From c8c15188c147e1b609b5c2b24552f60ebb153804 Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Mon, 14 Sep 2026 21:47:37 -0700 Subject: [PATCH] docs: record September meeting-location release truth --- IMPLEMENTATION_PLAN.md | 2 +- OFFICER_START_HERE.md | 2 +- OPERATIONS_RUNBOOK.md | 4 +- README.md | 2 + SECURITY.md | 2 +- SYSTEM_DESIGN.md | 17 ++- docs/officers/ACCESS_CONTINUITY.md | 14 +- docs/officers/EVENTS_SHOP_MEMBERS.md | 156 +++++++++++++--------- docs/officers/PUBLISH_AND_CHECK.md | 31 ++--- docs/officers/README.md | 6 +- docs/officers/REQUEST_A_CHANGE.md | 2 +- docs/officers/SYSTEM_MAPS.md | 4 +- docs/officers/UPDATE_PUBLIC_CONTENT.md | 8 +- tests/release-workflow.test.js | 174 ++++++++++++++++++------- 14 files changed, 271 insertions(+), 153 deletions(-) diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index af620d6..1877a4e 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -36,7 +36,7 @@ MPRC can open a race or merchandise item for sale only when the platform can: **WEB-002D completed release boundary:** [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one exact-artifact Netlify exception on 2026-08-14. Exact release merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` published deploy `6a7ece87c5ca4d0007c1a3fc` from source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, 62 files, and digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`. Signed-out desktop route-focus and phone menu/route-focus checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` passed exact-main CI run `31783808994`; attempt `6a7ed0ddb00a46000818878d` remained unpublished and retained the verified deploy. The manifest is inactive, the temporary source/control/repause refs are absent, and rollback ref `codex/netlify-source-659-rollback` remains pinned to #623 source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`. #659 published only the reviewed #291 visible-focus, #490 phone-menu, and #657 route-focus behavior. It deployed no Firebase, Rules, Functions, or indexes; changed no outside-provider configuration, account, sign-in state, production data, payment, or connected directory behavior; and left directory availability literal `false`. Reusable hosting remains open under #460/#133/#136, and #507 still owns every connected-directory gate. -**WEB-CONTENT-001 pending release boundary:** [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) arms one exact-artifact Netlify exception for the temporary Sept. 19 and Sept. 26 meeting-location banner. It is under review and is not published. Frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, and 62-file digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850` contain only the banner and its expiry tests on top of current live source `7496fe0881fb52908c4ff2f40f488df09c94c908`. Production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc` unless the exact-parent release, marker, phone/desktop checks, and immediate repause all succeed. No Firebase, provider, account, sign-in, private data, payment, route, or permission change is included. +**WEB-CONTENT-001 completed website release boundary:** [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed one exact-artifact Netlify publication of the temporary Sept. 19 and Sept. 26 meeting-location banner on 2026-09-14 Pacific time. [PR #686](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/686), head `f0c2d2378fd30b684ecb2fede447a184a414ab1c`, used preview `6aa8c3e0e5faba00080fd632` and passed all five jobs in PR CI run `34927419640`. Exact release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6`, parents `925a677cd807dad1f925b4a85e89fc317b7a38b7` and `f0c2d2378fd30b684ecb2fede447a184a414ab1c`, tree `0d7452a7a3c95c43a65784724aea56f0d214477f`, passed all five exact-main jobs in run `34927937346`. Netlify deploy `6aa8c5b3fddd040009eba99c` became ready and published at `2026-09-15T04:13:59.373Z`. Its marker and all 62 public files matched frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, previous source `7496fe0881fb52908c4ff2f40f488df09c94c908`, rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. Signed-out 390×844 and 1280×900 checks passed for exact notice text and safe map links, banner/page-heading visibility, and no horizontal overflow; no screenshot was retained. [Repause PR #687](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/687), head `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, used preview `6aa8c6b7e93356000806c950` and passed all five jobs in PR CI run `34928224571`. Exact repause merge `609d7884e0242abce23449562e7e0da04794da1e`, parents `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` and `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, passed all five exact-main jobs in run `34928449093`. Its Netlify attempt `6aa8c78dd7b9d1000952eaa2` errored before any build step, remained unpublished with `published_at` null, and retained #685 deploy `6aa8c5b3fddd040009eba99c`. The manifest is inactive. The temporary #685 source/control/repause refs are retired; rollback ref `codex/netlify-source-685-rollback` remains pinned to #659 source `7496fe0881fb52908c4ff2f40f488df09c94c908`. Both notices remain through Sept. 19, only Sept. 26 remains from Sept. 20 through Sept. 26, and the banner is absent from Sept. 27 Pacific time. Email was already sent on Sept. 12; the separate WhatsApp post remains pending the user's action-time confirmation, so issue #685 is not yet fully closed. The release changed no Firebase, GitHub Pages, DNS, provider configuration, account, sign-in state, private data, payment, route, permission, or reusable release authority. **Historical source-ref correction:** a 2026-09-14 remote read found the exact hot source refs for #473, #623, and #659 still present despite older absent/retired wording. Their manifests are inactive, so ordinary `main` merges remain paused, but an authorized manual rebuild of a historical active merge is a latent retry path. Do not treat that residual as resolved; retire those hot refs separately only after confirming their rollback refs. diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index 6a59bda..05d7fb1 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -51,7 +51,7 @@ As of **2026-08-13**, a merge runs checks but does not start the GitHub release. As of **2026-08-14**, [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only Netlify release. Deploy `6a7ece87c5ca4d0007c1a3fc` is live from frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`; its exact 62-file marker and signed-out desktop/phone route-focus and menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` made the manifest inactive. Its attempt `6a7ed0ddb00a46000818878d` published nothing and retained the verified deploy. #623 deploy `6a7e072f8f346b0008510d29` is the recorded rollback, not current production. #659 changed no Firebase, provider configuration, account, sign-in state, production data, payment, or connected directory behavior. Officers do not run commands, sign in, enter data, or approve this as a reusable release. Follow the completed record in [Review, merge, release, and check a change](./docs/officers/PUBLISH_AND_CHECK.md). -As of **2026-09-14**, [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is a temporary meeting-location notice under review and is not published. The reviewed banner gives the Sept. 19 Seal Point dog-park restroom pin and the Sept. 26 Baywinds Park meeting point, both at 8:45 AM, and removes each item after its Saturday in Pacific time. Production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc` until an exact frozen preview, exact-parent merge, public marker, phone/desktop readback, and immediate repause all pass. Officers do not run commands, sign in, enter data, or reuse this one-shot release control. +As of **2026-09-14 Pacific time**, [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) has published the temporary meeting-location notice as verified Netlify deploy `6aa8c5b3fddd040009eba99c` from frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. The banner gives the Sept. 19 Seal Point dog-park restroom pin and the Sept. 26 Baywinds Park meeting point, both at 8:45 AM. Both show through Sept. 19, only Sept. 26 shows from Sept. 20 through Sept. 26, and the banner is absent from Sept. 27 Pacific time. Its marker and all 62 files matched; signed-out 390×844 and 1280×900 text, map-link, visibility, and overflow checks passed without a retained screenshot. Repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five exact-main checks; attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null, retained the #685 deploy, and left the manifest inactive. #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are the immediate rollback; #623 is older history. The temporary #685 source/control/repause refs are retired. Email was already sent Sept. 12; WhatsApp remains pending the user's action-time confirmation, so the issue stays open. No Firebase, Pages, DNS, provider, account, data, payment, route, or permission changed. Officers do not run commands, sign in, enter data, or reuse this one-shot release control. Remote readback on 2026-09-14 found the old #473, #623, and #659 hot source refs still present; this supersedes older absent/retired wording. Their manifests are inactive and ordinary merges remain paused, but the latent manual-rebuild path is not yet retired. Officers do not remove refs; the platform owner must verify rollback refs before a separate cleanup. diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index 00d7248..3e81aac 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -741,9 +741,9 @@ WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) compl WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed its one-shot Netlify accessibility release on 2026-08-14. Release ID `WEB-002D-KEYBOARD-FOCUS-2026-08-14` used pinned Deploy Preview `6a7ec998bf8fde00086d2bfe`, matched release-control head `137d8a8721339a6ca1079283cc34c1bd7cc2706c`, and passed PR CI run `31781730576`. Exact two-parent release merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d`, parents `95880748e15c03b0ee58da6e1ed11ac6c9526529` and `137d8a8721339a6ca1079283cc34c1bd7cc2706c`, tree `3ef47ed0f664e1e9a2c703332ca9071cfda27ad2`, passed exact-main CI run `31783141914`. Netlify deploy `6a7ece87c5ca4d0007c1a3fc` became ready and published at `2026-08-14T08:16:09.268Z`. Its marker and all 62 artifact paths matched source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, previous source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, rollback deploy `6a7e072f8f346b0008510d29`, and digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`; the exact six-path live-source diff digest was `462eeb01e7a9858678802464f7dd4b76cd2fcb3c13be827efb4f98fa53ca809c`. Signed-out desktop `/shop` and phone `/events` checks passed: route changes left main focused at the top without horizontal overflow, and the phone menu exposed truthful open state before destination selection closed it and preserved normal route focus. Repause preview `6a7ecfbc90347c000804901c` matched head `94c949abed3759c15cdaa98afc6896343e8a6edd`, which passed PR CI run `31783487885`; exact repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7`, parents `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` and `94c949abed3759c15cdaa98afc6896343e8a6edd`, tree `c4667394dc9a2286c3a2eda028728314e925c22f`, passed all five exact-main jobs in run `31783808994`. Its attempt `6a7ed0ddb00a46000818878d` errored unpublished; provider and marker readback retained deploy `6a7ece87c5ca4d0007c1a3fc`. The manifest is inactive, the release/control/repause refs are absent, and rollback ref `codex/netlify-source-659-rollback` remains pinned to source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`. #659's frozen source differed from its predecessor only at `src/App.jsx`, `src/App.test.jsx`, `src/components/Navbar.jsx`, `src/components/ScrollToTop.jsx`, `src/headerClearance.test.jsx`, and `src/index.css`. It deployed no Firebase, Rules, Functions, or indexes; changed no outside-provider configuration, account, sign-in state, production data, content, route set, payment, or connected directory behavior; and left directory availability literal `false`. Follow the completed no-terminal audit record in `docs/officers/PUBLISH_AND_CHECK.md`; never use this exception as a general release button. -WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is one active Netlify content exception under review and is not published. Release ID `WEB-CONTENT-001-SEPTEMBER-LOCATIONS-2026-09-14` pins source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, 62 files, digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`, exact expected first parent `925a677cd807dad1f925b4a85e89fc317b7a38b7`, and current production/rollback deploy `6a7ece87c5ca4d0007c1a3fc`. The source differs from current live source `7496fe0881fb52908c4ff2f40f488df09c94c908` only in `src/components/AnnouncementBanner.jsx` and `src/components/AnnouncementBanner.test.jsx`. Before merge, require the pinned preview marker, public notice/map checks at 390×844 and 1280×900, all hosted checks, an unchanged `main`, and a prepared manifest-disable branch. Stop and rebuild the control if `main` advances or any identity differs. After a successful live marker/readback, merge the disable change immediately and verify its attempt publishes nothing. This exception changes no Firebase, provider configuration, account, sign-in state, private data, payment, route, permission, or reusable release authority. +WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed its website publication on 2026-09-14 Pacific time. Release ID `WEB-CONTENT-001-SEPTEMBER-LOCATIONS-2026-09-14` used [PR #686](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/686), preview `6aa8c3e0e5faba00080fd632`, release-control head `f0c2d2378fd30b684ecb2fede447a184a414ab1c`, and all five successful jobs in PR CI run `34927419640`. Exact two-parent release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6`, parents `925a677cd807dad1f925b4a85e89fc317b7a38b7` and `f0c2d2378fd30b684ecb2fede447a184a414ab1c`, tree `0d7452a7a3c95c43a65784724aea56f0d214477f`, passed all five exact-main jobs in run `34927937346`. Production deploy `6aa8c5b3fddd040009eba99c` became ready and published at `2026-09-15T04:13:59.373Z`. Its marker and all 62 served files matched source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, previous source `7496fe0881fb52908c4ff2f40f488df09c94c908`, rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. The source differs from #659 only at `src/components/AnnouncementBanner.jsx` and `src/components/AnnouncementBanner.test.jsx`. Signed-out checks at 390×844 and 1280×900 confirmed exact notice text, both safe map links, banner and page-heading visibility, and no horizontal overflow; no screenshot was retained. [Repause PR #687](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/687) used preview `6aa8c6b7e93356000806c950`, head `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, and all five successful jobs in PR CI run `34928224571`. Exact repause merge `609d7884e0242abce23449562e7e0da04794da1e`, parents `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` and `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, passed all five exact-main jobs in run `34928449093`. Its Netlify attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null; provider and marker readback retained deploy `6aa8c5b3fddd040009eba99c`. The manifest is inactive. The temporary #685 source/control/repause refs are retired, while rollback ref `codex/netlify-source-685-rollback` remains pinned to #659 source `7496fe0881fb52908c4ff2f40f488df09c94c908` and deploy `6a7ece87c5ca4d0007c1a3fc`; #623 is older history. The banner shows both notices through Sept. 19, only Sept. 26 from Sept. 20 through Sept. 26, and none from Sept. 27 Pacific time. Email was already sent Sept. 12; WhatsApp still awaits the user's action-time confirmation, so issue #685 remains open. This release changed no Firebase, GitHub Pages, DNS, provider configuration, account, sign-in state, private data, payment, route, permission, or reusable release authority. -Remote-ref correction recorded 2026-09-14: the exact hot source refs for #473, #623, and #659 remain present, superseding older absent/retired statements in this record. Inactive manifests block ordinary `main` publication, but an authorized manual rebuild of a historical active merge remains a latent retry path. Do not call the refs retired. Confirm each rollback ref, then use a separate approved cleanup before removing the corresponding hot ref. +Remote-ref correction recorded 2026-09-14: the old #473/#623/#659 hot source refs remain present, superseding older absent/retired statements in this record. Inactive manifests block ordinary `main` publication, but an authorized manual rebuild of a historical active merge remains a latent manual-rebuild path. Do not call those old refs retired. Confirm each rollback ref, then use a separate approved cleanup before removing the corresponding hot ref. Incident record: on 2026-08-01, overbroad source `094af1096ed8721597561cd59bf695d4c4a9d210` was published by merge `40728ff6141e34a279b70cc41d983c22ac5f0daa` as deploy `6a6dc0167fbe68000816b448` after a release-blocker comment. Exact rollback merge `1099ee8e6fdb81141fd9460de175b6d854cbcfdd` published deploy `6a6dc219a8136300081811db`, restoring source `ed1b0833`, tree `878c6628d961f4484cb49208aef53f1e9f2e3b47`, 60 files, and digest `7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092`. Safety merge `dee79511b6e371329aa129139729e112e7a51aad` re-paused the manifest; its Netlify attempt `6a6dc35767a4ef000877e74b` did not publish, and provider readback left the rollback deploy live. The overbroad release ref was deleted and verified absent. This incident changed no Firebase, outside-provider configuration, account, payment, or production data. diff --git a/README.md b/README.md index 442dba2..c6821ac 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,8 @@ Historical developer/content/LLM guides remain under [`docs/`](./docs/README.md) - `.github/workflows/`: frontend, Functions, Rules CI and deployment automation. - `public/404.html`, `public/index.html`, and `public/spa-navigation.js`: current tested GitHub Pages callback handoff. It preserves safe same-origin path, query, and fragment state. +**Current Netlify publication checked 2026-09-14 Pacific time:** WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed one bounded content-only release. Exact merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` published deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, 62 files, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. The marker and every live file matched. Signed-out 390×844 and 1280×900 checks passed for both temporary meeting notices, exact safe map links, banner and page-heading visibility, and no horizontal overflow; no screenshot was retained. Repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five exact-main jobs in run `34928449093`. Attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null, retained the verified #685 deploy, and left the manifest inactive. The temporary #685 source/control/repause refs are retired; rollback ref `codex/netlify-source-685-rollback` remains pinned to #659 source `7496fe0881fb52908c4ff2f40f488df09c94c908` and deploy `6a7ece87c5ca4d0007c1a3fc`. #623 and #473 are older history. The old #473/#623/#659 hot refs remain a documented latent manual-rebuild risk despite inactive manifests. No Firebase, Pages, DNS, provider, account, sign-in, data, payment, route, or permission changed. The Sept. 12 email is already sent; WhatsApp remains pending action-time confirmation, so issue #685 remains open. + **Deployment reality checked 2026-08-14:** merges run CI but do not start the manual release workflow. The protected gate accepts one exact current merged commit, rechecks its newest CI run after approval, uses one fixed Firebase target set, fails when protected authority/configuration is missing, verifies Firebase before publishing GitHub Pages, and gives no server credential to website preparation or publication. Ordinary Git-triggered Netlify production builds are paused. WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one bounded accessibility release: exact merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` published deploy `6a7ece87c5ca4d0007c1a3fc` from source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, 62 files, and artifact digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`. Signed-out desktop and phone route-focus/menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` passed exact-main CI run `31783808994`; attempt `6a7ed0ddb00a46000818878d` published nothing, deploy `6a7ece87c5ca4d0007c1a3fc` remained live, and the manifest is inactive. #623 deploy `6a7e072f8f346b0008510d29` remains rollback history and its inert directory interface is unchanged beneath the accessibility delta. No Firebase, Rules, Functions, indexes, provider configuration, account, sign-in state, role, member data, payment, or connected directory backend changed. The prior bounded #473 deploy `6a6dc9ea588b0c0008036312` remains older history. The source stops adding a Pages `CNAME`, but GitHub Pages currently still claims `runmprc.com` and its default URL redirects there; only a controlled #136/WEB-001 publication and provider readback can clear that conflict. Reusable protected publication to the live Netlify-served `runmprc.com` is not configured yet. Treat GitHub Pages, Netlify, `runmprc.com`, Firebase, and outside providers as separate states. **Owned staging checked 2026-08-26:** WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the isolated `run-mprc-staging` Firebase project under the club account and published its first static Hosting version. CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a protected staging-only OIDC verifier with two named reviewers and a keyless principal that can read only the exact project identity. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds the empty delete-protected `(default)` Firestore database in `us-west2` and deploys exact Rules/indexes from source `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`; provider definitions matched, fixed anonymous server-only reads were denied, and the root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deployed exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` to Auth only. Live readback shows instrumentless Firebase Authentication with Identity Platform, billing disabled, password-required email/password, improved email privacy, only the two staging authorized domains, and no other sign-in provider. Disposable API and browser sign-in/sign-out checks passed, both identities were removed, no email or SMS was requested, and the final user and Firestore root-collection counts were zero. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a source-only guard for exactly `createMemberOnSignUp` and `ensureMemberProfile`; billing remains unapproved, so no Functions-related API was enabled and no Function was deployed. