Fail-closed wildcard rollout parsing

General lesson: when extending a UUID allowlist with a global wildcard, treat the wildcard as a sole, exact sentinel after trimming rather than as another CSV token. Accept only *; keep *,uuid, uuid,*, empty entries, uppercase UUIDs, and malformed input fail-closed. Apply the sentinel only after existing authorization, authoritative-entity, and feature-selection guards, so “all” widens the intended cohort without bypassing identity validation or enabling unrelated execution paths. Test exact wildcard enablement, null authoritative identity, mixed-token rejection, and isolation of non-selected/local paths.

Applicability and limits: this pattern fits operator-controlled server configuration where malformed rollout input should disable behavior. It may not fit user-facing ACLs or systems that require explicit configuration errors instead of fail-closed disablement.

Evidence/example — 2026-09-16: a server-owned organization UUID rollout was extended locally with this pattern; focused parser/resolution and page-propagation tests passed, as did type checking, linting, and environment-contract checks. No production activation or deployment was performed.