diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
index 767fe4b..b9b0717 100644
--- a/GITHUB_ISSUES.md
+++ b/GITHUB_ISSUES.md
@@ -1,6 +1,6 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
-**COMMUNITY-003 / #711, core staging verified 2026-10-11; recovery/handoff open:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified. #711/#114/#115/AUTH-003/ADMIN-001 remain open.
+**COMMUNITY-003 / #711, staging recovery and handoff verified 2026-10-12:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Natural expiry, denied old session, fresh native TOTP/App Check recovery, actual UI restoration, final no-terminal handoff and exact owned cleanup passed on 2026-10-12. #711 has its final bounded staging acceptance; #114/#115/AUTH-003/ADMIN-001 and ordinary production access remain separate and open.
 
 **COMMUNITY-002 / #707:** one staging-only service/UI for pending membership requests/withdrawal, paid-term cancellation intent and free-event signup/cancellation. Dependencies: #701 hosted profiles/Auth/App Check, #705 approved paid-term policy and existing pure authority; paid activation/dues/production work stays separate. UID-only additive server collections, native identity/attestation, transaction/revision/saved-command safety and bounded reads; no payment, role, email, schedule, migration or production fallback. Officer impact: disposable staging review only. Officer documentation: STAGING_COMMUNITY plus entrypoints/maps/cost guide. Deployment evidence: version1 native archive/spec/IAM, website60435c8,38 genuine hosted checks and all four page actions verified on 2026-10-11; #707 records final website/visual/cleanup proof. #114 and production launch remain open.
 
diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
index 3690f05..1a4b035 100644
--- a/IMPLEMENTATION_PLAN.md
+++ b/IMPLEMENTATION_PLAN.md
@@ -109,7 +109,7 @@ Parallel work is safe only across branches that do not share schemas or security
 
 ## 4. Phases and exit gates
 
-**Bounded community slice — #711, core staging verified 2026-10-11; recovery/handoff open:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified; do not close the issue or advertise ordinary officer access.
+**Bounded community slice — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser attestation, cleared/restored privileged UI and the no-terminal handoff passed on 2026-10-12. Record the final dated acceptance and documentation merge before closing #711. Ordinary officer access and production are not available.
 
 ### Phase 0 — Stop accidental harm and establish a trustworthy baseline
 
diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
index a60168a..26a54a5 100644
--- a/OFFICER_START_HERE.md
+++ b/OFFICER_START_HERE.md
@@ -16,7 +16,7 @@ Attach the exact wording, public link, or approved photo when you have it. The A
 
 ## Choose the closest task
 
-**Officer staging controls — #711, core checks verified 2026-10-11; recovery/handoff open:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open) only with new specialist-supplied disposable fixtures. Fresh sign-in recovery after the ten-minute limit and final handoff are unverified; ordinary officer access is **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched.
+**Officer staging controls — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified) only with new specialist-supplied disposable fixtures. After the ten-minute limit, sign out and sign in again with a fresh authenticator code; this recovery and the no-terminal handoff passed on 2026-10-12. A denied refresh hides the protected sections. Ordinary officer access and recovery without the authenticator are **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched.
 
 **Staging membership/free events — #707:** one isolated service and screen passed hosted pending membership signup/withdrawal, synthetic paid-term cancellation and free-event signup/cancellation checks on 2026-10-11. No paid membership activation or real payment is included. Follow the [staging-only review](./docs/officers/STAGING_COMMUNITY.md); ask the specialist for disposable fixtures. The issue records the current website, visual review and cleanup; production remains **NOT AVAILABLE YET**.
 
diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
index 65583bd..4495bf1 100644
--- a/OPERATIONS_RUNBOOK.md
+++ b/OPERATIONS_RUNBOOK.md
@@ -8,7 +8,7 @@ This runbook explains how to operate the website, Firebase services, and Stripe
 
 Club officers and backup maintainers should start with [OFFICER_START_HERE.md](./OFFICER_START_HERE.md). It converts this technical runbook into short request, approval, verification, access, and emergency steps without terminal commands.
 
-**#711 officer community release — core staging verified 2026-10-11; recovery/handoff open:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Fresh-after-expiry sign-in recovery and final officer handoff are not verified; ordinary officer access and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer.
+**#711 officer community release — staging recovery and handoff verified 2026-10-12:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser App Check and final no-terminal handoff passed on 2026-10-12. Ordinary officer access, lost-authenticator recovery and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer.
 
