`references/platform-notes.md`

58 lines
# Platform flow notes & failure modes

Everything below UberEats was proven live on 2026-08-02 (TK-10140); DoorDash and
Instacart entries are the expected shapes — verify with `state.js` at every gate
and update this file as sessions teach us more.

## UberEats (proven live)

Login chain observed: email → email code → SMS 4-digit code → (sometimes) card
missing-digits gate → logged in.

- Login URL: `https://auth.uber.com/v2/?next_url=https%3A%2F%2Fwww.ubereats.com%2Flogin-redirect`
  Email field `#PHONE_NUMBER_or_EMAIL_ADDRESS`, submit `#forward-button`.
- **Session expiry is brutal** — well under 30 min. A code entered after expiry
  returns "Bad request — Current session has timed out." Restart the flow; Uber
  often skips already-passed steps and goes straight to the next gate, auto-firing
  a fresh code (cooldown timer visible = code fired).
- **SMS rate-limit**: "Error sending code / Bad request / Please use another
  method" — restart the flow; Uber rotates to phone-call ("Call me with code")
  or email code by itself. Email code is the best outcome (self-serve via George).
- **Card missing-digits gate**: after 2FA, Uber may ask for N digits of a saved
  card (e.g. "____-5001" = the 4 digits immediately before the last 4; on a
  15-digit Amex that's digits 8–11). STATIC data, no expiry race. Exactly one
  text input + Next; there is no alternative path — you need the user.
- **Email codes via George**: strip `<style>` blocks before searching the body —
  Uber's marketing CSS and its street address (e.g. "1725") look like codes.
- Addresses: Account → Addresses → add; a pin editor may appear (drag only where
  the USER said — never infer). Mid-order address edits are hard-blocked; the
  only live-order path is order Help → change delivery address, when offered.

## DoorDash (expected shape — verify live)

- Login: `https://identity.doordash.com/auth` — email first; then either
  password, a 6-digit emailed code, or a magic link. A magic link must be
  clicked in OUR browser session: ask the user to paste the link/landing URL,
  then `page.goto()` it in the matched tab.
- Addresses: Account → Addresses. Live order: order page → Help → may allow
  address change before pickup.
- Watch for PerimeterX-style bot walls; we run REAL Chrome headed, which
  usually passes. If hard-blocked, escalate to `browserbase` (metered).

## Instacart (expected shape — verify live)

- Login: `https://www.instacart.com/login` — email → 6-digit emailed code.
- Address lives in two places: Account settings AND per-order. A live order's
  address is editable only until shopping starts ("Your orders" → order →
  delivery details). Fix BOTH the account default and the live order when asked.

## Universal failure modes

| symptom | meaning | action |
|---|---|---|
| code rejected, "session timed out" | auth session expired (<30 min) | restart-login.js; tell user fresh code coming |
| "Error sending code / use another method" | channel rate-limited | restart-login.js; platform rotates channel |
| page reset to email/phone entry | parked state expired | restart-login.js |
| tab index changed / wrong page | another automation opened tabs | ALWAYS select by `--match`, never index |
| number in email looks like a code | CSS/address noise | strip `<style>`, prefer the code near "code" text |