fix(auth): bind mailbox callbacks to pending popup

docs/redesign/phase-7/p7-08/OPERATIONS.md

@@ -85,3 +85,8 @@ Operations implemented scope is **CONDITIONAL GO**, pending final staged hygiene
 All 57 groups remain **56 PARTIAL / C11 DEFERRED**, with 33 current route patterns. F20 and existing reliability debt, human screen-reader, real zoom, physical touch/software keyboard, production font/photo/print, actual MariaDB/provider execution and PDF-corpus qualifications remain open. P5-13 is withheld with zero qualification calls; followMode is deferred. Production is **NO-GO**, main is unchanged and Phase 8 implementation has not started. Settings follows this boundary in the approved sequence.
 
 Final staged hygiene passes **2026-10-17T02:03:25.900686UTC**: four secret/whitespace gates, 23 documents/568 local links, 57 groups and 33 routes. All 25 staged canonical-LF hashes match final as-run sources. Operations commit and normal development push follow; no production action.
+
+
+### P7-08 publication and P7-09 entry
+
+Operations **c5176e3251c869e13284b994b59b2f7aa9220eb1** is normally pushed and directly verified **2026-10-17T02:03:53.815275UTC**: clean HEAD=origin=live development, local/origin/live main27657f3 unchanged. Both P7-08 UI boundaries remain implemented **CONDITIONAL GO and published**; manual/provider/output/release conditions remain. Earlier pending-publication text is superseded by this exact receipt in Operations results. P7-09 follows its approved two boundaries; a separately bounded OAuth sender repair first protects its two existing callback consumers. Fresh entry23/3 frontend and40 unchanged-binary backend cases pass;791/95,323,1054 remain derived inventories, not full-suite passes. No production or Phase8 action.

docs/redesign/phase-7/p7-08/README.md

@@ -100,3 +100,8 @@ Fresh **2026-10-17 UTC** evidence in the [portable Operations results](evidence/
 All **14 final Operations PNGs are actually reviewed** by root/peer, plus root's final P2-D01 image: **15 of 31 final images reviewed**. The 16 notification-consumer images are retained without a fresh review claim. Operations axe records **12 scans, 0 violations / 3 incomplete occurrences** (two short badge-text and one overlapping-background language-button contrast context); notification consumers independently record **14 scans, 0 / 102**, all retained and qualified. These finite checks establish no human screen-reader, physical-device, precise incomplete-contrast or production acceptance. The preliminary [static-check receipt](evidence/operations-static-checks.json) passes at **02:02:20.371383 UTC**: 23 documents, 566 local links, 57 groups, 33 routes and four secret/whitespace commands exiting 0. Final staged hygiene/canonical comparison, commit and verified normal push remain pending.
 
 The 21 Operations cases add **18** over its three-case baseline without a new suite, deriving frontend **791/95** from 773/95. Five new browser cases derive **323** from 318; backend remains **1,054**. These are inventories, not fresh integrated counts or proof of publication; full frontend **573/89**, backend **1,033** and sidecar **49** remain inherited until P7-12. All 57 preservation statuses and 33 routes remain unchanged. **Both P7-08 presentation boundaries: implemented CONDITIONAL GO, with Operations staged hygiene/commit/publication pending.** Settings remains the next approved checkpoint, and Phase 8 remains separate.
+
+
+### P7-08 publication and P7-09 entry
+
+Operations **c5176e3251c869e13284b994b59b2f7aa9220eb1** is normally pushed and directly verified **2026-10-17T02:03:53.815275UTC**: clean HEAD=origin=live development, local/origin/live main27657f3 unchanged. Both P7-08 UI boundaries remain implemented **CONDITIONAL GO and published**; manual/provider/output/release conditions remain. Earlier pending-publication text is superseded by this exact receipt in Operations results. P7-09 follows its approved two boundaries; a separately bounded OAuth sender repair first protects its two existing callback consumers. Fresh entry23/3 frontend and40 unchanged-binary backend cases pass;791/95,323,1054 remain derived inventories, not full-suite passes. No production or Phase8 action.

docs/redesign/phase-7/p7-08/evidence/operations-results.json

@@ -4,8 +4,8 @@
   "slice": "Operations page",
   "recordedUtc": "2026-10-17T02:00:33.397472+00:00",
   "decisions": {
-    "implementedScope": "CONDITIONAL GO; final runtime/visual/peer/staged hygiene PASS; normal push pending",
-    "wholeCheckpoint": "Both presentation boundaries implemented CONDITIONAL GO; final Operations normal push pending",
+    "implementedScope": "CONDITIONAL GO; final runtime/visual/peer/staged hygiene PASS, normally pushed and directly verified",
+    "wholeCheckpoint": "Both presentation boundaries implemented CONDITIONAL GO and published; manual/release qualifications remain",
     "production": "NO-GO",
     "phase8": "NOT STARTED"
   },
@@ -4562,7 +4562,6 @@
     "qualification": "Existing routes,50-item limits,15s polling,serverCanCancel/CanRetry,existing identities and owners preserved. No schema/API/handler/producer/provider/model/renderer changes."
   },
   "remaining": [
-    "Final staged hygiene and normal development push/direct verification",
     "P7-09 throughP7-12",
     "Human/device/output/provider qualifications and existing reliability debt",
     "F20,RD11,RD12,RD13,RD21 and historical scaling/unsaved-state debt remain",
@@ -4576,5 +4575,34 @@
     "sha256": "e02d443b53a7b03e77596482db8d5ea15a942cf9e0bddb118c26826786f2fc9c",
     "inputs": 25,
     "canonicalLfMatch": true
+  },
+  "pushReceipt": {
+    "command": [
+      "rtk",
+      "proxy",
+      "git",
+      "push",
+      "origin",
+      "HEAD:refs/heads/codex/ui-redesign-phase4"
+    ],
+    "startedUtc": "2026-10-17T02:03:51.750936+00:00",
+    "finishedUtc": "2026-10-17T02:03:53.590804+00:00",
+    "exitCode": 0,
+    "head": "c5176e3251c869e13284b994b59b2f7aa9220eb1",
+    "log": ".artifacts/phase7/p7-08/operations-push-receipt.log",
+    "logSha256": "a8093fb40b1c0f99606eb05af96104e9ff31abc16b35b7d45e7c020e583c8687",
+    "observedUtc": "2026-10-17T02:03:53.815275+00:00",
+    "originDevelopment": "c5176e3251c869e13284b994b59b2f7aa9220eb1",
+    "liveDevelopment": "c5176e3251c869e13284b994b59b2f7aa9220eb1",
+    "main": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "originMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "liveMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+    "pendingPaths": [],
+    "workingTreeClean": true,
+    "raw": {
+      "path": ".artifacts/phase7/p7-08/operations-push-receipt.json",
+      "bytes": 861,
+      "sha256": "83ba5d7a669cb47a4b3f71534dc3bbe4db1ea68269db0f911cb0756512b4380c"
+    }
   }
 }