fix(agent): consent questions aren't the phone/email field (#414); two controls under one label (#416); 1.66.6

.env.production.example

@@ -1,7 +1,7 @@
 # Production deployments intentionally have no working secret defaults.
 # Copy this file to .env.production, replace every CHANGE-ME value, keep the
 # result out of version control, and pin a released OSApplyTrack version.
-OSAPPLYTRACK_VERSION=1.66.5
+OSAPPLYTRACK_VERSION=1.66.6
 POSTGRES_USER=applytrack
 POSTGRES_PASSWORD=CHANGE-ME-use-a-long-random-password
 POSTGRES_DB=applytrack

BACKLOG.md

@@ -165,6 +165,8 @@ review items and unsupported forms still need human attention.
 - [ ] [#408 — Agent: LinkedIn SDUI Easy Apply — the contact step's City typeahead is still left unmapped (SMX)](https://github.com/CryptoJones/OSApplyTrack/issues/408) (found re-running the Ready lane after #406: `CityLabel()` matches and the résumé location is typed, but the typeahead is never committed on the SDUI dialog; the run stops at the contact step with `City` the only unmapped field)
 - [ ] [#410 — Agent: a packet's whole answer draft rides one LLM completion under the API's 120 s timeout — Orbis's 29-question form timed out twice and every answer was voided](https://github.com/CryptoJones/OSApplyTrack/issues/410) (not the network or the endpoint — a 36 KB request from the agent's own netns answers in 1.5 s; the real 22-question prompt just takes poolside longer than two minutes. Mitigated on pluto with `Llm__TimeoutSeconds=600` on the agent; the fix is a worker-side ceiling, chunked drafting, or both)
 - [ ] [#409 — Agent: LinkedIn SDUI Easy Apply — Trility's dialog never reaches Submit within 12 steps](https://github.com/CryptoJones/OSApplyTrack/issues/409) (`mapped: 0, unmapped: []` — the driver presses Next twelve times on a step it cannot leave and reports nothing about it; needs the screenshot and the live dialog)
+- [x] [#416 — Agent: two controls under one label — OneStream's address Country lost to the phone's country picker](https://github.com/CryptoJones/OSApplyTrack/issues/416) (fixed in 1.66.6: when a locator matches several controls, the one whose id or name is the question's own id wins; a react-select reads empty after a choice, so "prefer the empty one" took the phone's picker every time.)
+- [x] [#414 — Agent: a consent question that mentions the phone number gets answered with the phone number (Prenuvo SMS opt-in)](https://github.com/CryptoJones/OSApplyTrack/issues/414) (fixed in 1.66.6: the drafter's phone and email rules skip a label that asks for consent, opt-in or agreement, or names SMS, text messages, WhatsApp or subscribing; plain "Phone" / "Mobile phone number" still take the number.)
 - [x] [#412 — Agent: LinkedIn SDUI years-of-experience text boxes refuse prose answers ("5+ years")](https://github.com/CryptoJones/OSApplyTrack/issues/412) (fixed in 1.66.5: the SDUI dialog draws "How many years …?" as a plain 20-character text box, so the #332 whole-number coercion keyed on `type=number` never fired and the drafter's "10+ years — …" was refused after Next. A label that asks "How many years" now gets the whole number its answer states, and "Less than 1 year" reads 0, not 1. Found on the 2026-10-05 Ready sweep: seven LinkedIn rows rebuilt on Claude answered every question and still dry-ran 0 mapped.)
 - [x] [#406 — Agent: Ready rows stuck on failures the worker should have recovered from — DNS blip stamped non-transient, browser crash unflagged, LLM 429 hammered every tick](https://github.com/CryptoJones/OSApplyTrack/issues/406) (fixed in 1.66.4: "the posting's host could not be resolved" is a `TransientRunException`, retried once after two seconds and recorded as transient, so the reconciler retries it; a run the browser died under ("Target page, context or browser has been closed") is flagged `transient` by the submitter and read by those words from before; and a pass stops judging at the first `LlmUnavailableException` and holds the tenant off for 15 minutes instead of asking the next eleven leads every five minutes. The eight rows the fix could not reach — four stored `transient: false`, launchdarkly's crash, and three LinkedIn runs from before #403 — were queued again by hand.)
 - [x] [#403 — Agent: LinkedIn Easy Apply times out on the new SDUI dialog (no .jobs-easy-apply-modal)](https://github.com/CryptoJones/OSApplyTrack/issues/403) (fixed in 1.66.2: the driver now also recognizes LinkedIn's SDUI `<dialog>`. It finds Next / Review / Submit application and Dismiss by their text or label, reads fields from `label[for]` / `aria-label` and radio options from the text beside each one, catches errors that appear only after a refused Next, unticks Follow by its aria-label, and answers the blank mobile-number box from the packet's standard phone. Checked against the live dialog on 2026-10-03.)

