v1.8.0 — bucket templates, account safety, honest privacy, and guided UX

[ihabkhaled]

Delivers the eleven requested v1.8.0 items on top of main (1.7.4 → 1.8.0).

What changed

1. Buckets are reusable order templates. "Start round" opens an order
   session from a shared bucket, seeds the same members, and notifies each of
   them. The template is never renamed or consumed, so the same menu runs every
   week. Built on the existing ADR-0009 order-session architecture, which was
   complete but unreachable from the UI.
2. Logout asks for confirmation and shows a busy state.
3. Account deletion requires re-entering email and password; nothing is
   removed until they verify, in both Firebase and local-device modes.
4. Zero is a placeholder, not a value, in every money and percentage field —
   typing 14 yields 14, not 014.
5. Per-section loading. Headings, filters, and actions paint immediately;
   each section shows its own placeholder, and the two bucket collections
   resolve independently.
6. OS tray notifications. In-app notifications mirror to the system tray
   while the app is backgrounded, and a tap opens the destination. Permission is
   only ever requested from a deliberate user action.
7. Settings split into a hub plus preferences, privacy, security, and
   account pages.
8. Privacy made real. Analytics consent now gates an actual sink: a capped
   device-local diagnostics window that never leaves the device, with a visible
   count and a clear action. Consent roams with the profile.
9. Language and theme restore from the profile on a new device; system
   theme follows live OS changes.
10. Guided tours on all nineteen screens, dismissible and replayable from
    Settings → Preferences.
11. UX fixes from a manual browser pass — see below.

Evidence

• 382 Vitest unit/component tests; 180 Playwright tests across Chromium desktop,
  Pixel 7, and iPad Mini; Firefox cross-browser suite green.
• Firestore rules tests against the emulator (new optional analyticsConsent).
• Firebase Functions tests (18), covering the order-round notification fan-out.
• Android debug APK built locally against the new local-notifications plugin.
• Manual browser walkthrough with zero console errors or warnings. It found and
  fixed two real defects: the notification prompt stacked on top of the
  first-run tour, and could interrupt a half-filled form.

Notes for review

• Adding @capacitor/local-notifications expands the Android permission surface
  (POST_NOTIFICATIONS, RECEIVE_BOOT_COMPLETED, WAKE_LOCK) via manifest
  merging; recorded in docs/migration/native-security-audit.md.
• Remote push (app fully closed) is not included — it needs a VAPID key,
  google-services.json, and APNs assets that live outside this repository.
  Prerequisites: docs/operations/push-notifications.md.
• iOS is unvalidated (EXC-5); WebKit cannot launch on the Windows dev machine,
  so desktop WebKit and mobile Safari rely on this pipeline's Linux runners.
• No new environment variables. .env.example gained the previously undocumented
  CONTACT_EMAIL_PROVIDER key to close a drift with .env.
• The in-app brand still reads "FoodOrder" while the native app is
  "Gama3 Orderak" — left for an owner decision rather than changed unilaterally.

🤖 Generated with Claude Code

v1.8.0

Build: the branch prerelease publishes the APK once every gate passes.

