Why: refine the approved IAM scope into enforceable account, directory and recovery boundaries. Evidence: SELF document checks and independent document reviews; business tests and CI are NOT_RUN. Impact: proposed contract and implementation plan only; preserve the approved global plan and all runtime data. Refs: Dev feature/iam-u3-account-directory-recovery; IAM r1 U3 and IAM-D/IAM-C