api/ApplyTrack.Api.Tests/AnswerDrafterTests.cs

@@ -545,4 +545,23 @@ public void Fit_to_options_matches_case_insensitively_and_splits_a_multiselect()
         var free = new PacketQuestion("q", "Why", true, PacketQuestion.Textarea, [], PacketQuestion.Custom);
         Assert.Equal(("because", null), AnswerDrafter.FitToOptions(free, "because"));
     }
+
+    [Theory]
+    [InlineData("By selecting YES, I consent to receive recruiting SMS messages from Prenuvo at the phone number provided on my job application.")]
+    [InlineData("Do you opt-in to receive WhatsApp messages at your mobile number?")]
+    [InlineData("I agree to receive updates by email")]
+    public void A_consent_question_naming_a_phone_or_email_is_not_that_field(string label)
+    {
+        var (answer, _) = AnswerDrafter.Deterministic(
+            new("question_1", label, true, PacketQuestion.Select, ["Yes", "No"], PacketQuestion.Custom), Ctx());
+        Assert.NotEqual("555-0100", answer);
+        Assert.False(answer is { } a && a.Contains('@'));
+    }
+
+    [Theory]
+    [InlineData("Phone")]
+    [InlineData("Mobile phone number")]
+    public void A_plain_phone_label_still_takes_the_number(string label) =>
+        Assert.Equal(("555-0100", null), AnswerDrafter.Deterministic(
+            new("question_2", label, true, PacketQuestion.Text, [], PacketQuestion.Custom), Ctx()));
 }

api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs

@@ -470,6 +470,7 @@ function suggest(box) {
         // Greenhouse's current form: react-select comboboxes for country, city (an async
         // autocomplete) and the custom questions, each with a hidden required input.
         _fixture.MapGet("/jobs/react-select", () => Results.Content(ReactSelectHtml, "text/html"));
+        _fixture.MapGet("/jobs/react-select-two-countries", () => Results.Content(ReactSelectTwoCountriesHtml, "text/html"));
         // A form whose own validation blocks Submit on a field the DOM never marks required.
         _fixture.MapGet("/jobs/validating", () => Results.Content(ValidatingFormHtml, "text/html"));
         // A form that re-mounts itself on Submit instead of posting.
@@ -1134,6 +1135,27 @@ Click the object that does not fit the column pattern
         </body></html>
         """;
 
+    // OneStream's form (#416): the phone number's country picker and the address block's
+    // Country are both labelled "Country*", the address one further down the page.
+    private static readonly string ReactSelectTwoCountriesHtml = ReactSelectHtml.Replace(
+        "<button id=\"submit_app\"",
+        """
+          <label id="question_12-label">Country*</label>
+          <div class="select-shell" data-select="question_12">
+            <div class="select__control"><div class="select__value-container">
+              <div class="select__placeholder">Select...</div>
+              <div class="select__input-container"><input id="question_12" role="combobox" aria-autocomplete="list" aria-required="true" aria-labelledby="question_12-label" aria-controls="question_12-listbox" /></div>
+            </div></div>
+            <input required tabindex="-1" class="requiredInput" />
+            <div id="question_12-listbox" role="listbox" hidden>
+              <div role="option" data-value="United Kingdom">United Kingdom</div>
+              <div role="option" data-value="United States">United States</div>
+            </div>
+            <input type="hidden" name="question_12_value" />
+          </div>
+          <button id="submit_app"
+        """.TrimEnd());
+
     // The DOM says nothing about email being required; only the form's own submit handler does.
     private const string ValidatingFormHtml = """
         <html><body>
@@ -3859,6 +3881,25 @@ public async Task A_react_select_combobox_is_driven_to_a_committed_option_and_re
         Assert.Equal("1", post["question_9_value"]);
     }
 
+    [SkippableFact]
+    public async Task Two_controls_under_one_label_each_take_their_own_answer()
+    {
+        Skip.IfNot(Available, "Node Playwright is not installed (npm ci)");
+        // Both pickers read "Country*" and a react-select keeps its input empty after a choice,
+        // so the address Country used to land on the phone's picker and stay blank (#416).
+        var packet = ReactSelectPacket();
+        packet.Questions.Add(new("question_12", "Country", true, PacketQuestion.Select, ["United Kingdom", "United States"], PacketQuestion.Custom));
+        packet.Answers["question_12"] = "United States";
+
+        var outcome = await Submitter().RunAsync($"{_fixtureUrl}/jobs/react-select-two-countries", packet, (Pdf, "resume.pdf"), dryRun: false);
+
+        Assert.True(outcome.Submitted, outcome.Error);
+        Assert.Contains("question_12", outcome.Mapped);
+        var post = Assert.Single(_posts);
+        Assert.Equal("US", post["country_value"]);
+        Assert.Equal("United States", post["question_12_value"]);
+    }
+
     [SkippableFact]
     public async Task An_autocomplete_that_finds_nothing_for_the_full_text_is_retried_with_a_shorter_one()
     {

