From 19a0d0af1870a15162a7451242516fff85818463 Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:15:53 +1000
Subject: [PATCH 1/5] Ask for an optional contact email, with separate update
 and follow-up consent

Problem reports arrive with no way to reply. People can now leave an email
address with two separate opt-ins: occasional update notices, and follow-up
questions from the maintainer.

- ui/frame_contact.py keeps the address and choices locally and sends each
  change privately to PostHog as a contact_consent event under its own random
  contact id; removing the address sends a withdrawal without it. Changes made
  offline wait and are retried.
- A one-time, dismissible prompt appears after the Frame first connects; No
  thanks and showing it once are both remembered.
- Privacy & updates gains a Contact email section to add, change or remove it.
- The report form's contact field now goes with a report only when "may
  contact me with follow-up questions" is ticked (contact_followup).
- frame_report.py contacts [updates|followup] lists who agreed to what,
  using the newest event per copy.
- docs/privacy.md says what is collected, why, where and how to remove it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/privacy.md         |  46 ++++++++++-
 tests/test_contact.py   | 173 ++++++++++++++++++++++++++++++++++++++++
 tests/test_telemetry.py |   8 +-
 ui/frame_contact.py     | 166 ++++++++++++++++++++++++++++++++++++++
 ui/frame_report.py      |  67 ++++++++++++++--
 ui/index.html           | 107 +++++++++++++++++++++++--
 ui/server.py            |   5 ++
 7 files changed, 555 insertions(+), 17 deletions(-)
 create mode 100644 tests/test_contact.py
 create mode 100644 ui/frame_contact.py

diff --git a/docs/privacy.md b/docs/privacy.md
index db7004f..4edda2e 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -103,8 +103,10 @@ privately to Frame Control's PostHog project as a `problem_report` event, the
 same way as the analytics above, so only the maintainer can read it and
 nothing is published. It works whatever the analytics settings are, because
 the person sends it deliberately. The report has the kind, title and text you
-wrote, how to reach you if you gave it, a short reference shown after sending,
-and the diagnostics below. It has its own random id, so it isn't linked to
+wrote, a short reference shown after sending, and the diagnostics below. Your
+email address goes with it only if you tick **The maintainer may contact me
+with follow-up questions** (the report then carries `contact_followup: true`);
+it's filled in from **Contact email** below when you've agreed there. It has its own random id, so it isn't linked to
 your analytics events.
 
 With **Include diagnostics** ticked (the default), the report adds:
@@ -128,6 +130,46 @@ The maintainer reads reports on the Frame Control dashboard in PostHog, or
 with `python3 ui/frame_report.py inbox [days]`, which uses the same personal
 API key as `frame_compat_db.py sync`.
 
+## Contact email (optional)
+
+Frame Control never needs an email address. If you'd like to leave one, there
+are two separate choices, both off until you tick them:
+
+| Choice | What it's for |
+|---|---|
+| **Email me about Frame Control updates** | Occasional notices about new releases and updates |
+| **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
+
+You're asked once, in a bar at the top of the page, after the Frame has
+connected for the first time. **No thanks** hides it for good, and it isn't
+shown again even if you ignore it. **Contact email** in **Privacy & updates**
+is where you add, change or remove the address and either choice at any time.
+
+**What's sent, and where.** The address and the two choices go privately to
+Frame Control's PostHog project, the same place as problem reports, as a
+`contact_consent` event with `email`, `updates`, `followup`, `action` (`set`
+or `withdraw`) and the common properties above. Only the maintainer can read
+that project, and nothing in it is published or shared. It's sent only when
+you save, whatever the analytics settings are, because you chose to. It
+carries its own random contact id, not the analytics id, so it isn't linked
+to your usage events. On this computer the address and choices are kept in
+`contact/contact.json` in Frame Control's data folder. An address is only
+kept with at least one choice ticked.
+
+**Removing it.** **Remove my email** (or clearing the address and saving)
+deletes it from this computer and sends a `withdraw` event with no address in
+it. The maintainer's list only uses the newest event from each copy, so from
+then on the address isn't listed for either choice. Unticking one choice
+works the same way for that choice. If you're offline, the change waits on
+this computer and is sent when PostHog can be reached. The earlier event
+stays in PostHog until its data retention removes it; to have it deleted
+sooner, ask the maintainer (for example in a problem report).
+
+Nothing sends email yet: this only records who agreed to what. The
+maintainer lists the addresses with
+`python3 ui/frame_report.py contacts [updates|followup]`, which uses the same
+personal API key as `inbox`.
+
 ## Turning it all off
 
