OBS-001A3: remove raw frontend console error payloads

[daliu]

Outcome

The remaining browser diagnostics covered by #111 no longer pass caught errors, provider objects, or React component stacks to console. Five fixed outcome identifiers are the only application/public runtime console path, and a broken console cannot alter the underlying member flow.

Tracks #142. Parent tracker: #111.

Security invariant and failure behavior

• Render, verification-email, members-only fetch, App Check-disabled, and App Check-initialization diagnostics accept only a closed event identifier.
• Unknown strings, objects, accessors, coercion hooks, errors, responses, URLs, form/member values, and stacks are neither read nor logged.
• Direct application/public runtime console calls outside the helper fail the repository guard.
• A console exception is swallowed so diagnostics cannot change registration, content, Firebase initialization, or error-boundary behavior.
• ErrorBoundary still sends the original error through OBS-001A1 — Disable Sentry replay and fail closed for personal data #134's sanitized Sentry wrapper; only its raw console copy is removed.

Scope

• New src/services/monitoring/clientDiagnostics.ts and focused test
• src/components/ErrorBoundary.tsx
• src/components/MembersOnly.jsx
• src/services/identity/Identity.ts
• src/services/firebase/FirebaseResources.ts
• Narrow OBS-001A3 — Remove raw frontend error objects from browser logs #142 evidence in SECURITY.md and OPERATIONS_RUNBOOK.md

Excluded: Sentry sanitizer/config, Analytics, signup/profile/Auth Functions, Stripe/webhooks, Strava/OAuth, Rules, provider consoles, production data, cookies/history, and sitemap.

Test evidence

Node 20.20.2 on exact rebased head bcb8b353f60b34f874371da5ee94826439fc615b, base 2e3228acc7be649e0b154b450f7bac362e8dfb83:

• Deliberate pre-fix focused run: the new guard failed with all four raw-console source paths; three bypass-recognition assertions passed.
• Focused diagnostics/Sentry/Firebase suites: 3 suites / 64 tests passed.
• Complete frontend suite: 8 suites / 108 tests passed; only existing React Router future warnings.
• SPA callback plus protected-release gates: 23/23 passed.
• Changed-file ESLint with --max-warnings=0: passed.
• Diagnostic production build: compiled successfully.
• git diff --check: passed.
• The first reviews found regex guard bypasses and three statically inspected caller paths. The current patch uses TypeScript syntax-tree traversal with 13 normal/alias/computed/escaped/evaluated bypass fixtures and executes Identity, MembersOnly, missing-App-Check, and throwing-App-Check failure paths.
• The two OBS-001A3 — Remove raw frontend error objects from browser logs #142 commits were rebased without conflict over merged PR PROMO-001: disable unmodeled Stripe adjustments #144. Its Stripe implementation and separate root-document sections are preserved. Two independent exact-head re-reviews approved the rebased range and independently confirmed the final fingerprint; one reran 64 focused tests and the other reran all 108 frontend tests plus 23 callback/release/Firebase gates.
• Hosted CI run 29245243743 passed frontend, Functions, and Firestore Rules on this exact head. Netlify created a review-only deploy preview; that is not production evidence. Earlier run 29244983108 is historical evidence only.
• Final diff SHA-256 against the current base: 4d0f4aeba1e32fb708991611eee9a3621206b7c2b329c7749815091e86dff28c.

Tests use mocks, static runtime-source inspection, and synthetic privacy canaries. They make no Firebase, Sentry, or other provider call.

Compatibility / rollback

No dependency, schema, route, storage, permission, provider, or public-content change. Existing error UI/state and promise behavior remain unchanged. Rollback would restore raw caught objects to browser consoles and requires privacy review.

Officer impact: None — member/officer tasks and screens behave the same; only diagnostic payloads change.

Officer documentation: None — no officer procedure, navigation, permission, or collected field changes. Engineering security/operations evidence is updated.

Deployment evidence:

• Source/tests: exact head is pushed, independently reviewed, and green in hosted CI; not merged.
• Website publication: not performed. CI-001B2 — Make releases protected, backend-first, and fail-closed #135 keeps Git-triggered production publication paused.
• runmprc.com verification: not performed; no exact revision is claimed live.
• Firebase deployment: not required or performed; this is frontend source/tests/docs only.
• Outside-provider configuration: not inspected or changed.
• Live behavior / console history: not tested or deleted; a preview/green check is not production evidence.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	bcb8b35
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54c751f9a0c70007dcc27d
😎 Deploy Preview	https://deploy-preview-143--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.