Home Roadmap Yer Cloud Stuff

Yer Cloud Stuff

Scheme

Every screen a person would see, painted with index.html's own stylesheet and its own class names — an .act in here is an .act.
Proposal: PROPOSAL.md, beside this file. Nothing here is built.
The stylesheet is stamped by stamp.mjs. If this looks unlike the site, restamp it rather than editing the CSS.

1Where it lives

Yer Stuff → Settings. One new .stuff-group, between the two controls that are already there and the Start over block that is already below them. No new tab, no new section, no new idiom: the heading is the h3 a .stuff-group already has, and every control in it is an .act or a .seg.

Yer Stuff → Settingsthe whole panel, top to bottom
Theme
Map

Yer Cloud Stuff KEEPING A COPY

There’s a copy of what you’ve marked, kept under a code and nothing else — no name, no email, no account. We can’t read it: it’s scrambled on this device before it goes anywhere. Last saved a moment ago.

Start over

Bookmarks, itineraries, any trip you’re halfway through, and your Settings above — all of it, back to how the page arrives.

Why here. It is a setting, it belongs to no collection, and the panel it sits in is the one that exists whatever is saved — the same structural reason Forget everything stopped needing to render in two branches. Above Start over, because the block that keeps your stuff should be read before the block that destroys it.

2The four states

Every one of them is the same block with a different .n on the heading and a different sentence under it. A person should be able to tell which state they are in from the row alone, without pressing anything.

Savingtransient

Yer Cloud Stuff SAVING…

Keeping up with what you just marked.

No spinner. The push is debounced three seconds and usually finishes before anybody looks. A spinner would be a thing that flashes on a page where nothing is waiting on it.

Couldn’t reach itnetwork, or the Worker is down

Yer Cloud Stuff NOT SAVED YET

Couldn’t reach the copy. Everything you’ve marked is still here on this device and nothing has been lost — it just isn’t backed up yet. It’ll try again on its own.

It says what it does not mean. The failure people fear here is losing their marks, and that is the one thing that has not happened. Same reason stuffSaved already earns a sentence of its own.

Offturned off by hand

Yer Cloud Stuff OFF

Nothing is being kept anywhere but this device. Clear your browser and it’s gone.

Restore still works when it is off. Coming back to a copy and choosing to keep making one are two different decisions, and somebody restoring onto a borrowed laptop wants exactly one of them.

Nothing saved yeta first visit

Yer Cloud Stuff NOTHING TO KEEP

Bookmark somewhere and a copy starts keeping itself. Got a code from another device?

No code exists yet, because nothing has been saved and a code with nothing behind it is a thing to write down for no reason. The derive — a second and a half of it — has not run either.

3The code, revealed

Hidden until asked for. A code on screen is a code in a screenshot, in a screen share, and over the shoulder of whoever is sitting next to you — and unlike a password there is nothing to change it to afterwards.

Show yer codepressed

Yer Cloud Stuff KEEPING A COPY

Yer code

mesquite-kolache-bluebonnet-caliche-armadillo-7
Write it down. It’s the only thing that says which copy is yours. There’s no email on file, no password to reset and nobody to ask — lose the five words and the copy is gone for good.

Five words, and the last character is a check. It is a weighted sum of the five, so a mistyped or swapped word is caught on the device before anything is asked of the network — that isn’t a code rather than no copy found.

Copiedtwo seconds, then back

Yer Cloud Stuff KEEPING A COPY

Yer code

mesquite-kolache-bluebonnet-caliche-armadillo-7

The pressed .act is the only "on" idiom on this page — the filled accent an un-bookmark already wears. No toast, no new component.

4Sending it to yourself

The link is the code, in a form a phone can open. It is a fragment, which never reaches a server — not our Worker’s request line, not Cloudflare’s logs, and not the Referer of whatever gets clicked next.

Send it to mepressed

Send yer code to yerself NOTHING IS EMAILED

This makes a link. Where it goes is up to you — text it to yourself, put it in a note, email it. We don’t send anything and we never see the address.

