Drift Analysis

• Update banner and shared version constant. Every Cam-hosted PWA except this one shows a small banner when a new version has been deployed since you last opened it. Drift Analysis never had that — the service worker did quietly install the new shell each deploy, but there was no surface to tell you what changed. Fixed. A new version.js module now runs on every page, publishes the current version, fills every version chip from a single constant, and shows a teal banner at the bottom of the screen the first time you land on an updated build. Tap the banner to jump straight to this update log; tap the × to dismiss.
• Version chip is now clickable everywhere. Previously only the info icon in the top-right of the Map page opened this log. Now the little pill next to the app name — on every page — is a tap target that opens the update log. On pages without their own log modal (Fleet, Setup, Dashboard, Finance, Settings, Sponsors, Sponsor View) the tap navigates back to the Map page with a #changelog hash that auto-opens the modal on arrival. The hash gets stripped from the URL immediately so a refresh does not keep re-opening it.
• Single source of truth for the version string. Prior deploys bumped the version chip on eight separate HTML files by hand — an easy place to leave one behind. The chips are now empty divs in the HTML and get filled at load time from the APP_VERSION constant in version.js. Future deploys bump one constant plus the service worker SHELL_VERSION, and the changelog entry. That is it.
• First-visit behaviour is quiet. A brand-new browser session with no login key present does not get the banner on its very first visit — the seen-version key is silently initialised so a first-time visitor is not greeted with a nag about a version they have no context for. Anyone with existing local state DOES see the banner on the upgrade to v9.15, which is the whole point of adding the feature.

• Wind and current now flow across the map. The static grid arrows have been shrunk to about half of their v9.13 footprint so they read as compact reference glyphs rather than dominating the basemap, and a new canvas-based particle field animates over the top. Hundreds of short-lived streaks spawn at random points inside the viewport, follow the bilinearly interpolated wind or current vector at their location, fade out, and respawn — close to the Windy visual language, but keeping the numeric speed labels at each grid node for exact values.
• Bilinear interpolation between grid cells. The eight-by-eight grid from the weather worker is rebuilt into a proper 2D array on the client, and each particle interpolates its local u and v components across the four nearest cells. That means particles smoothly bend and accelerate as they cross a front or eddy rather than snapping between values — which is what turns an eight-by-eight sample grid into a continuous field.
• Wind is pale blue, current is teal, both scale with speed. Line width tracks local speed against the same clamp thresholds the arrows use (15 m/s for wind, 1.5 m/s for surface current), so a stiff breeze and a slack tide look visually different at a glance. Wind particles move faster and live longer to match the physical scale gap between the two layers.
• Anchored to the map, not the screen. Particle positions are stored in latitude and longitude, not pixels. When you pan or zoom, they stay locked to their real geographic position and the whole field slides with the tiles beneath. Zooming in reveals finer flow detail because the same physical velocity now covers more screen pixels per second.
• Battery-aware. The animation pauses during map drag and zoom, and while the browser tab is hidden. The particle count scales with viewport area, so a narrow window uses fewer particles than a full-screen iPad. The canvas caps device pixel ratio at 1.5 so retina rendering does not burn cycles without visible benefit.
• Arrow shrink numbers, for anyone curious. The divIcon dropped from 36 by 44 pixels to 24 by 30. The shaft went from 10 to 28 pixels down to 5 to 14. The arrowhead half-width went from 5 to 3. The numeric label went from 9.5 to 8.5 point with a slightly thinner white halo. Small enough to leave the map readable end to end; still legible on outdoor iPad brightness.

• Click the silent chip to filter to silent drifters. The "⚠ N silent" summary chip on the Fleet toolbar used to be a display-only badge — you knew how many silent units you had but had no fast way to zero in on them. Now the chip is clickable: one tap narrows the fleet list to just the silent drifters; the chip inverts to solid red and its label changes to "⚠ N silent — clear" while the filter is engaged; tap again to clear and return to the full list. Combines with the other filters (search, status, sponsor, area) so you can, for instance, show silent drifters attached to a specific sponsor.
• The silent count itself still reflects the WHOLE fleet, not just what is on screen — same behaviour as before — so filtering by sponsor does not hide the fact that other sponsors have silent units too.
• If a silent drifter reports in and the fleet ends up with zero silent units while the filter is engaged, the filter clears itself automatically rather than leaving you looking at a hidden empty state.

• QR scanner now works on iPad Safari. v9.11 relied on the browser-native BarcodeDetector API, which turns out to be an Android-Chrome-only feature — despite being drafted in 2019, Safari on iPadOS has never shipped it. Cam hit the fallback path (manual entry only) which was not the intended experience. v9.12 vendors jsQR (pure-JS decoder, MIT, at /vendor/jsqr.js) and wires it as the universal camera path. Frames from the video stream get drawn to an off-DOM canvas and passed to jsQR at 5 fps.
• Native path still preferred where available. Chrome / Edge on Android continue to use BarcodeDetector when it is present — the decoder is offloaded to the browser engine and saves battery. jsQR runs only when the native detector is missing or refuses the QR format. Same manual-entry field remains as a last-ditch fallback if the camera itself is unavailable.
• Camera play() called explicitly for iOS. Some Safari versions require video.play() to be triggered after srcObject assignment; without it the video element sits black even though the stream is live. Added.
• jsQR added to the service worker precache list so the scanner works offline once the app has been visited at least once.

• QR code labels for every drifter. New Show QR button in the Fleet drawer opens a modal with a scannable QR big enough to read across a workshop. Download buttons produce PNG for the label printer and SVG for the laser cutter, plus a Print button that pops a dedicated print window with a boxed QR and ID caption sized for a 60 mm sticker. QR content is da:DRIFT-NNN — the da: prefix identifies it as a Drift Analysis code so an unrelated QR scanned by the app is rejected cleanly.
• Print QR sheet. New Fleet-page toolbar button pops a grid of QR labels for every drifter currently visible under your filters. Four columns, each cell about 40 mm square, break-inside-avoid so labels never split across pages. Print, cut, stick.
• In-app camera scanner. New Scan QR button on the Fleet page opens the iPad camera and decodes QR codes in real time using the browser BarcodeDetector API (native on iPad Safari 17+, Chrome 83+, Edge). A manual-entry fallback is always visible so scanning still works under poor light or on browsers that lack barcode detection. Camera access uses the environment-facing lens by default.
• Action picker after a scan. Instead of guessing what you want to do, the scanner opens a picker with four options: Show in Fleet, Show on Map, Setup / configure, and Recover (only for deployed drifters). If the scanned ID does not match any drifter in the fleet, the picker instead offers Setup as new tracker.
• Deep-link routing. QR scans land on /fleet.html?drifter=ID, /setup.html?drifter=ID, or /?focus=ID&recover=1. Each page consumes the query param on load, opens the appropriate view, and strips the param from the URL bar so a page refresh does not re-fire the action. Also means a Slack message with a raw link works the same way as a physical QR scan.
• QR library vendored, not CDN. Uses Kazuhiko Arase qrcode-generator (MIT license, ~2 300 lines) served from /vendor/qrcode.js. No external CDN dependency; no widening of the v9.5 Content-Security-Policy.

• Fixed the collapsed Map page layout. The Map used to render as a narrow strip at the top of the viewport with an enormous empty cream area below it. Root cause was in the .app grid template: since v9.3 the grid had four row tracks (auto auto 1fr auto) matching four direct children — header, demo-banner, main, statusbar. But the demo banner defaults to display: none, which does not just hide the element, it removes it from the grid entirely. Auto-placement then shifted .main up into the second auto track and pushed the statusbar into the 1fr track, collapsing the map to content-height and letting the statusbar stretch to fill the rest of the viewport.
• Fix. Every direct child of .app now has an explicit grid-row assignment, so display state of any sibling can no longer shift the layout. Also gave .main an explicit grid-template-rows: 1fr so the child #map (which uses height: 100%) has a definite parent height to resolve against, and a min-height: 0 on .main so the grid does not try to fit the sidebar contents as a floor.
• Bug only affected the Map page — sponsor page uses a different layout entirely and was never impacted.