 Untick the boxes, or set `DO_NOT_TRACK=1` or `FRAME_CONTROL_TELEMETRY=0` in
diff --git a/tests/test_contact.py b/tests/test_contact.py
new file mode 100644
index 0000000..c775541
--- /dev/null
+++ b/tests/test_contact.py
@@ -0,0 +1,173 @@
+"""A contact email (ui/frame_contact.py): kept only with a matching choice, sent privately,
+withdrawn when removed, never lost offline, and the one-time prompt stays dismissed.
+
+Run: python3 -m unittest discover -s tests
+"""
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "ui"))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import frame_compat_db as db  # noqa: E402
+import frame_contact as fc  # noqa: E402
+import frame_report as fr  # noqa: E402
+import frame_telemetry as tm  # noqa: E402
+from test_telemetry import Base, ReportProblem  # noqa: E402
+
+REPORT = {"title": "RDP not working", "message": "It never connects on Windows."}
+
+
+class Contact(Base):
+    """Base's temp telemetry state, ReportProblem's PostHog stand-in, and a temp contact file."""
+    serve = ReportProblem.serve
+
+    def setUp(self):
+        super().setUp()
+        for name, value in (("STATE", tm.STATE / "contact"), ("FILE", tm.STATE / "contact" / "contact.json")):
+            p = mock.patch.object(fc, name, value)
+            p.start()
+            self.addCleanup(p.stop)
+        self.got = self.serve()
+
+    def events(self):
+        return [body["batch"][0] for _, body in self.got]
+
+    def offline(self):
+        return mock.patch.object(tm, "post", side_effect=tm.SendError("couldn't reach PostHog"))
+
+    # ---- storage and consent flags
+
+    def test_nothing_is_kept_or_sent_until_chosen(self):
+        s = fc.state()
+        self.assertEqual((s["email"], s["updates"], s["followup"], s["waiting"]), ("", False, False, False))
+        self.assertFalse(fc.FILE.exists())
+        self.assertEqual(self.got, [])
+
+    def test_an_address_needs_a_choice_and_a_real_address(self):
+        with self.assertRaisesRegex(ValueError, "tick"):
+            fc.save({"email": "me@example.com"})
+        with self.assertRaisesRegex(ValueError, "email address"):
+            fc.save({"email": "not an address", "updates": True})
+        self.assertEqual(fc.load()["email"], "")
+        self.assertEqual(self.got, [])
+
+    def test_each_choice_is_sent_privately_on_its_own(self):
+        fc.save({"email": " me@example.com ", "updates": True})
+        fc.save({"email": "me@example.com", "updates": False, "followup": True})
+        first, second = self.events()
+        self.assertEqual(first["event"], "contact_consent")
+        self.assertEqual({k: first["properties"][k] for k in ("email", "updates", "followup", "action")},
+                         {"email": "me@example.com", "updates": True, "followup": False, "action": "set"})
+        self.assertEqual((second["properties"]["updates"], second["properties"]["followup"]), (False, True))
+        self.assertEqual(first["distinct_id"], second["distinct_id"])  # one contact id, newest wins
+        self.assertNotEqual(first["distinct_id"], tm.settings()["id"])  # not the analytics id
+        self.assertEqual((first["properties"]["$process_person_profile"], first["properties"]["$geoip_disable"]),
+                         (False, True))
+        self.assertEqual([e["event"] for e in tm._read_lines(tm.SENT)], ["contact_consent"] * 2)
+
+    def test_sent_whatever_the_analytics_settings(self):
+        tm.update_settings({"usage": False})
+        fc.save({"email": "me@example.com", "followup": True})
+        self.assertEqual(len(self.got), 1)
+
+    def test_saving_the_same_choice_again_sends_nothing(self):
+        fc.save({"email": "me@example.com", "updates": True})
+        fc.save({"email": "me@example.com", "updates": True})
+        self.assertEqual(len(self.got), 1)
+
+    # ---- withdrawal
+
+    def test_removing_the_address_sends_a_withdrawal_without_it(self):
+        fc.save({"email": "me@example.com", "updates": True, "followup": True})
+        s = fc.save({"email": "", "updates": True, "followup": True})
+        self.assertEqual((s["email"], s["updates"], s["followup"]), ("", False, False))
+        withdrawal = self.events()[-1]["properties"]
+        self.assertEqual((withdrawal["action"], withdrawal["email"], withdrawal["updates"], withdrawal["followup"]),
+                         ("withdraw", "", False, False))
+        self.assertNotIn("me@example.com", fc.FILE.read_text())
+
+    def test_an_address_still_waiting_is_withdrawn_too(self):
+        with self.offline():
+            fc.save({"email": "me@example.com", "updates": True})  # may already be on its way
+        with mock.patch.object(tm, "post") as post:
+            fc.save({"email": ""})
+        self.assertEqual([c.args[0][0]["properties"]["action"] for c in post.call_args_list], ["withdraw"])
+        self.assertFalse(fc.state()["waiting"])
+
+    def test_offline_the_newest_choice_waits_and_a_withdrawal_is_never_lost(self):
+        fc.save({"email": "me@example.com", "updates": True})
+        with self.offline():
+            s = fc.save({"email": ""})
+            self.assertTrue(s["waiting"])
+            self.assertFalse(fc._send_pending())
+        self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw")
+        self.assertTrue(fc._send_pending())
+        self.assertFalse(fc.state()["waiting"])
+        self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"])
+
+    # ---- the one-time prompt
+
+    def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self):
+        self.assertFalse(fc.state()["showPrompt"])  # a new install: the Frame hasn't connected yet
+        tm.frame_seen("20260901.1", "3.8")
+        self.assertTrue(fc.state()["showPrompt"])
+        fc.prompt({"prompt": "dismissed"})
+        fc.prompt({"prompt": "shown"})  # a later session can't bring it back
+        self.assertEqual(fc.load()["prompt"], "dismissed")
+        self.assertFalse(fc.state()["showPrompt"])
+        self.assertEqual(self.got, [])  # No thanks sends nothing
+        with self.assertRaises(ValueError):
+            fc.prompt({"prompt": "reset"})
+
+    def test_the_prompt_is_shown_once_and_saving_answers_it(self):
+        tm.frame_seen("20260901.1", "3.8")
+        fc.prompt({"prompt": "shown"})
+        self.assertFalse(fc.state()["showPrompt"])
+        fc.save({"email": "me@example.com", "followup": True, "fromPrompt": True})
+        self.assertEqual(fc.load()["prompt"], "answered")
+
+    # ---- reports and the maintainer's list
+
+    def test_a_report_carries_the_address_only_with_follow_up_consent(self):
+        fr.send({**REPORT, "contact": "me@example.com"})
+        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
+        without, with_ = (e["properties"] for e in self.events())
+        self.assertEqual((without["contact"], without["contact_followup"]), ("", False))
+        self.assertEqual((with_["contact"], with_["contact_followup"]), ("me@example.com", True))
+        with self.assertRaisesRegex(ValueError, "email address"):
+            fr.send({**REPORT, "contact": "discord:me", "contactFollowup": True})
+
+    def test_contacts_lists_the_newest_choice_per_copy_by_consent(self):
+        rows = [["a", "both@example.com", True, "true", "2026-09-01T10:00:00Z"],
+                ["b", "news@example.com", "true", False, "2026-09-02T10:00:00Z"],
+                ["c", "", False, False, "2026-09-03T10:00:00Z"],  # withdrawn
+                ["d", "not-an-address", True, True, "2026-09-03T10:00:00Z"], ["short"]]
+        with mock.patch.object(db, "_posthog_query", return_value={"results": rows}) as q:
+            found = fr.contacts()
+        self.assertIn("argMax", q.call_args.args[0])
+        self.assertEqual(found, {"updates": [("both@example.com", "2026-09-01"), ("news@example.com", "2026-09-02")],
+                                 "followup": [("both@example.com", "2026-09-01")]})
+        with mock.patch.object(fr, "contacts", return_value=found), \
+             mock.patch.object(sys, "argv", ["frame_report.py", "contacts", "followup"]), \
+             mock.patch("builtins.print") as out:
+            fr.main()
+        printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args)
+        self.assertIn("both@example.com", printed)
+        self.assertNotIn("news@example.com", printed)
+
+    def test_the_page_can_reach_it(self):
+        import server
+        self.assertIs(server.POST["/api/contact"], fc.save)
+        self.assertIs(server.POST["/api/contact/prompt"], fc.prompt)
+
+
+# Run these once, in test_telemetry, not again through the import above.
+del Base, ReportProblem
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_telemetry.py b/tests/test_telemetry.py
index 4b400c6..71c9f7e 100644
--- a/tests/test_telemetry.py
+++ b/tests/test_telemetry.py
@@ -392,13 +392,14 @@ class ReportProblem(Base):
         got = self.serve()
         tm.update_settings({"usage": False})  # analytics off: a deliberate report still goes
         res = fr.send({"kind": "idea", "title": "Live view stops", "message": "It stops after a minute.",
-                       "contact": "me@example.com"})
+                       "contact": "me@example.com", "contactFollowup": True})
         path, body = got[0]
         event = body["batch"][0]
         self.assertEqual((path, body["api_key"], event["event"]), ("/batch/", "phc_test", "problem_report"))
         props = event["properties"]
         self.assertEqual((props["kind"], props["title"], props["message"], props["contact"], props["report_id"]),
                          ("idea", "Live view stops", "It stops after a minute.", "me@example.com", res["id"]))
+        self.assertIs(props["contact_followup"], True)
         self.assertEqual((props["$process_person_profile"], props["$geoip_disable"]), (False, True))
         self.assertNotEqual(event["distinct_id"], tm.settings()["id"])  # not linked to the analytics
         self.assertIn(res["id"], res["message"])
@@ -421,8 +422,9 @@ class ReportProblem(Base):
 
