Drift Analysis

• Shared topbar. The eight admin tabs used to live in each of eight HTML files — with the Map page using inline styles (including a stray escaped-quote artefact on the Finance tab) and the others using class-based styling. Adding, renaming or reordering a tab meant editing eight places in two styles, and I missed pages more than once. All eight pages now render the tab strip from a single topbar.js. Edit the TABS array in that one file and every page updates.
• CORS whitelist. The worker used to echo any Origin header back to the browser (or default to * when Origin was absent), which meant any web page could invoke the API on behalf of a logged-in admin's browser. Restricted to drift-analysis.pages.dev and localhost dev origins. Server-to-server callers that don't send Origin are unaffected.
• Login rate limiting. Ten failed attempts for the same email in a fifteen-minute window now returns 429 before the password is verified. Successful login clears the failure history so a fat-fingered admin isn't locked out afterwards. Records live in a new login_attempts D1 table (migration 0013); the daily backup cron prunes rows older than 24 hours.

Post-deploy step for rate limiting: apply migration 0013 in the D1 console — npx wrangler d1 execute drift_analysis --file=schema/0013_login_attempts.sql. Until it lands, the rate-limit check silently no-ops (the code catches the missing-table error), so nothing breaks in the meantime.

• Sponsor map markers now match the activity feed. A recovered drifter used to render on the RRF sponsor map in green because the marker colour came only from its last transmission mode, but the activity feed showed the same event in orange. Confusing at a glance. Markers now colour by lifecycle status first, transmission mode only if the drifter is still deployed. Recovered = coral orange, missing = red, in-workshop and other non-deployed states = muted gray.
• View All flicker eliminated. Even after the v8.5 throttle, the satellite basemap had a residual flicker behind the drifters. It was Leaflet's default tile fade-in cycling on every setView during the lerp. Disabled the fade animation on the admin map — tiles now snap in without the alpha crossfade.
• Page loads faster after login. A latent bug had the login flow write a plain email string over the JSON identity blob a moment after writing it, which broke the client-side role cache and forced every page to network-fetch /api/whoami before it could apply the role UI. Removed the overwrite in three places (Map, Fleet, Setup) and taught the reader to accept the JSON. First paint no longer waits on a round trip.
• Stored-XSS closed across the admin pages. Fleet, Setup, Sponsors, Dashboard and Settings previously wrote server-controlled strings (sponsor name, abbreviation, area name, drifter notes and so on) into innerHTML without escaping. A rogue admin could have injected script that ran in every other admin's session and exfiltrated the session token from localStorage. Every interpolation now goes through esc(), and sponsor colour values used inside CSS style attributes are additionally clamped to a hex-only regex before insertion.
• Ingest and env-admin login now use constant-time compares. The Myriota ingest token and the break-glass env-admin password were compared with ===, which short-circuits at the first differing byte. Not exploitable over the network in practice, but the fix is a one-line loop and there is no reason not to do it.
• Worker 500 responses no longer leak internal error text. The catch-all used to return e.message in the response body, which surfaced D1 error strings and stack fragments to any caller. Now logs internally and returns a generic "Server error".
• Security headers. Added X-Content-Type-Options: nosniff, X-Frame-Options: DENY and Referrer-Policy: strict-origin-when-cross-origin site-wide via _headers. CSP is next but needs a decision on inline scripts.

• View All no longer leaves the satellite view blank. The smooth lerp toward the fleet bounds was calling setView at 60 frames a second, which fired a new tile request on every frame and cancelled the previous one before it could arrive. OSM tiles are heavily CDN-cached so they mostly got through, but Esri satellite tiles are slower and were being cancelled repeatedly, leaving the map blank until the user manually zoomed. The lerp now commits at 20 frames a second and forces a fresh tile redraw the moment it converges on the target view, so the satellite basemap fills in immediately when View All finishes.
• Track overlay fade skipped during View All. The v8.3 zoom-hide handler was toggling the polyline overlay pane opacity 60 times a second while View All was lerping. Harmless but wasteful — the handler now checks whether it is a real user zoom before running.

• Sponsor activity feed no longer double-lists drifters. A drifter that was deployed and later recovered used to show up twice, which read as if the same unit was simultaneously "Deployed" and "Recovered". The feed now shows one row per drifter with its latest lifecycle event, matching the current status on the card grid below.

• Track zoom glitch fixed properly this time. On both the Map and Sponsor View, tracks were being drawn at the target zoom level while the map tiles were still animating to it, so during a pinch the polylines briefly appeared far too large and snapped back into place when the finger came off. Canvas rendering alone did not fix it because Leaflet reprojects path pixel positions on zoom-animation start. The overlay pane (which holds all polylines and the canvas layer) is now faded out for the 80 ms of the zoom animation and faded back in on completion, so tiles animate smoothly and tracks reappear at the correct position with no visual jump. Markers and tooltips are unaffected.

• Sponsor View tab restored on the Map page. Every other admin page had it, the Map page was missing it. Now the topbar shows the same eight tabs everywhere: Dashboard, Map, Fleet, Setup, Sponsors, Sponsor View, Finance, Settings.
• Sponsor map now matches the admin Map page. Markers use the same shape-by-variant convention (R is a circle, E is a square) and are filled with the mode colour: green for Normal, blue for High cadence, red for Beached, plus the Geofence, Low battery, and Recovery colours from the admin palette. Track polylines are drawn in the sponsor's brand colour. A legend row above the map spells out the shape, mode, and sponsor conventions in the same layout as the admin map.
• Smoother pinch zoom. Track polylines were rendering to SVG with per-vertex reprojection, which made them lag behind the tile pane during a pinch gesture and snap into place when the gesture ended. Switched the map to canvas rendering for its overlay so the tracks stay in lockstep with the map tiles throughout the zoom.

• Pinch and double-tap zoom work on the sponsor map again. The v7.6 "no zoom" change over-corrected: page-level gesture blocking was also killing pinch inside the map. The gesture handlers now skip when the touch is inside the map, and Leaflet's touch and double-click zoom are re-enabled. The page still stays fixed to screen size and the plus/minus buttons stay hidden as before.

