web: bake each community header once, .zip installs for any public deck or pattern, wall search

[engmung]

What

• Baked once. A published firmware header is compiled once per toolchain revision and kept in module_cache (migration 0024, additive) beside the code. Installs and downloads are assembled from it in the web process — no queue, no compiler. The worker bakes on every header write, warms idle headers (5 a minute), caps bakes per owner (4), and caches a compile error only with positive evidence that the code is at fault, after a canary compile.
• .zip for anyone. New GET /api/community/patterns/[id]/zip (public, no sign-in, no catalog.txt). The deck zip is assembled per request from each slot's effective header (ports included), skips a bad slot instead of failing the whole pack, and renames colliding file names. Deck and pattern pages show Download .zip with install-from-a-file steps for people on a VPN; Send to my Patternflow needs no sign-in for a public pattern.
• Finding old patterns. The wall and the Marquee picker search titles and @authors and gain an Oldest sort; the picker loads past the newest 60; the Liked tab loads past its first batch; a missing size on GET /api/community/patterns means 12, not 1.
• Decks. /community/decks lists everyone else's decks before your own, with no cap at 60.
• The pattern page drops Reset code.

Needs the owner

• /terms §4 and §9 wording (legal text) — compiled modules of a published header are kept while it is on the site and deleted within 30 days after it is removed or replaced; other build artifacts stay 30 days. Please read before merging.
• UI copy on the deck/pattern pages (the file steps, the VPN line).

Tested

• npm run check:ci (all suites incl. new check:modcache, vitest 84 tests), npm run typecheck, eslint (outside the gitignored web/.tmp/), next build with the community off.
• Real Xtensa toolchain locally: scripts/module-build-smoke.ts, scripts/module-cache-e2e.ts (first bake ~0.7 s, served from cache ~10 ms, second bake 0 processes).
• Migration 0024 applied to a fresh DB and to a copy of the local dev DB; full backfill on that copy (43 compiled, 3 cached compile errors, 0 infra).
• Browser, local dev server + worker: wall search and Oldest, decks order, deck Download .zip (3 modules + catalog.txt in deck order, sidecars carry author/licence/url), pattern Download .zip (no catalog.txt), Send window signed out.

Deploy on the Pi

Pull, npm ci, npm run build, restart both patternflow-community and patternflow-worker. Migration 0024 applies on first DB open; the first idle worker publishes the toolchain revision and warms published headers, until then a first download answers 202 and bakes on demand. One worker per checkout (docs/SERVICES.md).

Not in this PR

• The header text check (includes / inline asm) is a filter, not a boundary — spelling tricks get past it. The Pi's bwrap compiler sandbox is what bounds a header; docs/SERVICES.md says so and says to keep secrets out of the bound firmware paths.
• Device console changes (a better message when a ?src= fetch fails) would need a firmware release.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pattern-flow_origin	Ignored		Sep 24, 2026 3:11am UTC