• Fleet-wide data export. Two new endpoints and buttons in Settings — download every drifter track ever ingested as a single CSV or GeoJSON file. CSV opens straight in Excel, Google Sheets, or a Jupyter notebook; GeoJSON drags into QGIS or ArcGIS as ready-to-use polylines. Optional sponsor filter lets you ship a research partner just their attributed drifters without piping the whole fleet through their firewall. Optional from/to timestamps clamp the fixed_at window.
• Per-drifter export. Two new Export buttons in the Fleet drawer (CSV and GeoJSON) download a single drifter track history without needing a fleet-wide download. GeoJSON includes start and end point features on top of the LineString so a GIS tool can symbolise launch vs recovery locations differently.
• Bulk CSV import. Backfill historical tracks (salvaged loggers, old CSVs from research partners, hand-collected surveys) via the new Data import card on Settings. Paste CSV directly or upload a file — same column layout as the export so an export-edit-import round trip is the safe backfill pattern. Dry-run mode validates the whole batch and reports would-insert / would-skip counts plus the first twenty errors before touching the database.
• Deduplication on import. The import path uses the same tolerance the live ingest uses — same drifter, fixed_at within one second, coordinates within roughly eleven metres — so re-importing an export by mistake produces zero new rows. Idempotent by construction.
• New endpoints: GET /api/export/drifter/:id?format=csv|geojson, GET /api/export/fleet?format=…&sponsor=…&from=…&to=…, POST /api/import/track-points?dry_run=true. CSV column order is fixed at drifter_id,fixed_at,lat,lon,mode,batt_mv,sst_c,sats,hdop,quality,deployment_id. sst_c is decimal degrees Celsius (unpacked from the centi-degree storage encoding); hdop is decimal (unpacked from tenths).

• Alerts on every admin page. A pulsing red pill appears in the topbar whenever the fleet has anything to look at. Click it for a modal listing every open alert with a Resolve button. Kinds tracked: beached (firmware reported BEACHED mode), low_battery (firmware reported LOW BATTERY mode), silent (deployed unit has not sent a fix in 24 hours), and missing (deployment was closed as lost).
• Detection pipeline. Beached and low-battery alerts fire on the ingest hook the moment a fresh track point with the matching mode code lands in D1. Silent alerts fire from a new every-10-minutes cron trigger that scans deployed drifters and opens an alert for any whose last_fix_at is older than 24 hours. Everything is idempotent by construction — the alerts table enforces "at most one open alert of each kind per drifter" via a guard inside the insert helper, so a beached drifter still pinging every 30 min does not spam new rows.
• Auto-resolve on recovery. The existing POST /api/drifters/:id/recover flow now closes every open alert for that drifter as part of the recovery transaction. A drifter that was beached-and-silent for a week and finally recovered clears both alerts in one action, no manual click-through needed. Deployments closed with outcome=lost open a fresh missing alert instead — a manually-marked missing unit that gets found later closes that alert automatically on the recovery call.
• Desktop notifications. New Settings toggle asks for browser Notification permission and, when granted, fires a system notification for each new alert while Drift Analysis is open in any tab. Not Web Push — this only works while the app is running in a browser. True push notifications on a locked phone come in a later release, but the plumbing (poll, dedup by known IDs, notification.tag for coalescing) is already in place.
• Two new endpoints and a stats endpoint. GET /api/alerts?open=true lists alerts with drifter context inlined; POST /api/alerts/:id/resolve closes one; GET /api/alerts/stats returns just the open-count-by-kind for the topbar badge so it does not need to fetch the full list every minute.
• Cron split. The daily backup + login-attempts prune stay on 0 0 * * *; the every-10-minutes silent-drifter check runs on */10 * * * *. The scheduled handler checks event.cron so the heavy backup does not run every ten minutes. Requires schema migration 0015_alerts.sql.

• Recovery mode. New Recover this drifter button in every drifter popup on the Map page. Opens a modal that concentrates everything a recovery team needs into one panel: last-known position (decimal degrees + degrees-minutes-seconds), time since last fix, distance and bearing from Cairns in kilometres and nautical miles, rough ETA at 15 kt, live wind and surface current at the drifter position, and a Mark as recovered button that closes the open deployment via the existing worker endpoint.
• GPX waypoint export. One-click GPX 1.1 download from the Recovery panel — feed it into Navionics, OpenCPN, iNavX, or any chartplotter that accepts GPX. Waypoint includes the drifter ID, last-fix timestamp, and a short description with the transmission mode and battery so an old cached waypoint of the same name does not confuse the plotter.
• Copy coordinates. Copies decimal degrees to the clipboard for pasting into a VHF handover, a Slack message, or a mate texting from the boat.
• Single-point weather query. New GET /api/weather?point=lat,lon mode shares the same Open-Meteo proxy and 15-minute cache as the grid mode, so the Recovery panel populates its wind and current values without a second code path or a second upstream fetch when the grid already covers that point.
• Wind and current direction match the arrow layer convention. Both are shown as "flow to" bearings in degrees plus a 16-point compass label. Consistent with the arrow overlays on the map — no mental rotation needed between the panel and the map.

• Wind and ocean-current overlays on the Map page and sponsor page. New Leaflet layers render an 8×8 grid of arrows over the visible bounds. Blue arrows point in the direction the wind is going; teal arrows point in the direction the surface current is flowing. Arrow length scales with speed so a stiff breeze reads at a glance without needing to check the numbers. Each arrow carries a small numeric label with the speed in the currently selected unit.
• Speed units: knots, km/h, mph. Cycle through them with the third button on the weather control (kt → km/h → mph → back to kt). Selection persists in localStorage so you get the same unit on every page load. Under the hood the worker always returns m/s; the client converts on render, so switching units does not refetch.
• Data source: Open-Meteo, proxied through the worker. New endpoint GET /api/weather?bbox=…&grid=8 fetches surface wind (10 m) and surface current (~0.5 m) from Open-Meteo in one worker call, converts wind from meteorological FROM-direction to flow-direction so both layers use the same arrow convention, and returns a compact grid. Responses are cached in the worker for 15 minutes keyed by rounded bbox so panning around does not hammer the upstream. Proxying through the worker also keeps the v9.5 Content-Security-Policy tight — nothing new added to connect-src.
• Layer toggles are independent and persistent. Two buttons in the top-right of the map: Wind and Current. Either can be on alone, both on, both off. State survives page reloads. Data refreshes automatically on map pan or zoom (debounced 800 ms) and every 15 minutes on a timer while any layer is active. Both layers off means zero upstream calls.
• Ocean current is null over land. The Open-Meteo Marine model returns nulls for grid points that fall on land; the client just skips those, so a bbox that straddles a coastline shows current arrows only over water and wind arrows everywhere.

• Content-Security-Policy header now shipping on every response. Closes the last open audit item from the v8.5 audit. The strictness had been on hold because the codebase leans heavily on inline scripts and per-element style attributes, and any policy tight enough to block inline execution would have needed a build-time nonce pipeline that does not exist. The v9.5 policy takes the pragmatic middle ground: script-src and style-src keep unsafe-inline so nothing breaks, but the exfiltration surface is closed off elsewhere. connect-src is locked to same-origin plus the worker only, so any future stored-XSS on an admin page cannot phone home to an attacker-controlled endpoint. img-src allows any HTTPS host so Leaflet tile providers keep working. frame-ancestors none, form-action self, base-uri self, and object-src none add belt-and-braces mitigations against clickjacking, form hijack, base tag injection, and legacy plugin exploits. Extracting inline scripts to files remains as follow-up tech debt for a future release.

• Sponsor share tokens bumped to 256 bits and can now expire. New tokens are 32 bytes / 64 hex characters instead of 16 bytes / 32 hex characters. The token generation endpoint POST /api/sponsors/:key/token now accepts an optional ttl_seconds body param — when supplied, the token becomes invalid after that many seconds. Existing 128-bit tokens keep verifying at their stored length so nothing breaks in the field; rotate through the admin UI when you want a wider token. Requires schema migration 0014_share_token_expiry.sql to add the expiry column.
• Password complexity now requires more than a length check. New passwords need to be at least 12 characters and must include at least one letter and at least one digit. Symbols are welcome but not required, so nobody has to invent a fresh Password1! pattern. Applies to user creation and password changes; login still accepts anything for an already-issued password so legacy accounts keep working until each user next rotates theirs. Client-side check in the Settings > Users modal mirrors the worker rule, and the auto-generated password now always contains both a letter and a digit by construction.
• View All convergence flag now resets when the target moves. Cosmetic follow-up to v8.8. The one-shot tile redraw that fires when the map first reaches the fleet target could never re-fire during long playback runs because the flag stayed pinned to true as the map drifted with the fleet. The flag now clears whenever the target position moves more than about a kilometre or a tenth of a zoom level between frames, so a returning redraw can happen properly.
• Verified sponsor page map-legend CSS variables. Audit item close-out: --border, --ink-2, --ink-3 and --ink-4 are all defined in the sponsor page root scope. Nothing to fix.

• Map page now shows live fleet data by default. The Map page used to load a 75 000-line static mock dataset on every hit and render a fake 14-day spawn scenario regardless of what was actually in the database. Convenient for the pre-hardware era but confusing once real drifters started landing in D1 and the Map still showed the fake fleet. New worker endpoint GET /api/fleet-map returns every drifter across every sponsor plus track history and the registry, shaped to match what the Map page already expected from the mock file. Track sst and hdop are unpacked from the centi-degree and tenths encoding used in track_points. Track fetch is capped at 200 points per drifter to bound the response size.
• Demo dataset gated behind ?demo=1 or a Settings toggle. The static mock fleet is still available for sponsor pitches, screenshots, and walkthroughs where you want a full 14-day spawn scenario without hardware. Append ?demo=1 to the Map URL, OR flip the new Demo data toggle on the Settings page, and mock_data.js loads dynamically instead of the live fetch. Setting persists in localStorage per device.
• Demo mode banner. When demo mode is active, a small amber banner sits under the header on the Map page explaining that the map is showing mock data and offering a one-click Turn off. Prevents demo mode getting left on accidentally when you switch back to live work.
• mock_data.js no longer ships on every page load. The 75 000-line file is now only fetched when demo mode is active, so a normal live-data visit to the Map page saves roughly 1.6 MB of transfer.

