[L4-PORT-JP] Prove single-writer port: JobPosition

[jason931225]

Lane L4-PORT-JP (phase P4). RE-SPECCED 2026-08-08 against the landed contract.

=== VERIFICATION BANNER — READ FIRST, ADDED BY THE SINGLE-WRITER APPLY PASS ===
This body was authored against console-p4-tai @ 19a01a1c5. The tip is now
30f8fd2a796c023d4c594c784dfce50e81559024, one commit later, and that commit touched
exactly the files this bead cites most: backend/ci/gates/writer-ownership/src/lib.rs
(+198), .../tests/gate_detects_violation.rs (+300), ops/postgres-reconcile-topology.sh
(+9). Corrected addresses at 30f8fd2a — ANCHOR BY SYMBOL NAME, the numbers are hints:
contract JobPosition key canonical-domain/src/lib.rs:120-122 (body says :118-122)
six-key lock canonical_contract.rs:39 thirteen_dispatch: :56
Report struct writer-ownership/src/lib.rs:180-182 (body says :156-160)
Report::unknown :195 Report::stale_exemptions :211
KNOWN_SECOND_WRITERS :241 EXCLUDED_DIRS :278
required_tables block topology :821-834, the 8 names :826-833 (unchanged)
REQUIRED_TABLES const census_executes_against_postgres.rs:72, still [&str; 8]
canonical_tables roster topology :794-818; job_positions :803,
job_position_revisions :804 (unchanged)
('console_rt','*') topology :1004 ('console_leave_definer','employees') :1007
gate_detects_violation.rs: dev_dependency_only_crates_are_excluded :1092
stale_ratchet_entries_fail_the_gate :1203 ratchet_entries_are_well_formed :1225
measured_tip_has_exactly_the_ratcheted_dual_writers :1256
topology_script_table_roster_matches_the_registry :1355
topology_script_names_the_roles_that_lose_dml :1375
marked_list() call sites: "table roster" :1356, "revoked roles" :1379,
"expected writers" :1396, "expected owners" :1480. Still NO "required tables" call —
the claim that required_tables is pinned by no Rust test SURVIVES the move.
NEW at 30f8fd2a and absent at 19a01a1c5: a fifth marked region "census statement"
(topology :975-1037) and a new test gate_roster_covers_every_object_key (:1514).
Neither is an append-point for this lane.

CORRECTION — ONE MEASUREMENT IN THIS BODY DOES NOT REPRODUCE, AND THE REASON MATTERS.
The body claims, twice, that
git grep -n -E "job_positions?\b" HEAD -- backend/ ops/ tools/ | grep -v canonical-domain
returns ZERO hits. IT DOES NOT, and it did not at 19a01a1c5 either. At both shas it
returns hits in five files under backend/crates/ontology/rest — BUCK mapped_srcs listing
tests/company_conformance/fixtures/job_position.rs, and the ObjectKey STRING
"job_position" in tests/company_conformance.rs:193 and :554. The stated command returned
empty for the author because \b is NOT supported in POSIX ERE, which is what git grep -E
uses: a trailing \b silently matches nothing. This is the SAME trap recorded in
console-e0v's method warning, hit independently in this lane, and it is now the third
occurrence in this program.

THE CONCLUSION SURVIVES; ONLY THE COMMAND CHANGES. Re-measured at 30f8fd2a with a
working regex:
git grep -n -E "job_positions\b" HEAD -- . | grep -v "canonical-domain|postgres-reconcile-topology"
-> ZERO. The plural TABLE NAME appears nowhere outside the contract and the pinned
topology roster.
DML census (INSERT/UPDATE/DELETE against job_positions or job_position_revisions,
anywhere in backend/) -> ZERO.
CREATE TABLE for either, over backend/crates/platform/db/migrations -> ZERO of 213.
The ontology/rest hits are the ontology METAMODEL's conformance fixtures for an instance
type named "job_position" — a different thing from the canonical job_positions table, and
they belong to no port lane. Read every "zero references" sentence below as "zero
references to the job_positions / job_position_revisions TABLES".
=== END BANNER ===

