merge(main): resolve conflict in handlers_users.go

Keep our primary-email cache write (LFXV2-2645) alongside main's new
isSoleQualifyingAlternateEmail logic (LFXV2-2662). The isPrimary block
now caches the email and returns false (matching main's return change);
the sole-qualifying-email block follows unchanged from main.

Generated with [Claude Code](https://claude.ai/code)

Signed-off-by: Andres Tobon <andrest2455@gmail.com>

Author: andrest50

CODEOWNERS

@@ -1,2 +1,2 @@
 # Platform engineering group within LFX engineering. @emsearcy represents the LFX architecture team.
-* @linuxfoundation/lfx-platform @emsearcy
+* @linuxfoundation/lfx-v1-sync-helper

README.md

@@ -176,6 +176,24 @@ lfx-v1-sync-helper --backfill-acs-project [--dry-run]
 lfx-v1-sync-helper --backfill-acs-org [--dry-run]
 ```
 
+**Committee-member reverse-mapping repair (`--backfill-committee-member-mappings`):**
+
+Repairs committee-member reverse mappings (`committee_member.uid.*` in `v1-mappings`) that store the `platform-community__c` record sfid instead of the contact SFID (v1 API "MemberID") — the root cause of v1 committee-member deletes 404ing and leaving members on the committee / meeting invites (LFXV2-2673). Resolves the contact SFID from the `v1-objects` KV bucket; makes no calls to any other service. Writes are optimistic-concurrency guarded against the live sync-helper, idempotent, and safe to re-run.
+
+Run once after deploying the fix, to repair already-affected mappings. A dry-run pass is recommended first:
+
+```sh
+kubectl --context lfx-v2-prod -n v1-sync-helper apply -f manifests/backfill-committee-member-mappings-job.yaml
+```
+
+Add `--dry-run` to the manifest args, apply, inspect logs (`inspected`/`poisoned`/`fixed`/`already_ok`/`unresolved`/`malformed`/`tombstoned`/`conflicted` counts), then re-apply without it for the live run.
+
+Locally (with NATS port-forwarded):
+
+```sh
+lfx-v1-sync-helper --backfill-committee-member-mappings [--dry-run]
+```
+
 ## Architecture Diagrams
 
 Regarding the following sequence diagrams:

charts/lfx-v1-sync-helper/templates/app-deployment.yaml

@@ -20,6 +20,10 @@ spec:
       component: app
   template:
     metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       labels:
         app: {{ .Chart.Name }}
         app.kubernetes.io/name: {{ .Chart.Name }}

cmd/lfx-v1-sync-helper/backfill_committee_member_mappings.go

@@ -0,0 +1,210 @@
+// Copyright The Linux Foundation and each contributor to LFX.
+// SPDX-License-Identifier: MIT
+
+// The lfx-v1-sync-helper service.
+package main
+
+import "testing"
+
+// Sample SFIDs/UUIDs used across the classification and parsing tests below.
+const (
+	testProjectSFID   = "a0941000002wBz9AAE"
+	testCommitteeSFID = "a0941000002wCz9AAE"
+	testRecordSFID    = "51fde723-67df-4e0e-91c6-936d01d59559" // UUID: platform-community__c record sfid
+	testContactSFID   = "0031000001AbCdeAAB"                   // Salesforce ID: contact_name__c
+)
+
+func TestClassifyReverseMapping(t *testing.T) {
+	tests := []struct {
+		name    string
+		data    []byte
+		want    reverseMappingOutcome
+		wantRec string // expected recordSFID, when applicable
+	}{
+		{
+			name: "empty value is malformed, not tombstoned",
+			data: []byte(""),
+			want: reverseMappingMalformed,
+		},
+		{
+			name: "explicit tombstone marker",
+			data: []byte(tombstoneMarker),
+			want: reverseMappingTombstoned,
+		},
+		{
+			name: "legacy 3-field mapping with UUID third field needs a fix",
+			data: []byte(testProjectSFID + ":" + testCommitteeSFID + ":" + testRecordSFID),
+			want: reverseMappingNeedsFix,
+		},
+		{
+			name: "legacy 3-field mapping with contact SFID third field is already OK",
+			data: []byte(testProjectSFID + ":" + testCommitteeSFID + ":" + testContactSFID),
+			want: reverseMappingAlreadyOK,
+		},
+		{
+			name: "3-field mapping with empty third field is malformed",
+			data: []byte(testProjectSFID + ":" + testCommitteeSFID + ":"),
+			want: reverseMappingMalformed,
+		},
+		{
+			name: "value with no colons is malformed",
+			data: []byte("not-a-mapping"),
+			want: reverseMappingMalformed,
+		},
+		{
+			name: "value with one colon is malformed",
+			data: []byte(testProjectSFID + ":" + testCommitteeSFID),
+			want: reverseMappingMalformed,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyReverseMapping(tt.data)
+			if got.outcome != tt.want {
+				t.Fatalf("classifyReverseMapping(%q).outcome = %v, want %v", tt.data, got.outcome, tt.want)
+			}
+		})
+	}
+}
+
+func TestClassifyReverseMapping_NeedsFixCarriesFields(t *testing.T) {
+	data := []byte(testProjectSFID + ":" + testCommitteeSFID + ":" + testRecordSFID)
+	got := classifyReverseMapping(data)
+
+	if got.outcome != reverseMappingNeedsFix {
+		t.Fatalf("outcome = %v, want %v", got.outcome, reverseMappingNeedsFix)
+	}
+	if got.projectSFID != testProjectSFID {
