From aee08bfb0504c3a31da7aaf17565d13a11d8824e Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Thu, 13 Aug 2026 15:35:35 -0700 Subject: [PATCH] Preserve uncertain change truth on reload (#635) --- IMPLEMENTATION_PLAN.md | 2 + SECURITY.md | 1 + SYSTEM_DESIGN.md | 2 + docs/officers/EVENTS_SHOP_MEMBERS.md | 75 +++++++- .../account/MemberDirectoryProfile.test.tsx | 181 ++++++++++++++++++ src/pages/account/MemberDirectoryProfile.tsx | 14 +- 6 files changed, 272 insertions(+), 3 deletions(-) diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 8b4a246..8b10da0 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -179,6 +179,8 @@ Exit gate: **MEMBERS-DIRECTORY-001H current source boundary:** [#633](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/633) changes only the preserved connected Account photo controls. **Remove current saved photo** distinguishes the authoritative saved thumbnail from a separate local replacement. A confirmed remove and authoritative readback preserves the exact current reading or ready draft identity while updating only the saved-photo state and revision; the replacement is not uploaded until a later explicit Save creates a new request ID and sends the same content type and bytes once against that refreshed revision. Definitive rejection plus successful readback keeps the draft and binds the fixed error to Remove. An unknown outcome or failed post-mutation readback discards the draft, bytes, and data URL, hides the photo and finder mutation controls, and retains only the existing **Reload settings** recovery with no Save or duplicate-mutation retry. Confirmed readback focuses a still-current Remove action first, an eligible Save action second, or the persistent Add/Replace input otherwise. Finder visibility and the existing context, read, render, mutation, and readback fences remain unchanged. No photo query, face recognition, matching, embedding, similarity, biometric processing, roster authority, or membership proof is added. Availability stays `false`, so the default source branch and live #623 preview remain inert. #633 changes no service contract, Function, Rule, index, package, workflow, backend, provider, account, sign-in, production data, or connected/live behavior. #507 still owns privacy approval, scoped authorization, isolated staging, backend-first deployment/readback, the reviewed availability flip, connected publication, and live proof. +**MEMBERS-DIRECTORY-001I current source boundary:** [#635](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/635) changes only the preserved connected Account recovery state. An unknown visibility, upload, or removal outcome, or a failed authoritative post-mutation readback, retains the fixed uncertain-change warning through failed and repeated **Reload settings** attempts in the same application and account lifetime. Photo and finder mutation controls stay hidden, and discarded draft bytes or data URLs do not return. Only a successful authoritative profile read clears uncertainty and shows the returned current photo and finder setting. Initial profile-load failures and failed confirming reads after definitive mutation rejection remain generic unavailable states, while the generic load message no longer promises globally that no setting changed. Reload creates no request ID, sends no visibility, upload, or removal mutation, and starts no automatic mutation retry; application change, account change, and unmount reset the component lifetime and fence older completions. Availability stays `false`, so the default source branch and live #623 preview remain inert. #635 changes no data movement, page structure, service contract, Function, Rule, index, package, workflow, backend, provider, account, sign-in, production data, deployment, or connected/live behavior. #507 still owns privacy approval, scoped authorization, isolated staging, backend-first deployment/readback, the reviewed availability flip, connected publication, and live proof. + ### Phase 5 — End-to-end qualification **Issue:** TEST-001 plus final closure evidence from all prior phases diff --git a/SECURITY.md b/SECURITY.md index 07d325f..07a5849 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -104,6 +104,7 @@ These entries are implementation evidence, not a production risk-acceptance deci | Source-only explicit photo-review containment for RISK-042 | MEMBERS-DIRECTORY-001F [#629](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/629) makes the preserved connected Account branch validate and read a selected JPG, PNG, or WebP locally into a centered-square component-memory draft labeled **Selected photo — not uploaded yet**. Selection, validation, reading, preview, and Cancel create no request ID and call no directory service. Only explicit **Save profile photo** creates the request ID and sends the existing revisioned upload request. Confirmed Save clears the draft after authoritative refetch. Request-ID failure or definitive rejection plus successful refetch retains a retryable draft and adopts the refreshed revision; unknown or failed readback discards the draft and hides controls. A visibility save preserves the draft. The application never reads, retains, renders, logs, sends, or otherwise exposes `file.name`; tests use only opaque generated fixture names. Generation and application/account-context fences prevent an older read or render event from changing or uploading a newer draft. Invalid and unreadable selections retain no draft. Unrenderable bytes and their draft UI are discarded, the fixed error remains associated with the persistent file control, and no Save action is exposed. The authoritative saved thumbnail has a version-reset, byte-free **Photo unavailable** fallback while Remove remains available. | A local preview still places private image bytes in browser memory, and explicit Save does not itself prove an approved notice, scoped authority, backend deployment, or successful processing. Retryable bytes intentionally remain in component memory only for request-ID failure or definitive rejection with successful readback; an unknown outcome clears them. This source-only UI control stays behind the unchanged `false` availability value; the live #623 preview remains inert. It changes no visibility preference or service/server contract. #507 still owns privacy and retention approval, scoped authorization, protected authority, isolated staging, backend-first deployment/readback, the availability flip, connected publication, and live proof. Use only generated non-face test images; do not inspect or upload a real photo. | | Source-only rendered-result containment for RISK-042 | MEMBERS-DIRECTORY-001G [#631](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/631) makes the preserved connected People finder distinguish an absent photo from a supplied thumbnail that the browser cannot display. `null` renders **No photo**; a failed non-null render removes the image/data URL from the page and renders **Photo unavailable**; a different later version receives a fresh render attempt. After completed validation, empty results, fixed failure, or result cards, **Clear search and result cards** empties the query, removes the prior message, headings, cards, names, and images from component state and the rendered page, announces **Search field and displayed result cards cleared.**, and focuses the name input. It creates no request ID and makes no directory-service call. Generated-only tests use made-up names and non-face thumbnails to cover the fallbacks, version reset, four clearable outcomes, focus, zero-call behavior, keyboard/44-pixel/contrast/320-pixel layout, and the unchanged unavailable default. | This local rendered-page disposal is not cancellation, browser-memory erasure, cache removal, audit rollback, or recall of a response already returned, seen, or captured. Clear is absent while idle or pending; existing pending, stale-context, guard, projection, cap, and fixed-error behavior remains. The source-controlled availability value stays `false`, and live #623 remains inert. No service/server contract, Firebase, provider, account, sign-in, production data, or live behavior changes. #507 still owns notice/retention approval, scoped authorization, protected authority, isolated staging, backend-first deployment/readback, the availability flip, connected publication, and live proof. Never add a photo query, face recognition, embedding, similarity, biometrics, total, export, or roster authority; use no real name or photo. | | Source-only reviewed-replacement containment for RISK-042 | MEMBERS-DIRECTORY-001H [#633](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/633) renames the destructive control **Remove current saved photo** and makes a confirmed remove plus authoritative readback preserve the exact current reading or ready component-memory draft identity while updating only the current saved-photo state and revision. The replacement creates no upload request or service call until a later explicit Save creates a new request ID, sends the same content type and bytes once, and uses the refreshed revision. Definitive rejection plus successful readback preserves the draft and associates the fixed error with Remove. Unknown outcome or failed post-mutation readback clears the draft identity, bytes, and data URL, hides photo and finder mutation controls, retains only the existing **Reload settings** recovery, and exposes no Save or duplicate-mutation retry. Confirmed readback moves focus to a still-current Remove action, otherwise an eligible Save action, otherwise the persistent Add/Replace input. Generated-only tests cover exact-byte/revision reuse, reading and ready drafts, no-draft and concurrent-photo focus, rejection, unknown/readback failure, unchanged visibility, stale contexts, reselection, unmount, and the unchanged unavailable default. | Intentionally preserving an unsaved replacement keeps private image bytes in component memory after the current saved photo is removed; it is not an upload, durable draft, server state, cancellation, or deletion proof outside the authoritative saved-photo readback. Context and generation fences limit stale restoration, while unknown state fails closed by discarding the draft. The source-controlled availability value stays `false`, and live #623 remains inert. No service/server contract, photo query, face recognition, matching, embedding, similarity, biometric processing, roster authority, membership proof, Firebase, provider, account, sign-in, production data, or connected/live behavior changes. #507 still owns notice/retention approval, scoped authorization, protected authority, isolated staging, backend-first deployment/readback, the availability flip, connected publication, and live proof. Use only generated non-face test images; do not inspect or upload a real photo. | +| Source-only uncertain-change recovery containment for RISK-042 | MEMBERS-DIRECTORY-001I [#635](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/635) gives the preserved connected Account branch a component-lifetime uncertainty marker for an ordinary mutation failure or failed authoritative post-mutation readback. Failed and repeated **Reload settings** reads retain the fixed **We could not confirm that change** warning, keep photo and finder mutation controls hidden, and cannot