docs: hand off verified staging member status and cleanup

GITHUB_ISSUES.md

@@ -168,7 +168,7 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 ## CI-001 — Repair test gates and secure the deployment pipeline
 
-**COMMUNITY-STATUS-001 #724 — source-only staging child:** correct member free-event availability/cancellation-history presentation and stale UI after uncertain status reads. Existing #707/#711/#719/#722 dependencies are closed. Additive response-only enum/after-read clock; no stored/mutation/policy/authorization/schema/migration change or new service/dependency/IAM/Rules/polling. Existing transactional checks and exact saved retries remain authoritative. Backend-first exact staging source/archive, resource/profile/security, Hosting and disposable real UI/cleanup are required before availability; real refunds/transfers/dues/production and full backend completion stay separate.
+**COMMUNITY-STATUS-001 #724 — staging acceptance verified 2026-10-13:** PR725/`485be670`, exact six PR/main CI38359747304/38360107295 jobs/every step, communityActions version 5/native archive `a4c2eefa`/91,973 bytes and exact Hosting pass. All six availability states, cancellation history/own cancellation, failed-read clearing, exact immutable retry and natural term expiry passed actual UI; read-only invariance and one-account/15-document fenced cleanup/sign-out/tab closure were verified. Additive response-only enum/after-read clock; existing schemas, mutations, policy, authorization, security/resource scope and profiles unchanged. No new service/dependency/IAM/Rules/polling/receiver/permission or production/payment action. Dated no-terminal handoff updated; real financial/production and broad backend completion remain separate. Dave approved fictional race rules for the next staging outcome, not real club policy.
 
 **CI-STAGING-VERIFY-001 #722:** one script-only child corrects the final community success output's undefined digest, adds closed redacted failure phases and fixed read-only native verification. Local reproduction proves the reporting bug, not the caught exception from every historical failure. Clean exact green current-main source, native ancestor provenance/exact archive, scoped owner/runtime/config/resource/invoker and unchanged profile inventory remain mandatory. No new deployment, provider/IAM/data/payment mutation, dependency, workflow or production authority. See the [officer review](./docs/officers/STAGING_COMMUNITY.md#check-an-uncertain-staging-release--722). This does not close #105/#133/#136 or full backend readiness; current command/unchanged-marker evidence must be recorded in #722 before claiming hosted verification.
 

OFFICER_START_HERE.md

@@ -1,5 +1,7 @@
 # MPRC Website: Officer Start Here
 
+**Member status — #724, STAGING VERIFIED 2026-10-13:** the member page separates event availability from stored signup history and hides old status after a failed read. Actual screens, exact retry, natural test-term expiry and disposable cleanup passed. Use the [screen-only review](./docs/officers/STAGING_COMMUNITY.md#current-member-status--724-staging-verified) with fresh specialist-supplied fictional fixtures. Production and real payments remain unavailable.
+
 **Fictional account linking — #719, STAGING VERIFIED 2026-10-12:** a separate staging permission links one fictional receipt to a specialist-marked disposable pending account. Test access ends at the original receipt term, including after cancellation; no Auth role or money changes. Use the [screen-only guide](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) only with fresh specialist-supplied private fixtures. Native Function/Hosting, actual screens/offline/retry/race/cancel/expiry/revocation and exact cleanup passed. Old accounts/records are removed; production and real club rules remain unavailable.
 
 **Use this page if Dave or the usual code owner is unavailable.** You do not need to know how to code.

OPERATIONS_RUNBOOK.md

@@ -1,6 +1,6 @@
 # MPRC Platform Operations Runbook
 
-**#724 current-status correction — SOURCE ONLY:** same scoped staging service/runtime, response-only availability and no migration. Deploy only exact reviewed communityActions after green main, verify its native archive/settings/IAM and unchanged profiles, then publish exact staging Hosting. Supply only owned disposable member/event fixtures. Check all six availability states, stored confirmed history after event cancellation, own cancellation/count preservation, failed refresh clearing and exact saved retry; sample term/window boundaries after reads. Follow the [no-terminal review](./docs/officers/STAGING_COMMUNITY.md#current-member-status--724-source-prepared-not-available-yet). Remove only owned fixtures with identity/update-time fences and sign out; no extra service/polling, new permissions, real policy/payment or production action. Fresh native acceptance is pending #724.
+**#724 current-status correction — STAGING VERIFIED 2026-10-13:** same scoped staging service/runtime, response-only availability and no migration. PR725/`485be670` passed six exact PR/main jobs/every step before backend-first publication. communityActions version 5/native 91,973-byte archive `a4c2eefa` and staging Hosting match; deployment and read-only verification returned success. Profiles, resource/security/IAM scope remain unchanged. All six availability states, cancelled-event confirmed history/own cancellation, failed refresh clearing, immutable saved retry and natural synthetic term expiry passed on the actual member page. Failed-read proof used invalid owned configuration, not offline simulation. One account/15 owned documents were removed with identity/update-time fences and absence checks, then sign-out/tab closure. Follow the [no-terminal review](./docs/officers/STAGING_COMMUNITY.md#current-member-status--724-staging-verified). No extra service/polling, receiver, browser permission, real policy/payment or production action. Fictional race rules are approved only for the next staging outcome; those workflows are not yet deployed.
 
