feat(web): gate the point layer, and say what an account opens

[khagele]

The layer control offered points, hex, both for every role. Below member
/api/points returns the last 24 hours and at most 500 rows
(server/internal/httpapi/degrade.go), so a guest switching to Points landed
on a thin or empty layer with nothing on the control saying why, and the
thinness read as a property of the data rather than of the account.

The hex heat is not windowed for anyone since #466, so the gate costs a
visitor nothing they could otherwise see.

The gate

auth.js gains three helpers beside canSeeLocate, which this mirrors:

canSeePointLayer, a member gate.
modeForRole, which holds a degraded role on hex whatever ?mode= asked
for. The mode is restored before /api/auth/me resolves, so it is
re-derived once the role is known, the same deferral ?locate=1 uses.
pointLayerReason, the line under the layer segments. Two audiences, the
split guestNotice already makes: a guest has no account, a hunter has one
and needs an admin to verify it, so "log in" is a dead end for them
(#174).

Since #539 the layer control is the #layer-seg segmented group in the
filter panel, so the gate lands there: Points and Both are disabled below
member, Hex stays live, and the reason renders as #layer-gate-note directly
under the group, with aria-describedby on the two disabled segments. A line
rather than a title, because on a phone a tooltip is nothing at all. The
segments stay visible rather than hidden: a visitor should be able to see
that the layer exists and what it takes to open it.

The seg click handler loses its syncTimeUi() call: the clamp note stopped
being layer-dependent when rangeLabelFor dropped showsPoints, so switching
layers no longer changes the range label.

A disabled attribute is not a disabled button

Nothing in style.css styled :disabled, so a gated segment rendered
identical to a live one, colour, opacity and cursor alike. #bar button:disabled at (1,1,1), because #bar select, #bar input, #bar button
sets colour at (1,0,1) and .bf-seg button.active sits at (0,2,1). e2e
asserts the rendered colour, opacity and cursor rather than the attribute.

Copy

The guest notice named "individual receptions" as a map layer, which is no
longer true for these roles: the ticker keeps its own /api/points feed and
is where they meet receptions. Rewritten to name it. Measured on the
current bar at 390x844 and 1280x720, the old and new strings render the
same bar heights for both roles, so the rewrite costs no room.

#492's clamp note moves with it: it named the point layer, which these
roles no longer have, so it names the ticker instead and no longer depends
on which layer is drawn.

A test that could not survive

e2e/auth.spec.js's "guest popup has no Locate button" opened a point popup
as a guest, which is now unreachable. It is split: a guest has no popup to
put a button in, and a member's popup still offers Locate, so the Locate
gate it was really about is still asserted.

Verified

web 509 unit, e2e 199/199 with --fail-on-flaky-tests, app 848 unit, eslint
clean, on ae9ba97. Mutation-checked on the segment build: dropping the
disable, dropping the mode re-derive, and emptying the note each turn
auth.spec red. The auth helper tests (gate boundary at hunter, per-role
copy, deep-link hold) carry over unchanged from the first round.

Closes #493

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Co-Authored-By: Claude Fable 5 noreply@anthropic.com

🤖 Generated with Claude Code

[efiten]

The maintainer has taken the call (2026-08-29): yes, the point layer goes behind a member account. So the direction here is settled and it is worth finishing.

It cannot merge as it stands, and the conflict is not mechanical, which is why I left it rather than rebasing it for you.

This branch gates #layer-toggle, the cycling points/hex/both button. #541 replaced that with a segmented three-button group (#layer-seg), so the two sides of the conflict in map.js are two different controls:

this branch   document.getElementById('layer-toggle').addEventListener('click', ...)
master        for (const segBtn of document.querySelectorAll('#layer-seg button')) ...

canSeePointLayer and modeForRole carry over unchanged — they are about the role, not the widget. What needs rethinking is pointLayerReason, which was written as copy on the disabled button. With a segment group there is no single button to disable: presumably the points and both segments are the ones that go, and the reason has to live somewhere a reader will find it, which is a design question rather than a merge one. You own both halves, so it is yours to make rather than mine to guess.

The rest of your reasoning stands and I checked it: the hex heat is not windowed for anyone since #466, so a visitor loses nothing they could otherwise see, and the split copy for guest versus hunter is the right one given #174.

Ping me when it is pushed and I will review it properly.

[khagele]

Pushed, 074218e, rebased onto ae9ba97.

The gate moved onto the segmented group. Points and Both are disabled below member, Hex stays live, and the reason renders as a line under the group (#layer-gate-note) with aria-describedby on the two disabled segments. A line rather than a title: on a phone a tooltip is nothing at all, which is the same reason the :disabled styling exists in this branch.

canSeePointLayer and modeForRole carry over unchanged, as you read them. pointLayerReason keeps both strings and its comment now says where they render.

One more resolution worth naming: the seg click handler on master calls syncTimeUi() because the clamp note was layer-dependent. This branch drops showsPoints from rangeLabelFor, so the note no longer depends on which layer is drawn and that call goes. The automerge kept it, which would have been a no-op call on every layer switch.

The bar-height table in the PR body was measured on the pre-#541 bar and no longer described anything, so it is replaced: measured on the current bar at 390x844 and 1280x720, the old and new guest and hunter strings render identical bar heights, so the copy rewrite costs no room.

Verification on the new top: web 509 unit, e2e 199/199 with --fail-on-flaky-tests (exit 0), app 848 unit, eslint clean. Three mutations on the segment build turn auth.spec.js red: dropping the disable, dropping the mode re-derive, emptying the note. CI is green.

[efiten]

The gate reads well on the segmented control, which is the part that needed rethinking rather than rebasing. Points and Both disabled with Hex live is the right shape: a visitor can see the layer exists and that it is not theirs yet, which is more honest than hiding it and much more honest than the thin layer they used to get with nothing saying why.

Verified with master merged in: web/ 509 unit and 199 playwright, eslint clean.

Both halves of the gate are pinned, checked by breaking them:

• The split copy. Collapsing the hunter branch so everyone gets the guest wording turns 3 unit tests red. That split is the whole of #174: telling a hunter to log in is a dead end, they are logged in, they are waiting on a person.
• The reason actually reaching the reader. Disabling the segments without wiring aria-describedby turns an e2e red. Worth having as its own assertion, since a disabled control with an unreachable explanation is the failure mode this is meant to fix, and it is invisible to anyone testing with a mouse.

A line under the group rather than a title is the right call for the reason you give: on a phone there is no hover, so a title is not an explanation, it is a secret.

One thing I checked rather than assumed, since it is what makes this defensible: the hex heat has not been windowed for anyone since #466, so a visitor loses nothing they could otherwise see. The maintainer accepted that trade on 2026-08-29.