The Stepo design

The ruling ledger. What each screen is for, the system behind it, what ships in V1, and the answers to every question raised in review. This doc is the plan the Flutter build follows, and it is the authority: when it and anything else disagree, this doc wins. The screens sit beside it in app/, and the gallery at the repo root (python3 scripts/build-gallery.py → index.html) renders every one of them with its dominant job. chat and chat-thread are V2 mocks.

What it is, in one paragraph

Stepo's UI is built around one mechanic: a step is live for 24 hours, and stepping with it while it's live is how support becomes recognition (Starter · Companion · Celebrator). The design makes that mechanic the loudest read everywhere — live cards glow and count down, past cards stay vivid but go quiet, and every badge is presented as a person you stepped with, never a number. The mechanic runs both directions: showing up gets remembered, and looking back — scrolling a journey to day one and seeing who started with you, who walked beside you, who was at the finish — is the payoff the whole system builds toward (the PO's day-one thesis; the store description's four beats are the canonical pitch: journey → 24h window → remembered → look back). The skin is neutral-premium: near-white canvas, neutral ink, and a sunset taxonomy inside the brand's orange family carrying every warm moment (the 2026-07-12 temperature ruling: neutral app, warm human moments).

Lineage (what was merged, from where)

The system

Palette — the sunset taxonomy. All recognition colors are siblings of the brand orange:

Canvas temperature (ruled 2026-07-12): "neutral app, warm human moments." The canvas, ink, borders, and shadows are neutral: --paper #FAFAF9, --paper2 #F2F2F0, --ink #191817, --ink2 #403E3B, --muted #666360, --faint #A6A4A1, solid borders --line #E7E6E3 / --line2 #DBDAD7, gray shadows rgba(23,23,23,…). Warmth lives ONLY in elements that earned it — the accent taxonomy, the authored serif, photos, and deliberate moment surfaces — never in ambient chrome, and never screen-scoped (one canvas everywhere; a warm screen would read as a bug). The adjudication line: a first step is yellow because it is a first step, not because the app is already yellow. Decision record: theme-lab/ (four-temperature board; PO + designer + codex chose BRIGHT over value-matched neutral and pure white).

The screen wash — one token, five screens (2026-08-08). The signed-out stretch — signup.html and the four onboarding*.html beats, and only those — paints radial-gradient(130% 70% at 50% -8%, #FBFBFA 0%, var(--paper) 55%, #EFEFEE 100%) instead of flat paper. It is what makes the pre-app screens read as one continuous room; inside the app the canvas stays flat. All three stops are neutral, like every other piece of chrome. It is a token, not a recipe: it was copied by hand into the Flutter port and drifted exactly as you would expect — two screens kept a warm pre-ruling copy (#FBF9F6 → #EFEAE4, visibly beige on the welcome screen) and three never received it at all. Held once in AppColors.screenWash, with a test that fails if the stops are written anywhere else.

Rule: one accent per card. A card is marigold OR tangerine OR rose, set by its step type; never mixed.

"Live" is the only name for the window, untranslated (2026-08-08). A step has two states and each has exactly one word: Live inside its 24 hours, Earlier after. "On air" retires entirely, and so does the verb it grew — "After it aired" is now "After it ended". This overrides the mocks, which drew both names at once: the feed zone header carried On air and a Live pill and a 6 windows open tally, three names for one thing on one row, and this file's own note on the step-card pill already conceded the pill was "the same idea as the app's 'On air'".

Live does not translate. Vietnamese borrows it whole, the way it borrows "live stream" — "đang live" is ordinary daily speech, and "lên live" is goes live. The two native candidates both failed: "trực tiếp" is the word for a televised live broadcast and promises streaming the product does not have, and "lên sóng" is broadcast-industry register nobody says about their own day. This is the same rule the badge titles already follow (Starter / Companion / Celebrator): the term is a proper noun in every locale, and Vietnamese prose around it teaches the meaning. The four chips carrying it are locked in dialect as untranslatable.

The one thing "Live" could mis-promise is streaming, and the countdown does that work: nothing anyone calls a livestream runs with "14h left" beside it.

The pulse is a dot, not a word. What the tangerine pill was actually for is the pulsing dot; the word inside it duplicated the heading beside it. The dot moves onto the heading and the pill goes. This is the sanctioned use of tangerine in chrome — inside the app the colour means exactly one thing, and here it is saying it.

Rule: accents never carry text. Raw --live/--starter/--celeb fail WCAG as text (2.8/2.4/3.6 : 1 on white); every character and glyph in an accent hue uses the -text twin — chips, tags, door numerals, match highlights, serif accent words, all of it. Raw accents are reserved for fills, countdown rings, borders, and white-on-accent photo pills. (White-on-accent pill contrast is a punch-list item for on-device review.)

Type. Archivo (display, numerals, buttons) · Inter (body) · Fraunces italic for the authored voice: journey titles, the verbatim recognition copy (badge names like "Companion"), the stepped with verb in prose lines, and brand taglines (the signup headline's one word). Never UI labels, never chrome. The test: if a human could have said it, it may be serif; if the interface is saying it, it may not.

Craft rules. Cards lift (dual-layer neutral-gray shadow + solid --line border — on the near-white canvas the border carries hierarchy with the shadow assisting), chrome stays flat. Live cards add an accent halo on top of the base shadow. Real photos always; SVG status bars; numbers agree across screens.

The signature moment. While live, Heart · Comment · Share light up in the card's accent and each shows a count (three equal peers). Tapping one fires a tiered particle burst: regular = radial puff, first step = rises up, final step = falls & settles (confetti logic). After 24h all three go flat monochrome — counts stay, color leaves.

Past content — "dim the mechanics, not the memories." Past steps remain full cards: vivid photo, full note, faces, all counts. Only the interaction chrome goes quiet (flat buttons, "From earlier" tag, no glow, no countdown). Photos are never desaturated — a grayed photo reads as broken, and the step is still someone's proud moment.

The screens — one dominant job each

Feed — "Who needs me now?"

Live zone first: live cards with countdown rings beside the actions and prompt lines that sell the badge at the moment of action ("Step with her first step and you become a Starter"). The final-step card is the celebration: inverted carbon with rose ripple rings. Then Earlier: full-but-quiet past cards, infinitely scrollable — the feed must feel alive even when zero windows are open (pre-launch reality). The "While you were away" digest is the only place steps collapse into rows — it's a catch-up affordance, not an archive. Two honesty contracts live here: the avatar rail is the Live zone's index — the same open windows, jumpable; its count and the zone count are one number — and injected cards wear an ink "Discover" chip on the journey line (the label keeps the feed honest, the injection keeps it alive; Lena's be-the-first card is the demo).

Feed — day zero — "Alive before anyone arrives" (feed-empty.html)

The zero-follow feed (submission pass 2026-07-11; founder auto-follow overturned same day, round 5) is a working feed of Discover-labeled cards, never a blank "follow people first" gate — the backend already serves it (0-follow cadence, hot-set backfill, founder + marketing seeding the early pool; feed_overview.md). The founder is present through a dismissible editorial welcome module: "From the founder" eyebrow, Chau's authored words in Fraunces italic, and two explicit actions — Follow Chau (carbon) and Find people (quiet outline). Nothing enters Following until the user chooses it: an automatic follow would make the graph tell a false story, and the module converts a manufactured count into real, chosen follows — keep-the-mechanism-add-the-honesty, applied to our own ruling. X dismisses forever; Follow becomes Following in place. Every card wears the Discover chip; the rail indexes the injected live windows exactly as it indexes followed ones. Push safety: new-step pushes go to journey followers only, so even a widely-followed founder account never touches lock screens. Persona: Minh Trần (@minhtran, men/40), who also carries the empty-states board.

Profile — "Who did I support / who supports me?"

The two door tiles are the heroes: Badges Earned ("Who you showed up for") and Support Received ("Who shows up for you") — faces land before numbers. Below, journey cards carry a media filmstrip of recent steps (steps are photos; show them — the live step gets the tangerine ring + hours pill, the final step gets rose) plus the people line ("Maya and 39 others stepped with you here"). Filmstrip thumbs are 4:5 portrait — phone photos are portrait, and landscape letterboxing chops the moment; 4:5 (not 9:16) so the strip stays below the serif title and people line in the card's hierarchy. Thumbs never overlap: the live/final rings and pills need their full perimeter, and overlap shrinks tap targets. Considered and ranked behind 4:5: 1:1 squares (consistent with the Steps-grid unit and 22px shorter per card — the fallback if profile scroll depth ever becomes a real problem) and a hero-thumb-for-the-live-step variant (rejected: the ring + pill already carries live semantics at this scale, and the layout goes unstable when nothing is live). The "your step is live" strip closes the creator's own loop. Follower counts are one quiet muted line under the bio (2026-07-11 ruling, from the second external review — the one product point it won): the profile is a progress record, not a creator dashboard, and a prominent follower bar is the single convergent status metric on the page. It also punishes exactly the user the doors ruling protects — a small-circle, quality-over-quantity user reads a big "3 followers" as deficiency, while their doors keep compounding. The doors and the live moment carry the hierarchy; the counts stay one tap from Followers.

Journey — "Who walked this with me?"

The screen recognition was built for. Hero (authored serif title, owner, meta), then — if the finish is live — one banner that carries everything about now: countdown ring, Celebrator prompt, a personal presence line, and the lit action buttons as the only CTA. The presence line obeys the meter rule (2026-07-11): a count is a memory, a ratio is a meter — "You've been part of 9 steps on this journey," never "9 of 14," never a progress bar, never "don't miss." The banner's prompt line already invites; the presence line only remembers. Then The people of this journey: Companions (with tier names), Starters (facepile — "You" tagged if you're one), Celebrators ("31 so far" while the window is open). Then the step trail: first step (marigold node) → steps → final step (rose node, elevated).

Badges — "Who did I show up for?"

Opens on a person, mirroring Supporters: "You've stepped with Priya 14 times — more than anyone," with the arithmetic (12 = 3 Companion + 5 Starter + 4 Celebrator) kept quiet below it. Then the people list under the density rule, closed by a whisper line ("Badges arrive on their own — all you ever do is show up"). Everything on this page is past tense (2026-07-11 ruling): the earlier "Needs you now" conversion card and companion-progress bar were removed — they were progress-toward-tier UI, the exact line the 2026-07-10 recognition verdict forbids, surviving here only because this mock predated it. A badges page with a deadline turns friendship into an assignment; the live moment belongs to Feed/Activity, and this room only holds memories.

Badge reveal — "A badge just arrived" (badge-reveal.html)

The discovery moment itself — mechanic #3 ("recognition is discovered, never operated") finally has its mock. ENTRY (amended 2026-08-11): the reveal fires at the act. The step-with lands, the cheer animation plays, and a beat later (~900 ms) the full-screen moment arrives in the same session — Starter and Celebrator always, Companion whenever its evaluation has committed by that beat, and otherwise on the next open behind a push that names the journey and withholds the tier. One full reveal per session: an earned-now reveal takes the slot and further earns queue for later sessions, oldest first. The screen holds the step's memento at its authored window, the emblem that is you (your avatar inside the tier ring, the tier glyph as a crest on its edge — raw rose for ring and glow, --celeb-text for every word), the verbatim memory line ("You were there at the finish."), one provenance sentence naming the act, the person and the window ("You stepped with Marco's final step while the finish was live."), and the journey title in Fraunces italic (authored voice — the title is the owner's words). No share button — a reveal with a share CTA turns recognition into a performance surface; the moment is for the person who earned it. No next-tier hint, no progress framing, no facepile: arrival only. Demo: Celebrator on Marco Ferri's guitar journey.

Supporters — "Who shows up for me?"

Opens on the podium: the one person who shows up most, with a crown and a human sentence. Then the list, ranked by step-with count — the one number that means showing up (the old lexicographic chip ordering is superseded; see Q&A). Each row leads with the person's highest recognition chip, then the four "by kind" buckets as facepiles. The beta tripwire is an evidence contract (2026-07-11): (a) supporters never see their own ordinal rank anywhere — this page is owner-only by design and that is load-bearing; (b) rank is never pushed and never appears in prompts or copy addressed to the supporter; (c) the instrument is pre-registered: beta exit interviews with owners as the primary signal (supporters never see ranks, so the real-world risk is owner behavior — do they describe the page in gratitude words or comparison words, and do they screenshot/share rankings at their supporters?), supporters as the secondary; (d) the threshold is pre-registered too: if more than a quarter of interviewed owners reach for pressure/comparison language unprompted, or any rank-sharing-at-supporters behavior surfaces, ordinal ranks collapse to recent/longtime buckets — the pre-agreed fallback, executed without re-litigation.

Step — "The conversation"

The step at top (keeping its live glow and countdown if the window is open), comments below, sticky composer above the tab bar. Comment rules render the spec: top-level comments inside the 24h window carry the "Stepped with" chip; replies indent one level (two max) and never carry it; a reply to a level-2 comment stays level-2 with an @mention. The composer is a conversion surface: "Commenting now counts as stepping with Maya · 9h left."

Profile / Steps tab — "Everything I've posted"

Same profile header; the Steps tab is an Instagram-style 3-column media grid carrying the ultimate's semantics — the live step ringed tangerine with an hours pill, first steps ringed marigold, final steps ringed rose, occasional quiet heart-count overlays. This is the media grid that answers the old calendar view (see Q&A below).

Profile — someone else's — "Can I step with this person?" (profile-other.html)

The visitor's version of the profile, reached from any people tap (feed author avatars, search rows, follower lists, Activity people rows). Same skeleton, four deltas: Follow (carbon-filled) replaces Edit profile; the app bar is a drill-in (back + kebab → report/block — the safety pair is reachable from every profile); the filmstrips have no "+" tile (composing is the owner's affordance); and the doors are tappable — numbers + faces computed from the viewer's visible set, opening the unranked visitor lists (see "Visitor doors open", 2026-07-15, which superseded the round-4 display-only ruling). The ranked Badges/Supporters pages remain owner-only: a visitor who could open Maya's ranked supporters page could see her own ordinal rank, which breaks the owner-facing premise the podium's survival depends on (see the tripwire contract under Supporters). A door whose visible set is empty for this viewer stays flat and does not tap. The live strip works as a visit-time conversion moment ("Be the first to step with her"). Demo state: Lena Ortiz, the feed's Discover-card author — day-one sourdough (22h, zero step-withs, one .solo filmstrip thumb) plus an achieved Grow a balcony garden for history. No tab is lit.

Profile — private — "A closed door, held kindly" (profile-locked.html)

What a non-follower sees of a private account, shown in the Requested state (the quiet outline sibling of Follow; tapping cancels). Public metadata stays — avatar, name, handle, bio, follower counts — and nothing below the head leaks: no doors, no journeys, no live, no step counts. One ink lock card carries the whole message ("Mai shares her journeys with people she approves… If she accepts, you'll see the journeys she shares with her followers" — consent-accurate: no presumed yes, no promise of everything, round-4 amendment), a whisper points at Activity ("You'll get a quiet note in Activity if she accepts" — the accept/decline row already lives there; declines are silent, never notified), and the rest of the page is intentionally empty paper. Zero accent on this page — quiet is the care. It matters more than it looks: under-18 accounts default to private, so this page is many young users' public face; the copy never scolds and never hints at gates. Report/block stays reachable via the kebab. No tab is lit.

Search landing — "Find your first people"

The Search tab's opening state, and Stepo's only discovery surface — the feed is following-only, so a new user's first follows happen here (ruling in Q&A). Three zones, spec-mirrored from search_overview.md Trending & Discovery: Recent (client-side history — it lives here, never under results), People you might know (suggested users; the reason is the row — "Followed by Maya and 2 others you follow", "Follows you" — never follower counts), Journeys getting steps (trending by 7-day step-with engagement; count rides the owner line, the right slot holds at most one accent — an Achievement chip or a Live chip). Field idle = ink chrome; the tangerine focus ring belongs to the typed state. Cold-start users see the two discovery zones only. No content grid, no hashtags — discovery stays people-and-journeys shaped.

Search — "Find people and journeys" (typed state)

Opened by tapping the landing's field. People results lead with the relationship, not popularity ("You stepped with her 8 times", "Follows you"); journey results are authored serif titles with owner + step count. Private accounts show Requested state; private journeys don't appear (footer says so). The ✕ clears back to the landing. No hashtags.

Notifications — "What happened while I was away"

New (tinted, dotted) vs Earlier (flat), per the SeenAt/ReadAt model: arriving is the read. Opening Activity stamps everything waiting, so the bell's count clears at the door and New shows exactly what it cleared, frozen for the visit — nothing the reader came for shifts under them, and what lands mid-visit waits unread for the next one. A tap is travel and nothing more. The Activity tab carries the unseen count (to 9, then "9+"), because a number says how much is waiting where a dot only says "something". Rows are step-withs, comments, follows, follow-requests (Accept/Decline inline), journey first-steps and new-steps, and the emotional peaks — recognition rows ("You became a Celebrator on…", "Priya became a Companion of your…") with their badge chip. Batched actors get a face-stack row (V2). Two documentary states: deleted content survives as a struck-through row ("This content is no longer available"), and the one non-person row is Stepo itself (ink mini-mark avatar, announcements only). The inline pills on people rows are server-truth: each row carries the viewer's live relationship to its actor, so a new-follower row offers "Follow back" only to someone who is not already following or waiting, and lands on "Following" or "Requested" as the actor's account decides. Tap destinations are contract — interaction and step rows open step detail, people rows open profile-other.html (other people, never your own tab root), achievement opens the journey; the full matrix lives on notifications-board.html.

Notification spec board (notifications-board.html — a spec board, not a screen)

The system behind the Activity screen, icon-board style: push anatomy on the lock screen (iOS collapsed thumbnail / long-press full photo via a Notification Service Extension; Android actor-face largeIcon + BigPicture; per-step thread grouping), the full trigger matrix (15 live enum types + 2 proposed recognition types + the V2 batch pair — trigger, recipient, verbatim push copy, media, tap destination), the one-push-per-step priority ladder (Achievement > First step > New step, publish-gated), the SeenAt/ReadAt badge model (server-COUNT absolute badge on both the app icon and the Activity tab, never +1; the visit stamps both timestamps), the quiet rules, the never-send list, the permission-ask trigger table (which surfaces raise the primer, at what cadence, and what a blocked user gets instead — the cadence ruled in "The one shot at the prompt"), and the settings-category mapping.

Empty-states board (states-empty.html — a spec board, not a screen)

The App Review reviewer's first five minutes, as three annotated frames on the new-user persona (Minh Trần, men/40, zero everything): Activity empty — one quiet centered block ("Quiet for now. When someone steps with you — a heart, a comment, a share — it lands here."), no CTA, because Activity never nags; Profile empty — doors present at honest muted 0 / 0 with one seat-line each, the dashed Start a journey tile as the page's only CTA (no progress framing, no ghost content, no "2 of 5"); Search no-results — "No one by that name yet", and no trending backfill under a failed people search (honest empty ≠ filler; discovery lives on the landing, one ✕-tap away). The one loud exception to quiet emptiness is the feed — feed-empty.html — where liveness is the product claim.

An empty profile, seen from both sides (states-empty.html §02; 2026-08-09)

The board above rules the owner's empty profile and the app never built half of it: the Steps tab had its quiet block, the Journeys tab had nothing at all, so a new account met a blank page under two tabs that both read 0. The dashed Start a journey tile is the fix and it was already drawn — it belongs to the Journeys tab, because that is the tab whose zero it answers, and it stays the page's only CTA.

The visitor's version is the same page with the ownership module absent: one quiet line naming what is not there, and nothing to press. "No journeys yet", and that when they start one it shows up here. A visitor's screen has no work for them to do, and the one thing a CTA could ask for on someone else's empty profile is that they go and prod that person into posting.

Never here: a CTA aimed at a page that is not yours, a follow-suggestion carousel backfilling the hole, a blurred ghost journey implying content behind a door, or a count dressed up as progress. The empty-state doctrine holds on both sides — honest empty is not filler — and the one loud exception stays the feed, where liveness is the product claim.

Errors & dead ends board (states-error.html — a spec board, not a screen; 2026-07-13)

The empty-states board's sibling: what the app does when something breaks — the states a reviewer on bad hotel Wi-Fi actually hits. Seven panels: Offline (fact, not failure — stated once, quiet ink-outline Retry, auto-retry on reconnect), Couldn't load more (inline row; pagination failures never take over the screen, loaded content stays), Your step didn't post (overlay sheet; everything stays local until the server confirms — retry re-sends note + media as-is; "Discard step" is the only place the word appears, muted, never red), This step is no longer here (the deep-link dead-end), Media that won't load (paper2 field, tap to reload; the card keeps its reserved media height — every step has media, layout never collapses), That didn't work (last-resort catch-all; codes go to logs, never the screen), and the bright lines. The rulings: errors are ink and muted — never an accent, never red (sunset accents stay semantic; alarm color makes a broken moment feel like a broken promise); voice is plain and blame-free (no "Oops!", no exclamation marks, no user-facing error codes); retry is the single action; nothing already loaded is ever thrown away; and the privacy bright line — deleted, author-blocked-you, and you-blocked-author all render the identical dead-end, client and server (a closed door, not a mystery). Governing line: when something breaks, the app gets quieter, not louder.

A returning user enters offline (ruled 2026-08-10, from a prod report)

A signed-in user opening Stepo with no signal lands on their feed as they last saw it, aging truthfully (fetchedAt drives the "last updated" line the snapshot cache already owes) — a stale feed beats a locked door at every age, so there is no TTL on entry. The gate obeys one boundary: only an authoritative denial from the server (a ban, a deleted account, a rejected session) blocks entry; an inability to decide — no response, or a server that answers 5xx during an outage — falls back to what the device already knows. Reads come from cache; writes still need the network and fail fast and quiet, per the no-silent-replay rule above. No global offline bar and no special offline mode: offline is the same staleness every surface already shows per-surface, not a banner (chrome that claims to know reachability usually lies). The one door that stays shut offline is a device that has never synced the account — there is genuinely nothing to show, and the error card says the single requirement plainly: connect once. And the session rule underneath it all, the reason the report existed: only the server may end a session; silence never may. Being offline for a day, a week, a month is never a sign-out.

A shared link opens for someone with no account (ruled 2026-08-10, from a prod report)

A Stepo link is built to leave Stepo. It goes to people who are not here, and the only reason to send one is that the person on the other end can look. So the content opens for anyone the content is already public to, and the app asks for an account at the moment an act needs one, never before. A reader who arrives on a link is a reader, not a half-signed-in user: they get the step, its journey, the person who wrote it, and the public lists hanging off those, drawn exactly as a member sees them. Privacy removes ink, never the room — the same law the visitor doors already obey, applied one ring further out.

A guest never enters the app. The signed-out reader stands in a room of their own: no feed, no search, no create button, no bottom bar, nothing that implies an account they do not have. Back from the content is the sign-in screen, because that is where they came from and it is the only other room they have.

The room holds three things: the step, its journey, and the person who wrote it (PO ruling, 2026-08-10: "just the post, and profile is enough"). Reading one public step is one thing; being handed the gathered-up lists of everyone around it is another, and that second thing is a member surface. So the four doors onto other people all wait for an account: Badges Earned, Support Received, the follower line, the journey's people card, and the step's own guest book. The counts and faces stay on the page — they are part of the content, and a door that shows what is behind it is what makes signing in worth doing — the tap is what asks. This is the same access-versus-aggregation line the visitor doors already draw, applied one ring further out: a stranger with a link may read; gathering people up is for members.

Every act is a door, and a door says where it goes. Heart, comment, follow, report: each one asks, in the words of the act it interrupts, and offers sign-in. The rule that makes this worth building is the one about what happens next — signing in returns the reader to what they were reading. The moment someone decides to join is the moment they were moved by something specific; landing them on an empty feed with that thing gone spends the only intent the app will get. Sharing is exempt: passing a public link along needs no account, so the share sheet opens for a guest and only the record of it waits.

What a guest must never meet is a failure. A dead button, an error toast, a screen that half-loads: each of those says the app is broken rather than that the reader is new. Governing line: the link opens; the act asks.

Media viewer board (media-viewer.html — a spec board, not a screen; 2026-07-13)

Every step has media, so every reviewer will tap one — this board is the canon for the full-screen viewer. Core stance: the viewer is a lightbox, not a surface. Today a step carries one media; multi-media steps are a known possible future (PO, 2026-07-13) — if they come, the viewer becomes a horizontal pager with faint page dots and nothing else changes; every rule here is per-media. Don't hard-code single-media shapes where plural is cheap. Entry point REVISED (2026-07-13, PO device pass): only the step detail's media tap opens the viewer. Cards (feed, chapter, profile grid) are navigation — their taps, media included, go to step detail; the ladder is glance-crop (card) → whole media (detail) → zoom (viewer). The shared-element enter/exit runs from the detail's media, not from cards. Five panels: photo with chrome (one X, and nothing else — top-right and the bottom edge both carry nothing; enter/exit is a shared-element fade+scale from the tapped card), chrome hidden (single tap toggles; zoom also hides it), video (thin scrub line + tabular times; sound ON in the viewer, muted in the feed — intent draws the line; tap = play/pause; no fullscreen button, it already is), the swipe-down dismiss (media follows the finger, the room fades back in; the X exists for the tap-minded, the gesture is the real door), and the bright lines: zero social actions in the viewer (hearts/comments/share live on the step, one dismiss away); no download, no save-to-library (other people's moments are theirs — the affordance isn't built, V1 ruling); no caption (PO, 2026-07-16 — see below); chrome is paper-white on carbon, zero accent; media shown whole — natural aspect, letterboxed, never cropped or filtered. Governing line: the viewer's job is to disappear.

Caption retired (PO, 2026-07-16). The board used to carry one caption line — the step's note in Fraunces italic, plus the date. Two things killed it. The note is free text, so "one line" was a mock convenience: real notes run to paragraphs (the founder's are bilingual), and the caption landed as a wall of text across the photo. And the caption was already redundant by the time it shipped — it was designed when a feed card could open the viewer and the note might be unread, but the same-day entry-point revision above made step detail the only door in, so the note and date are always on the screen you came from. The viewer is for zoom; the caption was the last thing in it that wasn't. The bottom scrim stays for video only — it exists to keep the transport legible, and a photo now has nothing down there to keep legible.

Sign-up — "The first impression"

The product sells itself: miniature feed-card fragments (a live card, a stepped-with face-pile, a Journey-achieved chip) floating on the paper gradient, then the promise ("Every step deserves someone cheering") and the auth block — Apple / Google / Facebook / email OTP, no passwords. Matches the shipped auth stack.

The ink button belongs to the platform's leading provider, not to Apple (2026-08-08). The mock is drawn for iOS, where Apple takes the one ink fill and Google and Facebook are white cards behind it. Ported literally, Android — which has no Apple sign-in, and cannot have one without a web-redirect flow we do not ship — lost the anchor along with the button and showed three identical white cards with nothing leading them. So the ink treatment is positional: exactly one per screen, worn by Apple on iOS and by Google on Android. Google's own branding permits a dark button with the full-colour mark, so nothing is bent to do it.

