docs: record native fictional race staging acceptance

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**RACE-SIM-001C / #731 — NATIVE TESTS VERIFIED, HANDOFF GATED:** actual fictional lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed on 2026-10-14, including real Auth/App Check/caller/current-authority boundaries and actual UI committed/lost-response retry. Exact retry changed none of six protected record update times; recipient-loss replay/revoke and terminal/current-revocation guards passed. Two fresh accounts/26 owned docs cleaned with fences/late absence; private browser SDK state/cache cleared, unused receiver closed/zero captures/port refused. Human permission-OFF confirmation and reviewed/current-CI handoff remain before closure or supervised use with fresh fixtures. Officer impact: verified fictional flow only; no real policy/payment/production readiness. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and root checkpoints. Deployment evidence: existing v6/669e2fb/archive94380430 and Hosting e21be35 unchanged, [native receipt6186206758](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); no new deploy or full backend completion. Earlier #731/#732 source/anonymous-only entries below are historical.
+
 **RACE-SIM-001C / #731 — STAGING DEPLOYED, OPEN:** PR734/merge `669e2fb`, exact PR38455181292/main38455775086 six jobs/every step, native v6/downloaded archive/resource/owner/MFA/invoker/unchanged profiles and dependent Hosting/public assets verified. Anonymous 390×844 screen passes, not signed-in lifecycle/security/cleanup. Officer impact: planned supervised fiction remains NOT AVAILABLE YET until that acceptance. Officer documentation: dated STAGING_COMMUNITY/entrypoints/maps/root checkpoint. Deployment evidence: [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731); earlier source-only/not-deployed entries are historical. No production/real payments or broader goal completion.
 
 **RACE-SIM-001C / #731 — CLIENT SOURCE PREPARED, OPEN:** closed staging request/status/ack parsing and `/community/races` screen cover synthetic signup, cancellation/full credit return, private offer/recipient waiver acceptance/revoke, exact retry and context/stale-state clearing. No migration, money/provider action, dependency/service/workflow/IAM/Rules allowance. Officer impact: planned supervised fictional screen, NOT AVAILABLE YET. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS and SYSTEM_MAPS. Deployment evidence: local doubles/full checks only at this milestone; genuine native security, exact backend-first Function/Hosting release, actual screens and fenced cleanup remain required. #732's backend source is merged; neither source milestone closes #731 or the full backend goal.

IMPLEMENTATION_PLAN.md

@@ -1,5 +1,7 @@
 # MPRC Secure Commerce Implementation Plan
 
+**#731 native tests complete — 2026-10-14, handoff gated:** actual fictional lifecycle/privacy/expiry/mobile plus 38 native evaluations/27 distinct security/replay checks passed. UI response discarded only after real server commit recovered through the exact saved action with all six protected update times unchanged. Recipient-loss replay/revoke and terminal-state/caller-revocation protection passed. Two fresh accounts/26 owned records removed with fences/immediate+late absence; browser test credentials/cache cleared and unused receiver closed. Final browser-permission confirmation and reviewed documentation/current-CI receipt remain before issue closure or supervised use with fresh fixtures. No new deploy/build/service/IAM/Rules/provider/production/payment work. [Dated native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); earlier #731/#732 source/anonymous-only milestones below are historical. Whole-backend completion is not claimed.
+
 **#731 staging deployment checkpoint — 2026-10-13:** exact PR/main checks passed; backend v6/archive was verified before Hosting `669e2fb`. Anonymous phone-width UI/public assets pass, not signed-in acceptance. Continue genuine disposable security/lifecycle/privacy/failure/retry/expiry/mobile and fenced cleanup before closing #731. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; full backend goal/production/real payments remain separate.
 
 **#731 client milestone — SOURCE PREPARED:** strict staging client and minimal member screen now have local positive/negative/context/failure/retry/expiry tests. Review and merge this source independently of deployment. Next verify all six exact current-main jobs/every step, deploy/read back the changed backend archive first, then publish staging Hosting and finish genuine security/actual UI/mobile/failure/expiry/owned cleanup. No new service/dependency/workflow/IAM or production/payment work; #731 and the broader backend goal remain open until native acceptance.

OFFICER_START_HERE.md

@@ -1,6 +1,6 @@
 # MPRC Website: Officer Start Here
 
-**#731 latest checkpoint — STAGING DEPLOYED 2026-10-13, TESTS STILL OPEN:** the [current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates verified deployment from unfinished signed-in race/cleanup tests. The planned officer flow is NOT AVAILABLE YET; ask Dave/platform specialist for the later acceptance receipt and fresh private fixtures. Older source-only/not-deployed notes below are historical. No real payments or production changes.
+**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** the [supervised handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) now has actual signup, fictional credit return, recipient-accepted same-bib transfer, privacy, expiry, native security and committed/lost-response retry proof. Ask Dave/platform specialist for the complete dated acceptance/cleanup receipt and fresh fake fixtures before using it. The issue remains open until those handoff gates are recorded; production and real payments are **NOT AVAILABLE YET**. Older #731/#732 source-only or anonymous-only notes below are historical.
 
