MEMBERS-DIRECTORY-001O — Preserve visibility-toggle focus after authoritative settlement #647

Parent: #504. Connected release remains owned by #507.

Officer impact: No live officer workflow changes. In the preserved future My Account interface, a keyboard or screen-reader user who changes the officer-finder checkbox can return to that same checkbox after the current save and authoritative readback settle, instead of being stranded when the checkbox is disabled during loading. Any other connected control deliberately focused while the request is pending keeps focus. The connected interface remains unavailable on production.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and only the optional-directory one-sentence text alternative plus one no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. No Mermaid change is required because element structure, page topology, permissions, ownership, and data movement do not change.

Deployment evidence: None at issue creation. This is source-only keyboard-focus hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no website, Firebase, provider, account/sign-in, production-data, deployment, publication, or connected-live action is authorized.

Atomic outcome

Restore otherwise-lost focus to the exact officer-finder checkbox that owned focus when one current visibility mutation was admitted, after confirmed success or definitive rejection plus successful authoritative readback, without stealing any other connected focus.

Exact base

• Source: 0f421e6d1ffc454aa1de09d342d7b70d3fbd2388
• Tree: 292cc0cd87e3246d1b2976a15f2d48bc7b3dce93
• Availability blob: 295909b0df8dd7c54a0f164f99d4943656aece4b

Defect

The preserved connected Account branch disables the officer-finder checkbox during every pending visibility mutation. Browsers may evict focus when that focused native checkbox becomes disabled. Current settlement re-enables the checkbox and renders an authoritative result or fixed rejection, but records no focus destination; keyboard and screen-reader users can be left on the document body. Confirmed upload/removal and People-finder search already have bounded operation-owned focus handoffs, while visibility does not.

Invariants and transitions

• Capture a visibility focus intent only after request-ID creation and admitted startMutation('visibility'), and only when the exact rendered checkbox owns focus.
• Store only the mounted application/account lifetime and exact operation identity. Store no query, name, profile, revision, request ID, result, error, provider value, photo byte, or data URL.
• Keep the existing native pending disablement and duplicate-mutation gate unchanged.
• Transfer the intent only after that exact current operation reaches a guarded ready state through either:
  • confirmed mutation success plus successful authoritative readback; or
  • definitive rejection plus successful confirming readback.
• Consume the transferred intent once after the matching ready render.
• Use the same persistent officer-finder checkbox as the only destination.
• Leave the checkbox alone if it already owns focus.
• Restore only from absent focus, document.body, document.documentElement, or a disconnected element, and only when the checkbox is connected and enabled.
• Preserve any other connected outside or in-profile focus deliberately selected while pending.
• If current name eligibility makes the returned off checkbox disabled, consume the intent without focusing it.
• An outside-focused or programmatic checkbox invocation creates no intent and cannot steal focus later.
• Request-ID construction failure and rejected mutation admission never enter pending and remain focus-inert beyond natural browser behavior.
• Ordinary unknown outcomes and all post-mutation/confirming-read failures create no visibility result focus; they retain MEMBERS-DIRECTORY-001J — Preserve profile-recovery keyboard focus #637's Reload recovery and uncertainty truth.
• Application change, UID change, unmount, cleanup, a newer load, or stale completion clears or fails the lifetime/operation guards.
• Focus creates no request ID, read, mutation, retry, audit, result, draft, photo byte, data URL, provider action, or data action beyond the already admitted operation.
• Preserve MEMBERS-DIRECTORY-001M — Restore surviving photo-control focus after rejected removal #643 rejected-removal focus, MEMBERS-DIRECTORY-001N — Preserve deliberate focus during confirmed photo changes #645 confirmed-photo focus, MEMBERS-DIRECTORY-001J — Preserve profile-recovery keyboard focus #637 Reload recovery, current error association, exact revisions, and existing confirmation copy.
• Availability stays literal false; the default branch and live WEB-002C — Publish the bounded inert member-directory interface preview #623 preview remain inert and zero-call.
• This remains name-prefix search plus human visual comparison of voluntary thumbnails. Add no photo query, facial recognition, matching, embedding, similarity, biometric processing, total, export, roster authority, or membership proof.