Spare vertical room splits above the collage and below the promise (2026-08-08). The mock's canvas has 19px to spare and hands all of it to .auth{flex:1; justify-content:flex-end}, which is invisible at that size. A tall Android phone without the Apple button has ~101pt to spare, and all of it in one place tears a hole between the promise and the sign-in stack. Two anchors stay fixed — the wordmark 22 below the status bar, the job at the thumb — and the collage-and-promise block floats centred between them. On iOS there is ~0 to spare, so this is the mock unchanged.

Onboarding — "Become someone people can step with."

One screen, right after auth — the pitch already happened on sign-up, so this screen has one job: identity confirmation. Avatar (prefilled from the social provider, edit badge), name, and the emotional beat — the username row, where the public identity is born (the only live-accented element: "@chaucao is yours"). ToS/Privacy as the standard implicit line above the CTA ("Start stepping") — deliberate: implicit clickwrap adjacent to the CTA is the Instagram/Threads/TikTok pattern and is enforceable; a checkbox adds friction on the most drop-off-sensitive screen for no legal gain. Age gating is a separate question a checkbox can't answer anyway ("I'm at least 13 ☑" fails COPPA's neutral-age-screen principle by telegraphing the answer): the mock now carries the neutral birthdate field (2026-07-10 verdict, propagated 2026-07-11) — same fbox grammar, calendar glyph, and one privacy caption ("Never shown on your profile"); no threshold revealed, no age-gate language. Under-13 rejected and under-18-defaults-private happen server-side (auth_overview.md). No carousels, no permission asks; the follow-suggestions beat is V1 (promoted by the 2026-07-10 review verdict) — it earned its own mock on 2026-07-12 when the founder distribution ruling turned it into a selection surface, and from 2026-07-29 the explainer beat sits between the two.

Onboarding — what you're starting (onboarding-how.html, ruled 2026-07-29)

The one explainer beat, added because the concept was arriving nowhere: users come with Instagram priors (a post is permanent, a like is a like), and at this graph size nobody can learn by watching others. In a mature app the feed teaches the app; at n≈0 that burden falls on onboarding whether we like it or not.

The governing line: name the promise, never the arithmetic. The screen teaches two words and one fact — journey, step, and a step is live for 24 hours — and it is exactly THE core pitch's four beats in order (journey → window → remembered → look back). It says nothing about step-with mechanics, supporters, Companions, badges or thresholds, and no tier name may ever appear on it. Recognition is discovered, not operated: a user told the shape of the reward starts working out how to earn it, which is the failure the badge model exists to prevent. The presence line is a plain count of people, never a tier and never a prompt to act.

The example is real, not drawn. It renders the feed's own live-step component filled from the public API at display time, so it cannot go stale and cannot lie — show, don't claim, applied to the explanation of the product itself. Three honest states, all derived from the step's timestamp: live (countdown ticking, preferred), closed (full-quiet past card, past tense, people kept — not a degraded state but the remembered beat drawn instead of claimed), and no card (the parts list carries the screen alone, the "here is one happening right now" line simply isn't said). Nothing is padded to compensate for a missing card; a screen that pads when it has nothing to show is a lying onboarding. Caching an example is safe for the same reason — a stale card becomes a closed card.

Selection comes from the editorial seed pool (EditorialSeedAccountIds, the same list that pins the people beat), never a hardcoded founder account, so keeping the screen alive is a config list rather than one person's posting obligation. The example is the most recent step qualifying on either ground: published within the last week, or someone stepped with it, however long ago. Recency and presence each carry a step on their own — a quiet week still has something to show, and a day people turned up for never ages out (PO ruling 2026-07-29, relaxing the original live-or-attended rule). The 24-hour window is the feed's clock and too tight here: pinned to it, one missed day empties a screen every new user sees. Nothing looser than a week, because past that "here is one from earlier" stops reading as a living app and starts reading as an abandoned one.

Position (PO ruling): the people beat stays mandatory, so this sits before it — knowing what a journey is makes the follow list legible too. One way forward, no secondary link ("Next: find your people"). The authoring-first bias is honored by where the user lands after onboarding, not by reordering these beats.

Onboarding — people — "Start with your people" (onboarding-people.html)

The follow-suggestions beat as a selection screen (2026-07-12 — this is where founder distribution lives; the feed welcome module is retired). Rows are selectable (tap toggles a check; the button does the following) with activity/relationship reasons as captions, never follower counts. The founder is pinned first and pre-selected as an ordinary row — same avatar, selection control, and caption slot as everyone else; no banner, no special styling (caption: "Made Stepo · sharing the journey from day one."). The primary button is dynamic and explicit — "Follow N and continue" (zero selected → plain "Continue", creates nothing); "Continue without following" is visible and low-emphasis. Bright lines: the founder is always deselectable, nothing is followed before the button tap, exactly one account is ever pre-selected — force or silence turns strong onboarding into manufactured relationships. Pinning is driven by the EditorialSeedAccountIds config and switched off when growth escapes the founder's network; while on, the beat always has a row; with it off and zero suggestions, the beat skips silently. Flow: onboarding → what you're starting → people → notification priming → feed.

Onboarding — notifications — "The one shot at the prompt" (onboarding-notifications.html)

The last onboarding beat (after follow-suggestions, before the native iOS prompt). iOS grants exactly one native permission prompt, and Stepo's loop travels through notifications — mute-rate economics makes this the highest-leverage single screen in the app. The priming leads with the quietness promise, stated as evidence rather than negation (recast 2026-07-13, the no-claims copy rule): the exhaustive trigger list ("When someone steps with you: a heart, a comment, someone sharing your step. And when a journey you follow goes live.") closed by "That's the whole list." → "Only people." — plus one real push preview (Priya, verbatim anatomy from the spec board) as proof. Carbon CTA fires the native prompt; "Not now" defers into the engagement cadence below. Zero accent: onboarding is chrome, and orange never enters the chrome.

Engagement keys the re-ask, and it is a baked-in rule of the app (ruled 2026-07-31; no mock — this ruling is the spec). Stepo is a 24-hour-window product, so push is structural rather than promotional: without it a user cannot know a journey they follow is live, which means they are not experiencing the product at all. The two failure modes are asymmetric. Asking too often costs a sheet swipe: recoverable, bounded, annoying at worst. Never converting permission costs the user, permanently and invisibly. So the cadence leans toward asking, bounded only by what the OS makes mechanically pointless, instrumented end to end, and re-balanced with real cohort data.

A primer may show whenever the OS will still prompt and the cadence allows it. The gate is live OS state, never an app latch that stands in for it: iOS self-latches (after its one alert the state never returns to askable, so the cadence ends exactly where it becomes pointless), and Android allows a second prompt after a soft deny, which the cadence spends. A swipe-away re-arms the counters instead of closing a door forever. The one place the fired latch stays a state input is Android, which cannot tell "never asked" from "permanently denied" on its own — without that bit, fresh installs read as blocked before the native prompt has ever fired.

All sheets carry the canon sheet anatomy (grabber, Archivo w800 headline, muted body, ink CTA, muted "Not now" — publish_failed_sheet.dart), share a 5-minute cooldown, and a showing resets every counter. The sheet surface runs under the home indicator and the last row is padded clear of it, never a scrim strip beneath the card. One anatomy, four arguments. Follow starts at the 1st press: the first follow is where push value becomes concrete for a consumer, and making them follow twice before we mention it wastes the warmest beat. Publish repeats and ignores the cooldown — an author putting a live step unpermitted is the highest-stakes miss in the app, every time, and it self-selects to people who have published. The publish sheet leads with the window because that is what makes the ask honest there: the step is live for 24 hours, support only counts inside that window, and an author who pockets their phone cannot know their own window is running. Zero accent throughout, same as the beat they repeat. The app never calls the OS from an app-open path; a primer the user taps through is the only thing allowed to reach it.

Blocked users still get one door, and it decays. Once the prompt is spent a tap-through can only reach system settings, so the same triggers convert to a settings-variant sheet ("Notifications are off for Stepo." / "Turn on notifications in Settings, it takes ten seconds." / Open Settings) at one per session, first trigger wins. On iOS that variant is the entire long tail of the system, so excluding it would quietly end the cadence at the first soft "no". A blocked user has already answered at the OS level, though, and every-session-forever is how an app earns "it won't stop nagging" reviews — so after three consecutive dismissals the rate drops to one per seven days, and any tap-through resets it. What makes that variant honest is the resume repair: a grant made in system settings is picked up the moment the user returns, rather than at the next process death.

Every showing and every outcome is captured (notif_ask_shown / _accepted / _deferred / _os_granted / _os_denied, each carrying surface, variant, counter value and session number). The cadence was set on judgment; the first real cohort judges it back. What stays untouched: the never-send list and the push trigger matrix (what we push is a separate promise from how we ask), the onboarding beat, and the passive settings banner.

Create journey — "What are you starting?" (1 of 2)

Journey creation is a two-screen flow per the spec (details → first step, one backend transaction — a journey can never exist empty). Screen 1 is nearly all typography: the title field IS the serif preview — your words render in large Fraunces italic as you type, the moment the authored voice is born. Description optional; no privacy toggle (journey visibility follows account privacy — a quiet caption says so). CTA: "Next: your first step".

Create first step — "Day one, documented." (2 of 2)

The marigold composer. Journey context is a locked chip (no picker — the journey was just named); the photo lands already wearing the first-step marigold ring it will carry everywhere else. One rule-teaching chip ("People who step with this in its first 24 hours become your Starters"), then the marigold CTA with a full 24h ring glyph — "Live for the next 24 hours."

Create step — "Add to the story."

What the tab bar's [Step] FAB opens. Journey picker row on top (defaults to the most recently stepped ongoing journey, "this will be step 15"), with "+ Start a new journey instead" linking into the journey flow. Media + caption, then the screen's single rose element: the "This is the final step" toggle — enabled (the journey is past the 5-step minimum), off, with the Achievement/Celebrator teaching sub-copy. Tangerine CTA with the full 24h ring. Marking a journey achieved IS posting a step — the toggle renders the spec's two-part action as one gesture.

Publishing — "The step goes live." (ruled 2026-07-13; no mock — this ruling is the spec)

The screen after the composer's CTA, while media uploads and the step goes live — the author's biggest beat in the loop, and it was never designed (the app shipped a pre-ultimate mechanical upload page: black scrim, giant percentage, square progress frame, red error type, shimmer "Uploading...", a disabled Done — and an instant pop on success that reads as a flash when the upload is quick). The ruling: one continuous moment, two phases, on the real card.

• The card is the feed card — the step renders in the exact grammar it is about to wear in the feed (reuse the step-card widget; one grammar, never a bespoke preview layout). Watching your own card become real IS the preview.
• Phase 1 — uploading: the media sits under a thinning carbon scrim that maps upload progress (the old page's one good idea, kept), a centered "Publishing" status beside a live spinner, and a progress bar with a visible track. No percentage type, no square frame, no app-bar shimmer. The rest of the card — countdown ring, 24h window, the three actions — renders in full below the media the whole time, so the author sees the real card immediately; the card is inert (nothing tappable) because publishing is not a place to navigate away from. The status word and spinner exist because the earlier lone thin line read as frozen to testers while the first bytes were still going up (added 2026-07-16).
• Phase 2 — ignition: on success the media goes live on screen — the scrim lifts and the live chip ignites (the feed's own live treatment, arriving for the first time) over the photo, while the chrome that was already present simply holds — then one readable beat, then auto-dismiss to wherever the flow already lands. No button, no tap; like the acknowledgment toast, the moment plays and leaves.
• Minimum dwell: the moment has a floor so it can never flash — if the upload beats the animation, phase 1 stretches to the floor before ignition (~1.8s total feel, ignition beat constant ~1.2s). A slow upload runs phase 1 as long as it needs; ignition never varies. The floor is theater and it is honest theater — the step IS going live; the screen just refuses to mumble it.
• Failure: the ruled "Your step didn't post." sheet (states-error panel 03) is the only error dressing — the in-page red headline dies; retry re-dims the same card. Ink and muted, never red.

Step sheet board (step-sheet.html — a spec board, not a screen; 2026-07-13)

The step's overflow sheet ("···"), ruled after the shipped legacy sheet surfaced two dead taps and a doctrine violation. Core stance: a sheet earns its rows. Your regular step: Share · Mark/Remove milestone (with the ruled footnote "Marking is quiet — nobody is notified.") · Delete step in danger ink. Someone else's step: Share · Report step (ink, not danger — protection isn't danger; and never "Report post", Stepo has steps). CUT from the legacy sheet: "Edit step" (a dead tap — no designed edit flow exists; parked for its own future ruling before anyone re-adds it) and "Turn on notifications for this step" (dead tap AND spec violation — the notification doctrine has no per-step subscriptions and never will; notifications announce people, not mechanics). Delete confirm: Archivo headline, one honest consequence sentence ("It goes right away, for everyone — along with its hearts, comments, and step-withs."), styled --danger CTA "Delete step" + muted "Keep it" — never the legacy inversion where the primary button said "Cancel". Deleting a final step returns the journey to ongoing; badges already earned stay (badges are permanent, ruled). Danger ink --danger #B3322E only, never rose. Governing line: the sheet is a tool tray, not a feature list.

Edit step, and the record it leaves (step-sheet.html; 2026-08-09)

The 2026-07-13 board cut Edit step as a dead tap and parked it "for its own future ruling before anyone re-adds it." This is that ruling, and it re-adds the row with a second one beside it.

Only the note is editable. Not the media, which is authored once through one window and never re-cropped after the fact; not the journey it belongs to, not its kind, not its hour. So Edit is a text surface — the composer's note field with the step's words already in it — and never a second pass at the composer. A typo, a sentence that came out wrong, a name spelled properly the next morning: that is the whole of what this door is for.

A step that changed says so, to everyone. The sheet carries an Edited row for every viewer, not just the author, showing when the note last moved; tapping it lists every edit time, newest first. A step is written to people who then heart it, comment on it, and step with it, and words that move after that arrive somewhere other than where they were answered. The reader is entitled to know that happened.

What is never kept is the replaced text. The record is the moment, and only the moment. Knowing the words changed is what a reader needs; reading a sentence its author withdrew is not something anyone is owed, and storing it would make a permanent second copy of writing someone chose to take back. We show that it moved, never what it used to say.

Two things are not edits: marking or unmarking a milestone, which sends the same note back untouched, and a save that changes nothing. Stamping "edited" on a step whose words nobody touched tells every reader something untrue about its author.

Ink: Edit is ink, and so is Edited. Neither destroys anything. Rows, in order — your step: Share · Edit step · Edited · Mark/Remove milestone · Delete step. Someone else's: Share · Edited · Report step. The Edited row is absent on a step nobody has edited, which is nearly all of them, so the tray does not grow a permanent empty seat: the sheet is a tool tray, not a feature list.

Taking a step-with back (step-with-sheet.html — a spec board, not a screen; 2026-08-10)

A supporter mis-tapped an un-heart and lost the step-with behind it. The heart is a toggle everywhere in the app, and on almost every step it can be pressed twice with nothing lost; on one kind of step it cannot, and nothing in the interface said so. This is the ask that catches it.

It fires on the condition, never on the act. Only the tap that would end the step-with raises it: the heart, or the comment delete, when no other act of that person's is still holding it. A step-with is one fact per person per step, carried by the step's heart, the step's share, or a top-level comment; a heart on a comment never carries one. So un-hearting a step you also commented on is silent, a late heart is silent, your own step is silent, a comment heart is silent, a reply delete is silent. Six taps that remove something, one that asks. The rarity is the guard: a sheet that fires when nothing is at stake teaches the thumb to dismiss it unread.

In the window and past it, both (PO ruling, 2026-08-10: "we should warning no matter what as accident can trigger a badge"). The earlier reading, that an in-window withdrawal is free because it can be re-earned, was wrong on the arithmetic: pulling the act takes the step out of both sides of the coverage ratio and the membership engine re-runs on the spot, so a Companion can fade in the same frame, silently, by design. On a first step it also recomputes whether the person was a starter, moving them between the 70/60 and the 90/80 lines. Recoverable is not the same as harmless when nothing announces the loss.

One anatomy, two states. Same sheet, same two buttons; the window swaps one sentence, the ring and the caption. Live: the step thumb wears the --live ring and the caption counts the hours left, and the copy ends "You can step with it again while it is live." Closed: no ring, the caption dates the close in words, and the copy ends "Its 24 hours are over, so this one cannot be put back." That clause is the only thing separating the harmless tap from the permanent one, so it is the only thing that changes. A context row (thumb, journey, window state) leads the sheet, which no other confirm carries: every other confirm answers something you asked for, and this one arrives out of a mis-tap, so it has to name what it is about.

Keeping is the styled primary, and this is the only place that inverts. The step-sheet ruling puts the destructive verb on the styled primary and never hides it beside a big Cancel, and that is right wherever it applies. The distinction: a confirm honors an act you chose, so the chosen verb leads; this sheet catches an act you may not have chosen, so keeping leads. Swipe, scrim and back all mean Keep it. The quiet way out never destroys anything. Delete step, delete journey and delete comment are untouched.

Recognition is never quoted. No percentage, no "you will lose your badge", no meter. The fade is silent by design and predicting it at the moment of a tap hands people a number to play with. The sheet speaks about the step's record, which is the part a person can see. It does mean withdrawing a heart on a first or final step also ends a Starter or Celebrator, since all three read from the same step-with, and the sheet is what makes that deliberate rather than accidental.

The comment door keeps the delete grammar. It already confirms, and a chosen Delete keeps its styled danger primary; it gains one added sentence when that comment is the last thing holding the step-with, and no stacked sheet.

Nothing moves until the answer. The heart stays filled behind the scrim and the count never flickers, so there is no optimistic un-heart to walk back. And the client is never left to derive the condition: the rule for what carries a step-with lives on the server, which answers it as heartHoldsStepWith and holdsStepWith (interactions_overview.md).

The comment sheet, and what a comment may take back (comment-sheet.html — a spec board, not a screen; 2026-08-10)

A comment was the only thing in Stepo a person wrote and then could not touch. The step it hangs under can be edited and deleted; four words underneath it could not be. The sheet that should have held those doors shipped Reply · Report · Hide, and two of the three did nothing when tapped — the same defect the step sheet was ruled over in July, sitting one surface away. This gives the comment the doors its step has, adds the one every reader reaches for, and clears the dead rows out. Governing line: you can take back a whole step, so you should be able to fix four words.

The step's edit ruling holds here word for word. Only the words are editable — not the step it hangs under, not its time, not who wrote it. A comment that changed says so, to everyone. And what is never kept is the replaced text: the record is the moment, and only the moment. A save that changes nothing is not an edit and stamps nothing.

Editing never moves the clock. A comment carries its step-with from the moment it was posted, and an edit does not touch that: one written at hour two keeps its step-with when it is fixed at hour thirty, and one written at hour thirty never gains one by being edited inside a later window. Otherwise Edit would be a way to buy a place among the people who were there, and the guest book would stop being a record of who showed up. Edit changes the words. It never changes when you said them.

Edited is said on the row, not behind a row. The step keeps its edit record behind a sheet row because a step is a large authored thing edited over days; a comment is one line with a timestamp already on it, so the honest place to say the words moved is beside the time they moved: 2h · Edited 20m ago. Two times, because they are two different facts — the first is when this person showed up, which is what the 24 hours turn on, and collapsing them would quietly restate the arrival. Faint ink, everyone sees it, and it is not a door: there is nothing behind it to open. The Stepped with chip is untouched by an edit, because the arrival was not.

Rows run harmless to permanent. Your comment: Copy text · Edit comment (footnote "Everyone will see that it changed.", because a person fixing a typo at midnight is entitled to know that before the tap) · Delete comment in the sheet's only danger ink. Someone else's: Copy text · Report comment in ink, since protection is not a destructive act. A reply of yours gets the same rows; nothing about a reply differs except what its delete confirm says.

Copy text, and it says so. It leads both sheets because it is the lightest thing in them, and it is the more useful row on someone else's comment — your own words you already have. It is named for what lands on the clipboard rather than for the object, because "Copy comment" is the phrase every other app uses for a link; the precise label beats the consistent one when the consistent one would mislead. This is the app's first clipboard action, and it carries one requirement: a copy that says nothing is indistinguishable from a dead tap, which is the defect this whole board exists to clear. The sheet closes and a quiet "Copied" confirms.

Editing is the composer, already filled. No screen, no modal, no second pass at anything: the composer waiting at the foot of the thread fills with your words, the send glyph becomes a check, and a plain Cancel sits where the prompt was. The live hint the composer normally carries ("Commenting now counts as stepping with…") is replaced while editing, because it is not true of this act.

Delete keeps the delete grammar. Step-sheet panel-03 exactly: an honest sentence and a styled, labeled danger primary, because the person chose Delete from a tray. It gains one added sentence when this comment is the last act holding their step-with — "It is also the only thing keeping your name among the people who stepped with this step" — and the final clause "and its 24 hours are over" only when they are. Never a stacked sheet: the heart raises its own ask because that tap is a toggle someone may have hit by accident, and this one is a chosen Delete. The server answers whether the sentence is true, as holdsStepWith; replies never carry it. Deleting a comment leaves the hearts other people put on it alone.

Cut: Reply (a dead tap, and the comment row already carries a Reply button) and Hide (a dead tap; there is no hide feature, and blocking lives on the profile where the whole relationship is). Two rows is a finished sheet — the sheet is a tool tray, not a feature list.

Profile sheet board (profile-sheet.html — a spec board, not a screen; 2026-07-27)

The profile's overflow sheet ("···" on someone else's profile), drawn after App Review put the safety surfaces under the lamp. profile-other.html had always described this sheet in a kebab comment and pointed at report.html; the sheet itself was never drawn, so the app shipped it in a second, drifting row grammar (OptionWidget: 48px pill rows, 17px regular labels, asset icons). Rows: Share · Report profile · Block, and no row was cut or added — this sheet had already earned all three. There is no owner variant: your own profile carries the settings gear instead. Anatomy is step-sheet.html verbatim, now from one shared component (SheetRow/SheetRows) rather than two copies.

The new ruling is about ink: Report and Block both stay ink. Danger ink marks irreversible destruction, and neither destroys anything — reporting protects someone, and a block is lifted from Settings › Blocked accounts. The block confirm therefore takes a carbon primary, not danger, and its copy states the way back: "You stop seeing each other's steps and journeys, and any follows between you are removed. You can unblock in Settings, but the follows will not come back." That last clause is the honest part — unblocking does not restore severed follows. The legacy body claimed blocking stopped someone tagging you; Stepo has no tagging and never has. Copy on a safety surface must be checkable against the code.

The moderation tray, and the ban ladder (profile-sheet.html §04-06; 2026-08-09)

Admin mode ruled "one surface, rows cut by role" and parked which actions a moderator keeps until a moderator existed. One does, so: an account carrying a role sees the visitor sheet unchanged, with a labelled Moderation section appended. The section header earns itself here even though section 01 rules that three rows need no chapters — Block and Ban sit inches apart and mean entirely different things, one personal and one the platform speaking, and a moderator who confuses them at speed does real damage.

The ban ladder is the safety model. Risk arrives faster than certainty, so the tray is shaped to let a moderator stop harm before they are sure: (1) something looks risky → Ban this person, which is the quiet ban — the account keeps working from the inside and reaches nobody from the outside; (2) read the reports, look at the account, no rush; (3a) it was fine → Lift the ban, and the person was never told; or (3b) it was not → Ban them for good.

Step 1 costs nothing to be wrong about: nothing is destroyed, no session is killed, no file leaves the CDN, and lifting restores the person exactly as they were. That is what makes it safe to be fast. Step 3b closes the session and permanently deletes every photo and video the account uploaded, which is the right answer to an account farm and a terrible thing to reach by accident on a product whose promise is looking back. So Ban them for good and Remove everything they made appear only on an account that is already quietly banned. The destructive act is never one tap from a profile; it is one tap from a decision already made. Fast where it is reversible, slow where it is not: the ladder is the safeguard, not the distance.

Ink follows from that and does real teaching work: standing in front of a working account a moderator is offered no danger ink at all, because everything on offer can be taken back. The one ban row is state-aware, reading the account's real standing before it draws itself, and once banned its footnote carries what you need in order to reverse: when, who, and why. The ban confirm states the consequence in the account's terms ("They keep their account and can still post. Nobody else sees them or anything they make.") rather than the system's, and its reason field is required on the client because it is required on the server — a ban with no stated reason is a ban nobody can review later. Lifting asks once and argues nothing: restoring access is the safe direction. Every action writes an audit entry. Nobody bans themselves, and no moderator acts on staff at or above their own tier.

Step people board (step-people.html: a spec board, not a screen; 2026-07-15)

Partially superseded the same day by "The step guest book opens" (below): the list is now PUBLIC (viewer-filtered, window-only, equal grid) and the presence line is tappable for every eligible viewer and counts window step-withs only. The owner's detailed sheet specced here (sections, glyphs, timing, late records) is unchanged and stays owner-only — it is the third layer.

Who interacted with a step, and who gets to see it. Ruled from the PO's question ("Threads shows every likers list, X shows reposters; what do we show?") plus the follow-up that made it better: fold the step-with list and the hearts list into one surface. Original stance (see supersession above): the owner keeps the guest book. Hearts, comments and shares stay public as counts; the per-step detailed record is owner-only. It is one list of PEOPLE, not three lists of acts: a person appears once, their heart/comment/share as small ink glyphs on the row, and the 24h window does the organizing it does everywhere: "While it was live" (arrival order, tiny time captions like "1h in": the book reads as the day unfolded) then "After it ended" (factual, never guilt; late support is valued). Entry point is a presence line under the step detail's interaction bar: three overlapping faces + "Maya, Linh and 5 others have been part of this step." (the ruled presence-line vocabulary: a count is a memory). Owner gets a chevron and the tap into the sheet; a visitor sees the identical line flat, display-only: faces and numbers for everyone, browsable lists owner-only, the exact Badges/Supporters grammar. On a live step the line runs present tense ("Maya and 2 others are stepping with you.") and the book fills top-down while the window is open; the "After" section is born when it closes. No empty state exists: the line renders only once someone has interacted. CUT: a public browsable likers list (turns hearting into performance and exposes a third party's activity to strangers; the visitor's answer is the journey People page, which answers with roles, not audits) · tier chips inside the sheet (recognition lives at the journey level; this sheet remembers one day) · per-person tallies, ranks, or any N-of-M (a memory, not a leaderboard) · a separate "step-with list" (any heart/comment/share in the window IS the same fact) · the owner's own rows (the book remembers who came, not the host). Supersedes the hearts-list-only sketch from the same table session. Build shape when queued (fast-follow, not submission scope): one owner-gated GET /api/v1/steps/{stepId}/people returning window-grouped people with act flags + timestamps; today no list endpoint exists at all (GET /steps/{id}/interactions returns only the viewer's own status). Governing line: the owner keeps the guest book; guests never audit each other.

Visitor doors open — unranked, viewer-filtered (PO ruling, 2026-07-15)

Refined the same day by "One interface — ownership is a module" (below): the separate visitor screens became the visitor STATE of the one Badges / Supporters page (shared list + owner-only module), headlines pronoun-swap. The visibility rule, no-toggle, and permanent ranking privacy all stand.