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merged its argument-closed Hosting/App Check source guard through [PR #677](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/677) as exact source `bce911a7083201cfe2141edaa9660f210287bf57`; all five exact-main jobs in run `33018136439` passed. The bounded provider phase enabled only Firebase App Check and reCAPTCHA Enterprise, created exactly one score-based key restricted to the two staging hosts, registered it to the one web app with a one-hour token lifetime, and published that exact source as Hosting version `8556fc51210bdc66`. A made-up reserved-domain browser account completed create, sign-out, fresh sign-in, and post-enforcement sign-in; the empty Events read succeeded both signed in and signed out with no browser warning or error. Authentication plus Firestore now read `ENFORCED` with replay protection `OFF`; the same valid Auth credentials without App Check were rejected with HTTP 401, and a tokenless Firestore Events request was rejected with HTTP 403. The disposable user was deleted and final users plus root collections are zero. Billing remains disabled, Functions-related APIs and deployed Functions remain absent, the account page fails closed while those Functions are unavailable, and production Firebase Hosting plus the Netlify-served `runmprc.com` are unchanged. diff --git a/SECURITY.md b/SECURITY.md index b993dcb..9905856 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -87,7 +87,7 @@ The findings below describe the repository at the start of the 2026-07-12 assess | RISK-035 | The deterministic frontend Jest suite and standalone SPA callback suite run as separate blocking hosted CI steps. CI-001B4/#186 merged a non-mutating frontend lint gate as `bec7d5e365eacb418563a172029f241f660d9768`; exact PR and post-merge runs passed. CI-001B4A [#227](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/227) removes one reviewed `arrow-body-style` error, CI-001B4B [#239](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/239) removes one stale `AdminMembers` unknown-rule suppression record, and PAY-004C1 [#359](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/359) retires one `no-alert` warning plus two label-association errors with the unsafe reusable-link controls. Reviewed functional changes in [PR #391](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/391) and [PR #392](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/392) add one and two TypeScript files respectively while retiring two TSX errors each. CI-001B4C [#449](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/449) replaces the four remaining stale `react-hooks/exhaustive-deps` directives with ordinary same-line comments, without changing executable code or the gate. MEMBERS-CONTENT-001B [#492](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/492) removes one finding-free dormant JSX file. MEMBERS-DIRECTORY-001A [#505](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/505) adds four finding-free TypeScript/TSX files, MEMBERS-DIRECTORY-001B [#506](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/506) adds four more, WEB-SUGGESTIONS-001A [#618](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/618) adds one finding-free JSX page, and MEMBERS-DIRECTORY-001D [#621](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/621) adds one finding-free TypeScript availability module. The current baseline scans 120 files and still records 113 configured errors and 6 warnings after the lint process disables the repository's severity-masking `eslint-plugin-only-warn` hook. Branch protection, remaining lint-debt cleanup, and broader domain/integration coverage remain incomplete. | Continue reducing the reviewed finding baseline in focused changes, prove required branch checks, and add domain/integration coverage. Never regenerate the baseline merely to make CI green. | | RISK-036 | #135 adds a manual exact-commit source gate, fixed profile-recovery targets, backend-first order, missing-config failure, and ordinary Git-triggered Netlify production containment. WEB-UX-001A [#457](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/457) used a temporary exact-artifact exception. On 2026-08-01 an overbroad WEB-002A artifact was merged after a late blocker and published; exact rollback merge `1099ee8` restored source `ed1b0833`, and `dee7951` paused the manifest. Bounded replacement [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) then published exact source `39ab8649` as deploy `6a6dc9ea588b0c0008036312`; its delta is only Shop and Events/Calendar failure containment, and its public checks passed. Final control `cb6a8f0` made the manifest inactive; Netlify attempt `6a6dcdd47bc81e000859a249` stopped unpublished and left that bounded deploy as #623's rollback. WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) then completed one exact-artifact release: merge `9d5cc8612b4321172370bd949d307e7e4ac0ec7d` published frozen inert source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, tree `411aa6ec9a9459f5d923030533ffc7c007fe6908`, 62 files, and digest `d837272a1e5efc1575809e87f532276b38d1a63f1dd79ec1aef0533f6da8afb1` as deploy `6a7e072f8f346b0008510d29`. Signed-out marker, route, guard, and no-connected-symbol/request checks passed. Repause merge `c8678c623afdd9becf77d596b71f36f26f04b746` made the manifest inactive; attempt `6a7e081e73fdd60009f7ba57` stopped unpublished and retained the verified deploy. The release source is absent and the rollback ref remains. Protected environments/OIDC, backend/provider staging, a reusable live-Netlify path, and provider-owned atomic rollback remain unverified; #665 proves only the static host. | Require a final blocker re-read and an executable delta from the live artifact before every release merge. Preserve the exact #473 rollback evidence, keep ordinary publication paused, and keep the reviewed Git rollback projection available. Treat #623 as a completed one-off, not a reusable control. Complete #133 and #136, extend #665 into protected backend/provider staging, protect the reusable Netlify release path under WEB-001, and rehearse provider rollback before broader production work. | | WEB-002D completed exact-artifact containment for RISK-036 | [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only release on 2026-08-14. Exact release merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` published deploy `6a7ece87c5ca4d0007c1a3fc`; its marker and all 62 artifact paths matched frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`, and exact six-path diff digest `462eeb01e7a9858678802464f7dd4b76cd2fcb3c13be827efb4f98fa53ca809c`. Signed-out desktop and phone route-focus/menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` passed exact-main CI run `31783808994`; attempt `6a7ed0ddb00a46000818878d` stayed unpublished and retained the verified deploy. Literal-false directory availability, Firebase, Rules, Functions, indexes, outside-provider configuration, accounts, sign-in, production data, payments, and connected directory behavior were unchanged. | The manifest is inactive; source/control/repause refs are absent; rollback ref `codex/netlify-source-659-rollback` remains pinned to #623 source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`. Treat #659 as a completed one-off, not reusable authority. Keep ordinary publication paused, preserve #507 connected-directory gates, and preserve active #616 OAUTH-001A2L files and its RISK-024 wording byte-for-byte. | -| WEB-CONTENT-001 pending exact-artifact containment for RISK-036 | [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is a content-only banner release under review and is not published. The frozen two-file delta names two public meeting locations and has Pacific-time expiry tests; production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc`. A 2026-09-14 remote read found the old #473, #623, and #659 hot source refs still present, superseding older absent/retired wording; inactive manifests block ordinary merges, but the manual-rebuild residual remains. | Permit only the pinned source/tree/artifact and exact first-parent merge. Require signed-out phone/desktop preview and live readback, then immediate repause. Stop on any identity, content, link, expiry, artifact, or `main` mismatch. The release must not change Firebase, providers, accounts, sign-in, private data, payment, routes, permissions, or reusable authority. Retire historical hot refs only in a separate approved cleanup after rollback refs are confirmed. | +| WEB-CONTENT-001 completed exact-artifact containment for RISK-036 | [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed the content-only banner release. Exact release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` published deploy `6aa8c5b3fddd040009eba99c` from frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, 62 files, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. Its marker and every live file matched. Signed-out phone and desktop checks passed for exact notice text and safe map links, visibility, and overflow; no screenshot was retained. Repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five exact-main jobs; attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and retained the verified deploy. The manifest is inactive. #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are the immediate rollback; #623 and #473 are older history. No Firebase, providers, accounts, sign-in, private data, payment, routes, permissions, or reusable authority changed. | Keep ordinary production publication inactive. The temporary #685 source/control/repause refs are retired; rollback ref `codex/netlify-source-685-rollback` remains exact. A 2026-09-14 remote read also found the old #473, #623, and #659 hot source refs present despite older absent/retired wording; their inactive manifests block ordinary merges, but an authorized manual rebuild of a historical active merge remains a latent retry path. Do not treat that residual as resolved. Confirm rollback refs before any separately approved cleanup. | | WEB-001A1/A2 boundary for RISK-010 and RISK-036 | [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) adds the dependency-free hosted-build contract and Hosting rewrite. [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) adds one club-owned staging project, web app, finalized static Hosting release, provider readback, and signed-out desktop/phone route checks from exact source `a614c68`. | This proves static engineering staging only. It creates no staging backend/provider isolation, App Check, WIF/IAM identity, protected branch/environment, automatic deployment, release marker, tested predecessor rollback, complete header policy, custom domain, DNS/TLS change, production Hosting, `runmprc.com` publication, or live protection. Complete #113/#133 and the remaining #460 children before any end-to-end staging or production claim. | | CI-001D1 boundary for RISK-006 and RISK-010 | [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) creates empty Native/Standard staging Firestore in `us-west2`, enables delete protection, keeps PITR off, and deploys exact Rules SHA-256 `fe3f53302db76df5febf7e9d242d82a6b6bec0c0b574ecc8253f1034f1a77dba`, four composite indexes, and 28 field overrides from source `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case emulator suite passed; active Rules content matched; fixed anonymous server-only reads returned denial; root collection count remained zero. | This proves only an empty staging data boundary. It creates no Auth test user/provider, Function, App Check enforcement, provider sandbox, protected Firebase deploy role, application record, website release, production Rules change, or production behavior. | | RISK-037 | Account/registration deletion, export, retention, backup, and restore procedures are incomplete. | Approve retention matrix, automate minimization, support access/deletion requests, and test backup restoration. | diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 3b6efd3..4617913 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -92,7 +92,7 @@ Text alternative: browsers can use the React app, Auth, Firestore, Functions, St | Operational data | Cloud Firestore | `src/services`, `firestore.rules`, `firestore.indexes.json` | Appropriate for current scale; counters and state transitions require transactional design. | | Server API | First-generation Firebase callable/HTTP/trigger functions | `functions/` | Prototype covers most workflows; validation, idempotency, and isolation are incomplete. | | Payments | Stripe Checkout Sessions, Payment Links, refunds, signed webhook | `functions/createCheckoutSession.js`, `createMerchCheckout.js`, `stripeWebhook.js` | Not ready for live payments until P0 issues are complete. | -| Hosting and release | Netlify currently answers `runmprc.com`. GitHub Pages still reports the same custom domain, so its default URL redirects to the Netlify-served name instead of providing an independent copy. #135 source stops ordinary automatic releases, pauses Git-triggered Netlify production builds, and removes the Pages CNAME from future protected artifacts. After an overbroad WEB-002A artifact was rolled back, [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) completed one bounded replacement. WEB-002C [#623](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/623) then published the frozen inert directory interface as deploy `6a7e072f8f346b0008510d29`. WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed a third bounded exception: exact merge `46e2364` published frozen source `7496fe0`, tree `ccac4c1`, 62 files, and digest `e4c26e6…` as deploy `6a7ece87c5ca4d0007c1a3fc`. Signed-out route-focus and phone-menu checks passed; repause merge `3138a00` left that deploy live and made the manifest inactive. | `netlify.toml`, `config/netlify-production-release.json`, `scripts/netlify-release-policy.js`, `.github/workflows/deploy.yml`, `public/404.html` | **LIVE FRONTEND CONTAINMENT.** Production is #659 deploy `6a7ece87c5ca4d0007c1a3fc` from source `7496fe0`. It adds only reviewed visible-focus, phone-menu, and client-side route-focus behavior to the inert #623 surface. Shop remains the static pickup catalog; Events and Calendar disclose no raw provider error. Event records remain unavailable because no Firebase or provider repair was deployed. The directory remains literal-false and inert. This does not connect its backend or complete the general protected host under #133/#136/WEB-001. | +| Hosting and release | Netlify currently answers `runmprc.com`. GitHub Pages still reports the same custom domain, so its default URL redirects to the Netlify-served name instead of providing an independent copy. #135 source stops ordinary automatic releases, pauses Git-triggered Netlify production builds, and removes the Pages CNAME from future protected artifacts. After bounded #473, #623, and #659 releases, WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed a fourth bounded exception: exact merge `d25b0fe` published frozen source `41a9ae4`, tree `7f75ebd`, 62 files, and digest `cb4eba7…` as deploy `6aa8c5b3fddd040009eba99c`. Signed-out phone/desktop notice, map-link, visibility, and overflow checks passed; repause merge `609d788` left that deploy live and made the manifest inactive. | `netlify.toml`, `config/netlify-production-release.json`, `scripts/netlify-release-policy.js`, `.github/workflows/deploy.yml`, `public/404.html` | **LIVE FRONTEND CONTAINMENT.** Production is #685 deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4`. It adds only the temporary Sept. 19 and Sept. 26 meeting-location banner and expiry tests to #659 source. #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback; #623 is older history. Shop remains the static pickup catalog; Events and Calendar disclose no raw provider error. Event records remain unavailable because no Firebase or provider repair was deployed. The directory remains literal-false and inert. This does not connect its backend or complete the general protected host under #133/#136/WEB-001. | | Email | Firestore `mail` outbox designed for the Firebase Trigger Email extension | `functions/sendConfirmationEmail.js` | Extension/provider deployment is unverified; outbox creation is not transactionally idempotent and HTML needs escaping. | | Observability | Optional Sentry; Firebase Analytics configuration remains but its runtime is not initialized by #139 source | `src/services/monitoring`, `src/services/analytics` | #134 source bounds Sentry payloads. #139 source removes every application runtime Firebase Analytics import, initialization, and emission while preserving no-op call compatibility. Website publication, provider collection/cookies and historical data, consent, retention, access, deletion, and vendor configuration remain unverified under #110/#111. | | Third-party fitness | Strava OAuth tokens and statistics | `functions/strava.js`, `src/services/strava` | Functional prototype. The #100 source Rules deny browser token access, but Firebase deployment is unproven and transactional refresh, scopes/revocation, IAM/encryption decision, and audit remain OAUTH-001. | @@ -103,7 +103,7 @@ The former workflow automatically published Pages before attempting Firebase and WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one exact-artifact exception on 2026-08-14. Pinned preview `6a7ec998bf8fde00086d2bfe` matched control `137d8a8721339a6ca1079283cc34c1bd7cc2706c`. Exact release merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` published deploy `6a7ece87c5ca4d0007c1a3fc` from source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, 62 files, and artifact digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`; the exact six-path predecessor diff digest was `462eeb01e7a9858678802464f7dd4b76cd2fcb3c13be827efb4f98fa53ca809c`. Signed-out desktop route-focus and phone menu/route-focus checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` passed exact-main CI `31783808994`; attempt `6a7ed0ddb00a46000818878d` stayed unpublished and retained the verified deploy. The manifest is inactive; temporary refs are absent; #623 deploy `6a7e072f8f346b0008510d29` is the rollback target. #659 changed no route set, content, Firebase surface, outside-provider configuration, account, sign-in state, production data, payment, or directory behavior; directory availability remains literal `false` and #507 still owns connection. -WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) arms a fourth bounded exact-artifact exception for one temporary public banner. It is under review and is not published. The pinned source adds only the two meeting-location notices and their automatic Pacific-time expiry tests to live #659 source; production remains deploy `6a7ece87c5ca4d0007c1a3fc` until exact preview, exact-parent merge, marker, signed-out phone/desktop readback, and repause proof all pass. Firebase, providers, accounts, private data, routes, payments, permissions, and the reusable release boundary do not change. +WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed the fourth bounded exact-artifact exception on 2026-09-14 Pacific time. Preview `6aa8c3e0e5faba00080fd632` matched control `f0c2d2378fd30b684ecb2fede447a184a414ab1c`. Exact release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` published deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, 62 files, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. The marker and every live file matched. Signed-out 390×844 and 1280×900 checks passed for exact notice text and safe links, visibility, and overflow; no screenshot was retained. Exact repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five jobs in exact-main run `34928449093`; Netlify attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and retained the verified #685 deploy. The manifest is inactive, the temporary #685 source/control/repause refs are retired, and rollback ref `codex/netlify-source-685-rollback` remains pinned to #659 source `7496fe0881fb52908c4ff2f40f488df09c94c908`. #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback; #623 is older history. Firebase, Pages, DNS, providers, accounts, private data, routes, payments, permissions, and the reusable release boundary did not change. Email was already sent Sept. 12; WhatsApp remains pending the user's action-time confirmation, so #685 remains open. Remote source-ref readback on 2026-09-14 found the old #473, #623, and #659 hot refs still present, superseding older absent/retired wording. Their inactive manifests keep ordinary `main` merges from publishing, but a manual rebuild of a historical active merge remains latent. A separate reviewed cleanup must confirm the matching rollback refs before retiring those hot refs. @@ -125,15 +125,14 @@ flowchart TD Verify -- "No" --> Stop Verify -- "Yes" --> Pages["Publish Pages branch without a CNAME"] Merge -. "Ordinary Git production build paused" .-> Netlify["Netlify / runmprc.com\nreusable protected publication not available"] - Predecessor["#623 inert artifact retained as older history"] --> Completed["#659 exact-parent one-shot completed"] - Completed --> WebOnly["#659 accessibility artifact remains live"] - WebOnly --> Pending["#685 temporary notice under review"] - Pending -. "Only the exact reviewed parent may publish" .-> Netlify - Netlify --> WebReadback["Exact marker and signed-out route/menu checks verified"] - WebReadback --> WebRepause["Temporary authority inactive; last verified deploy retained"] + Predecessor["#623 inert artifact retained as older history"] --> Completed["#659 accessibility release; immediate rollback"] + Completed --> WebOnly["#685 meeting notice release authorized exactly"] + WebOnly --> Netlify + Netlify --> WebReadback["Exact marker, all files, and signed-out notice checks verified"] + WebReadback --> WebRepause["Exact repause completed; manifest inactive; verified deploy retained"] ``` -Text alternative: ordinary merges run CI and do not publish Netlify. #659 completed one exact-parent accessibility exception, and production still serves deploy `6a7ece87c5ca4d0007c1a3fc`. #685 is under review and is not published; only its exact reviewed parent, frozen banner artifact, marker, public checks, and repause may replace #659. The separate protected workflow still requires approval and verified Firebase before publishing its Pages copy. +Text alternative: ordinary merges run CI and do not publish Netlify. #685 completed one exact-parent content exception, and production serves deploy `6aa8c5b3fddd040009eba99c` with an exact marker, all-file match, and signed-out notice checks. Immediate repause left that deploy live and made the manifest inactive. #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback; #623 and #473 are older history. The temporary #685 refs are retired; the old #473/#623/#659 hot refs remain a documented latent manual-rebuild risk. The separate protected workflow still requires approval and verified Firebase before publishing its Pages copy. ### GitHub Pages callback handoff diff --git a/docs/officers/ACCESS_CONTINUITY.md b/docs/officers/ACCESS_CONTINUITY.md index ff8036f..6fe5348 100644 --- a/docs/officers/ACCESS_CONTINUITY.md +++ b/docs/officers/ACCESS_CONTINUITY.md @@ -125,13 +125,13 @@ For each system, record only: 11. Confirm missing release authority becomes a red failure before backend installation, cloud authentication, deployment, or website publication. A public website artifact may be prepared without cloud authority. 12. Confirm Firebase verification must finish before the GitHub Pages publication job can start. 13. Confirm ordinary Netlify Git-triggered production builds remain paused. -14. Confirm the live #659 marker names control `46e23647d8e0bf9fa3a574ea5c5f993be10a419d`, source `7496fe0881fb52908c4ff2f40f488df09c94c908`, tree `ccac4c189c195db8ab594e0eefe256ea9fa04996`, 62 files, digest `e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7`, and deploy `6a7ece87c5ca4d0007c1a3fc`. -15. Confirm release merge `46e23647d8e0bf9fa3a574ea5c5f993be10a419d` passed exact-main CI run `31783141914`. -16. Confirm repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` passed exact-main CI run `31783808994`. -17. Confirm repause attempt `6a7ed0ddb00a46000818878d` published nothing and deploy `6a7ece87c5ca4d0007c1a3fc` stayed live. -18. Confirm the manifest is inactive, temporary refs are absent, and rollback ref `codex/netlify-source-659-rollback` remains. -19. Record completed #623 deploy `6a7e072f8f346b0008510d29` as the immediate rollback and completed #473 deploy `6a6dc9ea588b0c0008036312` as older history. -20. For any future exception, re-read the issue and pull request for a newer blocker. +14. Confirm the live #685 marker names control `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6`, source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, previous source `7496fe0881fb52908c4ff2f40f488df09c94c908`, rollback deploy `6a7ece87c5ca4d0007c1a3fc`, 62 files, digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`, and deploy `6aa8c5b3fddd040009eba99c`. +15. Confirm release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` passed all five exact-main jobs in run `34927937346`. +16. Confirm repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five exact-main jobs in run `34928449093`. +17. Confirm repause attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and deploy `6aa8c5b3fddd040009eba99c` stayed live. +18. Confirm the manifest is inactive, the temporary #685 source/control/repause refs are absent, and rollback ref `codex/netlify-source-685-rollback` remains pinned to source `7496fe0881fb52908c4ff2f40f488df09c94c908`. +19. Record completed #659 deploy `6a7ece87c5ca4d0007c1a3fc` as immediate rollback, completed #623 deploy `6a7e072f8f346b0008510d29` as older history, and completed #473 deploy `6a6dc9ea588b0c0008036312` as oldest retained history. +20. Record that the old #473, #623, and #659 hot refs remain a latent authorized-manual-rebuild path despite inactive manifests; do not claim that risk is resolved. 21. Compare its executable delta with the current live artifact immediately before merge. 22. Confirm reviewers reject release requests older than 24 hours and request the current `main` commit again. 23. **NOT AVAILABLE YET:** complete the synthetic role-boundary drill below after the reviewed database, Function, and website revisions are safely available in protected staging. diff --git a/docs/officers/EVENTS_SHOP_MEMBERS.md b/docs/officers/EVENTS_SHOP_MEMBERS.md index b2d5246..032cce9 100644 --- a/docs/officers/EVENTS_SHOP_MEMBERS.md +++ b/docs/officers/EVENTS_SHOP_MEMBERS.md @@ -55,13 +55,44 @@ There is currently no proven no-code switch that safely stops all new Stripe pay If any proof is missing, report the change as **not live**. +## Temporary September meeting locations — LIVE WEBSITE NOTICE + +**Status:** the website part of [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is complete. Exact live #685 deploy `6aa8c5b3fddd040009eba99c` comes from frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The Sept. 12 email is already sent. The WhatsApp announcement still awaits the user's action-time confirmation, so #685 remains open. + +**Purpose:** tell prospective members where the 8:45 AM runs meet on Sept. 19 and Sept. 26, 2026, then remove each stale website notice automatically. + +**Approver:** communications owner plus Dave Liu as platform owner. + +**Prerequisites:** use the exact published notice and map links. Stay signed out. Do not enter member information or reuse this one-time website release control. + +Officer read-only check: + +1. Open [runmprc.com](https://runmprc.com) while signed out. +2. Through Sept. 19, confirm the banner shows both temporary meeting locations. +3. Confirm Sept. 19 says **8:45 AM**, names the restrooms next to the Seal Point dog park, warns that parking may be limited, and opens the approved exact restroom pin. +4. Confirm Sept. 26 says **8:45 AM**, names The Kite School in Baywinds Park at 30 Lakeside Drive, Foster City, says run and social, identifies the artificial turf south of the restrooms toward the San Mateo Bridge, and opens the approved map. +5. From Sept. 20 through Sept. 26 Pacific time, confirm only the Sept. 26 notice remains. +6. From Sept. 27 Pacific time, confirm the banner is absent. +7. Stop after the signed-out read-only check. Do not sign in, change a provider, or send another email. + +**Expected result:** both notices are visible through Sept. 19, only the Sept. 26 notice is visible from Sept. 20 through Sept. 26, and the banner is absent from Sept. 27 Pacific time. The website expiry does not send, delete, or change any email or WhatsApp message. + +**Stop conditions:** either location, time, link, parking note, social note, or cutoff is wrong; the banner covers navigation or page content; a private route or account is requested; the public marker differs; or anyone treats the website expiry as proof that another channel's message disappeared. + +**Success proof:** exact release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` published deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. Its marker and all 62 files matched, and signed-out phone and desktop checks passed. Repause merge `609d7884e0242abce23449562e7e0da04794da1e` left the manifest inactive; attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and retained the #685 deploy. Temporary #685 source, control, and repause refs are retired. Rollback ref `codex/netlify-source-685-rollback` remains pinned to immediate-rollback source `7496fe0881fb52908c4ff2f40f488df09c94c908`, whose deploy is `6a7ece87c5ca4d0007c1a3fc`. #623 and #473 are older release history. A 2026-09-14 remote read found the old #473, #623, and #659 hot source refs still present despite inactive manifests; they remain a latent authorized-manual-rebuild risk and are not resolved by #685. + +**Undo:** if the banner is wrong, stop and ask the Netlify team owner to restore #659 deploy `6a7ece87c5ca4d0007c1a3fc` or use a separately reviewed exact-parent projection of source `7496fe0881fb52908c4ff2f40f488df09c94c908`. Do not edit production content, Firebase, email, WhatsApp, or a provider as a workaround. + +**Escalation:** communications owner for wording or location; platform owner for source, marker, Netlify, expiry, or rollback; security owner for any unexpected account, data, credential, provider, or permission behavior. + ## In-person Shop catalog — LIVE -**Status:** the bounded [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) -artifact is live as Netlify deploy `6a6dc9ea588b0c0008036312`. Its public marker -and `runmprc.com/shop` were verified on 2026-08-01. The page creates no online -order or payment. The same artifact contains Events/Calendar error display; -event records remain unavailable until a separate protected Firebase repair. +**Status:** the catalog first published by bounded [#473](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/473) +remains live inside current Netlify deploy `6aa8c5b3fddd040009eba99c` from source +`41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. The #473 publication record remains +historical evidence. The page creates no online order or payment. Current +production also preserves the Events/Calendar error display; event records +remain unavailable until a separate protected Firebase repair. **Purpose:** show the approved MPRC Hat at $10.00 and MPRC Jacket at $25.00 without taking an order or payment online. @@ -1229,7 +1260,7 @@ Officer source-review procedure for AUTH-006G [#651] confirmed profile-name Save 111. Confirm active #616 Strava runtime files remain unchanged. 