WEB-SUGGESTIONS-001A — Add a static Suggestions page with no page-level intake #618

Outcome

Add a simple public /suggestions information page that helps members and community visitors share short ideas through the club's existing Contact page.

This first slice adds no Suggestions form or suggestion-content submission. It adds no text field, upload, Firebase write, Google Form, suggestion-specific analytics or service call, public idea feed, voting, or new outside provider. The linked Contact page is a separate existing email channel and may retain the sender's address and message.

Current claim

#617 is COMPLETE/CLOSED/CLAIM RELEASED after independent readback proved that the exact bounded #473 artifact is production again. /root claimed this source-only slice at 2026-08-13T05:32:50Z from exact main 3af585077d665d7720b35b5b89505b1d90d9a007. The amended claim owns only the 16 paths/hunks below and does not authorize website publication.

Why this matters

The website has a general Contact page, but no clear place for someone who has an idea about club runs, events, communications, accessibility, or the website. A short Suggestions page makes that purpose easy to find while keeping the first version small enough for officers to understand and operate.

The club has not approved a data-retention, moderation, spam, access, or response workflow for a new Suggestions form. Reusing the existing Contact page avoids inventing a new intake store or provider.

Plain-language behavior

1. A visitor opens /suggestions.
2. The page explains the kinds of short ideas the club welcomes.
3. The page says not to include passwords, private codes, payment details, private member information, health information, emergency-contact information, or vulnerability evidence.
4. The page states that it contains no Suggestions form and makes no suggestion-specific service call.
5. One internal link opens the existing /contact page.
6. The page explains that sending a Contact message uses the existing email channel, where the message and sender address may be retained.
7. The page does not promise anonymity, confidentiality, a reply, or implementation.
8. For a security or privacy concern, the page summarizes the current first-contact boundary: use Contact, label the message security report, ask for a secure reply, and keep secrets, private records, payment references, and exploit details out of an ordinary suggestion.

Exact source scope

Sixteen paths only:

• New src/pages/suggestions/Suggestions.jsx: one accessible page, normal SEO title/description/canonical /suggestions, safety wording, and internal Contact link.
• New src/pages/suggestions/suggestions.css: narrow responsive content/CTA styles with a visible :focus-visible state.
• src/App.jsx: add only the /suggestions route/import.
• src/components/Footer.jsx: add only the Suggestions link. Keep the already crowded primary navigation unchanged.
• src/App.test.jsx: one separately named WEB-SUGGESTIONS-001A actual-route/footer/SEO/no-form block.
• public/index.html: add only react-helmet-async ownership markers to the existing title, description, keywords, Open Graph, Twitter, and canonical fallback tags so a rendered route replaces rather than duplicates them; all values and every other tag remain unchanged.
• scripts/generate-sitemap.js: add only /suggestions to STATIC_PAGES.
• public/sitemap.xml: add exactly one checked-in /suggestions entry while preserving every existing entry and lastmod value byte-for-byte.
• tests/test-artifact-safety.test.js: one separately named sitemap-generator fixture/assertion proving exactly one Suggestions URL without unrelated generated-date churn.
• .github/lint-baseline.json: only the generated scan-file count, .jsx count, Suggestions clean-file entry if emitted, and derived fingerprint.
• tests/ci-workflow.test.js: only EXPECTED_LINT_FILES (expected 118 to 119 if the new page is clean).
• docs/CONTENT_GUIDE.md: identify the page source, approved copy boundary, and existing Contact-channel distinction.
• docs/officers/SYSTEM_MAPS.md: add the public page and its internal Contact-only flow to the Mermaid map and one-sentence text alternative.
• docs/officers/UPDATE_PUBLIC_CONTENT.md: one separately named no-form Suggestions source/preview procedure with purpose, approver, prerequisites, one-action steps, expected result, stop conditions, proof, undo, and escalation.
• SECURITY.md: only the existing RISK-035 lint-inventory sentence and matching source-ledger sentence, updating 118 files / 34 JSX to 119 files / 35 JSX while preserving 113 errors / 6 warnings.
• OPERATIONS_RUNBOOK.md: only the existing frontend-lint inventory paragraph with the same derived count update.

