Docs: bind emergency rollback to current main

OPERATIONS_RUNBOOK.md

@@ -644,10 +644,12 @@ The GitHub release workflow is now manual and exact-current-commit. After protec
 
 WEB-UX-001A [#457](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/457) used a separate temporary **web-only** Netlify release. Its manifest named the expected first parent of one `main` merge, release-specific source ref, exact reviewed source commit/tree, exact artifact file count/digest, and known rollback deploy. The release-control Deploy Preview and production both built that pinned source. Netlify continued production only for the exact-parent merge, fetched the public ref into a fresh temporary Git repository with provider/global Git configuration disabled, verified both source hashes, installed the pinned lockfile with lifecycle scripts disabled, built without the data-dependent sitemap prebuild or any React/provider variables, scanned the output for credential markers, verified the exact artifact digest, and published a public provenance marker. A wrong/missing context, branch, commit, parent, ref, tree, artifact, canonical manifest, build-hook marker, or inactive manifest stops without replacing the live deploy. This path changed no Firebase, Rules, Functions, provider configuration, or production data and did not complete WEB-001.
 
-For #457, prepare the manifest-disable pull request and exact previous-source Git rollback projection before merging the release. The current Git/Netlify identity cannot select Netlify's atomic restore control; a Netlify team owner remains the preferred fast rollback, while the pre-reviewed Git projection pinned to `e86a0f702cff6495f50630c5de3337290db8b8cb` is the available slower fallback. Freeze unrelated `main` merges until the Netlify deploy and public smoke checks finish, because a later merge invalidates the exact-parent gate and may supersede the provider build. Verify the pinned Deploy Preview marker and artifact digest before merge; after merge verify `/.well-known/run-mprc-release.json`, the Netlify deploy record, `/events`, `/shop`, and the signed-out `/account` route on phone and desktop sizes. If the release fails before publication, leave the prior deploy live and diagnose offline. If it publishes but verification fails, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`; if that owner is unavailable, update the prepared rollback manifest's expected parent to the release merge, reverify its pinned previous-source preview, and merge it. A source-only disable is not rollback. After success, merge the disable pull request, confirm its production attempt is skipped, delete `codex/netlify-source-457-header`, and verify that ref is absent so a historical rebuild cannot fetch the hotfix source. The platform owner approves and performs this exception; officers do not run commands or handle credentials.
+For #457, prepare the manifest-disable pull request and exact previous-source Git rollback projection before merging the release. The current Git/Netlify identity cannot select Netlify's atomic restore control; a Netlify team owner remains the preferred fast rollback, while the pre-reviewed Git projection pinned to `e86a0f702cff6495f50630c5de3337290db8b8cb` is the available slower fallback. Freeze unrelated `main` merges until the Netlify deploy and public smoke checks finish, because a later merge invalidates the exact-parent gate and may supersede the provider build. Verify the pinned Deploy Preview marker and artifact digest before merge; after merge verify `/.well-known/run-mprc-release.json`, the Netlify deploy record, `/events`, `/shop`, and the signed-out `/account` route on phone and desktop sizes. If the release fails before publication, leave the prior deploy live and diagnose offline. If it publishes but verification fails, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, rebase the prepared rollback projection onto the exact current `main`, set the manifest's expected parent to that same commit, and reverify its pinned previous-source preview. Confirm `main` is unchanged immediately before merging with a merge commit. Stop, refresh the projection, and rerun its checks and preview if `main` advances. A source-only disable is not rollback. After success, merge the disable pull request, confirm its production attempt is skipped, delete `codex/netlify-source-457-header`, and verify that ref is absent so a historical rebuild cannot fetch the hotfix source. The platform owner approves and performs this exception; officers do not run commands or handle credentials.
 
 Dated result: on 2026-07-23 America/Los_Angeles, Netlify deploy `6a61c544171ea80008307623` published trigger commit `4f67e6cafb975a3f985fefc67f094b3a37526702`. The public marker matched source `ed1b0833f25822cee80c99ded8753722b5608a3f`, tree `878c6628d961f4484cb49208aef53f1e9f2e3b47`, 60 files, and digest `7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092`. Signed-out checks passed at 1280px desktop and 390px phone widths. The release source was deleted and verified absent. The rollback source remains at `e86a0f702cff6495f50630c5de3337290db8b8cb`.
 
+Post-release control result: safety merge `04d6d2cd88dda0e6ec7e2b6a71514e6ce2e4db25` produced unpublished Netlify attempt `6a61ca460c41450008ee531d`; the published site remained deploy `6a61c544171ea80008307623`. Ordinary `main` merges are paused from publishing the website again. Any later Git rollback projection must name the exact current `main` immediately before its merge, not the original release merge.
+
 ### Production approvals
 
 Production commerce changes require:

docs/officers/PUBLISH_AND_CHECK.md

@@ -163,7 +163,7 @@ In words: the release preview and production must contain the same pinned fronte
 
 **Success proof:** keep the public deploy link and marker, exact hashes, check date, phone/desktop sizes, and a redacted public screenshot. Keep settings, logs, credentials, and member data out of public evidence.
 
-**Undo:** if nothing published, leave the prior deploy live. If the wrong result published, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, set the prepared rollback manifest's expected parent to the release merge, verify its preview still pins previous source `e86a0f702cff6495f50630c5de3337290db8b8cb`, and merge that exact rollback projection. Disabling the source manifest prevents builds of later `main` commits but does not roll back an already published deploy; deleting the release-specific source ref makes a later rebuild of the old release commit fail its fetch.
+**Undo:** if nothing published, leave the prior deploy live. If the wrong result published, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, rebase the prepared rollback projection onto the exact current `main`, set its expected parent to that same current `main` commit, and verify its preview still pins previous source `e86a0f702cff6495f50630c5de3337290db8b8cb`. Confirm `main` has not advanced, then merge that exact rollback projection with a merge commit. Stop, refresh the projection, and rerun its checks and preview if `main` changes at any point. Disabling the source manifest prevents builds of later `main` commits but does not roll back an already published deploy; deleting the release-specific source ref makes a later rebuild of the old release commit fail its fetch.
 
 **Escalation:** platform owner first; website/content owner second. Escalate to the security owner if private data or an unexpected application version appears.