112. Confirm active #616 OAUTH-001A2L/RISK-024 documentation remains unchanged. 113. Confirm the optional-directory availability value remains byte-for-byte `false`. -114. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +114. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 115. Confirm #507 still owns every optional-directory connection and live-proof gate. 116. Record the source change as its own state. 117. Record the named test results as their own state. @@ -1244,11 +1275,11 @@ Officer source-review procedure for AUTH-006G [#651] confirmed profile-name Save 126. Record whether connected profile-photo or officer-finder behavior is live as its own state. 127. Stop before changing Firebase, a provider, an account, production data, directory availability, or the live website. -**Expected result:** one exact current full-name update plus its successful non-null authoritative profile reread renders exactly **Profile name saved.** between the Profile heading and Edit, with status, polite live, atomic, programmatic-focus, bounded-layout, and visible-outline semantics. Only an admitted Save that owned focus records the current generation and attempt ID. Exact current confirmed success alone transfers that intent. The layout effect consumes it before target checks. Absent, body, document-root, or disconnected focus returns to the connected result; retained result focus is left alone; and every other connected focus is preserved. An unfocused Save still shows the truthful result without moving focus. Initial load, validation, update rejection, missing or rejected reread, profile reload, context or generation change, newer attempt, stale work, unmount, and later rerender cannot show or focus stale success. Edit, a new Save, profile load, and context change clear the old result. The handoff creates no extra read, write, request, retry, provider call, log, or stored value. Existing unconfirmed-change recovery remains unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. +**Expected result:** one exact current full-name update plus its successful non-null authoritative profile reread renders exactly **Profile name saved.** between the Profile heading and Edit, with status, polite live, atomic, programmatic-focus, bounded-layout, and visible-outline semantics. Only an admitted Save that owned focus records the current generation and attempt ID. Exact current confirmed success alone transfers that intent. The layout effect consumes it before target checks. Absent, body, document-root, or disconnected focus returns to the connected result; retained result focus is left alone; and every other connected focus is preserved. An unfocused Save still shows the truthful result without moving focus. Initial load, validation, update rejection, missing or rejected reread, profile reload, context or generation change, newer attempt, stale work, unmount, and later rerender cannot show or focus stale success. Edit, a new Save, profile load, and context change clear the old result. The handoff creates no extra read, write, request, retry, provider call, log, or stored value. Existing unconfirmed-change recovery remains unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. **Stop conditions:** a real account, profile, name, email, UID, screenshot, or production sign-in; direct production Firebase access; a provider configuration or production-data action; success copy other than **Profile name saved.**; a result shown before a current non-null authoritative reread; a result containing a member, provider, or error detail; missing status, live, atomic, programmatic-focus, bounded-layout, or visible-outline semantics; DOM order other than heading, result, Edit; a focused exact current Save whose confirmed result receives no otherwise-lost focus; an unfocused Save that moves focus; a connected control that loses deliberately selected focus; an intent containing anything beyond generation and attempt ID; transfer before current confirmed success; delayed focus on a later render; stale application, Firestore, identity, UID, generation, attempt, reread, or unmounted work that shows or focuses success; an extra read, write, request, retry, provider call, log, or stored value; changed validation, payload, confirmation-reread, AUTH-006F, unconfirmed-change, failure/retry, AUTH-006I Edit-to-input focus, Cancel-to-Edit focus, directory, or Strava behavior; a Function, Rule, schema, index, package, workflow, provider, account, sign-in, production-data, deployment, publication, membership, dues, role, payment, entitlement, roster, photo-query, facial-recognition, matching, embedding, similarity, or biometric change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, preview, or green CI proves the behavior live. -**Success proof:** record the exact #651 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure and 243 skipped tests plus test-only digest `df02329a39ee24b127f801d4a8726f5748bdff0b992b8706a16456bbeb2fd66f`; green 22-of-22 AUTH-006G block; green 265-of-265 Account suite; passing type-check, scoped ESLint, and diff-check; bounded grid, containment, and focus-style evidence; runtime diff digest `c00a6c7e0486dcdfbb0e9d0a4b4c48215f03e3e8c72634fc1f2b17142c08c1d5`; relevant full frontend, repository Node, diagnostic build, unchanged lint-baseline, workflow, and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. +**Success proof:** record the exact #651 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure and 243 skipped tests plus test-only digest `df02329a39ee24b127f801d4a8726f5748bdff0b992b8706a16456bbeb2fd66f`; green 22-of-22 AUTH-006G block; green 265-of-265 Account suite; passing type-check, scoped ESLint, and diff-check; bounded grid, containment, and focus-style evidence; runtime diff digest `c00a6c7e0486dcdfbb0e9d0a4b4c48215f03e3e8c72634fc1f2b17142c08c1d5`; relevant full frontend, repository Node, diagnostic build, unchanged lint-baseline, workflow, and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. No Firebase, provider, account, sign-in, or production-data undo is needed because #651 changes source only. An undo must preserve AUTH-006F context fencing, generic unconfirmed-change recovery, the inert directory default, and active #616 work. Do not undo by editing or deleting a profile or account. @@ -1372,7 +1403,7 @@ Officer source-review procedure for AUTH-006H [#653] unconfirmed profile-name Sa 108. Confirm active #616 Strava runtime files remain unchanged. 109. Confirm active #616 OAUTH-001A2L/RISK-024 documentation remains unchanged. 110. Confirm the optional-directory availability value remains byte-for-byte `false`. -111. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +111. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 112. Confirm #507 still owns every optional-directory connection and live-proof gate. 113. Record the source change as its own state. 114. Record the named test results as their own state. @@ -1387,11 +1418,11 @@ Officer source-review procedure for AUTH-006H [#653] unconfirmed profile-name Sa 123. Record whether connected profile-photo or officer-finder behavior is live as its own state. 124. Stop before changing Firebase, a provider, an account, production data, directory availability, or the live website. -**Expected result:** an exact current update rejection, `null` confirmation reread, or rejected confirmation reread keeps the existing fixed unconfirmed alert and enabled **Try profile again** action. Every exact current unconfirmed result records only its generation and attempt ID to own that result. Only an admitted Save that owned focus records a pending focus token. The exact current catch transfers that pending token only when it matches the result. One layout effect consumes it before target checks and requires the matching generation and attempt, unavailable state, no profile, editor, or success confirmation, the exact message, and a connected alert. The alert has assertive, atomic, programmatic-focus, bounded-wrapping, and scoped visible-outline semantics. Its message immediately precedes the retry action. Absent, body, document-root, or disconnected focus returns to the alert; retained alert focus is left alone; and any other connected focus is preserved. An unfocused Save still shows the recovery without moving focus. Initial setup/read failure, validation, reload, context or generation change, newer attempt, stale update/reread work, unmount, and later rerender cannot focus stale recovery. Try clears the old intent before loading. The handoff creates no extra read, write, request, retry, provider call, log, or stored value. It does not claim whether the update persisted. AUTH-006G success remains unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. +**Expected result:** an exact current update rejection, `null` confirmation reread, or rejected confirmation reread keeps the existing fixed unconfirmed alert and enabled **Try profile again** action. Every exact current unconfirmed result records only its generation and attempt ID to own that result. Only an admitted Save that owned focus records a pending focus token. The exact current catch transfers that pending token only when it matches the result. One layout effect consumes it before target checks and requires the matching generation and attempt, unavailable state, no profile, editor, or success confirmation, the exact message, and a connected alert. The alert has assertive, atomic, programmatic-focus, bounded-wrapping, and scoped visible-outline semantics. Its message immediately precedes the retry action. Absent, body, document-root, or disconnected focus returns to the alert; retained alert focus is left alone; and any other connected focus is preserved. An unfocused Save still shows the recovery without moving focus. Initial setup/read failure, validation, reload, context or generation change, newer attempt, stale update/reread work, unmount, and later rerender cannot focus stale recovery. Try clears the old intent before loading. The handoff creates no extra read, write, request, retry, provider call, log, or stored value. It does not claim whether the update persisted. AUTH-006G success remains unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. **Stop conditions:** a real account, profile, name, email, UID, screenshot, or production sign-in; direct production Firebase access; a provider configuration or production-data action; unconfirmed copy other than **We could not confirm your profile change. Try the profile again before making another change.**; an alert containing a member, provider, response, or caught detail; missing alert, assertive, atomic, programmatic-focus, bounded-wrapping, or visible-outline semantics; the retry action appearing before the message or not remaining the next Tab stop; focus sent directly to the retry action; a focused exact current Save whose unconfirmed alert receives no otherwise-lost focus; an unfocused Save that moves focus; a connected control that loses deliberately selected focus; a token containing anything beyond generation and attempt ID; transfer outside an exact current catch; a browser claim that the write failed or persisted; delayed focus on a later render; stale application, Firestore, identity, UID, generation, attempt, update, reread, reload, or unmounted work that shows or focuses recovery; an extra read, write, request, retry, provider call, log, or stored value; changed validation, payload, AUTH-006F, AUTH-006G success, Try-profile-again result focus, validation error association, AUTH-006I Edit-to-input focus, Cancel-to-Edit focus, directory, or Strava behavior; a Function, Rule, schema, index, package, workflow, provider, account, sign-in, production-data, deployment, publication, membership, dues, role, payment, entitlement, roster, photo-query, facial-recognition, matching, embedding, similarity, or biometric change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, preview, or green CI proves the behavior live. -**Success proof:** record the exact #653 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure and 287 skipped tests plus test-only RED digest `25ca6ccd34dcd0acbef28727d05f05f72079ed6bd55ee0ae3b11b43c04a4f056`; green 23-of-23 AUTH-006H block; green 288-of-288 Account suite; passing type-check, scoped ESLint, and diff-check; bounded wrapping and focus-style evidence; runtime-only digest `6e9d9a8da90d1a0c22144d7e64b27fdb05735893177393ae74bd5e3ff18e6170`; final test-diff digest `895cb6ef708ed0714d53a0cf2dc7b7336104cf111ab2d5f591078051772d81ea`; combined three-path digest `b84d60f1166e924062d65e7a9834d9a94a567098561e9e4ba955d6f3f3b1350b`; relevant full frontend, repository Node, diagnostic build, unchanged lint-baseline, workflow, and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. +**Success proof:** record the exact #653 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure and 287 skipped tests plus test-only RED digest `25ca6ccd34dcd0acbef28727d05f05f72079ed6bd55ee0ae3b11b43c04a4f056`; green 23-of-23 AUTH-006H block; green 288-of-288 Account suite; passing type-check, scoped ESLint, and diff-check; bounded wrapping and focus-style evidence; runtime-only digest `6e9d9a8da90d1a0c22144d7e64b27fdb05735893177393ae74bd5e3ff18e6170`; final test-diff digest `895cb6ef708ed0714d53a0cf2dc7b7336104cf111ab2d5f591078051772d81ea`; combined three-path digest `b84d60f1166e924062d65e7a9834d9a94a567098561e9e4ba955d6f3f3b1350b`; relevant full frontend, repository Node, diagnostic build, unchanged lint-baseline, workflow, and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. No Firebase, provider, account, sign-in, or production-data undo is needed because #653 changes source only. An undo must preserve AUTH-006F context fencing, AUTH-006G confirmed-save behavior, the fixed generic unconfirmed recovery, the inert directory default, and active #616 work. Do not undo by editing or deleting a profile or account. @@ -1508,7 +1539,7 @@ Officer source-review procedure for AUTH-006I [#655] profile Edit-to-full-name-i 101. Confirm active #616 Strava runtime blobs remain `2eb48945061ab5ad2a896c6835f308cefd7fe63a` and `d1792d390bd57608fecab84341a6e5916fcf8196`. 102. Confirm active #616 OAUTH-001A2L/RISK-024 documentation remains unchanged. 103. Confirm the optional-directory availability blob remains `295909b0df8dd7c54a0f164f99d4943656aece4b`, whose value is byte-for-byte `false`. -104. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +104. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 105. Confirm #507 still owns every optional-directory connection and live-proof gate. 106. Record the source change as its own state. 107. Record the named test results as their own state. @@ -1523,11 +1554,11 @@ Officer source-review procedure for AUTH-006I [#655] profile Edit-to-full-name-i 116. Record whether connected profile-photo or officer-finder behavior is live as its own state. 117. Stop before changing Firebase, a provider, an account, production data, directory availability, or the live website. -**Expected result:** a connected focused current **Edit** opens the existing editor, clears prior Save feedback, keeps the authoritative current name, and returns otherwise-lost focus once to the connected enabled **Full name** input. Full name remains a native labeled input with its linked description, autocomplete, maximum length, existing global visible-focus rule, and position before Save and Cancel; Save is the next ordinary Tab stop. An unfocused or programmatic Edit opens the editor without moving focus. The layout effect consumes the generation-only intent before checks, preserves any deliberate connected focus, and cannot reuse stale or consumed intent after a target disappears, context changes, profile reloads, Save, Cancel, Try, unmount, or a later render. Editor entry creates no validation, read, write, request, retry, provider call, log, stored value, CSS change, or page node. AUTH-006F/G/H and exact calls remain unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. +**Expected result:** a connected focused current **Edit** opens the existing editor, clears prior Save feedback, keeps the authoritative current name, and returns otherwise-lost focus once to the connected enabled **Full name** input. Full name remains a native labeled input with its linked description, autocomplete, maximum length, existing global visible-focus rule, and position before Save and Cancel; Save is the next ordinary Tab stop. An unfocused or programmatic Edit opens the editor without moving focus. The layout effect consumes the generation-only intent before checks, preserves any deliberate connected focus, and cannot reuse stale or consumed intent after a target disappears, context changes, profile reloads, Save, Cancel, Try, unmount, or a later render. Editor entry creates no validation, read, write, request, retry, provider call, log, stored value, CSS change, or page node. AUTH-006F/G/H and exact calls remain unchanged. The behavior is source only and **NOT LIVE** until separately published and verified. Directory availability remains `false`, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. **Stop conditions:** a real account, profile, name, email, UID, screenshot, or production sign-in; direct production Firebase access; a provider configuration or production-data action; a non-native Edit or Full name control; changed input value, label, description, autocomplete, maximum length, enabled state, or input/Save/Cancel order; missing existing visible-focus behavior; any Account or global CSS change; an intent containing more than the profile generation; `autoFocus`, timeout, animation frame, text selection, or new React state; an unfocused or programmatic Edit that moves focus; a focused current Edit whose otherwise-lost focus does not reach Full name; focus sent directly to Save or Cancel; a connected deliberate target that loses focus; delayed or repeated focus after a missing, disabled, disconnected, stale, removed, or consumed target; stale application, Firestore, identity, UID, profile generation, load, reload, Try, Save, Cancel, or unmounted work that moves focus; validation, a read, write, request, retry, provider call, log, stored value, or page node caused by entry focus; changed AUTH-006F/G/H, payload, call count, Cancel-to-Edit focus, validation-error behavior, Try settlement, save-pending announcement, directory, or Strava behavior; a Function, Rule, schema, index, service, package, workflow, provider, account, sign-in, production-data, deployment, publication, membership, dues, role, payment, entitlement, roster, photo-query, facial-recognition, matching, embedding, similarity, or biometric change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, preview, or green CI proves the behavior live. -**Success proof:** record the exact #655 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure, 288 skipped tests, 289 total tests, focus left on the body, and test-only RED digest `3de742e72b8ef0d847c0a5811da0000631ecd926dcd1e9e5c589932e9b78efb4`; green 17-of-17 AUTH-006I block; green 305-of-305 Account suite; passing type-check, zero-output scoped ESLint, and diff-check; unchanged `Account.css` and `index.css` blobs plus existing global visible-focus evidence; runtime-only digest `a5bddd143b62af06b2357b30f3045117009b3bc827b1753bbb7a34f6c42cd5b4`; final test-diff digest `b5966220783abca0c5cfed832752471f167f0dcf48d636ab2eafd2c07896c3f3`; combined two-path digest `24dcd9003bb12fdc3abccfa19820682473644fa38d8a1b606a8e824277a51dd1`; green full frontend result with 18-of-18 suites and 1,314-of-1,314 tests; green 105-of-105 repository Node result; passing unchanged lint baseline and diagnostic build; workflow and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. +**Success proof:** record the exact #655 issue, reviewed pull request and commit; trustworthy unchanged-runtime result with one expected failure, 288 skipped tests, 289 total tests, focus left on the body, and test-only RED digest `3de742e72b8ef0d847c0a5811da0000631ecd926dcd1e9e5c589932e9b78efb4`; green 17-of-17 AUTH-006I block; green 305-of-305 Account suite; passing type-check, zero-output scoped ESLint, and diff-check; unchanged `Account.css` and `index.css` blobs plus existing global visible-focus evidence; runtime-only digest `a5bddd143b62af06b2357b30f3045117009b3bc827b1753bbb7a34f6c42cd5b4`; final test-diff digest `b5966220783abca0c5cfed832752471f167f0dcf48d636ab2eafd2c07896c3f3`; combined two-path digest `24dcd9003bb12fdc3abccfa19820682473644fa38d8a1b606a8e824277a51dd1`; green full frontend result with 18-of-18 suites and 1,314-of-1,314 tests; green 105-of-105 repository Node result; passing unchanged lint baseline and diagnostic build; workflow and security checks when complete; independent frontend/accessibility, security/privacy/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and live behavior separately. Record the unchanged `false` directory availability, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge. Merge does not prove publication. Publication does not prove `runmprc.com`, Firebase, provider, account, data, or live behavior. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. No Firebase, provider, account, sign-in, production-data, or CSS undo is needed because #655 changes source focus behavior and documentation only. An undo must preserve AUTH-006F/G/H, the authoritative current name and name-only payload, the inert directory default, and active #616 work. Do not undo by editing or deleting a profile or account. @@ -2379,7 +2410,7 @@ Officer review steps after the source merge: ## Public Events-list load failure privacy — LIVE FRONTEND CONTAINMENT -**Status: LIVE. EVENT RECORDS REMAIN UNAVAILABLE.** Exact deploy `6a6dc9ea588b0c0008036312` was checked on 2026-08-01. Firebase and event records were unchanged. +**Status: LIVE. EVENT RECORDS REMAIN UNAVAILABLE.** Current deploy `6aa8c5b3fddd040009eba99c` was checked on 2026-09-14 Pacific time and preserves the containment first published by #473. Firebase and event records were unchanged. **Purpose:** give any public Events visitor one plain next step when the event list cannot load, without showing a database, provider, account, endpoint, or technical error. @@ -2389,7 +2420,7 @@ Officer review steps after the source merge: Officer review steps after the source merge: -1. Confirm the platform owner names deploy `6a6dc9ea588b0c0008036312` before using this procedure. +1. Confirm the platform owner names current deploy `6aa8c5b3fddd040009eba99c` before using this procedure. 2. Ask the platform owner for the exact #258 issue, pull request, merged commit, and synthetic frontend test result. 3. Confirm the tests use only a made-up event, mocked event subscription, and mocked database reference. 4. Confirm a made-up subscription rejection announces `Error: We could not load events right now. Please try again later.` as an alert. @@ -2403,7 +2434,7 @@ Officer review steps after the source merge: **Stop conditions:** any real member, registration, event record, private location, discount, payment, waiver, or contact data; a request for a database or provider error, account detail, private endpoint, or screenshot containing private values; a production Firebase or provider change; a raw detail on the page or in the console; an attempt to force a production failure; or a claim that source, tests, merge, preview, or a green workflow proves the sentence is live. -**Success proof:** for source completion, record the exact #258 issue, reviewed pull request, merged commit, intended old-source failures, green synthetic tests, relevant full checks, and independent privacy review. For live availability, record deploy `6a6dc9ea588b0c0008036312` and the dated signed-out `runmprc.com/events` check. The fixed alert appeared naturally because event records remain unavailable; no failure was forced and no private event data was opened. Synthetic tests remain the proof that a hostile rejected value is never inspected. Record Firebase deployment, database-permission changes, provider configuration, event-record changes, and production-data actions as **not performed** for this frontend-only change. +**Success proof:** preserve the exact #258 source record and the #473 publication evidence. For current live availability, record #685 deploy `6aa8c5b3fddd040009eba99c` and the dated signed-out `runmprc.com/events` check. The fixed alert appeared naturally because event records remain unavailable; no failure was forced and no private event data was opened. Synthetic tests remain the proof that a hostile rejected value is never inspected. Record Firebase deployment, database-permission changes, provider configuration, event-record changes, and production-data actions as **not performed** for this frontend-only change. **Undo:** before publication, use one reviewed frontend revert or safe roll-forward. After publication, use the same protected website release path and verify the replacement revision on `runmprc.com/events`. Do not undo by changing an event, member account, registration, database record, permission, source document, or provider setting. @@ -2413,7 +2444,7 @@ No system diagram changes for this source slice because page structure, data mov ## Public Events-calendar load failure privacy — LIVE FRONTEND CONTAINMENT -**Status: LIVE. EVENT RECORDS REMAIN UNAVAILABLE.