WEB-UX-001A — Publish an exact-delta production header hotfix

[daliu]

Outcome

Completed on 2026-07-23.

Events, Shop, and My Account now use the shared page-hero layout, with decorative images and enough clearance below the fixed navigation on desktop and mobile. The solution is generalized through the shared Header component so every current and future page using that component receives the same navigation clearance.

Production remains on Netlify for this release. The separate move to controlled Firebase Hosting and automatic protected-branch releases is tracked by #460.

Production release

• Release PR: Release: deploy exact page-header hotfix to Netlify #461.
• Control merge commit: 4f67e6cafb975a3f985fefc67f094b3a37526702.
• Exact hotfix source: ed1b0833f25822cee80c99ded8753722b5608a3f.
• Exact source tree: 878c6628d961f4484cb49208aef53f1e9f2e3b47.
• Netlify production deploy: 6a61c544171ea80008307623.
• Published: 2026-07-23 at 07:41 UTC.
• Live bundles: main.9ab083e3.js and main.9b75243f.css.
• Artifact proof: 60 files with SHA-256 digest 7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092.
• GitHub Actions: PR and post-merge runs passed all five jobs.

The source ref used by the exact-artifact builder was deleted after publication, so a historical retry cannot rebuild the authorized release.

Production verification

• runmprc.com served the exact public release marker and expected bundles.
• Events and Shop were visually checked at 1280px desktop and 390x844 mobile sizes.
• Their images loaded, headings were readable below navigation, and no horizontal overflow was present.
• Signed-out My Account routing was checked through /account to the image-backed Login page without signing in or accessing member data.
• Existing shared-header pages retained one page heading and the same generalized clearance.
• No Firebase, Functions, Firestore Rules, Stripe, provider settings, permissions, customer/member data, or production data changed.

Rollback and post-release safety

• Prior known-good Netlify deploy: 6a54a3c93db9d300082e1f5f.
• Exact Git rollback fallback: draft PR Rollback: prepare exact pre-header Netlify artifact #462 at 2f2bbf1abab7f303c09ca27606966cee8b3938cc, based on current main a70545760510ed5e6575919eac9b8111e97f927f.
• Rollback preview 6a61cf4b22a1580008821ba2 is ready. Its public marker pins the former source/tree, 60 files, digest 72d690a7d1faa5b707fc10ce3c50387d31f7c4745df4d21453c90d4a2a84ebe4, and former live bundles main.58ede287.js / main.cdd8bda4.css.
• Preferred emergency action: a Netlify owner atomically restores the prior deploy, then verifies the public release marker and routes.
• Safety PR Release: re-pause temporary Netlify hotfix gate #463 merged as 04d6d2cd88dda0e6ec7e2b6a71514e6ce2e4db25.
• Netlify recorded that merge as unpublished deploy 6a61ca460c41450008ee531d with state error; the published production deploy remained 6a61c544171ea80008307623.
• Documentation PR Docs: bind emergency rollback to current main #465 merged as a70545760510ed5e6575919eac9b8111e97f927f, correcting rollback instructions to bind the exact current main rather than the original release merge.
• Netlify also recorded the documentation merge as unpublished deploy 6a61d10d69aef30007454a71 with state error; the published production deploy again remained unchanged.
• The temporary exact-release gate is inactive again. Ordinary main merges do not publish the website.

Follow-up

#460 owns the permanent release contract:

feature PR -> main
approved promotion PR -> protected production-web
merge -> automatic exact-SHA Firebase Hosting deploy

Netlify must remain available until that Firebase Hosting cutover, DNS/TLS verification, observation period, and rollback proof are complete.

Officer impact: Events, Shop, and My Account are readable below the fixed navigation and use consistent page titles and decorative hero images. Officers do not need to edit source files, run commands, or handle deployment secrets.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/REQUEST_A_CHANGE.md, docs/officers/ACCESS_CONTINUITY.md, and docs/officers/SYSTEM_MAPS.md.

Deployment evidence: Netlify deploy 6a61c544171ea80008307623; public release marker and bundles verified on runmprc.com; desktop/mobile Events and Shop plus signed-out Account routing verified; unpublished skip deploys 6a61ca460c41450008ee531d and 6a61d10d69aef30007454a71; exact rollback preview 6a61cf4b22a1580008821ba2; GitHub Actions release, safety, documentation, and rollback runs passed all five jobs.

[daliu]

CLAIMED by Codex at 2026-07-22T18:40:00Z; branch codex/production-header-hotfix; exact live base e86a0f702cff6495f50630c5de3337290db8b8cb.

[daliu]

Source candidate is complete and independently approved at b9f77ba9dfb153ff8ba203811dfc9c81f7cac31f in PR #458. Verification passed: frontend 53/53, SPA 10/10, diagnostic build, focused lint with no new findings, diff audit, and local desktop/mobile layout checks.

Production is not changed yet. Netlify generated no preview because Git-triggered builds are paused, and the current tooling session lacks access to the club site. Release is safely paused at the owner-controlled Netlify OAuth step. Do not merge #458 until a preview for the exact head is verified; rollback remains deploy 6a54a3c93db9d300082e1f5f.

[daliu]

Production deployment is still blocked by provider authority, not source readiness.

