MEMBERS-DIRECTORY-001M — Restore surviving photo-control focus after rejected removal

[daliu]

Closes #643.

Officer impact: No live officer workflow changes. In the preserved future My Account interface, a keyboard or screen-reader user whose focused Remove current saved photo action disappears after a definitive rejection and authoritative readback returns to the closest surviving photo action, without stealing focus the user deliberately moved elsewhere.

Officer documentation: Updated SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory text alternative plus the no-terminal MEMBERS-DIRECTORY-001M evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. No Mermaid change; page topology, permissions, and data movement are unchanged.

Deployment evidence: Source and synthetic tests only. The exact six-file candidate is commit 5ac46b43b7d2e18e338bb75d23106a851d6c7942, tree a07d391b8e23e28dd39785329be444f452fa2953, with binary diff SHA-256 0497c75100eddc38b7b3b38d7fd8403cb60d01b7bbad9a50bbb79472ec3d28b7. Local verification passed: named tests 15/15, full profile 111/111, full frontend 1,196/1,196, TypeScript, lint baseline, repository Node tests 105/105, diagnostic build, and diff-check. Exact-head CI run 31759493222 passed all five jobs. Netlify preview 6a7e69c973d2b40009a3e5a6 is ready for the exact head, remains unpublished (published_at:null), and deploys no Functions or Edge Functions; header and redirect checks passed and Pages-changed skipped as expected. memberDirectoryAvailability.ts remains literal false; no website, Firebase, provider, account/sign-in, production-data, or connected-live action is authorized or claimed. Live #623 remains inert, and #507 retains all connection and release gates.

The patch:

• binds a focused-Remove intent to the exact mounted lifetime and admitted mutation operation;
• transfers it only after a current definitive rejection and successful authoritative readback;
• targets surviving Remove, otherwise an exact ready Save action, otherwise the persistent file input;
• restores only from body, document-root, absent, or disconnected focus and preserves any other connected focus;
• keeps a vanished-Remove rejection as a standalone alert; and
• adds no request ID, callable, retry, mutation, photo bytes, data URL, provider action, or data action.

Independent focus/race, security/privacy, frontend/accessibility, and backup-officer/operations reviews all reported GO with no findings. Exact candidate evidence: #643 (comment)

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	5ac46b4
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7e69c973d2b40009a3e5a6
😎 Deploy Preview	https://deploy-preview-644--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.