** Exact deploy `6a6dc9ea588b0c0008036312` was checked on 2026-08-01. Firebase and event records were unchanged. +**Status: LIVE. EVENT RECORDS REMAIN UNAVAILABLE.** Current deploy `6aa8c5b3fddd040009eba99c` was checked on 2026-09-14 Pacific time and preserves the containment first published by #473. Firebase and event records were unchanged. **Purpose:** give a visitor to the public Events calendar one plain next step when calendar data cannot load, without showing a database, provider, account, endpoint, or technical error. @@ -2423,7 +2454,7 @@ No system diagram changes for this source slice because page structure, data mov Officer review steps after the source merge: -1. Confirm the platform owner names deploy `6a6dc9ea588b0c0008036312` before using this procedure. +1. Confirm the platform owner names current deploy `6aa8c5b3fddd040009eba99c` before using this procedure. 2. Ask the platform owner for the exact #260 issue, pull request, merged commit, and synthetic frontend test result. 3. Confirm the tests use only a made-up event, mocked event subscription, and mocked database reference. 4. Confirm a made-up subscription rejection shows exactly `We could not load events right now. Please try again later.` in one alert that assistive technology reads immediately as a complete sentence. @@ -2440,7 +2471,7 @@ Officer review steps after the source merge: **Stop conditions:** any real member, registration, event record, private location, discount, payment, waiver, or contact data; a request for a database or provider error, account detail, private endpoint, or screenshot containing private values; a production Firebase or provider change; a raw detail on the page or in the console; an attempt to force a production failure; an attempt to decide #121's canonical event-source work or edit #249's commerce-result work in this slice; or a claim that source, tests, merge, preview, or a green workflow proves the sentence is live. -**Success proof:** for source completion, record the exact #260 issue, reviewed pull request, merged commit, intended old-source failures, green synthetic tests, relevant full checks, and independent privacy review. For live availability, record deploy `6a6dc9ea588b0c0008036312` and the dated signed-out `runmprc.com/events/calendar` check. The fixed alert appeared naturally because event records remain unavailable; no failure was forced and no private event data was opened. Synthetic tests remain the proof that a hostile rejected value is never inspected. Record Firebase deployment, database-permission changes, provider configuration, event-record changes, and production-data actions as **not performed** for this frontend-only change. +**Success proof:** preserve the exact #260 source record and the #473 publication evidence. For current live availability, record #685 deploy `6aa8c5b3fddd040009eba99c` and the dated signed-out `runmprc.com/events/calendar` check. The fixed alert appeared naturally because event records remain unavailable; no failure was forced and no private event data was opened. Synthetic tests remain the proof that a hostile rejected value is never inspected. Record Firebase deployment, database-permission changes, provider configuration, event-record changes, and production-data actions as **not performed** for this frontend-only change. **Undo:** before publication, use one reviewed frontend revert or safe roll-forward. After publication, use the same protected website release path and verify the replacement revision on `runmprc.com/events/calendar`. Do not undo by changing an event, member account, registration, database record, permission, source document, or provider setting. @@ -2849,7 +2880,7 @@ Officer review steps after every prerequisite has proof: ## Optional profile photo and officer people finder — INERT FRONTEND PREVIEW; BACKEND NOT LIVE -**Purpose:** let officers review the future profile-photo, independent finder-choice, and People finder layouts without connecting the private backend. The #621 frontend default is an inert preview: every related control is disabled; it reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing. #623 published only that inert interface as bounded Netlify deploy `6a7e072f8f346b0008510d29`. Signed-out route, guard, and no-directory-request checks passed, and the temporary authority is inactive. #659 live deploy `6a7ece87c5ca4d0007c1a3fc` preserves the exact inert directory surface beneath its accessibility-only delta. After a later approved connection, a signed-in person could choose one private profile thumbnail and, separately, choose whether the People finder may show their display name and thumbnail. A properly authorized officer could search by name and compare voluntary thumbnails visually. The system will not search a photo or recognize a face. +**Purpose:** let officers review the future profile-photo, independent finder-choice, and People finder layouts without connecting the private backend. The #621 frontend default is an inert preview: every related control is disabled; it reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing. #623 published only that inert interface as bounded Netlify deploy `6a7e072f8f346b0008510d29`. Signed-out route, guard, and no-directory-request checks passed, and the temporary authority is inactive. #659 deploy `6a7ece87c5ca4d0007c1a3fc` completed its accessibility-only publication. Current live #685 deploy `6aa8c5b3fddd040009eba99c` preserves that exact inert directory surface. After a later approved connection, a signed-in person could choose one private profile thumbnail and, separately, choose whether the People finder may show their display name and thumbnail. A properly authorized officer could search by name and compare voluntary thumbnails visually. The system will not search a photo or recognize a face. **Approver:** membership lead, privacy owner, and platform/security owner. The privacy owner must approve the final notice and backup/removal wording before connected publication. @@ -2864,8 +2895,9 @@ flowchart TD Officer --> Search["Name field and Search button disabled"] Account --> None["No directory name or photo read, upload, remove, search, or save"] Search --> None - Release["#623 exact inert artifact published"] --> Preserve["#659 accessibility artifact preserves inert surface"] - Preserve --> Public["Completed signed-out revision and guard readback only"] + Release["#623 exact inert artifact published"] --> Preserve["#659 accessibility artifact preserved inert surface"] + Preserve --> Current["#685 meeting-notice artifact preserves inert surface"] + Current --> Public["Completed signed-out revision and guard readback only"] Public -. "does not prove protected layout" .-> Synthetic Hardening["#627 connected-interface hardening — SOURCE ONLY"] --> Preserved["Accessible Account and People finder branches preserved behind false availability"] Review["#629 connected photo review — SOURCE ONLY"] --> Draft["Generated valid image is read locally; centered-square draft says Selected photo — not uploaded yet"] @@ -2915,7 +2947,7 @@ flowchart TD Connected -. "never photo search or proof" .-> Official["Membership, role, payment, or official records"] ``` -Text alternative: the published #623 artifact, preserved by live #659 deploy `6a7ece87c5ca4d0007c1a3fc`, keeps the Account and administrator-guarded People-finder controls disabled; source-only #627 preserves the accessible connected layouts behind the unchanged false availability value; source-only #629 adds local photo review where Cancel sends nothing, Save alone sends the existing upload command, and the current saved photo remains authoritative with a version-reset unavailable fallback; source-only #631 distinguishes a `null` **No photo** result from an unrenderable supplied **Photo unavailable** result, retries a different later photo version, and lets completed local states clear the query, messages, cards, names, and images with an announcement, input focus, and no new request or service call; that Clear action does not cancel work, erase memory or cache, roll back an audit, or recall a seen result; source-only #633 makes **Remove current saved photo** preserve the same local reading or ready replacement through a confirmed authoritative remove, use the refreshed revision only when the person later chooses Save, focus a remaining Remove action before a ready Save action before the persistent file input, keep the draft after a definitive rejection with successful readback, and after an unknown outcome or failed readback discard its bytes, hide photo and finder mutation controls, and retain only the existing Reload settings recovery with no Save retry; source-only #635 keeps that uncertain-change warning through failed Reload settings attempts until one authoritative profile read succeeds, while generic load failures make no global no-change promise and reload sends no mutation; source-only #637 focuses the recovery action after user-initiated mutation or readback failure, binds a Reload focus intent to the exact current load before focusing a replacement after failure, never steals focus on an initial load failure, and keeps stale application, account, and unmounted completions focus-inert; source-only #639 admits a returned saved photo only when its canonical decoded bytes total 12 through 65,536 with `RIFF` at bytes 0–3 and `WEBP` at bytes 8–11, maps every other returned byte shape to one fixed byte-free failure before the Account image path, preserves the version-scoped **Photo unavailable** fallback and Remove action for structurally admitted bytes the browser cannot display, and leaves outbound uploads unchanged; source-only #641 records only the exact current input-or-Search focus origin after a valid search enters pending, restores that same now-enabled origin after cards, empty, or fixed failure only when native disablement left no meaningful focus, and preserves any other connected focus the user chose during the request; source-only #643 records only the exact current lifetime and removal operation when focused Remove enters pending, and after definitive rejection plus successful authoritative readback restores otherwise-lost focus to surviving Remove, a current ready Save, or the persistent file input without stealing deliberately moved connected focus or attaching the standalone rejection alert to a replacement target; source-only #645 records only the exact current lifetime, operation, and upload-or-remove action when focused Save or Remove enters pending, transfers it only after confirmed success plus current authoritative readback, restores otherwise-lost upload focus to the persistent file input or removal focus by the existing Remove, ready Save, then file-input priority, and preserves any other connected focus deliberately chosen during the mutation or readback; source-only #647 records only the exact current lifetime and visibility operation when the focused officer-finder checkbox enters pending, transfers that intent after confirmed success or definitive rejection only after current authoritative readback, restores otherwise-lost focus to the same connected and enabled checkbox without stealing another deliberately focused control, and consumes without focus when current name eligibility leaves the returned off checkbox disabled; source-only #649 puts the fixed **Profile photo and officer finder settings reloaded** polite atomic status first in recovered ready controls after every valid explicit current Reload success, restores otherwise-lost focus to its connected visibly outlined node only when that exact Reload owned focus and its exact current authoritative read succeeded, preserves any deliberately selected connected focus, shows the result without moving focus for a programmatic or unfocused Reload, and leaves initial/background success and failed Reloads on their existing paths; and only #507 may later connect name search plus voluntary thumbnails after privacy, authorization, staging, and backend-first readback, without photo search, face recognition, or official-record authority. +Text alternative: the published #623 artifact, first preserved by #659 deploy `6a7ece87c5ca4d0007c1a3fc` and now by live #685 deploy `6aa8c5b3fddd040009eba99c`, keeps the Account and administrator-guarded People-finder controls disabled; source-only #627 preserves the accessible connected layouts behind the unchanged false availability value; source-only #629 adds local photo review where Cancel sends nothing, Save alone sends the existing upload command, and the current saved photo remains authoritative with a version-reset unavailable fallback; source-only #631 distinguishes a `null` **No photo** result from an unrenderable supplied **Photo unavailable** result, retries a different later photo version, and lets completed local states clear the query, messages, cards, names, and images with an announcement, input focus, and no new request or service call; that Clear action does not cancel work, erase memory or cache, roll back an audit, or recall a seen result; source-only #633 makes **Remove current saved photo** preserve the same local reading or ready replacement through a confirmed authoritative remove, use the refreshed revision only when the person later chooses Save, focus a remaining Remove action before a ready Save action before the persistent file input, keep the draft after a definitive rejection with successful readback, and after an unknown outcome or failed readback discard its bytes, hide photo and finder mutation controls, and retain only the existing Reload settings recovery with no Save retry; source-only #635 keeps that uncertain-change warning through failed Reload settings attempts until one authoritative profile read succeeds, while generic load failures make no global no-change promise and reload sends no mutation; source-only #637 focuses the recovery action after user-initiated mutation or readback failure, binds a Reload focus intent to the exact current load before focusing a replacement after failure, never steals focus on an initial load failure, and keeps stale application, account, and unmounted completions focus-inert; source-only #639 admits a returned saved photo only when its canonical decoded bytes total 12 through 65,536 with `RIFF` at bytes 0–3 and `WEBP` at bytes 8–11, maps every other returned byte shape to one fixed byte-free failure before the Account image path, preserves the version-scoped **Photo unavailable** fallback and Remove action for structurally admitted bytes the browser cannot display, and leaves outbound uploads unchanged; source-only #641 records only the exact current input-or-Search focus origin after a valid search enters pending, restores that same now-enabled origin after cards, empty, or fixed failure only when native disablement left no meaningful focus, and preserves any other connected focus the user chose during the request; source-only #643 records only the exact current lifetime and removal operation when focused Remove enters pending, and after definitive rejection plus successful authoritative readback restores otherwise-lost focus to surviving Remove, a current ready Save, or the persistent file input without stealing deliberately moved connected focus or attaching the standalone rejection alert to a replacement target; source-only #645 records only the exact current lifetime, operation, and upload-or-remove action when focused Save or Remove enters pending, transfers it only after confirmed success plus current authoritative readback, restores otherwise-lost upload focus to the persistent file input or removal focus by the existing Remove, ready Save, then file-input priority, and preserves any other connected focus deliberately chosen during the mutation or readback; source-only #647 records only the exact current lifetime and visibility operation when the focused officer-finder checkbox enters pending, transfers that intent after confirmed success or definitive rejection only after current authoritative readback, restores otherwise-lost focus to the same connected and enabled checkbox without stealing another deliberately focused control, and consumes without focus when current name eligibility leaves the returned off checkbox disabled; source-only #649 puts the fixed **Profile photo and officer finder settings reloaded** polite atomic status first in recovered ready controls after every valid explicit current Reload success, restores otherwise-lost focus to its connected visibly outlined node only when that exact Reload owned focus and its exact current authoritative read succeeded, preserves any deliberately selected connected focus, shows the result without moving focus for a programmatic or unfocused Reload, and leaves initial/background success and failed Reloads on their existing paths; and only #507 may later connect name search plus voluntary thumbnails after privacy, authorization, staging, and backend-first readback, without photo search, face recognition, or official-record authority. Officer review steps for the #621 frontend preview: @@ -3017,7 +3049,7 @@ The section purpose, approvers, stop conditions, undo path, and escalation roles 1. Keep the complete profile-photo and People-finder feature marked **NOT AVAILABLE YET**. 2. Ask the platform owner for the exact #627 reviewed pull request, merge commit, and generated-only frontend test record. 3. Confirm the source-controlled availability value remains byte-for-byte `false`. -4. Confirm production deploy `6a7ece87c5ca4d0007c1a3fc` preserves the unchanged inert #623 preview from rollback deploy `6a7e072f8f346b0008510d29`. +4. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the unchanged inert directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback, and #623 deploy `6a7e072f8f346b0008510d29` is older history. 5. Confirm the tests use only made-up names and generated non-face images. 6. Confirm My Account supplies the current full display name to the preserved connected profile controls. 7. Confirm new opt-in uses the same bounded Unicode display-name eligibility as the private projection. @@ -3046,9 +3078,9 @@ The section purpose, approvers, stop conditions, undo path, and escalation roles 30. Confirm #627 changes no Function, Rule, index, service contract, package, workflow, release control, provider setting, account, sign-in state, or production data. 31. Record source change, tests, merge, preview, website publication, exact `runmprc.com` revision, Firebase, provider configuration, account/sign-in change, production data, and connected behavior as separate results. -**#627 expected result:** the reviewed source applies the projection's exact name-eligibility boundary to new opt-in, preserves turn-off after a name becomes ineligible, improves control and placeholder semantics, announces a non-empty search without a count, uses scoped readable colors, contains native controls at 320 pixels, and makes an older file read inert after its Account context changes. The availability value remains `false`. The default branch remains inert, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the unchanged inert #623 preview. Neither makes a directory request. The backend and connected behavior remain **NOT AVAILABLE YET**. A merge is not website publication. +**#627 expected result:** the reviewed source applies the projection's exact name-eligibility boundary to new opt-in, preserves turn-off after a name becomes ineligible, improves control and placeholder semantics, announces a non-empty search without a count, uses scoped readable colors, contains native controls at 320 pixels, and makes an older file read inert after its Account context changes. The availability value remains `false`. The default branch remains inert, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. Neither makes a directory request. The backend and connected behavior remain **NOT AVAILABLE YET**. A merge is not website publication. -**#627 success proof:** record the exact issue, reviewed pull request and merge commit, green focused and full frontend checks, type-checking, diagnostic production build, unchanged lint baseline, independent privacy/security, frontend/accessibility, and backup-officer GO reviews, and exact-main CI. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Record website publication, `runmprc.com` revision change, Firebase deployment, Rules or index change, provider configuration, account/sign-in change, production-data action, and connected behavior as **not performed**. Final connection and live proof remain #507 work. +**#627 success proof:** record the exact issue, reviewed pull request and merge commit, green focused and full frontend checks, type-checking, diagnostic production build, unchanged lint baseline, independent privacy/security, frontend/accessibility, and backup-officer GO reviews, and exact-main CI. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Record website publication, `runmprc.com` revision change, Firebase deployment, Rules or index change, provider configuration, account/sign-in change, production-data action, and connected behavior as **not performed**. Final connection and live proof remain #507 work. Officer review steps for MEMBERS-DIRECTORY-001F [#629] explicit photo review — connected source only, **NOT LIVE**: @@ -3061,7 +3093,7 @@ Officer review steps for MEMBERS-DIRECTORY-001F [#629] explicit photo review — 1. Keep the complete profile-photo and People-finder feature marked **NOT AVAILABLE YET**. 2. Ask the platform owner for the exact #629 issue, reviewed pull request, merge commit, and synthetic test record. 3. Confirm the source-controlled availability value remains byte-for-byte `false`. -4. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +4. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 5. Confirm the synthetic test uses a generated non-face image. 6. Select one supported generated image in the isolated connected-source test. 7. Confirm the browser validates and reads the selection locally. @@ -3134,11 +3166,11 @@ Officer review steps for MEMBERS-DIRECTORY-001F [#629] explicit photo review — 74. Record whether connected behavior became available. 75. Stop. Do not turn availability on, deploy a backend, publish the connected source, or use a real photo. -**Expected result:** selecting a valid generated image produces one centered-square local draft labeled **Selected photo — not uploaded yet** and sends nothing. A polite status announces when that local preview is ready. Cancel discards that draft, sends nothing, announces the result, and returns focus to the persistent file control. Save alone creates a request number, sends the existing revisioned upload request, and then refetches the authoritative processed thumbnail or no-photo fallback; confirmed Save also returns focus to the persistent Add or Replace photo control. Request-number failure or definitive rejection with successful readback retains the retryable draft; unknown or failed readback discards it and hides controls. A visibility save preserves it and refreshes the revision used by its later Save. The application does not use or expose the filename, stale reads and image events are inert, finder visibility is unchanged, and invalid or unreadable selections retain no draft. Unrenderable bytes are discarded and cannot be saved. A failed saved-thumbnail display uses a version-reset **Photo unavailable** fallback while Remove remains available. Availability remains `false`; live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 preview, and the backend remains unavailable. Connected behavior is **NOT AVAILABLE YET**. +**Expected result:** selecting a valid generated image produces one centered-square local draft labeled **Selected photo — not uploaded yet** and sends nothing. A polite status announces when that local preview is ready. Cancel discards that draft, sends nothing, announces the result, and returns focus to the persistent file control. Save alone creates a request number, sends the existing revisioned upload request, and then refetches the authoritative processed thumbnail or no-photo fallback; confirmed Save also returns focus to the persistent Add or Replace photo control. Request-number failure or definitive rejection with successful readback retains the retryable draft; unknown or failed readback discards it and hides controls. A visibility save preserves it and refreshes the revision used by its later Save. The application does not use or expose the filename, stale reads and image events are inert, finder visibility is unchanged, and invalid or unreadable selections retain no draft. Unrenderable bytes are discarded and cannot be saved. A failed saved-thumbnail display uses a version-reset **Photo unavailable** fallback while Remove remains available. Availability remains `false`; live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback, and the backend remains unavailable. Connected behavior is **NOT AVAILABLE YET**. **Stop conditions:** a real name or photo; a production sign-in; any photo request before explicit Save; a request number created by selection or Cancel; a filename read, retained, rendered, logged, sent, or exposed; an unknown-outcome or failed-readback draft retained; a retryable draft discarded after request-number failure or definitive rejection with successful readback; a stale draft rendered or sent after reselection, Cancel, unmount, application change, or account change; an invalid, unreadable, or unrenderable byte-bearing draft retained or savable; a saved-photo display failure that removes the Remove action or suppresses a new version; a photo change that alters finder visibility; a Firebase, Rule, index, Function, provider, account, sign-in, or production-data change; an availability flip; a connected website publication; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #629 issue, reviewed pull request and merge commit; green focused and full frontend checks; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer GO reviews; and exact-main CI. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Record website publication, `runmprc.com` revision change, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected behavior as **not performed**. Final backend connection and live proof remain #507 work. +**Success proof:** record the exact #629 issue, reviewed pull request and merge commit; green focused and full frontend checks; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer GO reviews; and exact-main CI. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Record website publication, `runmprc.com` revision change, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected behavior as **not performed**. Final backend connection and live proof remain #507 work. **Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase or production-data undo is needed because #629 changes source only. @@ -3160,7 +3192,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001G [#631] local People-f 6. Ask the platform owner for the written synthetic-behavior report. 7. Confirm the report names the platform owner or testing specialist who ran the test. 8. Confirm the source-controlled availability value remains byte-for-byte `false`. -9. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +9. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 10. Confirm the evidence uses only made-up names. 11. Confirm the evidence uses only generated non-face thumbnails. 12. Confirm the named test keeps the page behind the existing administrator guard. @@ -3219,11 +3251,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001G [#631] local People-f 65. Record whether connected or live People-finder behavior became available as its own state. 66. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source uses **No photo** only for a `null` photo and uses **Photo unavailable** when a supplied generated thumbnail cannot render. The failed image/data URL leaves the rendered page, and a different later photo version receives a fresh attempt. Clear is offered only after completed validation, empty results, fixed failure, or result cards. It removes the query and prior displayed message, headings, cards, names, and images, uses the persistent polite status region to announce **Search field and displayed result cards cleared.**, focuses the persistent input, creates no request number, and makes no directory-service call. It is not available while idle or pending. Availability remains `false`; the default branch remains inert, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 preview. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source uses **No photo** only for a `null` photo and uses **Photo unavailable** when a supplied generated thumbnail cannot render. The failed image/data URL leaves the rendered page, and a different later photo version receives a fresh attempt. Clear is offered only after completed validation, empty results, fixed failure, or result cards. It removes the query and prior displayed message, headings, cards, names, and images, uses the persistent polite status region to announce **Search field and displayed result cards cleared.**, focuses the persistent input, creates no request number, and makes no directory-service call. It is not available while idle or pending. Availability remains `false`; the default branch remains inert, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real name or photo; a face or photo query; production sign-in; direct production Firebase access; Clear offered while idle, pending, or in the disabled preview; a new request number or service call caused by Clear; a failed supplied image that remains in the page or is mislabeled **No photo**; a later photo version that inherits an older failure; a query, prior message, result heading, card, name, image, or image data URL that remains displayed after Clear; missing input focus; an availability flip; a Function, Rule, index, schema, provider, account, sign-in, production-data, or website change; or a claim that local Clear cancels network work, erases browser memory/cache, rolls back the query-free audit, or recalls a result already returned, seen, or captured. -**Success proof:** record the exact #631 issue, reviewed pull request and commit; green separately named MEMBERS-DIRECTORY-001G focused tests; green full frontend tests; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #631 issue, reviewed pull request and commit; green separately named MEMBERS-DIRECTORY-001G focused tests; green full frontend tests; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #631 changes source only. Undo cannot recall a result already seen or captured and must not alter the query-free audit. @@ -3247,7 +3279,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001H [#633] reviewed-repla 8. Confirm the evidence uses only a made-up account. 9. Confirm the evidence uses only generated non-face images. 10. Confirm the source-controlled availability value remains byte-for-byte `false`. -11. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +11. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 12. Confirm the destructive action is named **Remove current saved photo**. 13. Confirm that label distinguishes the saved thumbnail from the local replacement. 14. Confirm selecting a replacement creates no upload request number. @@ -3304,21 +3336,21 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001H [#633] reviewed-repla 65. Record whether connected behavior became available as its own state. 66. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source clearly separates **Remove current saved photo** from the local replacement. Confirmed removal and authoritative readback preserve the same current reading or ready draft while updating the saved-photo state and revision. A later explicit Save sends the preserved content type and bytes once against that refreshed revision. Definitive rejection plus successful readback keeps the draft and associates the fixed error with Remove. Unknown outcome or failed readback discards the draft and data URL, hides the photo and finder mutation controls, retains only the existing **Reload settings** recovery, and offers no Save or duplicate-mutation retry. Focus moves to a still-current Remove action first, an eligible Save action second, or the persistent Add/Replace input otherwise. Finder visibility stays unchanged. Stale completions remain inert. Availability remains `false`; the default branch remains inert, and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 preview. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source clearly separates **Remove current saved photo** from the local replacement. Confirmed removal and authoritative readback preserve the same current reading or ready draft while updating the saved-photo state and revision. A later explicit Save sends the preserved content type and bytes once against that refreshed revision. Definitive rejection plus successful readback keeps the draft and associates the fixed error with Remove. Unknown outcome or failed readback discards the draft and data URL, hides the photo and finder mutation controls, retains only the existing **Reload settings** recovery, and offers no Save or duplicate-mutation retry. Focus moves to a still-current Remove action first, an eligible Save action second, or the persistent Add/Replace input otherwise. Finder visibility stays unchanged. Stale completions remain inert. Availability remains `false`; the default branch remains inert, and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account or photo; production sign-in; a replacement upload before explicit Save; a local draft lost after confirmed removal; a draft retained after an unknown outcome or failed readback; a discarded data URL left in the page; Save using the pre-remove revision; duplicate upload; focus sent to a missing or stale control; an older reader, mutation, or readback restoring bytes, state, focus, or a service call in another context; a photo change that alters finder visibility; a Firebase, Rule, index, Function, service-contract, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #633 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001H focused tests; green full frontend tests; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #633 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001H focused tests; green full frontend tests; type-checking; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #633 changes source only. Undo must not retain or restore a stale local draft. **Escalation:** membership lead plus privacy and platform/security owners. Use the private incident path if a real photo appeared, a replacement was uploaded without explicit Save, draft bytes survived an unknown state, finder visibility changed, or connected behavior became available. -**Expected result:** production deploy `6a7ece87c5ca4d0007c1a3fc` preserves the #623 visibly disabled preview from rollback deploy `6a7e072f8f346b0008510d29`. It makes zero directory calls, accepts no file or name, and shows no person. Separate synthetic tests prove the protected disabled layouts and preserved connected source. Completed signed-out public readback proves only the exact revision, normal guards, and absence of a member-directory request. The backend and connected behavior remain unavailable. There is no public directory, official roster, public photo URL, Firebase Storage object, photo-as-query path, face recognition, similarity score, embedding, biometric template, export, result total, or pagination. +**Expected result:** live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the visibly disabled directory preview from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback, and #623 deploy `6a7e072f8f346b0008510d29` is older history. The live artifact makes zero directory calls, accepts no file or name, and shows no person. Separate synthetic tests prove the protected disabled layouts and preserved connected source. Completed signed-out public readback proves only the exact revision, normal guards, and absence of a member-directory request. The backend and connected behavior remain unavailable. There is no public directory, official roster, public photo URL, Firebase Storage object, photo-as-query path, face recognition, similarity score, embedding, biometric template, export, result total, or pagination. **Stop conditions:** an enabled preview control; a preview that reads saved directory state, accepts a file or finder name, creates a directory request number, calls a directory service, or shows a sample or result card; a real person, name, photo, member record, production sign-in, direct production Firebase access, production data change, or member-directory callable request; a public/permanent photo URL; an upload that silently opts in; a result from a search transaction ordered after completed opt-out; a notice that fails to explain that an earlier-committed response may still arrive; raw image, name, query, result identity, or provider detail in a log, issue, screenshot, message, email, or AI tool; a request for photo search, face recognition, similarity matching, or biometric processing; missing privacy approval for connected publication; an unreviewed availability flip; or a claim that source, tests, merge, frontend publication, or preview means the backend feature is live. -**Success proof:** record the exact #505, #506, and #621 pull requests and merge commits; green focused and full checks; dependency review; independent privacy/security and backup-officer reviews; and explicit statements that Firebase, providers, accounts/sign-in, and production data were unchanged. Preserve the full #623 record: preview deploy `6a7e05febf8fde00084cf9e0`, preview head `1fdb31f71fcaf01c33b5e57a4cd28fc473a4a737`, PR CI `31728469418`, release merge `9d5cc8612b4321172370bd949d307e7e4ac0ec7d`, exact-main CI `31728908486`, production deploy `6a7e072f8f346b0008510d29`, exact public marker, signed-out guards, anonymous no-connected-symbol/request result, repause head `d401daa409176dce0906c245adf3f20310cb513b`, repause PR CI `31728977578`, repause merge `c8678c623afdd9becf77d596b71f36f26f04b746`, repause exact-main CI `31729248865`, unpublished attempt `6a7e081e73fdd60009f7ba57`, and retained-deploy readback. Also record that #659 live deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert surface and that its manifest is inactive after unpublished repause attempt `6a7ed0ddb00a46000818878d`. Synthetic artifacts and tests prove only the disabled protected layouts and default zero-directory-call branches. Publication and anonymous readback prove only the exact revision, signed-out guards, and absence of a public member-directory request. Record separately that the privacy notice, Firebase/backend deployment, provider configuration, account/sign-in change, production-data action, connected behavior, and live directory were not performed. Final connected live proof belongs to #507. +**Success proof:** record the exact #505, #506, and #621 pull requests and merge commits; green focused and full checks; dependency review; independent privacy/security and backup-officer reviews; and explicit statements that Firebase, providers, accounts/sign-in, and production data were unchanged. Preserve the full #623 record: preview deploy `6a7e05febf8fde00084cf9e0`, preview head `1fdb31f71fcaf01c33b5e57a4cd28fc473a4a737`, PR CI `31728469418`, release merge `9d5cc8612b4321172370bd949d307e7e4ac0ec7d`, exact-main CI `31728908486`, production deploy `6a7e072f8f346b0008510d29`, exact public marker, signed-out guards, anonymous no-connected-symbol/request result, repause head `d401daa409176dce0906c245adf3f20310cb513b`, repause PR CI `31728977578`, repause merge `c8678c623afdd9becf77d596b71f36f26f04b746`, repause exact-main CI `31729248865`, unpublished attempt `6a7e081e73fdd60009f7ba57`, and retained-deploy readback. Also preserve the historical record that #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserved the inert surface and its manifest became inactive after unpublished repause attempt `6a7ed0ddb00a46000818878d`. Current live #685 deploy `6aa8c5b3fddd040009eba99c` preserves that inert surface; #659 is immediate rollback. Synthetic artifacts and tests prove only the disabled protected layouts and default zero-directory-call branches. Publication and anonymous readback prove only the exact revision, signed-out guards, and absence of a public member-directory request. Record separately that the privacy notice, Firebase/backend deployment, provider configuration, account/sign-in change, production-data action, connected behavior, and live directory were not performed. Final connected live proof belongs to #507. **Undo:** before or after frontend-preview publication, use one reviewed frontend revert or safe roll-forward and read back the exact disabled state. The #621 preview changes no Firebase record to undo. After a future approved backend release, use the documented backend-first release path and verify opt-out/removal with a made-up account. Never undo by deleting or editing a real account or Firebase record manually. @@ -3342,7 +3374,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001I [#635] uncertain-chan 8. Confirm the evidence uses only a made-up account. 9. Confirm the evidence uses only generated non-face image bytes. 10. Confirm the source-controlled availability value remains byte-for-byte `false`. -11. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +11. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 12. Confirm an ordinary unknown visibility, upload, or removal outcome displays **We could not confirm that change**. 13. Confirm a failed authoritative read after a resolved mutation displays the same warning. 14. Confirm each warning tells the person not to make another change yet. @@ -3387,11 +3419,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001I [#635] uncertain-chan 53. Record whether connected behavior became available as its own state. 54. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source preserves the fixed uncertain-change warning through failed and repeated **Reload settings** reads until one authoritative profile read succeeds. Mutation controls and discarded draft bytes stay absent while the outcome is uncertain. A successful read displays the returned current profile state. Initial profile-load failure and failed confirming read after definitive rejection remain generic unavailable without a global no-change promise. Reload creates no request ID, sends no visibility, upload, or removal mutation, and starts no mutation retry. Application and account lifetime fences keep older reloads inert. Availability remains `false`; the default branch obtains no directory context, creates no request ID, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source preserves the fixed uncertain-change warning through failed and repeated **Reload settings** reads until one authoritative profile read succeeds. Mutation controls and discarded draft bytes stay absent while the outcome is uncertain. A successful read displays the returned current profile state. Initial profile-load failure and failed confirming read after definitive rejection remain generic unavailable without a global no-change promise. Reload creates no request ID, sends no visibility, upload, or removal mutation, and starts no mutation retry. Application and account lifetime fences keep older reloads inert. Availability remains `false`; the default branch obtains no directory context, creates no request ID, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a failed Reload that replaces uncertain-change truth with generic unavailable or **No setting was changed**; an initial or definitive-rejection load failure mislabeled as known mutation uncertainty; a discarded draft or data URL restored; a mutation control shown while uncertainty remains; a request number or visibility, upload, or removal mutation caused by Reload; an automatic mutation retry; an older reload changing a new application or account state; a data-flow or page-structure change; a Function, Rule, index, schema, service-contract, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #635 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001I focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/state, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #635 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001I focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/state, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #635 changes source only. Undo must not introduce a false no-change assurance or restore discarded draft bytes. @@ -3416,7 +3448,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001J [#637] profile-recove 9. Confirm the evidence uses only a made-up account. 10. Confirm the evidence uses only generated non-face image bytes. 11. Confirm the source-controlled availability value remains byte-for-byte `false`. -12. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +12. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 13. Confirm an ordinary unknown visibility outcome focuses **Reload settings**. 14. Confirm an ordinary unknown upload outcome focuses **Reload settings**. 15. Confirm an ordinary unknown removal outcome focuses **Reload settings**. @@ -3474,11 +3506,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001J [#637] profile-recove 67. Record whether connected behavior became available as its own state. 68. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source focuses **Reload settings** after an ordinary unknown visibility, upload, or removal outcome; failed authoritative post-mutation readback; or failed confirming read after definitive rejection. A Reload-created focus intent belongs to the same mounted application-and-account lifetime and is bound to that exact load. Each guarded failed Reload focuses its replacement recovery action. Initial load failure does not steal focus. Successful authoritative reload clears the intent without redirecting focus to an unrelated ready control. Application change, account change, unmount, and stale completion remain focus-inert. The focus handoff creates no request ID, extra service call, mutation, automatic retry, restored draft, or data URL. Existing uncertainty and generic failure truth remain unchanged. Availability remains `false`; the default branch obtains no directory context, creates no request ID, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source focuses **Reload settings** after an ordinary unknown visibility, upload, or removal outcome; failed authoritative post-mutation readback; or failed confirming read after definitive rejection. A Reload-created focus intent belongs to the same mounted application-and-account lifetime and is bound to that exact load. Each guarded failed Reload focuses its replacement recovery action. Initial load failure does not steal focus. Successful authoritative reload clears the intent without redirecting focus to an unrelated ready control. Application change, account change, unmount, and stale completion remain focus-inert. The focus handoff creates no request ID, extra service call, mutation, automatic retry, restored draft, or data URL. Existing uncertainty and generic failure truth remain unchanged. Availability remains `false`; the default branch obtains no directory context, creates no request ID, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a user-initiated mutation or readback failure whose rendered **Reload settings** action is not focused; a failed Reload whose replacement **Reload settings** action is not focused; an initial load failure that steals unrelated focus; a successful Reload that redirects focus to an unrelated ready control; an older load, application, account, or unmounted completion that moves focus; a request number or visibility, upload, or removal mutation caused by Reload; an automatic mutation retry; a restored draft or data URL; changed uncertainty or generic failure wording; a data-flow or page-structure change; a Function, Rule, index, schema, service-contract, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #637 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001J focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #637 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001J focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #637 changes source only. Undo must not strand focus after a user-initiated recovery transition or permit a stale completion to move focus. @@ -3503,7 +3535,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001K [#639] saved-photo re 9. Confirm the evidence uses only a made-up account. 10. Confirm the evidence uses only generated non-face image bytes. 11. Confirm the source-controlled availability value remains byte-for-byte `false`. -12. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +12. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 13. Confirm the named bridge imports the actual Account profile component. 14. Confirm the named bridge imports the actual member-directory service. 15. Confirm the named bridge mocks only Firebase Functions transport. @@ -3574,11 +3606,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001K [#639] saved-photo re 80. Record whether connected behavior became available as its own state. 81. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source admits an inbound returned saved photo only when its existing exact object, WebP MIME, dimensions, and version contract contains canonical decoded bytes from 12 through 65,536 with `RIFF` at bytes 0–3 and `WEBP` at bytes 8–11. Other returned bytes become only **Invalid member directory response.** and the generic unavailable Account state without a saved-thumbnail image, data URL, raw bytes, provider value, caught detail, or log. Structural admission is not full decoding. If the browser cannot display admitted bytes, the image and data URL leave the page, the version-scoped byte-free **Photo unavailable** fallback appears, and **Remove current saved photo** remains enabled without another callable. Outbound JPG, PNG, and WebP admission and exact upload bytes remain unchanged. Availability remains `false`; the default branch obtains no directory-service context, creates no request number, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source admits an inbound returned saved photo only when its existing exact object, WebP MIME, dimensions, and version contract contains canonical decoded bytes from 12 through 65,536 with `RIFF` at bytes 0–3 and `WEBP` at bytes 8–11. Other returned bytes become only **Invalid member directory response.** and the generic unavailable Account state without a saved-thumbnail image, data URL, raw bytes, provider value, caught detail, or log. Structural admission is not full decoding. If the browser cannot display admitted bytes, the image and data URL leave the page, the version-scoped byte-free **Photo unavailable** fallback appears, and **Remove current saved photo** remains enabled without another callable. Outbound JPG, PNG, and WebP admission and exact upload bytes remain unchanged. Availability remains `false`; the default branch obtains no directory-service context, creates no request number, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; malformed returned bytes that create a saved-thumbnail image or data URL; a rejection that renders or logs raw bytes, a provider value, or caught detail; admitted bytes outside 12 through 65,536; missing `RIFF` or `WEBP` checks; a browser decode failure that leaves the data URL rendered, omits **Photo unavailable**, or removes the Remove action; an extra callable caused by image failure; changed outbound JPG, PNG, or WebP admission or bytes; a photo query; face recognition, matching, embedding, similarity scoring, or biometric processing; a Function, Rule, index, schema, package, workflow, release-control, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #639 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001K focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend, response-contract, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #639 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001K focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend, response-contract, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed service-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #639 changes source only. Undo must not turn clearly mislabeled returned bytes into a saved-thumbnail image or change outbound upload bytes. @@ -3604,7 +3636,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001L [#641] People-finder 10. Confirm the evidence uses only made-up names. 