• Session warmup with a loading screen. When you sign in or open the app on an already-authenticated device, a full-screen "Preparing your workspace" overlay appears while every read endpoint the app uses is prefetched in parallel: whoami, registry, drifters, dashboard, finance summary, contributions, and one sponsor-view per sponsor. When it dismisses, Dashboard, Fleet, Setup, Sponsors, Finance, Settings, and the Sponsor View all pop open instantly for the rest of the session. Runs once per browser session and skips for sponsor logins and on the sponsor.html page directly.
• Satellite view on the sponsor map. Sponsor dashboard map now has a small Map / Satellite toggle in the top-right corner, using Esri World Imagery for satellite. Defaults to the street map with reef labels. The toggle is collapsed by default so it does not intrude on the fleet view.

• Faster page data. The offline layer now serves cached API responses instantly on repeat visits and refreshes them in the background, instead of blocking every page on a network round-trip to the worker. Together with the v7.7 shell caching, this should make hopping between Fleet, Setup, Sponsors, Finance, and the Sponsor View feel near-instant on a warm cache. Fresh data still flows in on the next visit.
• Freshness window is five minutes. Beyond that, the cached copy is treated as stale and the network is queried first (with cache fallback if offline). Writes still purge related cache entries immediately, so anything you edit shows up correctly on the next read.
• Opt-out available. Live-tracking screens can force a fresh fetch by calling fetch with cache no-store. Not used anywhere yet, but the door is open.

• Fixed the Safari service-worker crash. After v7.7 shipped, Safari on iPad started refusing to open the site with "Response served by service worker has redirections". Cloudflare Pages returns a redirect for some shell URLs, and Safari refuses to serve a redirected response back from the service worker cache. The service worker now strips the redirect flag off every response before storing it, and re-strips defensively on the way out for anything cached by an older version.
• Recovery. If any device is still stuck on the "Safari can not open the page" screen after this deploy, pull to refresh twice, or clear the site data for drift-analysis.pages.dev in Safari Settings.

• Pages open instantly. The service worker now serves the cached shell straight to the browser and refreshes the cache in the background, instead of waiting on a full network round-trip for every navigation. Switching between Dashboard, Fleet, Setup, Sponsors, Finance, Settings, and the Sponsor View should feel near-instant on a warm cache. New deploys still propagate on the next load thanks to the shell-version bump on every release.
• Offline path unchanged. If the app really is offline and the requested page was never cached, the previous fleet-page fallback still kicks in.

• Sponsor map is now fixed to the screen. Pinch and double-tap zoom are disabled on the sponsor page, and the map itself no longer shows the plus and minus controls or accepts scroll-wheel, pinch, or double-click zoom. The view is fit to the fleet on load and stays put.
• Tap a drifter on the map to see its name. Map markers now show a labelled tooltip with the drifter ID on tap, so it is obvious which dot is which. Replaces the older popup which did not open reliably on touch.
• Tap a Recent activity event to highlight the drifter. Clicking a deploy or recover entry in the activity list now pans the map to the matching drifter and opens its label. Same behaviour as tapping one of the drifter cards below the map.
• Sponsor picker feels instant. Chip highlight updates immediately on tap. The dashboard fades subtly while the new sponsor loads. Repeated visits to the same sponsor during a session paint instantly from an in-memory cache while the fresh data loads in the background.
• Play button now works with the mock fleet. Drifters without real satellite pings get a deterministic synthesised track history (about 45 points across the last three days, ending at their last known position) so the play button can animate the fleet without needing hardware in the water. Once real pings are ingested for a drifter they take precedence and the synth track is not shown.
• Ping counts on the sponsor dashboard stay coherent. Satellite messages fleet-wide and per-sponsor now reflect whichever is higher of the server count and the synthesised track total, so cards, stats, and the map animation all tell the same story on demo data.

• Admin topbar on the sponsor dashboard. When signed in as admin or viewer, the sponsor page now shows the full topbar with Dashboard, Map, Fleet, Setup, Sponsors, Sponsor View, Finance, and Settings tabs, matching every other admin page. Sponsor View is highlighted as the active tab. The Exit preview pill from v7.4 has been retired since the tabs make it redundant.
• Sponsor sessions and share-link visitors do not see the topbar. They still see the marine hero and Sign out only, as before.

• Exit preview button on the sponsor dashboard. Admins and viewers previewing a sponsor now get an Exit preview pill next to Sign out that jumps straight back to the admin Dashboard. Previously the only way out of the sponsor page was to sign out completely. Share links and sponsor sessions do not see this button.

• Play button on the sponsor fleet map. Sponsors can now watch their drifters actually drift. A play control in the map header sweeps virtual time across all track points for the current sponsor, growing each polyline and moving each marker along its path. Markers appear one by one as their first ping is reached.
• Speed pill cycles 1× / 4× / 16× so the full history can be watched in about thirty seconds or blown through in two. A slim scrubber under the map shows overall progress with the current virtual timestamp on the right.
• Play → Pause → Resume on a single button. Playback auto-stops at the end and restores the static full-path view. Swapping to a different sponsor in the admin picker cleanly cancels an in-flight animation.

• Fix sponsor dashboard failing to load. The v7.1 track-points query in getSponsorView referenced a non-existent column fix_at; the actual column on track_points is fixed_at. The drifters table uses last_fix_at which is where the typo crept in from. Sponsor dashboards now load again for admin preview, share links, and sponsor sign-ins.

• Interactive fleet map on sponsor dashboard. Markers are now 10px (up from 7) with 3px white outline — clearly visible. Tap any marker to open a themed popup with variant, area, hardware rev, battery, and last-fix age. Track polylines drawn behind markers show each drifter's drift path.
• "Your drifters" card grid below the map. Every attributed drifter gets a card with status chip (Deployed / Recovered / Missing colour-coded to match the map), variant, area, battery, last fix, track ping count, and position. Cards use a coloured left border matching their status.
• Click a drifter card → fly the map to that unit and open its popup. Smooth interlink between the cards below and the map above.
• Backend: /api/sponsor-view/:key now returns a tracks object keyed by drifter_id, with the most recent 60 pings per unit (chronological), so paths render without an extra request.

