[daliu]

Outcome

Adds a safe, verification-only /auth/action source route. Opening the link—including a mail scanner opening it—does not check or apply the one-time code. A person must choose Verify email first.

• Captures one bounded web-safe code, scrubs the native URL and React Router location, and clears terminal capabilities.
• Requires Firebase provider operation VERIFY_EMAIL before one apply.
• Blocks a different or email-less signed-in account without displaying either address.
• Ignores query authority and continuation URLs; all output and recovery navigation are fixed.
• Suppresses Sentry and initial App Check while capability state is present.
• Fails closed on malformed percent/Unicode input, duplicate parameters, later same-route capabilities, history failure, wrong operations, and stale async results.
• Documents the existing SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 Pages tab-local handoff residual and the direct-rewrite alternative.

Safety boundary

This is verification-only source. Firebase uses one project-wide custom handler for verification, password reset, and email recovery. Do not configure this route as that global handler until every enabled mode is safely implemented, or retain Firebase's existing multi-mode handler. See the official Firebase custom-handler design.

Verification proves control of an email address only. It never grants membership, dues/payment status, discounts, roles, or officer access; it writes no Firestore data and calls no Function.

Verification

Exact source commit: 1eae2d14917406cd9ee5e05224c07ac47d1558ae
Exact staged diff SHA-256: 8d82d831b734ba75823fa70cb447b6b07b668ed3436f34949412963567000180

• focused Auth/action/App Check/Sentry/App route suites: 111/111
• complete frontend: 11 suites, 198/198
• SPA handoff: 11/11
• Functions lint; unit suites: 990 passed, 32 emulator-only skipped
• Firestore Rules emulator: 317/317
• commerce journal real emulator: 31/31
• release/workflow/artifact guards: 42/42
• lint baseline: 104 files, 125 existing errors, 7 existing warnings, zero new findings
• strict changed-source lint, diagnostic build, relative links, diff check, and sensitive-pattern scan: pass
• exact-diff security, test, and backup-officer reviews: approved

Officer handoff

Officer impact: Members get one plain, deliberate verification action. Officers never request, copy, open, or screenshot a member's private link, code, or email address.

Officer documentation: docs/officers/EMERGENCY_AND_RECOVERY.md, docs/officers/EVENTS_SHOP_MEMBERS.md, and docs/officers/SYSTEM_MAPS.md; system/security/operations status maps are updated too.

Deployment evidence: Source/tests/merge only at PR creation. No website publication, runmprc.com verification, Firebase deployment, custom-handler/template/sender/DNS change, mailbox test, member-data action, or live behavior is claimed. Protected production release remains separately blocked on #133/#136 provider and environment configuration.

Closes #194

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	1eae2d1
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a557ee1ddc9c10008d26845
😎 Deploy Preview	https://deploy-preview-195--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.