# Working notes — R1 / R3

- Base SHA: `6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60`.
- npm lock before changes: `next@16.3.2` (MIT), `sharp@0.35.3` (Apache-2.0), `source-map-js@1.2.1` (BSD-3-Clause).
- Minimal same-major patched versions selected from npm registry metadata: `next@16.3.8` (MIT), `sharp@0.35.5` (Apache-2.0), `source-map-js@1.2.2` (BSD-3-Clause). `eslint-config-next` moved 16.3.2→16.3.8 to match Next.
- Production audit before update found next Critical, sharp High, source-map-js High; after update `npm audit --omit=dev` reported zero vulnerabilities.
- Pagination must be considered incomplete when reported totals are absent/invalid/change mid-read, pages end early, page sizes are invalid, or the safety ceiling is reached. Do not return partial participants for persistence.
- `groups.isMember` only produces an accepted status when every requested ID appears exactly once with `member` exactly 0 or 1. Missing/invalid data aborts the import before repository save.
- Provider currently does not use `execute`; observed execute method limits and live VK method contracts are `UNVERIFIED`.
- A-H smoke was exercised against a fake localhost HTTP server. A, C-H emitted PASS and B emitted MANUAL; no real VK credentials/session were used.