• Sponsor View tab in the topbar. Added a new tab on every admin page (Dashboard, Fleet, Setup, Sponsors, Finance, Settings) that opens the marine sponsor dashboard directly. One tap access, no drawer needed.
• Admin sponsor picker inside the dashboard. When an admin visits sponsor.html without a specific sponsor selected, the hero now shows a chip row of all sponsors (by abbrev). Tap a chip to swap the view — last choice is remembered in localStorage so subsequent visits open the same sponsor by default.

• Admin can now preview the sponsor dashboard. The /api/sponsor-view/:key endpoint was scoped so only the matching sponsor's own session (or a valid share token) could reach it — admins hitting it got 403. Now admin and viewer roles can fetch any sponsor's view without a token.
• New "Sponsor dashboard" section on the sponsor detail drawer with a Preview → button that opens sponsor.html?key=<KEY> in a new tab, showing exactly what that sponsor sees when they sign in.

• Premium sponsor dashboard. Complete redesign of sponsor.html with a marine-themed layout — deep ocean navy hero header with the sponsor's name, italic tagline, and a stat strip (units funded, contributed, fleet coverage, data received). Serif display type (Fraunces) for headers, paper-warm body background. This is the face sponsors see when they log in.
• Programme-at-a-glance stat grid below the hero: fleet size, currently deployed, recovery rate, recovered units, total pings, and their seasons. Coral + seafoam accent bars on the two most-important cards.
• Fleet map + activity timeline side by side. Their attributed drifters plotted on a real Leaflet map with color-coded markers (seafoam for deployed, coral for recovered). Recent-activity timeline shows deployments and recoveries of their units.
• Contributions section with per-contribution rows showing season, units × rate, total, and status chip (Paid / Invoiced / Uninvoiced).
• Programme impact block — dark gradient panel explaining the open-data model and recovery-drives-next-year-cost dynamic.
• Backend: enhanced /api/sponsor-view/:key to return the sponsor's contributions, their programme stats (fleet coverage %, sponsor pings, seasons), programme-wide stats (fleet total, deployed, recovered, recovery rate, total pings), and a merged recent-events feed. Sponsors log in via their credentials and land here automatically.

• Purchase batch modal now has both Unit Cost and Total Cost fields. Type either — the other auto-fills based on quantity. Changing quantity re-computes the field you didn't last touch, so "15 units at $400/unit" and "$6,000 for 15 units" both work correctly without maths in your head. Live "15 × $400.00 = $6,000.00" hint below.
• Date field (Acquired) now renders consistently on iOS — was previously ignoring width/alignment styling and looking narrow next to the other inputs.

• Fixed "Server error: user is not defined" when saving purchase batches. Typo in the POST /api/purchase-batches route — it referenced a variable user when the actual variable at that scope is currentUser. Batch save now works. (The v6.4 CORS/error-handling fix surfaced this correctly as a real server error instead of a bare CORS block — nice to see it working.)

• Finance tab now shows on Sponsors and Settings pages. The v6.2 topbar patch script used a regex that only matched non-active tab links, so the Finance tab wasn't inserted on the two pages where an existing tab happened to have class="topbar-tab active". Both fixed.

• Fixed the "Load failed" error on Finance and Invoice. Two v6.2/v6.3 queries referenced s.email — a column that never existed on the sponsors table. Migration 0012_sponsor_email.sql adds it. Now the Contributions list on Finance renders correctly and printable invoices can pull the sponsor's billing email.
• Sponsor create/edit forms have a dedicated Email field (in addition to Contact person). Existing sponsors get NULL email until you edit them and fill it in.
• Worker error handling hardened. The wrap() helper now catches its own promise rejections and always returns a proper 500 response WITH CORS headers, rather than letting rejections propagate past the router's try/catch and produce a bare 500 without CORS headers (which is what caused the browser to report the crash as a "CORS block" instead of a server error — the actual bug was hidden behind that).

• Contributions list on Finance page. Fixed the "{} is not iterable" error — the fallback code was trying to iterate a wrapper object as if it were an array. New dedicated endpoint GET /api/contributions returns the flat list of all contributions with sponsor name / contact / email joined, so the Finance page renders one row per contribution without an N+1 fetch pattern.

• Finance page. New top-level tab with the full P&L picture: total costs, average unit cost, paid revenue, outstanding revenue, effective loss (lost units × avg unit cost), and net position.
• Purchase batches. Every time you buy or build drifters, record the batch — supplier, variant, quantity, total cost. Volume deals just work: "10 units for $4,000" goes in as quantity 10 and total 4000, and the unit cost is computed as A$400. Effective unit cost across all batches (weighted by quantity) drives the loss calculation and the next-year prediction.
• Next-year prediction calculator. Set target fleet size and sponsor rate, then drag the recovery-rate slider. Shows how many new units you need to buy, predicted cost, predicted revenue, and predicted surplus/shortfall. Encodes the reusable-drifter logic: if you recover 60% of the fleet, next year you only need to buy 40% new to replace the losses.
• Printable invoices. Every contribution on the Finance page now has an "Invoice" button that opens a proper invoice in a new tab with RRF letterhead, sponsor billing details, line items, totals, and payment terms. Use the browser's Print / Save-as-PDF from there. Placeholder RRF details (address, ABN) are hardcoded — edit the values in worker/src/index.js or ask me to make them editable via Settings.
• New endpoints: GET/POST /api/purchase-batches, PATCH/DELETE /api/purchase-batches/:id, GET /api/finance/summary, GET /api/invoices/:id. Schema migration 0011_purchase_batches.sql.

• Topbar now clears the Dynamic Island on iPhone PWA. v6.0 introduced the mobile CSS but the safe-area-inset padding wasn't taking effect — the inline styles on each page loaded after mobile.css and overrode it. Now marked with !important and combined with a small extra gap so the first row of content sits comfortably below the notch rather than hugging it.
• Dropped the @supports (padding: env(...)) wrapper. iOS Safari has quirks resolving env() inside @supports queries; the direct rule with a max() fallback works everywhere and degrades gracefully on browsers without env() support.

• PWA fits the iPhone screen properly. On installed PWA in fullscreen mode, the topbar was rendering under the Dynamic Island (invisible) and the sidebar content was clipped off the left of the viewport — caused by viewport-fit=cover being set without the matching safe-area-inset padding, and the topbar being ~730px wide on a 390px screen with no wrap allowance.
• New shared mobile.css loaded by every page. Adds env(safe-area-inset-*) handling so the header clears the Dynamic Island, the statusbar clears the home indicator, and content stays within the safe zones on rounded-corner phones and landscape iPads.
• Topbar wraps onto multiple rows on narrow screens instead of overflowing. Tab labels, version chip, and icon buttons compress on very small screens (iPhone SE, etc.) so nothing gets pushed off-screen.
• Belt-and-braces overflow-x: hidden + max-width: 100vw on html, body, and .app so no rogue element can create a horizontal scroll offset again.

• Real offline sign-in. Once you've logged in on a device, the app trusts the stored session and skips the server validation when you're offline. Open the PWA at sea, land on the dashboard, navigate freely — no login screen ambush. When you reconnect, the token gets validated on the next API call automatically.
• Cached identity for instant role UI. On login, your role (admin / viewer / sponsor) is cached in localStorage. Role-aware buttons hide correctly from the very first paint, even offline — no flicker where write buttons briefly show before the whoami call returns.
• Offline hint on the login card. If you land on a login screen without connectivity, a yellow notice explains that first-time sign-in needs internet, and that closing/reopening the app should let you in via offline mode if you've used the device before.
• Session TTL bumped 30 → 365 days. No more mid-voyage token expiry. Combined with the offline sign-in tolerance, you can be offline for weeks and the app just keeps working.

• The app now works offline. Open any page while at sea and it loads with whatever data was last fetched. New shared offline.js layer intercepts every API GET, caches the response in IndexedDB, and serves from cache when the network is unreachable.
• Offline provisioning + cadence edits. The write queue now covers new-drifter provisioning (POST /api/drifters), drifter edits (PATCH /api/drifters/:id), and profile cadence changes (PATCH /api/profiles/:key). Program units on the way out to the reef; the writes drain automatically when signal returns.
• Queue drains on the browser's online event and every 30 seconds as a safety net. Existing Deploy/Recover offline queue (from v4.0) continues to work unchanged.
• Naive cache invalidation on write success — writing a drifter clears cached GETs under /api/drifters and clears the dashboard aggregate, so freshly-changed data appears next fetch without a hard reload.
• PWA start_url now points at /dashboard.html so installing the app to your home screen lands on the fleet dashboard.
• Manifest and icons verified (192, 512, 512-maskable, plus 180-px apple-touch-icon). The PWA is genuinely installable on iOS Safari (Share sheet → Add to Home Screen) and Android Chrome (install prompt).

• Cadence editor moved to Setup. When you're provisioning a drifter you want cadence right there, not one tab away. The editor card now sits below the provisioning form on the Setup page, and after you save a profile's cadence, the config.h preview above refreshes to use the new values.
• Removed the duplicate card from Settings.
• Fixed the "0" display bug on empty cadence fields (D1 returns 0 for some NULL integer columns; render treats 0 as unset now, consistent with cadence being invalid at 0).

• Cadence profiles are editable. The burst / drift / beached interval values that get baked into config.h at provision time used to be hardcoded in setup.html JavaScript. Now they live on the profiles table with a dedicated editor card on Settings.
• Four numeric fields per profile: Drift interval (normal cadence), Burst interval and Burst duration (initial-spawn burst window), Beached interval (when motion sensor detects stationary). All in seconds with live "= 15 min / = 1 h" hint text as you type.
• Setup page's config.h generator now reads these values from the selected profile row. Change cadence on Settings → next provisioned unit picks it up. Existing flashed units are still static (no downlink support), but at least you're not editing HTML.
• New endpoint PATCH /api/profiles/:key for admin edits. Schema migration 0010_profile_cadence.sql adds the four columns and seeds the two existing profiles (spawn, longterm) with their historical values.

• Role-aware UI. Viewer accounts now get a genuinely read-only interface. Primary write buttons (Deploy, Recover, Add sponsor, Delete, Grant access, Add user, Run backup, Save changes) are hidden entirely instead of showing and returning 403 on click. Refresh, Close, Cancel, and other neutral actions remain accessible.
• "Read-only" chip in the topbar makes the current role visible next to the version chip, so a viewer knows why the UI looks pared-down.
• Shared role-aware.js loaded by every admin page — calls /api/whoami, sets body.dataset.role, injects the hide rules. One place to maintain.

• Sponsor login accounts. New third role in the users table: sponsor. Sponsors log in with an email and password at the normal sign-in screen, and land directly on their own sponsor.html dashboard showing their fleet, positions, and stats. No more emailing URL tokens that need to be rotated.
• Grant login access from the Sponsors page. Open any sponsor's detail drawer, find the new "Login access" section, click Grant access, fill in an email (an auto-suggested 12-character password is generated for you), Create login. Per-account menu supports Reset password (revokes existing sessions), Disable/Re-enable, and Revoke access.
• Scoped auth gate. Sponsor role can only hit /api/sponsor-view/:key where :key matches their sponsor_key. Every other endpoint returns 403. Even /api/whoami and /api/logout are the only exceptions (and they only return the sponsor's own identity).
• Session-aware sponsor.html. Rewritten to try session auth first (a logged-in sponsor lands on their own view automatically), fall back to legacy URL tokens (so existing shared links still work), or show a login form. Log-out button in the header for session-authed views.
• Login form on any admin page (Map / Fleet / Setup / Sponsors / Settings / Dashboard) automatically redirects sponsor logins to sponsor.html, so accidental logins on the wrong page still work smoothly.
• New schema migration schema/0009_sponsor_users.sql adds the sponsor_key column to the users table plus an index.

• New Dashboard tab. Top-level page with fleet totals grouped by status, activity metrics (total pings, last 7 days, silent drifters, last ingest), sponsor billing rollup (contributed / invoiced / paid / outstanding), and a unified recent-activity feed (deployments, recoveries, ingests) sorted by time.
• Single-fetch aggregator endpoint GET /api/dashboard — one round-trip pulls the whole snapshot.
• Auto-refreshes every 60 seconds so you can leave it open on a monitor and see fleet state in near-real-time.