     def test_the_inbox_skips_malformed_reports(self):
         good = ["2026-09-28T09:50:00Z", "AB12CD34", "bug", "Live view stops", "It stops.", None,
-                "0.4.0", "macOS", "", ""]
-        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None], ["short"], good]
+                "0.4.0", "macOS", "", "", None]
+        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None, None],
+                ["short"], good]
         with mock.patch.object(db, "_posthog_query", return_value={"results": rows}), \
              mock.patch.object(sys, "argv", ["frame_report.py", "inbox"]), \
              mock.patch("builtins.print") as out:
diff --git a/ui/frame_contact.py b/ui/frame_contact.py
new file mode 100644
index 0000000..dbe313b
--- /dev/null
+++ b/ui/frame_contact.py
@@ -0,0 +1,166 @@
+"""An email address the person chooses to leave, and what it may be used for. Python stdlib only.
+
+Two separate opt-in choices, both off until ticked:
+
+- updates: occasional notices about Frame Control releases and updates
+- followup: the maintainer may ask follow-up questions, mainly about problem reports
+
+The address and the choices are kept on this computer (frame_host.data_dir('contact')) and
+sent privately to Frame Control's PostHog project as a `contact_consent` event, the same way
+as problem reports (frame_report.py), so only the maintainer can read them. Every change
+sends a new event under this copy's own random contact id (not the analytics id), and the
+newest event for an id is the one that counts: removing the address sends a withdrawal with
+no address in it. The maintainer lists who agreed to what with
+`python3 ui/frame_report.py contacts`. Nothing here sends email.
+
+A change that can't be sent (offline) waits in the state file and is retried in the
+background, so a withdrawal is never lost. The page's one-time prompt is remembered here
+too: once it has been shown or dismissed it never comes back.
+"""
+import json
+import os
+import re
+import threading
+import time
+import uuid
+
+import frame_host
+import frame_telemetry
+
+STATE = frame_host.data_dir('contact')
+FILE = STATE / 'contact.json'
+EMAIL_MAX = 254
+EMAIL_RE = re.compile(r'[^@\s]+@[^@\s]+\.[^@\s.]+')
+PROMPTS = ('new', 'shown', 'dismissed', 'answered')
+RETRY_EVERY = 600
+
+_lock = threading.RLock()
+_retrier = None
+
+
+def _defaults():
+    return {'id': str(uuid.uuid4()), 'email': '', 'updates': False, 'followup': False,
+            'prompt': 'new', 'pending': None}
+
+
+def load():
+    with _lock:
+        s = _defaults()
+        try:
+            with open(FILE) as f:
+                saved = json.load(f)
+            if isinstance(saved, dict):
+                s.update({k: v for k, v in saved.items() if k in s})
+        except (OSError, ValueError):
+            pass
+        return s
+
+
+def _save(s):
+    STATE.mkdir(parents=True, exist_ok=True)
+    tmp = FILE.with_suffix('.tmp')
+    tmp.write_text(json.dumps(s, indent=1))
+    os.replace(tmp, FILE)
+
+
+def valid_email(email):
+    return len(email) <= EMAIL_MAX and bool(EMAIL_RE.fullmatch(email))
+
+
+def state():
+    """What the page shows. showPrompt: the one-time prompt hasn't been shown or answered yet,
+    and the Frame has connected at least once (setup worked), so it never greets a new install."""
+    s = load()
+    set_up = bool(frame_telemetry.settings().get('frames_seen'))
+    return {'email': s['email'], 'updates': s['updates'], 'followup': s['followup'],
+            'waiting': s['pending'] is not None, 'showPrompt': s['prompt'] == 'new' and set_up}
+
+
+def _event(s):
+    email = s['email'] if s['updates'] or s['followup'] else ''
+    return {'event': 'contact_consent', 'distinct_id': s['id'], 'uuid': str(uuid.uuid4()),
+            'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+            'properties': {**frame_telemetry.common(), 'email': email, 'updates': bool(email and s['updates']),
+                           'followup': bool(email and s['followup']),
+                           'action': 'set' if email else 'withdraw', 'level': 'contact'}}
+
+
+def _send_pending():
+    """Send the waiting change. True if nothing is left waiting."""
+    with _lock:
+        s = load()
+        event = s['pending']
+        if event is None:
+            return True
+    try:
+        frame_telemetry.post([event], timeout=30)
+    except frame_telemetry.SendError:
+        return False
+    with _lock:
+        s = load()
+        if s['pending'] and s['pending'].get('uuid') == event['uuid']:  # not replaced meanwhile
+            s['pending'] = None
+            _save(s)
+    try:
+        frame_telemetry.record_sent([event])
+    except OSError:
+        pass
+    return True
+
+
+def save(body):
+    """Set, change or remove the address and the two choices. An address needs at least one
+    choice ticked; an empty address (or neither ticked) removes it and withdraws both."""
+    email = str(body.get('email') or '').strip()
+    updates, followup = bool(body.get('updates')), bool(body.get('followup'))
+    if email and not valid_email(email):
+        raise ValueError("that doesn't look like an email address")
+    if email and not (updates or followup):
+        raise ValueError('tick what the address may be used for, or remove it')
+    if not email:
+        updates = followup = False
+    with _lock:
+        s = load()
+        changed = (email, updates, followup) != (s['email'], s['updates'], s['followup'])
+        s.update(email=email, updates=updates, followup=followup)
+        if body.get('fromPrompt') or email:
+            s['prompt'] = 'answered'
+        if changed:
+            # Only the newest choice matters, so it replaces anything still waiting. A withdrawal
+            # is sent even for an address still waiting here: its send may already be under way.
+            s['pending'] = _event(s)
+        _save(s)
+    if changed:
+        _send_pending()
+    return state()
+
+
+def prompt(body):
+    """The one-time prompt was shown, or dismissed with No thanks. Either way it stays gone."""
+    action = body.get('prompt')
+    if action not in ('shown', 'dismissed'):
+        raise ValueError('unknown prompt action')
+    with _lock:
+        s = load()
+        if s['prompt'] in ('new', 'shown'):
+            s['prompt'] = action
+            _save(s)
+    return state()
+
+
+def start():
+    """Retry a change that couldn't be sent, from now on in the background."""
+    global _retrier
+    if _retrier:
+        return
+
+    def loop():
+        while True:
+            try:
+                _send_pending()
+            except Exception:
+                pass
+            time.sleep(RETRY_EVERY)
+
+    _retrier = threading.Thread(target=loop, name='contact', daemon=True)
+    _retrier.start()
diff --git a/ui/frame_report.py b/ui/frame_report.py
index ffcfa9d..9134456 100644
--- a/ui/frame_report.py
+++ b/ui/frame_report.py
@@ -6,6 +6,10 @@ project as a `problem_report` event: only the maintainer can read it, and
 nothing is published. It is sent whatever the analytics settings are, because
 the person sends it deliberately. Diagnostics are scrubbed first
 (frame_telemetry.scrub); the person's own words are sent as written.
+
+An email address goes with a report only when the person ticks "may contact me with
+follow-up questions" (contact_followup). Standing choices made in Settings are
+frame_contact.py's `contact_consent` events; `contacts` lists them.
 """
 import os
 import platform
@@ -13,6 +17,7 @@ import sys
 import time
 import uuid
 
+import frame_contact
 import frame_host
 import frame_telemetry
 
@@ -107,9 +112,13 @@ def send(body):
     """Send the report to PostHog. Returns {"id", "message"}; raises ReportError."""
     kind = body.get('kind') if body.get('kind') in KINDS else 'bug'
     title, text, diag = compose(body)
+    followup = bool(body.get('contactFollowup'))
+    contact = str(body.get('contact') or '').strip() if followup else ''
+    if followup and not frame_contact.valid_email(contact):
+        raise ValueError('add your email address for follow-up questions, or untick that box')
     ref = uuid.uuid4().hex[:8].upper()
     props = {**frame_telemetry.common(), 'kind': kind, 'title': title, 'message': text,
-             'contact': str(body.get('contact') or '').strip()[:120], 'diagnostics': diag,
+             'contact': contact, 'contact_followup': followup, 'diagnostics': diag,
              'report_id': ref, 'steamos': str(frame.get('build') or '')[:120], 'level': 'report'}
     # Its own random id: a report can carry contact details, so it isn't linked to this copy's analytics.
     event = {'event': 'problem_report', 'distinct_id': str(uuid.uuid4()), 'uuid': str(uuid.uuid4()),
@@ -135,22 +144,68 @@ def inbox(days=30):
     import frame_compat_db
     res = frame_compat_db._posthog_query(
         "SELECT timestamp, properties.report_id, properties.kind, properties.title, properties.message, "
-        "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics "
+        "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics, "
+        "properties.contact_followup "
         f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {int(days)} DAY "
         "ORDER BY timestamp DESC LIMIT 200")
     return res.get('results') or []
 
