AUTH-006G — Announce a confirmed profile-name save and preserve focus #651

Foundation: #531 / PR #534. Conceptual profile parent: #118.

Officer impact: No live workflow change is claimed at issue creation. In the reviewed My Account source, a member who completes a confirmed full-name Save will see one plain result and will not be stranded when the Save control disappears.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the existing My Account profile-name Mermaid, matching one-sentence text alternative, and one no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md.

Deployment evidence: None at issue creation. This is a source-only interface correction. No website publication, Firebase deployment, provider configuration, account/sign-in action, production-data action, or live behavior is authorized or claimed.

Atomic outcome

After one exact current full-name update and its successful non-null authoritative profile reread, show the fixed result Profile name saved. and restore otherwise-lost focus to that result only when the admitted Save control owned focus.

Defect

On exact released main 4f11ddd1f87cf10d40a620c1d32389276b8073f6, handleSave correctly waits for the update and a current authoritative reread, then collapses the editor. The focused Save button disappears, the page renders no success result, and keyboard or screen-reader focus can fall to the document body. The current attempt/app/Firestore/identity/UID/generation fences are strong and must remain compatible.

Invariants and transitions

• Validation, the synchronous one-attempt gate, write payload, captured context, authoritative reread, and current-attempt checks remain unchanged.
• A success result appears only after the exact current update completes and the exact current authoritative reread returns a non-null profile.
• The exact fixed result is Profile name saved.; it contains no name, email, UID, revision, provider detail, or caught value.
• The result uses role="status", aria-live="polite", aria-atomic="true", and tabIndex={-1}.
• The Profile header DOM order is heading, result, Edit. Scoped layout keeps the existing heading/Edit presentation while the result occupies the next row, so Tab from the focused result reaches Edit.
• A focus intent is armed only after validation and exact save admission, and only when the rendered Save control owns focus.
• The intent contains only the current opaque generation and attempt ID.
• Exact current confirmed success transfers the intent. A post-render effect consumes it before every target check.
• Focus is restored only from null, document body, document root, or a disconnected element. An already-focused result is left alone, and every other connected focused element is preserved.
• A programmatic or unfocused valid Save still shows the truthful result but never moves focus.
• Initial/background profile loads never show or focus the result.
• Validation failure, update rejection, missing or rejected confirmation read, unavailable recovery, context/resource/UID/identity change, A-to-unavailable-to-A generation change, a newer attempt, stale completion, and unmount cannot show or focus a stale result.
• Edit, a new admitted Save, profile reload, and context change clear the prior result and any obsolete focus intent.
• Focus and feedback add no read, write, request, retry, provider call, data URL, log, or stored value.
• Existing unconfirmed-change copy and recovery remain unchanged. Failure/retry focus is a separate outcome.

Exact ownership

• src/pages/account/Account.tsx: only confirmed-save result state/refs, exact focus intent transfer/consume, Profile-header markup/classes, and result clearing.
• src/pages/account/Account.test.tsx: one separately named AUTH-006G profile-save success feedback and focus block plus minimum directly affected assertions.
• src/pages/account/Account.css: only scoped Profile-header/result layout and programmatic-focus styling.
• SYSTEM_DESIGN.md: one separately named AUTH-006G source-only paragraph.
• IMPLEMENTATION_PLAN.md: one separately named AUTH-006G current-source paragraph.
• SECURITY.md: one separately named AUTH-006G/RISK-039 row, disjoint from active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024.
• docs/officers/EVENTS_SHOP_MEMBERS.md: only the existing My Account profile-name Mermaid, its one-sentence text alternative, and one separately named no-terminal AUTH-006G source-evidence procedure.

Required RED and GREEN evidence

• Capture trustworthy RED on unchanged runtime: focus Save, admit a deferred valid save, model disabled-control focus eviction, settle update plus authoritative reread, and prove the old page has neither the fixed result nor a focus destination.
• Prove exact copy, status/polite/atomic/tabIndex semantics, DOM-before-Edit order, visible scoped focus rule, and 320px containment.
• Prove the authoritative reread value reaches the summary and existing directory displayName prop with exactly one update and one confirmation read.
• Cover otherwise-lost null/body/document-root/disconnected restoration, already-focused no-redundant-focus behavior, and one-shot consumption.
• Preserve connected outside and connected in-Profile focus through settlement.
• Prove an unfocused/programmatic save shows the result without moving focus, including removing its outside origin before settlement and proving no delayed focus.
• Prove initial load, validation failure, update rejection, null reread, rejected reread, app-only, Firestore-only, identity-only, UID-only, unavailable/same-context generation, stale/newer attempt, and unmount paths cannot show or focus stale success.
• Preserve rapid-repeat counts, AUTH-006F privacy fences, existing generic errors, and default directory availability false.
• Bound CSS assertions to the exact rule block so removing the focus declarations fails the test.
• Run focused Account, full frontend, repository Node, TypeScript, scoped ESLint, unchanged lint baseline, diagnostic build, workflow/security tests, and diff check; obtain independent frontend/accessibility, security/privacy/race, and officer/operations reviews.

Explicit exclusions

• Unconfirmed-save retry focus.
• Validation aria-invalid or error association.
• Edit-to-input and Cancel-to-Edit focus.
• Directory component/service/runtime/tests/availability behavior.
• Account service, profile payload/validation semantics, Functions, Rules, schema, indexes, packages, workflows, provider configuration, Firebase deployment, accounts, sign-in, production data, publication, or live action.
• Membership, dues, role, payment, entitlement, roster, facial recognition, matching, embeddings, similarity, biometrics, or photo query.
• Active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named OAUTH-001A2L/RISK-024 hunk.

Migration and residual risk

No migration. This result proves only that the browser received the current authoritative profile after its update. It does not prove provider deployment, production availability, identity ownership beyond existing authentication, membership, dues, directory eligibility, or live behavior. The unconfirmed failure path and Edit/Cancel/validation focus gaps remain separate follow-ups.

Coordination

• Released AUTH-006F — Make My Account profile saves one-attempt and context-safe #531/AUTH-006F: fence My Account profile saves by current context #534 supplies the exact account-context and one-attempt fences.
• MEMBERS-DIRECTORY-001 — Add a private opt-in officer photo directory #504 coordinates the optional directory; this slice does not edit directory behavior.
• MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 retains every directory privacy/capability/staging/backend-first/release gate.
• OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 owns only both Strava Function files and its separate SECURITY hunk; those are immutable.
• Pre-claim notices were posted before issue creation. No open PR or exact profile-save-focus claim was found.

Claim protocol

Creation is not a claim. Before editing, create a unique branch/worktree from exact current main, assign this issue, post and re-read a timestamped CLAIMED by /root at <UTC>; branch <branch>; base <SHA>; exact seven paths, and change status:ready to status:in-progress. The claim remains active through reviewed merge, exact-main/provider audit, closure, and explicit release.