Every product surface, clickable.

EC: “explaining the key things in the pitch decks and positioning, eg. Invisible Wall, Platform Agnostic, MCP Anything.” Each idea the decks carry in the investor register is said plainly (the 2026-09-23 register rule) and drawn as one paper short with one move: 01 the invisible wall; 02 not another tool (it runs under the ones you use); 03 any tool you like (platform agnostic); 04 if it speaks MCP, it speaks Relay; 05 you own what travels. Each idea shows the deck line, the plain line and the picture, with what’s safe to say; then a five-slide carousel, a “why Relay” site band beside How Relay works, founder-led uses, a copy bank and the open calls. Clean URL /concepts/big-ideas. Concept — stealth, nothing public.

EC’s 2026-07-23 naming call built out as a campaign: keep connect-the-dots as brand language and a visual system, not a name, because it is the one metaphor that describes what the product does — Codes are the numbers on the dots. A live dot-to-dot you can watch or draw yourself across three sheets (your week → a paper plane, your team → a bridge, every tool → the Relay mark, whose rays turn out to be the line), the four-mark grammar (dot · number and Code · line · picture) on v3.6 tokens, and five executions: the 15-second film’s frames, a “Can you see it yet?” carousel, a printable activity sheet, a “your week in dots” card (drawn, not built), and a billboard. Copy bank, do/don’t against the vocabulary, and the gates. Concept — stealth, nothing public.

EC: “show off how to use Relay on the site … demonstrate the key benefits and values you get with Relay in an agentic work space.” Six working specimens, each showing one thing a person or an agent does and proving one benefit by what is visibly different afterwards: 01 two harnesses, one thread (the first reply is a decision, not a question, against a ghosted cold session); 02 tomorrow’s you (scroll-driven — the lid closes at 18:40, a different tool resumes at 09:10); 03 the workspace day (agent → agent → person → pipeline → you, with a margin ledger nobody typed); 04 where the Code lives (an issue, a chat, a pull request, a sticky note — tap one and it lifts into the input); 05 consent at the boundary (a real Allow beside the org-admin view whose content column stays blank); 06 before/after the router (a diptych where only the noisy half moves). Each carries the idea, the proof, where it would live on the site and what it costs; closes with a recommendation (ship 02 and 01, place 05 and 03, hold 04 and 06) and a position on transcripts vs glyphs. Both grounds in the header switch. The hands only, never the machine’s insides. Clean URL /concepts/how-it-works.

The design record of the extension MVP merged 2026-09-23 (relay-app extension/, PR #797), drawn as HTML from the code with its real strings: the toolbar badge in seven states with their tooltips (count, p0 amber, 99+, signed out, offline, having trouble), desktop notifications (p1, p0 that stays on screen, fallback titles, the “N more waiting” fold), the 360px popup in six states, the click → destination table, the four behaviour rules and the 22-case register as a person meets it. P2 Act and P3 Capture/Carry sketched and stamped not built.

Relay as a native Slack app, not a dashboard link-out: inline approve/deny on real messages, /relay capture, forwarded-message and reaction capture, resurfacing that lands where the team already looks. Reuses the MCP response-card component inside Slack's own attachment chrome.

The agent's own chat window as the surface — no separate Relay UI. A full claim → load → capture → pending-approvals transcript rendered with the exact MCP response-card component, switchable across Claude / ChatGPT / Cursor-style chrome to show the card travels unchanged.

Relay's own first-party conversational surface, not cards rendered by someone else's chat client. Same morning-brief → capture → claim loop as the Chat concept, but with fully designed app cards (working approve/deny) instead of a raw tool-call block, and it can approve a connection request directly, which the Chat concept's guest agents deliberately can't.

Chat with your agent, land on a prompt and settings, relay_send it, then pull the Code straight into a ComfyUI workflow. A working prototype, not a mockup: Relay In + typed Relay Field nodes parse a tagged-on ```relay-fields JSON block off the relay's markdown content — zero backend changes needed. Getting generated images back out is explicitly parked pending binary/object relay support.

Entry point for the pair. The thesis: version the experience, keep the material. v3.5 neutral-first is settled and these concepts change no value — what 4.0 versions is composition, because the same object wears different chrome, vocabulary and grammar depending on which surface you meet it on. Five pillars: say the layer model out loud (hats are walls, lenses are windows) · one shell, one list, one card everywhere · make the way in as light as the product · depth behind a bounded door · two bodies, one user. RCTX-240 ratified 2026-08-12 (--rly-accent-fill → #0f766e), retiring the one token override these pages carried — they now run on canonical values with no deviation. Doc: relay-board/docs/product/experience-4-0.md.

