v5.2.13

Removed

• Dropped the marketing-webhooks Firestore idempotency ledger. The marketing-webhook dispatcher no longer reads/writes marketing-webhooks/{eventId} docs for dedup. Both handler side effects — writing consent.marketing.status = 'revoked' and the cross-provider mailer.remove() — are naturally idempotent, so a provider retry or duplicate parent fan-out re-runs to the same end state with no extra side effects. (Unlike payments-webhooks, where dedup is load-bearing because payment side effects are NOT idempotent.) Events with no eventId are now processed instead of skipped. Consumers with an existing marketing-webhooks collection can safely delete it.

Fixed

• libraries/infer-contact.js: guard the optional assistant arg with ?. on all log/error calls so inferContact(email) works without an assistant (was throwing TypeError when BACKEND_MANAGER_OPENAI_API_KEY was unset).
• libraries/email/marketing/index.js: gate Marketing.remove() behind test mode, matching add()/sync(). Closes a gap where auth onDelete (fired ~44× at test startup) could hit the live SendGrid/Beehiiv remove APIs during normal test runs. The gate lives at the library SSOT so every caller inherits it.

Changed

• Dependency bumps: @anthropic-ai/claude-agent-sdk ^0.3.152 → ^0.3.153, stripe ^22.1.1 → ^22.2.0.
• templates/_.env: consolidate OpenAI/Anthropic keys under an "AI" section and add CLAUDE_CODE_OAUTH_TOKEN.
• Marketing webhook tests rewritten as *-reprocessed-idempotently; docs/consent.md + docs/testing.md updated to describe the no-ledger design.