• Password hashing bumped from 100 k to 600 k PBKDF2 iterations. Matches the OWASP 2023 baseline for PBKDF2-SHA-256 and brings the crypto surface in line with Volunteerapp. Existing users are not disrupted: stored hashes now carry their iteration count so old 100 k hashes still verify, and the login handler quietly rehashes each user at the new work factor the moment they successfully sign in. Legacy hashes disappear naturally as everyone logs in over the coming weeks. Storage format is iters$hexhash for anything written by v9.2+; bare hex is treated as a 100 k legacy hash.
• Sponsor view cache no longer keeps stale copies indefinitely. The admin picker used to keep every fetched sponsor dashboard in memory for the life of the tab. On a browser session left open for a working day, clicking back onto a sponsor could paint from a cache that was hours out of date before the fresh fetch resolved. Cache entries now expire after five minutes, and the whole cache is cleared whenever the tab becomes visible again, so returning to Drift Analysis after a break always refetches. Instant paint on quick picker swaps still works exactly the same.

• Sponsor map marker now matches the activity feed after recovery. Third time this bug has come round the loop and it keeps happening because there is a middle state we did not colour for. A drifter that has been recovered goes from status recovered (orange) to status in_workshop (grey) the moment someone opens it for refurb — but the activity feed still shows the recovery as its latest event, so the map read grey while the feed read orange. Now, when a drifter sits in in_workshop or ready_to_deploy, the marker colour falls back to the outcome of its most recent completed deployment. Recovered → orange, lost → red, no prior deployment → the v8.9 rule (ready green, workshop grey). The dot stays orange until the unit is redeployed.

• Topbar tabs moved to their own row. Every admin page used to cram the eight nav tabs, the version chip and (on the Map page) the icon buttons into a single row on the right of the header, which looked squashed and left the middle of the header empty. The tab strip now sits on its own row below the brand, spanning the width of the header, with a hairline separator between rows. Row one carries brand + version chip + any icon buttons; row two is just the tabs. Applies at every viewport width, not only mobile.

• Sponsor map no longer greys out the whole fleet between deployments. The marker colour lookup treated only deployed, recovered and missing as coloured states, so a sponsor whose drifters were built and ready but not currently in the water (which is the RRF fleet most of the time) saw every marker in muted grey. ready_to_deploy now renders in the same green as a deployed drifter in Normal mode — the unit is prepped and armed, so the operational colour reads more honestly. in_workshop, retired and salvaged remain grey.
• Deployed drifters now show their real transmission mode on the sponsor map. Latent bug going back to v8.2. The sponsor-view worker query fetched every last-known field for each drifter except last_mode, so the mode lookup always fell through to Normal (green). A drifter transmitting in Beached, Low battery, Recovery, High cadence or Geofence mode would still render as Normal green on the sponsor page. Query now selects the field, marker colour matches the actual mode.
• Show all drifters button. Added to the sponsor page next to the play controls. Re-fits the map to include every attributed drifter last-known position plus full track history. Useful after zooming in on one unit, after playback finishes, or when a sponsor first loads the page and wants to reset the framing without reloading. Works the same whether the map is static or a playback animation is running.

• Playback flashing fixed. Pressing play on the Map used to make the basemap flash roughly four times a second — every tile appeared to briefly reload behind the moving drifters. The cause was the View All lerp committing a setView every 45ms even when the computed change moved the view less than a pixel, because the fleet was always shifting slightly during playback so the lerp target never converged. Now the code compares the target position to the current position in container-pixel space and only commits a setView when the change would be at least four pixels of pan or 0.03 zoom levels. Below that threshold the change is imperceptible, so we skip the setView entirely — the RAF loop keeps running frame-accurately, the tile pane just no longer churns.
• Topbar tabs wrap on mobile. The eight admin tabs used to spill off the right edge of the screen on a portrait iPhone (Finance and Settings got clipped). The tab-strip container was set to flex-wrap: nowrap as an inheritance from the desktop styling. On screens narrower than 820 pixels the container now wraps onto a second row, so every tab is tappable without guessing there's a hidden horizontal scroll.

• Shared topbar. The eight admin tabs used to live in each of eight HTML files — with the Map page using inline styles (including a stray escaped-quote artefact on the Finance tab) and the others using class-based styling. Adding, renaming or reordering a tab meant editing eight places in two styles, and I missed pages more than once. All eight pages now render the tab strip from a single topbar.js. Edit the TABS array in that one file and every page updates.
• CORS whitelist. The worker used to echo any Origin header back to the browser (or default to * when Origin was absent), which meant any web page could invoke the API on behalf of a logged-in admin's browser. Restricted to drift-analysis.pages.dev and localhost dev origins. Server-to-server callers that don't send Origin are unaffected.
• Login rate limiting. Ten failed attempts for the same email in a fifteen-minute window now returns 429 before the password is verified. Successful login clears the failure history so a fat-fingered admin isn't locked out afterwards. Records live in a new login_attempts D1 table (migration 0013); the daily backup cron prunes rows older than 24 hours.

• Sponsor map markers now match the activity feed. A recovered drifter used to render on the RRF sponsor map in green because the marker colour came only from its last transmission mode, but the activity feed showed the same event in orange. Confusing at a glance. Markers now colour by lifecycle status first, transmission mode only if the drifter is still deployed. Recovered = coral orange, missing = red, in-workshop and other non-deployed states = muted gray.
• View All flicker eliminated. Even after the v8.5 throttle, the satellite basemap had a residual flicker behind the drifters. It was Leaflet's default tile fade-in cycling on every setView during the lerp. Disabled the fade animation on the admin map — tiles now snap in without the alpha crossfade.
• Page loads faster after login. A latent bug had the login flow write a plain email string over the JSON identity blob a moment after writing it, which broke the client-side role cache and forced every page to network-fetch /api/whoami before it could apply the role UI. Removed the overwrite in three places (Map, Fleet, Setup) and taught the reader to accept the JSON. First paint no longer waits on a round trip.
• Stored-XSS closed across the admin pages. Fleet, Setup, Sponsors, Dashboard and Settings previously wrote server-controlled strings (sponsor name, abbreviation, area name, drifter notes and so on) into innerHTML without escaping. A rogue admin could have injected script that ran in every other admin's session and exfiltrated the session token from localStorage. Every interpolation now goes through esc(), and sponsor colour values used inside CSS style attributes are additionally clamped to a hex-only regex before insertion.
• Ingest and env-admin login now use constant-time compares. The Myriota ingest token and the break-glass env-admin password were compared with ===, which short-circuits at the first differing byte. Not exploitable over the network in practice, but the fix is a one-line loop and there is no reason not to do it.
• Worker 500 responses no longer leak internal error text. The catch-all used to return e.message in the response body, which surfaced D1 error strings and stack fragments to any caller. Now logs internally and returns a generic "Server error".
• Security headers. Added X-Content-Type-Options: nosniff, X-Frame-Options: DENY and Referrer-Policy: strict-origin-when-cross-origin site-wide via _headers. CSP is next but needs a decision on inline scripts.

• View All no longer leaves the satellite view blank. The smooth lerp toward the fleet bounds was calling setView at 60 frames a second, which fired a new tile request on every frame and cancelled the previous one before it could arrive. OSM tiles are heavily CDN-cached so they mostly got through, but Esri satellite tiles are slower and were being cancelled repeatedly, leaving the map blank until the user manually zoomed. The lerp now commits at 20 frames a second and forces a fresh tile redraw the moment it converges on the target view, so the satellite basemap fills in immediately when View All finishes.
• Track overlay fade skipped during View All. The v8.3 zoom-hide handler was toggling the polyline overlay pane opacity 60 times a second while View All was lerping. Harmless but wasteful — the handler now checks whether it is a real user zoom before running.

• Sponsor activity feed no longer double-lists drifters. A drifter that was deployed and later recovered used to show up twice, which read as if the same unit was simultaneously "Deployed" and "Recovered". The feed now shows one row per drifter with its latest lifecycle event, matching the current status on the card grid below.

• Track zoom glitch fixed properly this time. On both the Map and Sponsor View, tracks were being drawn at the target zoom level while the map tiles were still animating to it, so during a pinch the polylines briefly appeared far too large and snapped back into place when the finger came off. Canvas rendering alone did not fix it because Leaflet reprojects path pixel positions on zoom-animation start. The overlay pane (which holds all polylines and the canvas layer) is now faded out for the 80 ms of the zoom animation and faded back in on completion, so tiles animate smoothly and tracks reappear at the correct position with no visual jump. Markers and tooltips are unaffected.