Highlights

• Buckets are reusable order templates. "Start round" opens a new order session
  from a shared bucket, seeds the same members automatically, and notifies each
  of them — the template itself is never renamed, consumed, or duplicated, so
  the same menu can run every week.
• Duplicating a bucket now keeps its exact title; the "(copy)" suffix is gone.
• Replaced the "0" trap in every money and percentage field: a zero renders as a
  placeholder, so typing 14 produces 14 instead of 014.
• Logging out asks for confirmation and shows a busy state while the session
  ends, instead of signing out on a single mis-tap.
• Deleting an account now requires re-entering the account email and password;
  nothing is deleted until those credentials verify, in both Firebase and
  local-device modes.
• Split the single dense settings screen into a hub with four focused subpages:
  preferences, privacy, security, and data & account.
• The friends area follows the same shape: /social is a hub with counts and
  three rows, and search + friends list, pending requests, and groups each get
  their own page. Social notifications deep-link to the right subpage — an
  invitation opens Requests, a group change opens Groups.
• Bucket sharing too: the share screen keeps the invite code and freeze
  controls, while member roles/permissions and the activity log move to their
  own pages behind labelled rows with a member count.
• The deployment gate no longer fails when Google throttles its unauthenticated
  smoke probes: a persistent HTTP 429 can only come from an endpoint that
  exists (a missing function returns 404), so it is recorded as a warning while
  a real 404/5xx still fails. Probes are also spaced out so five callables do
  not trip the same quota.
• Language and theme restore from the signed-in profile on a new device, and the
  system theme now follows live operating-system light/dark changes.
• Analytics consent controls a real, consent-gated sink: diagnostics are written
  to a capped device-local window that never leaves the device, and the privacy
  screen shows the exact stored count with a clear action.
• Each screen loads section by section. The heading, filters, and actions paint
  immediately while individual sections show their own placeholders, and the two
  bucket collections now resolve independently of each other.
• In-app notifications mirror into the operating-system notification tray while
  the app is in the background, and tapping one opens its destination in the
  app. Permission is only ever requested from a deliberate user action.
• Guided tours cover all nineteen screens in 114 steps — dashboard, buckets,
  the bucket editor, sharing, collaboration, joining, orders, order details,
  order creation, order rounds and their details, friends, and every settings
  page. Each screen walks through five to eight explanations rather than a
  single hint, dims the page behind it, and highlights the element being
  described where there is one. Three deliberate exits: Got it retires that
  screen's tour, Skip ends only this visit, Skip all silences every
  screen. All of them replay from Settings → Preferences. Tour copy lives in a
  per-screen use-*-tour.hook.ts rather than inline in the containers.
• Arabic Franco is a first-class thirteenth language. Egyptian Arabic written
  in Latin script is hand-written idiomatic copy — "tasgeel el khoroog", not a
  transliteration table — across the app UI, the six feature catalogues, Firebase
  error messages, password-reset email, and all ten public marketing pages. It is
  selectable in Settings and served at /ar-latn, with its own sitemap, RSS feed,
  and hreflang entries.
• Remote push delivery: registered devices receive notifications through Firebase
  Cloud Messaging even with the app closed. Tokens live under
  users/{uid}/pushTokens, are pruned when they go stale, and are removed on
  sign-out so a shared phone never receives the previous account's rounds.
• Vercel Analytics and Speed Insights ship behind the same analytics consent that
  governs local diagnostics — neither loads until consent is granted.
• The public site has a light/dark switch beside the language menu. It defaults
  to the operating system, an explicit choice overrides it in either direction,
  and the choice is applied from an inline script before first paint so no page
  flashes the wrong palette. The prerendered pages stay free of external
  scripts.
• The public header is one tidy row at every width: the brand, the language
  menu, and the call to action, with all seven destinations in a collapsible
  list. Seven translated labels never fitted beside them — the bar reflowed
  into three rows in most locales, and the name was being cut short. Fixed
  alongside three layout faults found while measuring it: a call-to-action that
  wrapped mid-label, dropdown panels that claimed layout space while closed and
  gave narrow phones a horizontal scrollbar, and a hero grid whose 1fr track
  took its minimum from content so one long German compound word widened the
  page. Verified across all thirteen locales at nine widths.
• The product name is translated per locale — "Collect Your Order" in English,
  "جمع أوردرك" in Arabic, "Gama3 Orderak" in Franco, and its own rendering in
  the other ten — across the app shell, the public header and footer, the
  og:site_name tag, and the structured data. It used to read the Franco name
  in every language but English and Arabic. The square brand mark no longer
  shrinks to make room for a long name; the name wraps instead.
• Google AdSense loads only on indexable public marketing pages, with ads.txt
  generated from ADSENSE_PUBLISHER_ID. The logged-in app shell and all noindex
  system pages stay ad-free, and npm run public:validate enforces it.

Full notes: release-notes/v1.8.0.md

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
food-order-v1	Ready	Preview	Aug 1, 2026 11:35am