1. What we're building

Globie Earth: Guardians of the Forest is an Android app where you adopt a real tree in the Isaan Valley of Northeast Thailand, grow a digital guardian that mirrors it, and watch a forest come alive as deeds turn into planted saplings. The partner is a real NGO (OpenmindProjects), and the trees are real trees in real ground.

The whole thing runs on one rule, and the rule is not a marketing slogan. It is a filter that has already cost us eleven features.

2. The rule

If it isn't derivable from something the device, the register, or a recording actually did — it doesn't get a number, and it doesn't get a label.

That's it. No live feed we don't have. No sensor we don't own. No percentage we can't compute. No physiology we can't read.

Sounds obvious. It's brutal in practice, because the person it argues with most is the person who drew the mockup.

3. The deletion log

We drew the original mindfulness dashboard as a mockup. Mockups are allowed to be aspirational — they sketch the product you wish you had. Then we sat down to build it, and found that the mockup had quietly promised things that don't exist. Here is the log, unedited.

11 promises went through the rule: 7 deleted outright, 3 re-scoped or relabelled, 1 kept because it turned out to be derivable. Zero invented numbers left on any screen.

The mockup. Every card on it says something we could not back.

The dashboard that shipped. Fewer cards. Every word on every one of them is checkable.

"432 Hz Solfeggio Tone · Generated on this device · Web Audio" — and it is. You can hear it being generated.

4. Four things the build log caught us doing wrong

The rule isn't only for the mockup. Here are four real bugs from the public build log.

4.1 The font that printed its own name

Every "Read more" toggle rendered a large serif EXPAND_MORE next to its label, in the middle of our clean UI. The React component was correct. The font was not.

We ship a hand-subsetted Material Symbols woff2 containing only the ~169 glyphs the app actually names. expand_more was never in the subset, and the bundled font declares no fallback family — so the browser printed the ligature name in its default serif face instead of failing silently.

Measured before the fix:

forest       →  24 px   (one glyph)
volume_up    →  24 px   (one glyph)
chevron_left →  24 px   (one glyph)
expand_more  → 264 px   (11 characters of text)

The fix was not to re-subset the font. It was to use a glyph we already ship — chevron_left, rotated -90deg when collapsed and 90deg when open, with aria-hidden on the glyph because the visible Read more / Show less label already names the control.

Then we swept all six bottom-nav tabs for the same bug: every rendered icon checked as width / fontSize, and every icon name in the app probed by injection. ExpandableText was the only casualty — and then it wasn't. The Deeds vault was built afterwards and reintroduced expand_less on its detail toggle; the same sweep caught it again and the same swap fixed it. A subsetted icon font is not a rule you remember once, it is a rule you re-run.

Two gotchas worth stealing: a subsetted icon font with no fallback fails loudly as text rather than silently as a blank box — that's the good failure mode, keep it. And Tailwind v4's rotate-* utilities write the standalone rotate property, so getComputedStyle(el).transform reads none even when the rotation is applied — read .rotate instead.

4.2 The subscription that granted nothing, silently

RevenueCat has a failure mode that does not throw.

purchasePackage does not error for a package that exists but carries no entitlement. So: we had guardian_premium attached to guardian_unlock, while the product the app actually sells and requests is forestkeeper_monthly:monthly.

Result — a user pays, the purchase succeeds, the SDK reports success, and the app unlocks nothing. No exception. No red text. A happy path that gives the customer nothing.

Moved guardian_premium onto forestkeeper_monthly:monthly, and set the four dead one-time products to inactive rather than deleting them (a Play product id is permanent and never reusable; a one-time product is only deletable if never purchased).

The lesson we wrote into the project memory:

When you wire an entitlement, assert on the entitlement — never on the absence of an error.

4.3 The Thai names an English voice could not say

The two guides are Khae Na (Thai แค-นา) and Yaang Na (Thai ยางนา). They are the emotional core of the app and their names matter.

Hume's Voice Library has no Thai voice. Available languages are English, Japanese, Spanish, Hindi, Arabic, German, French, Italian, Korean, Portuguese and Russian. None of them is Thai.

So the pronunciation rule is explicit and written down:

• Thai script is used only for the two proper nouns. All surrounding narration stays English — do not switch whole lines to Thai.
• Mother: write แค-นา in the script; the English spelling is Khae Na.
• Father: write ยางนา in the script; the English spelling is Yaang Na.
• Verify the embedded names render correctly on every model version used, because English-tagged voices may skip or garble Thai glyphs — and fall back to the English spelling if a segment mispronounces.

We did not promise Thai audio. We promised two correct names.

The written line is displayed during playback, the tone says what it is and where it came from, and playback starts only from a user action — never on its own.

4.4 The mockup re-introduced all three fakes into the dashboard we were about to ship

This is the one that stings.

We had already written the honesty standard — no faked sensors, no faked brainwave entrainment, no invented figures. And then the new dashboard mockup walked all three straight back in: a "live" chime stream, hydrophone and sap sensors we don't own, and a delta-wave readout that implies an EEG we don't have.

The rule found it. Not a code review — the rule. Because the question is the same for a mockup as it is for a feature:

Can this be derived from something the device, the register, or a recording actually did?

Nobody could answer yes for any of them. That's §3 above — the deletion log is the fix.

The rule applied to our own work, and we changed our own dashboard. That is the whole point.

