daliu · Aug 13, 2026 · Aug 13, 2026
diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -28,7 +28,7 @@ MPRC can open a race or merchandise item for sale only when the platform can:
 3. Schema changes are additive first. Backfills are idempotent, dry-runnable, and report counts/anomalies.
 4. Backend/rules/indexes deploy before dependent clients. Legacy reads remain until migration evidence is complete.
 5. No issue requires production secrets for development or CI.
-6. Live-mode enabling is a separate protected operation. #135 supplies a manual, exact-commit, backend-first source gate and pauses ordinary Git-triggered Netlify production builds. WEB-UX-001A [#457](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/457) used one temporary web-only exception that required one exact `main` parent and independently verified one pinned source commit/tree. An overbroad WEB-002A attempt was rolled back on 2026-08-01; bounded replacement [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) then published only the static Shop and fixed Events/Calendar failure messages as exact deploy `6a6dc9ea588b0c0008036312`. Its public marker and page checks passed, and its temporary manifest is inactive again. This does not restore event records. Neither exception authorizes Firebase, commerce, or a reusable release path. Protected environment/OIDC configuration, staged/live proof, fail-closed lint, required checks, and a protected live-Netlify path remain open under #105/#133/#136/WEB-001.
+6. Live-mode enabling is a separate protected operation. #135 supplies a manual, exact-commit, backend-first source gate and pauses ordinary Git-triggered Netlify production builds. WEB-UX-001A [#457](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/457) used one temporary web-only exception that required one exact `main` parent and independently verified one pinned source commit/tree. An overbroad WEB-002A attempt was rolled back on 2026-08-01; bounded replacement [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) then published only the static Shop and fixed Events/Calendar failure messages as exact deploy `6a6dc9ea588b0c0008036312` from source `39ab8649df411262c8109a3c81a57bc38f1e168b`. Its public marker and page checks passed, and its temporary manifest became inactive again. WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) is now an active one-shot under review for one frozen inert member-directory interface artifact: source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, tree `411aa6ec9a9459f5d923030533ffc7c007fe6908`, 62 files, digest `d837272a1e5efc1575809e87f532276b38d1a63f1dd79ec1aef0533f6da8afb1`, and expected first parent `019353361210021483f23003e09ee6924b78e67c`. Until exact preview, merge, signed-out production readback, and immediate repause pass, #473 remains production and its deploy is the rollback target. #623 does not restore event records or authorize Firebase, providers, sign-in, production data, connected directory behavior, commerce, or a reusable release path. Protected environment/OIDC configuration, staged/live proof, fail-closed lint, required checks, and a protected live-Netlify path remain open under #105/#133/#136/WEB-001.
 7. A provider Console setting is not complete until its non-secret configuration and verification evidence are recorded privately.
 8. Security controls fail closed in hosted environments and remain developer-friendly only in explicit local/CI environments.
 9. Do not trade payment integrity for UI responsiveness. Confirmation may say “processing”; it must not guess “paid.”
@@ -169,7 +169,7 @@ Exit gate:
 - Payment SLOs, structured redacted logs, and actionable alerts are live.
 - Backup restoration into isolated infrastructure succeeds and is documented.
 
