@volter/twin-googleoauth 0.1.0

package/dist/src/googleoauth-capabilities.js

@@ -0,0 +1,1651 @@
+// Google OAuth 2.0 / OpenID Connect capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the
+// target), authored top-down from the vendor's own OIDC discovery document
+// (accounts.google.com/.well-known/openid-configuration) and the four protocol guides
+// (developers.google.com/identity/protocols/oauth2/{web-server,native-app,openid-connect,
+// service-account}) — NOT from what this twin has built. `verify()` (required to count as done) is
+// ground truth; every `expected:'done'` is genuinely claimed, so a broken one shows as a regression.
+//
+// GRANULARITY: one capability per PROTOCOL BEHAVIOUR (a parameter honoured, an error produced, a
+// claim minted), not per endpoint — this surface is nine endpoints with a hundred behaviours, so
+// per-endpoint entries would have been a denominator of nine and a lie.
+//
+// TWIN-ONLY ROUTES ARE NOT COUNTED. `/_twin/consent`, `/_twin/clients` and `/_twin/accounts` are
+// scaffolding (Google's own consent form posts to an undocumented internal endpoint, and there is
+// no API that creates an OAuth client), so they are absent from this denominator exactly as
+// ADDING_A_TWIN.md §6 requires. Counting them would be padding.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, verifyBoundary } from '@volter/world-tooling';
+import { AccountChooser, ConsentScreen, ErrorPage, ScopeList } from "../client/googleoauth-consent.js";
+import { CONSENT_CLIENT_JS, errorPageHtml, googleOAuthConsentState } from "./googleoauth-consent-ui.js";
+import { checkGoogleOAuthConformance } from "./googleoauth-conformance.js";
+import { GOOGLEOAUTH_BUDGET_CEILING, GOOGLEOAUTH_CALL_WEIGHTS, GoogleOAuthBudget, GoogleOAuthBudgetError, } from "./googleoauth-budget.js";
+import { liveGoogleOAuthExecute, mapTokenInfoClient, pullGoogleOAuthIdentity, syncGoogleOAuthFromReal, } from "./googleoauth-connector.js";
+import { decodeAuthError, ERROR_PAGE_PATH, FLOW_NAME } from "./googleoauth-autherror.js";
+import { pkceS256, verifyJwtWithJwks, decodeJwt } from "./googleoauth-jwt.js";
+import { DEFAULT_ACCOUNTS, DEFAULT_CLIENT_ID, DEFAULT_CLIENT_SECRET, defaultRedirectUris } from "./googleoauth-store.js";
+import { handleGoogleOAuthTwinRequest } from "./googleoauth-twin.js";
+const AT = '2026-02-01T00:00:00.000Z';
+const AT_SECONDS = Math.floor(Date.parse(AT) / 1000);
+/** The origin this harness's world serves the twin at. The seeded demo client's callbacks are
+ *  DERIVED from it (runtime contract R7: the port belongs to the caller's world, never to the
+ *  twin's source), so the probes below name no port of their own. */
+const DEMO_ORIGIN = 'http://localhost:3000';
+const REDIRECT_URIS = defaultRedirectUris(DEMO_ORIGIN);
+const REDIRECT = REDIRECT_URIS[0];
+const ADA = DEFAULT_ACCOUNTS[0];
+const GRACE = DEFAULT_ACCOUNTS[1];
+async function withRoot(steps) {
+    const root = mkdtempSync(join(tmpdir(), 'googleoauth-cap-'));
+    const h = ((s) => handleGoogleOAuthTwinRequest({
+        method: s.m,
+        path: s.p,
+        ...(s.b === undefined ? {} : { body: s.b }),
+        ...(s.h ? { headers: s.h } : {}),
+        root,
+        origin: DEMO_ORIGIN,
+        occurredAt: s.at ?? AT,
+    }));
+    h.root = root;
+    try {
+        return await verifyBoundary('googleoauth.withRoot', () => steps(h));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const ok = (r) => r.status >= 200 && r.status < 300;
+/** Rendered markup as a human reads it. React escapes `'` to `&#x27;`, so an assertion about
+ *  Google's own wording ("This app's request is invalid") must compare against the DECODED text or
+ *  it fails for a reason that has nothing to do with the twin. */
+const text = (markup) => markup.replace(/&#x27;/g, "'").replace(/&quot;/g, '"').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
+const body = (r) => r.body;
+const html = (r) => String(r.body);
+const err = (r) => r.body?.error;
+const loc = (r) => r.headers?.location ?? '';
+const qp = (r, key) => {
+    try {
+        return new URL(loc(r)).searchParams.get(key);
+    }
+    catch {
+        return null;
+    }
+};
+const form = (params) => new URLSearchParams(params).toString();
+/** Build an authorization-endpoint URL from parameters, so a verify can vary exactly one of them. */
+function authUrl(params, path = '/o/oauth2/v2/auth') {
+    const q = new URLSearchParams();
+    const base = {
+        client_id: DEFAULT_CLIENT_ID,
+        redirect_uri: REDIRECT,
+        response_type: 'code',
+        scope: 'openid email profile',
+        ...params,
+    };
+    for (const [k, v] of Object.entries(base))
+        if (v !== undefined)
+            q.set(k, v);
+    return `${path}?${q.toString()}`;
+}
+const AUTH_REQUEST_RE = /name="auth_request" value="([^"]+)"/;
+/**
+ * Drive an authorization request that is expected to FAIL, and follow Google's real failure path:
+ * a 302 to `/signin/oauth/error?authError=<protobuf>` and then the rendered page. Returns the
+ * decoded payload AND the markup, so a verify can assert both the machine-readable error and what
+ * the human is shown.
+ */
+async function errorPageFor(h, path) {
+    const redirect = await h({ m: 'GET', p: path });
+    if (redirect.status !== 302)
+        return { redirect, error: null, markup: '' };
+    const target = new URL(loc(redirect));
+    const error = decodeAuthError(target.searchParams.get('authError') ?? '');
+    const page = await h({ m: 'GET', p: `${target.pathname}${target.search}` });
+    return { redirect, error, markup: html(page) };
+}
+/**
+ * Drive the REAL browser legs: authorization request → consent screen → Allow (or Deny) → the 302.
+ * Everything a verify needs from the round trip comes back, so no verify has to hand-craft a code.
+ */
+async function consentFlow(h, opts = {}) {
+    const authPath = authUrl(opts.params ?? {});
+    const auth = await h({ m: 'GET', p: authPath, ...(opts.at ? { at: opts.at } : {}) });
+    const requestId = AUTH_REQUEST_RE.exec(html(auth))?.[1] ?? '';
+    const fields = new URLSearchParams();
+    fields.set('auth_request', requestId);
+    fields.set('sub', opts.sub ?? ADA.sub);
+    fields.set('decision', opts.decision ?? 'allow');
+    const ticked = opts.tick ?? (new URL(authPath, 'http://x.test').searchParams.get('scope') ?? '').split(/\s+/).filter(Boolean);
+    for (const s of ticked)
+        fields.append('scope', s);
+    const redirect = await h({ m: 'POST', p: '/_twin/consent', b: fields.toString(), ...(opts.at ? { at: opts.at } : {}) });
+    return { auth, requestId, redirect, code: qp(redirect, 'code'), state: qp(redirect, 'state') };
+}
+/** The full round trip, ending in redeemed tokens. */
+async function fullFlow(h, opts = {}) {
+    const flow = await consentFlow(h, opts);
+    if (!flow.code)
+        return { code: null, tokens: {}, status: 0, redirect: flow.redirect };
+    const res = await h({
+        m: 'POST',
+        p: '/token',
+        b: form({
+            grant_type: 'authorization_code',
+            code: flow.code,
+            client_id: DEFAULT_CLIENT_ID,
+            client_secret: DEFAULT_CLIENT_SECRET,
+            redirect_uri: REDIRECT,
+            ...(opts.verifier ? { code_verifier: opts.verifier } : {}),
+        }),
+        ...(opts.at ? { at: opts.at } : {}),
+    });
+    return { code: flow.code, tokens: body(res), status: res.status, redirect: flow.redirect };
+}
+/** A grant with an offline refresh token — the fixture the refresh/revoke verifies start from. */
+const offline = { access_type: 'offline', prompt: 'consent' };
+// ── shorthands ──
+const done = (id, area, title, dimension, tier, verify) => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id, area, title, dimension, tier) => ({ id, area, title, dimension, tier, expected: 'todo' });
+// ── the connector's offline fake: a REAL-SHAPED Google reply, not an invented one ──
+const FAKE_TOKENINFO = {
+    azp: '1044839207-realclient.apps.googleusercontent.com',
+    aud: '1044839207-realclient.apps.googleusercontent.com',
+    sub: '109876543210987654321',
+    scope: 'openid https://www.googleapis.com/auth/userinfo.email',
+    exp: '1800000000',
+    expires_in: '3599',
+    email: 'real.person@example.com',
+    email_verified: 'true',
+    access_type: 'offline',
+};
+const FAKE_USERINFO = {
+    sub: '109876543210987654321',
+    email: 'real.person@example.com',
+    email_verified: true,
+    name: 'Real Person',
+    given_name: 'Real',
+    family_name: 'Person',
+    picture: 'https://lh3.googleusercontent.com/a/real',
+};
+const fakeExecute = async (_method, path) => {
+    if (path.startsWith('/tokeninfo'))
+        return { ...FAKE_TOKENINFO };
+    if (path === '/v1/userinfo')
+        return { ...FAKE_USERINFO };
+    return {};
+};
+/** A `fetch` stand-in that COUNTS calls — "it threw" is not proof; the unchanged count is. */
+function countingFetch(response) {
+    let calls = 0;
+    const impl = (async () => {
+        calls += 1;
+        return response();
+    });
+    return { impl, calls: () => calls };
+}
+const jsonResponse = (payload, init = {}) => new Response(JSON.stringify(payload), { status: 200, headers: { 'content-type': 'application/json' }, ...init });
+export const GOOGLEOAUTH_CAPABILITIES = [
+    // ── Discovery ────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.discovery.document', 'discovery', 'GET /.well-known/openid-configuration — the OIDC discovery document', 'api', 'core', () => withRoot(async () => {
+        // Not routed through `h` for the same reason `origin_rewrite` below is not: this probe is
+        // about the ABSENT-`origin` rendering, where the document carries Google's REAL endpoints.
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-disc-doc-'));
+        try {
+            const r = await handleGoogleOAuthTwinRequest({ method: 'GET', path: '/.well-known/openid-configuration', root, occurredAt: AT });
+            const d = body(r);
+            return ok(r)
+                && d.issuer === 'https://accounts.google.com'
+                && d.authorization_endpoint === 'https://accounts.google.com/o/oauth2/v2/auth'
+                && d.token_endpoint === 'https://oauth2.googleapis.com/token'
+                && d.jwks_uri === 'https://www.googleapis.com/oauth2/v3/certs'
+                && d.userinfo_endpoint === 'https://openidconnect.googleapis.com/v1/userinfo'
+                && Array.isArray(d.id_token_signing_alg_values_supported)
+                && d.id_token_signing_alg_values_supported.includes('RS256')
+                && d.code_challenge_methods_supported.includes('S256');
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.discovery.origin_rewrite', 'discovery', 'Discovery rewrites every endpoint to the twin\'s own origin (a discovery-driven client stays inside the world)', 'api', 'core', () => withRoot(async () => {
+        // Not routed through `h` because this is about the `origin` input specifically.
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-disc-'));
+        try {
+            const r = await handleGoogleOAuthTwinRequest({ method: 'GET', path: '/.well-known/openid-configuration', root, occurredAt: AT, origin: 'http://127.0.0.1:45999' });
+            const d = body(r);
+            // The ISSUER must stay Google's — it is a token claim, not an address — while every
+            // ENDPOINT must move. Getting that backwards is the bug this pins.
+            return ok(r)
+                && d.issuer === 'https://accounts.google.com'
+                && d.authorization_endpoint === 'http://127.0.0.1:45999/o/oauth2/v2/auth'
+                && d.token_endpoint === 'http://127.0.0.1:45999/token'
+                && d.jwks_uri === 'http://127.0.0.1:45999/oauth2/v3/certs'
+                && d.revocation_endpoint === 'http://127.0.0.1:45999/revoke'
+                && d.userinfo_endpoint === 'http://127.0.0.1:45999/v1/userinfo';
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    // Tiered `common` to match its three `device.*` siblings: they describe one flow, and splitting
+    // its tier across areas made the same endpoint look niche in one place and common in another.
+    todo('googleoauth.discovery.device_authorization', 'discovery', 'GET /device/code — the device-authorization endpoint the discovery document advertises', 'api', 'common'),
+    // ── The authorization endpoint ───────────────────────────────────────────────────────────────
+    done('googleoauth.authorize.consent_screen', 'authorize', 'GET /o/oauth2/v2/auth — renders the consent surface as HTML (200)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: authUrl({ state: 'xyz' }) });
+        return r.status === 200
+            && r.headers?.['content-type'] === 'text/html; charset=utf-8'
+            && html(r).startsWith('<!doctype html>')
+            && html(r).includes('Choose an account')
+            && html(r).includes('Twin Demo App');
+    })),
+    done('googleoauth.authorize.legacy_path', 'authorize', 'GET /o/oauth2/auth — the legacy authorization path serves the same screen', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: authUrl({}, '/o/oauth2/auth') });
+        return r.status === 200 && html(r).includes('Twin Demo App') && html(r).includes(ADA.email);
+    })),
+    done('googleoauth.authorize.unknown_client_error_page', 'authorize', 'Unknown client_id → a 302 to Google\'s own /signin/oauth/error page carrying invalid_client (401), never to redirect_uri', 'api', 'core', () => withRoot(async (h) => {
+        const { redirect, error, markup } = await errorPageFor(h, authUrl({ client_id: '999-nosuch.apps.googleusercontent.com' }));
+        const target = new URL(loc(redirect));
+        // THE SECURITY PROPERTY: the bounce goes to Google's OWN error page, never to the
+        // redirect_uri the unknown client claimed — that would make the twin an open redirector.
+        return redirect.status === 302
+            && target.pathname === ERROR_PAGE_PATH
+            && !loc(redirect).startsWith(REDIRECT)
+            && target.searchParams.get('flowName') === FLOW_NAME
+            && error?.code === 'invalid_client'
+            && error.status === 401
+            && error.message === 'The OAuth client was not found.'
+            && text(markup).includes('Error 401')
+            && text(markup).includes('The OAuth client was not found.')
