MEMBERS-DIRECTORY-001I — Preserve uncertain-change truth across failed reloads

[daliu]

Parent: #504. Connected release remains owned by #507.

Officer impact: In the preserved future My Account interface, a failed Reload after an uncertain profile-photo or finder-setting change will no longer replace the warning with a false assurance that nothing changed. The connected interface remains unavailable on production.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory one-sentence text alternative plus one no-terminal evidence-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. The existing data-flow diagram does not change.

Deployment evidence: None at issue creation. This is source-only interface truth hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no Firebase, provider, account, sign-in, production-data, deployment, or live website action is authorized.

Atomic outcome

Preserve uncertain-change truth through failed profile reloads until one authoritative profile read succeeds.

Defect

An ordinary mutation failure or failed post-mutation readback correctly enters the fixed unknown-change state. If the person then chooses Reload settings and that read fails, the shared load effect currently changes the state to generic unavailable. The generic message says No setting was changed, even though the earlier visibility, upload, or removal may have committed.

Invariants and transitions

• An ordinary visibility/upload/remove failure with unknown outcome enters the existing fixed could not confirm that change warning.
• A mutation that resolves but whose authoritative readback fails enters the same unknown state.
• After that uncertainty, each failed Reload settings within the same app and UID lifetime retains the uncertain-change warning. It must not display or imply No setting was changed.
• Only a successful authoritative profile read clears uncertainty and displays the returned current photo/finder state.
• Unknown and failed-reload states keep photo/finder mutation controls hidden, keep all prior draft bytes/data URLs discarded, and retain only Reload settings.
• Reload creates no request ID and performs no visibility/upload/remove mutation or automatic retry.
• Initial load failure and definitive-rejection readback failure remain generic unavailable states, but the generic load copy must not globally promise that no setting changed.
• App change, UID change, and unmount reset the component lifetime; an older context's uncertainty or reload completion cannot change the new context.
• Existing rejection, request-ID, FileReader, render, mutation, focus, and authoritative-readback fences remain unchanged.
• Availability stays false; the default branch remains inert and zero-context/zero-call.
• No photo query, facial recognition, matching, embedding, similarity, biometric processing, roster authority, or membership proof.

Exact ownership

• src/pages/account/MemberDirectoryProfile.tsx
  • distinguish reloads that follow unknown mutation state from ordinary initial/unavailable loads;
  • preserve uncertain truth on failed reload;
  • remove only the misleading global no-change promise from generic load-failure copy.
• src/pages/account/MemberDirectoryProfile.test.tsx
  • one separately named MEMBERS-DIRECTORY-001I block plus minimum copy expectation updates.
• SYSTEM_DESIGN.md
  • one separately named 001I source-only paragraph.
• IMPLEMENTATION_PLAN.md
  • one separately named 001I current-source paragraph.
• SECURITY.md
  • one separately named 001I/RISK-042 row immediately after released 001H; preserve active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024 byte-for-byte.
• docs/officers/EVENTS_SHOP_MEMBERS.md
  • only the optional-directory one-sentence text alternative and one separately named no-terminal 001I source-evidence procedure; no diagram change because data movement is unchanged.

Required tests

• Capture trustworthy RED on the old runtime for a failed Reload replacing unknown truth.
• Ordinary unknown mutation plus failed and repeated reloads retains the exact unknown warning and never renders No setting was changed.
• Successful mutation plus failed authoritative readback follows the same failed/repeated reload behavior.
• An eventual successful Reload clears uncertainty and shows the returned authoritative toggle/photo state.
• Initial profile-load failure retains generic unavailable recovery without a false no-change promise.
• Definitive mutation rejection whose confirming readback fails remains generic unavailable, not falsely elevated to known mutation uncertainty.
• App and UID changes do not inherit the prior context's uncertainty; late old reloads are inert.
• Every reload creates zero request IDs and zero visibility/upload/remove calls and restores no draft/data URL.
• Default unavailable branch remains zero-context, zero-ID, and zero-call.
• Existing profile, race, accessibility, photo-review, focus, privacy, and mobile tests remain green.

Explicit exclusions

• Account wiring/tests/CSS, admin finder, client service adapters, and inbound WebP validation.
• Functions, Rules, indexes, schemas, repair/backfill, packages, workflows, or release controls.
• Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 activation.
• Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live connected behavior.
• Both active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.

Claim protocol

Assign the issue and post a timestamped CLAIMED marker naming the exact branch and released base before any edit. The claim remains active through reviewed merge, exact-main audit, closure, and explicit release.

[daliu]

CLAIMED by /root at 2026-08-13T22:15:22Z on branch codex/issue-635-preserve-unknown-reload, exact released base fd0988afc8f55869db3bd8e5f0a391de83b8c816.

Exact ownership is limited to:

• src/pages/account/MemberDirectoryProfile.tsx: preserve unknown mutation truth through failed Reload within the same app+UID lifetime and remove only the misleading generic no-change promise;
• src/pages/account/MemberDirectoryProfile.test.tsx: one separately named MEMBERS-DIRECTORY-001I block plus minimum copy expectation updates;
• one separately named 001I hunk in SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, and SECURITY.md;
• only the optional-directory one-sentence text alternative and one separately named no-terminal 001I evidence-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md; no diagram change.

Everything else is immutable: Account wiring/tests/CSS, admin finder, client services and inbound WebP validation, availability, Functions, Rules, indexes, packages, workflows, release controls, providers, accounts, sign-in, data, deployment/live behavior, #507 gates, and both #616 Strava files plus its OAUTH-001A2L/RISK-024 SECURITY row. No source edit preceded this marker. Claim remains active through reviewed merge, exact-main audit, closure, and explicit release.

[daliu]

RED/GREEN and review evidence for the exact uncommitted #635 candidate on released base fd0988a:\n\n- Trustworthy RED on the unchanged runtime: the separately named MEMBERS-DIRECTORY-001I block was 0/5; each failure showed a failed Reload replacing the uncertain-change warning with the generic no-change message.\n- GREEN: the named block is 5/5 and the full MemberDirectoryProfile suite is 85/85.\n- Full frontend: 18 suites / 1,130 tests passed.\n- TypeScript noEmit: passed.\n- Frontend lint baseline: 120 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.\n- Diagnostic production build: passed.\n- Repository workflow/security suite: 105/105 passed.\n- git diff --check: passed.\n- Exact scope: six claimed paths only; current binary diff SHA-256 ca82cd91513757ee218ae6f2572551f685fb1668d51e22e4b38c2deaf185131c.\n- Independent frontend/state, privacy/security, design/race, and backup-officer/operations reviews: GO with no findings.\n- memberDirectoryAvailability.ts is byte-identical 295909b0df8dd7c54a0f164f99d4943656aece4b and remains false.\n- Active #616 Strava blobs remain byte-identical 2eb48945061ab5ad2a896c6835f308cefd7fe63a / d1792d390bd57608fecab84341a6e5916fcf8196; its separately claimed SECURITY row is untouched.\n- Remote main remains the exact released base. No branch was pushed and nothing was published by this evidence step.\n- Production remains the inert #623 interface; no Firebase, provider, account, sign-in, production-data, deployment, or connected-live action occurred.\n\nThe #635 claim remains active through commit, PR exact-head CI/review, merge, exact-main/deployment audit, closure, and explicit release.