5. Numbers we refuse to invent

A short sample of what "no invented numbers" cost us, in code:

• "42 Min This Week" → all-time total. One cumulative counter, no per-day buckets. We show the number the store can actually produce, and caption it as all-time.
• "14 kg Forest Bond" stays — because it is the CO₂ already summed from real deeds, not a number we typed.
• "Binaural 0.5–4 Hz" becomes nothing. One sine plus its own octave is not two ears.
• The tone channel's slider had to be earned. The library card reads "fixed level" and means it — the tone plays there alone, at one gain, with nothing to balance it against. The two screens that actually mix it, the mindfulness mixer and the Sound Studio's session, each carry a working slider that says which is which. A slider you can move is a control; a slider that moves nothing is a label pretending to be one.
• "Live Sensors" and "Basin Live Telemetry" become "Regional Data" and "Regional baseline." The one thing in this app that genuinely is live is the weather — and it says so by name: "Open-Meteo", with the sanctuary coordinates, on every screen that uses it. The four crisis tiles under those two labels were neither live nor sensors; they are published regional statistics. A label that borrows the credibility of the live feed for numbers that aren't in it is the same failure as an invented figure — and two of those tiles carried progress bars at 68% and 82%. A bar asserts a scale, and there was no scale. We deleted the bars rather than invent the scale to justify them.

The last bullet is not from the deletion log. It came from writing this post: publishing the store listing — "Every figure in the app is cited — nothing invented" — made us re-read every screen against that sentence, and two labels and four bars did not survive it. Writing in public caught something our own review had missed, which is the entire argument for writing in public.

6. What the rule let through

Subtracting is the easy half. The hard half is being specific enough to let real work through — a rule that only ever says no stops being a build tool and becomes a slogan.

Two features cleared it in the same release, on exactly the same terms.

Focus mode is one timed session, not a screen of settings. Pick 15, 30 or 60 minutes — or leave it open-ended — and the app takes the screen: a full-screen breath pacer, a soundtrack bed, a nature layer and a carrier tone, all at levels the mixer underneath already has. Every level it sets is a whole step of that mixer's own 5% sliders, so the summary line and the slider you open afterwards can never read as two different numbers. A finished session adds to the same listening counter every other screen shares, and to nothing else — there is no "sessions completed" total, because the device never produced one.

The Sound Studio is the opposite instinct, and it is the better argument for the rule as a tool rather than a brake. You describe a track in words, pick up to three styles from the app's own palette, and a cloud render comes back into your own library — where it then appears inside focus mode as a bed, in the same row as the built-in ones.

What makes it publishable is the machinery, not the model:

• The render runs on a separate service (studio.globie.earth), reached with the same device id every other write in the app uses. There is no provider key in the client.
• The job row lives in api.studio_tracks. The mp3 never does — the audio goes to a volume, and the row keeps a filename, a length and a sha256.
• The quota is 5 renders per device per day, counted from the rows themselves and read from the environment rather than compiled in, so the number can move without a release.
• Nothing else in the app depends on it. With the Studio unreachable, every other screen behaves exactly as before and the "Your tracks" row is simply not drawn.

That last point is the whole test. A generated track is not a number we invented — it is a recording we can point at, with a receipt. Same question as §3, and the Studio answers it.

Focus mode's opening mix — three engines, at levels the mixer already has, rather than a preset name.

Describe it, choose styles, get a track. What lands in the library feeds the same mixer focus mode runs on.

7. What sharing this in public actually changed

Public feedback has not changed this app yet — and we are not going to pretend it has. Every bug in §3, §4 and §6 was found by us, going down our own build log. When a reply changes something, it gets written here with a link to the post that caused it. If that never happens, this section will still say so on submission day.

But building in public did change the app, in two ways that have nothing to do with replies:

It carried the mission further than the store listing can. Globie Earth is not a tool with a growth loop bolted on. It is an argument about old-growth cover in the Isaan Valley and the smallholder families who carry the cost of losing it. A store listing has room to say what the app does; it has no room to say why it should exist — why every purchase ends in real ground, why we deleted eleven features rather than describe them dishonestly, why a 432 Hz tone is labelled as a tone. Six days of dated posts under #Shipaton #BuildInPublic put that argument into feeds where it could be read, argued with, and passed on, in front of people who were never going to search for a reforestation app. That is awareness of the problem we could not have bought, and it is the clearest thing building in public gave us. What we will not do is dress it up as growth: we are not going to quote a reach number we cannot tie to a source.

It made our own media become true. Writing the deletion log in public meant every line of it had to survive a reader asking "prove it" — and the cheapest way to keep a published log honest is to keep deleting. Then, when we relabelled the mindfulness dashboard, we found that our own screenshots and both demo GIFs still showed the wording we had just removed. They were the build-in-public media, not private notes. So we re-captured all of them, animations included, so that what we show and what we ship are the same thing. A build-in-public post that shows a screenshot of a claim you just deleted is a slower way of lying. That re-capture would not have happened on a private build log, and it is the most concrete thing this has done to the app so far.

The two posts that drew the most replies were the two failure write-ups — the entitlement that granted nothing, and the icon font that printed its own name. We answered every reply.

If you want to change a line in this app: the comments are open, and the deletion log above is the list of things we already gave up. Tell us what's next.

8. Try it

• Android / Google Play — live now: Globie Earth on Google Play (com.globie.earth). First public release in the Shipaton window; the Journey tab is free to explore.
• RevenueCat: the SDK powers forestkeeper_monthly (the guardian_premium entitlement) plus three consumable tree products (Mother Tree $5, Father Tree $15, Sacred Pair $20).
• Judge access: a one-time-use Play promo code on the live subscription (forestkeeper_monthly) grants a 30-day free trial; redeem it at play.google.com/redeem.