+            && text(markup).includes('Access blocked: Authorization Error');
+    })),
+    done('googleoauth.authorize.missing_client_id', 'authorize', 'Missing client_id → 400 error page naming the parameter', 'api', 'common', () => withRoot(async (h) => {
+        const { redirect, error, markup } = await errorPageFor(h, authUrl({ client_id: undefined }));
+        return redirect.status === 302 && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+            && error?.code === 'invalid_request' && error.status === 400
+            && error.message === 'Required parameter is missing: client_id'
+            && text(markup).includes('Error 400') && text(markup).includes('Required parameter is missing: client_id');
+    })),
+    done('googleoauth.authorize.missing_redirect_uri', 'authorize', 'Missing redirect_uri → 400 error page naming the parameter', 'api', 'common', () => withRoot(async (h) => {
+        const { redirect, error } = await errorPageFor(h, authUrl({ redirect_uri: undefined }));
+        return redirect.status === 302 && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+            && error?.code === 'invalid_request' && error.message === 'Required parameter is missing: redirect_uri';
+    })),
+    done('googleoauth.authorize.redirect_uri_mismatch_page', 'authorize', 'Unregistered redirect_uri → the "redirect_uri_mismatch" page with Google\'s own policy wording, never a bounce to that URI', 'api', 'core', () => withRoot(async (h) => {
+        const { redirect, error, markup } = await errorPageFor(h, authUrl({ redirect_uri: 'https://evil.test/steal' }));
+        return redirect.status === 302
+            // The attacker-supplied URI is NOT where the browser is sent.
+            && !loc(redirect).startsWith('https://evil.test')
+            && new URL(loc(redirect)).pathname === ERROR_PAGE_PATH
+            && error?.code === 'redirect_uri_mismatch'
+            && error.status === 400
+            && error.message.includes("doesn't comply with Google's OAuth 2.0 policy")
+            && error.param === 'redirect_uri=https://evil.test/steal'
+            // …and the page uses the OTHER headline Google reserves for a misconfigured app.
+            && text(markup).includes("Access blocked: This app's request is invalid")
+            && text(markup).includes('Error 400') && text(markup).includes('redirect_uri_mismatch');
+    })),
+    done('googleoauth.authorize.redirect_uri_bypasses_refused', 'authorize', 'A fragment, a userinfo subcomponent or an alternate IPv4 spelling cannot smuggle past redirect-URI matching', 'api', 'core', () => withRoot(async (h) => {
+        // Three bypasses §9 round two found, all against the LOOPBACK branch, which compared
+        // protocol/host/path/search and nothing else. Google forbids a fragment outright, forbids the
+        // userinfo subcomponent, and documents its loopback exception for the LITERALS 127.0.0.1 and
+        // [::1] — but WHATWG `URL` folds 0177.0.0.1, 2130706433 and 127.1 all onto 127.0.0.1, so
+        // reading `.hostname` accepted three spellings the vendor's exact-match rule does not.
+        const bypasses = [
+            'http://127.0.0.1:3000/api/auth/callback/google#evil',
+            'http://attacker:hunter2@127.0.0.1:3000/api/auth/callback/google',
+            'http://0177.0.0.1:3000/api/auth/callback/google',
+            'http://2130706433:3000/api/auth/callback/google',
+            'http://127.1:3000/api/auth/callback/google',
+        ];
+        for (const redirect_uri of bypasses) {
+            const { error } = await errorPageFor(h, authUrl({ redirect_uri }));
+            if (error?.code !== 'redirect_uri_mismatch')
+                return false;
+        }
+        // …and the genuine loopback registration still works, so this is not "everything is refused".
+        return (await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://127.0.0.1:51999/api/auth/callback/google' }) })).status === 200;
+    })),
+    done('googleoauth.authorize.exact_redirect_uri_matching', 'authorize', 'redirect_uri matching is EXACT — a trailing slash is a different URI', 'api', 'core', () => withRoot(async (h) => {
+        // The single most common Google integration bug, and only reproducible if the twin is as
+        // strict as the vendor.
+        const exact = await h({ m: 'GET', p: authUrl({}) });
+        const slashed = await errorPageFor(h, authUrl({ redirect_uri: `${REDIRECT}/` }));
+        const cased = await errorPageFor(h, authUrl({ redirect_uri: REDIRECT.replace('/callback/google', '/Callback/Google') }));
+        return exact.status === 200
+            && slashed.error?.code === 'redirect_uri_mismatch'
+            && cased.error?.code === 'redirect_uri_mismatch';
+    })),
+    done('googleoauth.authorize.loopback_port_ignored', 'authorize', 'Installed-app loopback redirect: the PORT is ignored, the host and path are not', 'api', 'common', () => withRoot(async (h) => {
+        // Registered: http://127.0.0.1:3000/api/auth/callback/google
+        const otherPort = await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://127.0.0.1:51999/api/auth/callback/google' }) });
+        const otherPath = await errorPageFor(h, authUrl({ redirect_uri: 'http://127.0.0.1:51999/other' }));
+        // …and the exception is for the loopback IP LITERALS only: `localhost` is an ordinary host to
+        // Google, so a different port there is a mismatch even though the path matches a registration.
+        const localhostOtherPort = await errorPageFor(h, authUrl({ redirect_uri: 'http://localhost:51999/api/auth/callback/google' }));
+        const localhostExact = await h({ m: 'GET', p: authUrl({ redirect_uri: 'http://localhost:3000/api/auth/callback/google' }) });
+        return otherPort.status === 200
+            && otherPath.error?.code === 'redirect_uri_mismatch'
+            && localhostOtherPort.error?.code === 'redirect_uri_mismatch'
+            && localhostExact.status === 200;
+    })),
+    done('googleoauth.authorize.parameter_errors_never_reach_redirect_uri', 'authorize', 'EVERY parameter error renders Google\'s error page — it is NOT bounced to redirect_uri (RFC 6749 notwithstanding)', 'api', 'core', () => withRoot(async (h) => {
+        // The behaviour a live capture of the real endpoint refuted an RFC-shaped implementation on:
+        // the spec says redirect these back to the client, and Google does not.
+        const cases = [
+            [authUrl({ response_type: undefined, state: 'keepme' }), 'Required parameter is missing: response_type'],
+            [authUrl({ scope: undefined }), 'Missing required parameter: scope'],
+            [authUrl({ access_type: 'sideways' }), "Invalid parameter value for access_type: 'sideways' is not valid"],
+            [authUrl({ display: 'bogus' }), "Invalid parameter value for display: 'bogus' is not valid"],
+            [authUrl({ prompt: 'shout' }), 'Invalid prompt: shout'],
+            [authUrl({ include_granted_scopes: 'yes' }), 'Invalid value, must be one of false, true: yes'],
+            [authUrl({ enable_granular_consent: 'maybe' }), 'Invalid value, must be one of false, true: maybe'],
+        ];
+        for (const [path, message] of cases) {
+            const { redirect, error } = await errorPageFor(h, path);
+            if (redirect.status !== 302)
+                return false;
+            if (loc(redirect).startsWith(REDIRECT))
+                return false; // the whole point
+            if (new URL(loc(redirect)).pathname !== ERROR_PAGE_PATH)
+                return false;
+            if (error?.code !== 'invalid_request' || error.message !== message)
+                return false;
+        }
+        // …and the same request WITHOUT the bad parameter renders the screen, so this is not
+        // "everything fails".
+        return (await h({ m: 'GET', p: authUrl({ display: 'popup', prompt: 'consent select_account', include_granted_scopes: 'true' }) })).status === 200;
+    })),
+    done('googleoauth.authorize.unsupported_response_type', 'authorize', 'response_type=token is refused as UNMODELLED — the twin never claims Google rejects a flow Google supports', 'api', 'common', () => withRoot(async (h) => {
+        const { redirect, error } = await errorPageFor(h, authUrl({ response_type: 'token' }));
+        return redirect.status === 302
+            && error?.code === 'unsupported_response_type'
+            // The INVERSE false-green guard: Google DOES support the implicit flow, so the message must
+            // say the TWIN does not model it, not that the request is invalid.
+            && error.message.includes('not modelled')
+            && error.message.includes('Real Google supports it')
+            && qp(redirect, 'code') === null;
+    })),
+    done('googleoauth.authorize.repeated_parameter', 'authorize', 'A repeated query parameter is refused outright ("OAuth 2 parameters can only have a single value")', 'api', 'common', () => withRoot(async (h) => {
+        const { error } = await errorPageFor(h, `${authUrl({})}&response_type=id_token`);
+        const scopeErr = await errorPageFor(h, `${authUrl({})}&scope=openid`);
+        return error?.code === 'invalid_request'
+            && error.message === 'OAuth 2 parameters can only have a single value: response_type'
+            && scopeErr.error?.message === 'OAuth 2 parameters can only have a single value: scope';
+    })),
+    done('googleoauth.authorize.prompt_none_interaction_required', 'authorize', 'prompt=none with no covering grant → 302 to redirect_uri with error=interaction_required + error_subtype', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: authUrl({ prompt: 'none', state: 'sil' }) });
+        // One of the only TWO outcomes that reach the caller's redirect_uri.
+        return r.status === 302 && loc(r).startsWith(REDIRECT)
+            && qp(r, 'error') === 'interaction_required'
+            && qp(r, 'error_subtype') === 'access_denied'
+            && qp(r, 'state') === 'sil'
+            && qp(r, 'code') === null;
+    })),
+    done('googleoauth.authorize.prompt_none_must_be_alone', 'authorize', 'prompt=none combined with another value is refused (Google documents it as mutually exclusive)', 'api', 'niche', () => withRoot(async (h) => {
+        const { error } = await errorPageFor(h, authUrl({ prompt: 'none consent' }));
+        const fine = await h({ m: 'GET', p: authUrl({ prompt: 'consent select_account' }) });
+        return error?.code === 'invalid_request' && error.message === 'Invalid prompt: none consent' && fine.status === 200;
+    })),
+    done('googleoauth.authorize.login_hint', 'authorize', 'login_hint naming a known account SKIPS the chooser; an unknown hint falls back to it', 'api', 'common', () => withRoot(async (h) => {
+        const hinted = await h({ m: 'GET', p: authUrl({ login_hint: GRACE.email }) });
+        const unknown = await h({ m: 'GET', p: authUrl({ login_hint: 'nobody@nowhere.test' }) });
+        return hinted.status === 200
+            && html(hinted).includes('wants access to your Google Account')
+            && html(hinted).includes(GRACE.email)
+            && !html(hinted).includes('Choose an account')
+            // An unknown hint is NOT an error on Google — it just shows the chooser.
+            && unknown.status === 200
+            && html(unknown).includes('Choose an account');
+    })),
+    done('googleoauth.authorize.state_roundtrip', 'authorize', 'state is echoed VERBATIM on the success redirect (CSRF binding)', 'api', 'core', () => withRoot(async (h) => {
+        const weird = 'a b/c+d=e&f%20g';
+        const flow = await consentFlow(h, { params: { state: weird } });
+        return flow.redirect.status === 302 && flow.state === weird && !!flow.code;
+    })),
+    done('googleoauth.authorize.no_state_no_echo', 'authorize', 'A request with NO state gets NO state parameter back (not an empty one)', 'api', 'niche', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        return flow.redirect.status === 302 && !!flow.code && new URL(loc(flow.redirect)).searchParams.has('state') === false;
+    })),
+    done('googleoauth.authorize.code_redirect_shape', 'authorize', 'The success redirect carries EXACTLY Google\'s documented parameters — no more, no fewer', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, { params: { state: 's' } });
+        if (flow.redirect.status !== 302)
+            return false;
+        if (!(flow.code ?? '').startsWith('4/0A'))
+            return false;
+        if (qp(flow.redirect, 'scope') !== 'openid email profile')
+            return false;
+        if (qp(flow.redirect, 'authuser') !== '0' || qp(flow.redirect, 'error') !== null)
+            return false;
+        // AND NOTHING ELSE. This is the one assertion in the pack that pins an ABSENCE, and it exists
+        // because §9 found the inverse false-green here: the twin was emitting RFC 9207's `iss`,
+        // licensed by a discovery key neither of which could be confirmed against Google's artefacts.
+        // ADDING_A_TWIN.md §6 says no gate can red-flag invented surface because "there is no oracle
+        // for absence" — but on a REDIRECT there is one, because the vendor's parameter set is closed
+        // and documented. An allowlist turns the unpinnable class into a pinned one: re-add `iss`, or
+        // any other invention, and this capability reddens by name.
+        const DOCUMENTED = new Set(['code', 'state', 'scope', 'authuser', 'prompt', 'hd', 'error', 'error_subtype', 'error_description']);
+        const undocumented = [...new URL(loc(flow.redirect)).searchParams.keys()].filter((k) => !DOCUMENTED.has(k));
+        if (undocumented.length)
+            return false;
+        // …and the same closed set on a Workspace account (which adds `hd`) and on the denial path.
+        const workspace = await consentFlow(h, { params: { state: 's' }, sub: GRACE.sub });
+        const denied = await consentFlow(h, { params: { state: 's' }, decision: 'deny' });
+        for (const r of [workspace.redirect, denied.redirect]) {
+            if ([...new URL(loc(r)).searchParams.keys()].some((k) => !DOCUMENTED.has(k)))
+                return false;
+        }
+        return qp(workspace.redirect, 'hd') === GRACE.hd;
+    })),
+    done('googleoauth.authorize.access_denied', 'authorize', 'Deny → 302 back with error=access_denied and the state, and NO code', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, { params: { state: 'denied-state' }, decision: 'deny' });
+        return flow.redirect.status === 302
+            && qp(flow.redirect, 'error') === 'access_denied'
+            && qp(flow.redirect, 'state') === 'denied-state'
+            && flow.code === null;
+    })),
+    done('googleoauth.authorize.consent_replay_refused', 'authorize', 'An authorization request can be settled ONCE — a replayed consent post is refused', 'api', 'common', () => withRoot(async (h) => {
+        const auth = await h({ m: 'GET', p: authUrl({}) });
+        const rid = AUTH_REQUEST_RE.exec(html(auth))?.[1] ?? '';
+        const first = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+        const second = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+        return first.status === 302 && !!qp(first, 'code') && second.status === 400 && err(second) === 'invalid_request';
+    })),
+    done('googleoauth.authorize.prompt_none_succeeds_silently', 'authorize', 'prompt=none WITH a covering grant mints a code silently — a 302, never an HTML screen', 'api', 'core', () => withRoot(async (h) => {
+        // The other half of prompt=none, and the half that was broken: an earlier version answered
+        // `interaction_required` correctly and then fell through to RENDERING THE CONSENT SCREEN when
+        // the grant did cover, handing an HTML page to a caller that asked for no UI (§9 round one).