WHY THIS WAS RE-SPECCED. The prior text was generic lane boilerplate carried since
2026-08-07: "Objective: Prove single-writer port: JobPosition", depends_on ['L4-PORT-DES'],
tip_serial False, one Success line. It had no premise, no owned root and no acceptance
criteria — the same defect repaired for console-kyh and console-ivo today. Its one
substantive promise, "path-disjoint allowlist", is FALSE as written: four port lanes
(console-ivo, console-kyh, console-6pl, console-e0v) share ONE adapter crate, so
disjointness is a property of the module split inside that crate plus merge discipline on
shared registries, not of a per-lane crate.

THE CLOSURE QUESTION, SETTLED WITH EVIDENCE. A prior survey recommended closing this bead
as not-real-work; a later audit left it OPEN. The audit is right. From console-p4-tai @
30f8fd2a:

git grep -n -E "job_positions\b" HEAD -- . | grep -v "canonical-domain|postgres-reconcile-topology"
-> ZERO hits. The table name exists nowhere outside the contract declaration and the
pinned topology roster.
git grep -l -E "job_positions?" HEAD -- backend/crates/platform/db/migrations/
-> ZERO of 213 migration files.

So this lane is not "already done" — it is entirely un-started, and it is the ONLY one of
the six with no table, no writer and no migration at the tip. That is what made it look
closable. It is also load-bearing: 'job_positions' and 'job_position_revisions' are
ALREADY in the topology script's canonical_tables roster (:803-804), which
topology_script_table_roster_matches_the_registry pins ORDER-SENSITIVELY equal to
ObjectKey::owned_tables(). The database half therefore already CLAIMS to enforce two
tables that do not exist. Closing this bead freezes that claim as permanently vacuous, and
strands console-xxp (L5-JOB), which depends on it, on a closed blocker. Do not re-propose
closure without proposing it for all six {ivo, kyh, 6pl, e0v, kmb, 0hq}.

THE CONTRACT, backend/crates/ontology/canonical-domain/src/lib.rs:120-122 (doc comment at
:118-119):

/// Heads/revisions referencing OrgUnit. Recruiting postings and employee
/// position strings are not canonical positions.
JobPosition => "job_position",
    owner = "console-ontology-canonical-adapter-postgres",
    tables = ["job_positions", "job_position_revisions"];

The two exclusions in that doc comment name REAL EXISTING OBJECTS, measured, and they
define this lane's boundary:

• "Recruiting postings" = recruit_postings, migration 0187_create_recruiting.sql:15. Not
  a canonical position; not owned here.
• "employee position strings" = employees.position TEXT, migration
  0066_hr_core_employee_fields.sql:10, indexed at :51-52. Not a canonical position;
  employees belongs to Employment (console-kmb).
• "referencing OrgUnit" means job_positions carries an FK to org_units, a table only
  console-kyh creates. That is a MIGRATION-ORDER dependency, not merely a crate
  dependency.

Port trait: JobPositionPort (canonical_ports!). Dispatch targets bound to JobPosition:
organization.create_job_position (lib.rs:213) and organization.revise_job_position (:214).
ReceiptOwner::Canonical(ObjectKey::JobPosition) is already in the sized receipt roster.

OBJECTIVE. Create job_positions and job_position_revisions, implement JobPositionPort in
console-ontology-canonical-adapter-postgres, and make that crate the sole production writer
of both — proven by a RED-first negative test and by the executed database half, NOT by a
green static gate.

MEASURED CURRENT PRODUCTION WRITERS: NONE. ZERO. Measured, not inferred:

git grep -n -iE "(INSERT +INTO|UPDATE|DELETE +FROM) +["'`]?(job_positions|job_position_revisions)" HEAD -- backend/
-> no output.

Unlike Employment (a real orgchange writer) and PayRun (nineteen owner statements plus one
second writer), this lane's grep returns EMPTY before EXCLUDED_DIRS (target, tests,
migrations, benches, examples, .git) or the #[cfg(test)] Truth::Never rule is even applied.
Neither table appears in KNOWN_SECOND_WRITERS (exactly two entries: employees/console-app,
payroll_draft_runs/console-workflow-runtime-adapter-postgres).

