Finish P0.2e cluster forcedotcom#6 (part 2): photo test fix + OpenID baseline

Two test-only resolutions plus a baseline decision, all triaged against the
pre-migration oracle (unmigrated ObjC at merge-base 6ed0ab4).

- SFUserAccountPhotoTests.testPhotoWithoutCompletionBlock: the migration changed
  the assertion from the ObjC original's XCTAssertNotNil(user.photo) to
  XCTAssertTrue over a reference-equality poll (user.photo == testPhoto). The
  `photo` getter re-decodes from disk into a NEW UIImage when _photo is nil
  (byte-faithful to ObjC SFUserAccount.m:170-185), so ref-equality never
  converges and the poll times out. Restored the ObjC assertion semantics
  (wait for the async setPhoto to settle, then assert final state). Both photo
  tests pass. Test-only; production unchanged.

- SalesforceOAuthUnitTests/testCredentialsCoding: already green (resolved by the
  cluster forcedotcom#1 init?(coder:) decode fix, deae6b0); confirmed by run. No change.

- SFSDKAuthUtilTests.testOpenIDToken: baselined as pre-existing/old-refresh-flow,
  NOT a migration regression. A 3-way oracle comparison proved it: the same
  intermittent setUp auth-refresh hang (listener status stuck 'waiting' -> 30s
  timeout, callback never fires) reproduces in the UNMIGRATED ObjC at our
  merge-base 6ed0ab4, while current dev -- which carries upstream's new token
  refresh coordinator (PR forcedotcom#4087 / 8f597c9) ~155 commits ahead -- runs 9/9
  green. So it is an old-refresh-flow defect upstream already fixed, independent
  of the ObjC->Swift migration. Likely refresh-token rotation. Will be
  superseded when the refresh-coordinator work is pulled via the port queue.

Baseline entries added with rationale (anti-laundering: not migration-caused).

Author: JohnsonEricAtSalesforce

.claude/test-baseline-ids.txt

@@ -7,3 +7,4 @@ SFSmartStoreAlterTests/testAlterSoupWithFullTextIndexesToGetIndexesOnCreatedAndL
 SFMultipleSmartStoresTests/testGetGlobalStoreNames
 SFSmartSqlTests/testCleanupRegexpFaster
 SalesforceRestAPITests/testRedirect
+SFSDKAuthUtilTests/testOpenIDToken

.claude/test-baseline.md

@@ -63,6 +63,22 @@ outcome depends on the org's photo-endpoint behavior/data. 61 other SalesforceRe
 the live org. Baselined by operator decision (investigate-deeper concluded env/org-dependent).
 Candidate for a CI-org-specific fixture or removal.
 
+### `pre-existing/old-refresh-flow` — SFSDKAuthUtilTests.testOpenIDToken (operator-approved 2026-07-16)
+
+`SFSDKAuthUtilTests.testOpenIDToken` does a live-org refresh and asserts a non-nil OpenID `id_token`
+(line 93). It fails intermittently (nil id_token), and the class `setUp` auth-refresh also HANGS
+intermittently (`SFSDKTestRequestListener` status stuck `waiting` → 30s `maxWaitTime` timeout; the
+refresh callback never fires — NOT a 429/`invalid_grant`, which would fire the failure callback →
+`didFail`). **Proven PRE-EXISTING, not a migration regression, via a 3-way oracle comparison (2026-07-16):**
+the identical hang reproduces in the **unmigrated ObjC at our merge-base `6ed0ab40`** (`git worktree`, same
+creds/org) — the exact pre-migration source our branch was converted from — while the **current-dev**
+oracle (which carries upstream's new *token refresh coordinator*, ~155 commits ahead: 997c4e09a / PR #4087
+/ 8f597c962 "Improve error handling at token refresh") runs 9/9 green in the same window. So this is an
+old-refresh-flow defect upstream already fixed, independent of the ObjC→Swift migration. Likely
+refresh-token rotation (first run w/ a fresh token succeeded; later runs hang on the stale-token response).
+Baselined by operator decision. Will be superseded when the refresh-coordinator work is pulled in via the
+upstream port queue. See memory [[premigration-oracle-clone]] for the merge-base-oracle method.
+
 ---
 
 ## ✅ RESOLVED 2026-07-14 (tracker finding P0.2b) — SmartStore setUp crash cluster
@@ -218,6 +234,29 @@ migration regressions vs. test-isolation). SDKCore gate remains **provisional**
 kill the 2 remaining crashes) → #1 (identity/credentials — 12, but ESCALATION-GATED, needs approval) →
 #3 → #4 → #6. Cluster #1 requires operator escalation approval before any credentials/OAuth code change.
 