Exact ownership

• src/pages/account/MemberDirectoryProfile.tsx
  • only an operation-bound focused-visibility pending/result intent, checkbox ref, cleanup/failure guards, and guarded ready-state focus handoff.
• src/pages/account/MemberDirectoryProfile.test.tsx
  • one separately named MEMBERS-DIRECTORY-001O block plus the minimum directly affected focus assertions/helpers.
• SYSTEM_DESIGN.md
  • one separately named 001O source-only paragraph.
• IMPLEMENTATION_PLAN.md
  • one separately named 001O current-source paragraph.
• SECURITY.md
  • one separately named 001O/RISK-042 row immediately after released 001N; preserve active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024 byte-for-byte.
• docs/officers/EVENTS_SHOP_MEMBERS.md
  • only the optional-directory one-sentence text alternative and one separately named no-terminal 001O source-evidence procedure; no Mermaid or unrelated procedure change.

No other path is in scope.

Trustworthy RED and required tests

• On unchanged runtime, focus the checkbox, admit a deferred visibility mutation, assert pending disablement, model native disabled-control focus eviction, settle authoritative readback, and prove focus is not restored.
• Matrix requested on, requested off, and changed-again authoritative results after confirmed mutation success.
• Definitive rejection plus successful confirming read restores lost focus and retains the fixed rejection alert/checkbox association.
• Already-retained checkbox focus causes no redundant .focus() call.
• Connected outside and in-profile focus deliberately selected while pending remains focused across both success and definitive rejection.
• Outside-focused/programmatic invocation creates no later focus handoff; remove/blur the outside node before settlement to prove no hidden intent was captured.
• Request-ID failure remains enabled, generic, zero-call, and focus-inert.
• Unknown outcome and post-mutation/confirming-read failure focus only Reload through existing recovery; never the checkbox.
• A name eligibility change that disables the returned checkbox consumes the intent without focusing it.
• Application change, UID change, unmount, stale mutation completion, and stale authoritative readback cannot move focus in another context.
• One-shot consumption cannot refocus on a later ready-state rerender.
• Preserve exact existing profile-read, request-ID, and visibility-call counts; create no upload/removal call, retry, draft, or data URL.
• Default unavailable rendering remains zero directory-service context, zero request ID, and zero directory call.
• Existing profile photo, result disposal, accessibility, mobile, stale-context, response-contract, and privacy tests remain green.

Then run the full component and frontend suites, TypeScript, scoped ESLint, unchanged lint baseline, repository Node/workflow/security tests, diagnostic build, and diff-check.

Explicit exclusions

• No Account.tsx, profile-name editor, Account CSS, photo selection/upload/removal behavior, successful-Reload behavior, People finder/admin route, client service, availability, or route wiring change.
• No Function, Rule, index, schema, repair/backfill, package/lockfile, workflow, release-control, or migration change.
• No privacy-notice approval, AUTH-003 capability design, role/MFA change, or MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 activation.
• No Firebase/provider configuration, deployment, publication, sign-in, account, production-data, real-name/photo, or live connected action.
• No change to either active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava file or its separately named OAUTH-001A2L/RISK-024 SECURITY hunk.

Migration and residual risk

No migration. Programmatic focus is an accessibility handoff, not authorization, provider acknowledgement, audit proof, mutation correctness, saved-state proof, or live evidence. Live #623 remains the inert preview, and #507 retains every privacy, authorization, staging, backend-first deployment/readback, availability-flip, publication, and live-proof gate.

Stop conditions

Stop if the diff leaves the six paths, changes availability, adds a read/mutation/retry, changes payloads/revisions/bytes, weakens #637/#643/#645, focuses a disabled checkbox, steals connected focus, lets a stale operation move focus, stores private/service values in an intent, changes CSS/Mermaid, overlaps #616, connects/deploys the backend, uses real data, or implies source/tests/preview are live.

Claim protocol

Assign the issue and post a timestamped CLAIMED marker naming the exact branch and released base before any source edit. The claim remains active through reviewed merge, exact-main/non-publication audit, closure, and explicit release.