api/ApplyTrack.Api/Agent/AnswerDrafter.cs

@@ -55,6 +55,11 @@ public sealed partial class AnswerDrafter
     private static partial Regex Phone();
     [GeneratedRegex(@"\be-?mail\b", RegexOptions.IgnoreCase)]
     private static partial Regex EmailRe();
+    // A question that asks permission to use the number or address ("By selecting YES, I
+    // consent to receive recruiting SMS messages … at the phone number provided") is a
+    // yes/no, not the contact field it names. Prenuvo's got the phone number typed in (#414).
+    [GeneratedRegex(@"\bconsent|\bopt[- ]?in\b|\bagree\b|\bsubscribe|\bsms\b|text messages|whatsapp", RegexOptions.IgnoreCase)]
+    private static partial Regex Consent();
     [GeneratedRegex(@"first name|given name", RegexOptions.IgnoreCase)]
     private static partial Regex FirstName();
     [GeneratedRegex(@"last name|surname|family name", RegexOptions.IgnoreCase)]
@@ -211,9 +216,10 @@ public static (string? Answer, string? Reason) Deterministic(PacketQuestion q, A
         }
         if (FullName().IsMatch(label))
             return ctx.Resume.FullName.Length > 0 ? (ctx.Resume.FullName, null) : (null, "add your name in Résumé settings");
-        if (id is "email" || EmailRe().IsMatch(label))
+        var consent = Consent().IsMatch(label);
+        if (id is "email" || (EmailRe().IsMatch(label) && !consent))
             return ctx.Email.Length > 0 ? (ctx.Email, null) : (null, "no email on the account");
-        if (id is "phone" || Phone().IsMatch(label))
+        if (id is "phone" || (Phone().IsMatch(label) && !consent))
             return ctx.Settings.Phone.Length > 0 ? (ctx.Settings.Phone, null) : (null, "add a phone number in Settings · Agent");
         if (id is "cover_letter")
             return ctx.CoverLetter.Length > 0 ? (ctx.CoverLetter, null) : (null, "no cover letter drafted");

api/ApplyTrack.Api/Agent/Browser/BrowserSubmitter.cs

@@ -2257,6 +2257,13 @@ private static string Unprefixed(string id) =>
             try { count = Math.Min(await c.CountAsync(), 6); }
             catch (PlaywrightException) { continue; }
             ILocator? usable = null;
+            // Two controls under one label: OneStream's address "Country" and the phone
+            // number's country picker are both "Country*". A react-select keeps its input
+            // empty after a choice, so both read as empty and the first — the phone's — took
+            // the answer while the address Country stayed blank (#416). The one that IS this
+            // question, by its own id or name, wins.
+            if (count > 1 && await OwnControlAsync(c, count, id) is { } own)
+                return own;
             for (var i = 0; i < count; i++)
             {
                 var nth = c.Nth(i);
@@ -2276,6 +2283,24 @@ private static string Unprefixed(string id) =>
         return null;
     }
 
+    /// <summary>Among several matches, the visible, editable one whose id or name is the
+    /// question's own id, or null when none is (#416).</summary>
+    private static async Task<ILocator?> OwnControlAsync(ILocator matches, int count, string id)
+    {
+        if (id.Length == 0) return null;
+        for (var i = 0; i < count; i++)
+        {
+            var nth = matches.Nth(i);
+            try
+            {
+                var own = await nth.EvaluateAsync<bool>("(el, id) => el.id === id || el.getAttribute('name') === id", id);
+                if (own && await nth.IsVisibleAsync() && await nth.IsEditableAsync()) return nth;
+            }
+            catch (PlaywrightException) { /* not a control; the next match */ }
+        }
+        return null;
+    }
+
     /// <summary>Is the question's control a select or combobox that already holds a value?</summary>
     private static async Task<bool> PrefilledPickerAsync(IFrame page, PacketQuestion q)
     {

api/ApplyTrack.Api/ApplyTrack.Api.csproj

@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <RootNamespace>ApplyTrack.Api</RootNamespace>
-    <Version>1.66.5</Version>
+    <Version>1.66.6</Version>
     <Authors>Aaron K. Clark</Authors>
     <Copyright>Copyright 2026 Aaron K. Clark</Copyright>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "applytrack-poller"
-version = "1.66.5"
+version = "1.66.6"
 description = "Discovery poller for OSApplyTrack — fetches and scores remote job leads into shared Postgres."
 requires-python = ">=3.10"
 license = { text = "Apache-2.0" }

src/applytrack/__init__.py

@@ -2,4 +2,4 @@
 # Copyright 2026 Aaron K. Clark
 """applytrack — a local, markdown-backed job-application tracker."""
 
-__version__ = "1.66.5"
+__version__ = "1.66.6"