[daliu]

Outcome

A verified account without current membership can currently take a free-event place. Require canonical current membership inside the same transaction as capacity, while preserving cancellation after expiry/suspension and read-only replay of saved success.

Scope

• Issue: COMMUNITY-004 — Require current membership for new free-event signups #737 (source slice; do not close broader member/provider/production programs).
• Server reads membership with event/registration and samples time after reads. Missing, pending, expired, future, suspended, wrong-UID or malformed authority cannot create a signup or command/rate write. An expired member can still cancel an existing signup.
• Member screen disables waiver/new-signup controls for noncurrent membership, keeping existing cancellation available.
• Record Dave's $25 individual/$30 family calendar-year rule, selected online dues and separate verified family accounts under one paid Family ID. Proposed family enrollment uses private single-use invitations; a bare Family ID never authorizes access. This PR does not implement payment or family enrollment.
• Add requested privacy/retention/waiver drafts for review. They are unused and unapproved; no real person accepts them. Correct the current officer RACE-SIM-001C — Connect fictional race staging RPC status and member screens #731 checkpoint to its accepted closed cleanup state while preserving dated history.
• No schema migration, dependency, workflow, IAM, provider, real-data or payment change; production guards remain.

Officer handoff

Officer impact: Only current members can create new free-event signups after the later release; former members can still cancel. No extra discretionary member approval is added.

Officer documentation: OFFICER_START_HERE.md; docs/officers/README.md, EVENTS_SHOP_MEMBERS.md, STAGING_COMMUNITY.md, SYSTEM_MAPS.md; docs/MEMBER_LAUNCH_SCOPE.md; docs/legal/MEMBER_LAUNCH_DRAFTS.md; matching root architecture/security/operations/status notes.

Approving role: Dave for source/release; club privacy/legal/insurance owner for final policy/guardian wording. Standing build/deploy approval is retained; policy approval is not inferred from it.

Preview: deterministic member-screen tests; no real account or screenshot. Undo: hold publication or use a compatible reviewed correction/rollback; never edit a member or booking directly.

Deployment evidence: No new Function/Hosting/production/provider deployment. Existing #731 accepted staging receipt stays closed and its fixtures/harness are untouched. Exact current deployment remains dated prior evidence, not reverified by this source change.

Validation

• Reproduced the defect before the fix: 10 new membership-gate regressions failed because nonmembers/expired members could join; 4 controls passed.
• Focused backend: 155 passed; new admission suite: 14 passed. Focused member screen: 21 passed.
• Full local Node22 backend: 7,978 passed, 82 emulator-only skips (4 suites). Java is not installed locally. Exact-head CI38767846712 subsequently passed all six jobs and every step. Its Node22 emulator job executed communityActions.emulator.test.js and the new membership suite:7,997 passed/63 separate-journal skips; the dedicated command-journal job passed separately.
• Full frontend: 1,467 passed. Frontend non-mutating lint baseline and Functions lint passed. Initial new style findings were fixed without changing the baseline.
• Synthetic staging build in a task-owned output directory passed, and the executable Firebase artifact verifier passed; existing ignored handoff build/rollback material was preserved.
• Protected release/hosting checks: 43 passed. git diff --check passed. No new dependency or GitHub Actions workflow.

Proof by surface

Source changed and local checks passed. Code merged: not yet. Website published/runmprc.com/Firebase deployed/provider configured/production behavior: not changed or qualified by this PR. Exact-head source/emulator CI38767846712 is complete and green; the Netlify synthetic preview also passed. No provider acceptance or production behavior is inferred.

Safety review

• No secrets, member/payment records, private URLs or recovery codes.
• Source-only changes and draft policy are clearly unavailable/unapproved.
• Local emulator skips are explicit; no live proof inferred from green tests.
• Updated flow map and one-sentence text alternative.
• Officer screen-only readthrough: release, test fixture supply, recovery and cleanup remain explicit specialist work; no terminal/database workaround.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e616b37
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6ad0fcc346673d614d7713d8
😎 Deploy Preview	https://deploy-preview-738--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Owner-delegated Opus code approval — October 16, 2026

Dave instructed: “Approval should come automatically if Opus 5.5 medium/max approve on a code review.”

Independent native Claude CLI2.1.280 review ran exact model claude-opus-5-5, max effort, with only Read/Grep/Glob in safe/restricted mode and no fallback, hooks/plugins/MCP, shell or edit tools. Native init and final model usage confirm the exact model; final verdict is APPROVE for head e616b37, base d90cb22. It found no correctness or security regression.

The reviewer inspected the actual transaction, authority reducer, callable identity boundary, UI, unit/emulator fixtures, Rules, CI and draft/officer material. It confirmed current membership and capacity share a transaction, time is sampled after reads, denials precede writes, saved success is read-only, cancellation remains available after expiry and drafts remain unused.

Non-blocking evidence limitation: the suspension race test allows either valid serializable outcome, so that test alone does not detect moving membership outside the transaction. Actual code inspection establishes the current same-transaction read. The reviewer had no shell for hashes and its CI projection lacked the head SHA; the orchestrator independently rehashed every changed file and freshly verified run38767846712 binds this exact head, all six jobs and every step success, latest exact-head CI, unchanged PR/main base and a clean source tree.

Code approval is accepted under Dave's delegation. GitHub still requires another account's review and cannot accept author self-approval; the acting owner will use the existing administrator merge capability for this exact passing head and record it as an owner-authorized review-gate override, not a fabricated GitHub APPROVED review. No branch protection is edited and no new reviewer identity is created.

Officer impact: current-member admission source accepted; membership/event production remains unavailable. Officer documentation: PR738 source procedure/maps and draft packet remain unchanged. Deployment evidence: code review and exact-head CI only; no new Firebase/Hosting/provider/production deployment or payment. Final privacy/retention/waiver/guardian policy, protected release and provider/live-payment gates remain separate. #731 sealed evidence/fixtures remain untouched.