Parent: #504. Connected release remains owned by #507.\n\nOfficer impact: In the preserved future My Account interface, keyboard and screen-reader users will be moved to the available recovery action after a profile-photo or finder-setting failure instead of losing their place. The connected interface remains unavailable on production.\n\nOfficer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory one-sentence text alternative plus one no-terminal evidence-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. The existing data-flow diagram does not change.\n\nDeployment evidence: None at issue creation. This is source-only interface accessibility hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no Firebase, provider, account, sign-in, production-data, deployment, or live website action is authorized.\n\n## Atomic outcome\n\nKeep keyboard focus on the correct Reload settings recovery action after user-initiated profile-setting failure and each failed reload.\n\n## Defect\n\nThe preserved connected Account branch removes a focused checkbox, Save, or Remove action when a mutation outcome becomes unknown or its authoritative readback fails. The replacement Reload settings button has no focus intent. Choosing Reload then removes that focused button during loading, and a failed read creates another replacement button without restoring focus. Keyboard and screen-reader users can be stranded on the document body precisely while recovery is required.\n\n## Invariants and transitions\n\n- A user-initiated visibility, upload, or removal mutation that enters unknown state focuses the rendered Reload settings button.\n- A resolved mutation whose authoritative readback fails follows the same focus transition.\n- A definitive mutation rejection whose confirming read fails enters generic unavailable and focuses Reload settings.\n- Choosing Reload records one bounded focus intent for that exact same-lifetime load.\n- A failed unknown or generic Reload focuses the replacement Reload settings button.\n- An initial/background profile-load failure does not steal focus from an unrelated control or the document.\n- A successful Reload follows existing ready-state focus behavior and does not focus a removed recovery button.\n- App change, UID change, unmount, or stale earlier completion clears/fences the recovery focus intent and cannot move focus in a new context.\n- Focus never creates a request ID, mutation, automatic retry, draft restoration, data URL, or service call beyond the existing profile read.\n- Existing uncertainty truth, generic failure truth, mutation/read/render/context fences, and photo-draft rules remain unchanged.\n- Availability stays false; the default branch remains inert and zero-context/zero-call.\n- No photo query, facial recognition, matching, embedding, similarity, biometric processing, roster authority, or membership proof.\n\n## Exact ownership\n\n- src/pages/account/MemberDirectoryProfile.tsx\n - only a bounded recovery-focus intent/ref, Reload button ref, and guarded focus handoff.\n- src/pages/account/MemberDirectoryProfile.test.tsx\n - one separately named MEMBERS-DIRECTORY-001J block plus minimum focus assertions in directly affected recovery tests.\n- SYSTEM_DESIGN.md\n - one separately named 001J source-only paragraph.\n- IMPLEMENTATION_PLAN.md\n - one separately named 001J current-source paragraph.\n- SECURITY.md\n - one separately named 001J/RISK-042 row immediately after released 001I; preserve active #616 OAUTH-001A2L/RISK-024 byte-for-byte.\n- docs/officers/EVENTS_SHOP_MEMBERS.md\n - only the optional-directory one-sentence text alternative and one separately named no-terminal 001J source-evidence procedure; no diagram change because data movement/page structure are unchanged.\n\n## Required tests\n\n- Capture trustworthy RED on the old runtime for focus falling to body after user-initiated failure and failed Reload.\n- Ordinary unknown visibility, upload, and remove paths focus Reload settings.\n- Successful mutation plus failed authoritative readback focuses Reload settings.\n- Definitive rejection plus failed confirming read focuses generic Reload settings.\n- Failed and repeated unknown-state Reloads focus each replacement button.\n- Failed generic Reload focuses its replacement button.\n- Initial load failure never steals preexisting outside focus.\n- Successful authoritative Reload does not leave focus on a removed recovery button and preserves existing ready behavior.\n- App and UID changes and unmount make late old failures/reloads focus-inert.\n- Every reload creates zero request IDs and zero visibility/upload/remove calls and restores no draft/data URL.\n- Default unavailable branch remains zero-context, zero-ID, and zero-call.\n- Existing profile, race, accessibility, photo-review, uncertainty, privacy, and mobile tests remain green.\n\n## Explicit exclusions\n\n- CSS/layout, Account wiring/tests, admin finder, client service adapters, inbound WebP validation, or integration harnesses.\n- Functions, Rules, indexes, schemas, repair/backfill, packages, workflows, or release controls.\n- Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or #507 activation.\n- Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live connected behavior.\n- Both active #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.\n\n## Claim protocol\n\nAssign the issue and post a timestamped CLAIMED marker naming the exact branch and released base before any edit. The claim remains active through reviewed merge, exact-main audit, closure, and explicit release.
