'm 12. My referral system slept for 3 days — here's the SQL trigger that woke it up

Harun, a 12-year-old developer, built KODA, an AI coding mentor, entirely on a POCO C55 Android phone. He discovered that his referral system had never fired because the client-side code only attached referrals within a 10-minute window, but users often confirmed their emails hours later. He fixed it by extending the window to 48 hours and moving the logic into a database trigger that automatically increments referral counts and grants ambassador status, bypassing Row Level Security restrictions.

Quick recap if you're new: I'm Harun, 12 years old, no laptop. I build KODA — an AI coding mentor — entirely on a POCO C55 Android phone. Vanilla JS + Supabase + Groq + Netlify. This week I opened my database expecting a growth story. I found a mystery instead. | username | referred by | referral count | is ambassador | |---|---|---|---| | me founder | NULL | 0 | false | | my brother | NULL | 0 | false | | my 2 friends | NULL | 0 | false | | 4 strangers | NULL | 0 | false | 8 users. Zero referrals. Zero ambassadors. The "Invite a friend, unlock Gold Mode" loop I was so proud of? It had never fired. Not once. No error messages. No red banners. Just... silence. Silent failures are the worst failures. My client code only attached a referral if the account was less than 10 minutes old when the user logged in: if ref == me.id && ageMs < 10 60 1000 { await db.from 'profiles' .update { referred by: ref } .eq 'id', me.id .is 'referred by', null ; } But my signup flow says: "check your inbox, tap the confirmation link, THEN sign in." Humans don't do that in 10 minutes. They confirm their email hours later. By then ageMs is huge and the referral dies silently. Every single time. Fix: a 48-hour window. if ref == me.id && ageMs < 48 60 60 1000 { ... } Here's the embarrassing part. The client wrote referred by on the NEW user... and that was it. Nothing anywhere incremented the referrer's referral count or flipped is ambassador = true . And it can't be done from the client anyway — Row Level Security good security blocks users from editing other people's rows. Fix: move the logic into the database. A security definer trigger that powers up the referrer automatically: create or replace function public.bump referrer returns trigger language plpgsql security definer set search path = public as $$ begin if new.referred by is not null and new.referred by < new.id and old is null or old.referred by is null then update public.profiles set referral count = coalesce referral count, 0 + 1, is ambassador = true where id = new.referred by; end if; return new; end; $$; drop trigger if exists trg bump referrer on public.profiles; create trigger trg bump referrer after insert or update of referred by on public.profiles for each row execute function public.bump referrer ; Now when a referral lands, the database itself grants the Gold. No client code, no RLS fights. When RLS says "no," move the logic to the database. One deploy = one bundle. This bundle v9 shipped with: print f'{bugs=} {count=}' — yes, on Python 3.14, the current "pi version."Why batch? Because every deploy costs attention and risk on a phone. Ship in bundles, test once, celebrate once. If you're a senior dev: roast my trigger in the comments. I read every single word. Built with ❤️ by Harun age 12 on a POCO C55.