A live v3.5 ↔ v4.0 switch over the same data, same tokens, same list shell. The shipped side is drawn honestly from the findings register (EXP-003–008): five stacked control layers, a tag wall ending in +104 more, tabs mixing three axes, and three identical badges on every row taking the width the title needed. The 4.0 side: one control row, filters in a sheet, an honest count (8 of 68 · 2 need you · 41 never left this workspace), badges only on the exception, dormant dims rather than hides. Then the rail at 24 → 6 with a stated destination for every removed item — including the three that are one table in the platform — hats and lenses made touchable (positions never move, sealed is absent not dimmed), and the bounded depth door whose counter describes what is drawn, never what exists. Toggle to 390px for the composition that produced “I don’t even know where to begin.”

Dressed by the same stylesheet as the app concept — not a build convenience, the argument: an operator learns one rail, one list, one card, one confirm and has learned both surfaces. Shows the shared table reaching all twenty screens, density as a remembered server-side setting rather than a screen property, honest counts with page position instead of a silent “showing first 100”, the console’s first display moment, and dense tables becoming the app’s own card at phone width. Preview-as-role is named as a lens that never grants — it changes the projection, never authorization, and the audit entry names you, not the role you wore. The blast-radius confirm is promoted from one screen’s good behaviour to console grammar. Sections are deliberately unchanged: the IA was never the problem, the shell was.

The native app on the same stylesheet as the app and console concepts — and here the shared sheet carries the most weight, because the app in the build today is not a density of anything, it is a third design system (mobile/lib/theme.ts, Primer-dark, #00D9C8, system fonts). Draws the four jobs — Act · Aware · Capture · Attend, the fourth added because the build already crossed v2’s scope line and the largest screen in the app is the governance surface. Posture, not depth, is what keeps it honest: three jobs arrive from outside, the fourth is what you opened the app to do. The mechanic is a live reachability counter over the fifteen destinations the mobile PRD puts in scope — the shipped five-tab bar reaches eight (four in tabs, four nested in the Menu sheet) and strands seven with no route at all, the drawer reaches every one, and the counter describes what the shell can reach, never what the product holds. Also states the depth-rule amendment (depth is a property of the view, not the surface) and the Connect naming collision, where one word names three different products and the phone shows the least common one. Gated on D1 (nav) and D3 (depth rule). Doc: relay-board/docs/product/PRD.mobile-v3.md.

The scope the mobile concept is drawn against, rendered here so it can be read beside the drawing. The board is behind Cloudflare Access and this repo is not — a designer should not need board credentials to check what a concept is answering to. Carries the four jobs, the as-built twelve-screen inventory, which surfaces travel mobile-first versus ported, the notification layer as the unbuilt spine, and decisions D1–D8. A projection, never a source: the record stays relay-board/docs/product/PRD.mobile-v3.md, and the page is regenerated by scripts/render_prd_mirror.py rather than edited. Design-side direction is briefs/BRIEF.mobile-v40.md.

The proposed shell, drivable. All fifteen PRD destinations route through the drawer; approve/deny resolves with an undo snack and every tally re-derives; capture goes thought → draft → filed; the hat switcher seals — content re-gates, the nav order never moves; relay detail carries both DEC-025 states (Code hero, and no Code — never left this workspace); the relays list keeps one control row with the filter sheet behind it and an honest computed count. Error states behind a toggle (offline, mic denied, failed send with retry, expired lookup). Hash-routed per screen, full-bleed at phone width. Fixture data only. Gated on D1/D3 like the concept it drives.

The companion app, PRD v2 (8NHT5P): Act / Aware / Capture. Five-tab shell — Home / Activity / Capture / Search / You — on v3.5 neutral-first, resurfacing Today strip, share-target capture, working approve/deny, and a horizon Explore/graph surface. Light + dark. First cut of the prototype loop.

Not a shrunk phone: three faces only (Glance, Act, Capture), no keyboard, no Search, no You. Digital-crown-first approve, voice-only capture, undo-on-deny by a second tap. Companion to Mobile V2, unscheduled.

Earlier iOS execution artifact (#65–#67) — segmented Sent / Received, Activity feed, Relay detail timeline. Dark, v3.4. Predates the v2 IA.

The June companion concept — five-tab Inbox / Claim / Approve / Stream / Settings on v3.4, push-governance lock-screen demo, real Codes. Superseded by V2's Act / Aware / Capture IA; kept for reference.

The organizing layer at 390px, designed at 390 rather than collapsed to it: lens and library segments at the top, shelf list with visible predicates, rows with origin markers and unread dots, and everything secondary in bottom sheets — filters, view-as, and the object sheet answering why you can see it (attribution basis: self / custody / grant) and why it is on this shelf (matched vs added) with the properties that decide it. Primary actions at the thumb; counts read “N you can see”. Console governance sibling: console-v35/org-ia.html.

The Map tab in the Expo app, specced as a working phone-frame simulation: List as the phone default, tap-through detail sheets with the envelope spec, filters and help as bottom sheets, live ticker, canvas map with pulses and the locked treatment. Flanked by the native implementation notes — Skia renderer, gesture vocabulary, sheet snap points, offline envelope cache, tour sync, perf budget.

