[daliu]

Outcome

Retire an in-memory verification code if Firebase readiness or the exact identity-service object changes after a provider verification request begins. Late work from the obsolete service cannot overwrite the current page, and the private code is never reused through a replacement service.

Closes #571.

Invariant

• Before any provider request, the current committed ready service may be selected deliberately.
• An offline click makes no provider request and does not bind the code.
• Once verifyEmailAction is invoked, the code belongs to that exact committed service generation.
• Any later readiness loss, missing service, or distinct service replacement retires the code and shows only the fixed unusable state.
• Same-object wrapper changes preserve state.
• Obsolete completion/rejection/cleanup cannot change or focus UI, inspect/log rejection data, navigate, or unlock another attempt.
• Same-route capability scrubbing and same-context temporary retry remain unchanged.

Evidence

• Trustworthy amended RED on untouched source: 10 intended failures / 2 valid controls / 27 skipped.
• Focused VerifyEmailAction suite: 39/39.
• Full frontend: 18 suites / 1,052 tests.
• TypeScript: pass.
• Direct ESLint: pass.
• Non-mutating lint ledger: 118 files / 113 reviewed errors / 6 reviewed warnings.
• SPA safety: 11/11.
• Workflow/release/artifact/dependency safety: 93/93.
• Diagnostic production build: pass.
• Three independent exact-diff reviews: security/runtime GO; test/mutation GO; officer/scope GO.
• Exact three-file binary diff SHA-256: deb47b0a8451ec4b07c0c6498fbfe7252b83ca3dfa824f6156da9e5703798025.
• Exact reviewed head: 5ecdbf4c08097921399031f861711d3cfd926148.
• Exact parent/main at publication: b94622bd42775d84704d5fc05ee87da81f5a76e0.

Compatibility and residuals

No schema, package, route, Firebase configuration, provider template, account, or data migration changes. A provider request already sent through the obsolete service cannot be cancelled or proven by this browser; the UI therefore fails closed and requires one new verification email after a context change.

Officer impact

No live procedure changes. The source-review section explains the observable Checking verification... boundary, same-page temporary retry, and when one new verification email is required.

Officer documentation

docs/officers/EMERGENCY_AND_RECOVERY.md — only the existing verification-link source-review section and diagram.

Deployment evidence

Source changed and local tests passed. This PR is not yet merged. The website and runmprc.com were not published or verified. Firebase was not deployed or configured. No email provider, account, production data, or live verification action occurred. Hosted PR CI remains required.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	5ecdbf4
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7d5390868d870008a6dc36
😎 Deploy Preview	https://deploy-preview-619--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.