restore discarded draft bytes or data URLs. A successful guarded authoritative profile read clears uncertainty and displays the returned state. Initial load failures and failed confirming reads after definitive mutation rejection remain generic unavailable; that generic message no longer globally promises **No setting was changed**. Reload creates no request ID or visibility, upload, or removal mutation. Generated-only tests cover repeated failures, eventual authoritative success, generic failures, zero mutation retries, discarded bytes, and stale application/account reload fences. | The marker preserves truthful uncertainty only within one mounted application-and-account component lifetime; it is not provider acknowledgement, durable mutation evidence, reconciliation, deletion proof, or authorization. Generic unavailable state deliberately does not infer whether a prior change occurred. The source-controlled availability value stays `false`, and live #623 remains inert. No data movement, page structure, service/server contract, Firebase, provider, account, sign-in, production data, deployment, or connected/live behavior changes. #507 still owns notice/retention approval, scoped authorization, protected authority, isolated staging, backend-first deployment/readback, the availability flip, connected publication, and live proof. Use no real name or photo. | | Immediate Product-binding containment part of RISK-031 | PAY-PRODUCT-001A is tracked in live [#353](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/353). One dependency-free projection is used by the paid race and Shop checkout paths. A present stored Product link must be an own primitive non-empty string from 1 through 255 JavaScript code units and is copied without trimming, conversion, character restrictions, or `prod_` inference. Only a genuinely missing own field retains the compatibility Product-create path. Before any mapping write, a resolved Product must provide a bounded custom ID, exact Product kind, expected declared mode, and an installed-SDK 2xx response marker. Malformed stored links stop before token, registration/order identifier, Product-link or business-record write, or Stripe work; earlier access and request-count checks and their safety-counter writes may already have run. Malformed created results stop after at most one Product attempt but before mapping, Checkout Session, or business-record writes. | This structural containment does not prove provider origin, Stripe account ownership, intended catalog identity, metadata binding, Product status, price, dispatch, delivery, or reconciliation. A rejected create result may leave an orphaned Product; do not retry automatically. Anonymous clean-missing creation remains concurrency-prone and reachable from public traffic. Complete #113 inventory/disposition, authenticated idempotent catalog synchronization, Product-specific plan/pre-send/result/lost-acknowledgement/reconciliation controls, isolated staging, protected Firebase deployment, and provider proof before live commerce. | | Immediate current-handler containment part of RISK-003 | PAY-SESSION-001A is tracked in live [#357](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/357). The current paid race and Shop handlers build one immutable expectation before the Session call, catch rejection without opening it, and immediately project only a closed installed-SDK result. A result must match declared test/live mode, payment/open/unpaid state, exact cents, USD, buyer email, exact closed metadata, exact callbacks, a mode-compatible bounded Session ID, one canonical HTTPS capability at the hard-coded default `checkout.stripe.com` origin, and an installed-SDK 200 marker. Only copied ID/URL values continue; records store the ID but never the URL. Invalid results create no registration/order record and return one fixed unknown-result message. The website makes rejection or a missing paid URL terminal for that page visit, retains the form, and blocks a second direct handler call. | This is a narrow legacy compatibility stop, not trusted provider/account origin, deterministic business idempotency, dispatch/delivery proof, durable result evidence, payment proof, or adoption of the unused C4 chain. The Session call occurs first, so a rejected result may leave a payable orphan; earlier rate-counter, token/identifier, and lazy Product-mapping effects may remain. Reload, another tab/device, or a scripted caller bypasses the page lock. A configured Stripe custom checkout domain is blocked until #113 and a protected configuration boundary approve it. Complete PAY-002C/D persistence-first sagas, trusted C4 controller/result persistence, reconciliation, protected staging/deployment, provider readback, and exact website/Firebase/live proof. | | Immediate pre-render browser containment part of RISK-003 | PAY-SESSION-001B is tracked in live [#503](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/503). Each current public race and Shop page now keeps one component-local in-memory marker. After existing local checks admit a request, the handler sets that marker synchronously before analytics or its first Checkout promise can settle. A same-action or later submission on that mounted page is inert, including the gap before React renders the existing pending disabled button. Focused actual-route tests prove one service/analytics attempt across same-action and post-render repeats; preserve free-participant, volunteer-without-price-tier, and both paid-link navigation branches; and prove local waiver/native-disabled paths do not consume an attempt. | This browser marker is not a server boundary, durable idempotency