daliu · Jul 14, 2026 · Jul 14, 2026 · Jul 14, 2026 · Jul 14, 2026 · Jul 14, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -16,6 +16,8 @@ Published foundation mapping:
 - CI-001A → [#103](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/103)
 - CI-001B1 → [#124](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/124)
 - SUPPLY-001A → [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127)
+- SUPPLY-001B → [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192)
+- SUPPLY-001C → [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202)
 - ARCH-001 documentation → [#104](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/104)
 - CI-001 tracker → [#105](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/105)
 - PAY-003 tracker → [#106](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/106)
@@ -52,7 +54,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | ---: | --- | --- | --- | --- | --- | --- |
 | 1 | SAFETY-001 | Preserve commerce/OAuth callbacks and isolate local Firebase Functions | P0 | S | source/test complete under #99; provider/live callback unproven | — |
 | 2 | CI-001 | Repair test gates and secure the deployment pipeline | P0 | L | partial: #103 baseline + #124 hosted Jest; #126 SPA gate and remaining gates open | SAFETY-001 |
-| 3 | SUPPLY-001 | Remove vulnerable dependency chains and stage SDK/build upgrades | P0 | L | partial: SUPPLY-001A tracked by #127; remaining upgrade/scanning slices open | CI-001 baseline |
+| 3 | SUPPLY-001 | Remove vulnerable dependency chains and stage SDK/build upgrades | P0 | L | partial: A/#127 and B/#192 delivered; C source/tests tracked by #202; D–G open | CI-001 baseline |
 | 4 | SEC-001 | Replace the Firestore admin catch-all with resource-specific rules | P0 | M | source merged #123; Firebase live unproven | — |
 | 5 | CONFIG-001 | Fail closed on server environment and commerce configuration | P0 | M | CONFIG-001A merged in #149/PR #150; CONFIG-001B1 tracked in [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151); B2 blocked; not deployed | CI-001A recommended |
 | 6 | AUTH-001 | Require verified email for member and privileged claims | P0 | M | partial: #98 merged; Rules slice tracked in #196; Firebase live unproven; parent open | SEC-001 recommended |
@@ -186,20 +188,20 @@ Repository changes can implement tests/workflow shape, but OIDC/IAM/environment
 ## SUPPLY-001 — Remove vulnerable dependency chains and stage SDK/build upgrades
 
 **Labels:** `priority:P0`, `type:maintenance`, `type:security`, `area:web`, `area:firebase`, `area:stripe`, `size:L`
-**Status:** Partial; SUPPLY-001A is represented by [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127), SUPPLY-001B is represented by [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192), and the remaining upgrade/scanning slices stay open
+**Status:** Partial; SUPPLY-001A is represented by [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127), SUPPLY-001B by [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192), and SUPPLY-001C source/tests by [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202); D–G remain open
 **Depends on:** CI-001A
 
 ### Problem
 
-The 2026-07-12 baseline production audit reported 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). SUPPLY-001A/#127 removes the unused `gpxparser` and obsolete `jsdom/request/form-data` chain; on a fresh Node 20 install, the root production audit falls to 22 advisories (1 critical, 8 high) while production bundle hashes remain identical. SUPPLY-001B/#192 pins the compatible React Router 6.30.4 graph and removes all three router findings, reducing that root audit to 19 advisories (1 critical, 5 high). The Firebase client still needs a tested patch, Firebase Admin needs a staged major upgrade, and Create React App remains unmaintained.
+The 2026-07-12 baseline production audit reported 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). SUPPLY-001A/#127 removes the unused `gpxparser` and obsolete `jsdom/request/form-data` chain; on a fresh Node 20 install, the root production audit falls to 22 advisories (1 critical, 8 high) while production bundle hashes remain identical. SUPPLY-001B/#192 pins the compatible React Router 6.30.4 graph and removes all three router findings, reducing that root audit to 19 advisories (1 critical, 5 high). SUPPLY-001C/#202 pins the last Firebase 11 compatibility release and its matching Rules helper; its fresh production audit reports 6 advisories (0 critical, 3 high). Firebase Admin still needs a staged major upgrade, Create React App remains unmaintained, and scanning/policy automation remains open.
 
