[daliu]

Outcome

My Account registration sorting now maps exceptional retained timestamp access or numeric coercion to the existing fixed registration-load failure. The caught value is never bound, inspected, logged, attached, or serialized by application code, and no partial callable response returns.

Closes #598.
Parent: #374.
Follows released DATA-001A8/#579.

Defect and invariant

After App Check/Auth, the exact-UID query, registration projection, and all event work, the final comparator previously read createdAt._seconds and subtracted the retained values outside every fixed-error boundary. A throwing nested accessor or coercion hook escaped into Firebase/platform handling.

This PR wraps only the existing final Array.from-and-sort expression in a catch without a binding. The comparator expression, token sequence, and runtime semantics remain unchanged; only indentation changes inside the new try boundary. App Check/Auth ordering, exact-UID authority, runner minimization, A5–A8 boundaries, event lookup concurrency, projection, successful response bytes, descending order, fallback-to-zero behavior, ties, empty/one-row behavior, and read-only behavior remain unchanged.

Trustworthy test-first proof

On untouched source, the test-only patch produced exactly two intended failures after 29 existing/control passes:

• retained _seconds access threw the exact hostile value;
• later numeric coercion threw the exact hostile value.

Both failures occurred after the exact query, two registration projections, and one complete event acquisition/projection. The tests proved the caught value was not otherwise inspected or logged and no response resolved. The positive descending-order and missing-time fallback control passed before the runtime change.

Exact scope

• functions/listMyRegistrations.js — only the final registration materialize/sort catch.
• functions/listMyRegistrations.test.js — one separately named DATA-001A9 block.
• SECURITY.md — one separately named remediation-ledger row after A8.

Exact base: d462ff6.
Exact head: 3bb8fd5.
Exact tree: fb78356422c4754e1c0b95db804d0bc03c22988a.
Binary patch SHA-256: 0249c70b5658a9b76df360ec545dcd523f997341568c158183bffee5ba9d2d75.

Verification

• Focused DATA-001A3–A9: 31/31.
• Functions lint: passed.
• Full Functions: 69 suites passed / 2 intentionally skipped; 7,490 passed / 64 intentionally skipped.
• Frontend: 951/951.
• TypeScript: passed.
• Frontend lint: 118 files / 113 reviewed legacy errors / 6 reviewed warnings.
• SPA: 11/11.
• Workflow/release/artifact/dependency safety: 93/93.
• Diagnostic build: passed.
• Rules emulator: 418/418.
• Real demo-only commerce emulator: 63/63.
• Audit snapshot: root 59 total with zero critical; root production 4; Functions 8. No dependency file changed and no forced update was applied.

Security and compatibility review

• Authorization and App Check are unchanged.
• No new read, write, provider call, log, timestamp, package, schema, Rule, index, or response field.
• The exception catch has no binding.
• Valid comparator and response behavior are unchanged.
• Previously exceptional sort outcomes now receive only the existing fixed callable error.
• Tests use invented local values only; no Firebase network, provider, production data, or real member data.

Residuals remain: malformed-but-nonthrowing timestamp values and their ordering; event-ID derivation/validation; sibling cancellation/order; response/platform serialization and platform logging; retries; deployment/readback and live proof. This is the final in-function sort-stage boundary, not final overall failure containment.

Migration and rollback

No schema, stored-data, client, Rules, index, package, provider, or production migration. Roll back the single merge if the fixed failure boundary causes an unexpected regression; no data reversal is required.

Officer impact: None — My Account already discards every registration-list rejection detail and shows the same generic registration-load error.

Officer documentation: None — this internal server sort-failure boundary changes no officer procedure, screen, navigation, page structure, collected field, data movement, permission, account ownership, approval, or deployment process.

Deployment evidence: Source changed; synthetic/local tests and hosted PR CI run 30732412289 passed. Netlify deploy preview 6a6ec73fd569250008c8d477 was created for exact head 3bb8fd5 and is ready with HTTP 200, x-robots-tag noindex, and published_at null. This deploy-preview is not production publication or live proof. Code is not yet merged. The production website and runmprc.com were not published or verified; Firebase was not deployed or read back; outside-provider configuration, production data, migration, and live behavior were not changed or verified.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	3bb8fd5
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6ec73fd569250008c8d477
😎 Deploy Preview	https://deploy-preview-599--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

DELIVERY-EVIDENCE CORRECTION

Hosted PR CI run 30732412289 passed all five required jobs for exact head 3bb8fd5.

Netlify deploy preview 6a6ec73fd569250008c8d477 is exact-head, deploy-preview context, state ready, HTTP 200, x-robots-tag noindex, and published_at null. This is a provider preview outcome, not a production publication, runmprc.com verification, Firebase deployment/readback, production-data action, migration, or live-behavior proof. The PR body now records these states separately.

[daliu]

SELF-REVIEW COMPLETE — NO ACTIONABLE FINDINGS

Exact reviewed head: 3bb8fd5 on exact current base d462ff6.

I reviewed the complete three-file diff for:

• App Check/Auth and exact-UID authority ordering;
• registration/event read topology and partial-result behavior;
• caught-value binding, inspection, coercion, formatting, logging, attachment, serialization, and raw escape;
• comparator semantics, descending order, fallback-to-zero, ties, empty/one-row behavior, and response compatibility;
• writes, timestamps, providers, schema, Rules, indexes, packages, and migration;
• SECURITY residuals, officer-documentation impact, active claims, and delivery-state accuracy.

No issue remains. The runtime catch has no binding and creates only the existing fixed HttpsError. The comparator expression, token sequence, and runtime semantics are unchanged; only indentation changes inside the try boundary. Trustworthy RED failed exactly the two intended cases on old runtime. All focused/full local gates and hosted CI 30732412289 passed.

Three independent exact-head reviewers returned final GO for security/privacy, tests/compatibility, and docs/scope/backup-officer review. Their two remote-record STOPs were both resolved before this marker: literal byte-equivalence wording was corrected, and exact-head Netlify preview 6a6ec73fd569250008c8d477 was recorded separately from production/live states.

Merge policy: the repository still requires an external approving review, but the maintainer has explicitly instructed this task to self-review and merge once no issues remain. If ordinary merge rejects only that requirement, an admin squash merge is authorized. No required check or substantive finding may be bypassed.

[daliu]

MERGED AND EXACT-MAIN VERIFIED

Reviewed head 3bb8fd5 was squash-merged as exact main 57ac85b on parent d462ff6. Reviewed and merge trees are identical at fb78356422c4754e1c0b95db804d0bc03c22988a; binary patch SHA-256 is 0249c70b5658a9b76df360ec545dcd523f997341568c158183bffee5ba9d2d75.

Exact-main CI 30732611095 passed all five required jobs. GitHub deployments are empty. Netlify exact-main production attempt 6a6ec8d87569330008962c25 failed with published_at null; the public runmprc.com marker remains the earlier bounded #473 release, so this source correction is not published or live. Firebase was not deployed/read back, provider configuration was not changed, and no production data or live behavior was accessed.

Issue #598 is closed and its claim is released.