fix(boost): count a lane click once per address, not per user agent

app/db/schema.sql

@@ -1,3 +1,3 @@
 -- basebid.lol · free token launchpad on Base.
 --
 -- Applied by scripts/migrate.mjs (Fly release_command) against the DEDICATED
@@ -450,9 +450,11 @@
 ALTER TABLE bb_token_settings ADD COLUMN IF NOT EXISTS boost_hidden boolean NOT NULL DEFAULT false;  -- admin: kept out of the Boosted lane
 
 -- ── Boosted lane views + clicks (2026-10-16): counted only while the token is in the lane ──
--- Shown as each lane card's click count and on /admin; never read by the ranking (boost-ui.test.ts). visitor = sha256(presence visitor hash | token), cut
--- short: the presence hash rotates every UTC day and cannot be reversed, and mixing in the token means one person's
--- clicks on two tokens cannot be linked. One row per visitor, token and 30-minute slot, so a reload counts once.
+-- Shown as each lane card's click count and on /admin; never read by the ranking (boost-ui.test.ts). visitor =
+-- sha256(address hash | token), cut short. The address hash (the client address, an IPv6 one by its /64, with the
+-- daily presence salt, no user agent) rotates every UTC day and cannot be reversed, and mixing in the token means one
+-- address's clicks on two tokens cannot be linked. One row per visitor, token and 30-minute slot: one address counts
+-- once per card every 30 minutes, whatever user agent it sends.
 CREATE TABLE IF NOT EXISTS bb_boost_clicks (
   chain_id   integer NOT NULL,
   token      text NOT NULL,

app/src/app/api/boost/seen/route.ts

@@ -3,7 +3,7 @@ import { rateLimited } from "@/lib/launchpad/editServer";
 import { clientIp, readJson } from "@/lib/profiles/http";
 import { looksLikeBot, visitorHash } from "@/lib/launchpad/presence";
 import { ethUsd } from "@/lib/launchpad/ethPrice";
-import { boostBeaconSameOrigin, parseBoostSeen } from "@/lib/launchpad/boost";
+import { boostBeaconSameOrigin, boostClickAddress, parseBoostSeen } from "@/lib/launchpad/boost";
 import { recordBoostSeen } from "@/lib/launchpad/boostServer";
 
 export const runtime = "nodejs";
@@ -22,13 +22,15 @@ export async function POST(req: Request) {
   if (!boostBeaconSameOrigin(req.headers.get("sec-fetch-site"), req.headers.get("origin"), req.headers.get("host"))) {
     return NextResponse.json({ error: "cross-site" }, { status: 403 });
   }
-  const ip = clientIp(req);
+  // the address, an IPv6 one by its /64 (boostClickAddress): rotating within one's own block buys no fresh bucket
+  const ip = boostClickAddress(clientIp(req));
   // a person sends one view per page and a click per card opened; 60 a minute leaves room for a shared address
   if (rateLimited(`boost-seen:ip:${ip}`, 60)) return NextResponse.json({ error: "slow down" }, { status: 429 });
   const seen = parseBoostSeen(await readJson(req, 512));
   if (!seen) return NextResponse.json({ error: "bad beacon" }, { status: 400 });
   try {
-    await recordBoostSeen(seen, visitorHash(ip, ua), await ethUsd());
+    // the address alone, no user agent: the caller picks that, and a click must not count again for a new one
+    await recordBoostSeen(seen, visitorHash(ip, ""), await ethUsd());
   } catch (err) {
     console.warn("[boost] beacon failed:", err instanceof Error ? err.message : err);
   }

app/src/components/launchpad/BoostAdmin.tsx

@@ -94,8 +94,8 @@ const num = (n: number) => n.toLocaleString("en-US");
 