 ### Scope
 
 Deliver as small ordered PRs:
 
 1. [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127): prove `gpxparser` is unused, remove it, refresh only its lockfile graph, and retest route behavior.
 2. [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192): pin `react-router-dom` to 6.30.4 with `react-router` 6.30.4 and `@remix-run/router` 1.23.3; enable and test the two declarative-router future flags without changing the route tree.
-3. Upgrade Firebase web SDK within compatibility, then evaluate/stage the next supported major.
+3. [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202): pin the Firebase browser SDK to 11.10.0 and `@firebase/rules-unit-testing` to 4.0.1; keep the application on one compatibility boundary and repair only the Node 20 Rules harness needed to prove it.
 4. Upgrade Firebase Admin/Functions with emulator and Auth/Firestore trigger tests.
 5. Upgrade Stripe SDK and deliberately select/test the Stripe API version.
 6. Plan and execute CRA migration to a maintained build tool without mixing payment behavior changes.
@@ -221,10 +223,11 @@ Deliver as small ordered PRs:
 - Bundle/dependency diff and SBOM artifact.
 - SUPPLY-001A/#127: source search finds no runtime use; a fresh Node 20 lockfile install contains no `gpxparser`; 50 entries are removed with no retained package identity change; the root production audit changes from 33 to 22; all 47 frontend and 10 standalone SPA tests pass; and optimized JS/CSS asset hashes match the baseline exactly.
 - SUPPLY-001B/#192: the root declaration and only the three router package records change; a fresh Node 20 production audit changes from 22 findings (1 critical, 8 high, 12 moderate, 1 low) to 19 (1 critical, 5 high, 12 moderate, 1 low), with no remaining router entry. A fail-before/pass-after test covers the compatibility warnings; the focused suite also covers double-slash normalization, wildcard-to-home navigation, login return-path handling, account routing, and the 10-test standalone callback boundary.
+- SUPPLY-001C/#202: exact Firebase 11.10.0 and Rules helper 4.0.1 resolve the root production `protobufjs` path to 7.6.5 and remove Firebase's root `undici` path. The fresh production audit changes from 19 findings (1 critical, 5 high, 12 moderate, 1 low) to 6 (0 critical, 3 high, 2 moderate, 1 low). A red test proves the upgraded Rules helper cannot discover the emulator in the old Jest sandbox; the Node 20 native-web-API environment makes all 348 Rules cases pass. Focused Firebase/Auth/App Check tests pass 71/71, the frontend passes 198/198, Functions pass 1,077/1,077 applicable unit tests, and the callback and release-safety suites pass. Reproducible clean builds change the optimized main bundle from `main.fdd058b4.js` to `main.56edbdb7.js`: +8.29 kB gzip (about 3.3%) and +180 KiB on disk overall (about 1.0%). A dev-only older `protobufjs` remains nested under `firebase-tools`; the remaining six root and nine Functions production findings are still open.
 
 ### Agent handoff
 
-Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. SUPPLY-001A is represented by #127 and SUPPLY-001B by #192; do not publish duplicates. Stop if a major provider SDK change needs a product/runtime decision.
+Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. SUPPLY-001A, B, and C are represented by #127, #192, and #202; do not publish duplicates. #202 is source/test evidence only: it does not publish the website, deploy Firebase, change provider settings, or prove live behavior. Stop if a later provider SDK change needs a product/runtime decision.
 
