Geocaching.

Geocaching is a real treasure hunt: I hide an object in a specific spot, publish it on a map and whoever reaches it claims it. I wanted it to live inside my site, like The Wolf and The Impostor, not in a separate app.

The map was the easy part; the real starting point was that the game be played with your phone out in the street and that claiming a drop mean something: that your name shows up and counts toward a ranking.

A physical-world game has a dangerous technical temptation: verify proximity by GPS, require accounts, build anti-fraud. All of that is the perfect excuse to never ship.

The real challenge was integrity with the least friction: making it impossible to claim a drop from the couch, and having "the same person" count as one in the ranking without forcing anyone to sign up.

I reused the maps module I'd already built for the analytics (MapLibre over tiles with no API key) instead of pulling in a new library. The same component serves both the player's public map and the coordinate picker in the admin panel.

From the admin I publish a drop with its location, a photo and when it activates (now, scheduled or draft). The player's map shows each drop with its status (unclaimed or "Claimed by …") and, on tap, a card with the photo and who has it. The link to claim never appears on the map.

The secret lives in the physical spot: inside the object there's a QR with a unique token. Without being there you can't claim it, so there's no need to verify GPS. The token is secret and never travels to the public client; the map shows the approximate location, not the link.

One winner per drop, the first. The claim is a single atomic operation in the database (find-and-update with "still ownerless" in the filter), so two people claiming at once can't both win.

No accounts: honor system. You put your name and that's it. For the ranking I normalize the name (no accents or capitals) so that "José" and "jose" count as the same person. Photos on Vercel Blob and data in the same database as the analytics and the login.

A game you can play from start to finish on your phone: you open the map, see which drops are still free, go for one, scan its code and land on the ranking. Nothing to install.

The game is brand content, not an add-on: it lives at /laboratorio like the others, with the same editorial aesthetic and the same quality gate (typecheck, lint, tokens, build and tests) before every change.

The integrity of a game like this is a data decision, not an interface one: "first wins" is guaranteed with an atomic operation and with the secret inside the filter, not with client-side validations.

Reusing the design system (the same maps module from the analytics) cut the work in half. GPS proximity verification and accounts stay as a possible v2; for v1, the physical secret and the honor system are enough for the game to work and be fun.