Hand off verified fictional staging membership activation

GITHUB_ISSUES.md

@@ -1,6 +1,6 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
-**COMMUNITY-DUES-002 / #719 — SOURCE PREPARED, NOT AVAILABLE YET:** link one immutable fictional receipt to one owner-marked disposable pending account and activate its unchanged current test term. Separate v3 association capability, recent native TOTP/App Check, authoritative verified/enabled Auth, strict input/revision/marker guards, atomic uniqueness and permission-first replay. No real policy/data/money, Auth claim, IAM expansion, dependency/service/schedule or production change. Officer impact: supervised screen-only fictional linking and member verification. Officer documentation: STAGING_COMMUNITY, entrypoints, ACCESS_CONTINUITY, EVENTS_SHOP_MEMBERS, glossary and maps. Deployment evidence: source/local tests only until native #719 records exact merge, staging Function/Hosting, security/UI/race/retry/cancel/expiry and owned cleanup. #716 is historical recording-only proof; broad #115/#81 and real launch remain separate.
+**COMMUNITY-DUES-002 / #719 — STAGING VERIFIED 2026-10-12:** one immutable fictional receipt links deliberately to one owner-marked disposable pending account and activates its unchanged current test term. Separate v3 capability, recent native TOTP/App Check, authoritative verified/enabled Auth, exact guards, atomic uniqueness and permission-first replay; no real policy/data/money, Auth claim, IAM/service/schedule/dependency/production change. Officer impact: supervised screen-only linking and cancellation/original-expiry verification. Officer documentation: STAGING_COMMUNITY, entrypoints, ACCESS_CONTINUITY, EVENTS_SHOP_MEMBERS, glossary and maps. Deployment evidence: PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched. #716 remains historical recording-only proof; broad #115/#81 and real launch are separate.
 
 **COMMUNITY-DUES-001 / #716 — staging verified 2026-10-12:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: PR717 merged d212fab; all six exact PR/main jobs and every step passed. Native Function v3/archive and staging Hosting matched; twenty-two hosted denials, immutable retry/race, twenty-plus-one pages, actual UI/offline/390×844/revocation and 51-document/two-account cleanup passed. Release-command reporting caveat and supervised fresh-fixture handoff are recorded in STAGING_COMMUNITY; production/runmprc.com and real payments were untouched. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof.
 

IMPLEMENTATION_PLAN.md

@@ -1,6 +1,6 @@
 # MPRC Secure Commerce Implementation Plan
 
-**#719 focused continuation — SOURCE PREPARED, NOT AVAILABLE YET:** verified/closed #716 is the dependency. Add only fictional receipt-to-disposable-account linking and derived current test membership. Preserve receipt/term, pending revision, separate capability, authoritative Auth, transaction uniqueness, permission-first replay and cancellation-through-term policy. Complete local checks, exact source/main CI, native archive/security/resource readback, hosted positive/negative/race/retry/cancellation/expiry/UI review and exact owned cleanup before closing this child. Broad #115/#81, real rules/payments and production launch remain separate.
+**#719 focused continuation — STAGING VERIFIED 2026-10-12:** verified #716 dependency is followed by deliberate fictional receipt linking/unchanged term activation in the same staging service/UI. Separate capability/marker, authoritative Auth, pending revision, atomic uniqueness, permission-first retry and cancellation-through-term guards passed local full checks and 44 hosted cases, including real screens/offline/races/natural expiry. PR720/b6a8fd5 exact PR/main CI passed; Function v4/archive and staging Hosting match; six users/47 documents cleaned. Close only the scoped child after final native handoff; #115/#81, real rules/payments and production launch remain separate.
 
 **Status:** Approved technical sequence and assessment snapshot; GitHub issues are the live execution/status source
 **Last reviewed:** 2026-07-12

OFFICER_START_HERE.md

@@ -1,6 +1,6 @@
 # MPRC Website: Officer Start Here
 
-**Fictional account linking — #719, SOURCE PREPARED / NOT AVAILABLE YET:** a separate staging-only permission will link one fictional receipt to a specialist-marked disposable pending account. Its test access lasts only through the receipt's unchanged term, including after cancellation; no Auth role or money changes. Follow the [screen-only guide](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) only after native acceptance and fresh private test fixtures. Production and real membership rules remain unavailable.
+**Fictional account linking — #719, STAGING VERIFIED 2026-10-12:** a separate staging permission links one fictional receipt to a specialist-marked disposable pending account. Test access ends at the original receipt term, including after cancellation; no Auth role or money changes. Use the [screen-only guide](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) only with fresh specialist-supplied private fixtures. Native Function/Hosting, actual screens/offline/retry/race/cancel/expiry/revocation and exact cleanup passed. Old accounts/records are removed; production and real club rules remain unavailable.
 