 ### Node 22 profile release prerequisite — hosted behavior NOT AVAILABLE YET
 
diff --git a/SECURITY.md b/SECURITY.md
index 655697c..cfd8685 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -250,7 +250,7 @@ This is source-only attack-surface reduction. The component had no runtime route
 
 ### Authorization
 
-**#711 synthetic staging boundary (core hosted proof 2026-10-11; recovery/handoff open):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Fresh-after-expiry sign-in recovery and final no-terminal handoff are not verified. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.
+**#711 synthetic staging boundary (hosted proof and expired-session recovery verified 2026-10-12):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Natural expiry, cleared privileged UI and fresh native TOTP sign-in recovery passed on 2026-10-12, with independently renewed genuine browser App Check and native server acceptance. The no-terminal handoff and exact disposable cleanup passed; this is not lost-authenticator recovery or ordinary production access. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.
 
 - Server code and Firestore rules check signed token capabilities; the UI is never the enforcement point.
 - Separate catalog/content editing from financial state, identity administration, exports, and secrets.
diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md
index 925eac7..e2321f9 100644
--- a/SYSTEM_DESIGN.md
+++ b/SYSTEM_DESIGN.md
@@ -10,7 +10,7 @@ The repository already contains a substantial prototype: a public React site, Fi
 
 ## 1. Goals and non-goals
 
-**Staging officer extension — #711, core hosted checks verified 2026-10-11; recovery/handoff open:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Function version 2 and Hosting source `57261ae`, native Auth/App Check/MFA, capability/race/retry/phone/offline/real-clock expiry and owned cleanup are recorded in #711 and the [staging guide](./docs/officers/STAGING_COMMUNITY.md). Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified; production is NOT AVAILABLE YET.
+**Staging officer extension — #711, hosted checks and expired-session recovery verified 2026-10-12:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Function version 2 and Hosting source `57261ae`, native Auth/App Check/MFA, capability/race/retry/phone/offline/real-clock expiry and owned cleanup are recorded in #711 and the [staging guide](./docs/officers/STAGING_COMMUNITY.md). On 2026-10-12, natural ten-minute expiry denied the unchanged session; sign-out and fresh native TOTP sign-in restored the actual officer view, and a new genuine native App Check token passed the same server boundary. The no-terminal handoff and exact disposable cleanup passed. This is supervised synthetic staging only; ordinary officer access, lost-authenticator recovery and production are NOT AVAILABLE YET.
 
 **Isolated nonfinancial lifecycle — #707, staging only:** `communityOnly.js` exports only `communityActions`, outside the prototype index. Native Auth/App Check, exact account binding and verified email protect mutations. UID-only pending membership requests never grant dues/roles; cancellation preserves an approved synthetic authority record and its original expiry. Server-owned zero-price events/waiver snapshots and UID registrations share one capacity transaction. Per-account command results/revision fences prevent old cancellation retries changing a later signup. New `communityMemberships`, `communityEvents`, `communityCommands`, `communityLimits` and `communityConfig` collections are server-only; no migration or legacy commerce adoption. The first release's separate runtime had exactly Firestore transaction/get/create/update permissions at staging-project scope; #711 adds only list and read-only Auth lookup as described above. UI and server fail closed outside staging. The existing pure authority is now consumed only by this isolated staging service; earlier unused-runtime statements below remain historical outside this scope. This original slice included no role/dues activation, Stripe/mail, officer admin endpoint, schedule or production release. First native hosted acceptance was verified on 2026-10-11; see the [officer staging guide](./docs/officers/STAGING_COMMUNITY.md) and #707 for current website/cleanup proof, not production availability.
 
diff --git a/docs/officers/README.md b/docs/officers/README.md
index c4321af..d256b65 100644
--- a/docs/officers/README.md
+++ b/docs/officers/README.md
@@ -33,7 +33,7 @@ In words: approve the merge, request one exact release, and approve its protecte
 
 ## Short guides
 
-Core staging officer approval/free-event management checks passed on 2026-10-11 under [#711](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711). Fresh sign-in recovery after expiry and final handoff remain unverified. Follow the [supervised staging checklist](./STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open) only with new specialist-supplied disposable fixtures; ordinary officer access, real dues and production remain **NOT AVAILABLE YET**.
+Core staging officer approval/free-event management checks passed on 2026-10-11 under [#711](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711). Expired-session recovery and the no-terminal handoff passed on 2026-10-12: sign out, sign in again and enter a fresh authenticator code. Follow the [supervised staging checklist](./STAGING_COMMUNITY.md#officer-review--711-staging-verified) only with new specialist-supplied disposable fixtures; ordinary officer access, real dues and production remain **NOT AVAILABLE YET**.
 