 /**
  * Views and clicks per token over a period, with the TWIG burned for each: whether a place in the lane brings visitors.
- * A view is a page load that brought the lane on screen; a click counts once per visitor and 30 minutes, and only
- * while the token was in the lane. Visitors: one per person per day.
+ * A view is a page load that brought the lane on screen; a click counts once per address and 30 minutes, and only
+ * while the token was in the lane. Visitors: one per address per day.
  */
 function LaneStats({ wallet }: { wallet: string }) {
   const [days, setDays] = useState<BoostStatsDays>(7);
@@ -137,7 +137,7 @@ function LaneStats({ wallet }: { wallet: string }) {
           ))}
         </div>
       </div>
-      <p className="text-[11px] leading-relaxed text-muted">A view is a page that brought the lane on screen. A click counts once per visitor every 30 minutes, only while the token is in the lane. Visitors: one per person per day, per token. The top {num(100)} tokens are listed; the totals cover all.</p>
+      <p className="text-[11px] leading-relaxed text-muted">A view is a page that brought the lane on screen. A click counts once per address every 30 minutes, only while the token is in the lane. Visitors: one per address per day, per token. The top {num(100)} tokens are listed; the totals cover all.</p>
       {err ? <p role="status" className="text-xs text-down-ink">{err}</p> : null}
       {rows === null ? (
         err ? null : <p className="text-xs text-muted">Loading…</p>

app/src/components/launchpad/BoostedLane.tsx

@@ -151,6 +151,8 @@ export default function BoostedLane({ initial, serverNow, source }: { initial: B
             const left = boostTimeLeft(b.last_at, now);
             const fuse = boostFuse(b.last_at, now);
             const lit = ignited[l.token];
+            // absent from a machine on the older build while a deploy rolls: no count shown, never "undefined"
+            const clicks = b.clicks ?? 0;
             // two columns from 640px: an odd last card takes the whole row instead of leaving a hole
             const lastOdd = i === items.length - 1 && items.length % 2 === 1;
             // the whole card opens the token (the link's ::after covers it); only "Latest burn" sits above as its own link
@@ -169,7 +171,7 @@ export default function BoostedLane({ initial, serverNow, source }: { initial: B
                 <ArrowUpRight size={14} aria-hidden="true" className="pointer-events-none absolute right-3 top-3 text-warm-ink max-sm:hidden opacity-0 transition duration-150 group-hover/card:opacity-100 motion-safe:-translate-x-0.5 motion-safe:translate-y-0.5 motion-safe:group-hover/card:translate-x-0 motion-safe:group-hover/card:translate-y-0 motion-reduce:transition-none" />
                 <Link
                   href={`/t/${l.chain}/${l.token}`}
-                  title={`${b.boosts} ${b.boosts === 1 ? "boost" : "boosts"} from ${b.boosters} ${b.boosters === 1 ? "wallet" : "wallets"} · ${b.clicks} ${b.clicks === 1 ? "click" : "clicks"} from this lane, in the last 24 hours`}
+                  title={`${b.boosts} ${b.boosts === 1 ? "boost" : "boosts"} from ${b.boosters} ${b.boosters === 1 ? "wallet" : "wallets"} · ${clicks} ${clicks === 1 ? "click" : "clicks"} from this lane, in the last 24 hours`}
                   onClick={() => {
                     setPendingToken({ chain: l.chain, token: l.token, name: l.name, symbol: l.symbol, image: l.image_url });
                     sendSeen({ kind: "click", token: l.token }, source);
@@ -201,11 +203,11 @@ export default function BoostedLane({ initial, serverNow, source }: { initial: B
                   ) : null}
                 </span>
                 {/* clicks from this lane in the last 24 hours; nothing until the first, so a fresh boost never reads "0" */}
-                {b.clicks > 0 ? (
+                {clicks > 0 ? (
                   <span className="inline-flex shrink-0 items-center gap-1 justify-self-end font-mono text-[11px] text-body tnum [grid-area:clicks]">
                     <MousePointerClick size={11} aria-hidden="true" className="shrink-0 text-muted" />
-                    <LiveNumber value={b.clicks} format={CLICKS_FORMAT} />
-                    <span className="sr-only">{b.clicks === 1 ? " click" : " clicks"} in the last 24 hours</span>
+                    <LiveNumber value={clicks} format={CLICKS_FORMAT} />
+                    <span className="sr-only">{clicks === 1 ? " click" : " clicks"} in the last 24 hours</span>
                   </span>
                 ) : null}
                 <span className="shrink-0 justify-self-end text-[11px] text-muted [grid-area:left]" suppressHydrationWarning>{left}</span>

