schalli
68aca81f71
- syncUsersForTenant() now calls syncBoundGroupsForTenant() (5a) BEFORE syncGroupMembershipsForTenant() (5b) — the central correctness ordering of Phase 16 (RESEARCH.md Pitfall 1): a rename detected in the same run must be written back before the memberOf filter is built, or the membership sync would misreport a rename as a membership wipeout - Add observable ordering test (call-order spies), a no-op-guard test, and a regression test proving a memberOf search never uses the stale pre-rename DN - Update the D-21 membership-sync test fixtures to resolve step 5a as a deterministic no-op (DN-derived identity GUID), since the wiring now runs 5a ahead of every syncUsersForTenant() call those tests exercise A1 (objectGUID survives an AD rename) and A2 (binary filter escape syntax) remain unverified against a real directory — no reachable AD in this sandbox. Documented as an outstanding live verification in the plan SUMMARY, not silently skipped.