@volter/twin-googleoauth 0.1.0

package/src/googleoauth-capabilities.ts

@@ -0,0 +1,1775 @@
+// Google OAuth 2.0 / OpenID Connect capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the
+// target), authored top-down from the vendor's own OIDC discovery document
+// (accounts.google.com/.well-known/openid-configuration) and the four protocol guides
+// (developers.google.com/identity/protocols/oauth2/{web-server,native-app,openid-connect,
+// service-account}) — NOT from what this twin has built. `verify()` (required to count as done) is
+// ground truth; every `expected:'done'` is genuinely claimed, so a broken one shows as a regression.
+//
+// GRANULARITY: one capability per PROTOCOL BEHAVIOUR (a parameter honoured, an error produced, a
+// claim minted), not per endpoint — this surface is nine endpoints with a hundred behaviours, so
+// per-endpoint entries would have been a denominator of nine and a lie.
+//
+// TWIN-ONLY ROUTES ARE NOT COUNTED. `/_twin/consent`, `/_twin/clients` and `/_twin/accounts` are
+// scaffolding (Google's own consent form posts to an undocumented internal endpoint, and there is
+// no API that creates an OAuth client), so they are absent from this denominator exactly as
+// ADDING_A_TWIN.md §6 requires. Counting them would be padding.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, verifyBoundary, type CapabilityReport, type CapabilitySpec } from '@volter/world-tooling';
+import { AccountChooser, ConsentScreen, ErrorPage, ScopeList, type ConsentView } from '../client/googleoauth-consent.tsx';
+import { CONSENT_CLIENT_JS, errorPageHtml, googleOAuthConsentState } from './googleoauth-consent-ui.ts';
+import { checkGoogleOAuthConformance } from './googleoauth-conformance.ts';
+import {
+  GOOGLEOAUTH_BUDGET_CEILING,
+  GOOGLEOAUTH_CALL_WEIGHTS,
+  GoogleOAuthBudget,
+  GoogleOAuthBudgetError,
+} from './googleoauth-budget.ts';
+import {
+  liveGoogleOAuthExecute,
+  mapTokenInfoClient,
+  pullGoogleOAuthIdentity,
+  syncGoogleOAuthFromReal,
+  type GoogleOAuthExecute,
+} from './googleoauth-connector.ts';
+import { decodeAuthError, ERROR_PAGE_PATH, FLOW_NAME } from './googleoauth-autherror.ts';
+import { pkceS256, verifyJwtWithJwks, decodeJwt, type Jwks } from './googleoauth-jwt.ts';
+import { DEFAULT_ACCOUNTS, DEFAULT_CLIENT_ID, DEFAULT_CLIENT_SECRET, defaultRedirectUris } from './googleoauth-store.ts';
+import { handleGoogleOAuthTwinRequest, type GoogleOAuthResponse } from './googleoauth-twin.ts';
+
+type Step = { m: string; p: string; b?: string; h?: Record<string, string>; at?: string };
+type Body = Record<string, any>;
+/** The per-verify handler, carrying the temp `root` it is bound to. Threading the root ON the
+ *  handler is what lets a verify call a projection-level helper (`googleOAuthConsentState`) against
+ *  the SAME isolated root — an omitted root silently falls back to the operator's real ~/.volter
+ *  state dir, which is gitignored, so nothing would catch the leak. */
+type H = ((s: Step) => Promise<GoogleOAuthResponse>) & { root: string };
+
+const AT = '2026-02-01T00:00:00.000Z';
+const AT_SECONDS = Math.floor(Date.parse(AT) / 1000);
+/** The origin this harness's world serves the twin at. The seeded demo client's callbacks are
+ *  DERIVED from it (runtime contract R7: the port belongs to the caller's world, never to the
+ *  twin's source), so the probes below name no port of their own. */
+const DEMO_ORIGIN = 'http://localhost:3000';
+const REDIRECT_URIS = defaultRedirectUris(DEMO_ORIGIN);
+const REDIRECT = REDIRECT_URIS[0]!;
+const ADA = DEFAULT_ACCOUNTS[0]!;
+const GRACE = DEFAULT_ACCOUNTS[1]!;
+
+async function withRoot(steps: (h: H) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'googleoauth-cap-'));
+  const h = ((s: Step) =>
+    handleGoogleOAuthTwinRequest({
+      method: s.m,
+      path: s.p,
+      ...(s.b === undefined ? {} : { body: s.b }),
+      ...(s.h ? { headers: s.h } : {}),
+      root,
+      origin: DEMO_ORIGIN,
+      occurredAt: s.at ?? AT,
+    })) as H;
+  h.root = root;
+  try {
+    return await verifyBoundary('googleoauth.withRoot', () => steps(h));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+const ok = (r: GoogleOAuthResponse) => r.status >= 200 && r.status < 300;
+/** Rendered markup as a human reads it. React escapes `'` to `&#x27;`, so an assertion about
+ *  Google's own wording ("This app's request is invalid") must compare against the DECODED text or
+ *  it fails for a reason that has nothing to do with the twin. */
+const text = (markup: string) =>
+  markup.replace(/&#x27;/g, "'").replace(/&quot;/g, '"').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
+const body = (r: GoogleOAuthResponse) => r.body as Body;
+const html = (r: GoogleOAuthResponse) => String(r.body);
+const err = (r: GoogleOAuthResponse) => (r.body as { error?: unknown } | null)?.error;
+const loc = (r: GoogleOAuthResponse) => r.headers?.location ?? '';
+const qp = (r: GoogleOAuthResponse, key: string) => {
+  try {
+    return new URL(loc(r)).searchParams.get(key);
+  } catch {
+    return null;
+  }
+};
+const form = (params: Record<string, string>) => new URLSearchParams(params).toString();
+
+/** Build an authorization-endpoint URL from parameters, so a verify can vary exactly one of them. */
+function authUrl(params: Record<string, string | undefined>, path = '/o/oauth2/v2/auth'): string {
+  const q = new URLSearchParams();
+  const base: Record<string, string | undefined> = {
+    client_id: DEFAULT_CLIENT_ID,
+    redirect_uri: REDIRECT,
+    response_type: 'code',
+    scope: 'openid email profile',
+    ...params,
+  };
+  for (const [k, v] of Object.entries(base)) if (v !== undefined) q.set(k, v);
+  return `${path}?${q.toString()}`;
+}
+
+const AUTH_REQUEST_RE = /name="auth_request" value="([^"]+)"/;
+
+/**
+ * Drive an authorization request that is expected to FAIL, and follow Google's real failure path:
+ * a 302 to `/signin/oauth/error?authError=<protobuf>` and then the rendered page. Returns the
+ * decoded payload AND the markup, so a verify can assert both the machine-readable error and what
+ * the human is shown.
+ */
+async function errorPageFor(h: H, path: string): Promise<{ redirect: GoogleOAuthResponse; error: ReturnType<typeof decodeAuthError>; markup: string }> {
+  const redirect = await h({ m: 'GET', p: path });
+  if (redirect.status !== 302) return { redirect, error: null, markup: '' };
+  const target = new URL(loc(redirect));
+  const error = decodeAuthError(target.searchParams.get('authError') ?? '');
+  const page = await h({ m: 'GET', p: `${target.pathname}${target.search}` });
+  return { redirect, error, markup: html(page) };
+}
+
+type FlowOpts = {
+  params?: Record<string, string | undefined>;
+  sub?: string;
+  decision?: 'allow' | 'deny';
+  /** Which scope checkboxes are TICKED. Omitted ⇒ all of them, which is what the served form does
+   *  (every declinable checkbox ships `defaultChecked`, so a browser posts them all). Supply this
+   *  only when the point of the verify is a user UNTICKING something. */
+  tick?: string[];
+  at?: string;
+};
+
+/**
+ * Drive the REAL browser legs: authorization request → consent screen → Allow (or Deny) → the 302.
+ * Everything a verify needs from the round trip comes back, so no verify has to hand-craft a code.
+ */
+async function consentFlow(
+  h: H,
+  opts: FlowOpts = {},
+): Promise<{ auth: GoogleOAuthResponse; requestId: string; redirect: GoogleOAuthResponse; code: string | null; state: string | null }> {
+  const authPath = authUrl(opts.params ?? {});
+  const auth = await h({ m: 'GET', p: authPath, ...(opts.at ? { at: opts.at } : {}) });
+  const requestId = AUTH_REQUEST_RE.exec(html(auth))?.[1] ?? '';
+  const fields = new URLSearchParams();
+  fields.set('auth_request', requestId);
+  fields.set('sub', opts.sub ?? ADA.sub);
+  fields.set('decision', opts.decision ?? 'allow');
+  const ticked = opts.tick ?? (new URL(authPath, 'http://x.test').searchParams.get('scope') ?? '').split(/\s+/).filter(Boolean);
+  for (const s of ticked) fields.append('scope', s);
+  const redirect = await h({ m: 'POST', p: '/_twin/consent', b: fields.toString(), ...(opts.at ? { at: opts.at } : {}) });
+  return { auth, requestId, redirect, code: qp(redirect, 'code'), state: qp(redirect, 'state') };
+}
+
+/** The full round trip, ending in redeemed tokens. */
+async function fullFlow(
+  h: H,
+  opts: FlowOpts & { verifier?: string } = {},
+): Promise<{ code: string | null; tokens: Body; status: number; redirect: GoogleOAuthResponse }> {
+  const flow = await consentFlow(h, opts);
+  if (!flow.code) return { code: null, tokens: {}, status: 0, redirect: flow.redirect };
+  const res = await h({
+    m: 'POST',
+    p: '/token',
+    b: form({
+      grant_type: 'authorization_code',
+      code: flow.code,
+      client_id: DEFAULT_CLIENT_ID,
+      client_secret: DEFAULT_CLIENT_SECRET,
+      redirect_uri: REDIRECT,
+      ...(opts.verifier ? { code_verifier: opts.verifier } : {}),
+    }),
+    ...(opts.at ? { at: opts.at } : {}),
+  });
+  return { code: flow.code, tokens: body(res), status: res.status, redirect: flow.redirect };
+}
+
+/** A grant with an offline refresh token — the fixture the refresh/revoke verifies start from. */
+const offline = { access_type: 'offline', prompt: 'consent' } as const;
+
+// ── shorthands ──
+const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
+
+// ── the connector's offline fake: a REAL-SHAPED Google reply, not an invented one ──
+const FAKE_TOKENINFO = {
+  azp: '1044839207-realclient.apps.googleusercontent.com',
+  aud: '1044839207-realclient.apps.googleusercontent.com',
+  sub: '109876543210987654321',
+  scope: 'openid https://www.googleapis.com/auth/userinfo.email',
+  exp: '1800000000',
+  expires_in: '3599',
+  email: 'real.person@example.com',
+  email_verified: 'true',
+  access_type: 'offline',
+};
+const FAKE_USERINFO = {
+  sub: '109876543210987654321',
+  email: 'real.person@example.com',
+  email_verified: true,
+  name: 'Real Person',
+  given_name: 'Real',
+  family_name: 'Person',
+  picture: 'https://lh3.googleusercontent.com/a/real',
+};
+const fakeExecute: GoogleOAuthExecute = async (_method, path) => {
+  if (path.startsWith('/tokeninfo')) return { ...FAKE_TOKENINFO };
+  if (path === '/v1/userinfo') return { ...FAKE_USERINFO };
+  return {};
+};
+
+/** A `fetch` stand-in that COUNTS calls — "it threw" is not proof; the unchanged count is. */
+function countingFetch(response: () => Response): { impl: typeof fetch; calls: () => number } {
+  let calls = 0;
+  const impl = (async () => {
+    calls += 1;
+    return response();
+  }) as unknown as typeof fetch;
+  return { impl, calls: () => calls };
+}
+const jsonResponse = (payload: unknown, init: ResponseInit = {}) =>
+  new Response(JSON.stringify(payload), { status: 200, headers: { 'content-type': 'application/json' }, ...init });
+
+export const GOOGLEOAUTH_CAPABILITIES: CapabilitySpec[] = [
+  // ── Discovery ────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.discovery.document', 'discovery', 'GET /.well-known/openid-configuration — the OIDC discovery document', 'api', 'core', () =>
+    withRoot(async () => {
+      // Not routed through `h` for the same reason `origin_rewrite` below is not: this probe is
+      // about the ABSENT-`origin` rendering, where the document carries Google's REAL endpoints.
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-disc-doc-'));
+      try {
+      const r = await handleGoogleOAuthTwinRequest({ method: 'GET', path: '/.well-known/openid-configuration', root, occurredAt: AT });
+      const d = body(r);
+      return ok(r)
+        && d.issuer === 'https://accounts.google.com'
+        && d.authorization_endpoint === 'https://accounts.google.com/o/oauth2/v2/auth'
+        && d.token_endpoint === 'https://oauth2.googleapis.com/token'
+        && d.jwks_uri === 'https://www.googleapis.com/oauth2/v3/certs'
+        && d.userinfo_endpoint === 'https://openidconnect.googleapis.com/v1/userinfo'
+        && Array.isArray(d.id_token_signing_alg_values_supported)
+        && d.id_token_signing_alg_values_supported.includes('RS256')
+        && d.code_challenge_methods_supported.includes('S256');
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.discovery.origin_rewrite', 'discovery', 'Discovery rewrites every endpoint to the twin\'s own origin (a discovery-driven client stays inside the world)', 'api', 'core', () =>
+    withRoot(async () => {
+      // Not routed through `h` because this is about the `origin` input specifically.
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-disc-'));
+      try {
+        const r = await handleGoogleOAuthTwinRequest({ method: 'GET', path: '/.well-known/openid-configuration', root, occurredAt: AT, origin: 'http://127.0.0.1:45999' });
+        const d = body(r);
+        // The ISSUER must stay Google's — it is a token claim, not an address — while every
+        // ENDPOINT must move. Getting that backwards is the bug this pins.
+        return ok(r)
+          && d.issuer === 'https://accounts.google.com'
+          && d.authorization_endpoint === 'http://127.0.0.1:45999/o/oauth2/v2/auth'
+          && d.token_endpoint === 'http://127.0.0.1:45999/token'
+          && d.jwks_uri === 'http://127.0.0.1:45999/oauth2/v3/certs'
+          && d.revocation_endpoint === 'http://127.0.0.1:45999/revoke'
+          && d.userinfo_endpoint === 'http://127.0.0.1:45999/v1/userinfo';
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  // Tiered `common` to match its three `device.*` siblings: they describe one flow, and splitting
+  // its tier across areas made the same endpoint look niche in one place and common in another.