The packaging concept: one corpus in three states — pipe (in motion), library (at rest, organized), vault (at rest, guarded) — under one rule, “everything enters through the pipe,” which is what makes the store trustworthy: provenance by construction. The shipped MCP verbs as the brain’s API (relay_context orient · relay_session bridge · relay_request as interlibrary loan), the Root Manifest as boot sector / filtered shared map / attestation surface by tier, solo–team–enterprise packaging with honest status chips, and the Obsidian stance: cede the solo vault, own the accountable brain — “keep the vault, Relay is the remote.” Doc of record: relay-board/docs/product/second-brain-concept.md.

Decided 2026-08-30: Option A, nouns only (DEC-029), revised same day to ten doors — Library and Graph keep their own screens; only Series and Trash nest as views on Relays; Option B stays rendered as the record. The options layer on top of the app-surface diagnosis, from the brief “config depth near Cloudflare, a more basic target user, Shopify for UX.” Decodes what Shopify’s rail actually does (nouns only, no section headers, one pinned Settings door, one badge) and reframes the target: not “in between” but Cloudflare’s depth behind Shopify’s width. Two clickable rail prototypes — A · Nouns only (8 doors, verbs become page buttons) and B · The verbs are the product (6 doors, the phase-5 rail from the diagnosis) — plus an interactive “where did it go?” strip: click any of today’s 25 doors and both prototypes navigate to its new address. Nothing deleted; either rail ships as a gating.ts cohort preset.

Answers “why is the web app so confusing?” with measurement rather than impression: 33 routes, 25 nav destinations, 73 modules, 30,633 lines — and only 4 screens hidden by the streamlined preset that already exists to hide them. Two findings carry it. The rail says Transfers while the page it opens renders 120 relays, so the first list a new user sees names the product’s own object two ways at once. And ten of the 25 doors answer one question — Series, Sessions, Stream, Library, Trash, Graph and Search are all the same corpus under a different filter. Proposes 25 → 6 in five independently revertible phases, the first of which is one word. Nothing deleted: the shared list shell, the cross-type Objects table and gating.ts already exist, so this is promotion rather than invention.

Two bright green buttons ship on the stealth page and only one of them passes: “Keep me posted” puts white on #0d9488 (3.74:1, fails AA) while the consent banner’s “Allow” puts near-black #001311 on the same fill (5.09:1, passes). The ink flip is therefore already shipping in light mode, not a proposal. Shows the button four ways with computed ratios — today’s #0f766e/white at 5.47:1, the broken bright, and two flipped variants at 4.94:1 and 9.94:1, the brightest being the most accessible — plus the same app fragment with and without the flip, Codes deliberately left as text-safe #0f766e. Also names the deeper problem: every light-mode semantic sits near 5:1, so equal contrast means equal loudness and no hierarchy. Three decisions posed.

Display direction for DEC-025 lazy mint: a Code exists only where someone deliberately handed context over, so most objects have none. Four laws (mark presence never absence · one teal moment per object · the title never changes rank · absence is addressable not annotated), relay detail in both states with an annotation overlay, the mint moment as a live event, a mixed list with a circulation filter, and the four rejected drafts drawn so they are not re-proposed. Brief: BRIEF.code-presence.md. Ratifying it unblocks the relay-app REFERENCE rewrite that gates Train 3.

The relay-app overhaul prototype (epic #475): one universal collapsible rail + a principal top-bar ⌘K search across every screen. Overview (Root Manifest projection), Transfers, Series, Sessions on the shared list-shell — direction/status pills, click-to-sort tables, density, pager, Code-first cards, social sender byline. Personal-default org, light/dark + mobile. Graph is now a live screen in the shell — Map/List, type filters, an Arrange lens + time window, focus mode, and saved views.

Visual explainer for the Root Manifest setup: the per-user entry vertex, projected into many lenses (agent boot, the Overview home, the Graph Map) from one engine. Shows how it’s incorporated across the key pages, the shape-encoded node vocabulary, and the recurring “live projection” callout treatment.

The member-facing half of the billing lifecycle, on the shipped rail (Billing under Account): plan and seats, usage against the plan contract, invoices and receipts, payment method. Built around the three states the platform actually resolves — active, past_due (retrying, full access retained), unpaid (dunning exhausted, effective tier drops to the Free contract). Switch state and the usage ceilings move to Free with over-limit treatment, the alert band offers the hosted invoice, the document row flips to Pay invoice; nothing is deleted and billing stays reachable throughout. Reactivation is webhook-confirmed, never client-claimed. Deep-linkable: ?state=retrying / ?state=paused. Operator counterpart: Console — Finance lifecycle.