key, provider dispatch/result record, business-state lock, payment proof, or reconciliation. It never releases during the mounted page visit because the admitted result must navigate or enter #357's terminal unknown-result state. Existing form controls other than the submit button remain editable. Reload, a remount, another tab/device, a script, or a direct service caller can bypass it. A same-mounted route change instead stays locked, and this slice does not fence an older pending result from that changed route. Complete PAY-002C/D persistence-first deterministic commands, durable replay/reconciliation, protected deployment, and exact website/Firebase/Stripe/live proof. | diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index c741461..135b5fd 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -695,6 +695,8 @@ The backend source still has no production index, Rules, Function, privacy-notic WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) published only that inert interface as deploy `6a7e072f8f346b0008510d29`, from source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, tree `411aa6ec9a9459f5d923030533ffc7c007fe6908`, and a 62-file artifact with digest `d837272a1e5efc1575809e87f532276b38d1a63f1dd79ec1aef0533f6da8afb1`. Protected-layout proof remains synthetic. Completed signed-out public proof is limited to the exact revision, normal sign-in and administrator guards, and absence of a member-directory request. The manifest is inactive; the release source is absent; and the rollback ref remains. #623 deployed no Firebase, Rules, Functions, or indexes and changed no provider configuration, account, sign-in, or production data. #507 remains **NOT AVAILABLE YET**. +**MEMBERS-DIRECTORY-001I uncertain-change reload truth — SOURCE ONLY:** [#635](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/635) changes only the preserved connected Account recovery state. An ordinary visibility, upload, or removal failure with an unknown outcome, or a mutation whose authoritative readback fails, sets a component-lifetime uncertainty marker and displays the fixed **We could not confirm that change** warning. Each failed **Reload settings** preserves that warning, keeps the photo and finder mutation controls hidden, and cannot restore discarded draft bytes or data URLs. Only a successful guarded authoritative profile read clears uncertainty and renders the returned current photo and finder setting. An initial profile-load failure and a failed confirming read after a definitive mutation rejection remain generic unavailable states; the generic load message no longer makes the global promise **No setting was changed**. Reload creates no request ID, performs no visibility, upload, or removal mutation, and starts no automatic mutation retry. The existing application/account key and lifetime/load fences reset uncertainty on application change, account change, or unmount and make an older reload completion inert. This is state and copy hardening only: it changes no data movement, page structure, service contract, Function, Rule, index, package, workflow, backend, provider, account, sign-in state, production data, deployment, or connected/live behavior. Availability remains byte-for-byte `false`; the default source branch and live #623 preview remain inert, and #507 retains every privacy, authorization, staging, deployment, connection, publication, and live-proof gate. + ### 8.0a Provider-neutral membership authority and entitlement — SOURCE ONLY, UNUSED MEMBERS-IDENTITY-001A [#208](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/208), with its command-order correction in MEMBERS-IDENTITY-001H [#451](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/451), defines one unused pure contract that keeps a stable MPRC membership separate from the Firebase account used to sign in. A membership record can exist and receive monotonic term decisions without a UID. Such a record grants no website entitlement. Google, WhatsApp, Strava, email equality, a profile role, and any browser field remain projections or inputs to future reviewed workflows; none is membership authority. diff --git a/docs/officers/EVENTS_SHOP_MEMBERS.md b/docs/officers/EVENTS_SHOP_MEMBERS.md index c93fbe0..ac4c4e6 100644 --- a/docs/officers/EVENTS_SHOP_MEMBERS.md +++ b/docs/officers/EVENTS_SHOP_MEMBERS.md @@ -2472,7 +2472,7 @@ flowchart TD Connected -. "never photo search or proof" .-> Official["Membership, role, payment, or official records"] ``` -Text alternative: the published #623 artifact keeps the Account and administrator-guarded People-finder controls disabled; source-only #627 preserves the accessible connected layouts behind the unchanged false availability value; source-only #629 adds local photo review where Cancel sends nothing, Save alone sends the existing upload command, and the current saved photo remains authoritative with a version-reset unavailable fallback; source-only #631 distinguishes a `null` **No photo** result from an unrenderable supplied **Photo unavailable** result, retries a different later photo version, and lets completed local states clear the query, messages, cards, names, and images with an announcement, input focus, and no new request or service call; that Clear action does not cancel work, erase memory or cache, roll back an audit, or recall a seen result; source-only #633 makes **Remove current saved photo** preserve the same local reading or ready replacement through a confirmed authoritative remove, use the refreshed revision only when the person later chooses Save, focus a remaining Remove action before a ready Save action before the persistent file input, keep the draft after