• Sponsor View tab restored on the Map page. Every other admin page had it, the Map page was missing it. Now the topbar shows the same eight tabs everywhere: Dashboard, Map, Fleet, Setup, Sponsors, Sponsor View, Finance, Settings.
• Sponsor map now matches the admin Map page. Markers use the same shape-by-variant convention (R is a circle, E is a square) and are filled with the mode colour: green for Normal, blue for High cadence, red for Beached, plus the Geofence, Low battery, and Recovery colours from the admin palette. Track polylines are drawn in the sponsor's brand colour. A legend row above the map spells out the shape, mode, and sponsor conventions in the same layout as the admin map.
• Smoother pinch zoom. Track polylines were rendering to SVG with per-vertex reprojection, which made them lag behind the tile pane during a pinch gesture and snap into place when the gesture ended. Switched the map to canvas rendering for its overlay so the tracks stay in lockstep with the map tiles throughout the zoom.

• Pinch and double-tap zoom work on the sponsor map again. The v7.6 "no zoom" change over-corrected: page-level gesture blocking was also killing pinch inside the map. The gesture handlers now skip when the touch is inside the map, and Leaflet's touch and double-click zoom are re-enabled. The page still stays fixed to screen size and the plus/minus buttons stay hidden as before.

• Session warmup with a loading screen. When you sign in or open the app on an already-authenticated device, a full-screen "Preparing your workspace" overlay appears while every read endpoint the app uses is prefetched in parallel: whoami, registry, drifters, dashboard, finance summary, contributions, and one sponsor-view per sponsor. When it dismisses, Dashboard, Fleet, Setup, Sponsors, Finance, Settings, and the Sponsor View all pop open instantly for the rest of the session. Runs once per browser session and skips for sponsor logins and on the sponsor.html page directly.
• Satellite view on the sponsor map. Sponsor dashboard map now has a small Map / Satellite toggle in the top-right corner, using Esri World Imagery for satellite. Defaults to the street map with reef labels. The toggle is collapsed by default so it does not intrude on the fleet view.

• Faster page data. The offline layer now serves cached API responses instantly on repeat visits and refreshes them in the background, instead of blocking every page on a network round-trip to the worker. Together with the v7.7 shell caching, this should make hopping between Fleet, Setup, Sponsors, Finance, and the Sponsor View feel near-instant on a warm cache. Fresh data still flows in on the next visit.
• Freshness window is five minutes. Beyond that, the cached copy is treated as stale and the network is queried first (with cache fallback if offline). Writes still purge related cache entries immediately, so anything you edit shows up correctly on the next read.
• Opt-out available. Live-tracking screens can force a fresh fetch by calling fetch with cache no-store. Not used anywhere yet, but the door is open.

• Fixed the Safari service-worker crash. After v7.7 shipped, Safari on iPad started refusing to open the site with "Response served by service worker has redirections". Cloudflare Pages returns a redirect for some shell URLs, and Safari refuses to serve a redirected response back from the service worker cache. The service worker now strips the redirect flag off every response before storing it, and re-strips defensively on the way out for anything cached by an older version.
• Recovery. If any device is still stuck on the "Safari can not open the page" screen after this deploy, pull to refresh twice, or clear the site data for drift-analysis.pages.dev in Safari Settings.

• Pages open instantly. The service worker now serves the cached shell straight to the browser and refreshes the cache in the background, instead of waiting on a full network round-trip for every navigation. Switching between Dashboard, Fleet, Setup, Sponsors, Finance, Settings, and the Sponsor View should feel near-instant on a warm cache. New deploys still propagate on the next load thanks to the shell-version bump on every release.
• Offline path unchanged. If the app really is offline and the requested page was never cached, the previous fleet-page fallback still kicks in.

• Sponsor map is now fixed to the screen. Pinch and double-tap zoom are disabled on the sponsor page, and the map itself no longer shows the plus and minus controls or accepts scroll-wheel, pinch, or double-click zoom. The view is fit to the fleet on load and stays put.
• Tap a drifter on the map to see its name. Map markers now show a labelled tooltip with the drifter ID on tap, so it is obvious which dot is which. Replaces the older popup which did not open reliably on touch.
• Tap a Recent activity event to highlight the drifter. Clicking a deploy or recover entry in the activity list now pans the map to the matching drifter and opens its label. Same behaviour as tapping one of the drifter cards below the map.
• Sponsor picker feels instant. Chip highlight updates immediately on tap. The dashboard fades subtly while the new sponsor loads. Repeated visits to the same sponsor during a session paint instantly from an in-memory cache while the fresh data loads in the background.
• Play button now works with the mock fleet. Drifters without real satellite pings get a deterministic synthesised track history (about 45 points across the last three days, ending at their last known position) so the play button can animate the fleet without needing hardware in the water. Once real pings are ingested for a drifter they take precedence and the synth track is not shown.
• Ping counts on the sponsor dashboard stay coherent. Satellite messages fleet-wide and per-sponsor now reflect whichever is higher of the server count and the synthesised track total, so cards, stats, and the map animation all tell the same story on demo data.

• Admin topbar on the sponsor dashboard. When signed in as admin or viewer, the sponsor page now shows the full topbar with Dashboard, Map, Fleet, Setup, Sponsors, Sponsor View, Finance, and Settings tabs, matching every other admin page. Sponsor View is highlighted as the active tab. The Exit preview pill from v7.4 has been retired since the tabs make it redundant.
• Sponsor sessions and share-link visitors do not see the topbar. They still see the marine hero and Sign out only, as before.

• Exit preview button on the sponsor dashboard. Admins and viewers previewing a sponsor now get an Exit preview pill next to Sign out that jumps straight back to the admin Dashboard. Previously the only way out of the sponsor page was to sign out completely. Share links and sponsor sessions do not see this button.

• Play button on the sponsor fleet map. Sponsors can now watch their drifters actually drift. A play control in the map header sweeps virtual time across all track points for the current sponsor, growing each polyline and moving each marker along its path. Markers appear one by one as their first ping is reached.
• Speed pill cycles 1× / 4× / 16× so the full history can be watched in about thirty seconds or blown through in two. A slim scrubber under the map shows overall progress with the current virtual timestamp on the right.
• Play → Pause → Resume on a single button. Playback auto-stops at the end and restores the static full-path view. Swapping to a different sponsor in the admin picker cleanly cancels an in-flight animation.

• Fix sponsor dashboard failing to load. The v7.1 track-points query in getSponsorView referenced a non-existent column fix_at; the actual column on track_points is fixed_at. The drifters table uses last_fix_at which is where the typo crept in from. Sponsor dashboards now load again for admin preview, share links, and sponsor sign-ins.

• Interactive fleet map on sponsor dashboard. Markers are now 10px (up from 7) with 3px white outline — clearly visible. Tap any marker to open a themed popup with variant, area, hardware rev, battery, and last-fix age. Track polylines drawn behind markers show each drifter's drift path.
• "Your drifters" card grid below the map. Every attributed drifter gets a card with status chip (Deployed / Recovered / Missing colour-coded to match the map), variant, area, battery, last fix, track ping count, and position. Cards use a coloured left border matching their status.
• Click a drifter card → fly the map to that unit and open its popup. Smooth interlink between the cards below and the map above.
• Backend: /api/sponsor-view/:key now returns a tracks object keyed by drifter_id, with the most recent 60 pings per unit (chronological), so paths render without an extra request.

• Sponsor View tab in the topbar. Added a new tab on every admin page (Dashboard, Fleet, Setup, Sponsors, Finance, Settings) that opens the marine sponsor dashboard directly. One tap access, no drawer needed.
• Admin sponsor picker inside the dashboard. When an admin visits sponsor.html without a specific sponsor selected, the hero now shows a chip row of all sponsors (by abbrev). Tap a chip to swap the view — last choice is remembered in localStorage so subsequent visits open the same sponsor by default.

• Admin can now preview the sponsor dashboard. The /api/sponsor-view/:key endpoint was scoped so only the matching sponsor's own session (or a valid share token) could reach it — admins hitting it got 403. Now admin and viewer roles can fetch any sponsor's view without a token.
• New "Sponsor dashboard" section on the sponsor detail drawer with a Preview → button that opens sponsor.html?key=<KEY> in a new tab, showing exactly what that sponsor sees when they sign in.

