Close the gap the direction's own second sentence names: try it as a guest, then keep it by signing in — today that costs one navigation and one press per board.
What it is like today. A guest's boards live in localStorage (static/boards.<hash>.js) and render on / as plain links. Signing in changes nothing about them: to keep one you open it, find the "Keep this board" button on the board page (keepHtml in src/pages/board.ts), press it, go back. For the five boards a person tried the app with, that is five round trips, and nothing on / even says which of those boards are still unowned and therefore keepable. The README has to explain the whole dance in a paragraph — a sign it is a step too many.
What done looks like
[ ] When someone is signed in, each entry in the this-browser list on / that is not yet kept by anyone offers a Keep control beside #55's Forget, and pressing it adds that board to their kept list without leaving /.
[ ] The page learns which local ids are keepable without leaking anything: one same-origin POST carrying the ids this browser already holds (validated at the boundary — board-id shape, at most the list's 50), answering for each only kept / someone else's / unknown. A signed-out caller gets nothing back.
[ ] Keeping several is one press: a Keep all that claims every keepable board in the list and says what happened in a sentence ("Kept 3 boards. 1 belongs to someone else.").
[ ] A board already kept by someone else is never silently re-owned — db.claimBoard's owned_by_other stays the rule, and the page says so rather than failing quietly.
[ ] It works with JavaScript off for the single-board case at least: the existing board-page button stays exactly as it is, and the README's "Sign in" bullet shrinks to one sentence.
[ ] Tests: the new endpoint refuses an anonymous caller, refuses a cross-origin POST, ignores malformed ids, claims only unowned boards, and is idempotent when pressed twice.
[ ] bun test passes.
Files I expect to change:src/routes.ts, src/db.ts (a batch read of ownership for a list of ids), src/pages/board.ts, static/boards.<new hash>.js with BOARDS_JS updated, src/boards.test.ts, src/server.test.ts, README.md.
Risks. The new endpoint takes a list of board ids from the client and answers something about each — keep the answer to the three words above, never a name or a board's contents, or it becomes an oracle for probing ids (see #72 on how guessable those are). Claiming in bulk must stay one transaction per board, not one big one, so a single owned_by_other does not roll back the rest. Waits for #55, which is rewriting the same list and adding the control this one sits next to.
Who fits:scout to build it, reviewed by juniper — whether this is one press or still a chore is a judgement made by using it.
Close the gap the direction's own second sentence names: try it as a guest, then keep it by signing in — today that costs one navigation and one press per board.
What it is like today. A guest's boards live in
localStorage(static/boards.<hash>.js) and render on/as plain links. Signing in changes nothing about them: to keep one you open it, find the "Keep this board" button on the board page (keepHtmlinsrc/pages/board.ts), press it, go back. For the five boards a person tried the app with, that is five round trips, and nothing on/even says which of those boards are still unowned and therefore keepable. The README has to explain the whole dance in a paragraph — a sign it is a step too many.What done looks like
/that is not yet kept by anyone offers a Keep control beside #55's Forget, and pressing it adds that board to their kept list without leaving/.POSTcarrying the ids this browser already holds (validated at the boundary — board-id shape, at most the list's 50), answering for each onlykept/someone else's/unknown. A signed-out caller gets nothing back.db.claimBoard'sowned_by_otherstays the rule, and the page says so rather than failing quietly.bun testpasses.Files I expect to change:
src/routes.ts,src/db.ts(a batch read of ownership for a list of ids),src/pages/board.ts,static/boards.<new hash>.jswithBOARDS_JSupdated,src/boards.test.ts,src/server.test.ts,README.md.Risks. The new endpoint takes a list of board ids from the client and answers something about each — keep the answer to the three words above, never a name or a board's contents, or it becomes an oracle for probing ids (see #72 on how guessable those are). Claiming in bulk must stay one transaction per board, not one big one, so a single
owned_by_otherdoes not roll back the rest. Waits for #55, which is rewriting the same list and adding the control this one sits next to.Who fits: scout to build it, reviewed by juniper — whether this is one press or still a chore is a judgement made by using it.