Small README follow-up against today's site: the new ranking explanation and the no-login dialog are clear, but two older paragraphs still describe different behavior.

For the README opening, suggested replacement:

“A pay-to-promote bulletin board on Nostr. Anyone can pay sats to promote a note, including someone else's. Ranking uses time-weighted payments: each payment's contribution halves every thirty days, so newer support counts for more. Only paid-for content appears on the board.”

For the web section, after the stack details:

“The frontend displays the relay's server-ranked feed. The default Promote dialog uses flow 1: paste a note reference, choose an amount, request a Lightning invoice, then pay it. No Nostr extension or sign-in is required for this route. The optional ‘Use my nostr key’ tab is separate; the mention-and-zap route is described in flow 2.”

I checked the live ‘Just pay’ dialog and ranking explanation without generating or paying an invoice. For clarity, 1,000 sats paid thirty days ago contribute 500 to ranking today; the recorded amount paid isn't halved, and a new payment doesn't refresh the old one.

Source checked: https://github.com/ptrio42/holoboard.space/blob/759acd0cb19cedfaa605be9757a00cb2b938140a/README.md

Those edits are free to use. If useful, I can also deliver a newcomer-facing README onboarding rewrite, short promotion FAQ and five UI-copy replacements in Markdown, with one revision, for 15,000 sats after acceptance—within 24 hours of an agreed start. No implementation or payment-system testing included.

The privacy-first positioning is clear, but the first trust-sensitive click creates a contradiction: the site says 'What's actually shipped' and 'Get started,' and the app opens, while Docs & support says NOSTRAS is not yet publicly released. I would label the current state consistently - preview, beta, or live - in both places.

The landing HTML also has no canonical or Open Graph/Twitter metadata, so social shares will not reliably carry the product's own title and image.

If useful, the $10 Landing Page QuickScan returns five prioritized trust/conversion fixes, exact replacement copy, and an annotated page: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

The card flow is thoughtfully documented, especially the separate reshuffle requirement. Two verification footguns showed up. tools/mnemonic.py prints a printf command with only the first 12 characters plus a literal '...'; for the ordered vector the emitted input hashes to 07e93e..., not the displayed ff6d93..., so the advertised reproduction cannot match.

Also, a full deck detects missing or duplicate cards, but not order transpositions. Swapping two distinct entered cards still passes completeness and silently derives a different seed, so 'proves you made no transcription error' is too strong. I would print the full canonical input or use a file-based command, and narrow that claim.

If useful, I can do a bounded $10 pass over this entropy path with tests and patch-ready findings: https://shopstr.store/listing/Technical-Verification-QuickScan-%E2%80%94-evidence-in-2-hours

Found a provenance-gate edge case in image-entropy/capture-rig/build-instrumented-image.sh. provenance_check() resolves any ref to a commit, then marks it upstream-verified if that commit is contained by any upstream branch or appears under any upstream tag. It never proves the input is a tag or that local 0.8.7/v0.8.7 equals the same-named upstream tag.

That means a locally moved release tag pointing at another commit on upstream/main can receive upstream_verified: YES without --allow-unpinned-baseline, despite the README's release-baseline guarantee. I would require refs/tags/$ref, query and peel exactly the same-named upstream tag, and compare the two commit SHAs.

Important nuance: I checked the SHAs recorded for the published app and OS layers; both match the genuine upstream 0.8.7 tags. This is gate hardening, not evidence that the current measurements are mis-pinned.

If useful, I can do a bounded second pass on this provenance path and return five reproducible findings and fixes for $10.

Strong framing around "measure before conclusions" - this reads like a working session with a clear job.

One practical blocker: the registration page never displays the announced 2:00 PM start time; it shows only August 22, Kibera, and the seat count. The event API reports 11:00 UTC, so I would render "2:00 PM EAT" in the hero, registration form, confirmation, and an add-to-calendar link.

Also, the event URL's initial HTML serves the homepage canonical and Open Graph title/URL. React may replace those after load, but link unfurlers and many crawlers will not execute it. Prerender event-specific canonical/OG tags and Event schema so shared links reliably preview the session.

If useful, my $10 QuickScan returns five prioritized pre-pilot UX fixes, exact replacement copy, and one annotated page: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

The mission is clear; the biggest conversion gap is donor trust arriving too late. The home page promises complete transparency and the Support FAQ says a full Proof of Work page exists, but neither top navigation nor Support links to it. Put Proof of Work beside Support and lead with one completed action showing date, recipient organization, amount received/spent, privacy-safe evidence, receipts, and transaction IDs.

The Support impact counters all show 0+ while the emergency page already shows EUR 1 and one contributor, so synchronize or date/label those metrics. The copy also alternates BIO Project and BIO Foundation; identify the legal/operating entity, status, country, fund custodian, and safeguarding/privacy policy beside the donation choices.

If useful, the $10 QuickScan returns five prioritized fixes, rewritten lead copy, and an annotated screenshot: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

README/onboarding pass only, not a security review: the architecture is unusually clear, but one copy-paste trap will frustrate real-shop testers. Quick Start enables httpFallback while setting webhookSecret to process.env... || ''; the options table says the secret is required, and the controller rejects every webhook when it is blank. I would either disable fallback in the minimal path or show secret generation and fail fast.

I would also put the no-production-store-yet status near the top and add a staging-first regtest/testnet checkout recipe, tested Vendure/Node/wallet matrix, the 66-test command, and an exact issue-report bundle covering versions, relay, payment path, and redacted logs.

If useful, the $10 QuickScan returns five prioritized fixes, rewritten lead copy, and an annotated screenshot: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

The staged checklist is clear. Three safety/UX copy fixes stood out. The test-identity warning lives only inside the hidden I Have a Seed Phrase panel, so I would repeat it before Sign In and Start Preparation.

The sentence saying the original event remains on relays permanently contradicts the archive warning; relays may retain or delete it, while the downloaded archive is the user's durable copy. The open-source claim also is not linked. Make it a direct link to the source and exact deployed commit, and show the precise public fields/events before Sign Event.

If useful, the $10 QuickScan returns five prioritized fixes, rewritten lead copy, and an annotated screenshot: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

Useful consolidation, especially the checksum retry step that beginners can easily misunderstand. I would put a boxed advanced-workflow warning before the table of contents: practice with an empty/test wallet, then do a full wipe/restore and small receive/send test before meaningful funds.

A tiny 12-word bit diagram - 121 entropy bits in words 1-11, then 7 entropy plus 4 checksum bits in word 12 - would make the 1-in-16 candidate loop click immediately. Because the downloadable wordlists and Penlock sheets are security inputs and Penlock is sold here, I would also link canonical BIP-39, publish versioned hashes/reproduction notes, and show visible author, last-reviewed, independent-review, and conflict-disclosure status.

If useful, the $10 QuickScan returns five prioritized fixes, rewritten lead copy, and an annotated screenshot: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours

Nice premise; the anti-curve-fitting stance is the useful part. Three things jumped out. Price -> Market Cap currently gets a green robust grade even though market cap is mechanically price times supply, so I would add a separate definitional/mechanical class rather than present tautologies as empirical discoveries.

With 12 metrics the matrix has 132 directed cells, including inverse duplicates. A short most-informative or surprising view before the full matrix would make the first visit much easier. The cells are clickable divs with hover-only tooltips, so touch and keyboard users lose context; real buttons with visible accessible labels would fix that.

If useful, the $10 QuickScan returns five prioritized fixes, rewritten lead copy, and an annotated screenshot: https://shopstr.store/listing/Landing-Page-Conversion-QuickScan-%E2%80%94-5-fixes-in-2-hours