• Premium sponsor dashboard. Complete redesign of sponsor.html with a marine-themed layout — deep ocean navy hero header with the sponsor's name, italic tagline, and a stat strip (units funded, contributed, fleet coverage, data received). Serif display type (Fraunces) for headers, paper-warm body background. This is the face sponsors see when they log in.
• Programme-at-a-glance stat grid below the hero: fleet size, currently deployed, recovery rate, recovered units, total pings, and their seasons. Coral + seafoam accent bars on the two most-important cards.
• Fleet map + activity timeline side by side. Their attributed drifters plotted on a real Leaflet map with color-coded markers (seafoam for deployed, coral for recovered). Recent-activity timeline shows deployments and recoveries of their units.
• Contributions section with per-contribution rows showing season, units × rate, total, and status chip (Paid / Invoiced / Uninvoiced).
• Programme impact block — dark gradient panel explaining the open-data model and recovery-drives-next-year-cost dynamic.
• Backend: enhanced /api/sponsor-view/:key to return the sponsor's contributions, their programme stats (fleet coverage %, sponsor pings, seasons), programme-wide stats (fleet total, deployed, recovered, recovery rate, total pings), and a merged recent-events feed. Sponsors log in via their credentials and land here automatically.

• Purchase batch modal now has both Unit Cost and Total Cost fields. Type either — the other auto-fills based on quantity. Changing quantity re-computes the field you didn't last touch, so "15 units at $400/unit" and "$6,000 for 15 units" both work correctly without maths in your head. Live "15 × $400.00 = $6,000.00" hint below.
• Date field (Acquired) now renders consistently on iOS — was previously ignoring width/alignment styling and looking narrow next to the other inputs.

• Fixed "Server error: user is not defined" when saving purchase batches. Typo in the POST /api/purchase-batches route — it referenced a variable user when the actual variable at that scope is currentUser. Batch save now works. (The v6.4 CORS/error-handling fix surfaced this correctly as a real server error instead of a bare CORS block — nice to see it working.)

• Finance tab now shows on Sponsors and Settings pages. The v6.2 topbar patch script used a regex that only matched non-active tab links, so the Finance tab wasn't inserted on the two pages where an existing tab happened to have class="topbar-tab active". Both fixed.

• Fixed the "Load failed" error on Finance and Invoice. Two v6.2/v6.3 queries referenced s.email — a column that never existed on the sponsors table. Migration 0012_sponsor_email.sql adds it. Now the Contributions list on Finance renders correctly and printable invoices can pull the sponsor's billing email.
• Sponsor create/edit forms have a dedicated Email field (in addition to Contact person). Existing sponsors get NULL email until you edit them and fill it in.
• Worker error handling hardened. The wrap() helper now catches its own promise rejections and always returns a proper 500 response WITH CORS headers, rather than letting rejections propagate past the router's try/catch and produce a bare 500 without CORS headers (which is what caused the browser to report the crash as a "CORS block" instead of a server error — the actual bug was hidden behind that).

• Contributions list on Finance page. Fixed the "{} is not iterable" error — the fallback code was trying to iterate a wrapper object as if it were an array. New dedicated endpoint GET /api/contributions returns the flat list of all contributions with sponsor name / contact / email joined, so the Finance page renders one row per contribution without an N+1 fetch pattern.

• Finance page. New top-level tab with the full P&L picture: total costs, average unit cost, paid revenue, outstanding revenue, effective loss (lost units × avg unit cost), and net position.
• Purchase batches. Every time you buy or build drifters, record the batch — supplier, variant, quantity, total cost. Volume deals just work: "10 units for $4,000" goes in as quantity 10 and total 4000, and the unit cost is computed as A$400. Effective unit cost across all batches (weighted by quantity) drives the loss calculation and the next-year prediction.
• Next-year prediction calculator. Set target fleet size and sponsor rate, then drag the recovery-rate slider. Shows how many new units you need to buy, predicted cost, predicted revenue, and predicted surplus/shortfall. Encodes the reusable-drifter logic: if you recover 60% of the fleet, next year you only need to buy 40% new to replace the losses.
• Printable invoices. Every contribution on the Finance page now has an "Invoice" button that opens a proper invoice in a new tab with RRF letterhead, sponsor billing details, line items, totals, and payment terms. Use the browser's Print / Save-as-PDF from there. Placeholder RRF details (address, ABN) are hardcoded — edit the values in worker/src/index.js or ask me to make them editable via Settings.
• New endpoints: GET/POST /api/purchase-batches, PATCH/DELETE /api/purchase-batches/:id, GET /api/finance/summary, GET /api/invoices/:id. Schema migration 0011_purchase_batches.sql.

• Topbar now clears the Dynamic Island on iPhone PWA. v6.0 introduced the mobile CSS but the safe-area-inset padding wasn't taking effect — the inline styles on each page loaded after mobile.css and overrode it. Now marked with !important and combined with a small extra gap so the first row of content sits comfortably below the notch rather than hugging it.
• Dropped the @supports (padding: env(...)) wrapper. iOS Safari has quirks resolving env() inside @supports queries; the direct rule with a max() fallback works everywhere and degrades gracefully on browsers without env() support.

• PWA fits the iPhone screen properly. On installed PWA in fullscreen mode, the topbar was rendering under the Dynamic Island (invisible) and the sidebar content was clipped off the left of the viewport — caused by viewport-fit=cover being set without the matching safe-area-inset padding, and the topbar being ~730px wide on a 390px screen with no wrap allowance.
• New shared mobile.css loaded by every page. Adds env(safe-area-inset-*) handling so the header clears the Dynamic Island, the statusbar clears the home indicator, and content stays within the safe zones on rounded-corner phones and landscape iPads.
• Topbar wraps onto multiple rows on narrow screens instead of overflowing. Tab labels, version chip, and icon buttons compress on very small screens (iPhone SE, etc.) so nothing gets pushed off-screen.
• Belt-and-braces overflow-x: hidden + max-width: 100vw on html, body, and .app so no rogue element can create a horizontal scroll offset again.

• Real offline sign-in. Once you've logged in on a device, the app trusts the stored session and skips the server validation when you're offline. Open the PWA at sea, land on the dashboard, navigate freely — no login screen ambush. When you reconnect, the token gets validated on the next API call automatically.
• Cached identity for instant role UI. On login, your role (admin / viewer / sponsor) is cached in localStorage. Role-aware buttons hide correctly from the very first paint, even offline — no flicker where write buttons briefly show before the whoami call returns.
• Offline hint on the login card. If you land on a login screen without connectivity, a yellow notice explains that first-time sign-in needs internet, and that closing/reopening the app should let you in via offline mode if you've used the device before.
• Session TTL bumped 30 → 365 days. No more mid-voyage token expiry. Combined with the offline sign-in tolerance, you can be offline for weeks and the app just keeps working.

• The app now works offline. Open any page while at sea and it loads with whatever data was last fetched. New shared offline.js layer intercepts every API GET, caches the response in IndexedDB, and serves from cache when the network is unreachable.
• Offline provisioning + cadence edits. The write queue now covers new-drifter provisioning (POST /api/drifters), drifter edits (PATCH /api/drifters/:id), and profile cadence changes (PATCH /api/profiles/:key). Program units on the way out to the reef; the writes drain automatically when signal returns.
• Queue drains on the browser's online event and every 30 seconds as a safety net. Existing Deploy/Recover offline queue (from v4.0) continues to work unchanged.
• Naive cache invalidation on write success — writing a drifter clears cached GETs under /api/drifters and clears the dashboard aggregate, so freshly-changed data appears next fetch without a hard reload.
• PWA start_url now points at /dashboard.html so installing the app to your home screen lands on the fleet dashboard.
• Manifest and icons verified (192, 512, 512-maskable, plus 180-px apple-touch-icon). The PWA is genuinely installable on iOS Safari (Share sheet → Add to Home Screen) and Android Chrome (install prompt).

• Cadence editor moved to Setup. When you're provisioning a drifter you want cadence right there, not one tab away. The editor card now sits below the provisioning form on the Setup page, and after you save a profile's cadence, the config.h preview above refreshes to use the new values.
• Removed the duplicate card from Settings.
• Fixed the "0" display bug on empty cadence fields (D1 returns 0 for some NULL integer columns; render treats 0 as unset now, consistent with cadence being invalid at 0).

• Cadence profiles are editable. The burst / drift / beached interval values that get baked into config.h at provision time used to be hardcoded in setup.html JavaScript. Now they live on the profiles table with a dedicated editor card on Settings.
• Four numeric fields per profile: Drift interval (normal cadence), Burst interval and Burst duration (initial-spawn burst window), Beached interval (when motion sensor detects stationary). All in seconds with live "= 15 min / = 1 h" hint text as you type.
• Setup page's config.h generator now reads these values from the selected profile row. Change cadence on Settings → next provisioned unit picks it up. Existing flashed units are still static (no downlink support), but at least you're not editing HTML.
• New endpoint PATCH /api/profiles/:key for admin edits. Schema migration 0010_profile_cadence.sql adds the four columns and seeds the two existing profiles (spawn, longterm) with their historical values.

