[Maseeek]

Summary

Sharing a recommendation previously granted Gold immediately. A reward now requires a unique new account created through a Player-specific link and confirmed by email. Sharing, copying, self-referrals, existing accounts and repeated confirmation grant no credit.

- share/copy link → reward
+ unique new signup → confirmation → referral reward
- colour save → profile fetch → history reload → selected option
+ select colour immediately → save → authoritative metadata, or rollback

The palette reserves the opponent’s colour and shows their themed initial. Supabase locks the Duel row and enforces distinct colours. Player metadata derives independently of incremental history synchronization. Displayed referral counts and Gold authorization use the confirmed ledger even if a confirmation races first pairing.

Merged current main into this branch, preserving incremental sync, cached history, membership signup redirects and both database check suites.

Closes #58.

Evidence

• Before: sharing regression failed with credit 1 !== 0.
• After: npm run check passes 196 tests plus both PostgreSQL suites; npm run build passes. CI and Vercel preview build passed on 70e12c4.
• The independent reviewer found the first-pairing reward cache race; the canonical ledger fix and stale-counter regression passed review.
• Earlier desktop/390px phone inspection and a synthetic delayed API verified immediate selection, rollback and no extra history reads. Current incremental sync was preserved and its database suite passes.
• Production migration 20261014220745 applied through Supabase MCP. Live rolled-back fixtures passed confirmation, self/existing/repeat rejection, immutable attribution, stable links, canonical rewards, Gold eligibility and colour exclusivity. No fixture records remain; existing Duel data stayed intact except the intended sharing-credit reset.

Merge Danger

Door: Code is reversible. The migration replaces old sharing counts with confirmed referral counts and relocks unearned Gold; this reset has been applied.

Blast Radius: Player profiles and signup referrals.

Both SQL files have been applied in order to production. Supabase public REST still returns HTTP 402 exceed_egress_quota, so user-facing live API verification is blocked by the existing service restriction. No billing settings were changed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
do-it	Ready	Preview	Oct 14, 2026 10:08pm UTC