OAUTH-001B2 — Redact ambiguous Strava disconnect browser failures

[daliu]

Parent: #88
Predecessors: #235 and #250 are complete and released.

Outcome

When the signed-in Account page cannot confirm a requested Strava disconnect, show one fixed, plain refresh-before-retry message. Never inspect, render, or log the rejected provider, callable, SDK, or exception value.

This is immediate browser leak containment only. It does not claim that revocation is retry-safe, that Strava accepted a revoke, that local records were deleted, or that any source change is live.

Invariant

A rejected disconnect result is ambiguous. The browser must preserve the current connected athlete and activity view, end the busy state, and ask the member to refresh so the authoritative connection record is read again. It must not blindly claim success or encourage an immediate repeat.

Fixed public message:

We could not confirm the Strava disconnect. Please refresh this page before trying again.

Exact scope

1. src/pages/account/StravaSection.tsx
   • only the handleDisconnect rejection hunk
   • argument-free catch and fixed message
   • preserve confirmation, one callable request, rejection state, busy cleanup, and success transition
2. src/pages/account/Account.test.tsx
   • additive stravaDisconnect mock/import and one focused actual-component disconnect describe
3. docs/officers/EVENTS_SHOP_MEMBERS.md
   • separately named Strava disconnect failure privacy — SOURCE ONLY, NOT LIVE section only

Everything else is excluded, including service/Functions/Rules/root docs/lint/workflows/packages/provider/deploy/data and all #249/#246 commerce paths.

Acceptance

• Old source test exposes a synthetic private canary, then passes after the correction.
• Rejection shows exactly the fixed atomic alert and no rejected detail reaches DOM or five console methods.
• A hostile throwing message getter is never accessed.
• Connected athlete/activity remain visible and Disconnect becomes enabled after rejection.
• Cancel makes no callable request and shows no alert.
• Synthetic success still calls once, switches to the disconnected view, clears activity, and shows no alert.
• Focused and full frontend checks, typecheck, lint safety, SPA/workflow/release/artifact checks, build, diff review, and independent security/accessibility/officer review pass.
• Officer impact, officer documentation, and exact deployment truth are recorded.

Safety and deployment truth

Tests use only made-up values and mocks. Do not contact Firebase or Strava, inspect a real account, change provider configuration, or use production data. Source, tests, merge, and green CI do not prove the website, Firebase, provider, or live behavior changed.

[daliu]

CLAIMED — 2026-07-14T07:50:33Z

Agent: /root
Branch: codex/issue-252-strava-disconnect-ui-redaction
Exact base: 15f995821cdbe2b65275af179323b25954844184

Exact ownership:

1. src/pages/account/StravaSection.tsx — only the handleDisconnect rejection hunk
2. src/pages/account/Account.test.tsx — additive stravaDisconnect mock/import and one focused actual-component disconnect describe
3. docs/officers/EVENTS_SHOP_MEMBERS.md — separately named Strava disconnect failure privacy — SOURCE ONLY, NOT LIVE section

The live audit found only open commerce PR #249/#246, whose nine paths are disjoint. #235 and #250 are closed/released; no duplicate browser-disconnect issue or branch exists. All service/Functions/Rules/root-doc/lint/workflow/package/provider/deploy/data paths, #250 stats hunks, callback hunks, and every #249/#246 path are excluded and immutable. No file edit began before this marker.

[daliu]

SCOPE AMENDED / CLAIM MARKER — 2026-07-14T07:55Z

Independent review found that a later stats rejection can overwrite the more important ambiguous-disconnect refresh warning because both paths currently share one error state. Before editing that area, #252 ownership expands within the already claimed src/pages/account/StravaSection.tsx only to:

• one dedicated disconnect-error state declaration
• only the Connected error-prop precedence expression
• the already claimed handleDisconnect rejection hunk

The #250 stats request/catch hunk remains byte-for-byte immutable. Account.test.tsx ownership expands only within the already named focused disconnect describe to add deferred-stats precedence, pending disabled-state, repeat-activation, and exact-text proof. The separately named #252 officer section may add the corresponding precedence sentence.

All other paths/hunks and every #249/#246 commerce path remain excluded. No scope-amended file edit began before this marker.

[daliu]

PR #253 is published from exact reviewed head 45c4d6b3ff9181f44eca3656d85736d75c3c680c, base 15f995821cdbe2b65275af179323b25954844184. Final three-path diff SHA-256 is 9ad38d66778169e150264eebce0a9934912b2f3e8c58b987bbeb2662a277f035. Local proof: red 33 pass / 2 intended failures; green 36/36 focused, 259 full frontend, typecheck, unchanged lint 106/123/7, SPA 11/11, workflow/release/readback/artifact 42/42, build, diff check; three independent final PASS reviews after the async-precedence correction. Hosted exact-head CI is running as 29316409429. No merge, release, website/Firebase/Strava/provider/data action, or live proof yet.