From 15a122017408978638bd586c644f9997c5ad0a6a Mon Sep 17 00:00:00 2001
From: tiXor-code <tiXor-code@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:29:57 +0300
Subject: [PATCH 1/2] docs: security-gate header, and the stale :3000 server
 e2e trap

The SEC-RULES header is the fleet-wide block every other repo's CLAUDE.md
carries; it was added locally when this repo was enrolled and never committed.

The Playwright note is from a real miss this session: a leftover `next start`
on :3000 made `reuseExistingServer` skip the build, so the suite ran against a
binary built from older source with a different NEXT_PUBLIC_ inlining. Two
tests "failed" against code that was already fixed.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 CLAUDE.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 5b03236..ac370b7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,3 +1,7 @@
+<!-- SEC-RULES v1 START -->
+**Security gate.** Every change made in this workspace must comply with the Secure Development Rules Reference: `~/aios/security/rules/secure-development-rules-reference.md` (index: `~/aios/security/rules/RULES-INDEX.md`). Before completing any task, check the work against those rules and flag every breach with its SEC ID and severity. CRITICAL breaches block completion -- fix or escalate before proceeding. For security-relevant changes (auth, secrets, input handling, dependencies, agent/MCP/hook/skill config), read the matching rule section first.
+<!-- SEC-RULES v1 END -->
+
 # termo-site
 
 [faraapacalda.ro](https://faraapacalda.ro) — Next 16 App Router, TypeScript strict,
@@ -17,6 +21,12 @@ npx playwright test             # needs .data/ populated AND a production build
 local bundle instead of the published release. That is the way to develop against a
 bundle the nightly has not published yet.
 
+**A server already on :3000 makes Playwright test stale code.** `reuseExistingServer` is
+on outside CI, so if anything is serving :3000 the webServer step is skipped and no
+rebuild happens — the suite silently runs against whatever was built last, including a
+different `NEXT_PUBLIC_*` inlining. A suite that finishes suspiciously fast (no build) is
+the tell. Free the port first: `kill $(lsof -ti:3000)`.
+
 ## Pure SSG is a constraint, not a preference
 
 Pages use `export const dynamic = 'error'` plus `generateStaticParams`. Data is read at

From 94b26d5ddf43787c7ac910ea746c2915a1b74518 Mon Sep 17 00:00:00 2001
From: tiXor-code <tiXor-code@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:30:13 +0300
Subject: [PATCH 2/2] poll: ask visitors on an answer page whether they want an
 app
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A centred dialog on /strada/ and /punct-termic/ pages asks "Te-ar interesa o
aplicație pentru faraapacalda.ro?", then Android or iOS. It holds the screen
until answered or closed, per the brief.

Deliberate choices worth reviewing:

- It fires 10s after load, not on arrival. A dialog that covers content the
  moment someone lands from search is what Google treats as an intrusive
  interstitial, and this site lives on organic search.
- Two steps, ONE row, upserted on a client-generated UUID nonce. Tapping "Da"
  writes immediately, so closing before picking a platform still counts as a
  "Da" instead of vanishing. Verified against the real table: insert 201,
  merge 200, one row with the platform merged in.
- A new fac_app_poll table rather than reusing fac_feedback, because
  GET /api/feedback counts every vote=eq.up with no page filter — poll answers
  landing there would inflate the public "N" badge on the live site. RLS on,
  zero policies, same as fac_feedback: only the service role reaches it.
- No GET route. Unlike the feedback tally there is nothing here to expose.
- The feedback pill hides while the dialog is open (one ask at a time), via a
  body data attribute rather than coupling the two components.
- The delay is overridable so the e2e build can push it out of reach; a spec
  that merely visits a street page can never race a screen-covering modal.

Kill switch: NEXT_PUBLIC_APP_POLL=0.