 ---
 

diff --git a/GITHUB_ISSUE_SLICES.md b/GITHUB_ISSUE_SLICES.md
@@ -24,7 +24,7 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | CI-001B4 | merged/closed through [#186](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/186) / [PR #189](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/189) as `bec7d5e365eacb418563a172029f241f660d9768`; CI-001B1 | Replace the mutating fail-open frontend lint line with a named blocking JS/JSX/TS/TSX gate over 102 files. Disable the repository-wide severity-masking hook inside the lint process and baseline all 125 configured errors plus 7 warnings as reviewable individual records. Any added, removed, moved, or changed record and every fatal parser/configuration failure rejects with a fixed diagnostic; lint may not rewrite tracked files or create non-ignored untracked files. | Exact PR run `29291402007` and post-merge run `29291515653` passed lifecycle-disabled install, direct lint, clean proof, tests, and build. Ignored dependency/build paths remain outside this proof, with no clean-lint, branch-protection, deployment, website, Firebase, or provider claim. |
 | SUPPLY-001A | published as [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127); CI-001A | Prove `gpxparser` unused and remove its obsolete transitive chain. | `rg`/tree proof, before/after audits, root lockfile diff, full frontend checks. |
 | SUPPLY-001B | source/test delivery tracked in [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192); CI-001A | Pin React Router DOM/Router 6.30.4 and `@remix-run/router` 1.23.3; opt the declarative routers into `v7_startTransition` and `v7_relativeSplatPath` without a route redesign. | Exact three-node lock diff; Node 20 production audit 22→19 and high 8→5 with no router finding; focused route/future-flag tests, standalone callback suite, full CI, and build. |
-| SUPPLY-001C | proposed; CI-001A | Upgrade Firebase web SDK within one compatibility boundary. | Auth/Firestore/Functions/App Check/emulator tests and bundle/audit diff. |
+| SUPPLY-001C | source/tests tracked in live [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202); CI-001A | Pin the Firebase browser SDK to 11.10.0 and its Rules test helper to 4.0.1; bridge Node 20's native web APIs into the isolated Jest Rules environment without changing application behavior or provider settings. | Root production audit 19→6, critical 1→0, and high 5→3; focused Firebase/Auth/App Check tests, full frontend/Functions/Rules suites, standalone callback and safety suites, diagnostic build, dependency tree, and bundle comparison. Website publication, Firebase deployment, provider configuration, and live behavior remain unproven. |
 | SUPPLY-001D | proposed; CI-001A | Upgrade Firebase Admin/Functions in one supported set. | Node 20 lint/unit/emulator/trigger tests and deploy compatibility notes. |
 | SUPPLY-001E | proposed; PAY-003C | Upgrade Stripe SDK and deliberately select/test an API version. | Signed fixture/test-mode diff and rollback notes; no live endpoint change. |
 | SUPPLY-001F | proposed; CI-001B2, A–C | Replace CRA while preserving env handling, SPA callbacks, sitemap/SEO, code splitting, and deploy output. | Full CI, bundle/SEO comparison, staging dry run. |

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -298,6 +298,12 @@ npm --prefix functions audit --omit=dev
 
 Do not run `npm audit fix --force` blindly. Review reachability, upgrade direct dependencies deliberately, inspect lockfile changes, and rerun all checks.
 
+SUPPLY-001C [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202) is the source/test record for the Firebase browser compatibility upgrade. It pins Firebase 11.10.0 and `@firebase/rules-unit-testing` 4.0.1. A clean Node 20 production audit changes from 19 findings (1 critical, 5 high) to 6 (0 critical, 3 high). The remaining findings are not accepted as safe; a dev-only older `protobufjs` also remains under `firebase-tools` and must not be mistaken for the repaired browser path.
+
+The upgraded Rules helper fails before rule evaluation if Jest does not receive Node 20's native `fetch`, `Headers`, `Request`, `Response`, and `FormData`. The repository's dedicated Rules environment exposes those host APIs and no provider credential. The proof is 348/348 Rules cases, 71/71 focused Firebase/Auth/App Check tests, 198/198 frontend tests, 1,077/1,077 applicable Functions unit tests, 11/11 standalone callback cases, and 42/42 workflow/release safety cases. Reproducible clean builds change the optimized main JavaScript from `main.fdd058b4.js` to `main.56edbdb7.js`, +8.29 kB gzip (about 3.3%); total build output grows 180 KiB (about 1.0%).
+
+This is source and synthetic test evidence only. It does not publish the website, deploy Firebase, change an outside provider, or prove production behavior. Use the protected release process and record each affected surface separately before making any live claim.
+
 ### Target payment integration suite
 
 CI/staging must eventually include:

