[daliu]

Outcome

Password-reset requests now have one neutral public result after every provider outcome. The page never promises that an account or message exists. An immediate guard blocks rapid duplicate calls, both outcomes use the same 60-second browser wait, and one later retry recovers after ordinary, suspended-tab, and clock-shift cases.

Closes #155

Safety boundary

• Provider success and failure produce byte-equivalent result DOM, copy, ARIA, countdown, and button state.
• Caught Firebase errors, addresses, UIDs, action links, query/fragment values, and codes never enter UI or logs.
• Empty local input makes no request and returns focus to Email.
• Pending results are discarded after unmount; completed intervals are cleaned up.
• Sign-in, registration, password/email inputs, and the intended return route are preserved.
• This is a browser usability guard, not server abuse control.
• Identical UI does not prove Firebase direct-API email-enumeration protection; private provider readback remains AUTH-MAIL-001 — Brand and authenticate Firebase Authentication email #119.
• No Identity runtime, Firebase configuration, Functions, Rules, workflow, package, or provider setting changed.

Review and verification

Exact source commit: e218b4ebdf7381a2331ff6441164927973a0eacc

Exact staged diff SHA-256 reviewed by three independent reviewers: 2a1acc2e9ee0e6c476558697d74853829047c1653ccb238e35d6620cfdb15972

Node 20 local evidence:

• LoginForm focused: 28/28
• Full frontend: 9 suites, 130/130
• SPA callback safety: 10/10
• Strict ESLint on changed LoginForm source/test: passed
• Optimized diagnostic build: passed
• Diff check and 19 relative links: passed
• Credential/private-key/private-document pattern scan: no findings

Two pre-existing React Router future warnings and the existing stale Browserslist-data notice remain unchanged.

Officer impact

Members receive one private, plain-language result, wait one visible minute, and can try once more. Officers do not ask which address was entered and never request passwords, codes, links, screenshots, or mailbox access.

Officer documentation

• docs/officers/EMERGENCY_AND_RECOVERY.md
• docs/officers/EVENTS_SHOP_MEMBERS.md
• Exact source/live status in SECURITY.md, OPERATIONS_RUNBOOK.md, GITHUB_ISSUES.md, and GITHUB_ISSUE_SLICES.md

The procedure is marked NOT AVAILABLE YET and includes purpose, approver, prerequisites, a Mermaid flow plus text alternative, steps, expected result, stop conditions, proof, undo, and escalation.

Deployment evidence

None from this pull request. This branch was not published and made no Firebase/provider call. Earlier protected release run 29252492614 for current main validated exact main/CI, then stopped before build because the approved public App Check key was absent; Firebase and Pages were skipped. Website publication, runmprc.com, Firebase/provider configuration, enumeration protection, mailbox delivery, Spam placement, and production behavior remain unverified.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e218b4e
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54e8a16cda260008904e43
😎 Deploy Preview	https://deploy-preview-156--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

MERGE GATE — exact head e218b4ebdf7381a2331ff6441164927973a0eacc

• Hosted CI run 29254075796 passed Frontend lint/build (including 9 suites / 130 Jest tests and SPA 10/10), Cloud Functions lint/tests, and Firestore Rules emulator tests.
• Netlify deploy preview 6a54e8a16cda260008904e43 completed successfully.
• Three independent exact-diff reviews approved; final reviewed diff hash: 2a1acc2e9ee0e6c476558697d74853829047c1653ccb238e35d6620cfdb15972.
• main remains 23bca8c8bfb3cba8eb4683136fd35da41330da71; GitHub reports MERGEABLE.
• This proves source/tests/review only. It does not prove a production website, Firebase, email-provider, or live password-reset outcome.

Proceeding with the user-authorized admin squash merge. Protected publication will remain fail-closed if required App Check configuration is absent.