+### Cluster #6 resolution (2026-07-16) — part 1 committed, part 2 via the pre-migration oracle
+Part 1 (commit 280f13d39): SFPreferences global-pref, URLRequest doubled-path, SFOAuthInfo IDP casing,
+testCoordinator, URLRequestRestRequestTests. Part 2:
+- **SalesforceOAuthUnitTests/testCredentialsCoding** — already GREEN (resolved by cluster #1 decode fix
+  deae6b04b). Confirmed by run.
+- **SFUserAccountPhotoTests.testPhotoWithoutCompletionBlock** — FIXED (test-only). Migration changed the
+  assertion from ObjC `XCTAssertNotNil(user.photo)` to `XCTAssertTrue(<ref-equality poll>)`; the `photo`
+  getter re-decodes from disk into a new UIImage (byte-faithful to ObjC .m:170-185), so ref-equality never
+  converges. Restored ObjC assertion. Both photo tests pass. (Uncommitted at time of writing.)
+- **SFSDKAuthUtilTests.testOpenIDToken** + a **setUp auth-refresh HANG** — determined PRE-EXISTING, NOT a
+  migration regression, via a 3-way oracle comparison (documented for the ratchet):
+    * Current-dev oracle (has upstream's NEW token refresh coordinator, ~155 commits ahead): 9/9 green.
+    * **Merge-base `6ed0ab40` UNMIGRATED ObjC** (the exact pre-migration source our branch was converted
+      from, via `git worktree`): setUp **HANGS** identically (`'didLoad'`→`'waiting'`, 30s timeout,
+      Executed 0 tests). Same failure as our migrated branch.
+    * Our migrated Swift branch: setUp hangs identically.
+  Since the hang reproduces in the pre-migration ObjC, it is an **old-refresh-flow defect that upstream
+  fixed via the token refresh coordinator** (997c4e09a / PR #4087 / 8f597c962 "Improve error handling at
+  token refresh"), NOT introduced by the migration. Likely refresh-token rotation: first run w/ a fresh
+  token succeeded, subsequent runs hang on the stale-token response (old flow never times out cleanly).
+  → **Candidates to baseline** (env/pre-existing, like `testRedirect`) pending operator decision; must NOT
+  be laundered as migration-caused. See [[premigration-oracle-clone]] for the merge-base-oracle method.
+
 ## (historical) P0.2d root-cause analysis — three independent migration artifacts
 
 Distinct from the (now-fixed) credentials cluster. Root-caused 2026-07-14: **three independent

libs/SalesforceSDKCore/SalesforceSDKCoreTests/SFUserAccountPhotoTests.swift

@@ -44,14 +44,17 @@ class SFUserAccountPhotoTests: XCTestCase {
     func testPhotoWithoutCompletionBlock() {
         let user = createNewUser()
         user.setPhoto(nil, completion: nil)
-        let nilCondition = waitForBlockCondition({ user.photo == nil }, timeout: 2.0)
-        XCTAssertTrue(nilCondition)
+        // Wait for the async setPhoto to settle, then assert final state (matches the
+        // ObjC original, SFUserAccountPhotoTests.m). Do NOT assert the poll's bool result:
+        // the `photo` getter re-decodes from disk into a NEW UIImage when `_photo` is nil,
+        // so a reference-equality poll (`== testPhoto`) can never converge — a test-only
+        // migration artifact, not a production regression (getter is faithful to .m:170-185).
+        _ = waitForBlockCondition({ user.photo == nil }, timeout: 2.0)
         XCTAssertNil(user.photo)
 
         let testPhoto = SFSDKResourceUtils.imageNamed("salesforce-logo")
         user.setPhoto(testPhoto, completion: nil)
-        let photoCondition = waitForBlockCondition({ user.photo == testPhoto }, timeout: 2.0)
-        XCTAssertTrue(photoCondition)
+        _ = waitForBlockCondition({ user.photo != nil }, timeout: 2.0)
         XCTAssertNotNil(user.photo)
     }