CONSEQUENCE FOR ACCEPTANCE, and it is the whole reason this section exists:
cargo run -p console-gate-writer-ownership exits 0 for job_positions TODAY, with no port,
no module, no crate and no table. For this lane the green gate is MAXIMALLY uninformative —
more so than for any sibling, because it cannot distinguish the finished state from the
current state along any axis. Any criterion resting on the exit code alone is unfalsifiable.
Criteria 3 and 6 below are the ones with teeth.

OWNED ROOT (a module inside the shared crate, not a crate of its own):

• backend/crates/ontology/canonical-adapter-postgres/src/job_position.rs (+ its own tests/)
• backend/crates/platform/db/migrations/_create_job_positions.sql — number assigned at
  MERGE, not at authoring; the contiguity gate is the authority. Must merge AFTER
  console-kyh's org_units migration (FK).
• ops/postgres-reconcile-topology.sh — the required_tables block ONLY
• backend/ci/gates/writer-ownership/tests/census_executes_against_postgres.rs — the
  pinned REQUIRED_TABLES const ONLY
• tools/buck/gen_first_party.py — TEST_RESOURCE_REQUIREMENTS, the
  'console-ontology-canonical-adapter-postgres' key ONLY, and only after console-1qw.1
  lands

THE THREE SHARED APPEND-POINTS. This lane adds TWO new names at each of the first two —
unlike console-ivo, which adds one because organizations already exists.

1. ops/postgres-reconcile-topology.sh required_tables (marked region "required tables";
   the eight names today are organizations, employees and the six payroll tables). ADD
   BOTH 'job_positions' and 'job_position_revisions'. Neither is present. Order inside this
   shell array is NOT pinned by any Rust test — re-verified at 30f8fd2a:
   gate_detects_violation.rs calls marked_list() for "table roster", "revoked roles",
   "expected writers" and "expected owners", and for nothing else. required_tables is
   guarded ONLY by the executed census, which needs Docker. That is precisely why criterion
   6 must actually run rather than skip.
2. backend/ci/gates/writer-ownership/tests/census_executes_against_postgres.rs
   REQUIRED_TABLES. Bump the arity by TWO from whatever it is at merge ([&str; 8] ->
   [&str; 10] if this lane merges first). The array MUST stay in BYTE order: examined_set()
   ends in names.sort() and the pin is assert_eq! against the whole array. Correct
   placement is after "employees" and before "organizations", and "job_position_revisions"
   comes BEFORE "job_positions" — '_' (0x5F) sorts below 's' (0x73). Getting those two the
   intuitive way round is a red test.
3. tools/buck/gen_first_party.py TEST_RESOURCE_REQUIREMENTS. LEASED to console-1qw.1. Do
   not touch before it lands.

NOT AN APPEND-POINT. The canonical_tables roster (topology, marked region "table roster")
ALREADY contains 'job_positions' (:803) and 'job_position_revisions' (:804), in registry
order, as part of the full twenty. topology_script_table_roster_matches_the_registry
asserts it ORDER-SENSITIVELY equal to ObjectKey::owned_tables(). Re-adding either name
breaks the test. A diff touching that block is a failure, not progress.

MUST NOT CREATE / FORBIDDEN:

• backend/crates/ontology/adapter-postgres/** — THE ONE-WORD-AWAY TRAP, and the one most
  likely to catch this lane. That path is a real, populated crate whose Cargo.toml:2
  reads name = "console-ontology-adapter-postgres" — the ontology METAMODEL adapter, and
  the same crate whose tests/ hold the "job_position" conformance fixtures corrected in
  the banner above, which makes it doubly attractive and doubly wrong. The owner is
  "console-ontology-canonical-adapter-postgres", one hyphenated word longer, and it DOES
  NOT EXIST at 30f8fd2a (git ls-tree HEAD backend/crates/ontology/canonical-adapter-postgres/
  -> 0 entries; backend/crates/ontology/ holds five crates: adapter-postgres,
  application, canonical-domain, domain, rest). JobPosition DML placed in the near-name
  crate COMPILES and enforces nothing. Check Cargo.toml:2, never the directory name.
• a backend/crates/job_position or backend/crates/position crate. There is no per-object
  crate; the code is a MODULE in the shared adapter crate.
• the sibling modules company.rs / org_unit.rs / person.rs in that shared crate.
• backend/crates/ontology/canonical-domain/src/lib.rs — console-tai's owned root.
  ObjectKey is LOCKED at six by six_projected_stable_object_keys_verbatim
  (canonical-domain/src/canonical_contract.rs:39 — note the path is src/, not tests/),
  which pins the six key strings verbatim and then re-checks the length. A seventh key
  fails a test in another lane's root.
• touching recruit_postings, employees.position, or employee_lifecycle_events.{from,to}_position.
  The contract excludes them by name; folding them in is a different bead.
• touching backend/crates/ontology/rest/tests/company_conformance/** . Those fixtures
  name an ontology INSTANCE type "job_position"; they are not this lane's tables and
  changing them is scope creep with no gate signal.
• adding to KNOWN_SECOND_WRITERS. Its length is pinned twice
  (stale_ratchet_entries_fail_the_gate, measured_tip_has_exactly_the_ratcheted_dual_writers).
  It may only SHRINK, and this lane shrinks it by zero.
• removing ('console_rt','*') from the expected-writer ratchet. Its own comment reads
  "Deleted by the six port lanes" — it is ONE schema-wide ALTER DEFAULT PRIVILEGES grant,
  not per-table, and topology_script_names_the_roles_that_lose_dml pins the list by
  equality. It belongs to the LAST port lane to land.
• .github/workflows/ci.yml, third-party/rust/buckify.sh (console-1qw.1's lease).
• docs/current/** as authority; multi-tip; Grok model sol/claude; HOLD clearance by
  implication.

DEPENDENCY EDGES — checked against this lane, not assumed:

• console-1qw.2 [L4-ADAPTER-SKEL] — APPLIES, already wired. The owner crate does not
  exist. Four lanes share it, so its lib.rs must pre-declare pub mod job_position;
  (PUB — with bare mod this lane must come back and edit lib.rs, exactly the collision
  the skeleton exists to prevent) and its Cargo.toml must already carry the full
  dependency set. This lane adds NO dependency and NO module declaration of its own. The
  skeleton must also be a real dependency of something shipped, not dev-only:
  dev_dependency_only_crates_are_excluded means a dev-only crate is skipped entirely by
  the gate and produces the same green as a correct port.
• console-1qw.1 [L4-INT-LEASE] — APPLIES; EDGE ADDED BY THIS RE-SPEC.
  gen_first_party.py's validate_resource_metadata raises on BOTH missing and stale
  entries, and neither console-ontology-canonical-domain nor console-gate-writer-ownership
  has a TEST_RESOURCE_REQUIREMENTS entry or a BUCK file today, so
  tools/buck/generated-face-first-party.sh FAILS at the tip before this lane adds
  anything. Read the edge as "cannot be COMPLETE before the lease", not "cannot START":
  criteria 1-7 are runnable the moment the skeleton lands.
• console-kyh [L4-PORT-OU] — a MERGE-ORDER constraint the graph does not carry as an
  edge, and deliberately not added as one: "Heads/revisions referencing OrgUnit" means
  job_positions FKs org_units, which only console-kyh creates. Author concurrently; merge
  after. If the FK is deferred to console-xxp instead, say so in the PR rather than
  silently omitting it.
• console-tai [L4-PORT-DES] — already wired; the contract it produced is what this bead
  is specced against.

TIP-SERIAL: FALSE for authoring, serial at merge. The collision on append-points 1 and 2 is
a merge-time union of DISTINCT added lines inside delimited blocks, and merges are already
strictly serial on one tip (this lane's migration number is taken at merge). All six port
lanes may be authored concurrently. This lane merges after console-kyh (FK), and its census
arity is +2 from whatever it is at that moment.

Transport: .grok/bin/mm-role -> codex exec / claude -p.