Implement staging-only membership and free-event signup/cancellation

.github/lint-baseline.json

@@ -10,12 +10,12 @@
   "targets": [
     "src"
   ],
-  "scannedFileCount": 120,
+  "scannedFileCount": 124,
   "scannedFilesByExtension": {
     ".js": 12,
     ".jsx": 35,
-    ".ts": 43,
-    ".tsx": 30
+    ".ts": 45,
+    ".tsx": 32
   },
   "errorCount": 113,
   "warningCount": 6,
@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:b62532df877e1a1599273d0bdbf9876e75dae8be6e60ecadce601f854c283b6a",
+  "fingerprint": "sha256:314fc7ec13b35e59b8dfddedb5c8f7b4a82d02c368c81e991e7de0aa50d3245a",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -79,6 +79,8 @@
     "src/pages/admin/shop/AdminOrders.tsx",
     "src/pages/admin/shop/AdminProductEditor.tsx",
     "src/pages/admin/shop/AdminProducts.tsx",
+    "src/pages/community/Community.test.tsx",
+    "src/pages/community/Community.tsx",
     "src/pages/contact/Contact.jsx",
     "src/pages/events/EventCalendar.tsx",
     "src/pages/events/EventDetail.tsx",
@@ -122,6 +124,8 @@
     "src/services/accountEmail/accountEmailSender.ts",
     "src/services/analytics/analytics.test.ts",
     "src/services/analytics/analytics.ts",
+    "src/services/community/communityService.test.ts",
+    "src/services/community/communityService.ts",
     "src/services/events/adminService.ts",
     "src/services/events/eventsService.ts",
     "src/services/firebase/FirebaseResources.test.ts",

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**COMMUNITY-002 / #707:** one staging-only service/UI for pending membership requests/withdrawal, paid-term cancellation intent and free-event signup/cancellation. Dependencies: #701 hosted profiles/Auth/App Check, #705 approved paid-term policy and existing pure authority; paid activation/dues/production work stays separate. UID-only additive server collections, native identity/attestation, transaction/revision/saved-command safety and bounded reads; no payment, role, email, schedule, migration or production fallback. Officer impact: disposable staging review only. Officer documentation: STAGING_COMMUNITY plus entrypoints/maps/cost guide. Deployment evidence: source/emulator preparation only until native hosted acceptance is recorded. #114 and production launch remain open.
+
 **MEMBERS-CANCEL-001A / #705 (2026-10-11):** owner-approved cancellation retains membership access through the already-paid annual term and does not issue an automatic refund. Scope: versioned backend source policy, existing authority expiry/ownership/suspension regressions, and officer handoff. No cancellation endpoint, persistence, claim, Rule, IAM, website, provider or deployment change. #114 and hosted membership/event signup/cancellation remain open. Officer impact: the rule is recorded; no new member control is available. Officer documentation: entrypoint and Events/Shop/Members guide. Deployment evidence: source/local checks only until native issue records otherwise.
 
 **CI-001C4 / #701 (2026-10-11):** exactly `createMemberOnSignUp` and `ensureMemberProfile` were deployed to isolated engineering staging by protected run 38176811598 from `2843388`, with six exact-main checks and normal delegated daliu approval. Both native source archives match the reviewed bundle; Node 22/min0/max2/256 MB/30s and explicit runtime/build identities are verified. Genuine browser App Check/Auth, seven callable denials, signup, recovery, two concurrency cases, profile/claim preservation and background replay passed. Two owned test accounts/profiles were removed; Auth count0/empty collection metadata restored. No schema migration, real data, email, payment, website publication or production deployment. Officer impact: verified staging profiles and no administrator bypass. Officer documentation: low-cost procedure, maps and entrypoints updated. Deployment evidence: native issue and dated guide. #113/#133/#136 and broader core operations stay open.

IMPLEMENTATION_PLAN.md

@@ -15,6 +15,8 @@ RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) pr
 
 ## 1. Program outcome
 
+**#707 staging slice:** implement and test pending membership signup/withdrawal, paid-term cancellation intent and free-event signup/cancellation using one isolated service. No payment/privileged membership activation is prerequisite for these nonfinancial requests; those workflows remain separate. Fixed owner-approved staging release must verify exact merged source and all six main CI jobs, native source archive, explicit runtime/build identities and resource limits before staging Hosting. No production release is authorized.
+
 **Membership cancellation policy, 2026-10-11 — #705:** Dave approved retaining access until the already-paid annual term ends, without an automatic refund. Versioned backend source configuration and boundary regressions are a small dependency-clearing slice only. A member-owned durable cancellation request, retries/audit, UI and disposable hosted staging proof remain separate implementation work; do not route this request through legacy admin race cancellation or mark the membership ended early.
 
