Meta's ruling 2026-11-11. The OIDC issuer (the chat tier) now requires a live
receipt for TrainingNotice.Version: a refused authorize redirects to the consent
page with the parked request as returnUrl; token and userinfo re-read the receipt;
the back-channel reconciler ends sessions of accounts whose receipt is gone.
Notice relabelled version 1 with a pinned hash; docs add a Before deploy step
(clear ConsentReceipts), deploy and smoke notes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
One configured client (stale clients removed with their tokens and authorizations), Active membership re-checked at token and userinfo through IsStillActiveMemberAsync, PKCE required by the server option, OpenIddict.Server.AspNetCore + EntityFrameworkCore 7.7.1 with no vulnerable transitives. Soul s2, s3 and s4 hold; Low conformance gaps in gamecult-chat:follow_up:oidc-issuer-spec-conformance.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