 
+def _yes(v):
+    return v is True or str(v).lower() in ('true', '1')
+
+
+def contacts():
+    """{'updates': [(email, since)], 'followup': [...]}: the addresses whose newest
+    contact_consent event agrees to each, oldest first. A withdrawal, or a change to another
+    address, replaces what came before, so withdrawn addresses are never listed."""
+    import frame_compat_db
+    res = frame_compat_db._posthog_query(
+        "SELECT distinct_id, argMax(properties.email, timestamp), argMax(properties.updates, timestamp), "
+        "argMax(properties.followup, timestamp), max(timestamp) FROM events WHERE event = 'contact_consent' "
+        "GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
+    out = {'updates': [], 'followup': []}
+    for row in res.get('results') or []:
+        if not isinstance(row, list) or len(row) != 5:
+            continue
+        _, email, updates, followup, ts = row
+        email = str(email or '').strip()
+        if not frame_contact.valid_email(email):
+            continue
+        for kind, agreed in (('updates', updates), ('followup', followup)):
+            if _yes(agreed):
+                out[kind].append((email, str(ts or '')[:10]))
+    return out
+
+
+USAGE = 'usage: frame_report.py inbox [days] | contacts [updates|followup]'
+
+
 def main():
     cmd, *args = sys.argv[1:] or ['inbox']
+    if cmd == 'contacts':
+        kinds = args[:1] or ['updates', 'followup']
+        if not set(kinds) <= {'updates', 'followup'}:
+            sys.exit(USAGE)
+        found = contacts()
+        for kind in kinds:
+            print(f"== {'Release and update notices' if kind == 'updates' else 'Follow-up questions'}"
+                  f" ({len(found[kind])})")
+            for email, since in found[kind]:
+                print(f"   {email}  (since {since})")
+            print()
+        return
     if cmd != 'inbox':
-        sys.exit('usage: frame_report.py inbox [days]')
+        sys.exit(USAGE)
     for row in inbox(*(args[:1] or [30])):
-        if not isinstance(row, list) or len(row) != 10:
+        if not isinstance(row, list) or len(row) != 11:
             continue
-        ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row)
+        ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row[:10])
+        # Reports from before contact_followup existed only carried an address given for a reply.
+        reply = contact and (row[10] is None or _yes(row[10]))
         print(f"== {ts[:16].replace('T', ' ')}  {ref}  [{kind}] {title}")
-        print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}{', reply to ' + contact if contact else ''}")
+        print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}"
+              f"{', may follow up at ' + contact if reply else ''}")
         print('   ' + text.replace('\n', '\n   '))
         if diag:
             print('   --- diagnostics\n   ' + diag.replace('\n', '\n   '))
diff --git a/ui/index.html b/ui/index.html
index 0d7a686..09512bd 100644
--- a/ui/index.html
+++ b/ui/index.html
@@ -175,7 +175,7 @@
   .seg { display: inline-flex; background: rgba(0,0,0,.3); border-radius: 3px; padding: 2px; }
   .seg button { background: transparent; height: 28px; font-size: 12.5px; letter-spacing: .6px; text-transform: uppercase; }
   .seg button.on { background: var(--btn-hi); color: var(--bright); }
-  input[type=text], input[type=search], input[type=url], input[type=password], textarea { width: 100%; background: rgba(0,0,0,.28); color: var(--text); border: 1px solid transparent;
+  input[type=text], input[type=search], input[type=url], input[type=password], input[type=email], textarea { width: 100%; background: rgba(0,0,0,.28); color: var(--text); border: 1px solid transparent;
                                border-radius: 3px; padding: 9px 11px; font: inherit; }
   textarea { resize: vertical; min-height: 76px; }
   input:focus, textarea:focus { outline: none; border-color: var(--blue); background: rgba(0,0,0,.4); }
@@ -296,6 +296,11 @@
             background: rgba(26,159,255,.12); border-left: 3px solid var(--blue); font-size: 13.5px; line-height: 1.5; }
   .notice .grow { flex: 1; min-width: 260px; }
   .notice .progress { width: 160px; margin-top: 0; display: block; }
+  .contact-opts { display: flex; gap: 6px 18px; flex-wrap: wrap; margin-top: 8px; }
+  .contact-opts label { display: inline-flex; gap: 7px; align-items: center; cursor: pointer; }
+  .contact-opts input { width: 15px; height: 15px; margin: 0; accent-color: var(--blue); }
+  #contactNotice input[type=email] { width: min(320px, 100%); margin-top: 8px; padding: 7px 10px; }
+  #cEmail { max-width: 420px; }
   .popt { display: grid; grid-template-columns: auto 1fr; gap: 4px 10px; align-items: start; margin: 0 0 14px; cursor: pointer; }
   .popt input { margin: 3px 0 0; width: 16px; height: 16px; accent-color: var(--blue); }
   .popt b { font-weight: 600; color: var(--text); }
@@ -674,6 +679,17 @@
     <button class="small" id="noticeMore" title="Also share compatibility results and error details (you can turn either off later)">Share more to help fix problems</button>
     <button class="action small" id="noticeOk">OK</button>
   </div>
+  <form class="notice" id="contactNotice" hidden>
+    <div class="grow"><b>Leave an email address?</b> Optional: Frame Control works the same either way, and
+      you can change or remove it any time in Privacy &amp; updates.
+      <div><input type="email" id="cpEmail" maxlength="254" placeholder="you@example.com" aria-label="Email address" required></div>
+      <div class="contact-opts">
+        <label><input type="checkbox" id="cpUpdates"> Email me about Frame Control updates</label>
+        <label><input type="checkbox" id="cpFollowup"> The maintainer may contact me with follow-up questions</label></div></div>
+    <span class="sub" id="cpMsg" role="status"></span>
+    <button type="button" class="small" id="cpNo">No thanks</button>
+    <button type="submit" class="action small" id="cpSave">Save</button>
+  </form>
   <div class="banner" id="offline" role="alert" hidden>
     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M2 8.5a15 15 0 0 1 20 0M5.5 12a10 10 0 0 1 13 0M9 15.5a5 5 0 0 1 6 0"/><circle cx="12" cy="19" r="1.2" fill="currentColor"/><path d="M3 3l18 18"/></svg>
     <div class="grow"><div class="t" id="offMsg">Can't reach the Frame</div>
@@ -1127,6 +1143,17 @@
         <span class="sub">Error messages and where in Frame Control they happened, with your home
           folder, user name, addresses and keys removed.</span></label>
       <div class="hint" id="tStatus"></div>
+      <h3 style="margin-top:22px">Contact email (optional)</h3>
+      <form id="contactForm">
+        <input type="email" id="cEmail" maxlength="254" placeholder="you@example.com" aria-label="Email address">
+        <div class="contact-opts">
+          <label><input type="checkbox" id="cUpdates"> Email me about Frame Control updates</label>
+          <label><input type="checkbox" id="cFollowup"> The maintainer may contact me with follow-up questions</label></div>
+        <div class="row" style="margin-top:10px"><button type="submit" class="small action" id="cSave">Save</button>
+          <button type="button" class="small" id="cRemove">Remove my email</button></div>
+      </form>
+      <div class="hint" id="cStatus">Sent privately to the Frame Control maintainer, never shared or published.
+        Updates are occasional release notices; follow-up questions are mainly about problem reports you send.</div>
       <details id="tSentBox"><summary>Show what's been sent</summary><div class="sentlog" id="tSent"></div></details>
       <div class="row" style="margin-top:14px"><button class="small action" data-report>Report a problem</button>
         <button class="small" id="updateCheck" hidden>Check for updates</button>
@@ -1234,7 +1261,9 @@
       placeholder="e.g. Installing an APK stops at 'copying to the Frame'"></label>
     <label class="field">What happened?<textarea id="bugText" maxlength="5000" required minlength="10"
       placeholder="What you did, what happened, and what you expected."></textarea></label>
-    <label class="field">How can we reach you? (optional, for a reply)<input type="text" id="bugContact" maxlength="120" placeholder="Email, GitHub or Discord name"></label>
+    <label class="popt"><input type="checkbox" id="bugFollowup"><b>The maintainer may contact me with follow-up questions</b>
+      <span class="sub">Optional. Your email address goes with this report only when this is ticked.</span></label>
+    <label class="field">Your email address<input type="email" id="bugContact" maxlength="254" placeholder="you@example.com" disabled></label>
     <label class="popt"><input type="checkbox" id="bugDiag" checked><b>Include diagnostics</b>
       <span class="sub">Frame Control's version, your OS and the Frame's SteamOS build.</span></label>
     <label class="popt"><input type="checkbox" id="bugLogs"><b>Also include recent activity and the server log</b>
@@ -3964,7 +3993,64 @@ $("noticeMore").onclick = async () => {
   toast("Thanks! Compatibility results and error details will be shared too. Change it any time in Privacy.");
 };
 $("noticeSettings").onclick = () => { $("privacyNotice").hidden = true; location.hash = "#privacy"; };
-loadTelemetry();
+const telemetryLoaded = loadTelemetry();
+
+// ---- contact email: two separate opt-ins (ui/frame_contact.py, docs/privacy.md) ----
+const contact = { email: "", updates: false, followup: false };
+function renderContact(s) {
+  Object.assign(contact, s);
+  $("cEmail").value = s.email; $("cUpdates").checked = s.updates; $("cFollowup").checked = s.followup;
+  $("cRemove").hidden = !s.email;
+  $("cStatus").textContent = s.waiting ? "Saved here; it's sent to the maintainer when Frame Control can reach PostHog."
+    : s.email ? `Saved. ${s.email} may get ${[s.updates && "update notices", s.followup && "follow-up questions"].filter(Boolean).join(" and ")}. Remove it any time.`
+    : "Sent privately to the Frame Control maintainer, never shared or published. Updates are occasional release notices; follow-up questions are mainly about problem reports you send.";
+}
+async function saveContact(change) {
+  const s = await api("/api/contact", change);
+  renderContact(s);
+  return s;
+}
+// One time only, never on top of the privacy notice, and only once the Frame has connected.
+async function loadContact() {
+  await telemetryLoaded;
+  let s;
+  try { s = await api("/api/contact"); } catch { return; }
+  renderContact(s);
+  if (s.showPrompt && $("privacyNotice").hidden) {
+    $("contactNotice").hidden = false;
+    api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
+  }
+}
+$("contactNotice").onsubmit = async e => {
+  e.preventDefault();
+  if (!$("cpUpdates").checked && !$("cpFollowup").checked) { $("cpMsg").textContent = "Tick at least one, or choose No thanks."; return; }
+  $("cpSave").disabled = true;
+  try {
+    await saveContact({ email: $("cpEmail").value, updates: $("cpUpdates").checked, followup: $("cpFollowup").checked, fromPrompt: true });
+    $("contactNotice").hidden = true;
+    toast("Thanks! Change or remove it any time in Privacy & updates.");
+  } catch (err) { $("cpMsg").textContent = `Couldn't save: ${err.message}`; }
+  finally { $("cpSave").disabled = false; }
+};
+$("cpNo").onclick = () => {
+  $("contactNotice").hidden = true;
+  api("/api/contact/prompt", { prompt: "dismissed" }).catch(() => {});
+};
+$("contactForm").onsubmit = async e => {
+  e.preventDefault();
+  const email = $("cEmail").value.trim();
+  if (email && !$("cUpdates").checked && !$("cFollowup").checked) {
+    $("cStatus").textContent = "Tick what your email may be used for, or use Remove my email."; return;
+  }
+  try { await saveContact({ email, updates: $("cUpdates").checked, followup: $("cFollowup").checked });
+        toast(email ? "Contact email saved." : "Contact email removed."); }
+  catch (err) { toast(`Couldn't save: ${err.message}`, true); }
+};
+$("cRemove").onclick = async () => {
+  try { await saveContact({ email: "", updates: false, followup: false }); toast("Contact email removed. Neither choice applies any more."); }
+  catch (err) { toast(`Couldn't remove it: ${err.message}`, true); }
+};
+loadContact();
 function pageEvent(event, properties) {
   if (telemetry.usage && !telemetry.blocked) api("/api/telemetry/event", { event, properties }).catch(() => {});
 }
@@ -3979,8 +4065,8 @@ document.querySelectorAll("nav a").forEach(a => a.addEventListener("click", () =
 const bug = { preview: "" };
 const activityLines = () => [...$("log").children].slice(0, 25).map(el => el.textContent.trim());
 function bugReportText() {
-  const contact = $("bugContact").value.trim();
-  const body = `Kind: ${$("bugKind").value}${contact ? `\nContact: ${contact}` : ""}\n\n${$("bugText").value.trim()}${bug.preview ? "\n\n---\nDiagnostics:\n```\n" + bug.preview + "\n```" : ""}`;
+  const email = $("bugFollowup").checked ? $("bugContact").value.trim() : "";
+  const body = `Kind: ${$("bugKind").value}${email ? `\nFollow-up questions welcome: ${email}` : ""}\n\n${$("bugText").value.trim()}${bug.preview ? "\n\n---\nDiagnostics:\n```\n" + bug.preview + "\n```" : ""}`;
   return { title: $("bugTitleIn").value.trim(), body };
 }
 // The preview is a snapshot: exactly this text is sent, even if more activity happens meanwhile.
@@ -3996,12 +4082,20 @@ function openBugReport() {
   $("bugMsg").textContent = ""; $("bugSend").disabled = false;
   $("bugCancel").textContent = "Cancel";
   $("bugDiagBox").open = false; $("bugLogs").disabled = false;
+  // A standing yes to follow-up questions (Privacy & updates) fills this in; it can be unticked.
+  $("bugFollowup").checked = contact.followup; $("bugContact").value = contact.followup ? contact.email : "";
+  $("bugContact").disabled = !contact.followup; $("bugContact").required = contact.followup;
   $("bugDlg").showModal();
   loadBugPreview();
 }
 document.body.addEventListener("click", e => { if (e.target.closest("[data-report]")) openBugReport(); });
 $("bugDiag").onchange = () => { $("bugLogs").disabled = !$("bugDiag").checked; loadBugPreview(); };
 $("bugLogs").onchange = loadBugPreview;
+$("bugFollowup").onchange = () => {
+  const on = $("bugFollowup").checked;
+  $("bugContact").disabled = !on; $("bugContact").required = on;
+  if (on && !$("bugContact").value) { $("bugContact").value = contact.email; $("bugContact").focus(); }
+};
 $("bugCancel").onclick = () => $("bugDlg").close();
 $("bugCopy").onclick = async () => {
   const { title, body } = bugReportText();
@@ -4015,7 +4109,8 @@ $("bugForm").onsubmit = async e => {
   try {
     const res = await api("/api/report", {
       kind: $("bugKind").value, title: $("bugTitleIn").value, message: $("bugText").value,
-      contact: $("bugContact").value, diagnostics: $("bugDiag").checked ? bug.preview : "" });
+      contactFollowup: $("bugFollowup").checked, contact: $("bugFollowup").checked ? $("bugContact").value : "",
+      diagnostics: $("bugDiag").checked ? bug.preview : "" });
     $("bugMsg").textContent = `Sent, thank you. Your reference is ${res.id}.`;
     $("bugCancel").textContent = "Close";
     log(res.message, "ok");
diff --git a/ui/server.py b/ui/server.py
index 7771b72..5dfa19f 100755
--- a/ui/server.py
+++ b/ui/server.py
@@ -50,6 +50,7 @@ import frame_catalog  # noqa: E402
 import frame_devices  # noqa: E402
 import frame_steamgriddb
 import frame_comfort  # noqa: E402
+import frame_contact  # noqa: E402
 import frame_host  # noqa: E402
 import frame_link  # noqa: E402
 import frame_macview  # noqa: E402
@@ -2151,6 +2152,7 @@ POST = {
         "/api/webinstall/check": webinstall_check, "/api/webinstall/start": webinstall_start,
         "/api/webinstall/cancel": webinstall_cancel,
         "/api/telemetry": frame_telemetry.update_settings, "/api/telemetry/event": frame_telemetry.page_event,
+        "/api/contact": frame_contact.save, "/api/contact/prompt": frame_contact.prompt,
         "/api/report/preview": report_preview, "/api/report": report_send, "/api/macview": macview_action, "/api/panels": panels_action,
         "/api/devices": lambda body: devices_post(body)}
 