12 unit tests, 9 e2e. Escape is bound at document level, not on the backdrop —
a backdrop click moves focus to <body>, which silently killed Escape and left
the x as the only exit from a dialog that locks scroll. Found in visual
verification, pinned by a regression test.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 app/api/app-poll/route.ts   |  71 +++++++++++
 app/globals.css             |   4 +
 app/layout.tsx              |   2 +
 components/AppPollModal.tsx | 248 ++++++++++++++++++++++++++++++++++++
 e2e/app-poll.spec.ts        | 151 ++++++++++++++++++++++
 lib/app-poll.ts             |  61 +++++++++
 playwright.config.ts        |  10 +-
 test/app-poll.test.ts       |  99 ++++++++++++++
 8 files changed, 645 insertions(+), 1 deletion(-)
 create mode 100644 app/api/app-poll/route.ts
 create mode 100644 components/AppPollModal.tsx
 create mode 100644 e2e/app-poll.spec.ts
 create mode 100644 lib/app-poll.ts
 create mode 100644 test/app-poll.test.ts

diff --git a/app/api/app-poll/route.ts b/app/api/app-poll/route.ts
new file mode 100644
index 0000000..60bdfe2
--- /dev/null
+++ b/app/api/app-poll/route.ts
@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+
+import { validateAppPoll } from "@/lib/app-poll";
+
+// Anonymous "would you want an app?" poll. Same posture as /api/feedback: raw
+// IPs never touch storage, only a salted hash used for best-effort rate
+// limiting. No GET - unlike the feedback tally there is nothing here the site
+// should expose publicly.
+//
+// The poll is answered in two steps and both write the SAME row, upserted on
+// the client's nonce. That way someone who taps "Da" and closes the dialog
+// without picking a platform still counts as a "Da" rather than vanishing.
+const WINDOW_MS = 10 * 60 * 1000;
+const MAX_PER_WINDOW = 6; // two writes per answer, plus slack
+const recent = new Map<string, number[]>();
+
+function rateLimited(ipHash: string): boolean {
+  const now = Date.now();
+  const hits = (recent.get(ipHash) ?? []).filter((t) => now - t < WINDOW_MS);
+  if (hits.length >= MAX_PER_WINDOW) return true;
+  hits.push(now);
+  recent.set(ipHash, hits);
+  if (recent.size > 5000) recent.clear(); // crude memory bound
+  return false;
+}
+
+export async function POST(req: Request) {
+  const url = process.env.SUPABASE_URL;
+  const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const salt = process.env.FEEDBACK_IP_SALT;
+  if (!url || !key || !salt) {
+    return new Response(null, { status: 503 });
+  }
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return new Response(null, { status: 400 });
+  }
+  const result = validateAppPoll(body as Record<string, unknown>);
+  if (!result.ok) {
+    // Honeypot hits get a clean 204 so bots learn nothing.
+    return new Response(null, { status: result.reason === "honeypot" ? 204 : 400 });
+  }
+
+  const ip = (req.headers.get("x-forwarded-for") ?? "unknown").split(",")[0].trim();
+  const ipHash = createHash("sha256").update(salt + ip).digest("hex");
+  if (rateLimited(ipHash)) {
+    return new Response(null, { status: 429 });
+  }
+
+  // Upsert on the unique nonce: step 1 inserts the interest, step 2 merges the
+  // platform onto that same row.
