@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/dist/serve/site-ui/docs/auth-compat.md

@@ -19,6 +19,7 @@
 <div class="compat-key">
 <span class="compat-key-item"><span class="compat-dot" data-status="ok"></span><strong>Conforming</strong> — sandbox matches prod, locked by a passing probe</span>
 <span class="compat-key-item"><span class="compat-dot" data-status="diverged"></span><strong>Diverged (documented)</strong> — intentional difference with a written reason</span>
+<span class="compat-key-item"><span class="compat-dot" data-status="bug"></span><strong>Bug</strong> — should match prod but doesn't; failing probe pins it</span>
 <span class="compat-key-item"><span class="compat-dot" data-status="unsupported"></span><strong>Not implemented yet</strong> — deliberately or pending</span>
 <span class="compat-key-item"><span class="compat-dot" data-status="unverified"></span><strong>Unverified</strong> — claim from docs that we haven't yet observed prod-side</span>
 </div>
@@ -147,7 +148,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">createUserWithEmailAndPassword(auth, email, password)</code><span class="compat-sub"><span class="compat-behavior">Returns <code>UserCredential</code> with <code>operationType: 'signIn'</code> (NOT <code>'register'</code> — matches prod)</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-password.test.ts#L29" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-password.test.ts</code></a> + oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-createUser-operationType.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/auth/auth-createUser-operationType.json</code></a> (<code>operationType: 'signIn'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox) (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L152" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-password.test.ts#L29" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-password.test.ts</code></a> + oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-createUser-operationType.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/auth/auth-createUser-operationType.json</code></a> (<code>operationType: 'signIn'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox) (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L160" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">createUserWithEmailAndPassword(auth, email, password)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>auth/email-already-in-use</code> when the email is already registered</span></span></span></summary>
@@ -408,7 +409,12 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">User` methods</code><span class="compat-sub"><span class="compat-behavior">ID token claims project the account record: <code>email</code> with <code>email_verified</code>, <code>name</code>, <code>picture</code> and <code>phone_number</code> each only when the account has the field, <code>user_id</code>, <code>provider_id: 'anonymous'</code> for anonymous accounts, and <code>firebase.identities</code> keyed by identity type (<code>email</code>, <code>phone</code>, federated provider ID; <code>{}</code> when none). For a custom claim of the same name, the account value wins for <code>user_id</code>, <code>email</code>, <code>email_verified</code>, <code>phone_number</code>, and <code>provider_id</code> on an anonymous account; the custom value wins for <code>name</code>, <code>picture</code>, and <code>provider_id</code> on any other account. Custom claims with a reserved name (<code>sub</code>, <code>iat</code>, <code>firebase</code>, and the other JWT and OIDC names) are refused with <code>auth/reserved-claim</code>. Rules read the same claims on <code>auth.token</code> / <code>request.auth.token</code> in Firestore, Realtime Database and Storage: in process, through the served worker (including after reauthentication), and under the MCP agent identity</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-id-token-standard-claims.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-id-token-standard-claims</code></a> replayed per sign-in flow; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/standard-token-claims.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>unit:standard-token-claims.test.ts</code></a> (rules in all three services allow a verified password user and deny an unverified one); <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/auth-standard-claims.test.ts#L33" target="_blank" rel="noopener noreferrer"><code>unit:auth-standard-claims.test.ts</code></a> (worker port session, RTDB and Storage, reauthentication); <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/bridge/surface/identity-standard-claims.test.ts#L31" target="_blank" rel="noopener noreferrer"><code>unit:identity-standard-claims.test.ts</code></a> (MCP agent identity); <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/src/auth/auth.test.ts#L10" target="_blank" rel="noopener noreferrer"><code>unit:auth.test.ts</code></a> (Admin <code>setCustomUserClaims</code> reserved names). <code>aud</code> and <code>iss</code> name the sandbox issuer rather than a project. A federated identity lists the uid, since the sandbox records no provider-side account ID (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L860" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-id-token-standard-claims.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-id-token-standard-claims</code></a> replayed per sign-in flow; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/standard-token-claims.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>unit:standard-token-claims.test.ts</code></a> (rules in all three services allow a verified password user and deny an unverified one); <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/auth-standard-claims.test.ts#L34" target="_blank" rel="noopener noreferrer"><code>unit:auth-standard-claims.test.ts</code></a> (worker port session, RTDB and Storage, reauthentication); <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/bridge/surface/identity-standard-claims.test.ts#L31" target="_blank" rel="noopener noreferrer"><code>unit:identity-standard-claims.test.ts</code></a> (MCP agent identity); <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/src/auth/auth.test.ts#L10" target="_blank" rel="noopener noreferrer"><code>unit:auth.test.ts</code></a> (Admin <code>setCustomUserClaims</code> reserved names). <code>aud</code> and <code>iss</code> name the sandbox issuer rather than a project. A federated identity lists the uid, since the sandbox records no provider-side account ID (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L868" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+</details>
+<details class="compat-row" data-status="bug">