@@ -2380,6 +2382,8 @@ class Handler(BaseHTTPRequestHandler):
                 self.send_json(macview_state(parse_qs(url.query)))
             elif path == "/api/telemetry":
                 self.send_json(frame_telemetry.state())
+            elif path == "/api/contact":
+                self.send_json(frame_contact.state())
             elif path == "/api/computer/state":
                 self.send_json(json.loads(ssh("python3 -", stdin=(HERE / "frame_computer.py").read_text(), timeout=20)))
             elif path == "/api/status":
@@ -2644,6 +2648,7 @@ def main():
     sweep_tmp()
     threading.Thread(target=apk_search.warm, daemon=True).start()  # big indexes download before the first search
     frame_telemetry.start()
+    frame_contact.start()
     global LINK, _ONE_SERVER
     if not LOCAL:
         if not PRIVATE:  # a private server only uses the headsets (see one_server)

From b8ed53f2ffc4222ae312b778bfe4b77e293878d4 Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:22:45 +1000
Subject: [PATCH 2/5] Contact email: newest choice wins by rev, removal wipes
 the local log

Review follow-ups:
- Each contact_consent event carries a rev that goes up with every change,
  sends are serialized, and `contacts` picks every field from the highest
  rev per copy, so a withdrawal can't lose to an earlier event sent in the
  same second or with a skewed clock.
- Removing the address also replaces it with <removed> in the local
  sent log (earlier contact events and problem reports).
- The prompt is rechecked when the Frame connects, not only at page load.
- No thanks hides the bar only once the dismissal is saved.
- docs/privacy.md: say that the analytics switches don't block a report or
  contact change the person sends deliberately.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/privacy.md       | 18 +++++++++----
 tests/test_contact.py | 50 +++++++++++++++++++++++++++++++++-
 ui/frame_contact.py   | 63 +++++++++++++++++++++++++++++++------------
 ui/frame_report.py    | 11 +++++---
 ui/index.html         | 24 ++++++++++-------
 5 files changed, 129 insertions(+), 37 deletions(-)

diff --git a/docs/privacy.md b/docs/privacy.md
index 4edda2e..5619075 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -141,7 +141,8 @@ are two separate choices, both off until you tick them:
 | **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
 
 You're asked once, in a bar at the top of the page, after the Frame has
-connected for the first time. **No thanks** hides it for good, and it isn't
+connected for the first time (never while the first-run privacy notice is
+showing). **No thanks** hides it for good, and it isn't
 shown again even if you ignore it. **Contact email** in **Privacy & updates**
 is where you add, change or remove the address and either choice at any time.
 
@@ -152,13 +153,16 @@ or `withdraw`) and the common properties above. Only the maintainer can read
 that project, and nothing in it is published or shared. It's sent only when
 you save, whatever the analytics settings are, because you chose to. It
 carries its own random contact id, not the analytics id, so it isn't linked
-to your usage events. On this computer the address and choices are kept in
+to your usage events, and a `rev` number that goes up with each change, so
+the newest choice always wins. Like everything else sent, it's listed under
+**Show what's been sent**. On this computer the address and choices are kept in
 `contact/contact.json` in Frame Control's data folder. An address is only
 kept with at least one choice ticked.
 
 **Removing it.** **Remove my email** (or clearing the address and saving)
-deletes it from this computer and sends a `withdraw` event with no address in
-it. The maintainer's list only uses the newest event from each copy, so from
+deletes it from this computer, including from the **Show what's been sent**
+log (in earlier contact events and problem reports), and sends a `withdraw`
+event with no address in it. The maintainer's list only uses the newest event from each copy, so from
 then on the address isn't listed for either choice. Unticking one choice
 works the same way for that choice. If you're offline, the change waits on
 this computer and is sent when PostHog can be reached. The earlier event
@@ -174,7 +178,11 @@ personal API key as `inbox`.
 
 Untick the boxes, or set `DO_NOT_TRACK=1` or `FRAME_CONTROL_TELEMETRY=0` in
 the environment that starts Frame Control. A copy run from a source checkout
-never sends anything unless `FRAME_CONTROL_TELEMETRY=1` is set.
+never sends analytics unless `FRAME_CONTROL_TELEMETRY=1` is set.
+
+These switches cover the analytics above. A problem report or a contact email
+is only ever sent when you press its Send or Save button, so those still go
+when you choose to send them; if you don't, nothing is sent.
 