 MPRC can open a race or merchandise item for sale only when the platform can:

OFFICER_START_HERE.md

@@ -16,6 +16,8 @@ Attach the exact wording, public link, or approved photo when you have it. The A
 
 ## Choose the closest task
 
+**Staging membership/free events — #707:** one isolated service and screen are being prepared for pending membership signup/withdrawal, paid-term cancellation requests and free-event signup/cancellation. No paid membership activation or real payment is included. Hosted acceptance is not verified yet. Follow the [staging-only review](./docs/officers/STAGING_COMMUNITY.md); production remains **NOT AVAILABLE YET**.
+
 **Membership cancellation decision, 2026-10-11:** Dave approved keeping access through the already-paid annual term, without an automatic refund. [#705](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/705) records the rule and checks the existing term-end logic only. A member cancellation control is **NOT AVAILABLE YET**; do not edit a member record or use race cancellation as a workaround. See [the membership policy handoff](./docs/officers/EVENTS_SHOP_MEMBERS.md#membership-cancellation--policy-approved-not-available-yet).
 
 **Staging profiles verified, 2026-10-11:** [#701](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/701) deployed and tested exactly two profile Functions, using scoped identities, genuine browser App Check and made-up accounts. Signup, recovery, denied requests, retries and concurrency passed; both test accounts/profiles were removed. With Dave's delegated decision, administrator bypass is disabled for production/backend-staging; normal self-approval remains. Original read-only staging is unchanged. Follow [the dated staging proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). Production, membership, registration and payments are not launched; no officer handles a key or member record.

OPERATIONS_RUNBOOK.md

@@ -828,6 +828,8 @@ The current protected release plan names only the profile-recovery Functions. It
 
 ## 9. Staging dress rehearsal
 
+For #707, only the club owner may use the fixed `scripts/staging-community-release.js` after reviewed exact-main source/six successful jobs. It deploys one isolated Function through the existing explicit builder, with a separate four-permission runtime and native archive/resource readback. This is a separately approved staging owner route, not a widening of the protected profile workflow or a reusable production release. The profile path may inspect the one known community service but still deploys only its original pair. The specialist supplies/removes UID-only synthetic fixtures, tests actual Auth/App Check plus retry/ownership/capacity/term-boundary behavior, then records staged Hosting and cleanup evidence. Officers use [the no-terminal staging review](./docs/officers/STAGING_COMMUNITY.md). Never run against production or a payment provider; future release cleanup/rollback uses a separate reviewed owner action, not direct member edits.
+
 For future membership cancellation acceptance, use a disposable account and a synthetic approved term. Prove access remains just before the original term end and is denied at/after it; the term and payment evidence must not change. Also prove ownership denials, repeated/lost-response recovery, and that suspension is not undone. #705 currently supplies only the approved policy and existing-authority unit regressions, not the cancellation request or hosted proof. Do not test with production members or real payments.
 
 Before every major payment release:

SECURITY.md

@@ -8,6 +8,8 @@ This is both the repository security policy and the current engineering risk reg
 
 ## 1. Production readiness decision
 
+**#707 isolated staging boundary:** one new service requires native Auth/App Check and an exact caller-account match; mutations also require verified email. It accepts closed bounded inputs and server-owned free-event/waiver/capacity state, saves command results transactionally and fences stale revisions. Browser access to new collections remains denied, including admins. The separate staging runtime has only transaction/get/create/update Firestore permissions; IAM is project-scoped, not collection-scoped. It has no Auth mutation, delete, secret, key, payment or mail permission. No claims, real membership/payment data, production fallback, raw error/body logging or legacy schema migration. Existing two profile Functions and their runtime IAM are unchanged. Hosted enforcement must be separately verified before claiming this source is live.
+
 The public informational website can continue operating with normal care. **Live race or merchandise payments should remain disabled until every P0 launch blocker below is closed and verified in a staging dress rehearsal.** The existing payment implementation is a useful prototype, but several correctness defects could mark unpaid transactions paid, lose payment callbacks, oversell race capacity, fail to reconcile late-payment links, or allow overly broad administrative access.
 
 ### Runtime prerequisite — source only, 2026-09-27

STRIPE_COMMERCE_DESIGN.md

@@ -8,6 +8,8 @@ This document defines how MPRC should configure Stripe and how race-registration
 
 ## 1. Launch status
 
+**#707 exception is nonfinancial staging only:** pending membership requests and zero-price free-event registrations use a separate service/collections, never `createCheckoutSession`, legacy admin cancellation, Stripe, mail or payment state. Free registrations store `paymentStatus=not_required`, never paid/comp money evidence. Approved membership cancellation does not trigger a refund or alter a term. All live-payment blockers below remain unchanged.
+
 **Do not enable or advertise live checkout yet.** The initial 2026-07-12 assessment found unsafe payment confirmation, no Event-ID ledger, enabled unmodeled promotions, and callback loss. Repository safety slices now validate paid/amount/currency/mode/explicit livemode, reject unapproved adjustments, deduplicate Events, protect terminal/refund state, and preserve callbacks. PAY-003A [#101](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/101) is merged source; PROMO-001 [#102](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/102) supplies the adjustment guard and exact tests. Neither statement is deployment, provider, or live-behavior evidence, and these slices do not close the payment architecture. These residual conditions still prevent safe production use:
 
 - Checkout creation lacks validated fail-closed environment configuration, command idempotency, a persistence-first saga, and the canonical versioned state/schema contract.

