Prepare bounded fictional race callable and private status

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**RACE-SIM-001C1 / #732 — SOURCE / DEMO ONLY:** child of open #731. Exact race-prefixed native-context routing, explicit same-project SDK app, current disposable authority/metadata, closed twenty-race manifest and consistent private read-only status. No broad query/Auth roster, other UID/contact/waiver/history/count/capacity/financial total projection; exact incoming offer only and uniform missing/unrelated denial. Fresh post-read time; original credit/index/retry and lost-recipient owner recovery preserved. Deterministic archive includes all necessary relative imports. Officer impact: race screens remain NOT AVAILABLE YET. Officer documentation: staging guide, entrypoints, Events-Shop-Members, maps and root status. Deployment evidence: none from this child; source/double/native-wrapper tests with mocked verifiers and actual demo SDK proof are not genuine hosted identity/App Check/deployment/UI. No production/payment/service/IAM/dependency/workflow/Rules-allowance/migration change. #731 retains typed client/screen, exact backend-first release, genuine security/UI/mobile/failure proof and exact owned hosted cleanup; the full backend goal stays open.
+
 **COMMUNITY-DUES-002 / #719 — STAGING VERIFIED 2026-10-12:** one immutable fictional receipt links deliberately to one owner-marked disposable pending account and activates its unchanged current test term. Separate v3 capability, recent native TOTP/App Check, authoritative verified/enabled Auth, exact guards, atomic uniqueness and permission-first replay; no real policy/data/money, Auth claim, IAM/service/schedule/dependency/production change. Officer impact: supervised screen-only linking and cancellation/original-expiry verification. Officer documentation: STAGING_COMMUNITY, entrypoints, ACCESS_CONTINUITY, EVENTS_SHOP_MEMBERS, glossary and maps. Deployment evidence: PR720 merged b6a8fd57d9add466da73df1d33b69e131e3fecbd after six exact PR/main jobs and every step passed. Native communityActions version 4 and staging Hosting match that source; the downloaded 91,793-byte archive matches SHA-256 47f11b8bec7f5ae58281c9029a015e9cc751a04e5ad3eafe3234441fa3a963db. Forty-four hosted cases (32 denial cases), atomic races, immutable retries, actual officer/member UI, offline retry, phone-size DOM layout, cancellation and natural expiry passed. Six disposable users and 47 exact owned documents were removed; native absence and late profiles were verified. Both capabilities were disabled first; browser sign-out, Apps-on-device OFF, normal networking/viewport, closed tab/receiver and memory disposal complete the test handoff. Profiles v2/v1/2843388, App Check/MFA and the six-permission min0/max2 runtime remain unchanged. The release command reported its existing generic post-deploy failure; independent native checks qualified the result without repeating deployment or bypassing a guard. Reporting cause remains unqualified. Production/runmprc.com and real payments were untouched. #716 remains historical recording-only proof; broad #115/#81 and real launch are separate.
 
 **COMMUNITY-DUES-001 / #716 — staging verified 2026-10-12:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: PR717 merged d212fab; all six exact PR/main jobs and every step passed. Native Function v3/archive and staging Hosting matched; twenty-two hosted denials, immutable retry/race, twenty-plus-one pages, actual UI/offline/390×844/revocation and 51-document/two-account cleanup passed. Release-command reporting caveat and supervised fresh-fixture handoff are recorded in STAGING_COMMUNITY; production/runmprc.com and real payments were untouched. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof.

IMPLEMENTATION_PLAN.md

@@ -1,5 +1,7 @@
 # MPRC Secure Commerce Implementation Plan
 
+**#731 review split / #732 — SOURCE / DEMO ONLY:** first review exact callable routing, explicit SDK realm, private bounded read-only status and deterministic archive independently. Current source/double, native-wrapper-with-mocked-verifiers and actual demo transaction/metadata tests qualify only that child. Then #731 adds strict client parsing, context fences and minimal fictional member screens; exact green-main backend archive must deploy/verify before staging Hosting. Genuine native Auth/App Check denials, actual UI/retry/expiry/recipient-loss/mobile proof and exact owned hosted cleanup are still required. No production, real payments, new service/dependency/workflow/IAM, backfill or broader goal completion is implied; earlier #727/#729 nonintegration notes are historical.
+
 **#729 progression — SOURCE / DEMO ONLY:** implement fictional entry creation, unique enrollment and atomic transitions/immutable retries before screens. Bounded native Auth metadata, expiring disposable authority and exact SDK realm checks are tested with real demo transactions; existing Rules deny the nine namespaces. Continue with platform-verified caller/App Check, minimal status/RPC/client contracts and exact backend-first staging release/UI/owned cleanup. No current deployed import, new workflow/service/IAM, financial or production action; #727/#729 are dependencies, not full backend completion.
 
 **#727 fictional race foundation — SOURCE ONLY:** first test a closed pure transition model without provider calls or deployed integration. Then implement native Auth/App Check/disposable-target/permission admission and atomic event/entry/command receipts; test actual concurrency and immutable retries. Only afterward add minimal staging screens and perform exact backend-first Function/Hosting deployment, genuine disposable UI/security/lifecycle checks and owned cleanup. No real rules/payments/production authority is implied; #724 core stays unchanged.

OFFICER_START_HERE.md

@@ -1,5 +1,7 @@
 # MPRC Website: Officer Start Here
 
+**Fictional race boundary — #732, SOURCE / DEMO ONLY:** safe backend routing and private test status are prepared, but there is no new deployed race screen yet. Use the [source review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-boundary--732-source-only) to ask for proof. #731 still needs actual staging release, disposable screens and cleanup. Do not use legacy refund/substitute controls or real member/payment details.
+
 **Member status — #724, STAGING VERIFIED 2026-10-13:** the member page separates event availability from stored signup history and hides old status after a failed read. Actual screens, exact retry, natural test-term expiry and disposable cleanup passed. Use the [screen-only review](./docs/officers/STAGING_COMMUNITY.md#current-member-status--724-staging-verified) with fresh specialist-supplied fictional fixtures. Production and real payments remain unavailable.
 
 **Fictional account linking — #719, STAGING VERIFIED 2026-10-12:** a separate staging permission links one fictional receipt to a specialist-marked disposable pending account. Test access ends at the original receipt term, including after cancellation; no Auth role or money changes. Use the [screen-only guide](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) only with fresh specialist-supplied private fixtures. Native Function/Hosting, actual screens/offline/retry/race/cancel/expiry/revocation and exact cleanup passed. Old accounts/records are removed; production and real club rules remain unavailable.

OPERATIONS_RUNBOOK.md

@@ -1,5 +1,7 @@
 # MPRC Platform Operations Runbook
 
+**#732 source boundary — NOT DEPLOYED:** race routes/status are now connected in source and included in the prepared archive, not the existing staging v5 runtime or website. `communityConfig/fictionalRaces` must be an exact fictional manifest with no more than twenty IDs; missing/corrupt configuration denies rather than discovering entries. Current caller marker/own-entry permission and verified/enabled Auth are required for status too. Own history and privately supplied named offers only; no officer queries a roster, edits records or enters real details. Status uses consistent reads and fresh time, adds no write/poll or scheduled cleanup. #731's specialist must supply fixtures, exact green reviewed release, genuine security/UI proof and identity/update-time-fenced cleanup before the screen becomes available. Source rollback is a reviewed revert; there is no cloud change from this child to undo. Keep the existing exact staging/rollback proof and six-permission/min0/max2/256MB/30s scope. Historical #727/#729 archive-exclusion notes describe older milestones; production and real payments remain untouched.
+
 **#729 fictional persistence — SOURCE / DEMO ONLY:** no current service release is needed: new files remain outside the deployed entrypoint/archive. Local tests use only explicitly selected loopback Auth/Firestore demo SDKs; caller context is synthetic, not genuine native token/App Check proof. Nine server-only namespaces hold fictional event/policy/entry/enrollment/target/permission/command/audit/rate state. A specialist supplies current expiring markers and own-entry permissions for actors and relevant verified/enabled disposable mutation targets; receipts never override caller revocation/expiry, missing indexes or corrupt state. Read-only acknowledgement and owner withdrawal do not require continued recipient access. No member/officer edits a record, enters real payment data or uses a legacy substitute/refund control. Keep real policy/provider money and production untouched. Future callable/client integration and exact hosted security/UI/cleanup evidence remain unavailable. Local cleanup removes only task-owned demo Auth UIDs and test namespaces, verifies absence and shuts down emulators before removing owned idle logs; no retention/backfill/hosted cleanup decision is made here.
 
 **#727 fictional race foundation — NOT AVAILABLE YET:** pure helper/tests only; it is intentionally excluded from callable/client imports and the community runtime archive. Do not deploy unchanged Functions or use legacy real-payment/runner-substitution screens for this test. Future operation needs current native identity/authority, expiring owner-marked disposable targets, strict fictional configuration, atomic event/entry/immutable receipt persistence, bounded retry/rate/audit and actual backend-first staging/UI/cleanup proof. Source simulation has no provider/account state to undo. Current #724 staging remains unchanged; real club rules, financial/provider work and production are separate.

