New in the Reading Room: book recommendations from website visitors

The Reading Room is a first-person 3D room you can walk through, built in Three.js and hosted on GitHub Pages — books on the shelves, a record in the corner, a table by the door. Click a spine to pull it out; the ones on the reading table are whatever I'm in the middle of.

Until now the table only held my own books. This update adds the room's first way for website visitors to put something on it: a book recommendation.

Links

• Room: readingroom.rr2.dev
• Repo: github.com/r-r-2/thereadingroom
• Sample recommendation: github.com/r-r-2/thereadingroom/issues/19

---

New feature: Website visitors can recommend a book without a GitHub account. The form files an issue; adding the approved label shelves it on the table for everyone. First real book through the pipe: The Secret, recommended by Swaa (#19).

Why add it this way

The room is static GitHub Pages. Website visitors shouldn't need an account, and unreviewed titles shouldn't land in the repo on their own. Issues are the queue; guestbook.js stays the source of truth.

How the feature works

1. Visitor writes in the room. Quill / sign / table opens a form (title, author, name, why). Open Library can attach an ISBN and cover. Submit POSTs to a Cloudflare Worker — not to GitHub from the browser.
2. Worker files an issue. It validates the fields, applies abuse limits (20 per hashed IP, 3/min burst, no links, duplicate/flood guards), and opens an issue labeled recommendation, with the payload in a <!-- rr-guest --> JSON block. Secrets stay in Actions and get pushed to the Worker on deploy; the static page never sees them.
3. The submitter sees it right away. Their book appears on the table in this browser, with an "awaiting approval" tag (localStorage). Other visitors do not see it on the table until it's shelved — only in the ledger's Waiting page.
4. Approve = shelve. Open the issue, add the approved label. The shelve Action appends the entry to guestbook.js, commits to main, and closes the issue. Pages redeploys; the tag comes off for everyone.
5. Decline = close. Close the issue without approved. The submitter's local copy is dropped on their next visit.

What powers it

• GitHub Issues — the moderation queue. Each recommendation is an issue (recommendation label). Approve by adding approved; decline by closing without it.
• Cloudflare Worker — the public write path. Anonymous POST from the room, validation and abuse limits, then files the issue with a PAT. The static page never talks to GitHub.
• GitHub Actions — two workflows. One deploys the Worker (and pushes Actions secrets into Cloudflare). The other watches for approved and commits the entry to guestbook.js.

What shipped

• #17 — visitor table, Worker, issue relay, shelve Action (c403cd4).
• #18 — form pointed at the live Worker (7692384).
• First shelved recommendation: The Secret (Swaa, #19).