Show immediate Unlocking feedback; prepare Chrome-only 0.2.5 #18

Merged

backmeupplz merged 2 commits from board24-unlock into main

2026-10-04 15:35:28 +00:00

backmeupplz commented

2026-10-04 15:15:37 +00:00

(Migrated from github.com)

#24 — immediate unlock feedback; prepare Chrome-only 0.2.5

Changes

Native unlock form shows Unlocking... synchronously and disables repeat click/Enter submissions. Accessible busy/live status, wrong-password recovery, retries, detached/page lifecycle guards, stale-render suppression.
Two animation frames give the browser an opportunity to paint before existing scrypt work begins. Crypto parameters, password checks, vault/store implementation and auto-lock policy unchanged. No new dependencies.
Patch version 0.2.5; both browser builds remain supported. Repository STORE_PLAY_PAUSED=true and STORE_FIREFOX_PAUSED=true. Credential-free selection additionally caps immutable tag v0.2.5 to Chrome, including future full reruns after flags change. No Play/AMO environment or credentials for this tag.
Document pause pre-values, future intentional Play restoration and release preflight. No store release has been published by this PR.

Verification

npm ci, full npm test, npm run build (Chrome), Firefox MV3 build, tsc --noEmit and git diff --check passed locally.
44 Python release tests passed (one existing JDK signing fixture skipped locally; CI runs JDK21/Android strict build).
New tests execute the actual unlock helper and render function for delay, frame ordering, duplicate submissions, success/errors/retries, redraws, close/restoration and stale render/lock races.
Independent exact-head Astra review and CI results will be recorded before handoff. Browser diagnostics are supplemental, not an installed-extension or screen-reader audit.

Release handoff

Implement phase only: merge/release owner must recheck latest main/tags, store version and active runs. Public Chrome listing observed at 0.2.0; v0.2.4 journal says PENDING_REVIEW at submission with DEFAULT_PUBLISH/100%, not live status. Existing PR15 submitter cancels older pending reviews: inspect current state and address applicable owner authorization explicitly before publishing, never silently cancel or repeat ambiguous writes. Publish only a genuine reviewed v0.2.5 release, record exact Chrome receipt, distinguish pending review from public, leave Play/Firefox pauses intact, and report to origin topic4009286.

Board: https://agentboard.icefish-betta.ts.net/#24

#24 — immediate unlock feedback; prepare Chrome-only 0.2.5 ## Changes - Native unlock form shows Unlocking... synchronously and disables repeat click/Enter submissions. Accessible busy/live status, wrong-password recovery, retries, detached/page lifecycle guards, stale-render suppression. - Two animation frames give the browser an opportunity to paint before existing scrypt work begins. Crypto parameters, password checks, vault/store implementation and auto-lock policy unchanged. No new dependencies. - Patch version 0.2.5; both browser builds remain supported. Repository STORE_PLAY_PAUSED=true and STORE_FIREFOX_PAUSED=true. Credential-free selection additionally caps immutable tag v0.2.5 to Chrome, including future full reruns after flags change. No Play/AMO environment or credentials for this tag. - Document pause pre-values, future intentional Play restoration and release preflight. No store release has been published by this PR. ## Verification - npm ci, full npm test, npm run build (Chrome), Firefox MV3 build, tsc --noEmit and git diff --check passed locally. - 44 Python release tests passed (one existing JDK signing fixture skipped locally; CI runs JDK21/Android strict build). - New tests execute the actual unlock helper and render function for delay, frame ordering, duplicate submissions, success/errors/retries, redraws, close/restoration and stale render/lock races. - Independent exact-head Astra review and CI results will be recorded before handoff. Browser diagnostics are supplemental, not an installed-extension or screen-reader audit. ## Release handoff Implement phase only: merge/release owner must recheck latest main/tags, store version and active runs. Public Chrome listing observed at 0.2.0; v0.2.4 journal says PENDING_REVIEW at submission with DEFAULT_PUBLISH/100%, not live status. Existing PR15 submitter cancels older pending reviews: inspect current state and address applicable owner authorization explicitly before publishing, never silently cancel or repeat ambiguous writes. Publish only a genuine reviewed v0.2.5 release, record exact Chrome receipt, distinguish pending review from public, leave Play/Firefox pauses intact, and report to origin topic4009286. Board: https://agentboard.icefish-betta.ts.net/#24

backmeupplz commented

2026-10-04 15:17:10 +00:00

(Migrated from github.com)

Independent Astra exact-head review PASS at ffe950b710; no must-fix findings. Full tests, TypeScript and Chrome/Firefox builds independently passed. Release tests: 43 pass, one local JDK fixture skip (CI supplies JDK21). Supplemental Chrome real-DOM diagnostic additionally passed native Enter/retry, duplicate-submit guard, synchronous pending state and frame opportunity before simulated blocking work; screenshot is attached to board #24. Firefox browser runtime unavailable locally; build/shared tests passed. No installed-extension or screen-reader audit claimed. Release preflight remains separate, including current Chrome review/cancellation authorization.