• No more login-screen flash between pages. Every admin page used to load with the login overlay visible in HTML, then hide it after a background auth check completed — a brief but jarring flash on every navigation. Fixed: a pre-paint synchronous script in each page's head checks localStorage for the auth key, and the overlay is now hidden by default. Only shown if the key is missing (fresh visitor) or the async validation returns 401 (session expired).

• Self-healing env-admin bootstrap. The v5.0 bootstrap only fired at login, so an admin already signed in via the old FLEET_API_KEY key wouldn't appear in the users list until they logged out and back in. Fixed: the users-table upsert now runs on any authenticated env-admin request, so the list is always accurate.

• Multi-user access with roles. New Users management on the Settings page — add additional accounts with either viewer role (read-only: fleet, map, sponsors, everything visible but nothing editable) or admin role (full access). Great for giving volunteers or interns access without letting them accidentally deploy or delete anything.
• Real password auth. Passwords are hashed with PBKDF2-SHA-256 at 100k iterations with a per-user salt. Session tokens are 32 bytes of crypto randomness stored in a sessions table with 30-day expiry. Changing a user password revokes their existing sessions.
• Blanket write protection. Every POST / PATCH / DELETE across the API is checked for admin role — a viewer who somehow got the request to fire (extension, curl, forged UI) gets a 403 back. Reads are permitted for any authenticated user.
• Auto-bootstrap on first login. The env-based admin (ADMIN_EMAIL / ADMIN_PASSWORD) is automatically upserted into the users table on first login, so nothing needs to be seeded manually. Existing FLEET_API_KEY sessions keep working during the rollout as a break-glass credential.
• Per-user session revocation. Logging out now hits POST /api/logout to delete the server-side session, not just the localStorage key. Deleting a disabled user cascades to their sessions.
• Dropped the "Update vX coming" banner from the map page — it was noise and always went stale. If you want to know what's coming, the changelog button in the header still works.

• New Settings tab. Top-level nav is now Map / Fleet / Setup / Sponsors / Settings — deployment configuration and operational admin lives in its own home.
• Deployment status card — at-a-glance check of what services are wired up: admin email, worker version, D1 connection, R2 backups bucket, ingest token, fleet API key. Boolean pills for each, no secrets exposed.
• Database backups moved from Setup to Settings. Same UI, more logical home. The manual "Run backup now" button, list of recent backups, and download links all still work identically.
• Users placeholder. Shows the current admin account, notes that view-only user accounts are coming in v5.0 (the admin-vs-viewer role split needs an auth refactor with a real users table and per-user session tokens, so it's getting its own focused release rather than being crammed into this one).
• Session log-out moved to Settings so it's discoverable outside the Fleet page's action row.

• Business model correction — contributions, not per-unit purchases. Sponsors contribute funding to the spawn-tracking programme at a rate (e.g. $500/unit for 2026 spawn). Their money is pooled to buy drifters, deploy them, and gather open-source drift data. They do not own specific units. Recovered R-variant units carry over and reduce next year's cost.
• New contributions table. Each row records: sponsor, units_purchased, price_per_unit_aud, season (freetext), invoice_ref, invoiced_at, paid_at, notes. Sponsors can have multiple contributions across seasons or as top-ups within a season.
• Sponsor detail drawer now has a Contributions section with "New contribution" button + per-row menu for Mark invoiced (prompts for ref), Mark paid, Edit, Delete. Live total preview in the add/edit modal while you type units × rate.
• Sponsor detail drawer's Drifters section is now read-only — shows operational attribution (drifters currently associated with this sponsor for deployment) rather than billing. Billing lives entirely in Contributions now.
• Aggregate strip and sponsor table columns updated: "Value" → "Contributed", "Units" → "Units funded". Numbers roll up from the contributions table.
• New schema migration schema/0007_contributions.sql. The drifter billing columns from v4.7 (purchase_price_aud, invoice_ref, invoiced_at, paid_at) are now unused; they stay in the schema for now, will be removed in a later cleanup migration.

• Sponsors as a top-level tab. New sponsors.html page with the full sponsor list, per-sponsor billing rollup (units, total value, invoiced, paid, outstanding), aggregate strip across the top for at-a-glance totals, and a click-through detail drawer for each sponsor.
• Sponsor CRUD. Add sponsor via a modal (key + name + colour + contact + notes), edit any field inline in the detail drawer, delete with foreign-key safety — the DELETE fails cleanly if any drifter or deployment still references the sponsor, so you cannot accidentally orphan operational history.
• Per-drifter billing. Every drifter now has a purchase price (AUD), invoice reference (freetext, e.g. "GBRF-2026-04"), invoiced_at timestamp, and paid_at timestamp. Edit price inline in the sponsor detail. Tap ••• on a drifter row for Mark invoiced (prompts for reference), Mark paid, Reset billing state, Edit invoice ref. Sponsor totals update live from these fields — no denormalisation.
• Share-link management moved from Setup to Sponsors. The share-link block that lived at the bottom of the setup page is now integrated into each sponsor's detail drawer alongside the sponsor's other settings. One place to manage everything about a sponsor.
• Schema migration schema/0006_billing_fields.sql adds four new columns to the drifters table. Apply in D1 Console (one ALTER at a time) before deploying the v4.7 Worker.

• Hotfix: "Run backup now" was throwing "Cannot read properties of null (reading 'key')". The runBackup() function in the Worker was returning a plain object where the router expected a Response. The wrap step then dispatched an empty-body 200 to the client, which parsed as null, and reading .key off it exploded. Every other endpoint properly wraps in jsonResponse(); missed it here.
• Fixed deploy.sh: a Worker Cron Trigger attach failure (usually a token permission gap on the account) no longer halts the whole script under set -e. The Worker code itself uploads successfully in that scenario; the schedule attach is the only thing that fails. Pages deploy now still runs so the frontend picks up the new version. Warning message points at the dashboard workaround.

The v4.5 cron-trigger dashboard workaround still applies: Workers & Pages → drift-analysis → Settings → Trigger Events → Add → Cron Trigger → 0 0 * * *.

• Automated daily D1 backups to R2. New Worker cron trigger runs at 00:00 UTC (10am Cairns), dumps every table in the database to a single JSON file, writes it to the drift-analysis-backups R2 bucket with generation timestamp metadata, and prunes anything older than 30 days.
• New Database backups card on the Setup page: shows the last 20 backups with their timestamp, size, row count, and a Download link. "Run backup now" button triggers the same code path on demand for testing or a pre-migration snapshot. Downloads go through an authenticated blob fetch so anchor-download's no-auth-header limitation isn't a problem.
• Removes the daily --skip-backup habit that the wrangler token permission gap forced on earlier releases. Backups now come from inside the Worker, which has direct D1 read access and doesn't need any additional token.
• Killed the "Install update" button that had been showing a v1.9-era placeholder alert since forever. Banner now just informs "next version coming" without the misleading action.

One-time setup: create the R2 bucket in the Cloudflare dashboard (R2 → Create bucket → name it drift-analysis-backups) before deploying v4.5. The Worker deploy will otherwise fail with an unknown-binding error.

• Sponsor-facing read-only view. Each sponsor gets a rotatable share link (e.g. /sponsor.html?key=gbrf&token=<32-char-hex>) that shows their drifters, current positions on a map, headline stats (total drifters, currently deployed, active this week, total drift-km), and deployment history. No admin controls, no other sponsors' data, no maintenance log — deliberately separate endpoint so there is no way to accidentally leak internal data through it.
• Share tokens are managed from a new "Sponsor share links" card on the Setup page: Generate creates or rotates a link, Copy puts the URL on the clipboard, Revoke NULLs the token so the URL 404s. Rotate is destructive — the old URL stops working immediately.
• Public view endpoint (GET /api/sponsor-view/:key?token=xxx) validates the token via a constant-time-ish comparison and returns 403 on mismatch. No admin auth is checked; the token IS the credential.
• Sponsor page uses the same visual language as the internal dashboard (marine-blue accent, warm chart-paper background, mono-space coordinates) but with a distinct dark-navy header carrying the sponsor's name + coloured abbreviation chip. Feels like a portal, not the internal tool.
• Schema migration adds share_token column to sponsors (nullable). Apply schema/0005_sponsor_share_tokens.sql in D1 Console before deploying the v4.4 Worker.

• Fixed stale live-state on non-deployed drifters. The mode field is an operational state (BEACHED, DRIFTING, etc.) that only makes sense while the drifter is in the water. Previously, once a drifter was recovered to the workshop the last observed mode stayed pinned on its row — so units sitting on a bench displayed BEACHED, which is nonsensical.
• Server side: the recover endpoint now NULLs out last_mode when a drifter comes out of the water. Historical last_lat / last_lon / last_fix_at / last_batt_mv are retained since those remain useful reference values.
• Client side (defensive): the fleet table only renders the mode chip when status === "deployed", so any drifter with an already-polluted stale mode (like the two workshop units that triggered this fix) immediately shows — without needing a DB migration. Mode filter dropdown now also gates on deployed status, so filtering by BEACHED cannot match workshop rows with a stale mode.

• Deploy and Recover coordinate flow reframed. Instead of separate Lat / Lon fields and two seemingly-decorative buttons underneath, the section now reads as a single question — "Where did you deploy it?" / "Where did you retrieve it?" — with the coordinate inputs side by side and the two ways of filling them (📍 Use my location, 🗺 Mark on map) presented as an explicit pair beneath. Intent-first, mechanism-second.
• Picker map now shows context. On Recover, the target drifter's last known Myriota position appears as a grey reference dot with a small label — so the picker answers "the satellite says it's here; tap where you actually found it" rather than showing an empty map. On Deploy, other currently-deployed drifters appear as small tan dots so you can see the fleet layout when picking a new drop point.
• Picker header hint text adapts to what's on the map — different sentence for Recover, Deploy, and the no-reference case.

• Tap-on-map coordinate picker on Deploy and Recover. New 🗺 Pick on map button next to the 📍 GPS button. Opens a full-screen Leaflet overlay — tap anywhere to drop a marker, drag the marker for fine-tuning, live coordinate readout in the header. Confirm writes the picked coordinates back to the form field.
• Picker starts with a sensible default view: any existing coordinate in the form is honoured first, otherwise the drifter's last known position, otherwise the assigned area's centre, otherwise Cairns. So when you open the picker for a drifter that's already deployed at Fitzroy, it opens zoomed on Fitzroy.
• GPS button also available inside the picker — for when you open the picker, decide GPS would be easier, and don't want to close-and-reopen.
• Leaflet is lazy-loaded on first open so the ~150 KB bundle only costs you if you actually use the picker. Service worker pre-caches the vendor assets, so a second open (and any future open, even offline) is instant.

• Installable as a PWA on iPhone and iPad. Add-to-home-screen from Safari (tap the share icon, then "Add to Home Screen") gives Drift Analysis its own app icon, standalone window with no Safari chrome, and dark-navy status bar. Same behaviour on Android Chrome. Icons are placeholders matching the topbar brand mark — swap for real artwork whenever you're ready.
• Manifest declares Map / Fleet / Setup as launch shortcuts so long-press on the home screen icon (iOS 16+, Android) jumps straight to a specific page.
• Service worker caches the app shell (HTML, Leaflet vendor, icons) so the PWA opens even with no signal. Deliberately does NOT cache API responses or map tiles — you were explicit about not wanting an offline map or stale data.
• Offline-safe deploy and recover. Both actions on the fleet page now queue in localStorage when the device is offline or the request fails with a network error. Queue drains automatically on reconnect, on tab-becomes-visible, and every 30 seconds while the page is open. A yellow ⏳ N pending sync chip in the action bar shows the queue depth; tap it to see each pending action with Retry and Remove buttons. Conflict rule is last-write-wins — the boat is authoritative for what happened in the water.
• Small green/red dot in the topbar reflects navigator.onLine. Hover for a tooltip.
• "Use my current location" button on Deploy and Recover. One tap fills lat/lon from the browser's geolocation API with high-accuracy request. Works offline (GPS doesn't need signal). Shows accuracy in metres.

