RACE-SIM-001B: atomic fictional race transactions and saved retries

GITHUB_ISSUES.md

@@ -168,6 +168,8 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 ## CI-001 — Repair test gates and secure the deployment pipeline
 
+**RACE-SIM-001B #729 — source transaction implementation:** extend #727's fictional model with bounded server-only event/entry/unique enrollment and immutable command/audit/rate transactions. Read-only native Auth metadata after exact expiring disposable permission/marker checks; no financial/provider mutation. Include server-configured fictional entry creation to prove concurrent final-seat and duplicate-recipient safety. Recheck authority before replay, reject changed request IDs, preserve original credit/waiver/bib and never reinterpret simulation as paid/refunded evidence. Source-only local/demo proof precedes genuine Auth/App Check/RPC/client/backend-first staging deployment/UI/cleanup; no new IAM/service/dependency/workflow or production action.
+
 **RACE-SIM-001A #727 — source-only fictional transition foundation:** Dave approved fictional staging refund/bib-transfer rules after #724 closed. Pure strict synthetic schema/cents/time/revision/ownership/terminal/deadline/waiver transitions, without runtime/client/bundle integration or deployment. Full simulated return releases one place; one recipient-accepted transfer preserves bib/count/original credit/waiver. Actual native authorization, target marking, transactions/immutable command receipts/concurrency/retries and staging UI/deployment/cleanup are separate follow-ons. Real policy/provider money/production and financial parents remain open.
 
 **COMMUNITY-STATUS-001 #724 — staging acceptance verified 2026-10-13:** PR725/`485be670`, exact six PR/main CI38359747304/38360107295 jobs/every step, communityActions version 5/native archive `a4c2eefa`/91,973 bytes and exact Hosting pass. All six availability states, cancellation history/own cancellation, failed-read clearing, exact immutable retry and natural term expiry passed actual UI; read-only invariance and one-account/15-document fenced cleanup/sign-out/tab closure were verified. Additive response-only enum/after-read clock; existing schemas, mutations, policy, authorization, security/resource scope and profiles unchanged. No new service/dependency/IAM/Rules/polling/receiver/permission or production/payment action. Dated no-terminal handoff updated; real financial/production and broad backend completion remain separate. Dave approved fictional race rules for the next staging outcome, not real club policy.

IMPLEMENTATION_PLAN.md

@@ -1,5 +1,7 @@
 # MPRC Secure Commerce Implementation Plan
 
+**#729 progression — SOURCE / DEMO ONLY:** implement fictional entry creation, unique enrollment and atomic transitions/immutable retries before screens. Bounded native Auth metadata, expiring disposable authority and exact SDK realm checks are tested with real demo transactions; existing Rules deny the nine namespaces. Continue with platform-verified caller/App Check, minimal status/RPC/client contracts and exact backend-first staging release/UI/owned cleanup. No current deployed import, new workflow/service/IAM, financial or production action; #727/#729 are dependencies, not full backend completion.
+
 **#727 fictional race foundation — SOURCE ONLY:** first test a closed pure transition model without provider calls or deployed integration. Then implement native Auth/App Check/disposable-target/permission admission and atomic event/entry/command receipts; test actual concurrency and immutable retries. Only afterward add minimal staging screens and perform exact backend-first Function/Hosting deployment, genuine disposable UI/security/lifecycle checks and owned cleanup. No real rules/payments/production authority is implied; #724 core stays unchanged.
 
 **#719 focused continuation — STAGING VERIFIED 2026-10-12:** verified #716 dependency is followed by deliberate fictional receipt linking/unchanged term activation in the same staging service/UI. Separate capability/marker, authoritative Auth, pending revision, atomic uniqueness, permission-first retry and cancellation-through-term guards passed local full checks and 44 hosted cases, including real screens/offline/races/natural expiry. PR720/b6a8fd5 exact PR/main CI passed; Function v4/archive and staging Hosting match; six users/47 documents cleaned. Close only the scoped child after final native handoff; #115/#81, real rules/payments and production launch remain separate.

