Wizard steps 2–3: metadata write + pools + invert verification (hub-e19 increment C)

[krandder]

Stacked on #93 (base: selfserve-wizard) so review units stay small — merge #93 first, then rebase this onto main.

Implements the frozen spec hub/docs/specs/2026-08-06-selfserve-wizard-increment-C.md:

• Step 2 — metadata write: createAndAddProposalMetadata via the org owner/editor key. Role gate read on-chain, simulate-first, TWAP timing recomputed at write time (a page-load-stale draft can never be written — the validator's past-start gate backs this), shared args tuple with OrganizationManagerModal.
• Step 3 — pools: conditional tokens from the existing fetchProposalFromChain (wrappedOutcome 0–3), YES/NO pools via the existing useCreatePool, initial price prefilled from the org's spot ticker and operator-confirmed (a wrong initial price permanently distorts quotes — the RAGE-pool lesson).
• Invert verification (the point of the increment): after both pools exist, read each pool's token0(), validate the on-chain metadata's invert flags against the conditional company token (the market page's authoritative rule), and offer a single flags-only updateExtendedMetadata built with mergeMetadataForUpdate — read-modify-write, nothing else touched. KIP-88/90 becomes unrepresentable through this flow.
• Steps unlock from the step-1 result or ?proposal=0x… (refresh-safe resume).

Proof: npm run test:unit 17/17 (new: args tuple, invert context/patch, end-to-end wrong-flag → flags-only merge) · next build green · exported HTML still timestamp-free.

Not in scope (per spec): FLM bootstrap (hub-rslu gate), liquidity amounts (deferred decision), arb activation, Snapshot vote-timing autofill (increment D). Known ceiling: anvil-fork E2E scenario to land via the auto-qa harness before merge.

[krandder]

E2E fork demonstration added and passing (test/e2e-fork-demo.mjs, run node test/e2e-fork-demo.mjs — spawns its own anvil fork of Gnosis):

✓ org.setEditor(client)                       — one-time onboarding grant (org owner's only appearance)
✓ factory.createProposal → 0xeE88…BadeF       — client-signed, 1.87M gas
✓ org.createAndAddProposalMetadata            — client as editor, timing recomputed at write
✓ create YES pool / create NO pool            — Algebra NFPM, 6.77M gas each
✓ invert flags wrong on-chain ({invertTwapPoolNo:true}) — client fixes with one flags-only tx
PASS — 6 txs total, 0 from Kelvin's EOA, TWAP 120h ending close−48h, invert flags verified

Note what happened on the first run: the NO pool's real token ordering required invertTwapPoolNo: true — the wizard's verification pass caught and corrected a genuine inversion, the exact KIP-88/90 failure mode this increment exists to kill. The demo asserts zero Kelvin-signed transactions and that the org owner appears exactly once (the mixed-mode setEditor grant).

This is the success-criterion mechanics (create → metadata → pools → verified) proven on a fork through the same modules the UI calls. The browser-level twin lands as an auto-qa harness scenario before merge.

[krandder]

Increment D (wizard side) added in fe61325: pasting a Snapshot proposal hash autofills the close time from the vote's real end (hub.snapshot.org GraphQL), and deriveTwapTiming anchors the whole 0xAlex window to it — 5-day window, 48h buffer before close, openingTime 48h after close. Fails closed on bad id / unknown proposal / hub outage (manual entry stands). 19/19 unit tests, build green. With this, every timing field in the wizard derives from the vote itself — the hand-aligned windows behind both production TWAP incidents can no longer be typed in.

[krandder]

Full-journey demonstration now passing (node test/e2e-fork-demo.mjs --full, commit 840c743) — the goal's complete success-criterion mechanics on an anvil Gnosis fork:

create proposal → metadata (editor key) → both pools → invert-verified
→ split collateral (FutarchyRouter) → seed both pools (~$10.8k currency side)
→ LIVE: floor gate passes (a $100 trade moves price 1.83% < 3%)
→ warp past openingTime → Reality answer (1 xDAI bond, client-posted)
→ 3.5d timeout → realityProxy.resolve(proposal) — permissionless
→ CTF payout vector read → winning side redeemed: 1,200 sDAI returned
PASS FULL — 21 txs, 0 from Kelvin's EOA, org owner only the setEditor grant

Demo liquidity amounts decide nothing about the deferred product defaults (§5a) — they exist to exercise the mechanics. What remains for the criterion is exactly the review/merge/deploy gates: this same journey through the deployed wizard UI is what the browser-level auto-qa scenario will replay once #93/#94 land.

