prod /sign-in throws 'Invalid or unexpected token' — browser-only JS parse error (client-partial-dead, #294 SWC-octal class)

[TortoiseWolfe]

Found by the new #288 post-deploy @smoke suite (PR forthcoming) — it did exactly its job: caught a real, deployed-but-broken defect that every other test is green through.

Symptom

The live production sign-in page throws a JavaScript parse error:

pageerror: Invalid or unexpected token

• Reproduces deterministically (3/3 Playwright retries, and again in standalone repros) on https://scripthammer.com/sign-in/.
• It is a parse-time error — the pageerror has an empty stack (the script failed to parse before any statement ran).
• Browser-only: node's (sloppy-mode) parser accepts the source, so the build's check-chunks-parse.mjs gate and the CI build both stay green — this is why it reaches prod undetected. This is the Adding cesium inlines a WASM module as a template literal → vendor chunk fails to parse → client JS dead app-wide #294 SWC-octal class (a \0<digit> octal escape that is a SyntaxError in strict/module/template context but not in a sloppy classic script) — TECHNICAL-DEBT [Gap-Audit] Stability: PaymentConsentModal Firefox focus timing + imperative/declarative hybrid #11, previously worked around via a @spz-loader/core@0.3.0 pnpm override. This is a regression or a new instance of that class.

What I ruled out (repro notes)

• The page still renders (the "Continue with GitHub/Google" buttons are visible), apex serves 200, and OAuth client_ids are valid — so it's a partial client break, not a white screen.
• Loading each of the 13 _next/static/*.js chunks standalone via <script src> does NOT reproduce the error. So the offending script is not a standalone static chunk — it is most likely an inline hydration script in the page HTML (self.__next_f/flight data) or a dynamically import()-ed chunk whose content carries the bad escape. Next step for the fixer: capture the page's inline <script> bodies + the dynamic-import chunks and strict-parse each ("use strict" / module mode) to find the \0<digit> (or raw NUL) token, then trace it to the source construct / dependency and re-apply/adjust the SWC override.

Impact

A deployed JS parse error on the sign-in page — the #287-class "the product a customer touches is broken while every test is green." Priority to (a) confirm what functionality is actually dead, (b) fix the octal-escape source, (c) add a build-time detector that parses chunks the way the browser does (strict/module), since the current sloppy-mode check-chunks-parse.mjs misses it.

Relationship to the @smoke suite

The @smoke suite (#288 item 2) ships with its "sign-in loads with zero console errors" check skipped, annotated with this issue number. Un-skip that check when this is fixed — a green smoke run then re-confirms the fix on the live origin. The suite's other checks (providers enabled, OAuth client_id validity, canonical redirects) gate immediately.