[daliu]

Fictional race signup, full credit return and recipient-accepted bib transfer now have a bounded server transaction and immutable saved retries. This source/local-demo milestone is not a deployed race screen or payment system.

Officer impact: No usable new action yet. The guide names current source/demo proof, remaining native caller/App Check/staging screen/release/cleanup gates, and the no-terminal stop path.
Officer documentation: docs/officers/STAGING_COMMUNITY.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/SYSTEM_MAPS.md plus root design/commerce/security/implementation/runbook/registry.
Deployment evidence: None for #729. New helper/service remain outside callable/client/runtime-bundle imports; current archive byte/digest matches91,973/a4c2eefa. Fresh native unchanged-Function/Hosting verification follows exact green merge. Production/runmprc.com, real payments, Stripe/provider configuration, IAM/services and existing profile/community behavior excluded.

Scope and review

• Closed staging-with-commerce-disabled or loopback-demo realm and same-project SDK app; strict account-bound request/synthetic record/policy/grant schemas. No amount/price/role/profile/offer-deadline injection.
• Exact current expiring disposable markers/own-entry capability and at most3 read-only Auth metadata lookups. Verified/enabled metadata plus recent default-tenant password context; browser admin claims do not bypass. Caller-context signature/App Check is a remaining native integration gate, not proved by synthetic context.
• Server computes fictitious cents, original waiver/bib and offer deadline. Unique per-event enrollment prevents repeated signup and duplicate recipient. The test allows one enrollment ever per UID/event; no rejoin/partial refund/real policy decision.
• Atomically persist changed event/count, entry/enrollment, exact fingerprinted command result, minimal append audit and rate. Replay rechecks current authority/metadata/index/state first, returns immutable result without writes or rate charge. Orphan/corrupt receipts deny. Sample time after all reads; no stale expiry extension. Auth metadata is not locked with Firestore and has no instantaneous cross-service revocation guarantee.
• Original credit/waiver/bib preserved; one transfer; confirmed cancellation releases one place once. No Stripe/mail/claim/profile/real record writes; no package/lockfile/workflow/IAM/Rule change, migration/backfill or new service. Schema is additive simulation-only namespaces, not legacy adoption.
• Unchanged Rules explicitly tested for nine namespace roots/children and anonymous/member/verified browser-admin read/list/create/update/delete denials. New source/data-flow map is labelled source/demo only.

Checks

• Initial focused110/full7,903/77 skipped passed; follow-up recovery regression reproduced recipient loss blocking acknowledgement/withdrawal, then narrowed metadata checks to current caller for read-only replay and excluded irrelevant recipient for owner revoke. Caller grant/identity and current record/index checks remain. Final counts recorded after rerun; no guard bypass or new rights.
• Initial real local suite7/7:20 final-seat requests one winner, five duplicate cancellations one release, exact native nanosecond update-time replay, old join replay no resurrection, competing refund/offer and accept/revoke, two offered bibs one recipient, native disabled/unverified/revoked/expired denials without writes, and real commit plus synthetic lost acknowledgement/replay. Added native recipient-loss recovery test is checked with the final complete suite. Each run removes exact owned local accounts/namespaces/command children and stops emulators. Synthetic context is not callable token verification or native attestation.
• Full Rules suite443/443 passed; final create-denial extension checked in focused9-case rerun. First Rules command incorrectly passed a Jest flag to Firebase CLI and exited before emulator start; corrected exact command, no guard relaxed. One new rate test used an already-invalid signup; corrected to an eligible refund, no product limit weakened.
• Existing Node22 CI job already runs full backend under demo-functions-test; the new emulator suite permits only that owned CI demo and local demo-mprc-local, with loopback/realm checks before any cleanup. No new CI/workflow added. Exact PR/main six jobs/every step must pass before child closure.

Refs #729. Keep full backend/real finance/production goals separate. Next: strict native callable/status/client bridge and minimal staging screen, then backend-first exact release/genuine disposable UI/security/cleanup proof.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	0dc6fd6
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6ace69f4de84db679fe4db8a
😎 Deploy Preview	https://deploy-preview-730--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.