v1.4.5 — Touch ID Google sign-in + UID migration UX + TigerScale v2 schema

═══ Migration consent + progress modals ═══

Two modals coordinate the on-the-fly decimal → hex spool id migration:

1. Consent modal (phase 1) — non-destructive, asks before any write.
   Shows the spool count and an estimated duration ("about N seconds"
   or "about N minutes" with proper pluralisation). Two buttons:
   - "Update now" → starts the migration
   - "Remind me later" → defers until next app launch (no persistent
     snooze; resets on every sign-in / app start)

2. Lock-screen progress modal (phase 2) — only opens AFTER consent and
   only when the backlog is non-trivial (≥ 3 docs). Shows a progress
   bar `done / total`, the count is updated live as the queue drains.
   Explicitly tells the user "do not close the app" in bold.
   Cmd+Q during this phase is intercepted by main.js — a native macOS
   dialog asks the user to confirm before letting the quit through.

Adaptive politeness: 250 ms gap between migrations by default,
500 ms when the queue exceeds 50 spools, so we stay well within
Firestore's per-document write throughput. ~1 s per spool end-to-end.

═══ TigerScale v2 schema cutover ═══

Studio Manager now reads the heartbeat doc using v2 field names only.
No v1 fallback — old firmware writing `last_seen` / `name` /
`last_spool` / `rssi` / `battery_pct` will appear OFFLINE in the UI
until updated.

New v2 reads (via dedicated accessor helpers in inventory.js):
- last_heartbeat_at  (Firestore serverTimestamp, NOT Unix ms)
- display_name
- current_spool_uid_1 / current_spool_uid_2 (twin-tag pair)
- wifi_signal_dbm, battery_percent, is_charging
- power_source enum ("ac" | "battery" | "usb" | "poe")
- hardware_revision

Twin-tag detection: when both _1 and _2 are filled, Studio cross-
references them against state.rows. If one row's twin_tag_uid points
at the other, render one card (= one physical spool). Otherwise,
render two cards (= two unrelated spools on the platform).

═══ i18n ═══

9 new keys × 9 locales (en / fr / de / es / it / pl / pt / pt-pt / zh):
- uidMigrConfirmTitle / Msg / Remind / Accept
- uidMigrProgressTitle / Msg / Warn
- uidMigrDurationSeconds / Minutes (pluralised via {one,other})

The confirm modal message uses `{{count}}` and `{{duration}}`
interpolation; the duration is computed by a JS helper that maps
spool count → human-friendly time string.

═══ All previous v1.4.5-prep changes are now released ═══

This release also rolls in the changes that were already merged to
main but never tagged: Google Auth via system browser (Touch ID +
passkey work), friend banner repositioned to the top header with
own-user variant, sidebar avatar swap-back ⇄ affordance, double
chevron on the "Not Stored" tile, scale icon red fixed when no
scale paired, friend-view bleed-through bug fix (3-layer defence),
WCAG-driven readable initials on light avatar backgrounds, and
the lazy decimal → hex migration core itself.

Files: package.json + package-lock.json (1.4.4 → 1.4.5),
README.md (changelog), main.js, preload.js, renderer/inventory.html
+ inventory.css + inventory.js, all 9 renderer/locales/*.json.

Triggers GitHub Actions: tag v1.4.5 will run the macOS / Linux /
Windows matrix. Windows .exe will be UNSIGNED (Microsoft Trusted
Signing identity validation for STARGATE GROUP is still in
progress, no TRUSTED_SIGNING_CERT_PROFILE variable on the repo).
The signing step is skipped via the existing if-guard in build.yml,
so the rest of the pipeline runs cleanly.

