The operator procedure now documents hash-only random code generation, private delivery, non-consuming validation, and the difference between the authenticated admin workflow and a privileged standalone-code fallback.

Read-only production inspection found no recipient metadata columns in the API database. A recipient-aware attempt rolled back; one standalone code was issued and checked through HTTP and availability flags, without recording recipient information or modifying accounts. Real codes and recipient addresses are intentionally absent from this record.

Documentation-only delivery: no migration, app release or API deployment is needed. The live schema discrepancy is documented, not repaired by these PRs.

Validation: source comparison with backend routes and the admin generator; Markdown diff checks; VitePress production build. Runtime regression tests are not rerun for documentation-only changes.

Related: backend issue #656. See the operator guide.