+  todo('googleoauth.discovery.device_authorization', 'discovery', 'GET /device/code — the device-authorization endpoint the discovery document advertises', 'api', 'common'),
+
+  // ── The authorization endpoint ───────────────────────────────────────────────────────────────
+  done('googleoauth.authorize.consent_screen', 'authorize', 'GET /o/oauth2/v2/auth — renders the consent surface as HTML (200)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: authUrl({ state: 'xyz' }) });
+      return r.status === 200
+        && r.headers?.['content-type'] === 'text/html; charset=utf-8'
+        && html(r).startsWith('<!doctype html>')
+        && html(r).includes('Choose an account')
+        && html(r).includes('Twin Demo App');
+    })),
+  done('googleoauth.authorize.legacy_path', 'authorize', 'GET /o/oauth2/auth — the legacy authorization path serves the same screen', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: authUrl({}, '/o/oauth2/auth') });
+      return r.status === 200 && html(r).includes('Twin Demo App') && html(r).includes(ADA.email);
+    })),
+  done('googleoauth.authorize.unknown_client_error_page', 'authorize', 'Unknown client_id → a 302 to Google\'s own /signin/oauth/error page carrying invalid_client (401), never to redirect_uri', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const { redirect, error, markup } = await errorPageFor(h, authUrl({ client_id: '999-nosuch.apps.googleusercontent.com' }));
+      const target = new URL(loc(redirect));
+      // THE SECURITY PROPERTY: the bounce goes to Google's OWN error page, never to the
+      // redirect_uri the unknown client claimed — that would make the twin an open redirector.
+      return redirect.status === 302
+        && target.pathname === ERROR_PAGE_PATH
+        && !loc(redirect).startsWith(REDIRECT)
+        && target.searchParams.get('flowName') === FLOW_NAME
+        && error?.code === 'invalid_client'
+        && error.status === 401
+        && error.message === 'The OAuth client was not found.'
+        && text(markup).includes('Error 401')
+        && text(markup).includes('The OAuth client was not found.')
+        && text(markup).includes('Access blocked: Authorization Error');
+    })),
+  done('googleoauth.authorize.missing_client_id', 'authorize', 'Missing client_id → 400 error page naming the parameter', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const { redirect, error, markup } = await errorPageFor(h, authUrl({ client_id: undefined }));
+      return redirect.status === 302 && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+        && error?.code === 'invalid_request' && error.status === 400
+        && error.message === 'Required parameter is missing: client_id'
+        && text(markup).includes('Error 400') && text(markup).includes('Required parameter is missing: client_id');
+    })),
+  done('googleoauth.authorize.missing_redirect_uri', 'authorize', 'Missing redirect_uri → 400 error page naming the parameter', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const { redirect, error } = await errorPageFor(h, authUrl({ redirect_uri: undefined }));
+      return redirect.status === 302 && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+        && error?.code === 'invalid_request' && error.message === 'Required parameter is missing: redirect_uri';
+    })),
+  done('googleoauth.authorize.redirect_uri_mismatch_page', 'authorize', 'Unregistered redirect_uri → the "redirect_uri_mismatch" page with Google\'s own policy wording, never a bounce to that URI', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const { redirect, error, markup } = await errorPageFor(h, authUrl({ redirect_uri: 'https://evil.test/steal' }));
+      return redirect.status === 302
+        // The attacker-supplied URI is NOT where the browser is sent.
+        && !loc(redirect).startsWith('https://evil.test')
+        && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+        && error?.code === 'redirect_uri_mismatch'
+        && error.status === 400
+        && error.message.includes("doesn't comply with Google's OAuth 2.0 policy")
+        && error.param === 'redirect_uri=https://evil.test/steal'
+        // …and the page uses the OTHER headline Google reserves for a misconfigured app.
+        && text(markup).includes("Access blocked: This app's request is invalid")
+        && text(markup).includes('Error 400') && text(markup).includes('redirect_uri_mismatch');
+    })),
+  done('googleoauth.authorize.redirect_uri_bypasses_refused', 'authorize', 'A fragment, a userinfo subcomponent or an alternate IPv4 spelling cannot smuggle past redirect-URI matching', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // Three bypasses §9 round two found, all against the LOOPBACK branch, which compared
+      // protocol/host/path/search and nothing else. Google forbids a fragment outright, forbids the
+      // userinfo subcomponent, and documents its loopback exception for the LITERALS 127.0.0.1 and
+      // [::1] — but WHATWG `URL` folds 0177.0.0.1, 2130706433 and 127.1 all onto 127.0.0.1, so
+      // reading `.hostname` accepted three spellings the vendor's exact-match rule does not.
+      const bypasses = [
+        'http://127.0.0.1:3000/api/auth/callback/google#evil',
+        'http://attacker:hunter2@127.0.0.1:3000/api/auth/callback/google',
+        'http://0177.0.0.1:3000/api/auth/callback/google',
+        'http://2130706433:3000/api/auth/callback/google',
+        'http://127.1:3000/api/auth/callback/google',
+      ];
+      for (const redirect_uri of bypasses) {
+        const { error } = await errorPageFor(h, authUrl({ redirect_uri }));
+        if (error?.code !== 'redirect_uri_mismatch') return false;
+      }
+      // …and the genuine loopback registration still works, so this is not "everything is refused".
+      return (await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://127.0.0.1:51999/api/auth/callback/google' }) })).status === 200;
+    })),
+  done('googleoauth.authorize.exact_redirect_uri_matching', 'authorize', 'redirect_uri matching is EXACT — a trailing slash is a different URI', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // The single most common Google integration bug, and only reproducible if the twin is as
+      // strict as the vendor.
+      const exact = await h({ m: 'GET', p: authUrl({}) });
+      const slashed = await errorPageFor(h, authUrl({ redirect_uri: `${REDIRECT}/` }));
+      const cased = await errorPageFor(h, authUrl({ redirect_uri: REDIRECT.replace('/callback/google', '/Callback/Google') }));
+      return exact.status === 200
+        && slashed.error?.code === 'redirect_uri_mismatch'
+        && cased.error?.code === 'redirect_uri_mismatch';
+    })),
+  done('googleoauth.authorize.loopback_port_ignored', 'authorize', 'Installed-app loopback redirect: the PORT is ignored, the host and path are not', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Registered: http://127.0.0.1:3000/api/auth/callback/google
+      const otherPort = await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://127.0.0.1:51999/api/auth/callback/google' }) });
+      const otherPath = await errorPageFor(h, authUrl({ redirect_uri: 'http://127.0.0.1:51999/other' }));
+      // …and the exception is for the loopback IP LITERALS only: `localhost` is an ordinary host to
+      // Google, so a different port there is a mismatch even though the path matches a registration.
+      const localhostOtherPort = await errorPageFor(h, authUrl({ redirect_uri: 'http://localhost:51999/api/auth/callback/google' }));
+      const localhostExact = await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://localhost:3000/api/auth/callback/google' }) });
+      return otherPort.status === 200
+        && otherPath.error?.code === 'redirect_uri_mismatch'
+        && localhostOtherPort.error?.code === 'redirect_uri_mismatch'
+        && localhostExact.status === 200;
+    })),
+  done('googleoauth.authorize.parameter_errors_never_reach_redirect_uri', 'authorize', 'EVERY parameter error renders Google\'s error page — it is NOT bounced to redirect_uri (RFC 6749 notwithstanding)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // The behaviour a live capture of the real endpoint refuted an RFC-shaped implementation on:
+      // the spec says redirect these back to the client, and Google does not.
+      const cases: Array<[string, string]> = [
+        [authUrl({ response_type: undefined, state: 'keepme' }), 'Required parameter is missing: response_type'],
+        [authUrl({ scope: undefined }), 'Missing required parameter: scope'],
+        [authUrl({ access_type: 'sideways' }), "Invalid parameter value for access_type: 'sideways' is not valid"],
+        [authUrl({ display: 'bogus' }), "Invalid parameter value for display: 'bogus' is not valid"],
+        [authUrl({ prompt: 'shout' }), 'Invalid prompt: shout'],
+        [authUrl({ include_granted_scopes: 'yes' }), 'Invalid value, must be one of false, true: yes'],
+        [authUrl({ enable_granular_consent: 'maybe' }), 'Invalid value, must be one of false, true: maybe'],
+      ];
+      for (const [path, message] of cases) {
+        const { redirect, error } = await errorPageFor(h, path);
+        if (redirect.status !== 302) return false;
+        if (loc(redirect).startsWith(REDIRECT)) return false; // the whole point
+        if (new URL(loc(redirect)).pathname !== ERROR_PAGE_PATH) return false;
+        if (error?.code !== 'invalid_request' || error.message !== message) return false;
+      }
+      // …and the same request WITHOUT the bad parameter renders the screen, so this is not
+      // "everything fails".
+      return (await h({ m: 'GET', p: authUrl({ display: 'popup', prompt: 'consent select_account', include_granted_scopes: 'true' }) })).status === 200;
+    })),
+  done('googleoauth.authorize.unsupported_response_type', 'authorize', 'response_type=token is refused as UNMODELLED — the twin never claims Google rejects a flow Google supports', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const { redirect, error } = await errorPageFor(h, authUrl({ response_type: 'token' }));
+      return redirect.status === 302
+        && error?.code === 'unsupported_response_type'
+        // The INVERSE false-green guard: Google DOES support the implicit flow, so the message must
+        // say the TWIN does not model it, not that the request is invalid.
+        && error.message.includes('not modelled')
+        && error.message.includes('Real Google supports it')
+        && qp(redirect, 'code') === null;
+    })),
+  done('googleoauth.authorize.repeated_parameter', 'authorize', 'A repeated query parameter is refused outright ("OAuth 2 parameters can only have a single value")', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const { error } = await errorPageFor(h, `${authUrl({})}&response_type=id_token`);
+      const scopeErr = await errorPageFor(h, `${authUrl({})}&scope=openid`);
+      return error?.code === 'invalid_request'
+        && error.message === 'OAuth 2 parameters can only have a single value: response_type'
+        && scopeErr.error?.message === 'OAuth 2 parameters can only have a single value: scope';
+    })),
+  done('googleoauth.authorize.prompt_none_interaction_required', 'authorize', 'prompt=none with no covering grant → 302 to redirect_uri with error=interaction_required + error_subtype', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: authUrl({ prompt: 'none', state: 'sil' }) });
+      // One of the only TWO outcomes that reach the caller's redirect_uri.
+      return r.status === 302 && loc(r).startsWith(REDIRECT)
+        && qp(r, 'error') === 'interaction_required'
+        && qp(r, 'error_subtype') === 'access_denied'
+        && qp(r, 'state') === 'sil'
+        && qp(r, 'code') === null;
+    })),
+  done('googleoauth.authorize.prompt_none_must_be_alone', 'authorize', 'prompt=none combined with another value is refused (Google documents it as mutually exclusive)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const { error } = await errorPageFor(h, authUrl({ prompt: 'none consent' }));
+      const fine = await h({ m: 'GET', p: authUrl({ prompt: 'consent select_account' }) });
+      return error?.code === 'invalid_request' && error.message === 'Invalid prompt: none consent' && fine.status === 200;
+    })),
+  done('googleoauth.authorize.login_hint', 'authorize', 'login_hint naming a known account SKIPS the chooser; an unknown hint falls back to it', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const hinted = await h({ m: 'GET', p: authUrl({ login_hint: GRACE.email }) });
+      const unknown = await h({ m: 'GET', p: authUrl({ login_hint: 'nobody@nowhere.test' }) });
+      return hinted.status === 200
+        && html(hinted).includes('wants access to your Google Account')
+        && html(hinted).includes(GRACE.email)
+        && !html(hinted).includes('Choose an account')
+        // An unknown hint is NOT an error on Google — it just shows the chooser.
+        && unknown.status === 200
+        && html(unknown).includes('Choose an account');
+    })),
+  done('googleoauth.authorize.state_roundtrip', 'authorize', 'state is echoed VERBATIM on the success redirect (CSRF binding)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const weird = 'a b/c+d=e&f%20g';
+      const flow = await consentFlow(h, { params: { state: weird } });
+      return flow.redirect.status === 302 && flow.state === weird && !!flow.code;
+    })),
+  done('googleoauth.authorize.no_state_no_echo', 'authorize', 'A request with NO state gets NO state parameter back (not an empty one)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      return flow.redirect.status === 302 && !!flow.code && new URL(loc(flow.redirect)).searchParams.has('state') === false;
+    })),
+  done('googleoauth.authorize.code_redirect_shape', 'authorize', 'The success redirect carries EXACTLY Google\'s documented parameters — no more, no fewer', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, { params: { state: 's' } });
+      if (flow.redirect.status !== 302) return false;
+      if (!(flow.code ?? '').startsWith('4/0A')) return false;
+      if (qp(flow.redirect, 'scope') !== 'openid email profile') return false;
+      if (qp(flow.redirect, 'authuser') !== '0' || qp(flow.redirect, 'error') !== null) return false;
+
+      // AND NOTHING ELSE. This is the one assertion in the pack that pins an ABSENCE, and it exists
+      // because §9 found the inverse false-green here: the twin was emitting RFC 9207's `iss`,
+      // licensed by a discovery key neither of which could be confirmed against Google's artefacts.
+      // ADDING_A_TWIN.md §6 says no gate can red-flag invented surface because "there is no oracle
+      // for absence" — but on a REDIRECT there is one, because the vendor's parameter set is closed
+      // and documented. An allowlist turns the unpinnable class into a pinned one: re-add `iss`, or
+      // any other invention, and this capability reddens by name.
+      const DOCUMENTED = new Set(['code', 'state', 'scope', 'authuser', 'prompt', 'hd', 'error', 'error_subtype', 'error_description']);
+      const undocumented = [...new URL(loc(flow.redirect)).searchParams.keys()].filter((k) => !DOCUMENTED.has(k));
+      if (undocumented.length) return false;
+      // …and the same closed set on a Workspace account (which adds `hd`) and on the denial path.
