Building NICHLYST: The 14-Day Clock, the "Web App" Illusion, and Hardening the Archive

On September 10th, at 10:19 AM, the system finally turned green.

12 Testers Google Play

Twelve confirmed, opt-in testers. The threshold is met.

The 14-day Google Play closed testing clock is officially locked.

For the next two weeks, NICHLYST sits in a state of anabiosis. My role has shifted from "Builder" to "Watcher." But as any builder who has ever shipped knows, the moment you stop building is the moment you start seeing the cracks.

This week was the week of the "Web App" realization—a harsh feedback loop that transformed the project from a browser experiment into a tactile, native experience. When debating the native app vs web app architecture early on, I chose the web for speed. But the reality of shipping a Capacitor mobile app forced me to deeply reconsider the native app web app comparison. Under the hood, it relies on a native app WebView, but the user’s hand is the ultimate critic.

---

The "Web App" Illusion

A few days ago, I sat with the build on my Redmi Note 9 Pro. I was looking for glitches, for paywall bugs, for layout breaks. Instead, I saw a reflection of my own haste. Good mobile app UX design demands more than just functional code; it demands physical empathy.

The game felt like a website wrapped in a thin layer of Android glue. The scrolling lacked inertia, the buttons felt like generic text inputs, and the total absence of tactile feedback made the bunker feel... hollow. In a game about the "slow weight of testimony," the interface felt weightless.

When you build with Capacitor, the browser is your engine, but the user’s hand is the ultimate critic. If the scrolling doesn't have momentum, or if the system doesn't acknowledge a tap with a haptic tick, the user subconsciously knows they are looking at a document, not a world.

I spent 48 hours purging "web-isms":

1. Kinetic Scrolling & Notch Awareness: I replaced browser-default scrolling with CSS momentum and reclaimed the pixels stolen by the Android camera cutout. The UI is no longer "pushed" by the hardware; it flows around it.

/* Preventing overscroll bounce on body for native feel */
body {
  overscroll-behavior: none;
  -webkit-user-select: none;
  touch-action: manipulation;
}

/* Kinetic scrolling on individual scroll containers */
.scroll-container {
  -webkit-overflow-scrolling: touch;
}

/* Safe area inset padding for notch awareness (injected via NativeBridge) */
:root {
  --nl-safe-area-top: env(safe-area-inset-top, 0px);
  --nl-safe-area-bottom: env(safe-area-inset-bottom, 0px);
}

Capacitor Haptics

Tactile Haptics: When the Interface Feels Real

1. Tactile Feedback: If you are looking for a quick Capacitor plugin tutorial, the setup is straightforward. I integrated the @capacitor/haptics plugin. Every choice button now triggers a light pulse; every raid event or consequence trigger results in a distinct, medium haptic impact.

It is a small set of changes, but the difference between "viewing a site" and "holding an archive" is exactly the sum of these details.

---

Mobile Game Security

Security as a Feature: Hardening the Archive

In the first devlog, I wrote about an antifragile architecture. But when evaluating mobile game security, antifragility means nothing if the system is insecure. If your monetization is a bypassable localStorage flag, you haven't built a business; you've built a suggestion.

I audited the security of the payment flow this week. The results were sobering.

I had hardcoded the RevenueCat public keys and relied on weak integrity checks for save files. During the Shipaton, your work is not just being reviewed by judges; it is being probed by the entire community.

I implemented two critical hardening layers:

1. djb2 Checksum Integrity: Every save file now contains a djb2 checksum. If a user tries to modify their memory_integrity or guilt stats in the JSON, the checksum mismatch triggers a safe recovery protocol (backup restore) rather than a game-breaking crash.
2. Runtime Security: I stripped out the placeholder keys and implemented a strict build-time injection via sed in the Codemagic CI pipeline. The debug harness now checks for a native platform and a __DEV_MODE__ flag before initializing. If you are running a production build, the debug triggers are inert—they exist in the source but are gated by runtime checks that never pass on a signed APK.

Shipaton is about shipping, but it is also about shipping securely. If the paywall can be bypassed by opening the Chrome DevTools, it isn't "shipped," it's "leaked."

---

The 14-Day Clock and the Silence

The silence of the Google Play closed testing period is psychological warfare.

I have 15 testers now, well above the minimum Google Play testing requirements. I am waiting for the algorithm to tick over. In the meantime, I have stopped trying to "play" the game. I have stopped trying to find new features. The roadmap for Days 16 through 40 is written. The narrative is heavy. The engine is stable.

I am not optimizing for "more" anymore. I am optimizing for "deep."

For the next two weeks, the only work that matters is the polish of the remaining chapters. I am refining the weight of the testimonies—making sure that when a courier enters your bunker, you feel the cold air behind him.

My hands are steadier now. The medication adjustment is helping, and the rhythm of the building process has become a cage I am happy to live in. We don't have control over the city outside the window, but we have control over the bunker inside the phone.

The Archive demands a key. We are just waiting for the door to open.

Follow this devlog for the final sprint of the #BuildInPublic journey toward the RevenueCat Shipaton 2026.