• Role-aware UI. Viewer accounts now get a genuinely read-only interface. Primary write buttons (Deploy, Recover, Add sponsor, Delete, Grant access, Add user, Run backup, Save changes) are hidden entirely instead of showing and returning 403 on click. Refresh, Close, Cancel, and other neutral actions remain accessible.
• "Read-only" chip in the topbar makes the current role visible next to the version chip, so a viewer knows why the UI looks pared-down.
• Shared role-aware.js loaded by every admin page — calls /api/whoami, sets body.dataset.role, injects the hide rules. One place to maintain.

• Sponsor login accounts. New third role in the users table: sponsor. Sponsors log in with an email and password at the normal sign-in screen, and land directly on their own sponsor.html dashboard showing their fleet, positions, and stats. No more emailing URL tokens that need to be rotated.
• Grant login access from the Sponsors page. Open any sponsor's detail drawer, find the new "Login access" section, click Grant access, fill in an email (an auto-suggested 12-character password is generated for you), Create login. Per-account menu supports Reset password (revokes existing sessions), Disable/Re-enable, and Revoke access.
• Scoped auth gate. Sponsor role can only hit /api/sponsor-view/:key where :key matches their sponsor_key. Every other endpoint returns 403. Even /api/whoami and /api/logout are the only exceptions (and they only return the sponsor's own identity).
• Session-aware sponsor.html. Rewritten to try session auth first (a logged-in sponsor lands on their own view automatically), fall back to legacy URL tokens (so existing shared links still work), or show a login form. Log-out button in the header for session-authed views.
• Login form on any admin page (Map / Fleet / Setup / Sponsors / Settings / Dashboard) automatically redirects sponsor logins to sponsor.html, so accidental logins on the wrong page still work smoothly.
• New schema migration schema/0009_sponsor_users.sql adds the sponsor_key column to the users table plus an index.

• New Dashboard tab. Top-level page with fleet totals grouped by status, activity metrics (total pings, last 7 days, silent drifters, last ingest), sponsor billing rollup (contributed / invoiced / paid / outstanding), and a unified recent-activity feed (deployments, recoveries, ingests) sorted by time.
• Single-fetch aggregator endpoint GET /api/dashboard — one round-trip pulls the whole snapshot.
• Auto-refreshes every 60 seconds so you can leave it open on a monitor and see fleet state in near-real-time.

• No more login-screen flash between pages. Every admin page used to load with the login overlay visible in HTML, then hide it after a background auth check completed — a brief but jarring flash on every navigation. Fixed: a pre-paint synchronous script in each page's head checks localStorage for the auth key, and the overlay is now hidden by default. Only shown if the key is missing (fresh visitor) or the async validation returns 401 (session expired).

• Self-healing env-admin bootstrap. The v5.0 bootstrap only fired at login, so an admin already signed in via the old FLEET_API_KEY key wouldn't appear in the users list until they logged out and back in. Fixed: the users-table upsert now runs on any authenticated env-admin request, so the list is always accurate.

• Multi-user access with roles. New Users management on the Settings page — add additional accounts with either viewer role (read-only: fleet, map, sponsors, everything visible but nothing editable) or admin role (full access). Great for giving volunteers or interns access without letting them accidentally deploy or delete anything.
• Real password auth. Passwords are hashed with PBKDF2-SHA-256 at 100k iterations with a per-user salt. Session tokens are 32 bytes of crypto randomness stored in a sessions table with 30-day expiry. Changing a user password revokes their existing sessions.
• Blanket write protection. Every POST / PATCH / DELETE across the API is checked for admin role — a viewer who somehow got the request to fire (extension, curl, forged UI) gets a 403 back. Reads are permitted for any authenticated user.
• Auto-bootstrap on first login. The env-based admin (ADMIN_EMAIL / ADMIN_PASSWORD) is automatically upserted into the users table on first login, so nothing needs to be seeded manually. Existing FLEET_API_KEY sessions keep working during the rollout as a break-glass credential.
• Per-user session revocation. Logging out now hits POST /api/logout to delete the server-side session, not just the localStorage key. Deleting a disabled user cascades to their sessions.
• Dropped the "Update vX coming" banner from the map page — it was noise and always went stale. If you want to know what's coming, the changelog button in the header still works.

• New Settings tab. Top-level nav is now Map / Fleet / Setup / Sponsors / Settings — deployment configuration and operational admin lives in its own home.
• Deployment status card — at-a-glance check of what services are wired up: admin email, worker version, D1 connection, R2 backups bucket, ingest token, fleet API key. Boolean pills for each, no secrets exposed.
• Database backups moved from Setup to Settings. Same UI, more logical home. The manual "Run backup now" button, list of recent backups, and download links all still work identically.
• Users placeholder. Shows the current admin account, notes that view-only user accounts are coming in v5.0 (the admin-vs-viewer role split needs an auth refactor with a real users table and per-user session tokens, so it's getting its own focused release rather than being crammed into this one).
• Session log-out moved to Settings so it's discoverable outside the Fleet page's action row.

• Business model correction — contributions, not per-unit purchases. Sponsors contribute funding to the spawn-tracking programme at a rate (e.g. $500/unit for 2026 spawn). Their money is pooled to buy drifters, deploy them, and gather open-source drift data. They do not own specific units. Recovered R-variant units carry over and reduce next year's cost.
• New contributions table. Each row records: sponsor, units_purchased, price_per_unit_aud, season (freetext), invoice_ref, invoiced_at, paid_at, notes. Sponsors can have multiple contributions across seasons or as top-ups within a season.
• Sponsor detail drawer now has a Contributions section with "New contribution" button + per-row menu for Mark invoiced (prompts for ref), Mark paid, Edit, Delete. Live total preview in the add/edit modal while you type units × rate.
• Sponsor detail drawer's Drifters section is now read-only — shows operational attribution (drifters currently associated with this sponsor for deployment) rather than billing. Billing lives entirely in Contributions now.
• Aggregate strip and sponsor table columns updated: "Value" → "Contributed", "Units" → "Units funded". Numbers roll up from the contributions table.
• New schema migration schema/0007_contributions.sql. The drifter billing columns from v4.7 (purchase_price_aud, invoice_ref, invoiced_at, paid_at) are now unused; they stay in the schema for now, will be removed in a later cleanup migration.

• Sponsors as a top-level tab. New sponsors.html page with the full sponsor list, per-sponsor billing rollup (units, total value, invoiced, paid, outstanding), aggregate strip across the top for at-a-glance totals, and a click-through detail drawer for each sponsor.
• Sponsor CRUD. Add sponsor via a modal (key + name + colour + contact + notes), edit any field inline in the detail drawer, delete with foreign-key safety — the DELETE fails cleanly if any drifter or deployment still references the sponsor, so you cannot accidentally orphan operational history.
• Per-drifter billing. Every drifter now has a purchase price (AUD), invoice reference (freetext, e.g. "GBRF-2026-04"), invoiced_at timestamp, and paid_at timestamp. Edit price inline in the sponsor detail. Tap ••• on a drifter row for Mark invoiced (prompts for reference), Mark paid, Reset billing state, Edit invoice ref. Sponsor totals update live from these fields — no denormalisation.
• Share-link management moved from Setup to Sponsors. The share-link block that lived at the bottom of the setup page is now integrated into each sponsor's detail drawer alongside the sponsor's other settings. One place to manage everything about a sponsor.
• Schema migration schema/0006_billing_fields.sql adds four new columns to the drifters table. Apply in D1 Console (one ALTER at a time) before deploying the v4.7 Worker.

• Hotfix: "Run backup now" was throwing "Cannot read properties of null (reading 'key')". The runBackup() function in the Worker was returning a plain object where the router expected a Response. The wrap step then dispatched an empty-body 200 to the client, which parsed as null, and reading .key off it exploded. Every other endpoint properly wraps in jsonResponse(); missed it here.
• Fixed deploy.sh: a Worker Cron Trigger attach failure (usually a token permission gap on the account) no longer halts the whole script under set -e. The Worker code itself uploads successfully in that scenario; the schedule attach is the only thing that fails. Pages deploy now still runs so the frontend picks up the new version. Warning message points at the dashboard workaround.

The v4.5 cron-trigger dashboard workaround still applies: Workers & Pages → drift-analysis → Settings → Trigger Events → Add → Cron Trigger → 0 0 * * *.

• Automated daily D1 backups to R2. New Worker cron trigger runs at 00:00 UTC (10am Cairns), dumps every table in the database to a single JSON file, writes it to the drift-analysis-backups R2 bucket with generation timestamp metadata, and prunes anything older than 30 days.
• New Database backups card on the Setup page: shows the last 20 backups with their timestamp, size, row count, and a Download link. "Run backup now" button triggers the same code path on demand for testing or a pre-migration snapshot. Downloads go through an authenticated blob fetch so anchor-download's no-auth-header limitation isn't a problem.
• Removes the daily --skip-backup habit that the wrangler token permission gap forced on earlier releases. Backups now come from inside the Worker, which has direct D1 read access and doesn't need any additional token.
• Killed the "Install update" button that had been showing a v1.9-era placeholder alert since forever. Banner now just informs "next version coming" without the misleading action.