 ## Read-only community release verification — #722
 

SYSTEM_DESIGN.md

@@ -1,6 +1,6 @@
 # MPRC Platform System Design
 
-**#724 member-status correction — SOURCE ONLY:** the existing staging status read adds a response-only closed `signupStatus` enum (open/not_open_yet/closed/ended/full/cancelled), derived from validated event/window/capacity with server time sampled after reads. No stored schema, mutation authorization, count, registration/waiver/audit, membership policy, IAM/Rules/service/dependency or production change. UI distinguishes cancelled events from stored signups, fails closed on missing/unknown availability and hides old membership/event status/actions on uncertain reads while preserving exact saved retry and account/provider fences. No polling. Backend-first staging archive/resource/readback, Hosting and disposable UI/failure/cleanup proof remain required under #724; source/tests are not hosted acceptance.
+**#724 member-status correction — STAGING VERIFIED 2026-10-13:** the existing staging status read adds a response-only closed `signupStatus` enum (open/not_open_yet/closed/ended/full/cancelled), derived from validated event/window/capacity with server time sampled after reads. No stored schema, mutation authorization, count, registration/waiver/audit, membership policy, IAM/Rules/service/dependency or production change. UI distinguishes cancelled events from stored signups, fails closed on missing/unknown availability and hides old membership/event status/actions on uncertain reads while preserving exact saved retry and account/provider fences. No polling. PR725 merged `485be670244c7ecf59cc7ab32ac465f5b3372a1f`; exact PR/main CI38359747304/38360107295 passed all six jobs/every step. Native Function version 5 and staging Hosting match that source; the 91,973-byte archive matches SHA-256 `a4c2eefaa3e7c3a6b40580ef7dcd7d668c80dedf4563a13565cb5034a449ba1c`. Deployment/read-only verification returned success; profiles/security/resource scope are unchanged. Actual UI proved all six states, cancelled-event history/own cancellation, failed-read clearing, immutable saved retry and natural synthetic term expiry. Nine initial documents/update times stayed unchanged by reads; one disposable account/15 owned documents were removed with fences and absence checks, followed by sign-out/tab closure. Backend failure used an invalid owned manifest, not offline simulation. No new service, receiver or browser permission was needed. Production and real payments remain separate; fictional race rules were approved only for subsequent staging tests.
 
 **#719 fictional account linking — STAGING VERIFIED 2026-10-12:** `admin_dues_link` deliberately connects one immutable fictional receipt to one owner-marked verified/enabled disposable pending account. Exact v3 association permission is separate from recording/approval/event permissions; native recent TOTP/App Check, exact caller/input/revision and <=24-hour disposable marker are required. One transaction creates a separate link and derived authority preserving the original current term, preventing duplicate receipt/account activation, reassignment and renewal. Saved retries recheck permission first; cancellation keeps the original term and server-clock expiry removes test membership. Receipt review adds only a linked boolean, no UID/contact data. No Auth claim/role, real policy/data/payment, dependency/service/schedule/IAM expansion/migration or production change. Default-deny browser Rules cover both new collections. PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched.
 

docs/officers/README.md

@@ -1,5 +1,7 @@
 # Officer Website Handbook
 
+[#724 member status](./STAGING_COMMUNITY.md#current-member-status--724-staging-verified) passed native staging release, actual availability/cancellation/failure/retry screens, natural test-term expiry and exact owned cleanup on 2026-10-13. Fresh specialist-supplied fictional fixtures are required. No production or real payment behavior is included.
+
 [#719 fictional account linking](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) passed native staging release, actual officer/member screens, offline retry, races, cancellation/original expiry and exact cleanup on 2026-10-12. A separate permission and fresh specialist-marked disposable pending account are required; all old fixtures were removed. No real membership, payment or production release is available.
 
