Require current membership for free-event signup

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**COMMUNITY-004 / [#737](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/737) — SOURCE IN REVIEW:** October 15 owner rule requires current paid membership plus existing verified email and waiver for new free-event entries. The transaction checks current authority after reads; cancellation after expiry/suspension and immutable retry remain safe. Unit/UI and emulator regressions cover nonmembers, exact expiry, suspension, wrong UID, forgery, final seats and no-write denials. $25 individual/$30 family calendar-year policy is recorded, not activated; online dues and separate family accounts under a paid Family ID are selected for first launch; minor/privacy/retention and actual payment integration remain separate. Requested [policy drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) are unapproved and unused. No deployed/prod/real-payment claim; #731 stays closed with final6186640177.
+
 **RACE-SIM-001C / #731 — NATIVE TESTS VERIFIED, HANDOFF GATED:** actual fictional lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed on 2026-10-14, including real Auth/App Check/caller/current-authority boundaries and actual UI committed/lost-response retry. Exact retry changed none of six protected record update times; recipient-loss replay/revoke and terminal/current-revocation guards passed. Two fresh accounts/26 owned docs cleaned with fences/late absence; private browser SDK state/cache cleared, unused receiver closed/zero captures/port refused. Human permission-OFF confirmation and reviewed/current-CI handoff remain before closure or supervised use with fresh fixtures. Officer impact: verified fictional flow only; no real policy/payment/production readiness. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and root checkpoints. Deployment evidence: existing v6/669e2fb/archive94380430 and Hosting e21be35 unchanged, [native receipt6186206758](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); no new deploy or full backend completion. Earlier #731/#732 source/anonymous-only entries below are historical.
 
 **RACE-SIM-001C / #731 — STAGING DEPLOYED, OPEN:** PR734/merge `669e2fb`, exact PR38455181292/main38455775086 six jobs/every step, native v6/downloaded archive/resource/owner/MFA/invoker/unchanged profiles and dependent Hosting/public assets verified. Anonymous 390×844 screen passes, not signed-in lifecycle/security/cleanup. Officer impact: planned supervised fiction remains NOT AVAILABLE YET until that acceptance. Officer documentation: dated STAGING_COMMUNITY/entrypoints/maps/root checkpoint. Deployment evidence: [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731); earlier source-only/not-deployed entries are historical. No production/real payments or broader goal completion.

IMPLEMENTATION_PLAN.md

@@ -29,6 +29,8 @@ RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) pr
 
 ## 1. Program outcome
 
+**October 15 scope / #737 source:** free-event admission additionally requires canonical current membership inside the booking transaction. A pending request or verified email alone is insufficient. Expired/suspended membership still permits cancelling an existing signup; paid-term voluntary cancellation preserves access through the original end. Dave supplied $25 individual/$30 family calendar-year dues and no extra discretionary approval after verified identity, waiver and confirmed payment. Online dues and shared paid Family ID enrollment are now first-launch scope; final legal/data/guardian wording and ordinary production activation remain separate; the [drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) are not policy approval. Existing #707 receipts below describe their older behavior; #737 is not yet deployed.
+
 **#707 staging slice:** implement and test pending membership signup/withdrawal, paid-term cancellation intent and free-event signup/cancellation using one isolated service. No payment/privileged membership activation is prerequisite for these nonfinancial requests; those workflows remain separate. Fixed owner-approved staging release must verify exact merged source and all six main CI jobs, native source archive, explicit runtime/build identities and resource limits before staging Hosting. No production release is authorized.
 
 **Membership cancellation policy, 2026-10-11 — #705:** Dave approved retaining access until the already-paid annual term ends, without an automatic refund. Versioned backend source configuration and boundary regressions are a small dependency-clearing slice only. A member-owned durable cancellation request, retries/audit, UI and disposable hosted staging proof remain separate implementation work; do not route this request through legacy admin race cancellation or mark the membership ended early.

OFFICER_START_HERE.md

@@ -1,6 +1,8 @@
 # MPRC Website: Officer Start Here
 
-**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** the [supervised handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) now has actual signup, fictional credit return, recipient-accepted same-bib transfer, privacy, expiry, native security and committed/lost-response retry proof. Ask Dave/platform specialist for the complete dated acceptance/cleanup receipt and fresh fake fixtures before using it. The issue remains open until those handoff gates are recorded; production and real payments are **NOT AVAILABLE YET**. Older #731/#732 source-only or anonymous-only notes below are historical.
+**Minimum member launch — October 15 decisions; #737 SOURCE ONLY:** Dave set $25 individual/$30 family calendar-year dues. New free-event signup requires verified email, accepted waiver and current paid membership; no additional discretionary member approval follows satisfied requirements. The new source checks membership in the booking transaction and preserves cancellation after expiry. This change is **NOT AVAILABLE YET** on the deployed website. Online dues are selected for first launch; separate family accounts share a paid Family ID. Final policy/guardian handling remains undecided. Review the [privacy/waiver drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) and [source-only test procedure](./docs/officers/STAGING_COMMUNITY.md#current-membership-for-free-events--737-source-only). This source change adds no checkout or public external-payment instructions; paid-race commerce remains later. Earlier source checkpoints below are historical.
+
+**#731 final checkpoint — CLOSED October 15:** [native acceptance and cleanup](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186640177) are complete, including the human-confirmed local-access Block and final tab/kernel cleanup. No deleted fixture or resolved permission question is reopened. Production and real payments remain **NOT AVAILABLE YET**.
 
 **#731 fictional race screen — SOURCE PREPARED, NOT AVAILABLE YET:** the [planned review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) covers signup, fictional credit return and private recipient-accepted bib transfer. Local screen tests are not hosted proof. Dave/platform specialist must verify staging release, security, real screens and cleanup first; production and real payments remain untouched.
 

