Use Zeffy signup with separate guest waiver and officer access

.github/lint-baseline.json

@@ -10,18 +10,18 @@
   "targets": [
     "src"
   ],
-  "scannedFileCount": 137,
+  "scannedFileCount": 141,
   "scannedFilesByExtension": {
     ".js": 12,
-    ".jsx": 35,
+    ".jsx": 39,
     ".ts": 52,
     ".tsx": 38
   },
-  "errorCount": 113,
+  "errorCount": 111,
   "warningCount": 6,
   "errorsByExtension": {
     ".js": 2,
-    ".jsx": 26,
+    ".jsx": 24,
     ".ts": 2,
     ".tsx": 83
   },
@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:b4fdd4e8efba6c011d293d96f8453a4e2dccccddf7907e2ff9b67cf2b74ba81f",
+  "fingerprint": "sha256:c39f2619673c2ce72d2473f683bbca5119858c510e6f158fadd2d46fcc6e8b4e",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -49,13 +49,16 @@
     "src/components/ObfuscatedEmail.jsx",
     "src/components/Officer.jsx",
     "src/components/Paragraph.jsx",
+    "src/components/PublicNavigation.test.jsx",
     "src/components/SEO.d.ts",
     "src/components/SEO.jsx",
     "src/components/ScrollToTop.jsx",
     "src/components/SectionHead.jsx",
     "src/components/Subheader.jsx",
     "src/components/UpcomingEventsPreview.tsx",
     "src/components/VideoCarousel.jsx",
+    "src/components/ZeffyMembershipForm.jsx",
+    "src/components/ZeffyMembershipForm.test.jsx",
     "src/components/index.ts",
     "src/data.jsx",
     "src/headerClearance.test.js",
@@ -97,6 +100,7 @@
     "src/pages/events/raceCheckoutRequest.ts",
     "src/pages/home/Home.jsx",
     "src/pages/joinUs/JoinUs.jsx",
+    "src/pages/joinUs/JoinUs.test.jsx",
     "src/pages/joinUs/JoinUsConditionalRoute.jsx",
     "src/pages/joinUs/Route.jsx",
     "src/pages/joinUs/Waiver.jsx",
@@ -1316,32 +1320,6 @@
       "nodeType": "ConditionalExpression",
       "fatal": false
     },
-    {
-      "file": "src/pages/joinUs/JoinUs.jsx",
-      "line": 130,
-      "column": 1,
-      "endLine": 130,
-      "endColumn": 104,
-      "severity": 2,
-      "ruleId": "max-len",
-      "message": "This line has a length of 103. Maximum allowed is 100.",
-      "messageId": "max",
-      "nodeType": "Program",
-      "fatal": false
-    },
-    {
-      "file": "src/pages/joinUs/JoinUs.jsx",
-      "line": 134,
-      "column": 17,
-      "endLine": 134,
-      "endColumn": 36,
-      "severity": 2,
-      "ruleId": "react/no-array-index-key",
-      "message": "Do not use Array index in keys",
-      "messageId": "noArrayIndex",
-      "nodeType": "TemplateLiteral",
-      "fatal": false
-    },
     {
       "file": "src/pages/joinUs/Route.jsx",
       "line": 22,

OFFICER_START_HERE.md

@@ -1,5 +1,9 @@
 # MPRC Website: Officer Start Here
 
+**October 18 simplified signup — staging verified October 18:** members use Zeffy, guests retain a separate waiver option, and officers use a footer Officer access link. The public account link and repeated member waiver text are removed in the preview. No account, permission or provider configuration changes. Follow the [Zeffy review guide](./docs/officers/ZEFFY_MEMBERSHIP.md) for availability and exact staging evidence.
+
+**Zeffy membership preview — October 18, 2026:** Join Us embeds the club's supplied Zeffy form with an iframe fallback and a direct link. The [view-only review guide](./docs/officers/ZEFFY_MEMBERSHIP.md) records verified phone/desktop display and all 61 staging file hashes at source `99ca1e3`. The separate preview expires October 25 at 10:31 PM Pacific; shared staging is unchanged. This is the real provider form; do not submit details or pay during the demo. No Firebase membership activation or production release is included.
+
 **Saved test Checkout — October 18, 2026, native clarification verified:** Hosting `30d5f27` now explains when Resume cannot reopen the same open, inactive purchase. A fresh sandbox decline/expiry retained the original order and term; no replacement payment or membership was created. Both owned test accounts were retired, seven financial-record hashes stayed unchanged and two expiry receipts were retained. Dues Functions remain v1/source `71f59e2`. [Dated evidence](./docs/TEST_DUES_RECOVERY_MESSAGE.md) and [officer steps](./docs/officers/TEST_DUES.md). Real payments, production, family invitations and final club policies remain separate. Earlier checkpoints below are historical.
 