The purchase moment as a child of Billing: payment method, the billing profile the invoice is made out to, receipt notes, a recurring-charge authorization, and an overview rail — then a success step that replaces the whole screen. The profile belongs to the org, never the user (plan is a property of the org), so the same page serves a personal account buying Pro and a team workspace buying Team behind one switch. Every number is the enforced contract in billing.TIERS; annual billing is shown disabled because no annual price exists; tax reads “from the billing address” rather than an invented rate. Built to the forms law, with the pending → confirmed status kept because the plan flip is webhook-confirmed. Deep links: ?plane=team · ?profile=saved · ?step=success.

The credential you hand a headless agent, as a section of Connect. A key is not a smaller password — it is a named, narrowed, revocable delegation, so its scopes, its hat and Revoke sit on the row rather than behind an edit screen. Five scope families, with relay:approve permanently unavailable to a key: an agent cannot satisfy a step-up, and one that could approve could approve its own requests. The chips carry the distinction the whole surface exists to make — a hat is a wall, a view is a window, drawn dashed and labelled. Roll is what makes one-time reveal honest instead of a trap: shown at creation and at every roll, never otherwise, keeping the name, permissions and history while refusing the old secret at once. Says plainly what is real, what is real and broken (Revoke is cosmetic for MCP today — the revoked row goes invisible to the verifier, which mints a replacement for the same live token) and what is only drawn. Phone composition drawn, not assumed. Deep links: ?view=mint · ?view=reveal · ?view=summary · ?view=mobile.

Rev Sep 30 — which machine is this? A local app’s 127.0.0.1 reads like a fact and identifies nothing, so the screen says “an app on this computer” and asks for a connection name, prefilled; a web connector named the same way; the workspace picker (built on branch); and a new §5 with what the server can actually see and the Sessions list where the name lands. Originally drawn in five states from one renderer: today (it asks you to authorize “this application” and never names it), named client + stated scope, the optional data-capture ask EC flagged from Klaviyo — placed both above and below the action so the placement is picked rather than assumed — a spoofed client name (registration is dynamic and verifies nothing, so the name is a claim and the redirect host is the fact PKCE binds), and an unidentified client that says so rather than inventing reassurance. §3 runs the two consent laws side by side: the optional row authorizes unchecked, the required one refuses, flags and takes focus. Relay collects no prompt-derived data today — the ask is a proposal and the session recommendation is not yet. Record: relay-platform DESIGN-NOTE.mcp-authorization-consent.md.

The manage half of billing, deliberately low-fidelity: it poses three questions rather than answering them. No in-app cancel today (though cancel_at_period_end is a real webhook-fed column), no downgrade anywhere, and no view of who the bill covers — which is the decision: Relay seats are derived from membership, the reference console assigns them, and adopting that would let a member exist without a seat, changing quota reads and the seat true-up. Both models sit behind one switch. Each action names the audit row and funnel event it writes, because ga4_event() has zero callers and billing has no funnel data at all. Companion to the purchase half at /concepts/checkout.

Clickable prototype for SPEC-address-custody-v1 with the rulings applied: strict scoping (contract-consistent views), per-membership contact-address mapping, the claim simulator with governance fallbacks, the org-tagged bell with guided switching, one-tap Home, and Pass → between joined workspaces with the per-object timeline carrying provenance across the wall — data crosses org walls only as a relay. Opens the in-shell version (real sidebar/topbar chrome); the standalone walkthrough lives beside it in the area index.

The ratified product-UI direction: black & white first, brand as a layer. Walk Stage 1→3, flip light/dark, compare AA vs brand button fills. Mobile-first shell, desktop icon rail, live WCAG contrast table. Feeds the app token fix and the console re-skin.

What a Team pick hands off to, drawn where it runs: create the workspace (name · handle · logo · region, a live preview in the aside and the rail chip), who’s in it (domain autojoin first, invites second), one welcome frame, then the Overview where your agent sets the workspace up with you — a pre-filled description to correct, an interview with suggested answers, bring your context (paste · file · describe), labelled sample relays with a purge, the Get-started card in the rail, and the plan state in its footer. One document in the responsive shell (shell-responsive-v1/workspace-first-run.html), framed desktop and 390px. Every control is tagged: data-track on each act, a screen view per render, and a Measure drawer that lists what fired, its consent disposition and the server stamp that is the record — kit app-v35/ui/track.js, the gate-denied precedent generalised (consent-gated by relay_consent, PII guard, drawn POST /telemetry). The page carries the full tagging plan for both flows (event → props → server record → GA4 name → the question it answers) and the pipeline. The plan-pick intake in the shell is tagged the same way. Twenty and Relaticle read as mechanism; nothing copied. Drawn, not built. Deep links: ?step=create|members|welcome|overview · ?consent=granted|denied|unknown · ?measure=1.