Overturns the round-4 deferral: both profile doors are now tappable for visitors and open unranked, viewer-filtered relationship lists by default. Rankings stay permanently owner-only. No hide toggle, ever. The PO's bright line, now canon: "Linh supported Maya" is ordinary social context; "Linh supports Maya more than everyone else" turns affection into competition. The flat list is what likers and reposter lists are on other platforms; the podium is what no platform shows, and ours stays private gratitude. Why the deferral fell: a door displaying counts and faces but refusing the tap is a dead door: it says the relationships matter, then withholds the relationships. It also cut discovery and suppressed Stepo's most distinctive profile dimension, identity through kindness. Sequencing must not shape the product model; this is the intended final design, promoted from deferred.

The visibility rule (viewer-aware, one rule everywhere): a visitor sees only relationships whose underlying journey AND participants are visible to that visitor. Public relationship on a visible public journey: shown. Followers-only: shown only to eligible followers. Only-me or inaccessible journey: completely absent. Blocked either direction: absent (indistinguishable, per the block canon). Private or under-18 supporters: never aggregated into a stranger-facing list; eligible followers may see them. The filter's two questions are distinct (build articulation, 2026-07-15, ratified): access — a minor's public step is ordinary content anyone with the link may read — versus aggregation — being readable is not being gathered up and shown to strangers. Door counts and facepiles are computed from the same visible set, so numbers never leak hidden relationships; two viewers may see different door numbers on the same profile, by design (the same honesty property as private-indistinguishable-from-deleted). A door whose visible set is empty for this viewer stays flat and does not tap (no empty state, same grammar as the step presence line). An interaction stays visible in its permitted journey context even when excluded from a stranger's aggregated list: contextual privacy, not erasure.

Why no hide toggle (affirmed): account visibility and journey audience already express who may see a relationship; the profile owner cannot consent on behalf of supporters; default-visible plus optional hiding means visible for almost everyone; and hiding creates a social signal that punishes exactly the people it meant to protect. Less exposure comes from the real privacy layers, consistently everywhere.

Design-authority fill-ins (mine, contestable): the visitor pages are headlined in human language, not door labels: "People {name} showed up for" (Badges Earned) and "People who showed up for {name}" (Support Received). Row grammar: person-first, face + name + earned role chips + visible journey context in relationship language; a person spanning several visible journeys collapses to one row ("and 2 more journeys"); no step-with tallies, no per-row counts, no engagement ordering. Ordering is recency of the most recent visible step-with, newest first: time is a fact, not a measure of affection. Facepiles show the first faces of the same visible set in the same order. Owner pages are unchanged; the supporters tripwire contract stands (supporters still never see a rank, anywhere).

Build shape: the filter framework must be viewer-aware from day one; at launch it evaluates account-level visibility and inherits per-journey audiences when they ship (the effective-audience rule, min(account, journey), already spec'd in journeys_overview). Mocks: badges-visitor.html + supporters-visitor.html, plus profile-other.html doors gaining the tap affordance. Governing line: counts and faces are everyone's; the list is browsable; the ranking is the owner's alone.

The step guest book opens (PO ruling, 2026-07-15, same day)

Refined the same day by "One interface — ownership is a module" (below): the public book gained the After section (no longer window-only), and the equal grid was replaced by one row-based sheet for everyone (owner ink: glyphs + times). The layers, the visibility rule, and the never-rank lines all stand.

Overturns the owner-only list ruled hours earlier on the step-people board. The PO's motivating image: being able to see who stepped with the first step of what later became something enormous — the Tesla-first-step lookback. "Showing up gets remembered, but only the author can see the memory" contradicts the core pitch's look-back beat. The design authority's own reason for conceding, recorded for calibration: window presence was already public for the steps that matter most — Starter and Celebrator are public roles on the journey People page, so the owner-only book protected a secret the product had already published for first and final steps, hiding it only for the middle ones. Opening it makes the model consistent. New governing line, replacing the old one: everyone can remember who was there; only the owner can inspect how they showed up.

Three layers, three questions:

The public guest book: anyone eligible to see the step may open its viewer-filtered step-with guest book. While live, entry language is "People stepping with this" and the book grows as people step with; after the window closes it becomes "People who were here" and stays permanently browsable as part of the step's history. Contents: window step-withs only. It shows face, name, and a tap to the person's permitted profile state. It NEVER shows: which act the step-with came from (heart/comment/share), arrival times or "1h in" captions, chronological position, ordinals or ranking, per-person interaction counts, recognition roles or Companion tiers, or late interactions presented as step-withs. Layout is a face-forward equal grid, visibly non-ranked.

Design-authority refinements (stood ground on two codex suggestions): (1) NO relationship sentences in the public grid — equal faces mean equal rows, and a sentence re-differentiates what the grid exists to equalize (codex's "optionally one quiet sentence" declined; sentences belong to the profile visitor lists, where the durable relationship is the content). (2) Pagination order is a stable per-step shuffle — deterministic so pages don't jump, unreadable as arrival order or contribution (alphabetical declined: an alphabet is a register, a shuffle is a crowd).

The presence line, revised: it now counts window step-withs from the viewer's visible set only (same-set integrity with the book behind it — late hearts no longer inflate the line) and is tappable for every eligible viewer, not just the owner. Live: "Maya and 2 others are stepping with you." (owner) / "Maya and 2 others are stepping with this." (visitor). Closed: "Maya, Linh and 3 others were here." The line still renders only when the viewer's visible set is non-empty. The owner's tap opens the detailed book; a visitor's tap opens the public grid.

The owner's detailed book is unchanged (the step-people board's sheet): While it was live / After it ended sections, act glyphs, arrival timing, late-support records — the audit-capable surface, owner-only, subject to deletion/block rules. Late support stays valued: it counts in the interaction counts, lands in Activity, and appears in the owner's After section — it never enters the historical guest book, because the 24h distinction stays consequential.

Visibility and count integrity mirror the visitor doors: step and journey must be visible to the viewer; blocked either direction, private-to-strangers, and under-18 participants are excluded from stranger-facing lists (eligible followers may see them); line number, facepile, and grid all compute from the same visible set; two viewers may see different counts.

Build shape when queued: public GET /api/v1/steps/{stepId}/people (viewer-filtered window step-withs, stable-shuffle order, paginated) + an owner-gated detail variant carrying act flags, timestamps, and the late section. Mock: step-people.html reworked to this model (public grid panels added, presence line and counts revised, governing line replaced). Steps carry no ordinal anywhere user-facing (the board's original "Step 12" was mock flavor; the sheet's context line is the journey title alone), and time captions in the owner's book use timezone-honest phrasing ("the next day", never "the next morning": a daypart needs the owner's timezone to be true).

One interface — ownership is a module (PO + both advisors, 2026-07-15)

The PO challenged the day's own output: owner and visitor were getting two different rooms for one feature (public grid vs owner ledger; visitor list pages vs ranked owner pages), and the accumulated hiding was drifting toward "tasteful but lifeless." Both advisors converged independently on the same law, now canon:

One feature, one interface. Privacy removes ink; it never replaces the room. Ownership adds a private module, never a different screen.

Owner and visitor see the same hierarchy, language, sections, and row design. Applied:

• Guest book, one sheet for everyone: context, "While it was live", "After it ended", the same person rows (face + name, tap to profile) in both states. The After section is public now (supersedes the window-only public book ruled earlier the same day): late comments were already publicly attributed, so hiding late hearters protected little while making the visitor's book disagree with the public heart count; a public After section reconciles the numbers visibly, remembers late kindness for everyone, and makes the window's consequence publicly legible on every step. Late support sits in its own section, never presented as step-with. Owner-only ink on the same rows: act glyphs, time captions (and future moderation affordances). Visitor rows are shuffled within each section (arrival order stays owner-only). The grid dies; rows for everyone.
• Badges Earned / Support Received, one page each: headline pronoun-swaps ("People you showed up for" / "People Lena showed up for"); below it ONE shared list component for owner and visitor alike — unranked person rows, role chips, journey context, relationship sentences, recency order. The owner's ranked detail collapses into a private module above the list: Supporters gets the podium (crown, most-present, deeper counts — the gratitude moment and its tripwire survive whole); Badges gets a quiet given-summary (raw tallies remain caption language). Even the owner's list below the module is unranked — the podium was always the payoff, not the ranked ledger. The separate visitor screens (badges-visitor.html, supporters-visitor.html) become the visitor STATE of the one page, not sibling designs.
• The narrow restriction list, complete: no public ordinal affection ranking anywhere; no acts or timing for visitors; no progress meters; no leaking through totals (same-set integrity); no recognition chips inside the guest book. Everything else is open, browsable, permanent.
• Build shape: the endpoint splits collapse into one viewer-aware endpoint per surface — owner-only fields (act flags, timestamps, module data) are null for visitors. One contract, one widget, density by viewer. /people/record retires.

The openness correction, recorded: the app's public set is now live windows, counts, doors, browsable support graphs, permanent guest books, and the crawl loop they form (book → face → profile → doors → journeys → books). What stays private protects engines, not feelings: public affection rank makes support strategic; behavioral audit makes watching creepy; meters make recognition grindable. Governing line: one expressive surface; hide only the private elements, never the experience.

Peaks public, ladders private (final ruling, 2026-07-15)

The PO's original vision (archive explorations: stat bands, per-badge counts, top supporters, ranked drill-downs) returned to the table with the KOL/startup-journey case; codex argued for a fully public ranked Support Received (complete ordered list, exact counts, "You're #18"). Final ruling, standing between both: peaks are public, ladders are private, and your own place is yours to see. Conceded on merits: a private Top Supporter card cannot make anyone want to become Top Supporter (motivation requires visibility), and unique-step counting is an honest metric of exactly what Stepo celebrates. Held: the complete public ladder adds no motivation beyond summit + own distance; its only marginal product is the shame floor, which lands hardest at friend scale (no crowd to hide in at N=9), where Stepo's entire launch graph lives.

Support Received (IA: headline → stat band → podium → your standing → filters → rows): the podium goes public: top three, faces, exact unique-step counts (overturns "rankings permanently owner-only"; a summit is celebration-shaped, a credits roll). Each supporter sees their own standing privately ("You've stepped with 9 of her steps · #7 of 23"): rendered only to that viewer, so the climb is legible while the ladder between is never published. The shared list stays unranked (recency); the owner keeps the complete ranked list behind their module (the private stats room: the original vision, intact). Stat band for everyone: people · step-withs · tappable Starter / Companion / Celebrator counts that filter the list. The supporters list includes step-with-only people (neutral Step-with chip, no badge): the door counts badges, the list counts people, and the two are different honest facts.

Badges Earned: public totals (badges by type, step-withs given as caption), tappable category filters, and "Shows up most for" restored as a public identity section (a peak in the giving direction: it flatters the strongest relationship without ranking the rest). No outward ranking of the full list, ever: numbering whom you love is publishing a hierarchy of friendships. Owner's full outward record stays in the private drill-down.

The private stats room is mocked: stats-room.html (Supporters variant; the Badges variant, "Your full record", is the same composition with giving-direction data). Owner-only drill-in behind both pages' "Only you see this" rows: the complete ladder with rank ordinals and exact unique-step counts, ties sharing a rank (5 · 5 · 7 demoed, tied ranks in ink, never accent: a tie is a fact, not a moment), step-with-only people included at the bottom, filters that never renumber, and the pull-only rule as the footer whisper ("Standing is yours to look up. Stepo never sends it to you.").

Guardrails (canon, all of them): standing counts unique steps only (one step-with per step; comments cannot farm); no act weighting; ties tie; no "2 more to overtake Linh"; no rank-loss or overtake notifications; no progress bars, multipliers, or prizes; everything viewer-filtered; no hide toggle; and standing is pull-only: you look it up, it never notifies, never pushes, never lands in Activity. The moment Stepo prompts the grind, it has built the thing the doctrine forbids.

Doctrine amendment, admitted openly: identity mechanic #3 narrows to "Badges are discovered. Standing is a visible consequence of showing up: peaks are public, ladders are private, and Stepo never prompts the grind." The supporters tripwire stays live with a pre-registered retreat: comparison language, rank-defense behavior, or mute-rate degradation at friend scale in beta collapses the podium back to owner-only. Calibration note: codex reversed its own round-8 position (public rank "changes optimal behavior") within a day of the PO stating the vision; the concessions above were made on merits, not on the reversal.

The live prompt is visitor copy (2026-07-15)

The live ring prompt ("Heart, comment or share in the next 22 hours and you've stepped with Chau") is conversion copy aimed at the step's audience — and the spec has always excluded your own steps from step-with. Shown to the owner it invites an act the system will not count, on their own step, by name. Ruling: the prompt never renders on your own step. The owner's live step detail carries the live chip, the countdown, and the presence line; the invitation belongs to everyone else. (Surfaced by the guest-book build: the new presence line sits directly under the prompt and made the false invitation obvious.)

Addendum, 2026-08-09. Not rendering the invitation is not the same as leaving the line empty. The author's own line — "While it's live, anyone who hearts, comments or shares steps with you." — describes what other people can do, so it never invites the author into an act that will not count, and the ruling above holds. It used to appear only when the row would otherwise be blank, which inverted the intent: the moment somebody stepped with you, your own card lost its second line and went back to one line beside a ring twice its height. The band beside the ring always carries two lines: the audience's invitation, or the author's read of the same window.

The stepped-with line finishes its sentence (2026-08-09)

The live card's l1 — "{first} and {count} others stepped with {author}" — names two people and says the one mechanic the product is built on. It sits in a ~194dp column: the card's inner width less the 56dp ring, the gap, and the stack of faces.

The sentence does not fit one line, and cannot be made to. Its invariant skeleton alone, " and 9 others stepped with ", is wider than the column before either name is placed. So a one-line clamp never shortens this line, it amputates it: what survives is the part that varies (a name) and what is cut is the part that carries the meaning (the verb, and who it was done for). Real cards read "Tina Nhi Nguyen and 9 othe…" and "Chau Cao and 3 others step…" — faces, a name, and no mechanic. Ruling: l1 wraps, capped at two lines. feed.html already ruled this and was simply not read: it sets no nowrap and no clamp, and both of its example cards render this row 32px tall, which is two lines of 13px. The step page and the chapter card allow two. The feed card was the outlier.

On height, since the feed card is already tall. The row is max(ring 56dp, text column). Measured on device against a fixed media anchor: on your own live step the wrap costs nothing — the action row and the card's bottom edge land on the same pixel either way, because the column stays under the ring's 56dp. On a visitor's card, where the prompt sits under it, the column crosses that floor and the card grows 9pt. That is the price, stated plainly, and it is the right way round: a card is long because of the media it carries, and buying 9pt back by deleting the verb from the only sentence that explains the product is not a trade.

(The author's card then spends 13dp of its own on the second line the addendum above restores. Different decision, same band, and worth separating: the wrap buys back a sentence that was being destroyed, the second line buys a balanced block.)

The general rule this is an instance of. When a sentence must truncate, the invariant belongs where it survives. A line that ends in a name degrades to a shorter name; a line that ends in the verb degrades to nonsense. Any future one-line sentence in this app gets read against that before it ships.

Recognition row sentences — one template per tier (2026-07-16)

The Round-3 build surfaced that the recognition-page rows had ad-hoc sentences: the same tier phrased three ways across mocks, and several sentences claiming moments the tier definitionally excludes (a Die-Hard Fan row saying "there when it began and celebrated the finish" — a Die-Hard Fan by definition missed both). Ruling, two parts:

A sentence is the tier's definition in memory language. It states exactly the moments the tier includes — never more, never fewer. Collapsed chips make this load-bearing: the chip absorbs its constituents, so the sentence is where the absorbed Starter/Celebrator facts remain visible.

One template per tier, both directions and both page states (J = journey title; badges pages prepend the subject, "You" for the owner / first name for a visitor, with verb agreement; supporters pages render subjectless because the subject is the row's person; the caller's own row uses "You"). Sentences name the journey only, never the viewer — so a row's public ink is byte-identical for every eligible viewer, which is the one-interface invariant made testable:

Repetition between adjacent rows is the truth of a templated system and is fine. All six recognition mocks carry these lines.

Superseded in form by "One Companion, no ladder" (2026-07-24): the four tier names are retired, and the table above is now the output of a generative rule rather than a lookup — one clause per fact held, joined beginning → through → finish. The ruling's intent survives intact and is strengthened: a sentence claiming a moment the person did not have is no longer forbidden, it is unconstructable.

Vietnamese voice (ruled 2026-07-16; first locale wave shipped same day)

Stepo's vocabulary is meaning-bearing common words carrying the journey metaphor, not coined proper nouns, so it translates. The keep-English test (all three must hold): genuinely a proper noun or deliberate global surface name; translating loses more identity than it gains; sounds natural inside Vietnamese speech. Stepo passes, and so does Live — added by the 2026-08-08 window ruling above, on the same grounds the badge titles hold: Vietnamese borrows it whole from "live stream", so it is a proper noun in every locale. The chip reads "Live"; sentences read "đang live".

The framework, proven across 751 keys:

• Translation is sentence-level, never substring substitution.
• The mechanic verb never varies: wherever English names the step-with act, Vietnamese says "bước cùng".
• Presence language varies where English varies: có mặt (a moment), ở bên (emotional memory), đồng hành (relationship over time). "Đồng hành" carries the Companion relationship in prose and never names the step-with act.
• Badge titles are proper nouns and stay English in every locale (ruled 2026-07-31): Starter · Companion · Celebrator, on the rank-title model. One badge, one name, wherever a person reads it. The prose around a title is fully localized and still teaches what the title means ("Có mặt ở bước đầu tiên của ai đó, bạn là Starter của hành trình ấy"). A title never takes an English plural inside a localized sentence: Vietnamese uses a classifier or the bare title, "một Starter", "các Companion". Titles appear in mechanic-teach sentences (as English canon does) and never in memory-row sentences.
• Register: the user is bạn; warm, plain, casual-adult. All copy doctrine binds vi: show-don't-claim, recognition voice earned-only, and zero em-dashes — the six quarantined English canon lines recast with commas in Vietnamese.

The living artifact is stepo-mobile/dialect/glossary.yaml (18 terms); the translations await the PO + codex native-ear review in dialect serve, where reviewed lines get locked.

Chapter-card header earns its place (2026-07-16)

Real content exposed a board weakness: journey.html drew every chapter card with a top row of tag-left/date-right, and on the many untagged steps that row held only an 11px faint date in the corner — the mock's rich three-line demo notes hid the blank band that a real one-line note leaves. Ruling, extending the step-sheet principle (a row earns its place): the chapter card's header row renders only when it has a left occupant (First step / Final step tag or the Milestone kicker). An untagged card with a note opens with the author's words, and the date rides the note's first line, right-aligned — the timeline anchor stays in the card's top-right corner in both card types, so scanning the spine for dates is unchanged. An untagged media-only card keeps the date-only row (it sits directly against the media's visual weight). REJECTED — a permanent left occupant such as a "STEP 4" ordinal: redundant with the spine's sequence, adds ledger flavor to a memory surface, and the count already lives in the zone label. journey.html reworked to match (.hnote.dated).

The trail runs newest-first (2026-07-16)

Early users asked for the newest step on top; the design authority defended story order (oldest-first, finale as the last-card payoff) and proposed a jump-to-latest patch; the PO and codex rejected both, and the concession is on merits: Stepo's own pitch says "look back" and "scroll back to day one" — that is motion from now toward the beginning, not opening on day one. The oldest-first clause in the chapter-card ruling was never independently justified by doctrine. The journey page's identity lives in the hero, the spine, the tags, and the remembered people — not in chronological direction. The rule:

• Hero and People of this journey stay at the top. The header is the journey's face; landing mid-trail (chat-style anchoring) was rejected in the same discussion because it skips it.
• The trail always starts with the newest step. A live step naturally occupies first position, directly under the header — so the hero jump chip is retired ("pointer, never a second representation" stands; there is nothing left to point at).
• An achieved journey opens with the Final Step card; scrolling reveals what it took. The header's "Journey achieved" eyebrow already announced the ending, so the finale first spoils nothing. The First Step is the emotional destination at the bottom: where it began.
• One order for every journey state. No toggle, no duplicate card, no ongoing-vs-finished reversal (silently flipping the page at achievement creates two mental models).
• Watch item (codex): if testers still call the newest step "buried," the next question is the People panel's position between hero and trail — not the order.

Build shape: the flip belongs to the backend (journey-steps endpoint returns newest-first with the cursor paging older), never a client-side reverse of loaded pages — this also makes the endless founder journey page naturally (newest page first, older loads as you scroll). The date scrubber is direction-agnostic (a position tool). Mocks: journey.html + journey-milestones.html trails reversed, jump chips removed; milestones-board.html prose updated.

The unfinished step is a status, not a broken card (2026-07-16)

The backend intentionally shows owners their own unpublished steps (WhereMediaVisibleTo: PublishDate null is owner-only) so they can watch an upload land and retry a failure. The card rendered that state as a silent gray field inside full live dressing — a countdown ring for a window that hasn't started, action pills nobody can press, on a step nobody else can see. Early users read it as a broken step. Ruling, extending "The live prompt is visitor copy" (chrome that invites or counts acts nobody can perform is false):

• No live dressing. The 24h clock starts at PublishDate, so an unpublished step is not live: no Live pill, no ring, no prompt, no action pills, no counts, no presence line. What remains is the author's words, the date, and the truth about the upload.
• One status voice. The media field carries a small quiet state mark (ink and muted gray only — tangerine belongs to live); the footer row, where the interaction bar would sit, carries one sentence naming state + audience. Publishing: mark = blinking muted dot + PUBLISHING kicker; footer "Publishing this step. Only you can see it until it's up." Failed: mark = retry glyph + TRY AGAIN kicker (the field is the button); footer "This step didn't finish publishing. Only you can see it." + one ink Try again button.
• Quiet failure. Muted ink and a door, never red panic — the danger palette stays reserved for destructive confirms. Retry re-runs the cached upload or opens the step's media picker (the edit-on-failed-media flow the visibility exemption was built for). Delete stays in the overflow sheet; the failed card gets one primary act, not a fork.
• Stale truth is the backend's job. A sweep fails media stuck in Pending after an order-of-hours threshold; the client renders state and never infers failure from age.
• Card-level rule: applies wherever the owner meets their own unpublished step — journey trail, feed, step detail. First/Final/Milestone header tags are authorial facts and survive. No progress bars on the trail; the publish moment (composer) owns the live watch, the trail owns the fact.

Board: step-unpublished.html (both states, bright-lines table).

Delete journey — the owner's last door (2026-07-17)

Journey deletion never existed: the backend service was fully written (cascading step deletes, moderation tracking) but no endpoint exposed it and the Manage sheet had no row — unbuilt plumbing, not a ruled absence. Not an App Store violation (5.1.1(v) requires account deletion, which Stepo has, immediate; no guideline mandates per-content deletion), but three reasons to build it pre-submission: user expectation (a regretted journey was the only permanent object in the app), reviewer dead-ends, and the moderation path — the founder's report-email flow had no lever to remove a reported journey, which is a real 1.2 gap once reports arrive. Ruling:

• Row: last in the Manage journey sheet, danger ink (danger = delete only, never rose — step-sheet canon). Label "Delete journey", caption "The whole journey, gone for everyone." Close (pause, ink) sits above it; the captions carry the difference.
• Confirm: step-sheet panel-03 grammar — asks once, honest body, styled danger primary labeled with the real verb ("Delete journey"), quiet "Keep it". Body names the real count: "Its {n} steps go right away, for everyone, along with their hearts, comments, and step-withs. Badges people earned stay theirs and no longer name this journey." (No "This can't be undone" line: the step confirm's voice carries finality as "right away, for everyone"; one family.)
• Recognition permanence extends ("deletion never claws back recognition", ruled at step level): badges earned on the journey stay on people's walls — tier, earned date, owner attribution, and their contribution to recognition totals. This closes a grief vector: deleting a journey can never strip supporters of what they earned.
• Deleted content never survives as badge metadata (codex challenge, conceded same day; governing line adopted: content is deletable; earned recognition is permanent; deleted content cannot survive as badge metadata). The journey title is the owner's authored content and is exactly where sensitive words live, so it goes with the deletion — the original "title as memory text" stance is dead. Owner attribution stays: "you supported Marco" derives from the step-with fact, not from journey content. The badge row renders as a non-interactive tombstone: tier + earned date + owner, sentence slot "From a journey that was deleted.", no chevron, no tap (a tap that dead-ends reads as broken — same defect class as the unfinished-step card).
• No state gating: ongoing, closed, achieved, live — the owner can always delete. Share links to a deleted journey dead-end (existing canon).
• Build shape: expose the existing DeleteJourneyAsync at DELETE /api/v1/journeys/{journeyId} (owner-gated; the service's isModeratorAction variant stays ready for the admin-dashboard lever, a separate follow-up). Verify recognition/badge queries tolerate a soft-deleted journey rather than joining its rows away, with tests.

Mock: journey-manage.html (danger row added; confirm copy in its header comment, grammar boarded on step-sheet.html panel 03).

Close is a verb for unfinished journeys (2026-07-17)

Live-prod finding: an achieved journey that was then closed showed Celebrators beside a Closed chip and "the finale hasn't been written yet" — because close silently demoted the achievement (nulled FinalStepId, kept the set-once WasFinalStep), leaving current-state and permanent-state contradicting each other. The reconciling copy fix (people panel speaks in past fact, "finale written", hasFinale from the backend) is correct and ships — but the producible contradiction dies at the source. Ruling:

• Close does not exist on an achieved journey. Its own caption defines it ("Pause or park it. No final step needed.") — a verb for unfinished journeys; a finished story has nothing to pause. The Manage sheet drops the row on achieved journeys; the backend rejects close on an achieved journey; close never touches FinalStepId (on the journeys it still applies to, there is no finale to touch).
• The un-achieve doors are the existing ruled ones: delete the final step (journey returns to ongoing, badges stay) or add a new step (the story continues past its peak; the finale becomes history). No third demote path.
• Repair the stranded data: achieved-then-closed journeys (Closed + null FinalStepId + a live WasFinalStep step) are restored to Achieved with the finale re-pointed. Recognition was never wrong — the Celebrators and Companions on these journeys were legitimately earned; it was the journey state that lied.
• The achieved journey's sheet names the doors (codex amendment, adopted): Edit / Continue journey / Share / Delete. Continue is the Add-step row relabeled with its consequence ("The story reopens; the finale stays a chapter.") — reopening stops being an unlabeled side effect of posting. No Close, no Achieve.
• Closed-with-history is a valid state (codex amendment, adopted): achieved → continued → stepped → closed without a second finale is a legitimate Closed journey carrying historical Celebrators. The hero says Closed, plainly; the historical finale keeps its peak chapter card in the trail with its celebration attached ("Achievement reached · N people celebrated this finish").
• Celebrators of a past peak stay visible in past-fact language (permanence canon): on any journey whose finale became history (finale deleted, or story continued), the people panel counts them against "finale written", never against "the finale hasn't been written yet". REJECTED — removing the Celebrator row from the People panel on such journeys: the panel is the one people surface and its rows are the doors to journey-people; role rows never come and go with journey state. Past-fact language is what prevents the "celebrating the quiet close" misread, not relocation.