+<summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">User` methods</code><span class="compat-sub"><span class="compat-behavior">Rules see the session's minted ID token exactly: RTDB <code>auth.token</code> and Firestore and Storage <code>request.auth.token</code> carry every decoded claim with its value, <code>sub</code>, <code>aud</code>, <code>iss</code>, <code>iat</code>, <code>exp</code> and <code>auth_time</code> included (<code>iss</code> is <code>https://securetoken.google.com/</code> plus <code>aud</code>, <code>exp - iat</code> is 3600, <code>auth_time</code> stays the sign-in time across refreshes), claims the token lacks read null, and RTDB <code>auth.provider</code> equals <code>firebase.sign_in_provider</code>; per sign-in kind (anonymous, password, verified profile, custom token for a new or existing account, custom claims after a forced refresh, reload, updateProfile, password reauthentication, email link). Custom-token claims merge over the account's stored claims for that session only</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Production: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-request-auth-per-sign-in.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-request-auth-per-sign-in</code></a> (real sign-ins, RTDB probes deployed per decoded token) and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-request-auth-rules-test-api.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-request-auth-rules-test-api</code></a> (Firestore and Storage evaluating the same claim sets). In-page replay with pins: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-captures/request-auth-per-sign-in.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:request-auth-per-sign-in.test.ts</code></a></div>
+<div class="compat-note">Firestore and Storage drop the JWT claims (#1341); RTDB fills iat, exp and auth_time from the evaluation time and names the sandbox issuer; custom-token claims replace and persist; password reauthentication keeps sign_in_provider custom; a float custom claim is not a float in Firestore rules</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">User` methods</code><span class="compat-sub"><span class="compat-behavior">Custom-claims changes (<code>sandbox.updateUser</code> / re-seed) reach an active session on the next FORCED token refresh, not immediately — claims are read live from the user DB at mint time (prod's refresh-propagation story; AUTH-B10)</span></span></span></summary>
@@ -467,7 +473,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">updatePassword(user, newPassword)</code><span class="compat-sub"><span class="compat-behavior">Sets the stored password (validated for strength). The sandbox DOES store and verify passwords, so this is a real mutation: a subsequent <code>signInWithEmailAndPassword</code> with the new password succeeds and the old one throws <code>auth/wrong-password</code>. A session older than five minutes is refused with <code>auth/requires-recent-login</code> until it signs in again or re-authenticates</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/fruit-aliases.test.ts#L19" target="_blank" rel="noopener noreferrer"><code>unit:fruit-aliases.test.ts</code></a>: new password signs in, old password throws <code>auth/wrong-password</code>. Recent-login gate: oracle capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-requires-recent-login.json" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login</code></a> (refused at 330 seconds, allowed right after sign-in and after reauthentication), replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L783" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a> (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/requires-recent-login.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>requires-recent-login.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/fruit-aliases.test.ts#L19" target="_blank" rel="noopener noreferrer"><code>unit:fruit-aliases.test.ts</code></a>: new password signs in, old password throws <code>auth/wrong-password</code>. Recent-login gate: oracle capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-requires-recent-login.json" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login</code></a> (refused at 330 seconds, allowed right after sign-in and after reauthentication), replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L791" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a> (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/requires-recent-login.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>requires-recent-login.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">reload(user)</code><span class="compat-sub"><span class="compat-behavior">Re-reads the stored record into the <code>user</code> object in place, so a change made out of band (e.g. <code>sandbox.updateUser</code>) is reflected on the held reference — matching prod's server refresh. If the identity is absent from the store (including after <code>deleteUser</code>), rejects with <code>auth/user-token-expired</code></span></span></span></summary>
@@ -489,35 +495,35 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">ActionCodeURL.parseLink(link) / parseActionCodeURL(link)</code><span class="compat-sub"><span class="compat-behavior">Parses an out-of-band action link. The <code>mode</code> query param maps to a NORMALIZED operation (<code>mode=resetPassword</code> -&gt; <code>PASSWORD_RESET</code>, <code>mode=signIn</code> -&gt; <code>EMAIL_SIGNIN</code>), <code>oobCode</code> surfaces as <code>code</code>, <code>lang</code> as <code>languageCode</code>, and <code>continueUrl</code> comes out URL-DECODED. A link missing <code>mode</code>, missing <code>oobCode</code>, carrying an unknown mode, or that is not a URL at all parses to <code>null</code> — the parse NEVER throws. <code>parseActionCodeURL</code> and <code>ActionCodeURL.parseLink</code> agree.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED and project-independent: this is a PURE client-side parse (no network, no project, no mailbox), so the sandbox owes prod an exact match and there is no room for a divergence. Oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-actioncodeurl-parse.json" target="_blank" rel="noopener noreferrer"><code>auth-actioncodeurl-parse</code></a> against firebase-js-sdk 12.13.0. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L570" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L15" target="_blank" rel="noopener noreferrer"><code>sandbox-email-link.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED and project-independent: this is a PURE client-side parse (no network, no project, no mailbox), so the sandbox owes prod an exact match and there is no room for a divergence. Oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-actioncodeurl-parse.json" target="_blank" rel="noopener noreferrer"><code>auth-actioncodeurl-parse</code></a> against firebase-js-sdk 12.13.0. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L578" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L15" target="_blank" rel="noopener noreferrer"><code>sandbox-email-link.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">isSignInWithEmailLink(auth, link)</code><span class="compat-sub"><span class="compat-behavior">Pure predicate over the link string — no network. <code>true</code> only for a link whose mode is <code>signIn</code> AND which carries an <code>oobCode</code>; <code>false</code> for a password-reset link, for <code>mode=signIn</code> with no code, for garbage, and for the empty string. Never throws.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED, project-independent (no server involved): <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-issigninwithemaillink-predicate.json" target="_blank" rel="noopener noreferrer"><code>auth-issigninwithemaillink-predicate</code></a> captured all five cases against prod. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L606" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>sandbox-email-link.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED, project-independent (no server involved): <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-issigninwithemaillink-predicate.json" target="_blank" rel="noopener noreferrer"><code>auth-issigninwithemaillink-predicate</code></a> captured all five cases against prod. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L614" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>sandbox-email-link.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">applyActionCode(auth, code)</code><span class="compat-sub"><span class="compat-behavior">Redeems an out-of-band code and performs its state change (<code>VERIFY_EMAIL</code> sets <code>emailVerified</code>, <code>VERIFY_AND_CHANGE_EMAIL</code> moves the account to the new address). Throws <code>auth/invalid-action-code</code> for a code the project never issued, for the empty string, and for a code already redeemed (single-use). A <code>PASSWORD_RESET</code> code is refused — <code>confirmPasswordReset</code> owns that one.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-action-code-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-action-code-invalid</code></a> confirmed prod emits <code>auth/invalid-action-code</code> for both a bogus code and the empty string (this endpoint is NOT gated on the password provider, so it answered honestly). The APPLY path (a real code, redeemed) cannot be probed from a client — it needs a code from a real inbox — and is unit-backed end to end against the sandbox outbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L16" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L616" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-action-code-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-action-code-invalid</code></a> confirmed prod emits <code>auth/invalid-action-code</code> for both a bogus code and the empty string (this endpoint is NOT gated on the password provider, so it answered honestly). The APPLY path (a real code, redeemed) cannot be probed from a client — it needs a code from a real inbox — and is unit-backed end to end against the sandbox outbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L16" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L624" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">sendSignInLinkToEmail(auth, email, settings)</code><span class="compat-sub"><span class="compat-behavior">ActionCodeSettings validation, enforced CLIENT-side before any request leaves the process: a missing or unparseable <code>url</code> throws <code>auth/invalid-continue-uri</code> (NOT <code>auth/missing-continue-uri</code>, despite the constant's name), and <code>handleCodeInApp</code> other than <code>true</code> throws <code>auth/argument-error</code>. On success the sandbox mints a single-use code and posts the message to the outbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on both client-side arms (project-independent — prod threw before any network call): <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendsigninlinktoemail-settings-validation.json" target="_blank" rel="noopener noreferrer"><code>auth-sendsigninlinktoemail-settings-validation</code></a> captured <code>missingUrl: auth/invalid-continue-uri</code> and <code>handleCodeInAppFalse: auth/argument-error</code>. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L631" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>; the send path is unit-backed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L26" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on both client-side arms (project-independent — prod threw before any network call): <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendsigninlinktoemail-settings-validation.json" target="_blank" rel="noopener noreferrer"><code>auth-sendsigninlinktoemail-settings-validation</code></a> captured <code>missingUrl: auth/invalid-continue-uri</code> and <code>handleCodeInAppFalse: auth/argument-error</code>. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L639" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>; the send path is unit-backed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L26" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">signInWithEmailLink(auth, email, link)</code><span class="compat-sub"><span class="compat-behavior">Redeems the code in a sign-in link. A link carrying no <code>oobCode</code> throws <code>auth/argument-error</code> CLIENT-side (the SDK never reaches the server to ask about a code it cannot find in the link). A first-time sign-in for an address CREATES the account, <code>getAdditionalUserInfo(cred).isNewUser</code> is <code>true</code>, and the account arrives <code>emailVerified: true</code> — redeeming a code mailed to that address is proof of control. The code is single-use.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the client-side reject (<a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithemaillink-invalid-link.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithemaillink-invalid-link</code></a>: <code>noOobCode: auth/argument-error</code>). The REDEMPTION path could not be probed: the oracle project has email-link sign-in disabled, so the server arm answered <code>auth/operation-not-allowed</code>. That half is unit-backed end to end against the sandbox outbox (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a> drives send -&gt; read the outbox -&gt; sign in). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L651" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the client-side reject (<a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithemaillink-invalid-link.