 **#731 fictional race screen — SOURCE PREPARED, NOT AVAILABLE YET:** the [planned review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) covers signup, fictional credit return and private recipient-accepted bib transfer. Local screen tests are not hosted proof. Dave/platform specialist must verify staging release, security, real screens and cleanup first; production and real payments remain untouched.
 

OPERATIONS_RUNBOOK.md

@@ -1,5 +1,7 @@
 # MPRC Platform Operations Runbook
 
+**#731 native acceptance/handoff — 2026-10-14:** [current officer procedure](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates actual native/UI proof from final acceptance and cleanup gates. Existing v6/669e2fb/101386-byte94380430 archive and Hosting e21be35 remain unchanged; no redeploy is needed for these documentation facts. Actual lost-response retry, current authority/privacy, natural expiry and recipient-loss recovery passed. Two fresh fake accounts/26 exact owned records were removed with identity/create-time/update-time fences and immediate/late absence; private browser helper/Auth/matching staging SDK cache were cleared. The unused receiver closed with zero captures and a refused port. The specialist must record the human's temporary browser-permission OFF confirmation and owned-tab closure before final handoff. No workaround for blocked browser settings; no accounts/server left waiting for that input. Fresh fixtures, final receipt and Dave's supervision are required; production/payments stay untouched. Earlier #731/#732 source/anonymous-only notes below are historical.
+
 **#731 staging deployment checkpoint — 2026-10-13:** existing community service v6 and Hosting `669e2fb` are verified; no additional Function build is needed for this documentation. Signed-in tests/fixture cleanup and qualified officer use remain pending. Follow the [current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared), not old source-only/not-deployed checkpoints below. Preserve exact current/rollback evidence; fixture supply, native tests/cleanup and rollback remain specialist-only. Production/real payments untouched.
 
 **#731 member screen — SOURCE PREPARED, NOT AVAILABLE YET:** use the [planned no-terminal review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) only after the specialist supplies native release/security/UI/cleanup proof and fresh private fixtures. Keep the same fixed staging target and resource limits; no new polling, scheduler or financial provider. Account/permission/config supply, backend-first deployment/readback and fenced cleanup/rollback remain specialist-only. Existing v5/Hosting485be670 are historical deployed proof, not race-screen proof; production and real payments stay untouched.

SECURITY.md

@@ -1,5 +1,7 @@
 # MPRC Security, Privacy, and Risk Plan
 
+**#731 native staging security — 2026-10-14:** [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758) records real verified password Auth and normal App Check: isolated missing/invalid Auth or attestation401, caller substitution403, extra authority/malformed input400, current/expired marker/capability and current native account denials403. Populated status omits other UIDs/contact/waiver/count/capacity. Firebase refuses unsupported tenant sign-in with INVALID_TENANT_ID; no tenant or valid nondefault-tenant token was created. Actual UI response loss after commit, exact retry without writes, terminal-state protection, recipient-loss replay/revoke and revoked-caller replay passed. No debug attestation/custom claims, new permission, Rule allowance, production or money action. Supervised use still requires the complete final cleanup/acceptance receipt and fresh fixtures. Earlier #731/#732 source/anonymous-only notes below are historical.
+
 **#731 staging deployment checkpoint — 2026-10-13:** native v6/archive/resources/owner/MFA/invoker/unchanged profiles and website assets are verified at `669e2fb`. Two requests without Auth and with missing/invalid attestation denied; this does not isolate App Check or qualify signed-in caller/grant/privacy tests. Those and disposable cleanup remain open. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; no production/payment/IAM authority expansion.
 
 **#731 client — SOURCE PREPARED, NOT DEPLOYED:** closed plain-object/array parsing rejects extra fields, accessors, coercions, malformed bounds and mismatched request acknowledgements before display. UI/transport bind the same verified disposable SDK account/app/default tenant; observed session epochs fence even same-UID renewals. No token extraction/logging, direct database access or runner directory. Failed/uncertain reads and known deadlines remove old controls; exact saved retries never cross account/session/provider changes. These local tests use SDK/service doubles, not genuine hosted Auth/App Check proof; server authority, native release and hosted acceptance remain required.