+      const workspace = await consentFlow(h, { params: { state: 's' }, sub: GRACE.sub });
+      const denied = await consentFlow(h, { params: { state: 's' }, decision: 'deny' });
+      for (const r of [workspace.redirect, denied.redirect]) {
+        if ([...new URL(loc(r)).searchParams.keys()].some((k) => !DOCUMENTED.has(k))) return false;
+      }
+      return qp(workspace.redirect, 'hd') === GRACE.hd;
+    })),
+  done('googleoauth.authorize.access_denied', 'authorize', 'Deny → 302 back with error=access_denied and the state, and NO code', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, { params: { state: 'denied-state' }, decision: 'deny' });
+      return flow.redirect.status === 302
+        && qp(flow.redirect, 'error') === 'access_denied'
+        && qp(flow.redirect, 'state') === 'denied-state'
+        && flow.code === null;
+    })),
+  done('googleoauth.authorize.consent_replay_refused', 'authorize', 'An authorization request can be settled ONCE — a replayed consent post is refused', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const auth = await h({ m: 'GET', p: authUrl({}) });
+      const rid = AUTH_REQUEST_RE.exec(html(auth))?.[1] ?? '';
+      const first = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+      const second = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+      return first.status === 302 && !!qp(first, 'code') && second.status === 400 && err(second) === 'invalid_request';
+    })),
+  done('googleoauth.authorize.prompt_none_succeeds_silently', 'authorize', 'prompt=none WITH a covering grant mints a code silently — a 302, never an HTML screen', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // The other half of prompt=none, and the half that was broken: an earlier version answered
+      // `interaction_required` correctly and then fell through to RENDERING THE CONSENT SCREEN when
+      // the grant did cover, handing an HTML page to a caller that asked for no UI (§9 round one).
+      const scope = 'openid email';
+      // Grace, deliberately NOT the first seeded account: the old check only ever consulted
+      // accounts[0], so any other persona's covering grant was invisible to it.
+      await consentFlow(h, { params: { scope }, sub: GRACE.sub });
+      const silent = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', state: 'quiet' }) });
+      if (silent.status !== 302 || !loc(silent).startsWith(REDIRECT)) return false;
+      if (qp(silent, 'error') !== null || qp(silent, 'state') !== 'quiet') return false;
+      const code = qp(silent, 'code');
+      if (!code?.startsWith('4/0A')) return false;
+      // …the silently-minted code is a REAL code, redeemable for the account that granted it.
+      const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      if (!ok(token) || decodeJwt(String(body(token).id_token)).payload.sub !== GRACE.sub) return false;
+      // The silent redirect must NOT claim a screen was shown: `prompt` echoes what happened, and
+      // stamping `consent` on a no-UI response asserts the opposite (§9 round two).
+      if (qp(silent, 'prompt') !== null) return false;
+      // …and asking for MORE than the grant covers still refuses rather than showing a screen.
+      const wider = await h({ m: 'GET', p: authUrl({ scope: `${scope} https://www.googleapis.com/auth/drive`, prompt: 'none' }) });
+      return wider.status === 302 && qp(wider, 'error') === 'interaction_required';
+    })),
+  done('googleoauth.authorize.prompt_none_never_substitutes_an_account', 'authorize', 'prompt=none with a login_hint that does NOT cover refuses — it never silently hands back a different human\'s token', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // The sharpest failure this surface can have, and one an app cannot detect until it decodes
+      // the token: with no screen shown, a substituted subject is invisible. An earlier version fell
+      // through from an uncovering hint to `accounts.find(covers)` and minted a code for whoever
+      // happened to have a grant (§9 round two, MAJOR).
+      const scope = 'openid email';
+      await consentFlow(h, { params: { scope }, sub: GRACE.sub });   // Grace covers; Ada does not.
+      const hintedAtAda = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', login_hint: ADA.email }) });
+      if (hintedAtAda.status !== 302 || qp(hintedAtAda, 'error') !== 'interaction_required') return false;
+      if (qp(hintedAtAda, 'code') !== null) return false;
+      // …and the SAME request hinted at the account that DOES cover succeeds, so this is a refusal
+      // to substitute rather than a blanket refusal.
+      const hintedAtGrace = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', login_hint: GRACE.email }) });
+      const code = qp(hintedAtGrace, 'code');
+      if (!code) return false;
+      const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return ok(token) && decodeJwt(String(body(token).id_token)).payload.sub === GRACE.sub;
+    })),
+  todo('googleoauth.authorize.iss_parameter', 'authorize', 'RFC 9207 `iss` on the authorization response — the twin does NOT emit it: neither the parameter nor the discovery flag that would license it could be confirmed against Google\'s real artefacts', 'api', 'niche'),
+  todo('googleoauth.authorize.implicit_flow', 'authorize', 'response_type=token / id_token — the implicit and hybrid flows (fragment response)', 'api', 'niche'),
+  todo('googleoauth.authorize.response_mode', 'authorize', 'response_mode=form_post / fragment / query', 'api', 'niche'),
+  todo('googleoauth.authorize.hd_parameter', 'authorize', 'hd=<domain> restricts the chooser to a Workspace domain (and error=org_internal)', 'api', 'common'),
+  todo('googleoauth.authorize.enable_granular_consent', 'authorize', 'enable_granular_consent parameter toggles the per-scope checkbox UI explicitly', 'api', 'niche'),
+  todo('googleoauth.authorize.admin_policy_enforced', 'authorize', 'error=admin_policy_enforced when a Workspace admin blocks the scope', 'api', 'niche'),
+  todo('googleoauth.authorize.disallowed_useragent', 'authorize', 'error=disallowed_useragent for an embedded webview', 'api', 'niche'),
+
+  // ── PKCE ─────────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.pkce.s256_roundtrip', 'pkce', 'PKCE S256: a code minted with a challenge is redeemable with the matching verifier', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+      const flow = await fullFlow(h, { params: { code_challenge: pkceS256(verifier), code_challenge_method: 'S256' }, verifier });
+      return flow.status === 200 && typeof flow.tokens.access_token === 'string';
+    })),
+  done('googleoauth.pkce.s256_mismatch_rejected', 'pkce', 'PKCE S256: the WRONG verifier is refused with invalid_grant', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: { code_challenge: pkceS256('right-verifier-right-verifier-right-verifier'), code_challenge_method: 'S256' }, verifier: 'wrong-verifier-wrong-verifier-wrong-verifier' });
+      return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+  done('googleoauth.pkce.missing_verifier_rejected', 'pkce', 'PKCE: a challenged code redeemed with NO verifier is refused', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: { code_challenge: pkceS256('some-verifier-some-verifier-some-verifier'), code_challenge_method: 'S256' } });
+      return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+  done('googleoauth.pkce.plain_method', 'pkce', 'PKCE plain: the verifier IS the challenge', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const verifier = 'plain-verifier-plain-verifier-plain-verifier';
+      const good = await fullFlow(h, { params: { code_challenge: verifier, code_challenge_method: 'plain' }, verifier });
+      const bad = await fullFlow(h, { params: { code_challenge: verifier, code_challenge_method: 'plain' }, verifier: 'other' });
+      return good.status === 200 && typeof good.tokens.access_token === 'string' && bad.status === 400 && bad.tokens.error === 'invalid_grant';
+    })),
+  done('googleoauth.pkce.invalid_method_rejected', 'pkce', 'code_challenge_method outside {S256, plain} → 302 error=invalid_request', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const { error } = await errorPageFor(h, authUrl({ code_challenge: 'abc', code_challenge_method: 'SHA1' }));
+      return error?.code === 'invalid_request'
+        && error.message === "Invalid parameter value for code_challenge_method: 'SHA1' is not a valid CodeChallengeMethod";
+    })),
+  done('googleoauth.pkce.unexpected_verifier_rejected', 'pkce', 'A verifier presented for a code minted WITHOUT a challenge is refused', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { verifier: 'unexpected-verifier-unexpected-verifier' });
+      return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+  done('googleoauth.pkce.s256_transform', 'pkce', 'The S256 transform is real SHA-256: BASE64URL(SHA256(ASCII(verifier))), unpadded', 'api', 'core', () =>
+    withRoot(async () =>
+      // RFC 7636 Appendix B's own test vector — a LITERAL, so this cannot become the twin
+      // agreeing with itself.
+      pkceS256('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk') === 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'),
+  ),
+  todo('googleoauth.pkce.verifier_length_validation', 'pkce', 'RFC 7636 verifier length rules (43-128 chars) rejected at the token endpoint', 'api', 'niche'),
+
+  // ── The token endpoint ───────────────────────────────────────────────────────────────────────
+  done('googleoauth.token.authorization_code', 'token', 'POST /token grant_type=authorization_code — the full success envelope', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: offline });
+      const t = flow.tokens;
+      return flow.status === 200
+        && typeof t.access_token === 'string' && String(t.access_token).startsWith('ya29.')
+        && t.expires_in === 3600
+        && t.token_type === 'Bearer'
+        && t.scope === 'openid email profile'
+        && typeof t.refresh_token === 'string' && String(t.refresh_token).startsWith('1//')
+        && typeof t.id_token === 'string';
+    })),
+  done('googleoauth.token.legacy_v4_path', 'token', 'POST /oauth2/v4/token — the legacy token path older clients default to', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const r = await h({ m: 'POST', p: '/oauth2/v4/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return r.status === 200 && String(body(r).access_token).startsWith('ya29.');
+    })),
+  done('googleoauth.token.code_single_use', 'token', 'An authorization code is redeemable EXACTLY ONCE; the replay is invalid_grant', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const redeem = () => h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      const first = await redeem();
+      const second = await redeem();
+      return first.status === 200 && second.status === 400 && err(second) === 'invalid_grant';
+    })),
+  done('googleoauth.token.code_expiry', 'token', 'An authorization code older than its ~10-minute life is invalid_grant', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const late = new Date(Date.parse(AT) + 11 * 60_000).toISOString();
+      const r = await h({ m: 'POST', p: '/token', at: late, b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      // …and it is only the CLOCK that made it fail: the same code inside the window works.
+      const flow2 = await consentFlow(h, {});
+      const early = new Date(Date.parse(AT) + 60_000).toISOString();
+      const r2 = await h({ m: 'POST', p: '/token', at: early, b: form({ grant_type: 'authorization_code', code: flow2.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return r.status === 400 && err(r) === 'invalid_grant' && r2.status === 200;
+    })),
+  done('googleoauth.token.unknown_code', 'token', 'An unknown code is invalid_grant with Google\'s "Bad Request" description', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: '4/0Anever-minted', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return r.status === 400 && err(r) === 'invalid_grant'
+        && body(r).error_description === 'The supplied authorization code is invalid or in the wrong format.';
+    })),
+  done('googleoauth.token.redirect_uri_mismatch', 'token', 'The redirect_uri must be REPEATED at the token endpoint and must match the code\'s', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const wrong = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT_URIS[1]! }) });
+      const missing = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      return wrong.status === 400 && err(wrong) === 'redirect_uri_mismatch' && missing.status === 400 && err(missing) === 'redirect_uri_mismatch';
+    })),
+  done('googleoauth.token.wrong_client_rejected', 'token', 'A code minted for one client cannot be redeemed by another', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'other.apps.googleusercontent.com', client_secret: 'GOCSPX-other', redirect_uris: [REDIRECT] }) });
+      const flow = await consentFlow(h, {});
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: 'other.apps.googleusercontent.com', client_secret: 'GOCSPX-other', redirect_uri: REDIRECT }) });
+      return r.status === 400 && err(r) === 'invalid_grant';
+    })),
+  done('googleoauth.token.invalid_client_secret', 'token', 'A wrong or missing client_secret is 401 invalid_client (not 400)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const wrong = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: 'GOCSPX-wrong', redirect_uri: REDIRECT }) });
+      const missing = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, redirect_uri: REDIRECT }) });
+      const unknown = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: 'nope.apps.googleusercontent.com', client_secret: 'x', redirect_uri: REDIRECT }) });
+      // The two DISTINCT messages captured live: an unknown client is "The OAuth client was not
+      // found."; a known client with the wrong secret is "The provided client secret is invalid."
+      return wrong.status === 401 && err(wrong) === 'invalid_client' && body(wrong).error_description === 'The provided client secret is invalid.'
+        && missing.status === 401 && err(missing) === 'invalid_client'
+        && unknown.status === 401 && err(unknown) === 'invalid_client' && body(unknown).error_description === 'The OAuth client was not found.';
+    })),
+  done('googleoauth.token.basic_auth', 'token', 'client_secret_basic: credentials in the Authorization header are accepted', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const basic = Buffer.from(`${encodeURIComponent(DEFAULT_CLIENT_ID)}:${encodeURIComponent(DEFAULT_CLIENT_SECRET)}`).toString('base64');
+      const r = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${basic}` }, b: form({ grant_type: 'authorization_code', code: flow.code!, redirect_uri: REDIRECT }) });
+      // …and a WRONG basic secret is still refused, so this is not "any header passes".