 ## Update checks
 
diff --git a/tests/test_contact.py b/tests/test_contact.py
index c775541..330fb3a 100644
--- a/tests/test_contact.py
+++ b/tests/test_contact.py
@@ -5,6 +5,8 @@ Run: python3 -m unittest discover -s tests
 """
 import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import sys
+import threading
+import time
 import unittest
 from pathlib import Path
 from unittest import mock
@@ -110,6 +112,51 @@ class Contact(Base):
         self.assertFalse(fc.state()["waiting"])
         self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"])
 
+    def test_removing_the_address_wipes_it_from_the_sent_log_too(self):
+        fc.save({"email": "me@example.com", "followup": True})
+        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
+        self.assertIn("me@example.com", tm.SENT.read_text())
+        fc.save({"email": ""})
+        self.assertNotIn("me@example.com", tm.SENT.read_text())
+        self.assertEqual([e["properties"].get("action") for e in tm._read_lines(tm.SENT)
+                          if e["event"] == "contact_consent"], ["set", "withdraw"])
+
+    def test_each_change_has_a_higher_rev_so_the_newest_wins_whatever_the_clock(self):
+        fc.save({"email": "me@example.com", "updates": True})
+        fc.save({"email": "new@example.com", "updates": True})
+        fc.save({"email": ""})
+        self.assertEqual([e["properties"]["rev"] for e in self.events()], [1, 2, 3])
+
+    def test_a_withdrawal_during_a_send_goes_after_it(self):
+        started, release, order = threading.Event(), threading.Event(), []
+        real = tm.post
+
+        def slow(batch, timeout=20):
+            order.append(batch[0]["properties"]["action"])
+            if len(order) == 1:
+                started.set()
+                release.wait(5)
+            real(batch, timeout)
+
+        with mock.patch.object(tm, "post", side_effect=slow):
+            t = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},))
+            t.start()
+            self.assertTrue(started.wait(5))
+            w = threading.Thread(target=fc.save, args=({"email": ""},))
+            w.start()
+            for _ in range(500):  # the withdrawal is saved while the first send is still out
+                if fc.load()["rev"] == 2:
+                    break
+                time.sleep(0.01)
+            self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw")
+            release.set()
+            t.join(5)
+            w.join(5)
+        self.assertEqual(order, ["set", "withdraw"])
+        self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"])
+        self.assertFalse(fc.state()["waiting"])
+        self.assertNotIn("me@example.com", tm.SENT.read_text())
+
     # ---- the one-time prompt
 
     def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self):
@@ -149,7 +196,8 @@ class Contact(Base):
                 ["d", "not-an-address", True, True, "2026-09-03T10:00:00Z"], ["short"]]
         with mock.patch.object(db, "_posthog_query", return_value={"results": rows}) as q:
             found = fr.contacts()
-        self.assertIn("argMax", q.call_args.args[0])
+        self.assertIn("argMax(properties.email, tuple(ifNull(toInt(properties.rev), 0), timestamp))",
+                      q.call_args.args[0])
         self.assertEqual(found, {"updates": [("both@example.com", "2026-09-01"), ("news@example.com", "2026-09-02")],
                                  "followup": [("both@example.com", "2026-09-01")]})
         with mock.patch.object(fr, "contacts", return_value=found), \
diff --git a/ui/frame_contact.py b/ui/frame_contact.py
index dbe313b..0a7eb87 100644
--- a/ui/frame_contact.py
+++ b/ui/frame_contact.py
@@ -8,9 +8,10 @@ Two separate opt-in choices, both off until ticked:
 The address and the choices are kept on this computer (frame_host.data_dir('contact')) and
 sent privately to Frame Control's PostHog project as a `contact_consent` event, the same way
 as problem reports (frame_report.py), so only the maintainer can read them. Every change
-sends a new event under this copy's own random contact id (not the analytics id), and the
-newest event for an id is the one that counts: removing the address sends a withdrawal with
-no address in it. The maintainer lists who agreed to what with
+sends a new event under this copy's own random contact id (not the analytics id), numbered
+by `rev`, and the highest rev for an id is the one that counts, whatever the clocks say:
+removing the address sends a withdrawal with no address in it, and wipes the address from
+the local log of what was sent. The maintainer lists who agreed to what with
 `python3 ui/frame_report.py contacts`. Nothing here sends email.
 
 A change that can't be sent (offline) waits in the state file and is retried in the
@@ -35,12 +36,13 @@ PROMPTS = ('new', 'shown', 'dismissed', 'answered')
 RETRY_EVERY = 600
 
 _lock = threading.RLock()
+_send_lock = threading.Lock()  # one send at a time, so events reach PostHog in rev order
 _retrier = None
 
 
 def _defaults():
     return {'id': str(uuid.uuid4()), 'email': '', 'updates': False, 'followup': False,
-            'prompt': 'new', 'pending': None}
+            'prompt': 'new', 'pending': None, 'rev': 0}
 
 
 def load():
@@ -82,30 +84,50 @@ def _event(s):
             'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
             'properties': {**frame_telemetry.common(), 'email': email, 'updates': bool(email and s['updates']),
                            'followup': bool(email and s['followup']),
-                           'action': 'set' if email else 'withdraw', 'level': 'contact'}}
+                           'action': 'set' if email else 'withdraw', 'rev': s['rev'], 'level': 'contact'}}
 
 
 def _send_pending():
     """Send the waiting change. True if nothing is left waiting."""
-    with _lock:
-        s = load()
-        event = s['pending']
+    with _send_lock:
+        with _lock:
+            event = load()['pending']
         if event is None:
             return True
-    try:
-        frame_telemetry.post([event], timeout=30)
-    except frame_telemetry.SendError:
-        return False
+        try:
+            frame_telemetry.post([event], timeout=30)
+        except frame_telemetry.SendError:
+            return False
+        _sent(event)
+    return True
+
+
+def _sent(event):
     with _lock:
         s = load()
         if s['pending'] and s['pending'].get('uuid') == event['uuid']:  # not replaced meanwhile
             s['pending'] = None
             _save(s)
-    try:
-        frame_telemetry.record_sent([event])
-    except OSError:
-        pass
-    return True
+        # A withdrawal, or the address still in use: not an old one removed while this was on its way.
+        if event['properties']['email'] in ('', s['email']):
+            try:
+                frame_telemetry.record_sent([event])
+            except OSError:
+                pass
+
+
+def _forget_locally(email):
+    """Take a removed address out of the log of what was sent (contact events and reports)."""
+    with frame_telemetry._lock:
+        rows = frame_telemetry._read_lines(frame_telemetry.SENT)
+        hit = False
+        for e in rows:
+            p = e.get('properties') or {}
+            for k in ('email', 'contact'):
+                if p.get(k) and str(p[k]).strip().lower() == email.lower():
+                    p[k], hit = '<removed>', True
+        if hit:
+            frame_telemetry._write_lines(frame_telemetry.SENT, rows)
 
 
 def save(body):
@@ -121,6 +143,7 @@ def save(body):
         updates = followup = False
     with _lock:
         s = load()
+        old = s['email']
         changed = (email, updates, followup) != (s['email'], s['updates'], s['followup'])
         s.update(email=email, updates=updates, followup=followup)
         if body.get('fromPrompt') or email:
@@ -128,8 +151,14 @@ def save(body):
         if changed:
             # Only the newest choice matters, so it replaces anything still waiting. A withdrawal
             # is sent even for an address still waiting here: its send may already be under way.
+            s['rev'] += 1
             s['pending'] = _event(s)
         _save(s)
+        if old and old.lower() != email.lower():
+            try:
+                _forget_locally(old)
+            except OSError:
+                pass
     if changed:
         _send_pending()
     return state()
diff --git a/ui/frame_report.py b/ui/frame_report.py
index 9134456..a39d36d 100644
--- a/ui/frame_report.py
+++ b/ui/frame_report.py
@@ -158,12 +158,15 @@ def _yes(v):
 def contacts():
     """{'updates': [(email, since)], 'followup': [...]}: the addresses whose newest
     contact_consent event agrees to each, oldest first. A withdrawal, or a change to another
-    address, replaces what came before, so withdrawn addresses are never listed."""
+    address, replaces what came before, so withdrawn addresses are never listed. "Newest" is
+    the highest rev from that copy (then time), so every field comes from the same event
+    whatever order they arrived in or what the clocks said."""
     import frame_compat_db
+    newest = "tuple(ifNull(toInt(properties.rev), 0), timestamp)"
     res = frame_compat_db._posthog_query(
-        "SELECT distinct_id, argMax(properties.email, timestamp), argMax(properties.updates, timestamp), "
-        "argMax(properties.followup, timestamp), max(timestamp) FROM events WHERE event = 'contact_consent' "
-        "GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
+        f"SELECT distinct_id, argMax(properties.email, {newest}), argMax(properties.updates, {newest}), "
+        f"argMax(properties.followup, {newest}), argMax(timestamp, {newest}) FROM events "
+        "WHERE event = 'contact_consent' GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
     out = {'updates': [], 'followup': []}
     for row in res.get('results') or []:
         if not isinstance(row, list) or len(row) != 5:
diff --git a/ui/index.html b/ui/index.html
index 09512bd..df27d06 100644
--- a/ui/index.html
+++ b/ui/index.html
@@ -4010,16 +4010,20 @@ async function saveContact(change) {
   renderContact(s);
   return s;
 }
-// One time only, never on top of the privacy notice, and only once the Frame has connected.
 async function loadContact() {
   await telemetryLoaded;
+  try { renderContact(await api("/api/contact")); } catch { return; }
+  checkContactPrompt();
+}
+// One time only, never on top of the privacy notice, and only once the Frame has connected:
+// checked at load and again whenever the Frame connects.
+async function checkContactPrompt() {
+  if (!$("contactNotice").hidden || !$("privacyNotice").hidden) return;
   let s;
   try { s = await api("/api/contact"); } catch { return; }
-  renderContact(s);
-  if (s.showPrompt && $("privacyNotice").hidden) {
-    $("contactNotice").hidden = false;
-    api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
-  }
+  if (!s.showPrompt) return;
+  $("contactNotice").hidden = false;
+  api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
 }
 $("contactNotice").onsubmit = async e => {
   e.preventDefault();
@@ -4032,9 +4036,9 @@ $("contactNotice").onsubmit = async e => {
   } catch (err) { $("cpMsg").textContent = `Couldn't save: ${err.message}`; }
   finally { $("cpSave").disabled = false; }
 };
-$("cpNo").onclick = () => {
-  $("contactNotice").hidden = true;
-  api("/api/contact/prompt", { prompt: "dismissed" }).catch(() => {});
+$("cpNo").onclick = async () => {
+  try { await api("/api/contact/prompt", { prompt: "dismissed" }); $("contactNotice").hidden = true; }
+  catch (err) { $("cpMsg").textContent = `Couldn't save that: ${err.message}. Try again.`; }
 };
 $("contactForm").onsubmit = async e => {
   e.preventDefault();
@@ -4418,7 +4422,7 @@ function onConnection(s) {
       $("offline").hidden = true;
       const reload = link.reload;
       link.reload = false;
-      refresh().then(() => { if (reload) reloadAll(); });
+      refresh().then(() => { if (reload) reloadAll(); checkContactPrompt(); });
     } else if (s.phase === "failed" && s.error) {
       setOnline(false, s.error.message);
     } else if (s.phase === "connecting" && prev && prev.phase === "connected") {

