Drift Analysis

• Automated daily D1 backups to R2. New Worker cron trigger runs at 00:00 UTC (10am Cairns), dumps every table in the database to a single JSON file, writes it to the drift-analysis-backups R2 bucket with generation timestamp metadata, and prunes anything older than 30 days.
• New Database backups card on the Setup page: shows the last 20 backups with their timestamp, size, row count, and a Download link. "Run backup now" button triggers the same code path on demand for testing or a pre-migration snapshot. Downloads go through an authenticated blob fetch so anchor-download's no-auth-header limitation isn't a problem.
• Removes the daily --skip-backup habit that the wrangler token permission gap forced on earlier releases. Backups now come from inside the Worker, which has direct D1 read access and doesn't need any additional token.
• Killed the "Install update" button that had been showing a v1.9-era placeholder alert since forever. Banner now just informs "next version coming" without the misleading action.

One-time setup: create the R2 bucket in the Cloudflare dashboard (R2 → Create bucket → name it drift-analysis-backups) before deploying v4.5. The Worker deploy will otherwise fail with an unknown-binding error.

• Sponsor-facing read-only view. Each sponsor gets a rotatable share link (e.g. /sponsor.html?key=gbrf&token=<32-char-hex>) that shows their drifters, current positions on a map, headline stats (total drifters, currently deployed, active this week, total drift-km), and deployment history. No admin controls, no other sponsors' data, no maintenance log — deliberately separate endpoint so there is no way to accidentally leak internal data through it.
• Share tokens are managed from a new "Sponsor share links" card on the Setup page: Generate creates or rotates a link, Copy puts the URL on the clipboard, Revoke NULLs the token so the URL 404s. Rotate is destructive — the old URL stops working immediately.
• Public view endpoint (GET /api/sponsor-view/:key?token=xxx) validates the token via a constant-time-ish comparison and returns 403 on mismatch. No admin auth is checked; the token IS the credential.
• Sponsor page uses the same visual language as the internal dashboard (marine-blue accent, warm chart-paper background, mono-space coordinates) but with a distinct dark-navy header carrying the sponsor's name + coloured abbreviation chip. Feels like a portal, not the internal tool.
• Schema migration adds share_token column to sponsors (nullable). Apply schema/0005_sponsor_share_tokens.sql in D1 Console before deploying the v4.4 Worker.

• Fixed stale live-state on non-deployed drifters. The mode field is an operational state (BEACHED, DRIFTING, etc.) that only makes sense while the drifter is in the water. Previously, once a drifter was recovered to the workshop the last observed mode stayed pinned on its row — so units sitting on a bench displayed BEACHED, which is nonsensical.
• Server side: the recover endpoint now NULLs out last_mode when a drifter comes out of the water. Historical last_lat / last_lon / last_fix_at / last_batt_mv are retained since those remain useful reference values.
• Client side (defensive): the fleet table only renders the mode chip when status === "deployed", so any drifter with an already-polluted stale mode (like the two workshop units that triggered this fix) immediately shows — without needing a DB migration. Mode filter dropdown now also gates on deployed status, so filtering by BEACHED cannot match workshop rows with a stale mode.

• Deploy and Recover coordinate flow reframed. Instead of separate Lat / Lon fields and two seemingly-decorative buttons underneath, the section now reads as a single question — "Where did you deploy it?" / "Where did you retrieve it?" — with the coordinate inputs side by side and the two ways of filling them (📍 Use my location, 🗺 Mark on map) presented as an explicit pair beneath. Intent-first, mechanism-second.
• Picker map now shows context. On Recover, the target drifter's last known Myriota position appears as a grey reference dot with a small label — so the picker answers "the satellite says it's here; tap where you actually found it" rather than showing an empty map. On Deploy, other currently-deployed drifters appear as small tan dots so you can see the fleet layout when picking a new drop point.
• Picker header hint text adapts to what's on the map — different sentence for Recover, Deploy, and the no-reference case.

• Tap-on-map coordinate picker on Deploy and Recover. New 🗺 Pick on map button next to the 📍 GPS button. Opens a full-screen Leaflet overlay — tap anywhere to drop a marker, drag the marker for fine-tuning, live coordinate readout in the header. Confirm writes the picked coordinates back to the form field.
• Picker starts with a sensible default view: any existing coordinate in the form is honoured first, otherwise the drifter's last known position, otherwise the assigned area's centre, otherwise Cairns. So when you open the picker for a drifter that's already deployed at Fitzroy, it opens zoomed on Fitzroy.
• GPS button also available inside the picker — for when you open the picker, decide GPS would be easier, and don't want to close-and-reopen.
• Leaflet is lazy-loaded on first open so the ~150 KB bundle only costs you if you actually use the picker. Service worker pre-caches the vendor assets, so a second open (and any future open, even offline) is instant.

• Installable as a PWA on iPhone and iPad. Add-to-home-screen from Safari (tap the share icon, then "Add to Home Screen") gives Drift Analysis its own app icon, standalone window with no Safari chrome, and dark-navy status bar. Same behaviour on Android Chrome. Icons are placeholders matching the topbar brand mark — swap for real artwork whenever you're ready.
• Manifest declares Map / Fleet / Setup as launch shortcuts so long-press on the home screen icon (iOS 16+, Android) jumps straight to a specific page.
• Service worker caches the app shell (HTML, Leaflet vendor, icons) so the PWA opens even with no signal. Deliberately does NOT cache API responses or map tiles — you were explicit about not wanting an offline map or stale data.
• Offline-safe deploy and recover. Both actions on the fleet page now queue in localStorage when the device is offline or the request fails with a network error. Queue drains automatically on reconnect, on tab-becomes-visible, and every 30 seconds while the page is open. A yellow ⏳ N pending sync chip in the action bar shows the queue depth; tap it to see each pending action with Retry and Remove buttons. Conflict rule is last-write-wins — the boat is authoritative for what happened in the water.
• Small green/red dot in the topbar reflects navigator.onLine. Hover for a tooltip.
• "Use my current location" button on Deploy and Recover. One tap fills lat/lon from the browser's geolocation API with high-accuracy request. Works offline (GPS doesn't need signal). Shows accuracy in metres.

• Same-second impossible-jump check fixed (second layer of the v3.7 bug). The v3.8 hotfix restored the denorm columns in the drifter lookup, but the distance check still required dtHours > 0, so two ingestion calls that landed in the same Unix second (Myriota timestamps are second-resolution, and satellite passes can deliver multiple packets per second) slipped through. Caught by re-running the Darwin smoke test: both calls got the same fixed_at and the jump was marked clean again.
• Quality rule rewritten as an implied ground-speed check: computes distance / time and flags anything above 20 km/h (physically well above the ~10 km/h East Australian Current cap). The time-delta divisor is floored at one minute-worth-of-hours so same-second deliveries don't hit division-by-zero and GPS jitter inside a satellite pass window doesn't false-positive. A secondary distance > 500 m guard stops small jitter cases from ever tripping the rule, no matter what the implied speed says.
• Verified against six edge cases before shipping: same-second 1900 km jump, legit 15-min spawn-cadence fix, GPS jitter same-second, 44-second Darwin jump, (0,0) cold-start, and first-ever fix. All produce the expected quality tag.

• Impossible-jump quality check fixed. v3.7 shipped the distance-jump rule (>200 km from previous fix in under an hour = mark suspect) but the drifter lookup query only selected the id column, so assessQuality saw undefined for last_lat / last_lon / last_fix_at and silently skipped the distance check. Caught by a smoke test that posted a Fitzroy → Darwin jump (~1900 km in 44 s) and got quality: "clean" back. The lookup now selects the denorm columns, and the null-guard uses != null so future callers can't recreate the bug with an undefined field.
• Cleanup SQL provided in schema/0004_reset_test_pollution.sql — DRIFT-051's denorm state was polluted with Darwin coordinates during the v3.7 test run. Paste this in the D1 Console to reset before re-testing.
• The (0,0) cold-start rule was unaffected and continued working correctly in v3.7; only the distance-jump rule was broken.

• Myriota envelope adapter — new POST /api/ingest/myriota endpoint that speaks Device Manager's actual webhook shape. Parses the escaped Data JSON string, decodes each 20-byte hex payload using the DriftSpawn binary format, and delegates into the same code path as the idealised /api/ingest. Point Myriota's custom destination at this URL when you register the first live module.
• DriftSpawn 20-byte payload format frozen and documented — the Setup page's generated config.h now includes the exact DriftSpawn_message_t struct definition at the top, so firmware and decoder can never drift out of sync. Layout: seq (u16), lat_e7 (i32), lon_e7 (i32), fixed_at (u32), sst_c100 (i16), batt_mv (u16), mode_sats (u8), hdop_x10 (u8) — 20 bytes exactly, matching Myriota's per-message maximum.
• Dedup on ingest — Myriota's Message Store retries on transient network errors. Ingestion now silently accepts duplicate deliveries (same drifter, same fixed_at within 1 s, coordinates matching to ~11 m) rather than double-inserting. Response includes a dedup: true flag so you can tell it happened.
• Bad-fix quarantine — fixes at exactly (0,0) (classic GPS-not-locked cold start) and impossible jumps (>200 km inside an hour from the previous fix) are now tagged quality: "suspect" in the track_points table. Suspect fixes are stored but do NOT update the drifter's last_lat / last_lon, so the map stays anchored to the last clean position rather than teleporting on a garbage lock. Requires a one-time schema change — see schema/0003_track_point_quality.sql.
• Silent-drifter warnings on the fleet page — a deployed unit whose profile expects, say, one message every 50 minutes but hasn't reported for over 2.5 hours (3x expected gap) now shows a red ⚠ chip next to its ID and a warm-tint background on the row. A summary chip in the action bar ("⚠ 3 silent") gives you the whole-fleet count at a glance, independent of active filters. Threshold is derived per-profile from msg_per_month, so spawn-cadence and long-term profiles use their own appropriate cutoffs.
• simulate_ingest.sh myriota — new subcommand posts a realistic Myriota-shaped envelope (with a properly packed 20-byte binary payload) through the adapter end-to-end, so you can prove the whole decode path works before any hardware is registered.

