Working notes — R1 / R3

Base SHA: 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60.
npm lock before changes: next@16.3.2 (MIT), sharp@0.35.3 (Apache-2.0), source-map-js@1.2.1 (BSD-3-Clause).
Minimal same-major patched versions selected from npm registry metadata: next@16.3.8 (MIT), sharp@0.35.5 (Apache-2.0), source-map-js@1.2.2 (BSD-3-Clause). eslint-config-next moved 16.3.2→16.3.8 to match Next.
Production audit before update found next Critical, sharp High, source-map-js High; after update npm audit --omit=dev reported zero vulnerabilities.
Pagination must be considered incomplete when reported totals are absent/invalid/change mid-read, pages end early, page sizes are invalid, or the safety ceiling is reached. Do not return partial participants for persistence.
groups.isMember only produces an accepted status when every requested ID appears exactly once with member exactly 0 or 1. Missing/invalid data aborts the import before repository save.
Provider currently does not use execute; observed execute method limits and live VK method contracts are UNVERIFIED.
A-H smoke was exercised against a fake localhost HTTP server. A, C-H emitted PASS and B emitted MANUAL; no real VK credentials/session were used.