One-time setup: create the R2 bucket in the Cloudflare dashboard (R2 → Create bucket → name it drift-analysis-backups) before deploying v4.5. The Worker deploy will otherwise fail with an unknown-binding error.

• Sponsor-facing read-only view. Each sponsor gets a rotatable share link (e.g. /sponsor.html?key=gbrf&token=<32-char-hex>) that shows their drifters, current positions on a map, headline stats (total drifters, currently deployed, active this week, total drift-km), and deployment history. No admin controls, no other sponsors' data, no maintenance log — deliberately separate endpoint so there is no way to accidentally leak internal data through it.
• Share tokens are managed from a new "Sponsor share links" card on the Setup page: Generate creates or rotates a link, Copy puts the URL on the clipboard, Revoke NULLs the token so the URL 404s. Rotate is destructive — the old URL stops working immediately.
• Public view endpoint (GET /api/sponsor-view/:key?token=xxx) validates the token via a constant-time-ish comparison and returns 403 on mismatch. No admin auth is checked; the token IS the credential.
• Sponsor page uses the same visual language as the internal dashboard (marine-blue accent, warm chart-paper background, mono-space coordinates) but with a distinct dark-navy header carrying the sponsor's name + coloured abbreviation chip. Feels like a portal, not the internal tool.
• Schema migration adds share_token column to sponsors (nullable). Apply schema/0005_sponsor_share_tokens.sql in D1 Console before deploying the v4.4 Worker.

• Fixed stale live-state on non-deployed drifters. The mode field is an operational state (BEACHED, DRIFTING, etc.) that only makes sense while the drifter is in the water. Previously, once a drifter was recovered to the workshop the last observed mode stayed pinned on its row — so units sitting on a bench displayed BEACHED, which is nonsensical.
• Server side: the recover endpoint now NULLs out last_mode when a drifter comes out of the water. Historical last_lat / last_lon / last_fix_at / last_batt_mv are retained since those remain useful reference values.
• Client side (defensive): the fleet table only renders the mode chip when status === "deployed", so any drifter with an already-polluted stale mode (like the two workshop units that triggered this fix) immediately shows — without needing a DB migration. Mode filter dropdown now also gates on deployed status, so filtering by BEACHED cannot match workshop rows with a stale mode.

• Deploy and Recover coordinate flow reframed. Instead of separate Lat / Lon fields and two seemingly-decorative buttons underneath, the section now reads as a single question — "Where did you deploy it?" / "Where did you retrieve it?" — with the coordinate inputs side by side and the two ways of filling them (📍 Use my location, 🗺 Mark on map) presented as an explicit pair beneath. Intent-first, mechanism-second.
• Picker map now shows context. On Recover, the target drifter's last known Myriota position appears as a grey reference dot with a small label — so the picker answers "the satellite says it's here; tap where you actually found it" rather than showing an empty map. On Deploy, other currently-deployed drifters appear as small tan dots so you can see the fleet layout when picking a new drop point.
• Picker header hint text adapts to what's on the map — different sentence for Recover, Deploy, and the no-reference case.

• Tap-on-map coordinate picker on Deploy and Recover. New 🗺 Pick on map button next to the 📍 GPS button. Opens a full-screen Leaflet overlay — tap anywhere to drop a marker, drag the marker for fine-tuning, live coordinate readout in the header. Confirm writes the picked coordinates back to the form field.
• Picker starts with a sensible default view: any existing coordinate in the form is honoured first, otherwise the drifter's last known position, otherwise the assigned area's centre, otherwise Cairns. So when you open the picker for a drifter that's already deployed at Fitzroy, it opens zoomed on Fitzroy.
• GPS button also available inside the picker — for when you open the picker, decide GPS would be easier, and don't want to close-and-reopen.
• Leaflet is lazy-loaded on first open so the ~150 KB bundle only costs you if you actually use the picker. Service worker pre-caches the vendor assets, so a second open (and any future open, even offline) is instant.

• Installable as a PWA on iPhone and iPad. Add-to-home-screen from Safari (tap the share icon, then "Add to Home Screen") gives Drift Analysis its own app icon, standalone window with no Safari chrome, and dark-navy status bar. Same behaviour on Android Chrome. Icons are placeholders matching the topbar brand mark — swap for real artwork whenever you're ready.
• Manifest declares Map / Fleet / Setup as launch shortcuts so long-press on the home screen icon (iOS 16+, Android) jumps straight to a specific page.
• Service worker caches the app shell (HTML, Leaflet vendor, icons) so the PWA opens even with no signal. Deliberately does NOT cache API responses or map tiles — you were explicit about not wanting an offline map or stale data.
• Offline-safe deploy and recover. Both actions on the fleet page now queue in localStorage when the device is offline or the request fails with a network error. Queue drains automatically on reconnect, on tab-becomes-visible, and every 30 seconds while the page is open. A yellow ⏳ N pending sync chip in the action bar shows the queue depth; tap it to see each pending action with Retry and Remove buttons. Conflict rule is last-write-wins — the boat is authoritative for what happened in the water.
• Small green/red dot in the topbar reflects navigator.onLine. Hover for a tooltip.
• "Use my current location" button on Deploy and Recover. One tap fills lat/lon from the browser's geolocation API with high-accuracy request. Works offline (GPS doesn't need signal). Shows accuracy in metres.

• Same-second impossible-jump check fixed (second layer of the v3.7 bug). The v3.8 hotfix restored the denorm columns in the drifter lookup, but the distance check still required dtHours > 0, so two ingestion calls that landed in the same Unix second (Myriota timestamps are second-resolution, and satellite passes can deliver multiple packets per second) slipped through. Caught by re-running the Darwin smoke test: both calls got the same fixed_at and the jump was marked clean again.
• Quality rule rewritten as an implied ground-speed check: computes distance / time and flags anything above 20 km/h (physically well above the ~10 km/h East Australian Current cap). The time-delta divisor is floored at one minute-worth-of-hours so same-second deliveries don't hit division-by-zero and GPS jitter inside a satellite pass window doesn't false-positive. A secondary distance > 500 m guard stops small jitter cases from ever tripping the rule, no matter what the implied speed says.
• Verified against six edge cases before shipping: same-second 1900 km jump, legit 15-min spawn-cadence fix, GPS jitter same-second, 44-second Darwin jump, (0,0) cold-start, and first-ever fix. All produce the expected quality tag.

• Impossible-jump quality check fixed. v3.7 shipped the distance-jump rule (>200 km from previous fix in under an hour = mark suspect) but the drifter lookup query only selected the id column, so assessQuality saw undefined for last_lat / last_lon / last_fix_at and silently skipped the distance check. Caught by a smoke test that posted a Fitzroy → Darwin jump (~1900 km in 44 s) and got quality: "clean" back. The lookup now selects the denorm columns, and the null-guard uses != null so future callers can't recreate the bug with an undefined field.
• Cleanup SQL provided in schema/0004_reset_test_pollution.sql — DRIFT-051's denorm state was polluted with Darwin coordinates during the v3.7 test run. Paste this in the D1 Console to reset before re-testing.
• The (0,0) cold-start rule was unaffected and continued working correctly in v3.7; only the distance-jump rule was broken.

• Myriota envelope adapter — new POST /api/ingest/myriota endpoint that speaks Device Manager's actual webhook shape. Parses the escaped Data JSON string, decodes each 20-byte hex payload using the DriftSpawn binary format, and delegates into the same code path as the idealised /api/ingest. Point Myriota's custom destination at this URL when you register the first live module.
• DriftSpawn 20-byte payload format frozen and documented — the Setup page's generated config.h now includes the exact DriftSpawn_message_t struct definition at the top, so firmware and decoder can never drift out of sync. Layout: seq (u16), lat_e7 (i32), lon_e7 (i32), fixed_at (u32), sst_c100 (i16), batt_mv (u16), mode_sats (u8), hdop_x10 (u8) — 20 bytes exactly, matching Myriota's per-message maximum.
• Dedup on ingest — Myriota's Message Store retries on transient network errors. Ingestion now silently accepts duplicate deliveries (same drifter, same fixed_at within 1 s, coordinates matching to ~11 m) rather than double-inserting. Response includes a dedup: true flag so you can tell it happened.
• Bad-fix quarantine — fixes at exactly (0,0) (classic GPS-not-locked cold start) and impossible jumps (>200 km inside an hour from the previous fix) are now tagged quality: "suspect" in the track_points table. Suspect fixes are stored but do NOT update the drifter's last_lat / last_lon, so the map stays anchored to the last clean position rather than teleporting on a garbage lock. Requires a one-time schema change — see schema/0003_track_point_quality.sql.
• Silent-drifter warnings on the fleet page — a deployed unit whose profile expects, say, one message every 50 minutes but hasn't reported for over 2.5 hours (3x expected gap) now shows a red ⚠ chip next to its ID and a warm-tint background on the row. A summary chip in the action bar ("⚠ 3 silent") gives you the whole-fleet count at a glance, independent of active filters. Threshold is derived per-profile from msg_per_month, so spawn-cadence and long-term profiles use their own appropriate cutoffs.
• simulate_ingest.sh myriota — new subcommand posts a realistic Myriota-shaped envelope (with a properly packed 20-byte binary payload) through the adapter end-to-end, so you can prove the whole decode path works before any hardware is registered.

• Hover to preview on desktop — mousing over a drifter marker now opens its details popup, so you no longer have to click every unit just to check on it. Clicking still works and behaves the same as before (opens popup, selects the drifter in the sidebar). On touch devices (iPhone, iPad without a mouse) the behaviour is unchanged: tap to open. Detection uses @media (hover: hover) and (pointer: fine), so an iPad with a paired trackpad or mouse does get hover behaviour.
• Small close delay after mousing off a marker so you can slide onto the popup itself without it vanishing, matching standard hovercard behaviour.
• Coast overlay cleanup — the crude Yarrabah mainland rectangle is gone. The Coast layer still bundles the Fitzroy Island, Little Fitzroy, outer reef, and Arlington Reef guides, which are genuinely useful markers on satellite view where the reefs render as pale blobs. The Yarrabah place-name label is unchanged.
• _headers file for Pages caching — HTML entry points now serve with no-cache, must-revalidate, and vendor assets with a one-year immutable cache. Fixes the "I deployed but it did not update" issue at the source: every future deploy is visible on refresh, no hard reload needed.

• Setup page — new third tab in the top nav. One form captures every parameter a new drifter needs (ID, variant, Myriota module serial, hardware rev, build date, sponsor / area / cadence profile, initial status), registers it in the fleet, and generates two things you paste at the bench:
• A per-unit config_DRIFT-###.h header (copy or download) that drops straight into the Myriota SDK build tree — one #define per parameter, so nothing gets typed twice and every flashed unit carries its identity, sponsor, area, profile, and cadence constants baked into the firmware.
• A copy-pasteable bench command block that walks through the SDK build, USB flash, Device Manager registration, and post-flash smoke-test with simulate_ingest.sh.
• Suggest next ID button — picks the next number in the appropriate range based on variant and area, so you don't collide with an existing unit.
• Preview only button — see the generated config and commands without touching the fleet database. Useful for spot-checking an already-provisioned unit's parameters.
• Recently provisioned list at the bottom of the page so you can glance back at what was last built.

• Telemetry ingestion endpoint — new POST /api/ingest on the Worker, ready to receive real fixes from a Myriota webhook. Accepts one point or a batch, resolves drifters by ID or module serial, auto-links each fix to the open deployment, updates the drifter's last-known position (skipping out-of-order deliveries).
• Uses a separate INGEST_TOKEN secret rather than the admin key, so a leaked webhook URL cannot pivot into the fleet management API.
• Simulator endpoint — POST /api/ingest/simulate generates a plausible fix near a drifter's last known position and pushes it through the real ingestion path, so you can smoke-test the whole pipeline without hardware.
• Dashboard still reads from the mock dataset; the switch to live track_points reads is scheduled for v3.5.

• Labels toggle — new icon in the header (between full-screen and settings) turns drifter ID pills on and off. When on, the pills reappear with their dashed leader lines pointing back at the marker; when off, both stay hidden. Choice is remembered across sessions.
• By default labels stay hidden (the cleaner map look introduced in v2.5).

• Killed the dangling leader lines — the little dashed lines fanning out from each marker were left over from when drifter IDs were shown next to markers. Since v2.5 hid the labels, those lines were pointing at nothing. Gone now.
• Coast overlay off by default — the beige "Yarrabah / Fitzroy / Outer Reef / Arlington" polygons no longer paint over the satellite imagery on first load. Still available: layer picker (top-right of the map) → tick Coast to bring them back.
• No more login flash on the Fleet tab — the overlay used to blink into view for ~200 ms while the cached key was being validated. Now it stays hidden immediately when a key is present, and only reappears if the key turns out to be bad.

• Login stops nagging — going Fleet → Map no longer forces a re-sign-in; the overlay now correctly stays hidden when credentials are already cached.
• New full-screen map toggle (icon in the header next to the ⚙ gear) — hides the fleet sidebar so the map takes the whole viewport. State is remembered across visits.
• Track polylines now render on canvas instead of SVG — fixes the visible "jump-and-snap" of vector lines while pinch-zooming on iOS satellite view.

• Richer fleet table — four new sortable columns: Mode (current operating mode with colour), Dist (total km travelled), Msgs (message count), and Last fix (time of latest position).
• New Mode filter dropdown — quickly show only Beached drifters, only Normal, only High cadence, etc.
• Rows for drifters that never left the workshop show "—" in the telemetry columns.
• Telemetry values come from the shared mock dataset for now; will switch to live track_points reads once v3.3's Myriota webhook lands.

• Marker taps stay put — tapping a drifter on the map now just opens the info popup, no more auto-zoom to that drifter's track (which forced you to zoom back out to see the rest of the fleet). Sidebar card taps still pan & zoom to fit the drifter's full track, since that's when you actually want to focus on one.
• Popup also no longer pans the map to keep itself in view — it opens where you tapped, full stop.

• Login overlay fix — the sign-in card was falling through into document flow on iPad Safari (a missing CSS selector line meant position: fixed was never applied). Now correctly covers the whole viewport so you can log in on any device without scrolling past the map to find the fields.

• No more ?api= in URLs — the Worker URL is now baked into the frontend as a default. Bookmark the plain drift-analysis.pages.dev URL and login works out of the box.
• Override still supported: ?api=<url> for local dev, ?api= (empty) for same-origin once a route is set.

• Deploy hardening — deploy.sh now auto-installs wrangler if it's missing (fixes the Cloud Shell wipe-on-session issue) and treats a failed D1 backup as a warning rather than a hard-stop, so schema/worker/pages steps always run.

• Cleaner map — drifter ID tags are hidden by default so the water stays uncluttered.
• Tap any drifter marker to open a compact info popup: ID, sponsor, variant, current mode, distance covered, battery voltage & %, message count, area, and time of the last fix.
• Popup content updates to reflect the current timeline moment, not just the latest fix.

• Email + password login — both Map and Fleet pages now sit behind a proper sign-in form; single admin account for now, password changeable via wrangler secret put ADMIN_PASSWORD.
• New Settings panel (gear icon in header) — shows the signed-in email, exposes the API key with a Copy button for pasting into other devices, and a Log out action.
• New POST /api/login worker endpoint validating ADMIN_EMAIL / ADMIN_PASSWORD secrets and returning the FLEET_API_KEY.

• First production deploy on Cloudflare (Workers + D1 + Pages) under the drift-analysis project.

• Renamed — product is now called Drift Analysis (dashboard + management). The hardware platform itself is still DriftSpawn.

• Full fleet management system on Cloudflare Workers + D1 + Pages
• New Fleet tab: sortable/filterable table, add/edit drifters, deployment workflow, recovery workflow (R variants auto-route to workshop with cycle count, E variants to retired), maintenance log per unit
• Bearer-token auth, CORS-friendly, same-origin routing supported
• Deploy script with backup-before-migrate pattern

• Sponsor colouring — drifters tagged with a sponsor (e.g. RRF, SSC, CWI); trails and start-rings take the sponsor's colour while marker fill keeps the mode colour and shape keeps the variant
• Smooth continuous zoom interpolation — fractional zoom + per-frame lerp, no more discrete zoom-level jumps
• 14-day deployment scenario — extended from 36 h; four drifters beach or run aground (Yarrabah, Cape Grafton, outer reef, Little Fitzroy), one stays offshore drifting east into the Coral Sea
• Cadence transitions baked into the data — HIGH_CADENCE 15 min (first 48 h) → NORMAL 60 min while drifting → BEACHED 30 min once stationary, per v1.3 firmware spec
• Embedded coast outlines for Fitzroy, Little Fitzroy, Cape Grafton/Yarrabah mainland, and an outer GBR reef — always visible without map tiles
• Realistic spawn-night ring deployment around Fitzroy
• Label collision avoidance — outward from deploy point, min 20° angular gap, iterative push-out
• Solid drift trails (replaced fading gradient)
• Five playback speeds (Very Slow / Slow / Normal / Fast / Very Fast)
• View All toggle — auto-fit map to all visible drifters; starts close, zooms out as they spread
• Video export — render the drift to a downloadable MP4 / WebM at the selected speed, with the same auto-zoom behaviour
• Layer toggle for Map (OSM) and Satellite (Esri) tiles when available

• Timeline playback — play, pause, scrub through the last week
• Animated drifter movement with smooth marker interpolation
• Tracks grow as time advances; not-yet-deployed drifters stay hidden
• Speed selector (slow / normal / fast)

• First fleet dashboard release with map, sidebar, light theme