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithemaillink-invalid-link</code></a>: <code>noOobCode: auth/argument-error</code>). The REDEMPTION path could not be probed: the oracle project has email-link sign-in disabled, so the server arm answered <code>auth/operation-not-allowed</code>. That half is unit-backed end to end against the sandbox outbox (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a> drives send -&gt; read the outbox -&gt; sign in). (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L659" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">sendPasswordResetEmail(auth, email)</code><span class="compat-sub"><span class="compat-behavior">For an address NO account owns, prod RESOLVES silently — it does not throw <code>auth/user-not-found</code>. Email Enumeration Protection is on by default and refusing to leak account existence is the point. The sandbox matches: it resolves and mails nothing. A malformed address still throws <code>auth/invalid-email</code>. For a real account, the sandbox mails a reset code; <code>confirmPasswordReset</code> redeems it and the new password signs in while the old one throws <code>auth/wrong-password</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the enumeration-protection behavior — the fact most likely to be got wrong: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendpasswordresetemail-unknown-user.json" target="_blank" rel="noopener noreferrer"><code>auth-sendpasswordresetemail-unknown-user</code></a> captured <code>resolvedForUnknownUser: true</code>, <code>unknownUserCode: null</code>, <code>malformedEmailCode: auth/invalid-email</code>. A shim that threw <code>auth/user-not-found</code> here would hand agent code an account oracle production deliberately removed. Reset round trip unit-backed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L663" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the enumeration-protection behavior — the fact most likely to be got wrong: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendpasswordresetemail-unknown-user.json" target="_blank" rel="noopener noreferrer"><code>auth-sendpasswordresetemail-unknown-user</code></a> captured <code>resolvedForUnknownUser: true</code>, <code>unknownUserCode: null</code>, <code>malformedEmailCode: auth/invalid-email</code>. A shim that threw <code>auth/user-not-found</code> here would hand agent code an account oracle production deliberately removed. Reset round trip unit-backed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L671" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">sendEmailVerification(user)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>auth/missing-email</code> for a user with no email on the account (an anonymous user). For a real account the mail goes out and NOTHING ELSE HAPPENS: <code>user.emailVerified</code> stays <code>false</code>. Verification happens when the code in the message is redeemed (<code>applyActionCode</code>), not when it is sent.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the anonymous reject: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendemailverification-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-sendemailverification-shape</code></a> captured <code>anonymousUserCode: auth/missing-email</code> against prod. The send-does-not-verify property is the one the whole flow turns on and is unit-backed (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L24" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a> asserts <code>emailVerified</code> is still false after the send and true only after the code is applied) — it cannot be oracle-confirmed end to end because confirming it would require reading a real inbox. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L683" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the anonymous reject: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-sendemailverification-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-sendemailverification-shape</code></a> captured <code>anonymousUserCode: auth/missing-email</code> against prod. The send-does-not-verify property is the one the whole flow turns on and is unit-backed (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L24" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a> asserts <code>emailVerified</code> is still false after the send and true only after the code is applied) — it cannot be oracle-confirmed end to end because confirming it would require reading a real inbox. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L691" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">verifyBeforeUpdateEmail(user, newEmail)</code><span class="compat-sub"><span class="compat-behavior">Mails a code to the NEW address and returns. The account's email does NOT change until that code is redeemed. That is the single guarantee separating this API from a bare <code>updateEmail</code>: the user must prove control of the new address before it becomes theirs. On redemption the account moves and the new address arrives <code>emailVerified: true</code>. <code>checkActionCode</code> on the code reports <code>data.email</code> = the new address and <code>data.previousEmail</code> = the old one. A session older than five minutes is refused with <code>auth/requires-recent-login</code> (oracle capture <code>auth-requires-recent-login</code>).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">UNIT-BACKED, not oracle-backed, and the reason is recorded rather than hidden: the probe (<a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-verifybeforeupdateemail-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-verifybeforeupdateemail-shape</code></a>) ran against the real project and came back <code>auth/operation-not-allowed</code> on every arm, because the oracle project has the Email/Password provider DISABLED and the probe could not even create the user whose email it would change. The capture is committed showing exactly that. Behavior is proven end to end against the sandbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L30" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L96" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">UNIT-BACKED, not oracle-backed, and the reason is recorded rather than hidden: the probe (<a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-verifybeforeupdateemail-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-verifybeforeupdateemail-shape</code></a>) ran against the real project and came back <code>auth/operation-not-allowed</code> on every arm, because the oracle project has the Email/Password provider DISABLED and the probe could not even create the user whose email it would change. The capture is committed showing exactly that. Behavior is proven end to end against the sandbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L30" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L97" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">sandbox.takeAuthMail(auth) / sandbox.setAuthMailResolver(auth, resolver)</code><span class="compat-sub"><span class="compat-behavior">The sandbox IS the mail server. Every send posts a real message (operation, recipient, single-use code, and the full action link) to an outbox; <code>sandbox.takeAuthMail</code> reads it — the program's substitute for a human opening an inbox. The mailed link round-trips through the public <code>isSignInWithEmailLink</code> / <code>parseActionCodeURL</code> unchanged, and its code is the code the redeemer accepts, so the round trip production cannot complete without a human closes in-process. An installed <code>AuthMailResolver</code> is additionally notified per message; a resolver that THROWS does not fail the send that produced it.</span></span></span></summary>