+  const res = await fetch(`${url}/rest/v1/fac_app_poll?on_conflict=nonce`, {
+    method: "POST",
+    headers: {
+      apikey: key,
+      Authorization: `Bearer ${key}`,
+      "Content-Type": "application/json",
+      Prefer: "return=minimal,resolution=merge-duplicates",
+    },
+    body: JSON.stringify({
+      ...result.record,
+      updated_at: new Date().toISOString(),
+      ip_hash: ipHash,
+      ua: (req.headers.get("user-agent") ?? "").slice(0, 300),
+    }),
+  });
+  return new Response(null, { status: res.ok ? 204 : 502 });
+}
diff --git a/app/globals.css b/app/globals.css
index b6ee899..3b40811 100644
--- a/app/globals.css
+++ b/app/globals.css
@@ -26,6 +26,10 @@
 /* utilities */
 .tnum { font-variant-numeric: tabular-nums; }
 .hairline-b { border-bottom: 1px solid var(--color-hairline); }
+
+/* Only one ask on screen: while the app poll holds the view, the floating
+   feedback pill steps aside. AppPollModal sets the attribute. */
+body[data-app-poll="open"] [aria-label="Feedback despre site"] { display: none; }
 .display-num { font-family: var(--font-display); font-weight: 700; letter-spacing: -0.01em; }
 
 /* ===== verdict band =====
diff --git a/app/layout.tsx b/app/layout.tsx
index e866c2b..ef3b1c0 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -2,6 +2,7 @@ import type { Metadata } from 'next';
 import { Inter, Source_Serif_4 } from 'next/font/google';
 import Script from 'next/script';
 import './globals.css';
+import AppPollModal from '@/components/AppPollModal';
 import FeedbackWidget from '@/components/FeedbackWidget';
 import SiteNav from '@/components/SiteNav';
 import SourceFooter from '@/components/SourceFooter';
@@ -38,6 +39,7 @@ export default function RootLayout({ children }: { children: React.ReactNode })
         {children}
         <SourceFooter />
         <FeedbackWidget />
+        <AppPollModal />
         <JsonLd data={webSiteJsonLd()} />
         <Script
           src={`https://www.googletagmanager.com/gtag/js?id=${GA_ID}`}
diff --git a/components/AppPollModal.tsx b/components/AppPollModal.tsx
new file mode 100644
index 0000000..0918b75
--- /dev/null
+++ b/components/AppPollModal.tsx
@@ -0,0 +1,248 @@
+"use client";
+
+import { usePathname } from "next/navigation";
+import { useCallback, useEffect, useRef, useState } from "react";
+
+// One-question poll: "would you want an app?", then Android or iOS.
+//
+// It only fires on the pages where a visitor has just been given their answer
+// (a street or a punct termic), and only after a delay. The delay is not just
+// politeness: a dialog that covers content the moment someone arrives from
+// search is what Google treats as an intrusive interstitial, and this site
+// lives on organic search. After real engagement it is not that.
+//
+// Answers are written in two steps against one nonce-keyed row, so tapping
+// "Da" and then closing still counts as a "Da".
+const STORAGE_KEY = "fac-app-poll";
+const SUPPRESS_ANSWERED_MS = 365 * 24 * 3600 * 1000;
+const SUPPRESS_DISMISSED_MS = 90 * 24 * 3600 * 1000;
+// Overridable so the e2e build can push the modal out of reach of specs that
+// merely happen to visit a street page (see playwright.config.ts).
+const DELAY_MS = Number(process.env.NEXT_PUBLIC_APP_POLL_DELAY_MS) || 10_000;
+const ANSWER_PAGES = ["/strada/", "/punct-termic/"];
+
+// Kill switch: set NEXT_PUBLIC_APP_POLL=0 and redeploy (or let the nightly
+// rebuild pick it up) to take the poll down without reverting code.
+const ENABLED = process.env.NEXT_PUBLIC_APP_POLL !== "0";
+
+type Stage = "interest" | "platform" | "done";
+
+function suppressed(): boolean {
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return false;
+    const { kind, t } = JSON.parse(raw) as { kind: string; t: number };
+    const ttl = kind === "dismissed" ? SUPPRESS_DISMISSED_MS : SUPPRESS_ANSWERED_MS;
+    return Date.now() - t < ttl;
+  } catch {
+    return false;
+  }
+}
+
+function remember(kind: "answered" | "dismissed") {
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify({ kind, t: Date.now() }));
+  } catch {
+    /* private mode etc. - fine */
+  }
+}
+
+// crypto.randomUUID() needs a secure context; getRandomValues does not.