app/src/components/launchpad/boost-ui.test.ts

@@ -242,7 +242,10 @@ test("a click counts only while the token is in the lane, at the server's place,
   assert.equal((server.match(/boostTimeLeft\(/g) ?? []).length, 1, "one expiry filter on the server");
   // no address, wallet or raw presence hash is stored: the visitor is the daily hash mixed with the token
   assert.match(server, /createHash\("sha256"\)\.update\(`\$\{visitorHash\}\|\$\{token\}`\)\.digest\("hex"\)\.slice\(0, 32\)/);
-  assert.match(seenRoute, /await recordBoostSeen\(seen, visitorHash\(ip, ua\), await ethUsd\(\)\);/);
+  // the address alone: no user agent (the caller's to choose) goes into a click's visitor, and the bucket is the same key
+  assert.match(seenRoute, /const ip = boostClickAddress\(clientIp\(req\)\);/);
+  assert.match(seenRoute, /await recordBoostSeen\(seen, visitorHash\(ip, ""\), await ethUsd\(\)\);/);
+  assert.doesNotMatch(seenRoute, /visitorHash\(ip, ua\)/);
   assert.match(seenRoute, /return new NextResponse\(null, \{ status: 204 \}\);\n\}/);
 });
 
@@ -255,7 +258,10 @@ test("views and clicks are read in boostServer.ts alone; the full table only for
 });
 
 test("each card shows its clicks of the last 24 hours, never a 0, and a failed read never fails the lane", () => {
-  assert.match(lane, /\{b\.clicks > 0 \? \(\n\s*<span className="[^"]*\[grid-area:clicks\]">\n\s*<MousePointerClick size=\{11\} aria-hidden="true"[^>]*\/>\n\s*<LiveNumber value=\{b\.clicks\} format=\{CLICKS_FORMAT\} \/>\n\s*<span className="sr-only">\{b\.clicks === 1 \? " click" : " clicks"\} in the last 24 hours<\/span>/);
+  assert.match(lane, /\{clicks > 0 \? \(\n\s*<span className="[^"]*\[grid-area:clicks\]">\n\s*<MousePointerClick size=\{11\} aria-hidden="true"[^>]*\/>\n\s*<LiveNumber value=\{clicks\} format=\{CLICKS_FORMAT\} \/>\n\s*<span className="sr-only">\{clicks === 1 \? " click" : " clicks"\} in the last 24 hours<\/span>/);
+  // a poll from a machine still on the older build (mid-deploy) has no clicks: none shown, never "undefined"
+  assert.match(lane, /const clicks = b\.clicks \?\? 0;/);
+  assert.doesNotMatch(lane.replace("b.clicks ?? 0", ""), /b\.clicks/);
   // the count is the lane's own window, read with the lane; a read that fails is no counts, not no lane
   const body = server.slice(server.indexOf("async function laneClicks("), server.indexOf("export async function getBoostLane("));
   assert.match(body, /AND clicked_at > now\(\) - make_interval\(hours => \$\{BOOST_WINDOW_H\}\)/);

app/src/lib/launchpad/boost.test.ts

@@ -35,6 +35,7 @@ import {
   BOOST_CLICKS_KEEP_DAYS,
   BOOST_SOURCES,
   boostBeaconSameOrigin,
+  boostClickAddress,
   boostViewHour,
   BOOST_STATS_DAYS,
   boostClickRate,
@@ -313,3 +314,23 @@ test("only the site's own pages may send the beacon: another site's visitors can
   // neither header: not a browser page (a script could forge both); the per-IP limit holds it
   assert.equal(boostBeaconSameOrigin(null, null, HOST), true);
 });
+
+test("a click is counted per address, an IPv6 one by its /64: a new user agent or a new address in one's own block adds nothing", () => {
+  assert.equal(boostClickAddress("203.0.113.7"), "203.0.113.7");
+  assert.equal(boostClickAddress(" 203.0.113.7 "), "203.0.113.7");
+  // one /64, however it is written or whichever host in it
+  const block = "2001:db8:abcd:12::/64";
+  for (const ip of ["2001:db8:abcd:12::1", "2001:0db8:abcd:0012:ffff:1:2:3", "2001:DB8:ABCD:12:0:0:0:9", "[2001:db8:abcd:12::77]", "2001:db8:abcd:12::1%eth0"]) {
+    assert.equal(boostClickAddress(ip), block, ip);
+  }
+  assert.notEqual(boostClickAddress("2001:db8:abcd:13::1"), block, "the next /64 is another address");
+  // compressed zeros in the network half are expanded before the cut
+  assert.equal(boostClickAddress("2001:db8::1"), "2001:db8:0:0::/64");
+  assert.equal(boostClickAddress("::1"), "0:0:0:0::/64");
+  // an IPv4 client seen through IPv6 is its IPv4 address
+  assert.equal(boostClickAddress("::ffff:203.0.113.7"), "203.0.113.7");
+  assert.equal(boostClickAddress("0:0:0:0:0:ffff:203.0.113.7"), "203.0.113.7");
+  // anything else is its own key, never a crash
+  assert.equal(boostClickAddress("1::2::3"), "1::2::3");
+  assert.equal(boostClickAddress("0.0.0.0"), "0.0.0.0");
+});

