Two bugs, both invisible to every test written so far, because those tests
post to wp-login.php over HTTP and a browser does not.
**The submit was blocked.** WordPress marks its username and password inputs
`required`. The wallet path deliberately leaves both empty — the signature is
the credential — so `form.requestSubmit()` ran constraint validation, refused,
and pointed a "Please fill out this field" bubble at an input the visitor is
not supposed to touch, with a valid signature already sitting in the form.
Nothing happened and nothing explained why. The wallet submit now turns
validation off for that submission only; password sign-in keeps it.
**`hidden` did not hide.** The attribute works through a UA rule that any
author rule with a `display` outranks, and WordPress ships exactly such a
rule — `.wp-core-ui .button { display: inline-block }`. So the two buttons
this plugin ships hidden were on screen regardless. That inverted the whole
progressive-enhancement story: "Use the browser wallet" was offered on every
browser including those without one, and a visitor with JavaScript disabled
would have been shown a sign-in button that could never do anything, instead
of the paste-a-signature box that works without scripts.
Found by opening the login page in a browser and clicking the button, which
is the one thing 178 passing checks had not done.
2287138149