The same intake placed where it would run: one document in the responsive shell (shell-responsive-v1/plan-pick.html), framed twice on this page — desktop with the plan card in a sticky aside, and 390px where the rail has folded to the drawer, the plan summary is row 2 of chrome and the action sits in the bottom third. Nothing redrawn for the phone; the shell folds and the intake goes with it. Rule and fixtures from one kit (app-v35/ui/plan-pick.js) shared with the standalone. Arrival and step switches reload both frames. Drawn, not built.

The intake that right-sizes the plan, built to get plans picked. Higgsfield’s signup quiz read as mechanism (fourteen screens, each adopt / adapt / reject on the record) and rebuilt on Relay’s three boundaries: five questions — who needs this context, how many, here to do what, where your agents live, how you heard — each footer naming the consumer of the answer, and the plan card assembling live on the left so the pick at the end is one tap on something you watched get built. Arrival decides whether you are asked at all (a Code in hand never meets a questionnaire); a campaign’s access grant is the honest twin of the “personal 55% off”; the countdown becomes the five No Surprises commitments printed on the card. Twelve edge cases, three ship gates; a plan_picked funnel stage proposed. Drawn, not built. Deep links: ?arrival=campaign · ?arrival=invite · ?arrival=claim · ?step=plan.

The 14-screen onboarding prototype on the v3.5 neutral-first frame. Step routing, pill pickers, flow map. Migrated from the v3.4.1 teal-tinted build.

Baseline audit of the onboarding flow as it shipped, before the redesign work below and Onboarding Flows above.

The redesign concept that preceded Onboarding Flows above — journey-mapped rework of the baseline current-state audit.

Series V1 "First Relay" — the seed-on-demand walkthrough. One clickable phone screen per step (Claim → Transfer → Stream → Handoff-unlock → Graph → Profile) plus gated, nudge, and complete states. Progress dots, chained-release flow map. The Profile step now folds in make it yours — handle → workspace pre-fill (Activation v2 reconciliation).

The zero-dep agent-launcher demo re-skinned to v3.5 — activation.css now inherits the neutral token layer, accents split across the role slots.

Looping marketing motion stings. Chrome neutralized to v3.5; the stings keep their brand teal + #00D9C8 pulse as motion. Switch stings, flip light/dark.

The internal blog every seat writes to, drawn as a new console section rather than a page: the feed (seat · kind · visibility on every post; withheld rows counted, never dropped), On the go — one card per seat on the board dashboard’s five source states, where a seat past its cadence reads quiet and never blank — the write form that renders the exact updates/YYYY-MM-DD-slug.md a session commits in the same PR as its work, and the hook register: every boot surface (CLAUDE.md, the coordination convention, the hub close-out, the seat series, the boot pack) that has to point here for another session to find it, each marked exists · extend · proposed. One record, three renders — console, board site, boot — the board dashboard’s generated, never typed law applied to narrative. Preview-as is a lens that only narrows (?as=management). Concept only, nothing built. Doc of record: relay-board/docs/product/updates-feed.md.

Board-level surface, tier-1/finance gated. Instruments the four milestone-gated tranches (T1 Protect → T2 Sustain → T3 Team, the round floor → T4 Scale) instead of rendering a wall of zeros. Every figure carries a provenance chip (source + as-of) across five source states — live, manual, stale, not instrumented, not computable — so measured-zero and never-wired can't be confused. Roadmap is one source, two renders: board view keeps dates, the investor render drops them at render time and reports its withheld-row count. A fourth screen adds the one column the Investor track screen doesn't carry — onboarding enrollment — because activation rate is a T4 gate signal and an investor enrolled in First Relay sits in its denominator; register, compliance and audit stay owned there. Concept only; no build until the canonical source is settled and approved.

Keeping EAP participants in the loop ahead of public disclosure — drawn as a third render of the roadmap source the board dashboard already carries, never a second roadmap. Two real shells on one switch: the participant surface in the app rail, and the console screen going from two renders to three plus the mode the others don’t have — Unfiltered, where every withheld row is visible with the predicate that withheld it. Admission is three server-side predicates, all required, defaulting to withheld (committed ∧ destined public ∧ outcome-safe), and the operator toggle can only ever withhold — a switch that could publish a refused row is a disclosure control with a manual bypass. The console’s Show to participants toggles and its message editor drive the app surface live on the page, with a preview that is the render rather than an approximation. Requests are framed as the constructive twin of gate-denied: one feature-key namespace, two directions. Twelve edge cases, three of them ship gates — led by the fail-open inversion: the legal gate fails open on a DB error, which on a pre-disclosure surface turns a blip into a public disclosure against a zero EU/EPO grace period. Nothing built; the forward half is blocked on the canonical source. PRD: relay-board/docs/product/PRD.eap-roadmap-visibility.md. Deep link: ?surface=admin.

Error statuses in the shell: tier chips (critical/warning active counts, pulsing dot on critical) on every screen + a bell with the per-admin unseen count and notification panel — fed by platform_alerts (categories incl. the new client + public from the error-triage pipeline). Interactive: fire client/boot/public spikes and watch the shell escalate; mark-seen (per-admin cursor) vs resolve (global) modeled as the backend does it.

