MEMBERS-DIRECTORY-001P — Announce and focus a successful profile-settings reload

[daliu]

Parent: #504. Connected release remains owned by #507.

Officer impact: No live officer workflow changes. In the preserved future My Account interface, a keyboard or screen-reader user who activates Reload settings will receive a fixed successful-reload result before the restored controls, and otherwise-lost focus will move to that result without overriding a deliberate focus move elsewhere. The connected interface remains unavailable on production.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and only the optional-directory Mermaid, its matching one-sentence text alternative, plus one no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. The new successful-Reload result is a visible page-structure node; data movement, permissions, ownership, and deployment topology remain unchanged.

Deployment evidence: None at issue creation. This is source-only accessibility and recovery hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no website, Firebase, provider, account/sign-in, production-data, deployment, or connected-live action is authorized.

Atomic outcome

Announce an exact successful profile-settings Reload and restore otherwise-lost focus to that result only for the exact current Reload that owned focus.

Defect

On exact released main 161ebb8, Reload settings correctly keeps uncertain-change truth across failure and refocuses a replacement Reload after failure. On guarded success, however, the focused Reload disappears, the component returns to ready with no completion result, and existing regression coverage explicitly expects document.body to own focus. The user gets restored controls but no exact reload-completion announcement or logical keyboard location.

Invariants and transitions

• Every valid explicit current Reload that completes an authoritative profile read shows exactly “Profile photo and officer finder settings reloaded.”
• The result is the first child of the recovered ready-controls region, before photo and finder controls, so the next Tab enters the refreshed controls.
• The result uses role=status, aria-live=polite, aria-atomic=true, tabIndex=-1, and a scoped visible focus outline.
• The result proves only that the current authoritative profile read completed. It does not claim whether an earlier uncertain mutation succeeded, provider state changed, or connected production is live.
• A success-focus intent is created only when the exact rendered Reload button owns focus at one valid unknown/unavailable Reload invocation.
• The intent stores only component lifetime and exact load identity. It contains no UID, name, profile, revision, request ID, photo, query, result, error, or provider value.
• The pending intent binds to the exact new load symbol. Only that current guarded authoritative success may transfer it to the rendered result.
• The result focus effect consumes the exact intent before target checks, requires the target to be connected, avoids redundant focus, and restores only from null, document.body, document.documentElement, or a disconnected active element.
• Any connected focus chosen while Reload is pending, whether outside or inside the profile region, is preserved.
• A valid explicit programmatic or unfocused Reload may show the successful result, but it creates no focus intent and cannot move focus.
• Initial/background load success shows no Reload result and never moves focus.
• Reload failure shows no success result and retains released MEMBERS-DIRECTORY-001J — Preserve profile-recovery keyboard focus #637 replacement-Reload focus behavior and MEMBERS-DIRECTORY-001I — Preserve uncertain-change truth across failed reloads #635 uncertainty truth.
• A later rerender cannot consume an old result intent. Application change, UID change, unmount, a new load, and obsolete completions clear or fail the exact lifetime/load checks.
• The handoff creates no request ID, mutation, retry, extra profile read, data URL, provider call, audit record, or stored value.
• Existing upload/remove/visibility confirmations and MEMBERS-DIRECTORY-001M — Restore surviving photo-control focus after rejected removal #643/MEMBERS-DIRECTORY-001N — Preserve deliberate focus during confirmed photo changes #645/MEMBERS-DIRECTORY-001O — Preserve visibility-toggle focus after authoritative settlement #647 focus contracts remain unchanged.
• Availability stays false; the default route remains an inert zero-context, zero-ID, zero-call preview.
• This remains name-prefix search plus human visual comparison of voluntary thumbnails. No photo query, facial recognition, matching, embedding, similarity, biometric processing, total, export, roster authority, or membership proof.