Author: TigerTag-Project

README.md

@@ -41,6 +41,23 @@
 
 ## Changelog
 
+### v1.4.5 — 2026-05-03
+
+- **Google sign-in via Touch ID / passkey.** Replaced `firebase.auth().signInWithPopup()` (whose Chromium popup couldn't reach macOS authd, leaving "Use your passkey" inert) with the loopback OAuth flow (RFC 8252 + PKCE). The system browser opens for the auth step, so Touch ID, passkeys, and hardware keys work natively. After the auth handshake completes, the Electron window is brought back to the foreground automatically. Falls back to popup gracefully if the loopback step fails for any reason.
+- **Lazy on-the-fly migration of legacy decimal spool ids → hex uppercase.** Whenever Studio sees an inventory doc whose id is in the legacy decimal big-endian form (e.g. `8307741719072896`), it migrates it to the canonical hex form (`1D895E7C004A80`) in the background. Migration is idempotent, atomic per spool (single Firestore batch per migration: SET hex doc + SET map entry + UPDATE twin partner's `twin_tag_uid` + DELETE decimal doc), polite (250-500 ms gap between writes to stay well within Firestore quota), and safe vs concurrent mobile-app writes. A new `users/{uid}/uidMigrationMap/{decimal_uid}` collection serves as a bridge — any client still holding a legacy decimal UID can resolve it to the canonical hex doc in one read.
+- **Migration consent + progress UI.** Two modals coordinate the migration UX:
+  - A **consent modal** asks for confirmation before any write, showing the spool count and an estimated duration ("about N seconds" / "about N minutes"). Two buttons: "Update now" / "Remind me later" (re-prompts at next app launch). Fully translated across all 9 locales.
+  - A **lock-screen progress modal** shows during the initial sweep (≥ 3 docs) with a progress bar and an explicit "do not close the app" warning. Cmd+Q during this phase is intercepted by the main process — a native macOS dialog asks the user to confirm before quitting mid-migration.
+- **TigerScale v2 schema cutover.** The scale heartbeat document at `users/{uid}/scales/{mac}` is now read with the v2 field names: `last_heartbeat_at` (Firestore serverTimestamp), `display_name`, `current_spool_uid_1` / `_2` (twin-pair detection), `wifi_signal_dbm`, `power_source` (enum `ac` | `battery` | `usb` | `poe`), `battery_percent`, `is_charging`, `hardware_revision`. No backward compatibility with v1 names — firmwares writing the legacy `name` / `last_seen` / `last_spool` / `rssi` / `battery_pct` fields will appear offline / unnamed until they ship a v2 update. Full contract documented at https://github.com/TigerTag-Project/TigerTag_Firebase_Integration/blob/main/docs/clients/tigerscale-doc-schema.md.
+- **Twin-pair display on the TigerScale side-card.** When two RFID tags are simultaneously present and reference each other via `twin_tag_uid`, Studio renders them as a single physical spool (one card). Two unrelated tags render as two cards.
+- **Friend banner repositioned + own-user variant.** The "READ-ONLY" pill that used to sit inside `#card-inv` now lives in the top header, to the left of the KPI stats. Same chip frame in own-user mode shows a random welcome greeting from `t("welcomeBack")` instead of the READ-ONLY badge. Avatar size aligned to the stat tiles' height (50×50). The decorative card frame around the chip was removed for a cleaner top-row look.
+- **Sidebar avatar — swap-back affordance.** A small ⇄ badge appears at the bottom-right of the user's own avatar in the sidebar while a friend's inventory is being previewed. The whole avatar acts as a one-click "return to my own inventory" button in that mode. Pointer-events on the badge funnel clicks to the avatar itself.
+- **Storage view "Not Stored" tile — double chevron.** Single `›` replaced with a double `»` to better telegraph that clicking opens a side-card. Color inherits the orange of the `.rv-stat-chev` rule.
+- **Scale health icon — red when no scale paired.** When `state.scales.length === 0`, the ⚖ icon in the header turns red as a discoverability cue. Stays at default 18px size with no animation per user feedback.
+- **Friend-view bug fixed — previous user's data no longer bleeds through.** Three layers of protection: `unsubscribeInventory()` + `unsubscribeRacks()` are called BEFORE any state mutation in `switchToFriendView`, both `subscribeInventory` and `subscribeRacks` snapshot callbacks now have a `state.friendView` early-return guard (defence-in-depth against in-flight buffered events), and `switchBackToOwnView` calls `renderStats()` + `renderInventory()` immediately so the friend's data is wiped from the DOM the same frame the user clicks "swap back". `renderInventory()` also now hands off to `renderRackView()` even on empty/loading state when `viewMode === "rack"` so stale rack DOM is cleared.
+- **Initials contrast on coloured avatars.** A new `readableTextOn(bg)` helper computes WCAG luminance via a 1×1 canvas and switches initials text colour to `#1a1a1a` for light avatar backgrounds. Applied to all 10 avatar render sites.
+- **i18n.** 9 new keys for migration consent / progress modals, with proper `{{count}}` and `{{duration}}` interpolation, plus pluralised duration formatters (`one` / `other`). All 9 locales (en / fr / de / es / it / pl / pt / pt-pt / zh).
+
 ### v1.4.4 — 2026-05-02
 