The admin console on the shipped v3.5-a neutral-first system (same tokens.css + shell as the app). Expandable icon rail over the full 7-section operator map, operator topbar (status pill, maintenance flag, preview-as-role), dense tables, confirm-modal + toast. Mobile: the universal menu (topbar → off-canvas drawer, no bottom tabs) + scroll tables. Shell + 5 canonical screens: Dashboard, Transfers, Users, Claim approvals, Access codes. Light/dark, keyboard-operable.

The screen the campaign-funnel work order gated on #1900, redrawn on the answer. Class is a column, so the four things called “campaign” — demo, growth, invite, referral — are one list with an honest filter rather than three screens sharing a name; the handle shows the door each arrives through (/x/, /i/, ?ref=) and the detail adapts its funnel and protection line per class. Tags carry the grouping, which is what lets Track (formerly Angle) go optional behind a General default — the personalizer already has the person’s own role, workflow and goal. The create form checks the namespace at mint, case-folded: type AILDR14 and it is refused with the owner named, because /x/ resolves campaigns first and the collision would otherwise be silent. Access codes split label from campaign and show the /x/{CODE} link each mints. Sep 13 amendment: Access is the third axis — none | plan | trial (EAP is plan with beta) — and a trial length exists only under trial: pick EAP and the Plan and Days fields are not there to type into, because tier='beta' has no expiry field and ends by graduation, never by trial lapse. Record: relay-board DEC-030, relay-platform docs/SPEC.campaign-management.md §7.

Tier-1 operator surface for the investor lens, inside the operator shell: register with opaque pack IDs (never a name or firm in a URL), NDA version + ToS acceptance, compliance flagging access without a current signature, and grant/revoke audit where revoke names the Cloudflare Access step it does not reach. The Lens & gate tab carries the argument: EAPA can't be made optional in the gate component, because the gate only renders what /api/legal/pending returns — skipping it client-side leaves gate_needed() true at seven server call sites and traps the user with nothing to sign. Proposes applicability as a third axis beside version and enforcement mode. Draft — awaiting approval, nothing built. Spec: relay-platform docs/SPEC.investor-track.md.

Same operator shell in the neutral dark contrast mode — canvas darkest, cards lighter, teal #2dd4bf, ink-flip fills. Theme toggle (auto→light→dark) in the topbar. The full 36-screen inventory + v3.5-a gaps live in briefs/AUDIT.console-v35.md, tracked under RCTX-705.

Parallel v3.5 console build focused on the Finance group: commitment lifecycle (5 states, committed-vs-realized $), seat↔member true-up with the 402 confirm, trials with discount-at-conversion, Seats & Segments (free / EAP-open / EAP-grace / paid-full / paid-discounted cost-vs-revenue split, margin flips to net burn when only unpaid segments are selected, sortable + CSV export), P4/P5 stubs. Mirrors the membership-billing lifecycle shipped to relay-platform. New: the Gateway panel — connection health and console-managed config, built adapter-shaped so a Launchpad product on another processor inherits it. Three scenarios, all real failure modes: healthy, webhooks stale (six days of silence against 41 live subscriptions — the one check that catches an outage rather than a misconfiguration, and it reads processor_events, not the API), and test key in prod. Secrets are reported present-or-not, never shown or editable. Deep-linkable: ?gw=stale / ?gw=testkey.

11 portable micro-interactions for the app, console, and marketing site. Self-contained vanilla JS/CSS drop-ins. Konami beam, mark × 5, Code scramble, status snap, receive beam, gravestone, empty states, 404, late-night banner, idle pulse.

Full spec deck — constraints, per-egg effect + porting guide, key CSS, and priority table.

The internal, team-facing onboarding component — distinct from the app's own user-onboarding line above. Dashed mono eyebrow, italic accent headline, flat cards, step checklist. Shown here with placeholder data; real per-person instances are gated on resources.relayctx.com/onboarding/<person>. First built for the initial brand & product hire.

EC (2026-09-12), on the GitHub contribution graph: “This type of activity on the user’s profile and dash is a great way to get them using Relay a lot.” Three proposals that only work together. The activity graph as a component: every cell a count of relay_timeline events (sent · claimed · forwarded · landed · handoff · stream · session; reads never), agents marked ◆, levels from the data’s own quartiles, a sequential teal ramp derived from the accent by color-mix() so dark mode flips its anchor by construction and no new hex exists. The module contract: a module is the smallest unit a screen lends to another surface — one owning screen, declared hosts and widths, a tier per viewer (full · counts · none), empty means gone, pinned moves but never leaves — with the interface, eight rules, a sixteen-module catalogue generated from the registry the prototypes run on, and six hosts including the agent’s Root Manifest. The lens: hat, scope, viewer and time, composing under the rulings already ratified — a lens never grants; a visitor can only ever see less. Live specimens for all three, the day-one state, Step 6 amended to “Make it yours”, ten worked edge cases, what ships versus what is new, six decisions to ratify. Concept — proposal, not canon; nothing built. Record: relay-board/docs/product/activity-and-modules.md.