+        const scope = 'openid email';
+        // Grace, deliberately NOT the first seeded account: the old check only ever consulted
+        // accounts[0], so any other persona's covering grant was invisible to it.
+        await consentFlow(h, { params: { scope }, sub: GRACE.sub });
+        const silent = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', state: 'quiet' }) });
+        if (silent.status !== 302 || !loc(silent).startsWith(REDIRECT))
+            return false;
+        if (qp(silent, 'error') !== null || qp(silent, 'state') !== 'quiet')
+            return false;
+        const code = qp(silent, 'code');
+        if (!code?.startsWith('4/0A'))
+            return false;
+        // …the silently-minted code is a REAL code, redeemable for the account that granted it.
+        const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        if (!ok(token) || decodeJwt(String(body(token).id_token)).payload.sub !== GRACE.sub)
+            return false;
+        // The silent redirect must NOT claim a screen was shown: `prompt` echoes what happened, and
+        // stamping `consent` on a no-UI response asserts the opposite (§9 round two).
+        if (qp(silent, 'prompt') !== null)
+            return false;
+        // …and asking for MORE than the grant covers still refuses rather than showing a screen.
+        const wider = await h({ m: 'GET', p: authUrl({ scope: `${scope} https://www.googleapis.com/auth/drive`, prompt: 'none' }) });
+        return wider.status === 302 && qp(wider, 'error') === 'interaction_required';
+    })),
+    done('googleoauth.authorize.prompt_none_never_substitutes_an_account', 'authorize', 'prompt=none with a login_hint that does NOT cover refuses — it never silently hands back a different human\'s token', 'api', 'core', () => withRoot(async (h) => {
+        // The sharpest failure this surface can have, and one an app cannot detect until it decodes
+        // the token: with no screen shown, a substituted subject is invisible. An earlier version fell
+        // through from an uncovering hint to `accounts.find(covers)` and minted a code for whoever
+        // happened to have a grant (§9 round two, MAJOR).
+        const scope = 'openid email';
+        await consentFlow(h, { params: { scope }, sub: GRACE.sub }); // Grace covers; Ada does not.
+        const hintedAtAda = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', login_hint: ADA.email }) });
+        if (hintedAtAda.status !== 302 || qp(hintedAtAda, 'error') !== 'interaction_required')
+            return false;
+        if (qp(hintedAtAda, 'code') !== null)
+            return false;
+        // …and the SAME request hinted at the account that DOES cover succeeds, so this is a refusal
+        // to substitute rather than a blanket refusal.
+        const hintedAtGrace = await h({ m: 'GET', p: authUrl({ scope, prompt: 'none', login_hint: GRACE.email }) });
+        const code = qp(hintedAtGrace, 'code');
+        if (!code)
+            return false;
+        const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return ok(token) && decodeJwt(String(body(token).id_token)).payload.sub === GRACE.sub;
+    })),
+    todo('googleoauth.authorize.iss_parameter', 'authorize', 'RFC 9207 `iss` on the authorization response — the twin does NOT emit it: neither the parameter nor the discovery flag that would license it could be confirmed against Google\'s real artefacts', 'api', 'niche'),
+    todo('googleoauth.authorize.implicit_flow', 'authorize', 'response_type=token / id_token — the implicit and hybrid flows (fragment response)', 'api', 'niche'),
+    todo('googleoauth.authorize.response_mode', 'authorize', 'response_mode=form_post / fragment / query', 'api', 'niche'),
+    todo('googleoauth.authorize.hd_parameter', 'authorize', 'hd=<domain> restricts the chooser to a Workspace domain (and error=org_internal)', 'api', 'common'),
+    todo('googleoauth.authorize.enable_granular_consent', 'authorize', 'enable_granular_consent parameter toggles the per-scope checkbox UI explicitly', 'api', 'niche'),
+    todo('googleoauth.authorize.admin_policy_enforced', 'authorize', 'error=admin_policy_enforced when a Workspace admin blocks the scope', 'api', 'niche'),
+    todo('googleoauth.authorize.disallowed_useragent', 'authorize', 'error=disallowed_useragent for an embedded webview', 'api', 'niche'),
+    // ── PKCE ─────────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.pkce.s256_roundtrip', 'pkce', 'PKCE S256: a code minted with a challenge is redeemable with the matching verifier', 'api', 'core', () => withRoot(async (h) => {
+        const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+        const flow = await fullFlow(h, { params: { code_challenge: pkceS256(verifier), code_challenge_method: 'S256' }, verifier });
+        return flow.status === 200 && typeof flow.tokens.access_token === 'string';
+    })),
+    done('googleoauth.pkce.s256_mismatch_rejected', 'pkce', 'PKCE S256: the WRONG verifier is refused with invalid_grant', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: { code_challenge: pkceS256('right-verifier-right-verifier-right-verifier'), code_challenge_method: 'S256' }, verifier: 'wrong-verifier-wrong-verifier-wrong-verifier' });
+        return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+    done('googleoauth.pkce.missing_verifier_rejected', 'pkce', 'PKCE: a challenged code redeemed with NO verifier is refused', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: { code_challenge: pkceS256('some-verifier-some-verifier-some-verifier'), code_challenge_method: 'S256' } });
+        return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+    done('googleoauth.pkce.plain_method', 'pkce', 'PKCE plain: the verifier IS the challenge', 'api', 'niche', () => withRoot(async (h) => {
+        const verifier = 'plain-verifier-plain-verifier-plain-verifier';
+        const good = await fullFlow(h, { params: { code_challenge: verifier, code_challenge_method: 'plain' }, verifier });
+        const bad = await fullFlow(h, { params: { code_challenge: verifier, code_challenge_method: 'plain' }, verifier: 'other' });
+        return good.status === 200 && typeof good.tokens.access_token === 'string' && bad.status === 400 && bad.tokens.error === 'invalid_grant';
+    })),
+    done('googleoauth.pkce.invalid_method_rejected', 'pkce', 'code_challenge_method outside {S256, plain} → 302 error=invalid_request', 'api', 'common', () => withRoot(async (h) => {
+        const { error } = await errorPageFor(h, authUrl({ code_challenge: 'abc', code_challenge_method: 'SHA1' }));
+        return error?.code === 'invalid_request'
+            && error.message === "Invalid parameter value for code_challenge_method: 'SHA1' is not a valid CodeChallengeMethod";
+    })),
+    done('googleoauth.pkce.unexpected_verifier_rejected', 'pkce', 'A verifier presented for a code minted WITHOUT a challenge is refused', 'api', 'niche', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { verifier: 'unexpected-verifier-unexpected-verifier' });
+        return flow.status === 400 && flow.tokens.error === 'invalid_grant';
+    })),
+    done('googleoauth.pkce.s256_transform', 'pkce', 'The S256 transform is real SHA-256: BASE64URL(SHA256(ASCII(verifier))), unpadded', 'api', 'core', () => withRoot(async () => 
+    // RFC 7636 Appendix B's own test vector — a LITERAL, so this cannot become the twin
+    // agreeing with itself.
+    pkceS256('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk') === 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM')),
+    todo('googleoauth.pkce.verifier_length_validation', 'pkce', 'RFC 7636 verifier length rules (43-128 chars) rejected at the token endpoint', 'api', 'niche'),
+    // ── The token endpoint ───────────────────────────────────────────────────────────────────────
+    done('googleoauth.token.authorization_code', 'token', 'POST /token grant_type=authorization_code — the full success envelope', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: offline });
+        const t = flow.tokens;
+        return flow.status === 200
+            && typeof t.access_token === 'string' && String(t.access_token).startsWith('ya29.')
+            && t.expires_in === 3600
+            && t.token_type === 'Bearer'
+            && t.scope === 'openid email profile'
+            && typeof t.refresh_token === 'string' && String(t.refresh_token).startsWith('1//')
+            && typeof t.id_token === 'string';
+    })),
+    done('googleoauth.token.legacy_v4_path', 'token', 'POST /oauth2/v4/token — the legacy token path older clients default to', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const r = await h({ m: 'POST', p: '/oauth2/v4/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return r.status === 200 && String(body(r).access_token).startsWith('ya29.');
+    })),
+    done('googleoauth.token.code_single_use', 'token', 'An authorization code is redeemable EXACTLY ONCE; the replay is invalid_grant', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const redeem = () => h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        const first = await redeem();
+        const second = await redeem();
+        return first.status === 200 && second.status === 400 && err(second) === 'invalid_grant';
+    })),
+    done('googleoauth.token.code_expiry', 'token', 'An authorization code older than its ~10-minute life is invalid_grant', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const late = new Date(Date.parse(AT) + 11 * 60_000).toISOString();
+        const r = await h({ m: 'POST', p: '/token', at: late, b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        // …and it is only the CLOCK that made it fail: the same code inside the window works.
+        const flow2 = await consentFlow(h, {});
+        const early = new Date(Date.parse(AT) + 60_000).toISOString();
+        const r2 = await h({ m: 'POST', p: '/token', at: early, b: form({ grant_type: 'authorization_code', code: flow2.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return r.status === 400 && err(r) === 'invalid_grant' && r2.status === 200;
+    })),
+    done('googleoauth.token.unknown_code', 'token', 'An unknown code is invalid_grant with Google\'s "Bad Request" description', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: '4/0Anever-minted', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return r.status === 400 && err(r) === 'invalid_grant'
+            && body(r).error_description === 'The supplied authorization code is invalid or in the wrong format.';
+    })),
+    done('googleoauth.token.redirect_uri_mismatch', 'token', 'The redirect_uri must be REPEATED at the token endpoint and must match the code\'s', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const wrong = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT_URIS[1] }) });
+        const missing = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        return wrong.status === 400 && err(wrong) === 'redirect_uri_mismatch' && missing.status === 400 && err(missing) === 'redirect_uri_mismatch';
+    })),
+    done('googleoauth.token.wrong_client_rejected', 'token', 'A code minted for one client cannot be redeemed by another', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'other.apps.googleusercontent.com', client_secret: 'GOCSPX-other', redirect_uris: [REDIRECT] }) });
+        const flow = await consentFlow(h, {});
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: 'other.apps.googleusercontent.com', client_secret: 'GOCSPX-other', redirect_uri: REDIRECT }) });
+        return r.status === 400 && err(r) === 'invalid_grant';
+    })),
+    done('googleoauth.token.invalid_client_secret', 'token', 'A wrong or missing client_secret is 401 invalid_client (not 400)', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const wrong = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: 'GOCSPX-wrong', redirect_uri: REDIRECT }) });
+        const missing = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, redirect_uri: REDIRECT }) });
+        const unknown = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: 'nope.apps.googleusercontent.com', client_secret: 'x', redirect_uri: REDIRECT }) });
+        // The two DISTINCT messages captured live: an unknown client is "The OAuth client was not
+        // found."; a known client with the wrong secret is "The provided client secret is invalid."
+        return wrong.status === 401 && err(wrong) === 'invalid_client' && body(wrong).error_description === 'The provided client secret is invalid.'
+            && missing.status === 401 && err(missing) === 'invalid_client'
+            && unknown.status === 401 && err(unknown) === 'invalid_client' && body(unknown).error_description === 'The OAuth client was not found.';
+    })),
+    done('googleoauth.token.basic_auth', 'token', 'client_secret_basic: credentials in the Authorization header are accepted', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const basic = Buffer.from(`${encodeURIComponent(DEFAULT_CLIENT_ID)}:${encodeURIComponent(DEFAULT_CLIENT_SECRET)}`).toString('base64');
+        const r = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${basic}` }, b: form({ grant_type: 'authorization_code', code: flow.code, redirect_uri: REDIRECT }) });
+        // …and a WRONG basic secret is still refused, so this is not "any header passes".
+        const flow2 = await consentFlow(h, {});
+        const badBasic = Buffer.from(`${encodeURIComponent(DEFAULT_CLIENT_ID)}:nope`).toString('base64');
+        const bad = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${badBasic}` }, b: form({ grant_type: 'authorization_code', code: flow2.code, redirect_uri: REDIRECT }) });
+        return r.status === 200 && String(body(r).access_token).startsWith('ya29.') && bad.status === 401 && err(bad) === 'invalid_client';
+    })),
+    done('googleoauth.token.public_client_no_secret', 'token', 'An installed (public) client redeems with NO secret; a wrong one is still refused', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'installed.apps.googleusercontent.com', client_secret: 'GOCSPX-installed', client_type: 'installed', redirect_uris: [REDIRECT], name: 'Installed App' }) });
+        const mint = async () => {
+            const a = await h({ m: 'GET', p: authUrl({ client_id: 'installed.apps.googleusercontent.com' }) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            const d = await h({ m: 'POST', p: '/_twin/consent', b: form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }) });
+            return qp(d, 'code');
+        };
+        const noSecret = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: await mint(), client_id: 'installed.apps.googleusercontent.com', redirect_uri: REDIRECT }) });
+        const wrongSecret = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: await mint(), client_id: 'installed.apps.googleusercontent.com', client_secret: 'GOCSPX-wrong', redirect_uri: REDIRECT }) });
+        return noSecret.status === 200 && String(body(noSecret).access_token).startsWith('ya29.') && wrongSecret.status === 401;
+    })),
+    done('googleoauth.token.missing_grant_type', 'token', 'Missing grant_type → 400 invalid_request naming the parameter', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/token', b: form({ code: 'x' }) });
+        return r.status === 400 && err(r) === 'invalid_request' && body(r).error_description === 'Missing required parameter: grant_type';
+    })),
+    done('googleoauth.token.unsupported_grant_type', 'token', 'An unmodelled grant_type is refused with unsupported_grant_type — never faked', 'api', 'core', () => withRoot(async (h) => {
+        const password = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'password', username: 'a', password: 'b' }) });
+        const device = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: 'x' }) });
+        return password.status === 400 && err(password) === 'unsupported_grant_type'
+            && device.status === 400 && err(device) === 'unsupported_grant_type';
+    })),
+    done('googleoauth.token.missing_code', 'token', 'authorization_code grant with no code → 400 invalid_request', 'api', 'niche', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return r.status === 400 && err(r) === 'invalid_request' && String(body(r).error_description).includes('code');
+    })),
+    done('googleoauth.token.no_store_headers', 'token', 'Token responses carry Cache-Control: no-store (RFC 6749 §5.1)', 'api', 'niche', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, {});
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return r.status === 200 && r.headers?.['cache-control'] === 'no-store' && r.headers?.pragma === 'no-cache';
+    })),
+    todo('googleoauth.token.json_body_tolerance', 'token', 'Accept an application/json token request body (the twin is form-encoded-only until this is grounded)', 'api', 'niche'),
+    todo('googleoauth.token.device_code_grant', 'token', 'grant_type=urn:ietf:params:oauth:grant-type:device_code (the TV/CLI flow)', 'api', 'common'),
+    todo('googleoauth.token.sts_token_exchange', 'token', 'The STS token-exchange grant — on sts.googleapis.com, a HOST this pack does not claim in VENDOR_HOSTS (workload identity federation)', 'api', 'niche'),
+    // ── Refresh ──────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.refresh.grant', 'refresh', 'grant_type=refresh_token mints a NEW access token for the same subject', 'api', 'core', () => withRoot(async (h) => {
+        const first = await fullFlow(h, { params: offline });
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(first.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        const t = body(r);
+        // …and the REFRESHED token still belongs to an OFFLINE grant: deriving access_type from
+        // "did a refresh token come back?" made a refreshed token report `online`, which is wrong.