 **Use this page if Dave or the usual code owner is unavailable.** You do not need to know how to code.
 

OPERATIONS_RUNBOOK.md

@@ -1,6 +1,6 @@
 # MPRC Platform Operations Runbook
 
-**#719 fictional linking — SOURCE PREPARED, NOT AVAILABLE YET:** reuse the same service, six-permission runtime and min0/max2/256MB/30s limits. Dave/specialist supplies only disposable verified Auth accounts, pending requests/revisions, expiring exact v3 association capabilities and six-field `communityAssociationTargets/{uid}` markers. Follow the [screen-only procedure](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) after native acceptance. Disable capabilities first; exact owned cleanup uses identity/update-time fences. No ordinary officer grants a role, edits records, deploys or runs a terminal. No migration/scheduler/provider/payment/production change. The existing release command's post-deploy reporting failure remains unresolved; inspect native state/archive before any retry, never blindly redeploy.
+**#719 fictional linking — STAGING VERIFIED 2026-10-12:** reuse the same service, six-permission runtime and min0/max2/256MB/30s limits. Dave/specialist supplies fresh disposable verified Auth accounts, pending requests/revisions, exact expiring v3 association capabilities and six-field disposable markers. Follow the [screen-only procedure](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719); old fixtures are removed. Disable capabilities first, deny old successful replays, then remove only inventoried owned records using identity/update-time fences. No ordinary officer edits records, grants a role, deploys or runs a terminal. No migration/scheduler/provider/payment/production change. PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched.
 
 **Status:** Target operating procedure; several controls are not implemented yet
 **Last reviewed:** 2026-07-12

SECURITY.md

@@ -1,6 +1,6 @@
 # MPRC Security, Privacy, and Risk Plan
 
-**#719 staging linking — SOURCE PREPARED, NOT AVAILABLE YET:** live expiring v3 association permission is separate from recording/approval/event access. Require recent native verified TOTP/App Check, exact caller binding, explicit test confirmation, an owner-marked disposable UID, authoritative verified/enabled Auth lookup and a pending null-authority application/revision. One receipt and one pending account can be linked only once transactionally; saved retries recheck permission before replay. Receipt/term, profiles and Auth claims stay unchanged. Receipt review exposes no target/contact data. Both new collections stay default-denied to browser admins. The six-permission project-scoped runtime gains no rights. Source/tests do not qualify native deployment or production security.
+**#719 staging linking — STAGING VERIFIED 2026-10-12:** live expiring exact v3 association permission remains separate. Native recent verified TOTP/App Check, exact caller/input, owner-marked disposable UID, authoritative enabled/verified Auth and pending null-authority revision are required. Atomic receipt/account uniqueness and permission-first replay prevent duplicate activation/reassignment/renewal; original evidence/term and profiles/claims remain unchanged. Minimal linked receipt projection exposes no target/contact data. Both new collections remain default-denied even to browser admins; runtime keeps the same six project-scoped permissions. Native source/spec/security and 32 denial cases plus hosted races/retries/UI/revocation/cancel/expiry and exact cleanup passed. This is fictional staging proof, not production security qualification.
 
 **Status:** Pre-production security assessment
 **Assessment date:** 2026-07-12

STRIPE_COMMERCE_DESIGN.md

@@ -1,6 +1,6 @@
 # Stripe, Race Registration, and Merchandise Design
 
-**#719 fictional activation — SOURCE PREPARED, NOT AVAILABLE YET:** a separately authorized disposable staging account may receive the unchanged test term from a fictional external-dues receipt. This does not verify a payment, reconcile Stripe, grant an Auth role, renew a term, issue a refund or approve real club policy. Receipt evidence stays immutable; association is a separate server-only record. Production and real payments remain untouched and unavailable.
+**#719 fictional activation — STAGING VERIFIED 2026-10-12:** separately authorized disposable accounts may receive only an unchanged fictional receipt term. This is not payment verification, Stripe reconciliation, a real dues decision, renewal, refund or Auth-role grant. Receipt evidence stays immutable; association is separate and server-only. Native Function v4/Hosting b6a8fd5 and actual cancellation/expiry tests passed; six users/47 documents were cleaned. Production and real payments remain untouched and unavailable.
 