• Hover to preview on desktop — mousing over a drifter marker now opens its details popup, so you no longer have to click every unit just to check on it. Clicking still works and behaves the same as before (opens popup, selects the drifter in the sidebar). On touch devices (iPhone, iPad without a mouse) the behaviour is unchanged: tap to open. Detection uses @media (hover: hover) and (pointer: fine), so an iPad with a paired trackpad or mouse does get hover behaviour.
• Small close delay after mousing off a marker so you can slide onto the popup itself without it vanishing, matching standard hovercard behaviour.
• Coast overlay cleanup — the crude Yarrabah mainland rectangle is gone. The Coast layer still bundles the Fitzroy Island, Little Fitzroy, outer reef, and Arlington Reef guides, which are genuinely useful markers on satellite view where the reefs render as pale blobs. The Yarrabah place-name label is unchanged.
• _headers file for Pages caching — HTML entry points now serve with no-cache, must-revalidate, and vendor assets with a one-year immutable cache. Fixes the "I deployed but it did not update" issue at the source: every future deploy is visible on refresh, no hard reload needed.

• Setup page — new third tab in the top nav. One form captures every parameter a new drifter needs (ID, variant, Myriota module serial, hardware rev, build date, sponsor / area / cadence profile, initial status), registers it in the fleet, and generates two things you paste at the bench:
• A per-unit config_DRIFT-###.h header (copy or download) that drops straight into the Myriota SDK build tree — one #define per parameter, so nothing gets typed twice and every flashed unit carries its identity, sponsor, area, profile, and cadence constants baked into the firmware.
• A copy-pasteable bench command block that walks through the SDK build, USB flash, Device Manager registration, and post-flash smoke-test with simulate_ingest.sh.
• Suggest next ID button — picks the next number in the appropriate range based on variant and area, so you don't collide with an existing unit.
• Preview only button — see the generated config and commands without touching the fleet database. Useful for spot-checking an already-provisioned unit's parameters.
• Recently provisioned list at the bottom of the page so you can glance back at what was last built.

• Telemetry ingestion endpoint — new POST /api/ingest on the Worker, ready to receive real fixes from a Myriota webhook. Accepts one point or a batch, resolves drifters by ID or module serial, auto-links each fix to the open deployment, updates the drifter's last-known position (skipping out-of-order deliveries).
• Uses a separate INGEST_TOKEN secret rather than the admin key, so a leaked webhook URL cannot pivot into the fleet management API.
• Simulator endpoint — POST /api/ingest/simulate generates a plausible fix near a drifter's last known position and pushes it through the real ingestion path, so you can smoke-test the whole pipeline without hardware.
• Dashboard still reads from the mock dataset; the switch to live track_points reads is scheduled for v3.5.

• Labels toggle — new icon in the header (between full-screen and settings) turns drifter ID pills on and off. When on, the pills reappear with their dashed leader lines pointing back at the marker; when off, both stay hidden. Choice is remembered across sessions.
• By default labels stay hidden (the cleaner map look introduced in v2.5).

• Killed the dangling leader lines — the little dashed lines fanning out from each marker were left over from when drifter IDs were shown next to markers. Since v2.5 hid the labels, those lines were pointing at nothing. Gone now.
• Coast overlay off by default — the beige "Yarrabah / Fitzroy / Outer Reef / Arlington" polygons no longer paint over the satellite imagery on first load. Still available: layer picker (top-right of the map) → tick Coast to bring them back.
• No more login flash on the Fleet tab — the overlay used to blink into view for ~200 ms while the cached key was being validated. Now it stays hidden immediately when a key is present, and only reappears if the key turns out to be bad.

• Login stops nagging — going Fleet → Map no longer forces a re-sign-in; the overlay now correctly stays hidden when credentials are already cached.
• New full-screen map toggle (icon in the header next to the ⚙ gear) — hides the fleet sidebar so the map takes the whole viewport. State is remembered across visits.
• Track polylines now render on canvas instead of SVG — fixes the visible "jump-and-snap" of vector lines while pinch-zooming on iOS satellite view.