+		t.Errorf("projectSFID = %q, want %q", got.projectSFID, testProjectSFID)
+	}
+	if got.committeeSFID != testCommitteeSFID {
+		t.Errorf("committeeSFID = %q, want %q", got.committeeSFID, testCommitteeSFID)
+	}
+	if got.recordSFID != testRecordSFID {
+		t.Errorf("recordSFID = %q, want %q", got.recordSFID, testRecordSFID)
+	}
+}
+
+func TestBuildRepairedReverseMappingValue(t *testing.T) {
+	got := buildRepairedReverseMappingValue(testProjectSFID, testCommitteeSFID, testContactSFID)
+	want := testProjectSFID + ":" + testCommitteeSFID + ":" + testContactSFID
+	if got != want {
+		t.Fatalf("buildRepairedReverseMappingValue() = %q, want %q", got, want)
+	}
+
+	// The repaired value must itself classify as already OK and re-parse to the same
+	// contact SFID, so a repaired mapping is stable under a second backfill pass.
+	class := classifyReverseMapping([]byte(got))
+	if class.outcome != reverseMappingAlreadyOK {
+		t.Fatalf("classifyReverseMapping(repaired value).outcome = %v, want %v", class.outcome, reverseMappingAlreadyOK)
+	}
+
+	gotProject, gotCommittee, gotRecord, gotContact, ok := parseCommitteeMemberReverseMapping(got)
+	if !ok {
+		t.Fatalf("parseCommitteeMemberReverseMapping(%q) failed to parse", got)
+	}
+	if gotProject != testProjectSFID || gotCommittee != testCommitteeSFID || gotRecord != "" || gotContact != testContactSFID {
+		t.Fatalf("parseCommitteeMemberReverseMapping(%q) = (%q, %q, %q, %q), want (%q, %q, %q, %q)",
+			got, gotProject, gotCommittee, gotRecord, gotContact,
+			testProjectSFID, testCommitteeSFID, "", testContactSFID)
+	}
+}
+
+func TestIsUUID(t *testing.T) {
+	tests := []struct {
+		name string
+		s    string
+		want bool
+	}{
+		{"canonical lowercase UUID", "51fde723-67df-4e0e-91c6-936d01d59559", true},
+		{"canonical uppercase UUID", "51FDE723-67DF-4E0E-91C6-936D01D59559", true},
+		{"salesforce 18-char id", testContactSFID, false},
+		{"salesforce 15-char id", "a094100000TFAKE", false},
+		{"empty string", "", false},
+		{"wrong length", "51fde723-67df-4e0e-91c6-936d01d5955", false},
+		{"missing hyphens", "51fde72367df4e0e91c6936d01d59559", false},
+		{"hyphens in wrong place", "51fde7236-7df-4e0e-91c6-936d01d59559", false},
+		{"non-hex character", "51fde723-67df-4e0e-91c6-936d01d5955g", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isUUID(tt.s); got != tt.want {
+				t.Errorf("isUUID(%q) = %v, want %v", tt.s, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseCommitteeMemberReverseMapping(t *testing.T) {
+	tests := []struct {
+		name          string
+		s             string
+		wantOK        bool
+		wantProject   string
+		wantCommittee string
+		wantRecord    string
+		wantContact   string
+	}{
+		{
+			name:          "legacy 3-field mapping with record sfid",
+			s:             testProjectSFID + ":" + testCommitteeSFID + ":" + testRecordSFID,
+			wantOK:        true,
+			wantProject:   testProjectSFID,
+			wantCommittee: testCommitteeSFID,
+			wantRecord:    testRecordSFID,
+			wantContact:   "",
+		},
+		{
+			name:          "legacy 3-field mapping with contact sfid",
+			s:             testProjectSFID + ":" + testCommitteeSFID + ":" + testContactSFID,
+			wantOK:        true,
+			wantProject:   testProjectSFID,
+			wantCommittee: testCommitteeSFID,
+			wantRecord:    "",
+			wantContact:   testContactSFID,
+		},
+		{
+			name:   "too few fields",
+			s:      testProjectSFID + ":" + testCommitteeSFID,
+			wantOK: false,
+		},
+		{
+			// splitThreeParts only splits on the first two colons, so everything after
+			// the second colon (including further colons) folds into the third field;
+			// the result is neither a UUID nor a valid SFID, so it must be rejected as
+			// malformed rather than misclassified as a usable contact SFID.
+			name:   "extra colons fold into an invalid third field",
+			s:      testProjectSFID + ":" + testCommitteeSFID + ":" + testContactSFID + ":extra",
+			wantOK: false,
+		},
+		{
+			name:   "third field is neither a UUID nor a valid SFID",
+			s:      testProjectSFID + ":" + testCommitteeSFID + ":not-a-sfid",
+			wantOK: false,
+		},
+		{
+			name:   "no colons",
+			s:      "not-a-mapping",
+			wantOK: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotProject, gotCommittee, gotRecord, gotContact, gotOK := parseCommitteeMemberReverseMapping(tt.s)
+			if gotOK != tt.wantOK {
+				t.Fatalf("parseCommitteeMemberReverseMapping(%q) ok = %v, want %v", tt.s, gotOK, tt.wantOK)
+			}
+			if !tt.wantOK {
+				return
+			}
+			if gotProject != tt.wantProject || gotCommittee != tt.wantCommittee || gotRecord != tt.wantRecord || gotContact != tt.wantContact {
+				t.Fatalf("parseCommitteeMemberReverseMapping(%q) = (%q, %q, %q, %q), want (%q, %q, %q, %q)",
+					tt.s, gotProject, gotCommittee, gotRecord, gotContact,
+					tt.wantProject, tt.wantCommittee, tt.wantRecord, tt.wantContact)
+			}
+		})
+	}
+}