diff --git a/SECURITY.md b/SECURITY.md
@@ -112,6 +112,7 @@ These entries are implementation evidence, not a production risk-acceptance deci
 | RISK-013 | PROMO-001 [#102](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/102) sets both current Checkout creators to promotion entry off and automatic tax off. Exact payload and signed event tests require an explicit all-zero breakdown; malformed or nonzero discount, tax, or shipping data creates durable review evidence while definitive failed/expired Sessions still cancel. | Privately inventory pre-change Sessions/provider promotion settings, keep the guard through protected staging/deploy, verify provider and live state separately, and implement an approved authoritative discount/tax/shipping contract before ever enabling it. |
 | Part of RISK-014 | SUPPLY-001A [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127) removes the unused direct `gpxparser` dependency and 50 lockfile entries without changing any retained package version, source URL, or integrity hash. A fresh Node 20 install lowers the root production audit from 33 findings (3 critical, 9 high) to 22 (1 critical, 8 high), and the optimized production asset hashes remain identical. | #192 completes the separately tested router patch. Remediate or time-bound the remaining root and Functions findings through the Firebase, Stripe, build-system, and scanning slices; do not use a forced audit upgrade. |
 | Part of RISK-014 | SUPPLY-001B [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192) pins `react-router-dom` and `react-router` 6.30.4 with `@remix-run/router` 1.23.3. The only lockfile identity changes are those three nodes. A fresh Node 20 production audit removes all three router findings and lowers the root total from 22 to 19 and high findings from 8 to 5. The declarative router opts into `v7_startTransition` and `v7_relativeSplatPath`; focused tests cover warning removal, double-slash normalization, wildcard navigation, login/account harnesses, and the standalone callback boundary. | The remaining 19 root and 9 Functions production findings are not accepted as safe or fixed. Patch Firebase in separate compatibility slices, replace the unmaintained build chain, and add continuous scanning. Source/tests/merge do not prove website publication or live route behavior. |
+| Part of RISK-014 | SUPPLY-001C [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202) pins the Firebase browser SDK to 11.10.0 and its Rules helper to 4.0.1. A fresh Node 20 production audit falls from 19 findings (1 critical, 5 high) to 6 (0 critical, 3 high); the root production `protobufjs` path resolves to 7.6.5 and Firebase's root `undici` path is removed. The upgraded Rules helper first failed closed because Jest lacked `fetch`; a dedicated Node 20 environment exposes only the host's native web APIs, after which 348/348 Rules cases pass. Focused Firebase/Auth/App Check tests pass 71/71, the full frontend passes 198/198, and applicable Functions units pass 1,077/1,077. | The remaining 6 root and 9 Functions production findings are not accepted as safe. An older dev-only `protobufjs` remains nested under `firebase-tools`; the build chain still accounts for the root findings. Reproducible clean builds change the main optimized bundle from `main.fdd058b4.js` to `main.56edbdb7.js`, +8.29 kB gzip (about 3.3%); overall build output grows 180 KiB (about 1.0%). Complete SUPPLY-001D/F/G through separate reviewable changes. This source/test result does not publish the website, deploy Firebase, change a provider, or prove live behavior. |
 | Part of RISK-024 | SEC-001 protects token documents from every browser client. | OAUTH-001 must still add transactional refresh/versioning, scope/account binding, disconnect/revocation, IAM/encryption decision, and redacted lifecycle audit. |
 | Part of RISK-027 | #99 blocks App Check, Firebase Analytics, and Sentry in local/test and on initial capability-callback startup. OBS-001A1 [#134](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/134) source disables Sentry replay, tracing, browser session tracking, client reports, member user context, breadcrumbs, attachments, transactions, and unapproved default integrations. OBS-001A2 [#139](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/139) source removes every application runtime Firebase Analytics import, initialization, and emission, preserves existing wrapper calls as provider-free no-ops, and removes the direct Waiver SDK bypass. OBS-001A3 [#142](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/142) source routes the remaining render, Auth-email, members-only, and App Check browser diagnostics through five fixed outcome identifiers and prohibits direct console calls elsewhere in application/public runtime source. Synthetic tests use mocks/canaries and make no provider call. | #110/#111 still own any future approved telemetry purpose, consent, event/parameter schema, provider settings, and residual hosted boundary. Source/tests and merge evidence do not prove website publication, the exact `runmprc.com` revision, provider transport/collection, IP/cookie behavior, console history, historical data deletion, retention, access, consent, deletion, or vendor terms. Sentry provider behavior is likewise unverified. Callback protected handoffs remain with ABUSE-001A, DATA-001A, and OAUTH-001C in #88. |
 | Part of RISK-035 | The Jest environment is repaired, #124 adds the complete frontend suite as a named blocking hosted step, and #126 adds the standalone SPA callback suite. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) merged the lockfile-bound Node 20/Java 17 `Commerce command journal emulator` job using exact demo project `demo-pay002b2-test`, Firestore only, and explicit opt-in. CI-001B4 [#186](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/186) merged through [PR #189](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/189) as `bec7d5e365eacb418563a172029f241f660d9768`, adding the no-new-dependency exact-record checker over 102 frontend files, named blocking lint step, and clean-checkout step. Exact PR run `29291402007` and post-merge run `29291515653` passed every GitHub job. | The reviewable lint baseline deliberately records 125 configured errors and 7 warnings as individual file/line/column/rule/message records; it is not a clean-lint claim. Any added, removed, moved, or changed record requires review, every fatal parser/configuration failure rejects with a fixed diagnostic, and the baseline must not be regenerated just to pass. The clean check covers tracked and non-ignored untracked files; ignored dependency/build outputs are outside this proof. Hosted source checks do not configure branch protection, deploy Firebase, or prove Stripe/live behavior. #169, #173, and #182 expand the focused commerce suite; configure/prove branch-required checks and add the broader TEST-001 suite. |