• Same-second impossible-jump check fixed (second layer of the v3.7 bug). The v3.8 hotfix restored the denorm columns in the drifter lookup, but the distance check still required dtHours > 0, so two ingestion calls that landed in the same Unix second (Myriota timestamps are second-resolution, and satellite passes can deliver multiple packets per second) slipped through. Caught by re-running the Darwin smoke test: both calls got the same fixed_at and the jump was marked clean again.
• Quality rule rewritten as an implied ground-speed check: computes distance / time and flags anything above 20 km/h (physically well above the ~10 km/h East Australian Current cap). The time-delta divisor is floored at one minute-worth-of-hours so same-second deliveries don't hit division-by-zero and GPS jitter inside a satellite pass window doesn't false-positive. A secondary distance > 500 m guard stops small jitter cases from ever tripping the rule, no matter what the implied speed says.
• Verified against six edge cases before shipping: same-second 1900 km jump, legit 15-min spawn-cadence fix, GPS jitter same-second, 44-second Darwin jump, (0,0) cold-start, and first-ever fix. All produce the expected quality tag.

• Impossible-jump quality check fixed. v3.7 shipped the distance-jump rule (>200 km from previous fix in under an hour = mark suspect) but the drifter lookup query only selected the id column, so assessQuality saw undefined for last_lat / last_lon / last_fix_at and silently skipped the distance check. Caught by a smoke test that posted a Fitzroy → Darwin jump (~1900 km in 44 s) and got quality: "clean" back. The lookup now selects the denorm columns, and the null-guard uses != null so future callers can't recreate the bug with an undefined field.
• Cleanup SQL provided in schema/0004_reset_test_pollution.sql — DRIFT-051's denorm state was polluted with Darwin coordinates during the v3.7 test run. Paste this in the D1 Console to reset before re-testing.
• The (0,0) cold-start rule was unaffected and continued working correctly in v3.7; only the distance-jump rule was broken.

• Myriota envelope adapter — new POST /api/ingest/myriota endpoint that speaks Device Manager's actual webhook shape. Parses the escaped Data JSON string, decodes each 20-byte hex payload using the DriftSpawn binary format, and delegates into the same code path as the idealised /api/ingest. Point Myriota's custom destination at this URL when you register the first live module.
• DriftSpawn 20-byte payload format frozen and documented — the Setup page's generated config.h now includes the exact DriftSpawn_message_t struct definition at the top, so firmware and decoder can never drift out of sync. Layout: seq (u16), lat_e7 (i32), lon_e7 (i32), fixed_at (u32), sst_c100 (i16), batt_mv (u16), mode_sats (u8), hdop_x10 (u8) — 20 bytes exactly, matching Myriota's per-message maximum.
• Dedup on ingest — Myriota's Message Store retries on transient network errors. Ingestion now silently accepts duplicate deliveries (same drifter, same fixed_at within 1 s, coordinates matching to ~11 m) rather than double-inserting. Response includes a dedup: true flag so you can tell it happened.
• Bad-fix quarantine — fixes at exactly (0,0) (classic GPS-not-locked cold start) and impossible jumps (>200 km inside an hour from the previous fix) are now tagged quality: "suspect" in the track_points table. Suspect fixes are stored but do NOT update the drifter's last_lat / last_lon, so the map stays anchored to the last clean position rather than teleporting on a garbage lock. Requires a one-time schema change — see schema/0003_track_point_quality.sql.
• Silent-drifter warnings on the fleet page — a deployed unit whose profile expects, say, one message every 50 minutes but hasn't reported for over 2.5 hours (3x expected gap) now shows a red ⚠ chip next to its ID and a warm-tint background on the row. A summary chip in the action bar ("⚠ 3 silent") gives you the whole-fleet count at a glance, independent of active filters. Threshold is derived per-profile from msg_per_month, so spawn-cadence and long-term profiles use their own appropriate cutoffs.
• simulate_ingest.sh myriota — new subcommand posts a realistic Myriota-shaped envelope (with a properly packed 20-byte binary payload) through the adapter end-to-end, so you can prove the whole decode path works before any hardware is registered.

• Hover to preview on desktop — mousing over a drifter marker now opens its details popup, so you no longer have to click every unit just to check on it. Clicking still works and behaves the same as before (opens popup, selects the drifter in the sidebar). On touch devices (iPhone, iPad without a mouse) the behaviour is unchanged: tap to open. Detection uses @media (hover: hover) and (pointer: fine), so an iPad with a paired trackpad or mouse does get hover behaviour.
• Small close delay after mousing off a marker so you can slide onto the popup itself without it vanishing, matching standard hovercard behaviour.
• Coast overlay cleanup — the crude Yarrabah mainland rectangle is gone. The Coast layer still bundles the Fitzroy Island, Little Fitzroy, outer reef, and Arlington Reef guides, which are genuinely useful markers on satellite view where the reefs render as pale blobs. The Yarrabah place-name label is unchanged.
• _headers file for Pages caching — HTML entry points now serve with no-cache, must-revalidate, and vendor assets with a one-year immutable cache. Fixes the "I deployed but it did not update" issue at the source: every future deploy is visible on refresh, no hard reload needed.

• Setup page — new third tab in the top nav. One form captures every parameter a new drifter needs (ID, variant, Myriota module serial, hardware rev, build date, sponsor / area / cadence profile, initial status), registers it in the fleet, and generates two things you paste at the bench:
• A per-unit config_DRIFT-###.h header (copy or download) that drops straight into the Myriota SDK build tree — one #define per parameter, so nothing gets typed twice and every flashed unit carries its identity, sponsor, area, profile, and cadence constants baked into the firmware.
• A copy-pasteable bench command block that walks through the SDK build, USB flash, Device Manager registration, and post-flash smoke-test with simulate_ingest.sh.
• Suggest next ID button — picks the next number in the appropriate range based on variant and area, so you don't collide with an existing unit.
• Preview only button — see the generated config and commands without touching the fleet database. Useful for spot-checking an already-provisioned unit's parameters.
• Recently provisioned list at the bottom of the page so you can glance back at what was last built.

