MEMBERS-DIRECTORY-001P — Announce and focus a successful profile-settings reload #649

Parent: #504. Connected release remains owned by #507.

Officer impact: No live officer workflow changes. In the preserved future My Account interface, a keyboard or screen-reader user who activates Reload settings will receive a fixed successful-reload result before the restored controls, and otherwise-lost focus will move to that result without overriding a deliberate focus move elsewhere. The connected interface remains unavailable on production.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and only the optional-directory Mermaid, its matching one-sentence text alternative, plus one no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. The new successful-Reload result is a visible page-structure node; data movement, permissions, ownership, and deployment topology remain unchanged.

Deployment evidence: None at issue creation. This is source-only accessibility and recovery hardening. memberDirectoryAvailability.ts must remain byte-for-byte false; no website, Firebase, provider, account/sign-in, production-data, deployment, or connected-live action is authorized.

Atomic outcome

Announce an exact successful profile-settings Reload and restore otherwise-lost focus to that result only for the exact current Reload that owned focus.

Defect

On exact released main 161ebb8, Reload settings correctly keeps uncertain-change truth across failure and refocuses a replacement Reload after failure. On guarded success, however, the focused Reload disappears, the component returns to ready with no completion result, and existing regression coverage explicitly expects document.body to own focus. The user gets restored controls but no exact reload-completion announcement or logical keyboard location.

Invariants and transitions

• Every valid explicit current Reload that completes an authoritative profile read shows exactly “Profile photo and officer finder settings reloaded.”
• The result is the first child of the recovered ready-controls region, before photo and finder controls, so the next Tab enters the refreshed controls.
• The result uses role=status, aria-live=polite, aria-atomic=true, tabIndex=-1, and a scoped visible focus outline.
• The result proves only that the current authoritative profile read completed. It does not claim whether an earlier uncertain mutation succeeded, provider state changed, or connected production is live.
• A success-focus intent is created only when the exact rendered Reload button owns focus at one valid unknown/unavailable Reload invocation.
• The intent stores only component lifetime and exact load identity. It contains no UID, name, profile, revision, request ID, photo, query, result, error, or provider value.
• The pending intent binds to the exact new load symbol. Only that current guarded authoritative success may transfer it to the rendered result.
• The result focus effect consumes the exact intent before target checks, requires the target to be connected, avoids redundant focus, and restores only from null, document.body, document.documentElement, or a disconnected active element.
• Any connected focus chosen while Reload is pending, whether outside or inside the profile region, is preserved.
• A valid explicit programmatic or unfocused Reload may show the successful result, but it creates no focus intent and cannot move focus.
• Initial/background load success shows no Reload result and never moves focus.
• Reload failure shows no success result and retains released MEMBERS-DIRECTORY-001J — Preserve profile-recovery keyboard focus #637 replacement-Reload focus behavior and MEMBERS-DIRECTORY-001I — Preserve uncertain-change truth across failed reloads #635 uncertainty truth.
• A later rerender cannot consume an old result intent. Application change, UID change, unmount, a new load, and obsolete completions clear or fail the exact lifetime/load checks.
• The handoff creates no request ID, mutation, retry, extra profile read, data URL, provider call, audit record, or stored value.
• Existing upload/remove/visibility confirmations and MEMBERS-DIRECTORY-001M — Restore surviving photo-control focus after rejected removal #643/MEMBERS-DIRECTORY-001N — Preserve deliberate focus during confirmed photo changes #645/MEMBERS-DIRECTORY-001O — Preserve visibility-toggle focus after authoritative settlement #647 focus contracts remain unchanged.
• Availability stays false; the default route remains an inert zero-context, zero-ID, zero-call preview.
• This remains name-prefix search plus human visual comparison of voluntary thumbnails. No photo query, facial recognition, matching, embedding, similarity, biometric processing, total, export, roster authority, or membership proof.

Exact ownership

• src/pages/account/MemberDirectoryProfile.tsx
  • only the fixed top-of-ready-controls Reload result, dedicated pending/result exact-load focus intents and result ref, guarded success transfer, and cleanup/fences.
• src/pages/account/MemberDirectoryProfile.test.tsx
  • one separately named MEMBERS-DIRECTORY-001P block plus the minimum directly affected successful-Reload assertion.
• src/pages/account/Account.css
  • only the scoped visible focus treatment for the programmatically focused Reload result.
• SYSTEM_DESIGN.md
  • one separately named 001P source-only paragraph.
• IMPLEMENTATION_PLAN.md
  • one separately named 001P current-source paragraph.
• SECURITY.md
  • one separately named 001P/RISK-042 row immediately after released 001O; preserve active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024 byte-for-byte.
• docs/officers/EVENTS_SHOP_MEMBERS.md
  • only the matching optional-directory Mermaid, its one-sentence text alternative, and one separately named no-terminal 001P source-evidence procedure.

Required tests

• Capture trustworthy old-runtime RED by replacing the released body-focus expectation after an exact focused deferred successful Reload with the fixed result/focus contract.
• Verify the exact result copy, first-in-controls placement, status/live/atomic semantics, tabIndex, scoped class, and visible focus-style contract.
• Cover successful Reload from both generic unavailable and uncertain-change recovery states.
• Prove an initial/background success renders no result and steals no outside focus.
• Prove programmatic/unfocused Reload success renders the result but does not move focus, including after the outside origin is removed before settlement.
• Prove connected outside focus and connected in-profile focus moved during pending are preserved.
• Prove focused failed Reload still focuses the replacement Reload and renders no success result.
• Prove repeated failure followed by exact success focuses the result only on the successful exact load.
• Prove the result intent is one-shot and cannot refocus after a later same-context rerender.
• Prove old successful resolution after application change, UID change, or unmount is focus- and result-inert.
• Assert exact profile-read counts and zero request IDs, mutations, photo calls, retries, or draft restoration.
• Keep default unavailable preview zero-context, zero-ID, and zero-call.
• Run the focused profile suite, full frontend suite, TypeScript, scoped lint, unchanged lint baseline, diagnostic build, workflow/security tests, and diff check.

Explicit exclusions

• Account.tsx/test, admin finder runtime/tests, directory services/tests, availability file, AdminGuard, route wiring, upload/photo/visibility semantics, or copy outside the separately named docs hunks.
• Functions, Rules, indexes, schema, repair/backfill, packages, workflows, or release controls.
• Privacy-notice approval, AUTH-003 capability design, role/MFA changes, or MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 activation.
• Firebase/provider configuration, deployment, sign-in, accounts, production data, real names/photos, or live connected behavior.
• Both active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named SECURITY OAUTH-001A2L/RISK-024 hunk.

Migration and residual risk

No migration. Programmatic focus and a local completion status are accessibility feedback, not authorization, provider acknowledgement, mutation proof, data correctness, or live evidence. Live #623 remains the inert preview, and #507 retains every privacy, authorization, staging, backend-first deployment/readback, availability-flip, publication, and live-proof gate.

Claim protocol

Assign the issue and post a timestamped CLAIMED marker naming the exact branch, released base, tree, and seven-path ownership before any source edit. The claim remains active through reviewed merge, exact-main/deployment audit, closure, and explicit release.