+        const info = await h({ m: 'GET', p: `/tokeninfo?access_token=${t.access_token}` });
+        return r.status === 200
+            && String(t.access_token).startsWith('ya29.')
+            && t.access_token !== first.tokens.access_token
+            && t.expires_in === 3600
+            // Google does NOT rotate the refresh token, so none comes back.
+            && t.refresh_token === undefined
+            && typeof t.id_token === 'string'
+            && ok(info) && body(info).access_type === 'offline' && body(info).sub === ADA.sub;
+    })),
+    done('googleoauth.refresh.only_when_offline', 'refresh', 'A refresh_token is issued only for access_type=offline — an online grant gets none', 'api', 'core', () => withRoot(async (h) => {
+        const online = await fullFlow(h, {});
+        const offlineFlow = await fullFlow(h, { params: offline });
+        return online.status === 200 && online.tokens.refresh_token === undefined
+            && offlineFlow.status === 200 && typeof offlineFlow.tokens.refresh_token === 'string';
+    })),
+    done('googleoauth.refresh.second_grant_needs_prompt', 'refresh', 'A SECOND offline authorization gets no refresh_token unless prompt=consent forced the screen', 'api', 'common', () => withRoot(async (h) => {
+        // Google's real rule, and the source of the classic "we lost the refresh token" bug.
+        const first = await fullFlow(h, { params: { access_type: 'offline' } });
+        const second = await fullFlow(h, { params: { access_type: 'offline' } });
+        const forced = await fullFlow(h, { params: offline });
+        return typeof first.tokens.refresh_token === 'string'
+            && second.status === 200 && second.tokens.refresh_token === undefined
+            && typeof forced.tokens.refresh_token === 'string';
+    })),
+    done('googleoauth.refresh.unknown_rejected', 'refresh', 'An unknown refresh token is invalid_grant "Token has been expired or revoked."', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: '1//0never', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        return r.status === 400 && err(r) === 'invalid_grant' && body(r).error_description === 'Token has been expired or revoked.';
+    })),
+    done('googleoauth.refresh.scope_narrowing', 'refresh', 'A refresh may NARROW the scope; widening it is invalid_scope (RFC 6749 §6)', 'api', 'common', () => withRoot(async (h) => {
+        const first = await fullFlow(h, { params: offline });
+        const rt = String(first.tokens.refresh_token);
+        const narrow = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: rt, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, scope: 'openid email' }) });
+        const wide = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: rt, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, scope: 'openid email https://www.googleapis.com/auth/drive' }) });
+        return narrow.status === 200 && body(narrow).scope === 'openid email'
+            && wide.status === 400 && err(wide) === 'invalid_scope';
+    })),
+    done('googleoauth.refresh.missing_token', 'refresh', 'refresh_token grant with no token → 400 invalid_request', 'api', 'niche', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        return r.status === 400 && err(r) === 'invalid_request'
+            && body(r).error_description === 'Missing required parameter: refresh_token';
+    })),
+    todo('googleoauth.refresh.testing_mode_7_day_expiry', 'refresh', 'Refresh tokens expire after 7 days while the app is in testing status', 'api', 'common'),
+    todo('googleoauth.refresh.hundred_token_cap', 'refresh', 'The 101st refresh token per (user, client) silently invalidates the oldest', 'api', 'niche'),
+    // ── id_token / JWKS (real crypto) ────────────────────────────────────────────────────────────
+    done('googleoauth.idtoken.rs256_signed', 'idtoken', 'The id_token is a REAL RS256 JWT with Google\'s header shape', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const { header } = decodeJwt(String(flow.tokens.id_token));
+        return header.alg === 'RS256' && header.typ === 'JWT' && typeof header.kid === 'string' && header.kid.length === 40;
+    })),
+    done('googleoauth.idtoken.jwks_endpoint', 'idtoken', 'GET /oauth2/v3/certs serves a real JWKS document', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: '/oauth2/v3/certs' });
+        const keys = body(r).keys;
+        return ok(r) && Array.isArray(keys) && keys.length === 1
+            && keys[0].kty === 'RSA' && keys[0].alg === 'RS256' && keys[0].use === 'sig'
+            && typeof keys[0].n === 'string' && keys[0].n.length > 300 && keys[0].e === 'AQAB';
+    })),
+    done('googleoauth.idtoken.verifies_against_jwks', 'idtoken', 'A twin-issued id_token VERIFIES against the JWKS the twin serves (claims round-trip)', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        const v = verifyJwtWithJwks(String(flow.tokens.id_token), jwks, { now: AT_SECONDS + 10 });
+        return v.valid === true
+            && v.payload.iss === 'https://accounts.google.com'
+            && v.payload.sub === ADA.sub
+            && v.payload.aud === DEFAULT_CLIENT_ID
+            && v.payload.azp === DEFAULT_CLIENT_ID
+            && v.payload.email === ADA.email
+            && v.payload.email_verified === true;
+    })),
+    done('googleoauth.idtoken.tamper_rejected', 'idtoken', 'A tampered or expired id_token FAILS verification against the same JWKS', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const token = String(flow.tokens.id_token);
+        const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        const tampered = `${token.slice(0, -4)}AAAA`;
+        const good = verifyJwtWithJwks(token, jwks, { now: AT_SECONDS + 10 });
+        const bad = verifyJwtWithJwks(tampered, jwks, { now: AT_SECONDS + 10 });
+        const expired = verifyJwtWithJwks(token, jwks, { now: AT_SECONDS + 100_000 });
+        return good.valid === true && bad.valid === false && bad.reason === 'bad_signature' && expired.valid === false && expired.reason === 'expired';
+    })),
+    done('googleoauth.idtoken.stable_kid', 'idtoken', 'The token header kid matches a JWKS kid, and is STABLE across calls (one persisted key)', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const { header } = decodeJwt(String(flow.tokens.id_token));
+        const jwks1 = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        const jwks2 = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        return header.kid === jwks1.keys[0].kid && jwks1.keys[0].kid === jwks2.keys[0].kid && jwks1.keys[0].n === jwks2.keys[0].n;
+    })),
+    done('googleoauth.idtoken.at_hash', 'idtoken', 'at_hash is the real OIDC left-half SHA-256 of the access token (openid-client validates it)', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const { payload } = decodeJwt(String(flow.tokens.id_token));
+        // Recomputed here from the OIDC Core §3.1.3.6 definition, independently of the handler.
+        const digest = new Bun.CryptoHasher('sha256').update(String(flow.tokens.access_token)).digest();
+        const expected = Buffer.from(digest.subarray(0, digest.length / 2)).toString('base64url');
+        return payload.at_hash === expected && typeof payload.at_hash === 'string';
+    })),
+    done('googleoauth.idtoken.nonce_roundtrip', 'idtoken', 'A `nonce` on the authorization request rides into the id_token; without one it is absent', 'api', 'core', () => withRoot(async (h) => {
+        const withNonce = await fullFlow(h, { params: { nonce: 'n-0S6_WzA2Mj' } });
+        const without = await fullFlow(h, {});
+        return decodeJwt(String(withNonce.tokens.id_token)).payload.nonce === 'n-0S6_WzA2Mj'
+            && decodeJwt(String(without.tokens.id_token)).payload.nonce === undefined;
+    })),
+    done('googleoauth.idtoken.claims_follow_scope', 'idtoken', 'Profile/email claims appear ONLY when their scope was granted', 'api', 'core', () => withRoot(async (h) => {
+        const full = await fullFlow(h, { params: { scope: 'openid email profile' } });
+        const openidOnly = await fullFlow(h, { params: { scope: 'openid' } });
+        const emailOnly = await fullFlow(h, { params: { scope: 'openid email' } });
+        const f = decodeJwt(String(full.tokens.id_token)).payload;
+        const o = decodeJwt(String(openidOnly.tokens.id_token)).payload;
+        const e = decodeJwt(String(emailOnly.tokens.id_token)).payload;
+        return f.email === ADA.email && f.name === ADA.name && f.picture === ADA.picture
+            && o.email === undefined && o.name === undefined && o.sub === ADA.sub
+            && e.email === ADA.email && e.name === undefined;
+    })),
+    done('googleoauth.idtoken.omitted_without_openid', 'idtoken', 'A plain OAuth 2.0 grant (no `openid` scope) gets NO id_token', 'api', 'core', () => withRoot(async (h) => {
+        const r = await fullFlow(h, { params: { scope: 'https://www.googleapis.com/auth/calendar.readonly' } });
+        return r.status === 200 && typeof r.tokens.access_token === 'string' && r.tokens.id_token === undefined;
+    })),
+    done('googleoauth.idtoken.hd_claim', 'idtoken', 'A Workspace account\'s `hd` claim rides in the id_token; a consumer account has none', 'api', 'common', () => withRoot(async (h) => {
+        const workspace = await fullFlow(h, { sub: GRACE.sub });
+        const consumer = await fullFlow(h, { sub: ADA.sub });
+        return decodeJwt(String(workspace.tokens.id_token)).payload.hd === GRACE.hd
+            && decodeJwt(String(consumer.tokens.id_token)).payload.hd === undefined;
+    })),
+    done('googleoauth.idtoken.legacy_pem_certs', 'idtoken', 'GET /oauth2/v1/certs serves the SAME key in PEM form, keyed by kid', 'api', 'niche', () => withRoot(async (h) => {
+        const pem = body(await h({ m: 'GET', p: '/oauth2/v1/certs' }));
+        const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        const kid = jwks.keys[0].kid;
+        return Object.keys(pem).length === 1 && typeof pem[kid] === 'string' && String(pem[kid]).includes('-----BEGIN PUBLIC KEY-----');
+    })),
+    todo('googleoauth.idtoken.key_rotation', 'idtoken', 'Google publishes several keys and rotates them; the twin serves exactly one', 'api', 'common'),
+    todo('googleoauth.certs.v1_x509_certificate', 'idtoken', '/oauth2/v1/certs serves X.509 CERTIFICATES; the twin serves the bare public key PEM', 'api', 'niche'),
+    todo('googleoauth.idtoken.iss_bare_host_variant', 'idtoken', 'Google also issues `iss: accounts.google.com` (no scheme); the twin always uses the URL form', 'api', 'niche'),
+    // ── Granular / incremental consent ───────────────────────────────────────────────────────────
+    done('googleoauth.granular.declined_scope_excluded', 'granular', 'A scope the user unticks is NOT in the grant, the redirect\'s scope, or the token', 'api', 'core', () => withRoot(async (h) => {
+        const scope = 'openid email https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/drive.file';
+        // Tick only the calendar scope; drive.file is declined.
+        const flow = await consentFlow(h, { params: { scope }, tick: ['https://www.googleapis.com/auth/calendar.readonly'] });
+        const granted = qp(flow.redirect, 'scope') ?? '';
+        const token = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: flow.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        if (!granted.includes('calendar.readonly') || granted.includes('drive.file'))
+            return false;
+        if (!String(body(token).scope).includes('calendar.readonly') || String(body(token).scope).includes('drive.file'))
+            return false;
+        // …and the GRANT, which is the clause the title makes and the one that was false: an earlier
+        // version unioned the prior scopes in unconditionally, so a decline stayed in the grant and a
+        // later `include_granted_scopes=true` handed the scope back WITHOUT the user re-ticking it.
+        // Grant everything first, then decline one, then ask incrementally — the resurrection path.
+        await consentFlow(h, { params: { scope } });
+        const declineRound = await consentFlow(h, { params: { scope }, tick: ['https://www.googleapis.com/auth/calendar.readonly'] });
+        if (String(qp(declineRound.redirect, 'scope')).includes('drive.file'))
+            return false;
+        const incremental = await consentFlow(h, { params: { scope: 'openid', include_granted_scopes: 'true' } });
+        const unioned = qp(incremental.redirect, 'scope') ?? '';
+        if (!unioned.includes('calendar.readonly') || unioned.includes('drive.file'))
+            return false;
+        // …and the SAME-REQUEST case, which the across-requests test above structurally cannot see:
+        // decline a scope on a screen that ALSO carries include_granted_scopes=true. An earlier
+        // version computed the token's scope set from the PRE-removal prior scopes, so the scope the
+        // user unticked on that very screen was handed straight back — leaving an access token whose
+        // scope set was a strict superset of the grant that authorised it (§9 round two, MAJOR).
+        const both = 'openid https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/calendar.readonly';
+        await consentFlow(h, { params: { scope: both }, sub: GRACE.sub });
+        const sameRequest = await consentFlow(h, {
+            params: { scope: both, include_granted_scopes: 'true' },
+            sub: GRACE.sub,
+            tick: ['https://www.googleapis.com/auth/calendar.readonly'],
+        });
+        const echoed = qp(sameRequest.redirect, 'scope') ?? '';
+        if (echoed.includes('drive.file'))
+            return false;
+        const sameToken = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'authorization_code', code: sameRequest.code, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET, redirect_uri: REDIRECT }) });
+        return ok(sameToken) && !String(body(sameToken).scope).includes('drive.file')
+            && String(body(sameToken).scope).includes('calendar.readonly');
+    })),
+    done('googleoauth.granular.oidc_scopes_not_declinable', 'granular', 'openid/email/profile ride with signing in — they survive even when nothing is ticked', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await consentFlow(h, { params: { scope: 'openid email profile https://www.googleapis.com/auth/drive.file' }, tick: [] });
+        const granted = qp(flow.redirect, 'scope') ?? '';
+        return granted === 'openid email profile' && !granted.includes('drive.file');
+    })),
+    done('googleoauth.granular.all_declined_is_denial', 'granular', 'Unticking every scope on a granular screen is access_denied, not an empty grant', 'api', 'common', () => withRoot(async (h) => {
+        // TWO product scopes, so Google's granular rule actually shows checkboxes to untick.