@@ -546,7 +552,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">unlink(user, providerId)</code><span class="compat-sub"><span class="compat-behavior">Detaches a provider and returns the updated user with a SHRUNKEN <code>providerData</code>. Unlinking a provider that was never linked throws <code>auth/no-such-provider</code>. Unlinking <code>'password'</code> takes the password with it, so <code>signInWithEmailAndPassword</code> for that account stops working. Unlinking the LAST provider does NOT re-anonymize the account — <code>isAnonymous</code> describes how an identity was born, not what it currently carries.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path — the ONE linking fact the oracle could reach, because it needs no email credential: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-unlink-provider.json" target="_blank" rel="noopener noreferrer"><code>auth-unlink-provider</code></a> captured <code>noSuchProviderCode: auth/no-such-provider</code> against prod on an anonymous user. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L692" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. The detach path is unit-backed (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-linking-reauth.test.ts#L33" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-linking-reauth.test.ts</code></a>).</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path — the ONE linking fact the oracle could reach, because it needs no email credential: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-unlink-provider.json" target="_blank" rel="noopener noreferrer"><code>auth-unlink-provider</code></a> captured <code>noSuchProviderCode: auth/no-such-provider</code> against prod on an anonymous user. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L700" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. The detach path is unit-backed (<a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-linking-reauth.test.ts#L33" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-linking-reauth.test.ts</code></a>).</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">linkWithPopup(user, provider, resolver?) / linkWithRedirect(...)</code><span class="compat-sub"><span class="compat-behavior">Route through the SAME <code>AuthFlowResolver</code> seam as <code>signInWithPopup</code>, with <code>authType: 'link'</code> on the request so a host UI can present 'link your Google account' rather than 'sign in'. The resolved credential names the provider to attach; the sandbox performs the attach and the uid is preserved. A disabled provider throws <code>auth/operation-not-allowed</code> AHEAD of the resolver check — a code deliberately distinct from <code>auth/argument-error</code>, which keeps meaning 'enabled, but no resolver/mock wired'.</span></span></span></summary>
@@ -563,7 +569,7 @@
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">reauthenticate* and the <code>auth/requires-recent-login</code> gate</code><span class="compat-sub"><span class="compat-behavior"><code>updatePassword</code>, <code>updateEmail</code>, <code>verifyBeforeUpdateEmail</code> and <code>deleteUser</code> refuse a non-anonymous session whose last authentication is more than five minutes old with <code>auth/requires-recent-login</code> (message <code>Firebase: Error (auth/requires-recent-login).</code>). The age is measured on the sandbox clock, so advancing the clock reaches the gate. A sign-in or a successful re-authentication restarts the window; a forced token refresh, a <code>reload</code> and a served-session restore do not, and a refreshed token keeps its <code>auth_time</code>. Not gated: <code>updateProfile</code>, <code>getIdToken(true)</code>, <code>unlink</code>, and <code>linkWithCredential</code> and <code>deleteUser</code> on an anonymous account. Enforced in the in-page sandbox and in the served worker's port sessions.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Oracle capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-requires-recent-login.json" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login</code></a>: deleteUser allowed at ages 280 and 295 seconds and refused at 305 and 320; at 330 seconds updatePassword, verifyBeforeUpdateEmail and deleteUser refused, updateProfile, forced refresh, unlink, anonymous link and anonymous delete allowed; a refresh at 120 seconds left the gate in place at 330; reauthenticateWithCredential cleared it. Replayed against the sandbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L783" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>; served-worker parity in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/requires-recent-login.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:auth-requires-recent-login.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/auth-requires-recent-login.test.ts#L29" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Oracle capture <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-requires-recent-login.json" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login</code></a>: deleteUser allowed at ages 280 and 295 seconds and refused at 305 and 320; at 330 seconds updatePassword, verifyBeforeUpdateEmail and deleteUser refused, updateProfile, forced refresh, unlink, anonymous link and anonymous delete allowed; a refresh at 120 seconds left the gate in place at 330; reauthenticateWithCredential cleared it. Replayed against the sandbox in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L791" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>; served-worker parity in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/requires-recent-login.test.ts#L7" target="_blank" rel="noopener noreferrer"><code>unit:auth-requires-recent-login.test.ts</code></a>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/auth-requires-recent-login.test.ts#L29" target="_blank" rel="noopener noreferrer"><code>auth-requires-recent-login.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">reauthenticateWithPopup(user, provider, resolver?) / reauthenticateWithRedirect(...)</code><span class="compat-sub"><span class="compat-behavior">Route through the shared resolver seam with <code>authType: 'reauth'</code>. The identity the resolver produces MUST be the user being re-authenticated — a resolver that hands back a different uid throws <code>auth/user-mismatch</code>. That check is the entire security content of the flow; without it 're-authentication' would accept anyone.</span></span></span></summary>
@@ -576,19 +582,19 @@