a definitive rejection with successful readback, and after an unknown outcome or failed readback discard its bytes, hide photo and finder mutation controls, and retain only the existing Reload settings recovery with no Save retry; and only #507 may later connect name search plus voluntary thumbnails after privacy, authorization, staging, and backend-first readback, without photo search, face recognition, or official-record authority. +Text alternative: the published #623 artifact keeps the Account and administrator-guarded People-finder controls disabled; source-only #627 preserves the accessible connected layouts behind the unchanged false availability value; source-only #629 adds local photo review where Cancel sends nothing, Save alone sends the existing upload command, and the current saved photo remains authoritative with a version-reset unavailable fallback; source-only #631 distinguishes a `null` **No photo** result from an unrenderable supplied **Photo unavailable** result, retries a different later photo version, and lets completed local states clear the query, messages, cards, names, and images with an announcement, input focus, and no new request or service call; that Clear action does not cancel work, erase memory or cache, roll back an audit, or recall a seen result; source-only #633 makes **Remove current saved photo** preserve the same local reading or ready replacement through a confirmed authoritative remove, use the refreshed revision only when the person later chooses Save, focus a remaining Remove action before a ready Save action before the persistent file input, keep the draft after a definitive rejection with successful readback, and after an unknown outcome or failed readback discard its bytes, hide photo and finder mutation controls, and retain only the existing Reload settings recovery with no Save retry; source-only #635 keeps that uncertain-change warning through failed Reload settings attempts until one authoritative profile read succeeds, while generic load failures make no global no-change promise and reload sends no mutation; and only #507 may later connect name search plus voluntary thumbnails after privacy, authorization, staging, and backend-first readback, without photo search, face recognition, or official-record authority. Officer review steps for the #621 frontend preview: @@ -2881,6 +2881,79 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001H [#633] reviewed-repla **Escalation:** membership lead plus privacy and platform/security owners. Use the private incident path if a real photo/name appeared, a visibility choice was wrong, or deletion could not be confirmed. +Officer source-review procedure for MEMBERS-DIRECTORY-001I [#635] uncertain-change reload truth — connected source only, **NOT LIVE**: + +**Purpose:** let a backup officer verify from specialist-prepared evidence that a failed settings reload does not replace an uncertain-change warning with a false assurance. This review does not connect the feature, retry a mutation, use a real account or photo, or change production. + +**Approvers:** membership lead, privacy owner, and platform/security owner. + +**Prerequisites:** #633 is reviewed and merged. Ask the platform owner or testing specialist for the exact #635 source candidate, the named generated-only test output, and a redacted written synthetic-behavior report. The specialist runs the tests and records the evidence. The backup officer reviews that written evidence without a terminal or test harness. Keep the source-controlled availability value `false`. Do not sign in to production, use a real name or photo, call production Firebase, or change production data. + +1. Keep the complete profile-photo and People-finder feature marked **NOT AVAILABLE YET**. +2. Ask the platform owner for the exact #635 issue. +3. Ask the platform owner for the reviewed pull request. +4. Ask the platform owner for the candidate or merge commit. +5. Ask the testing specialist for the named MEMBERS-DIRECTORY-001I test output. +6. Ask the testing specialist for the redacted written synthetic-behavior report. +7. Confirm the report names the specialist who ran the tests. +8. Confirm the evidence uses only a made-up account. +9. Confirm the evidence uses only generated non-face image bytes. +10. Confirm the source-controlled availability value remains byte-for-byte `false`. +11. Confirm the last verified production deployment remains inert #623 deploy `6a7e072f8f346b0008510d29`. +12. Confirm an ordinary unknown visibility, upload, or removal outcome displays **We could not confirm that change**. +13. Confirm a failed authoritative read after a resolved mutation displays the same warning. +14. Confirm each warning tells the person not to make another change yet. +15. Confirm the warning retains only **Reload settings** recovery. +16. Confirm the photo mutation controls stay hidden while the outcome is uncertain. +17. Confirm the finder mutation control stays hidden while the outcome is uncertain. +18. Confirm an uncertain upload leaves no selected-photo data URL in the rendered page. +19. Confirm the first failed Reload preserves the exact uncertain-change warning. +20. Confirm a repeated failed Reload preserves the exact uncertain-change warning. +21. Confirm neither failed Reload displays **No setting was changed**. +22. Confirm a successful authoritative Reload clears the uncertain-change warning. +23. Confirm that successful Reload shows the returned current photo state. +24. Confirm that successful Reload shows the returned current finder setting. +25. Confirm an initial profile-load failure displays the generic unavailable message. +26. Confirm