Independent Astra exact-head review PASS at ffe950b71094be64ded168f821f784393d73aad3; no must-fix findings. Full tests, TypeScript and Chrome/Firefox builds independently passed. Release tests: 43 pass, one local JDK fixture skip (CI supplies JDK21). Supplemental Chrome real-DOM diagnostic additionally passed native Enter/retry, duplicate-submit guard, synchronous pending state and frame opportunity before simulated blocking work; screenshot is attached to board #24. Firefox browser runtime unavailable locally; build/shared tests passed. No installed-extension or screen-reader audit claimed. Release preflight remains separate, including current Chrome review/cancellation authorization.

backmeupplz commented

2026-10-04 15:23:11 +00:00

(Migrated from github.com)

Review verdict

CHANGES REQUIRED — P2. Head SHA: ffe950b710
Independent Astra review6d3ddf93-964e-4a97-b6dc-554e87eb9c3a initially passed, then revised after targeted lifecycle follow-up; the revised finding supersedes the initial PASS. Parent independently confirms the reachable code/test path.

entrypoints/popup/unlock.ts:54–69: an unrelated redraw of the same locked view loses an in-flight unlock failure. Send transaction, lock while confirmation pending, start incorrect-password unlock; lib/chain.ts:50–52 writes session mined, main.ts:811–817 redraws/replaces pending form, then rejection fails stillActive and replacement current.update clears status. User receives no wrong-password/failure explanation. test-unlock.js:119–137 already reproduces this but incorrectly expects empty replacement status. Preserve failure feedback/retry across harmless locked-view redraws while still suppressing outcomes after pagehide, actual navigation or a newer authentication lifecycle; add regression assertions for both categories.

Validation at reviewed head: npm ci/full npm test, Chrome build, Firefox MV3 build, tsc --noEmit and diff checks passed; Python release tests44 (43 pass,1 JDK-fixture skip). GitHub exact-head build37212328593 green including strict Android packaging. In own detached worktree worktrees/plainwallet-review24, merging latest origin/main4849b96 returned already up to date. No merge/tag/release/store mutation. Return in-progress for dispatcher fixer, do not fix in reviewer lane.

Release handoff: live STORE_PLAY_PAUSED=true and STORE_FIREFOX_PAUSED=true, Chrome enabled. Existing PR15/docs already record owner authorization for replacing older pending Chrome review; do not recycle satisfied setup/IAM requests. Exact live Chrome preflight still needed via established release-only OIDC path; historical v0.2.4 receipt and public listing0.2.0 do not establish current review status. No local Google credential path/gcloud found; do not widen trust or run a throwaway release. Keep v0.2.5 tag unused and immutable Chrome-only cap; next owner must reconcile preflight and observe real receipt before claiming submission.

## Review verdict CHANGES REQUIRED — P2. Head SHA: ffe950b71094be64ded168f821f784393d73aad3 Independent Astra review6d3ddf93-964e-4a97-b6dc-554e87eb9c3a initially passed, then revised after targeted lifecycle follow-up; the revised finding supersedes the initial PASS. Parent independently confirms the reachable code/test path. - entrypoints/popup/unlock.ts:54–69: an unrelated redraw of the same locked view loses an in-flight unlock failure. Send transaction, lock while confirmation pending, start incorrect-password unlock; lib/chain.ts:50–52 writes session mined, main.ts:811–817 redraws/replaces pending form, then rejection fails stillActive and replacement current.update clears status. User receives no wrong-password/failure explanation. test-unlock.js:119–137 already reproduces this but incorrectly expects empty replacement status. Preserve failure feedback/retry across harmless locked-view redraws while still suppressing outcomes after pagehide, actual navigation or a newer authentication lifecycle; add regression assertions for both categories. Validation at reviewed head: npm ci/full npm test, Chrome build, Firefox MV3 build, tsc --noEmit and diff checks passed; Python release tests44 (43 pass,1 JDK-fixture skip). GitHub exact-head build37212328593 green including strict Android packaging. In own detached worktree worktrees/plainwallet-review24, merging latest origin/main4849b96 returned already up to date. No merge/tag/release/store mutation. Return in-progress for dispatcher fixer, do not fix in reviewer lane. Release handoff: live STORE_PLAY_PAUSED=true and STORE_FIREFOX_PAUSED=true, Chrome enabled. Existing PR15/docs already record owner authorization for replacing older pending Chrome review; do not recycle satisfied setup/IAM requests. Exact live Chrome preflight still needed via established release-only OIDC path; historical v0.2.4 receipt and public listing0.2.0 do not establish current review status. No local Google credential path/gcloud found; do not widen trust or run a throwaway release. Keep v0.2.5 tag unused and immutable Chrome-only cap; next owner must reconcile preflight and observe real receipt before claiming submission.