+      const flow2 = await consentFlow(h, {});
+      const badBasic = Buffer.from(`${encodeURIComponent(DEFAULT_CLIENT_ID)}:nope`).toString('base64');
+      const bad = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${badBasic}` }, b: form({ grant_type: 'authorization_code', code: flow2.code!, redirect_uri: REDIRECT }) });
+      return r.status === 200 && String(body(r).access_token).startsWith('ya29.') && bad.status === 401 && err(bad) === 'invalid_client';
+    })),
+  done('googleoauth.token.public_client_no_secret', 'token', 'An installed (public) client redeems with NO secret; a wrong one is still refused', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'installed.apps.googleusercontent.com', client_secret: 'GOCSPX-installed', client_type: 'installed', redirect_uris: [REDIRECT], name: 'Installed App' }) });
+      const mint = async () => {
+        const a = await h({ m: 'GET', p: authUrl({ client_id: 'installed.apps.googleusercontent.com' }) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        const d = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+        return qp(d, 'code')!;
+      };
+      const noSecret = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: await mint(), client_id: 'installed.apps.googleusercontent.com', redirect_uri: REDIRECT }) });
+      const wrongSecret = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: await mint(), client_id: 'installed.apps.googleusercontent.com', client_secret: 'GOCSPX-wrong', redirect_uri: REDIRECT }) });
+      return noSecret.status === 200 && String(body(noSecret).access_token).startsWith('ya29.') && wrongSecret.status === 401;
+    })),
+  done('googleoauth.token.missing_grant_type', 'token', 'Missing grant_type → 400 invalid_request naming the parameter', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/token', b: form({ code: 'x' }) });
+      return r.status === 400 && err(r) === 'invalid_request' && body(r).error_description === 'Missing required parameter: grant_type';
+    })),
+  done('googleoauth.token.unsupported_grant_type', 'token', 'An unmodelled grant_type is refused with unsupported_grant_type — never faked', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const password = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'password', username: 'a', password: 'b' }) });
+      const device = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: 'x' }) });
+      return password.status === 400 && err(password) === 'unsupported_grant_type'
+        && device.status === 400 && err(device) === 'unsupported_grant_type';
+    })),
+  done('googleoauth.token.missing_code', 'token', 'authorization_code grant with no code → 400 invalid_request', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return r.status === 400 && err(r) === 'invalid_request' && String(body(r).error_description).includes('code');
+    })),
+  done('googleoauth.token.no_store_headers', 'token', 'Token responses carry Cache-Control: no-store (RFC 6749 §5.1)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, {});
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return r.status === 200 && r.headers?.['cache-control'] === 'no-store' && r.headers?.pragma === 'no-cache';
+    })),
+  todo('googleoauth.token.json_body_tolerance', 'token', 'Accept an application/json token request body (the twin is form-encoded-only until this is grounded)', 'api', 'niche'),
+  todo('googleoauth.token.device_code_grant', 'token', 'grant_type=urn:ietf:params:oauth:grant-type:device_code (the TV/CLI flow)', 'api', 'common'),
+  todo('googleoauth.token.sts_token_exchange', 'token', 'The STS token-exchange grant — on sts.googleapis.com, a HOST this pack does not claim in VENDOR_HOSTS (workload identity federation)', 'api', 'niche'),
+
+  // ── Refresh ──────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.refresh.grant', 'refresh', 'grant_type=refresh_token mints a NEW access token for the same subject', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const first = await fullFlow(h, { params: offline });
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(first.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      const t = body(r);
+      // …and the REFRESHED token still belongs to an OFFLINE grant: deriving access_type from
+      // "did a refresh token come back?" made a refreshed token report `online`, which is wrong.
+      const info = await h({ m: 'GET', p: `/tokeninfo?access_token=${t.access_token}` });
+      return r.status === 200
+        && String(t.access_token).startsWith('ya29.')
+        && t.access_token !== first.tokens.access_token
+        && t.expires_in === 3600
+        // Google does NOT rotate the refresh token, so none comes back.
+        && t.refresh_token === undefined
+        && typeof t.id_token === 'string'
+        && ok(info) && body(info).access_type === 'offline' && body(info).sub === ADA.sub;
+    })),
+  done('googleoauth.refresh.only_when_offline', 'refresh', 'A refresh_token is issued only for access_type=offline — an online grant gets none', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const online = await fullFlow(h, {});
+      const offlineFlow = await fullFlow(h, { params: offline });
+      return online.status === 200 && online.tokens.refresh_token === undefined
+        && offlineFlow.status === 200 && typeof offlineFlow.tokens.refresh_token === 'string';
+    })),
+  done('googleoauth.refresh.second_grant_needs_prompt', 'refresh', 'A SECOND offline authorization gets no refresh_token unless prompt=consent forced the screen', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // Google's real rule, and the source of the classic "we lost the refresh token" bug.
+      const first = await fullFlow(h, { params: { access_type: 'offline' } });
+      const second = await fullFlow(h, { params: { access_type: 'offline' } });
+      const forced = await fullFlow(h, { params: offline });
+      return typeof first.tokens.refresh_token === 'string'
+        && second.status === 200 && second.tokens.refresh_token === undefined
+        && typeof forced.tokens.refresh_token === 'string';
+    })),
+  done('googleoauth.refresh.unknown_rejected', 'refresh', 'An unknown refresh token is invalid_grant "Token has been expired or revoked."', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: '1//0never', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      return r.status === 400 && err(r) === 'invalid_grant' && body(r).error_description === 'Token has been expired or revoked.';
+    })),
+  done('googleoauth.refresh.scope_narrowing', 'refresh', 'A refresh may NARROW the scope; widening it is invalid_scope (RFC 6749 §6)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const first = await fullFlow(h, { params: offline });
+      const rt = String(first.tokens.refresh_token);
+      const narrow = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: rt, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, scope: 'openid email' }) });
+      const wide = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: rt, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, scope: 'openid email https://www.googleapis.com/auth/drive' }) });
+      return narrow.status === 200 && body(narrow).scope === 'openid email'
+        && wide.status === 400 && err(wide) === 'invalid_scope';
+    })),
+  done('googleoauth.refresh.missing_token', 'refresh', 'refresh_token grant with no token → 400 invalid_request', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      return r.status === 400 && err(r) === 'invalid_request'
+        && body(r).error_description === 'Missing required parameter: refresh_token';
+    })),
+  todo('googleoauth.refresh.testing_mode_7_day_expiry', 'refresh', 'Refresh tokens expire after 7 days while the app is in testing status', 'api', 'common'),
+  todo('googleoauth.refresh.hundred_token_cap', 'refresh', 'The 101st refresh token per (user, client) silently invalidates the oldest', 'api', 'niche'),
+
+  // ── id_token / JWKS (real crypto) ────────────────────────────────────────────────────────────
+  done('googleoauth.idtoken.rs256_signed', 'idtoken', 'The id_token is a REAL RS256 JWT with Google\'s header shape', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const { header } = decodeJwt(String(flow.tokens.id_token));
+      return header.alg === 'RS256' && header.typ === 'JWT' && typeof header.kid === 'string' && (header.kid as string).length === 40;
+    })),
+  done('googleoauth.idtoken.jwks_endpoint', 'idtoken', 'GET /oauth2/v3/certs serves a real JWKS document', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: '/oauth2/v3/certs' });
+      const keys = body(r).keys as Body[];
+      return ok(r) && Array.isArray(keys) && keys.length === 1
+        && keys[0]!.kty === 'RSA' && keys[0]!.alg === 'RS256' && keys[0]!.use === 'sig'
+        && typeof keys[0]!.n === 'string' && keys[0]!.n.length > 300 && keys[0]!.e === 'AQAB';
+    })),
+  done('googleoauth.idtoken.verifies_against_jwks', 'idtoken', 'A twin-issued id_token VERIFIES against the JWKS the twin serves (claims round-trip)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      const v = verifyJwtWithJwks(String(flow.tokens.id_token), jwks, { now: AT_SECONDS + 10 });
+      return v.valid === true
+        && v.payload!.iss === 'https://accounts.google.com'
+        && v.payload!.sub === ADA.sub
+        && v.payload!.aud === DEFAULT_CLIENT_ID
+        && v.payload!.azp === DEFAULT_CLIENT_ID
+        && v.payload!.email === ADA.email
+        && v.payload!.email_verified === true;
+    })),
+  done('googleoauth.idtoken.tamper_rejected', 'idtoken', 'A tampered or expired id_token FAILS verification against the same JWKS', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const token = String(flow.tokens.id_token);
+      const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      const tampered = `${token.slice(0, -4)}AAAA`;
+      const good = verifyJwtWithJwks(token, jwks, { now: AT_SECONDS + 10 });
+      const bad = verifyJwtWithJwks(tampered, jwks, { now: AT_SECONDS + 10 });
+      const expired = verifyJwtWithJwks(token, jwks, { now: AT_SECONDS + 100_000 });
+      return good.valid === true && bad.valid === false && bad.reason === 'bad_signature' && expired.valid === false && expired.reason === 'expired';
+    })),
+  done('googleoauth.idtoken.stable_kid', 'idtoken', 'The token header kid matches a JWKS kid, and is STABLE across calls (one persisted key)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const { header } = decodeJwt(String(flow.tokens.id_token));
+      const jwks1 = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      const jwks2 = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      return header.kid === jwks1.keys[0]!.kid && jwks1.keys[0]!.kid === jwks2.keys[0]!.kid && jwks1.keys[0]!.n === jwks2.keys[0]!.n;
+    })),
+  done('googleoauth.idtoken.at_hash', 'idtoken', 'at_hash is the real OIDC left-half SHA-256 of the access token (openid-client validates it)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const { payload } = decodeJwt(String(flow.tokens.id_token));
+      // Recomputed here from the OIDC Core §3.1.3.6 definition, independently of the handler.
+      const digest = new Bun.CryptoHasher('sha256').update(String(flow.tokens.access_token)).digest();
+      const expected = Buffer.from(digest.subarray(0, digest.length / 2)).toString('base64url');
+      return payload.at_hash === expected && typeof payload.at_hash === 'string';
+    })),
+  done('googleoauth.idtoken.nonce_roundtrip', 'idtoken', 'A `nonce` on the authorization request rides into the id_token; without one it is absent', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const withNonce = await fullFlow(h, { params: { nonce: 'n-0S6_WzA2Mj' } });
+      const without = await fullFlow(h, {});
+      return decodeJwt(String(withNonce.tokens.id_token)).payload.nonce === 'n-0S6_WzA2Mj'
+        && decodeJwt(String(without.tokens.id_token)).payload.nonce === undefined;
+    })),
+  done('googleoauth.idtoken.claims_follow_scope', 'idtoken', 'Profile/email claims appear ONLY when their scope was granted', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const full = await fullFlow(h, { params: { scope: 'openid email profile' } });
+      const openidOnly = await fullFlow(h, { params: { scope: 'openid' } });
+      const emailOnly = await fullFlow(h, { params: { scope: 'openid email' } });
+      const f = decodeJwt(String(full.tokens.id_token)).payload;
+      const o = decodeJwt(String(openidOnly.tokens.id_token)).payload;
+      const e = decodeJwt(String(emailOnly.tokens.id_token)).payload;
+      return f.email === ADA.email && f.name === ADA.name && f.picture === ADA.picture
+        && o.email === undefined && o.name === undefined && o.sub === ADA.sub
+        && e.email === ADA.email && e.name === undefined;
+    })),
+  done('googleoauth.idtoken.omitted_without_openid', 'idtoken', 'A plain OAuth 2.0 grant (no `openid` scope) gets NO id_token', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await fullFlow(h, { params: { scope: 'https://www.googleapis.com/auth/calendar.readonly' } });
+      return r.status === 200 && typeof r.tokens.access_token === 'string' && r.tokens.id_token === undefined;
+    })),
+  done('googleoauth.idtoken.hd_claim', 'idtoken', 'A Workspace account\'s `hd` claim rides in the id_token; a consumer account has none', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const workspace = await fullFlow(h, { sub: GRACE.sub });
+      const consumer = await fullFlow(h, { sub: ADA.sub });
+      return decodeJwt(String(workspace.tokens.id_token)).payload.hd === GRACE.hd
+        && decodeJwt(String(consumer.tokens.id_token)).payload.hd === undefined;
+    })),
+  done('googleoauth.idtoken.legacy_pem_certs', 'idtoken', 'GET /oauth2/v1/certs serves the SAME key in PEM form, keyed by kid', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const pem = body(await h({ m: 'GET', p: '/oauth2/v1/certs' }));
+      const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      const kid = jwks.keys[0]!.kid;
+      return Object.keys(pem).length === 1 && typeof pem[kid] === 'string' && String(pem[kid]).includes('-----BEGIN PUBLIC KEY-----');
+    })),
+  todo('googleoauth.idtoken.key_rotation', 'idtoken', 'Google publishes several keys and rotates them; the twin serves exactly one', 'api', 'common'),
+  todo('googleoauth.certs.v1_x509_certificate', 'idtoken', '/oauth2/v1/certs serves X.509 CERTIFICATES; the twin serves the bare public key PEM', 'api', 'niche'),
+  todo('googleoauth.idtoken.iss_bare_host_variant', 'idtoken', 'Google also issues `iss: accounts.google.com` (no scheme); the twin always uses the URL form', 'api', 'niche'),
+
+  // ── Granular / incremental consent ───────────────────────────────────────────────────────────
+  done('googleoauth.granular.declined_scope_excluded', 'granular', 'A scope the user unticks is NOT in the grant, the redirect\'s scope, or the token', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const scope = 'openid email https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/drive.file';
+      // Tick only the calendar scope; drive.file is declined.
+      const flow = await consentFlow(h, { params: { scope }, tick: ['https://www.googleapis.com/auth/calendar.readonly'] });
+      const granted = qp(flow.redirect, 'scope') ?? '';
+      const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      if (!granted.includes('calendar.readonly') || granted.includes('drive.file')) return false;
+      if (!String(body(token).scope).includes('calendar.readonly') || String(body(token).scope).includes('drive.file')) return false;
+
+      // …and the GRANT, which is the clause the title makes and the one that was false: an earlier
+      // version unioned the prior scopes in unconditionally, so a decline stayed in the grant and a
+      // later `include_granted_scopes=true` handed the scope back WITHOUT the user re-ticking it.
+      // Grant everything first, then decline one, then ask incrementally — the resurrection path.
+      await consentFlow(h, { params: { scope } });
+      const declineRound = await consentFlow(h, { params: { scope }, tick: ['https://www.googleapis.com/auth/calendar.readonly'] });
+      if (String(qp(declineRound.redirect, 'scope')).includes('drive.file')) return false;
+      const incremental = await consentFlow(h, { params: { scope: 'openid', include_granted_scopes: 'true' } });
+      const unioned = qp(incremental.redirect, 'scope') ?? '';
+      if (!unioned.includes('calendar.readonly') || unioned.includes('drive.file')) return false;
+
+      // …and the SAME-REQUEST case, which the across-requests test above structurally cannot see:
+      // decline a scope on a screen that ALSO carries include_granted_scopes=true. An earlier
+      // version computed the token's scope set from the PRE-removal prior scopes, so the scope the
+      // user unticked on that very screen was handed straight back — leaving an access token whose
+      // scope set was a strict superset of the grant that authorised it (§9 round two, MAJOR).
+      const both = 'openid https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/calendar.readonly';
+      await consentFlow(h, { params: { scope: both }, sub: GRACE.sub });
+      const sameRequest = await consentFlow(h, {
+        params: { scope: both, include_granted_scopes: 'true' },
+        sub: GRACE.sub,
+        tick: ['https://www.googleapis.com/auth/calendar.readonly'],
+      });
+      const echoed = qp(sameRequest.redirect, 'scope') ?? '';
+      if (echoed.includes('drive.file')) return false;
+      const sameToken = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: sameRequest.code!, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+      return ok(sameToken) && !String(body(sameToken).scope).includes('drive.file')
+        && String(body(sameToken).scope).includes('calendar.readonly');
+    })),
+  done('googleoauth.granular.oidc_scopes_not_declinable', 'granular', 'openid/email/profile ride with signing in — they survive even when nothing is ticked', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await consentFlow(h, { params: { scope: 'openid email profile https://www.googleapis.com/auth/drive.file' }, tick: [] });
+      const granted = qp(flow.redirect, 'scope') ?? '';
+      return granted === 'openid email profile' && !granted.includes('drive.file');
+    })),
+  done('googleoauth.granular.all_declined_is_denial', 'granular', 'Unticking every scope on a granular screen is access_denied, not an empty grant', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // TWO product scopes, so Google's granular rule actually shows checkboxes to untick.
+      const flow = await consentFlow(h, { params: { scope: 'https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/calendar.readonly' }, tick: [] });
+      return flow.redirect.status === 302 && qp(flow.redirect, 'error') === 'access_denied' && flow.code === null;
+    })),
+  done('googleoauth.granular.rule_governs_the_screen', 'granular', 'The per-scope checkboxes appear ONLY when Google\'s granular rule applies — and the grant follows the screen', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // Google documents the rule: checkboxes when (a sign-in scope + a product scope) or (two or
+      // more product scopes). One scope, or sign-in scopes alone, is all-or-nothing. An integration
+      // asking for exactly one product scope can therefore NEVER get a partial grant, and a twin
+      // that offered a checkbox there would invent a code path production never produces.
+      const single = await consentFlow(h, { params: { scope: 'https://www.googleapis.com/auth/drive.file' }, tick: [] });
+      const signInOnly = await consentFlow(h, { params: { scope: 'openid email profile' }, tick: [] });
+      const mixed = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file' }, tick: [] });
+      return (qp(single.redirect, 'scope') ?? '') === 'https://www.googleapis.com/auth/drive.file'
+        && (qp(signInOnly.redirect, 'scope') ?? '') === 'openid email profile'
+        // …and where the rule DOES apply, unticking really removes the scope.
+        && (qp(mixed.redirect, 'scope') ?? '') === 'openid';
+    })),
+  done('googleoauth.granular.incremental_authorization', 'granular', 'include_granted_scopes=true unions this grant with everything previously granted', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/calendar.readonly' } });
+      const second = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file', include_granted_scopes: 'true' } });
+      const granted = qp(second.redirect, 'scope') ?? '';
+      // …and WITHOUT the flag the third grant is narrow again, so the union is the flag's doing.
+      const third = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file' } });
+      const narrow = qp(third.redirect, 'scope') ?? '';
+      return granted.includes('calendar.readonly') && granted.includes('drive.file')
+        && !narrow.includes('calendar.readonly') && narrow.includes('drive.file');
+    })),
+  done('googleoauth.granular.unknown_scope_accepted', 'granular', 'An unrecognised scope string is ACCEPTED (Google does not curate them) and echoed back', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const weird = 'https://www.googleapis.com/auth/some-future-product.readonly';
+      const flow = await consentFlow(h, { params: { scope: `openid ${weird}` }, tick: [weird] });
+      return (qp(flow.redirect, 'scope') ?? '').includes(weird) && !!flow.code;
+    })),
+
+  // ── The dirty-state verify (behaviour that only breaks OVER prior state) ─────────────────────
+  done('googleoauth.grants.regrant_after_revoke', 'grants', 'DIRTY STATE: revoke a grant, re-consent, and the NEW tokens work while the old stay dead', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // Every other verify starts from a fresh root and therefore cannot see this class of bug:
+      // a sticky revocation tombstone that poisons the re-grant, or a re-grant that resurrects
+      // the revoked tokens.
+      const first = await fullFlow(h, { params: offline });
+      const oldAccess = String(first.tokens.access_token);
+      const oldRefresh = String(first.tokens.refresh_token);
+      const revoked = await h({ m: 'POST', p: '/revoke', b: `token=${oldRefresh}` });
+      if (revoked.status !== 200) return false;
+      // The old credentials are dead in BOTH directions.
+      const deadUser = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${oldAccess}` } });
+      const deadRefresh = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: oldRefresh, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      if (deadUser.status !== 401 || deadRefresh.status !== 400) return false;
+      // Re-consent over that dirty state mints working credentials again — and crucially WITHOUT
+      // `prompt=consent`, which would force a refresh token unconditionally and route around the
+      // defect. Google treats a re-consent after revocation as a FIRST authorization, so an offline
+      // request must get a refresh token back; an earlier version left the grant row standing after
+      // revocation and silently withheld one (§9 round one).
+      const second = await fullFlow(h, { params: { access_type: 'offline' } });
+      if (typeof second.tokens.refresh_token !== 'string') return false;
+      const newAccess = String(second.tokens.access_token);
+      const liveUser = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${newAccess}` } });
+      // …and the OLD ones are still dead afterwards (no resurrection).
+      const stillDead = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${oldAccess}` } });
+      // …and the revoked refresh token is still dead, so the new grant did not resurrect the old one.
+      const oldRefreshAgain = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: oldRefresh, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      return second.status === 200 && newAccess !== oldAccess && liveUser.status === 200
+        && body(liveUser).sub === ADA.sub && stillDead.status === 401 && oldRefreshAgain.status === 400;
+    })),
+  done('googleoauth.grants.per_account_isolation', 'grants', 'Two accounts consenting to one client keep SEPARATE grants and tokens', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const ada = await fullFlow(h, { sub: ADA.sub });
+      const grace = await fullFlow(h, { sub: GRACE.sub });
+      const adaInfo = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${ada.tokens.access_token}` } });
+      const graceInfo = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${grace.tokens.access_token}` } });
+      // Revoking one must not touch the other — the grant is per (client, user).
+      await h({ m: 'POST', p: '/revoke', b: `token=${ada.tokens.access_token}` });
+      const adaAfter = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${ada.tokens.access_token}` } });
+      const graceAfter = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${grace.tokens.access_token}` } });
+      return body(adaInfo).sub === ADA.sub && body(graceInfo).sub === GRACE.sub
+        && adaAfter.status === 401 && graceAfter.status === 200 && body(graceAfter).sub === GRACE.sub;
+    })),
+
+  done('googleoauth.ids.pull_after_local_create_no_collision', 'grants', 'ID COLLISION: a pull over a locally registered client of the SAME client_id leaves it BEHAVIOURALLY intact (no confidential\u2192public downgrade)', 'connector', 'core', () =>
+    withRoot(async () => {
+      // This vendor is unusually exposed to the collision class §9 names: the connector pulls rows
+      // keyed by the REAL client_id and the REAL account `sub`, which are exactly the ids an
+      // operator registers locally. A pulled client carries `secret: null` and
+      // `clientType: 'installed'`, so a clobber would DOWNGRADE a confidential client — after which
+      // the app's real secret is rejected and a secret-less caller is accepted.
+      //
+      // WHAT THIS ACTUALLY PINS, stated honestly (§9 round two): the kernel folds local actions OVER
+      // the observed mirror unconditionally, so this direction is safe BY CONSTRUCTION rather than
+      // by anything this pack does. That is exactly why it is worth a capability — the property is
+      // load-bearing here, it is invisible in this pack's own source, and nothing else in the pack
+      // would notice if the kernel's fold order ever changed.
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-collide-'));
+      try {
+        const azp = FAKE_TOKENINFO.azp;
+        const h = (m: string, p: string, b?: string) =>
+          handleGoogleOAuthTwinRequest({ method: m, path: p, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT });
+        // LOCAL first, then PULL over it.
+        await h('POST', '/_twin/clients', JSON.stringify({ client_id: azp, client_secret: 'GOCSPX-mine', name: 'My Real App', redirect_uris: [REDIRECT] }));
+        await syncGoogleOAuthFromReal(fakeExecute, { root });
+        // The local registration must survive, and be BEHAVIOURALLY intact: a code minted for it
+        // still requires the real secret, which is the property a downgrade would destroy.
+        const page = await h('GET', authUrl({ client_id: azp }));
+        if (!String(page.body).includes('My Real App')) return false;
+        const rid = AUTH_REQUEST_RE.exec(String(page.body))?.[1] ?? '';
+        const decision = await h('POST', '/_twin/consent', form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }));
+        const code = new URL(decision.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+        const withSecret = await h('POST', '/token', form({ grant_type: 'authorization_code', code, client_id: azp, client_secret: 'GOCSPX-mine', redirect_uri: REDIRECT }));
+        const page2 = await h('GET', authUrl({ client_id: azp }));
+        const rid2 = AUTH_REQUEST_RE.exec(String(page2.body))?.[1] ?? '';
+        const d2 = await h('POST', '/_twin/consent', form({ auth_request: rid2, sub: ADA.sub, decision: 'allow' }));
+        const code2 = new URL(d2.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+        const withoutSecret = await h('POST', '/token', form({ grant_type: 'authorization_code', code: code2, client_id: azp, redirect_uri: REDIRECT }));
+        return withSecret.status === 200 && withoutSecret.status === 401;
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.ids.local_create_after_pull_no_collision', 'grants', 'ID COLLISION, the other direction: a pulled client is UNUSABLE until registered, and registering over it takes effect', 'connector', 'core', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-collide2-'));
+      try {
+        // The second half of this pair is NOT the mirror image of the first — under the kernel's
+        // fold there is no mirror image. What is genuinely this pack's own behaviour is the FIRST
+        // assertion below: a pulled-only client is UNUSABLE, because tokeninfo discloses no redirect
+        // URIs and the twin refuses to invent one (§9 round two).
+        const azp = FAKE_TOKENINFO.azp;
+        const sub = FAKE_USERINFO.sub;
+        const h = (m: string, p: string, b?: string) =>
+          handleGoogleOAuthTwinRequest({ method: m, path: p, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT });
+        // PULL FIRST. A pulled client discloses no redirect URIs (tokeninfo does not return any), so
+        // it is correctly UNUSABLE for a consent flow — the twin refuses with redirect_uri_mismatch
+        // rather than inventing a registration. That refusal is the honest state, and it is what a
+        // clobber in this direction would silently replace.
+        await syncGoogleOAuthFromReal(fakeExecute, { root });
+        const beforeRegistration = await h('GET', authUrl({ client_id: azp }));
+        if (beforeRegistration.status !== 302) return false;
+        const errorTarget = new URL(loc(beforeRegistration));
+        if (decodeAuthError(errorTarget.searchParams.get('authError') ?? '')?.code !== 'redirect_uri_mismatch') return false;
+
+        // …then REGISTER over it. The local action must win over the pulled observation.
+        await h('POST', '/_twin/clients', JSON.stringify({ client_id: azp, client_secret: 'GOCSPX-later', name: 'Registered Later', redirect_uris: [REDIRECT] }));
+        const page = await h('GET', authUrl({ client_id: azp }));
+        if (page.status !== 200) return false;
+        if (!html(page).includes('Registered Later') || html(page).includes('Pulled client')) return false;
+
+        // …and the PULLED PERSONA is a real account that can consent through it, keyed by the real
+        // Google `sub` the pull brought in — a local consent must not overwrite a pulled subject.
+        if (!html(page).includes(FAKE_USERINFO.email)) return false;
+        const rid = AUTH_REQUEST_RE.exec(html(page))?.[1] ?? '';
+        const decision = await h('POST', '/_twin/consent', form({ auth_request: rid, sub, decision: 'allow' }));
+        const code = new URL(decision.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+        const token = await h('POST', '/token', form({ grant_type: 'authorization_code', code, client_id: azp, client_secret: 'GOCSPX-later', redirect_uri: REDIRECT }));
+        return token.status === 200
+          && decodeJwt(String((token.body as Body).id_token)).payload.sub === sub
+          && decodeJwt(String((token.body as Body).id_token)).payload.email === FAKE_USERINFO.email;
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  // ── userinfo ─────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.userinfo.get', 'userinfo', 'GET /v1/userinfo returns the OIDC claim set for the bearer\'s subject', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      const u = body(r);
+      return ok(r) && u.sub === ADA.sub && u.email === ADA.email && u.email_verified === true
+        && u.name === ADA.name && u.given_name === ADA.givenName && u.picture === ADA.picture;
+    })),
+  done('googleoauth.userinfo.legacy_path', 'userinfo', 'GET /oauth2/v3/userinfo — the www.googleapis.com alias serves the same claims', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const r = await h({ m: 'GET', p: '/oauth2/v3/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      return ok(r) && body(r).sub === ADA.sub && body(r).email === ADA.email;
+    })),
+  done('googleoauth.userinfo.post_method', 'userinfo', 'POST /v1/userinfo is accepted as well as GET (OIDC Core §5.3.1)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const r = await h({ m: 'POST', p: '/v1/userinfo', b: '', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      return ok(r) && body(r).sub === ADA.sub;
+    })),
+  done('googleoauth.userinfo.unauthenticated_two_hosts', 'userinfo', 'A bad credential is 401 on BOTH hosts — with the DIFFERENT error bodies each host really returns', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // The trap: openidconnect.googleapis.com answers `invalid_request`/"Invalid Credentials"
+      // while www.googleapis.com answers `invalid_token`/"Invalid Value" for the same failure.
+      // Normalising the two would hide a real difference an integration can trip over.
+      const noneOidc = await h({ m: 'GET', p: '/v1/userinfo' });
+      const bogusOidc = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: 'Bearer ya29.not-a-real-token' } });
+      const bogusApis = await h({ m: 'GET', p: '/oauth2/v3/userinfo', h: { authorization: 'Bearer ya29.not-a-real-token' } });
+      return noneOidc.status === 401 && err(noneOidc) === 'invalid_request' && body(noneOidc).error_description === 'Invalid Credentials'
+        && bogusOidc.status === 401 && err(bogusOidc) === 'invalid_request'
+        && bogusApis.status === 401 && err(bogusApis) === 'invalid_token' && body(bogusApis).error_description === 'Invalid Value';
+    })),
+  done('googleoauth.userinfo.insufficient_scope', 'userinfo', 'A token with no identity scope is REFUSED — never an empty or partial profile', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: { scope: 'https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/drive.file' } });
+      const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      // Refusal, not a fake success. Google's EXACT answer for this case was not captured, so the
+      // twin reuses the credential-rejection envelope rather than inventing a third shape —
+      // `googleoauth.userinfo.insufficient_scope_shape` is the filed todo.