that generic unavailable message does not say **No setting was changed**. +27. Confirm a failed confirming read after a definitive rejection remains generic unavailable. +28. Confirm that definitive-rejection path is not elevated to known mutation uncertainty. +29. Confirm Reload creates no directory request number. +30. Confirm Reload calls no visibility mutation. +31. Confirm Reload calls no photo upload mutation. +32. Confirm Reload calls no photo removal mutation. +33. Confirm Reload starts no automatic mutation retry. +34. Confirm an application change resets the earlier component lifetime. +35. Confirm an account change resets the earlier component lifetime. +36. Confirm an older reload completion cannot change the new application or account state. +37. Confirm the default Account branch obtains no directory context. +38. Confirm the default Account branch creates no directory request number. +39. Confirm the default Account branch calls no directory service. +40. Confirm the source diff changes no Account wiring or People-finder page. +41. Confirm the source diff changes no data movement or page structure. +42. Confirm the source diff changes no client service contract. +43. Confirm the source diff changes no Function, Rule, index, schema, package, workflow, or release control. +44. Record the source change as its own state. +45. Record the named test results as their own state. +46. Record whether the change merged as its own state. +47. Record whether any website artifact was published as its own state. +48. Record the exact `runmprc.com` revision as its own state. +49. Record whether Firebase was deployed as its own state. +50. Record whether an outside provider was configured as its own state. +51. Record whether an account or sign-in state changed as its own state. +52. Record whether production data changed as its own state. +53. Record whether connected behavior became available as its own state. +54. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. + +**Expected result:** the reviewed connected source preserves the fixed uncertain-change warning through failed and repeated **Reload settings** reads until one authoritative profile read succeeds. Mutation controls and discarded draft bytes stay absent while the outcome is uncertain. A successful read displays the returned current profile state. Initial profile-load failure and failed confirming read after definitive rejection remain generic unavailable without a global no-change promise. Reload creates no request ID, sends no visibility, upload, or removal mutation, and starts no mutation retry. Application and account lifetime fences keep older reloads inert. Availability remains `false`; the default branch obtains no directory context, creates no request ID, and calls no directory service; and live #623 remains inert. The backend and connected behavior remain **NOT AVAILABLE YET**. + +**Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a failed Reload that replaces uncertain-change truth with generic unavailable or **No setting was changed**; an initial or definitive-rejection load failure mislabeled as known mutation uncertainty; a discarded draft or data URL restored; a mutation control shown while uncertainty remains; a request number or visibility, upload, or removal mutation caused by Reload; an automatic mutation retry; an older reload changing a new application or account state; a data-flow or page-structure change; a Function, Rule, index, schema, service-contract, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. + +**Success proof:** record the exact #635 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001I focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/state, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value and unchanged #623 deploy separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. + +**Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #635 changes source only. Undo must not introduce a false no-change assurance or restore discarded draft bytes. + +**Escalation:** membership lead plus privacy and platform/security owners. Use the private incident path if a real name or photo appeared, a failed Reload hid uncertain-change truth, Reload sent a mutation, stale state crossed accounts, or connected behavior became available. + ## Admin screens — NOT AVAILABLE YET Admin event and product editors exist in source, but their live permissions, backup, preview, and rollback behavior have not been approved. Saving can write directly to production Firestore. Officers must not use these screens as a continuity procedure yet. diff --git a/src/pages/account/MemberDirectoryProfile.test.tsx b/src/pages/account/MemberDirectoryProfile.test.tsx index 882a8ea..2285c14 100644 --- a/src/pages/account/MemberDirectoryProfile.test.tsx +++ b/src/pages/account/MemberDirectoryProfile.test.tsx @@ -1623,6 +1623,187 @@ describe('My Account member directory profile', () => { expect(setMyMemberDirectoryPhoto).toHaveBeenCalledTimes(1); }); + describe('MEMBERS-DIRECTORY-001I uncertain-change reload truth', () => { + const unknownChangeMessage = 'We could not confirm that change. Do not make another change yet. Reload settings to check what is currently saved.'; + + test('keeps an ordinary unknown upload warning through failed and repeated reloads without restoring draft bytes or retrying', async () => { + (setMyMemberDirectoryPhoto as jest.Mock) + .mockRejectedValueOnce(new Error('synthetic private outcome detail')); + (getMyMemberDirectoryProfile as jest.Mock) + .mockResolvedValueOnce(DEFAULT_PROFILE) + .mockRejectedValueOnce(new Error('synthetic private first reload detail')) + .mockRejectedValueOnce(new Error('synthetic private second reload detail')); + renderProfile(); + const input = await screen.findByLabelText('Add profile photo'); + fireEvent.change(input, { + target: { + files: [new File(['uncertain local bytes'], 'fixture-001i-001.png', { + type: 'image/png', + })], + }, + }); + const preview = await screen.findByRole('img', { + name: 'Selected profile photo preview', + }); + fireEvent.load(preview); + fireEvent.click(screen.getByRole('button', { name: 'Save profile photo' })); + + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + expect(document.body.innerHTML).not.toContain(btoa('uncertain local bytes')); + expect(screen.queryByLabelText('Add profile photo')).not.toBeInTheDocument(); + expect(screen.queryByRole('checkbox')).