[daliu]

Outcome

Adds a truthful frontend-only preview for the optional profile photo, independent People finder choice, and officer People finder while keeping every directory backend path unavailable by default.

• My Account shows a neutral photo placeholder plus natively disabled photo and finder controls.
• /admin/member-directory remains behind AdminGuard and shows a disabled name field and Search button.
• One source-controlled constant defaults false; it is UI routing only, never authorization.
• Default branches do not read files or directory state, create directory request IDs, initialize directory services, search, upload, save, or render people/results.
• Connected MEMBERS-DIRECTORY-001A — Add private profile thumbnail and opt-in preference #505/MEMBERS-DIRECTORY-001B — Add bounded officer name search and photo gallery #506 source remains preserved behind an explicit test seam for later MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 backend-first release work.
• No photo query, facial recognition, image matching, embedding, similarity, or biometric behavior is added.

Closes #621.

Safety boundary

Invariant: a frontend preview must not imply saved consent or accept private input before the backend/privacy/release gates exist.

Failure behavior: controls stay disabled and visibly described. Missing display name adds future-prerequisite copy but never enables the choice. The officer route retains its ordinary authentication/role guard but obtains no member-directory service context in preview mode.

Migration impact: none. No schema, Rules, index, Function, provider, data, environment, dependency, or workflow change. #507 still owns privacy approval, scoped authorization, isolated staging, backend/index deployment and readback, projection repair/backfill proof, and the later reviewed availability flip.

Verification

• npm run lint:ci — 120 files; unchanged 113 reviewed legacy errors / 6 warnings
• Full frontend Jest — 18 suites, 1,057 tests passed
• Functions lint — passed
• Functions Jest — 69 suites, 7,569 tests passed; 2 suites / 64 tests intentionally skipped
• Firestore Rules with demo-only local emulator — 5 suites, 418 tests passed
• Repository workflow/artifact/SPA/dependency Node tests — 105 tests passed
• Diagnostic production build — compiled successfully
• git diff --check — passed
• Synthetic local browser QA at desktop and 320 px — Account document 320/320 and panel 254/254; admin document 320/320; no horizontal overflow; directory controls disabled; no directory callable; no console warning/error
• Three independent frontend, operations, and security/privacy reviews — GO, no remaining findings
• Dependency review — no manifest or lockfile changed

Only synthetic local Auth/Firestore/Functions emulators were used for protected-layout QA. No production sign-in, real name/photo, production data, or provider action was used.

Officer impact

Officer impact: Officers can review an inert People finder layout and its future privacy boundaries in synthetic local evidence. They cannot search a name, view a person, or use the directory.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, and docs/officers/EVENTS_SHOP_MEMBERS.md; matching architecture/security/implementation/operations current-truth sections are also updated.

Deployment evidence: Website — not yet published by this pull request; production remained on the known-good bounded #473 Netlify deploy during the pre-PR audit. Firebase — unchanged and not deployed. Outside providers and production data — unchanged. Connected behavior and live directory — not performed and remain NOT AVAILABLE YET.

Exact candidate

• Base: 3cf3e5bfc3ee13b084edb6efb8eff6bb21b907c5
• Head: 1c9f463bfe72b189d5f64e38643f45a5d73ab29f
• Tree: e403c15f6588ea9ed4ecb5cb958b33ce4e6c4768
• Binary diff SHA-256: daba9d6e4e2942617f6d21036ddf3cb23f1cbad2c157b7398551b31a2bfe8c46

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	1c9f463
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7df6fdbb12ce00097329c6
😎 Deploy Preview	https://deploy-preview-622--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Final review on exact head 1c9f463bfe72b189d5f64e38643f45a5d73ab29f: GO.

• Independent frontend review: GO; neutral placeholder, hook routing, accessibility, disabled controls, CSS, mobile containment, and lint accounting verified.
• Independent operations/backup-officer review: GO; protected-layout evidence is synthetic-only and public readback is limited to exact revision, signed-out guards, and no public directory request.
• Independent security/privacy review: GO; source default is hard false, default branches perform zero directory calls, AdminGuard remains, and no PII/sample/biometric path is introduced.
• Hosted PR CI 31723120207: all five jobs passed.
• Netlify preview 6a7df6fdbb12ce00097329c6: ready, exact commit, preview context, no Netlify or edge Functions; its asset manifest is byte-identical to the locally verified production build (b1d0cebc8ad828883c23c334e12d2a4194593c7411c8e3f3880fa455ca085cdf).
• Dependency review: no manifest or lockfile changes.
• Scope review: no Firebase Rules/index/Functions/deployment/provider/data/workflow change and no OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 hunk overlap.

The repository requires a GitHub-account review that the author cannot submit. Under the user's explicit authorization to review and merge, the three independent reviews above and exact green gates support an administrator squash merge. The claim stays active through exact-main CI and deployment/readback audit.