Atomically find or create a customer and upsert an external membership in one call. external_id is the source of truth: if it already exists, the customer that owns it is used, their first_name, last_name, birthdate (and sex, if sent) are updated from the request, and the membership is updated (200). Email and phone are never overwritten. If the external_id is on more than one customer → 409 with customer_ids. For a new external_id, matches on first_name + last_name + birthdate (+ email if provided), ignoring customers already linked to a different external_id: 1 match → creates the membership for that customer (201); 0 or 2+ matches → creates a new customer + membership (201). Concurrent requests for the same external_id are processed one at a time; if one waits too long → 503, retry. Status is automatically derived from expires_at: null/future → active, past → expired. Every save is recorded in the audit log (objectType = SIT_ExternalMembership).