[daliu]

Closes #127.

Outcome

Remove the unused direct gpxparser dependency and only the lockfile entries that become unreachable. The tested website behavior and optimized production asset hashes are unchanged.

Officer impact: No member or officer workflow changes. Officers should see the same pages and navigation; the website build has a smaller production dependency graph.

Officer documentation: None — this dependency/lockfile cleanup changes no public content, navigation, collected data, permissions, accounts, payments, deployment duties, recovery procedure, or officer workflow.

Deployment evidence: PR head c747564ab6ad2695e768a15d8b24a94d7cab8941 passed run 29235020205 and merged as 91f834dc7e33eb36b34f520544f9fd7d00810d8e. Post-merge run 29235228183 passed frontend Jest 47/47, build, Functions, and Rules. Deploy run 29235228098 rebuilt/published the byte-identical GitHub Pages artifact and correctly found nothing new to commit. Netlify production deploy 6a54a055f0b97c000829980a is ready for the exact merge commit; its immutable response and runmprc.com both return HTTP 200 with identical index hashes/assets. Firebase explicitly skipped because FIREBASE_SERVICE_ACCOUNT is absent; outside providers were unchanged.

Invariant and compatibility

• Before: the root manifest declares unused gpxparser@3.0.8, which pulls an obsolete jsdom@15/request/form-data chain.
• After: gpxparser is absent; no replacement dependency is added.
• No application, callback, member, payment, Firebase, Functions, Rules, workflow, provider, or public-asset source changes.
• No schema, data, environment, or officer migration is needed. Reverting this commit restores the previous manifest and lockfile.
• Installation failure, a retained package identity change, a test failure, or any bundle-hash change is a stop condition.

Lockfile and security evidence

• Fresh Node 20.20.2 npm ci --legacy-peer-deps installs 2,155 packages successfully.
• npm ls gpxparser --all returns the expected empty tree.
• Exactly 50 lock entries are removed and zero are added.
• Dependency reachability proves those exact 50 entries become unreachable: zero removed-but-reachable and zero unreachable-but-retained.
• No retained package version, resolved, or integrity field changes. Shared entries only become development-only after the obsolete production path disappears.
• Root npm audit --omit=dev: 33 → 22 total; critical 3 → 1; high 9 → 8; moderate 20 → 12; low remains 1. Production dependencies fall from 686 → 590.
• The unchanged Functions audit remains 9 total: 1 high and 8 moderate.
• Remaining root and Functions advisories stay open for the separately tested router, Firebase, Stripe, build-system, and continuous-scanning slices. No audit fix or forced upgrade was run.

Verification

• CI=true npm test -- --runInBand — 4 suites, 47/47 tests passed.
• npm run test:spa-navigation — 10/10 tests passed.
• CI=true DISABLE_ESLINT_PLUGIN=true npx --no-install react-scripts build — compiled successfully.
• Optimized asset names match the pre-removal baseline exactly, including main.58ede287.js, main.cdd8bda4.css, and 962.0a706e83.chunk.js; all other emitted content-hash names also match.
• git diff --check — passed.
• Source search — no gpxparser import or use outside the removed manifest entry and tracking/security records.

Review and release

• Two independent read-only reviews APPROVED exact commit c747564ab6ad2695e768a15d8b24a94d7cab8941 with no blockers. One independently reproduced the lock reachability and audit delta; the other also confirmed the pre/post build directories are byte-identical.
• Exact-head hosted pull-request run 29235020205 passed frontend Jest 47/47, frontend build, Functions, and Rules; the Netlify preview is ready and returns HTTP 200 with the unchanged asset hashes.
• Exact post-merge run 29235228183 passed frontend Jest 47/47, frontend build, Functions, and Rules.
• Deploy run 29235228098 passed. GitHub Pages generated no new commit because the artifact is identical; Netlify deploy 6a54a055f0b97c000829980a is ready at exact merge commit 91f834dc7e33eb36b34f520544f9fd7d00810d8e; its immutable URL and runmprc.com return matching HTTP-200 content.
• Firebase did not deploy because FIREBASE_SERVICE_ACCOUNT was absent. Provider configuration remained unchanged.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	c747564
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a549f7d3d59c500080f060c
😎 Deploy Preview	https://deploy-preview-130--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

INDEPENDENT EXACT-COMMIT REVIEWS — c747564ab6ad2695e768a15d8b24a94d7cab8941

• /root/live_queue_audit: APPROVE. Independently confirmed the five-file scope, exact 50-entry reachability removal, zero retained package identity changes, no runtime use, and the 33→22 production-audit delta.
• /root/membership_model_audit: APPROVE. Independently confirmed scope/security/officer-documentation truth, root and Functions audit counts, 47/47 frontend plus 10/10 SPA tests, and byte-identical pre/post build directories.

No review blocker remains. Merge is still blocked on the exact pull-request hosted checks and release evidence.

[daliu]

EXACT-HEAD HOSTED EVIDENCE — c747564ab6ad2695e768a15d8b24a94d7cab8941

• GitHub Actions run 29235020205: frontend job passed, including the named Jest step at 47/47 and the optimized build; Functions and Firestore Rules jobs also passed.
• Netlify deploy preview: ready, HTTP 200, x-robots-tag: noindex, and the unchanged main.58ede287.js / main.cdd8bda4.css assets are referenced.
• All required PR checks are complete. Header/page-change checks are neutral because this dependency-only PR does not alter those surfaces; redirect validation passed.
• Two independent exact-commit reviews approved with no blockers.

Merge remains the next controlled transition. Post-merge CI, GitHub Pages, production Netlify, runmprc.com, and explicit Firebase/provider non-deployment evidence remain required before #127 closes.