Preserve docs/officers/EVENTS_SHOP_MEMBERS.md byte-for-byte.

Required tests

• Direct navigation renders one accessible Suggestions heading.
• A realistic static-shell render exposes exactly one expected title, description, canonical /suggestions URL, Open Graph URL, and Twitter URL.
• The page exposes one internal Contact link and no external form URL.
• No form, textbox, upload, submit control, suggestion-specific analytics hook, or page-specific service call is introduced.
• Safety wording covers credentials/codes, payment details, private member information, health information, emergency contacts, and vulnerability evidence without echoing example secrets or personal data.
• The Contact-channel disclosure does not promise anonymity, confidentiality, reply, or implementation.
• The footer exposes the Suggestions route; the primary Navbar is unchanged.
• The checked-in sitemap and generator each include exactly one /suggestions static entry.
• Sitemap work preserves every unrelated checked-in URL/date byte-for-byte.
• The lint ledger remains truthful at 119 scanned files / 113 errors / 6 warnings if direct ESLint confirms the new page is clean.
• Existing route, footer, lint, build, SPA, workflow, and repository-safety tests remain green.

Explicit exclusions

• Native form, Firebase Function, Firestore collection/Rules/index, email Function, Google Form, Sheets, Drive, Slack, voting, comments, attachments, moderation dashboard, or notification.
• Any new suggestion-specific collection of name, email, phone, UID, IP address, user agent, analytics, or suggestion content. Ordinary host/network behavior remains unchanged and unverified.
• New mailbox address or direct mailto: link; reuse the existing Contact page.
• Primary Navbar or src/data.jsx changes.
• Privacy/Terms policy decisions, retention/deletion/export decisions, legal promises, intellectual-property terms, response-time promises, or provider configuration.
• Packages, lockfiles, workflows, deployment, production data, or live publication.
• A claim that OPS-SEC-001 — Establish private security/privacy reporting and rehearse incident response #112 has established a dedicated incident channel; only mirror the current temporary SECURITY instructions.
• Active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616, coordinating parent MEMBERS-DIRECTORY-001 — Add a private opt-in officer photo directory #504, and draft PR Rollback: prepare exact pre-header Netlify artifact #462 paths/hunks.

Future form dependency

Any later native form or outside-provider link requires a separate issue after:

• DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 approves purpose, fields, access, vendor, retention, deletion, backup, and export handling;
• OPS-SEC-001 — Establish private security/privacy reporting and rehearse incident response #112 establishes a separate monitored security/privacy reporting path;
• named communications and backup officers own triage and account recovery;
• the club chooses public versus verified-member access and a spam/abuse model;
• the public privacy notice truthfully describes the new collection.

Acceptance evidence

• Exact source diff and synthetic tests.
• Independent accessibility, privacy/no-page-intake, and backup-officer reviews.
• Hosted pull-request CI and exact-main CI.
• Separate evidence for source changed, tests passed, merged, website published, and runmprc.com verified.

Officer impact: Visitors gain a clearer path for short ideas. Any email still uses the existing Contact mailbox. This slice assigns no mailbox owner, response deadline, or moderation duty and creates no new Suggestions dashboard, mailbox, provider, form, or stored suggestion record. The officer procedure explains how to review the page and distinguish it from a real intake system.

Officer documentation: docs/CONTENT_GUIDE.md, docs/officers/SYSTEM_MAPS.md, and one separately named procedure in docs/officers/UPDATE_PUBLIC_CONTENT.md. docs/officers/EVENTS_SHOP_MEMBERS.md stays unchanged because this slice changes no event, shop, member, or payment process.

Deployment evidence: None at issue correction or claim. Source, tests, merge, website publication, and live verification remain separate; this issue authorizes no production publication.