• Richer fleet table — four new sortable columns: Mode (current operating mode with colour), Dist (total km travelled), Msgs (message count), and Last fix (time of latest position).
• New Mode filter dropdown — quickly show only Beached drifters, only Normal, only High cadence, etc.
• Rows for drifters that never left the workshop show "—" in the telemetry columns.
• Telemetry values come from the shared mock dataset for now; will switch to live track_points reads once v3.3's Myriota webhook lands.

• Marker taps stay put — tapping a drifter on the map now just opens the info popup, no more auto-zoom to that drifter's track (which forced you to zoom back out to see the rest of the fleet). Sidebar card taps still pan & zoom to fit the drifter's full track, since that's when you actually want to focus on one.
• Popup also no longer pans the map to keep itself in view — it opens where you tapped, full stop.

• Login overlay fix — the sign-in card was falling through into document flow on iPad Safari (a missing CSS selector line meant position: fixed was never applied). Now correctly covers the whole viewport so you can log in on any device without scrolling past the map to find the fields.

• No more ?api= in URLs — the Worker URL is now baked into the frontend as a default. Bookmark the plain drift-analysis.pages.dev URL and login works out of the box.
• Override still supported: ?api=<url> for local dev, ?api= (empty) for same-origin once a route is set.

• Deploy hardening — deploy.sh now auto-installs wrangler if it's missing (fixes the Cloud Shell wipe-on-session issue) and treats a failed D1 backup as a warning rather than a hard-stop, so schema/worker/pages steps always run.

• Cleaner map — drifter ID tags are hidden by default so the water stays uncluttered.
• Tap any drifter marker to open a compact info popup: ID, sponsor, variant, current mode, distance covered, battery voltage & %, message count, area, and time of the last fix.
• Popup content updates to reflect the current timeline moment, not just the latest fix.

• Email + password login — both Map and Fleet pages now sit behind a proper sign-in form; single admin account for now, password changeable via wrangler secret put ADMIN_PASSWORD.
• New Settings panel (gear icon in header) — shows the signed-in email, exposes the API key with a Copy button for pasting into other devices, and a Log out action.
• New POST /api/login worker endpoint validating ADMIN_EMAIL / ADMIN_PASSWORD secrets and returning the FLEET_API_KEY.

• First production deploy on Cloudflare (Workers + D1 + Pages) under the drift-analysis project.

• Renamed — product is now called Drift Analysis (dashboard + management). The hardware platform itself is still DriftSpawn.

• Full fleet management system on Cloudflare Workers + D1 + Pages
• New Fleet tab: sortable/filterable table, add/edit drifters, deployment workflow, recovery workflow (R variants auto-route to workshop with cycle count, E variants to retired), maintenance log per unit
• Bearer-token auth, CORS-friendly, same-origin routing supported
• Deploy script with backup-before-migrate pattern

• Sponsor colouring — drifters tagged with a sponsor (e.g. RRF, SSC, CWI); trails and start-rings take the sponsor's colour while marker fill keeps the mode colour and shape keeps the variant
• Smooth continuous zoom interpolation — fractional zoom + per-frame lerp, no more discrete zoom-level jumps
• 14-day deployment scenario — extended from 36 h; four drifters beach or run aground (Yarrabah, Cape Grafton, outer reef, Little Fitzroy), one stays offshore drifting east into the Coral Sea
• Cadence transitions baked into the data — HIGH_CADENCE 15 min (first 48 h) → NORMAL 60 min while drifting → BEACHED 30 min once stationary, per v1.3 firmware spec
• Embedded coast outlines for Fitzroy, Little Fitzroy, Cape Grafton/Yarrabah mainland, and an outer GBR reef — always visible without map tiles
• Realistic spawn-night ring deployment around Fitzroy
• Label collision avoidance — outward from deploy point, min 20° angular gap, iterative push-out
• Solid drift trails (replaced fading gradient)
• Five playback speeds (Very Slow / Slow / Normal / Fast / Very Fast)
• View All toggle — auto-fit map to all visible drifters; starts close, zooms out as they spread
• Video export — render the drift to a downloadable MP4 / WebM at the selected speed, with the same auto-zoom behaviour
• Layer toggle for Map (OSM) and Satellite (Esri) tiles when available

• Timeline playback — play, pause, scrub through the last week
• Animated drifter movement with smooth marker interpolation
• Tracks grow as time advances; not-yet-deployed drifters stay hidden
• Speed selector (slow / normal / fast)

• First fleet dashboard release with map, sidebar, light theme