AUTH-006B: Bound Google sign-in failure outcomes

[daliu]

Adds a source-only fixed-output classifier for a future Google sign-in attempt failure. It adds no Google sign-in control, provider call, account action, or live behavior.

Closes #471
Parent: #109 remains open.

Outcome and boundary

• Maps only the three exact future display outcomes: quiet cancellation, blocked popup, and different-credential collision; every other ordinary value or failed inspection becomes unavailable.
• Reads only an own data-property descriptor for ordinary caught values. It does not read detail fields, invoke an ordinary code accessor or coercion hook, log, persist, navigate, retry, or grant authority.
• Contains no Google provider, popup/redirect, credential, linking, reauthentication, or token API and has no runtime caller.
• Keeps email/password, verification, reset, Auth-state, role projection, Rules, Functions, schema, provider configuration, and production behavior unchanged.

JavaScript has no reliable general Proxy detector. A nonthrowing Proxy trap or trap-returned descriptor getter may run, side-effect, or fabricate a supported code before the classifier receives the descriptor. The implementation catches inspection/validation failures and limits any fabricated result to one fixed non-authoritative label. A future caller must never treat that label as provider evidence or permission to retry or link.

Verification

Red proof:

• Before the export existed, the focused suite failed all 22 initial classifier cases.
• A revoked-Proxy regression exposed an uncaught Array.isArray inspection failure before the inspection was fully guarded.
• An adversarial review regression exposed a Proxy that replaced Object.prototype.hasOwnProperty after descriptor inspection; validation and mapping are now inside the same guarded block.

Final proof on exact commit 828604a with Node.js 20:

• Focused Identity suite: 98/98 passed.
• Full frontend suite: 760/760 passed across 14 suites.
• Release, dependency-security, CI, Firebase-release, and artifact-safety checks: 65/65 passed.
• SPA navigation checks: 11/11 passed.
• Frontend lint baseline: exact 111 files; unchanged 113 reviewed legacy errors and 6 reviewed legacy warnings.
• Targeted ESLint and git diff --check: clean.
• Production build: compiled successfully; executable main bundle SHA-256 ba1252ea68eb7721fe6f066c1d1eebfa4749db6b1b62b9c8d541aaff97d970d6.
• Deployable JavaScript scan: no test canaries and no unused classifier in executable bundles.
• Independent code, adversarial-test, and documentation reviews: no remaining findings.
• Production dependency audit: unchanged 5 findings (1 low, 2 moderate, 2 high, 0 critical). No forced or breaking upgrade applied.

Officer handoff

Officer impact: None yet. The helper is unused and creates no officer-visible control, account behavior, or procedure.

Officer documentation: None — this source-only helper does not change public content, admin duties, collected data, permissions, deployment, provider accounts, payments, incidents, backup, or recovery.

Deployment evidence: Source changed and local tests/build passed at 828604a. Code merged: no. Website published: no. runmprc.com verified: no. Firebase deployed: no. Google provider configured: no. Production behavior verified: no. Any Netlify result for this PR is a source preview only and cannot prove Google account behavior.

Compatibility and migration

• Additive named export only; existing default export and callers are unchanged.
• No dependency, data, schema, Rules, Functions, environment, or migration change.
• MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81 and AUTH-004 — Link a Google identity to an existing Firebase member account #82 remain prerequisites for any actual Google sign-in invocation or collision-recovery flow.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	828604a
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6a5501663ce500089486cd
😎 Deploy Preview	https://deploy-preview-472--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Hosted verification for exact head 828604a: all five GitHub CI jobs passed; Netlify deploy-preview, header, and redirect checks passed; Pages changed was neutral/skipped as expected. Preview: https://deploy-preview-472--luminous-fox-7c393f.netlify.app. Netlify readback reports deploy 6a6a5501663ce500089486cd, state ready, context deploy-preview, exact commit, and published_at: null. The preview main bundle SHA-256 exactly matches the local Node 20 production build (ba1252ea68eb7721fe6f066c1d1eebfa4749db6b1b62b9c8d541aaff97d970d6); /login returns HTTP 200 with x-robots-tag: noindex. This is source-preview evidence only: no website production publication, Firebase deployment, Google provider configuration, account flow, or production behavior was performed or verified.