daliu · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/.github/lint-baseline.json b/.github/lint-baseline.json
@@ -10,11 +10,11 @@
   "targets": [
     "src"
   ],
-  "scannedFileCount": 131,
+  "scannedFileCount": 133,
   "scannedFilesByExtension": {
     ".js": 12,
     ".jsx": 35,
-    ".ts": 48,
+    ".ts": 50,
     ".tsx": 36
   },
   "errorCount": 113,
@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:5ba90c83db63c37a2a3cf738e5d923ba77d172937d79153896e5a2eea3133878",
+  "fingerprint": "sha256:f2e9add8612f9e8be9e77ae321ee247b21439f5f5999cbeca43dfe2a5cb46c31",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -128,6 +128,8 @@
     "src/services/accountEmail/accountEmailSender.ts",
     "src/services/analytics/analytics.test.ts",
     "src/services/analytics/analytics.ts",
+    "src/services/community/communityMemberStatus.test.ts",
+    "src/services/community/communityMemberStatus.ts",
     "src/services/community/communityService.test.ts",
     "src/services/community/communityService.ts",
     "src/services/community/fictionalRaceService.test.ts",

diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **COMMUNITY-004 / [#737](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/737) — SOURCE IN REVIEW:** October 15 owner rule requires current paid membership plus existing verified email and waiver for new free-event entries. The transaction checks current authority after reads; cancellation after expiry/suspension and immutable retry remain safe. Unit/UI and emulator regressions cover nonmembers, exact expiry, suspension, wrong UID, forgery, final seats and no-write denials. $25 individual/$30 family calendar-year policy is recorded, not activated; online dues and separate family accounts under a paid Family ID are selected for first launch; minor/privacy/retention and actual payment integration remain separate. Requested [policy drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) are unapproved and unused. No deployed/prod/real-payment claim; #731 stays closed with final6186640177.
 
 **RACE-SIM-001C / #731 — NATIVE TESTS VERIFIED, HANDOFF GATED:** actual fictional lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed on 2026-10-14, including real Auth/App Check/caller/current-authority boundaries and actual UI committed/lost-response retry. Exact retry changed none of six protected record update times; recipient-loss replay/revoke and terminal/current-revocation guards passed. Two fresh accounts/26 owned docs cleaned with fences/late absence; private browser SDK state/cache cleared, unused receiver closed/zero captures/port refused. Human permission-OFF confirmation and reviewed/current-CI handoff remain before closure or supervised use with fresh fixtures. Officer impact: verified fictional flow only; no real policy/payment/production readiness. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and root checkpoints. Deployment evidence: existing v6/669e2fb/archive94380430 and Hosting e21be35 unchanged, [native receipt6186206758](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); no new deploy or full backend completion. Earlier #731/#732 source/anonymous-only entries below are historical.

diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -1,5 +1,7 @@
 # MPRC Secure Commerce Implementation Plan
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **#731 native tests complete — 2026-10-14, handoff gated:** actual fictional lifecycle/privacy/expiry/mobile plus 38 native evaluations/27 distinct security/replay checks passed. UI response discarded only after real server commit recovered through the exact saved action with all six protected update times unchanged. Recipient-loss replay/revoke and terminal-state/caller-revocation protection passed. Two fresh accounts/26 owned records removed with fences/immediate+late absence; browser test credentials/cache cleared and unused receiver closed. Final browser-permission confirmation and reviewed documentation/current-CI receipt remain before issue closure or supervised use with fresh fixtures. No new deploy/build/service/IAM/Rules/provider/production/payment work. [Dated native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); earlier #731/#732 source/anonymous-only milestones below are historical. Whole-backend completion is not claimed.
 
 **#731 staging deployment checkpoint — 2026-10-13:** exact PR/main checks passed; backend v6/archive was verified before Hosting `669e2fb`. Anonymous phone-width UI/public assets pass, not signed-in acceptance. Continue genuine disposable security/lifecycle/privacy/failure/retry/expiry/mobile and fenced cleanup before closing #731. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; full backend goal/production/real payments remain separate.

diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
@@ -1,5 +1,7 @@
 # MPRC Website: Officer Start Here
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **Minimum member launch — October 15 decisions; #737 SOURCE ONLY:** Dave set $25 individual/$30 family calendar-year dues. New free-event signup requires verified email, accepted waiver and current paid membership; no additional discretionary member approval follows satisfied requirements. The new source checks membership in the booking transaction and preserves cancellation after expiry. This change is **NOT AVAILABLE YET** on the deployed website. Online dues are selected for first launch; separate family accounts share a paid Family ID. Final policy/guardian handling remains undecided. Review the [privacy/waiver drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) and [source-only test procedure](./docs/officers/STAGING_COMMUNITY.md#current-membership-for-free-events--737-source-only). This source change adds no checkout or public external-payment instructions; paid-race commerce remains later. Earlier source checkpoints below are historical.
 
 **#731 final checkpoint — CLOSED October 15:** [native acceptance and cleanup](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186640177) are complete, including the human-confirmed local-access Block and final tab/kernel cleanup. No deleted fixture or resolved permission question is reopened. Production and real payments remain **NOT AVAILABLE YET**.