From 3f0f09b138ac26507be39b487de26f32c82c0ad6 Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:29:17 +1000
Subject: [PATCH 3/5] Contact email: don't block Save on a slow send; redact
 reports still in flight

Second review follow-ups:
- Saving returns once the choice is stored; a send already under way picks up
  the newest change, or the background retry is woken.
- A problem report still being sent when its address is removed is logged as
  <removed>, checked under the same lock the removal holds.
- The prompt re-checks the privacy notice after fetching its state.
- docs/privacy.md: offline contact changes are sent later by themselves; the
  prompt never follows straight after the privacy notice.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/privacy.md       |  9 +++----
 tests/test_contact.py | 28 ++++++++++++++++++++++
 ui/frame_contact.py   | 56 ++++++++++++++++++++++++++++++-------------
 ui/frame_report.py    |  4 +++-
 ui/index.html         |  6 ++---
 5 files changed, 79 insertions(+), 24 deletions(-)

diff --git a/docs/privacy.md b/docs/privacy.md
index 5619075..1ec1755 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -141,8 +141,8 @@ are two separate choices, both off until you tick them:
 | **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
 
 You're asked once, in a bar at the top of the page, after the Frame has
-connected for the first time (never while the first-run privacy notice is
-showing). **No thanks** hides it for good, and it isn't
+connected for the first time, and never while or straight after the
+first-run privacy notice is showing. **No thanks** hides it for good, and it isn't
 shown again even if you ignore it. **Contact email** in **Privacy & updates**
 is where you add, change or remove the address and either choice at any time.
 
@@ -181,8 +181,9 @@ the environment that starts Frame Control. A copy run from a source checkout
 never sends analytics unless `FRAME_CONTROL_TELEMETRY=1` is set.
 
 These switches cover the analytics above. A problem report or a contact email
-is only ever sent when you press its Send or Save button, so those still go
-when you choose to send them; if you don't, nothing is sent.
+is sent only because you pressed its Send or Save button, so those still go
+when you choose to send them (a contact change saved while offline is sent
+by itself once PostHog can be reached); if you don't, nothing is sent.
 
 ## Update checks
 
diff --git a/tests/test_contact.py b/tests/test_contact.py
index 330fb3a..52fe010 100644
--- a/tests/test_contact.py
+++ b/tests/test_contact.py
@@ -30,6 +30,7 @@ class Contact(Base):
 
     def setUp(self):
         super().setUp()
+        self.addCleanup(fc._removed.clear)
         for name, value in (("STATE", tm.STATE / "contact"), ("FILE", tm.STATE / "contact" / "contact.json")):
             p = mock.patch.object(fc, name, value)
             p.start()
@@ -157,6 +158,33 @@ class Contact(Base):
         self.assertFalse(fc.state()["waiting"])
         self.assertNotIn("me@example.com", tm.SENT.read_text())
 
+    def test_a_report_still_sending_when_its_address_is_removed_is_logged_without_it(self):
+        fc.save({"email": "me@example.com", "followup": True})
+        real = tm.post
+
+        def remove_meanwhile(batch, timeout=20):
+            real(batch, timeout)
+            fc.save({"email": ""})  # removed while the report is on its way, before it's logged
+
+        with mock.patch.object(tm, "post", side_effect=remove_meanwhile):
+            fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
+        self.assertNotIn("me@example.com", tm.SENT.read_text())
+        fc._removed.clear()
+        fr.send({**REPORT, "contact": "other@example.com", "contactFollowup": True})
+        self.assertIn("other@example.com", tm.SENT.read_text())  # other reports are logged as sent
+
+    def test_saving_during_a_slow_send_returns_at_once(self):
+        busy = fc._send_lock
+        busy.acquire()
+        try:
+            s = fc.save({"email": "me@example.com", "updates": True})
+        finally:
+            busy.release()
+        self.assertTrue(s["waiting"])  # left for the send under way (or the retry) to take
+        self.assertEqual(self.got, [])
+        self.assertTrue(fc._send_pending())
+        self.assertEqual(len(self.got), 1)
+
     # ---- the one-time prompt
 
     def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self):
diff --git a/ui/frame_contact.py b/ui/frame_contact.py
index 0a7eb87..3586337 100644
--- a/ui/frame_contact.py
+++ b/ui/frame_contact.py
@@ -18,6 +18,7 @@ A change that can't be sent (offline) waits in the state file and is retried in
 background, so a withdrawal is never lost. The page's one-time prompt is remembered here
 too: once it has been shown or dismissed it never comes back.
 """
+import calendar
 import json
 import os
 import re
@@ -37,6 +38,8 @@ RETRY_EVERY = 600
 
 _lock = threading.RLock()
 _send_lock = threading.Lock()  # one send at a time, so events reach PostHog in rev order
+_removed = {}  # address (lower case) -> when it was removed, for reports still being sent then
+_wake = threading.Event()
 _retrier = None
 
 
@@ -87,19 +90,24 @@ def _event(s):
                            'action': 'set' if email else 'withdraw', 'rev': s['rev'], 'level': 'contact'}}
 
 
-def _send_pending():
-    """Send the waiting change. True if nothing is left waiting."""
-    with _send_lock:
-        with _lock:
-            event = load()['pending']
-        if event is None:
-            return True
-        try:
-            frame_telemetry.post([event], timeout=30)
-        except frame_telemetry.SendError:
-            return False
-        _sent(event)
-    return True
+def _send_pending(block=True):
+    """Send what's waiting, including changes made while sending. True if nothing is left
+    waiting. Without block, a send already under way is left to pick up the newest change."""
+    if not _send_lock.acquire(blocking=block):
+        return False
+    try:
+        while True:
+            with _lock:
+                event = load()['pending']
+            if event is None:
+                return True
+            try:
+                frame_telemetry.post([event], timeout=30)
+            except frame_telemetry.SendError:
+                return False
+            _sent(event)
+    finally:
+        _send_lock.release()
 
 
 def _sent(event):
@@ -119,6 +127,7 @@ def _sent(event):
 def _forget_locally(email):
     """Take a removed address out of the log of what was sent (contact events and reports)."""
     with frame_telemetry._lock:
+        _removed[email.lower()] = time.time()
         rows = frame_telemetry._read_lines(frame_telemetry.SENT)
         hit = False
         for e in rows:
@@ -130,6 +139,20 @@ def _forget_locally(email):
             frame_telemetry._write_lines(frame_telemetry.SENT, rows)
 
 
+def redact_removed(event):
+    """Before logging a report sent while its address was being removed: take the address out.
+    Call with frame_telemetry._lock held, so a removal can't slip between this and the log."""
+    p = event.get('properties') or {}
+    removed_at = _removed.get(str(p.get('contact') or '').strip().lower())
+    if removed_at is not None:
+        try:
+            started = calendar.timegm(time.strptime(event['timestamp'], '%Y-%m-%dT%H:%M:%SZ'))
+        except (KeyError, ValueError):
+            started = 0
+        if started <= removed_at:
+            p['contact'] = '<removed>'
+
+
 def save(body):
     """Set, change or remove the address and the two choices. An address needs at least one
     choice ticked; an empty address (or neither ticked) removes it and withdraws both."""
@@ -159,8 +182,8 @@ def save(body):
                 _forget_locally(old)
             except OSError:
                 pass
-    if changed:
-        _send_pending()
+    if changed and not _send_pending(block=False):
+        _wake.set()  # offline, or a send under way that will take this change with it
     return state()
 
