[daliu]

Defines and exhaustively tests the provider-neutral membership-authority boundary needed before account-linked membership can be designed. This is pure, unused source; it changes no member or officer behavior.

Officer impact: None yet — membership activation, annual renewal, discounts, account access, roles, roster work, and outside channels remain unchanged and NOT AVAILABLE YET through this contract.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md — adds the source-only future-state map, plain-language review procedure, stop conditions, proof, undo, and escalation.

Deployment evidence:

• Source changed: exact reviewed commit aee505c on base 1730977.
• Tests passed: yes; see verification below.
• Code merged: no — pending this pull request.
• Website published: no change and not attempted.
• runmprc.com verified: no website change to verify.
• Firebase deployed/read back: no change and not attempted.
• Outside provider configured: no change and not attempted.
• Production data or migration: none.
• Live behavior verified: no live behavior exists from this unused module.

Contract boundary

• Keeps a stable club membership separate from a Firebase account and from email, Google, WhatsApp, Strava, roles, payments, and browser fields.
• An unlinked membership is valid but never entitled.
• One explicit account association plus an approved term inside a half-open time range yields only a fixed, non-identifying result.
• Strict exact-object validation, frozen snapshots/results, generic errors, revision ordering, immediate retry protection, and safe-integer exhaustion fail closed.
• The module has no runtime/index import, Firebase/Stripe/provider SDK, clock, environment, random, log, network, storage, schema, Rules, claim, route, migration, or deployment edge.

Durable replay protection, cross-record account-link uniqueness, owner-approved membership/payment policy, schema, authorization, migration, deployment, and live proof remain explicit future work behind #110, #113, #114, AUTH-003/ADMIN, and protected release children. This pull request must not be adopted as a live membership system.

Verification

Node 20.19.5 and Java 17 where required:

• Focused membership contract: 46/46 passed.
• Full Functions: 19 suites passed, 2 emulator-only suites skipped; 1244 passed, 39 skipped.
• Functions lint: passed.
• Frontend Jest: 198/198 passed.
• SPA navigation: 11/11 passed.
• Firestore Rules emulator: 357/357 passed.
• Commerce journal Firestore emulator: 38/38 passed.
• CI/release/artifact workflow tests: 42/42 passed.
• Reviewed frontend lint baseline: passed.
• Production build: compiled successfully without regenerating the sitemap.
• git diff --check and exact four-path scope: passed.
• Three independent reviews approved the exact final hashes: security/privacy, contract/tests, and officer continuity/coordination.

Production-only dependency audit baseline remains unchanged: root 6 findings (1 low, 2 moderate, 3 high); Functions 9 findings (8 moderate, 1 high). This PR changes no dependency or lockfile and applies no forced upgrade.

Closes #208

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	aee505c
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a55aef5fa386b000809caf5
😎 Deploy Preview	https://deploy-preview-210--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.