Refuse an emailless identity where the session is minted, and rows the upstream should not have sent

e2e-tests/full-flow.spec.ts

@@ -194,10 +194,7 @@ test.describe.serial("authenticated admin journey", () => {
     await expect(page.locator("h1")).toHaveText("Shifts");
     await expect(page.locator("table")).toContainText("Morning — Front desk"); // seeded by the mock upstream
 
-    // The session-gated page scopes the upstream read by the visitor's identity id. The demo
-    // upstream's rows belong to three made-up people, so the admin's own page is empty — which is
-    // the assertion that matters: nobody else's shifts come back. (A matching row rendering is
-    // covered where it is exact, in the plugin's own unit test.)
+    // The admin owns none of the demo's rows, so an empty page is the no-leak assertion.
     await page.goto("/scheduling/mine");
     await expect(page.locator("h1")).toHaveText("My shifts");
     await expect(page.getByText("No shifts are assigned to admin@plainpages.local")).toBeVisible();

e2e-tests/visual.spec.ts

@@ -179,9 +179,8 @@ test("the reference plugin: public Overview is open to all, My shifts takes any
   await expect(page.locator('.sidebar a[href="/scheduling/shifts"]')).toHaveCount(0); // gated leaf filtered out
   await expect(page.locator('.sidebar a[href="/scheduling/mine"]')).toHaveCount(1); // session gate: a session is enough
 
-  // And the page itself renders for that same member, holding no permission at all. This stack runs
-  // no shifts upstream, so it also pins the degraded page: the reason, never a 500 and never a claim
-  // about what is assigned. The working page is asserted against a real upstream in full-flow.spec.
+  // No shifts upstream on this stack, so this also pins the degraded page: the reason, never a 500
+  // and never a claim about what is assigned.
   await page.goto("/scheduling/mine");
   await expect(page.getByRole("heading", { name: "My shifts" })).toBeVisible();
   await expect(page.getByText("Couldn't reach the scheduling service")).toBeVisible();