martbost
2f4b70c886
Three things, one of which we were quietly getting wrong. REAL OPT-OUT. We told members "removable any time" in three separate places and there was no way to remove anything. Same class of failure as the dead "Add mine" button: copy written, mechanism never built. The profile card now offers Remove username, Remove email and Remove everything, and profiles.remove() clears the value while never touching the position. Adding it again later works exactly as before, so opting out is not a one-way door. It is a two-step inline confirm, not a native confirm() dialog. Browsers with "suppress dialogs" switched on return false, which would have made Remove look broken in precisely the way Add mine was broken. First tap arms and explains the consequence, second tap does it, and it disarms itself after six seconds. THE PROMISE WE WERE BREAKING. The payout mailer and the upgrade alerts read member-alerts.json, NOT profiles.json. So a member who completed the new profile got NOTHING, while the invitation card promised "a note the moment POL lands in your wallet". Verifying a profile email now mirrors into member-alerts.json so every existing alert path works, including the unsubscribe link, and removing the email clears both stores so opting out actually stops the email. MANSON'S HUGE ASTERISK. He asked for it to be bigger and bolder so nobody can say they did not see it, and on a decentralized build that burden is ours, not the member's. One gold badge now appears on the dashboard invitation, inside the dialog on every step, in the inbox banner and on the profile card itself: "100% OPTIONAL - never required", with the plain statement that the position, the payouts, the team and everything on the page work exactly the same without it, nothing on chain depends on it, and it can be removed again any time. gate-e2e is 52 assertions, up from 38. The new ones prove one tap does NOT remove anything, the second tap does, the server agrees the value is gone, an email-only removal leaves the username alone, and the invitation reappears afterwards so the whole thing is reversible. profiles-unit 28, signin-fallback 7, captions-e2e 158 all green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
RM Circle QA
Optional member profile
Since 2026-09-17 contact details are optional (Marty + Manson). Nothing about holding a position, getting paid, reading the org, the training or the tools may depend on a username or an email. There is no onboarding gate. The dashboard shows a dismissable invitation, and the inbox asks only because a message cannot be delivered to someone who left no way to reach them.
If a change to this area makes any of those suites fail on "NO modal is forced", stop. That assertion is the product decision, not a test detail.
# unit: profiles.js in isolation (seeding, username rules, code flow, persistence)
node qa/profiles-unit.mjs
# sign-in fallback: real secp256k1 signatures, including the abuse cases
node qa/signin-fallback.mjs
# end to end: the real UI with real inbox sessions.
# reseed.sh builds a throwaway data dir and starts the server on 3399.
# NOT idempotent: the suite completes a profile for 21, so reseed before every run.
bash qa/reseed.sh
D=/d/tmp/rmc-e2e-data
LOCAL=http://127.0.0.1:3399 TOKEN=$(sed -n 1p $D/tokens.txt) TOKEN2=$(sed -n 2p $D/tokens.txt) node qa/gate-e2e.mjs
Covers: no automatic modal on the owner's own page or on a phone, the dismissable invitation and its 7-day snooze, opting in end to end (including the regression that saving a username must ADVANCE to the email step rather than close), abandoning the dialog at any point, the profile card and in-place editing, the seeded email pre-filling at step 2, the inbox's reason-led ask, visitors on every ID-keyed shared link seeing no prompt and no 401, and phone-width layout.
Two traps that cost real time, both now guarded in reseed.sh:
- Never call a shell variable
TMP,TEMPorTMPDIR. Windows already sets them to the system temp directory, so${TMP:-default}silently inherits it and a followingrm -rf "$TMP"wipes the machine's temp folder, including the tooling's own scratch files. - Never add
pkill/taskkill. A broad pattern kills the tooling running the script. Stop the old server through the pid file.
The event flyer and the upgrade promo are full-screen overlays that legitimately cover /my once
per browser/session and swallow clicks. Both E2E suites mark them already-seen via an init script
rather than racing their fade-out.
devCode is returned by /api/public/profile/email-start only when NODE_ENV !== 'production',
which is what lets the test read the code. The live container runs with NODE_ENV=production.
Join flow (the money path)
Drives the REAL /join-now page with a fake wallet that produces genuine secp256k1 signatures, against
a server whose chain reads are stubbed by qa/harness-server.js. COLD=1 reproduces the state that
left #787 without a profile: the cached index does not yet know the brand-new position.
node -e "const c=require('crypto'),s=require('./vendor/secp256k1.js'),{keccak256}=require('./vendor/sha3.js');s.utils.hmacSha256Sync=(k,...m)=>{const h=c.createHmac('sha256',Buffer.from(k));m.forEach(x=>h.update(Buffer.from(x)));return Uint8Array.from(h.digest())};const p=c.randomBytes(32),pub=s.getPublicKey(p,false);require('fs').writeFileSync('D:/tmp/rmc-qa-wallet.json',JSON.stringify({priv:p.toString('hex'),addr:'0x'+keccak256(Buffer.from(pub.slice(1))).slice(-40)}))"
J=/d/tmp/rmc-jd && rm -rf $J && mkdir -p $J && echo '[]' > $J/sponsors.json # never name it TMP, see the trap above
ssh root@coolify.saasy.top "docker exec \$(docker ps -q --filter name=kr445fqc) cat /app/data/config.json" > $J/config.json
# cold index (the state that broke #787) on 3400, warm index on 3402
TEST_ADDR=<addr> TEST_ID=9001 COLD=1 PORT=3400 DATA_DIR=$J ADMIN_PASSWORD=localtest node qa/harness-server.js &
TEST_ADDR=<addr> TEST_ID=9003 COLD=0 PORT=3402 DATA_DIR=$J-w ADMIN_PASSWORD=localtest node qa/harness-server.js &
LOCAL=http://127.0.0.1:3400 TEST_ADDR=<addr> TEST_PRIV=<priv> TEST_ID=9001 SCENARIO=sign node qa/join-flow-e2e.mjs
LOCAL=http://127.0.0.1:3400 TEST_ADDR=<addr> TEST_PRIV=<priv> TEST_ID=9002 SCENARIO=refuse node qa/join-flow-e2e.mjs
LOCAL=http://127.0.0.1:3402 TEST_ADDR=<addr> TEST_PRIV=<priv> TEST_ID=9003 SCENARIO=sign node qa/join-flow-e2e.mjs
COLD defaults to ON: only COLD=0 gives a warm index, so a missing COLD var does not silently
run the cold case twice.
SCENARIO=refuse is the regression that matters most: a member who declines the signature must still
complete the join and reach their dashboard. Never ship a join-flow change without it passing.
Gotchas: seed sponsors.json as [] (an object 500s), and the fake wallet auto-connects so
#connectBtn is hidden. Counters live in sessionStorage because the page redirects.