Contact email: withdrawal covers earlier reports; consent is a real true

- A report with follow-up ticked carries this copy's contact id, and the
  inbox marks its permission withdrawn when a later choice from that copy
  no longer agrees to follow-up questions at that address.
- The one-time prompt never appears in a visit that showed the privacy
  notice, even if the Frame connects just after it's dismissed.
- Saving contact details isn't headset work: it can't hold up switching
  headsets or be refused after a switch.
- Consent flags must be JSON true/false; "false" is no longer consent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/frame_contact.py

@@ -71,6 +71,24 @@ def valid_email(email):
     return len(email) <= EMAIL_MAX and bool(EMAIL_RE.fullmatch(email))
 
 
+def flag(body, key):
+    """A consent choice: true only when it really is true (not "false" or 1), left out is no."""
+    v = body.get(key)
+    if v is not None and not isinstance(v, bool):
+        raise ValueError(f'{key} must be true or false')
+    return v is True
+
+
+def contact_id():
+    """This copy's contact id, kept from now on. A report with follow-up consent carries it, so
+    removing the address later takes back the follow-up permission given with the report too."""
+    with _lock:
+        s = load()
+        if not FILE.exists():
+            _save(s)
+        return s['id']
+
+
 def state():
     """What the page shows. showPrompt: the one-time prompt hasn't been shown or answered yet,
     and the Frame has connected at least once (setup worked), so it never greets a new install."""
@@ -156,7 +174,7 @@ def save(body):
     """Set, change or remove the address and the two choices. An address needs at least one
     choice ticked; an empty address (or neither ticked) removes it and withdraws both."""
     email = str(body.get('email') or '').strip()
-    updates, followup = bool(body.get('updates')), bool(body.get('followup'))
+    updates, followup = flag(body, 'updates'), flag(body, 'followup')
     if email and not valid_email(email):
         raise ValueError("that doesn't look like an email address")
     if email and not (updates or followup):

ui/frame_report.py

@@ -112,13 +112,15 @@ def send(body):
     """Send the report to PostHog. Returns {"id", "message"}; raises ReportError."""
     kind = body.get('kind') if body.get('kind') in KINDS else 'bug'
     title, text, diag = compose(body)
-    followup = bool(body.get('contactFollowup'))
+    followup = frame_contact.flag(body, 'contactFollowup')
     contact = str(body.get('contact') or '').strip() if followup else ''
     if followup and not frame_contact.valid_email(contact):
         raise ValueError('add your email address for follow-up questions, or untick that box')
     ref = uuid.uuid4().hex[:8].upper()
     props = {**frame_telemetry.common(), 'kind': kind, 'title': title, 'message': text,
              'contact': contact, 'contact_followup': followup, 'diagnostics': diag,
+             # Only with an address: so removing it later (Settings) also takes this permission back.
+             'contact_id': frame_contact.contact_id() if followup else '',
              'report_id': ref, 'steamos': str(frame.get('build') or '')[:120], 'level': 'report'}
     # Its own random id: a report can carry contact details, so it isn't linked to this copy's analytics.
     event = {'event': 'problem_report', 'distinct_id': str(uuid.uuid4()), 'uuid': str(uuid.uuid4()),
@@ -143,15 +145,43 @@ class ReportError(RuntimeError):
 
 def inbox(days=30):
     """The maintainer's recent reports from PostHog, newest first (needs the personal API key
-    frame_compat_db.sync uses)."""
+    frame_compat_db.sync uses). Column 10 is whether the person may be asked follow-up
+    questions now: 'withdrawn' when a later choice from the same copy took it back."""
     import frame_compat_db
+    days = int(days)
     res = frame_compat_db._posthog_query(
         "SELECT timestamp, properties.report_id, properties.kind, properties.title, properties.message, "
         "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics, "
-        "properties.contact_followup "
-        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {int(days)} DAY "
+        "properties.contact_followup, properties.contact_id "
+        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {days} DAY "
         "ORDER BY timestamp DESC LIMIT 200")
-    return res.get('results') or []
+    rows = [r for r in res.get('results') or [] if isinstance(r, list) and len(r) == 12]
+    if any(r[11] and _yes(r[10]) for r in rows):
+        later = frame_compat_db._posthog_query(
+            "SELECT distinct_id, properties.email, properties.followup, ifNull(toInt(properties.rev), 0), timestamp "
+            f"FROM events WHERE event = 'contact_consent' AND timestamp > now() - INTERVAL {days} DAY LIMIT 100000")
+        mark_withdrawn(rows, later.get('results') or [])
+    return rows
+
+
+def mark_withdrawn(reports, consents):
+    """Mark reports whose follow-up permission was taken back: the newest contact choice from
+    the same copy made at or after the report (same second counts, so a withdrawal wins) no
+    longer agrees to follow-up questions at that address."""
+    newest = {}
+    for c in consents:
+        if not isinstance(c, list) or len(c) != 5:
+            continue
+        cid, email, followup, rev, ts = c
+        newest.setdefault(str(cid), []).append(((int(rev or 0), str(ts or '')), str(email or ''), followup))
+    for r in reports:
+        if not (r[11] and _yes(r[10])):
+            continue
+        after = [c for c in newest.get(str(r[11]), []) if c[0][1] >= str(r[0] or '')]
+        if after:
+            _, email, followup = max(after, key=lambda c: c[0])
+            if not (_yes(followup) and email.strip().lower() == str(r[5] or '').strip().lower()):
+                r[10] = 'withdrawn'
 