-**Current optional-directory boundary:** Parent [#504](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/504) defines a private, opt-in officer people finder as name search with voluntary thumbnails—not facial recognition. MEMBERS-DIRECTORY-001A [#505](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/505) owns the signed-in person's server-only processed thumbnail and independent default-off preference. MEMBERS-DIRECTORY-001B [#506](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/506) adds source for the minimum server-only projection, current-state reconciler, bounded verified-admin name-prefix callable, query-free audit, and separate `/admin/member-directory` gallery. It returns at most 24 current opted-in display-name/optional-thumbnail cards and has no image query, facial recognition, cursor, total, export, or membership authority. MEMBERS-DIRECTORY-001D [#621](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/621) makes the shipped frontend boundary default unavailable: My Account and the guarded officer route show only visibly described, disabled layouts and perform zero directory reads, uploads, searches, saves, request-ID creation, or service calls. [#507](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/507) still owns #110 policy completion, scoped authorization, #133 protected authority, isolated staging, required backend/index deployment and readback, and a later separately reviewed source flip before connected website publication and live proof. Do not reuse the current browser-side full-account filter or describe a disabled preview or #505/#506 source as an available directory.
+**Current optional-directory boundary:** Parent [#504](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/504) defines a private, opt-in officer people finder as name search with voluntary thumbnails—not facial recognition. MEMBERS-DIRECTORY-001A [#505](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/505) owns the signed-in person's server-only processed thumbnail and independent default-off preference. MEMBERS-DIRECTORY-001B [#506](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/506) adds source for the minimum server-only projection, current-state reconciler, bounded verified-admin name-prefix callable, query-free audit, and separate `/admin/member-directory` gallery. It returns at most 24 current opted-in display-name/optional-thumbnail cards and has no image query, facial recognition, cursor, total, export, or membership authority. MEMBERS-DIRECTORY-001D [#621](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/621) makes the shipped frontend boundary default unavailable: My Account and the guarded officer route show only visibly described, disabled layouts and perform zero directory reads, uploads, searches, saves, request-ID creation, or service calls. #623 freezes that inert interface over the current live source for one bounded Netlify release, but it is under review and not published. Protected layout proof remains synthetic; signed-out public proof, if publication later passes, is limited to revision and guard readback plus the absence of a directory request. [#507](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/507) still owns #110 policy completion, scoped authorization, #133 protected authority, isolated staging, required backend/index deployment and readback, and a later separately reviewed source flip before connected website publication and live proof. Do not reuse the current browser-side full-account filter or describe a disabled preview, #623 release candidate, or #505/#506 source as an available directory.
 
 ### Phase 5 — End-to-end qualification
 

diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
@@ -46,8 +46,8 @@ Use the club's approved password manager for access. Share only a public link or
 - **Website live:** Did Netlify identify that commit, and was the exact change then seen on [runmprc.com](https://runmprc.com)?
 - **Outside service verified:** If Stripe, Netlify, DNS, Google, or email changed, was that service checked separately?
 
-As of **2026-08-01**, a merge runs checks but does not start the GitHub release. The protected release is **NOT AVAILABLE YET** until its short-lived cloud identity and named environment approvers are configured under issue #133. Ordinary Git-triggered Netlify production builds are paused. An overbroad #473 web artifact was published and immediately rolled back. The bounded replacement is now live as Netlify deploy `6a6dc9ea588b0c0008036312`: Shop is the static in-person catalog, while Events and Calendar show a fixed retry-later notice instead of a raw provider error. Event records are still unavailable because no Firebase repair was deployed. The temporary release manifest is inactive again. This does not change sign-in, expose protected event offers, add officer editing, or make commerce safe. GitHub Pages still reports `runmprc.com` as its custom domain even though Netlify serves that name; source removal is not provider proof. A green test or workflow does **not** by itself prove that GitHub Pages, `runmprc.com`, Firebase, or that domain setting changed.
+As of **2026-08-13**, a merge runs checks but does not start the GitHub release. The protected release is **NOT AVAILABLE YET** until its short-lived cloud identity and named environment approvers are configured under issue #133. Ordinary Git-triggered Netlify production builds are paused. An overbroad #473 web artifact was published and immediately rolled back. The bounded replacement is still live as Netlify deploy `6a6dc9ea588b0c0008036312` from source `39ab8649df411262c8109a3c81a57bc38f1e168b`: Shop is the static in-person catalog, while Events and Calendar show a fixed retry-later notice instead of a raw provider error. Event records are still unavailable because no Firebase repair was deployed. #623 is a separate one-shot release under review for a frozen inert member-directory interface. It has not published or been verified, and the current #473 deploy is its rollback target. This does not change sign-in, expose protected event offers, add officer editing, or make commerce safe. GitHub Pages still reports `runmprc.com` as its custom domain even though Netlify serves that name; source removal is not provider proof. A green test or workflow does **not** by itself prove that GitHub Pages, `runmprc.com`, Firebase, or that domain setting changed.
 
-The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. Officers inspect those protected disabled layouts only in synthetic local artifacts. After publication, signed-out public review proves only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not choose a real photo, enter a real name, or treat the preview as a directory. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
+The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend source default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. #623 freezes that interface over the current live source for one exact release, but the release is still under review and production still serves #473. Officers inspect the protected disabled layouts only in synthetic local artifacts. If #623 later publishes, signed-out public review proves only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not sign in to production, choose a real photo, enter a real name, or treat the preview as a directory. #623 changes no Firebase, provider, account, sign-in, or production data. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
 
 For the concise handbook, see [OFFICER_HANDBOOK.md](./OFFICER_HANDBOOK.md). The expanded task index is [docs/officers/README.md](./docs/officers/README.md).
diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -689,6 +689,8 @@ Post-release control result: safety merge `04d6d2cd88dda0e6ec7e2b6a71514e6ce2e4d
 
 WEB-002A [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) completed its bounded web-only permissions containment on 2026-08-01. Exact two-parent merge `9ad6837756cdd409d296009fde5082eeeae5c059` published Netlify deploy `6a6dc9ea588b0c0008036312` from frozen source `39ab8649df411262c8109a3c81a57bc38f1e168b`, tree `d76b496cdc5e79015bc048cb961758abbe88b9ce`, 60 files, and digest `07b10c7d5ff176a1ad893d7549b07042312df35f4a4126e8765824ca94eaefb8`. Preview and live marker/header/robots/deep-route checks passed. Signed-out Shop, Events, Calendar, and Account checks passed; Shop shows the approved static catalog, and Events/Calendar show only the fixed retry-later notice. Final control merge `cb6a8f0a418fc14b448bce5ded71d68520415c92` made the temporary manifest inactive; Netlify attempt `6a6dcdd47bc81e000859a249` stopped unpublished, exact-main CI run `30696264830` passed all five jobs, and provider plus public-marker readback left deploy `6a6dc9ea588b0c0008036312` live. Both temporary release-source refs are absent; exact rollback source `ed1b0833f25822cee80c99ded8753722b5608a3f` remains. This did not restore event records or deploy Firebase, Rules, Functions, provider configuration, account state, protected offers, officer editing, ledger, or production data. Keep rollback deploy `6a6dc219a8136300081811db` as dated incident evidence.
 
+WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) is an active one-shot Netlify release under review, not a completed publication. Its only frontend input is frozen inert source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, tree `411aa6ec9a9459f5d923030533ffc7c007fe6908`, built as 62 files with digest `d837272a1e5efc1575809e87f532276b38d1a63f1dd79ec1aef0533f6da8afb1`. The release control expects exact first parent `019353361210021483f23003e09ee6924b78e67c`. Until its pinned preview, exact two-parent merge, production marker, signed-out route/network checks, and immediate repause all pass, production remains #473 deploy `6a6dc9ea588b0c0008036312` from source `39ab8649df411262c8109a3c81a57bc38f1e168b`; that same deploy is #623's rollback target. Protected Account and administrator layouts are proved only with synthetic local artifacts. Production checks must stay signed out and can prove only the exact revision, normal sign-in and administrator guards, and absence of a member-directory request. Stop for any source, tree, count, digest, parent, marker, route, network, or repause mismatch. #623 has no authority for Firebase, Rules, Functions, indexes, outside-provider configuration, account/sign-in changes, real names/photos, or production data. Connected behavior remains **NOT AVAILABLE YET** under [#507](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/507). Follow the pending procedure in `docs/officers/PUBLISH_AND_CHECK.md`; do not reuse it as a general release button.
+
 Incident record: on 2026-08-01, overbroad source `094af1096ed8721597561cd59bf695d4c4a9d210` was published by merge `40728ff6141e34a279b70cc41d983c22ac5f0daa` as deploy `6a6dc0167fbe68000816b448` after a release-blocker comment. Exact rollback merge `1099ee8e6fdb81141fd9460de175b6d854cbcfdd` published deploy `6a6dc219a8136300081811db`, restoring source `ed1b0833`, tree `878c6628d961f4484cb49208aef53f1e9f2e3b47`, 60 files, and digest `7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092`. Safety merge `dee79511b6e371329aa129139729e112e7a51aad` re-paused the manifest; its Netlify attempt `6a6dc35767a4ef000877e74b` did not publish, and provider readback left the rollback deploy live. The overbroad release ref was deleted and verified absent. This incident changed no Firebase, outside-provider configuration, account, payment, or production data.
 
 ### Production approvals