daliu · Oct 13, 2026 · Oct 13, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -168,6 +168,8 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 ## CI-001 — Repair test gates and secure the deployment pipeline
 
+**CI-STAGING-VERIFY-001 #722:** one script-only child corrects the final community success output's undefined digest, adds closed redacted failure phases and fixed read-only native verification. Local reproduction proves the reporting bug, not the caught exception from every historical failure. Clean exact green current-main source, native ancestor provenance/exact archive, scoped owner/runtime/config/resource/invoker and unchanged profile inventory remain mandatory. No new deployment, provider/IAM/data/payment mutation, dependency, workflow or production authority. See the [officer review](./docs/officers/STAGING_COMMUNITY.md#check-an-uncertain-staging-release--722). This does not close #105/#133/#136 or full backend readiness; current command/unchanged-marker evidence must be recorded in #722 before claiming hosted verification.
+
 **CI-001C2 owner decision, 2026-10-11:** [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697) applies Dave's direct approval to continue Firebase backend setup without a backup owner. Dave (`daliu`) is the sole release/recovery owner. Backup appointment and two-person ownership are no longer backend prerequisites; absence of backup remains documented risk. #113/#133/#136 retain their other inventory, authority, exact-source, staging, policy and rollback requirements. Jeff's #667 read-only staging role does not expand. This decision is not Firebase deployment or live payment approval.
 
 **COST-001 source child:** [#683](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/683) binds only the two profile Functions to zero reserved instances, max two each, 256 MB and 30 seconds, with actual SDK metadata tests and matching fail-closed provider readback validation. It records the community-first minimal-service direction and officer review procedure without changing schema, privileges, deployment scope, billing, providers, or public pages. This is source preparation, not reduced-bill or hosted quality evidence; #113/#133/#136 retain release prerequisites, synthetic cold-start/burst/recovery proof and compatible rollback.

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -1,5 +1,13 @@
 # MPRC Platform Operations Runbook
 
+## Read-only community release verification — #722
+
+The former success output used an undefined `digest` identifier; a provider-free regression reproduces `ReferenceError` and verifies serialization of `bundle.digest`. Historical generic failures remain their original reported status; this does not prove which exception every old run caught. New failures expose only a closed phase enum, never exception text, provider responses, tokens or signed URLs.
+
+Specialist command after clean exact current-main/six-job evidence: `node scripts/staging-community-release.js verify`. It retains existing staging-only owner/runtime/zero-key/MFA checks, requires ancestor deployed provenance and identical downloaded reviewed bundle, validates ACTIVE resource/security/invoker state and unchanged two-profile inventory. Provider transport accepts only fixed reads and the signed source-read URL request. It cannot deploy, enable MFA, update IAM/Hosting or read/write member records. No-argument deployment remains separate, fixed-target and fail-closed; any other/extra argument fails before credentials. No new dependency, workflow, service, permissions, scheduler, migration or runtime-bundle change. The archive stream is bounded to one million bytes; credentials are never sent to its signed URL. Recheck exact current-main CI before reporting success. Separately read the public staging marker; record native command/marker results in #722 before claiming hosted verification. Do not redeploy unchanged code to investigate an observation failure.
+
+Officers follow the [no-terminal review](./docs/officers/STAGING_COMMUNITY.md#check-an-uncertain-staging-release--722). Dave approves/escalates; no backup is appointed. Source/CI/provider inspection and any repair remain specialist-only. Failed readback means stop, not skip a guard. Production, real dues, financial actions and full backend acceptance remain unavailable through this tooling child.
+
 **#719 fictional linking — STAGING VERIFIED 2026-10-12:** reuse the same service, six-permission runtime and min0/max2/256MB/30s limits. Dave/specialist supplies fresh disposable verified Auth accounts, pending requests/revisions, exact expiring v3 association capabilities and six-field disposable markers. Follow the [screen-only procedure](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719); old fixtures are removed. Disable capabilities first, deny old successful replays, then remove only inventoried owned records using identity/update-time fences. No ordinary officer edits records, grants a role, deploys or runs a terminal. No migration/scheduler/provider/payment/production change. PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched.
 
