Build test-mode annual dues and automatic payer activation

.github/lint-baseline.json

@@ -10,12 +10,12 @@
   "targets": [
     "src"
   ],
-  "scannedFileCount": 133,
+  "scannedFileCount": 137,
   "scannedFilesByExtension": {
     ".js": 12,
     ".jsx": 35,
-    ".ts": 50,
-    ".tsx": 36
+    ".ts": 52,
+    ".tsx": 38
   },
   "errorCount": 113,
   "warningCount": 6,
@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:f2e9add8612f9e8be9e77ae321ee247b21439f5f5999cbeca43dfe2a5cb46c31",
+  "fingerprint": "sha256:b4fdd4e8efba6c011d293d96f8453a4e2dccccddf7907e2ff9b67cf2b74ba81f",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -85,6 +85,8 @@
     "src/pages/community/CommunityAdmin.tsx",
     "src/pages/community/FictionalRaces.test.tsx",
     "src/pages/community/FictionalRaces.tsx",
+    "src/pages/community/TestDues.test.tsx",
+    "src/pages/community/TestDues.tsx",
     "src/pages/contact/Contact.jsx",
     "src/pages/events/EventCalendar.tsx",
     "src/pages/events/EventDetail.tsx",
@@ -134,6 +136,8 @@
     "src/services/community/communityService.ts",
     "src/services/community/fictionalRaceService.test.ts",
     "src/services/community/fictionalRaceService.ts",
+    "src/services/community/testDuesService.test.ts",
+    "src/services/community/testDuesService.ts",
     "src/services/community/testSupport/fictionalRaceFixtures.ts",
     "src/services/events/adminService.ts",
     "src/services/events/eventsService.ts",
@@ -254,7 +258,7 @@
       "endColumn": 25,
       "severity": 2,
       "ruleId": "react/jsx-no-useless-fragment",
-      "message": "Fragments should contain more than one child - otherwise, there’s no need for a Fragment at all.",
+      "message": "Fragments should contain more than one child - otherwise, there\u2019s no need for a Fragment at all.",
       "messageId": "NeedsMoreChildren",
       "nodeType": "JSXFragment",
       "fatal": false
@@ -1346,7 +1350,7 @@
       "endColumn": 9,
       "severity": 2,
       "ruleId": "react/jsx-one-expression-per-line",
-      "message": "` Seal Point Park → 3rd Ave Launch → Bridgeview Park → back        ` must be placed on a new line",
+      "message": "` Seal Point Park \u2192 3rd Ave Launch \u2192 Bridgeview Park \u2192 back        ` must be placed on a new line",
       "messageId": "moveToNewLine",
       "nodeType": "JSXText",
       "fatal": false
@@ -1463,7 +1467,7 @@
       "endColumn": 11,
       "severity": 2,
       "ruleId": "react/jsx-one-expression-per-line",
-      "message": "` — payment processing (subject to Stripe's Privacy Policy)          ` must be placed on a new line",
+      "message": "` \u2014 payment processing (subject to Stripe's Privacy Policy)          ` must be placed on a new line",
       "messageId": "moveToNewLine",
       "nodeType": "JSXText",
       "fatal": false
@@ -1476,7 +1480,7 @@
       "endColumn": 11,
       "severity": 2,
       "ruleId": "react/jsx-one-expression-per-line",
-      "message": "` — hosting, auth, database, email delivery          ` must be placed on a new line",
+      "message": "` \u2014 hosting, auth, database, email delivery          ` must be placed on a new line",
       "messageId": "moveToNewLine",
       "nodeType": "JSXText",
       "fatal": false
@@ -1489,7 +1493,7 @@
       "endColumn": 11,
       "severity": 2,
       "ruleId": "react/jsx-one-expression-per-line",
-      "message": "` — transactional email delivery          ` must be placed on a new line",
+      "message": "` \u2014 transactional email delivery          ` must be placed on a new line",
       "messageId": "moveToNewLine",
       "nodeType": "JSXText",
       "fatal": false

GITHUB_ISSUES.md

@@ -1,6 +1,8 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
-**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The markup correction is source-only until its matching Hosting release is recorded in [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739); no Function rebuild or permission change is needed. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md).
+
+**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
 
 **COMMUNITY-004 / [#737](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/737) — SOURCE IN REVIEW:** October 15 owner rule requires current paid membership plus existing verified email and waiver for new free-event entries. The transaction checks current authority after reads; cancellation after expiry/suspension and immutable retry remain safe. Unit/UI and emulator regressions cover nonmembers, exact expiry, suspension, wrong UID, forgery, final seats and no-write denials. $25 individual/$30 family calendar-year policy is recorded, not activated; online dues and separate family accounts under a paid Family ID are selected for first launch; minor/privacy/retention and actual payment integration remain separate. Requested [policy drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) are unapproved and unused. No deployed/prod/real-payment claim; #731 stays closed with final6186640177.
 