OPERATIONS_RUNBOOK.md

@@ -1,5 +1,7 @@
 # MPRC Platform Operations Runbook
 
+**#729 fictional persistence — SOURCE / DEMO ONLY:** no current service release is needed: new files remain outside the deployed entrypoint/archive. Local tests use only explicitly selected loopback Auth/Firestore demo SDKs; caller context is synthetic, not genuine native token/App Check proof. Nine server-only namespaces hold fictional event/policy/entry/enrollment/target/permission/command/audit/rate state. A specialist supplies current expiring markers and own-entry permissions for actors and relevant verified/enabled disposable mutation targets; receipts never override caller revocation/expiry, missing indexes or corrupt state. Read-only acknowledgement and owner withdrawal do not require continued recipient access. No member/officer edits a record, enters real payment data or uses a legacy substitute/refund control. Keep real policy/provider money and production untouched. Future callable/client integration and exact hosted security/UI/cleanup evidence remain unavailable. Local cleanup removes only task-owned demo Auth UIDs and test namespaces, verifies absence and shuts down emulators before removing owned idle logs; no retention/backfill/hosted cleanup decision is made here.
+
 **#727 fictional race foundation — NOT AVAILABLE YET:** pure helper/tests only; it is intentionally excluded from callable/client imports and the community runtime archive. Do not deploy unchanged Functions or use legacy real-payment/runner-substitution screens for this test. Future operation needs current native identity/authority, expiring owner-marked disposable targets, strict fictional configuration, atomic event/entry/immutable receipt persistence, bounded retry/rate/audit and actual backend-first staging/UI/cleanup proof. Source simulation has no provider/account state to undo. Current #724 staging remains unchanged; real club rules, financial/provider work and production are separate.
 
 **#724 current-status correction — STAGING VERIFIED 2026-10-13:** same scoped staging service/runtime, response-only availability and no migration. PR725/`485be670` passed six exact PR/main jobs/every step before backend-first publication. communityActions version 5/native 91,973-byte archive `a4c2eefa` and staging Hosting match; deployment and read-only verification returned success. Profiles, resource/security/IAM scope remain unchanged. All six availability states, cancelled-event confirmed history/own cancellation, failed refresh clearing, immutable saved retry and natural synthetic term expiry passed on the actual member page. Failed-read proof used invalid owned configuration, not offline simulation. One account/15 owned documents were removed with identity/update-time fences and absence checks, then sign-out/tab closure. Follow the [no-terminal review](./docs/officers/STAGING_COMMUNITY.md#current-member-status--724-staging-verified). No extra service/polling, receiver, browser permission, real policy/payment or production action. Fictional race rules are approved only for the next staging outcome; those workflows are not yet deployed.

SECURITY.md

@@ -1,5 +1,7 @@
 # MPRC Security, Privacy, and Risk Plan
 
+**#729 fictional server transactions — SOURCE / DEMO ONLY:** strict account-bound commands, closed record/config/grant schemas, exact staging/demo app/realm, unsupported-tenant denial, current expiring marker/own-entry permission and bounded read-only verified/enabled Auth metadata checks precede both mutation and receipt replay. Original/current runner enrollment indexes must match; orphans and corrupt receipts deny. Server controls fictitious cents, bib, deadlines, counts, waiver and revisions; unknown price/role/profile fields reject before Auth lookup. Atomic fingerprinted receipt/audit/rate plus entry/index/count state resolves retries/races; no mutable audit array or request/token/profile logging. Browser reads/lists/creates/updates/deletes remain denied, even for admins, by unchanged Rules. These source/demo tests supply no native callable token-signature or App Check proof and no instantaneous Auth/Firestore distributed revocation guarantee. No deployed integration, IAM/service/dependency or real financial/production change; genuine platform binding and hosted denial/UI/cleanup proof remain required.
+
 **#727 fictional race foundation — SOURCE ONLY:** strict closed synthetic record/request shapes, integer bounds, expected revisions, fixed safe errors and original evidence preservation apply only to an unconnected pure helper. Fake identifier prefixes or simulation markers are not identity, disposable-target, permission, App Check, atomic persistence/retry or provider proof. No callable, client, release-bundle import, IAM/Rule/service change or deployment; existing #724 staging and production boundaries unchanged. A later server boundary must independently supply native verified identities, current scoped authority, target markers, time, transactional command receipts/counts and genuine staging denial/race/retry/cleanup evidence before the screen is available.
 