• Telemetry ingestion endpoint — new POST /api/ingest on the Worker, ready to receive real fixes from a Myriota webhook. Accepts one point or a batch, resolves drifters by ID or module serial, auto-links each fix to the open deployment, updates the drifter's last-known position (skipping out-of-order deliveries).
• Uses a separate INGEST_TOKEN secret rather than the admin key, so a leaked webhook URL cannot pivot into the fleet management API.
• Simulator endpoint — POST /api/ingest/simulate generates a plausible fix near a drifter's last known position and pushes it through the real ingestion path, so you can smoke-test the whole pipeline without hardware.
• Dashboard still reads from the mock dataset; the switch to live track_points reads is scheduled for v3.5.

• Labels toggle — new icon in the header (between full-screen and settings) turns drifter ID pills on and off. When on, the pills reappear with their dashed leader lines pointing back at the marker; when off, both stay hidden. Choice is remembered across sessions.
• By default labels stay hidden (the cleaner map look introduced in v2.5).

• Killed the dangling leader lines — the little dashed lines fanning out from each marker were left over from when drifter IDs were shown next to markers. Since v2.5 hid the labels, those lines were pointing at nothing. Gone now.
• Coast overlay off by default — the beige "Yarrabah / Fitzroy / Outer Reef / Arlington" polygons no longer paint over the satellite imagery on first load. Still available: layer picker (top-right of the map) → tick Coast to bring them back.
• No more login flash on the Fleet tab — the overlay used to blink into view for ~200 ms while the cached key was being validated. Now it stays hidden immediately when a key is present, and only reappears if the key turns out to be bad.

• Login stops nagging — going Fleet → Map no longer forces a re-sign-in; the overlay now correctly stays hidden when credentials are already cached.
• New full-screen map toggle (icon in the header next to the ⚙ gear) — hides the fleet sidebar so the map takes the whole viewport. State is remembered across visits.
• Track polylines now render on canvas instead of SVG — fixes the visible "jump-and-snap" of vector lines while pinch-zooming on iOS satellite view.

• Richer fleet table — four new sortable columns: Mode (current operating mode with colour), Dist (total km travelled), Msgs (message count), and Last fix (time of latest position).
• New Mode filter dropdown — quickly show only Beached drifters, only Normal, only High cadence, etc.
• Rows for drifters that never left the workshop show "—" in the telemetry columns.
• Telemetry values come from the shared mock dataset for now; will switch to live track_points reads once v3.3's Myriota webhook lands.

• Marker taps stay put — tapping a drifter on the map now just opens the info popup, no more auto-zoom to that drifter's track (which forced you to zoom back out to see the rest of the fleet). Sidebar card taps still pan & zoom to fit the drifter's full track, since that's when you actually want to focus on one.
• Popup also no longer pans the map to keep itself in view — it opens where you tapped, full stop.

• Login overlay fix — the sign-in card was falling through into document flow on iPad Safari (a missing CSS selector line meant position: fixed was never applied). Now correctly covers the whole viewport so you can log in on any device without scrolling past the map to find the fields.

• No more ?api= in URLs — the Worker URL is now baked into the frontend as a default. Bookmark the plain drift-analysis.pages.dev URL and login works out of the box.
• Override still supported: ?api=<url> for local dev, ?api= (empty) for same-origin once a route is set.

• Deploy hardening — deploy.sh now auto-installs wrangler if it's missing (fixes the Cloud Shell wipe-on-session issue) and treats a failed D1 backup as a warning rather than a hard-stop, so schema/worker/pages steps always run.

• Cleaner map — drifter ID tags are hidden by default so the water stays uncluttered.
• Tap any drifter marker to open a compact info popup: ID, sponsor, variant, current mode, distance covered, battery voltage & %, message count, area, and time of the last fix.
• Popup content updates to reflect the current timeline moment, not just the latest fix.

• Email + password login — both Map and Fleet pages now sit behind a proper sign-in form; single admin account for now, password changeable via wrangler secret put ADMIN_PASSWORD.
• New Settings panel (gear icon in header) — shows the signed-in email, exposes the API key with a Copy button for pasting into other devices, and a Log out action.
• New POST /api/login worker endpoint validating ADMIN_EMAIL / ADMIN_PASSWORD secrets and returning the FLEET_API_KEY.

• First production deploy on Cloudflare (Workers + D1 + Pages) under the drift-analysis project.

• Renamed — product is now called Drift Analysis (dashboard + management). The hardware platform itself is still DriftSpawn.

• Full fleet management system on Cloudflare Workers + D1 + Pages
• New Fleet tab: sortable/filterable table, add/edit drifters, deployment workflow, recovery workflow (R variants auto-route to workshop with cycle count, E variants to retired), maintenance log per unit
• Bearer-token auth, CORS-friendly, same-origin routing supported
• Deploy script with backup-before-migrate pattern

• Sponsor colouring — drifters tagged with a sponsor (e.g. RRF, SSC, CWI); trails and start-rings take the sponsor's colour while marker fill keeps the mode colour and shape keeps the variant
• Smooth continuous zoom interpolation — fractional zoom + per-frame lerp, no more discrete zoom-level jumps
• 14-day deployment scenario — extended from 36 h; four drifters beach or run aground (Yarrabah, Cape Grafton, outer reef, Little Fitzroy), one stays offshore drifting east into the Coral Sea
• Cadence transitions baked into the data — HIGH_CADENCE 15 min (first 48 h) → NORMAL 60 min while drifting → BEACHED 30 min once stationary, per v1.3 firmware spec
• Embedded coast outlines for Fitzroy, Little Fitzroy, Cape Grafton/Yarrabah mainland, and an outer GBR reef — always visible without map tiles
• Realistic spawn-night ring deployment around Fitzroy
• Label collision avoidance — outward from deploy point, min 20° angular gap, iterative push-out
• Solid drift trails (replaced fading gradient)
• Five playback speeds (Very Slow / Slow / Normal / Fast / Very Fast)
• View All toggle — auto-fit map to all visible drifters; starts close, zooms out as they spread
• Video export — render the drift to a downloadable MP4 / WebM at the selected speed, with the same auto-zoom behaviour
• Layer toggle for Map (OSM) and Satellite (Esri) tiles when available

• Timeline playback — play, pause, scrub through the last week
• Animated drifter movement with smooth marker interpolation
• Tracks grow as time advances; not-yet-deployed drifters stay hidden
• Speed selector (slow / normal / fast)

• First fleet dashboard release with map, sidebar, light theme