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getAdditionalUserInfo(userCredential)</code><span class="compat-sub"><span class="compat-behavior">Returns <code>{ isNewUser, profile, providerId }</code>. For a fresh anonymous sign-in prod reports <code>{ isNewUser: true, providerId: null, profile: {} }</code> — <code>providerId</code> is NULL, not <code>'anonymous'</code>, because anonymous is not a federated provider. <code>isNewUser</code> is <code>true</code> for <code>createUserWithEmailAndPassword</code>, a first-time email-link sign-in, and a custom-token sign-in that minted the account; <code>false</code> for a returning <code>signInWithEmailAndPassword</code> and for every <code>link</code> / <code>reauthenticate</code>.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the anonymous shape: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-additional-user-info-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-additional-user-info-shape</code></a> captured <code>{isNewUser: true, providerId: null, profile: {}}</code> against prod. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L702" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Email create/sign-in + custom-token mint/return isNewUser matrix (providerId null per AUTH-B2): <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/upstream-auth-probes.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>unit:upstream-auth-probes.test.ts</code></a>. Email-link + link/reauth arms: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-linking-reauth.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-linking-reauth.test.ts</code></a>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the anonymous shape: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-additional-user-info-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-additional-user-info-shape</code></a> captured <code>{isNewUser: true, providerId: null, profile: {}}</code> against prod. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L710" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Email create/sign-in + custom-token mint/return isNewUser matrix (providerId null per AUTH-B2): <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/upstream-auth-probes.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>unit:upstream-auth-probes.test.ts</code></a>. Email-link + link/reauth arms: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-linking-reauth.test.ts#L22" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-linking-reauth.test.ts</code></a>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">ProviderId / SignInMethod / OperationType / ActionCodeOperation / AuthErrorCodes</code><span class="compat-sub"><span class="compat-behavior">The constant maps, value for value. <code>OperationType.SIGN_IN === 'signIn'</code>, <code>SignInMethod.EMAIL_LINK === 'emailLink'</code>, <code>ProviderId.GOOGLE === 'google.com'</code>, <code>ActionCodeOperation.PASSWORD_RESET === 'PASSWORD_RESET'</code>, and the 106-entry <code>AuthErrorCodes</code> map (<code>INVALID_OOB_CODE === 'auth/invalid-action-code'</code>, <code>PROVIDER_ALREADY_LINKED === 'auth/provider-already-linked'</code>, <code>NO_SUCH_PROVIDER === 'auth/no-such-provider'</code>, <code>USER_MISMATCH === 'auth/user-mismatch'</code>, …).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED, snapshotted straight from the shipped SDK: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-mechanical-surface-constants.json" target="_blank" rel="noopener noreferrer"><code>auth-mechanical-surface-constants</code></a> against firebase-js-sdk 12.13.0, replayed value-for-value in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L718" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. This matters more than it looks: consumer code COMPARES against these constants, so a mirror that got a string wrong would turn every such comparison into a silent <code>false</code> — a worse failure than the export simply being absent, because it typechecks and runs. NOTE: the capture's <code>persistenceTypes</code> block is deliberately NOT asserted — the harness runs under Node, where firebase/auth stubs the browser-only persistence tokens to <code>type: 'NONE'</code> (it reports 'NONE' even for <code>browserLocalPersistence</code>, which is unambiguously 'LOCAL'); asserting it would be asserting a harness artifact. See auth#178.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED, snapshotted straight from the shipped SDK: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-mechanical-surface-constants.json" target="_blank" rel="noopener noreferrer"><code>auth-mechanical-surface-constants</code></a> against firebase-js-sdk 12.13.0, replayed value-for-value in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L726" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. This matters more than it looks: consumer code COMPARES against these constants, so a mirror that got a string wrong would turn every such comparison into a silent <code>false</code> — a worse failure than the export simply being absent, because it typechecks and runs. NOTE: the capture's <code>persistenceTypes</code> block is deliberately NOT asserted — the harness runs under Node, where firebase/auth stubs the browser-only persistence tokens to <code>type: 'NONE'</code> (it reports 'NONE' even for <code>browserLocalPersistence</code>, which is unambiguously 'LOCAL'); asserting it would be asserting a harness artifact. See auth#178.</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">signInWithCustomToken(auth, customToken)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>auth/invalid-custom-token</code> for a malformed token and for the empty string. The sandbox accepts a token in the two shapes it can honestly read: a JSON (optionally base64url) <code>{uid, claims}</code> payload — exactly what <code>admin.auth().createCustomToken</code> signs, so the pyric-admin mint and this redeem compose — or a real three-part JWT whose payload segment carries <code>uid</code>/<code>sub</code>. The SIGNATURE IS NOT VERIFIED: the sandbox has no service-account key. The identity is created if it does not exist, and the credential carries <code>providerId: null</code> (custom-token sign-in is not a federated provider).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithcustomtoken-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithcustomtoken-invalid</code></a> captured <code>auth/invalid-custom-token</code> for both a malformed token and the empty string, replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L749" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Diverged on the ACCEPT path, declared rather than hidden: prod verifies an RS256 signature against the project's service-account key and the sandbox has no key, so it reads the token's claims WITHOUT verifying them. A forged token that prod would reject is accepted here. The happy path cannot be oracle-probed from a Web SDK client at all (it needs an Admin-SDK-signed JWT).</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithcustomtoken-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithcustomtoken-invalid</code></a> captured <code>auth/invalid-custom-token</code> for both a malformed token and the empty string, replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L757" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Diverged on the ACCEPT path, declared rather than hidden: prod verifies an RS256 signature against the project's service-account key and the sandbox has no key, so it reads the token's claims WITHOUT verifying them. A forged token that prod would reject is accepted here. The happy path cannot be oracle-probed from a Web SDK client at all (it needs an Admin-SDK-signed JWT).