SECURITY.md

@@ -1,5 +1,7 @@
 # MPRC Security, Privacy, and Risk Plan
 
+**#732 race routing/status — SOURCE / DEMO ONLY:** clone bounded closed input before inspecting its action; only six exact race-prefixed routes enter the existing native callable wrapper. Platform-verified UID/claims and App Check are required, never browser flags. Status also requires current exact expiring marker/own-entry permission, default-tenant recent verified password context and enabled/verified native caller metadata. A consistent read-only transaction reads at most twenty configured races, caller indexes and necessary exact entry/index records, not a query/roster or broad Auth lookup. Only own state and an exactly named offer to the caller are projected; no other UID/contact/waiver/count/capacity/total is returned. Missing/unrelated incoming IDs share one fixed denial. Fresh post-read time prevents slow reads extending access/availability. SDK/config/state errors are redacted; status writes nothing. The archive now includes these source helpers, with no Rules allowance or runtime permission expansion. Historical #727/#729 integration limits are superseded in source only: native HTTP tests mock verifiers, demo caller context remains synthetic, no deployed native token/App Check/UI qualification exists yet, and Auth metadata is still not locked by a Firestore transaction.
+
 **#729 fictional server transactions — SOURCE / DEMO ONLY:** strict account-bound commands, closed record/config/grant schemas, exact staging/demo app/realm, unsupported-tenant denial, current expiring marker/own-entry permission and bounded read-only verified/enabled Auth metadata checks precede both mutation and receipt replay. Original/current runner enrollment indexes must match; orphans and corrupt receipts deny. Server controls fictitious cents, bib, deadlines, counts, waiver and revisions; unknown price/role/profile fields reject before Auth lookup. Atomic fingerprinted receipt/audit/rate plus entry/index/count state resolves retries/races; no mutable audit array or request/token/profile logging. Browser reads/lists/creates/updates/deletes remain denied, even for admins, by unchanged Rules. These source/demo tests supply no native callable token-signature or App Check proof and no instantaneous Auth/Firestore distributed revocation guarantee. No deployed integration, IAM/service/dependency or real financial/production change; genuine platform binding and hosted denial/UI/cleanup proof remain required.
 
 **#727 fictional race foundation — SOURCE ONLY:** strict closed synthetic record/request shapes, integer bounds, expected revisions, fixed safe errors and original evidence preservation apply only to an unconnected pure helper. Fake identifier prefixes or simulation markers are not identity, disposable-target, permission, App Check, atomic persistence/retry or provider proof. No callable, client, release-bundle import, IAM/Rule/service change or deployment; existing #724 staging and production boundaries unchanged. A later server boundary must independently supply native verified identities, current scoped authority, target markers, time, transactional command receipts/counts and genuine staging denial/race/retry/cleanup evidence before the screen is available.

STRIPE_COMMERCE_DESIGN.md

@@ -1,5 +1,7 @@
 # Stripe, Race Registration, and Merchandise Design
 
+**#732 boundary — SOURCE / DEMO ONLY:** exact staging race RPC routing and minimal own-entry status now exist in source, without any Checkout, PaymentIntent, Refund, provider state or real-money action. Simulated credits are explicitly fictional integer cents. No client price/deadline/recipient profile or finance-role bypass; original credit/waiver/bib and immutable retry behavior remain #729's rules. Native HTTP tests use verifier doubles; real local Auth metadata/Firestore tests are not hosted identity/App Check proof. #731 still owns client and genuine hosted acceptance. This child does not deploy, establish real club rules, replace finance permission/recent MFA/provider reconciliation, or close real refund/transfer launch blockers. Earlier #727/#729 nonintegration statements are historical milestone boundaries.
+
 **#729 simulation persistence — SOURCE / DEMO ONLY:** server-configured fictional entry creation and atomic simulated credit return/bib transfer use separate records and never Stripe/payment state. No client amount, discount, refund total, arbitrary runner profile or offer deadline is accepted. Original fictitious credit remains immutable; transferred runners cannot redirect it. Same-command receipts replay without writes after renewed authority/identity/state checks; lost-acknowledgement recovery and native demo final-seat/competing transitions are tested. Read-only Auth metadata is the only external dependency of the transaction, not a provider money action. Default-tenant verified password context here is for member-owned fictional credits only; it does not replace finance capability/recent MFA, provider truth, refund operation/reconciliation or real policy gates. No live callable/client/deployment from this child.
 
 **#727 fictional race foundation — SOURCE ONLY:** a separate unconnected pure model uses explicit fictional cents/returned-credit fields and closed simulation markers. It neither reads nor creates a Checkout, PaymentIntent, Refund, provider object, webhook or real payment status. Test-only full credit return/recipient-accepted bib transfer rules do not approve actual club policy or close PAY-004/PAY-005/RACE-001. Real refunds still require verified provider state, finance permission/recent MFA, durable idempotent operations and reconciliation below. No runtime/client/release-bundle import or deployment.