UNISPACE

During semester, finding a free desk on campus means guessing, and the cost of a wrong guess is not evenly distributed — a commuter with ninety minutes between classes, or someone for whom each failed attempt is ten minutes of physical effort, pays far more for it than someone who lives on campus. The obvious fix is an app that reports occupancy, but the obvious fix has two problems. Anything that tracks where students are all day is a thing students are right to refuse. And a crowdsourced occupancy app is wrong or empty for its entire first week, which is precisely when it is being judged.

A web app over 18 University of Melbourne buildings where the privacy design is the constraint everything else bends around: the browser reads GPS, matches the point against building polygons locally with Turf.js, and sends a zone id — never a coordinate. Session identifiers rotate every thirty minutes, live in memory only, and are never written to a table. The second half of the work is the harder half: showing occupancy honestly when the app is not sure, which for a crowdsourced product is most of the time. Occupancy is assembled from whichever source is best available and the interface always states which, in text as well as colour, with estimates rendered at reduced intensity behind a `~` and only genuinely live data getting the status dot.

UniSpace answers one question before the walk instead of after it: is there anywhere to sit. It covers 18 buildings at the University of Melbourne's Parkville campus, needs no account, and is a web app rather than a native one because requiring an install would exclude exactly the person who opens it once a week on a train platform.

The interesting problem was never rendering occupancy. It was rendering occupancy honestly while not being sure — which, for a crowdsourced product, is most of the time and all of the first week. So the app never shows a number without showing where it came from. Live counts, crowd reports, model predictions and modelled weekly estimates are distinct states with distinct visual treatments, and confidence is a property of the display rather than a footnote: estimates come through dimmed, dashed and prefixed with `~`, and only genuinely live data earns the status dot. A test enforces that an estimate can never render as a live reading.

That principle runs down into the data rather than stopping at the presentation layer. Researching accessibility against the University's own campus map showed that every flag in the database had been invented, and that the columns could only say yes or no — so the true answer for most buildings, nobody has checked, was not expressible. The columns became nullable, a flag may never be set false from an absence of evidence, and unverified facts render [?] with their provenance shown inline. Opening hours got the same treatment.

Most of this project's engineering time went into repairing itself rather than extending itself. An audit of a plan that recorded itself as complete found that the database had been deleted, that Tailwind was emitting roughly half its utilities because v4 was installed against v3 syntax, and that the build had not compiled in five sprints because the check ran `vite build`, which succeeds while `tsc -b` fails. That audit is committed in the repository, unedited.

React with TypeScript on Vite, built as a PWA, with Mapbox GL rendering real OpenStreetMap building footprints and Recharts drawing the daily curve. Two decisions shaped everything downstream.

Zone matching happens on the client. The Geolocation API hands a raw coordinate to zoneDetection.ts, a pure function that runs a Turf.js point-in-polygon test and returns a zone id, with no logging, no network and no storage — the coordinate is discarded the moment it returns, and a test asserts that file stays side-effect free. Only the zone id crosses the wire. Session ids are module-scoped, regenerate every thirty minutes, are intentionally lost on reload, and are counted in memory by the aggregation function but never written to a table.

Every hook reads through one seam. dataSource.ts exposes fetchRows and subscribeRows, and nothing above it knows whether the rows came from Postgres or from a local fixture. Every external payload is parsed through a Zod schema on the way in. The blending layer then resolves a reading through a fixed chain — live, crowd report, predicted, modelled estimate, none — and confidence.ts holds the single definition of the three confidence tiers that the map, the building card and the finder all render from.

The backend is Postgres with row-level security on every table, seven Deno Edge Functions covering aggregation, predictions, reports, alerts, feedback and an opening-hours sync, and a full migration history. All of it is committed and readable, and none of it is running. The deployed site reads from a fixture layer generated from the same committed seed SQL a real database would be seeded from, with a test that fails if the generated fixtures and the seeds fall out of step.