IMPLEMENTATION_PLAN.md

@@ -1,6 +1,8 @@
 # MPRC Secure Commerce Implementation Plan
 
-**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The markup correction is source-only until its matching Hosting release is recorded in [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739); no Function rebuild or permission change is needed. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md).
+
+**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
 
 **#731 native tests complete — 2026-10-14, handoff gated:** actual fictional lifecycle/privacy/expiry/mobile plus 38 native evaluations/27 distinct security/replay checks passed. UI response discarded only after real server commit recovered through the exact saved action with all six protected update times unchanged. Recipient-loss replay/revoke and terminal-state/caller-revocation protection passed. Two fresh accounts/26 owned records removed with fences/immediate+late absence; browser test credentials/cache cleared and unused receiver closed. Final browser-permission confirmation and reviewed documentation/current-CI receipt remain before issue closure or supervised use with fresh fixtures. No new deploy/build/service/IAM/Rules/provider/production/payment work. [Dated native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); earlier #731/#732 source/anonymous-only milestones below are historical. Whole-backend completion is not claimed.
 

OFFICER_START_HERE.md

@@ -1,6 +1,8 @@
 # MPRC Website: Officer Start Here
 
-**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The markup correction is source-only until its matching Hosting release is recorded in [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739); no Function rebuild or permission change is needed. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md).
+
+**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
 
 **Minimum member launch — October 15 decisions; #737 SOURCE ONLY:** Dave set $25 individual/$30 family calendar-year dues. New free-event signup requires verified email, accepted waiver and current paid membership; no additional discretionary member approval follows satisfied requirements. The new source checks membership in the booking transaction and preserves cancellation after expiry. This change is **NOT AVAILABLE YET** on the deployed website. Online dues are selected for first launch; separate family accounts share a paid Family ID. Final policy/guardian handling remains undecided. Review the [privacy/waiver drafts](./docs/legal/MEMBER_LAUNCH_DRAFTS.md) and [source-only test procedure](./docs/officers/STAGING_COMMUNITY.md#current-membership-for-free-events--737-source-only). This source change adds no checkout or public external-payment instructions; paid-race commerce remains later. Earlier source checkpoints below are historical.
 

OPERATIONS_RUNBOOK.md

@@ -1,6 +1,8 @@
 # MPRC Platform Operations Runbook
 
-**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The markup correction is source-only until its matching Hosting release is recorded in [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739); no Function rebuild or permission change is needed. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md).
+
+**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
 
 **#731 native acceptance/handoff — 2026-10-14:** [current officer procedure](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates actual native/UI proof from final acceptance and cleanup gates. Existing v6/669e2fb/101386-byte94380430 archive and Hosting e21be35 remain unchanged; no redeploy is needed for these documentation facts. Actual lost-response retry, current authority/privacy, natural expiry and recipient-loss recovery passed. Two fresh fake accounts/26 exact owned records were removed with identity/create-time/update-time fences and immediate/late absence; private browser helper/Auth/matching staging SDK cache were cleared. The unused receiver closed with zero captures and a refused port. The specialist must record the human's temporary browser-permission OFF confirmation and owned-tab closure before final handoff. No workaround for blocked browser settings; no accounts/server left waiting for that input. Fresh fixtures, final receipt and Dave's supervision are required; production/payments stay untouched. Earlier #731/#732 source/anonymous-only notes below are historical.
 

SECURITY.md

@@ -1,6 +1,8 @@
 # MPRC Security, Privacy, and Risk Plan
 
-**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The markup correction is source-only until its matching Hosting release is recorded in [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739); no Function rebuild or permission change is needed. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
+**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md).
+
+**Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).
 
 **#731 native staging security — 2026-10-14:** [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758) records real verified password Auth and normal App Check: isolated missing/invalid Auth or attestation401, caller substitution403, extra authority/malformed input400, current/expired marker/capability and current native account denials403. Populated status omits other UIDs/contact/waiver/count/capacity. Firebase refuses unsupported tenant sign-in with INVALID_TENANT_ID; no tenant or valid nondefault-tenant token was created. Actual UI response loss after commit, exact retry without writes, terminal-state protection, recipient-loss replay/revoke and revoked-caller replay passed. No debug attestation/custom claims, new permission, Rule allowance, production or money action. Supervised use still requires the complete final cleanup/acceptance receipt and fresh fixtures. Earlier #731/#732 source/anonymous-only notes below are historical.