 **Status:** Target operating procedure; several controls are not implemented yet

diff --git a/docs/officers/STAGING_COMMUNITY.md b/docs/officers/STAGING_COMMUNITY.md
@@ -8,6 +8,23 @@
 
 **Prerequisites:** the platform specialist supplies the exact reviewed release, a disposable verified account and a visibly made-up free event. Use only the staging website. Do not use real runner details or payment information.
 
+## Check an uncertain staging release — #722
+
+**Purpose:** establish what is deployed without starting another build. **Approver and escalation:** Dave Liu, sole staging owner; no backup is appointed. **Prerequisites:** the specialist uses the merged, reviewed #722 source and its six green current-main checks. No member account, authenticator code or test fixture is needed. Production verification or release is **NOT AVAILABLE YET** through this check.
+
+1. Ask Dave/platform specialist to check the existing staging community release without deploying.
+2. State that production, real records and payments must stay untouched.
+3. Request the #722 evidence link, not a provider screenshot or credential.
+4. Check that the result separately names the reviewed source and deployed source, archive match, resource settings, unchanged two profiles and unchanged staging website marker.
+5. If any check fails, stop and ask the specialist to investigate the named safe failure phase.
+6. Do not request another deployment merely to clear an uncertain result.
+
+**Expected result and success proof:** the specialist's read-only verifier checks existing staging runtime permissions/zero keys, club account identity, MFA configuration, exact Function settings/source ancestry, downloaded source bytes, callable access and unchanged profile versions/labels. It performs no deployment, Auth/IAM update, member-data action or Hosting publication. The specialist separately reads the public staging website marker; the verifier does not claim fresh UI/lifecycle or complete backend acceptance. Record current native command evidence in #722 before calling this procedure verified. Green CI and labels alone are insufficient.
+
+**Stop conditions:** failed source/authority/config/resource/provenance/access/archive/inventory check; production target; new service/billing/permission request; real data; uncertain deployment. A failure reports only a fixed phase name, not private provider details. **Undo:** no provider state was changed, so stop the read-only check; any repair or reviewed staging rollback is separate. **Specialist-only work:** source/CI/provider verification and any later approved repair. Officers never run a terminal, sign in to test accounts, handle secrets or edit records for this review.
+
+**Reporting correction:** #722 identifies and reproduces the old final success statement's undefined `digest` variable. It now uses the actual bundle digest. That deterministic reporting bug could throw after all provider checks passed; it does not retroactively prove the exception from every historical run. Historical #711/#716/#719 deployment receipts and independent hosted proofs remain dated evidence. The new read-only mode avoids paying for another build to inspect an already-deployed result.
+
 ## What the actions mean
 
 ## Link a fictional receipt — #719

diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md
@@ -2,6 +2,21 @@
 
 These diagrams show where pages, information, and deployments go. Each diagram includes a one-sentence text version.
 
+## Uncertain staging release review — #722
+
+```mermaid
+flowchart LR
+    Officer["Request a read-only review; no credentials"] --> Specialist["Dave/platform specialist; exact green main"]
+    Specialist --> Verify["Fixed staging verification; no deployment"]
+    Verify --> Native["Resource, source archive, access and unchanged profiles"]
+    Specialist --> Marker["Separate public staging website marker check"]
+    Native --> Proof["Dated issue evidence; failure phase means stop"]
+    Marker --> Proof
+    Verify -. "No writes" .-> Mutations["Build, IAM/Auth/Hosting, member data, production/payments"]
+```
+
+Text alternative: an officer asks the specialist for a current read-only staging source/resource/access check and a separate website-marker check, with dated issue proof or a safe stop phase, without another deployment or any account, record or production/payment mutation.
+
 ## Fictional account linking — #719, staging verified 2026-10-12
 
 ```mermaid