+function uuid4(): string {
+  const b = new Uint8Array(16);
+  crypto.getRandomValues(b);
+  b[6] = (b[6] & 0x0f) | 0x40;
+  b[8] = (b[8] & 0x3f) | 0x80;
+  const h = [...b].map((n) => n.toString(16).padStart(2, "0")).join("");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+
+export default function AppPollModal() {
+  const pathname = usePathname();
+  const [open, setOpen] = useState(false);
+  const [stage, setStage] = useState<Stage>("interest");
+  const nonceRef = useRef<string | null>(null);
+  const dialogRef = useRef<HTMLDivElement>(null);
+  const firstButtonRef = useRef<HTMLButtonElement>(null);
+
+  const onAnswerPage = ANSWER_PAGES.some((p) => pathname.startsWith(p));
+
+  useEffect(() => {
+    if (!ENABLED || !onAnswerPage || suppressed()) return;
+    const id = setTimeout(() => setOpen(true), DELAY_MS);
+    return () => clearTimeout(id);
+  }, [onAnswerPage, pathname]);
+
+  // While the dialog holds the screen: lock scrolling, and hide the feedback
+  // pill so there is only ever one ask on screen (see app/globals.css).
+  useEffect(() => {
+    if (!open) return;
+    const prev = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    document.body.dataset.appPoll = "open";
+    return () => {
+      document.body.style.overflow = prev;
+      delete document.body.dataset.appPoll;
+    };
+  }, [open]);
+
+  useEffect(() => {
+    if (open) firstButtonRef.current?.focus();
+  }, [open, stage]);
+
+  const close = useCallback(
+    (kind: "answered" | "dismissed") => {
+      remember(kind);
+      setOpen(false);
+    },
+    [],
+  );
+
+  function send(interested: boolean, platform?: "android" | "ios") {
+    if (nonceRef.current === null) nonceRef.current = uuid4();
+    // Best-effort: a poll answer is not worth blocking or scolding anyone over.
+    void fetch("/api/app-poll", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        nonce: nonceRef.current,
+        interested,
+        platform,
+        page: pathname,
+        website: "",
+      }),
+    }).catch(() => {});
+  }
+
+  function answerInterest(interested: boolean) {
+    send(interested);
+    if (interested) {
+      setStage("platform");
+    } else {
+      setStage("done");
+      setTimeout(() => close("answered"), 2500);
+    }
+  }
+
+  function answerPlatform(platform: "android" | "ios") {
+    send(true, platform);
+    setStage("done");
+    setTimeout(() => close("answered"), 2500);
+  }
+
+  // Tab cycles inside the dialog; Escape is equivalent to the × button.
+  //
+  // Both listen on the DOCUMENT, not on the backdrop element: clicking the
+  // backdrop moves focus to <body>, and a handler bound to the backdrop subtree
+  // stops firing the moment focus leaves it - which killed Escape exactly when
+  // it was most needed, since a backdrop click is the first thing people try.
+  useEffect(() => {
+    if (!open) return;
+    function onKey(ev: KeyboardEvent) {
+      if (ev.key === "Escape") {
+        ev.preventDefault();
+        close(stage === "interest" ? "dismissed" : "answered");
+        return;
+      }
+      if (ev.key !== "Tab" || !dialogRef.current) return;
+      const focusable = dialogRef.current.querySelectorAll<HTMLElement>("button");
+      if (focusable.length === 0) return;
+      const first = focusable[0];
+      const last = focusable[focusable.length - 1];
+      const active = document.activeElement;
+      if (!dialogRef.current.contains(active)) {
+        // Focus escaped the dialog - pull it back rather than tabbing the page behind.
+        ev.preventDefault();
+        (ev.shiftKey ? last : first).focus();
+        return;
+      }
+      if (ev.shiftKey && active === first) {
+        ev.preventDefault();
+        last.focus();
+      } else if (!ev.shiftKey && active === last) {
+        ev.preventDefault();
+        first.focus();
+      }
+    }
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [open, stage, close]);
+
+  if (!open) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center p-4"
+      style={{ background: "rgba(33, 28, 23, 0.45)" }}
+    >
+      <div
+        ref={dialogRef}
+        role="dialog"
+        aria-modal="true"
+        aria-label="Întrebare despre o aplicație"
+        className="relative flex min-h-[9rem] w-full max-w-sm flex-col justify-center border border-hairline bg-paper p-5 text-ink"
+      >
+        <button
+          type="button"
+          aria-label="Închide"
+          onClick={() => close(stage === "interest" ? "dismissed" : "answered")}
+          // 40x40 hit area (WCAG 2.5.8 wants >=24x24); the glyph stays small.