 - **Auto-update toggle.** New "Updates" section in **Settings** lets the user enable or disable automatic update downloads, and exposes a **Check for updates now** button. The preference persists to `<userData>/auto-update.json`. When enabled, the existing `electron-updater` flow runs on launch and prompts for restart when an update is ready; when disabled, the app stays on the installed version until the user manually checks. (`main.js`, `preload.js`, `renderer/inventory.js`)

main.js

@@ -495,6 +495,48 @@ function initUpdater() {
 }
 
 // IPC: renderer asks to install downloaded update
+// ─────────────────────────────────────────────────────────────────────────
+// UID migration — block accidental app quit during the initial sweep
+// ─────────────────────────────────────────────────────────────────────────
+//
+// Tiger Studio Manager migrates legacy decimal-format inventory ids to hex
+// uppercase in the background (see renderer/inventory.js). On the first
+// launch after the new mobile-app-version cutover, a user with a large
+// pre-existing inventory may have several hundred docs to migrate, taking
+// 30–120 seconds. The renderer puts up a lock-screen modal saying "do not
+// close the app", but a determined user can still hit Cmd+Q.
+//
+// The renderer signals via the `migration:set-in-flight` IPC when the
+// sweep starts/ends. While in flight, we intercept `before-quit` and
+// `mainWindow.close` events and pop a confirm dialog: leaving mid-sweep
+// is safe (next launch resumes), but we want the user to KNOW that.
+let _migrationInFlight = false;
+ipcMain.on('migration:set-in-flight', (_evt, inFlight) => {
+  _migrationInFlight = !!inFlight;
+});
+
+const { dialog } = require('electron');
+let _quitConfirmedDuringMigration = false;
+app.on('before-quit', (event) => {
+  if (!_migrationInFlight || _quitConfirmedDuringMigration) return;
+  // Block this quit attempt and ask the user to confirm
+  event.preventDefault();
+  if (mainWindow) mainWindow.show();
+  const choice = dialog.showMessageBoxSync(mainWindow, {
+    type:    'warning',
+    title:   'Migration in progress',
+    message: 'Inventory upgrade is still running.',
+    detail:  'Closing now is safe — the migration will resume the next time you open Tiger Studio Manager — but for the cleanest experience, please let it finish (it usually takes less than a minute).\n\nQuit anyway?',
+    buttons: ['Wait for it to finish', 'Quit anyway'],
+    defaultId: 0,
+    cancelId:  0,
+  });
+  if (choice === 1) {
+    _quitConfirmedDuringMigration = true;
+    app.quit();   // re-trigger the quit, this time we let it through
+  }
+});
+
 ipcMain.on('install-update', () => {
   autoUpdater.quitAndInstall();
 });

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "tigertag-inventory",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Tiger Studio Manager — desktop app",
   "main": "main.js",
   "engines": {

package.json

@@ -47,6 +47,13 @@ contextBridge.exposeInMainWorld('electronAPI', {
   // inert. Resolves with `{ ok, idToken, accessToken }` or `{ ok:false, error }`.
   signInWithGoogleLoopback: () => ipcRenderer.invoke('auth:google-loopback'),
 
+  // ── UID migration in-flight signal ─────────────────────────────────────
+  // Renderer announces when the inventory migration sweep starts and
+  // finishes. Main uses this to intercept Cmd+Q / window close and prompt
+  // the user before letting them quit mid-migration (which would leave
+  // a partial state, even though the next launch would resume cleanly).
+  setMigrationInFlight: (inFlight) => ipcRenderer.send('migration:set-in-flight', !!inFlight),
+
   // ── App info (version / platform — used by the diagnostic report) ──────
   getAppInfo: () => ipcRenderer.invoke('app:info'),
 

preload.js

@@ -2836,6 +2836,162 @@
     background: var(--danger) !important; color: #fff !important;
   }
 
