[daliu]

Outcome

Rejects a Strava recent-activity response when two otherwise-valid rows carry the same copied safe-integer ID. The server fails the whole payload through the existing fixed error instead of sending duplicate React keys to My Account.

Fixes #602. Parent: #88.

Officer impact: After a future protected Firebase Functions release, duplicate recent-activity identifiers will produce the existing generic My Account loading failure. There is no current officer-visible change, and no new officer action is introduced.

Officer documentation: None — this server-only admission rule changes no public page, officer duty, collected field, permission, account, deployment step, or recovery procedure. Existing generic Strava failure guidance remains accurate.

Deployment evidence: Source/test candidate only. Exact reviewed head is 945a647d2519fa6b87077122befd39bf08f62c80; tree 56fb8e3bd2ee741dfbb14fbf3ce4a5e09ccbb5c1; patch SHA-256 216d029f805fd5ffc5667e44ec1cab2fae97e71b346780d6a7dc14db3dfeffba. No website publication, runmprc.com verification, Firebase deployment, Strava/provider change, production-data action, or live verification has occurred.

Invariant and compatibility

• A successful recentActivities result contains at most five copied records with pairwise-distinct positive safe-integer IDs.
• A duplicate rejects the whole activities payload before append and before statistics JSON; no winner, merge, reorder, deduplication, or normalization policy is invented.
• Distinct IDs retain provider order, numeric type, fields, provider requests, and response schema.
• The bounded nested scan performs at most ten primitive comparisons and touches only frozen internal snapshots. Auth, App Check, refresh, persistence, logging, and provider dispatch are unchanged.
• No schema or migration change.

Tests and checks

• Trustworthy RED on unchanged runtime: 691 total, 690 passed, exactly the duplicate-ID rejection failed; the distinct-boundary control passed. Test-only diff SHA-256 d3c034b1c0f54323897c13f4fdd47dacb50d3c7f1c588f2e996ef599b8812c3d.
• Focused Strava: 691/691.
• Functions lint: passed.
• Full Functions: 69 suites passed / 2 skipped; 7,494 passed / 64 skipped.
• Frontend: 18 suites, 951/951.
• TypeScript: passed.
• Deterministic frontend lint: 118 files; 113 reviewed legacy errors; 6 reviewed legacy warnings.
• SPA/workflow/release/dependency/artifact safety: 104/104.
• Diagnostic production build: passed.
• Firestore Rules on demo emulator with Java 21: 418/418.
• Commerce journal on real demo-only emulator: 63/63.
• Dependency audit unchanged: root 59 total / 4 production; Functions 8 total/production; no critical finding and no dependency-file diff.
• git diff --check: passed; exact two-file scope.

Review and residual risk

Self-review found no authorization, App Check, input-bound, privacy/logging, persistence, provider-call, type/order, or fallback regression. Three independent exact-head reviews covering code/security, tests/compatibility, and officer/documentation scope are GO with no findings.

Out of scope and still separate: lossless String/Long transport, client key/type migration, response-status admission, response-byte limits, refresh concurrency/reconciliation, provider governance/configuration, Firebase deployment, and live verification. No real token, member data, or production provider host was used.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	945a647
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6ed206d8ef7f0008e89b1e
😎 Deploy Preview	https://deploy-preview-603--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

SELF-REVIEW: GO — no actionable findings on exact head 945a647d2519fa6b87077122befd39bf08f62c80 against unchanged base 287bfa55af969daea189dad35d7d7ac1875fd1c3.

I reviewed the complete two-file diff for Auth/App Check ordering, copied-input bounds, fixed failure behavior, provider request count, PII/logging, persistence, response schema/type/order, hostile hooks, and production fallback. The scan is bounded to ten comparisons of validated frozen snapshots; a duplicate fails the whole activities payload before statistics JSON. It does not select, merge, reorder, normalize, or deduplicate provider records.

Three independent exact-head reviews returned GO: security/compatibility, RED/tests, and officer/documentation scope. The trustworthy RED failed only the new duplicate rejection on old runtime; final focused tests are 691/691. All five required jobs in hosted CI 30733746716 passed. Exact-head Netlify preview 6a6ed206d8ef7f0008e89b1e is ready, HTTP 200, noindex, and published_at: null.

Officer impact: only after a future protected Firebase Functions release, duplicates use the existing generic failure; there is no current officer-visible change. Officer documentation: None — existing SOURCE ONLY / NOT LIVE guidance remains accurate.

Repository policy still requires an external approval, so merge state is review-blocked despite all checks. The maintainer explicitly instructed this task to self-review and merge clean issues; an administrative squash merge is authorized only after the evidence above.

[daliu]

FINAL DELIVERY — COMPLETE / MERGED / CLAIM RELEASED

Exact reviewed head 945a647d2519fa6b87077122befd39bf08f62c80 was squash-merged as exact main dff1a40194bd1f25938ac16564a6ce27bbb9eab5. Parent, tree, two-file scope, and patch hash match. PR CI 30733746716 and post-main CI 30733851679 passed all five jobs. No actionable review finding remained.

Deployment evidence: the exact-head preview was ready and unpublished; the exact-main Netlify production attempt is error/unpublished; GitHub deployments are empty; runmprc.com remains on the older #473 release; Firebase and Strava configuration were not changed or verified; production behavior is not claimed live.

Officer impact: only after a future protected Functions release, duplicates use the existing generic failure. Officer documentation: None — current SOURCE ONLY / NOT LIVE guidance remains accurate.