Preserve the requested destination through email sign-in callbacks

Applications that accept an internal destination before an existing verified-email account signs in with its password.

Accept a bounded application-relative destination at the entry point and validate it against the same origin before beginning authentication.

Carry the validated destination through the email/password sign-in form and its authentication callback.

Apply the validated destination when the authenticated session becomes active, and preserve its supported query parameters.

Use a safe application default when the destination is absent or invalid.

Exercise the real email/password sign-in flow and assert the final browser URL and authenticated state; a provider fixture alone cannot establish this behavior.

Reject cross-origin destinations without widening credential scope; measure additional authentication entry points separately.

A real browser signed an existing verified-email account in with its password. The authenticated browser reached its requested internal destination with supported query parameters preserved, and the destination view was usable. No email-code or second-factor challenge was presented or measured. This is agent-reported verification, separate from provider fixture checks.