+        const flow = await consentFlow(h, { params: { scope: 'https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/calendar.readonly' }, tick: [] });
+        return flow.redirect.status === 302 && qp(flow.redirect, 'error') === 'access_denied' && flow.code === null;
+    })),
+    done('googleoauth.granular.rule_governs_the_screen', 'granular', 'The per-scope checkboxes appear ONLY when Google\'s granular rule applies — and the grant follows the screen', 'api', 'core', () => withRoot(async (h) => {
+        // Google documents the rule: checkboxes when (a sign-in scope + a product scope) or (two or
+        // more product scopes). One scope, or sign-in scopes alone, is all-or-nothing. An integration
+        // asking for exactly one product scope can therefore NEVER get a partial grant, and a twin
+        // that offered a checkbox there would invent a code path production never produces.
+        const single = await consentFlow(h, { params: { scope: 'https://www.googleapis.com/auth/drive.file' }, tick: [] });
+        const signInOnly = await consentFlow(h, { params: { scope: 'openid email profile' }, tick: [] });
+        const mixed = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file' }, tick: [] });
+        return (qp(single.redirect, 'scope') ?? '') === 'https://www.googleapis.com/auth/drive.file'
+            && (qp(signInOnly.redirect, 'scope') ?? '') === 'openid email profile'
+            // …and where the rule DOES apply, unticking really removes the scope.
+            && (qp(mixed.redirect, 'scope') ?? '') === 'openid';
+    })),
+    done('googleoauth.granular.incremental_authorization', 'granular', 'include_granted_scopes=true unions this grant with everything previously granted', 'api', 'common', () => withRoot(async (h) => {
+        await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/calendar.readonly' } });
+        const second = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file', include_granted_scopes: 'true' } });
+        const granted = qp(second.redirect, 'scope') ?? '';
+        // …and WITHOUT the flag the third grant is narrow again, so the union is the flag's doing.
+        const third = await consentFlow(h, { params: { scope: 'openid https://www.googleapis.com/auth/drive.file' } });
+        const narrow = qp(third.redirect, 'scope') ?? '';
+        return granted.includes('calendar.readonly') && granted.includes('drive.file')
+            && !narrow.includes('calendar.readonly') && narrow.includes('drive.file');
+    })),
+    done('googleoauth.granular.unknown_scope_accepted', 'granular', 'An unrecognised scope string is ACCEPTED (Google does not curate them) and echoed back', 'api', 'common', () => withRoot(async (h) => {
+        const weird = 'https://www.googleapis.com/auth/some-future-product.readonly';
+        const flow = await consentFlow(h, { params: { scope: `openid ${weird}` }, tick: [weird] });
+        return (qp(flow.redirect, 'scope') ?? '').includes(weird) && !!flow.code;
+    })),
+    // ── The dirty-state verify (behaviour that only breaks OVER prior state) ─────────────────────
+    done('googleoauth.grants.regrant_after_revoke', 'grants', 'DIRTY STATE: revoke a grant, re-consent, and the NEW tokens work while the old stay dead', 'api', 'core', () => withRoot(async (h) => {
+        // Every other verify starts from a fresh root and therefore cannot see this class of bug:
+        // a sticky revocation tombstone that poisons the re-grant, or a re-grant that resurrects
+        // the revoked tokens.
+        const first = await fullFlow(h, { params: offline });
+        const oldAccess = String(first.tokens.access_token);
+        const oldRefresh = String(first.tokens.refresh_token);
+        const revoked = await h({ m: 'POST', p: '/revoke', b: `token=${oldRefresh}` });
+        if (revoked.status !== 200)
+            return false;
+        // The old credentials are dead in BOTH directions.
+        const deadUser = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${oldAccess}` } });
+        const deadRefresh = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: oldRefresh, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        if (deadUser.status !== 401 || deadRefresh.status !== 400)
+            return false;
+        // Re-consent over that dirty state mints working credentials again — and crucially WITHOUT
+        // `prompt=consent`, which would force a refresh token unconditionally and route around the
+        // defect. Google treats a re-consent after revocation as a FIRST authorization, so an offline
+        // request must get a refresh token back; an earlier version left the grant row standing after
+        // revocation and silently withheld one (§9 round one).
+        const second = await fullFlow(h, { params: { access_type: 'offline' } });
+        if (typeof second.tokens.refresh_token !== 'string')
+            return false;
+        const newAccess = String(second.tokens.access_token);
+        const liveUser = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${newAccess}` } });
+        // …and the OLD ones are still dead afterwards (no resurrection).
+        const stillDead = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${oldAccess}` } });
+        // …and the revoked refresh token is still dead, so the new grant did not resurrect the old one.
+        const oldRefreshAgain = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: oldRefresh, client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        return second.status === 200 && newAccess !== oldAccess && liveUser.status === 200
+            && body(liveUser).sub === ADA.sub && stillDead.status === 401 && oldRefreshAgain.status === 400;
+    })),
+    done('googleoauth.grants.per_account_isolation', 'grants', 'Two accounts consenting to one client keep SEPARATE grants and tokens', 'api', 'common', () => withRoot(async (h) => {
+        const ada = await fullFlow(h, { sub: ADA.sub });
+        const grace = await fullFlow(h, { sub: GRACE.sub });
+        const adaInfo = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${ada.tokens.access_token}` } });
+        const graceInfo = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${grace.tokens.access_token}` } });
+        // Revoking one must not touch the other — the grant is per (client, user).
+        await h({ m: 'POST', p: '/revoke', b: `token=${ada.tokens.access_token}` });
+        const adaAfter = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${ada.tokens.access_token}` } });
+        const graceAfter = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${grace.tokens.access_token}` } });
+        return body(adaInfo).sub === ADA.sub && body(graceInfo).sub === GRACE.sub
+            && adaAfter.status === 401 && graceAfter.status === 200 && body(graceAfter).sub === GRACE.sub;
+    })),
+    done('googleoauth.ids.pull_after_local_create_no_collision', 'grants', 'ID COLLISION: a pull over a locally registered client of the SAME client_id leaves it BEHAVIOURALLY intact (no confidential\u2192public downgrade)', 'connector', 'core', () => withRoot(async () => {
+        // This vendor is unusually exposed to the collision class §9 names: the connector pulls rows
+        // keyed by the REAL client_id and the REAL account `sub`, which are exactly the ids an
+        // operator registers locally. A pulled client carries `secret: null` and
+        // `clientType: 'installed'`, so a clobber would DOWNGRADE a confidential client — after which
+        // the app's real secret is rejected and a secret-less caller is accepted.
+        //
+        // WHAT THIS ACTUALLY PINS, stated honestly (§9 round two): the kernel folds local actions OVER
+        // the observed mirror unconditionally, so this direction is safe BY CONSTRUCTION rather than
+        // by anything this pack does. That is exactly why it is worth a capability — the property is
+        // load-bearing here, it is invisible in this pack's own source, and nothing else in the pack
+        // would notice if the kernel's fold order ever changed.
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-collide-'));
+        try {
+            const azp = FAKE_TOKENINFO.azp;
+            const h = (m, p, b) => handleGoogleOAuthTwinRequest({ method: m, path: p, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT });
+            // LOCAL first, then PULL over it.
+            await h('POST', '/_twin/clients', JSON.stringify({ client_id: azp, client_secret: 'GOCSPX-mine', name: 'My Real App', redirect_uris: [REDIRECT] }));
+            await syncGoogleOAuthFromReal(fakeExecute, { root });
+            // The local registration must survive, and be BEHAVIOURALLY intact: a code minted for it
+            // still requires the real secret, which is the property a downgrade would destroy.
+            const page = await h('GET', authUrl({ client_id: azp }));
+            if (!String(page.body).includes('My Real App'))
+                return false;
+            const rid = AUTH_REQUEST_RE.exec(String(page.body))?.[1] ?? '';
+            const decision = await h('POST', '/_twin/consent', form({ auth_request: rid, sub: ADA.sub, decision: 'allow' }));
+            const code = new URL(decision.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+            const withSecret = await h('POST', '/token', form({ grant_type: 'authorization_code', code, client_id: azp, client_secret: 'GOCSPX-mine', redirect_uri: REDIRECT }));
+            const page2 = await h('GET', authUrl({ client_id: azp }));
+            const rid2 = AUTH_REQUEST_RE.exec(String(page2.body))?.[1] ?? '';
+            const d2 = await h('POST', '/_twin/consent', form({ auth_request: rid2, sub: ADA.sub, decision: 'allow' }));
+            const code2 = new URL(d2.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+            const withoutSecret = await h('POST', '/token', form({ grant_type: 'authorization_code', code: code2, client_id: azp, redirect_uri: REDIRECT }));
+            return withSecret.status === 200 && withoutSecret.status === 401;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.ids.local_create_after_pull_no_collision', 'grants', 'ID COLLISION, the other direction: a pulled client is UNUSABLE until registered, and registering over it takes effect', 'connector', 'core', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-collide2-'));
+        try {
+            // The second half of this pair is NOT the mirror image of the first — under the kernel's
+            // fold there is no mirror image. What is genuinely this pack's own behaviour is the FIRST
+            // assertion below: a pulled-only client is UNUSABLE, because tokeninfo discloses no redirect
+            // URIs and the twin refuses to invent one (§9 round two).
+            const azp = FAKE_TOKENINFO.azp;
+            const sub = FAKE_USERINFO.sub;
+            const h = (m, p, b) => handleGoogleOAuthTwinRequest({ method: m, path: p, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT });
+            // PULL FIRST. A pulled client discloses no redirect URIs (tokeninfo does not return any), so
+            // it is correctly UNUSABLE for a consent flow — the twin refuses with redirect_uri_mismatch
+            // rather than inventing a registration. That refusal is the honest state, and it is what a
+            // clobber in this direction would silently replace.
+            await syncGoogleOAuthFromReal(fakeExecute, { root });
+            const beforeRegistration = await h('GET', authUrl({ client_id: azp }));
+            if (beforeRegistration.status !== 302)
+                return false;
+            const errorTarget = new URL(loc(beforeRegistration));
+            if (decodeAuthError(errorTarget.searchParams.get('authError') ?? '')?.code !== 'redirect_uri_mismatch')
+                return false;
+            // …then REGISTER over it. The local action must win over the pulled observation.
+            await h('POST', '/_twin/clients', JSON.stringify({ client_id: azp, client_secret: 'GOCSPX-later', name: 'Registered Later', redirect_uris: [REDIRECT] }));
+            const page = await h('GET', authUrl({ client_id: azp }));
+            if (page.status !== 200)
+                return false;
+            if (!html(page).includes('Registered Later') || html(page).includes('Pulled client'))
+                return false;
+            // …and the PULLED PERSONA is a real account that can consent through it, keyed by the real
+            // Google `sub` the pull brought in — a local consent must not overwrite a pulled subject.
+            if (!html(page).includes(FAKE_USERINFO.email))
+                return false;
+            const rid = AUTH_REQUEST_RE.exec(html(page))?.[1] ?? '';
+            const decision = await h('POST', '/_twin/consent', form({ auth_request: rid, sub, decision: 'allow' }));
+            const code = new URL(decision.headers?.location ?? 'http://x.test/').searchParams.get('code') ?? '';
+            const token = await h('POST', '/token', form({ grant_type: 'authorization_code', code, client_id: azp, client_secret: 'GOCSPX-later', redirect_uri: REDIRECT }));
+            return token.status === 200
+                && decodeJwt(String(token.body.id_token)).payload.sub === sub
+                && decodeJwt(String(token.body.id_token)).payload.email === FAKE_USERINFO.email;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    // ── userinfo ─────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.userinfo.get', 'userinfo', 'GET /v1/userinfo returns the OIDC claim set for the bearer\'s subject', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        const u = body(r);
+        return ok(r) && u.sub === ADA.sub && u.email === ADA.email && u.email_verified === true
+            && u.name === ADA.name && u.given_name === ADA.givenName && u.picture === ADA.picture;
+    })),
+    done('googleoauth.userinfo.legacy_path', 'userinfo', 'GET /oauth2/v3/userinfo — the www.googleapis.com alias serves the same claims', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const r = await h({ m: 'GET', p: '/oauth2/v3/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        return ok(r) && body(r).sub === ADA.sub && body(r).email === ADA.email;
+    })),
+    done('googleoauth.userinfo.post_method', 'userinfo', 'POST /v1/userinfo is accepted as well as GET (OIDC Core §5.3.1)', 'api', 'niche', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const r = await h({ m: 'POST', p: '/v1/userinfo', b: '', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        return ok(r) && body(r).sub === ADA.sub;
+    })),
+    done('googleoauth.userinfo.unauthenticated_two_hosts', 'userinfo', 'A bad credential is 401 on BOTH hosts — with the DIFFERENT error bodies each host really returns', 'api', 'core', () => withRoot(async (h) => {
+        // The trap: openidconnect.googleapis.com answers `invalid_request`/"Invalid Credentials"
+        // while www.googleapis.com answers `invalid_token`/"Invalid Value" for the same failure.
+        // Normalising the two would hide a real difference an integration can trip over.
+        const noneOidc = await h({ m: 'GET', p: '/v1/userinfo' });
+        const bogusOidc = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: 'Bearer ya29.not-a-real-token' } });
+        const bogusApis = await h({ m: 'GET', p: '/oauth2/v3/userinfo', h: { authorization: 'Bearer ya29.not-a-real-token' } });
+        return noneOidc.status === 401 && err(noneOidc) === 'invalid_request' && body(noneOidc).error_description === 'Invalid Credentials'
+            && bogusOidc.status === 401 && err(bogusOidc) === 'invalid_request'
+            && bogusApis.status === 401 && err(bogusApis) === 'invalid_token' && body(bogusApis).error_description === 'Invalid Value';
+    })),
+    done('googleoauth.userinfo.insufficient_scope', 'userinfo', 'A token with no identity scope is REFUSED — never an empty or partial profile', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: { scope: 'https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/drive.file' } });
+        const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        // Refusal, not a fake success. Google's EXACT answer for this case was not captured, so the
+        // twin reuses the credential-rejection envelope rather than inventing a third shape —
+        // `googleoauth.userinfo.insufficient_scope_shape` is the filed todo.