 **Audience:** MPRC officers and backup maintainers with little or no coding experience

docs/officers/STAGING_COMMUNITY.md

@@ -62,9 +62,13 @@
 
 ## Existing membership and free-event actions
 
-### Current member status — #724 source prepared, NOT AVAILABLE YET
+### Current member status — #724 staging verified
 
-**Purpose:** distinguish the event's current signup availability from the member's stored signup, and stop displaying old status after an uncertain read. **Approver/escalation:** Dave, sole staging owner. **Prerequisites:** the specialist supplies the verified #724 staging release, disposable account and made-up events. New behavior is not hosted proof until #724 records exact deployment, actual UI and cleanup.
+**Status:** STAGING VERIFIED on 2026-10-13. PR725 merged `485be670244c7ecf59cc7ab32ac465f5b3372a1f`; exact PR CI38359747304/main CI38360107295 passed all six jobs and every step, without skips. Native communityActions version 5 and staging Hosting use that source. Its 91,973-byte archive matches SHA-256 `a4c2eefaa3e7c3a6b40580ef7dcd7d668c80dedf4563a13565cb5034a449ba1c`. Deployment and the separate read-only verifier both returned success. The two profile Functions, six runtime permissions/zero keys, App Check/MFA and min0/max2/256MB/30s limits stayed unchanged. Production/runmprc.com and real payments were untouched.
+
+**Purpose:** distinguish the event's current signup availability from the member's stored signup, and stop displaying old status after an uncertain read. **Approver/escalation:** Dave, sole staging owner. **Prerequisites:** the specialist supplies this verified staging release, a new disposable account and made-up events. All fixtures used for the dated proof below were removed; no old test account remains available.
+
+**Hosted proof and cleanup:** the actual member screen showed all six availability messages. Native reads left all nine initial documents and their update times unchanged. A confirmed signup stayed visible as history after its event was cancelled; the member's own cancellation released its place once. Deliberately invalid owned configuration caused a real failed backend read, which hid old status and actions. This was not an offline/network-loss test. A membership action committed before its status read failed; **Retry request** reused the same command, leaving the membership and all three command records unchanged. Failed refresh hid an active synthetic term, and a fresh read after its natural end showed inactive access without changing the term. One disposable account and 15 exact owned documents were removed with account identity/create-time and document update-time fences; absence was checked. The browser signed out and the owned tab closed. No local receiver, local-network grant, networking override or viewport override was used.
 
 1. Open the supplied staging `/community` link and confirm **Staging test only**.
 2. Sign in with the supplied disposable account.
@@ -77,7 +81,7 @@
 9. Use **Retry request** only for an uncertain saved action, or **Refresh status** for a new read.
 10. Confirm only a successful fresh read restores current controls, then sign out and request owned-fixture cleanup.
 
-**Expected result/proof:** the server projects existing event window/capacity/status constraints using its clock after reads; the browser cannot turn a display value into authorization. Counts, registration/waiver evidence and paid-term cancellation policy are unchanged. A confirmed stored signup on a cancelled event is history, not proof that the event will take place. Existing transactional join checks still decide the result if availability changes after the read. Missing/unknown projection fails closed. No polling or extra service is added. **Stop:** production, real data/payment, unclear availability/count/history, stale status surviving failure or request for secrets/record edits. **Undo:** sign out; Dave/specialist uses the reviewed staging rollback if required. Account/fixture supply, deployment/readback/cleanup and rollback remain specialist-only; no officer uses a terminal or edits records. Real refunds, bib transfers and production remain unavailable.
+**Expected result/proof:** the server projects existing event window/capacity/status constraints using its clock after reads; the browser cannot turn a display value into authorization. Counts, registration/waiver evidence and paid-term cancellation policy are unchanged. A confirmed stored signup on a cancelled event is history, not proof that the event will take place. Existing transactional join checks still decide the result if availability changes after the read. Missing/unknown projection fails closed. No polling or extra service is added. **Stop:** production, real data/payment, unclear availability/count/history, stale status surviving failure or request for secrets/record edits. **Undo:** sign out; Dave/specialist uses the reviewed staging rollback if required. Account/fixture supply, deployment/readback/cleanup and rollback remain specialist-only; no officer uses a terminal or edits records. The screen-only steps were reviewed as a backup officer without a terminal. Dave approved fictional race rules for later staging work; real refunds, bib transfers and production remain unavailable.
 
 - Request membership: records a pending request. It does not prove dues or grant membership.
 - Withdraw membership request: withdraws a pending application.

docs/officers/SYSTEM_MAPS.md

@@ -2,7 +2,7 @@
 
 These diagrams show where pages, information, and deployments go. Each diagram includes a one-sentence text version.
 
-## Member status freshness — #724 source only
+## Member status freshness — #724 staging verified
 
 ```mermaid
 flowchart LR
@@ -14,7 +14,7 @@ flowchart LR
     Display --> Mutation["Existing transactional join/cancel checks decide again"]
 ```
 
-Text alternative: the staging member page displays server-derived availability separately from stored signup history, hides old status on uncertainty and restores it only after a fresh read, while existing transactions—not the display—continue deciding joins and cancellations; hosted proof remains pending #724.
+Text alternative: the staging member page displays server-derived availability separately from stored signup history, hides old status on uncertainty and restores it only after a fresh read, while existing transactions—not the display—continue deciding joins and cancellations; native deployment, actual screens, failed reads, exact retry, natural term expiry and owned cleanup passed on 2026-10-13 under #724, not in production.
 
 ## Uncertain staging release review — #722