 **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).

SYSTEM_DESIGN.md

@@ -1,5 +1,11 @@
 # MPRC Platform System Design
 
+**October 18 Zeffy simplification — staging verified October 18:** Dave chose Zeffy for member enrollment. Join Us leads with that form, removes the repeated member waiver text, and retains the existing activity-waiver URL under a distinct Guest waiver section. Public navigation has no Sign in/My Account entry. Footer Officer access opens `/officer-access`, reusing the existing sign-in/recovery service without registration; successful sign-in still encounters the existing admin guard. Legacy `/login` and protected-route behavior remain compatible. No role, Auth provider, account, waiver policy/text, payment, schema or membership-sync change is included. The [officer flow map and review procedure](./docs/officers/ZEFFY_MEMBERSHIP.md) record the verified paths and exact staging receipt.
+
+**Zeffy membership embed — October 18, 2026, staging display verified:** Join Us replaces its Google membership application link with the owner-supplied fixed Zeffy form, route-scoped loader, iframe-on-loader-error fallback and persistent direct link. The staging page labels this as a view-only display of a real provider form. No form value, payment result or provider message is read into Firebase; no account, role, dues, webhook, schema or membership synchronization is added. Prices and renewal terms remain provider content and require reconciliation before production. The separate `zeffy-750` preview serves source `99ca1e3`, with all 61 file hashes and signed-out phone/desktop display verified; shared staging is unchanged. See the [officer procedure and data-flow map](./docs/officers/ZEFFY_MEMBERSHIP.md) for exact staging evidence. This does not claim a merge, submission or production release.
+
+The staging executable scan allows only the three complete quoted literals for this approved Zeffy form (relative embed path, absolute embed URL and public ticketing URL). Its slug overlaps the production Firebase project name. Staging configuration validation remains unchanged; every actual production identifier elsewhere in the same file or another executable still rejects, as do changed hosts, form suffixes and production endpoints. The Hosting regression test reproduces the original false rejection and checks the narrowed exception.
+
 **Saved test Checkout — October 18, 2026, native clarification verified:** Hosting `30d5f27` now explains when Resume cannot reopen the same open, inactive purchase. A fresh sandbox decline/expiry retained the original order and term; no replacement payment or membership was created. Both owned test accounts were retired, seven financial-record hashes stayed unchanged and two expiry receipts were retained. Dues Functions remain v1/source `71f59e2`. [Dated evidence](./docs/TEST_DUES_RECOVERY_MESSAGE.md) and [officer steps](./docs/officers/TEST_DUES.md). Real payments, production, family invitations and final club policies remain separate. Earlier checkpoints below are historical.
 
 **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md).

docs/MEMBER_LAUNCH_SCOPE.md

@@ -1,5 +1,7 @@
 # Minimum member launch
 
+**October 18, 2026 current public signup decision:** Dave selected Zeffy for now, without MPRC member accounts. The staging preview removes the duplicate member waiver and public Sign in link, retains the existing guest waiver form, and provides separate officer access. See the [verified staging review](./officers/ZEFFY_MEMBERSHIP.md). The October 15 Firebase account/dues/family plan below is historical and deferred for this public signup; it is not the current enrollment procedure. No provider policy, waiver text or production release is changed.
+
 **October 15, 2026 decisions.** Dave approved building and deploying the agreed release. Online membership dues are included; paid MPRC race checkout, race refunds and bib transfers follow a separate release. This document records scope and technical requirements, not deployed payment capability or legal-policy approval.
 