Parent: #504. Connected release remains owned by #507.\n\nOfficer impact: In the preserved future My Account interface, keyboard and screen-reader users will be moved to the available recovery action after a profile-photo or finder-setting failure instead of losing their place. The connected interface remains unavailable on production.\n\nOfficer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory one-sentence text alternative plus one no-terminal evidence-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. The existing data-flow diagram does not change.\n\nDeployment evidence: None at issue creation. This is source-only interface accessibility hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no Firebase, provider, account, sign-in, production-data, deployment, or live website action is authorized.\n\n## Atomic outcome\n\nKeep keyboard focus on the correct Reload settings recovery action after user-initiated profile-setting failure and each failed reload.\n\n## Defect\n\nThe preserved connected Account branch removes a focused checkbox, Save, or Remove action when a mutation outcome becomes unknown or its authoritative readback fails. The replacement Reload settings button has no focus intent. Choosing Reload then removes that focused button during loading, and a failed read creates another replacement button without restoring focus. Keyboard and screen-reader users can be stranded on the document body precisely while recovery is required.\n\n## Invariants and transitions\n\n- A user-initiated visibility, upload, or removal mutation that enters unknown state focuses the rendered Reload settings button.\n- A resolved mutation whose authoritative readback fails follows the same focus transition.\n- A definitive mutation rejection whose confirming read fails enters generic unavailable and focuses Reload settings.\n- Choosing Reload records one bounded focus intent for that exact same-lifetime load.\n- A failed unknown or generic Reload focuses the replacement Reload settings button.\n- An initial/background profile-load failure does not steal focus from an unrelated control or the document.\n- A successful Reload follows existing ready-state focus behavior and does not focus a removed recovery button.\n- App change, UID change, unmount, or stale earlier completion clears/fences the recovery focus intent and cannot move focus in a new context.\n- Focus never creates a request ID, mutation, automatic retry, draft restoration, data URL, or service call beyond the existing profile read.\n- Existing uncertainty truth, generic failure truth, mutation/read/render/context fences, and photo-draft rules remain unchanged.\n- Availability stays false; the default branch remains inert and zero-context/zero-call.\n- No photo query, facial recognition, matching, embedding, similarity, biometric processing, roster authority, or membership proof.\n\n## Exact ownership\n\n- src/pages/account/MemberDirectoryProfile.tsx\n - only a bounded recovery-focus intent/ref, Reload button ref, and guarded focus handoff.\n- src/pages/account/MemberDirectoryProfile.test.tsx\n - one separately named MEMBERS-DIRECTORY-001J block plus minimum focus assertions in directly affected recovery tests.\n- SYSTEM_DESIGN.md\n - one separately named 001J source-only paragraph.\n- IMPLEMENTATION_PLAN.md\n - one separately named 001J current-source paragraph.\n- SECURITY.md\n - one separately named 001J/RISK-042 row immediately after released 001I; preserve active #616 OAUTH-001A2L/RISK-024 byte-for-byte.\n- docs/officers/EVENTS_SHOP_MEMBERS.md\n - only the optional-directory one-sentence text alternative and one separately named no-terminal 001J source-evidence procedure; no diagram change because data movement/page structure are unchanged.\n\n## Required tests\n\n- Capture trustworthy RED on the old runtime for focus falling to body after user-initiated failure and failed Reload.\n- Ordinary unknown visibility, upload, and remove paths focus Reload settings.\n- Successful mutation plus failed authoritative readback focuses Reload settings.\n- Definitive rejection plus failed confirming read focuses generic Reload settings.\n- Failed and repeated unknown-state Reloads focus each replacement button.\n- Failed generic Reload focuses its replacement button.\n- Initial load failure never steals preexisting outside focus.\n- Successful authoritative Reload does not leave focus on a removed recovery button and preserves existing ready behavior.\n- App and UID changes and unmount make late old failures/reloads focus-inert.\n- Every reload creates zero request IDs and zero visibility/upload/remove calls and restores no draft/data URL.\n- Default unavailable branch remains zero-context, zero-ID, and zero-call.\n- Existing profile, race, accessibility, photo-review, uncertainty, privacy, and mobile tests remain green.\n\n## Explicit exclusions\n\n- CSS/layout, Account wiring/tests, admin finder, client service adapters, inbound WebP validation, or integration harnesses.\n- Functions, Rules, indexes, schemas, repair/backfill, packages, workflows, or release controls.\n- Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or #507 activation.\n- Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live connected behavior.\n- Both active #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.\n\n## Claim protocol\n\nAssign the issue and post a timestamped CLAIMED marker naming the exact branch and released base before any edit. The claim remains active through reviewed merge, exact-main audit, closure, and explicit release.