Exact ownership

• src/pages/account/MemberDirectoryProfile.tsx
  • only the fixed top-of-ready-controls Reload result, dedicated pending/result exact-load focus intents and result ref, guarded success transfer, and cleanup/fences.
• src/pages/account/MemberDirectoryProfile.test.tsx
  • one separately named MEMBERS-DIRECTORY-001P block plus the minimum directly affected successful-Reload assertion.
• src/pages/account/Account.css
  • only the scoped visible focus treatment for the programmatically focused Reload result.
• SYSTEM_DESIGN.md
  • one separately named 001P source-only paragraph.
• IMPLEMENTATION_PLAN.md
  • one separately named 001P current-source paragraph.
• SECURITY.md
  • one separately named 001P/RISK-042 row immediately after released 001O; preserve active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024 byte-for-byte.
• docs/officers/EVENTS_SHOP_MEMBERS.md
  • only the matching optional-directory Mermaid, its one-sentence text alternative, and one separately named no-terminal 001P source-evidence procedure.

Required tests

• Capture trustworthy old-runtime RED by replacing the released body-focus expectation after an exact focused deferred successful Reload with the fixed result/focus contract.
• Verify the exact result copy, first-in-controls placement, status/live/atomic semantics, tabIndex, scoped class, and visible focus-style contract.
• Cover successful Reload from both generic unavailable and uncertain-change recovery states.
• Prove an initial/background success renders no result and steals no outside focus.
• Prove programmatic/unfocused Reload success renders the result but does not move focus, including after the outside origin is removed before settlement.
• Prove connected outside focus and connected in-profile focus moved during pending are preserved.
• Prove focused failed Reload still focuses the replacement Reload and renders no success result.
• Prove repeated failure followed by exact success focuses the result only on the successful exact load.
• Prove the result intent is one-shot and cannot refocus after a later same-context rerender.
• Prove old successful resolution after application change, UID change, or unmount is focus- and result-inert.
• Assert exact profile-read counts and zero request IDs, mutations, photo calls, retries, or draft restoration.
• Keep default unavailable preview zero-context, zero-ID, and zero-call.
• Run the focused profile suite, full frontend suite, TypeScript, scoped lint, unchanged lint baseline, diagnostic build, workflow/security tests, and diff check.

Explicit exclusions

• Account.tsx/test, admin finder runtime/tests, directory services/tests, availability file, AdminGuard, route wiring, upload/photo/visibility semantics, or copy outside the separately named docs hunks.
• Functions, Rules, indexes, schema, repair/backfill, packages, workflows, or release controls.
• Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 activation.
• Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live connected behavior.
• Both active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.

Migration and residual risk

No migration. Programmatic focus and a local completion status are accessibility feedback, not authorization, provider acknowledgement, mutation proof, data correctness, or live evidence. Live #623 remains the inert preview, and #507 retains every privacy, authorization, staging, backend-first deployment/readback, availability-flip, publication, and live-proof gate.

Claim protocol

Assign the issue and post a timestamped CLAIMED marker naming the exact branch, released base, tree, and seven-path ownership before any source edit. The claim remains active through reviewed merge, exact-main/deployment audit, closure, and explicit release.

[daliu]

CLAIMED by /root. Server-timestamped marker; no source edit preceded this comment.

Branch: codex/issue-649-reload-success-focus
Exact released base: 161ebb8
Exact base tree: f5f598aab4efb8a4ad7d8668be2ad2e4b6a9ad7f

Exact ownership is limited to seven paths: src/pages/account/MemberDirectoryProfile.tsx; src/pages/account/MemberDirectoryProfile.test.tsx; src/pages/account/Account.css; SYSTEM_DESIGN.md; IMPLEMENTATION_PLAN.md; SECURITY.md; docs/officers/EVENTS_SHOP_MEMBERS.md.