 **#719 staging linking — STAGING VERIFIED 2026-10-12:** live expiring exact v3 association permission remains separate. Native recent verified TOTP/App Check, exact caller/input, owner-marked disposable UID, authoritative enabled/verified Auth and pending null-authority revision are required. Atomic receipt/account uniqueness and permission-first replay prevent duplicate activation/reassignment/renewal; original evidence/term and profiles/claims remain unchanged. Minimal linked receipt projection exposes no target/contact data. Both new collections remain default-denied even to browser admins; runtime keeps the same six project-scoped permissions. Native source/spec/security and 32 denial cases plus hosted races/retries/UI/revocation/cancel/expiry and exact cleanup passed. This is fictional staging proof, not production security qualification.

STRIPE_COMMERCE_DESIGN.md

@@ -1,5 +1,7 @@
 # Stripe, Race Registration, and Merchandise Design
 
+**#729 simulation persistence — SOURCE / DEMO ONLY:** server-configured fictional entry creation and atomic simulated credit return/bib transfer use separate records and never Stripe/payment state. No client amount, discount, refund total, arbitrary runner profile or offer deadline is accepted. Original fictitious credit remains immutable; transferred runners cannot redirect it. Same-command receipts replay without writes after renewed authority/identity/state checks; lost-acknowledgement recovery and native demo final-seat/competing transitions are tested. Read-only Auth metadata is the only external dependency of the transaction, not a provider money action. Default-tenant verified password context here is for member-owned fictional credits only; it does not replace finance capability/recent MFA, provider truth, refund operation/reconciliation or real policy gates. No live callable/client/deployment from this child.
+
 **#727 fictional race foundation — SOURCE ONLY:** a separate unconnected pure model uses explicit fictional cents/returned-credit fields and closed simulation markers. It neither reads nor creates a Checkout, PaymentIntent, Refund, provider object, webhook or real payment status. Test-only full credit return/recipient-accepted bib transfer rules do not approve actual club policy or close PAY-004/PAY-005/RACE-001. Real refunds still require verified provider state, finance permission/recent MFA, durable idempotent operations and reconciliation below. No runtime/client/release-bundle import or deployment.
 
 **#719 fictional activation — STAGING VERIFIED 2026-10-12:** separately authorized disposable accounts may receive only an unchanged fictional receipt term. This is not payment verification, Stripe reconciliation, a real dues decision, renewal, refund or Auth-role grant. Receipt evidence stays immutable; association is separate and server-only. Native Function v4/Hosting b6a8fd5 and actual cancellation/expiry tests passed; six users/47 documents were cleaned. Production and real payments remain untouched and unavailable.

