[antuz123]

A delayed biometric prompt could reject outside its intended catch, or dispatch authentication after the login screen unmounted, its account changed, or PIN authentication completed. This bounded R5 follow-up cancels the queued timer, ignores inactive native results, catches native rejection inside the callback, and preserves PIN fallback.

Source and review boundary

• Verified source: c1c4b803039b61b940373c4dc9d08473cf25e042 from fix: protected-backup follow-up and accurate Version History #7067, including core R5: safe key deletion and startup fixes on submitted 2.6.4 source (draft) #7058 at 77b72da29ac5f2cdf3f51c9a0e9f3fd1c2af7238 and released R4 1d8a86a7462d935cbd0e28b857934b5718c152fc.
• Head: 257fbe17e1a85d0e5d7e5d8ab97e1a69edbd9628; branch codex/r5-biometric-callback-guard.
• Patch-only comparison. Base remains sprint per AGENTS.md, so the ordinary PR diff contains inherited R4/R5/5.1 history.
• One small login lifecycle correction; provisional estimate 1k–3k changed code/test tokens. No credential verification, PIN lockout, storage, native dependency, protocol or app-version changes.
• Separate 5.2 identity/handoff remains unverified. Review its scope before combining; this branch neither changes nor establishes completion of its producer work.
• Current app inputs remain 2.6.4 / Android627 / iOS620; 5.1/5.2 are package labels, not assigned versions.

Demonstrated checks

Check	Actual result
Before-control: new callback cases against unchanged c1c4 Login	5 FAIL / 6 PASS: escaped native rejection, queued prompt after unmount, late success after unmount/account change/PIN authentication
Final targeted PIN + biometric component suite	11/11 PASS
Focused Login ESLint	FAIL: 12 errors / 4 warnings, identical rules/messages to baseline after line normalization
Modified test, explicit eslint --no-ignore	PASS: 0 errors / 0 warnings
Whole TypeScript before/after, same dependencies	FAIL: 943 diagnostics both, zero added/removed normalized diagnostics
Formatting, whitespace, EN/ES helper distinction assertions	PASS
Native iOS/Android feature acceptance and physical biometrics	NOT RUN

The component tests control native biometric/Firebase/storage boundaries. They demonstrate production callback behavior, not device authentication or an account-isolation exploit. Full combined-candidate checks belong to the R5 integration branch; passes from another SHA are not transferred.

Evidence and bounded app triage: #7055 remains unresolved, #6991 remains not reproduced, the shipped #7007 PIN fix and existing Emergency Key helper/5.1 backup terminology are retained. No speculative navigation/timezone patch was added.

Cloud native handoff

State: NEEDS_CLOUD_NATIVE
PR head commit: 257fbe1
Required native checks: IOS, ANDROID
Physical checks: HARDWARE — real biometric device/tester evidence remains separate.
Run exact-candidate hosted iOS/Android prompt rejection/cancel → PIN fallback, current prompt success, relock/account change and no authentication from late results, plus the combined R5 feature matrix. The latest owner instructions require Cloud execution; do not request or use the owner's personal Mac. Current legacy local gate remains fail-closed until trustworthy applicable native evidence is installed and passes.

Independent/security review and combined acceptance remain open. No merge, shared-branch promotion, release signing, upload, distribution, deployment or publication is authorized or performed.