</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">validatePassword(auth, password)</code><span class="compat-sub"><span class="compat-behavior">Returns a <code>PasswordValidationStatus</code> against the project's password policy, WITHOUT attempting a sign-up (so a UI can show live strength feedback). The sandbox's policy is <code>minPasswordLength: 6</code>, <code>maxPasswordLength: 4096</code>, <code>enforcementState: 'ENFORCE'</code>, with every character-class requirement UNSET — so a password this function calls valid is exactly one <code>createUserWithEmailAndPassword</code> will accept. The character-class fields are <code>undefined</code>, not <code>false</code>: upstream distinguishes 'not required' from 'required and unmet', and reporting <code>false</code> would claim the password failed a rule the project never had.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-validatepassword-status-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-validatepassword-status-shape</code></a> captured prod's live policy (minPasswordLength 6, maxPasswordLength 4096, ENFORCE, character classes unset) and the status shape for a weak and a strong password. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L760" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. The 6-char minimum agrees with the separately oracle-pinned <code>auth/weak-password</code> threshold on the create path, so the two surfaces draw the same line here exactly as they do in prod.</div></div>
+<div class="compat-evidence"><div class="compat-probe">ORACLE-BACKED: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-validatepassword-status-shape.json" target="_blank" rel="noopener noreferrer"><code>auth-validatepassword-status-shape</code></a> captured prod's live policy (minPasswordLength 6, maxPasswordLength 4096, ENFORCE, character classes unset) and the status shape for a weak and a strong password. Replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L768" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. The 6-char minimum agrees with the separately oracle-pinned <code>auth/weak-password</code> threshold on the create path, so the two surfaces draw the same line here exactly as they do in prod.</div></div>
 </details>
 <details class="compat-row" data-status="unsupported">
 <summary class="compat-line"><span class="compat-dot" data-status="unsupported" role="img" aria-label="Not implemented yet" title="Not implemented yet"></span><span class="compat-main"><code class="compat-api">fetchSignInMethodsForEmail(auth, email)</code><span class="compat-sub"><span class="compat-behavior">Not implemented; disposition <code>auth.email-enumeration</code> owns the reviewed availability and rationale.</span></span></span></summary>
@@ -635,7 +641,7 @@ A server process started with `node --import @pyric/cli/register` and `PYRIC_SAN
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
 <div class="compat-note">one configuration per runtime; the session is not persisted across processes</div></div>
 </details>
 </div>
@@ -682,7 +688,7 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">sendSignInLinkToEmail</code><span class="compat-sub"><span class="compat-behavior">Prod rejects a continue URL whose domain is not on the project's authorized-domains list. The sandbox has NO domain allowlist and does not invent one: it accepts any parseable continue URL. A continue URL that would be rejected in production is accepted here.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">The sandbox has no project config to hold an authorized-domains list, so there is nothing to check against; inventing an allowlist would mean inventing a policy the user never set. The probe attempted the server arm (<code>auth-sendsigninlinktoemail-settings-validation</code>, <code>unauthorizedDomain</code>) but the oracle project has email-link sign-in disabled, so it answered <code>auth/operation-not-allowed</code> rather than <code>auth/unauthorized-continue-uri</code> — the divergence is declared from the documented contract, not from a capture we do not have. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L26" target="_blank" rel="noopener noreferrer"><code>sandbox-email-link.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">signInWithCustomToken(auth, customToken)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>auth/invalid-custom-token</code> for a malformed token and for the empty string. The sandbox accepts a token in the two shapes it can honestly read: a JSON (optionally base64url) <code>{uid, claims}</code> payload — exactly what <code>admin.auth().createCustomToken</code> signs, so the pyric-admin mint and this redeem compose — or a real three-part JWT whose payload segment carries <code>uid</code>/<code>sub</code>. The SIGNATURE IS NOT VERIFIED: the sandbox has no service-account key. The identity is created if it does not exist, and the credential carries <code>providerId: null</code> (custom-token sign-in is not a federated provider).</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithcustomtoken-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithcustomtoken-invalid</code></a> captured <code>auth/invalid-custom-token</code> for both a malformed token and the empty string, replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L749" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Diverged on the ACCEPT path, declared rather than hidden: prod verifies an RS256 signature against the project's service-account key and the sandbox has no key, so it reads the token's claims WITHOUT verifying them. A forged token that prod would reject is accepted here. The happy path cannot be oracle-probed from a Web SDK client at all (it needs an Admin-SDK-signed JWT).</div></div></details>
+<div class="compat-evidence"><div class="compat-note">ORACLE-BACKED on the reject path: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-signinwithcustomtoken-invalid.json" target="_blank" rel="noopener noreferrer"><code>auth-signinwithcustomtoken-invalid</code></a> captured <code>auth/invalid-custom-token</code> for both a malformed token and the empty string, replayed in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-conformance.test.ts#L757" target="_blank" rel="noopener noreferrer"><code>unit:oracle-conformance.test.ts</code></a>. Diverged on the ACCEPT path, declared rather than hidden: prod verifies an RS256 signature against the project's service-account key and the sandbox has no key, so it reads the token's claims WITHOUT verifying them. A forged token that prod would reject is accepted here. The happy path cannot be oracle-probed from a Web SDK client at all (it needs an Admin-SDK-signed JWT).