The link

texasfindem.com/#restore=
mesquite-kolache-bluebonnet-caliche-armadillo-7
Anyone who opens this link can restore your list. Send it to yourself, not to a group chat.

Share… is the OS sheet (navigator.share), which puts the link into whatever the person already uses and keeps us out of it entirely. Email it to myself is a mailto: with an empty to: — their mail app, their address, no server of ours in the path. Neither one is a form that collects anything.

5The restore box

One field, one button, one line of result. The field takes the words however anybody plausibly wrote them down — hyphens, spaces, commas, capitals, a stray blank at the end — because the copy was made on a phone and typed back in on a different one.

Emptythe resting state

Restore a copy

Five words from another device.

input[type=search], the same control the town and ZIP boxes use. Nothing new to style and nothing new to learn.

Mistypedthe check character disagrees

Restore a copy

That isn’t a code. Check the words — bluebonet isn’t one of them. Did you mean bluebonnet?

Caught on the device, with no request made. Every word is on the list or it isn’t, and the nearest one is a lookup. This is why the wordlist forbids two words within one edit of each other: the suggestion can only ever be one word.

Nothing therea valid code, no copy

Restore a copy

That’s a real code, but there’s no copy under it. Either it’s not the one from your other device, or that copy was forgotten.

A different sentence, because it means a different thing. One says you typed it wrong; this one says you typed it right and there is nothing here, and somebody standing in a parking lot needs to know which.

Foundthe confirm step

Restore a copy

Found it. 7 bookmarks and 2 drives, last saved August 27.

What was found is on screen before the decision is made. That is what makes the extra tap cost nothing — it is a decision with its answer already in front of you, not a speed bump.

6Arriving by link

Someone taps texasfindem.com/#restore=…. The page loads normally, the fragment is read and stripped from the address bar with replaceState, Yer Stuff opens on Settings, and this is waiting. It fills the code in. It does not restore.

A clean devicenothing saved here yet — the common case

Somebody sent you a copy FROM A LINK

This link carries a code for a saved copy: 7 bookmarks and 2 drives, last saved August 27. There’s nothing saved on this device yet, so restoring it just brings the lot over.
7 bookmarks 2 drives Saved Aug 27

Not now leaves this device exactly as it is and forgets the link. The code stays in the box if you want to look again.

Why it doesn’t just do it. The link is the credential. It will end up forwarded, screenshotted, and pasted into a group chat, and a link that silently rewrites a phone when somebody taps it out of curiosity is a bug there is no apologising for. One tap, with the answer already on screen.

A device that already has its own copythe case that’s easy to get wrong

Somebody sent you a copy FROM A LINK

This link carries a copy with 7 bookmarks and 2 drives, last saved August 27. This device already has 4 bookmarks and 1 drive of its own, under a different code.
Restoring joins them. Nothing on this device is thrown away — you’d end up with 9 bookmarks and 3 drives (two of the bookmarks are on both). From then on this device saves under the code from the link, and the one it has now stops being used.

This device’s current code — write it down if you want to keep the two apart

pecan-shiner-guadalupe-brisket-chachalaca-k

Three things this screen has to say and no fewer. That the word "restore" means merge here and nothing local is lost; what the result will actually be, as a number rather than a promise; and that a code is being retired — because the copy it points at may still be somebody else’s phone, and orphaning it silently is the failure. The button says Join them, not Restore, for the same reason.

7After the restore

The confirmation stands where the panel was — the same rule Save itinerary already follows. It names what came back, and it names what didn’t.

Everything came backthe good day

Got it RESTORED

7 bookmarks and 2 drives are back. This device keeps a copy under that code from now on.
See yer bookmarks

It lands on a real anchor and nothing more. The browser scrolls; the Bookmarks tab is selected; nothing is auto-opened. Same call the saved-itinerary panel already made.

A stop has gonesaid out loud, always

Got it RESTORED — WITH ONE NOTE

6 of your 7 bookmarks are back, and both drives.
One store isn’t on the map any more — Beechnut H-E-B, saved March 4. It may have closed, or its chain may have renumbered it. Nothing we can do from here, but you should know it’s missing rather than wonder later.