+          className="absolute right-1 top-1 flex h-10 w-10 items-center justify-center text-lg text-ink-soft hover:text-ink"
+        >
+          ×
+        </button>
+
+        {stage === "done" ? (
+          <p className="pr-6 font-medium">
+            Mulțumesc mult! La cât mai puține zile fără apă caldă!
+          </p>
+        ) : stage === "platform" ? (
+          <>
+            <p className="pr-6 text-ink-soft">Preferi pe:</p>
+            <div className="mt-3 flex gap-2">
+              <button
+                type="button"
+                ref={firstButtonRef}
+                onClick={() => answerPlatform("android")}
+                className="flex-1 border border-ink px-3 py-2 font-medium hover:bg-ok"
+              >
+                Android
+              </button>
+              <button
+                type="button"
+                onClick={() => answerPlatform("ios")}
+                className="flex-1 border border-ink px-3 py-2 font-medium hover:bg-ok"
+              >
+                iOS
+              </button>
+            </div>
+          </>
+        ) : (
+          <>
+            <p className="pr-6 text-ink-soft">Hei, te deranjez o secundă cu o întrebare:</p>
+            <p className="mt-2 pr-6 font-medium">
+              Te-ar interesa o aplicație pentru faraapacalda.ro?
+            </p>
+            <div className="mt-4 flex gap-2">
+              <button
+                type="button"
+                ref={firstButtonRef}
+                onClick={() => answerInterest(true)}
+                className="flex-1 border border-ink px-3 py-2 font-medium hover:bg-ok"
+              >
+                Da
+              </button>
+              <button
+                type="button"
+                onClick={() => answerInterest(false)}
+                className="flex-1 border border-hairline px-3 py-2 hover:bg-ok"
+              >
+                Nu
+              </button>
+            </div>
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/e2e/app-poll.spec.ts b/e2e/app-poll.spec.ts
new file mode 100644
index 0000000..f4a8f4b
--- /dev/null
+++ b/e2e/app-poll.spec.ts
@@ -0,0 +1,151 @@
+import { expect, test, type Page } from "@playwright/test";
+
+import { POLL_DELAY_MS } from "../playwright.config";
+import { singlePtStreet, topPt } from "./helpers";
+
+// The route needs Supabase envs that exist only on Vercel, so every spec
+// intercepts /api/app-poll - we test the dialog, not Supabase.
+const STREET = singlePtStreet();
+const PT = topPt();
+
+function intercept(page: Page, posts: string[] = []) {
+  return page.route("**/api/app-poll", (route) => {
+    if (route.request().method() === "POST") posts.push(route.request().postData() ?? "");
+    return route.fulfill({ status: 204 });
+  });
+}
+
+// The dialog is deliberately delayed so it never behaves as an on-arrival
+// interstitial. Fake the clock and jump past the (test-inflated) delay rather
+// than waiting on it.
+async function openPoll(page: Page, path: string) {
+  await page.clock.install();
+  await page.goto(path);
+  await page.clock.fastForward(POLL_DELAY_MS + 1_000);
+  const dialog = page.getByRole("dialog", { name: "Întrebare despre o aplicație" });
+  await expect(dialog).toBeVisible();
+  return dialog;
+}
+
+test("does not appear on arrival, only after the delay", async ({ page }) => {
+  await intercept(page);
+  await page.clock.install();
+  await page.goto(`/strada/${STREET.slug}`);
+  await page.clock.fastForward(POLL_DELAY_MS - 1_000);
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+  await page.clock.fastForward(2_000);
+  await expect(page.getByRole("dialog")).toBeVisible();
+});
+
+test("Da then platform: records both steps against one nonce, then thanks", async ({ page }) => {
+  const posts: string[] = [];
+  await intercept(page, posts);
+  const dialog = await openPoll(page, `/strada/${STREET.slug}`);
+
+  await expect(dialog.getByText("Te-ar interesa o aplicație pentru faraapacalda.ro?")).toBeVisible();
+  await dialog.getByRole("button", { name: "Da", exact: true }).click();
+
+  await expect(dialog.getByText("Preferi pe:")).toBeVisible();
+  await dialog.getByRole("button", { name: "Android" }).click();
+  await expect(dialog.getByText(/Mulțumesc mult!/)).toBeVisible();
+
+  expect(posts).toHaveLength(2);
+  const first = JSON.parse(posts[0]);
+  const second = JSON.parse(posts[1]);
+  expect(first).toMatchObject({ interested: true, website: "" });
+  expect(first.platform).toBeUndefined();
+  expect(second).toMatchObject({ interested: true, platform: "android" });
+  // Both steps must land on the SAME row, or the platform answer is orphaned.
+  expect(second.nonce).toBe(first.nonce);
+  expect(first.page).toBe(`/strada/${STREET.slug}`);
+});
+
+test("Nu records a single answer and never asks a platform", async ({ page }) => {
+  const posts: string[] = [];
+  await intercept(page, posts);
+  const dialog = await openPoll(page, `/punct-termic/${PT.slug}`);
+
+  await dialog.getByRole("button", { name: "Nu", exact: true }).click();
+  await expect(dialog.getByText(/Mulțumesc mult!/)).toBeVisible();
+  await expect(dialog.getByText("Preferi pe:")).toHaveCount(0);
+
+  expect(posts).toHaveLength(1);
+  expect(JSON.parse(posts[0])).toMatchObject({ interested: false });
+});
+
+test("closing with × suppresses it on reload, and records nothing", async ({ page }) => {
+  const posts: string[] = [];
+  await intercept(page, posts);
+  const dialog = await openPoll(page, `/strada/${STREET.slug}`);
+
+  await dialog.getByRole("button", { name: "Închide" }).click();
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+  expect(posts).toHaveLength(0);
+
+  await page.clock.install();
+  await page.reload();
+  await page.clock.fastForward(POLL_DELAY_MS + 1_000);
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+});
+
+test("tapping Da still counts if the dialog is closed before picking a platform", async ({
+  page,
+}) => {
+  const posts: string[] = [];
+  await intercept(page, posts);
+  const dialog = await openPoll(page, `/strada/${STREET.slug}`);
+
+  await dialog.getByRole("button", { name: "Da", exact: true }).click();
+  await dialog.getByRole("button", { name: "Închide" }).click();
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+
+  expect(posts).toHaveLength(1);
+  expect(JSON.parse(posts[0])).toMatchObject({ interested: true });
+});
+
+test("only one ask on screen: the feedback pill hides while the dialog is open", async ({
+  page,
+}) => {
+  await intercept(page);
+  await page.route("**/api/feedback", (route) =>
+    route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({ up: 0 }) }),
+  );
+  await page.clock.install();
+  await page.goto(`/strada/${STREET.slug}`);
+  const pill = page.getByRole("region", { name: "Feedback despre site" });
+  await expect(pill).toBeVisible();
+
+  await page.clock.fastForward(POLL_DELAY_MS + 1_000);
+  await expect(page.getByRole("dialog")).toBeVisible();
+  await expect(pill).toBeHidden();
+});
+
+test("never fires on pages that are not an answer page", async ({ page }) => {
+  await intercept(page);
+  for (const path of ["/", "/clasament", "/metodologie"]) {
+    await page.clock.install();
+    await page.goto(path);
+    await page.clock.fastForward(POLL_DELAY_MS + 1_000);
+    await expect(page.getByRole("dialog")).toHaveCount(0);
+  }
+});
+
+test("Escape closes the dialog", async ({ page }) => {
+  await intercept(page);
+  await openPoll(page, `/strada/${STREET.slug}`);
+  await page.keyboard.press("Escape");
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+});
+
+// Regression: the key handler used to be bound to the backdrop element, so
+// clicking the backdrop moved focus to <body> and Escape silently stopped
+// working - leaving the × as the only way out of a dialog that locks scroll.
+test("Escape still closes after a backdrop click moves focus away", async ({ page }) => {
+  await intercept(page);
+  await openPoll(page, `/strada/${STREET.slug}`);
+
+  await page.mouse.click(5, 5); // backdrop, well clear of the centred dialog
+  await expect(page.getByRole("dialog")).toBeVisible(); // backdrop click must NOT dismiss
+  await page.keyboard.press("Escape");
+  await expect(page.getByRole("dialog")).toHaveCount(0);
+});
diff --git a/lib/app-poll.ts b/lib/app-poll.ts
new file mode 100644
index 0000000..791d434
--- /dev/null
+++ b/lib/app-poll.ts
@@ -0,0 +1,61 @@
+// Pure validation for the app-interest poll - kept dependency-free so vitest can
+// exercise it without the route handler's runtime. Mirrors lib/feedback.ts.
+//
+// The poll is answered in two steps (interest, then platform) and both steps
+// write the same row, keyed on a client-generated nonce. Whoever holds the
+// nonce can amend that row, so the nonce is required to look like a UUID: it
+// keeps enumeration out of reach and bounds what reaches the unique index.
+
+export interface AppPollInput {
+  nonce?: unknown;
+  interested?: unknown;
+  platform?: unknown;
+  page?: unknown;
+  website?: unknown; // honeypot: humans never fill it
+}
+
+export type Platform = "android" | "ios";
+
+export interface AppPollRecord {
+  nonce: string;
+  interested: boolean;
+  platform: Platform | null;
+  page: string | null;
+}
+
+export type AppPollResult =
+  | { ok: true; record: AppPollRecord }
+  | { ok: false; reason: "honeypot" | "invalid" };
+
+const MAX_PAGE = 200;
+const PLATFORMS: readonly string[] = ["android", "ios"];
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+export function validateAppPoll(body: AppPollInput): AppPollResult {
+  if (typeof body.website === "string" && body.website.trim() !== "") {
+    return { ok: false, reason: "honeypot" };
+  }
+
+  if (typeof body.nonce !== "string") return { ok: false, reason: "invalid" };
+  const nonce = body.nonce.trim().toLowerCase();
+  if (!UUID_RE.test(nonce)) return { ok: false, reason: "invalid" };
+
+  if (typeof body.interested !== "boolean") return { ok: false, reason: "invalid" };
+
+  let platform: Platform | null = null;
+  if (body.platform !== undefined && body.platform !== null) {
+    if (typeof body.platform !== "string" || !PLATFORMS.includes(body.platform)) {
+      return { ok: false, reason: "invalid" };
+    }
+    // Same rule as the fac_app_poll_platform_implies_interest CHECK constraint.
+    if (!body.interested) return { ok: false, reason: "invalid" };
+    platform = body.platform as Platform;
+  }
+
+  let page: string | null = null;
+  if (typeof body.page === "string" && body.page.startsWith("/")) {
+    page = body.page.slice(0, MAX_PAGE);
+  }
+
+  return { ok: true, record: { nonce, interested: body.interested, platform, page } };
+}
diff --git a/playwright.config.ts b/playwright.config.ts
index c1a4d26..ed9b5ef 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -4,6 +4,14 @@ import { defineConfig } from '@playwright/test';
 // Run `node scripts/fetch-data.mjs` (with DATA_BUNDLE_PATH if local) BEFORE
 // `npm run e2e` — the webServer below skips the fetch (SKIP_DATA_FETCH=1)
 // so the explicit fetch step stays the single source of data.
+/**
+ * The app poll opens a modal that covers the page on /strada/ and /punct-termic/
+ * after a delay. In the test build that delay is pushed far out of reach, so an
+ * unrelated spec visiting a street page can never race it — app-poll.spec.ts
+ * fakes the clock and fast-forwards past this value instead of waiting.
+ */
+export const POLL_DELAY_MS = 600_000;
+
 export default defineConfig({
   testDir: 'e2e',
   fullyParallel: true,
@@ -15,7 +23,7 @@ export default defineConfig({
   webServer: {
     command: 'npm run build && npm run start',
     url: 'http://localhost:3000',
-    env: { SKIP_DATA_FETCH: '1' },
+    env: { SKIP_DATA_FETCH: '1', NEXT_PUBLIC_APP_POLL_DELAY_MS: String(POLL_DELAY_MS) },
     timeout: 600_000,
     reuseExistingServer: !process.env.CI,
   },
diff --git a/test/app-poll.test.ts b/test/app-poll.test.ts
new file mode 100644
index 0000000..06efc45
--- /dev/null
+++ b/test/app-poll.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+
+import { validateAppPoll } from "@/lib/app-poll";
+
+const NONCE = "8f14e45f-ea8f-4b2d-9f1a-3c7d5b6e0a91";
+
+describe("validateAppPoll", () => {
+  it("accepts a bare 'nu' answer", () => {
+    const r = validateAppPoll({ nonce: NONCE, interested: false });
+    expect(r).toEqual({
+      ok: true,
+      record: { nonce: NONCE, interested: false, platform: null, page: null },
+    });
+  });
+
+  it("accepts 'da' with a platform", () => {
+    const r = validateAppPoll({ nonce: NONCE, interested: true, platform: "android" });
+    if (!r.ok) throw new Error("expected ok");
+    expect(r.record.platform).toBe("android");
+    expect(r.record.interested).toBe(true);
+  });
+
+  it("accepts 'da' before a platform is chosen", () => {
+    const r = validateAppPoll({ nonce: NONCE, interested: true });
+    if (!r.ok) throw new Error("expected ok");
+    expect(r.record.platform).toBeNull();
+  });
+
+  it("flags honeypot submissions", () => {
+    expect(
+      validateAppPoll({ nonce: NONCE, interested: true, website: "spam.example" }),
+    ).toEqual({ ok: false, reason: "honeypot" });
+  });
+
+  it("empty honeypot is fine", () => {
+    expect(validateAppPoll({ nonce: NONCE, interested: true, website: "" }).ok).toBe(true);
+  });
+
+  it("rejects a missing or non-boolean interest", () => {
+    expect(validateAppPoll({ nonce: NONCE })).toEqual({ ok: false, reason: "invalid" });
+    expect(validateAppPoll({ nonce: NONCE, interested: "da" })).toEqual({
+      ok: false,
+      reason: "invalid",
+    });
+  });
+
+  it("rejects unknown platforms", () => {
+    expect(
+      validateAppPoll({ nonce: NONCE, interested: true, platform: "windows-phone" }),
+    ).toEqual({ ok: false, reason: "invalid" });
+  });
+
+  // The DB carries the same rule as a CHECK constraint; rejecting it here keeps
+  // a nonsense row from ever reaching PostgREST.
+  it("rejects a platform paired with 'nu'", () => {
+    expect(validateAppPoll({ nonce: NONCE, interested: false, platform: "ios" })).toEqual({
+      ok: false,
+      reason: "invalid",
+    });
+  });
+
+  it("requires a UUID nonce", () => {
+    expect(validateAppPoll({ nonce: "not-a-uuid", interested: true })).toEqual({
+      ok: false,
+      reason: "invalid",
+    });
+    expect(validateAppPoll({ interested: true })).toEqual({ ok: false, reason: "invalid" });
+    // No unbounded strings reach the unique index.
+    expect(validateAppPoll({ nonce: "x".repeat(500), interested: true })).toEqual({
+      ok: false,
+      reason: "invalid",
+    });
+  });
+
+  it("normalises the nonce to lower case", () => {
+    const r = validateAppPoll({ nonce: NONCE.toUpperCase(), interested: false });
+    if (!r.ok) throw new Error("expected ok");
+    expect(r.record.nonce).toBe(NONCE);
+  });
+
+  it("page must be a site-relative path", () => {
+    const ok = validateAppPoll({
+      nonce: NONCE,
+      interested: true,
+      page: "/strada/sos-pantelimon",
+    });
+    if (!ok.ok) throw new Error("expected ok");
+    expect(ok.record.page).toBe("/strada/sos-pantelimon");
+    const bad = validateAppPoll({ nonce: NONCE, interested: true, page: "https://evil.example" });
+    if (!bad.ok) throw new Error("expected ok");
+    expect(bad.record.page).toBeNull();
+  });
+
+  it("clips overlong pages", () => {
+    const r = validateAppPoll({ nonce: NONCE, interested: true, page: "/" + "a".repeat(500) });
+    if (!r.ok) throw new Error("expected ok");
+    expect(r.record.page).toHaveLength(200);
+  });
+});