Audit: roleless-but-sessionful paths vs genuine-Google gate

pmmaster fleet dispatch 2026-07-30: containment hypothesis 'role lookup catches everything' is RETIRED — §Auth deliberately admits a sessionful roleless user (genuine-Google login with no person row -> /solicitar-acceso). Role lookup cannot distinguish that from a self-minted email session; both present as valid-session+zero-roles. Only the identity check separates them, and a callback-only gate can miss it on exactly this class of path. Enumerate EVERY path that serves a session WITHOUT requiring a role and show whether genuine-Google is enforced on each, named per-path (no bare 'clean'). Starting candidate list (not complete): /solicitar-acceso submit (VENUS-281 already gates this - reverify), the / redirector reading session before role resolution, session-attributed appEvents writes, uploads, ticket creation. 'No roleless paths exist beyond X' is a fine answer if demonstrated. Same dispatch to mars/pluto.