 ## Member experience

docs/officers/ACCESS_CONTINUITY.md

@@ -1,5 +1,7 @@
 # Access Continuity
 
+**October 18 Zeffy preview update — staging verified:** footer **Officer access** opens a dedicated existing-account sign-in page. Public membership uses Zeffy without an MPRC account. This is a navigation change, not an officer role, provider or recovery configuration change. Check the [Zeffy staging receipt and no-terminal review](./ZEFFY_MEMBERSHIP.md) before use. Existing private-route and legacy login behavior remain compatible; ordinary officer access still requires its established authorization.
+
 **#719 linking permission — STAGING VERIFIED 2026-10-12:** Dave/platform specialist supplies a fresh expiring association permission and exact disposable-target marker for the [supervised screen review](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719). Existing recording/approval/event access grants no linking authority. Hosted revocation cleared target/receipt controls and denied old successful retries; old capabilities, accounts and records were removed. Do not change a role, email-match an account or share credentials/codes. Stop on an uncertain ID/revision or access surviving revocation. Enrollment, fixture supply, cleanup and rollback remain specialist-only; no backup appointment or production permission changes.
 
 **Purpose:** ensure at least two named officers can reach every important service if the usual owner is unavailable.

docs/officers/README.md

@@ -1,5 +1,9 @@
 # Officer Website Handbook
 
+**Zeffy simplification, staging verified October 18:** members use Zeffy, guests keep the existing waiver form, and separate Officer access is in the footer. The top menu has no account link. Check the [dated staging review](./ZEFFY_MEMBERSHIP.md) before using the preview; the preview is not a production release.
+
+[Review the Zeffy membership preview](./ZEFFY_MEMBERSHIP.md) on Join Us. The supplied form is real: view only during staging review. Provider submissions, payments, Firebase activation and production release remain separate.
+
 **October 18:** [Test annual dues](./TEST_DUES.md) now has a verified stop message when a saved Checkout cannot reopen. Keep the purchase and ask Dave for reconciliation. Read the [native evidence and exact test-account cleanup](../TEST_DUES_RECOVERY_MESSAGE.md); real payments and production remain separate.
 
 [Test annual dues](./TEST_DUES.md) has a connected staging screen and verified core hosted flow and [bounded native recovery checks](../TEST_DUES_NATIVE_RECOVERY.md) as of October 17. Fresh specialist-provided fictional accounts are required; the completed run's accounts were removed. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). Real payments and production remain separate.

