Dubloons are struck metal coins with a QR code on one face and a hosted media experience behind it. Scan one and it opens what that coin is for — a record, a short film, a photo set, a playlist, a browser game. The distinction that matters is that the experience lives on the platform. A coin that forwards to a third-party link is only as permanent as that link; a coin that opens something we host stays honest as long as the domain does.

The encoding decision the whole product rests on

The QR carries DUBLOON.UK/A7K in uppercase, and that is not a style choice. QR's alphanumeric mode covers digits, A–Z and a handful of symbols — no lowercase — and it is far denser than byte mode. Fourteen characters uppercase fit a version-1, 21×21 symbol at error correction Q; the identical string in lowercase forces byte mode, a version-2 25×25 symbol, and drops to correction level M. On a 28 mm coin panel that is 0.97 mm per module against 0.85 mm, with ten points more redundancy on top.

That margin is the difference between a coin that still scans after five years in a pocket and one that does not. Two independent mechanisms make an uppercase scan resolve to a lowercase slug — path normalisation before lookup, and a COLLATE NOCASE slug column — and a named test asserts both, because if either regresses every coin already in circulation stops working.

The coin exists on screen before it exists in metal

• A rendered digital twin. Every Dubloon draws as a spinning struck coin on a canvas — eight metal finishes, the name stamped into the reverse, the spin dwelling face-on, click to freeze it. The QR on the rendered coin is real and scannable off the screen.
• A decoder in CI. One command drives a headless browser over every coin in the fleet, decodes each rendered QR with jsQR, and asserts it equals the payload the server would serve. It is the only check that catches a coin that renders beautifully and cannot be read — the failure mode you otherwise discover after the dies are cut.
• Mockup QRs that must not scan. Design previews carry deliberately invalid codes, and that is tested too, so a mockup can never escape into production artwork.

Hosting media without becoming a warez locker

A platform that hosts other people's media is one upload away from being an infringement problem, and the hostname is cast into every coin — a rights complaint that takes the domain down would break coins already sold. So the media bucket is gated: the platform carries only content the operator owns or holds a release for, an admin queue moderates every asset, and the moderation layer fails closed — an asset that has not been cleared does not serve. Crews and roles decide who can push what.

How it's built

One Go binary and one SQLite file, rendering through html/template, with a vanilla JavaScript front end and the coin renderer on a raw canvas — no framework and no bundler. The experience layer adds experiences, assets, asset_variants and coin_runs to the schema, all through additive-only migrations, because a coin struck today has to resolve against every schema that comes after it. Deployment is a systemd unit behind Apache with Let's Encrypt on a single host.

An admin console covers the fleet: minting a coin, filling it with media, working the moderation queue, and choosing where a run gets struck. Coin art is generated through an image-model router with a hard budget cap wired into the studio, so an art session cannot silently run up a bill.