A QR code cannot hide a bug from you, because checking it costs nothing. You point a phone at it. A URL pops up or it doesn't.
That's why I picked a QR encoder for a hackathon whose entire rule is standard library only: no packages, an empty dependency manifest, verified at submission. I rebuilt qrcode, the library nearly every JavaScript project reaches for, in 844 lines of Node and an empty dependency manifest. By the end I had fifty tests, all green, and two bugs that not one of them could see. A phone found the first in four seconds, on day three, the first time I bothered to try. A tool one command away would have found both on the first afternoon. I just wouldn't run it, because running it felt like cheating.
The encoder was the easy part. This is a write-up about the hard part, which was verification, which I also got wrong.
What npm install qrcode actually installs
qrcode gets 24 million downloads a week. Before rebuilding it I looked at what it was.