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(2)); + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + expect(document.body).not.toHaveTextContent('No setting was changed'); + expect(document.body.innerHTML).not.toContain(btoa('uncertain local bytes')); + expect(screen.queryByLabelText('Add profile photo')).not.toBeInTheDocument(); + expect(screen.queryByRole('checkbox')).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(3)); + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(3); + expect(createMemberDirectoryRequestId).toHaveBeenCalledTimes(1); + expect(setMyMemberDirectoryPhoto).toHaveBeenCalledTimes(1); + expect(removeMyMemberDirectoryPhoto).not.toHaveBeenCalled(); + expect(setMyMemberDirectoryVisibility).not.toHaveBeenCalled(); + expect(document.body).not.toHaveTextContent('synthetic private'); + }); + + test('keeps successful-mutation readback uncertainty through failed reloads until one authoritative read succeeds', async () => { + const authoritative = { + ...PROFILE_WITH_PHOTO, + revision: 8, + searchableByOfficers: true, + }; + (getMyMemberDirectoryProfile as jest.Mock) + .mockResolvedValueOnce(DEFAULT_PROFILE) + .mockRejectedValueOnce(new Error('synthetic private readback detail')) + .mockRejectedValueOnce(new Error('synthetic private first reload detail')) + .mockRejectedValueOnce(new Error('synthetic private second reload detail')) + .mockResolvedValueOnce(authoritative); + renderProfile(); + fireEvent.click(await screen.findByRole('checkbox')); + + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(3)); + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(4)); + expect(await screen.findByRole('alert')).toHaveTextContent(unknownChangeMessage); + expect(screen.queryByRole('checkbox')).not.toBeInTheDocument(); + + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(5)); + expect(await screen.findByRole('checkbox')).toBeChecked(); + expect(screen.getByRole('img', { name: 'Your current profile thumbnail' })) + .toBeInTheDocument(); + expect(screen.queryByText(unknownChangeMessage)).not.toBeInTheDocument(); + expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(5); + expect(createMemberDirectoryRequestId).toHaveBeenCalledTimes(1); + expect(setMyMemberDirectoryVisibility).toHaveBeenCalledTimes(1); + expect(setMyMemberDirectoryPhoto).not.toHaveBeenCalled(); + expect(removeMyMemberDirectoryPhoto).not.toHaveBeenCalled(); + }); + + test('keeps initial and definitive-rejection read failures generic without a global no-change promise', async () => { + (getMyMemberDirectoryProfile as jest.Mock) + .mockRejectedValueOnce(new Error('synthetic private initial detail')) + .mockRejectedValueOnce(new Error('synthetic private initial reload detail')); + const initial = renderProfile(); + + const initialAlert = await screen.findByRole('alert'); + expect(initialAlert).toHaveTextContent( + 'We could not load your profile photo and officer finder settings. Reload settings to try again.', + ); + expect(initialAlert).not.toHaveTextContent('No setting was changed'); + expect(initialAlert).not.toHaveTextContent('could not confirm that change'); + expect(createMemberDirectoryRequestId).not.toHaveBeenCalled(); + expect(setMyMemberDirectoryVisibility).not.toHaveBeenCalled(); + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(2)); + const initialReloadAlert = await screen.findByRole('alert'); + expect(initialReloadAlert).toHaveTextContent( + 'We could not load your profile photo and officer finder settings. Reload settings to try again.', + ); + expect(initialReloadAlert).not.toHaveTextContent('No setting was changed'); + expect(initialReloadAlert).not.toHaveTextContent(unknownChangeMessage); + initial.unmount(); + + jest.clearAllMocks(); + (createMemberDirectoryRequestId as jest.Mock).mockReturnValue(REQUEST_ID); + const rejected = { code: 'functions/failed-precondition' }; + (setMyMemberDirectoryVisibility as jest.Mock).mockRejectedValueOnce(rejected); + (isDefinitiveMemberDirectoryRejection as jest.Mock).mockImplementation( + (error) => error === rejected, + ); + (getMyMemberDirectoryProfile as jest.Mock) + .mockResolvedValueOnce(DEFAULT_PROFILE) + .mockRejectedValueOnce(new Error('synthetic private confirming detail')) + .mockRejectedValueOnce(new Error('synthetic private reload detail')); + renderProfile(); + fireEvent.click(await screen.findByRole('checkbox')); + + const rejectionAlert = await screen.findByRole('alert'); + expect(rejectionAlert).toHaveTextContent( + 'We could not load your profile photo and officer finder settings. Reload settings to try again.', + ); + expect(rejectionAlert).not.toHaveTextContent(unknownChangeMessage); + fireEvent.click(screen.getByRole('button', { name: 'Reload settings' })); + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(3)); + expect(await