Feature 4
Scan trust-state UI
Mechanism-visible answers on every scan.
Live flat status panel + grouped trust blocks
About this feature
Why it matters
Trust products fail when limits are buried. Scan separates card status, human trust, QR credential scope, live control, and vouch issuance - plus one “what this does not prove” panel.
Design decisions
Flat status panel + iOS-style grouped lists; bearer warning on scan hero; revoked/suspended overrides hide positive verification badges. Machine-readable twin at GET …/cards/{id}/status matches HTML truth.
Safety · privacy · security
No scan analytics or passive scan alerts on the public page - resolver returns object state, not who scanned. Future interaction signals must stay coarse and log-free. Cache-Control: no-store on live scans.
Limits
Scan UI is server-rendered; artifact-specific layouts are minimal in v1. Holding a printed QR still does not prove ownership. Optional Plain language reader (L3 P1): opt-in on scans with public_snapshot via POST …/ai/explain-snapshot — summary is not signed resolver truth.
Future directions
Activity stream merge rules on scan, offline/stale banners, role-specific templates for maintainers vs game operators.