WEB-002D: publish bounded keyboard-navigation and SPA-focus chain

[daliu]

Refs #659

Officer impact: Publishes one bounded accessibility-only website artifact after every gate passes. Keyboard users receive reviewed visible focus, deterministic and truthfully announced phone-menu closure, and a one-time focus move into destination main content after client-side path navigation. No officer duty, sign-in workflow, member-directory behavior, backend, or production data changes.

Officer documentation: SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, OPERATIONS_RUNBOOK.md, OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/UPDATE_PUBLIC_CONTENT.md contain the pending-only release boundary and a complete no-terminal procedure. Final live truth remains a separate post-publication change.

Deployment evidence: Exact-head CI run 31781730576 passed all five jobs. Netlify Deploy Preview 6a7ec998bf8fde00086d2bfe is ready at exact control head 137d8a8721339a6ca1079283cc34c1bd7cc2706c, review 660, branch codex/issue-659-netlify-release, context deploy-preview, and published_at:null; provider metadata reports no Netlify Functions and no edge functions. Header and redirect checks passed; Pages-changed was neutral as expected. The exact marker binds frozen source 7496fe0881fb52908c4ff2f40f488df09c94c908, tree ccac4c189c195db8ab594e0eefe256ea9fa04996, sole parent prior live source c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec, previous source c2d87d1f..., rollback deploy 6a7e072f8f346b0008510d29, 62 files, and digest e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7. Marker/root are HTTPS 200 with HSTS and noindex; the marker is also no-store and nosniff. Signed-out safe GET/HEAD checks for /, /shop, /events/calendar, /login, /account, /admin/member-directory, and SPA fallback returned 200/noindex without form, sign-in, or data actions. At 1280×900, a client-side Shop route change placed focus on main#main-content, retained scroll 0/0, and caused no horizontal overflow. At 390×844, the phone menu exposed aria-expanded=true and aria-controls=primary-navigation; activating Events closed it to aria-expanded=false/hide__nav, moved focus to main#main-content, retained scroll 0/0, and caused no horizontal overflow. The scoped cue geometry and two-tone styling are proven by mutation-sensitive tests and byte-exact served CSS/source maps; pointer-origin browser activation correctly did not claim a keyboard :focus-visible modality. PR #660 merged as exact two-parent commit 46e23647d8e0bf9fa3a574ea5c5f993be10a419d, tree 3ef47ed0f664e1e9a2c703332ca9071cfda27ad2; exact-main CI run 31783141914 passed all five jobs. Netlify production deploy 6a7ece87c5ca4d0007c1a3fc is ready and published from that merge with the exact marker and artifact; all 62 live files match digest e4c26e6f..., and signed-out desktop/phone checks passed again. Repause PR #661 merged as exact two-parent commit 3138a00c1c48e1d5d1dcda0b44722b09a2194ff7; exact-main CI run 31783808994 passed all five jobs, while Netlify attempt 6a7ed0ddb00a46000818878d remained unpublished and the published deploy/marker stayed unchanged. Final live-truth documentation remains pending and must be recorded separately. Firebase, Rules, Functions, indexes, providers, accounts/sign-in, production data, payments, DNS, and connected directory behavior are excluded and unchanged.

Exact control

• Head 137d8a8721339a6ca1079283cc34c1bd7cc2706c
• Tree 3ef47ed0f664e1e9a2c703332ca9071cfda27ad2
• Sole parent / required production first parent 95880748e15c03b0ee58da6e1ed11ac6c9526529
• Exact 11 paths; binary diff SHA-256 11bef16e7b2a46b4ba0d4d3e844bfca0654f6e438a42d73b59012122e6254290
• Release ID WEB-002D-KEYBOARD-FOCUS-2026-08-14
• Rollback source ref codex/netlify-source-659-rollback pinned to c2d87d1f...
• Pre-reviewed repause head 94c949abed3759c15cdaa98afc6896343e8a6edd, sole parent exact control head, exact three-file diff SHA-256 757f3c16a444d3c371c350a6a109aff24f3f166c9bbb56c2c45e8eb9bd05ad2c

Local verification

• Frozen focused projection tests: 35/35
• Frozen full frontend: 92/92
• Frozen SPA navigation: 10/10
• TypeScript, scoped ESLint, diagnostic production build: pass
• Active release workflow: 14/14
• Active root release/security/SPA subset: 105/105
• Pinned local release builder: exact 62 files / e4c26e6f...
• Repause release workflow: 14/14
• Repause root subset: 105/105
• Repause production/local authority: fails closed
• Diff checks, canonical manifest, secret scan, protected OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 hashes, and literal-false directory availability: pass

Publication gate

Merge only with a GitHub merge commit after exact-head CI, exact pinned preview marker/assets, signed-out 1280×900 and 390×844 focus/menu checks, no-directory-request proof, exact rollback ref, and the prepared repause all independently pass. Stop on any main advance or source/tree/path/count/digest/marker/behavior mismatch. Never squash, rebase, promote a preview, invoke a build hook or netlify deploy --prod, or dispatch the Firebase/GitHub Pages workflow.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	137d8a8
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7ec998bf8fde00086d2bfe
😎 Deploy Preview	https://deploy-preview-660--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.