STRIPE_COMMERCE_DESIGN.md

@@ -1,5 +1,7 @@
 # Stripe, Race Registration, and Merchandise Design
 
+**#731 fictional native acceptance — 2026-10-14:** actual signup, full fictional credit return, same-bib recipient transfer, revoke and original credit ownership passed in staging. Native committed/lost-response retry preserved one seat/receipt/audit, did not resurrect cancellation and could not bypass current authority. [Proof and supervised gate](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). These integer-credit simulations are not provider-backed payment/refund evidence; no real policy, finance authorization, Stripe object or production launch changed. Complete acceptance/cleanup receipt and fresh fake fixtures remain prerequisites; earlier #731/#732 source-only notes below are historical.
+
 **#731 staging deployment checkpoint — 2026-10-13:** Function v6/website `669e2fb` and their archive/public assets are verified. Fictional credits remain disconnected from Stripe and real money; signed-in race/cleanup acceptance is pending. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical. No real policy, provider payment or production launch is approved.
 
 **#731 member screen — SOURCE PREPARED, NOT DEPLOYED:** UI labels all amounts and returns fictional credit, never paid/refunded money. It accepts no client price, deadline, finance role or runner profile; transfer keeps the original credit owner. No provider SDK, Checkout, payment/refund object or real rule is added. Hosted staging release/UI/security/cleanup remain open; finance/MFA/provider reconciliation and production gates are unchanged.

SYSTEM_DESIGN.md

@@ -1,5 +1,7 @@
 # MPRC Platform System Design
 
+**#731 native staging acceptance — 2026-10-14:** actual lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed, including isolated Auth/App Check/caller/current-authority denials and actual UI committed/lost-response saved retry. Same existing v6/669e2fb archive and Hosting e21be35; no architecture/runtime/Rules/IAM/dependency/provider/production change. Exact owned accounts/records and browser SDK state were cleaned. Use remains gated on the complete dated acceptance/cleanup receipt and fresh fake fixtures; #731 stays open until final handoff gates are recorded. [Current officer handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier #731/#732 source/anonymous-only checkpoints below are historical, not current test status. The full backend/real-payment/public-launch objective remains incomplete.
+
 **#731 staging deployment checkpoint — 2026-10-13:** Function v6 and the staging website use `669e2fb`; exact archive, resource/identity/security settings, unchanged profiles and public assets passed verification. Signed-in race security/lifecycle/cleanup remain unqualified. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes below are historical checkpoints, not current deployment status. Production and real payments remain untouched.
 
 **#731 member screen — SOURCE PREPARED, NOT DEPLOYED:** a separate `/community/races` route/link uses the same staging service, exact bounded DTOs and server-supplied entry IDs/revisions. Same Auth/Functions app, verified disposable caller, default tenant and session/provider generation fences prevent late cross-context display/retry. Failed reads hide old controls; saved commands retry exactly; acceptance rereads own status without the consumed offer. Conservative deadline timers clear status without polling. No migration, runtime/Rules/IAM/service/dependency change or money action; genuine native security, backend-first release, actual screens and fenced cleanup remain open.

docs/officers/EVENTS_SHOP_MEMBERS.md

@@ -1,6 +1,6 @@
 # Events, Shop, Members, and Money
 
-**#731 latest checkpoint — STAGING DEPLOYED 2026-10-13:** only deployment/archive/public assets and the signed-out page are verified. Signed-in race actions/security/cleanup and qualified officer use remain pending. [Current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Older source-only/not-deployed notes are historical; do not use legacy refund/substitute controls or real details.
+**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** [current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) records actual fictional signup/credit return/same-bib transfer/revoke, privacy, expiry/mobile and native security/committed lost-response retry. Use only fresh fake fixtures after Dave/specialist supplies the complete dated acceptance/cleanup receipt. #731 stays open until final handoff gates are recorded; real refunds, payments, club policy and production remain **NOT AVAILABLE YET**. Older #731/#732 source/anonymous-only notes below are historical; never use legacy controls or real details for these tests.
 
 **#731 member screen — SOURCE PREPARED, NOT AVAILABLE YET:** the [planned screen review](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) covers fictional signup, credit return and privately named bib offers/acceptance/revocation. Native staging release/security/screens/cleanup still require the specialist; local service doubles do not prove hosted behavior. No real refund, payment, club policy or production change is available.
 

docs/officers/README.md

@@ -1,6 +1,6 @@
 # Officer Website Handbook
 
-**#731 latest checkpoint — 2026-10-13:** deployment/archive/public assets are verified in staging, but signed-in race security/screens and disposable cleanup remain open. Use the [current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared); its planned procedure is NOT AVAILABLE YET. Older source-only/not-deployed notes are historical. Production and real payments stay untouched.
+**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** [supervised fictional race review](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) has actual lifecycle/privacy/expiry/mobile and genuine security/committed-retry proof. A complete dated acceptance/cleanup receipt and fresh specialist-supplied fake fixtures are required before use. #731 stays open until the final handoff gates are recorded; production and real payments remain **NOT AVAILABLE YET**. Older #731/#732 source/anonymous-only notes below are historical.
 
 [#731's fictional race screen](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) is source prepared, **NOT AVAILABLE YET**. A separate dated native release/security/screen/cleanup receipt is required before the planned review. No real payment, policy or production change is supplied.