+      const okToken = await fullFlow(h, { params: { scope: 'openid email' } });
+      const good = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${okToken.tokens.access_token}` } });
+      return r.status === 401 && body(r).sub === undefined && body(r).email === undefined
+        && good.status === 200 && body(good).sub === ADA.sub;
+    })),
+  done('googleoauth.userinfo.claims_follow_scope', 'userinfo', 'userinfo claims are filtered by granted scope, exactly as the id_token\'s are', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const emailOnly = await fullFlow(h, { params: { scope: 'openid email' } });
+      const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${emailOnly.tokens.access_token}` } });
+      return ok(r) && body(r).sub === ADA.sub && body(r).email === ADA.email && body(r).name === undefined;
+    })),
+  done('googleoauth.userinfo.expired_token', 'userinfo', 'An access token past its 3600s life → 401, not a stale profile', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const later = new Date(Date.parse(AT) + 3600_000).toISOString();
+      const r = await h({ m: 'GET', p: '/v1/userinfo', at: later, h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      const stillFine = await h({ m: 'GET', p: '/v1/userinfo', at: new Date(Date.parse(AT) + 1000).toISOString(), h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      return r.status === 401 && stillFine.status === 200;
+    })),
+
+  // ── revoke ───────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.revoke.post', 'revoke', 'POST /revoke with a form-encoded token → 200, an empty body, and the token really stops working', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // A `200 {}` is exactly what a DEAD handler returns, so status+shape alone is not a check —
+      // the mutation gate caught this verify surviving a behaviourally-empty twin. The teeth are the
+      // EFFECT: the revoked token must stop working, and an unrelated token must not.
+      const victim = await fullFlow(h, { params: offline });
+      const bystander = await fullFlow(h, { sub: GRACE.sub, params: offline });
+      const before = await h({ m: 'GET', p: `/tokeninfo?access_token=${victim.tokens.access_token}` });
+      if (!ok(before)) return false;
+
+      const r = await h({ m: 'POST', p: '/revoke', b: `token=${victim.tokens.refresh_token}` });
+      if (r.status !== 200 || Object.keys(body(r)).length !== 0) return false;
+
+      const after = await h({ m: 'GET', p: `/tokeninfo?access_token=${victim.tokens.access_token}` });
+      const refreshed = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(victim.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      const other = await h({ m: 'GET', p: `/tokeninfo?access_token=${bystander.tokens.access_token}` });
+      return after.status === 400 && err(after) === 'invalid_token'
+        && refreshed.status === 400 && err(refreshed) === 'invalid_grant'
+        && ok(other) && body(other).sub === GRACE.sub;
+    })),
+  done('googleoauth.revoke.get', 'revoke', 'GET /revoke?token= is accepted too', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const r = await h({ m: 'GET', p: `/revoke?token=${flow.tokens.access_token}` });
+      const after = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+      return r.status === 200 && after.status === 401;
+    })),
+  done('googleoauth.revoke.whole_grant', 'revoke', 'Revoking EITHER token kills the WHOLE grant — access and refresh together', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: offline });
+      // Revoke the ACCESS token; the REFRESH token must die with it.
+      const r = await h({ m: 'POST', p: '/revoke', b: `token=${flow.tokens.access_token}` });
+      const refresh = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(flow.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+      return r.status === 200 && refresh.status === 400 && err(refresh) === 'invalid_grant';
+    })),
+  done('googleoauth.revoke.unknown_token', 'revoke', 'An unknown token → 400 invalid_token "Token expired or revoked"', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: '/revoke', b: 'token=ya29.never-existed' });
+      const missing = await h({ m: 'POST', p: '/revoke', b: '' });
+      return r.status === 400 && err(r) === 'invalid_token' && body(r).error_description === 'Token expired or revoked'
+        && missing.status === 400 && err(missing) === 'invalid_request';
+    })),
+
+  // ── tokeninfo ────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.tokeninfo.access_token', 'tokeninfo', 'GET /tokeninfo?access_token= describes the token (aud/azp/sub/scope/exp, as STRINGS)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, { params: offline });
+      const r = await h({ m: 'GET', p: `/tokeninfo?access_token=${flow.tokens.access_token}` });
+      const t = body(r);
+      return ok(r) && t.aud === DEFAULT_CLIENT_ID && t.azp === DEFAULT_CLIENT_ID && t.sub === ADA.sub
+        && t.scope === 'openid email profile' && t.email === ADA.email
+        // Google returns exp/expires_in as STRINGS on this endpoint, not numbers.
+        && typeof t.exp === 'string' && typeof t.expires_in === 'string' && t.access_type === 'offline';
+    })),
+  done('googleoauth.tokeninfo.invalid', 'tokeninfo', 'An unknown, revoked or expired token → 400 invalid_token "Invalid Value"', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const flow = await fullFlow(h, {});
+      const unknown = await h({ m: 'GET', p: '/tokeninfo?access_token=ya29.nope' });
+      await h({ m: 'POST', p: '/revoke', b: `token=${flow.tokens.access_token}` });
+      const revoked = await h({ m: 'GET', p: `/tokeninfo?access_token=${flow.tokens.access_token}` });
+      const none = await h({ m: 'GET', p: '/tokeninfo' });
+      return unknown.status === 400 && err(unknown) === 'invalid_token' && body(unknown).error_description === 'Invalid Value'
+        && revoked.status === 400 && none.status === 400 && err(none) === 'invalid_request';
+    })),
+  todo('googleoauth.tokeninfo.id_token', 'tokeninfo', 'GET /tokeninfo?id_token= — the id_token branch (its exact field set is not grounded yet)', 'api', 'niche'),
+  // Two gaps this pack's own code and README already CITE by id. Filing them is not bookkeeping:
+  // an id referenced in a comment but absent from the manifest is a gap that reads as tracked and
+  // is tracked nowhere.
+  todo('googleoauth.errors.authError_captured_literal', 'errors', 'Pin the authError protobuf against a CAPTURED base64url literal from a real ?authError= — the wire format is reproduced from a decode and is self-consistent, but nothing in the pack proves it byte-for-byte', 'api', 'common'),
+  todo('googleoauth.errors.error_page_http_status', 'errors', 'The HTTP status Google serves /signin/oauth/error with (the twin serves 200 and carries the named status in the payload)', 'api', 'niche'),
+  todo('googleoauth.userinfo.insufficient_scope_shape', 'userinfo', 'Google\'s exact status + body for a VALID token that holds no identity scope (the twin refuses with the credential-rejection envelope)', 'api', 'niche'),
+
+  // ── The service-account (two-legged) grant ───────────────────────────────────────────────────
+  done('googleoauth.serviceaccount.jwt_bearer_access_token', 'serviceaccount', 'grant_type=jwt-bearer mints an access token (what google-auth-library does before any Vertex/GCS call)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const assertion = `e30.${Buffer.from(JSON.stringify({ iss: 'svc@twin.iam.gserviceaccount.com', scope: 'https://www.googleapis.com/auth/cloud-platform' })).toString('base64url')}.sig`;
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion }) });
+      const t = body(r);
+      if (!ok(r) || !String(t.access_token).startsWith('ya29.') || t.token_type !== 'Bearer' || t.expires_in !== 3600) return false;
+      if (t.scope !== 'https://www.googleapis.com/auth/cloud-platform' || t.id_token !== undefined) return false;
+      // …and the token is USABLE, which is the whole point of a credential. An earlier version
+      // minted a bare string and persisted nothing, so the twin's own /tokeninfo refused the token
+      // it had just issued (§9 round one).
+      const info = await h({ m: 'GET', p: `/tokeninfo?access_token=${t.access_token}` });
+      // A service account is not a consenting user, so userinfo correctly refuses it — there is no
+      // account row and no grant behind it.
+      const profile = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${t.access_token}` } });
+      return ok(info) && body(info).scope === 'https://www.googleapis.com/auth/cloud-platform'
+        && profile.status === 401;
+    })),
+  done('googleoauth.serviceaccount.jwt_bearer_id_token', 'serviceaccount', 'A target_audience assertion mints a REAL RS256 id_token for that audience (getIdTokenClient)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const assertion = `e30.${Buffer.from(JSON.stringify({ iss: 'svc@twin.iam.gserviceaccount.com', target_audience: 'https://my-service.run.app' })).toString('base64url')}.sig`;
+      const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion }) });
+      const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' })) as Jwks;
+      const v = verifyJwtWithJwks(String(body(r).id_token), jwks, { now: AT_SECONDS + 10 });
+      // gemini-twin.ts's §googleauth stub returned an `alg: none` token here. This one is signed
+      // and verifies, which is the whole reason the surface moved into a pack of its own.
+      return ok(r) && body(r).access_token === undefined && v.valid === true
+        && v.payload!.aud === 'https://my-service.run.app'
+        && v.payload!.email === 'svc@twin.iam.gserviceaccount.com'
+        // `sub` is the account's NUMERIC unique id, NOT its address — an earlier version put the
+        // e-mail in both (§9 round one). The twin derives a stable 21-digit stand-in, because it has
+        // no directory to look the real number up in.
+        && typeof v.payload!.sub === 'string'
+        && /^\d{21}$/.test(String(v.payload!.sub))
+        && v.payload!.sub !== v.payload!.email;
+    })),
+  done('googleoauth.serviceaccount.missing_assertion', 'serviceaccount', 'jwt-bearer with no assertion → 400 invalid_request; an unparseable one → invalid_grant', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const none = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer' }) });
+      const junk = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: 'not.a.jwt' }) });
+      // Captured live: a MALFORMED assertion is `invalid_request` / "Bad Request" — the string a
+      // widely-repeated assumption misattributes to `invalid_grant` on the code grant.
+      return none.status === 400 && err(none) === 'invalid_request'
+        && junk.status === 400 && err(junk) === 'invalid_request' && body(junk).error_description === 'Bad Request';
+    })),
+  // §9 round one was right: verifying an RS256 assertion needs the
+  // PUBLIC half, which a world's own service-account key file carries and the twin could register
+  // exactly as it registers OAuth clients. The honest label is "no service-account key registry
+  // yet", which is a todo.
+  todo('googleoauth.serviceaccount.assertion_signature_verified', 'serviceaccount', 'Verify the jwt-bearer assertion\'s RS256 signature against a registered service-account public key (the twin decodes but does not verify today)', 'api', 'common'),
+  todo('googleoauth.serviceaccount.domain_wide_delegation', 'serviceaccount', 'The `sub` impersonation claim (Workspace domain-wide delegation)', 'api', 'niche'),
+
+  // ── Errors / twin-level behaviour ────────────────────────────────────────────────────────────
+  done('googleoauth.errors.unmodeled_route_404', 'errors', 'An unmodelled path is REFUSED with a 404 error envelope — never a fake success', 'api', 'core', () =>
+    withRoot(async (h) => {
+      // Paths the twin does not serve, including two Google DOES serve and this pack files as
+      // todos (`/gsi/client`, `/o/oauth2/postmessageRelay`) — refusing those is the point: an
+      // unmodelled operation must fail, not be answered by a twin that cannot serve it.
+      const e = (r: GoogleOAuthResponse) => (body(r).error ?? {}) as Body;
+      const paths = ['/o/oauth2/postmessageRelay', '/gsi/client', '/device/code', '/oauth2/v2/userinfo', '/oauth2/v2/certs', '/no/such/thing'];
+      for (const path of paths) {
+        const r = await h({ m: 'GET', p: path });
+        if (r.status !== 404 || e(r).code !== 404 || e(r).status !== 'NOT_FOUND') return false;
+      }
+      // …and a path the twin DOES serve is not swept up by the same branch.
+      return (await h({ m: 'GET', p: '/oauth2/v3/certs' })).status === 200;
+    })),
+  done('googleoauth.errors.wrong_method', 'errors', 'A wrong METHOD on a modelled endpoint is 405, not a 404 or a silent success', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'DELETE', p: '/token' });
+      return r.status === 405 && ((body(r).error ?? {}) as Body).status === 'FAILED_PRECONDITION';
+    })),
+  done('googleoauth.errors.malformed_request_guard', 'errors', 'A malformed request becomes the vendor 400 envelope, never an unhandled throw or a non-vendor 500', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // The route-boundary guard's real job. Basic credentials are percent-DECODED (RFC 6749
+      // §2.3.1 requires it), so a broken escape sequence reaches `decodeURIComponent` and throws a
+      // URIError — which must surface as Google's own error body, not as an HTML 500.
+      const broken = Buffer.from('%E0%A4%A:secret').toString('base64');
+      const r = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${broken}` }, b: form({ grant_type: 'authorization_code', code: 'x', redirect_uri: REDIRECT }) });
+      if (r.status !== 400 || err(r) !== 'invalid_request') return false;
+      // …and the CLASS is closed: a spread of hostile inputs each answers with a modelled status
+      // and a vendor-shaped body rather than escaping the handler.
+      const hostile: Step[] = [
+        { m: 'POST', p: '/token', b: '%%%' },
+        { m: 'POST', p: '/token', b: 'grant_type=authorization_code&code=%E0%A4%A' },
+        { m: 'GET', p: '/o/oauth2/v2/auth?client_id=%E0%A4%A' },
+        { m: 'GET', p: `/tokeninfo?access_token=${'x'.repeat(5000)}` },
+        { m: 'POST', p: '/_twin/clients', b: 'not json at all' },
+        { m: 'POST', p: '/revoke', b: 'token=%E0%A4%A' },
+      ];
+      for (const step of hostile) {
+        const res = await h(step);
+        // A 302 to Google's own error page is a MODELLED answer, not an escape: its payload is the
+        // vendor-shaped part, and the body is deliberately empty.
+        // The predicate has to be one a DEAD handler fails. `!!body && typeof body === 'object'`
+        // was not: `return {}` satisfies it for every step (§9 round one). A modelled refusal names
+        // itself — an OAuth `error` code, a Google-API `error.status`, a 302 to the error page, or a
+        // rendered "Error <n>: <code>" line — and `{}` has none of those.