SYSTEM_DESIGN.md

@@ -1,5 +1,7 @@
 # MPRC Platform System Design
 
+**#729 fictional race transactions — SOURCE / DEMO ONLY:** an unconnected server service uses an explicitly same-project SDK app in staging with commerce disabled, or loopback Auth/Firestore under a demo project. Exact expiring disposable markers and per-account `manageOwnEntry` permission precede at most three native Auth metadata reads; verified/enabled accounts and a recent default-tenant password context are required. Browser flags/admin roles grant nothing. A server-only fictional policy supplies amount/window/waiver; deterministic entry/bib and unique per-event enrollment prevent duplicate seats and two bibs for one recipient. Event/entry/index plus immutable fingerprinted request receipt, append audit and rate update commit atomically. Current authority/identity/index/state checks precede even old receipt replay; replay is read-only, never current eligibility or payment proof. Time is sampled after all reads before writes. Original fictional credit/bib/waiver are preserved. One simulation enrollment per account/event, with no rejoin after cancellation/transfer, is a technical test rule only. Local real SDK transaction/race tests and existing Rules denials qualify source, not native token verification/App Check or hosted callable/UI. No current entrypoint/client/archive integration, migration, IAM/service/dependency/workflow, provider-money or production action. Auth metadata is not transactionally locked with Firestore; its check is admission evidence, not instant cross-service revocation.
+
 **#727 fictional race foundation — SOURCE ONLY / NOT AVAILABLE YET:** `fictionalRaceTransitions.js` is a pure, strictly bounded model, not imported by an entrypoint, client or runtime release bundle. Dave approved fictional test rules only: full simulated credit return before race start; one recipient-accepted bib transfer with a short offer deadline, original credit/waiver/bib preservation and no capacity increase. Expected event/entry revisions and terminal guards prevent an admitted transition from using stale supplied records; this is not native authorization, atomic persistence, immutable retry/journal or concurrency proof. No payment/provider evidence, real rules, new service/dependency/IAM/Rules, migration or deployment. Follow-on trusted Auth/App Check/disposable-target/capability boundary, transactional command receipts/capacity, minimal staging UI and backend-first hosted tests/cleanup remain required. Current #724 Function/Hosting and production remain unchanged.
 
 **#724 member-status correction — STAGING VERIFIED 2026-10-13:** the existing staging status read adds a response-only closed `signupStatus` enum (open/not_open_yet/closed/ended/full/cancelled), derived from validated event/window/capacity with server time sampled after reads. No stored schema, mutation authorization, count, registration/waiver/audit, membership policy, IAM/Rules/service/dependency or production change. UI distinguishes cancelled events from stored signups, fails closed on missing/unknown availability and hides old membership/event status/actions on uncertain reads while preserving exact saved retry and account/provider fences. No polling. PR725 merged `485be670244c7ecf59cc7ab32ac465f5b3372a1f`; exact PR/main CI38359747304/38360107295 passed all six jobs/every step. Native Function version 5 and staging Hosting match that source; the 91,973-byte archive matches SHA-256 `a4c2eefaa3e7c3a6b40580ef7dcd7d668c80dedf4563a13565cb5034a449ba1c`. Deployment/read-only verification returned success; profiles/security/resource scope are unchanged. Actual UI proved all six states, cancelled-event history/own cancellation, failed-read clearing, immutable saved retry and natural synthetic term expiry. Nine initial documents/update times stayed unchanged by reads; one disposable account/15 owned documents were removed with fences and absence checks, followed by sign-out/tab closure. Backend failure used an invalid owned manifest, not offline simulation. No new service, receiver or browser permission was needed. Production and real payments remain separate; fictional race rules were approved only for subsequent staging tests.

docs/officers/EVENTS_SHOP_MEMBERS.md

@@ -4,6 +4,8 @@
 
 **Current status:** live commerce is **NOT AVAILABLE YET**.
 
+**#729 fictional transactions — SOURCE / DEMO ONLY:** server-controlled fake signup, credit return and recipient-accepted bib transfer have local transaction/retry/race proof. There is still no usable staging screen or deployed callable from this child. Ask Dave/platform specialist for the next dated native release/UI proof before trying it; do not use legacy controls, enter real details or edit a record. Real refunds still need finance permission/MFA, verified provider state and approved policy. See [the unavailable staging handoff](./STAGING_COMMUNITY.md#fictional-race-refunds-and-bib-transfers--727-source-foundation-not-available-yet).
+
 **Fictional race follow-on, #727:** Dave approved fictional refund and bib-transfer rules for staging tests, not real club policy. The [source-only handoff](./STAGING_COMMUNITY.md#fictional-race-refunds-and-bib-transfers--727-source-foundation-not-available-yet) models credit return and recipient-accepted transfer with made-up records. No usable screen, native authorization, transaction/retry proof, provider refund or deployment is supplied by that foundation. Do not use legacy refund/substitute controls or edit a real entry as a workaround.
 **Use this guide when:** a request touches registrations, members-only access, products, payments, refunds, waivers, or private data.