MEMBERS-IDENTITY-001F: define provider-link lifecycle reconciliation

[daliu]

Outcome: define and exhaustively test one unused, provider-neutral lifecycle contract for ordered link, unlink, relink, uncertain outcomes, collision evidence, and safe provider-account replacement.

Closes #445.
Parent #81 remains open; this is one source-only dependency-clearing child.

Officer impact: None yet. Signup, membership, discounts, email/password, Google, WhatsApp, Strava, officer screens, provider accounts, and live website behavior remain unchanged.

Officer documentation: SYSTEM_DESIGN.md; docs/officers/EVENTS_SHOP_MEMBERS.md

Deployment evidence: Source commit e11e44aeb2d70524e83ba1562acfeed17348c354 and local Node 20.19.5 / Java 17 qualification are verified below. Website publication: not performed. runmprc.com verification: not performed. Firebase deployment/readback: not performed. Outside-provider configuration: not performed. Production data or migration: not performed. Production behavior: not verified. A green workflow will prove source/tests only.

Contract and invariants

• The pure CommonJS reducer composes the merged MEMBERS-IDENTITY-001C — Provider-neutral external-account link + collision contract (source only, unused) #367 classifier; it does not duplicate consent, collision, or desired/observed drift policy.
• Creation requests unlinked but records provider observation as unknown; no external fact is invented.
• Every record and verdict hard-codes grantsAuthority: false.
• Commands use optimistic record revision plus exact next per-account reconciliation sequence.
• Reconciliation evidence pins the provider-account reference and desired state, closing stale/out-of-order link and unlink results.
• Success records only the requested known state; definitive failure preserves the last known observation; outcome-unknown preserves intent and invalidates observation.
• Reversing unresolved intent invalidates observation, so an in-flight action cannot make the record look aligned or replaceable.
• Provider-account replacement requires desired and observed unlinked, clears binding, and resets per-account observation/reconciliation.
• Exact latest retry is read-only. The reducer recomputes canonical SHA-256 over command type and every safe payload field; changed type/payload, changed expected revision, stale revision, and conflicting ID reuse fail.
• Purpose-specific typed references and fixed enums exclude raw email, phone, name, URL, provider error, and token values.
• Inputs are exact plain data objects; proxies, accessors, inherited/symbol/non-enumerable/extra/missing fields, malformed snapshots, and safe-integer overflow fail through one frozen non-echoing error.
• Outputs and nested records are frozen.

Failure and migration impact

• No runtime or Functions index imports the module.
• No endpoint, UI, Auth/custom claim, Firestore schema/Rules/index, provider call, package, workflow, configuration, migration, deployment, log, or production record changes.
• There is no data migration or compatibility impact because the contract is unused.
• Durable all-history replay protection, cross-record uniqueness, command authorization, persistence, consent receipts, retention/deletion/SLA, legacy migration, provider wiring, and live qualification remain future reviewed work under MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81 and its canonical dependencies.

Verification

RED:

• Focused suite initially failed because membershipProviderLinkLifecycle.js did not exist.

GREEN on Node 20.19.5:

• Focused lifecycle suite: 62/62.
• Full Functions Jest: 6,119 passed; 64 skipped; 64/66 suites passed with 2 intentionally skipped.
• Functions ESLint: passed.
• Frontend lint baseline: 111 files; 117 reviewed legacy errors; 6 reviewed legacy warnings; no mutation.
• Frontend Jest: 727/727.
• SPA callback safety: 11/11.
• Workflow/release/artifact/dependency safety: 54/54.
• Firestore Rules emulator on demo-rules-test: 378/378.
• Commerce journal concurrency emulator on demo-pay002b2-test: 63/63.
• Production diagnostic build: compiled successfully.
• YAML validation and git diff --check: passed.

Self-review

Three independent adversarial reviews covered state ordering/idempotency, security/privacy, and officer/acceptance documentation. Review-found blockers—unverified caller hashes, raw value-shaped references, unresolved-intent reversal, revision-1 forgery, and inaccurate diagrams/wording—were fixed and re-reviewed. Final result: no actionable findings.

Security review covered authorization, input bounds, PII/secrets, canonical digest verification, impossible state transitions, retries, uncertainty, replacement, source isolation, and production fallback.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e11e44a
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a60a1739d5d1400086ac4af
😎 Deploy Preview	https://deploy-preview-446--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Self-review completed against exact head e11e44a. No actionable findings remain. Reviewed the four-path diff for authority leakage, strict input bounds, PII/secrets/raw provider evidence, canonical digest verification, revision/sequence ordering, duplicate and out-of-order results, uncertain outcomes, provider-account replacement, immutable outputs, source isolation, migration impact, officer continuity, and deployment-state accuracy. Three independent adversarial passes were also clean after fixes. Awaiting all hosted checks before merge.