Addendum: the close sheet is one sheet with two states, and closing is a note moment (2026-07-31, founder-approved) The shipped flow raised a confirm dialog on top of the open Manage sheet: two scrims, two handles, and a yes/no question, for an act the ledger already calls non-destructive. Three rulings.

1 · One sheet, two states. Tapping the Close row rearranges the same sheet container in place: the scrim stays the scrim, the grabber stays the grabber, the rows give way to the close state, and a back chevron in the header slot returns to the rows. The sheet is never dismissed and never re-presented. REJECTED, a confirm sheet (or dialog) over the Manage sheet: one decision earns one surface, the second scrim darkens the first into mud, two grabbers disagree about what a downward drag dismisses, and a stack of overlays reads as a warning that a pause has not earned. The same rule governs every in-sheet fork on the owner's own object: swap the container, never stack another one. Delete keeps its own confirm, because a destructive act asks once, and it too swaps in place rather than stacking.

2 · The close state is the trail-end note moment, not a confirm. Its job is the last word, not a yes/no. Close is non-destructive by ruling, so the primary is ink, never --danger and never rose. The exact copy, in order:

• Header: back chevron · "Close journey" (Archivo w800) · the journey title beside it in Fraunces italic, muted. It is the same header slot the manage state used, so the swap is legible.
• Consequence line, muted, one line: "It reopens the next time you add a step. Nobody is notified."
• Field label: "Leave a last word · optional" (the create-journey .flabel grammar, with its · optional).
• Note field: multi-line, optional, 500 characters (CloseJourneyDto already accepts ClosingNote at that limit). Placeholder in interface voice, inviting authored words: "Where the journey pauses, and why." The placeholder is the interface talking, so it stays Inter; what the owner types renders in Fraunces italic inside the field, because the words are theirs and the field previews exactly how the trail will carry them. No autofocus (the keyboard would bury the primary in an optional moment); the character counter appears once there are words to count.
• Helper under the field: "It sits at the end of your trail, for anyone who comes looking."
• Primary: ink "Close journey" (radius 16). Quiet exit: "Keep it open", which dismisses the sheet; the back chevron is the way to the rows.
• No "Are you sure?", no second confirm, no toast that congratulates.

The Manage row's caption sheds its reopen sentence and returns to the ruled form, "Pause or park it. No final step needed.", because the consequence now lives where the decision is made.

3 · The closing note renders as the trail's quiet last word. On a Closed journey that carries a note:

• Position: the newest end of the trail. The note is the trail's first entry, sitting directly above the newest chapter card (the last step posted), under the zone label. Closing happened after that step, so newest-first (2026-07-16) puts the journey's last word at the head of the trail. The 2026-07-10 "renders small at the trail's end" phrasing was written under oldest-first and means the end of the story, which is now the top of the page.
• Not a card. No border, no shadow, no media well: a card would make the note look like a step. It rides the spine as its topmost node, a quiet node in ink hairline (no accent; accents are first, live, and final), under a small Archivo uppercase kicker ("Closed · 4 March") in --faint.
• Fraunces italic at chapter-note scale, --ink2, shown in full and never truncated. The owner said it, so the authored voice is legitimate here; the kicker around it stays interface ink.
• No note, nothing renders. The hero's Closed chip already carries the fact, and an empty node would be chrome inventing an event.
• Reopening clears it (StepService nulls ClosingNote when a new step reopens a closed journey), so the note belongs to the pause it explains, not to permanent history. A journey closed a second time carries its second note only.
• Visitors and the owner read the same thing. Closing still sends no notification and writes no feed row.

Sheet-header spacing (fixed in the mock, so the build has the right reference): 8 above the grabber, 20 between the grabber and the title, 14 under the title before the first row. The old 4/12 crowded the title into the sheet's 28px top curve.

Mock: journey-manage.html, both sheet states side by side in the state-catalog layout (.slot + .cap, the onboarding-how.html idiom).

The journey screen carries its own doors (2026-08-12)

The journey screen is pushed full-screen over the whole scaffold, so it has no tab bar and no Step FAB. Everything the owner does here therefore had to go through the ⋯ sheet — except the one thing that did not: a full-width "Complete journey" button under the hero, drawn in no mock, sitting where the reading starts and asking for the rarest act in the app. Four rulings replace it, and they turn on where an act belongs rather than on how it looks.

1 · The everyday act gets an everyday door: + in the app bar. An owner opens their own ongoing journey to add to it, so the app bar's right cluster is + · ⋯, both in the mock's 38px .iconbtn chrome, 9px apart. The + appears for the owner of an Open journey alone: a finished story is continued or reopened deliberately, through the sheet, and a visitor adds nothing. REJECTED, a dashed stub at the trail head: the frequency argument is the whole case for promoting this act, and a door below the fold is not a door. REJECTED, a floating action button: this page is a reading surface, and new floating chrome over the trail is exactly what the full-screen push was buying us out of.

2 · The ending has an author, and the act sits on the row that names it. The Celebrator row's still-possible state says "The finale hasn't been written yet." to every reader. For the author of that finale it carries a quiet rose "Write it" pill in the .followbtn grammar, in the slot the count and chevron would use — free precisely when the act is offered, because an unwritten finale has nobody behind it yet. Four conditions, all of them: owner · Open · no finale yet · the three-step floor (2 existing steps plus this one, the rule the backend enforces). It opens the same composer the + does, with the final-step mark on and this journey in the slot.

The one-interface law holds: the sentence is the same sentence for every reader; ownership adds the act, never a different row. Below the floor the pill is simply absent — the card states what is true of the people and never explains the mechanics of a rule; the manage sheet keeps that job, as a disabled signpost with the reason in its caption.

3 · A row leaves a sheet when a better door exists, not because the sheet is long. The manage sheet's Add a step row goes on Open journeys, where it is a second tap to the place the + already is. It stays on Closed journeys, which carry no +, and where the act means something more than posting — so its caption says so: "Reopens this journey. It goes live for 24 hours." Achieved journeys keep Continue journey (2026-07-17). Mark as achievement stays on both: the sheet is the deliberate door and the card's pill is the door in the moment, and because both open the same composer state they cannot disagree.

4 · The rows read in story order: Starters · Companions · Celebrators. The card's lead sentence has always read in time order ("there at the beginning… kept showing up… here for the finish"), and every piece of canon prose enumerates the tiers that way, so the old Companions-first order contradicted the card's own voice. Reading it now moves past → present → future, and it puts the row that can carry the owner's act at the card's bottom edge, beside the trail it writes into. The journey-people screen's filter chips follow: Everyone / Starters / Companions / Celebrators.

And a defect the wave closes. Every composer door on this screen used to push a composer with no journey on it, so the page derived its usual default — the open journey the author most recently stepped in — and an owner standing on journey B was handed a composer aimed at journey A. The journey now travels with the route, and the precedence is one line, top down: the author's own pick, the door's journey, a rescued draft's journey, the derived default. The tab bar's Step FAB and the profile's empty state carry no journey and keep the derive, which is what it was written for.

And a second one, found while verifying. The people card held its own one-shot fetch inside itself, so it was a part of the screen the page's pull-to-refresh could not reach: one failed read (a dropped connection is enough) and the card was simply absent until the page was left and re-entered. The people now live beside the detail and the trail on the journey wrapper, bound to the resolved journey the same way the trail is, and the gesture that refreshes the page refreshes all three of its reads. The standing rule behind it: a card that fetches its own data owes the page a way to ask again.

Mocks: journey.html (two devices: visitor/achieved, and owner/ongoing with the +, the description, and the Write-it pill), journey-manage.html (cluster in both backdrops, sheet without the Add-a-step row), people-card-board.html v7 (the act's specimens and rowspec, rows reordered), journey-people.html (chip order).

Media discloses more the closer you get (2026-07-18)

User feedback surfaced the card-vs-detail ratio difference as a suspected inconsistency (composer previews the square crop; the step page shows more). Adjudicated with codex; both converged on the same frame: this is not one aspect ratio to unify — it is the ladder of disclosure (2026-07-13 ruling), now named as the system-wide contract. Originals are never destructively cropped; navigation reveals more, never less. Four tiers, each with its own duty:

• Tile (profile journey filmstrip 4:5, selection grids and compact thumbnails 1:1): a pointer to the step, not a representation of it — the same doctrine that keeps the profile grid a navigation index. Tiles crop freely to the shape their index needs and owe no fidelity to the card band. Filmstrip stays 4:5 (thumbnails, not cards); grids stay square.
• Card (feed, trail chapter, composer preview): the step in a stream. One shared clamp band [1:1 tall … 1.91:1 wide], center cover-crop, display-time only, one source of truth (feedMediaAspect). The square tall cap stands — the deciding criterion is unchanged ("who needs me now?" dies at one-post-per-screen), and it holds for the trail too, now a newest-first skimming surface. Acceptance check: a card with a three-line note, media, presence line, and actions fits about one phone viewport.
• Page (step detail): the step's home — media whole, natural aspect, fit-width, uncropped, any ratio, photo and video alike. The one-post-per-screen objection belongs to streams, not to a page the reader deliberately opened; if the page cropped, the viewer would become required to learn what is actually published, inverting its role. (Page tier amended 2026-08-07 — see "The detail frames, the viewer holds the whole".)
• Viewer: the original, zoomable — reached only from the page.

The composer caption (codex finding, adopted; its two-state proposal, rejected): the square preview alone is ambiguous — the author cannot tell whether the crop is destructive, and content near the photo's edge stays publicly visible on the step page after they watched it vanish from the preview. That is a consent-grade surprise, not a visual one. Fix: when (and only when) the picked media falls outside the card band, one quiet muted line under the composer's media card — "The full photo stays on your step. Cards show this crop." (video variant swaps the noun). The preview itself stays exactly the feed card — the publish moment's whole design is that the preview IS the real card, so it never becomes a mode-switcher, and no expand affordance: the author saw the original in the picker a second ago; the ambiguity is about what persists, and the sentence answers exactly that.

REJECTED — author-positioned focal points (stored per-media, reused by every cover crop): a backend field, crop math on every card surface, and a repositioning UI added to a post-in-the-moment flow, all to fix a harm no user has reported. Center cover-crop is the default the whole industry ships. Revisit only on evidence of real subjects lost to the crop. (Revisited 2026-08-07 on that clause's own terms — see "The detail frames, the viewer holds the whole".)

The detail frames, the viewer holds the whole (2026-08-07)

(Amended 2026-08-08 — the page band and the card band collapsed into one. See "One window, authored once".) User feedback from the friends-and-family launch: step-page media dominates the screen vertically — a 9:16 shot makes the conversation a basement nobody reaches. PO proposed a 3:4 vertical bound for image and video plus a composer feed/detail preview toggle with drag-and-zoom framing. Adjudicated; the Page tier of the ladder is amended:

• Page tier revised. The step page renders media in its own band, [3:4 tall … 1.91:1 wide] (detailMediaAspect), center cover-crop, display-time only, photo and video alike. Taller than the card band so arriving at a step still unfurls the shot; capped because the page is a reading room — media, then note, then comments and guest book — and the conversation is the product. The 2026-07-18 defense ("if the page cropped, the viewer would become required") fails on the evidence: the viewer stays one tap away on the same surface, and the page still shows more than any card. The ladder now reads: tile (pointer) → card glance-crop [1:1 … 1.91] → page framed window [3:4 … 1.91] → viewer, the one surface that owes the original everything.
• Author framing returns (approved direction, next wave). The focal-point rejection above carried its own revisit clause; with the page now cropping too, the stakes of a blind center-crop rose and the evidence arrived. The wave ships one author-set viewport per media, stored as a normalized rect and applied at render — never baked, the original upload untouched, so the viewer and the look-back keep the whole memory, and video needs no re-encode. The author frames once at 3:4 (the tallest window); the card's square derives from its center. The composer previews both renders behind a feed/detail toggle — the preview stays the real card, now the real page too. (Where that toggle and the gesture live was settled next door: "Framing is a place, not a gesture".) Framing is optional: the default is a centered frame, and an untouched publish behaves exactly like today's clamp. Publish speed is the doctrine line — the act is being present, not operating an editor. The same rect travels to the web share pages.
• Caption follow-up. composerMediaCropNoticePhoto ("The full photo stays on your step. Cards show this crop.") remains true — the whole shot stays published and reachable from the step — but its wording predates the page frame; reword it in the framing wave, when the composer's media card changes anyway. (Reworded in the framing wave.)

Framing is a place, not a gesture (2026-08-07)

(Overturned 2026-08-08 — the gesture came back to the preview once the arena question had a real answer. See "One window, authored once".) The framing wave first shipped the gesture inline: the composer's preview card was itself the framer, drag and pinch live under the thumb, with a Feed / Step page toggle beneath it. On device that is ambiguous in a way no copy fixes — the composer scrolls, so a drag starting on the media is claimed by two recognizers at once and the gesture arena decides invisibly. Either the page will not scroll where the thumb naturally lands, or the framing drag scrolls the page away. Nothing on screen says which mode you are in, because there is no mode. PO asked whether to lock the page's scroll over the media and dress the card to signal crop mode. Adjudicated:

• Locking the scroll is the wrong trade. Scrolling past a screen-filling preview to reach the note field is the composer's most frequent gesture; framing is its rarest. A scroll lock fixes the ambiguity by making the common path worse.
• Framing is a place you go. The preview card goes inert — it renders the current frame and passes every touch through — and a Frame pill beside Change (or a tap on the media) opens a carbon blackout: the window alone on carbon, thirds hairlines while the media moves, the Feed / Step page chips, a Reset that appears once touched, and one Done. There the gesture has nothing to fight and the carbon itself is the "you are framing now" signal. The app already speaks this twice — the profile-picture crop is its own screen with everything outside the crop dimmed, and the media viewer is media alone on carbon.
• Publish speed holds. One tap in, one tap out, and only for authors who care; an untouched media still publishes no frame at all. The toggle keeps its job — one focal state, two windows, never two crops.
• Reopening resumes. The stored rect seeds the focal state back, so framing is revisable rather than one-shot.
• What is stored is the card's window, corrected on device. The wave first stored the page-shaped rect, on the reasoning that the tallest window should be the one authored. On device that silently threw away the author's pan for every ordinary phone photo: a 4:5 or 3:4 shot sits inside the page band, so its page window is the whole image, and a rect that covers everything cannot say where the author looked. The card window is the tightest of the two and always crops, so it is the one that can carry the intent. A frame stores where the author looked and how close, not a shape — shapes belong to the surfaces. Every surface re-fits its own window at the frame's scale around the frame's centre: the page shows more around the same point, the card shows exactly what was framed, and the viewer still holds the whole.

One window, authored once (2026-08-08)

PO rethought the two-window model a day after it shipped: one shape, the tall cap at 4:5, the framing gesture back on the composer preview with Instagram's fit/fill button, and the feed note clamped to three lines to pay for the extra height. Adjudicated; this amends both rulings above.

• One band, [4:5 tall … 1.91:1 wide], for card and page alike. The card's square cap rises to 4:5 and the page's 3:4 relaxes to it, so the two converge on one shape. The step page no longer unfurls the shot, and that is the trade: what the composer previews is what the feed shows is what the page shows, pixel for pixel. WYSIWYG beats a subtle unfurl, because the unfurl is what made two windows necessary in the first place. The viewer still owes the original everything.
• The rect is the window, shape included. The 2026-08-07 correction (store the card window, re-fit per surface) fixed the symptom. The disease was having two shapes at all: a stored rect that has to be re-derived on every surface is a rect that can be silently re-derived wrongly, which is exactly what happened. With one window the rect's own pixel aspect is the box every surface renders, and nothing downstream re-fits, re-crops or re-derives. deriveWindowFrame is gone from the app and the web alike.
• Fit or fill, never bars. The bottom-left button picks which window the author is aiming: fit, the photo's own shape clamped to the band, or fill, the house 4:5 with the sides cropped and pannable. A literal fixed 4:5 was rejected: a 16:9 shot would lose most of its width with no way out, and letterboxing it inside a tall box puts bars on a paper card, which this app has never done. The box changes shape instead.
• The button is an affordance before it is a control, so it is on for every media, photo and video alike, in the two-corner-brackets glyph people already read as "this picture moves". It first drafted as a fit/fill switch and hid itself wherever the two landed on the same shape, which is every portrait taller than the cap — and hiding it there took the zoom and pan hint with it, on exactly the media most in need of framing. One rule now covers both jobs: tap gives the next window, untouched. Two shapes swap; one shape returns to where it started, so a pan the author regrets is one tap from undone.
• A video frames while it plays, muted and looping, no play button and no tap-to-play. The preview's whole claim is that it is the card, and the card autoplays muted, so a frozen poster was the unfaithful option rather than the safe one. It also made framing dishonest: a window aimed at frame zero misses a subject who walks in at 0:04. A play button was rejected for adding chrome to the surface built around the fewest controls that let you post, and a hidden tap-to-play for being a gesture nothing announces. Silent regardless of the feed's mute preference: composing is not watching.
• Thirds hairlines while the shot moves, fading out 3s after it stops. They are the second half of the affordance — the grid answering the drag is what teaches that the window, not the photo, is the thing being aimed. A grid that never left would make a card read as an editor.
• Framing is a gesture again, and the arena objection was wrong. "Framing is a place, not a gesture" rested on a drag over the media being an invisible coin-flip between pan and scroll. It is not: photo_view's axis-scoped recognizer claims a vertical drag only while the shot still has room to move that way, so a window showing the whole photo, and a window already panned to its edge, hand the drag straight back to the composer's scroll. Fit mode scrolls, filled mode frames, and the page never freezes under the thumb. The carbon blackout is retired: it cost a round trip to fix a problem the gesture layer already solved.
• Three lines, not four. The card note clamps to three so the taller media still leaves a card plus its chrome inside one screen. This is the 2026-07-13 device ruling being honoured, not overturned.

A video's wait is a poster, and its failure is the reload field (2026-08-12)

Production reports of videos "loading slow" turned out to be the wait having no face: the player drew nothing at all until the stream opened, so a slow clip and a broken clip were the same blank box, and a broken one stayed blank forever. Ruled with codex review; built the same day.

• The poster covers the whole wait. Every video already has one; it paints in the same window, same cover-crop, the instant the card lays out. A slow video is a photo that starts moving — no spinner, no blank. When even the poster is missing, the quiet paper field stands in.
• A broken video shows the same field a broken photo does — paper2, pill glyph, "Tap to reload" (errors board, panel 05). Retry rebuilds the player; media that cannot load is never a permanent hole in a card.
• Only the clip being looked at loads. Off-screen cards wait for visibility before opening a stream, so the visible video gets the whole connection. The step page is the content itself and starts at once.
• Delivery tops out at 720p (Bunny library configuration). A playback-UX ruling for a phone-first app on Vietnamese mobile links: phones were pulling 1080p at 5 Mbps into feed cards for no visible gain at card or phone-viewer size, paying for it in seconds-to-first-frame. Not a cost ruling — Bunny bills 720p and 1080p encoding identically; delivery bytes drop by about a quarter.
• Ruled, not yet built: a step's clip caps at 60 seconds, surfaced in the picker on the clip that is too long — a step is a moment, not a film. No trim UI. Ships in its own wave with the backend rate limit that is the real guardrail.

Choose the journey sheet (create-step-journey.html — a spec board, not a screen; 2026-08-08)

The sheet the composer's ADDING TO row opens. The row was ruled on create-step.html ("its sheet holds the start-a-new-journey door") and the sheet itself was never drawn, so the app kept a pre-revamp screen: a centered title with a left X, a raw-tangerine New Journey label beside a dashed 62px tile, 76px thumbnails, and rows whose only fact was "6 steps". PO called it outdated on sight. Drawn now, with one finding that outranks the visual drift:

• The sheet changes a journey's state, silently. Per journeys_overview.md, a regular step on an Achievement or Closed journey reopens it, and on an Achievement also clears the finale marker (recognition already earned is permanent and is never touched). The shipped sheet listed those journeys with a step count and said nothing. Ruling: the row carries "Posting here reopens it", and the composer row you return to carries "Achievement · this step reopens it" above the Post button. Stated at both moments a person could change their mind.
• No confirm sheet, and no danger ink. Publish speed is doctrine, and a modal between "I chose" and "I post" buys nothing the line above the Post button does not. Continuing a journey you finished is a legitimate thing to want, so the line states rather than warns; --danger stays destructive-only. Finished journeys are never hidden from the list either — reopening by posting is the only way to continue one.
• A row answers "where does this step land?" State chip plus "step N next", not a bare count: "6 steps" is arithmetic, "step 7 next" is the act, and it matches the row the person came from. 44px thumbnail (the shipped 76px turned five journeys into a scroll), serif italic title as everywhere else.
• Selection is ink. The current target carries an ink check and a paper2 row. Accents are earned by first, live and final; a picker's cursor is none of those. The shipped sheet could not tell you which journey you were already adding to, which is the one thing a picker owes you.
• Two groups, Ongoing then Finished. One label away, never mixed in. The state words are the app's existing ones, one word each: Ongoing, Achievement, Closed.
• The new-journey door is a row, sheet-row grammar, on paper2, at the top, captioned "This step becomes its first step." CUT: the dashed square (that is the media picker's camera-tile idiom, where dashes mean "nothing here yet"; among real journeys the same square reads as an empty slot) and the raw accent label (accents never carry text, and creating a journey is an ordinary act — the marigold of a first step is earned by the step, never promised by a button).
• Sheet grammar, not page grammar: grabber, left-aligned Archivo w800 title, bottom edge. The title finishes the row's sentence — "ADDING TO" → Add this step to — so nothing is re-read.
• REJECTED for now — a search field: a person has a handful of journeys and a sheet earns its rows. Revisit when a real account passes roughly a dozen and scrolling is the complaint.

Governing line: a picker owes you two things, where you are and what changes if you move.

The composer is one page (2026-07-18)

User feedback: the everyday composer "feels like one long form." The proposed fix was a two-page wizard (media + journey, then content). Adjudicated with codex; both converged on rejecting the split. A step is one atomic thought ("I'm continuing this journey with this moment and this note"); the composer is the app's most-repeated surface and its job is speed-to-post — "Step 1 of 2" makes a daily action feel like onboarding, splits the glanceable whole, and would demand a third review stage when the publish moment already IS the review (the preview is the real card). The long-form feeling is a hierarchy defect: five equal-weight permanent cards (the board ruled four; the Milestone card arrived in round 3 and was never absorbed), with the final-step toggle below the fold once media is selected. Ruling — one page, restructured (create-step.html redrawn as a four-panel state board: 01 before media · 02 media selected · 03 final marked · 04 video selected — video shares the grammar; its two deltas are the stilled thumbnail + duration badge (never autoplay in the composer) and the caption's noun swap; grid video tiles carry the same badge):

• Media selection is a state transition, not a stage (codex, adopted): before selection the media card holds the picker — camera tile, recents grid, and an "All photos" door; once picked, the grid collapses into the exact card-crop preview with a small Change pill — never grid and preview together. The disclosure caption rides under it only when clamped (per the media-disclosure ruling above).
• Media is mandatory, so the empty state is the picker leading (state amendment, 2026-07-18): every step has media (PO invariant), so before a pick the Post button sits disabled and the footnote says what's missing ("Add a photo or video to post."); the note shows its placeholder ("Say what happened."). Change means "pick a different one", never "remove": it returns the card to the grid with the current photo ring-marked; the selection persists while browsing, so Post never disarms and there is no way back to the empty state.
• The picker is hybrid — native behind the "All photos" door (ruled 2026-07-18): the inline recents grid is ours (photo_manager; it works under iOS limited access, and when photo permission is denied the grid simply doesn't render — camera + All photos remain). "All photos" opens the NATIVE system picker (iOS PHPicker / Android Photo Picker): both run out-of-process and need no library permission at all, which deletes the permission-nag states and carries the strongest privacy story. Never build a custom full-library browser — canon chrome isn't worth the full-access permission and its state matrix.
• Journey identity is a slim hairline row, not a card: dot + "Adding to" + journey name + step count + chevron. Most days it confirms the default (most recently stepped ongoing journey); tapping opens the journey sheet, and the "start a new journey" door moves inside that sheet — a rare fork stops permanently occupying the composer.
• The two rare marks share one card, in sheet-row grammar (amended 2026-07-18 — reveal-only hid too much; "what is a final step?" must be answerable before any toggle is touched): milestone (amber) and final step (rose) as compact rows, each keeping its accent and gating (final at >=2 existing steps), each carrying a permanent one-line caption (milestone: "A bigger moment. It stands out on the trail." · final: "Completes the journey as an Achievement."). Enabling a toggle upgrades its caption to the full consequence line (the Celebrators mechanics). A finale cannot also be a milestone (ruled): while one mark is on, the other row dims and takes no taps — no silent auto-swap; turn one off to reach the other.
• Acceptance criterion (codex, adopted): with media selected, a normal phone shows the journey row, the card preview, the start of the note field, and the sticky Post button without scrolling.
• Create-journey stays its own flow: declaring a journey and posting its first step are genuinely two decisions; a regular step is not.

The picker browses, and says whose photos these are (2026-08-09)

Three pieces of early-user feedback on the composer, one root each.

• A grid inside a card reads as an attachment. A user opened the composer and believed the five recents were already on the step. Nothing on that card said otherwise: it sits exactly where the preview lands, its six tiles carry equal weight and a hairline each, and six bordered thumbnails inside a media card are the picture of a multi-photo post. The grid gets a field label, in the small-caps chrome already used for ADDING TO above the journey row: RECENT ON YOUR PHONE. Naming the source turns the grid into an input rather than content, and says out loud what the "All photos" door below it has always only implied. The label owes nothing more, because the Post footnote already states the job ("Add a photo or video to post.").
• The tile takes the band's tall edge, because that is the only choice with one direction of error. A uniform grid has one tile shape, and the card has as many shapes as the band allows: it renders the media's own ratio, clamped. A 1:1 upload really does render 1:1 (verified on device: no crop, and no disclosure caption, because inside the band the crop is lossless); 2.4:1 clamps to 1.91 and says so. So no tile shape previews every card, and the question is not which shape is right but which way a tile is allowed to be wrong. Tiles take 4:5:
• the card's aspect is clamp(source, 0.8, 1.91), so it is never narrower than 4:5, which makes the tile a sub-window of the card in every case — the tile can hide something the card will reveal, but it can never show something the card will cut;
• for anything at or taller than 4:5 — most phone photos, most phone video — the clamp lands on 4:5 and the tile is the card, exactly;
• square and landscape media are the tile's approximation, centre-cropped at the sides of a card that will be wider. A square tile had no such guarantee: it cropped the top and bottom of portrait media (the common case) and the sides of landscape, so which way it lied depended on what you shot. Cost: about 54dp on the picker state, paid out of the one state that carries no preview hero, so the "fits one viewport" acceptance criterion (written for media-selected) is untouched.
• The library sheet browses. "All photos" opened a single endless newest-first scroll, so reaching a video, or anything from an older album, meant scrolling to it. The sheet gains an album button in place of its static title — the album you are in is a better title than "Your media" — and a slim row of media-type chips (All · Photos · Videos) in the fchip grammar from journey-people.html. Type scopes, album narrows: changing the type keeps you in the album you were in whenever that album still holds that kind of media, and returns you to Recents when it does not. Album rows carry a name and a count and no cover thumbnail: a cover costs a thumbnail fetch per album to decorate a list that is read once and dismissed.