 
 def _yes(v):
@@ -204,14 +234,13 @@ def main():
     if cmd != 'inbox':
         sys.exit(USAGE)
     for row in inbox(*(args[:1] or [30])):
-        if not isinstance(row, list) or len(row) != 11:
-            continue
         ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row[:10])
         # Reports from before contact_followup existed only carried an address given for a reply.
         reply = contact and (row[10] is None or _yes(row[10]))
         print(f"== {ts[:16].replace('T', ' ')}  {ref}  [{kind}] {title}")
         print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}"
-              f"{', may follow up at ' + contact if reply else ''}")
+              f"{', may follow up at ' + contact if reply else ''}"
+              f"{', follow-up permission since withdrawn' if row[10] == 'withdrawn' else ''}")
         print('   ' + text.replace('\n', '\n   '))
         if diag:
             print('   --- diagnostics\n   ' + diag.replace('\n', '\n   '))

ui/index.html

@@ -3963,6 +3963,7 @@ async function offerTest(m) {
 
 // ---- privacy: anonymous analytics levels (ui/frame_telemetry.py, docs/privacy.md) ----
 const telemetry = { usage: false, compat: false, blocked: "not loaded" };
+let privacyNoticeShown = false;  // this visit: then the contact prompt waits for another one
 function renderTelemetry(s) {
   Object.assign(telemetry, s);
   setRepHint();
@@ -3973,6 +3974,7 @@ function renderTelemetry(s) {
                                          : "Nothing sent yet.";
   const showNotice = !s.blocked && !s.noticeShown && s.usage;
   $("privacyNotice").hidden = !showNotice;
+  if (showNotice) privacyNoticeShown = true;
   if (showNotice) api("/api/telemetry", { noticeShown: true }).catch(() => {});
 }
 async function loadTelemetry() {
@@ -4015,13 +4017,14 @@ async function loadContact() {
   try { renderContact(await api("/api/contact")); } catch { return; }
   checkContactPrompt();
 }
-// One time only, only once the Frame has connected, and never on top of the privacy notice or
-// straight after it (two asks in a row is nagging): checked at load and whenever the Frame connects.
+// One time only, only once the Frame has connected, and never in a visit that showed the privacy
+// notice (two asks in a row is nagging): checked at load and whenever the Frame connects.
 async function checkContactPrompt() {
-  if (!$("contactNotice").hidden || !$("privacyNotice").hidden) return;
+  await telemetryLoaded;
+  if (privacyNoticeShown || !$("contactNotice").hidden) return;
   let s;
   try { s = await api("/api/contact"); } catch { return; }
-  if (!s.showPrompt || !$("contactNotice").hidden || !$("privacyNotice").hidden) return;
+  if (!s.showPrompt || privacyNoticeShown || !$("contactNotice").hidden) return;
   $("contactNotice").hidden = false;
   api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
 }

ui/server.py

@@ -134,6 +134,7 @@ LINK = None  # the connector (frame_link.Link); None on the Frame itself
 # install's clean-up) to the other headset.
 _work_lock = threading.Lock()
 _work = [0]
+NOT_HEADSET_WORK = {"/api/devices", "/api/contact", "/api/contact/prompt"}
 
 
 @contextlib.contextmanager
@@ -2440,7 +2441,8 @@ class Handler(BaseHTTPRequestHandler):
             body = json.loads(self.rfile.read(length) or b"{}")
             if not isinstance(body, dict):
                 raise Failure("request body must be a JSON object", 400)
-            with (contextlib.nullcontext() if path == "/api/devices" else working(meant)):
+            # Not headset work: switching headsets mustn't wait for (or refuse) these.
+            with (contextlib.nullcontext() if path in NOT_HEADSET_WORK else working(meant)):
                 result = handler(body)
             self.send_json(result)
         except Failure as e: