[Cenn0]

Scope

• Reject duplicate same-realm directory subject IDs at the domain admission boundary before a new grant is queued.
• Stop connector role writes (including ambiguous revocations) if multiple directory entries resolve to one principal ID.
• Convert duplicate, unknown-type, empty remote-ID, stale and disabled/protected identity states into explicit reconciliation drift findings. Reconciliation must not be marked clean; avoid guessed Keycloak Admin REST endpoints.
• Add C#/xUnit negative regressions and update the P4 roadmap and test matrix.

Security model and limitations

• Grants fail closed; ambiguous revocations deliberately do not guess which remote Keycloak identity to delete. Remediation requires a fresh authoritative mapping and an operator action.
• Drift detection alone does not revoke existing Keycloak mappings or access tokens.
• This PR does not resolve the upstream Keycloak FGAP Groups.manage privilege breadth (#46); group grants remain default-denied unless exactly allowlisted.
• No real Microsoft AD, multi-host HA, or security-release signoff is implied.

Verification

• Request exact-SHA GitHub Actions validation: core .NET xUnit/PostgreSQL/API, Keycloak/OIDC, worker/recovery, accessibility, documentation. Merge only if the applicable checks pass; review the CI output before asserting completion.