+        const b = res.body as Record<string, unknown> | string | null;
+        const named = res.status === 302
+          ? !!res.headers?.location && new URL(res.headers.location).pathname === ERROR_PAGE_PATH
+          : typeof b === 'string'
+            ? /Error \d{3}: [a-z_]+/.test(text(b))
+            // A JSON refusal must ALSO be a 4xx. Without the status check a saboteur answering one
+            // hard-coded `{ error: … }` at 200 read as a modelled refusal for every step
+            // (§9 round two).
+            : res.status >= 400
+              && (typeof (b as Record<string, unknown>)?.error === 'string'
+                || typeof ((b as Record<string, any>)?.error?.status) === 'string');
+        if (res.status < 200 || res.status >= 500 || !named) return false;
+      }
+      return true;
+    })),
+  done('googleoauth.twin.read_only_refuses_writes', 'errors', 'A read-only twin refuses every credential-minting leg but still serves the stateless reads', 'api', 'common', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-ro-'));
+      try {
+        const ro = (method: string, path: string, b?: string) =>
+          handleGoogleOAuthTwinRequest({ method, path, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT, readOnly: true });
+        const auth = await ro('GET', authUrl({}));
+        const token = await ro('POST', '/token', form({ grant_type: 'refresh_token', refresh_token: 'x' }));
+        const certs = await ro('GET', '/oauth2/v3/certs');
+        const disc = await ro('GET', '/.well-known/openid-configuration');
+        return auth.status === 405 && err(auth) === 'temporarily_unavailable'
+          && token.status === 405
+          && certs.status === 200 && disc.status === 200;
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+
+  // ── The consent SCREEN (the vendor's own UI — data-coupled, per ADDING_A_TWIN.md §6) ─────────
+  done('googleoauth.ui.account_chooser', 'ui', 'Account chooser lists every seeded persona with its real name and address (data-coupled)', 'ui', 'core',
+    uiDataCoupled<H, string>({
+      withRoot,
+      // Seed a THIRD persona through the twin's own write path, so the screen cannot be passing on
+      // the two defaults alone.
+      seed: (h) => h({ m: 'POST', p: '/_twin/accounts', b: JSON.stringify({ sub: '100000000000000000003', email: 'katherine.johnson@nasa.example', name: 'Katherine Johnson', given_name: 'Katherine', family_name: 'Johnson' }) }),
+      fetch: async (h) => html(await h({ m: 'GET', p: authUrl({}) })),
+      assert: (markup) =>
+        markup.includes('Choose an account')
+        && markup.includes(ADA.name) && markup.includes(ADA.email)
+        && markup.includes(GRACE.name) && markup.includes(GRACE.email)
+        && markup.includes('Katherine Johnson') && markup.includes('katherine.johnson@nasa.example')
+        // each account is a real submit button carrying its own sub — the click IS the choice
+        && (markup.match(/class="account-row"/g) ?? []).length === 3
+        && markup.includes('value="100000000000000000003"'),
+    })),
+  done('googleoauth.ui.app_identity', 'ui', 'The screen names the REGISTERED app, not a hardcoded one (data-coupled to the client registry)', 'ui', 'core',
+    uiDataCoupled<H, string>({
+      withRoot,
+      seed: (h) => h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'seeded.apps.googleusercontent.com', client_secret: 'GOCSPX-seeded', name: 'Acme Scheduling', support_email: 'dev@acme.test', redirect_uris: [REDIRECT] }) }),
+      fetch: async (h) => html(await h({ m: 'GET', p: authUrl({ client_id: 'seeded.apps.googleusercontent.com' }) })),
+      assert: (markup) => markup.includes('Acme Scheduling') && markup.includes('to continue to') && !markup.includes('Twin Demo App'),
+    })),
+  done('googleoauth.ui.consent_screen', 'ui', 'The consent step names the app, the chosen account and every requested scope (data-coupled)', 'ui', 'core',
+    uiDataCoupled<H, string>({
+      withRoot,
+      seed: (h) => h({ m: 'GET', p: authUrl({}) }),
+      fetch: async (h) => {
+        const a = await h({ m: 'GET', p: authUrl({ scope: 'openid email https://www.googleapis.com/auth/calendar.readonly' }) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        return html(await h({ m: 'GET', p: `/_twin/consent?auth_request=${rid}&sub=${ADA.sub}` }));
+      },
+      assert: (markup) =>
+        markup.includes('wants access to your Google Account')
+        && markup.includes('Twin Demo App')
+        && markup.includes(ADA.email)
+        // the scope SENTENCES Google shows, from the catalog — not the raw scope strings
+        && markup.includes('See your primary Google Account email address')
+        && markup.includes('See and download any calendar you can access using your Google Calendar')
+        && markup.includes('Continue') && markup.includes('Cancel'),
+    })),
+  done('googleoauth.ui.scope_rows_render_real_component', 'ui', 'The shipped ScopeList component renders the twin\'s OWN scope rows over real state', 'ui', 'core',
+    uiDataCoupled<H, ConsentView | null>({
+      withRoot,
+      seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/gmail.send' }) }),
+      fetch: async (h) => {
+        const a = await h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/gmail.send' }) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        // The SAME state builder the served page uses — one renderer, no lookalike.
+        return googleOAuthConsentState({ root: h.root, requestId: rid, sub: ADA.sub, origin: 'https://accounts.google.com' });
+      },
+      render: (view) => (view ? renderToStaticMarkup(createElement(ScopeList, { scopes: view.scopes })) : ''),
+      assert: (view, markup) =>
+        !!view && !!markup
+        && view.scopes.length === 3
+        && markup.includes('See, edit, create, and delete all of your Google Drive files')
+        && markup.includes('Send email on your behalf')
+        // the sensitivity tags Google shows, driven by the catalog
+        && markup.includes('restricted') && markup.includes('sensitive')
+        // openid is not declinable, so it is a hidden input; the two product scopes are checkboxes
+        && (markup.match(/type="checkbox"/g) ?? []).length === 2
+        && markup.includes('value="https://www.googleapis.com/auth/drive"'),
+    })),
+  done('googleoauth.ui.unknown_scope_shown_raw', 'ui', 'An unknown scope is shown with its RAW string and flagged — never a fabricated description', 'ui', 'common',
+    uiDataCoupled<H, ConsentView | null>({
+      withRoot,
+      seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/not-a-real-google-scope' }) }),
+      fetch: async (h) => {
+        const a = await h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/not-a-real-google-scope' }) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        return googleOAuthConsentState({ root: h.root, requestId: rid, sub: ADA.sub, origin: 'https://accounts.google.com' });
+      },
+      render: (view) => (view ? renderToStaticMarkup(createElement(ScopeList, { scopes: view.scopes })) : ''),
+      assert: (view, markup) => {
+        const unknown = view?.scopes.find((s) => s.scope.endsWith('not-a-real-google-scope'));
+        return !!unknown && unknown.known === false && unknown.label === unknown.scope
+          && !!markup && markup.includes('not in the twin')
+          && markup.includes('https://www.googleapis.com/auth/not-a-real-google-scope');
+      },
+    })),
+  done('googleoauth.ui.unverified_notice', 'ui', 'The "Google hasn\'t verified this app" notice tracks the client\'s real verified flag', 'ui', 'common',
+    uiDataCoupled<H, { unverified: string; verified: string }>({
+      withRoot,
+      seed: (h) => h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'verified.apps.googleusercontent.com', client_secret: 'GOCSPX-v', name: 'Verified App', verified: true, redirect_uris: [REDIRECT] }) }),
+      fetch: async (h) => {
+        const unverifiedFlow = await h({ m: 'GET', p: authUrl({ login_hint: ADA.email }) });
+        const verifiedFlow = await h({ m: 'GET', p: authUrl({ client_id: 'verified.apps.googleusercontent.com', login_hint: ADA.email }) });
+        return { unverified: html(unverifiedFlow), verified: html(verifiedFlow) };
+      },
+      assert: (pages) =>
+        pages.unverified.includes('Google hasn') && pages.unverified.includes('verified this app')
+        && !pages.verified.includes('verified this app')
+        && pages.verified.includes('Verified App'),
+    })),
+  done('googleoauth.ui.chooser_renders_real_component', 'ui', 'The shipped AccountChooser component renders the twin\'s OWN accounts (server-render parity)', 'ui', 'common',
+    uiDataCoupled<H, ConsentView | null>({
+      withRoot,
+      seed: (h) => h({ m: 'POST', p: '/_twin/accounts', b: JSON.stringify({ sub: '100000000000000000009', email: 'margaret.hamilton@mit.example', name: 'Margaret Hamilton', given_name: 'Margaret' }) }),
+      fetch: async (h) => {
+        const a = await h({ m: 'GET', p: authUrl({}) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        return googleOAuthConsentState({ root: h.root, requestId: rid, origin: 'https://accounts.google.com' });
+      },
+      render: (view) => (view ? renderToStaticMarkup(createElement(AccountChooser, { view })) : ''),
+      assert: (view, markup) =>
+        !!view && view.step === 'choose' && view.accounts.length === 3
+        && !!markup && markup.includes('margaret.hamilton@mit.example') && markup.includes('Margaret Hamilton')
+        && markup.includes('value="100000000000000000009"')
+        && markup.includes(`action="https://accounts.google.com/_twin/consent"`),
+    })),
+  done('googleoauth.ui.consent_renders_real_component', 'ui', 'The shipped ConsentScreen component renders the chosen account + form over real state', 'ui', 'common',
+    uiDataCoupled<H, ConsentView | null>({
+      withRoot,
+      seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid email' }) }),
+      fetch: async (h) => {
+        const a = await h({ m: 'GET', p: authUrl({ scope: 'openid email' }) });
+        const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+        return googleOAuthConsentState({ root: h.root, requestId: rid, sub: GRACE.sub, origin: 'https://accounts.google.com' });
+      },
+      render: (view) => (view ? renderToStaticMarkup(createElement(ConsentScreen, { view })) : ''),
+      assert: (view, markup) =>
+        !!view && view.step === 'consent' && view.account?.sub === GRACE.sub
+        && !!markup && markup.includes(GRACE.email) && markup.includes('Twin Demo App')
+        && markup.includes('value="deny"') && markup.includes('value="allow"')
+        && markup.includes(`value="${view!.requestId}"`),
+    })),
+  done('googleoauth.ui.error_page', 'ui', 'The error page renders Google\'s headline, wording and "Error <status>: <code>" line over the real failure', 'ui', 'common', () =>
+    withRoot(async (h) => {
+      // SERVED path: the real 302 → /signin/oauth/error → the rendered page, driven end to end, with
+      // the app name resolved from the client registry rather than hardcoded.
+      const served = text((await errorPageFor(h, authUrl({ redirect_uri: 'https://evil.test/x' }))).markup);
+      // COMPONENT path: the SAME exported component, rendered directly — one renderer, no lookalike.
+      const direct = text(errorPageHtml({ status: 401, code: 'invalid_client', summary: 'Access blocked: Authorization Error', detail: 'The OAuth client was not found.', appName: 'Twin Demo App' }));
+      const bare = text(renderToStaticMarkup(createElement(ErrorPage, { status: 400, code: 'redirect_uri_mismatch', summary: 'S', detail: 'D' })));
+      return served.includes('Error 400')
+        && served.includes('redirect_uri_mismatch')
+        && served.includes('redirect_uri=https://evil.test/x')
+        && served.includes("Access blocked: This app's request is invalid")
+        && served.includes('flowName=GeneralOAuthFlow')
+        && served.includes('If you are a developer of Twin Demo App, see error details.')
+        && direct.includes('Error 401') && direct.includes('The OAuth client was not found.')
+        && bare.includes('Error 400') && bare.includes('redirect_uri_mismatch')
+        // the generic fallback wording when the failing request named no known client
+        && bare.includes('If you are a developer of this app, see error details.');
+    })),
+  done('googleoauth.ui.client_transpiles', 'ui', 'The consent client bundles for the browser and ships its granular-consent enhancement', 'ui', 'niche', async () => {
+    // The sanctioned STRUCTURAL fallback (the aws.s3.ui.transpiles precedent): bundling has no
+    // seedable state, so this asserts the REAL bundle — the COMMITTED one the twin serves
+    // (googleoauth-consent-client.gen.ts; consent-clients.test.ts proves it is a fresh build of
+    // the TSX) — rather than faking data-coupling. Static literals only — a template-literal
+    // class name would be erased by the minifier.
+    const js = CONSENT_CLIENT_JS;
+    return js.length > 10_000 && js.includes('Select all') && js.includes('granular-consent-controls') && js.includes('scope-check');
+  }),
+  todo('googleoauth.ui.two_step_account_add', 'ui', 'The "Use another account" sign-in step of Google\'s real chooser', 'ui', 'niche'),
+  todo('googleoauth.ui.branding', 'ui', 'The developer\'s configured app logo, homepage and privacy-policy links on the screen', 'ui', 'common'),
+
+  // ── Sign-in itself: genuinely impossible for a local twin ────────────────────────────────────
+
+  // ── Connector ────────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.connector.pull_identity', 'connector', 'Pull the operator\'s real identity + client from tokeninfo/userinfo into the projection', 'connector', 'core', () =>
+    withRoot(async (h) => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-pull-'));
+      try {
+        const result = await syncGoogleOAuthFromReal(fakeExecute, { root, occurredAt: AT });
+        if (result.observed !== 3 || result.deltasAppended < 1) return false;
+        // The pulled persona is REACHABLE THROUGH THE PROTOCOL — a pull that only writes rows a
+        // consumer can never see has not pulled anything useful.
+        const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+        return String(page.body).includes('real.person@example.com') && String(page.body).includes('Real Person');
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.pull_idempotent', 'connector', 'A re-pull of identical state appends NOTHING (shadow-diff dedupe)', 'connector', 'core', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-pull2-'));
+      try {
+        // NO pinned `occurredAt`: the connector's own MOVING pollTimestamp() is used, so a zero
+        // delta can only come from the shadow diff. Pinning both pulls to one millisecond let the
+        // kernel's content+timestamp dedupe produce the same answer for a different reason, which
+        // is a confound rather than a proof (§9 round one).