+        const okToken = await fullFlow(h, { params: { scope: 'openid email' } });
+        const good = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${okToken.tokens.access_token}` } });
+        return r.status === 401 && body(r).sub === undefined && body(r).email === undefined
+            && good.status === 200 && body(good).sub === ADA.sub;
+    })),
+    done('googleoauth.userinfo.claims_follow_scope', 'userinfo', 'userinfo claims are filtered by granted scope, exactly as the id_token\'s are', 'api', 'common', () => withRoot(async (h) => {
+        const emailOnly = await fullFlow(h, { params: { scope: 'openid email' } });
+        const r = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${emailOnly.tokens.access_token}` } });
+        return ok(r) && body(r).sub === ADA.sub && body(r).email === ADA.email && body(r).name === undefined;
+    })),
+    done('googleoauth.userinfo.expired_token', 'userinfo', 'An access token past its 3600s life → 401, not a stale profile', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const later = new Date(Date.parse(AT) + 3600_000).toISOString();
+        const r = await h({ m: 'GET', p: '/v1/userinfo', at: later, h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        const stillFine = await h({ m: 'GET', p: '/v1/userinfo', at: new Date(Date.parse(AT) + 1000).toISOString(), h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        return r.status === 401 && stillFine.status === 200;
+    })),
+    // ── revoke ───────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.revoke.post', 'revoke', 'POST /revoke with a form-encoded token → 200, an empty body, and the token really stops working', 'api', 'core', () => withRoot(async (h) => {
+        // A `200 {}` is exactly what a DEAD handler returns, so status+shape alone is not a check —
+        // the mutation gate caught this verify surviving a behaviourally-empty twin. The teeth are the
+        // EFFECT: the revoked token must stop working, and an unrelated token must not.
+        const victim = await fullFlow(h, { params: offline });
+        const bystander = await fullFlow(h, { sub: GRACE.sub, params: offline });
+        const before = await h({ m: 'GET', p: `/tokeninfo?access_token=${victim.tokens.access_token}` });
+        if (!ok(before))
+            return false;
+        const r = await h({ m: 'POST', p: '/revoke', b: `token=${victim.tokens.refresh_token}` });
+        if (r.status !== 200 || Object.keys(body(r)).length !== 0)
+            return false;
+        const after = await h({ m: 'GET', p: `/tokeninfo?access_token=${victim.tokens.access_token}` });
+        const refreshed = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(victim.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        const other = await h({ m: 'GET', p: `/tokeninfo?access_token=${bystander.tokens.access_token}` });
+        return after.status === 400 && err(after) === 'invalid_token'
+            && refreshed.status === 400 && err(refreshed) === 'invalid_grant'
+            && ok(other) && body(other).sub === GRACE.sub;
+    })),
+    done('googleoauth.revoke.get', 'revoke', 'GET /revoke?token= is accepted too', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const r = await h({ m: 'GET', p: `/revoke?token=${flow.tokens.access_token}` });
+        const after = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${flow.tokens.access_token}` } });
+        return r.status === 200 && after.status === 401;
+    })),
+    done('googleoauth.revoke.whole_grant', 'revoke', 'Revoking EITHER token kills the WHOLE grant — access and refresh together', 'api', 'core', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: offline });
+        // Revoke the ACCESS token; the REFRESH token must die with it.
+        const r = await h({ m: 'POST', p: '/revoke', b: `token=${flow.tokens.access_token}` });
+        const refresh = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'refresh_token', refresh_token: String(flow.tokens.refresh_token), client_id: DEFAULT_CLIENT_ID, client_secret: DEFAULT_CLIENT_SECRET }) });
+        return r.status === 200 && refresh.status === 400 && err(refresh) === 'invalid_grant';
+    })),
+    done('googleoauth.revoke.unknown_token', 'revoke', 'An unknown token → 400 invalid_token "Token expired or revoked"', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: '/revoke', b: 'token=ya29.never-existed' });
+        const missing = await h({ m: 'POST', p: '/revoke', b: '' });
+        return r.status === 400 && err(r) === 'invalid_token' && body(r).error_description === 'Token expired or revoked'
+            && missing.status === 400 && err(missing) === 'invalid_request';
+    })),
+    // ── tokeninfo ────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.tokeninfo.access_token', 'tokeninfo', 'GET /tokeninfo?access_token= describes the token (aud/azp/sub/scope/exp, as STRINGS)', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, { params: offline });
+        const r = await h({ m: 'GET', p: `/tokeninfo?access_token=${flow.tokens.access_token}` });
+        const t = body(r);
+        return ok(r) && t.aud === DEFAULT_CLIENT_ID && t.azp === DEFAULT_CLIENT_ID && t.sub === ADA.sub
+            && t.scope === 'openid email profile' && t.email === ADA.email
+            // Google returns exp/expires_in as STRINGS on this endpoint, not numbers.
+            && typeof t.exp === 'string' && typeof t.expires_in === 'string' && t.access_type === 'offline';
+    })),
+    done('googleoauth.tokeninfo.invalid', 'tokeninfo', 'An unknown, revoked or expired token → 400 invalid_token "Invalid Value"', 'api', 'common', () => withRoot(async (h) => {
+        const flow = await fullFlow(h, {});
+        const unknown = await h({ m: 'GET', p: '/tokeninfo?access_token=ya29.nope' });
+        await h({ m: 'POST', p: '/revoke', b: `token=${flow.tokens.access_token}` });
+        const revoked = await h({ m: 'GET', p: `/tokeninfo?access_token=${flow.tokens.access_token}` });
+        const none = await h({ m: 'GET', p: '/tokeninfo' });
+        return unknown.status === 400 && err(unknown) === 'invalid_token' && body(unknown).error_description === 'Invalid Value'
+            && revoked.status === 400 && none.status === 400 && err(none) === 'invalid_request';
+    })),
+    todo('googleoauth.tokeninfo.id_token', 'tokeninfo', 'GET /tokeninfo?id_token= — the id_token branch (its exact field set is not grounded yet)', 'api', 'niche'),
+    // Two gaps this pack's own code and README already CITE by id. Filing them is not bookkeeping:
+    // an id referenced in a comment but absent from the manifest is a gap that reads as tracked and
+    // is tracked nowhere.
+    todo('googleoauth.errors.authError_captured_literal', 'errors', 'Pin the authError protobuf against a CAPTURED base64url literal from a real ?authError= — the wire format is reproduced from a decode and is self-consistent, but nothing in the pack proves it byte-for-byte', 'api', 'common'),
+    todo('googleoauth.errors.error_page_http_status', 'errors', 'The HTTP status Google serves /signin/oauth/error with (the twin serves 200 and carries the named status in the payload)', 'api', 'niche'),
+    todo('googleoauth.userinfo.insufficient_scope_shape', 'userinfo', 'Google\'s exact status + body for a VALID token that holds no identity scope (the twin refuses with the credential-rejection envelope)', 'api', 'niche'),
+    // ── The service-account (two-legged) grant ───────────────────────────────────────────────────
+    done('googleoauth.serviceaccount.jwt_bearer_access_token', 'serviceaccount', 'grant_type=jwt-bearer mints an access token (what google-auth-library does before any Vertex/GCS call)', 'api', 'core', () => withRoot(async (h) => {
+        const assertion = `e30.${Buffer.from(JSON.stringify({ iss: 'svc@twin.iam.gserviceaccount.com', scope: 'https://www.googleapis.com/auth/cloud-platform' })).toString('base64url')}.sig`;
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion }) });
+        const t = body(r);
+        if (!ok(r) || !String(t.access_token).startsWith('ya29.') || t.token_type !== 'Bearer' || t.expires_in !== 3600)
+            return false;
+        if (t.scope !== 'https://www.googleapis.com/auth/cloud-platform' || t.id_token !== undefined)
+            return false;
+        // …and the token is USABLE, which is the whole point of a credential. An earlier version
+        // minted a bare string and persisted nothing, so the twin's own /tokeninfo refused the token
+        // it had just issued (§9 round one).
+        const info = await h({ m: 'GET', p: `/tokeninfo?access_token=${t.access_token}` });
+        // A service account is not a consenting user, so userinfo correctly refuses it — there is no
+        // account row and no grant behind it.
+        const profile = await h({ m: 'GET', p: '/v1/userinfo', h: { authorization: `Bearer ${t.access_token}` } });
+        return ok(info) && body(info).scope === 'https://www.googleapis.com/auth/cloud-platform'
+            && profile.status === 401;
+    })),
+    done('googleoauth.serviceaccount.jwt_bearer_id_token', 'serviceaccount', 'A target_audience assertion mints a REAL RS256 id_token for that audience (getIdTokenClient)', 'api', 'core', () => withRoot(async (h) => {
+        const assertion = `e30.${Buffer.from(JSON.stringify({ iss: 'svc@twin.iam.gserviceaccount.com', target_audience: 'https://my-service.run.app' })).toString('base64url')}.sig`;
+        const r = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion }) });
+        const jwks = body(await h({ m: 'GET', p: '/oauth2/v3/certs' }));
+        const v = verifyJwtWithJwks(String(body(r).id_token), jwks, { now: AT_SECONDS + 10 });
+        // gemini-twin.ts's §googleauth stub returned an `alg: none` token here. This one is signed
+        // and verifies, which is the whole reason the surface moved into a pack of its own.
+        return ok(r) && body(r).access_token === undefined && v.valid === true
+            && v.payload.aud === 'https://my-service.run.app'
+            && v.payload.email === 'svc@twin.iam.gserviceaccount.com'
+            // `sub` is the account's NUMERIC unique id, NOT its address — an earlier version put the
+            // e-mail in both (§9 round one). The twin derives a stable 21-digit stand-in, because it has
+            // no directory to look the real number up in.
+            && typeof v.payload.sub === 'string'
+            && /^\d{21}$/.test(String(v.payload.sub))
+            && v.payload.sub !== v.payload.email;
+    })),
+    done('googleoauth.serviceaccount.missing_assertion', 'serviceaccount', 'jwt-bearer with no assertion → 400 invalid_request; an unparseable one → invalid_grant', 'api', 'common', () => withRoot(async (h) => {
+        const none = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer' }) });
+        const junk = await h({ m: 'POST', p: '/token', b: form({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: 'not.a.jwt' }) });
+        // Captured live: a MALFORMED assertion is `invalid_request` / "Bad Request" — the string a
+        // widely-repeated assumption misattributes to `invalid_grant` on the code grant.
+        return none.status === 400 && err(none) === 'invalid_request'
+            && junk.status === 400 && err(junk) === 'invalid_request' && body(junk).error_description === 'Bad Request';
+    })),
+    // §9 round one was right: verifying an RS256 assertion needs the
+    // PUBLIC half, which a world's own service-account key file carries and the twin could register
+    // exactly as it registers OAuth clients. The honest label is "no service-account key registry
+    // yet", which is a todo.
+    todo('googleoauth.serviceaccount.assertion_signature_verified', 'serviceaccount', 'Verify the jwt-bearer assertion\'s RS256 signature against a registered service-account public key (the twin decodes but does not verify today)', 'api', 'common'),
+    todo('googleoauth.serviceaccount.domain_wide_delegation', 'serviceaccount', 'The `sub` impersonation claim (Workspace domain-wide delegation)', 'api', 'niche'),
+    // ── Errors / twin-level behaviour ────────────────────────────────────────────────────────────
+    done('googleoauth.errors.unmodeled_route_404', 'errors', 'An unmodelled path is REFUSED with a 404 error envelope — never a fake success', 'api', 'core', () => withRoot(async (h) => {
+        // Paths the twin does not serve, including two Google DOES serve and this pack files as
+        // todos (`/gsi/client`, `/o/oauth2/postmessageRelay`) — refusing those is the point: an
+        // unmodelled operation must fail, not be answered by a twin that cannot serve it.
+        const e = (r) => (body(r).error ?? {});
+        const paths = ['/o/oauth2/postmessageRelay', '/gsi/client', '/device/code', '/oauth2/v2/userinfo', '/oauth2/v2/certs', '/no/such/thing'];
+        for (const path of paths) {
+            const r = await h({ m: 'GET', p: path });
+            if (r.status !== 404 || e(r).code !== 404 || e(r).status !== 'NOT_FOUND')
+                return false;
+        }
+        // …and a path the twin DOES serve is not swept up by the same branch.
+        return (await h({ m: 'GET', p: '/oauth2/v3/certs' })).status === 200;
+    })),
+    done('googleoauth.errors.wrong_method', 'errors', 'A wrong METHOD on a modelled endpoint is 405, not a 404 or a silent success', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'DELETE', p: '/token' });
+        return r.status === 405 && (body(r).error ?? {}).status === 'FAILED_PRECONDITION';
+    })),
+    done('googleoauth.errors.malformed_request_guard', 'errors', 'A malformed request becomes the vendor 400 envelope, never an unhandled throw or a non-vendor 500', 'api', 'common', () => withRoot(async (h) => {
+        // The route-boundary guard's real job. Basic credentials are percent-DECODED (RFC 6749
+        // §2.3.1 requires it), so a broken escape sequence reaches `decodeURIComponent` and throws a
+        // URIError — which must surface as Google's own error body, not as an HTML 500.
+        const broken = Buffer.from('%E0%A4%A:secret').toString('base64');
+        const r = await h({ m: 'POST', p: '/token', h: { authorization: `Basic ${broken}` }, b: form({ grant_type: 'authorization_code', code: 'x', redirect_uri: REDIRECT }) });
+        if (r.status !== 400 || err(r) !== 'invalid_request')
+            return false;
+        // …and the CLASS is closed: a spread of hostile inputs each answers with a modelled status
+        // and a vendor-shaped body rather than escaping the handler.
+        const hostile = [
+            { m: 'POST', p: '/token', b: '%%%' },
+            { m: 'POST', p: '/token', b: 'grant_type=authorization_code&code=%E0%A4%A' },
+            { m: 'GET', p: '/o/oauth2/v2/auth?client_id=%E0%A4%A' },
+            { m: 'GET', p: `/tokeninfo?access_token=${'x'.repeat(5000)}` },
+            { m: 'POST', p: '/_twin/clients', b: 'not json at all' },
+            { m: 'POST', p: '/revoke', b: 'token=%E0%A4%A' },
+        ];
+        for (const step of hostile) {
+            const res = await h(step);
+            // A 302 to Google's own error page is a MODELLED answer, not an escape: its payload is the
+            // vendor-shaped part, and the body is deliberately empty.
