FAMILY MONEY — CORRECTED CLOUDFLARE UPLOAD

THIS UPDATE: REUPLOAD THE CLOUDFLARE ZIP

Upload MoneyTracker_Cloudflare.zip as a new production deployment in the SAME
Cloudflare Pages project. index.html is already at the ZIP root. Reload the
Pages site after deployment; scripts also have updated cache version markers.

Keep the previously supplied Apps Script wrapper. Its code has not changed.
If it was not installed/deployed yet, the same clean wrapper is available in
APPS_SCRIPT_UPDATE.txt and setup.html for first-time setup. Replace Code.gs in
the small WRAPPER project, retain the MoneyTracker library dependency, then
Deploy > Manage deployments > Edit > New version > Deploy.

STABLE APP ADDRESS

config.js now uses https://deb.s.gy/money directly. The browser follows whatever
Google deployment is assigned to that Short.io link. There is no saved Google
deployment ID in config.js to become stale when the short link changes.
The Pages frame policy allows both deb.s.gy and the Google frame destinations.

On 12 October 2026 the short link was checked in the browser. It redirected to
another Google /exec deployment and preserved mt_host and mt_channel, the two
query parameters needed by the embedding wrapper. Keep query forwarding enabled
on the short link. Any new Google deployment must still contain the same wrapper.

LOADING AND SCREEN FIT

The Google frame starts loading immediately. The loading screen closes on the
first valid app-ready message or the iframe load event. It does not wait for a
measurement reply, hide the iframe with CSS, or impose a fixed splash duration.
After eight seconds a slow connection exposes the frame and recovery actions
instead of leaving a full-screen loader. This timeout does not make an app that
has not loaded appear or bypass Google permissions.

The injected wrapper bridge and Cloudflare page measure the actual frame and
app width/height. When the sizes match, the difference in height is the top
banner space. The page crops that exact amount and enlarges the frame by the
same amount, preserving the bottom of the app. It adjusts again when the banner,
orientation or keyboard changes. No fixed 45px or other banner offset is used.
Automatic cropping requires the updated Google wrapper to be deployed.
The Google banner itself stays in Google's document; the wrapper clips it.

Access settings, Google server response time, first-run sheet setup and any
required Google sign-in still affect opening time. The shell starts one iframe navigation through your short link; no preliminary
fetch or URL-resolution request delays the iframe.

OPTIONAL HOST SETTING

If MT_EMBED_ORIGINS is already set in the wrapper's Script Properties, ensure it
contains your exact Cloudflare origin (https://your-project.pages.dev or your
custom HTTPS origin). Multiple origins can be comma-separated; no path or final
slash. Otherwise the wrapper accepts valid HTTPS embedding requests.

VERIFICATION

25 local VM checks passed, using the actual wrapper and Pages JavaScript:
loading recovery, immediate reveal, short-link URL and frame policy, dynamic banner dimensions,
rotation/keyboard changes, trusted-message validation and generated code.
The current original app's sign-in screen, changed /exec URL and query forwarding
were checked in the browser. These corrected files have not been deployed to your Google
project or Cloudflare account here. Google authorization/cookies and physical
mobile devices are not established by the local tests.

Official references:
https://developers.cloudflare.com/pages/get-started/direct-upload/
https://developers.google.com/apps-script/reference/html/html-output
https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage