MEMBERS-DIRECTORY-001N — Preserve deliberate focus during confirmed photo changes

[daliu]

Closes #645.

Officer impact: No live officer workflow changes. In the preserved future My Account interface, a confirmed profile-photo Save or removal returns keyboard focus only when that exact focused initiating control was displaced; another connected control deliberately focused while the mutation or authoritative readback is pending keeps focus.

Officer documentation: Updated SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory text alternative plus the no-terminal MEMBERS-DIRECTORY-001N evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. No Mermaid change; page topology, permissions, and data movement are unchanged.

Deployment evidence: Source and synthetic tests only. The exact six-file candidate is commit 4a855575eb071a4ec9f605a5b3aa2bfbfbecd050, tree 292cc0cd87e3246d1b2976a15f2d48bc7b3dce93, with binary diff SHA-256 1419b9bd720e876465c0e63c5d0110f8109b2ce7a84d166747202be2c09f939a. Local verification passed: named tests 20/20, full profile 131/131, full frontend 1,216/1,216, TypeScript, lint baseline, repository Node tests 105/105, diagnostic build, and diff-check. Exact-head CI run 31761641385 passed all five jobs. Netlify deploy preview 6a7e73629a8f58000829005f is ready on the exact head, remains unpublished, passed header and redirect checks, changed no Pages-owned files, and deployed no Netlify or Edge Functions. memberDirectoryAvailability.ts remains literal false; no website, Firebase, provider, account/sign-in, production-data, or connected-live action is authorized or claimed. Live #623 remains inert, and #507 retains all connection and release gates.

The patch:

• captures a confirmed-photo intent only after request-ID creation, admitted upload/removal, and exact initiating Save/Remove focus;
• binds pending/result ownership to the mounted lifetime, exact operation, and action;
• transfers only after confirmed mutation success plus current authoritative readback;
• preserves upload and removal destination priority while restoring only from absent/body/document-root/disconnected focus;
• consumes the result once and preserves any other connected focus; and
• adds no request ID, callable, retry, mutation, photo bytes, data URL, provider action, or data action.

Independent focus/race, security/privacy, frontend/accessibility, and backup-officer/operations reviews all reported GO with no findings. Exact candidate evidence: #645 (comment)

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	4a85557
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7e73629a8f58000829005f
😎 Deploy Preview	https://deploy-preview-646--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.