AUTH-006F — Make My Account profile saves one-attempt and context-safe

[daliu]

Parent: #109.

Outcome

Bind each My Account profile save to exactly one mounted account/service lifecycle. A completion started for account A must never display private profile data, errors, or control state after the page moves to account B or a newer lifecycle.

This is a provider-neutral corrective child. It does not add Google sign-in, link accounts, grant membership, or change server authorization.

Current defect

On exact released main 9e61a023301d10c0580253738e67cbc7867ea38b, handleSave captures the old Firestore service and UID, then unconditionally changes shared React state after its update and confirmation-read awaits.

If account B loads while account A save is pending, the A confirmation can finish afterward and replace profile with A private data while profileContext still names B. The existing context check therefore treats A data as B data and can render it. A stale A rejection can also replace the ready B page with an unavailable result, and stale finally work can clear the disabled state for a newer B save.

Privacy and lifecycle invariant

1. The effective save context is the exact UID, Firebase app, Firestore service, and Identity service.
2. Every real context transition and unmount invalidates the prior monotonic generation, including A → unavailable → the same A resources.
3. At most one save starts synchronously in one generation; a rapid repeat performs no second write or confirmation read.
4. A save captures its exact context, generation, and attempt token before the first write.
5. After the update resolves, a stale attempt stops before a confirmation read.
6. Success, failure, and finally state changes occur only for the still-mounted current attempt and generation.
7. A new context resets browser-only edit/save state without allowing an old completion to alter it.
8. The current exact validation, captured write target, confirmation-read requirement, generic uncertain-result message, accessible controls, and ordinary successful save remain compatible.
9. This browser fence does not make the underlying Firestore write idempotent and does not claim that an already-started old write was cancelled.

Exact scope

• src/pages/account/Account.tsx: only the profile-save generation/context/one-attempt/reset hunk.
• src/pages/account/Account.test.tsx: one separately named AUTH-006F profile-save context isolation block plus minimal existing-harness support.

Every other path and hunk is immutable.

Acceptance checks

• Trustworthy RED proves stale A success can render A private data after B is ready.
• A stale update completion performs no old-context confirmation read.
• A stale rejection leaves B ready and exposes no rejected detail.
• Settling A cannot clear a newer pending B save or enable its input/actions.
• A → unavailable → same A resources rejects the first A generation.
• A rapid same-generation repeat makes one update call.
• Unmount makes a late completion inert.
• Existing validation, current success, current failure, missing-confirmation, profile recovery, sign-out, registration, directory, Strava, and Account tests remain green.
• Full relevant local and hosted gates pass, with independent privacy/security, test/mutation, and scope/compatibility review.

Dependencies and coordination

• Completed foundations: SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99, CI-001A — Repair the deterministic frontend test baseline #103, AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118, AUTH-001D1 — Require verified email in browser role projection #213, AUTH-UX-001A — Make My Account sign-out private, truthful, and one-retry-safe #368, AUTH-006C — Make email/password submissions one-attempt #500, AUTH-006E — Bind browser auth projection to the current identity service #519.
• MEMBERS-DIRECTORY-001B — Add bounded officer name search and photo gallery #506 is complete/released at exact main 9e61a023301d10c0580253738e67cbc7867ea38b; preserve all merged directory behavior byte-for-byte.
• Active PAY-003A3 — Reject contradictory refund and dispute object realms #526 owns its Stripe webhook paths/hunk.
• Active OAUTH-001B6 — Migrate Strava disconnect to the supported revoke endpoint #530 owns only functions/strava.js and functions/strava.test.js.
• Draft Rollback: prepare exact pre-header Netlify artifact #462 owns only its release-manifest/workflow-test paths.
• Three independent read-only audits found no issue, pull request, branch, or path claim on either exact Account file/hunk.

Explicit exclusions

No account service, Identity service, member-directory component/service, Login form, Google/provider behavior, Functions, Firestore Rules/schema, membership, discounts, payments, Strava, package/lock, lint baseline/count, root/officer documentation, workflow, provider configuration, deployment, production account/data, or live testing.

Migration impact: none. No schema, stored record, account, credential, claim, provider, or production-state change.

Officer impact: None — this is an internal browser lifecycle/privacy containment with no new officer action or visible procedure.

Officer documentation: None — no officer procedure, permission, page structure, data movement, provider configuration, deployment, backup, or recovery action changes.

Deployment evidence: issue design only. Source change, tests, merge, website publication, runmprc.com verification, Firebase deployment, provider configuration, production data, and live behavior are separate and currently unperformed/unproven.

Claim protocol

Creation is not a claim. Before editing, assign this issue, create and push a unique branch from exact current main, post and re-read a UTC CLAIMED by <canonical agent> at <UTC>; branch <branch>; base <SHA>; paths/hunks <exact scope> marker, and change status:ready to status:in-progress. Earliest valid claim wins; any exact overlap is STOP-and-coordinate.

[daliu]

CLAIMED by /root at 2026-08-01T18:33:42Z; branch codex/issue-531-account-save-context; exact released base 9e61a023301d10c0580253738e67cbc7867ea38b.

Exact ownership is only:

• src/pages/account/Account.tsx: profile-save generation, exact effective-context, synchronous one-attempt guard, stale-completion fence, and new-context reset hunk.
• src/pages/account/Account.test.tsx: one separately named AUTH-006F profile-save context isolation block plus minimal existing-harness support.

All #506 merged directory behavior, active #526 Stripe paths/hunk, active #530 Functions Strava paths, draft #462, every other Account hunk, services, lint baseline/count, docs, packages/locks, Functions/Rules, providers, deployment, production data, and live behavior are immutable. Three independent read-only audits returned GO, and no tracked edit preceded this marker. Claim remains held through RED/GREEN evidence, exact-head review/CI, merge, exact-main audit, and explicit release.

[daliu]

TRUSTWORTHY RED — exact claimed base 9e61a023301d10c0580253738e67cbc7867ea38b, before any runtime edit.

Node 20 command:

CI=true node node_modules/react-scripts/bin/react-scripts.js test --watchAll=false --runInBand src/pages/account/Account.test.tsx -t "AUTH-006F profile-save context isolation"

Result: expected 5/5 failures, with 140 unrelated Account tests skipped.

• Stale A success issued a third private confirmation read after B was ready.
• Stale A rejection replaced B with the generic unavailable state.
• B inherited A Saving... state and could not start its own save.
• A → unavailable → same A allowed the first-generation completion to issue a third read.
• Two rapid activations started two writes; a later unmount would not stop the old confirmation read.

Only the separately named test/harness hunk differs at this marker. src/pages/account/Account.tsx remains exact released source. Synthetic mocks only: no Firebase/provider/network, production account/data, deployment, or live action occurred. Claim remains held.