docs/officers/ZEFFY_MEMBERSHIP.md

@@ -0,0 +1,72 @@
+# Review the Zeffy membership form
+
+**October 18 simplification — staging verified:** members use Zeffy without an MPRC account. The duplicate member waiver and public account navigation are removed. Guests retain the existing waiver form, and officers use a separate footer entry. The receipt below records the current preview.
+
+**Status:** [issue #750](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/750), staging display verified October 18, 2026. [Open the view-only preview](https://run-mprc-staging--zeffy-750-nqx3741y.web.app/joinus#membership-signup). Production is **NOT AVAILABLE YET** for this change.
+
+**Purpose:** review the embedded membership form on the Join Us page without creating a membership or payment.
+
+**Approver:** Dave for this staging demonstration. The membership lead, treasurer and platform owner must approve a later production release.
+
+**Prerequisites:** the specialist supplies the exact staging preview link and source revision. Stay signed out. The displayed Zeffy form is the club's real form, not a payment sandbox. Do not enter information, accept a waiver, submit or pay.
+
+```mermaid
+flowchart LR
+    A["Staging Join Us page"] --> B["Members: Zeffy embed loader"]
+    B --> C["Club membership form on Zeffy"]
+    A --> D["Direct link if the embed is unavailable"]
+    D --> C
+    B -- "Loader fails" --> E["Embedded iframe fallback"]
+    E --> C
+    A --> G["Guests: existing activity waiver form"]
+    A --> H["Footer: Officer access"]
+    H --> I["Existing officer sign-in and admin authorization"]
+    C -. "No account activation or sync added" .-> F["Existing Firebase member system"]
+```
+
+In words: members use Zeffy, guests retain the existing waiver form, and officers have a separate footer entry; the public menu has no account link, and this change adds no Firebase membership synchronization or access grant.
+
+## Review without a terminal
+
+1. Open the specialist's staging link while signed out.
+2. Find **Become an MPRC Member** on Join Us.
+3. Confirm the notice identifies a staging preview of the real Zeffy form.
+4. Confirm the club's membership options or opening message appear inside the page.
+5. Open **Open the membership form in a new tab**.
+6. Confirm it points to the club's membership on `www.zeffy.com`.
+7. Close the new tab without entering information.
+8. Return to Home and then Join Us.
+9. Confirm only one visible membership form appears.
+10. Repeat at phone and computer widths.
+11. Select **Use the guest waiver** and confirm it reaches the **Guest waiver** section.
+12. Confirm **Complete guest waiver** points to the existing activity waiver form; do not submit it.
+13. Confirm the old **Club Activity Waiver** text block is absent.
+14. Confirm **Sign in** and **My Account** are absent from the top menu, including the phone menu.
+15. Select **Officer access** in the footer.
+16. Confirm the page says **Officer sign in**, offers password recovery and has no registration button.
+17. Select **membership signup on Zeffy** to return to Join Us.
+
+**Expected result:** Zeffy is the member path, with no second MPRC account or repeated website waiver. Guests can reach the existing activity waiver. The footer officer entry uses existing authentication and admin authorization; it creates no account or privilege. The legacy `/login` route remains compatible with existing private-route redirects. Prices, renewal terms and the member waiver inside Zeffy remain provider configuration; this display change does not verify or alter them.
+
+**Stop conditions:** wrong club/form, missing real-form notice, clipped controls, duplicate forms, missing guest/direct links, public account navigation, officer-page registration, unexpected account activation or permission, or any request to test a payment or submit real details.
+
+**Success proof:** exact source revision, staging URL and deployment ID, dated phone/computer screenshots, one-form navigation check, loader/fallback tests and served artifact hashes. Viewing a form proves display only. It does not prove payment, membership activation, provider configuration or production readiness.
+
+**Undo:** ask the platform maintainer to expire the task's preview channel. For a later published change, use a reviewed revert and the normal protected release path. Do not edit Zeffy records, delete members or refund a payment to undo a website preview.
+
+**Escalation:** platform owner for display or deployment; membership lead and treasurer for provider options/prices; privacy owner for collected data or policy. A specialist is still required for deployment.
+
+## Deployment evidence
+
+- Source: deployed implementation `99ca1e328365cfd80a9b8a019d64083c9a47caf1`; not merged. Later documentation-only evidence commits do not change its executable source.
+- Tests: 29 frontend suites / 1,535 tests pass under Node 20. The exact lint gate passes with 111 legacy errors and six warnings, no new findings; removing the old waiver rendering removes two legacy findings. The subsequent CSS-only guest-button correction is verified in the hosted phone screen.
+- Hosting checks: all 16 pass. A test first reproduced the rejected Zeffy slug, then passed with the exact form-literal exception. All real production identifiers, endpoints, changed hosts and changed form suffixes still reject.
+- Staging website: project `run-mprc-staging`, preview channel `zeffy-750`, version `298cdee311b65eaf`. All 61 served file hashes match the local artifact. Preview expires October 25, 2026 at 10:31 PM Pacific time.
+- Actual signed-out screens: 390×844 phone and 1280×720 desktop; form choices, real-form notice, direct-link target and zero page horizontal overflow verified. Home → Join Us reinitializes one visible form and one loader. The guest jump link reaches its heading below the fixed menu; its button wraps within one background on phones. The top menu has no account link. Footer Officer access opens the dedicated sign-in/recovery screen without registration; its member link returns to Zeffy. No sign-in or recovery request was submitted. Dated screenshots are retained with this chat; no member or payment information was entered. Fallback behavior is covered by the local tests; no provider failure or checkout was induced.
+- Existing shared staging: version `6619f96ac1a39406` unchanged. Preview deployment explicitly disabled Auth-domain synchronization and did not enable the community or test-dues feature flags. No CI workflow was manually dispatched.
+- `runmprc.com`: unchanged; no production release authorized.
+- Firebase Functions, Rules, Auth, IAM and data: unchanged.
+- Zeffy account/form configuration: unchanged; public form display only.
+- Payments and membership submissions: not performed.
+
+The first compiled artifact was refused because the approved Zeffy slug overlapped the production-project text scan. The narrow exception above was tested before retry. A later successful CLI publication omitted its version field; native channel readback and all-file verification qualified that release without another deployment. The final simplified signup and responsive guest-button revision was published and all 61 files verified again. No deployment guard was skipped.