+  /* ── UID format migration overlay ─────────────────────────────────────
+     Lock-screen modal shown while Tiger Studio is migrating legacy
+     decimal-format inventory ids to the new hex canonical form. Z-index
+     above everything so the user CAN'T interact with the rest of the UI
+     and CAN'T dismiss the modal until the queue drains. The message
+     explicitly warns the user not to close the app. */
+  .uid-migr-overlay {
+    z-index: 10000;
+  }
+  .uid-migr-card {
+    max-width: 480px;
+    text-align: center;
+    padding: 32px 28px 28px;
+  }
+  .uid-migr-icon {
+    width: 64px; height: 64px;
+    margin: 0 auto 18px;
+    border-radius: 50%;
+    background: var(--primary-soft, rgba(255,122,24,.12));
+    display: flex; align-items: center; justify-content: center;
+    color: var(--primary);
+    animation: uidMigrSpin 1.6s linear infinite;
+  }
+  .uid-migr-icon .icon {
+    background: var(--primary);
+    width: 28px; height: 28px;
+  }
+  .uid-migr-card.uid-migr--done .uid-migr-icon {
+    background: rgba(16,185,129,.14);
+    color: #10b981;
+    animation: none;
+  }
+  .uid-migr-card.uid-migr--done .uid-migr-icon .icon {
+    background: #10b981;
+    /* Switch from refresh-arrow to check via mask swap */
+    -webkit-mask-image: url('../assets/svg/icons/icon_check.svg');
+            mask-image: url('../assets/svg/icons/icon_check.svg');
+  }
+  @keyframes uidMigrSpin {
+    from { transform: rotate(0deg); }
+    to   { transform: rotate(360deg); }
+  }
+  .uid-migr-title {
+    font-size: 20px;
+    font-weight: 700;
+    color: var(--text);
+    margin: 0 0 12px;
+    letter-spacing: -.01em;
+  }
+  .uid-migr-msg {
+    font-size: 14px;
+    color: var(--muted);
+    line-height: 1.5;
+    margin: 0 0 22px;
+  }
+  .uid-migr-msg strong {
+    color: var(--text);
+    font-weight: 700;
+  }
+  .uid-migr-progress {
+    margin-bottom: 16px;
+  }
+  .uid-migr-progress-track {
+    height: 8px;
+    background: var(--border);
+    border-radius: 8px;
+    overflow: hidden;
+    margin-bottom: 8px;
+  }
+  .uid-migr-progress-fill {
+    height: 100%;
+    background: linear-gradient(90deg, var(--primary), #ffb056);
+    width: 0%;
+    transition: width .25s ease;
+    border-radius: 8px;
+  }
+  .uid-migr-count {
+    font-size: 13px;
+    font-weight: 600;
+    color: var(--text);
+    font-variant-numeric: tabular-nums;
+  }
+  .uid-migr-warn {
+    font-size: 12px;
+    color: var(--muted);
+    background: var(--surface-2);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    padding: 10px 12px;
+    line-height: 1.4;
+  }
+  .uid-migr-card.uid-migr--done .uid-migr-warn {
+    display: none;
+  }
+  .uid-migr-card.uid-migr--done .uid-migr-msg {
+    /* In success state, simplify to a one-liner */
+    display: none;
+  }
+  .uid-migr-card.uid-migr--done .uid-migr-title::after {
+    content: " — done";
+    color: #10b981;
+  }
+
+  /* ── Confirm modal (phase 1) — user consent before migration starts ──
+     Same visual base as the progress modal but DISMISSIBLE, with three
+     action buttons. The icon doesn't spin (no operation in progress yet). */
+  .uid-migr-confirm-card {
+    max-width: 480px;
+    text-align: center;
+    padding: 32px 28px 24px;
+  }
+  .uid-migr-confirm-icon {
+    animation: none;          /* override the spinning animation from .uid-migr-icon */
+  }
+  #uidMigrationConfirmCount {
+    font-weight: 700;
+    color: var(--text);
+  }
+  .uid-migr-confirm-actions {
+    display: flex; flex-wrap: wrap;
+    justify-content: center;
+    gap: 8px;
+    margin-top: 20px;
+  }
+  .uid-migr-confirm-btn {
+    flex: 1 1 auto;
+    min-width: 110px;
+    height: 38px;
+    padding: 0 18px;
+    border-radius: 10px;
+    font-size: 13px;
+    font-weight: 600;
+    cursor: pointer;
+    font-family: inherit;
+    transition: background .15s, border-color .15s, color .15s;
+  }
+  .uid-migr-confirm-btn.ghost {
+    background: transparent;
+    border: 1.5px solid var(--border);
+    color: var(--text);
+  }
+  .uid-migr-confirm-btn.ghost:hover {
+    border-color: var(--primary);
+    color: var(--primary);
+    background: var(--primary-soft, rgba(255,122,24,.06));
+  }
+  .uid-migr-confirm-btn.primary {
+    background: var(--primary);
+    border: 1.5px solid var(--primary);
+    color: #fff;
+    box-shadow: 0 2px 10px rgba(255,122,24,.25);
+  }
+  .uid-migr-confirm-btn.primary:hover {
+    background: var(--primary-hover, #ff8a30);
+  }
+
   /* Friend view — full error state inside card-inv */
   .friend-inv-error {
     text-align: center;

