Members change profile data only through requests — never direct secure writes. Transfers need source and destination approval. Merges use survivorship + tombstone (no hard delete). Status and visible-field changes trigger ID-card refresh.

Activation is exactly-once per application. Member numbers are reserved uniquely and never used as document IDs. ID cards are vault-encrypted with opaque QR tokens — owner authenticated stream only; no public URLs. Missing number format or template blocks activation.