The shipped dashboard’s five bands become modules the user arranges, on the v3.5 shell verbatim. Customize mode with drag, keyboard reorder, width and remove; a catalogue sheet grouped by the screen that lends each module, saying why one is unavailable (needs the org hat, flag off) rather than greying it; Needs you pinned — moves, never leaves — and vanishing to zero height once cleared; the lens stated once in the header (all my contexts · this hat only) with org modules joining and leaving with the workspace chip; the activity graph at three widths; a first-run state carrying Step 6 · Arrange your dashboard with three one-tap starter layouts. Hooks: ?hat=org · ?scope=context · ?customize=1 · ?state=first-run|empty. Layout persists locally only; fixture data.

The Profile addressed in tandem, from the shipped /profile settings form and the shipped /u/{handle} card. The form becomes the edit state, kept whole; the profile becomes the identity card, the activity graph (year picker, table twin), the owner’s modules and Shows on your public profile — each pick labelled with the tier a visitor gets. View as You · A connection · Public previews the card exactly as the host computes it: modules with tier none disappear, counts modules drop to numbers, the graph shows org-visible counts unless the owner opts private contributions in — as numbers, never titles. /u/erik carries Relay to @erik as its primary action; private stays the shipped locked state. First-run carries Step 6 · What your profile shows with the graph’s first cell lit. Hooks: ?view=public|connection · ?vis=private · ?edit=1 · ?state=first-run.

EC: “Your team… tools for collaborating in the AI world.” An atlas isn’t a map — it’s a bound set of plates of one world, and what makes it an atlas is the gazetteer: look a thing up and it tells you where it sits on every plate. So all four plates stay on screen together and selecting a teammate lights them up across all four at once — switching would defeat the point. One week drawn as the team (who held it, who it ran in), the work (Context Map grammar), the week (a lane per teammate), and the hats (three sealed enclosures, cross-boundary count computed and shown at 0). The roster is three people and three agents, which is the argument: a solo consultant with Claude Code, Cursor and one client contact has a team of four. That dissolves the single-user-vs-team split the session framing had left open. Checks two phrases and keeps one — “your team” holds; “session management” does not, since OWASP already owns it for cookies and login state. Companion to relay-board/docs/strategy/the-session-is-the-unit.md.

EC: “Pinboard, whiteboard, stickies, pad of paper… or an archive. Whatever they need, Relay can make it work like they need it to.” The third axis after hats and lenses: not which identity you’re in or which role you read as, but which shape you already think in. The same 14 objects and 8 provenance edges rendered five ways — and the invariant strip fingerprints what actually got drawn, read back out of the DOM, so a surface that quietly dropped or invented an object would show it on screen. Argues the distinction that carries the weight: rendering, not configuration — the Notion/Airtable trap is charging for flexibility at the door, in setup, before the user has seen any value. Names the discipline that keeps the claim honest (a surface may choose what to show and how to lay it out, never what exists) and the consequence for naming (a vividly-metaphored name prescribes a surface). Deliberately monochrome: streams are told apart by label and elevation, never hue. Companion to relay-board/docs/strategy/framing-substrate-vs-transport.md.

The multi-hat framing made touchable. A working week’s context laid out once — 20 objects across four hats (employer, two clients, personal) — where positions never move: switching a hat seals or unseals, switching a lens emphasises or recedes. The demonstration is that zero edges cross a hat boundary, asserted in the data and shown in the readout, so separation is structural rather than a read-time filter. “Reveal what’s sealed” distinguishes what the owner can see from what an agent in that hat can. Argues hats are walls and lenses are windows, states what “ties it all together” is allowed to mean, and answers the single-point-of-trust objection with the zero-knowledge posture. Companion to relay-board/docs/strategy/framing-substrate-vs-transport.md.

