MEMBERS-DIRECTORY-001G — Clear People-finder results and distinguish unavailable photos

[daliu]

Parent: #504. Connected release remains owned by #507.

Officer impact: In the preserved future People finder, an officer can explicitly clear a completed search and its displayed name/photo cards, and can distinguish a person who supplied no photo from a supplied thumbnail that the browser could not display. This interface source remains disconnected and is not available on production.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory diagram, text alternative, and source-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md.

Deployment evidence: None at issue creation. This is source-only interface hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no Firebase, provider, account, production-data, or live website action is authorized. Closure must record source/test/merge evidence separately from the unchanged inert #623 production preview.

Atomic outcome

Harden only the preserved connected administrator People-finder interface so completed personal-data results are explicitly disposable from the rendered page and photo fallback copy is truthful.

Invariants and transitions

• A null photo alone renders No photo with the accessible label No profile photo for .
• A non-null voluntary thumbnail that fails browser rendering removes the image/data URL from the DOM and renders Photo unavailable with the accessible label Profile photo unavailable for . It must not claim that no photo exists.
• A later result with a different photo version receives a fresh render attempt; an earlier decode failure must not poison it.
• After a completed non-empty, empty, validation-failed, or fixed-failure search, Clear search and result cards clears the name field, validation/failure/completion message, headings, cards, names, and images from React state and the DOM, then returns focus to the persistent name input.
• Clear creates no request ID and makes no directory service call. It does not claim network cancellation, browser-memory erasure, cache removal, audit rollback, or recall of a result already seen or captured.
• Pending search behavior, explicit-submit normalization, stale application/admin/unmount fencing, fixed errors, result cap/projection, AdminGuard, and no-photo behavior remain unchanged.
• The source-controlled availability boundary stays false. The default route remains the inert zero-context, zero-request-ID, zero-call preview.
• Name search plus voluntary thumbnails remains visual comparison only. Do not add photo-as-query, facial recognition, embeddings, similarity, fuzzy name search, biometrics, totals, export, or roster authority.

Exact ownership

• src/pages/admin/members/AdminMemberDirectory.tsx
  • distinguish absent and browser-unavailable thumbnail fallbacks;
  • add the completed-state Clear action, focus restoration, and minimum state needed for those transitions only.
• src/pages/admin/members/AdminMemberDirectory.test.tsx
  • one separately named MEMBERS-DIRECTORY-001G block and the minimum expectation updates required by the truthful fallback.
• src/pages/account/Account.css
  • only scoped People-finder Clear/fallback color, focus, 44-pixel target, and 320-pixel containment rules if required.
• SYSTEM_DESIGN.md
  • one separately named MEMBERS-DIRECTORY-001G source-only paragraph.
• IMPLEMENTATION_PLAN.md
  • one separately named MEMBERS-DIRECTORY-001G current-source paragraph.
• SECURITY.md
  • one separately named MEMBERS-DIRECTORY-001G/RISK-042 source-ledger row immediately after 001F. Preserve active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616's OAUTH-001A2L/RISK-024 hunk byte-for-byte.
• docs/officers/EVENTS_SHOP_MEMBERS.md
  • only the existing optional-directory diagram/text alternative and one separately named source-review procedure for this change.

Required tests

• Non-null browser image failure yields the distinct unavailable copy/accessible label and removes the old image/data URL.
• photo: null still yields the absent-photo copy/accessible label.
• A later photo version receives a fresh image render.
• Clear after result cards removes the query, names, images, result heading, and completion state; returns focus; creates no new request ID; and makes no new service call.
• Clear after an empty result, local validation message, and fixed failure removes the retained query/message without a request.
• The Clear action is keyboard operable, at least 44 pixels high, explicitly contrasted, and contained/stacked at 320 pixels.
• The default unavailable branch still obtains no directory context and creates no request ID or service call.
• Existing race, validation, privacy, and guard tests remain green.

Explicit exclusions

• Account/profile photo controls and memberDirectoryService.
• Functions, Rules, indexes, schemas, repair/backfill, packages, workflows, or release controls.
• Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 activation work.
• Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live behavior.
• Both active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.

Claim protocol

Assign the issue and post a timestamped CLAIMED marker naming the exact branch and released base before any edit. The claim remains active through reviewed merge, exact-main audit, closure, and explicit release.