feat(membership): add owner-issued single-membership admission

CHANGELOG.d/membership-design-authority-boundary.md

@@ -0,0 +1,3 @@
+### Membership
+
+- Separate deserialized `MembershipDesignWire` coordinates from owner-derived longitudinal classification authority. `classify_membership_observations_wire` now returns `MembershipDesignClassification`, whose private state can only be issued after canonical Membership classification at each observation event time; parsing a supported `{version, name}` pair remains a non-authoritative serialization boundary.

CHANGELOG.d/membership-design-support-window.md

@@ -0,0 +1,5 @@
+## Changed
+
+- Bind owner-derived longitudinal Membership design classifications to the exact classified support cardinality and its earliest/latest event times. These coordinates are derived from the same `MembershipObservation` slice used by canonical classification and are not caller-supplied.
+- Keep parsed `MembershipDesignWire` values free of analytical authority. Support count and time bounds belong only to `MembershipDesignClassification` issued after canonical Membership classification.
+- Treat count plus event-time bounds as provenance coordinates, not complete cohort reconstruction: different supports can share the same summary, so released analysis projections still require privacy-appropriate observation-support evidence and exact binding where scientific reconstruction depends on it.

CHANGELOG.d/membership-design-wire-coordinate.md

@@ -0,0 +1 @@
+- `membership_core::MembershipDesignWire` binds the Membership-owned design vocabulary version and design name as one typed serialization coordinate. Supported names round-trip only under `tepp.membership_design.v1`; mismatched versions fail with `UnsupportedWireVersion` and unknown names fail with `UnknownMembershipDesign`. Parsed wire coordinates are non-authoritative. New analytical classification authority is returned separately as `MembershipDesignClassification` by `classify_membership_observations_wire`, which derives it from canonical Membership state; consumers may project its `.wire()` only after that owner-side classification.

CHANGELOG.d/membership-design-wire-vocabulary.md

@@ -0,0 +1 @@
+- `membership_core::MembershipDesign` now owns a versioned, closed wire vocabulary (`tepp.membership_design.v1`) with exact snake_case names and fail-closed parsing. Longitudinal consumers can bind the owner-derived design without reimplementing Membership semantics or accepting caller-asserted design labels.

CHANGELOG.d/membership-longitudinal-observation-support.md

@@ -0,0 +1 @@
+- `membership_core` now classifies cross-classified, multiple-membership, and classification-heterogeneous structure over explicit `(MemberId, EventTime)` observation support. Every requested observation must have active Membership-owned context at its own event time; missing rows fail closed instead of disappearing into an atomistic longitudinal design. This is a domain admission contract, not a new estimator or a consumer-authorized design label.

CHANGELOG.d/membership-observation-support-digest.md

@@ -0,0 +1,5 @@
+## Changed
+
+- Bind each owner-derived longitudinal Membership classification to a versioned SHA-256 identity for the exact opaque observation multiset and the active Membership topology resolved at each observation event time.
+- Canonicalize observation and active-assignment ordering while preserving duplicate observation multiplicity; frame variable-length fields and hash exact binary64 membership-weight bits so equivalent input ordering cannot change support identity and distinct same-window supports cannot alias silently.
+- Keep the support digest as provenance identity only. Released analytical contracts must still carry privacy-appropriate, reconstructable event-time/window/cohort/support coordinates and verify that representation against the owner digest rather than treating a digest as reconstruction evidence.

CHANGELOG.d/membership-observation-support-duplicate-coordinate.md

@@ -0,0 +1,5 @@
+# Membership support duplicate-coordinate determinism
+
+`tepp.membership_observation_support_projection.v1` now rejects a parsed payload when the same projection-local `(member_ordinal, event_time)` coordinate is repeated with different active Membership assignments. Canonical owner state resolves one topology at one member/event-time coordinate, so contradictory duplicate rows are unreachable even when each row is individually well formed and the aggregate design label remains plausible.
+
+Byte-identical duplicate rows remain valid and multiplicity-sensitive. This repair does not deduplicate observations, change the wire schema, make parsed wire authoritative, or alter Membership estimator arithmetic.