 **Status:** Required production design; current code is a test-mode prototype
 **Last reviewed:** 2026-07-13

SYSTEM_DESIGN.md

@@ -1,6 +1,6 @@
 # MPRC Platform System Design
 
-**#719 fictional account linking — SOURCE PREPARED, NOT AVAILABLE YET:** the isolated staging service adds `admin_dues_link`. A separate exact v3 `membershipAssociation` capability, recent native TOTP/App Check, authoritative verified/enabled Auth account, pending null-authority application with matching revision, and owner-supplied exact six-field disposable-target marker expiring within 24 hours are all required. One immutable fictional receipt supplies the unchanged approved current test term; an atomic transaction creates `communityDuesLinks/{membershipId}` and attaches its derived authority to `communityMemberships/{uid}`. Receipt and member uniqueness fences prevent double activation, reassignment and renewal. Saved retries recheck officer permission before replay. Recording remains unlinked; the bounded receipt view adds only a linked boolean, not a target UID. Cancellation preserves the original term; live clock expiry removes current-member status. No Auth claims/roles, real policy/data/payments, new dependency/service/schedule, IAM expansion, migration or production change. Existing default-deny browser Rules cover both new collections. Staging deployment and native acceptance remain required under #719.
+**#719 fictional account linking — STAGING VERIFIED 2026-10-12:** `admin_dues_link` deliberately connects one immutable fictional receipt to one owner-marked verified/enabled disposable pending account. Exact v3 association permission is separate from recording/approval/event permissions; native recent TOTP/App Check, exact caller/input/revision and <=24-hour disposable marker are required. One transaction creates a separate link and derived authority preserving the original current term, preventing duplicate receipt/account activation, reassignment and renewal. Saved retries recheck permission first; cancellation keeps the original term and server-clock expiry removes test membership. Receipt review adds only a linked boolean, no UID/contact data. No Auth claim/role, real policy/data/payment, dependency/service/schedule/IAM expansion/migration or production change. Default-deny browser Rules cover both new collections. PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched.
 
 **Status:** Target architecture and current-state assessment
 **Last reviewed:** 2026-07-13

docs/officers/ACCESS_CONTINUITY.md

@@ -1,6 +1,6 @@
 # Access Continuity
 
-**#719 linking permission — SOURCE PREPARED / NOT AVAILABLE YET:** only Dave/platform specialist supplies an expiring association permission and exact disposable-target marker for the [supervised screen review](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719). Existing recording/approval/event access grants no linking authority. Do not change a role, email-match an account or share passwords/codes. Stop if the supplied account/revision is uncertain or access survives revocation. Enrollment, fixture supply, cleanup and rollback remain specialist-only; no backup appointment or production permission changes.
+**#719 linking permission — STAGING VERIFIED 2026-10-12:** Dave/platform specialist supplies a fresh expiring association permission and exact disposable-target marker for the [supervised screen review](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719). Existing recording/approval/event access grants no linking authority. Hosted revocation cleared target/receipt controls and denied old successful retries; old capabilities, accounts and records were removed. Do not change a role, email-match an account or share credentials/codes. Stop on an uncertain ID/revision or access surviving revocation. Enrollment, fixture supply, cleanup and rollback remain specialist-only; no backup appointment or production permission changes.
 
 **Purpose:** ensure at least two named officers can reach every important service if the usual owner is unavailable.
 **Status:** setup is **INCOMPLETE** until the entry document is in a board-owned Drive and two backup officers complete a sign-in drill.

docs/officers/EVENTS_SHOP_MEMBERS.md

@@ -1,6 +1,6 @@
 # Events, Shop, Members, and Money
 
-**#719 fictional linking — SOURCE PREPARED / NOT AVAILABLE YET:** the [supervised staging procedure](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) will deliberately connect an immutable fictional receipt to a specialist-marked disposable pending account. Test access uses only the receipt's original term; cancellation preserves it until expiry. No real dues policy/payment/claim/renewal/refund/production launch is supplied. Stop on an uncertain ID/revision or changed term and contact Dave privately.
+**#719 fictional linking — STAGING VERIFIED 2026-10-12:** the [supervised screen procedure](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) deliberately connects an immutable fictional receipt to one specialist-marked disposable pending account. Real screens verified activation, cancellation through the unchanged original term and inactive status after natural expiry. Old test fixtures are removed; ask the specialist for fresh private setup. No real policy/payment/claim/renewal/refund/production launch is supplied. Stop on an uncertain ID/revision or changed term and contact Dave privately.
 
 **Current status:** live commerce is **NOT AVAILABLE YET**.
 **Use this guide when:** a request touches registrations, members-only access, products, payments, refunds, waivers, or private data.

docs/officers/README.md

@@ -1,6 +1,6 @@
 # Officer Website Handbook
 
-[#719 fictional account linking](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) is SOURCE PREPARED / NOT AVAILABLE YET. A separate permission and specialist-marked disposable account are required; do not use real members or receipts. Native deployment, screen review and exact cleanup remain required. This does not release real memberships/payments or production.
+[#719 fictional account linking](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) passed native staging release, actual officer/member screens, offline retry, races, cancellation/original expiry and exact cleanup on 2026-10-12. A separate permission and fresh specialist-marked disposable pending account are required; all old fixtures were removed. No real membership, payment or production release is available.
 
 **Audience:** MPRC officers and backup maintainers with little or no coding experience
 **Last checked:** 2026-07-30