auth login declares success on valid cookies and cannot clear Google's pending identity re-check (/about) #902

Summary

gflow auth login --browser chrome reports the session verified and closes Chrome within about half a second whenever the profile's cookies are valid. When Google has put the account into a pending identity re-verification ("Confirm it's you — sign in again to continue"), the cookies stay valid, so login succeeds without ever showing that page. The account stays broken: Flow sends it to flow.google.com/about and every command fails with exit 31.

So the one remediation our messages offer for an auth problem cannot fix this auth problem.

Observed (denon82, v0.78.0, 2026-09-23)

1. Flow sends every visit to /about. The page's CTA goes to accounts.google.com/v3/signin/confirmidentifier.
2. gflow auth login --browser chrome --profile denon82:

   auth_flow_session_verified   probe=in_context
   auth_login_session_detected  outcome=authenticated elapsed_s=0.4
   auth_flow_session_verified   probe=on_disk
   [OK] Flow session verified
   

   Nobody signed in, and the user never got the chance.
3. After that: still /about, 2/2.
4. Opening real Chrome on the profile by hand and completing "Confirm it's you" fixed it. The app loads and gflow project create succeeds.

The login banner even tells the user to "keep going until the Flow editor itself loads". The detector fires long before the editor could.

Why

The success probe answers "are the Flow/Google session cookies present and valid". This state has valid cookies. Flow's routing to /about is decided client-side, with no request to Flow (docs/superpowers/spikes/2026-09-11-about-redirect-is-decided-client-side.md), so a cookie-level probe cannot see it.

Direction (not prescriptive)

Before declaring success, observe the outcome rather than the cookies. For example, confirm the page has settled on a Flow app route and not on flow_landing_kind(url) == "public". If it lands on /about, keep Chrome open and tell the user to finish Google's check. That is the same "check the outcome, not the initiating signal" rule the spike skill asks for.

Needs /gflow:predict: it touches auth.

Evidence: docs/superpowers/spikes/2026-09-23-about-cta-leads-to-google-reauth.md. Related: #881, #888, #756.