MEMBERS-IDENTITY-001H: permit term evidence before account association

[daliu]

Corrects the provider-neutral membership contract so approved term evidence may safely exist before a website account, while website entitlement remains withheld until the exact account is explicitly associated.

Officer impact: No live officer workflow changes. The future manual-onboarding model now represents a paid/current membership before account creation without granting access; all officer steps remain SOURCE ONLY, UNUSED, and NOT AVAILABLE YET.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md — updated only the provider-neutral membership-authority future-state diagram, text alternative, review steps, proof, and undo guidance. SYSTEM_DESIGN.md §8.0a carries the matching engineering contract.

Deployment evidence: Source commit 2c528b120489e1a13acd5bb07a846d09429ccc0e and local synthetic checks only. Website publication: not performed. runmprc.com: not verified or changed. Firebase: not deployed or changed. Outside providers: not configured or contacted. Migration/production data: none. Production behavior: not verified or changed. A preview or green workflow will not prove any of those surfaces live.

Closes #451
Advances #81, #114, and #115; those parent trackers remain open.

Invariant and result

• Membership evidence and account identity remain independent prerequisites.
• create -> associate -> term remains valid and unchanged.
• create -> term(s) -> associate is now valid; the one-time association preserves the latest term.
• Every unlinked record returns not_entitled, even with approved/current evidence.
• Only the exact linked UID plus an approved term inside its explicit half-open range returns current_member.
• Pending, future, expired, suspended, ended, wrong-UID, malformed, stale, skipped, replay-conflicting, second-UID, and overflow cases remain fail-closed.

The implementation changes only three ordering guards in membershipAuthority.js. Schema version 1, record/command/result shapes, revision arithmetic, strict input validation, exact-latest retry semantics, one-time UID association, and entitlement logic are unchanged.

RED and compatibility

Before the source change, the new term-first test failed at the first valid revision-1 record_term_decision with MembershipAuthorityError. After the three-guard correction, both orderings and all sibling composition seams pass.

No migration or backfill is needed: the authority module remains unused, is not imported by functions/index.js, and has no persisted snapshots. Existing link-first snapshots stay valid. Future trusted runtime work must still transactionally bind the selected membership document, term receipt, command, and audit; this PR does not supply persistence or global replay/UID uniqueness.

Test evidence

• Focused authority + six composition suites: 7 suites, 768/768 tests passed.
• Full Functions: lint passed; 65/67 suites passed with 2 intentional skips; 6,231 passed and 64 intentional skips.
• Frontend: 14/14 suites, 727/727 tests passed.
• Firestore Rules emulator: 4/4 suites, 378/378 tests passed on demo project.
• Commerce command journal emulator: 63/63 tests passed on demo-pay002b2-test with Firestore only.
• SPA callback suite: 11/11 passed.
• Workflow/release/Firebase-readback/artifact/dependency suite: 54/54 passed.
• Frontend lint baseline: exact 111 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.
• Functions focused/full lint, production build, workflow YAML parsing, git diff --check, runtime-import scan, and clean tracked status passed.

Review

Root self-review covered authorization, entitlement ordering, App/Functions boundaries, PII/secrets/logging, idempotency, revision overflow, impossible state transitions, compatibility, migration, and deployment overclaim.

Three independent adversarial reviews covered state-machine reachability, security/reliability, and officer documentation/tests. Review findings were fixed and re-reviewed clean:

• diagrams now evaluate the exact account link before term status, matching the reducer's association-first entitlement result;
• an adjacent out-of-scope §8.0b wording edit was reverted; and
• the association seam treats duesConfirmed as independent trusted evidence, never as something inferred from an approved authority term.

Explicit exclusions

No emitter/runtime module, Function export, endpoint, Firestore schema/Rules, durable journal, cross-record UID index, Auth claim/token action, payment/provider verification, price/calendar/plan/refund policy, UI, package/workflow, migration, deployment, provider configuration, production data, or live behavior changes.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	2c528b1
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a60b9c3e3785800088e2d8d
😎 Deploy Preview	https://deploy-preview-452--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

SELF-REVIEW COMPLETE — no unresolved findings. I compared the GitHub patch byte-for-byte with exact local commit 2c528b1, reviewed all ten changed paths against #451, and rechecked the authority/revision/idempotency/entitlement, hostile-input, PII/logging, compatibility/migration, runtime-import, officer-continuity, and deployment-evidence boundaries. Three independent adversarial reviews covered state-machine, security/reliability, and docs/tests; all findings were fixed and re-reviewed clean. Hosted CI run 29920446311 passed every step of all five blocking jobs on this exact head. Netlify produced a PR preview only; no website/Firebase/provider/production change is claimed.