Members change profile data only through requests — never direct secure writes. Transfers need source and destination approval. Merges use survivorship + tombstone (no hard delete). Status and visible-field changes trigger ID-card refresh.