app/src/lib/launchpad/boost.ts

@@ -234,6 +234,25 @@ export function boostClickSlot(nowMs: number): string {
   return new Date(Math.floor(nowMs / BOOST_CLICK_SLOT_MS) * BOOST_CLICK_SLOT_MS).toISOString();
 }
 
+/**
+ * What a click is counted once per 30 minutes for: the client's address alone, never its user agent (which the caller
+ * picks, so one address could otherwise pass for a new visitor on every request). An IPv6 address is cut to its /64,
+ * the block one home or phone is given; an IPv4-mapped IPv6 address is its IPv4 address. People behind one shared
+ * address (an office, a mobile carrier) count once per 30 minutes: the public count leans low rather than high.
+ */
+export function boostClickAddress(ip: string): string {
+  const a = ip.trim().toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
+  if (!a.includes(":")) return a;
+  const mapped = /^(?:(?:0{1,4}:){5}|::)ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(a);
+  if (mapped) return mapped[1];
+  const parts = a.split("::");
+  if (parts.length > 2) return a; // not an address; whatever it is, it is its own key
+  const head = parts[0] ? parts[0].split(":") : [];
+  const tail = parts.length === 2 && parts[1] ? parts[1].split(":") : [];
+  const groups = parts.length === 2 ? [...head, ...Array<string>(Math.max(0, 8 - head.length - tail.length)).fill("0"), ...tail] : head;
+  return `${groups.slice(0, 4).map((g) => (parseInt(g, 16) || 0).toString(16)).join(":")}::/64`;
+}
+
 /** The hour a view is counted in (UTC). */
 export function boostViewHour(nowMs: number): string {
   return new Date(Math.floor(nowMs / 3_600_000) * 3_600_000).toISOString();

app/src/lib/launchpad/boostServer.ts

@@ -36,8 +36,11 @@ export { boostEnabled };
  * page shows the lane, the token page line or the dialog. The indexer records boosts either way: they are TWIG burns
  * on-chain whatever the switch says, and turning it on then shows the last 24 hours as they were.
  */
-/** `clicks`: the card's clicks from the lane in the last 24 hours (bb_boost_clicks), the window its TWIG is counted in. */
-export type BoostLaneItem = LaneTotals & { expires_at: string; launch: LaunchRow; clicks: number };
+/**
+ * `clicks`: the card's clicks from the lane in the last 24 hours (bb_boost_clicks), the window its TWIG is counted in.
+ * Optional for readers: a machine still on the older build answers polls without it while a deploy rolls.
+ */
+export type BoostLaneItem = LaneTotals & { expires_at: string; launch: LaunchRow; clicks?: number };
 export type BoostLane = { enabled: false } | { enabled: true; window_h: number; floor_twig: string; items: BoostLaneItem[] };
 export type TokenBoost =
   | { enabled: false }
@@ -235,7 +238,10 @@ async function flushViews(): Promise<void> {
   }
 }
 
-/** A click's visitor: the presence hash (daily salt) mixed with the token, cut short, so two tokens' clicks never link. */
+/**
+ * A click's visitor: the hash of the address with the daily salt (the route passes visitorHash(address, ""), no user
+ * agent), mixed with the token and cut short, so two tokens' clicks never link.
+ */
 function clickVisitor(visitorHash: string, token: string): string {
   return createHash("sha256").update(`${visitorHash}|${token}`).digest("hex").slice(0, 32);
 }

docs/boost.md

@@ -42,15 +42,16 @@ The whole card opens the token (the name link's `::after` covers it; only "Lates
 The lane counts how often it is seen and how often its cards are opened, to tell whether a place in it brings visitors. **Each card shows its clicks** of the last 24 hours (the window its TWIG is counted in) with a pointer icon, once it has one: nothing at 0, so a fresh boost never reads "0", and the number rolls up when a poll brings more. /admin has every figure (a "Views and clicks" table under the Boosted lane, 24 h / 7 d / 30 d). Nothing in the ranking reads them (`boost-ui.test.ts`). Views are not on the cards: one page load is a view for every card in the lane, so they would read nearly the same on all five.
 
