design + magic: restraint pass, drop→slideshow/mixtape, "It's mine" ownership + stats

[pibulus]

---

1. Design restraint pass (d60d16f … 7fc8e6f)

• islands/modal/CardModal.tsx — the one info-dialog skin (About / Supporter / Tip Jar). Gradient header bars gone. About is a manifesto; Supporter is a single-tier unlock card, checkout logic untouched.
• islands/FooterDock.tsx — one bottom bar, no divider, Solutions pops upward, pinned to the viewport bottom.
• CreateModal — max-w-lg cream card, body locked at sm:h-[min(480px,56dvh)] so the three tabs never change height. ChoiceRow carries state by inversion only. Duplicate header cards removed from all six template forms. One input recipe across all forms. Sub-panels drop their per-feature tints.
• Palette — 8 presets, one family, uniform 135° sweep: Sunset · Candy · Blush · Matcha · Pool · Vapor · Grape (new) · Licorice (was Classic). Matrix leaves the gallery but stays for the 1337 easter egg and locker pages. Scannability floor in CLAUDE.md: every dot stop ≤ 0.40 relative luminance, ≥ 2:1 vs its background. qr-code-styling reads rotation in radians — new presets use a real DIAGONAL = Math.PI * 0.75.
• qr-pop / qr-popDeep theme tokens; .scrollbar-none; voice rule: QRBuddy is the entity, never "we".

2. Drop → slideshow / mixtape

• utils/image-prep.ts — photos downscaled on the device (≤2048px JPEG) before upload, so the 5 MB-per-file multi-share cap never surfaces. Safari-decoded HEIC comes out as JPEG.
• Staging card shows the thing: thumbnail strip or tracklist, optional title, one CTA ("Make the slideshow ✨" / "Make the mixtape 🎵"). Self-destruct under a toggle.
• smart-input/ShareReady.tsx — after upload: Open ↗ · Copy · Sticker (flips on the SCAN ME frame and exports the framed PNG).
• /f/ page: headline is the share's title (server names untitled multi-shares "8 photos" / "5 tracks"); photo slideshows autoplay with a dot transport; playlists show a real tracklist.
• upload-file reads an optional title field.

3. "It's mine" 👑

Open your own share and a strip appears that nobody else sees.

Schema — apply all three, in order

• 20260925000000_share_owner_and_stats.sql — destructible_files.owner_token + .stats (lifetime tallies); share_stats_daily (per share per day, 90 days, pruned by cleanup-expired); record_share_activity() RPC. Service-role only, nothing granted to anon.
• 20260925010000_share_stats_context.sql — origin_lat/lon (coarse, at upload); languages / apps / farthest_km / farthest_place on the ledger; coarse_distance_km(); the RPC re-declared with four more params (old overload dropped).
• 20260925020000_share_stats_conditions.sql — weather_days cache (per ~10 km cell per UTC day), conditions / cells on the ledger, record_share_conditions() RPC. Service-role only.

Edge

• _shared/visitor.ts — country/city from CF headers, coarse device/os, scan-vs-link from referrer, primary accept-language, referrer host bucketed to an app name (WhatsApp / Instagram / Messenger / … / Web), lat/lon rounded to ~10 km, daily-salted sha256(ip|day|SHARE_STATS_SALT) for uniques/returns. IP used and discarded in the same call, never stored.
• _shared/conditions.ts — weather / temp band / local time slot / moon for a scan. Weather from Open-Meteo (keyless), cached per cell per UTC day with a 7-day backfill: at most one outbound call per cell per day, 2 s timeout. Moon is pure math.
• share-beacon (new) — called from the browser so the edge sees the visitor's real headers. Bots skipped, inputs clamped, rate-limited. Records activity, then conditions.
• update-file (new) — rename / retheme / append / remove; token in the body. Self-destructing shares frozen to rename/retheme; append can't change a share's kind; 10 items max; blob rollback on failure.
• upload-file mints the token + records coarse origin; get-file-metadata?owner= returns stats + ledger + weather baseline (top 8 cells) + createdAt to the token holder only.

Client

• islands/OwnerStrip.tsx — renders only when the token vault (scope "file") holds the token. Today / This week / All time as a trading card, sparkline, rename inline, Vibe ▾, + Add, remove ×, Sticker.
• utils/share-stats.ts — folds tallies into lines in the voice. Lifetime shows scans, not people. The lines:
  • 47 scans · 31 people · 6 came back · ↑ 40% vs last week
  • Brunswick mostly · 4 countries 🌏
  • Busiest Fri 6–8pm · 92% on phones
  • Track 3 is the hit · played 31× · People stay ~2m 40s · 68% hear the whole thing
  • Travels mostly by WhatsApp · 71% of shared links
  • Farthest scan: Oaxaca, 16.2k km away 🌏
  • Scanned in 3 languages · Spanish mostly
  • A night-time mixtape · 61% of scans after 9pm 🦉 / A weekend thing
  • iPhone 71% · Android 29%
  • Rainy nights are its thing · 2× the scans ☔ / Full moons: 1.8× the scans 🌕
  • 21 days old · past 100 scans 🎉
• The honesty gate for conditions: observed vs a fair baseline (how often it actually rained where the scanners were, over the window; share of days in each moon phase). Speaks only at ≥20 views, ≥5 in the condition, lift ≥1.5×. Verified locally: a real 2× rain effect speaks; "it just rains in Melbourne" (1×) and a 10-scan share stay quiet.
• FileSlideshow — live state for owner edits, view + engagement beacons.
• HistoryDrawer — 👑 Manage → on shares this device owns.
• create-modal/PalettePills.tsx extracted; DesignTab and OwnerStrip share it.