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -1,5 +1,7 @@
 # MPRC Platform Operations Runbook
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **#731 native acceptance/handoff — 2026-10-14:** [current officer procedure](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates actual native/UI proof from final acceptance and cleanup gates. Existing v6/669e2fb/101386-byte94380430 archive and Hosting e21be35 remain unchanged; no redeploy is needed for these documentation facts. Actual lost-response retry, current authority/privacy, natural expiry and recipient-loss recovery passed. Two fresh fake accounts/26 exact owned records were removed with identity/create-time/update-time fences and immediate/late absence; private browser helper/Auth/matching staging SDK cache were cleared. The unused receiver closed with zero captures and a refused port. The specialist must record the human's temporary browser-permission OFF confirmation and owned-tab closure before final handoff. No workaround for blocked browser settings; no accounts/server left waiting for that input. Fresh fixtures, final receipt and Dave's supervision are required; production/payments stay untouched. Earlier #731/#732 source/anonymous-only notes below are historical.
 
 **#731 staging deployment checkpoint — 2026-10-13:** existing community service v6 and Hosting `669e2fb` are verified; no additional Function build is needed for this documentation. Signed-in tests/fixture cleanup and qualified officer use remain pending. Follow the [current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared), not old source-only/not-deployed checkpoints below. Preserve exact current/rollback evidence; fixture supply, native tests/cleanup and rollback remain specialist-only. Production/real payments untouched.

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,5 +1,7 @@
 # MPRC Security, Privacy, and Risk Plan
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **#731 native staging security — 2026-10-14:** [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758) records real verified password Auth and normal App Check: isolated missing/invalid Auth or attestation401, caller substitution403, extra authority/malformed input400, current/expired marker/capability and current native account denials403. Populated status omits other UIDs/contact/waiver/count/capacity. Firebase refuses unsupported tenant sign-in with INVALID_TENANT_ID; no tenant or valid nondefault-tenant token was created. Actual UI response loss after commit, exact retry without writes, terminal-state protection, recipient-loss replay/revoke and revoked-caller replay passed. No debug attestation/custom claims, new permission, Rule allowance, production or money action. Supervised use still requires the complete final cleanup/acceptance receipt and fresh fixtures. Earlier #731/#732 source/anonymous-only notes below are historical.
 
 **#731 staging deployment checkpoint — 2026-10-13:** native v6/archive/resources/owner/MFA/invoker/unchanged profiles and website assets are verified at `669e2fb`. Two requests without Auth and with missing/invalid attestation denied; this does not isolate App Check or qualify signed-in caller/grant/privacy tests. Those and disposable cleanup remain open. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; no production/payment/IAM authority expansion.

diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md
@@ -1,5 +1,7 @@
 # MPRC Platform System Design
 
+**Member screen preparation — #739, October 16, 2026, SOURCE ONLY:** the membership/free-event screen now validates bounded server status and action acknowledgements, binds the native account/app/default tenant and observed session, and hides stale controls at the earliest known membership/window deadline or after at most 60 seconds from read start. No polling is added. Exact uncertain retries stay within their original observed session. The responsive layout uses Pacific event dates and explicit loading, empty, unavailable and retry states. Backend-first release is required: older status responses without schema/time fields fail closed. No policy, payment, family enrollment, permission or production change. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+
 **#731 native staging acceptance — 2026-10-14:** actual lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed, including isolated Auth/App Check/caller/current-authority denials and actual UI committed/lost-response saved retry. Same existing v6/669e2fb archive and Hosting e21be35; no architecture/runtime/Rules/IAM/dependency/provider/production change. Exact owned accounts/records and browser SDK state were cleaned. Use remains gated on the complete dated acceptance/cleanup receipt and fresh fake fixtures; #731 stays open until final handoff gates are recorded. [Current officer handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier #731/#732 source/anonymous-only checkpoints below are historical, not current test status. The full backend/real-payment/public-launch objective remains incomplete.
 
 **#731 staging deployment checkpoint — 2026-10-13:** Function v6 and the staging website use `669e2fb`; exact archive, resource/identity/security settings, unchanged profiles and public assets passed verification. Signed-in race security/lifecycle/cleanup remain unqualified. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes below are historical checkpoints, not current deployment status. Production and real payments remain untouched.

diff --git a/docs/MEMBER_LAUNCH_SCOPE.md b/docs/MEMBER_LAUNCH_SCOPE.md
@@ -56,3 +56,11 @@ Check current Firebase trial/usage and the club's actual Stripe pricing privatel
 Next, complete the real account-recovery qualification and one coherent test-mode membership purchase/activation/family-enrollment workflow. Keep generic commerce/race/shop work out unless it is an actual dependency. Qualify current Rules/App Check, narrow runtime identities, exact backend-first publication, compatible rollback/isolated restoration and an officer screen-only walkthrough for the selected release.
 
 The [privacy, retention and waiver drafts](./legal/MEMBER_LAUNCH_DRAFTS.md) remain for club review. Source changed, tests passed, merge, staging deployment, production deployment, provider configuration and real behavior must be evidenced separately. #731's accepted fictional race evidence remains closed; no deleted fixture or sealed harness is reused.
+
+## Screen preparation — October 16, #739
+
+The current staging-only membership/free-event screen gains native-session fencing, closed response parsing, a bounded display lifetime and responsive layout. Backend status adds `schemaVersion: 1` and server `observedAtMs`; no persisted record changes. Release the compatible backend before its frontend. An old backend or malformed response displays an unavailable state instead of retaining old membership/signup controls. The client freshness timer never extends membership, chooses capacity or contacts a provider. Automatic token-session observation can trigger one status reread; freshness expiry itself requires explicit Refresh status and does not poll.
+
+The lint inventory adds the two new clean TypeScript files only. Existing reviewed findings remain byte-for-byte unchanged: 113 errors and six warnings elsewhere. No lint rule or allowance is weakened.
+
+Online annual dues, private family enrollment, account-recovery/provider qualification, approved policy and the final protected production release remain incomplete. The prototype request screen explicitly says online dues and family invitations are unavailable; it does not imply that a manual approval queue is the approved final membership flow.