Six rendered with no mention of the seventh looks exactly like seven. This is the rule CLAUDE.md wrote down for the one permitted use of a uid in a URL, before the code that needed it. This is that code.

8Start over

Forget everything on this device means this device. The copy is not on this device. So either the button grows a second control or its caption starts lying, and the caption is the thing answering for the most destructive control on the site.

Forget everything on this devicepressed — the armed state

Start over

This clears everything on this device — bookmarks, itineraries, any trip you’re halfway through, your Settings, and the code. It also clears whatever search is on screen. There’s no undo.

And the copy?

Leave it and the copy stays where it is — but this device is about to forget the code, so unless you’ve written it down or another device has it, nobody will ever open it again. It deletes itself after a year untouched either way.

Nothing destructive is pre-selected, and the default is the less destructive of the two — but the caption says plainly what "less destructive" buys, which is usually nothing, because the code is going. That sentence is the one that stops Leave it from reading as a safe choice when it mostly isn’t. Caption is --dim, not --faint, the scoped exception this block already holds.

9The flows

Three lanes, so which side of the wire each step happens on is visible. The middle lane is the only thing that ever crosses the network, and it never carries the code or anything readable.

A — The first bookmark, on a device that has never saved anything

The phone
The wire
The Worker + KV
1Taps the bookmark on a card. It lights up. Everything after this is off the critical path.
2No code yet, so one is minted: 55 bits from crypto.getRandomValues, rendered as five words plus a check character.
3PBKDF2, 600k iterations, ~1.5s on idle. 64 bytes out: a storage key and an AES key. Both cached in texasfindem.cloud, so this never runs on this device again.
4Encrypts the blob. Debounces three seconds.
PUT ?k=…
{rev:null, blob}
Key doesn’t exist → writes it, TTL 400 days, mints a rev.
5Stores the rev. Settings now reads keeping a copy.
204

B — The laptop, opened at the kitchen table with the same code already restored

The laptop
The wire
The Worker + KV
1Page loads and paints. Map, search, everything — all of it from the page itself, exactly as it does today.
2On idle, after first paint: keys are already cached, so nothing is derived.
GET ?k=…
Hands back {rev, blob}. It has no idea what is in it.
3Decrypts. Merges per key into what is here: newer wins, a tombstone beats a value of the same age. The two bookmarks made on the phone this morning appear.
4The merge changed the local copy but not the remote one, so nothing is pushed. Silence is the correct outcome.

C — Two devices push at once

The phone
The wire
The Worker + KV
1Marks a Torchy’s. Pushes with the rev it holds.
PUT {rev: a1…}
Matches → writes, new rev b2…
2Meanwhile the laptop deletes a bookmark and pushes, still holding a1…
PUT {rev: a1…}
Stale → 409, and hands back the current {rev, blob} rather than an error.
3The laptop merges what came back into what it has — it gains the Torchy’s, it keeps its own tombstone — and pushes again with b2…
PUT {rev: b2…}
Matches → writes.
4The phone picks the deletion up on its next pull. Both devices agree, and neither of them ever asked the other anything.

D — Where this is honest about KV

Either device
The wire
The Worker + KV
1Two pushes inside the same second. KV is eventually consistent, so both can read a1… and the second overwrites the first.
PUT ×2
Both accepted. The CAS did not catch it, and cannot.
2Nothing is lost, because a push never touches the local copy. The loser’s marks are still on the loser’s device.
3Its next pull merges them back in and pushes. The failure is converges one round later, not data lost — and one round is the next page load.
GET → merge → PUT
Agrees.

If it ever bites, the escalation is written down rather than improvised: a Durable Object in front of the namespace makes the CAS real. One file, no schema change, no migration, and none of the four flows above alters. It is not being built now because a bounded convergence delay on one person’s own two devices is not a problem anybody would notice.

10Rules with no picture

The things a specimen can’t show. Phrased as the thing to do, the way the styleguide's own section 10 is; the reasoning behind each one is in PROPOSAL.md.