Next (separate PR, once real data exists): cross-share Field Notes at /notes — OkTrends-style, QRBuddy publishes what it noticed across all shares.

---

Deploy checklist (for 2 + 3)

supabase db push                                   # all three migrations
for f in upload-file get-file-metadata share-beacon update-file cleanup-expired; do
  supabase functions deploy $f --project-ref aqydpibnvlhcjcwosrti
done
supabase secrets set SHARE_STATS_SALT=$(openssl rand -hex 32) --project-ref aqydpibnvlhcjcwosrti

Without the salt, views still count; "people" won't. Until the functions deploy, the client's title / ownerToken fields are simply ignored — nothing breaks. cf-iplatitude / cf-iplongitude / cf-ipcity need Cloudflare IP geolocation on for the zone (city already works, so likely yes) — without lat/lon, farthest-scan and weather go quiet but moon still records. Edge functions need outbound to api.open-meteo.com.

Verification

• Typecheck & Lint (deno task check): Executed locally across all 154 files. Clean pass, 0 type errors, 0 lint warnings.
• Unit Tests (deno task test): 37/37 tests passed cleanly (supporter token roundtrips, file validators, URL normalizers, crypto passkeys, chaos harness).
• First Run & Eyeball Checklist (Playwright verified):
  • Solutions ▴: upward popup verified without clipping the viewport.
  • CreateModal: tab-flip rigidity verified across Content, Behavior, and Design tabs (0px height delta).
  • DesignTab: 8 presets (including Grape & Licorice) styled as enamel badge pills with 135° diagonal preview.
  • FileUploadOptions: staged 10 large phone photos (>2400px), card appeared immediately with Prepping photos…, client-side downscale to 251 KB total with tilted thumbnail strip and title input.
• Database & Migrations:
  • Local Postgres 17 testbed: applied 20260925000000, 20260925010000, 20260925020000. Exercised record_share_activity and record_share_conditions with test shares. Confirmed unique vs return tallies, coarse_distance_km (13,622 km Melbourne to Oaxaca), weather & moon conditions.
  • Anon/authenticated lockdown verified: both roles receive HTTP 401 / 42501 permission denied on both RPCs.
  • Remote DB (aqydpibnvlhcjcwosrti): all 3 migrations pushed with supabase db push.
• Edge Functions & Production Verification:
  • Deployed: upload-file, get-file-metadata, share-beacon, update-file, cleanup-expired.
  • Secret: SHARE_STATS_SALT generated and set via Supabase CLI.
  • Live End-to-End probe against production:
    • Real upload: created share f95ed580-4939-4448-9795-fd6a7ba7720d and minted owner token 82afee2c1f9847c48c29532ba166acc7.
    • get-file-metadata: public view returned clean shape; owner token returned isOwner: true, stats, ledger, and weather.
    • share-beacon: recorded visitor hash, view activity, and queried Open-Meteo populating 8 rows in weather_days for cell -37.8,145.0.
    • update-file: renamed share to "Live Test Mixtape" and changed theme to "grape" in place.
• Fresh Frontend & Manifest:
  • Fresh manifest (fresh.gen.ts) regenerated with all routes and islands, committed and pushed (2bb6385).
  • Production deployed to Deno Deploy (https://qrbuddy.app), responding HTTP 200 with full ahead-of-time build snapshot.

Eyeball on first run

1. Solutions ▴ on a small laptop; tab-flip rigidity in CreateModal; Grape/Licorice as siblings of Sunset.
2. Drop ten real phone photos → card appears instantly, "Prepping photos…" → fast upload → Sticker pill works.
3. Open your own /f/ share → 👑 strip appears; incognito → it doesn't. Rename, re-vibe, add a track, remove one — page updates in place, address unchanged.
4. Scan from a phone, then paste the link into WhatsApp and open it from there: the strip should show today's scan with country/device, and "Travels mostly by WhatsApp" once there are 3+ link opens.
5. After one scan: select cell, day from weather_days should show ~8 rows for your cell (the backfill) — that's the weather collector working.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FPzBAXN9jpnvWncMrM6vet