Review brief: console email sign-in spec (rev 1)

Repo: carlos/platform, branch email-signin, commit 49eaacf0. Spec: docs/superpowers/specs/2026-10-21-console-email-signin-design.md.

You are an independent reviewer. Read the spec, then read the code it changes to check every claim against it: internal/console/server.go (handleContinue, handleSignin, handleCallback, handleConfirm, handleInvite, handleInvitePage, handleAcceptInvite, session, setCookie), internal/console/stepup.go, internal/console/keymail.go, internal/console/keymailfed.go, internal/console/consolemail.go, internal/console/authcli.go (device flow, clientIP, notifyCLIIssued), internal/console/store.go (sessions, confirmations, invites), internal/console/store_gate.go (claimSQLTables), cmd/console/main.go (consoleMailer wiring), infra/modules/region-host (consolemail*).

Rulings R1-R4 in §2 are Paul's and fixed. Do not re-argue them; report only mechanisms that fail to honour them.

Report, ranked P1 (security hole or will not work) / P2 (real defect) / P3 (worth fixing):

• security holes: session fixation, login CSRF, downgrade of Keymail sessions to email re-confirmation, oracles (account existence, Keymail mailbox existence, rate limiting), token/code brute force, link scanners consuming tokens, open redirects via next, the pending action being swapped or replayed, mail-cannon abuse;
• places the spec contradicts the code or would break an existing flow (Keymail sign-in, the Apps-inbox confirmation, invites, CLI login, claim-mode gates);
• missing pieces a builder would trip over.

For each finding: the spec section, the code location (file:line) that proves it, the failure scenario, and a suggested fix. Verify every code citation. Do not edit files. Do not spawn Anthropic-model reviewers or subagents of your own. Do not run the full test suites.