Pre-launch member removal + address-bound invites (spec)

[franrolotti]

Summary

Contract-side spec for the general invite link / creator-approval flow (app-stacks#99). Implementation will land on this branch.

The spec (docs/specs/approval-flow-upgrade.md) covers:

• removeMember(id, member) — owner-only, callable strictly before start() (isActive guard closes the window atomically at launch). No refund logic needed: deposits are onlyActive, so pre-start circles hold no member funds.
• Address-bound invites — typehash becomes Invite(uint256 id,uint256 nonce,address member) and _hashInvite signs msg.sender, so an approved invite is only redeemable by the vetted wallet (closes the bearer-token hole in the approval flow).
• Why an upgrade is required — the deployed contract has no member-removal path and its invites are bearer tokens; neither is fixable off-chain.
• Why the upgrade is storage-safe — zero new storage (only existing mappings are written), the typehash is a constant in bytecode, EIP-712 domain state untouched, no reinitializer. Hard gate: identical forge inspect SavingCircles storage-layout between dev and this branch.
• Layer split — acceptance-criteria table mapping each item of Check issues regarding wallet connections on the app #99 to contract / app / Supabase; the contract stays the enforcement layer only.
• Execution path — implement + tests (unit, invariant handler, integration), layout check, then the upgrade scripts from 104-deploy-guardrails (commit 9f3de5f, not yet on dev) to execute ProxyAdmin.upgradeAndCall.

Implementation checklist

• removeMember + MemberRemoved event in SavingCircles and ISavingCircles
• Member-bound _INVITE_TYPEHASH / _hashInvite
• Update app/invites.tsx + app/invites.test.ts to the new typed data
• Unit tests (happy path incl. memberIndex fix-up; revert paths)
• Invariant handler action for removeMember
• Integration test: approve → redeem → remove → re-invite → start
• forge inspect storage-layout diff empty vs dev
• Merge/cherry-pick upgrade scripts from 104-deploy-guardrails

Coordinated release note: unredeemed old-format invite links stop validating at the upgrade (InvalidSigner), so the app-stacks change that signs member-bound invites ships in the same window.

[franrolotti]

Repeated. Closing in favour of #185