 For the isolated membership/free-event staging test, use [Staging community actions](./STAGING_COMMUNITY.md). Its status distinguishes source preparation from hosted proof; it is not a production procedure.
 
diff --git a/docs/officers/STAGING_COMMUNITY.md b/docs/officers/STAGING_COMMUNITY.md
index 981065c..8e3d8ad 100644
--- a/docs/officers/STAGING_COMMUNITY.md
+++ b/docs/officers/STAGING_COMMUNITY.md
@@ -53,15 +53,17 @@ The specialist's Hosting release uses Dave's existing club login for a short-liv
 
 <a id="officer-review--711-source-prepared-not-available-yet"></a>
 
-## Officer review — #711 staging verified; recovery and handoff open
+<a id="officer-review--711-staging-verified-recovery-and-handoff-open"></a>
 
-**Status checked 2026-10-11:** core hosted staging checks passed. [#711's dated acceptance receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215) records native authenticator sign-in, approval/event actions, denied requests, retries, booking races, phone/offline behavior and natural ten-minute sign-in expiry. Fresh sign-in recovery after that expiry and the final no-terminal handoff remain **NOT AVAILABLE YET / unverified**. #711 stays open. Production and real dues are not available.
+## Officer review — #711 staging verified
+
+**Status checked 2026-10-12:** core hosted staging checks, expired-session recovery and the no-terminal handoff passed. [#711's original acceptance receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215) records native authenticator sign-in, approval/event actions, denied requests, retries, booking races, phone/offline behavior and natural ten-minute sign-in expiry. The [October 12 recovery and cleanup receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6129376616) records the unchanged officer session naturally expiring, a denied refresh hiding both protected sections, and sign-out/fresh authenticator sign-in restoring them. A newly requested genuine browser App Check token also passed the native server check with fresh TOTP Auth. This is not recovery without an authenticator. Production and real dues are not available.
 
 **Release proof:** the Function and staging website were verified from `57261aed111976718ba8c04515e38394e4e0d2c8`. The community Function is version 2. Its 85,371-byte downloaded archive matched SHA-256 `d71690088e6ca8f5ac29cf9a0179ec17fe2d39b2e126a7776b657ffe5b699ab2`. The release command reported an unexplained failure despite completed provider deployment; independent archive/resource checks, Hosting's source gate and later read-only postchecks passed. Do not treat that command as a successful release or redeploy unchanged code to hide the error. All owned test accounts and records were removed, temporary local access was turned off and the test receiver was closed. New fixtures are needed for another review. These dated proofs do not publish `runmprc.com` or verify production behavior.
 
 **Purpose:** review synthetic membership approval and free-event management. These controls are not a real dues procedure. Dave selected externally confirmed dues for later work; no real payment method, annual plan, term or confirmation authority has been chosen here.
 
-**Approver:** Dave, sole staging/recovery owner. **Prerequisites for a supervised staging review:** the specialist supplies an explicitly disposable verified officer account, authenticator setup, expiring approval/event permission and a short server-configured synthetic term. It is not an ordinary browser admin role. No officer changes permissions, source or records directly. A Google Cloud or Gmail login is not a website test account; do not enter your Gmail password here. Do not rely on the unfinished recovery procedure for ordinary officer access.
+**Approver:** Dave, sole staging/recovery owner. **Prerequisites for a supervised staging review:** the specialist supplies an explicitly disposable verified officer account, authenticator setup, expiring approval/event permission and a short server-configured synthetic term. It is not an ordinary browser admin role. No officer changes permissions, source or records directly. A Google Cloud or Gmail login is not a website test account; do not enter your Gmail password here. Ordinary officer access and recovery without the authenticator remain **NOT AVAILABLE YET**.
 
 1. Open the supplied staging `/community/admin` link.
 2. Confirm **Staging test only** and the staging address.
@@ -83,14 +85,26 @@ The specialist's Hosting release uses Dave's existing club login for a short-liv
 18. Confirm the booked member can still cancel their own signup and release the place.
 19. Use **Retry saved action** for an uncertain result; do not repeatedly create new requests.
 20. Use **Refresh officer status** to read current state. A successful refresh clears the saved request before a new action.
-21. Stop if ten minutes pass or access is denied, and ask the specialist to end the review. Fresh sign-in recovery still needs its own verified test.
+21. If access is denied after ten minutes, follow **Recover an expired officer session** below. Do not repeatedly submit saved actions.
 22. Sign out at the end and ask the specialist to remove all owned fixtures.
 
 **Expected result:** one nonfinancial test approval and coherent free-event changes/counts. Editing booked event content is blocked. A cancelled event cannot reopen. At most twenty configured events are supported; old event archival is not included. Pending review shows twenty opaque test account IDs per page, no profiles/emails or export.
 
 **Stop:** production address, real data/dues, payment, absent authenticator gate, permission unexpectedly surviving revocation, lost bookings, stale result, or a request to edit records/share secrets. Tell Dave privately.
 