Amending "the picker is hybrid — native behind the All photos door" (2026-07-18). That ruling pointed the door at the native system picker and said never build a custom full-library browser, because canon chrome is not worth the full-access permission and its state matrix. Both halves of that reasoning have since been spent. The inline recents grid asks for the same photo permission on its own, so no native door can delete the ask; and the state matrix is built, shipped and hardened — loading, granted, limited, denied, permanently denied, restricted, with the Android partial-access grant that 1.0.4 fixed living inside it. Native would still be the cheaper way to get albums, and its Videos smart album would answer the type filter for free. It would also cost what the custom sheet gives: the current pick ring-marked while browsing, a picked asset landing back in the recents strip, and one AssetEntity from pick to publish instead of a second file-backed media path that has to re-derive a video's dimensions and duration. Ruling: the custom sheet stands, and now owes what a browser owes. The 2026-07-18 clause is retired, not reinterpreted — the door is ours.

The filmstrip shows the trail, not a button (2026-07-18)

The journey card's media strip (profile, profile.html) drops its trailing add tile. One dashed "+" is an invitation; repeated down a page of ongoing journeys it becomes the app tugging your sleeve on every unfinished thing — streak pressure in disguise, on the screen whose doctrine is "progress record, not creator dashboard." The FAB on the same screen is the add door, and the journey page has its own continuation affordance; the strip's one job is photos. Cutting it also heals a grammar split: other people's profiles and achievement cards never had the tile.

• Four fixed slots. Thumbs take the 4-across width at every count and never widen to fill; the strip shows the most recent steps, left-aligned. Strip fullness is the progress signal: 4+ steps reads full, 2 reads young, 1 reads just-started. The trailing space is an honest short trail, never a placeholder ghost (a ghost is the same nag readmitted).
• People row is omitted, not faked, while nobody has stepped with you on that journey yet — the card ends after the strip.
• Zero steps (deletion can empty a journey): no strip at all.
• Accents unchanged: live step ring + hours pill, final step rose + Final pill, one accent per card max.

Companion is living membership (2026-07-24)

Supersedes the same-day "two doors" ruling (cumulative count minting is dead — do not build it). Adjudicated three rounds with codex; adopted as the PO's original vision, correctly understood at last.

Companion is not a medal for past work — it is living membership in a journey's inner circle: "I am caring, and still caring." While the road is open, Companion is membership; when the chapter closes, Stepo remembers who its Companions were.

• Starter and Celebrator stay permanent memories — singular moments; history cannot change. The close-time record (a Sealed Companion, one name — see "One Companion, no ladder") is likewise permanent and purely discovered.
• The Companion Law (constitutional form, 2026-07-24 — supersedes both the 7-of-latest-10 and the 100-step-era mechanics; percentages are scale-free, counts are guesses that break when journey lengths differ from the guess): you become a Companion when you've stepped with 70% of a journey — 90% if you weren't there at the start. You stay one while you hold above 60% — 80%. Coverage is over the journey's whole open history; the existing 5-step floor (MinimumStepsForCompanion) arms the system — no new constants. All four numbers are dials in RecognitionSettings.
• The 10-point band is the forgiveness: whole-journey dilution moves slowly, so a rough month dents but never flickers; regain = climbing back over the gain line.
• The 20-point starter discount is permanent — the first ticket, priced into the law.
• Known jurisprudence, intended not accidental: epic journeys are epic to enter (the latecomer filter, PO-ruled) and their early heroes fade slowly (the first ticket's grace, PO-ruled via the Taylor-first-ticket argument) — both eventually yield to arithmetic: everyone losable, everyone regainable.
• Coverage moves only when the author publishes or the supporter steps. Author silence harms nobody; time alone expires nothing; one miss never fades anyone.
• A deleted step leaves the structure and survives in the record (ruled 2026-07-26, from a real prod defect: deleted rows were still splitting chapters and inflating the denominator, so an owner deleting a step silently destroyed their supporters' standing — the exact inversion of recognition permanence). A soft-deleted step is gone from chapter boundaries, from StepCount and its floor, and from the denominator: a vanished opportunity cannot be charged. The step-withs earned on it stay in the numerator: an act never un-happens. So coverage reads (live stepped + deleted stepped) / (live closed ∪ stepped) — per-supporter denominators are already the norm here (the pending-window rule), and the union keeps it ≤ 100%.
• Anchors are historical and never migrate: a deleted first step keeps the starter anchor where it happened rather than sliding it to the earliest survivor, so nobody acquires early faith by deletion and nobody loses it. A journey whose opening step is deleted with nobody on it simply has no starter discount to give.
• A deleted finale closes, splits and settles nothing. Deleting a finale after settlement never unseals: the record stands, the chapter merely reopens for future living evaluation.
• Ratified 2026-07-24 (codex conditions, adopted):
• A step joins a supporter's denominator only when its 24h window closes unanswered; it joins numerator and denominator immediately on step-with. A badge never fades while the person still has time.
• Achievement lands when the finale publishes; Companion freezing and the sealed record settles when the finale's window closes.
• The close has two independent doors: current Companions freeze (permanent record), AND the whole-chapter retrospective seals anyone the living lines would have minted over the chapter's full life — each can fire without the other, both producing the same record.
• Hold at ≥60% / ≥80%; fade strictly below. Arming is step count alone (≥5): a chapter with five steps can name Companions however young it is. Coverage spans the current natural chapter; prior chapters' records are permanent.
• No age gate on arming (PO ruling 2026-07-24, removing the ≥7-day span it shipped with). A floor added to stop an early burst from minting membership is the kind of prohibition that admits the core loop rewards the exploit, and the law already answers it: a Companion minted early on a fast young journey keeps showing up or fades. The fade is the correction. The residue is accepted — a journey that bursts five steps and its finale inside a day can seal a Companion record — and the reinstatement, if real usage shows it, is one line, not a redesign.
• The regain debt is the system's character, in doctrine: missing 100 steps costs ~900 perfect ones at 90% — Companion encodes early historical fandom, not merely current enthusiasm. The canonical answer ("how would someone living on a boat be a Companion?"): you aren't. You weren't there the whole time; that's the cost. The platform does not arbitrate user-to-user fairness (owner burst dilution included) — abuse tripwires watch, the formula stays pure.
• Dials are versioned constitutional settings: changes apply forward with an explicit reconciliation decision, never retroactive stripping.
• Silent fade gains one private, pull-only line on the relationship surface ("Not currently a Companion. Your past tenure remains part of this journey's history.") — no numbers, no campaign, not a public former list.
• Leave persists until explicit Rejoin; a new step-with never silently undoes a deliberate exit, and rejoining never resets coverage (no denominator-reset exploit).
• Contract: expose active/permanent state and companionSince; there is no distinction field to carry (see "One Companion, no ladder").
• Display doctrine (2026-07-24): records are counted forever, statuses are counted while held. Internal states: Active (open chapter, can fade) and Sealed (frozen at settlement, forever); users only ever see "Companion" — tense comes from context, never a second label.
• Journey page: open chapter shows Active Companions only (faces + since-date); an achieved chapter shows its Sealed Companions beside their Starter and Celebrator marks — the permanent guest book.
• Profile counts ("Badges Earned" door, stats) mean recognition you currently hold: Starters, Celebrators, and Sealed Companions are held forever; Active Companions count while true, so the number rises and falls with real membership (PO-ruled: the abandoner who returns sees the smaller number — by looking, which is the point).
• The drop is never narrated: no delta, no trend, no push, no activity entry — discovery is pull-only. Aggregates stay anonymous: a count never reveals which journey faded.
• Badges page: one unified grid, no sections — tense per chip (Active wears the live treatment + "since {date}"; Sealed reads in the past tense). A faded Companion is simply absent, same silence as every surface.
• Acts are permanent, roles are tensed (corrected 2026-07-24 after the mock pass): BOTH doors count roles and are therefore tensed — Support Received includes Active Companions of your open journeys exactly as Badges Earned includes the ones you hold, and the two sides of one membership rise and fall together (anything else double-books a state). What is monotonic is the act level: the People and step-with captions, the supporters list itself, the podium ranks — acts can never un-happen, so a fade removes a supporter's Companion chip, never the supporter, and never re-orders a rank. Viewer-scoping (counts never leak invisible relationships) extends to Active-Companion state.
• Fading is silent: no push, no activity entry, no "lost" label, no public former-Companion list — the chip simply leaves current surfaces. Private personal history may remember the period. Regain gets a small acknowledgment ("You're walking with Maya again."), never the full reveal — the full-screen reveal fires once, on first gain, so the badge cannot be cycled for repeat celebration.
• At Achievement: current Companions freeze into a permanent base Companion record for that chapter; the whole-chapter retrospective seals the same record for someone not current whose full history qualifies. Missing the finale affects Celebrator and the retrospective arithmetic — it is never a Companion guillotine. A reopened journey starts a fresh living period.
• Leave this journey (explicit action, sheet grammar): immediately removes the living badge and all current-surface presence, unfollows, notifies no one, keeps only private history. On completed journeys the public association can be withdrawn from the profile (the record stays privately remembered). Membership without exit is forced endorsement.
• Doctrine amendment, recorded honestly: "recognition is discovered, never operated" now carries one scoped exception — living Companion is knowingly operable (maintaining membership IS the mechanic). The interface still never campaigns: no progress bar, no proximity copy, no at-risk warning, no countdown. A static legend explains the rule ("Companion is a living badge. It reflects showing up lately. It can fade, and it can return.").
• Named cost + tripwire: mechanical hearts will exist; there is no social loss-aversion without maintenance behavior. If the first cohort describes Companion as "heart the last posts" rather than "showing up," widen the band going forward — never strip retroactively.
• Display: current Companions only, as faces and chips — never a rank, never a count-down, never a former list.

One Companion, no ladder (2026-07-24)

The close door shipped as four graded distinctions (Dedicated Follower 50 · Early Believer 65 · Consistent Supporter 75 · Die-Hard Fan 85, each keyed to which anchors you caught). Retired. Four thresholds and two anchor flags existed to produce four names for facts the badge set already tells: Starter and Celebrator are permanent badges in their own right, so the ladder re-encoded the anchors inside the Companion's name and then charged a different percentage for each combination. It is the densest object in the system, it invented the phantom "impossible under 14 steps" invariant, and it is the one surface that can ask two people who both stayed why one of them got the lesser word.

• Both doors now produce the same record: Companion. Door A (Active at close) and Door B (whole-chapter retrospective) stay independent — two ways to qualify, one outcome, no name to compare.
• Door B introduces no dial. It asks the living law in the past tense: would coverage over the chapter's whole life have minted you? — reusing the gain lines (70% having caught the starter, 90% without). The starter discount survives, so early faith still costs less, without a ladder.
• Constituent chips de-absorb. The old collapse rule (the tier name swallows its Starter/Celebrator constituents) existed because the name implied them. It no longer does: a person wears Companion · Starter · Celebrator as separate marks. Nothing about a row is inferred from a word.
• Row sentences become generative, retiring the one-template-per-tier table (2026-07-16). One clause per fact held, joined in the order they happened: There when J began → kept showing up → was there for the finish. A sentence claiming a moment the person did not have becomes structurally impossible rather than forbidden, which is what that ruling was reaching for.
• Notifications name the badge, not a tier: "Priya became a Companion of your Learn to freedive."

The general principle, from the same session that cut the chapter-age arming gate: a rule added to stop a degenerate reading is usually evidence the model allows a state it shouldn't. Prefer deleting the state (or the name) over adding the prohibition.

Why the window is 24 hours (2026-07-24)

The app's load-bearing number, ruled with reasons (it is config — StepWithSettings.WindowHours — so this is a product ruling, not a technical constraint):

• Minimum timezone-fair window. Any 24h span contains waking hours for every timezone — every step is catchable by anyone who opens the app that day. Shorter would orphan timezones; 24 is the floor of fairness.
• A step is a day. The unit of real-life progress is the day; the social window is congruent with the life unit it carries.
• The longest window where live is singular. Window ≤ daily posting cadence means at most one live step per journey — the live card, the ring, the hours pill, and window-aware feed ordering all assume one live moment per trail. At 48h a daily owner has two live steps at once; at a week, "live" is just a feed.
• Inherited literacy. Stories trained the world that 24h = live then gone. The one-sentence answer to "why 24 hours?": it's one day of your life.
• The seal makes presence honest. "You were there" means that day. The window closing is what recognition pays out on.

Admin mode — the app is the moderation console (2026-07-20)

Stepo's moderators are on the phone — today the founder, someday hired help. Splitting moderation across a web console nobody opens is maintenance without a user; the app — already the best renderer of the content being judged — is the console. The web admin dashboard is frozen (config + desktop fallback only; no further investment).

• Two admin pushes, push-only — they never enter the activity feed (that is a user surface). New report → tap opens the Report page; goes to every moderation-role account (that is the job). New user → tap opens their profile; admin-only — a business signal, not moderation work, and noise to a hired moderator. The Resend report email stays as the durable record.
• One surface, rows cut by role. A future moderator tier reuses these exact screens with actions filtered by permission — no moderator-specific screens. Which actions a moderator keeps (ban vs remove-and-escalate) is decided when a moderator exists, not speculatively.
• No on/off toggle (ruled): admin UI is one Settings row plus the report pages — every user surface is already identical to a normal user's, so there is nothing to turn off. "User feel" lives in the account, not the chrome (the founder account is seed-wired and can never feel normal); use a second account via the hidden switcher. An off state would also put moderation duty behind a forgettable switch — the account path fails safe, since vault accounts keep their push subscriptions.
• Members surface — one screen, admin-tier (2026-07-20), sitting below Reports in the staff section. Default state is a recent-signups roster (newest first: avatar, name, @handle, joined-time, a private badge where it applies) — the browse-who's-new companion to the admin-only new-user push; tap a row opens that profile in-app. A search field on top runs the existing admin lookup (any account by handle or email). Browse by default, type to search — no separate search screen. Admin-tier, not moderator (same rationale as the new-user push: business curiosity, not moderation work). Admin reads see private accounts on purpose — the staff view ignores the target's privacy setting and is backed by the audit trail, a deliberately different capability from public search (which respects privacy); do not "fix" it. Backend: Lookup covers search; add a reverse-chron admin/users/recent (cursor-paginated, includes private) for the roster.
• Revises the earlier "user search stays out of the app" line below: that assumed web was an acceptable home for rare lookups. The console is mobile-first and web goes unopened, so search belongs in the app.
• Report page: metadata before content. Reason and category, reporter (tap → profile), status, prior reports against the same author — then a preview of the reported step/comment/profile that taps through to the real thing in-app. The three actions live here and resolve the report in the same motion: Remove content · Ban author · Dismiss (the existing reports/{id}/remove-content|ban-user|dismiss endpoints — action and resolution are one). Danger-confirm grammar from the delete flows.
• Reports list — the backlog safety net for missed pushes: one plain list (open/resolved), entered from a role-gated Moderation row in Settings. Quiet-surface grammar throughout: chrome is ink, no sunset color — moderation is chrome, not content.
• Role-gated, not founder-hardcoded (SetRole exists); the server is the gate, client hiding is cosmetic. The appreview@ reviewer account sees none of it.
• Not in the app: audit history, unban/shadow-ban management, config — rare, deliberate work for the frozen web dashboard or an agent over the API. (User search moved into the app — see the Members surface above.)

Chat list — "Pick up the conversation." (V2)

Opened by the Feed's top-right icon. Deliberately plain: avatar, name, preview, time, one tangerine unread dot — no relationship chips (the preview text does the talking). The Stepo-native touch: a "Shared a step" preview row with a tiny step thumbnail — Share is one of the three step-with actions, so steps flow into chat the way posts flow into Instagram DMs.

Messenger — "Talk to one person." (V2)

The thread with Priya. Carbon bubbles for you, card-white for them; the header carries one quiet relationship caption ("You've stepped with her 14 times"). The centerpiece is the shared-step card inside a bubble — mini photo, serif journey title, "Live · 6h left" pill — chat as another door into the 24h window. Sticky composer with a tangerine send button.

Chat carries no tab bar. Chat is a side-space you step into and back out of, not a destination — the same reasoning that rejected a chat tab (it would compete with Feed as "where conversations happen"). Both chat screens present full-screen with a back arrow, like the composers.

The quiet surfaces (settings, forms, sheets)

The doctrine: settings is chrome, and chrome is ink. No sunset color appears on any settings screen — switches have ink tracks, buttons are bordered neutral — so that when orange appears anywhere in the app it still means exactly one thing: live. The single exception class is --danger (see palette) for destructive rows.

• **Settings hub — "Control your account." Identity row → grouped rows: Account, Privacy (Private account "Off" · Blocked "2"), Notifications, Support (Send feedback — a real backend feature, feedback.html — · Rate Stepo), About/legal, and Sign out last**. The screen carries no accent and no danger row at all: destructive account actions live on Edit profile (2026-07-31 ruling below).
• **Privacy — "Who can see me?" The private-account switch with the spec's real consequences spelled out (approval for new followers; journeys/steps gated; existing followers keep access), and blocked accounts inline with Unblock. State-catalog note: blocked users' faces appear ONLY here** — the spec removes them from search, notifications and comments, so reusing a known face would mock an impossible state.
• **Notifications — *"What wakes me up?"*** Toggle groups mirroring the notification spec's actual type table (one toggle deliberately OFF — both states documented); batching excluded because the spec itself excludes it from MVP.
• **Edit profile — "This is how you show up." Onboarding's sibling form (same field grammar); the username caption teaches the share URL ("Your profile lives at stepo.app/@chaucao"). No privacy toggle — privacy lives in Settings. The page ends in a danger zone**: a hairline, a wide gap, then the single Delete account row (2026-07-31 ruling below).
• **Followers — *"My people."*** Profile drill-in, Profile tab lit; segmented Followers · 214 / Following · 180 (the profile bar's numbers); relationship-first captions reusing the cast's established facts; real follow states (Following / Follow back / Requested-with-lock) plus one kebab documenting quiet Remove.
• **Report — *"Something's wrong here."*** Bottom sheet over the dimmed step; reason list is the moderation doc's taxonomy VERBATIM (Spam or Scam · Harassment or Hate Speech · Nudity or Sexual Content · Violence or Graphic Content · Self-harm or Suicide Risk · IP Infringement · Other); anonymous-report subline; all-ink — the scrim dims the app's warmth.
• **Report — crisis response — "When it's about a person, not a policy." (report-crisis.html, 2026-07-11) Submitting under Self-harm or Suicide Risk swaps the confirmation for a warm response: quiet ink check, "Thank you for looking out for them.", the priority promise (these reports are reviewed first), the anonymity promise (the reported person never learns who worried — bolded), and an ink resources card (findahelpline.com for local crisis lines; emergency services for immediate danger — generic and international, no hardcoded national number). Resources come after** submit, never obstructing the report. Zero accent; non-clinical voice.
• **Delete account — *"Delete means gone."*** (settings-delete.html, 2026-07-11) Overlay sheet over dimmed Edit profile, per Apple 5.1.1(v) and the account-lifecycle spec's immediate-permanent deletion: plain consent copy (journeys, steps, photos, comments, badges deleted right now; your name disappears from every step you cheered on; no recovery, no waiting period), an intent separator ("Just switching phones? You only need to sign out."), then the one --danger button ("Delete everything" — never rose; rose means celebration) followed in-app by a final native confirm.
• **Journey manage — "This journey, managed." Owner's sheet over their own journey: Edit · Add a step · Mark as achievement (→ the final-step toggle in create-step, the sheet's only accent) · Share (real URL grammar) · Close, rendered in ink, not red, with the spec's semantics (closing needs no final step and the journey reopens automatically on the next step) · Delete journey** in danger ink, last (2026-07-17). Close and Delete each swap the same sheet into a second state rather than stacking another overlay: Close opens the trail-end note moment, Delete asks once (2026-07-31 addendum to the Close ruling).

Presentation rules these add to the nav contract: settings screens and followers are profile drill-ins (back arrow, Profile tab lit); edit-profile is a form sheet (X + bottom CTA, no tab bar); report, report-crisis, journey-manage and settings-delete are overlay sheets (grabber, scrim tap dismisses, no tab bar); badge-reveal is a full-screen moment (no chrome at all, shown once, X or the single button exits).

The self-harm category and its crisis response shipped into the taxonomy 2026-07-11 (moderation_overview.md → Self-harm reports; mock report-crisis.html) — the backend enum gains the value in the next agreed-changes round.

Delete account moves to Edit profile — "Destructive lives where identity is edited." (2026-07-31)

Ruling: a destructive account action belongs on the screen where identity is edited, never one row below a routine session action. Delete account sat at the very end of Settings, directly under Sign out — two full-width rows of the same shape, the same tap target, adjacent. The only thing separating "I'm getting off this phone for the night" from "everything I made is gone" was 20px of paper and a colour the thumb never reads on the way down. Proximity like that is the defect; the confirm sheet behind it is a second line of defence, not a reason to keep the first one weak.

The fix is placement, not friction:

• Settings ends at Sign out. No danger row, no accent of any kind — the hub is now pure ink, which is what "settings is chrome, and chrome is ink" always wanted.
• Edit profile ends in a danger zone. A hairline and a wide gap below the last field, then the one Delete account row (danger ink #B3322E, caption "Permanent. Everything is deleted."). It is the last thing on the page, reached only by scrolling past the whole form, and it sits far from the pinned carbon Save — the destructive action and the routine one are never adjacent, and never the same shape.
• The flow is untouched. The row still opens settings-delete.html with its consent copy, its sign-out escape hatch, its --danger button and its final native confirm. Deletion stays immediate and permanent. Only the door moved.

Why Edit profile is the right home: deletion is the last operation in the same sequence as changing your name, your handle and your face. Grouping it there reads as one idea ("this is who I am here, and this is how I stop being here") instead of as an item on a list of switches. It also keeps Apple 5.1.1(v) satisfied — the path is still in-app and still reachable in two taps from the profile.

Mocks: settings.html (row removed, Sign out last), edit-profile.html (danger zone added), settings-delete.html (the sheet now dims Edit profile, and dismiss returns there).

Force-update interstitial — "Time to update Stepo." (2026-07-13)

The doctrine's counterweight: "break shamelessly" only works after launch if old clients can be told to update. So the app ships a store-driven force-update gate — a full-screen ink-and-paper panel: the Stepo wordmark, an Archivo headline ("Time to update Stepo"), one plain sentence, and a single ink "Update Stepo" CTA that opens the store. It is chrome, so it is ink — zero accent, matching the quiet surfaces. When the client is below the store's minimum supported version the panel cannot be dismissed (no "Later", no back gesture); for an ordinary newer version it softens to a dismissible nudge with a muted "Later". Presentation: a full-screen moment like badge-reveal (no tab bar, no chrome), but system-triggered and shown whenever the gate trips, not once.

The store is the single source of truth (no new backend surface): the App Store / Play listing carries a minimum-version tag ([:mav: x.y.z] iOS · [Minimum supported app version: x.y.z] Android); raising it is the "break" lever. Settings' single version row doubles as the self-serve path — when the store is ahead it grows a quiet underlined ink "Update available" link. Mechanism + runbook: stepo-mobile lib/core/upgrade/README.md (built on the upgrader package, mirroring the EtonHouse pattern). No mock was drawn for this panel; the ruling above is its spec.

Rate Stepo — two rows, no gate (2026-07-28)

Both stores approved, so Settings' Support group gets its second row back: Send feedback · Rate Stepo. Two plain rows, equal weight, always both present. Rate opens the store at its review page (?action=write-review on iOS, market:// on Android).

The proposal it replaced was a star rating inside the app that routed 4–5 stars to the store and 1–3 to the feedback form. Rejected on two grounds, either of which is sufficient:

• It is rating manipulation. Sorting people by sentiment and handing the store link only to the happy ones fails the consent counterfactual the ledger applies everywhere else: nobody shown the mechanism would endorse it. Google's In-App Review guidelines name the move outright — an app "shouldn't ask the user any questions before or while presenting the rating button or card, including questions about their opinion".
• The gate has no work to do. The person with a complaint already has Send feedback, sitting directly above. A star screen inserts a step in front of both doors to decide something the visitor had already decided by choosing a row.

Not the in-app review API, either. Google's guidelines rule out a call-to-action button that triggers the review flow, and Apple's requestReview() is quota-limited and may show nothing — a settings row that silently does nothing on tap is worse than no row. A row someone taps deliberately owes them the store. Implementation: stepo-mobile/lib/core/store/store_listing.dart.

Send feedback — "Tell the person who makes this what happened." (2026-07-30)

feedback.html, the Support row's destination, drawn as the plan for the Flutter page's revamp. A profile drill-in with a bottom CTA: back chevron to Settings, the short title Feedback, no tab bar, one full-width ink Send pinned at the foot. Chrome is ink, so the screen carries zero sunset color; its one accent is the caret in the focused note, the same interactivity-not-decoration exception edit-profile already holds.

• The question is the heading. The card opens with body copy, not a display title: "What did you run into? Pick the closest fit, then say it in your own words." A settings form that greets you with an Archivo headline is filing a ticket; a sentence is a conversation. ("Fit", not "shelf": shelves are how the maker files notes, and the word has no Vietnamese footing.)
• Three shelves, not six enum values. Report's radio grammar carries Something's broken · An idea · Something else, each with a one-line hint. The backend enum keeps its six values (bug · feature · general · UI/UX · performance · other); the interface maps into them, because sorting your own complaint into "UI/UX issue" versus "Performance" is the maker's filing problem and the note already answers it.
• The note carries no counter and no minimum hint. Counting characters at someone asks them to perform effort instead of write. The field is edit-profile's fbox grown multi-line.
• One screenshot. One tile in two states: dashed add tile when empty, thumbnail with a remove control when filled. One is what a person has when something looks wrong, and a strip invites a gallery dump nobody reads.
• The founder speaks above Send. One Fraunces-italic line, "I read every note that lands here.", signed "Chau, who makes Stepo" — the authored voice, which passes the "could a human have said it" test where the rest of the screen does not. It is the reason the note gets written instead of abandoned.

The icon (icon.html — a brand board, not a screen)

The zigzag line in the mocks' top bar was a placeholder, drawn fresh in the system's icon idiom — original, but generic (rising lines are everywhere in fitness/finance) and weakly ownable. The shipped Stepo icon already has the right mark: four pills climbing like stepping stones — literally the product, and the same pill/chip language the UI speaks. Decided: B — flat tangerine, crisp pills — is the store icon. C (carbon field, newest pill lit tangerine) serves as the iOS dark appearance of the same icon, and the mono glyph covers iOS tinted mode and Android themed icons — one mark, every system appearance. The board (icon.html) shows the picked mark in its real settings: home screens, the appearance trio, notification banner, Spotlight, in-app chrome, splash. The in-app swap is done: the top-bar wordmark and the Feed tab's glyph both carry the pill mark now (ink square + paper pills in the bar; currentColor pills as the tab icon — the brand mark as "home", the X pattern). Run a real trademark/app-store clearance before committing any mark to the stores.