CHANGELOG.d/membership-observation-support-wire.md

@@ -0,0 +1,8 @@
+## Changed
+
+- Add a Membership-owned `tepp.membership_observation_support_projection.v1` wire projection for longitudinal support. The owner path resolves every observation at its own event time, preserves repeated-member/repeated-group linkage through projection-local ordinals, retains role and exact binary64 weight bits, and carries the source-support digest issued by canonical Membership classification.
+- The opaque-source `support_sha256` remains an owner provenance fingerprint and is intentionally not recomputable after raw `MemberId`/`GroupId` UUID redaction. A separate versioned `tepp.membership_observation_support_projection_digest.v1` SHA-256 is recomputed from the complete privacy-reduced projection state, including the source-support digest, so valid-looking source digests and reconstructable coordinates cannot drift independently under the supported parser contract. This content digest is not a signature and does not turn parsed bytes into owner authority.
+- Canonical JSON omits raw `MemberId`/`GroupId` UUID text and rejects unsupported versions, unknown fields, timezone aliases, malformed weights, noncanonical ordering, invalid local-ordinal spaces, detached wire-content digests, and design labels that do not match the reconstructed role/group/weight topology. The parser reuses Membership's canonical design-signal classifier rather than maintaining a second topology interpretation.
+- Parsed support rows are also constrained to states reachable through canonical Membership admission: a role/group edge cannot occur twice at one observation, and known same-role shares may not exceed unity under the same exact represented-binary64 budget predicate used by `MembershipNetwork`.
+- The owner projection also returns a non-wire coordinate slice parallel to the caller's admitted observation order, containing only the Membership-issued local member ordinal and exact event time. Downstream owners can bind their own document/evidence identity without re-sorting raw member IDs; canonical support bytes remain input-order insensitive and duplicate observations remain multiplicity-sensitive.
+- This is privacy reduction for scientific reconstruction, not anonymity. Parsed wire values remain non-authoritative serialization data; new analytical authority is issued only through canonical Membership state.

crates/membership_core/Cargo.toml

@@ -16,6 +16,7 @@ publish = false
 [dependencies]
 serde.workspace = true
 serde_json.workspace = true
+sha2.workspace = true
 temporal_core = { path = "../temporal_core", version = "=0.2.0" }
 uuid.workspace = true
 

crates/membership_core/src/admission.rs

@@ -0,0 +1,85 @@
+//! Fail-closed admission for estimators that only support full single membership.
+
+use crate::{
+    GroupId, MemberId, MembershipError, MembershipNetwork, MembershipRole, MembershipWeight,
+};
+use temporal_core::EventTime;
+
+/// Owner-issued proof that one member has exactly one active, full-weight membership.
+///
+/// This value is intentionally constructed only from [`MembershipNetwork`] state. Consumers that
+/// implement a nested or single-membership estimator can require this admission instead of trusting
+/// a caller-selected cluster key or silently flattening cross-classified / multiple-membership
+/// structure.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct SingleMembershipAdmission {
+    member_id: MemberId,
+    group_id: GroupId,
+    role: MembershipRole,
+    weight: MembershipWeight,
+    event_time: EventTime,
+}
+
+impl SingleMembershipAdmission {
+    /// Return the admitted member identity.
+    #[must_use]
+    pub const fn member_id(self) -> MemberId {
+        self.member_id
+    }
+
+    /// Return the sole active group identity.
+    #[must_use]
+    pub const fn group_id(self) -> GroupId {
+        self.group_id
+    }
+
+    /// Return the sole active contextual role.
+    #[must_use]
+    pub const fn role(self) -> MembershipRole {
+        self.role
+    }
+
+    /// Return the full membership weight.
+    #[must_use]
+    pub const fn weight(self) -> MembershipWeight {
+        self.weight
+    }
+
+    /// Return the event time at which membership was admitted.
+    #[must_use]
+    pub const fn event_time(self) -> EventTime {
+        self.event_time
+    }
+}
+
+/// Admit one member for an estimator whose declared estimand supports only full single membership.
+///
+/// The admission is derived from canonical [`MembershipNetwork`] state. It fails closed when the
+/// member is inactive, has more than one simultaneous active assignment (including same-group
+/// cross-role assignments), or has a partial membership weight. A future cross-classified or
+/// weighted estimator must use a separate versioned admission path rather than reusing this proof.
+///
+/// # Errors
+///
+/// Returns [`MembershipError::SingleMembershipProfileInapplicable`] whenever the active membership
+/// structure cannot be represented without loss by a full single-membership estimator.
+pub fn admit_single_membership(
+    network: &MembershipNetwork,
+    member_id: MemberId,
+    event_time: EventTime,
+) -> Result<SingleMembershipAdmission, MembershipError> {
+    let active = network.active_memberships_for(member_id, event_time);
+    let [assignment] = active.as_slice() else {
+        return Err(MembershipError::SingleMembershipProfileInapplicable);
+    };
+    if assignment.weight().value().to_bits() != 1.0_f64.to_bits() {
+        return Err(MembershipError::SingleMembershipProfileInapplicable);
+    }
+    Ok(SingleMembershipAdmission {
+        member_id,
+        group_id: assignment.group_id(),
+        role: assignment.role(),
+        weight: assignment.weight(),
+        event_time,
+    })
+}