+        const first = await syncGoogleOAuthFromReal(fakeExecute, { root });
+        const second = await syncGoogleOAuthFromReal(fakeExecute, { root });
+        return first.deltasAppended > 0 && second.observed === 3 && second.deltasAppended === 0;
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.reverting_value_still_lands', 'connector', 'A vendor value that REVERTS across polls still lands (moving poll timestamp, not a pinned one)', 'connector', 'common', () =>
+    withRoot(async () => {
+      // The phantom-delta hazard: with a PINNED occurredAt the kernel hashes an observed event over
+      // (occurredAt + post-state), so an A→B→A sequence collides with its own first observation and
+      // syncPull reports a delta while the projection keeps the stale value.
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-revert-'));
+      try {
+        let name = 'Real Person';
+        const varying: GoogleOAuthExecute = async (_m, path) => {
+          if (path.startsWith('/tokeninfo')) return { ...FAKE_TOKENINFO };
+          if (path === '/v1/userinfo') return { ...FAKE_USERINFO, name };
+          return {};
+        };
+        await pullGoogleOAuthIdentity(varying, root);
+        name = 'Renamed Person';
+        await pullGoogleOAuthIdentity(varying, root);
+        name = 'Real Person'; // …back to the ORIGINAL value
+        await pullGoogleOAuthIdentity(varying, root);
+        const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+        // The projection must show the value the LAST poll observed, not the middle one.
+        return String(page.body).includes('Real Person') && !String(page.body).includes('Renamed Person');
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.refused_pull_throws', 'connector', 'A REFUSED pull throws — it is never mapped to an empty account folded over real state', 'connector', 'core', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-refuse-'));
+      try {
+        // First a good pull, so there IS real observed state to protect.
+        await syncGoogleOAuthFromReal(fakeExecute, { root, occurredAt: AT });
+        // Google answers a bad token on tokeninfo with an error envelope under HTTP 200 — a status
+        // check alone cannot tell refusal from genuine emptiness.
+        const counting = countingFetch(() => jsonResponse({ error: 'invalid_token', error_description: 'Invalid Value' }));
+        const execute = liveGoogleOAuthExecute('ya29.stale', { fetchImpl: counting.impl, budgetOptions: { path: join(root, 'ledger.json') } });
+        let threw = false;
+        try {
+          await syncGoogleOAuthFromReal(execute, { root });
+        } catch {
+          threw = true;
+        }
+        // …and the previously observed persona is still there.
+        const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+        return threw && counting.calls() === 1 && String(page.body).includes('real.person@example.com');
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.unmapped_host_refused', 'connector', 'The live executor REFUSES a path it has no Google host for (no accidental raw call)', 'connector', 'common', () =>
+    withRoot(async () => {
+      const root = mkdtempSync(join(tmpdir(), 'googleoauth-unmapped-'));
+      try {
+        const counting = countingFetch(() => jsonResponse({}));
+        const execute = liveGoogleOAuthExecute('ya29.x', { fetchImpl: counting.impl, budgetOptions: { path: join(root, 'ledger.json') } });
+        let threw = false;
+        try {
+          await execute('GET', '/some/unmapped/path');
+        } catch {
+          threw = true;
+        }
+        // The count is the proof: nothing reached the network.
+        return threw && counting.calls() === 0;
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.pull_invents_nothing', 'connector', 'A pulled client records what tokeninfo did NOT disclose — no fabricated secret, name or verification status', 'connector', 'common', () =>
+    withRoot(async () => {
+      const mapped = mapTokenInfoClient(FAKE_TOKENINFO);
+      const name = String(mapped.fields.name);
+      return mapped.type === 'oauth_client'
+        && mapped.id === FAKE_TOKENINFO.azp
+        && mapped.fields.secret === null
+        && mapped.fields.clientType === 'installed'
+        && Array.isArray(mapped.fields.redirectUris) && (mapped.fields.redirectUris as unknown[]).length === 0
+        // The name must SAY it is a pulled placeholder, not masquerade as the app's real name. An
+        // earlier version used `clientId.split('-')[0]`, putting the bare numeric project prefix on
+        // the consent screen as if it were a name (§9 round one).
+        && name.startsWith('Pulled client ') && name !== FAKE_TOKENINFO.azp.split('-')[0]
+        // …and the verified flag, which drives the unverified-app interstitial, must record
+        // "unknown" rather than claiming a verification tokeninfo never disclosed.
+        && mapped.fields.verified === null;
+    })),
+  done('googleoauth.connector.rate_budget_fail_closed', 'connector', 'The client-side budget REFUSES past the ceiling with the fake\'s call count unchanged', 'connector', 'core', () =>
+    withRoot(async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget-'));
+      try {
+        const counting = countingFetch(() => jsonResponse({ sub: 'x', email: 'a@b.test' }));
+        const execute = liveGoogleOAuthExecute('ya29.budget', { fetchImpl: counting.impl, budgetOptions: { path: join(dir, 'ledger.json') } });
+        // ceiling 60 / weight 2 = 30 calls, then the 31st must THROW without calling.
+        const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.other;
+        for (let i = 0; i < allowed; i++) await execute('GET', '/v1/userinfo');
+        if (counting.calls() !== allowed) return false;
+        let refused = false;
+        try {
+          await execute('GET', '/v1/userinfo');
+        } catch (e) {
+          refused = e instanceof GoogleOAuthBudgetError;
+        }
+        // "It threw" is not proof — the UNCHANGED count is what shows nothing reached the vendor.
+        return refused && counting.calls() === allowed;
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.rate_budget_persists', 'connector', 'The ledger is durable: a BRAND-NEW client gets no fresh allowance', 'connector', 'core', () =>
+    withRoot(async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget2-'));
+      const path = join(dir, 'ledger.json');
+      try {
+        const first = countingFetch(() => jsonResponse({}));
+        const a = liveGoogleOAuthExecute('ya29.same', { fetchImpl: first.impl, budgetOptions: { path } });
+        const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.other;
+        for (let i = 0; i < allowed; i++) await a('GET', '/v1/userinfo');
+        const second = countingFetch(() => jsonResponse({}));
+        const b = liveGoogleOAuthExecute('ya29.same', { fetchImpl: second.impl, budgetOptions: { path } });
+        let refused = false;
+        try {
+          await b('GET', '/v1/userinfo');
+        } catch (e) {
+          refused = e instanceof GoogleOAuthBudgetError;
+        }
+        return first.calls() === allowed && refused && second.calls() === 0;
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.rate_budget_revoke_weight', 'connector', 'POST /revoke is priced at 10, so it exhausts the ceiling proportionally sooner', 'connector', 'common', () =>
+    withRoot(async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget3-'));
+      try {
+        const counting = countingFetch(() => jsonResponse({}));
+        const execute = liveGoogleOAuthExecute('ya29.weights', { fetchImpl: counting.impl, budgetOptions: { path: join(dir, 'ledger.json') } });
+        const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.revoke; // 6, not 30
+        for (let i = 0; i < allowed; i++) await execute('POST', '/revoke');
+        let refused = false;
+        try {
+          await execute('POST', '/revoke');
+        } catch (e) {
+          refused = e instanceof GoogleOAuthBudgetError;
+        }
+        return counting.calls() === allowed && allowed === 6 && refused;
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    })),
+  done('googleoauth.connector.budget_unbypassable', 'connector', 'The live executor REFUSES to construct around a duck-typed, subclassed or proxied budget', 'connector', 'common', () =>
+    withRoot(async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget4-'));
+      try {
+        const path = join(dir, 'ledger.json');
+        const refuses = (budget: unknown) => {
+          try {
+            liveGoogleOAuthExecute('ya29.x', { budget: budget as GoogleOAuthBudget, budgetOptions: { path } });
+            return false;
+          } catch {
+            return true;
+          }
+        };
+        const duck = { checkBudget: () => ({}), recordCall: () => {} };
+        class Sneaky extends GoogleOAuthBudget {
+          override checkBudget(): never {
+            throw new Error('never called');
+          }
+        }
+        const proxied = new Proxy(new GoogleOAuthBudget({ path }), { get: (t, k) => (k === 'checkBudget' ? () => ({}) : Reflect.get(t, k)) });
+        // …and a REAL, unmodified budget is still accepted, so this is not "everything is refused".
+        let acceptsReal = false;
+        try {
+          liveGoogleOAuthExecute('ya29.x', { budget: new GoogleOAuthBudget({ path }), budgetOptions: { path } });
+          acceptsReal = true;
+        } catch {
+          acceptsReal = false;
+        }
+        return refuses(duck) && refuses(new Sneaky({ path })) && refuses(proxied) && acceptsReal;
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    })),
+  todo('googleoauth.connector.push', 'connector', 'Push local grants/clients to real Google — impossible today: there is no OAuth write API (clients are Cloud-Console objects, grants are myaccount.google.com)', 'connector', 'niche'),
+  todo('googleoauth.connector.pull_granted_scopes_per_app', 'connector', 'Pull the full list of apps a user has authorised (myaccount.google.com/permissions has no API)', 'connector', 'niche'),
+
+  // ── Google Identity Services (the MODERN "Sign in with Google" web surface) ──────────────────
+  // Enumerated top-down from developers.google.com/identity/gsi/web, NOT from what the twin built.
+  // This is a whole second product on accounts.google.com that this pack does not model at all: the
+  // classic authorization-code flow above is the protocol, GIS is the drop-in library most new
+  // integrations actually adopt. Filing it as todos is what keeps the denominator honest — a pack
+  // that enumerated only the protocol it implemented would read as near-complete while missing the
+  // half of the surface a greenfield app is most likely to use.
+  todo('googleoauth.gsi.client_library', 'gsi', 'GET /gsi/client — the Sign in with Google JavaScript library itself', 'api', 'core'),
+  todo('googleoauth.gsi.one_tap_prompt', 'gsi', 'One Tap: google.accounts.id.prompt() and its /gsi/iframe/select surface', 'api', 'core'),
+  todo('googleoauth.gsi.credential_response', 'gsi', 'The One Tap `credential` callback (a JWT id_token posted to the page)', 'api', 'core'),
+  todo('googleoauth.gsi.render_button', 'gsi', 'google.accounts.id.renderButton — the rendered Sign in with Google button', 'ui', 'core'),
+  todo('googleoauth.gsi.g_id_onload', 'gsi', 'The declarative `g_id_onload` / `g_id_signin` HTML element API', 'ui', 'common'),
+  todo('googleoauth.gsi.login_uri_post', 'gsi', 'data-login_uri: the credential POSTed form-encoded to the app\'s own endpoint with a g_csrf_token cookie', 'api', 'common'),
+  todo('googleoauth.gsi.token_client', 'gsi', 'google.accounts.oauth2.initTokenClient — the implicit token flow for browser apps', 'api', 'common'),
+  todo('googleoauth.gsi.code_client', 'gsi', 'google.accounts.oauth2.initCodeClient — the popup/redirect auth-code flow', 'api', 'common'),
+  todo('googleoauth.gsi.postmessage_relay', 'gsi', 'GET /o/oauth2/postmessageRelay — the popup-mode postMessage bridge', 'api', 'niche'),
+  todo('googleoauth.gsi.revoke_js', 'gsi', 'google.accounts.id.revoke / oauth2.revoke and their /gsi endpoints', 'api', 'niche'),
+  todo('googleoauth.gsi.intermediate_iframe', 'gsi', 'The intermediate-iframe support file for automatic One Tap cancellation', 'api', 'niche'),
+  todo('googleoauth.gsi.fedcm', 'gsi', 'FedCM migration: the browser-mediated identity API GIS is moving One Tap onto', 'api', 'common'),
+
+  // ── Cross-Account Protection (RISC) ──────────────────────────────────────────────────────────
+  todo('googleoauth.risc.register_endpoint', 'risc', 'POST risc.googleapis.com/v1beta/stream:update — register a receiver for security-event tokens (a HOST this pack does not claim in VENDOR_HOSTS, so adopting it means claiming it too)', 'api', 'niche'),
+  todo('googleoauth.risc.security_event_tokens', 'risc', 'Deliver RISC SETs (sessions-revoked, account-disabled, tokens-revoked) to the app', 'connector', 'niche'),
+  todo('googleoauth.risc.verify_jwt', 'risc', 'The RISC SET is a JWT signed by Google\'s RISC key set (a different JWKS)', 'api', 'niche'),
+
+  // ── The device / limited-input flow ──────────────────────────────────────────────────────────
+  todo('googleoauth.device.code_request', 'device', 'POST /device/code — mint a device_code + user_code + verification_url', 'api', 'common'),
+  todo('googleoauth.device.user_verification_screen', 'device', 'The accounts.google.com/device screen where a human types the user_code', 'ui', 'common'),
+  todo('googleoauth.device.polling_errors', 'device', 'authorization_pending / slow_down / expired_token while the app polls', 'api', 'common'),
+
+  // ── Remaining protocol surface ───────────────────────────────────────────────────────────────
+  todo('googleoauth.endpoints.legacy_revoke_path', 'errors', 'GET /o/oauth2/revoke — the legacy accounts.google.com revocation path', 'api', 'niche'),
+  todo('googleoauth.endpoints.userinfo_v2', 'userinfo', 'GET /oauth2/v2/userinfo — the oldest userinfo alias (a different field set)', 'api', 'niche'),
+  todo('googleoauth.authorize.approval_prompt_legacy', 'authorize', 'approval_prompt=force — the pre-`prompt` legacy parameter still in the wild', 'api', 'niche'),
+  todo('googleoauth.authorize.include_granted_scopes_incremental_ui', 'authorize', 'The consent screen shows only the NEW scopes during incremental authorization', 'ui', 'common'),
+  todo('googleoauth.accounts.multi_login_authuser', 'authorize', 'The `authuser` index and multi-login sessions (several accounts signed in at once)', 'api', 'common'),
+  todo('googleoauth.token.client_assertion_auth', 'token', 'private_key_jwt client authentication (client_assertion / client_assertion_type)', 'api', 'niche'),
+
+  // ── Conformance ──────────────────────────────────────────────────────────────────────────────
+  done('googleoauth.conformance.endpoint_probe', 'conformance', 'Every claimed endpoint answers a real probe with the OUTCOME a live handler produces', 'api', 'core', async () => {
+    const report = await checkGoogleOAuthConformance();
+    return report.ok && report.endpointsProbed === report.endpointsChecked && report.endpointsChecked >= 12 && report.violations.length === 0;
+  }),
+];
+
+export async function googleoauthCapabilities(): Promise<CapabilityReport> {
+  return checkCapabilities('googleoauth', GOOGLEOAUTH_CAPABILITIES);
+}