SYSTEM_DESIGN.md

@@ -10,6 +10,8 @@ The repository already contains a substantial prototype: a public React site, Fi
 
 ## 1. Goals and non-goals
 
+**Isolated nonfinancial lifecycle — #707, source prepared:** `communityOnly.js` exports only `communityActions`, outside the prototype index. Native Auth/App Check, exact account binding and verified email protect mutations. UID-only pending membership requests never grant dues/roles; cancellation preserves an approved synthetic authority record and its original expiry. Server-owned zero-price events/waiver snapshots and UID registrations share one capacity transaction. Per-account command results/revision fences prevent old cancellation retries changing a later signup. New `communityMemberships`, `communityEvents`, `communityCommands`, `communityLimits` and `communityConfig` collections are server-only; no migration or legacy commerce adoption. A separate runtime has exactly Firestore transaction/get/create/update permissions at staging-project scope. UI and server fail closed outside staging. The existing pure authority is now consumed only by this isolated staging service; earlier unused-runtime statements below remain historical outside this scope. No role/dues activation, Stripe/mail, officer admin endpoint, schedule or production release is included. Hosted acceptance remains unverified; see the [officer staging guide](./docs/officers/STAGING_COMMUNITY.md).
+
 **Engineering staging checkpoint, 2026-10-11 — #701:** only signup-profile creation and profile recovery are hosted and verified on Node 22. A profile-only entrypoint, explicit runtime/build accounts, scoped IAM and protected keyless deployment exclude commerce/mail/directory/Strava and website publication. Actual source archives/resource limits, genuine App Check/Auth, synthetic signup/recovery/denials/retries/concurrency and owned cleanup passed. Auth count returned to zero; no migration or production data/payment change. This supersedes source-only runtime/profile wording below only for isolated staging, not production or the target commerce platform. See the [dated officer map](./docs/officers/SYSTEM_MAPS.md#scoped-engineering-profile-release--701) and [acceptance proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701).
 
 ### Community-first cost direction — 2026-09-11

docs/officers/EVENTS_SHOP_MEMBERS.md

@@ -12,6 +12,8 @@ There is currently no proven no-code switch that safely stops all new Stripe pay
 
 ## Membership cancellation — POLICY APPROVED, NOT AVAILABLE YET
 
+[#707](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/707) prepares the separate [staging-only request and free-event review](./STAGING_COMMUNITY.md). This does not launch production membership, grant a paid term, or repair paid race cancellation. Hosted evidence is still required.
+
 Dave approved this rule on October 11, 2026: cancelling membership keeps access through the already-paid annual term. Cancellation does not issue a refund. It does not extend the term or restore suspended access. Refunds and race cancellation remain separate.
 
 There is no new member cancellation button or officer procedure from [#705](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/705). Its versioned rule and local tests do not prove a hosted workflow. Do not edit membership dates, mark a term ended, issue a refund, or use an admin race action as a workaround. Ask Dave, the sole release owner, for the separately reviewed request workflow and disposable staging proof before using it. A specialist is still needed to build and release that workflow; an officer needs no terminal, source edit, secret or member record to review this decision.

docs/officers/LOW_COST_COMMUNITY.md

@@ -8,6 +8,8 @@
 
 ## What we are prioritizing
 
+[#707](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/707) adds one staging-only nonfinancial service, with the same min0/max2/256MB/30s limits and no polling, mail worker, subscription or scheduled job. Existing profile IAM stays unchanged; the new runtime has four Firestore permissions at staging-project scope. See the [staging scope, proof and recovery guide](./STAGING_COMMUNITY.md). This source preparation is not deployment proof or a cost guarantee.
+
 - Clear information about regular runs, meeting places, joining, and contacts.
 - A useful events/calendar experience on phones as well as computers.
 - Public information without requiring an account.

docs/officers/README.md

@@ -33,6 +33,8 @@ In words: approve the merge, request one exact release, and approve its protecte
 
 ## Short guides
 
+For the isolated membership/free-event staging test, use [Staging community actions](./STAGING_COMMUNITY.md). Its status distinguishes source preparation from hosted proof; it is not a production procedure.
+
 **Staging profiles verified, #701:** two scoped Node 22 Functions passed protected deployment, genuine browser App Check/Auth, signup, recovery, negative requests, retries and concurrency. Only made-up accounts/profiles were used and then removed. Administrator bypass is disabled for production/backend-staging; Dave/main and normal self-approval remain. Read [the dated proof and procedure](./LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). Existing read-only reviewers gain no deployment access; production data/payments and website publication are unchanged. Membership and registrations remain unavailable.
 
 1. [Request a change](./REQUEST_A_CHANGE.md)