</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">inMemoryPersistence / browserSessionPersistence / browserLocalPersistence / indexedDBLocalPersistence / browserCookiePersistence / browserPopupRedirectResolver / debugErrorMap / prodErrorMap</code><span class="compat-sub"><span class="compat-behavior">Inert configuration tokens, accepted so the idiomatic <code>initializeAuth(app, { persistence: indexedDBLocalPersistence })</code> and <code>setPersistence(auth, browserCookiePersistence)</code> compile, run, and behave identically. The <code>.type</code> discriminant matches upstream exactly (<code>NONE</code> / <code>SESSION</code> / <code>LOCAL</code> / <code>LOCAL</code> / <code>COOKIE</code>) because consumer code branches on it. <code>browserPopupRedirectResolver</code> is accepted and ignored — the sandbox has its own first-class pluggable equivalent (<code>sandbox.setAuthFlowResolver</code>). <code>prodErrorMap</code> is accepted and DELIBERATELY not honored: installing it upstream strips error messages, and doing that in a sandbox whose purpose is to tell a developer what went wrong would be actively hostile.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">In an in-memory sandbox the persistence CHOICE has no observable consequence, so accepting the token and recording the mode is the honest behavior — the same inert-token pattern <code>pyric/firestore</code> uses for its cache-factory tokens. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/types.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>unit:types.test.ts</code></a> + <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/sandbox-email-link.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>unit:sandbox-email-link.test.ts</code></a> cover the exports. Oracle caveat recorded on auth#172: the <code>persistenceTypes</code> block of <code>auth-mechanical-surface-constants</code> reports <code>NONE</code> for every token including <code>browserLocalPersistence</code> — a Node-build stub artifact, not the browser contract, so the <code>.type</code> values here follow the documented <code>Persistence.type</code> union instead.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">revokeAccessToken(auth, token)</code><span class="compat-sub"><span class="compat-behavior">Accepted no-op. In production this reaches OUTSIDE Firebase entirely — it tells the identity provider (in practice Apple) to revoke an OAuth access token, which is a call landing on Apple's servers. There is no external IdP behind a sandbox sign-in, so there is no token out there to revoke and nothing this call could truthfully do. It resolves (so the account-deletion flow Apple requires an app to ship runs end to end against the sandbox) and changes no sandbox state (because claiming otherwise would be a lie).</span></span></span></summary>
@@ -690,11 +696,20 @@ Known differences between Pyric and production Firebase. Each remains tracked as
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Operations in flight at a hosted connection drop (web hosted client)</code><span class="compat-sub"><span class="compat-behavior">An Auth operation (a sign-in, a profile update, a token refresh) the web hosted client's socket had taken when it dropped fails once with <code>unavailable</code> and the message "The hosted sandbox connection was lost. Requests already sent may have completed; check state before retrying." It is not sent again. In production the Auth Web SDK fails a request whose network call fails with <code>auth/network-request-failed</code> and does not retry it.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production behavior read from <code>@firebase/auth</code> 1.13.1 <code>dist/esm</code>: a failed <code>fetch</code> is reported through <code>_fail(auth, "network-request-failed")</code>, and the request is not retried. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts</code></a> drops a real loopback socket with <code>auth.signInEmail</code> in flight and asserts it fails once with that message and reaches the host once.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/auth</code> in a server process signs in to the host: the session belongs to that process, the user is visible to <code>firebase-admin</code>, and its identity applies to the process's RTDB, Firestore and Storage calls. The session lasts as long as the process. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts a user the process created that firebase-admin finds, and rules that allow that user's own path and deny another's. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L213" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getAuth(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/auth</code> in a server-rendered module signs in to the host. The session belongs to the dev server process: every SSR request, both of Vite's SSR loaders and a module reloaded after an edit see the same <code>currentUser</code>, and its identity applies to the SSR RTDB, Firestore and Storage calls. Browser sessions are separate. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> signs in through <code>ssrLoadModule</code>, then finds the same user through the environment runner, and checks that the rules allow that user's paths and deny another's. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 </div>
 
+### Bugs
+
+Behavior that should match production Firebase but currently does not.
+
+<div class="compat-list">
+<details class="compat-row" data-status="bug"><summary class="compat-line"><span class="compat-dot" data-status="bug" role="img" aria-label="Bug" title="Bug"></span><span class="compat-main"><code class="compat-api">User` methods</code><span class="compat-sub"><span class="compat-behavior">Rules see the session's minted ID token exactly: RTDB <code>auth.token</code> and Firestore and Storage <code>request.auth.token</code> carry every decoded claim with its value, <code>sub</code>, <code>aud</code>, <code>iss</code>, <code>iat</code>, <code>exp</code> and <code>auth_time</code> included (<code>iss</code> is <code>https://securetoken.google.com/</code> plus <code>aud</code>, <code>exp - iat</code> is 3600, <code>auth_time</code> stays the sign-in time across refreshes), claims the token lacks read null, and RTDB <code>auth.provider</code> equals <code>firebase.sign_in_provider</code>; per sign-in kind (anonymous, password, verified profile, custom token for a new or existing account, custom claims after a forced refresh, reload, updateProfile, password reauthentication, email link). Custom-token claims merge over the account's stored claims for that session only</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Production: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-request-auth-per-sign-in.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-request-auth-per-sign-in</code></a> (real sign-ins, RTDB probes deployed per decoded token) and <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/auth/auth-request-auth-rules-test-api.json" target="_blank" rel="noopener noreferrer"><code>oracle:auth-request-auth-rules-test-api</code></a> (Firestore and Storage evaluating the same claim sets). In-page replay with pins: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/auth/oracle-captures/request-auth-per-sign-in.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>unit:request-auth-per-sign-in.test.ts</code></a></div></div></details>
+</div>
+
 ### Not implemented yet
 
 Tracked behavior that is not implemented in the current contract.