screen.findByRole('alert')).not.toHaveTextContent(unknownChangeMessage); + expect(setMyMemberDirectoryVisibility).toHaveBeenCalledTimes(1); + expect(createMemberDirectoryRequestId).toHaveBeenCalledTimes(1); + expect(document.body).not.toHaveTextContent('synthetic private'); + }); + + test.each([ + ['application', otherApp, 'synthetic-user'], + ['account', app, 'other-synthetic-user'], + ])('does not carry uncertainty or a late reload into a new %s context', async (_label, nextApp, nextUid) => { + const oldReload = deferred(); + (setMyMemberDirectoryVisibility as jest.Mock) + .mockRejectedValueOnce(new Error('synthetic private outcome detail')); + (getMyMemberDirectoryProfile as jest.Mock) + .mockResolvedValueOnce(DEFAULT_PROFILE) + .mockReturnValueOnce(oldReload.promise) + .mockRejectedValueOnce(new Error('synthetic private current load detail')); + const view = renderProfile(); + fireEvent.click(await screen.findByRole('checkbox')); + fireEvent.click(await screen.findByRole('button', { name: 'Reload settings' })); + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(2)); + + view.rerender( + , + ); + + await waitFor(() => expect(getMyMemberDirectoryProfile).toHaveBeenCalledTimes(3)); + const currentAlert = await screen.findByRole('alert'); + expect(currentAlert).toHaveTextContent( + 'We could not load your profile photo and officer finder settings. Reload settings to try again.', + ); + expect(currentAlert).not.toHaveTextContent(unknownChangeMessage); + await act(async () => oldReload.reject(new Error('synthetic private late reload detail'))); + expect(screen.getByRole('alert')).not.toHaveTextContent(unknownChangeMessage); + expect(screen.queryByRole('checkbox')).not.toBeInTheDocument(); + expect(createMemberDirectoryRequestId).toHaveBeenCalledTimes(1); + expect(setMyMemberDirectoryVisibility).toHaveBeenCalledTimes(1); + expect(document.body).not.toHaveTextContent('synthetic private'); + }); + }); + test('reloads settings before allowing a retry after an unknown outcome', async () => { const current = { ...DEFAULT_PROFILE, revision: 1, searchableByOfficers: true }; (getMyMemberDirectoryProfile as jest.Mock) diff --git a/src/pages/account/MemberDirectoryProfile.tsx b/src/pages/account/MemberDirectoryProfile.tsx index 29650e4..3871950 100644 --- a/src/pages/account/MemberDirectoryProfile.tsx +++ b/src/pages/account/MemberDirectoryProfile.tsx @@ -18,7 +18,7 @@ const MAX_DISPLAY_NAME_CODE_UNITS = 200; const MIN_CANONICAL_DISPLAY_NAME_CODE_UNITS = 2; const CONTROL_OR_FORMAT_PATTERN = /[\p{Cc}\p{Cf}]/u; const DIRECTORY_TOKEN_PATTERN = /[\p{L}\p{N}][\p{L}\p{M}\p{N}]*/gu; -const LOAD_FAILURE_MESSAGE = 'We could not load your profile photo and officer finder settings. No setting was changed. Reload settings to try again.'; +const LOAD_FAILURE_MESSAGE = 'We could not load your profile photo and officer finder settings. Reload settings to try again.'; const UNKNOWN_CHANGE_MESSAGE = 'We could not confirm that change. Do not make another change yet. Reload settings to check what is currently saved.'; const REJECTED_CHANGE_MESSAGE = 'That change was rejected before it was saved. Review the requirements and try again.'; const REQUEST_UNAVAILABLE_MESSAGE = 'This browser could not safely start that change. No setting was changed. Reload the page and try again.'; @@ -319,6 +319,7 @@ function MemberDirectoryProfileAttempt({ const lifetimeRef = useRef(null); const loadRef = useRef(null); const mutationRef = useRef(null); + const uncertainChangeRef = useRef(false); const photoReadRef = useRef(null); const photoInputRef = useRef(null); const removePhotoButtonRef = useRef(null); @@ -332,6 +333,7 @@ function MemberDirectoryProfileAttempt({ if (lifetimeRef.current === lifetime) lifetimeRef.current = null; loadRef.current = null; mutationRef.current = null; + uncertainChangeRef.current = false; photoReadRef.current = null; postMutationFocusRef.current = null; }; @@ -363,6 +365,7 @@ function MemberDirectoryProfileAttempt({ useEffect(() => { const lifetime = lifetimeRef.current; const load = Symbol('member-directory-load'); + const preserveUncertainChange = uncertainChangeRef.current; let active = true; loadRef.current = load; mutationRef.current = null; @@ -381,6 +384,7 @@ function MemberDirectoryProfileAttempt({ || lifetimeRef.current !== lifetime || loadRef.current !== load ) return; + uncertainChangeRef.current = false; setState({ phase: 'ready', profile, confirmation: null }); } catch { if ( @@ -389,7 +393,9 @@ function MemberDirectoryProfileAttempt({ || lifetimeRef.current !== lifetime || loadRef.current !== load ) return; - setState({ phase: 'unavailable' }); + setState({ + phase: preserveUncertainChange ? 'unknown' : 'unavailable', + }); } } @@ -440,6 +446,7 @@ function MemberDirectoryProfileAttempt({ const profile = await getMyMemberDirectoryProfile(app); if (!mutationIsCurrent(start)) return; mutationRef.current = null; + uncertainChangeRef.current = false; setState({ phase: 'ready', profile, confirmation: null }); setActionError({ control: start.action === 'upload' ? 'file' : start.action, @@ -460,6 +467,7 @@ function MemberDirectoryProfileAttempt({ photoReadRef.current = null; setPhotoDraft(null); setActionError(null); + uncertainChangeRef.current = true; setState({ phase: 'unknown' }); return; } @@ -476,6 +484,7 @@ function MemberDirectoryProfileAttempt({ } else if (start.action === 'remove') { postMutationFocusRef.current = 'remove-result'; } + uncertainChangeRef.current = false; setState({ phase: 'ready', profile, confirmation: confirmation(profile) }); } catch { if (!mutationIsCurrent(start)) return; @@ -483,6 +492,7 @@ function MemberDirectoryProfileAttempt({ photoReadRef.current = null; setPhotoDraft(null); setActionError(null); + uncertainChangeRef.current = true; setState({ phase: 'unknown' }); } }