+            // The predicate has to be one a DEAD handler fails. `!!body && typeof body === 'object'`
+            // was not: `return {}` satisfies it for every step (§9 round one). A modelled refusal names
+            // itself — an OAuth `error` code, a Google-API `error.status`, a 302 to the error page, or a
+            // rendered "Error <n>: <code>" line — and `{}` has none of those.
+            const b = res.body;
+            const named = res.status === 302
+                ? !!res.headers?.location && new URL(res.headers.location).pathname === ERROR_PAGE_PATH
+                : typeof b === 'string'
+                    ? /Error \d{3}: [a-z_]+/.test(text(b))
+                    // A JSON refusal must ALSO be a 4xx. Without the status check a saboteur answering one
+                    // hard-coded `{ error: … }` at 200 read as a modelled refusal for every step
+                    // (§9 round two).
+                    : res.status >= 400
+                        && (typeof b?.error === 'string'
+                            || typeof (b?.error?.status) === 'string');
+            if (res.status < 200 || res.status >= 500 || !named)
+                return false;
+        }
+        return true;
+    })),
+    done('googleoauth.twin.read_only_refuses_writes', 'errors', 'A read-only twin refuses every credential-minting leg but still serves the stateless reads', 'api', 'common', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-ro-'));
+        try {
+            const ro = (method, path, b) => handleGoogleOAuthTwinRequest({ method, path, ...(b !== undefined ? { body: b } : {}), root, occurredAt: AT, readOnly: true });
+            const auth = await ro('GET', authUrl({}));
+            const token = await ro('POST', '/token', form({ grant_type: 'refresh_token', refresh_token: 'x' }));
+            const certs = await ro('GET', '/oauth2/v3/certs');
+            const disc = await ro('GET', '/.well-known/openid-configuration');
+            return auth.status === 405 && err(auth) === 'temporarily_unavailable'
+                && token.status === 405
+                && certs.status === 200 && disc.status === 200;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    // ── The consent SCREEN (the vendor's own UI — data-coupled, per ADDING_A_TWIN.md §6) ─────────
+    done('googleoauth.ui.account_chooser', 'ui', 'Account chooser lists every seeded persona with its real name and address (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot,
+        // Seed a THIRD persona through the twin's own write path, so the screen cannot be passing on
+        // the two defaults alone.
+        seed: (h) => h({ m: 'POST', p: '/_twin/accounts', b: JSON.stringify({ sub: '100000000000000000003', email: 'katherine.johnson@nasa.example', name: 'Katherine Johnson', given_name: 'Katherine', family_name: 'Johnson' }) }),
+        fetch: async (h) => html(await h({ m: 'GET', p: authUrl({}) })),
+        assert: (markup) => markup.includes('Choose an account')
+            && markup.includes(ADA.name) && markup.includes(ADA.email)
+            && markup.includes(GRACE.name) && markup.includes(GRACE.email)
+            && markup.includes('Katherine Johnson') && markup.includes('katherine.johnson@nasa.example')
+            // each account is a real submit button carrying its own sub — the click IS the choice
+            && (markup.match(/class="account-row"/g) ?? []).length === 3
+            && markup.includes('value="100000000000000000003"'),
+    })),
+    done('googleoauth.ui.app_identity', 'ui', 'The screen names the REGISTERED app, not a hardcoded one (data-coupled to the client registry)', 'ui', 'core', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'seeded.apps.googleusercontent.com', client_secret: 'GOCSPX-seeded', name: 'Acme Scheduling', support_email: 'dev@acme.test', redirect_uris: [REDIRECT] }) }),
+        fetch: async (h) => html(await h({ m: 'GET', p: authUrl({ client_id: 'seeded.apps.googleusercontent.com' }) })),
+        assert: (markup) => markup.includes('Acme Scheduling') && markup.includes('to continue to') && !markup.includes('Twin Demo App'),
+    })),
+    done('googleoauth.ui.consent_screen', 'ui', 'The consent step names the app, the chosen account and every requested scope (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'GET', p: authUrl({}) }),
+        fetch: async (h) => {
+            const a = await h({ m: 'GET', p: authUrl({ scope: 'openid email https://www.googleapis.com/auth/calendar.readonly' }) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            return html(await h({ m: 'GET', p: `/_twin/consent?auth_request=${rid}&sub=${ADA.sub}` }));
+        },
+        assert: (markup) => markup.includes('wants access to your Google Account')
+            && markup.includes('Twin Demo App')
+            && markup.includes(ADA.email)
+            // the scope SENTENCES Google shows, from the catalog — not the raw scope strings
+            && markup.includes('See your primary Google Account email address')
+            && markup.includes('See and download any calendar you can access using your Google Calendar')
+            && markup.includes('Continue') && markup.includes('Cancel'),
+    })),
+    done('googleoauth.ui.scope_rows_render_real_component', 'ui', 'The shipped ScopeList component renders the twin\'s OWN scope rows over real state', 'ui', 'core', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/gmail.send' }) }),
+        fetch: async (h) => {
+            const a = await h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/gmail.send' }) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            // The SAME state builder the served page uses — one renderer, no lookalike.
+            return googleOAuthConsentState({ root: h.root, requestId: rid, sub: ADA.sub, origin: 'https://accounts.google.com' });
+        },
+        render: (view) => (view ? renderToStaticMarkup(createElement(ScopeList, { scopes: view.scopes })) : ''),
+        assert: (view, markup) => !!view && !!markup
+            && view.scopes.length === 3
+            && markup.includes('See, edit, create, and delete all of your Google Drive files')
+            && markup.includes('Send email on your behalf')
+            // the sensitivity tags Google shows, driven by the catalog
+            && markup.includes('restricted') && markup.includes('sensitive')
+            // openid is not declinable, so it is a hidden input; the two product scopes are checkboxes
+            && (markup.match(/type="checkbox"/g) ?? []).length === 2
+            && markup.includes('value="https://www.googleapis.com/auth/drive"'),
+    })),
+    done('googleoauth.ui.unknown_scope_shown_raw', 'ui', 'An unknown scope is shown with its RAW string and flagged — never a fabricated description', 'ui', 'common', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/not-a-real-google-scope' }) }),
+        fetch: async (h) => {
+            const a = await h({ m: 'GET', p: authUrl({ scope: 'openid https://www.googleapis.com/auth/not-a-real-google-scope' }) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            return googleOAuthConsentState({ root: h.root, requestId: rid, sub: ADA.sub, origin: 'https://accounts.google.com' });
+        },
+        render: (view) => (view ? renderToStaticMarkup(createElement(ScopeList, { scopes: view.scopes })) : ''),
+        assert: (view, markup) => {
+            const unknown = view?.scopes.find((s) => s.scope.endsWith('not-a-real-google-scope'));
+            return !!unknown && unknown.known === false && unknown.label === unknown.scope
+                && !!markup && markup.includes('not in the twin')
+                && markup.includes('https://www.googleapis.com/auth/not-a-real-google-scope');
+        },
+    })),
+    done('googleoauth.ui.unverified_notice', 'ui', 'The "Google hasn\'t verified this app" notice tracks the client\'s real verified flag', 'ui', 'common', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'POST', p: '/_twin/clients', b: JSON.stringify({ client_id: 'verified.apps.googleusercontent.com', client_secret: 'GOCSPX-v', name: 'Verified App', verified: true, redirect_uris: [REDIRECT] }) }),
+        fetch: async (h) => {
+            const unverifiedFlow = await h({ m: 'GET', p: authUrl({ login_hint: ADA.email }) });
+            const verifiedFlow = await h({ m: 'GET', p: authUrl({ client_id: 'verified.apps.googleusercontent.com', login_hint: ADA.email }) });
+            return { unverified: html(unverifiedFlow), verified: html(verifiedFlow) };
+        },
+        assert: (pages) => pages.unverified.includes('Google hasn') && pages.unverified.includes('verified this app')
+            && !pages.verified.includes('verified this app')
+            && pages.verified.includes('Verified App'),
+    })),
+    done('googleoauth.ui.chooser_renders_real_component', 'ui', 'The shipped AccountChooser component renders the twin\'s OWN accounts (server-render parity)', 'ui', 'common', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'POST', p: '/_twin/accounts', b: JSON.stringify({ sub: '100000000000000000009', email: 'margaret.hamilton@mit.example', name: 'Margaret Hamilton', given_name: 'Margaret' }) }),
+        fetch: async (h) => {
+            const a = await h({ m: 'GET', p: authUrl({}) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            return googleOAuthConsentState({ root: h.root, requestId: rid, origin: 'https://accounts.google.com' });
+        },
+        render: (view) => (view ? renderToStaticMarkup(createElement(AccountChooser, { view })) : ''),
+        assert: (view, markup) => !!view && view.step === 'choose' && view.accounts.length === 3
+            && !!markup && markup.includes('margaret.hamilton@mit.example') && markup.includes('Margaret Hamilton')
+            && markup.includes('value="100000000000000000009"')
+            && markup.includes(`action="https://accounts.google.com/_twin/consent"`),
+    })),
+    done('googleoauth.ui.consent_renders_real_component', 'ui', 'The shipped ConsentScreen component renders the chosen account + form over real state', 'ui', 'common', uiDataCoupled({
+        withRoot,
+        seed: (h) => h({ m: 'GET', p: authUrl({ scope: 'openid email' }) }),
+        fetch: async (h) => {
+            const a = await h({ m: 'GET', p: authUrl({ scope: 'openid email' }) });
+            const rid = AUTH_REQUEST_RE.exec(html(a))?.[1] ?? '';
+            return googleOAuthConsentState({ root: h.root, requestId: rid, sub: GRACE.sub, origin: 'https://accounts.google.com' });
+        },
+        render: (view) => (view ? renderToStaticMarkup(createElement(ConsentScreen, { view })) : ''),
+        assert: (view, markup) => !!view && view.step === 'consent' && view.account?.sub === GRACE.sub
+            && !!markup && markup.includes(GRACE.email) && markup.includes('Twin Demo App')
+            && markup.includes('value="deny"') && markup.includes('value="allow"')
+            && markup.includes(`value="${view.requestId}"`),
+    })),
+    done('googleoauth.ui.error_page', 'ui', 'The error page renders Google\'s headline, wording and "Error <status>: <code>" line over the real failure', 'ui', 'common', () => withRoot(async (h) => {
+        // SERVED path: the real 302 → /signin/oauth/error → the rendered page, driven end to end, with
+        // the app name resolved from the client registry rather than hardcoded.
+        const served = text((await errorPageFor(h, authUrl({ redirect_uri: 'https://evil.test/x' }))).markup);
+        // COMPONENT path: the SAME exported component, rendered directly — one renderer, no lookalike.
+        const direct = text(errorPageHtml({ status: 401, code: 'invalid_client', summary: 'Access blocked: Authorization Error', detail: 'The OAuth client was not found.', appName: 'Twin Demo App' }));
+        const bare = text(renderToStaticMarkup(createElement(ErrorPage, { status: 400, code: 'redirect_uri_mismatch', summary: 'S', detail: 'D' })));
+        return served.includes('Error 400')
+            && served.includes('redirect_uri_mismatch')
+            && served.includes('redirect_uri=https://evil.test/x')
+            && served.includes("Access blocked: This app's request is invalid")
+            && served.includes('flowName=GeneralOAuthFlow')
+            && served.includes('If you are a developer of Twin Demo App, see error details.')
+            && direct.includes('Error 401') && direct.includes('The OAuth client was not found.')
+            && bare.includes('Error 400') && bare.includes('redirect_uri_mismatch')
+            // the generic fallback wording when the failing request named no known client
+            && bare.includes('If you are a developer of this app, see error details.');
+    })),
+    done('googleoauth.ui.client_transpiles', 'ui', 'The consent client bundles for the browser and ships its granular-consent enhancement', 'ui', 'niche', async () => {
+        // The sanctioned STRUCTURAL fallback (the aws.s3.ui.transpiles precedent): bundling has no
+        // seedable state, so this asserts the REAL bundle — the COMMITTED one the twin serves
+        // (googleoauth-consent-client.gen.ts; consent-clients.test.ts proves it is a fresh build of
+        // the TSX) — rather than faking data-coupling. Static literals only — a template-literal
+        // class name would be erased by the minifier.
+        const js = CONSENT_CLIENT_JS;
+        return js.length > 10_000 && js.includes('Select all') && js.includes('granular-consent-controls') && js.includes('scope-check');
+    }),
+    todo('googleoauth.ui.two_step_account_add', 'ui', 'The "Use another account" sign-in step of Google\'s real chooser', 'ui', 'niche'),
+    todo('googleoauth.ui.branding', 'ui', 'The developer\'s configured app logo, homepage and privacy-policy links on the screen', 'ui', 'common'),
+    // ── Sign-in itself: genuinely impossible for a local twin ────────────────────────────────────
+    // ── Connector ────────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.connector.pull_identity', 'connector', 'Pull the operator\'s real identity + client from tokeninfo/userinfo into the projection', 'connector', 'core', () => withRoot(async (h) => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-pull-'));
+        try {
+            const result = await syncGoogleOAuthFromReal(fakeExecute, { root, occurredAt: AT });
+            if (result.observed !== 3 || result.deltasAppended < 1)
+                return false;
+            // The pulled persona is REACHABLE THROUGH THE PROTOCOL — a pull that only writes rows a
+            // consumer can never see has not pulled anything useful.
+            const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+            return String(page.body).includes('real.person@example.com') && String(page.body).includes('Real Person');
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.pull_idempotent', 'connector', 'A re-pull of identical state appends NOTHING (shadow-diff dedupe)', 'connector', 'core', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-pull2-'));
+        try {
+            // NO pinned `occurredAt`: the connector's own MOVING pollTimestamp() is used, so a zero
+            // delta can only come from the shadow diff. Pinning both pulls to one millisecond let the
+            // kernel's content+timestamp dedupe produce the same answer for a different reason, which
+            // is a confound rather than a proof (§9 round one).
+            const first = await syncGoogleOAuthFromReal(fakeExecute, { root });
+            const second = await syncGoogleOAuthFromReal(fakeExecute, { root });
+            return first.deltasAppended > 0 && second.observed === 3 && second.deltasAppended === 0;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.reverting_value_still_lands', 'connector', 'A vendor value that REVERTS across polls still lands (moving poll timestamp, not a pinned one)', 'connector', 'common', () => withRoot(async () => {
+        // The phantom-delta hazard: with a PINNED occurredAt the kernel hashes an observed event over
+        // (occurredAt + post-state), so an A→B→A sequence collides with its own first observation and
+        // syncPull reports a delta while the projection keeps the stale value.