Assets. Final SVGs live in brand/: stepo-icon-store.svg (B, the store icon — full-bleed square, stores mask their own corners), stepo-icon-store-carbon.svg (C alternate), stepo-mark-ink.svg (the in-app top-bar square), stepo-pills-ink.svg / stepo-pills-paper.svg (mono glyphs for light/dark surfaces), and stepo-icon-android-foreground.svg (adaptive-icon foreground, glyph inset to the safe zone).

Pill weight rule. The shipped icon's pills go "dot dot dot" at small sizes: at 29px its shortest pill renders ~5.5×3.5px, and a fully-rounded pill under ~1.9:1 reads as an oval, not a dash. The re-cut fixes both axes: height 12→15 (of 100) and a minimum pill width of 28 — thicker everywhere, longer only where it was too short. Keep the long-short stagger (that's the stepping rhythm) but never equalize the four lengths — four uniform bars read as a hamburger menu.

The status-bar icon wears the app's square (2026-08-09)

Android's notification small icon is a mask. The system throws away every colour in it, keeps the alpha, and paints the shape with its own tint: white on a dark status bar, ink on a light one, notification_color in the shade. Nothing in that file can carry brand colour, so the only thing the icon can vary is which parts are solid.

The shipped icon was drawn at half size and had drifted off the mark. Measured in a real status bar beside Google's G: ours came out 16×18px to the G's 31×32. Material gives system icons a 24dp canvas with the artwork filling a 20dp live area (~83% of the height); ours filled 51%, sitting 6px off-centre. Its four bars also tapered (0.104, 0.083, 0.073, 0.062 of the canvas) where the brand mark's four pills are all the same height. It was not the mark, and it was drawn at half the size of everything around it.

Ruled: the plate, with the pills knocked out of it. Three versions were built and looked at in the same real status bar. The bare glyph, re-cut to the 20dp live area, measures 28×32 — correct by the spec, exactly the G's height, and still too light to find: four thin pills with air between them lose to solid neighbours at a glance. The plate at 22dp reads instantly but comes out 36×36, looming over every other icon in the bar. The plate at 20dp is the one that ships: 32×32, the same footprint as the icons beside it, rx 7 so the square is round without becoming a pebble, pills punched through with about 4dp of plate all round. It carries the launcher icon's figure/ground into the status bar, which is what makes it recognisable as Stepo rather than as a generic mark.

The cost is real and accepted: a filled plate is louder than the silhouettes around it, and the mark inside it is a hole rather than a shape. Checked on a dark status bar as well as a light one — the pills stay legible in both, which was the risk worth checking.

Regenerate, never redraw. The five densities (24/36/48/72/96) come out of the one SVG, brand/stepo-icon-android-notification.svg; hand-editing a PNG is how the taper got in.

The in-app mark stays ink-and-paper, whatever the store icon does. Orange never enters the chrome: inside the app tangerine means exactly one thing — live — and the feed's balance (quiet ink top bar, vivid cards, flat tab bar) depends on the mark staying black-and-white. The store icon is the one surface where the brand competes with other apps instead of its own content, so it alone may carry the loud orange.

Why Badges and Supporters diverge on purpose: they mirror the data but not the emotion. Received support is a gift → the page celebrates (podium, gratitude). Given support is agency → the page activates ("Needs you now"). Both open on a face; they part ways at what you're supposed to feel.

The density rule (Badges / Supporters / Journey lists): dense in people, light in encoding. Every row = face + name + context + ONE chip + ONE number + chevron. Starter /celebrator breakdowns, per-journey detail, and progress bars live one tap deep — that detail view is ~80% of the journey screen's supporter panel, built once.

Questions answered during review

Why a trail on the journey screen instead of the current calendar / grid? A journey is a story, not a schedule. The trail keeps the two recognition anchors visible (first step = where Starters were made, final step = where Celebrators are made) and shows who joined where — a calendar can't carry any of that. The deeper reason: a date-grid visually rewards daily regularity, which is streak-thinking — and Stepo explicitly has no streaks. A month view full of empty days punishes exactly the user Stepo exists to encourage. A media grid view mode (Instagram-style, for 30+-step journeys) is compatible and scoped V2; a calendar is not recommended in any version — if a time-based surface is ever wanted, reframe it as a "monthly recap" (what happened), never a grid of days (what's missing). (2026-07-13: the trail's contents were upsized from compact rows to chapter cards — see the Q&A entry "Chapter cards — the trail ruling, finished". The calendar/grid rejection stands untouched.)

The mirror-door formula (one number per door, same math both ways). Both doors are badge sums, per the spec: Badges Earned = badges you earned on others' journeys (12 = 3 Companion + 5 Starter + 4 Celebrator); Support Received = badges others earned on yours (19 = 3 + 9 + 7). Raw step-with tallies ("87 given", "29 received") are captions, never door numbers — step-with is the currency, badges are what it buys, and the doors count what was bought.

Where do journey/step counts live on the profile? On the segmented tabs ("Journeys · 3" / "Steps · 41") — inventory counts belong on the inventory. The big numerals stay reserved for the two doors (people-stats outrank content-stats in the hierarchy).

Navigation contract. Five-slot bottom bar, Threads-style: Feed · Search · [Step] · Activity · Profile. Search and Activity are destinations, not drill-ins — no back arrows. The tab destinations carry zero icons in V1 on the top bar (wordmark only on Feed; gear on own Profile). True drill-ins get a back affordance; the content drill-ins (journey, step) additionally carry a quiet breadcrumb/title (e.g. "Step · {journey}") and a single overflow ··· that opens the step/journey sheet — per journey.html / step.html. The one act that joins it there is the journey screen's + for the owner of an ongoing journey, because that screen is pushed full-screen with no tab bar and therefore no Step FAB ("The journey screen carries its own doors", 2026-08-12). Share is never in the app bar: the card's Share action and the overflow sheet's Share row already own it, so a third app-bar share is redundant (ruled 2026-07-18). The unread badge lives as a dot on the Activity tab's bell.

Tab-active rule: each of the four tabs lights on its own screen; Profile stays lit on its drill-ins (badges, supporters); content drill-ins (journey, step) light no tab — they're reachable from anywhere, so claiming a tab would lie about where you are.

The bar floats, so every page under it owes it room (ruled 2026-08-09, from an early user). The bar paints over the page rather than shortening it, which is what lets content pass behind it as you scroll. The cost is that a list ending at its own padding ends behind the bar with no scroll left to free it: on Support Received the last supporter was half-covered and unreachable. Any scroll view that can reach the bottom of the screen under the bar reserves the bar's full footprint below its last item. The number is read off the framework at build time, never written down, because Profile's drill-ins are one page mounted two ways — under the tabs for the owner, above the whole scaffold for a visitor — and a hard-coded bar height would punch a hole in the visitor's copy.

Composer rule: the [Step] FAB opens create-step as a full-screen modal sheet — X to dismiss (back to where you were), no tab bar, no tab lit. The journey flow (create-journey → create-first-step) presents the same way, with a real back arrow between its two screens and a step indicator ("1 of 2" / "2 of 2") top-right. Onboarding and sign-up also carry no tab bar — there is no app behind them yet.

Where does chat go when it exists? The single top-right icon on Feed only — the Instagram DM pattern, landing in space that's deliberately empty in V1 (so adding it is purely additive: no reflow, no re-learning). Not a tab: a chat tab would compete with Feed as "where conversations happen" and break one-job-per-screen. Chat is V2; no dead icon ships until then — the feed mock now shows the V2 state (icon + unread dot), and chat.html / chat-thread.html mock the feature itself.

Why is journey creation two screens instead of one long form? The spec's rule — every journey must have at least one step — means creating a journey IS posting its first step. One combined form would bury that: the title deserves its own typographic moment (it's the story's name, rendered in the authored serif as you type), and the first step deserves its marigold framing (it's where Starters will be made). Two screens, one transaction, each with one job. The reverse door exists too: create-step's "+ Start a new journey instead" jumps into the flow.

Why is onboarding a single screen? Sign-up already did the pitch — the collage and the promise. After auth there is exactly one thing between the user and the feed: confirming who they are (avatar, name, username, ToS). Every extra beat (interest picking, permissions priming, follow suggestions) is a tax on the first session; follow-suggestions is the only one worth building and it's V2, after there are people to suggest.

Why doesn't the first step get the carbon blackout, if Starter is the scarcer badge? Because scarcity calls for urgency, not celebration. The blackout celebrates an achievement that exists (the payoff of a 5+ step story); a first step is a promise that doesn't exist yet — give day one the fireworks and the design rewards declaring goals instead of pursuing them, and pressures the tentative starter with a tuxedo they didn't ask for. Rarity is also the mechanism: first steps vastly outnumber finales, and two blackouts equal no blackout. The first step's scarcity is priced where it converts — the marigold card's prompt line ("step with her first step and you become a Starter") — in the dawn register of the sunset taxonomy. If the backend allows, live first steps may additionally sort to the top of Live (the finale gets the spotlight; the first step gets the front row) — an optional ranking rule, not a design dependency.

What ratio does step media display at in the feed? (2026-07-09 ruling) Fixed width, natural ratio clamped to [1.91:1 wide … 4:5 tall], center cover-crop beyond the bounds, applied at display time only (originals are never destroyed). Native 3:4 camera portraits render at 4:5 — they feel vertical while losing only a ~3% sliver top and bottom; 9:16 screenshots crop to 4:5; panoramas floor at 1.91:1; square and mild ratios display natural. Deciding criterion: the feed must keep ≥2 live cards reachable per swipe ("who needs me now?" dies at one-post-per-screen) while a progress app must never mutilate the proof photo — the clamp band is the only option protecting both, and it matches the profile filmstrip's 4:5 so all media speaks one portrait grammar. Rejected: fixed landscape (decapitates 3:4 shots, ~44% loss), free natural ratio (9:16 posts exceed a viewport), letterbox blur-bars (un-premium filler), zone-dependent clamps (cards would reflow when the window closes), stored upload crops (detail views couldn't show more). Runner-up: natural-up-to-3:4 — wins if Stepo ever goes media-first with lighter card chrome. Corollaries: the compose preview shows the exact feed crop (no surprises); carousels lock their viewport to the first image's clamped ratio; video uses the same band; step detail may show up to 3:4 natural with tap-to-fullscreen for the original.

REVISED on device (2026-07-13): the tall clamp tightens to square — [1.91:1 wide … 1:1 tall]. The 2026-07-09 band was ruled on mocks; the PO's device pass showed 4:5 still fails this ruling's own deciding criterion — a 4:5 card plus its chrome overruns one screen, and "who needs me now?" dies at one-post-per-screen. Square media + chrome always fits with headroom. The crop cost that made 4:5 attractive (~3% off a 3:4 portrait vs ~25% at square) is repriced by the ladder of disclosure ruled the same day: the feed crop is a glance, not the photograph — card tap (media included) → step detail, which shows the media whole (natural aspect, fit-width, uncropped, any ratio) → tapping media on the detail opens the viewer (zoom). Cards never open the viewer directly — a card is navigation into the step and its conversation; the lightbox is for when you're already there (the same logic that kept the profile grid a navigation index). Chapter cards share the card grammar and take the same clamp. Display-time-only, compose-preview-shows- the-feed-crop, carousel-lock, and video corollaries all carry over unchanged; profile filmstrip thumbs stay 4:5 (thumbnails, not cards). (Named as the system-wide contract and extended with the composer caption on 2026-07-18 — see "Media discloses more the closer you get".)

Why full past cards instead of the collapsed timeline broadcast-orange had? Cold start: for months most sessions will have 0–3 live windows; if past steps collapse, the feed is empty paper. And per the spec, late interactions are still valuable — a step is still tappable, heartable, commentable after its window. Collapsed rows survive only as the digest.

Does Search need a landing state before the user types? (2026-07-10 ruling) Yes — three zones: Recent, then suggested people, then trending journeys. Deciding criterion: Stepo has no explore tab and the feed is following-only, so the Search tab is the only place a new user with zero follows can bring the app to life; a blank field at that moment is a churn point, not restraint ("dim the mechanics" protects memories — a landing has none to protect). The spec already mandates it (search_overview.md: the tab "opens with recent searches and trending content"; suggested users ranked by mutual followers + recent activity; trending journeys by 7-day StepWith engagement — the endpoints exist and the shipped app already has an unstyled explore mode). Rejected: recents-only minimalism (starves the sparse-graph cold start), IG-style media-grid explore (doomscroll surface, off-spec, rewards lurking over stepping-with). Runner-up: an end-of-feed "find more people" module — complementary, not a substitute (passive vs. the active intent of a Search tap); V2 candidate once empty-feed drop-off data exists. Corollaries: recents move OUT of the typed state (recents under results imply the search failed); suggestion rows use relationship reasons, never follower counts; the only accents on the landing are semantic chips (Achievement / Live).

Notifications: revamp or keep? (2026-07-10 ruling) Keep the Activity screen's architecture — SeenAt/ReadAt zones, live creator strip, one-accent rows — it already encodes the system correctly; a visual revamp would be churn without a user outcome. (The 2026-07-31 wave kept that architecture and moved where Read is stamped: the visit reads, the tap travels.) What changed instead: tap destinations became contract (the old mock sent every row to journey.html; interaction rows must land on the step, people rows on the profile — a notification that lands one screen away from its promise teaches users to stop tapping), the missing types got rows (NewStepAlert, deleted-content strikethrough, system announcement), and the whole system now has a spec board (notifications-board.html). Push doctrine decided there: announce people and openings, never mechanics or nags — we push that a window opened (an event someone caused), never that one is closing (a countdown nag; urgency lives in the feed where the user chose to look). No streak/come-back/milestone pushes, no re-pings, no digest pushes. One voice from lock screen to row: title = actor's name, body = action + ≤150-char preview, no emoji; step/journey pushes carry the step photo (rich push both platforms), comment pushes stay text-only, people pushes carry the face. Rejected: IG-style filter tabs on Activity (volume doesn't justify chrome yet — V2 if mixed-type volume demands it); window-close recap push for the owner ("12 stepped with you" — good V2 candidate, in-app first). Deltas flagged as backlog, not silently changed: backend copy pass ("Step with you by replied" → the board's voice, live suffix on first-step/achievement pushes), RecognitionReceived/RecognitionEarned missing from spec table + enum, iOS Notification Service Extension + Android largeIcon avatar in payload, per-step thread-id.

Is the never-send list principle, or founder taste? (2026-07-10, challenged same day) Challenged with "Threads sends some of these." Re-run against the end-user criterion using a sharper test — the consent counterfactual (would the recipient, knowing everything, have chosen to receive this push?) plus channel economics: Stepo's core loop (step-with inside 24h) physically travels through notifications, so mute rate is an existential KPI — Threads monetizes the attention its pushes harvest and can afford a mediocre notification reputation; a muted Stepo is a dead Stepo. Under that test the list split. Bans that survive on economics, not taste: streak/come-back guilt (the app cheering for itself), milestone flattery (taps through to nothing but your own numbers), suggested-content pushes (strangers you never chose — added explicitly during this challenge), re-pings. Two items were overshoot, promoted to earned exceptions (V2): the finale last-call (once, closing hours, companion-tier recipients who haven't stepped yet — missing a finale you supported for months is permanent, unrecoverable regret; the "no countdowns" ban now applies to ordinary steps only) and the lapsed-week digest (7+ days away, real events from your own graph, never generic, self-silencing after two ignored sends). Runner-up: keep the absolute bans — wins again if the guardrails erode in practice (last-call creeping to ordinary steps, digest going generic → revert to the ban).

Notification prefs: 4 spec categories or the screen mock's 7 toggles? (2026-07-10) The 7+master of settings-notifications.html wins, and the board + notification_overview.md were updated to match it (the board had claimed to mirror the screen while summarizing the spec's coarser five — that inconsistency was the bug). Deciding criteria: the spec's categories were inherited-generic groupings ("Step Engagement" lumped post-window hearts with comment replies; "Social Activity" lumped follows with mentions) while the screen groups by relationship direction — Your steps / Following / People — matching the user's mental model; and the splits users will actually want are volume splits the coarse four can't express (muting "Journeys you follow", the loudest type, without silencing a friend's achievement; muting "Later engagement" while keeping the window sacred). Type mapping is in the spec's User Controls tables. Edge rulings: toggles govern push only (Activity always shows every row); FollowRequestAccepted rides New followers; SystemAnnouncement rides the master only; future types add toggles when they ship — no placeholders. Runner-up: 4+master — wins if usage data shows granular toggles go untouched, but the cost of granularity is three rows on a screen visited once.

External product-model review — what we kept, what we changed (2026-07-10) A full outside review (codex) proposed a product-model overhaul. Settled with the PO; deciding criterion throughout: end-user outcome, with distinctiveness treated as load-bearing (the retention hypothesis lives in the unique mechanics, not despite them).

Kept — the soul: Implicit step-with derivation (an explicit "Step with" button creates the two-tier support economy the review itself feared — hearts become the lesser gift; adopted only its runner-up: a one-time "You just stepped with Maya" confirmation after the first qualifying action). Window consequences (late support is valued — post-window interactions work, notify, persist — it just isn't presence; presence has a time dimension and making it legible is the product). Companion subtiers as discovery-layer surprises (never operable: no progress-toward-tier UI in V1). Supporters podium stays as owner-facing gratitude, instrumented in beta — if it produces competition instead of warmth, ordinal ranks collapse to recent/longtime buckets. Doors stay badge-sum moments (PO ruling: unique-people counts would freeze a small-circle user at "3" forever, punishing exactly the depth-over-breadth user Stepo serves; moments compound with the relationship. Legibility handled by caption copy; people are one tap deep). Share stays a full step-with kind (PO ruling, reversing the review and my own first concession: with per-journey audiences, sharing is structurally consent-based — share pages exist only for public content — and share is the costliest, most caring action plus the app's only organic growth loop; guardrails: share affordance only where a public share page exists, binary per person per step).

Changed — the review's genuine catches: Window clock starts at PublishedAt, not creation (a slow encode must not eat the window). Home stays honest, not empty (PO amendment): popularity injection stays interleaved per the feed spec, but every injected card carries a visible "Discover" label — discovery is never disguised as a followed post; follow-suggestions onboarding beat promoted to V1 (an empty feed and a lying feed are both bad apps). Per-journey audience (Only me / Followers / Public, remembered default) — no per-step override (a journey's audience is the story's audience); Selected-people circles are V2. Achievement floor drops 5 → 3 steps (beginning, middle, end — a narrative floor, not a magic number; small goals deserve finales). Achieved journeys: continuing is an explicit warned choice via a sheet whose primary action is "Start a new journey" (the IELTS 5.0 → 7.0 pattern is the paved road); continuing returns the journey to ongoing but badges are permanent, always (resolves the recognition spec's permanent-vs-recalculated contradiction: permanent). (The confirm sheet is overturned 2026-08-08 — see "Choose the journey sheet". Informed, yes; interrupted, no: the picker row and the composer row each state that posting reopens the journey, and nothing stands between the choice and Post. Badges permanent stands.) Close is quiet by design — zero notifications, zero feed events, no "abandoned" labeling; an optional closing note renders small at the trail's end for people who come looking (for sad endings, the care IS the quiet). Rejected: Paused/Archived states (silence is pause; closed reopens by stepping). Compliance simple-set: neutral birthdate screen + under-18 private defaults; deletion stays immediate (PO ruling — the 14-day grace was self-imposed, no regulation requires it, and the legal doc was aligned to the built behavior; grace is a post-launch revisit); regular-step pushes to journey followers only; reduced-motion + system text scaling honored; the report/block/moderation pipeline is the UGC filter at this scale. Demo bugs fixed (be-the-first card had counts; supporters header reused 29). Supporter ranking = step-with count (spec's lexicographic-by-badge ordering is superseded).

Second external review — the mocks catch up to the ledger (2026-07-11) A second codex review rendered all screens and measured them. Its calibration matched the first round exactly: near-perfect on audits, convergent on product taste. The headline ("redesign the recognition spine") was wrong — the recognition rules already forbade everything it found; the mocks were stale. Verdicts:

Confirmed and fixed (all verified in-file before ruling):

• badges.html violated our own 2026-07-10 ruling — "Needs you now" CTA, companion progress bar, "Don't miss the final step!" were progress-toward-tier UI in a mock that predated the verdict. Removed; the page is now all past tense (see the Badges section above). The same disease existed on journey.html's live-finish banner (codex missed it): a 90% progress bar + "9 of 14" + "don't miss." Fixed under a new codified line — a count is a memory, a ratio is a meter: presence lines may count ("You've been part of 9 steps"), never divide, never bar, never guilt.
• Contrast: raw accents fail WCAG as text (live 2.83:1, starter 2.36:1, celeb 3.59:1 on white — computed, not estimated). The system already owned the answer (--live-text); the twins are now in every screen's :root and the rule is global: accents never carry text (see The system). Even the door numerals re-tinted.
• 19 vs 48: profile-steps.html's Support Received door said 48; the catalog says 19. Fixed to 19.
• Rail vs zone count: the rail showed 6 open windows, the zone said 3. Contract codified: the rail is the Live zone's index — same windows, same count (now 6); cards below the fold are still in the zone.
• Stale-ruling propagation: the mocks now carry the settled 2026-07-10 verdicts they were missing — Discover chip on the injected feed card, neutral birthdate on onboarding, follow-suggestions noted V1. Still deliberately absent pending PO go: per-journey audience picker (own session), self-harm report category.

Accepted as a new ruling:

• Profile hierarchy — the one product point codex won, because it wins by our own doctrine: the ink follower bar was the single convergent status metric on a page that claims to be a progress record, and it punishes the small-circle user the doors ruling protects. Follower counts are now one quiet line under the bio.

Held (re-litigated without new evidence — the standing rulings apply):

• Supporters podium stays owner-facing gratitude with the beta tripwire (if it breeds competition, ordinal ranks collapse to recent/longtime buckets). The discovered-not-operated line binds the actor, not the recipient: Linh never sees her rank; the owner sees who showed up.
• The feed rail stays — it is identity mechanic #1 made ambient (hours-left on every open window) plus the jump affordance, not duplication (see the index contract above). Action rows below media are universal feed grammar; no fold-chasing.
• Responsive/touch-target audits of the HTML prototypes measure the wrong artifact: the shipping surface is Flutter (Material hit-target minimums, constraint layout); reduced-motion, text scaling, and the hit-target audit already sit on the launch backlog. The one real catch — contrast — is fixed above because it lives in the tokens, which are the spec.

Flagged open, then resolved (third review round, 2026-07-11): the voice ladder in recognition_overview.md turned out to be a Progress Messages table keyed to percentage bands — copy indexed to a progress formula is a meter regardless of which surface renders it, so no trace was needed. The pre-qualification ladder is retired (codex's ruling, accepted — it argued from our own meter rule and won): recognition copy is earned-only (reveals + memory language, spec'd in recognition_overview.md → Recognition Voice); "What a friend!" survives as the earned Companion reveal; "One day or day one" as brand editorial only. The spec's Companion Progress Percentage section was deleted and the tier DTO no longer specs the step-with ratio (a ratio in a DTO is meter fuel).

State debts (codex's "only golden paths" list, triaged): deliberate states the catalog now owes — offline/retry, media processing/failure, upload cancel/recover, permission denial, private/no-access content, crisis-report response, account-deletion confirm, long-text/large-type. These are catalog entries and Flutter states, not new mocks; deleted/moderated content already renders (notifications' struck-through row), empty-feed already ruled (Discover injection + "be the first" card).

Own profile vs someone else's — and the private door (2026-07-11) Asked: is the visitor's profile different enough from your own to need a mock, do we need a private-account mock, and where do follow requests get accepted?

Own vs other: the chrome deltas (Follow replaces Edit, drill-in app bar with report/block, no "+" compose tile) could have been a docs paragraph — but one thing couldn't: what happens when a visitor taps the doors. If that tap opens the ranked Supporters page, any supporter can see her own ordinal rank on someone else's profile, and "owner-facing gratitude" — the exact premise the podium tripwire contract stands on — is broken. Ruling: doors render on every profile as identity (numbers + faces); the ranked Badges/Supporters pages are owner-only. The display-only clause and the deferral of the unranked visitor list were superseded 2026-07-15 ("Visitor doors open"): the runner-up recorded here — a visitor tap opening an unranked list, real relationship-first discovery — was promoted by PO ruling to the intended product model, viewer-filtered. The ranking half of this ruling stands permanently. Because this ruling must be visible to builders, it earned a mock: profile-other.html.

Private account: profile-locked.html. Public metadata visible, nothing else — private leaks nothing below the head, not even door numbers (a support graph is relationship data). The mock shows the Requested state because that's the state builders get wrong (it's a quiet outline, not a disabled button, and it cancels on tap). Zero accent; the emotional register is a door held kindly, not a wall — most private accounts will be minors (private-by-default under 18).

Where requests are accepted: already designed and shipped in the V1 list — Activity's inline Accept/Decline row plus the "accepted your follow request" confirmation row. The locked page's whisper points there. No new surface.

Wiring: every people tap now resolves to profile-other.html (feed author avatars, search + search-landing people rows, followers list, Activity people rows); one search-landing suggestion (Astrid) goes to profile-locked.html to demo private-from-discovery. Neither new screen lights a tab (drill-in rule, same as journey/step). New cast recorded in the state catalog below.

Fourth external review — three stands, six amendments (2026-07-11) Codex reviewed the two new profile screens and the round-3 propagation. Verdicts:

Held — moment-of-action prompts keep the tier name. Third re-litigation of recognition copy, now codified so it stays settled: single-act tiers (Starter/Celebrator) may be named at the moment of action — the moment IS the qualification, there is nothing to grind. One first step, one finale; no campaign, no accumulation, no proximity. What earned-only forbids is prospective advertising of the multi-act tier (Companion — the grindable one), and no surface does that. Stripping "…and you become a Starter" from the feed prompt would trade the moment's legibility (the reward named at the invitation — why the moment feels special, and the feed's conversion engine) for no reduction in operability. Post-action reveals already use the earned grammar ("You were there at the beginning — Starter").

Held — the unranked visitor door list stays deferred, for a reason the review missed. A browsable support-graph surface exposes third parties: the people on Lena's doors may be private accounts or minors, and "who supports whom" is relationship data about them, not just her. That surface cannot ship before the audience session sets third-party visibility rules — this is right-layer sequencing, not scope-dodging. What WAS wrong is the affordance: raised cards promised a tap. Visitor doors are now flat — a stat band, not a button. The unranked list stays V2, scheduled with the audience session.

Accepted — Companion is a chapter award (their "still needs PO adjudication" item, resolved as a consequence of the PO-signed item 7): the old spec's open-journey section granted provisional live Companions, which under permanence would freeze step-5 tiers into 100-step stories. Chapter model to its conclusion: open journeys show presence (counts, faces); Companion arrives when the chapter closes — discovered alongside the Celebrators, which is more of a surprise, not less (recognition_overview.md → Open Journeys). Backend must verify its derivation matches (round-2 work list).

Accepted — the locked page's copy presumed consent. "When she accepts" → "If she accepts"; the promise of "her journeys and steps" → "the journeys she shares with her followers" (per-journey audience means acceptance shows what she shares, not everything); the day-one promise dropped (the window may close before she answers). Declines are silent — never notified.