renderer/inventory.css

@@ -1020,6 +1020,51 @@
   </div>
 </div>
 
+<!-- ─── UID format migration — phase 1: user consent ───────────────────────
+     Asked once per session when Studio detects legacy decimal-format spool
+     ids. Three actions:
+       • Update now      → starts the migration (phase-2 lock-screen modal opens)
+       • Remind me later → snoozes for 24 h (persisted in localStorage)
+       • Later           → defers for the rest of this session only
+     If the user dismisses with the close X (top-right) we treat it as "Later". -->
+<div class="modal-overlay uid-migr-confirm-overlay" id="uidMigrationConfirmOverlay">
+  <div class="modal-card uid-migr-confirm-card" role="dialog" aria-labelledby="uidMigrationConfirmTitle">
+    <div class="uid-migr-icon uid-migr-confirm-icon"><span class="icon icon-refresh icon-22"></span></div>
+    <h2 class="uid-migr-title" id="uidMigrationConfirmTitle" data-i18n="uidMigrConfirmTitle">Inventory format upgrade available</h2>
+    <p class="uid-migr-msg" id="uidMigrationConfirmMsg">
+      <!-- Dynamic content with {{count}} — populated by JS t() at show time -->
+    </p>
+    <div class="uid-migr-confirm-actions">
+      <button class="ghost uid-migr-confirm-btn" id="uidMigrationConfirmRemind" data-i18n="uidMigrConfirmRemind">Remind me later</button>
+      <button class="primary uid-migr-confirm-btn" id="uidMigrationConfirmAccept" data-i18n="uidMigrConfirmAccept">Update now</button>
+    </div>
+  </div>
+</div>
+
+<!-- ─── UID format migration — phase 2: lock-screen progress ──────────────
+     Opens AFTER the user clicked "Update now" on phase 1. NON-DISMISSIBLE
+     while the queue drains. Cmd+Q during this phase pops a confirm dialog
+     in main.js (see migration:set-in-flight IPC). After the last commit it
+     transitions to a success state and auto-closes 1.8 s later. -->
+<div class="modal-overlay uid-migr-overlay" id="uidMigrationOverlay">
+  <div class="modal-card uid-migr-card" role="alertdialog" aria-live="polite" aria-busy="true">
+    <div class="uid-migr-icon"><span class="icon icon-refresh icon-22"></span></div>
+    <h2 class="uid-migr-title" id="uidMigrationTitle" data-i18n="uidMigrProgressTitle">Inventory format upgrade in progress</h2>
+    <p class="uid-migr-msg" id="uidMigrationMsg" data-i18n="uidMigrProgressMsg">
+      Your inventory is being upgraded to a new, more efficient storage format. Please do not close the app until this finishes. Each spool only takes a fraction of a second.
+    </p>
+    <div class="uid-migr-progress">
+      <div class="uid-migr-progress-track">
+        <div class="uid-migr-progress-fill" id="uidMigrationBar"></div>
+      </div>
+      <div class="uid-migr-count" id="uidMigrationCount">0 / 0</div>
+    </div>
+    <div class="uid-migr-warn" id="uidMigrationWarn" data-i18n="uidMigrProgressWarn">
+      ⚠ Closing the app now would just resume on next launch — but for the cleanest experience, let it finish.
+    </div>
+  </div>
+</div>
+
 <script src="lib/firebase/firebase-app-compat.js"></script>
 <script src="lib/firebase/firebase-auth-compat.js"></script>
 <script src="lib/firebase/firebase-firestore-compat.js"></script>