Carrie’s Gift

My wife Carrie wasn't a match for a friend who needs a kidney, so she found another way. On October 20 she is donating one to a stranger through a voucher program, which moves her friend up the list for a kidney of her own. Her birthday is November 3.

Instead of gifts, we wanted to ask for support in her name. That needed a page that was warm enough to share by text message, trustworthy with money, honest about the totals, and open to friends' notes without becoming a target for spam. It also had to be live two weeks before her surgery.

I worked out the idea and the look with Claude Design, down to the copy and the shape of the necklace, then directed Claude Code through the build. A day after the first scaffold the site was live.

• A necklace of gifts. Every $100 adds a bead toward $5,000. Fifty beads hang on a curve laid out by equal arc length, fill from both ends so they meet at the pendant, and pop in as they arrive. The pendant counts down to her birthday.
• Real money, never ours. Every donate button opens the charity's own tribute page, which takes the payment and issues the receipt. The necklace fills from the total on that page, read every five minutes, with a figure I can enter by hand if it can't be read.
• An honest gift count. Coming back from the charity, "Yes, I gave" counts a gift and can pin a birthday note with a bead beside it on her wall. Those clicks move the count, never the money, and only Carrie and I see amounts.
• A wall that stays kind. Notes appear straight away, behind bot detection, a profanity filter, a honeypot that fakes success, a 180-character limit, and a rate limit keyed to a salted hash of the address rather than the address itself. I can hide a note from the admin page.
• Ways to do more. A donor-registration button counted anonymously, links to registering, living donation and help with donor costs, a timeline that updates itself by date, and updates from both of us, each able to carry a photo posted from a phone. The browser shrinks it to fit a 1 MB upload limit, and the server re-encodes it upright with its location data stripped.
• A small admin. Magic-link sign-in for an allowlist that never reveals who is on it, the live total, fallbacks and offsets, and moderation.
• Locked down. Row-level security is on for every table with no policies at all, so the public key can do nothing. Everything goes through the server.

Care for the person the work is for, and judgement about what not to build. The site never handles a payment, so there is nothing to secure, refund or receipt; the charity already does that well. The total comes from where the money actually is, and the honor-system clicks are kept apart from it. The friend at the heart of it stays anonymous.

It also shows the design-to-build loop I keep coming back to. The prototype's own necklace maths lives in the test suite as the answer key, so the production layout is checked against the design to six decimal places, across six widths and four fill levels. The design said the necklace mattered, and the tests make sure it was ported exactly.