Optin Form Preflight

The harness intercepts fetch, so nothing reaches AWS and no Klaviyo contact is created. Serve it over HTTP rather than opening the file directly — the scenarios are driven by query parameters.

• Serve optin/form/ locally

  python3 -m http.server 8765 --directory \
    ~/Desktop/TSS/tss-forms/optin/form

• Open the dashboard on a clean store

  http://localhost:8765/_test-harness.html — use a private window, or expect keys from other projects. localStorage is shared by port, not by directory, so anything ever served on 8765 shares this store. The harness counts foreign keys separately rather than showing them.

Default mode — the frames load ss-optin-form.js, the file you edited. Watch the console strip at the bottom of the dashboard; each submission reports endpoint, payload, redirect and storage.

• 2Scheduled slot writes the chosen time

  Pick a dated slot and submit. The record's startsAt matches the slot you picked, and watchNow is false.

  storage {"webinarTime":"2026-09-15T14:00:00Z",
           "ss:reg:UDrXDR":"{\"v\":1,\"type\":\"eg-webinar\",
           \"startsAt\":\"2026-09-15T14:00:00Z\",\"watchNow\":false,...}"}

• 1Watch Now stamps submit time, not render time

  Submit without touching the dropdown. watchNow is true and startsAt is the moment you clicked.

  A form rendered at 10:00 and submitted at 10:47 must send 10:47. This is why the option value is the sentinel watch-now rather than a timestamp.

• 5eg-default writes a record with no time

  A record appears with type:"eg-default" and no startsAt and no watchNow. No watchNow key in the payload either.

• 9live posts elsewhere and stores no start time

  The endpoint host differs from every other card — this is the launch handler. The record carries type:"live" and no startsAt.

  A live date is a property of the campaign and gets rescheduled. Copying it into storage would strand the old date in every registrant's browser with no way to correct it.

• Two campaigns coexistblocker

  Submit card 2, then card 3 (a different formId). Both ss:reg: keys are present. Neither overwrote the other.

  This is the defect the release exists to fix. The old flat webinarTime key is global, so the second registration silently replaced the first.

• 3data-no-watch-now removes the option

  Scheduled slots only, no Watch Now. Compare against card 1 — unset, the attribute must change nothing.

• 4data-watchnow-url override is honoured

  Redirect reports /watch/custom/.

• 6data-no-sms loads no phone library

  No SMS checkbox, no phone field, and no libphonenumber request in the Network tab.

• 7Blocked CDN degrades, never removesblocker

  Both CDNs refused before init. The form still renders — Watch Now plus "No scheduled times available", no SMS field. It must not say "Form failed to load".

• 8Blocked storage still completes the submissionblocker

  Every localStorage access throws. Submit and confirm the redirect still fires and the storage line reads blocked — … rather than nothing at all.

  The record is written just before the redirect. A throw there would strand the visitor on the form with the lead already captured server-side — the same shape as the head-load bug, where one throw silently killed every statement after it.

Switch every frame with the link in the harness header, or append ?build=min. This is the file partners actually load — terser has silently eaten code in this project before, and a source pass cannot catch it.

• The artifact reports its own versionblocker

  In the console of any frame:

  > window.__ssOptinFormLoaded
  "1.0.1"

  A stale value here is readable by the client in their own browser console, and it leaks the real version.

• Re-run scenarios 2, 8 and 9 against the buildblocker

  Same records, same redirects, same degraded behaviour as the source pass. Scenario 8 is the one to watch.

  emailTermsOverrides was dead-code-eliminated from 1.0.7 onward and went unnoticed for releases. StorageContract is a new object literal with a single caller — exactly the shape terser likes to drop.

• Literals survived minification

  cd optin/form
  for s in emailTermsOverrides ss:reg: startsAt \
           registeredAt watchNow webinarTime; do
    printf "%-22s %s\n" "$s" \
      "$(grep -c -- "$s" releases/ss-optin-form.v1.0.1.min.js)"
  done

  Every line reports 1. The file is one line, so this is a presence check, not a count.

• Style contract holds

  node optin/form/check-style-contract.js
  OK — 42 themeable variables, all matched.

  A drifted default means the builder silently stops writing CSS that is actually needed, and builder-themed forms render differently on the site.

Cloudflare Pages replaces the entire site on every deployment. That single fact drives the first item here.

• cdn-upload holds both buildsblocker

  ls cdn-upload/
  _headers
  ss-optin-form.v1.0.0.min.js
  ss-optin-form.v1.0.1.min.js

  Deploying v1.0.1 alone would delete v1.0.0 out from under the site still pinning it. Old builds stay until the last site has migrated.

• Drag the whole folder into tss-forms-cdn, then purge that path

  _headers must land at the root of the deployment or Pages ignores it and the file gets default caching.

• Served bytes match the local artifact

  curl -sI https://cdn.thesacredscience.com/ss-optin-form.v1.0.1.min.js \
    | grep -i cache-control
  curl -s https://cdn.thesacredscience.com/ss-optin-form.v1.0.1.min.js \
    | shasum -a 256
  shasum -a 256 optin/form/releases/ss-optin-form.v1.0.1.min.js

  Hashes identical, and cache-control: public, max-age=31536000, immutable.

• v1.0.0 still resolves

  A 200 on the old filename. The test site has not migrated yet.

One site at a time. Nothing moves on its own — every site pins a filename, so the release is only real for a site once its embed is edited.

• Point the test site's embed at v1.0.1

  <script src="https://cdn.thesacredscience.com/ss-optin-form.v1.0.1.min.js"></script>

• Confirm the running version on the real page

  window.__ssOptinFormLoaded returns "1.0.1" in the browser console on the live site.

  If it still says 1.0.0, the visitor's browser is holding an immutable copy — hard-reload before suspecting the code.

• One real registration end to end

  A genuine submission reaches Klaviyo, lands on the registrants list, and writes ss:reg:<formId> in that browser.