 - **A view** is a page load that brought the lane, with cards in it, a third on screen: one beacon per page, and the server adds 1 to this hour of every token in the lane then (`bb_boost_views`). Views are tallied in memory and written once every 10 seconds per machine, so a busy page never queues writes on the same few rows; a restart loses at most those seconds.
-- **A click** is a card opened by a click, a Cmd/Ctrl-click or a middle click. It counts **only while the token is in the lane**: the server checks the token against the same few-second lane the pages read, takes its place from there (never from the request), and a tab left open after the boost ran out counts nothing. One click per visitor, token and 30-minute slot, so a reload or a double click counts once (`bb_boost_clicks`).
+- **A click** is a card opened by a click, a Cmd/Ctrl-click or a middle click. It counts **only while the token is in the lane**: the server checks the token against the same few-second lane the pages read, takes its place from there (never from the request), and a tab left open after the boost ran out counts nothing. **One click per address, token and 30-minute slot** (an IPv6 address by its /64, `boostClickAddress`), so a reload, a double click or a script that changes its user agent counts once. People behind one shared address (an office, a mobile carrier) count once per 30 minutes: the public count leans low rather than high (`bb_boost_clicks`).
 - The beacon is `POST /api/boost/seen` (`navigator.sendBeacon`, so it never holds up the navigation). **Only the site's own pages may send it:** a request whose `Sec-Fetch-Site` is not `same-origin` (or, without that header, whose `Origin` is another host) gets a 403, so another site cannot raise a card's count from its own visitors' browsers. Bots are skipped, each IP has 60 a minute, the body is capped at 512 bytes, and the answer is a 204 otherwise.
 - Click rows are kept 90 days (each names a visitor of one day; /admin reads 30 at most) and pruned hourly. View rows are plain hourly counts and stay.
-- **Nothing names a person.** The visitor is the presence hash (sha256 of IP, user agent and a daily salt, see `presence.ts`) mixed with the token and cut short: it changes every UTC day and cannot link one person's clicks on two tokens. No IP, user agent or wallet is stored. "Visitors" in the table is one per person per day.
+- **Nothing names a person.** The visitor is a hash of the address (an IPv6 one by its /64) with the daily presence salt (`presence.ts`), no user agent, mixed with the token and cut short: it changes every UTC day and cannot link one address's clicks on two tokens. No IP, user agent or wallet is stored. "Visitors" in the table is one per address per day.
 - **Set `PRESENCE_SALT`** (any long random string, `fly secrets set PRESENCE_SALT=$(openssl rand -hex 32)`) so every machine salts the same way. Without it each machine draws its own salt at start, so a repeat click that lands on the other machine counts again, and a restart starts new visitors (the site's visit counter has the same gap).
-- The lane's own read (`GET /api/boost`, the live poll) carries each card's `clicks`; a failed click read shows no counts and never fails the lane.
+- The per-address limit (60 a minute) is kept per machine, and the address is the same /64 key, so changing addresses inside one's own IPv6 block buys no fresh bucket.
+- The lane's own read (`GET /api/boost`, the live poll) carries each card's `clicks`; a failed click read shows no counts and never fails the lane. While a deploy rolls, a poll from a machine on the older build has no `clicks`, and the cards simply show none.
 - `GET /api/boost/stats?wallet=<admin>&days=1|7|30` serves the table: per token, views, clicks, visitors, the click rate, and the TWIG burned for it in the period with the clicks per 100K TWIG. Views, clicks and burns start at the same whole hour. The top 100 tokens are listed and the totals cover all of them; visitors have no total, since a visitor is counted per token.
 
-A script with rotating user agents behind many IPs can still add clicks; the count is a guide, not a payout, and nothing is paid or ranked on it.
+Only many addresses can add many clicks: one address adds at most one per card every 30 minutes. The count is a guide, not a payout, and nothing is paid or ranked on it.
 
 ## The dialog