-**Proof:** #711 records exact source/CI/merge, native archive/resource/runtime checks, optional authenticator setup and unchanged sign-in/domain settings. Auth and Firestore App Check remain enforced. Hosted evidence covers both permission types, denied target verification, approval/withdrawal and capacity/closure races, immutable retries, expiry/revocation, actual phone/offline screens and exact disposable cleanup. Remaining acceptance is fresh sign-in recovery with new native attestation, followed by review of these steps without a terminal. Test enrollment, permission setup and cleanup remain specialist-only; they are not officer self-service.
+**Proof:** #711 records exact source/CI/merge, native archive/resource/runtime checks, optional authenticator setup and unchanged sign-in/domain settings. Auth and Firestore App Check remain enforced. Hosted evidence covers both permission types, denied target verification, approval/withdrawal and capacity/closure races, immutable retries, expiry/revocation, actual phone/offline screens and exact disposable cleanup. October 12 additionally verified real-clock expiry, denied/cleared privileged UI, fresh native TOTP sign-in, renewed genuine browser attestation, restored officer sections and the no-terminal handoff. Test enrollment, permission setup and cleanup remain specialist-only; they are not officer self-service.
+
+### Recover an expired officer session
+
+**Purpose:** renew a supervised staging officer sign-in after its ten-minute limit. **Approver:** Dave. **Prerequisites:** the same disposable account, its working authenticator and a still-enabled, unexpired specialist-supplied permission.
+
+1. Select **Sign out**.
+2. Sign in again on the staging officer page with the same disposable account.
+3. Enter a fresh authenticator code.
+4. Confirm the permitted membership/event sections return.
+5. If access is still denied or your authenticator is unavailable, stop and contact Dave/platform specialist privately. Do not change permissions or share passwords, codes or tokens.
+
+**Expected result / success proof:** the page restores only the sections permitted by the current capability. The specialist records genuine fresh sign-in and native attestation acceptance; a browser message alone is not proof. **Undo:** sign out and stop the review. **Escalation:** Dave/platform specialist. This does not reset a lost authenticator or grant access after permission expiry/revocation.
 
 **Undo:** stop testing. Ask Dave/specialist to disable the staged capability first and verify old requests are denied, then use the reviewed staged rollback if needed. Do not try to reopen a cancelled event or change membership/payment evidence yourself. **Escalation:** Dave/platform specialist for access, deployment, uncertain results or recovery.
 
diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md
index deaa164..22a8334 100644
--- a/docs/officers/SYSTEM_MAPS.md
+++ b/docs/officers/SYSTEM_MAPS.md
@@ -4,12 +4,15 @@ These diagrams show where pages, information, and deployments go. Each diagram i
 
 ## Staging community lifecycle — #707, first hosted release verified 2026-10-11
 
-Core hosted staging checks for the #711 officer extension below passed on 2026-10-11. Function version 2 and Hosting source `57261ae` are recorded in the [staging guide](./STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open). Fresh sign-in recovery after expiry and final handoff remain unverified; ordinary officer access and production are **NOT AVAILABLE YET**.
+Core hosted staging checks for the #711 officer extension below passed on 2026-10-11. Function version 2 and Hosting source `57261ae` are recorded in the [staging guide](./STAGING_COMMUNITY.md#officer-review--711-staging-verified). Expired-session recovery and the no-terminal handoff passed on 2026-10-12; ordinary officer access, lost-authenticator recovery and production are **NOT AVAILABLE YET**.
 
 ```mermaid
 flowchart LR
-    Officer["/community/admin; core staging verified; recovery open"] --> MFA["Verified recent authenticator sign-in + native App Check"]
+    Officer["/community/admin; supervised staging recovery verified"] --> MFA["Verified recent authenticator sign-in + native App Check"]
     MFA --> Cap["Live expiring approval / free-event permission"]
+    MFA --> Expired["After ten minutes: request denied; protected sections hidden"]
+    Expired --> Reauth["Sign out; sign in with a fresh authenticator code"]
+    Reauth --> MFA
     Cap --> One["Same communityActions service; no new reserved instance"]
     One --> Review["20 pending UID/revision requests per page; no profiles"]
     Review --> Approval["Verified target + configured synthetic term; no paid/role grant"]
@@ -19,7 +22,7 @@ flowchart LR
     Browser["Browser including broad admin"] -. "Denied direct access and capability writes" .-> Cap
 ```
 
-Text alternative: core staged officer checks passed using recent authenticator sign-in and current action permission with the same bounded service for synthetic approval, booking-safe free-event edits and immutable receipts; the browser cannot grant access or write records, and fresh sign-in recovery, ordinary officer access and real dues/production remain unavailable.
+Text alternative: core staged officer checks passed using recent authenticator sign-in and current action permission with the same bounded service for synthetic approval, booking-safe free-event edits and immutable receipts; the browser cannot grant access or write records, expired-session recovery requires a new authenticator sign-in, while ordinary officer access, lost-authenticator recovery and real dues/production remain unavailable.
 
 ```mermaid
 flowchart LR