The plan said the project was finished. An audit treated every checkmark in it as a claim rather than a fact, and all three load-bearing ones were false. The Supabase project the app pointed at had been deleted — three independent resolvers returned NXDOMAIN for the project ref while supabase.co itself resolved fine, and a merely paused project still answers DNS — taking with it a migration that had been applied to the cloud and never committed. Tailwind was installed at v4 while index.css was still written in v3 syntax, so the theme scale never loaded and every utility drawing a value from it silently emitted nothing; the shipped stylesheet carried roughly half the utilities it should have (97, against 194 after the fix). And the build had not compiled in five sprints, because the audit step ran `vite build`, which succeeds while `tsc -b` fails. None of the three was feature work, which is exactly why a plan that tracked features could not see them. The audit is committed as WIRING-AUDIT.md and preserved unedited, including the findings later closed as won't-do.

The recovery fixed roots rather than symptoms, and each fix left behind a test whose job is to make that failure mode impossible rather than merely absent. The CSS assertion compiles the real stylesheet and checks the build output, because a source-level check would have passed happily throughout the outage.

Rebuilding the data layer as fixtures immediately surfaced a P0 that would otherwise have shipped: blendOccupancy checked whether an occupancy row was fresh but not whether it was real, and since the aggregation function rewrites every row on a timer, a campus with zero users would have reported every building as "Live · 0%" — confidently telling a student that a full library was empty. Every existing blending test passed throughout, because the test helper defaulted data_quality to 'live' and no test ever varied it.

The fixture generator turned out to be the most productive place to look for bugs, because everything downstream inherits whatever it gets wrong. It was dropping every database-default timestamp behind an `as unknown as Building[]` cast, so last_updated was undefined campus-wide and every freshness stamp in the deployed app failed its truthiness guard and rendered nothing. It was also skipping two migrations whose `WHERE id = '...'` form the seed parser had no helper for — the two migrations that replace the original oversized rectangles with real geometry — so no version of this database had ever held a true footprint, and a courtyard building like Old Arts rendered as a flat four-cornered slab.

The last bug found is the one the whole project is organised against. The first line on the home screen announced CAMPUS IS BUSY while average occupancy read 14% and every building in the list said EMPTY. The cause was a single fallback: `occupancy?.pct ?? 100` scored a building with no reading as completely full, and 13 of 18 have no reading, so absent data was being rounded to bad news in the one line a user reads first. It now judges only against buildings that reported and names its own denominator, and falls all the way through to NO CAMPUS READING rather than guessing.

Two accessibility repairs were structural rather than cosmetic. A keyboard trap: two role=dialog sheets were dismissible only by pointer and they cover the tab bar (WCAG 2.1.2). There was already a test that pressed Escape and it passed on the bug, because it never asserted the sheet had actually gone — replacing it with an invariant over every dialog in the tree surfaced a third nobody had noticed. And the schema itself was wrong: accessibility flags could only say yes or no, so the true answer for most buildings — nobody has checked — was unrepresentable. The columns are now nullable, a flag may never be set false from an absence of evidence, and unverified facts render [?] with their provenance inline. Where data could not be recovered it was not invented: the deleted migration was rewritten without the Google Place IDs it originally carried, and 11 of 18 remain NULL.

Measurement changed decisions repeatedly, and not always in the expected direction. Splitting Mapbox out of the entry took the landing route from 637 KB gzip — the starting figure recorded in the budget test's own header — down to 169 KB in a local build. The next optimisation made things worse: naming a `charts` chunk for Recharts added about 108 KB to the route, because Recharts was already correctly split behind the lazily-loaded building card and naming it caused the bundler to hoist it into a static import. Shrinking it was the goal and growing it was the result, and only measuring the build output caught that.

The honest caveat on that headline number, since this page trades on honesty: the repository states this same measurement three incompatible ways, and the budget test asserts a ceiling of 210 KB rather than any of them. Re-measuring the deployed assets directly, the live landing route serves about 174 KB of JavaScript. That is why the figure on the card is the map library that never arrives at all — 438 KB gzip, verifiable by opening the network tab on the home screen — rather than a byte count that drifts between builds.

Computing WCAG contrast from index.css rather than eyeballing it caught a text token measuring 2.56:1 that was carrying 49 pieces of real content, and the same test later blocked a design revert: restoring the university palette's literal gold (2.02:1) and green (2.42:1) failed 13 assertions, so the shipped values are hue- and saturation-preserved and darkened until they pass. Three separate bugs in this project have now had the same shape — a stylesheet cannot be verified by reading it, only by measuring what a browser computes.