MEMBERS-IDENTITY-001G: define consent-decision receipts

[daliu]

Defines a bounded, provider-neutral technical consent-decision receipt contract without changing any live member, officer, Firebase, or provider behavior.

Officer impact: None yet. Officers gain a source-review guide for made-up technical receipt examples only; signup, membership, discounts, Google, WhatsApp, Strava, officer screens, and live accounts are unchanged.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md — added the Consent-decision receipts — SOURCE ONLY, UNUSED procedure, separate-call diagram and text alternative, prerequisites, limits, proof, undo, and escalation.

Deployment evidence: Source commit af53cf72be14b9ace8faa43e34fafda302cab625 was pushed for review. Local Node 20 and Java 17 checks passed. Code is not merged at PR creation. The website was not published; runmprc.com was not checked; Firebase was not deployed; no outside provider was configured or contacted; no production data was read or changed; no migration or live behavior was verified. Demo-only emulator results are test evidence, not deployment evidence.

Closes #447

Parent #81 remains open.

Outcome

• Adds unused pure CommonJS membershipConsentReceipt.js.
• Creates one bounded track head containing no unbounded receipt history.
• Appends one frozen technical granted or withdrawn receipt under exact track, revision, latest-receipt, command, and policy bindings.
• Treats an exact latest retry as read-only; rejects changed latest-command reuse, negative zero, stale/skipped/unsafe revisions, wrong track/latest receipt, current receipt-ID reuse, and internally inconsistent nested state.
• Projects the current head through the real MEMBERS-IDENTITY-001D — Provider-neutral versioned consent-state derivation (source only, unused) #370 classifyConsentState contract in a separate call with the caller-supplied required policy version.
• Uses purpose-specific synthetic reference formats and one fixed non-echoing failure boundary.
• Hard-codes grantsAuthority: false on every head, receipt, append result, and composed consent disposition.
• Adds SYSTEM_DESIGN.md §8.0j and the matching officer future-state procedure.

Security and scope review

• No runtime or transitive Functions-index import; the test walks the local CommonJS require graph.
• No clock, environment, randomness, network, Firebase, provider SDK, logger, package, Rules, endpoint, route, interface, workflow, or deployment edge.
• No actor, timestamp, contact data, provider identifier, policy/notice text, capture method, evidence content, secret, or production record.
• Structural validation does not authenticate a self-consistent rewritten head. Trusted actor authorization, canonical reads, create-only transactional persistence, all-history replay uniqueness, receipt preservation, and provider facts remain future work.
• Purpose/access/provider disclosure/retention/deletion/backup/request/public-notice decisions remain owner-blocked under DATA-001B — Inventory personal data and approve a minimization/retention matrix #110; provider-specific capture remains WHATSAPP-002 — Link a verified WhatsApp number and versioned consent to a member UID #87; legacy disposition remains BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113.
• Prior command/receipt IDs no longer visible in the bounded head cannot be deduplicated here; future durable storage must enforce them.

Test evidence

RED proof before implementation:

• npm --prefix functions run test:run -- --runInBand membershipConsentReceipt.test.js failed because ./membershipConsentReceipt did not exist.

Final environment:

• Node 20.19.5
• Java 17.0.19

Final results:

• Functions ESLint: passed.
• Focused consent receipt suite: 96/96 passed.
• Full Functions Jest: 6,215 passed; 64 intentionally skipped; 65/67 suites passed with two intentionally skipped.
• Frontend lint baseline: 111 files, 117 reviewed legacy errors, 6 reviewed legacy warnings; passed without mutation.
• Frontend Jest: 727/727 passed.
• SPA callback safety: 11/11 passed.
• Workflow/release/Firebase-verification/artifact/dependency safety: 54/54 passed.
• Firestore Rules emulator: 378/378 passed against demo-rules-test only.
• Commerce command journal emulator: 63/63 passed against demo-pay002b2-test only.
• Protected workflow YAML parsing: passed.
• Diagnostic production frontend build with the ESLint webpack pass disabled after the separate lint gate: passed.
• git diff --check: passed.

Self-review

Three independent adversarial reviews covered security/architecture, test/reliability, and officer/privacy wording. Findings were fixed and re-reviewed:

• rejected negative-zero revisions so 0 and -0 cannot masquerade as an exact retry;
• hardened the runtime-isolation graph scan for whitespace, extensionless, explicit .js, and directory index.js imports;
• added unfrozen-clone canonicalization, MAX−1→MAX, and strict required-policy coverage;
• corrected officer wording to latest-only replay detection and explicit older-history limits;
• made the separate projector call and required policy input explicit in both diagrams;
• stated plainly that source cannot authenticate a self-consistent rewritten head; and
• defined unavoidable technical terms in the no-terminal officer guide.

All three final re-reviews report no remaining findings.

Residual risk

This is source-only design evidence. It stores nothing and cannot prove informed/legal consent, notice delivery, actor authority, provider acceptance, canonical history, deployment, or live behavior. Parent #81 remains incomplete until the named policy, authorization, persistence, uniqueness, migration, provider, deployment, and production-verification boundaries are separately approved and delivered.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	af53cf7
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a60ab6be005130008c186a5
😎 Deploy Preview	https://deploy-preview-448--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

SELF-REVIEW COMPLETE at exact head af53cf72be14b9ace8faa43e34fafda302cab625.

Reviewed the GitHub diff and confirmed exactly four owned paths. The contract remains pure, unused, no-authority, bounded to one latest receipt, latest-retry-idempotent, strict about track/revision/latest-receipt binding, and composed with #370 only through the separate projector. No runtime import, Rules, package, endpoint, provider, persistence, migration, deployment, or production-data path was added.

Adversarial review findings were fixed: negative-zero revision aliasing, indirect import-scan evasions, all-history wording overclaim, missing head-authenticity warning, diagram call conflation, and officer terminology. Security/architecture, test/reliability, and officer/privacy reviewers each re-reviewed the final diff and reported no findings.

Hosted CI run https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/29916395606 passed all five blocking jobs at this exact head, including the named frontend Jest, Functions test, Rules emulator, concurrency emulator, and artifact-safety steps. The Netlify deploy preview succeeded; it is not production publication. Header/pages checks skipped because those surfaces did not change.

GitHub requires another-account approval and does not allow the PR author to satisfy that review state. The user explicitly requested self-review and merge when no issues remain. With the exact diff reviewed, three independent adversarial reviews clean, and every blocking hosted check green, this PR is ready for the documented administrator merge override. No protected release will be requested.