11. Confirm any image evidence uses generated non-face data. 12. Confirm the source-controlled availability value remains byte-for-byte `false`. -13. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +13. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 14. Confirm a valid query must pass before a focus intent can exist. 15. Confirm request-number creation must succeed before a focus intent can exist. 16. Confirm the current search must enter its pending state before a focus intent can exist. @@ -3680,11 +3712,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001L [#641] People-finder 86. Record whether connected or live People-finder behavior became available as its own state. 87. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source records only an exact-operation name-input or Search-button focus intent after a valid query and request number admit one pending search. Current result cards, empty results, and fixed failure consume that intent after render. The already-focused origin remains focused. Focus evicted to the document body, root, no active element, or a disconnected element returns to the same now-enabled origin. Another connected control deliberately focused during pending keeps focus. Programmatic or outside-focused submit, local validation failure, and request-number failure create no intent. Editing, Clear, application or administrator change, unmount, and obsolete resolution or rejection prevent stale focus movement. Clear keeps its existing local disposal, input focus, and zero-call behavior. Focus creates no request number, extra search, retry, Clear action, result, audit, service call, or data URL. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source records only an exact-operation name-input or Search-button focus intent after a valid query and request number admit one pending search. Current result cards, empty results, and fixed failure consume that intent after render. The already-focused origin remains focused. Focus evicted to the document body, root, no active element, or a disconnected element returns to the same now-enabled origin. Another connected control deliberately focused during pending keeps focus. Programmatic or outside-focused submit, local validation failure, and request-number failure create no intent. Editing, Clear, application or administrator change, unmount, and obsolete resolution or rejection prevent stale focus movement. Clear keeps its existing local disposal, input focus, and zero-call behavior. Focus creates no request number, extra search, retry, Clear action, result, audit, service call, or data URL. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a current input- or Search-origin search that leaves focus on the document body after cards, empty, or fixed failure; settlement that moves focus away from another connected control; programmatic submission that steals outside focus; validation or request-number failure that disables controls or starts a search; an application, administrator, unmounted, or obsolete completion that moves focus; a second request number, search, retry, Clear action, result, audit, service call, or data URL caused by focus; changed normalization, response, result, thumbnail, fixed-error, disposal, or guard behavior; a photo query; face recognition, matching, embedding, similarity scoring, biometric processing, total, export, roster authority, or membership proof; a Function, Rule, index, schema, package, workflow, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #641 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001L focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #641 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001L focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #641 changes source only. Undo must not strand focus after native pending-control eviction or permit a stale completion to move focus. @@ -3708,7 +3740,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001M [#643] rejected-remov 8. Confirm the report names the specialist who ran the tests. 9. Confirm every image fixture is generated non-face data. 10. Confirm the source-controlled availability value remains byte-for-byte `false`. -11. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +11. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 12. Confirm request-number creation must succeed before a rejected-removal focus intent can exist. 13. Confirm the exact current Remove operation must enter `pending` before the intent can exist. 14. Confirm **Remove current saved photo** must own focus when that operation enters `pending`. @@ -3779,11 +3811,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001M [#643] rejected-remov 79. Record whether connected or live profile-photo behavior became available as its own state. 80. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source creates a pending rejected-removal focus intent only after request-number creation and admitted pending removal while **Remove current saved photo** owns focus. That intent contains only the current mounted application-and-account lifetime and exact operation identity. Definitive rejection plus a current successful authoritative readback transfers the matching intent to result ownership, and the ready render consumes it. A current saved photo selects surviving Remove; otherwise an exact current ready draft selects enabled Save; otherwise the persistent Add/Replace input is selected for no, reading, or not-yet-ready draft. Focus returns from the document body, document root, no active element, or a disconnected element, but an already-focused target is left alone and any other connected focus deliberately chosen during pending is preserved. Surviving Remove alone describes the fixed rejection. If Remove disappears, the rejection remains a standalone alert and is not associated with Save or the file input; destination focus does not claim success or deletion proof. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, confirmed success, unknown outcome, failed confirming read, application or account change, unmount, and obsolete completion create no intent or clear or fail its guards. Existing confirmed-removal and #637 Reload focus behavior remains unchanged. Focus creates no request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source creates a pending rejected-removal focus intent only after request-number creation and admitted pending removal while **Remove current saved photo** owns focus. That intent contains only the current mounted application-and-account lifetime and exact operation identity. Definitive rejection plus a current successful authoritative readback transfers the matching intent to result ownership, and the ready render consumes it. A current saved photo selects surviving Remove; otherwise an exact current ready draft selects enabled Save; otherwise the persistent Add/Replace input is selected for no, reading, or not-yet-ready draft. Focus returns from the document body, document root, no active element, or a disconnected element, but an already-focused target is left alone and any other connected focus deliberately chosen during pending is preserved. Surviving Remove alone describes the fixed rejection. If Remove disappears, the rejection remains a standalone alert and is not associated with Save or the file input; destination focus does not claim success or deletion proof. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, confirmed success, unknown outcome, failed confirming read, application or account change, unmount, and obsolete completion create no intent or clear or fail its guards. Existing confirmed-removal and #637 Reload focus behavior remains unchanged. Focus creates no request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a focused current Remove action that disappears after definitive rejection and current successful readback while focus remains on the document body; a ready current replacement that does not select Save; a no, reading, or not-yet-ready draft that does not select the persistent file input; a settlement that steals another connected focus; an outside-focused invocation or request-number failure that creates an intent; a standalone rejection attached to Save or the file input; focus represented as removal success or deletion proof; a failed confirming read or unknown outcome that bypasses Reload recovery; an application, account, unmounted, or obsolete completion that moves focus; a second request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action caused by focus; changed draft, confirmed-removal, or #637 recovery behavior; a photo query; face recognition, matching, embedding, similarity scoring, biometric processing, roster authority, or membership proof; a Function, Rule, index, schema, package, workflow, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, or merge means the feature is live. -**Success proof:** record the exact #643 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001M focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #643 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001M focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #643 changes source only. Undo must not leave otherwise-lost focus on the document body after the current rejected-removal readback or misassociate the standalone rejection with a replacement action. @@ -3807,7 +3839,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001N [#645] confirmed-phot 8. Confirm the report names the specialist who ran the tests. 9. Confirm every image fixture is generated non-face data. 10. Confirm the source-controlled availability value remains byte-for-byte `false`. -11. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +11. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 12. Confirm request-number creation must succeed before a confirmed-photo focus intent can exist. 13. Confirm the exact upload or removal operation must enter `pending` before the intent can exist. 14. Confirm **Save profile photo** must own focus when an upload operation enters `pending`. @@ -3884,11 +3916,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001N [#645] confirmed-phot 85. Record whether connected or live profile-photo behavior became available as its own state. 86. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source records one pending confirmed-photo focus intent only after request-number creation and admitted pending upload or removal while the exact Save or Remove initiating action owns focus. The intent contains only the current mounted application-and-account lifetime, exact operation identity, and upload-or-remove action. Successful mutation plus a current successful authoritative profile read transfers only the matching intent to one ready render. Confirmed upload selects the persistent file input. Confirmed removal selects surviving Remove first, exact current ready Save second, or the persistent file input otherwise. Focus returns from the document body, document root, no active element, or a disconnected element, but an already-focused destination is left alone and any other connected focus deliberately chosen during mutation or readback is preserved. The result is consumed once. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, definitive rejection, unknown outcome, failed readback, application or account change, unmount, and obsolete completion create no intent or clear or fail its guards. #643 rejected-removal behavior and #637 Reload recovery remain separate. Focus creates no request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source records one pending confirmed-photo focus intent only after request-number creation and admitted pending upload or removal while the exact Save or Remove initiating action owns focus. The intent contains only the current mounted application-and-account lifetime, exact operation identity, and upload-or-remove action. Successful mutation plus a current successful authoritative profile read transfers only the matching intent to one ready render. Confirmed upload selects the persistent file input. Confirmed removal selects surviving Remove first, exact current ready Save second, or the persistent file input otherwise. Focus returns from the document body, document root, no active element, or a disconnected element, but an already-focused destination is left alone and any other connected focus deliberately chosen during mutation or readback is preserved. The result is consumed once. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, definitive rejection, unknown outcome, failed readback, application or account change, unmount, and obsolete completion create no intent or clear or fail its guards. #643 rejected-removal behavior and #637 Reload recovery remain separate. Focus creates no request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a focused current Save or Remove action that is displaced while confirmed work settles but never yields its current destination; settlement that moves focus away from another connected control; an outside-focused or programmatic invocation that creates an intent; an intent that records a profile, revision, request number, photo byte, data URL, provider value, response, or error; a transfer before successful current authoritative readback; changed upload or removal destination order; delayed focus during an unrelated later render; a definitive rejection that uses confirmed-success focus; an unknown outcome or failed readback that bypasses Reload recovery; an application, account, unmounted, or obsolete completion that moves focus; an extra request number, callable, retry, mutation, draft, data URL, confirmation, audit, provider action, or data action caused by focus; changed calls, bytes, revisions, confirmation copy, draft behavior, #643 behavior, or #637 behavior; a photo query; facial recognition, matching, embedding, similarity scoring, biometric processing, roster authority, or membership proof; a People-finder, visibility, service-contract, Function, Rule, index, schema, package, workflow, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, or a preview means the feature is live. -**Success proof:** record the exact #645 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001N focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #645 issue, reviewed pull request and commit; trustworthy old-source failure; green separately named MEMBERS-DIRECTORY-001N focused tests; green full frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #645 changes source only. Undo must not restore unconditional confirmed-photo focus or weaken #643 rejected-removal focus and #637 Reload recovery. @@ -3913,7 +3945,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001O [#647] visibility foc 9. Confirm every account and name in the evidence is made up. 10. Confirm no real photo appears in the evidence. 11. Confirm the source-controlled availability value remains byte-for-byte `false`. -12. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +12. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 13. Confirm request-number creation must succeed before a visibility focus intent can exist. 14. Confirm the visibility operation must enter `pending` before the intent can exist. 15. Confirm the exact officer-finder checkbox must own focus when the operation enters `pending`. @@ -3999,11 +4031,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001O [#647] visibility foc 95. Record whether connected or live profile-photo or officer-finder behavior became available as its own state. 96. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** the reviewed connected source creates one pending visibility focus intent only after request-number creation and admitted pending visibility while the exact officer-finder checkbox owns focus. The intent contains only the current mounted application-and-account lifetime and exact operation identity. Confirmed success plus a current successful authoritative read, or definitive rejection plus a current successful confirming read, transfers only the matching intent to one ready render. That render consumes the result once. Body, document-root, absent, or disconnected focus returns only to the same connected and enabled checkbox. A checkbox that retained focus is left alone. Any other connected focus deliberately chosen during mutation or readback is preserved. A returned off checkbox disabled by current name eligibility consumes the result without focus. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, unknown outcome, failed readback, application or account change, unmount, and obsolete mutation or readback completion create no result or clear or fail its guards. #637 Reload recovery, #643 rejected-removal focus, and #645 confirmed-photo focus remain separate. Focus creates no request number, read, mutation, retry, audit, result, draft, photo byte, data URL, provider action, or data action beyond the already admitted operation. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface. The backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** the reviewed connected source creates one pending visibility focus intent only after request-number creation and admitted pending visibility while the exact officer-finder checkbox owns focus. The intent contains only the current mounted application-and-account lifetime and exact operation identity. Confirmed success plus a current successful authoritative read, or definitive rejection plus a current successful confirming read, transfers only the matching intent to one ready render. That render consumes the result once. Body, document-root, absent, or disconnected focus returns only to the same connected and enabled checkbox. A checkbox that retained focus is left alone. Any other connected focus deliberately chosen during mutation or readback is preserved. A returned off checkbox disabled by current name eligibility consumes the result without focus. Programmatic or outside-focused invocation, request-number failure, failed mutation admission, unknown outcome, failed readback, application or account change, unmount, and obsolete mutation or readback completion create no result or clear or fail its guards. #637 Reload recovery, #643 rejected-removal focus, and #645 confirmed-photo focus remain separate. Focus creates no request number, read, mutation, retry, audit, result, draft, photo byte, data URL, provider action, or data action beyond the already admitted operation. Availability remains `false`; the default branch obtains no directory context, creates no request number, and calls no directory service; and live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. The backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; a focused current checkbox that loses focus during confirmed success or definitive rejection plus current successful readback and never regains it while enabled; focus placed on a returned disabled checkbox; settlement that moves focus away from another connected control; an outside-focused or programmatic invocation that creates an intent; an intent that records a query, name, profile, revision, request number, result, error, provider value, photo byte, or data URL; a transfer before successful current authoritative readback; delayed focus during a later unrelated render; an unknown outcome or failed readback that bypasses Reload recovery; an application, account, unmounted, or obsolete completion that moves focus; an extra request number, read, mutation, retry, audit, result, draft, photo byte, data URL, provider action, or data action caused by focus; changed errors, confirmations, revisions, native pending disablement, #637, #643, or #645 behavior; a photo query; facial recognition, matching, embedding, similarity scoring, biometric processing, total, export, roster authority, or membership proof; a People-finder, service-contract, Function, Rule, index, schema, package, workflow, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, or a preview means the feature is live. -**Success proof:** record the exact #647 issue, reviewed pull request and commit; trustworthy unchanged-runtime named failure; green 21-test MEMBERS-DIRECTORY-001O block; green full component and frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #647 issue, reviewed pull request and commit; trustworthy unchanged-runtime named failure; green 21-test MEMBERS-DIRECTORY-001O block; green full component and frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #647 changes source only. Undo must not restore lost visibility-checkbox focus after authoritative settlement or weaken #637, #643, or #645 focus containment. @@ -4029,7 +4061,7 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001P [#649] successful Rel 10. Confirm every account and name in the evidence is made up. 11. Confirm no real photo appears in the evidence. 12. Confirm the source-controlled availability value remains byte-for-byte `false`. -13. Confirm live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 directory surface and literal `false` availability. +13. Confirm live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623 and literal `false` availability; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback. 14. Confirm the successful result says exactly **Profile photo and officer finder settings reloaded.**. 15. Confirm every valid explicit current Reload with a successful guarded authoritative read shows that result. 16. Confirm the result is the first child of the recovered ready-controls region. @@ -4110,11 +4142,11 @@ Officer source-review procedure for MEMBERS-DIRECTORY-001P [#649] successful Rel 91. Record whether connected or live profile-photo or officer-finder behavior became available as its own state. 92. Stop before changing availability, Firebase, a provider, an account, production data, or the live website. -**Expected result:** every valid explicit current Reload followed by a guarded successful authoritative profile read renders exactly **Profile photo and officer finder settings reloaded.** as the first child of the recovered ready controls, with status, polite live, atomic, programmatic-focus, and visible-outline semantics. The result proves only that the read completed. An exact focused Reload records only the current lifetime and load identity, and only its matching current success may transfer that intent. One ready effect consumes the intent before target checks. Body, document-root, absent, or disconnected focus returns to the connected result; retained result focus is left alone; and any other connected focus deliberately chosen during the read is preserved. A programmatic or unfocused valid Reload shows the result without moving focus. Initial/background success shows no result. Failure shows no success result and retains #637 replacement-Reload focus. Application change, account change, unmount, a new load, obsolete completion, and later rerender cannot reuse the handoff. The result creates no request number, extra read, mutation, retry, audit, draft, photo byte, data URL, provider action, or data action. Availability remains `false`; the default branch obtains no directory-service context, creates no request number, and calls no directory service; live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623 surface; and the backend and connected behavior remain **NOT AVAILABLE YET**. +**Expected result:** every valid explicit current Reload followed by a guarded successful authoritative profile read renders exactly **Profile photo and officer finder settings reloaded.