Verified 2026-07-22:

• The exact hotfix was merged only into the isolated live-baseline branch as ed1b0833f25822cee80c99ded8753722b5608a3f.
• runmprc.com still serves Netlify deploy 6a54a3c93db9d300082e1f5f / source e86a0f702cff6495f50630c5de3337290db8b8cb.
• The signed-in runmprc@gmail.com account can view the Netlify deploy list, but Netlify denies the project Continuous Deployment page with “You might not have permissions to see this page.” There is no visible project deploy/configuration control for this identity.
• The available Google identity cannot access mid-peninsula-running-club, and the repository has no Firebase Hosting configuration or isolated staging build.

Required owner action: grant runmprc@gmail.com project configuration/deploy access in Jeffrey Chang's Netlify team, or sign into the existing browser with an authorized team-owner account. Do not send or paste credentials, tokens, recovery codes, or production data.

The requested merge-to-deploy release model is tracked separately in #460. main must not be reconnected to production: it is 176 commits and 247 files ahead of the live source. #460 keeps main as integration and makes an approved promotion into a protected web-production branch the automatic production trigger.

Officer impact: the public readability fix remains unavailable until an authorized provider account publishes it.

Officer documentation: no new source change in this comment; the release and Hosting implementation must update the paths listed in #460.

Deployment evidence: website unchanged; provider settings denied to the current identity; no Firebase/Netlify configuration changed.

[daliu]

Production publication completed through the existing Git-connected Netlify path on 2026-07-22 America/Los_Angeles. The earlier provider-UI blocker did not remove that automatic merge trigger.

Verified result:

• Release-control PR Release: deploy exact page-header hotfix to Netlify #461 merged as two-parent commit 4f67e6cafb975a3f985fefc67f094b3a37526702; first parent was the exact pinned main commit 491cc22d80de1faae1960bd63c80ce62e648397b.
• Current-head GitHub CI run 29988513494 passed all five jobs.
• Exact Netlify preview deploy 6a61c2b3da28ae0008d31785 matched source ed1b0833f25822cee80c99ded8753722b5608a3f, tree 878c6628d961f4484cb49208aef53f1e9f2e3b47, 60 files, and digest 7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092.
• Merging automatically created production deploy 6a61c544171ea80008307623; its public marker on runmprc.com matches the same source, tree, count, and digest and names the merge commit as control commit.
• Live index.html serves main.9ab083e3.js and main.9b75243f.css.
• Signed-out live checks passed at 1280px desktop and 390px phone widths. Events and Shop show their intended images and readable page titles below the 88px navigation with no horizontal overflow. /account redirects signed-out visitors to the readable image-backed Login page. No sign-in, purchase, registration, form submission, production member data, or provider mutation was used.
• Firebase, Functions, Rules, Stripe, outside provider configuration, and production data were unchanged.
• The exact rollback preview in Rollback: prepare exact pre-header Netlify artifact #462 matches previous live source e86a0f702cff6495f50630c5de3337290db8b8cb, tree 149627cdf65e1ebd34f6586200469ce330dca358, 60 files, digest 72d690a7d1faa5b707fc10ce3c50387d31f7c4745df4d21453c90d4a2a84ebe4, and the former live JS/CSS names.
• codex/netlify-source-457-header was deleted and verified absent, preventing a later retry of the historical armed merge. The exact rollback ref remains. PR Release: re-pause temporary Netlify hotfix gate #463 is the final manifest-disable and dated-documentation follow-up.

The issue body described Netlify atomic restore as the only rollback. That control remains unavailable to the current identity; the verified exact Git rollback projection is the available slower fallback, while a Netlify team owner remains preferred for atomic restore.

Officer impact: Events, Shop, and My Account now use the shared readable, image-backed page header; public verification is complete.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/REQUEST_A_CHANGE.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/GLOSSARY.md, and docs/officers/SYSTEM_MAPS.md; #463 records the completed post-release state.

Deployment evidence: website published and runmprc.com verified as above; Firebase and outside providers unchanged. The issue remains open only until #463 merges and its production attempt is confirmed skipped.

[daliu]

Date correction: production deploy 6a61c544171ea80008307623 published at 2026-07-23 00:41 America/Los_Angeles. The production publication and live verification date in the preceding comment is therefore 2026-07-23; all recorded hashes, IDs, and results are unchanged.

[daliu]

Completed and verified in production on 2026-07-23.

• Header fix release: PR Release: deploy exact page-header hotfix to Netlify #461 / control 4f67e6c / Netlify deploy 6a61c544171ea80008307623.
• Live Events and Shop passed desktop/mobile image, heading-clearance, and overflow checks; signed-out Account routing passed without using member data.
• Safety re-pause: PR Release: re-pause temporary Netlify hotfix gate #463 / 04d6d2c; unpublished Netlify attempt 6a61ca460c41450008ee531d.
• Corrected rollback guidance: PR Docs: bind emergency rollback to current main #465 / a705457; unpublished Netlify attempt 6a61d10d69aef30007454a71.
• Exact former-live fallback remains draft in PR Rollback: prepare exact pre-header Netlify artifact #462 at 2f2bbf1, with all checks green and ready preview 6a61cf4b22a1580008821ba2.
• Published production remained 6a61c544171ea80008307623 after both safety merges.

No Firebase, Functions, Rules, Stripe, provider settings, permissions, member/customer data, or production data changed. The permanent protected promotion branch and automatic Firebase Hosting deployment remain separately tracked in #460.