OPERATIONS_RUNBOOK.md

@@ -745,6 +745,8 @@ CI/staging must eventually include:
 
 ## 7. Change and release process
 
+**#737 source-only member admission change:** new free-event entries read membership with event/registration in one transaction and evaluate current entitlement after reads. Keep cancellation available after expiry/suspension and preserve exact command replay. No schema migration, new dependency/service/IAM/cost setting or production guard change. Run the new unit/UI and existing demo emulator transaction suite before a later exact-source release; record Function archive and Hosting publication separately. The requested [privacy/waiver drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) must not become an accepted document until approved. #731 acceptance/cleanup remains closed and its deleted fixtures must not be reused.
+
 ### Before merge
 
 1. Link one issue from [GITHUB_ISSUES.md](./GITHUB_ISSUES.md) or the corresponding GitHub issue.

SECURITY.md

@@ -264,6 +264,8 @@ This is source-only attack-surface reduction. The component had no runtime route
 
 ### Authorization
 
+**#737 source-only free-event admission:** verified email and a waiver cannot substitute for current membership. Every fresh join reads the caller-bound canonical authority in the same transaction as capacity and checks its term after reads. Missing/expired/future/suspended/wrong-UID/malformed authority denies without business, rate or command writes. Saved success is immutable; cancellation after expiry/suspension remains possible. Browser entitlement/payment/role fields never grant access. No new claim, permission, production fallback or deployed enforcement is asserted.
+
 **#716 fictional dues boundary — staging verified 2026-10-12:** `duesRecording` is separate from approval/event permissions and exists only in exact seven-field capability schema v2; v1 never acquires it. Native verified TOTP within ten minutes and native App Check remain mandatory. Every transaction reads current capability before immutable retry replay. Server-only synthetic policy fixes amount/currency/method/term; request accepts only a UUID confirmation, true test attestation, zero create revision and expected policy revision. A global server-hashed confirmation key prevents cross-officer duplicates; no arbitrary evidence/notes, bank refs, profiles, email, uploads or export. Receipt terms remain unlinked and cannot grant entitlement/claims. New collections are denied by existing default Rules, including browser admins. No new runtime permission, production fallback, provider call, real payment evidence or schema migration. #716 verified native Function v3/archive and Hosting d212fab, twenty-two hosted negative cases, retry/race/pagination, actual UI/offline/mobile/revocation and exact fixture cleanup. Rules430 checks passed. Fresh specialist-supplied fixtures and separate real-policy/production approval remain necessary.
 
 **#711 synthetic staging boundary (hosted proof and expired-session recovery verified 2026-10-12):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Natural expiry, cleared privileged UI and fresh native TOTP sign-in recovery passed on 2026-10-12, with independently renewed genuine browser App Check and native server acceptance. The no-terminal handoff and exact disposable cleanup passed; this is not lost-authenticator recovery or ordinary production access. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.

SYSTEM_DESIGN.md

@@ -26,6 +26,8 @@ The repository already contains a substantial prototype: a public React site, Fi
 
 ## 1. Goals and non-goals
 
+**October 15 member-launch policy / #737 source:** $25 individual and $30 family dues cover the calendar year; online dues and separate verified family accounts sharing a paid Family ID are selected for first launch; final privacy/waiver/retention and guardian handling remain undecided. Verified email, waiver acceptance and confirmed current dues suffice without another member-approval step. New free-event admission now reads canonical membership in the same transaction as capacity and samples the server clock after reads; expiry/suspension deny fresh joins but do not block existing cancellation. Exact saved success remains read-only. The staging/production environment guards and synthetic activation limits are unchanged. This is source, not a new deployment. See [the minimum launch scope](./docs/MEMBER_LAUNCH_SCOPE.md), [the officer procedure](./docs/officers/STAGING_COMMUNITY.md#current-membership-for-free-events--737-source-only) and [review-only policy drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md).
+
 **Fictional external dues — #716, staging verified 2026-10-12:** Dave chose fictional test amounts/methods/short terms on October 12. The existing isolated service gains only `admin_dues_record` and a bounded receipt projection. A separate expiring `duesRecording` permission in exact capability schema v2 is required; v1 retains its six-field behavior and denies this action. Server-only `communityConfig/duesTestTerm` supplies the fictional amount/currency/method/term/revision. One confirmation UUID creates a stable non-email membership ID, an unlinked authority/test term via the existing manual-evidence contract and an immutable `communityDues` receipt plus command audit. No UID association, entitlement/claim grant, member-record edit, Stripe/payment state, real policy, migration or provider action. Same-command retry is immutable; global confirmation uniqueness prevents another command/officer double-recording it. Only twenty minimal receipts per page; no profile/contact/bank data or exports. Runtime/IAM/cost limits are unchanged. Source PR717/merge d212fab and all six exact PR/main jobs passed; native Function v3/archive, staging Hosting, genuine attestation/TOTP, UI/offline/race/pagination/revocation and exact 51-document/two-account cleanup passed. See the staging guide for release-command caveat and fresh-fixture handoff; production remains unavailable.
 
 **Staging officer extension — #711, hosted checks and expired-session recovery verified 2026-10-12:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Function version 2 and Hosting source `57261ae`, native Auth/App Check/MFA, capability/race/retry/phone/offline/real-clock expiry and owned cleanup are recorded in #711 and the [staging guide](./docs/officers/STAGING_COMMUNITY.md). On 2026-10-12, natural ten-minute expiry denied the unchanged session; sign-out and fresh native TOTP sign-in restored the actual officer view, and a new genuine native App Check token passed the same server boundary. The no-terminal handoff and exact disposable cleanup passed. This is supervised synthetic staging only; ordinary officer access, lost-authenticator recovery and production are NOT AVAILABLE YET.