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-revert-'));
+        try {
+            let name = 'Real Person';
+            const varying = async (_m, path) => {
+                if (path.startsWith('/tokeninfo'))
+                    return { ...FAKE_TOKENINFO };
+                if (path === '/v1/userinfo')
+                    return { ...FAKE_USERINFO, name };
+                return {};
+            };
+            await pullGoogleOAuthIdentity(varying, root);
+            name = 'Renamed Person';
+            await pullGoogleOAuthIdentity(varying, root);
+            name = 'Real Person'; // …back to the ORIGINAL value
+            await pullGoogleOAuthIdentity(varying, root);
+            const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+            // The projection must show the value the LAST poll observed, not the middle one.
+            return String(page.body).includes('Real Person') && !String(page.body).includes('Renamed Person');
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.refused_pull_throws', 'connector', 'A REFUSED pull throws — it is never mapped to an empty account folded over real state', 'connector', 'core', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-refuse-'));
+        try {
+            // First a good pull, so there IS real observed state to protect.
+            await syncGoogleOAuthFromReal(fakeExecute, { root, occurredAt: AT });
+            // Google answers a bad token on tokeninfo with an error envelope under HTTP 200 — a status
+            // check alone cannot tell refusal from genuine emptiness.
+            const counting = countingFetch(() => jsonResponse({ error: 'invalid_token', error_description: 'Invalid Value' }));
+            const execute = liveGoogleOAuthExecute('ya29.stale', { fetchImpl: counting.impl, budgetOptions: { path: join(root, 'ledger.json') } });
+            let threw = false;
+            try {
+                await syncGoogleOAuthFromReal(execute, { root });
+            }
+            catch {
+                threw = true;
+            }
+            // …and the previously observed persona is still there.
+            const page = await handleGoogleOAuthTwinRequest({ method: 'GET', path: authUrl({}), root, origin: DEMO_ORIGIN, occurredAt: AT });
+            return threw && counting.calls() === 1 && String(page.body).includes('real.person@example.com');
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.unmapped_host_refused', 'connector', 'The live executor REFUSES a path it has no Google host for (no accidental raw call)', 'connector', 'common', () => withRoot(async () => {
+        const root = mkdtempSync(join(tmpdir(), 'googleoauth-unmapped-'));
+        try {
+            const counting = countingFetch(() => jsonResponse({}));
+            const execute = liveGoogleOAuthExecute('ya29.x', { fetchImpl: counting.impl, budgetOptions: { path: join(root, 'ledger.json') } });
+            let threw = false;
+            try {
+                await execute('GET', '/some/unmapped/path');
+            }
+            catch {
+                threw = true;
+            }
+            // The count is the proof: nothing reached the network.
+            return threw && counting.calls() === 0;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.pull_invents_nothing', 'connector', 'A pulled client records what tokeninfo did NOT disclose — no fabricated secret, name or verification status', 'connector', 'common', () => withRoot(async () => {
+        const mapped = mapTokenInfoClient(FAKE_TOKENINFO);
+        const name = String(mapped.fields.name);
+        return mapped.type === 'oauth_client'
+            && mapped.id === FAKE_TOKENINFO.azp
+            && mapped.fields.secret === null
+            && mapped.fields.clientType === 'installed'
+            && Array.isArray(mapped.fields.redirectUris) && mapped.fields.redirectUris.length === 0
+            // The name must SAY it is a pulled placeholder, not masquerade as the app's real name. An
+            // earlier version used `clientId.split('-')[0]`, putting the bare numeric project prefix on
+            // the consent screen as if it were a name (§9 round one).
+            && name.startsWith('Pulled client ') && name !== FAKE_TOKENINFO.azp.split('-')[0]
+            // …and the verified flag, which drives the unverified-app interstitial, must record
+            // "unknown" rather than claiming a verification tokeninfo never disclosed.
+            && mapped.fields.verified === null;
+    })),
+    done('googleoauth.connector.rate_budget_fail_closed', 'connector', 'The client-side budget REFUSES past the ceiling with the fake\'s call count unchanged', 'connector', 'core', () => withRoot(async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget-'));
+        try {
+            const counting = countingFetch(() => jsonResponse({ sub: 'x', email: 'a@b.test' }));
+            const execute = liveGoogleOAuthExecute('ya29.budget', { fetchImpl: counting.impl, budgetOptions: { path: join(dir, 'ledger.json') } });
+            // ceiling 60 / weight 2 = 30 calls, then the 31st must THROW without calling.
+            const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.other;
+            for (let i = 0; i < allowed; i++)
+                await execute('GET', '/v1/userinfo');
+            if (counting.calls() !== allowed)
+                return false;
+            let refused = false;
+            try {
+                await execute('GET', '/v1/userinfo');
+            }
+            catch (e) {
+                refused = e instanceof GoogleOAuthBudgetError;
+            }
+            // "It threw" is not proof — the UNCHANGED count is what shows nothing reached the vendor.
+            return refused && counting.calls() === allowed;
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.rate_budget_persists', 'connector', 'The ledger is durable: a BRAND-NEW client gets no fresh allowance', 'connector', 'core', () => withRoot(async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget2-'));
+        const path = join(dir, 'ledger.json');
+        try {
+            const first = countingFetch(() => jsonResponse({}));
+            const a = liveGoogleOAuthExecute('ya29.same', { fetchImpl: first.impl, budgetOptions: { path } });
+            const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.other;
+            for (let i = 0; i < allowed; i++)
+                await a('GET', '/v1/userinfo');
+            const second = countingFetch(() => jsonResponse({}));
+            const b = liveGoogleOAuthExecute('ya29.same', { fetchImpl: second.impl, budgetOptions: { path } });
+            let refused = false;
+            try {
+                await b('GET', '/v1/userinfo');
+            }
+            catch (e) {
+                refused = e instanceof GoogleOAuthBudgetError;
+            }
+            return first.calls() === allowed && refused && second.calls() === 0;
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.rate_budget_revoke_weight', 'connector', 'POST /revoke is priced at 10, so it exhausts the ceiling proportionally sooner', 'connector', 'common', () => withRoot(async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget3-'));
+        try {
+            const counting = countingFetch(() => jsonResponse({}));
+            const execute = liveGoogleOAuthExecute('ya29.weights', { fetchImpl: counting.impl, budgetOptions: { path: join(dir, 'ledger.json') } });
+            const allowed = GOOGLEOAUTH_BUDGET_CEILING / GOOGLEOAUTH_CALL_WEIGHTS.revoke; // 6, not 30
+            for (let i = 0; i < allowed; i++)
+                await execute('POST', '/revoke');
+            let refused = false;
+            try {
+                await execute('POST', '/revoke');
+            }
+            catch (e) {
+                refused = e instanceof GoogleOAuthBudgetError;
+            }
+            return counting.calls() === allowed && allowed === 6 && refused;
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    })),
+    done('googleoauth.connector.budget_unbypassable', 'connector', 'The live executor REFUSES to construct around a duck-typed, subclassed or proxied budget', 'connector', 'common', () => withRoot(async () => {
+        const dir = mkdtempSync(join(tmpdir(), 'googleoauth-budget4-'));
+        try {
+            const path = join(dir, 'ledger.json');
+            const refuses = (budget) => {
+                try {
+                    liveGoogleOAuthExecute('ya29.x', { budget: budget, budgetOptions: { path } });
+                    return false;
+                }
+                catch {
+                    return true;
+                }
+            };
+            const duck = { checkBudget: () => ({}), recordCall: () => { } };
+            class Sneaky extends GoogleOAuthBudget {
+                checkBudget() {
+                    throw new Error('never called');
+                }
+            }
+            const proxied = new Proxy(new GoogleOAuthBudget({ path }), { get: (t, k) => (k === 'checkBudget' ? () => ({}) : Reflect.get(t, k)) });
+            // …and a REAL, unmodified budget is still accepted, so this is not "everything is refused".
+            let acceptsReal = false;
+            try {
+                liveGoogleOAuthExecute('ya29.x', { budget: new GoogleOAuthBudget({ path }), budgetOptions: { path } });
+                acceptsReal = true;
+            }
+            catch {
+                acceptsReal = false;
+            }
+            return refuses(duck) && refuses(new Sneaky({ path })) && refuses(proxied) && acceptsReal;
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    })),
+    todo('googleoauth.connector.push', 'connector', 'Push local grants/clients to real Google — impossible today: there is no OAuth write API (clients are Cloud-Console objects, grants are myaccount.google.com)', 'connector', 'niche'),
+    todo('googleoauth.connector.pull_granted_scopes_per_app', 'connector', 'Pull the full list of apps a user has authorised (myaccount.google.com/permissions has no API)', 'connector', 'niche'),
+    // ── Google Identity Services (the MODERN "Sign in with Google" web surface) ──────────────────
+    // Enumerated top-down from developers.google.com/identity/gsi/web, NOT from what the twin built.
+    // This is a whole second product on accounts.google.com that this pack does not model at all: the
+    // classic authorization-code flow above is the protocol, GIS is the drop-in library most new
+    // integrations actually adopt. Filing it as todos is what keeps the denominator honest — a pack
+    // that enumerated only the protocol it implemented would read as near-complete while missing the
+    // half of the surface a greenfield app is most likely to use.
+    todo('googleoauth.gsi.client_library', 'gsi', 'GET /gsi/client — the Sign in with Google JavaScript library itself', 'api', 'core'),
+    todo('googleoauth.gsi.one_tap_prompt', 'gsi', 'One Tap: google.accounts.id.prompt() and its /gsi/iframe/select surface', 'api', 'core'),
+    todo('googleoauth.gsi.credential_response', 'gsi', 'The One Tap `credential` callback (a JWT id_token posted to the page)', 'api', 'core'),
+    todo('googleoauth.gsi.render_button', 'gsi', 'google.accounts.id.renderButton — the rendered Sign in with Google button', 'ui', 'core'),
+    todo('googleoauth.gsi.g_id_onload', 'gsi', 'The declarative `g_id_onload` / `g_id_signin` HTML element API', 'ui', 'common'),
+    todo('googleoauth.gsi.login_uri_post', 'gsi', 'data-login_uri: the credential POSTed form-encoded to the app\'s own endpoint with a g_csrf_token cookie', 'api', 'common'),
+    todo('googleoauth.gsi.token_client', 'gsi', 'google.accounts.oauth2.initTokenClient — the implicit token flow for browser apps', 'api', 'common'),
+    todo('googleoauth.gsi.code_client', 'gsi', 'google.accounts.oauth2.initCodeClient — the popup/redirect auth-code flow', 'api', 'common'),
+    todo('googleoauth.gsi.postmessage_relay', 'gsi', 'GET /o/oauth2/postmessageRelay — the popup-mode postMessage bridge', 'api', 'niche'),
+    todo('googleoauth.gsi.revoke_js', 'gsi', 'google.accounts.id.revoke / oauth2.revoke and their /gsi endpoints', 'api', 'niche'),
+    todo('googleoauth.gsi.intermediate_iframe', 'gsi', 'The intermediate-iframe support file for automatic One Tap cancellation', 'api', 'niche'),
+    todo('googleoauth.gsi.fedcm', 'gsi', 'FedCM migration: the browser-mediated identity API GIS is moving One Tap onto', 'api', 'common'),
+    // ── Cross-Account Protection (RISC) ──────────────────────────────────────────────────────────
+    todo('googleoauth.risc.register_endpoint', 'risc', 'POST risc.googleapis.com/v1beta/stream:update — register a receiver for security-event tokens (a HOST this pack does not claim in VENDOR_HOSTS, so adopting it means claiming it too)', 'api', 'niche'),
+    todo('googleoauth.risc.security_event_tokens', 'risc', 'Deliver RISC SETs (sessions-revoked, account-disabled, tokens-revoked) to the app', 'connector', 'niche'),
+    todo('googleoauth.risc.verify_jwt', 'risc', 'The RISC SET is a JWT signed by Google\'s RISC key set (a different JWKS)', 'api', 'niche'),
+    // ── The device / limited-input flow ──────────────────────────────────────────────────────────
+    todo('googleoauth.device.code_request', 'device', 'POST /device/code — mint a device_code + user_code + verification_url', 'api', 'common'),
+    todo('googleoauth.device.user_verification_screen', 'device', 'The accounts.google.com/device screen where a human types the user_code', 'ui', 'common'),
+    todo('googleoauth.device.polling_errors', 'device', 'authorization_pending / slow_down / expired_token while the app polls', 'api', 'common'),
+    // ── Remaining protocol surface ───────────────────────────────────────────────────────────────
+    todo('googleoauth.endpoints.legacy_revoke_path', 'errors', 'GET /o/oauth2/revoke — the legacy accounts.google.com revocation path', 'api', 'niche'),
+    todo('googleoauth.endpoints.userinfo_v2', 'userinfo', 'GET /oauth2/v2/userinfo — the oldest userinfo alias (a different field set)', 'api', 'niche'),
+    todo('googleoauth.authorize.approval_prompt_legacy', 'authorize', 'approval_prompt=force — the pre-`prompt` legacy parameter still in the wild', 'api', 'niche'),
+    todo('googleoauth.authorize.include_granted_scopes_incremental_ui', 'authorize', 'The consent screen shows only the NEW scopes during incremental authorization', 'ui', 'common'),
+    todo('googleoauth.accounts.multi_login_authuser', 'authorize', 'The `authuser` index and multi-login sessions (several accounts signed in at once)', 'api', 'common'),
+    todo('googleoauth.token.client_assertion_auth', 'token', 'private_key_jwt client authentication (client_assertion / client_assertion_type)', 'api', 'niche'),
+    // ── Conformance ──────────────────────────────────────────────────────────────────────────────
+    done('googleoauth.conformance.endpoint_probe', 'conformance', 'Every claimed endpoint answers a real probe with the OUTCOME a live handler produces', 'api', 'core', async () => {
+        const report = await checkGoogleOAuthConformance();
+        return report.ok && report.endpointsProbed === report.endpointsChecked && report.endpointsChecked >= 12 && report.violations.length === 0;
+    }),
+];
+export async function googleoauthCapabilities() {
+    return checkCapabilities('googleoauth', GOOGLEOAUTH_CAPABILITIES);
+}