 
@@ -189,7 +212,8 @@ def start():
                 _send_pending()
             except Exception:
                 pass
-            time.sleep(RETRY_EVERY)
+            _wake.wait(RETRY_EVERY)
+            _wake.clear()
 
     _retrier = threading.Thread(target=loop, name='contact', daemon=True)
     _retrier.start()
diff --git a/ui/frame_report.py b/ui/frame_report.py
index a39d36d..1c3f8f2 100644
--- a/ui/frame_report.py
+++ b/ui/frame_report.py
@@ -128,7 +128,9 @@ def send(body):
     except frame_telemetry.SendError as e:
         raise ReportError(str(e))
     try:
-        frame_telemetry.record_sent([event])
+        with frame_telemetry._lock:  # the lock a removal holds while wiping its address
+            frame_contact.redact_removed(event)
+            frame_telemetry.record_sent([event])
     except OSError:
         pass  # it was sent; failing to log it here mustn't make the person send it again
     return {'id': ref, 'message': f'Sent privately to the Frame Control developer (report {ref}).'}
diff --git a/ui/index.html b/ui/index.html
index df27d06..972a867 100644
--- a/ui/index.html
+++ b/ui/index.html
@@ -4015,13 +4015,13 @@ async function loadContact() {
   try { renderContact(await api("/api/contact")); } catch { return; }
   checkContactPrompt();
 }
-// One time only, never on top of the privacy notice, and only once the Frame has connected:
-// checked at load and again whenever the Frame connects.
+// One time only, only once the Frame has connected, and never on top of the privacy notice or
+// straight after it (two asks in a row is nagging): checked at load and whenever the Frame connects.
 async function checkContactPrompt() {
   if (!$("contactNotice").hidden || !$("privacyNotice").hidden) return;
   let s;
   try { s = await api("/api/contact"); } catch { return; }
-  if (!s.showPrompt) return;
+  if (!s.showPrompt || !$("contactNotice").hidden || !$("privacyNotice").hidden) return;
   $("contactNotice").hidden = false;
   api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
 }

From cf2db32721b29c8084a591c2f7a81104896f97ab Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:35:25 +1000
Subject: [PATCH 4/5] Contact email: don't strand a change saved as a send
 finishes; time reports exactly

Third review follow-ups:
- A sender that found nothing waiting checks again after letting go of the
  send lock, so a change saved in that moment is sent, not left for a retrier.
- A report is compared with a removal using its full-precision start time, so
  a report sent after the address was removed is logged as sent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 tests/test_contact.py | 27 ++++++++++++++++++++++++---
 ui/frame_contact.py   | 23 +++++++++++------------
 ui/frame_report.py    |  3 ++-
 3 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/tests/test_contact.py b/tests/test_contact.py
index 52fe010..de84848 100644
--- a/tests/test_contact.py
+++ b/tests/test_contact.py
@@ -169,9 +169,8 @@ class Contact(Base):
         with mock.patch.object(tm, "post", side_effect=remove_meanwhile):
             fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
         self.assertNotIn("me@example.com", tm.SENT.read_text())
-        fc._removed.clear()
-        fr.send({**REPORT, "contact": "other@example.com", "contactFollowup": True})
-        self.assertIn("other@example.com", tm.SENT.read_text())  # other reports are logged as sent
+        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
+        self.assertIn("me@example.com", tm.SENT.read_text())  # sent again after removal: logged as sent
 
     def test_saving_during_a_slow_send_returns_at_once(self):
         busy = fc._send_lock
@@ -185,6 +184,28 @@ class Contact(Base):
         self.assertTrue(fc._send_pending())
         self.assertEqual(len(self.got), 1)
 
+    def test_a_change_saved_as_a_send_finishes_is_not_left_behind(self):
+        real = fc._send_lock
+
+        class Lock:  # a Save lands after the sender found nothing waiting, before it lets go
+            saved = False
+
+            def acquire(self, blocking=True):
+                return real.acquire(blocking)
+
+            def release(self):
+                if not Lock.saved:
+                    Lock.saved = True
+                    s = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},))
+                    s.start()
+                    s.join(5)
+                real.release()
+
+        with mock.patch.object(fc, "_send_lock", Lock()):
+            self.assertTrue(fc._send_pending())
+        self.assertEqual([e["properties"]["email"] for e in self.events()], ["me@example.com"])
+        self.assertFalse(fc.state()["waiting"])
+
     # ---- the one-time prompt
 
     def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self):
diff --git a/ui/frame_contact.py b/ui/frame_contact.py
index 3586337..c79e2c1 100644
--- a/ui/frame_contact.py
+++ b/ui/frame_contact.py
@@ -18,7 +18,6 @@ A change that can't be sent (offline) waits in the state file and is retried in
 background, so a withdrawal is never lost. The page's one-time prompt is remembered here
 too: once it has been shown or dismissed it never comes back.
 """
-import calendar
 import json
 import os
 import re
@@ -100,7 +99,7 @@ def _send_pending(block=True):
             with _lock:
                 event = load()['pending']
             if event is None:
-                return True
+                break
             try:
                 frame_telemetry.post([event], timeout=30)
             except frame_telemetry.SendError:
@@ -108,6 +107,10 @@ def _send_pending(block=True):
             _sent(event)
     finally:
         _send_lock.release()
+    # A change saved just as this finished found the lock still held and left it to us.
+    with _lock:
+        left = load()['pending'] is not None
+    return _send_pending(block=False) if left else True
 
 
 def _sent(event):
@@ -139,18 +142,14 @@ def _forget_locally(email):
             frame_telemetry._write_lines(frame_telemetry.SENT, rows)
 
 
-def redact_removed(event):
-    """Before logging a report sent while its address was being removed: take the address out.
-    Call with frame_telemetry._lock held, so a removal can't slip between this and the log."""
+def redact_removed(event, started):
+    """Before logging a report (started at time.time() `started`) whose address was removed
+    while it was being sent: take the address out. Call with frame_telemetry._lock held, so a
+    removal can't slip between this and the log."""
     p = event.get('properties') or {}
     removed_at = _removed.get(str(p.get('contact') or '').strip().lower())
-    if removed_at is not None:
-        try:
-            started = calendar.timegm(time.strptime(event['timestamp'], '%Y-%m-%dT%H:%M:%SZ'))
-        except (KeyError, ValueError):
-            started = 0
-        if started <= removed_at:
-            p['contact'] = '<removed>'
+    if removed_at is not None and started <= removed_at:
+        p['contact'] = '<removed>'
 
 
 def save(body):
diff --git a/ui/frame_report.py b/ui/frame_report.py
index 1c3f8f2..25b887c 100644
--- a/ui/frame_report.py
+++ b/ui/frame_report.py
@@ -123,13 +123,14 @@ def send(body):
     # Its own random id: a report can carry contact details, so it isn't linked to this copy's analytics.
     event = {'event': 'problem_report', 'distinct_id': str(uuid.uuid4()), 'uuid': str(uuid.uuid4()),
              'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()), 'properties': props}
+    started = time.time()
     try:
         frame_telemetry.post([event], timeout=30)
     except frame_telemetry.SendError as e:
         raise ReportError(str(e))
     try:
         with frame_telemetry._lock:  # the lock a removal holds while wiping its address
-            frame_contact.redact_removed(event)
+            frame_contact.redact_removed(event, started)
             frame_telemetry.record_sent([event])
     except OSError:
         pass  # it was sent; failing to log it here mustn't make the person send it again

From 2ca0e6924a52a7dcee7d551affcdaffbbc58c33b Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:38:54 +1000
Subject: [PATCH 5/5] Contact email tests: pin the in-gap save and same-second
 report timing

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 tests/test_contact.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/test_contact.py b/tests/test_contact.py
index de84848..8c2234a 100644
--- a/tests/test_contact.py
+++ b/tests/test_contact.py
@@ -172,6 +172,15 @@ class Contact(Base):
         fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
         self.assertIn("me@example.com", tm.SENT.read_text())  # sent again after removal: logged as sent
 
+    def test_only_reports_started_before_the_removal_are_redacted_even_within_a_second(self):
+        fc._removed["me@example.com"] = 1790000000.3
+        event = lambda: {"timestamp": "2026-09-21T12:53:20Z", "properties": {"contact": "me@example.com"}}
+        before, after = event(), event()  # the same whole second as the removal
+        fc.redact_removed(before, 1790000000.1)
+        fc.redact_removed(after, 1790000000.6)
+        self.assertEqual((before["properties"]["contact"], after["properties"]["contact"]),
+                         ("<removed>", "me@example.com"))
+
     def test_saving_during_a_slow_send_returns_at_once(self):
         busy = fc._send_lock
         busy.acquire()
@@ -199,6 +208,7 @@ class Contact(Base):
                     s = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},))
                     s.start()
                     s.join(5)
+                    assert not s.is_alive()  # the change is saved while the sender still holds the lock
                 real.release()
 
         with mock.patch.object(fc, "_send_lock", Lock()):