Accepted — minors leave broad recommendations (standing default, ruled now rather than waiting for the session): under-18 accounts never enter suggested-people or Discover injection, regardless of visibility setting; exact search + reciprocal graph only (auth_overview.md). The session may refine, not weaken.

Accepted, half — link reactivation: re-widening restores the same link (stable PublicId; predictability beats a forced modal at a simple toggle) — but a V2 per-journey "reset share link" is the escape hatch, and public-share UI gains the honesty caveat that external caches may hold previews Stepo cannot retract (journeys_overview.md).

Fixed — flow and propagation: whole author block taps in the feed (not just the avatar); back = invoking context and kebab = profile action sheet (Report profile · Block), both annotated in profile-other.html; Runa Vik (the locked search result) now opens the locked page and Astrid the public one — people links are identity-consistent by state; the supporters-ordering contradiction in this doc is reconciled (step-with count ranks; the chip leads the row); the tripwire gained a pre-registered instrument and threshold with owners as the primary signal; handoff/review-doc counts and the stale "flagged open" line corrected.

Submission pass — the five missing moments (2026-07-11) Preparing for store submission, we ranked what the mocks still didn't cover and built the top five in one pass (five screens + one board, all fork-built, specs propagated same-day). The rulings, in priority order:

1. First-run empty states (feed-empty.html + states-empty.html). The App Review reviewer creates a fresh account and lands exactly where we'd never designed. The feed ruling: a zero-follow feed is Discover-fed, never a blank "follow people first" gate — a dead first screen is the worst first-run UX (liveness doctrine), and the backend already serves it (0-follow cadence, hot-set backfill). Honesty holds: every injected card wears the chip. (A same-day PO amendment added founder auto-follow as a primary layer; the fifth review overturned it — see the next Q&A entry. The surviving design: an editorial founder-welcome module with an explicit Follow action.) The other empties stay deliberately quiet — Activity never nags, profile doors show honest zeros with the Start-a-journey tile as the only CTA, and a failed people search never backfills with filler. Empty is only a problem on the surface whose job is liveness. 2. Notification permission priming (onboarding-notifications.html). iOS grants one native prompt and the core loop travels through notifications — the single highest-leverage screen we didn't have. The priming leads with the quietness promise because the never-send list makes it literally true; one real push preview is the proof. "Not now" defers to a natural moment, never a nag loop. 3. Delete-account consent sheet (settings-delete.html). Apple 5.1.1(v) + our immediate-permanent deletion means the consent copy must be exact and plain; the sheet also separates intents (sign-out escape hatch) so deletion is never the accidental path. Danger ink, never rose. 4. Self-harm category + crisis response (report.html + report-crisis.html). Apple 1.2 and duty-of-care: a person-at-risk report is not a policy report — it jumps the queue, thanks the reporter warmly, promises anonymity, and offers resources after submit so the report itself is never obstructed. Copy this sensitive is designed here, not improvised by implementers. 5. The badge reveal (badge-reveal.html). Mechanic #3 says recognition is discovered — and the discovery had no mock, which meant the implementers would have defaulted to a toast. Full-screen, once, one saturated pill, verbatim memory line, no share button (a reveal with a share CTA becomes a performance surface), no next-tier hint. Arrival only.

Runner-up (deliberately not built): offline/retry/media-failure states — that's the external reviewer's state-debt enumeration ask; one states board gets commissioned from its output rather than guessed at now. Under-13 signup refusal needs no mock (a plain blocking line; the neutral birthdate field already never telegraphs the threshold). Also fixed in this pass: the V2 table's stale follow-suggestions row (it was promoted to V1 on 2026-07-10 and built), and the gallery's stale badges blurb (still advertising the removed "Needs you now" card).

Fifth external review — the overturn and the honesty pass (2026-07-11) The strongest round yet: nearly every audit receipt verified real, and the one product overturn was argued from our own doctrine — so it won.

Overturned: founder auto-follow. The same-day PO amendment (every new account auto-follows the founder) fell to a doctrine-internal argument: Discover already delivers the day-one liveness (0-follow cadence, backfill), so the auto-follow's only unique products were an unauthored graph edge and a "1 following" the user never chose — and Stepo's identity says relationships are real (step-with is noticed, never performed). The replacement is our own template, keep-the-mechanism-add-the-honesty: a dismissible editorial founder-welcome module with an explicit Follow Chau action. Founder presence on day one survives intact; the follow becomes user-authored; the manufactured count becomes real, chosen follows. The PO's underlying goal (seeded content, never-empty first feed) is fully preserved. Codex also caught the mock undermining its own rationale (ordering put the "primary" founder card last).

Copy honesty — three fixes in the new screens, all real: the delete sheet no longer overpromises physical erasure ("disappear from Stepo right now… your identity is permanently deleted" — matching the anonymize-and-hide contract); the crisis response no longer implies a 24/7 human desk ("We've marked this urgent" + "Stepo isn't an emergency service" + tappable resources); the priming promise dropped the falsifiable "never 'come back'" (the V2 lapsed digest would break it) — the promise only says what is true forever. The primer's "only people" is kept true the other way: SystemAnnouncement is Activity-only (push only for critical service/legal notices).

New rules ruled: recognition is never pushed (a lock-screen line would front-run the reveal; the previously proposed recognition push types are withdrawn; owner-side record is a quiet Activity row); reveal queue — one reveal per session, oldest first; simultaneous chapter-close awards present as one combined arrival, Companion primary; time-sensitive social acts never silently replay offline (a queued heart landing after the window closes manufactures presence the user never chose — drafts and uploads persist, interactions fail fast and quiet). Propagation defects fixed: Companion DTO arithmetic (tier enum only), the 3-step floor in steps_overview + two mock comments, journey-follow gating keyed to effective audience, Discover exclusions rewritten (effective-Public, adult authors, blocked/muted/reported, minor viewers get the seeded editorial pool only), error_states_overview replaced (quiet empties, the screen-state matrix, the offline rule), "or invite them" cut (promised a feature that doesn't exist).

Held against codex: Circle audience stays V2 — the new-follower-inherits-history hole is real but mitigated by follower approval on private accounts, no store guideline demands it, and it's a real scope hit on the road to submission; the audience grammar reserves its slot (Only me < Selected < Followers < Public), revisit at launch. The lapsed-week digest stays — codex wanted it retired to make the primer copy true; that's fixing copy by deleting a retention mechanism, backwards — we fixed the copy. Prototype navigation conventions stand (back targets, representative profiles, kebab→representative sheet): static HTML can't know its invoking context; the conventions are annotated in-file and the real behavior is spec'd and built in Flutter. "Just switching phones" stays — warmer, and it's the actual user intent. Web findings parked by PO (out of scope now; the list is kept for a pre-launch stepo-web pass). The audience-transition matrix and Discover contract were accepted as session inputs, not V1 scope.

Founder distribution — the onboarding beat (2026-07-12) The PO rejected the round-5 welcome module on sight ("don't like it") and proposed the right surface instead: the follow-suggestions onboarding beat, with the founder on it — plus a hard gate ("force user must follow 1–2 people"). Three-way convergence followed: PO picked the surface, design authority supplied the mechanism, the external reviewer added the legibility polish. Final ruling (built as onboarding-people.html):

• Surface: the existing "People you might know" beat becomes a selection screen. It beats the feed module on every axis — it's the surface whose job is choosing who to follow, the follow is explicit, and it runs before the feed, so day one opens already-followed for most of the early network.
• Founder as ordinary row, pinned first, pre-selected — no banner, no special styling; the caption slot carries the honest reason. Position + default + a real early-network relationship produce the ~90% founder-follow rate without a single manufactured edge.
• The button says what it does (reviewer's point, conceded): "Follow N and continue," dynamic — a generic "Continue" that creates follows is visible consent but not legible consent. Zero selected → plain "Continue," creates nothing.
• The hard gate was rejected (both advisors, PO accepted): force only acts on the ~10% who deliberately deselected everyone, and those users would tap a random person to escape — recreating the hollow-graph problem force was meant to solve. Discover already protects the skipper's feed. The maximum-defensible fallback (must pick someone, founder replaceable) is on record but not chosen.
• Bright lines (never violate): founder always deselectable; nothing followed before the button tap; exactly one pre-selected account, ever. Silent follows, un-deselectable rows, or bulk pre-selection cross from strong onboarding into manufactured relationships.
• Kill-switch: pinning reads from EditorialSeedAccountIds (already shipped for the minor-viewer seed pool) — cleared when growth escapes the founder's network.
• No interests screen: Stepo has no topic taxonomy that would consume the answers — pure friction plus fake-personalization smell; revisit with the Discover relevance session. The feed welcome module is retired before it was ever built; feed-empty.html returns to the clean Discover-fed state with the quiet Find-people strip.

Canvas temperature — neutral app, warm human moments (2026-07-12) The PO's designer challenged the warm-paper canvas: cream + warm brown ink + marigold + rounded cards + Fraunces italic has become the recognizable "AI-generated warm lifestyle app" aesthetic, and reads low-effort to exactly our early-adopter audience. The challenge was upheld — with the fix landing on calibration, not on white.

• Diagnosis: base paper #F6F4F1 was only ~2% warm; the cream read was the aggregate of paper2, the beige desk gradient, ambient marigold, and warm-tinted shadows.
• Candidates, judged on a four-temperature board (theme-lab/, feed + profile + journey each): CURRENT warm · NEUTRAL #F5F5F4 value-matched · BRIGHT #FAFAF9 (codex's calibration, solid #E7E6E3 borders) · WHITE #FFFFFF reference.
• Ruling: BRIGHT (PO + designer + codex; design authority argued NEUTRAL and conceded on the on-glass judgment — under warm ambient light the value-matched canvas can still read beige, and solid borders carry card hierarchy the way the category's crafted apps do). WHITE rejected: cards flatten to hairlines. Screen-scoped warmth rejected: warmth is element-scoped (accents, serif, photos, moment surfaces), never per-screen canvases.
• What deliberately did NOT change: the sunset accent taxonomy, Fraunces italic (it does product work — authored voice — which the canvas's warmth never did), radii, card grammar. Neutralizing the canvas makes the accents more semantic: a first step is yellow because it is a first step, not because the app is already yellow.
• Follow-ups: ambient-marigold audit (accents only where earned) — separate pass; mobile AppColors swap rides the next coding-agents round; store shots re-rendered from the retinted mocks automatically.

Milestones — a landmark, not a reward (2026-07-13, V2) Mid-journey milestone markers, adjudicated from a codex proposal + a PO instinct (codex: pure narrative marker, no reward economy; PO: milestones feel kin to first/final steps — maybe a badge or extra Companion credit).

• Adopted (codex core): a Milestone is a special step inside an ongoing journey marking something that already happened; the journey stays ongoing — only a Final Step mints an Achievement; First Step / Milestone / Final Step are mutually exclusive; while live it behaves like any step; its normal notification may say "reached a milestone" but creates no additional push; retro-markable, silently; unlimited, framed "Mark as milestone — A small win that changed the journey."; no milestone totals, progress percentages, checklists, deadlines, or meters.
• REJECTED — Companion multiplier: Companion must stay legible ("walked enough of the road"). Weighted step-with credit makes which steps you attend strategic (farm the peaks), turns presence-memory into hidden arithmetic, and makes the role unexplainable.
• REJECTED — a new role (e.g. "Milestone Witness"): Starter and Celebrator are minted by a journey's two natural singularities — exactly one beginning, at most one ending, neither author-mintable (a finale even costs the journey its ongoing life). Milestones are unbounded and author-minted at zero cost; a role minted from an unbounded author-controlled event is a reward economy, and it corrupts the marking act (authors would mark milestones to mint badges). Marking must stay consequence-free for others so it stays honest for the author.
• ADOPTED — witnesses elevated in place (the piece codex's "nothing" missed): the milestone's memory line is a permanent, prominent part of the landmark ("Reached with Minh, Linh and 9 others" — faces first), and milestones anchor look-back, so presence at the peaks is specially remembered on the journey, not as profile inventory. Roles attach to relationships (beginning / road / end); memories attach to moments — milestone presence is deliberately a memory, not a role. Companion display language may later cite milestone co-presence descriptively ("was there for the big ones") — words, never arithmetic.
• Why it's near-core, not bloat: on a journey whose finale is far away (Making Stepo), milestones are the only mid-road peaks — this gives long journeys their celebration beats without ending anything. Taxonomy stays: First Step → Starters · Milestone → landmark + elevated witnesses · Regular Step · Final Step → Achievement + Celebrators · Companion → the road.
• Timing: V2, post-launch; not a submission item. Needs mock passes (timeline chapter-marker treatment, create/edit flows) before any build.
• (Superseded on presentation, 2026-07-13: the trail the milestones sit in was upsized to chapter cards — see "Chapter cards — the trail ruling, finished". The milestone MODEL above is untouched.)
• Round 2 — codex "milestone seals" (same day): core REAFFIRMED, payload ADOPTED. Codex revised toward the PO instinct: a permanent named seal per witnessed milestone ("You were there when Maya ran her first 5K"), +1 Companion credit, a pre-Companion keepsake, guarded by declare-before-publish / no-downgrade / no-visible-points. Adjudication: the +1 credit is the multiplier renamed — invisible arithmetic is worse for Companion legibility, peak-farming returns, and marking becomes a gift lever (the author knows who will step with what they post). The seal-as-object is an author-minted, recurring, permanently-missable collectible — every milestone becomes a scarcity event (miss the 24h window, permanently miss the keepsake), FOMO machinery on unbounded author-controlled supply; Starter is safe with the same missable-moment property only because a journey has exactly one beginning. The tell: every proposed guardrail exists to contain the economy the seal introduces, and one (declare-before-publish) would kill retrospective marking — the economy taxing the story. ADOPTED — the witness-side emotional payload as memory display in three places, never an object: (1) special step-with acknowledgment on a live milestone ("You were there. This one was a milestone." — a moment, not inventory); (2) the permanent in-place memory line (already ruled); (3) Companion reveal/detail cites witnessed milestones by name — codex's example copy ("You walked 7 steps with Maya. You were there for First 5K without stopping.") ships verbatim as display language. No credit, no object, no pre-Companion inventory surface. Dividend of no-economy, now explicit: retro-marking stays (silent) and unmarking is allowed — the story remains the author's to edit. Governing line: roles attach to relationships, memories attach to moments, and nothing the author marks may disburse value — milestone presence is remembered everywhere it emotionally matters and counted nowhere.
• Round 3 — RULING FINAL (codex adopted the model, same day). Codex withdrew both the +1 credit and the seal, and contributed one additional bright line, recorded: a milestone receives no extra push, no ranking boost, and no urgency treatment — the underlying step follows normal notification and feed rules; author-minted scarcity must not return through distribution instead of badges. Restated final model: Milestone is an editable narrative designation on a regular step (addable retrospectively, removable, always silent); it never changes Companion arithmetic, feed ranking, or step-with value; it grants no badge or collectible; presence is remembered in the moment ("You were there. This one was a milestone."), in place ("Reached with …", permanent), and in the Companion reveal (milestones cited by name). Milestones make Companion more meaningful, never easier or more strategic to earn.
• Display rulings for the screens (2026-07-13): milestone treatment is ink-weight, not accent — the sunset accents belong to recognition moments (live/Starter/Celebrator); authorial narrative structure is ink. Timeline: filled ink trail node (vs hairline nodes), small uppercase "Milestone" kicker, heavier title, permanent memory line "Reached with …" (faces first). While live, live rules override — the 24h window stays the loudest read. Feed card while on air carries one quiet ink-outline "Milestone" chip (information, never urgency; ink is not an accent, so one-accent-per-card holds). Mocks: journey-milestones.html (landmark treatment in a long ongoing journey) + milestones-board.html (spec board: mark/unmark flows, feed-card chip, live acknowledgment moment, Companion reveal citation, bright lines).

Chapter cards — the trail ruling, finished (2026-07-13, V1.1)

Amended 2026-07-16 by "The trail runs newest-first" (above): trail direction reversed to newest-first and the hero jump chip retired. The card grammar, spine + nodes, people card, scrubber, and never-elided rulings all stand.

The PO's designer challenged the journey trail's compact rows (46px thumbs, one-line truncation, counts instead of faces, "Show N more" eliding the middle); codex concurred with a hybrid; the PO felt the same; the design authority CONCEDED — honestly: the original trail ruling adjudicated trail-vs-calendar/grid and never ruled on row size. The compact rows were an unexamined default, and the milestone work exposed them (landmarks read as cards, ordinary steps read as filler). The journey screen is the look-back surface — it must be the best reading surface in the app.

• Chapter cards = feed step card MINUS a documented delta — one grammar, one delta, never a second card spec. Removed: the journey title line (the page is the journey), the author row (the hero is the author), Follow, any Discover labels. Kept: full untruncated authored note (the note is the product), large media on the established aspect clamp — every step has media (PO product invariant 2026-07-13: the composer requires it; a "text-only step" state does not exist in Stepo, so every chapter card carries a media block), the memory line with faces first ("Priya and 10 others stepped with him" — the compact rows' bare counts violated people-before-numbers; this redesign repays it), normal past-card quietness ("dim the mechanics, not the memories"), live treatment only inside the window.
• Timeline spine + nodes survive at the cards' left edge — marigold first-step node, ink milestone nodes + MILESTONE kicker + "Reached with" verb (the milestone differential was never about card size), tangerine live node, rose finale node.
• Hierarchy restructure: journey hero (serif title, description, owner, meta) → compact "people of this journey" summary (faces + roles, one row, supporters one tap away — the dense ledger no longer blocks the story) → the chapter-card timeline, story order, oldest first, never elided ("Show N more" is dead).
• Pointer, not duplicate: the live-finish banner and the tiny final row rendered the same moment twice. Now the big live/final card is the ONLY rendering, and the hero meta carries a one-line jump chip ("Live now · 6h left →") that scrolls to it. A pointer to the card, never a second representation.
• Date scrubber (long journeys only; hidden short): appears while dragging, handle shows month + step number, stronger ticks at First/Milestone/Final (marigold/ink/rose, mirroring node semantics) with light snap + haptic. Bright lines: the scrubber is a position tool, never a meter — no percentages, no progress framing, no fill-toward-the-end visual. No calendar, no Story/Grid toggle yet (media grid stays parked V2 for 30+-step journeys).
• Timing: V1.1, post-launch, built together with Milestones (they were designed against each other). The submission build ships the compact trail unchanged — at launch-era journey lengths the difference is invisible, and the screen is verified end-to-end; density is cheap to change later, wrong models are not. Mocks: journey.html + journey-milestones.html reworked to chapter cards; scrubber documented on milestones-board.html.

People of this journey — the recognition card, rebuilt (2026-07-13) Codex's review of the chapter-card rework: timeline approved; the one-row people summary judged underpowered for a defining surface (PO concurred), plus three timeline refinements. Adjudication:

• ADOPTED — the destination bug (codex's best catch): the people row linked to supporters.html, which is the owner-only, cross-journey, RANKED surface. A journey's people belong to a journey-scoped page: journey-people.html — header (journey title, owner, total unique people, the viewer's own place when applicable), filter chips (Everyone / Starters / Companions / Celebrators, in story order per "The journey screen carries its own doors", 2026-08-12 — a person may appear under several), person rows = face + name + earned role chips (canonical tier names) + relationship language, never arithmetic + witnessed milestones cited by name. No numbered ranking, no "13 of 14". Supporters stays the owner's private cross-journey surface; this page is the memory of ONE journey, and it ships with the card (V1.1).
• ADOPTED — honest copy: "walked this whole way with Marco" is only true of Companions → "You, Sofia, Kofi and 39 others became part of Marco's journey."
• ADOPTED — the card itself, rebuilt (the one-row summary was the design authority's over-correction): kicker "People of this journey" + quiet total; the viewer's own relationship as the emotional lead ("You were there at the beginning — and for 9 steps along the way." / owner sees "42 people became part of this journey."); then three compact tappable role rows (small facepile, role name + role-color dot, one relationship sentence, quiet count, chevron), in story order since 2026-08-12 ("The journey screen carries its own doors"): Starters "were there at the beginning" · Companions "kept showing up" · Celebrators "are here for the finish" ("N so far" while the finale window is open; on a journey with no finale yet, the row reads "the finale hasn't been written yet" — no count). Substance without the former dense ledger.
• ADOPTED — chapter cards tap to step detail (they are the card's destination), but no chevrons/affordance chrome on cards — feed cards carry none; tappability is the platform convention.
• Scrubber threshold lowered: drag-only means zero cost at rest, so it is available from ~10 steps (the finale-reach complaint itself was already the jump chip's job). Static mocks stay unchanged — a drag-only control is invisible at rest.
• REJECTED — heart/comment summaries on past chapter cards: a tappable card is not inert; interaction detail lives one tap deep. A second number on every card of the reading surface is counts-creep against the density rule.
• REJECTED (parked) — "Since you last looked, Priya and 3 others…": the Activity tab owns "what happened while I was away"; a per-journey recency line is a second competing what's-new surface and stateful re-engagement machinery. Revisit post-launch only with evidence.
• Canon addition: Marco's "Played for my parents in their living room" (Mar 8) is marked a milestone — the flagship journey now demos the landmark treatment, and journey-people.html cites a real milestone instead of a hypothetical.
• Round 2 corrections (codex canon audit, 2026-07-13 — verified against recognition_overview.md and adopted, with one fix to codex's own fix): Companion tiers are PATH-BASED and the mock's chip combinations were impossible (Dedicated Follower = Starter AND Celebrator ≥50% · Early Believer = Starter only ≥65% · Consistent Supporter = Celebrator only ≥75% · Die-Hard Fan = neither ≥85%). Canonical mapping for Marco's journey — chosen over codex's proposal because theirs made Sofia a Die-Hard Fan while the first step's memory line ("Sofia and 8 others") makes her a Starter. Tier names retired 2026-07-24 ("One Companion, no ladder"); the mapping now reads with constituents de-absorbed: Sofia = Companion · Starter, Kofi = Companion · Starter · Celebrator, Ren = Companion · Celebrator, Priya Nair (canonical surname per badges.html — not "Sharma") = Starter · Celebrator. Facepiles on the journey card must match the destination page person-for-person — tapping through preserves identity.
• Milestone citations have no title field (ruled): a citation is an authored excerpt — the step note's first non-empty sentence, clipped at a word boundary; if the note is empty, fall back to "the [Month D] milestone". No milestone-title input ever — a required field would tax retro-marking, and the note is already the authored voice.
• Navigation contract: the card's role rows deep-link to the people page with that filter selected (header/total → Everyone); person rows open that person's profile ("You" → own profile), with no chevrons on person rows. "and N others" is mock shorthand only — the page must browse ALL people (lazy-loaded); a people page that can't show everyone fails its own question.
• Filter strip: next chip peeks at the edge (or edge fade) so overflow is discoverable; the strip goes sticky once the header scrolls away.

Addendum — the tense grammar of an empty role row, and the mark of a row you are in (2026-07-30, PO + design lead; amended after codex review and Fable adjudication, and closed by founder rulings on 2026-07-30 and 2026-07-31) The card ships with all three role rows present for the life of every journey (the standing "role rows never come and go" ruling above). This addendum rules what a row says when nobody is behind it yet, the three slots that ride with a row, and the mark a row wears when the viewer belongs to it. It refines row COPY and row GROUND only; row presence is not in question and never becomes conditional. Board: people-card-board.html is the single spec, rendering every state side by side in the adopted treatment.

Two hard rules: 1. A zero never renders as a digit on this card. An empty row states its condition in words and the count slot is absent. "0" is a score, and this card keeps no score. The — placeholder is banned with it (it was live on journey-milestones.html's Celebrators row and is now removed). The rule extends to the card's own header: a journey nobody has stepped with reads "No one has stepped with this journey yet." with the total in words, never "0 people". 2. A chevron exists only where a people page with members behind it exists. An empty row carries no chevron and does not tap, because the filtered page it would open has nothing to list. Count and chevron travel together. The row stays; the affordance is what comes and goes, and it returns with the first person.

The tile is the third tense signal, and it reads exactly one thing: is this row still possible (never the journey's broad status). Dashes = someone can still arrive · faces = people came · nothing drawn = the row is settled and nobody can ever arrive. So the dashed ghost tile goes on every still-possible empty row: the Companions invitation while the chapter is unsettled, the Celebrators row while a finale is live with nobody in it yet, and the Celebrators row waiting on a finale nobody has written, whose moment is ahead rather than gone. The founder ruled the widening on 2026-07-31, with the reason in one line: one rule for every possible row beats a special Companions case. The earlier "open right now versus waiting" distinction is retired with it, and where a row's window sits in time is said by the row's sentence, which is where tense belongs. A row that draws nothing keeps its slot's width, so every role label stays in one column and only the sentence gains room, from the absent count. Reserving a face-shaped hole for someone who cannot arrive is the same error as printing a zero; letting the label slide left is a different error, and both are avoided by drawing nothing into a slot that still holds its place.

Self-membership is the ground a row stands on (V1b · Highlight, ADOPTED by the founder 2026-07-31). In any row the viewer belongs to, the row takes a wash in that row's role color, the role title switches to that role's darkened title tone, the sentence stays ink, and the viewer's avatar leads that row's facepile (marigold Starter, tangerine Companion, rose Celebrator). The mark is the whole row, so it survives being shrunk, screenshotted and reposted, which was the requirement the round was judged against. The earlier ring ruling is superseded: the wash and the title carry the mark, and the ring is retired with it. One accent per card was raised against this and overruled on sight: that rule protects a card from competing accent claims, and three role washes make one claim in three shades of the same voice, these rows are yours. The founder judged the three-role card full screen before ruling. REJECTED — elevation for member rows (codex): the card is the lifted object, its rows are not, and "cards lift, chrome stays flat" governs inside the card too. REJECTED — accent spend per role (codex): it collapses precisely on the three-role case, which is the case worth designing for. Implementation is two CSS modifiers on the existing row (.mine plus the role class, or .sealed) and one on the viewer's face (.me), never a new element.

A row with nobody behind it takes the grey wash only once it is settled, and the tile and the ground carry one identical tense (founder, 2026-07-31). That alignment is the whole logic of the rule, and after the tile widening it is literal: dashes always ride with paper, and an empty tile always rides with grey. Grey = closed for good (the window ended, nobody came, nobody ever can): "The first step passed quietly.", "No one became a Companion of this one.", "The finish passed quietly.", "This journey closed without a finale." Dashes on white paper = still possible: the Companions invitation while the chapter is unsettled, the finale live with nobody in it yet, and the Celebrators row waiting on a finale nobody has written. Greying a door that is open would tell the viewer it is shut, and so would leaving its tile bare. The wash lays over the tense grammar rather than replacing any of it: copy, role dot, tile rule and the label column are unchanged.

AA, measured and tuned (2026-07-31). The -text twins are tuned for paper, and on a wash of their own hue they land under AA: at the ruled wash strengths the Companion title measured 4.16:1 and the Starter title 4.38:1. The washes are what the founder judged, so the washes are unchanged and each title took one step deeper instead. The shipping values, each wash written as its raw accent over the white card and stored solid so the contrast is exact:

Every title and every sentence clears 4.5:1. A row with nobody behind it keeps its ink title on white and on grey alike: greying the copy was tried and dropped, because --faint on the grey wash measures 2.16:1 and the wash already carries the absence. A member row's count and chevron step from --faint to --muted, because a wash swallows the fainter tone; the count on an unwashed row keeps the card's standing --faint and that card-wide tone is a separate question.

