MEMBERS-DIRECTORY-001D: add a safe frontend-only directory preview

.github/lint-baseline.json

@@ -10,11 +10,11 @@
   "targets": [
     "src"
   ],
-  "scannedFileCount": 119,
+  "scannedFileCount": 120,
   "scannedFilesByExtension": {
     ".js": 12,
     ".jsx": 35,
-    ".ts": 42,
+    ".ts": 43,
     ".tsx": 30
   },
   "errorCount": 113,
@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:bda71336dd9fbb242334c9aaf7f2be6d58bc55814540f730d90fe4809ec7e829",
+  "fingerprint": "sha256:b62532df877e1a1599273d0bdbf9876e75dae8be6e60ecadce601f854c283b6a",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -113,6 +113,7 @@
     "src/services/account/accountService.test.ts",
     "src/services/account/accountService.ts",
     "src/services/account/adminMembersService.ts",
+    "src/services/account/memberDirectoryAvailability.ts",
     "src/services/account/memberDirectorySearchService.test.ts",
     "src/services/account/memberDirectorySearchService.ts",
     "src/services/account/memberDirectoryService.test.ts",
@@ -247,9 +248,9 @@
     },
     {
       "file": "src/pages/admin/AdminHome.tsx",
-      "line": 196,
+      "line": 197,
       "column": 1,
-      "endLine": 196,
+      "endLine": 197,
       "endColumn": 114,
       "severity": 2,
       "ruleId": "max-len",

IMPLEMENTATION_PLAN.md

@@ -169,7 +169,7 @@ Exit gate:
 - Payment SLOs, structured redacted logs, and actionable alerts are live.
 - Backup restoration into isolated infrastructure succeeds and is documented.
 
-**Current optional-directory boundary:** Parent [#504](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/504) defines a private, opt-in officer people finder as name search with voluntary thumbnails—not facial recognition. MEMBERS-DIRECTORY-001A [#505](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/505) owns the signed-in person's server-only processed thumbnail and independent default-off preference. MEMBERS-DIRECTORY-001B [#506](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/506) adds source for the minimum server-only projection, current-state reconciler, bounded verified-admin name-prefix callable, query-free audit, and separate `/admin/member-directory` gallery. It returns at most 24 current opted-in display-name/optional-thumbnail cards and has no image query, facial recognition, cursor, total, export, or membership authority. [#507](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/507) still owns #110 policy completion, #133 protected authority, required backend/index deployment and readback, website publication, and live proof. Do not reuse the current browser-side full-account filter or describe #505/#506 source as an available directory.
+**Current optional-directory boundary:** Parent [#504](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/504) defines a private, opt-in officer people finder as name search with voluntary thumbnails—not facial recognition. MEMBERS-DIRECTORY-001A [#505](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/505) owns the signed-in person's server-only processed thumbnail and independent default-off preference. MEMBERS-DIRECTORY-001B [#506](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/506) adds source for the minimum server-only projection, current-state reconciler, bounded verified-admin name-prefix callable, query-free audit, and separate `/admin/member-directory` gallery. It returns at most 24 current opted-in display-name/optional-thumbnail cards and has no image query, facial recognition, cursor, total, export, or membership authority. MEMBERS-DIRECTORY-001D [#621](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/621) makes the shipped frontend boundary default unavailable: My Account and the guarded officer route show only visibly described, disabled layouts and perform zero directory reads, uploads, searches, saves, request-ID creation, or service calls. [#507](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/507) still owns #110 policy completion, scoped authorization, #133 protected authority, isolated staging, required backend/index deployment and readback, and a later separately reviewed source flip before connected website publication and live proof. Do not reuse the current browser-side full-account filter or describe a disabled preview or #505/#506 source as an available directory.
 
 ### Phase 5 — End-to-end qualification
 

OFFICER_START_HERE.md

@@ -48,6 +48,6 @@ Use the club's approved password manager for access. Share only a public link or
 
 As of **2026-08-01**, a merge runs checks but does not start the GitHub release. The protected release is **NOT AVAILABLE YET** until its short-lived cloud identity and named environment approvers are configured under issue #133. Ordinary Git-triggered Netlify production builds are paused. An overbroad #473 web artifact was published and immediately rolled back. The bounded replacement is now live as Netlify deploy `6a6dc9ea588b0c0008036312`: Shop is the static in-person catalog, while Events and Calendar show a fixed retry-later notice instead of a raw provider error. Event records are still unavailable because no Firebase repair was deployed. The temporary release manifest is inactive again. This does not change sign-in, expose protected event offers, add officer editing, or make commerce safe. GitHub Pages still reports `runmprc.com` as its custom domain even though Netlify serves that name; source removal is not provider proof. A green test or workflow does **not** by itself prove that GitHub Pages, `runmprc.com`, Firebase, or that domain setting changed.
 
-The optional profile photo and officer **People finder** are also **NOT AVAILABLE YET**. #505/#506 source keeps the choice off by default and limits the source-only officer page to explicit name search with voluntary thumbnails. It is not a membership roster and does not recognize faces. Do not open production Account/Admin pages, upload a real photo, search a real name, or treat a source merge or preview as live proof. Follow the source-only procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
+The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. Officers inspect those protected disabled layouts only in synthetic local artifacts. After publication, signed-out public review proves only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not choose a real photo, enter a real name, or treat the preview as a directory. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
 
 For the concise handbook, see [OFFICER_HANDBOOK.md](./OFFICER_HANDBOOK.md). The expanded task index is [docs/officers/README.md](./docs/officers/README.md).