** as the first child of the recovered ready controls, with status, polite live, atomic, programmatic-focus, and visible-outline semantics. The result proves only that the read completed. An exact focused Reload records only the current lifetime and load identity, and only its matching current success may transfer that intent. One ready effect consumes the intent before target checks. Body, document-root, absent, or disconnected focus returns to the connected result; retained result focus is left alone; and any other connected focus deliberately chosen during the read is preserved. A programmatic or unfocused valid Reload shows the result without moving focus. Initial/background success shows no result. Failure shows no success result and retains #637 replacement-Reload focus. Application change, account change, unmount, a new load, obsolete completion, and later rerender cannot reuse the handoff. The result creates no request number, extra read, mutation, retry, audit, draft, photo byte, data URL, provider action, or data action. Availability remains `false`; the default branch obtains no directory-service context, creates no request number, and calls no directory service; live #685 deploy `6aa8c5b3fddd040009eba99c` preserves the inert directory surface from #659 and #623; #659 deploy `6a7ece87c5ca4d0007c1a3fc` is immediate rollback; and the backend and connected behavior remain **NOT AVAILABLE YET**. **Stop conditions:** a real account, name, or photo; production sign-in; direct production Firebase access; missing or changed successful-Reload copy; a result outside the first recovered ready-controls position; missing status, live, atomic, programmatic-focus, or visible-outline semantics; a result that claims an earlier change succeeded or failed; a result shown for initial/background success or failed Reload; a focused exact current Reload whose successful result receives no otherwise-lost focus; an outside-focused or programmatic invocation that creates an intent; a connected outside or in-profile control that loses deliberately selected focus; an intent that records a UID, query, name, profile, revision, request number, result, error, provider value, photo byte, or data URL; transfer before matching current authoritative success; delayed focus during a later render; an application, account, unmounted, new-load, or obsolete completion that moves focus or renders an old result; an extra request number, read, mutation, retry, audit, draft, photo byte, data URL, provider action, or data action; changed #637, #643, #645, or #647 behavior; a photo query; facial recognition, matching, embedding, similarity scoring, biometric processing, total, export, roster authority, or membership proof; a People-finder, service-contract, Function, Rule, index, schema, package, workflow, permission, ownership, provider, account, sign-in, production-data, or website change; an availability flip; use of a terminal or test harness by the backup officer; or a claim that source, tests, merge, or a preview means the feature is live. -**Success proof:** record the exact #649 issue, reviewed pull request and commit; trustworthy old-source named result with 8 failures and 5 passes; green 15-of-15 MEMBERS-DIRECTORY-001P block; green full component and frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #659 deploy `6a7ece87c5ca4d0007c1a3fc`, and preserved #623 rollback deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. +**Success proof:** record the exact #649 issue, reviewed pull request and commit; trustworthy old-source named result with 8 failures and 5 passes; green 15-of-15 MEMBERS-DIRECTORY-001P block; green full component and frontend tests; type-checking; scoped lint; diagnostic production build; unchanged lint baseline; repository Node tests; workflow checks; diff-check; independent privacy/security, frontend/accessibility, focus/race, and backup-officer reviews; and exact-main CI if merged. Record source, tests, merge, website publication, exact `runmprc.com` revision, Firebase deployment, provider configuration, account/sign-in change, production-data action, and connected/live behavior separately. Record the unchanged `false` availability value, current #685 deploy `6aa8c5b3fddd040009eba99c`, immediate #659 rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and older #623 deploy `6a7e072f8f346b0008510d29` separately. Source and tests do not prove merge; merge does not prove publication; publication does not prove `runmprc.com`, Firebase, provider, account, data, or connected-live behavior. Final connection and live proof remain #507 work. **Undo:** use one reviewed frontend-and-documentation revert or safe roll-forward. Confirm the default disabled branch still makes zero directory calls. No Firebase, provider, account, or production-data undo is needed because #649 changes source only. Undo must not restore the successful-Reload body-focus defect or weaken #637, #643, #645, or #647 focus containment. diff --git a/docs/officers/PUBLISH_AND_CHECK.md b/docs/officers/PUBLISH_AND_CHECK.md index d24646b..33287f3 100644 --- a/docs/officers/PUBLISH_AND_CHECK.md +++ b/docs/officers/PUBLISH_AND_CHECK.md @@ -12,31 +12,32 @@ **Firebase staging status:** **STATIC HOSTING, EMPTY FIRESTORE, DISPOSABLE EMAIL/PASSWORD AUTH PROOF, AND APP CHECK ENFORCEMENT FOR AUTHENTICATION PLUS FIRESTORE ARE AVAILABLE; FUNCTIONS, OFFICER OPERATION, AND PRODUCTION RELEASE ARE NOT AVAILABLE YET.** WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) requires controlled optimized builds to name staging or production and scans executable JavaScript for environment identity. WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty delete-protected Firestore database and exact reviewed Rules/indexes; fixed anonymous server-only reads were denied and the root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source, verifies provider/privacy/domain settings, passes disposable API/browser sign-in checks, and returns the project to zero users and records. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds only a fail-closed code guard for the future paired profile Functions; billing remains unapproved and no Function is live. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merged its separate staging Hosting guard through [PR #677](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/677), then configured one score-based App Check key restricted to the two staging hosts, one matching web-app registration with one-hour tokens, and exact source `bce911a7083201cfe2141edaa9660f210287bf57` as Hosting version `8556fc51210bdc66`. Authentication plus Firestore now read `ENFORCED` with replay protection `OFF`. A made-up browser account passed create, sign-out, fresh sign-in, and post-enforcement sign-in; signed-in and signed-out empty Events reads passed; tokenless Auth and Firestore requests were denied; and cleanup returned users plus root collections to zero. Officers do not sign in, enter information, run commands, configure App Check, attach billing, or use the site as a publish control. Provider sandboxes, protected short-lived publication, release marker, tested rollback, complete security headers, custom domain, and DNS/TLS change remain **NOT AVAILABLE YET**. Billing is disabled, no Functions-related API or Function exists, the account profile fails closed while Functions are absent, production Firebase Hosting remains empty, and Netlify still serves `runmprc.com`. -**Live Netlify publication status:** a reusable protected release is **NOT AVAILABLE YET**. Ordinary Git-triggered production builds are paused by repository configuration. An overbroad #473 artifact was published and then rolled back on 2026-08-01; bounded #473 deploy `6a6dc9ea588b0c0008036312` is older history. #623 completed the inert-directory predecessor and remains the immediate rollback as deploy `6a7e072f8f346b0008510d29`, source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`. #659 completed one separate exact-artifact accessibility release. Deploy `6a7ece87c5ca4d0007c1a3fc`, source `7496fe0881fb52908c4ff2f40f488df09c94c908`, is production now. Its exact marker/artifact and signed-out route-focus/menu checks passed. The manifest is inactive, temporary refs are absent, and the rollback ref remains. Shop is the static catalog; Events and Calendar show a fixed retry-later notice; the directory remains inert. Event records remain unavailable because this did not deploy Firebase. GitHub Pages currently still claims the same custom domain; future source omits that claim, but #136/WEB-001 must publish and verify its removal. +**Live Netlify publication status:** a reusable protected release is **NOT AVAILABLE YET**. Ordinary Git-triggered production builds are paused by repository configuration. WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is production as exact deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. Its marker and all 62 files matched, signed-out phone/desktop notice checks passed, and repause attempt `6aa8c78dd7b9d1000952eaa2` published nothing. The manifest is inactive, temporary #685 source/control/repause refs are absent, and rollback ref `codex/netlify-source-685-rollback` remains. #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are immediate rollback; #623 deploy `6a7e072f8f346b0008510d29` and #473 deploy `6a6dc9ea588b0c0008036312` are older history. The old #473/#623/#659 hot source refs remain a documented latent manual-rebuild risk despite inactive manifests. Shop is the static catalog; Events and Calendar show a fixed retry-later notice; the directory remains inert. Event records remain unavailable because this did not deploy Firebase. GitHub Pages currently still claims the same custom domain; future source omits that claim, but #136/WEB-001 must publish and verify its removal. -**Completed #659 exception:** WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one exact-artifact accessibility release on 2026-08-14. The frozen source contains only reviewed #291 visible focus, #490 phone-menu disclosure/close behavior, and #657 client-side route focus. Production is deploy `6a7ece87c5ca4d0007c1a3fc`; #623 deploy `6a7e072f8f346b0008510d29` is its rollback target. This is not an officer-operated or reusable control. The no-terminal section below is retained as the audit record. +**Completed #659 exception:** WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one exact-artifact accessibility release on 2026-08-14. The frozen source contains only reviewed #291 visible focus, #490 phone-menu disclosure/close behavior, and #657 client-side route focus. Deploy `6a7ece87c5ca4d0007c1a3fc` was production after that release and is now the immediate rollback for #685; #623 deploy `6a7e072f8f346b0008510d29` was its rollback target. This is not an officer-operated or reusable control. The no-terminal section below is retained as the historical audit record. -## Temporary #685 meeting-location release — UNDER REVIEW, NOT PUBLISHED +## Temporary #685 meeting-location release — WEBSITE COMPLETED 2026-09-14 **Purpose:** publish one frozen public banner that tells prospective members where the 8:45 AM runs meet on Sept. 19 and Sept. 26, 2026. The Sept. 19 item disappears at midnight after that run. The whole banner disappears at midnight after Sept. 26. Both cutoffs use Pacific time. **Approver:** Dave Liu as platform owner and the communications owner who supplied the notice. Officers observe the public result only; they do not run commands, handle credentials, or reuse this exception. -**Prerequisites:** issue [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685); exact approved public wording and map links; frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`; tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`; 62-file digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`; source ref `codex/netlify-source-685-september-locations`; exact expected first parent `925a677cd807dad1f925b4a85e89fc317b7a38b7`; current deploy `6a7ece87c5ca4d0007c1a3fc`; rollback ref `codex/netlify-source-685-rollback`; all required checks; a signed-out pinned preview; and a prepared manifest-disable change. +**Completed evidence:** release ID `WEB-CONTENT-001-SEPTEMBER-LOCATIONS-2026-09-14`; issue [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685); [release PR #686](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/686); exact approved public wording and map links; frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`; tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`; 62-file digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`; expected first parent `925a677cd807dad1f925b4a85e89fc317b7a38b7`; immediate rollback deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908`; retained rollback ref `codex/netlify-source-685-rollback`; all required checks; the signed-out pinned preview; and the completed manifest-disable change. ```mermaid flowchart LR - Live["#659 deploy remains live"] --> Preview["Review exact #685 frozen preview"] + Live["#659 deploy was live"] --> Preview["Exact #685 frozen preview passed"] Preview --> Parent{"main still equals the recorded parent?"} Parent -- "No" --> Stop["Stop and rebuild the control"] Parent -- "Yes" --> Merge["One exact two-parent merge"] Merge --> Marker{"Marker and public banner match?"} Marker -- "No" --> Rollback["Keep or restore #659 deploy"] - Marker -- "Yes" --> Repause["Merge prepared disable change"] - Repause --> Quiet["Later merges publish nothing"] + Marker -- "Yes" --> Production["#685 deploy verified live"] + Production --> Repause["Exact disable change merged"] + Repause --> Quiet["Manifest inactive; later merges publish nothing"] ``` -In words: #659 stays live while the exact #685 preview is reviewed. Only an unchanged recorded `main` parent may merge the control. The public marker and banner must match before the prepared disable change makes ordinary publication inactive again. Any mismatch stops or restores #659. +In words: #659 stayed live while the exact #685 preview was reviewed. The unchanged recorded `main` parent merged the control. The public marker, every file, and the banner matched before the exact disable change made ordinary publication inactive again. #685 remains live; #659 is immediate rollback. 1. Stay signed out. Use no member, account, payment, or private information. 2. Confirm the source diff contains only `src/components/AnnouncementBanner.jsx` and `src/components/AnnouncementBanner.test.jsx` on top of source `7496fe0881fb52908c4ff2f40f488df09c94c908`. @@ -63,15 +64,15 @@ In words: #659 stays live while the exact #685 preview is reviewed. Only an unch **Stop conditions:** stop if `main` advances; a required check fails; any source/tree/file-count/digest/parent/ref/deploy/marker value differs; either location, time, link, city, parking note, social note, or cutoff is wrong; layout clips or covers content; an account or private route is requested; any unrelated source enters the artifact; the disable change or rollback ref is absent; or Netlify attempts to build accumulated `main` instead of the frozen source. -**Success proof:** record the exact source/tree/digest, control head, PR and hosted run, pinned preview and marker, phone/computer dimensions and results, exact two-parent merge, production attempt/deploy time, public marker, both public map links, no-overflow result, manifest-disable PR/merge/attempt, retained rollback ref, and separate unchanged statements for Firebase, Pages, DNS, providers, accounts, data, and payments. Redact screenshots and include the check date. +**Success proof:** [PR #686](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/686) head `f0c2d2378fd30b684ecb2fede447a184a414ab1c` used preview `6aa8c3e0e5faba00080fd632` and passed all five jobs in run `34927419640`. Exact release merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` had parents `925a677cd807dad1f925b4a85e89fc317b7a38b7` and `f0c2d2378fd30b684ecb2fede447a184a414ab1c`, tree `0d7452a7a3c95c43a65784724aea56f0d214477f`, and passed all five exact-main jobs in run `34927937346`. Production deploy `6aa8c5b3fddd040009eba99c` became ready and published at `2026-09-15T04:13:59.373Z`. Its marker and all 62 served files matched source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, previous source `7496fe0881fb52908c4ff2f40f488df09c94c908`, rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. Signed-out checks at 390×844 and 1280×900 confirmed the exact notice text, both safe map links, banner and page-heading visibility, and no horizontal overflow; no screenshot was retained. [Repause PR #687](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/687) used preview `6aa8c6b7e93356000806c950`, head `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, and passed all five jobs in run `34928224571`. Exact repause merge `609d7884e0242abce23449562e7e0da04794da1e` had parents `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` and `9b450d4a7ef118fd4cd114b87a7a9e079f949bb2`, tree `55150c633ed81cb2913c413c24c5733da5ef5733`, and passed all five exact-main jobs in run `34928449093`. Attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and retained #685 deploy `6aa8c5b3fddd040009eba99c`. The manifest is inactive; temporary #685 source/control/repause refs are absent; rollback ref remains. Firebase, Pages, DNS, providers, accounts, private data, payments, routes, and permissions were unchanged. **Undo:** before publication, reject the control PR. If publication fails before replacing production, keep #659 live. If a bad #685 artifact becomes live, ask a Netlify team owner to atomically restore deploy `6a7ece87c5ca4d0007c1a3fc`; if that control is unavailable, use a newly reviewed exact-parent Git projection of rollback source `7496fe0881fb52908c4ff2f40f488df09c94c908`. A manifest-disable commit alone is not rollback. **Escalation:** communications owner for wording or location; platform owner for source, CI, Netlify, marker, or rollback; security owner for any unexpected account, data, credential, provider, or permission behavior. -#685 is under review and is not published. Production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc` until every step above passes. +#685's website work is complete, and production is deploy `6aa8c5b3fddd040009eba99c`. Both notices show through Sept. 19, only Sept. 26 shows from Sept. 20 through Sept. 26, and the banner is absent from Sept. 27 Pacific time. Email was already sent Sept. 12. WhatsApp remains pending the user's action-time confirmation, so issue #685 remains open. -Remote readback on 2026-09-14 found the old #473, #623, and #659 hot source refs still present; this supersedes older absent/retired wording in this guide. Their manifests are inactive, so ordinary merges remain paused, but the manual-rebuild residual is not retired. Officers do not remove refs. The platform owner must confirm the rollback refs and use a separate approved cleanup. +Remote readback on 2026-09-14 found the old #473/#623/#659 hot source refs still present; this supersedes older absent/retired wording in this guide. Their manifests are inactive, so ordinary merges remain paused, but a latent manual-rebuild path remains. Officers do not remove those old refs. The platform owner must confirm the rollback refs and use a separate approved cleanup. ## The release gate @@ -124,7 +125,7 @@ As of **2026-07-13**, with the internal tooling note below checked from source o - `runmprc.com` is served by Netlify, not GitHub Pages. - GitHub Pages currently reports `runmprc.com` as its custom domain and redirects its normal address there. It is not an independently reachable copy today. - Future source stops writing that Pages domain claim. Only provider readback after #136/WEB-001 can prove it cleared. -- Ordinary Git-triggered Netlify production builds are paused. The completed #473 exception used one exact two-parent merge and pinned source/tree/artifact; its release source is retired. #623 completed a second exact-parent one-shot and is #659's rollback predecessor. #659 completed a third exact-parent one-shot, published only its frozen accessibility artifact as deploy `6a7ece87c5ca4d0007c1a3fc`, passed signed-out readback, and was immediately re-paused. Its temporary refs are retired; rollback ref `codex/netlify-source-659-rollback` remains. +- Ordinary Git-triggered Netlify production builds are paused. The completed #473, #623, and #659 exceptions each used a bounded exact-parent release, but their old hot source refs remain even though their manifests are inactive; this is a latent manual-rebuild risk. #659 deploy `6a7ece87c5ca4d0007c1a3fc` is now the immediate rollback for current #685 production. The temporary #685 source/control/repause refs are retired, and rollback ref `codex/netlify-source-685-rollback` remains pinned to exact #659 source `7496fe0881fb52908c4ff2f40f488df09c94c908`. - Live race signup, merchandise payments, and refunds remain unavailable. - CONFIG-001B1 [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151) adds source enforcement for a server-only commerce pause. It is not in the fixed profile-recovery release plan, is not deployed, and has no approved officer control. A future reviewed plan must deploy the complete guarded Function set with the deploy ceiling and every runtime/resource flag off, then prove signed webhooks still work. Do not widen the current plan by hand. @@ -684,7 +685,7 @@ Do not use this section until #133 records that both GitHub environments are pro **Approver:** the named release observer, with the platform owner or accessibility reviewer available if the check fails. -**Prerequisites:** the exact approved commit must be live and identified by the host; the public site must be safe to open without signing in; and the observer must use a normal computer with a keyboard. The reusable protected website release is still **NOT AVAILABLE YET** under #133/#136. #659 completed one exact-artifact exception as deploy `6a7ece87c5ca4d0007c1a3fc`, and its marker matches the approved source. The completed route-focus audit did not separately retain a keyboard `:focus-visible` observation or screenshot; repeat the safe steps below if that additional evidence is required. #623 deploy `6a7e072f8f346b0008510d29` is the rollback host record. +**Prerequisites:** the exact approved commit must be live and identified by the host; the public site must be safe to open without signing in; and the observer must use a normal computer with a keyboard. The reusable protected website release is still **NOT AVAILABLE YET** under #133/#136. The current host marker must identify #685 deploy `6aa8c5b3fddd040009eba99c` and exact source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. That artifact retains the route-focus behavior first published by #659. The completed #659 route-focus audit did not separately retain a keyboard `:focus-visible` observation or screenshot; repeat the safe steps below if that additional evidence is required. #659 deploy `6a7ece87c5ca4d0007c1a3fc` is the immediate rollback host record; #623 is older history. 1. Open the public website in a private browser window. 2. Confirm the host identifies the exact approved commit. @@ -712,7 +713,7 @@ Do not use this section until #133 records that both GitHub environments are pro **Approver:** the pull-request accessibility reviewer approves the source evidence. The named release observer approves a later public check, with the platform owner available if the revision or publication record is unclear. -**Prerequisites:** issue #657; reviewed PR #658 and exact head `a411cb4ebcfb4f1f05b3883721aa55f3d72bc701`; the recorded old-source failure; the named green WEB-UX-004 and full App results; and a reviewed undo. The source check uses GitHub and test summaries only. It needs no terminal, account, sign-in, private page, or real data. #659 published the equivalent route-focus behavior with its #291/#490 prerequisites in source `7496fe0881fb52908c4ff2f40f488df09c94c908` as deploy `6a7ece87c5ca4d0007c1a3fc`. Signed-out desktop and phone route-focus/menu checks passed. Reusable protected publication remains **NOT AVAILABLE YET** under #133/#136. #623 Netlify deploy `6a7e072f8f346b0008510d29`, source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec`, is the rollback predecessor. +**Prerequisites:** issue #657; reviewed PR #658 and exact head `a411cb4ebcfb4f1f05b3883721aa55f3d72bc701`; the recorded old-source failure; the named green WEB-UX-004 and full App results; and a reviewed undo. The source check uses GitHub and test summaries only. It needs no terminal, account, sign-in, private page, or real data. #659 first published the equivalent route-focus behavior with its #291/#490 prerequisites in source `7496fe0881fb52908c4ff2f40f488df09c94c908` as deploy `6a7ece87c5ca4d0007c1a3fc`; signed-out desktop and phone route-focus/menu checks passed. Current #685 production retains that behavior as deploy `6aa8c5b3fddd040009eba99c`, and its exact marker must identify source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. Reusable protected publication remains **NOT AVAILABLE YET** under #133/#136. #659 is immediate rollback; #623 Netlify deploy `6a7e072f8f346b0008510d29` and source `c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec` are older history. **Specialist dependency:** the platform maintainer must supply the exact issue, pull request, commit, test record, and later host readback. The officer can perform every browser step without a terminal. No Firebase or provider specialist action belongs to this check because those surfaces do not change. @@ -773,7 +774,7 @@ Do not use this section until #133 records that both GitHub environments are pro **Expected result for a repeated full check:** main focus appears at both widths with a visible unclipped scoped cue, normal next-`Tab` order, correct Back/Forward focus settlement, and the released phone menu closing. Record that later observation separately from the completed #659 evidence above. -**Stop conditions:** stop if the issue, commit, review, old-source failure, or green results are missing or mismatched. Stop if the host still identifies #623 or another revision. Stop if anyone asks for sign-in, a private page, a form submission, a real name, member data, payment data, or a provider action. Stop if initial load moves focus, old or hidden navigation keeps focus, destination-chosen focus is replaced, the scoped cue is missing or clipped, focus becomes trapped, the next `Tab` order is wrong, or the layout moves. Stop if a merge, workflow, preview, or screenshot is called proof of publication or live behavior. +**Stop conditions:** stop if the issue, commit, review, old-source failure, or green results are missing or mismatched. Stop if the current host identifies #659, #623, or any revision other than the exact #685 marker. Stop if anyone asks for sign-in, a private page, a form submission, a real name, member data, payment data, or a provider action. Stop if initial load moves focus, old or hidden navigation keeps focus, destination-chosen focus is replaced, the scoped cue is missing or clipped, focus becomes trapped, the next `Tab` order is wrong, or the layout moves. Stop if a merge, workflow, preview, or screenshot is called proof of publication or live behavior. **Success proof:** keep the issue, pull request, exact commit, named review, old-source failure, green WEB-UX-004 and full App results, hosted checks, checked public pages, browser, date, and widths. The completed #659 record has no retained screenshot and no separate live keyboard-cue observation. If the repeatable full check is later performed, add its two redacted screenshots and keyboard results without rewriting the narrower #659 record. Complete every line below without combining states: diff --git a/docs/officers/README.md b/docs/officers/README.md index c7e6a8d..4cbd54f 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -64,11 +64,11 @@ In words: approve the merge, request one exact release, and approve its protecte Never shorten several of these states to “done.” -Independent officer publishing to the live Netlify host is **NOT AVAILABLE YET**. An overbroad #473 artifact was published and rolled back on 2026-08-01; bounded #473 deploy `6a6dc9ea588b0c0008036312` is older history. #623 completed one exact-artifact release of the inert member-directory interface and remains the immediate rollback at deploy `6a7e072f8f346b0008510d29`. #659 then completed one separate accessibility-only release. Deploy `6a7ece87c5ca4d0007c1a3fc`, source `7496fe0881fb52908c4ff2f40f488df09c94c908`, is live. Signed-out desktop/phone route-focus and menu checks passed. The manifest is inactive, and its repause attempt did not replace the verified deploy. Shop remains the static pickup catalog, Events/Calendar show a fixed retry-later notice, and the directory remains inert. This is not a reusable officer control. Use a platform maintainer until the Netlify connection and rollback path are documented and tested. +Independent officer publishing to the live Netlify host is **NOT AVAILABLE YET**. WEB-CONTENT-001 #685 deploy `6aa8c5b3fddd040009eba99c`, source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, is live. Its exact marker and all 62 files matched; signed-out phone/desktop notice and map-link checks passed. Repause attempt `6aa8c78dd7b9d1000952eaa2` published nothing, retained that deploy, and left the manifest inactive. The temporary #685 source/control/repause refs are absent; its rollback ref remains. #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are immediate rollback. #623 deploy `6a7e072f8f346b0008510d29` and #473 deploy `6a6dc9ea588b0c0008036312` are older history. Shop remains the static pickup catalog, Events/Calendar show a fixed retry-later notice, and the directory remains inert. This is not a reusable officer control. Use a platform maintainer until the Netlify connection and rollback path are documented and tested. -WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one temporary accessibility artifact release on 2026-08-14. Deploy `6a7ece87c5ca4d0007c1a3fc` is live and pins source `7496fe0881fb52908c4ff2f40f488df09c94c908` with only the reviewed visible-focus, phone-menu, and client-side route-focus behavior. Signed-out route/menu checks passed. Repause attempt `6a7ed0ddb00a46000818878d` published nothing, retained the deploy, and left the manifest inactive. #623 deploy `6a7e072f8f346b0008510d29` is the rollback target. Officers performed no terminal, account, Firebase, provider-configuration, or production-data action. The completed audit record is in [Review, merge, release, and check a change](./PUBLISH_AND_CHECK.md). A preview, green check, or merged release control alone does not prove the website changed. +WEB-002D [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one temporary accessibility artifact release on 2026-08-14. Deploy `6a7ece87c5ca4d0007c1a3fc` pinned source `7496fe0881fb52908c4ff2f40f488df09c94c908` with only the reviewed visible-focus, phone-menu, and client-side route-focus behavior. Signed-out route/menu checks passed. Repause attempt `6a7ed0ddb00a46000818878d` published nothing, retained the deploy, and left its manifest inactive. #685 now builds on that exact source, making #659 the immediate rollback; #623 is older history. Officers performed no terminal, account, Firebase, provider-configuration, or production-data action. The completed audit record is in [Review, merge, release, and check a change](./PUBLISH_AND_CHECK.md). A preview, green check, or merged release control alone does not prove the website changed. -WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) is a two-date public meeting-location banner under review and is not published. Production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc`. The banner must pass exact frozen preview, 390×844 and 1280×900 checks, exact-parent publication, public marker/readback, and immediate repause before anyone calls it live. Officers do not run commands, sign in, enter data, or reuse this one-shot release control. +WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) completed the two-date public meeting-location banner release on 2026-09-14 Pacific time. Production deploy `6aa8c5b3fddd040009eba99c` matches frozen source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, all 62 files, and the public marker. Signed-out 390×844 and 1280×900 checks passed without a retained screenshot. Repause merge `609d7884e0242abce23449562e7e0da04794da1e` passed all five exact-main checks, and unpublished attempt `6aa8c78dd7b9d1000952eaa2` retained the deploy with the manifest inactive. The #685 temporary refs are absent and its rollback ref remains. Email was already sent Sept. 12; WhatsApp still requires the user's action-time confirmation, so the issue remains open. Officers do not run commands, sign in, enter data, or reuse this one-shot release control. A 2026-09-14 remote check found the old #473, #623, and #659 hot source refs still present, superseding older absent/retired wording. Ordinary merges remain paused because their manifests are inactive, but a latent manual-rebuild path remains. Officers do not remove refs; a separate platform-owner cleanup must confirm rollback refs first. diff --git a/docs/officers/REQUEST_A_CHANGE.md b/docs/officers/REQUEST_A_CHANGE.md index e1b0600..a1e5695 100644 --- a/docs/officers/REQUEST_A_CHANGE.md +++ b/docs/officers/REQUEST_A_CHANGE.md @@ -34,7 +34,7 @@ Have one of these ready: If you open GitHub yourself, use the [canonical repository on `main`](https://github.com/Run-MPRC/Run-MPRC.github.io/tree/main), then select **Issues**. `main` is now the repository default. Do not use the legacy `dev` branch as the source for a new request. -The GitHub release is manual. A `main` merge runs checks but does not publish the GitHub Pages copy or deploy Firebase. Ordinary Git-triggered Netlify production builds are paused by repository configuration. The completed #659 exception published accessibility deploy `6a7ece87c5ca4d0007c1a3fc`, then repause attempt `6a7ed0ddb00a46000818878d` published nothing and retained that deploy. Its temporary manifest is inactive, so it is not a reusable officer control. Completed #623 inert-interface deploy `6a7e072f8f346b0008510d29` is the immediate rollback, and completed #473 deploy `6a6dc9ea588b0c0008036312` is older history. Netlify provider settings remain separately unverified. Stop and escalate any unexpected publication. +The GitHub release is manual. A `main` merge runs checks but does not publish the GitHub Pages copy or deploy Firebase. Ordinary Git-triggered Netlify production builds are paused by repository configuration. The completed WEB-CONTENT-001 [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685) website release published temporary-notice deploy `6aa8c5b3fddd040009eba99c` from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. Its marker and all 62 files matched, signed-out phone/desktop checks passed, and repause attempt `6aa8c78dd7b9d1000952eaa2` published nothing and retained that deploy. The manifest is inactive, temporary #685 source/control/repause refs are absent, and its rollback ref remains. Completed #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are immediate rollback; completed #623 deploy `6a7e072f8f346b0008510d29` and #473 deploy `6a6dc9ea588b0c0008036312` are older history. The old #473/#623/#659 hot refs remain a documented latent manual-rebuild risk despite inactive manifests. Netlify provider settings remain separately unverified. Stop and escalate any unexpected publication. ## If you cannot open an AI assistant diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index 5f3b1f9..39594b5 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -103,7 +103,7 @@ flowchart TD AuthProof -. "No Functions, real identity, or records" .-> Stop StagingHosting -. "No complete backend/provider test estate, protected deploy authority, marker, or rollback" .-> Stop HostingSource -. "Production branch, headers, authority, and cutover missing" .-> FutureHosting["Production Firebase Hosting — NOT AVAILABLE YET"] - Main -. "Completed #659 exact release; manifest inactive" .-> WebGate{"Temporary authority active?"} + Main -. "Completed #685 exact release; manifest inactive" .-> WebGate{"Temporary authority active?"} WebGate -- "No" --> Stop WebGate -- "Yes" --> Netlify Netlify["Netlify — current live host; reusable protected publication unavailable"] --> Live["runmprc.com"] @@ -111,7 +111,7 @@ flowchart TD Dev["dev — legacy branch"] -. "do not use for new release work" .-> PR ``` -In words: merge, release request, and protected approval are separate; #663 supplies build checks, #665 publishes the club-owned engineering staging site, and #671 deploys only narrow email/password Auth after exact-main review. Its earlier disposable identities were removed. #676 adds one restricted score-based provider registration, publishes exact source `bce911a7` as Hosting version `8556fc51210bdc66`, and sets Auth plus Firestore to `ENFORCED` with replay protection `OFF`; tokenless Auth/Firestore requests were denied, genuine browser Auth/Events passed, and cleanup returned users and root collections to zero. The current boundary still supplies no Functions, real identity/private-data testing, production release, or reusable authority. Ordinary merges cannot publish Netlify and the completed #659 exception is inactive; its deploy `6a7ece87c5ca4d0007c1a3fc` remains live while completed #623 deploy `6a7e072f8f346b0008510d29` is the immediate rollback and completed #473 deploy `6a6dc9ea588b0c0008036312` is older history; the future Pages branch must stop claiming the Netlify domain, and every host still needs separate proof. +In words: merge, release request, and protected approval are separate; #663 supplies build checks, #665 publishes the club-owned engineering staging site, and #671 deploys only narrow email/password Auth after exact-main review. Its earlier disposable identities were removed. #676 adds one restricted score-based provider registration, publishes exact source `bce911a7` as Hosting version `8556fc51210bdc66`, and sets Auth plus Firestore to `ENFORCED` with replay protection `OFF`; tokenless Auth/Firestore requests were denied, genuine browser Auth/Events passed, and cleanup returned users and root collections to zero. The current boundary still supplies no Functions, real identity/private-data testing, production release, or reusable authority. Ordinary merges cannot publish Netlify. The completed #685 exception is inactive after exact repause; deploy `6aa8c5b3fddd040009eba99c` remains live from source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`. #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are immediate rollback; completed #623 deploy `6a7e072f8f346b0008510d29` and #473 deploy `6a6dc9ea588b0c0008036312` are older history. The temporary #685 refs are absent, while old #473/#623/#659 hot refs preserve a documented latent manual-rebuild risk. The future Pages branch must stop claiming the Netlify domain, and every host still needs separate proof. ## Account and permission ownership diff --git a/docs/officers/UPDATE_PUBLIC_CONTENT.md b/docs/officers/UPDATE_PUBLIC_CONTENT.md index 923b9d5..142dc28 100644 --- a/docs/officers/UPDATE_PUBLIC_CONTENT.md +++ b/docs/officers/UPDATE_PUBLIC_CONTENT.md @@ -92,13 +92,13 @@ are separate states. This procedure describes #618 source and preview behavior only. It is **NOT LIVE** until an approved exact website release is published and the same checks pass on `runmprc.com`. -## Temporary September 2026 meeting locations — UNDER REVIEW, NOT PUBLISHED +## Temporary September 2026 meeting locations — #685 WEBSITE LIVE AND VERIFIED 2026-09-14 **Purpose:** show prospective members the two temporary Saturday meeting points, then remove each notice automatically after it is no longer useful. **Approver:** communications lead or the officer who owns Saturday-run announcements, plus the platform owner for the one-shot release. -**Before you start:** have issue [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685), the approved wording below, both public map links, the exact pinned preview, and a signed-out browser. Use Pacific time. Do not sign in or enter any information. +**Before you start:** have issue [#685](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/685), the approved wording below, both public map links, verified deploy `6aa8c5b3fddd040009eba99c`, and a signed-out browser. Use Pacific time. Do not sign in or enter any information. Approved public notice: @@ -128,13 +128,13 @@ In words: both notices show through the end of Sept. 19 Pacific time; only the S **Stop conditions:** stop if a date, time, city, landmark, link, parking note, social note, or expiry is wrong; the ordinary Seal Point pin is used; text is clipped or hidden; the page requires sign-in; unrelated content changed; or the marker does not identify the exact reviewed artifact. -**Success proof:** record the exact source and preview, check date, both viewport sizes, both map destinations, banner and page-heading visibility, no-overflow result, four expiry-test results, exact public marker, and the repause attempt. A green workflow alone is not website proof. +**Success proof:** release PR #686 preview `6aa8c3e0e5faba00080fd632` matched head `f0c2d2378fd30b684ecb2fede447a184a414ab1c` and passed all five jobs in run `34927419640`. Exact merge `d25b0fe497e0179d62c060a2df3e3a7a9a2c68c6` published deploy `6aa8c5b3fddd040009eba99c` at `2026-09-15T04:13:59.373Z`. The public marker and all 62 files matched source `41a9ae4ebc719212df610ff5cdcf9ca4eab18e71`, tree `7f75ebda7b9d295c5be26acc11b06b452dcc20c6`, rollback deploy `6a7ece87c5ca4d0007c1a3fc`, and digest `cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850`. Signed-out 390×844 and 1280×900 checks passed for both exact map destinations, banner and page-heading visibility, and no horizontal overflow; no screenshot was retained. Repause PR #687 and merge `609d7884e0242abce23449562e7e0da04794da1e` passed all checks. Attempt `6aa8c78dd7b9d1000952eaa2` errored unpublished with `published_at` null and retained the verified deploy. The manifest is inactive, temporary #685 refs are absent, and its rollback ref remains. A green workflow alone is not website proof. **Undo:** before publication, reject the pull request. After publication, ask the platform owner to restore the recorded #659 deploy or use the reviewed rollback projection. Do not remove the banner by editing production directly; the automatic cutoff is the normal content undo. **Escalation:** communications owner for wording or meeting-place questions; platform owner for layout, expiry, release, marker, or rollback; security owner for any unexpected account, private-data, or provider behavior. -#685 is under review and is not published. Production remains #659 deploy `6a7ece87c5ca4d0007c1a3fc` until the exact release and live checks pass. +#685's website work is complete. Production is deploy `6aa8c5b3fddd040009eba99c`; #659 deploy `6a7ece87c5ca4d0007c1a3fc` and source `7496fe0881fb52908c4ff2f40f488df09c94c908` are immediate rollback, while #623 and #473 are older history. Both notices show through Sept. 19, only Sept. 26 shows from Sept. 20 through Sept. 26, and the banner is absent from Sept. 27 Pacific time. Email was already sent Sept. 12. WhatsApp remains pending the user's action-time confirmation, so issue #685 remains open. Remote readback on 2026-09-14 also found the old #473, #623, and #659 hot source refs still present, superseding older absent/retired wording. Their inactive manifests keep ordinary merges paused, but the manual-rebuild residual still needs a separate approved cleanup after rollback refs are confirmed. diff --git a/tests/release-workflow.test.js b/tests/release-workflow.test.js index ff3d73c..ca169a7 100644 --- a/tests/release-workflow.test.js +++ b/tests/release-workflow.test.js @@ -34,16 +34,6 @@ const FINAL_RELEASE_TRUTH_PATHS = [ 'docs/officers/SYSTEM_MAPS.md', 'docs/officers/UPDATE_PUBLIC_CONTENT.md', ]; -const PENDING_RELEASE_TRUTH_PATHS = [ - 'IMPLEMENTATION_PLAN.md', - 'OFFICER_START_HERE.md', - 'OPERATIONS_RUNBOOK.md', - 'SECURITY.md', - 'SYSTEM_DESIGN.md', - 'docs/officers/PUBLISH_AND_CHECK.md', - 'docs/officers/README.md', - 'docs/officers/UPDATE_PUBLIC_CONTENT.md', -]; const { authorizeProductionRelease, evaluateProductionRelease, @@ -66,12 +56,6 @@ const finalReleaseTruth = new Map( fs.readFileSync(path.join(ROOT, relativePath), 'utf8'), ]), ); -const pendingReleaseTruth = new Map( - PENDING_RELEASE_TRUTH_PATHS.map((relativePath) => [ - relativePath, - fs.readFileSync(path.join(ROOT, relativePath), 'utf8'), - ]), -); function runNetlifyGate(context) { const env = { ...process.env }; @@ -288,25 +272,19 @@ test('Netlify manifest pins the inactive bounded #685 meeting-location release', ); }); -test('pending #685 records keep #659 live until exact publication', () => { +test('completed #685 records are current while #659 is immediate rollback', () => { assert.match( netlifyConfig, /temporary #685 production authority is inactive again/i, ); - pendingReleaseTruth.forEach((contents, relativePath) => { - assert.match(contents, /#685/); - assert.match(contents, /under review and is not published/i); - assert.match(contents, /6a7ece87c5ca4d0007c1a3fc/); - assert.doesNotMatch( - contents, - /#685[^\n]{0,180}(?:completed|is live|published deploy)/i, - `${relativePath} must not claim the pending #685 release is live`, - ); - }); -}); + assert.match( + netlifyConfig, + /Ordinary[\s\S]{0,20}previews use their checked-out tree/i, + ); -test('completed #659 records are live while #623 remains rollback history', () => { finalReleaseTruth.forEach((contents, relativePath) => { + assert.match(contents, /#685/); + assert.match(contents, /6aa8c5b3fddd040009eba99c/); assert.match(contents, /#659/); assert.match(contents, /6a7ece87c5ca4d0007c1a3fc/); assert.match(contents, /#623/); @@ -321,14 +299,22 @@ test('completed #659 records are live while #623 remains rollback history', () = /#473's narrower replacement is \*\*NOT AVAILABLE YET\*\*/i, /WEB-002D pending/i, /Temporary #659[^\n]*— (?:UNDER REVIEW|PENDING)/i, + /WEB-CONTENT-001 pending/i, + /Temporary #685[^\n]*— (?:UNDER REVIEW|PENDING)/i, + /#685 is under review and is not published/i, + /#685[^\n]{0,100}(?:release|publication)[^\n]{0,100}(?:under review|not published|not live yet)/i, + /(?:under review|not published)[^\n]{0,100}#685/i, + /production remains #659/i, /#659 LIVE CHECK UNDER REVIEW/i, /ONLY AFTER THE EXACT #659 MARKER IS LIVE/i, + /#685 LIVE CHECK UNDER REVIEW/i, + /ONLY AFTER THE EXACT #685 MARKER IS LIVE/i, /production remains #623/i, ].forEach((staleClaim) => { assert.doesNotMatch( contents, staleClaim, - `${relativePath} must not retain stale #659 or #473 release status`, + `${relativePath} must not retain stale #685, #659, or #473 release status`, ); }); }); @@ -336,55 +322,55 @@ test('completed #659 records are live while #623 remains rollback history', () = const completedTruth = new Map([ [ 'IMPLEMENTATION_PLAN.md', - /WEB-002D completed release boundary:[^\n]*#659[^\n]*completed[^\n]*6a7ece87c5ca4d0007c1a3fc/i, + /WEB-CONTENT-001 completed website release boundary:[^\n]*#685[^\n]*completed[^\n]*6aa8c5b3fddd040009eba99c/i, ], [ 'OFFICER_START_HERE.md', - /#659[^\n]*completed[^\n]*6a7ece87c5ca4d0007c1a3fc[^\n]*live/i, + /#685[^\n]*published[^\n]*deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'OPERATIONS_RUNBOOK.md', - /#659[^\n]*completed[^\n]*6a7ece87c5ca4d0007c1a3fc[^\n]*published/i, + /#685[^\n]*completed[^\n]*website publication[^\n]*6aa8c5b3fddd040009eba99c/i, ], [ 'README.md', - /#659[^\n]*completed one bounded accessibility release[^\n]*published deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /#685[^\n]*completed one bounded content-only release[^\n]*published deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'SECURITY.md', - /WEB-002D completed exact-artifact containment[^\n]*#659[^\n]*completed[^\n]*published deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /WEB-CONTENT-001 completed exact-artifact containment[^\n]*#685[^\n]*completed[^\n]*published deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'SYSTEM_DESIGN.md', - /#659[^\n]*completed[^\n]*published deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /#685[^\n]*completed[^\n]*published deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'docs/officers/ACCESS_CONTINUITY.md', - /live #659 marker[^\n]*deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /live #685 marker[^\n]*deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'docs/officers/EVENTS_SHOP_MEMBERS.md', - /live #659 deploy `6a7ece87c5ca4d0007c1a3fc` preserves the inert #623/i, + /live #685 deploy `6aa8c5b3fddd040009eba99c`[^\n]*#659/i, ], [ 'docs/officers/PUBLISH_AND_CHECK.md', - /Temporary #659 keyboard-navigation and route-focus release — COMPLETED 2026-08-14/i, + /Temporary #685 meeting-location release — WEBSITE COMPLETED 2026-09-14/i, ], [ 'docs/officers/README.md', - /#659[^\n]*completed[^\n]*Deploy `6a7ece87c5ca4d0007c1a3fc`[^\n]*live/i, + /#685[^\n]*completed[^\n]*meeting-location banner release[^\n]*deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'docs/officers/REQUEST_A_CHANGE.md', - /completed #659 exception published accessibility deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /completed WEB-CONTENT-001[^\n]*#685[^\n]*published temporary-notice deploy `6aa8c5b3fddd040009eba99c`/i, ], [ 'docs/officers/SYSTEM_MAPS.md', - /completed #659 exception[^\n]*deploy `6a7ece87c5ca4d0007c1a3fc` remains live/i, + /completed #685 exception[^\n]*deploy `6aa8c5b3fddd040009eba99c` remains live/i, ], [ 'docs/officers/UPDATE_PUBLIC_CONTENT.md', - /#659 LIVE AND VERIFIED 2026-08-14[\s\S]*production deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /#685's website work is complete[^\n]*Production is deploy `6aa8c5b3fddd040009eba99c`/i, ], ]); completedTruth.forEach((expectedTruth, relativePath) => { @@ -392,7 +378,7 @@ test('completed #659 records are live while #623 remains rollback history', () = assert.match( record, expectedTruth, - `${relativePath} must bind #659's completed state to the live deploy`, + `${relativePath} must bind #685's completed website state to the live deploy`, ); }); @@ -400,6 +386,72 @@ test('completed #659 records are live while #623 remains rollback history', () = finalReleaseTruth.get('OPERATIONS_RUNBOOK.md'), finalReleaseTruth.get('docs/officers/PUBLISH_AND_CHECK.md'), ]; + [ + 'WEB-CONTENT-001-SEPTEMBER-LOCATIONS-2026-09-14', + '6aa8c3e0e5faba00080fd632', + 'f0c2d2378fd30b684ecb2fede447a184a414ab1c', + '34927419640', + 'd25b0fe497e0179d62c060a2df3e3a7a9a2c68c6', + '925a677cd807dad1f925b4a85e89fc317b7a38b7', + '0d7452a7a3c95c43a65784724aea56f0d214477f', + '34927937346', + '6aa8c5b3fddd040009eba99c', + '41a9ae4ebc719212df610ff5cdcf9ca4eab18e71', + '7f75ebda7b9d295c5be26acc11b06b452dcc20c6', + 'cb4eba76c65c3501b37f9a0ad3cf00b6eefbc5a9c2e653f2b3c03607cfe64850', + '6aa8c6b7e93356000806c950', + '9b450d4a7ef118fd4cd114b87a7a9e079f949bb2', + '55150c633ed81cb2913c413c24c5733da5ef5733', + '34928224571', + '609d7884e0242abce23449562e7e0da04794da1e', + '34928449093', + '6aa8c78dd7b9d1000952eaa2', + ].forEach((identifier) => { + canonicalRecords.forEach((record) => { + assert.match(record, new RegExp(identifier)); + }); + }); + canonicalRecords.forEach((record) => { + assert.match(record, /(?:62 files|62-file)/i); + assert.match(record, /2026-09-15T04:13:59\.373Z/); + assert.match( + record, + /(?:6aa8c78dd7b9d1000952eaa2[\s\S]{0,240}(?:unpublished|published nothing|publish nothing)|(?:unpublished|published nothing|publish nothing)[\s\S]{0,240}6aa8c78dd7b9d1000952eaa2)/i, + ); + assert.match( + record, + /(?:6aa8c5b3fddd040009eba99c[\s\S]{0,300}(?:retained|remained|left|stayed)|(?:retained|remained|left|stayed)[\s\S]{0,300}6aa8c5b3fddd040009eba99c)/i, + ); + assert.match(record, /published_at[^\n]{0,40}null/i); + assert.match( + record, + /temporary #685 source\/control\/repause refs[^\n]{0,100}(?:retired|absent)/i, + ); + assert.match( + record, + /rollback ref `codex\/netlify-source-685-rollback`[^\n]{0,120}(?:remains|retained|pinned)/i, + ); + assert.doesNotMatch(record, /#685[^\n]*refs remain pending verified cleanup/i); + assert.match( + record, + /(?:old #473\/#623\/#659 hot (?:source )?refs|hot source refs for #473, #623, and #659)[^\n]{0,120}(?:remain|present)/i, + ); + assert.match( + record, + /(?:latent[^\n]{0,100}manual-rebuild|manual rebuild[^\n]{0,100}latent)/i, + ); + assert.match( + record, + /(?:email[^\n]{0,100}(?:already )?sent[^\n]{0,40}Sept\.? 12|Sept\.? 12[^\n]{0,40}email[^\n]{0,80}(?:already )?sent)/i, + ); + assert.match( + record, + /WhatsApp[^\n]{0,160}(?:pending|awaits)[^\n]{0,120}action-time confirmation/i, + ); + assert.match(record, /issue #685[^\n]{0,100}(?:remains|stays) open/i); + }); + + // Preserve the complete historical #659 release and rollback chain. [ '6a7ec998bf8fde00086d2bfe', '137d8a8721339a6ca1079283cc34c1bd7cc2706c', @@ -426,7 +478,6 @@ test('completed #659 records are live while #623 remains rollback history', () = }); }); canonicalRecords.forEach((record) => { - assert.match(record, /(?:62 files|62-file)/i); assert.match( record, /(?:6a7ed0ddb00a46000818878d[\s\S]{0,240}(?:unpublished|published nothing|publish nothing)|(?:unpublished|published nothing|publish nothing)[\s\S]{0,240}6a7ed0ddb00a46000818878d)/i, @@ -499,6 +550,39 @@ test('completed #659 records are live while #623 remains rollback history', () = assert.match(eventsAndShop, /event records remain unavailable/i); }); +test('officer live checks reject stale #659 production and ref-cleanup claims', () => { + const publishGuide = finalReleaseTruth.get( + 'docs/officers/PUBLISH_AND_CHECK.md', + ); + + [ + /Production is deploy `6a7ece87c5ca4d0007c1a3fc`/i, + /#659 completed one exact-artifact exception[^\n]{0,200}its marker matches/i, + /host still identifies #623 or another revision/i, + /#473[^\n]{0,120}release source is retired/i, + /#659[^\n]{0,160}temporary refs are retired/i, + ].forEach((staleClaim) => { + assert.doesNotMatch( + publishGuide, + staleClaim, + 'repeatable officer checks must use #685 as current and preserve old hot-ref risk', + ); + }); + + assert.match( + publishGuide, + /current host marker must identify #685 deploy `6aa8c5b3fddd040009eba99c`/i, + ); + assert.match( + publishGuide, + /current host identifies #659, #623, or any revision other than the exact #685 marker/i, + ); + assert.match( + publishGuide, + /old hot source refs remain[^\n]{0,160}latent manual-rebuild risk/i, + ); +}); + test('Netlify preview and production markers separate control from stable provenance', () => { const loaded = loadManifest(NETLIFY_MANIFEST_PATH); assert.equal(loaded.ok, true);