Companion tense keys on chapter SETTLEMENT, not journey status. recognition_overview.md is the authority: Companion freezing settles when the finale's 24h window closes, so an Achievement whose finale is still live is unsettled and its Companion row stays present tense ("keep showing up"). Only a settled chapter turns the sentence past ("kept showing up"). Spec note, ruled here: on a manual Close, the same law applies by the same logic. Settlement seals when the last open recognition window ends, never at the moment of Close. A journey closed while a step is still live has an open window and unsettled membership until that window expires; sealing at the tap would freeze a membership someone could still be earning inside a window the product promised them.

The tense table. Each line branches further on singular against plural and on viewer among them against viewer not, so these are the shapes rather than the whole set of strings:

Why each tense: Companions are living membership, so the row is present tense while the chapter is unsettled (membership can still be gained and can still fade), future-tense invitation while it is unsettled and empty, and past tense once settlement freezes it. The invitation names the mechanic: stepping with a live step is what fills the row, and viewing fills nothing, so the verb is never "being here". Starters is the only permanently-past row: the first step's 24 hours close once and cannot reopen, so "The first step passed quietly." is written the day that window shuts and never changes again, however full the journey gets behind it. Celebrators waits on a finale that may never be written; while the finale is live the count carries "so far" and the sentence is present tense, and both turn the moment the window ends. The last Celebrator line is the Starters line's mirror, ruled by symmetry so no cell of the table is empty: a closed window with nobody in it is a fact about a day, not a failure.

REJECTED — "This journey was walked alone." (codex caught it, the board proved it): the line is false wherever the journey has supporters, and the board's own settled specimen carries 13 Celebrators. A card that says the journey was walked alone directly above a row of 13 faces calls its own author a liar. The replacement mourns only the missing relationship: "No one became a Companion of this one." Marked a polish candidate; the ruling it must keep is that the sentence names the absent role and never characterizes the journey.

Loudness: how the treatment was picked (founder, 2026-07-31). The requirement changed from correctness to legibility: self-membership must read at screenshot scale, because the shareable artifact is a supporter's screenshot saying "I am in this journey's ledger". The format of that judgment is itself a ruling: the card is judged full screen, in the company it keeps. Four complete journey pages sat side by side in the frame, identical except for the treatment, each carrying the state chip, title, owner, description, meta, the people card and the finale card below it, on the hardest data there is (the viewer holds all three roles, so any per-role treatment has to spend three). V1b · Highlight won, and its ruling is written above. The other three, in one line each:

• V1a · Fill — every member row solid in its role color, text white. The card outshouts the finale it celebrates. A second finding from building it: the marigold row deepened to its twin reads closer to bronze than to a first step.
• V2 · Invert — role-colored copy on unchanged paper plus a thin ring on the viewer's face. Colored small text and a thin ring vanish in a shared screenshot, which is the very test of the round.
• V3 · Synthesis — an 8 to 10 percent fill with a 3px role edge bar. A weaker scream than the pick.

Standing constraints all four honored: no raw accent ever carries small text, rows never lift, role colors stay in their canon roles. REJECTED earlier in the same round — the place band (a promoted lead sentence on an accent band with a 34px avatar): the founder ruled it costs too much vertical space on a page that already carries the hero and the step cards, and the people card cannot buy its legibility with height it does not own. The four-page board that carried the comparison did its job and was deleted with the round; people-card-board.html is now the single spec for the card.

The page the card opens, and its own grammar (journey-people.html, founder 2026-07-31). Three of this round's rulings land on the destination page rather than on the card, and they are recorded here because they are the same ruling reaching further.

A role filter chip renders only where people stand behind it. This is the mirror of "a chevron promises a page": a filter is an affordance, so it comes and goes with its people, and a zero never renders in a chip any more than it renders on the card. The asymmetry with the card is the whole point rather than an inconsistency. The card's three role rows persist for the life of every journey because they are the ledger, and a ledger says "nobody" out loud; a chip is a way in, and there is no way in to an empty room. Everyone is the page's default view rather than a role filter, so a journey nobody has stepped with has nothing to filter and the strip is absent whole. All three roles are inhabited on Marco's journey, so the flagship mock renders all three chips and the visual change there is nil; the rule is stated in the page's header comment beside the strip.

The viewer's place is one element, and that element is a person row. The standalone grey place block in the header is retired (superseding the 2026-07-13 header inventory above): the pinned-first "You" row IS the viewer's place, and its relationship sentence absorbs anything the block said that the row did not already say. On Marco's journey that is the present tense of living membership: "You were there when this journey began. You keep showing up, 9 steps so far, and you're here for the finish." One relationship in two elements made the viewer read their own place twice, and the row is the copy that also carries the face, the earned chips and the way to the profile.

V1b propagates to the You row with a context-aware wash. Under a role filter the row takes that role's wash exactly, per V1b. Under Everyone no single role can be keyed on, and the three-role viewer is precisely the case that breaks any per-role pick, so context supplies the hue: the journey's own moment. Tangerine while a recognition window is live, rose once the finale has settled it, at the V1b wash strengths and tones from the measured table. The mock renders Everyone with the finale live, so the You row washes tangerine. Closure is invisible on this page (founder ruling, 2026-07-31). The page never reads the journey's status label: a closed journey renders exactly as an open one with the same window facts, so with no settled finale the hue stays tangerine, the same as open. A Companion of a closed journey is a Companion, the counts stand, and the only thing closure withholds is the owner's own path to an achievement. The Celebrators door follows the people, not the state: no people behind it, no chip, closed or not. There is no third neutral hue; two moments, two hues, and everything else is the open look. The role chips on the row are unchanged and keep carrying the multi-role truth, which is why the wash does not have to. The name stays ink: a person row's heading is a name, not a role name, so the card's title-tone switch has nothing to switch here, and every sentence stays ink as on the card. The marigold ring that used to sit on the viewer's avatar is retired with the card's ring, for the same reason the card's was: the whole row carries the mark. One measurement, ruled while propagating: a chip's soft tint is translucent, so a chip left sitting on a wash of its own hue thins toward the ground and takes its -text twin under AA with it (the Companion chip measures 4.49:1 on the card's white and 3.91:1 on the tangerine wash). On a washed row each chip composites its own tint over the card's white, so a chip renders identically wherever it appears. Same precedent as the title re-toning: the wash is what was judged, so the wash stands and the text keeps the contrast it was tuned for.

The order of the list, and the silence around it (founder, 2026-07-31). A list has an order whether or not anyone designs one, so the order is ruled here rather than left to whatever the query returns. It differs by view, because each view is asking a different question.

Why the split: Everyone and Companions are asking who this journey's people are, and the honest answer leads with the people who are most of it, which is what holding three roles means. Starters and Celebrators are each one moment, so the only thing left to sort by inside them is when a person arrived in that moment, and the earliest arrival is the one the moment belongs to. Roles held is a count of kinds and never of acts, so a person with one heart at the first step and one at the finale outranks a person with forty step-withs and one role: this page measures the shape of a relationship, not its volume. The viewer is pinned rather than sorted, because a person looking for themselves in a ledger should not have to hunt, and Starters and Celebrators do not pin them because a chronology with a hole punched in it is no longer a chronology.

The order is never labeled (the standing visitor-doors ruling, reaching here): no ordinals, no "top" or "most" language, no rank chips, no rule anywhere on the page that tells the viewer what the sequence means. The sort decides who reads first, and the interface stays silent about it. This is what keeps the page a list of people rather than a leaderboard, and it is the same line the podium sits behind: "Linh supported Maya" is ordinary social context; "Linh supports Maya more than everyone else" turns affection into competition. The sort is a reading order, and a reading order the interface never narrates cannot be read as a score.

The facepiles follow. A card facepile shows the first faces of the page it opens, with the viewer's face leading in any row the viewer belongs to (V1b), so tapping through preserves identity face-for-face. On Marco's journey that means the Companions facepile reads You, Kofi, Sofia (Kofi holds all three roles, Sofia two); the Starters and Celebrators facepiles read the earliest arrivals, which is why the Starters faces match the first step's memory line and the Celebrators faces match the finale's.

Copy voice throughout: interface voice (Inter, never the authored serif), show don't claim, no em-dashes, and the mechanic's verb for step-with.

Canon reconciled to the three-role viewer (2026-07-31). The card is specified on the true three-role case, so the viewer is a Companion on Marco's guitar journey everywhere: journey.html carries the three-tense lead ("You were there at the beginning, you keep showing up, and you're here for the finish."), a Companion count of 4, a Celebrators row reading "You and 30 others are here for the finish.", all three rows washed, and a finale card that states the earned fact instead of inviting an act already taken. journey-people.html lists You under all three filters with an active Companion chip and moves its Companions filter to 4, and its pinned You row carries the viewer's place on the journey's-moment wash. badges.html gives Marco's row an active Companion chip, moving the arithmetic to Starters 3 · Companions 6 · Celebrators 5, total 14, and profile.html's Badges Earned door follows to 14. The first step's memory line reads "Sofia and 4 others" (ruled 2026-07-31): everyone who steps with a first step is a Starter, so the line and the Starters count of 5 must be the same five people; the count held on three surfaces and the memory line took the one-word fix.

The reveal fires at the act, wears your face, and says why (2026-08-11) The badge reveal wave, adjudicated with the founder against badge-reveal-board.html (the three tiers side by side) and built from StepoBackend/docs/stepo/badge_reveal_wave_2026_08.md. Eight rulings; badge-reveal.html renders them.

Anchors fire in the moment they are earned. Starter and Celebrator arrive in session, right after the step-with that earns them: the cheer animation lands first and the reveal follows a beat later (~900 ms), so the reveal reads as the consequence of the tap. This restores the 2026-07-11 entry rule ("at the moment recognition lands") — the shipped app read pending reveals only at app open, which turned every anchor into a next-day surprise with nothing left to connect it to. The one-full-reveal-per-session rule stands: an earned-now reveal takes the session's slot, and further earns queue for later sessions, oldest first.

Companion arrives on the same beat, through the queue rather than the response. A Companion gain is always attached to a specific step-with, and its evaluation commits fast, so the reveal check at the cheer-beat surfaces a just-earned Companion in the same moment under the standing combined-arrival rule (Companion primary, the anchor line second). The evaluation itself stays in the background job: membership is computed in one place, and the app's hottest write does not grow a second one. When the job is slower than the beat, a tier-withheld supporter push carries it — "A badge just arrived on 'Learn to play guitar'." — and the reveal waits for the next open. Naming the journey while withholding the tier is what narrows the 2026-07-11 "recognition is never pushed" rule rather than breaking it: the lock screen points at the discovery and spends none of it. FirstGain only, once per person-journey, silent on fade and on regain; the owner's quiet Activity row is unchanged.

The badge is you. The emblem is the person's own avatar inside the tier ring, with the tier glyph as a crest on the ring's edge: first-step arrow for Starter, footprints for Companion (a new glyph, the walking metaphor the copy already owns — drawn as filled pads, because stroked ellipses read as balloons at the crest's 17px and filled forms are what survive small sizes), finale trophy for Celebrator. The crest artwork is one canon SVG per tier, shared by every surface that depicts the tier at any size; the app imports the SVGs as assets rather than approximating them with platform icons. The screen used to show a generic pill; the person it celebrates is now the thing it shows, and saying so costs no number.

No crowd on the reveal. No facepile, no "you and N others". A facepile is a count wearing faces, this screen refuses counts, and at the scale the app actually has, "you and 2 others" reads as loneliness rather than company. The crowd lives one tap away on the journey People page with the viewer tagged "You", which is where the CTA already goes.

Provenance answers "why did I get this", and the whisper is gone. Under the memory line sits one sentence naming the act, the person and the window: "You stepped with Marco's final step while the finish was live." / "You stepped with Khanh Lương's first step while it was live." / "Again and again, you stepped with Maya while her steps were live." It speaks the feed's own verb, since the feed already teaches that a heart, comment or share on a live step is stepping with it. The permanence whisper ("Yours forever. It lives with your badges.") is deleted with nothing in its place: it promised forever on a screen that also serves living Companion, which fades. Arrival only.

The memento renders the authored window. The step media band [4:5 … 1.91:1] governs the reveal as it governs everywhere else: aspect verbatim, never re-cropped. A tall window scales to the height cap and centers, a wide window rides the full content width, and the reveal payload carries the cover's frame so the client can draw the shape the author chose.

Timing is earn-time, not window-expiry. Nothing waits for the 24h window to close: the window is the rule for earning, not a delay on the gift. Withdrawing the act inside the window takes the badge with it, a cost the withdrawal sheet already names.

Give again, celebrate once. The record is the final state of the window, so a withdraw-and-redo ends with the badge held, and a faded Companion who returns is a Companion again. The celebration is once per person-journey, structurally: reveal acknowledgments outlive the interaction that earned them, and first-gain time makes every later return a regain, which fades quietly, comes back with a whisper, and fires neither push nor full reveal. Three standing guards keep the loop unfarmable — persistent acknowledgments, the Gain/Hold hysteresis pair (a new step dents nobody's coverage until its own window closes unstepped), and silent regains. Firing at the act runs those paths far more often, so this wave pins them rather than touching them.

V1 — ships

• Feed: Live / Earlier zones, live cards (3 step types incl. carbon finale), countdown rings, prompt lines, tiered bursts, full-quiet past cards
• Profile: doors, quiet follower line, live strip, journey cards (filmstrip + people line)
• Journey: hero, live-finish banner w/ personal presence line, people panel, step trail
• Badges: person-first summary, people list, whisper — all past tense
• Supporters: podium, ranked list, by-kind buckets
• Step detail: comments with Stepped-with chips, two-level replies, sticky composer
• Profile Steps tab: media grid with semantic rings
• Other profile: Follow states, visit-time live strip, tappable viewer-filtered doors (unranked lists behind them), report/block kebab
• Private profile: locked state w/ Requested button (accept lives in Activity)
• Search: landing (recents + suggested people + trending journeys) → typed results (people + journeys), privacy-gated
• Notifications: New/Earlier, follow-request actions, journey rows, deleted-content state, system row; push with media thumbnails per the spec board (recognition rows ship when the backend type lands)
• Sign-up: Apple / Google / Facebook / email OTP
• Onboarding: single identity-confirmation screen (avatar, name, username, ToS)
• Settings (hub, privacy, notifications), edit profile, followers/following list
• Report sheet + journey manage sheet (block/report = store-required safety pair)
• Create journey: two-screen flow (serif title moment → marigold first-step composer)
• Create step: journey picker, media + caption, final-step toggle, 24h live CTA
• Earned-only recognition voice (reveals + memory language; pre-qualification ladder retired 2026-07-11)
• Badge reveal moment: full-screen at the act, one per session, avatar-in-ring emblem + provenance line, no share / no next-tier / no facepile (badge-reveal.html)
• First-run states: Discover-fed zero-follow feed with the quiet Find-people strip (feed-empty.html); empty Activity / profile / search-no-results per the states-empty.html board
• Onboarding people beat as a selection screen with the pinned, pre-selected founder and the dynamic "Follow N and continue" (onboarding-people.html)
• Onboarding follow-suggestions beat (promoted 2026-07-10; reuses search-landing grammar) + notification priming before the single native prompt (onboarding-notifications.html)
• Delete-account consent sheet (settings-delete.html; Apple 5.1.1(v), immediate-permanent copy)
• Self-harm report category + crisis response (report-crisis.html; Apple 1.2, priority queue)

V2 — visible in mocks, deliberately deferred

Explicitly out (any version)

Streaks, day-counts, "N more to unlock" counters, global ranks/leaderboards, calendar day-grids — and progress-toward-tier UI of any kind: meters, "needs you now" CTAs, proximity copy, ratios in presence lines. Recognition is per-journey and its voice is earned-only (2026-07-11; recognition_overview.md → Recognition Voice): tier reveals and memory language after the fact ("You were there at the beginning"), never copy keyed to how close anyone is. "One day or day one" survives only as brand editorial, detached from recognition status.

Demo data is a state catalog

The mocks deliberately show many states at once so one screen documents them all: the feed holds all three live step types plus past cards; the journey is an Achievement whose final window is still open; profile shows both an ongoing live journey and a finished one. Numbers are consistent across screens (14/19 doors, Marco's 341/58/19, 5h/6h/9h windows) — if a number disagrees between screens it's a bug (profile-steps' 48 was one; 19 is canonical), but coexisting states are intentional. Don't "fix" them, and don't treat any single screen as the only state.

The composers extend the catalog: they show filled states (a form full of demo text documents more than an empty one), and they add one in-flight journey — Chau is starting "Run my first 10K" in the create-journey flow, while create-step targets Learn to run trails ("this will be step 15", consistent with its 14 steps on profile). The chat mocks reuse the same threads of truth: the messenger is the Priya relationship from badges ("stepped with her 14 times"), and the shared-step card is Chau's live trails step ("Live · 6h left", matching profile).

Two profiles extend the cast (2026-07-11). Lena Ortiz (@lenabakes, women/68, "Bread, patience, and second chances.") gained canon on profile-other.html: 89 followers · 132 following, doors 7 given / 4 received (tappable; the numbers are the viewer's visible set — see "Visitor doors open", 2026-07-15), Journeys · 2 / Steps · 13 — day-one sourdough (22h live, zero step-withs, same photo as the feed card, single .solo filmstrip thumb) + Grow a balcony garden (Achievement, 12 steps, finished October, 23 celebrated). Her door/celebrator faces are hers alone, and the visitor-list screens named them (2026-07-15): given — Noor Haddad (women/22), Elias Okafor (men/55), Freya Lund (women/85), Camille Roy (women/50, the +1 behind the facepile); received — Emil Novak (men/9), Saoirse Doyle (women/8), Tomas Vega (men/60), Ingrid Solberg (women/90). Their journeys (Walk the Camino, Bake rye bread at home, Grow a herb windowsill, Learn to throw pottery) are Lena's-circle canon, distinct from Chau's cast. Mai Phương (@maiphuong, women/81, "Learning to swim at 29.", 41 followers · 52 following) exists ONLY on profile-locked.html — a locked-page-only face, same logic as the blocked-only faces. Search-landing's Lena row reads "just started — first step live" (the earlier "26 stepped with" was impossible against her day-one state).

The search landing adds three suggested-people faces that exist nowhere else — Tomás Rivera (men/47), Astrid Meyer (women/63), Jonas Weber (men/71) — because suggestions are by definition people Chau doesn't follow yet; reusing the followed cast would mock an impossible state (same logic as the blocked-only faces on settings-privacy, where Hana Sato is women/35).

The first-run mocks add a third viewer (2026-07-11): Minh Trần (@minhtran, men/40, bio "Figuring it out, one step at a time.", 0 followers · 0 following, zero journeys, zero badges) exists only as the viewer of feed-empty.html and the states-empty.html board — his face renders only on the empty profile frame. The feed-empty cards reuse the established cast viewer-relatively: Lena's be-the-first card verbatim, plus Maya Okonkwo's and Idris Kane's cards from feed.html with Follow (not Following) buttons and Discover chips, because Minh follows nobody — same people, different viewer, intentional coexistence. onboarding-people.html (Minh's view too) reuses the search-landing suggestion trio (Tomás men/47, Astrid women/63, Jonas men/71 — suggestion-only faces, consistent) with Chau pinned + pre-selected first. badge-reveal.html is Chau's moment: Celebrator on Marco Ferri's guitar journey, memory line verbatim from recognition_overview.md. Its trending zone reuses the cast honestly: Marco's guitar journey, Bruno's achieved half-marathon (the finale spike is why an Achievement can trend), Maya's live Couch to 5K, Lena's sourdough (which also explains the "sourdough" recent query).

Building new screens (agent checklist)

Future screens (create-step, create-journey, onboarding, chat, …) join this set by following the recipe that built the existing ten:

1. feed.html is the source of truth. Copy its :root verbatim (all tokens incl. --live-text), device frame, SVG status bar (never emoji), fonts. Pure CSS — no Tailwind. 2. One dominant job per screen. Write the job as a question ("Who needs me now?") before designing; everything that doesn't serve it is V2 or cut. One CTA per screen. 3. Sunset taxonomy, one accent per card/row/tile. Marigold = first/Starter, tangerine = live/Companion, rose = final/Celebrator. Sub-12px text on tinted chips uses the darkened variant of the row's accent: --live-text / --starter-text / --celeb-text. Serif = authored voice only (the "could a human have said it" test). 4. People before numbers. Faces land first; big numerals only for the two door stats; counts elsewhere are captions. Density rule: dense in people, light in encoding — one chip + one number per row, detail one tap deep. 5. The 24h window is the loudest read wherever steps appear: live = accent + ring + badge-named-at-action prompt; past = full card, vivid media, quiet chrome (never grayscale). Bursts are tiered: puff / rise / settle. 6. Spec-check before inventing against StepoBackend/docs/project/*_overview.md. Verbatim gamification voice only. No streaks, day-counts, unlock counters, global ranks. Real vocabulary: Heart · Comment · Share, step with, Starter/Celebrator/ Companion (+ its four tier names). 7. Numbers must reconcile with the existing state catalog (14/19 doors, Marco's guitar journey 14 steps · 341/58/19 · 5h left, Chau's cast of people). Reuse the cast; don't mint contradicting data. 8. Wire the nav per the contract (5-slot bar, active-tab rule, drill-ins get back arrows) and update the gallery (scripts/build-gallery.py: ORDER, BLURBS, and the group it belongs to in APP_GROUPS), then re-run it. 9. Verify before done: tag balance, every href resolves, no banned patterns, real photos everywhere. 10. Copy rules (2026-07-13, PO): user-facing copy shows, never claims — no "never X / no Y" slogan constructions (state what the product does; a positive-exhaustive "That's the whole list." beats a never-triad). And no em-dashes in user-facing copy — restructure into two sentences, or use a colon or comma (a plain "-" only when a dash is truly needed). Marketing surfaces (store, landing, screenshots captions) hold this strictly; existing canon memory-lines are swept opportunistically, new copy complies from birth.

Handover to implementation (Revamp V1)

For the agents building this in stepo-mobile. The mocks and this doc are the design authority; they are not the only authority:

Three sources of truth, by question. How should it look/feel? → these mocks + this doc. How should it behave? → StepoBackend/docs/project/*_overview.md (the mocks render the spec; if they ever disagree, the spec wins — then report the mock as a bug). What data exists? → the generated StepoService / OpenAPI DTOs; regenerate the client when backend endpoints change. Follow stepo-mobile/CLAUDE.md for architecture (BLoC/Cubit, auto_route, BaseListCubit for feeds/lists).

The revamp supersedes the current mobile design system. New tokens (this doc's palette incl. the three contrast text variants), new type stack — Archivo (display) · Inter (body) · Fraunces italic (authored voice only). All three are Google Fonts (free, bundleable via google_fonts or asset fonts) and replace Cabin. The existing "cards lift, chrome stays flat" shadow doctrine carries over unchanged. Keep the pill mark assets from brand/ (mono glyph = Feed tab icon at currentColor).

Suggested build order (each stage leaves the app shippable): 1. Theme foundation — tokens, type stack, shadows, the 5-slot tab scaffold + nav contract (composers modal, drill-ins push, tab-active rule). 2. Feed — Live / Earlier zones, the three live hero cards, countdown rings (static state), prompt lines, bursts, full-quiet past cards. 3. Journey + Step detail — people panel, trail, finish banner; comments + sticky composer. 4. Profile + doors + Badges/Supporters + profile-steps grid. 5. Create flows (step, journey two-screen) wired to the FAB. 6. Search + Activity (notifications) + signup/onboarding reskin.

Known dependencies / flags for V1:

• Backend search is fully shipped (/api/v1/search/{accounts,steps,journeys} + suggested-users + popular-journeys) — V1 uses accounts + journeys; the steps endpoint is already there for V2's step-content search.
• "Live sorts first steps first" is an optional backend ranking rule — the feed must not depend on it.
• Chat, avatar rail, away-digest, weekly pulse, grid toggle: V2 — visible in mocks, do not build; leave Feed's top-right slot empty.
• Micro-labels in mocks run 8.5–10px; implement at ≥11px and test Vietnamese diacritics (the mocks are English-only).
• App icon: generate PNG ladders from brand/stepo-icon-store.svg (light), the carbon variant as iOS dark appearance, mono glyph for tinted/themed.
• Feed media clamp (see the ratio ruling in Q&A + its 2026-07-13 revision): displayAR = sourceAR.clamp(1.0, 1.91) — the tall bound is SQUARE, not 4:5 — with center cover-crop. Pre-size each media box from StepMediaDto.width/height (already in the API) before the image loads — no layout shift while scrolling, and no backend work needed. Step detail shows the media whole (natural AR, fit-width); only the detail's media tap opens the viewer.

For the Flutter port

• Motion: burst particles (tiered), live-pill blink, and card entrance rise are prototyped in the HTML — those timings are the spec. Countdown rings are static state, not animation: fill fraction = hours-left / 24 (the stroke-dashoffset math in the SVGs); they update as time passes, never visibly sweep.
• The 8.5–10px micro-labels in the mocks need a legibility pass (≥11px) and testing with Vietnamese diacritics.
• Dark theme: not designed yet; the carbon "moment" card is the natural seed for it.
• Accent halos on live cards = box-shadow composition (soft ring + colored glow + base shadow) — see .hero in feed.html.
• Continuous ("squircle") corners run on Flutter's native RoundedSuperellipseBorder / ClipRSuperellipse (2026-07-13), not a third-party package — border and clip are drawn from the same path, so a bordered, clipped card (an avatar ring, a media thumbnail) never shows the corner shaved short that a separate Border.all + ClipRRect pair produces. AppShapes.shape(radius, borderColor:) is the one call site; use it (or RoundedSuperellipseBorder/ClipRSuperellipse directly) for any new bordered or clipped surface — never plain BoxDecoration.border + ClipRRect.

Store kit (../store/, 2026-07-12)

Submission marketing assets, generated from the mocks themselves so the store never shows a UI the app doesn't ship. store/shot.html?id=01…06 composes a caption block (Archivo 800 headline, one Fraunces-italic accent word, kicker pill in -text twins) over the real mock iframed inside its device frame; shots.js holds the copy and names each mock from the repo root (app/feed.html); store/render.sh exports App Store 6.7" (1284×2778), Play phone (1080×2160), the Play feature graphic (1024×500, carbon field + paper pills with the newest pill live), and the 1024/512 store icons from ../brand/stepo-icon-store.svg. Shot order = the pitch: what it is → the 24h mechanic → the quiet promise → journeys → recognition → profile. All store metadata (names, descriptions, rating-questionnaire guidance, data safety, review notes) lives in store/store-copy.md.

Screenshot size (2026-07-14). App Store Connect accepts 1284×2778 and 1242×2688 portrait; the 6.9" native size (1320×2868) is rejected. The shot template is viewport-relative, so it recomposes at any accepted size without layout work — the 6.7" set covers the largest-iPhone slot and Apple down-scales it for the smaller classes.