The runtime scope is only a fixed top-of-ready-controls successful-Reload status, an exact-lifetime/load focus handoff that arms only from the focused Reload button, and its scoped visible focus outline. Tests will first capture the released body-focus defect. Documentation stays in separately named 001P hunks; the officer guide changes only its one-sentence optional-directory text alternative and one no-terminal evidence procedure, with no Mermaid change.

memberDirectoryAvailability.ts remains byte-for-byte false. Account.tsx, admin finder, services, Functions, Rules, indexes, packages, workflows, provider configuration, accounts/sign-in, data, deployment, publication, and connected-live behavior are excluded. #507 retains every connection gate. Active #616 Strava paths and its separate OAUTH-001A2L/RISK-024 SECURITY hunk are immutable; whichever merges later controlled-refreshes.

This claim remains active through reviewed merge, exact-main and deployment-surface audit, issue closure, and explicit release.

[daliu]

SCOPE WORDING CORRECTION before documentation edits: the exact seven-path ownership is unchanged, but the visible successful-Reload result is a new page-structure node. Repository continuity policy therefore requires the existing optional-directory Mermaid in docs/officers/EVENTS_SHOP_MEMBERS.md to change together with its one-sentence text alternative and the 001P no-terminal procedure. Data movement, permissions, ownership, deployment, backend, provider, and live topology remain unchanged. This correction supersedes only the earlier “no Mermaid change” phrase; every runtime invariant, exclusion, protected #616 boundary, false availability requirement, exact branch/base/tree, and seven-path claim remains unchanged.

[daliu]

#649 reviewed local candidate — SOURCE ONLY / NOT LIVE

Candidate commit: c111c37
Tree: cf61d8f2301462ff0d331257b9c07b69784703cc
Sole parent / exact released base: 161ebb8
Exact seven-path binary diff SHA-256: 37d81140fa4cb0c01f90fd856b93d0cc238a02e8b05d563bda69f6eb8f95607c

Scope is exactly the claimed MemberDirectoryProfile runtime/test, scoped Account.css focus rule, separate SYSTEM_DESIGN / IMPLEMENTATION_PLAN / SECURITY 001P hunks, and the matching optional-directory Mermaid, one-sentence text alternative, and no-terminal procedure. The corrected Mermaid requirement is included.

Trustworthy old-source RED: MEMBERS-DIRECTORY-001P had 8 failures and 5 containment passes; the failures were the absent successful result/focus behavior and missing scoped CSS rule. Current Node 20 evidence: named 15/15; full MemberDirectoryProfile 167/167; full frontend 18 suites and 1,252 tests; repository Node 105/105; TypeScript pass; scoped ESLint pass; lint baseline verified at 120 files / 113 reviewed legacy errors / 6 reviewed legacy warnings; diagnostic production build pass; diff-check pass. The one frontend-review finding was a greedy CSS-test regex; it is fixed with a same-rule-block bound and independently re-reviewed GO.

Independent focus/race, security/privacy/scope, and frontend/accessibility/mobile/docs reviews are GO. The fixed status is first in recovered controls, proves only the exact current authoritative read completed, and focuses only from otherwise-lost focus for the exact focused Reload/load. Initial, failure, unfocused/programmatic, connected-focus, later-rerender, application, account, and unmount paths remain contained. #637 failure focus and #643/#645/#647 contracts remain separate.

Availability remains literal false, blob 295909b0df8dd7c54a0f164f99d4943656aece4b. #616 protected blobs remain 2eb48945061ab5ad2a896c6835f308cefd7fe63a and d1792d390bd57608fecab84341a6e5916fcf8196; its OAUTH/RISK-024 hunk is untouched. #507 retains every connection gate. Live production remains inert #623 deploy 6a7e072f8f346b0008510d29. No website, Firebase, provider, account/sign-in, production-data, or connected-live action occurred.

Next gates: push this exact commit, open a ready PR, verify exact-head CI and unpublished preview, complete independent exact-head review, then merge only if remote main remains the exact parent and all evidence stays green.