[krandder]

Browser-level E2E now passing (node test/e2e-ui-demo.mjs, commit 4724665) — the wizard driven entirely through the real UI with Chromium against an anvil fork:

wallet connected through RainbowKit (EIP-6963-announced test wallet)
STEP 1 through UI — proposal created: 0x4120…1677 (broadcast from the page)
STEP 2 through UI — metadata written by the client as org editor
STEP 3 through UI — both conditional pools exist
invert flags VERIFIED through the UI
PASS UI — 0 Kelvin-signed txs; org owner only the pre-UI setEditor grant

Two gates proved themselves during test development: the metadata validator refused to write without a snapshot_id (the test had to fill it), and in the earlier scripted run the invert verification caught a real NO-pool inversion. Combined coverage: this UI run (steps 1–3) + e2e-fork-demo.mjs --full (LIVE seeding → Reality resolution → redeem) = the goal's full journey, demonstrated.

[krandder]

Review (2026-09-26): APPROVE after the fixes pushed today, merge after #93. (Posted as a comment because GitHub does not let the author approve their own PR.)

Today's changes:

• Rebased onto the fixed Self-serve Create Market wizard: planner → real transactor (hub-e19) #93. The old copies of Self-serve Create Market wizard: planner → real transactor (hub-e19) #93's commits are dropped, and the step 2–3 code is byte-identical to the previous head apart from the fixes below.
• Ported a local fix branch that another reviewer wrote on 09-12 but never pushed, and re-authored it.

This PR sends up to four wallet transactions: the org metadata write, the YES and NO pool creations, and a flags-only metadata update. None of them are token approvals.

P1, fixed on the branch

1. Metadata could be attached to someone else's market. After the write, step 2 took "the last entry in the org's proposal list" as its metadata contract. A concurrent write by another editor would make step 3's "Fix flags" call updateExtendedMetadata on a different live market and invert its price. The address now comes from this transaction's ProposalCreatedAndAdded event, matched to our proposal. (c81e548)
2. Steps 2–3 could use the wrong proposal. The step 1 fix is in Self-serve Create Market wizard: planner → real transactor (hub-e19) #93 (NewProposal event).
3. Metadata could be written from stale form values. After a refresh the form resets to defaults, and the org, close date, Snapshot autofill and question stayed editable after step 1. Step 2 wrote those live values, so the TWAP window or org could disagree with the proposal on chain. Now:
   • the org is locked and kept in the URL (c81e548);
   • step 2 reads the proposal back from chain (question, token pair, Reality opening time);
   • it refuses to write if the tokens are not the org's;
   • it derives the close time from the on-chain opening time (143dd8f).
4. Render loop after the first pool was created. It made step 3 unreachable. Fixed with stable callbacks and a publish-once guard (c81e548, 1647944).

Also fixed: only one metadata transaction is allowed per page load. Metadata and pool writes now switch to Gnosis and verify the chain before sending.

P2, still open (not blocking a first supervised launch)

• Existing pools are not price-checked. If a pool already exists (for example one someone else created at a bad price), it is accepted without checking its price. createAndInitializePoolIfNecessary also succeeds silently in that case. Suggested fix: read globalState().price and block on a mismatch.
• Snapshot lookup failures are silent. If the lookup fails or finds nothing, the typed close date is kept with no warning. Step 1 now blocks too-soon dates, and step 2 uses the on-chain time.
• A refresh after step 2 offers the metadata write again. The org would get a duplicate entry. Suggested fix: look up existing metadata for this proposal on load.
• Pool creation signs through window.ethereum, not the connected wagmi wallet. This is the same WalletConnect caveat as Self-serve Create Market wizard: planner → real transactor (hub-e19) #93.

P3

• The spot-price prefill reads fetchSpotCandles as an array, but it returns {candles, price}, so the prefill never fills. This fails safe (the field is left blank).
• Price math assumes 18/18 decimals.
• CI runs only auto-qa/tests. The wizard's test/*.test.mjs suite needs dependencies installed and does not run in CI.

Tests: 26/26 unit, 695/695 deterministic auto-QA, and lint on the changed files all pass, and next build succeeds. The fork end-to-end demos (test/e2e-*.mjs) were not run, because anvil is not installed here.

[netlify]

✅ Deploy Preview for futarchy ready!

Name	Link
🔨 Latest commit	cc3be7d
🔍 Latest deploy log	https://app.netlify.com/projects/futarchy/deploys/6ab85acff8cdc900081f7c8c
😎 Deploy Preview	https://deploy-preview-94--futarchy.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.