The 2026-08-10 direction calls landed in the app shell: Files is a rail section, not a Catalog tab — it sits directly after Overview (recommended placement, not final) and owns the content area, drawing its own tree beside the rail. The old SHELVES/LIBRARIES rail groups are gone, and the group that mislabelled the four lenses “Shelves” now reads Lenses, inside Files where it belongs. The files-v3.html GitHub shell carried across whole: library selector where the branch picker sits, “Go to file” + T as the search spine, a shelf tree that proves depth 3 (Auth & identity › On mobile › Warm), Last change as a supersession note, History with envelope diffs, and Edit that names the next version before you type. The cross-type Objects table moved in from Catalog as “All objects” — same table, every row and count per-viewer now. Runs on the catalog-shelves seeded corpus and grants, so the two prototypes describe the same workspace. Aug 17 — the pack-shelf layer: shelves can now be provisioned (SPEC.pack-shelf, Draft), and the surface exists to test the seam that spec turns on, not to illustrate it. An audience is grant rows (user · email · group · org — classes are v1); disclosure is a separate per-object act, so rule-matched objects sit on a provisioned shelf reading “matched, undisclosed” and reach nobody until someone acts — filing still never grants. A fourth viewer, Marta — External, is the Access floor: no Relay account, session-level provenance, watermark stamped, shown only the packs provisioned to her. Open one as her (that is a claim), revoke her row, and switch back: everything goes except the copy she claimed — “revocation ends access to the shelf and everything on it from that moment; what someone already claimed, they hold” made testable rather than quoted. Open calls render as open (§7.1 storage shape · §7.2 provenance exposure · §7.3 tier classes · §7.4 archive). Deep links: ?as · ?lib · ?shelf · ?obj&view=history · ?view=all · ?view=audience · ?q.

v1 drew Drive folders; v2 proved the set model but as a four-pane inspector — right semantics, lost shell. v3 is the shell the brief asked for: library selector where the branch picker sits, “Go to file” + T as the search spine, a shelf tree, and a listing whose second column is Last change — a supersession, not a commit. History opens the version chain; a click diffs two versions under an envelope header. Deliberately not GitHub: colour never carries type, no lock/shield glyphs, no export affordance. The set model survives intact — predicate under the breadcrumb, added chips, curator-only excluded rows, every count post-filter — and Edit on a claimed object names the version first: “claimed by 2 people. Editing creates v7.” Folded into the app as app-v35/files.html. Deep links: ?as=sam · ?lib=me · ?shelf=decisions · ?obj=o1&view=history · ?q=acme.

Superseded on composition by app-v35/files.html — Files is its own rail section now, not a tab inside Catalog. Kept as the record of the composed-into-Catalog answer (RCTX-1106): the organizing layer as a Shelves tab alongside Objects/Tags/Labels, reusing the existing rail tiers, table cells, peek drawer and tokens — no new class prefix. A shelf shows its predicate; hand-added rows carry an origin marker and rule-matched ones carry none; the peek drawer answers “why is this here” and exposes the properties that decide it. View as changes the same org shelf between Owner, Member and Viewer — 4 rows becomes 2. The model it draws is still correct; only the composition moved.

Where v1 drew folders — a place an object sits in — this draws libraries and shelves: sets an object belongs to, populated by a rule, augmented by hand, and filtered per viewer. Adds the four things v1 had no slot for: a library rail putting personal and org IA side by side; lens separation (Catalog and Workspace live, Graph and Journey greyed); membership origin, so rule-matched, hand-added and excluded are always legible; and a "view as" switch that changes the same org shelf between Owner, Member and Viewer — the projection made visible. Every count is post-filter. Foundation plan: relay-board/docs/product/organizing-layer.md.

Drive-shaped folders for relay objects, not Windows directories — the third projection of the corpus alongside List (search) and Graph (Context Map). Folders are loose, shallow buckets an object lives in one of; search sits inside the view as the spine, scoped to the current folder with a visible widen; labels cut across folders; a large share of the fixture corpus is deliberately unfiled, with no counts or nags on it. "Shared with me" holds received relays as a peer of the tree. Shows the integrity moment (editing claimed context supersedes, never mutates) and a Git-familiar unified diff across a version chain. Brief: BRIEF.cloud-files.md.

The temporal lens of Explore: a Journey is a linear projection of a graph walk — one ordered path shown beside the graph as an honest-time seam. Two buildable-now flavours (derivation via derived-from, session-handoff via continues), canvas⇄seam glint sync, fail-closed stub for the unseen ancestor. Reuses the map-v35 grammar (shape=type, teal=state, #00D9C8 motion-only). Seed-42 fixture. RCTX-612 · handoff 8QA9T6.

"I want to see my data and play with it." A live force-field canvas of your objects: drag a node to pull it around, scroll to zoom, drag the background to pan, hover to light up its neighbourhood, click for a detail rail with everything it connects to. The key move for edge-sparse data is Arrange — Free / Cluster (by container) / Type / Time regroup the same nodes so patterns fall out even with no lines. A trimmed List view rides the same data + detail rail (the minimal thread-reader). Journey's canvas grammar (shape=type, teal=state, #00D9C8 motion-only), canonical v3.5 tokens, light/dark. Extends DEC-018.

The v3.5 map refined from live feedback: the left legend/filter rail is gone (folded into a slim top control strip and the ? legend), and the right rail now always works — a live activity feed by default that leads with the selected object's envelope, relationships and Open action on select. Same connected, labelled map (shape=type, line-style=relation, dim-to-neighbourhood on select, hot-pulse on activity) on the canonical v3.5 neutral-first tokens.

Merges v2 + v2-1 + v2-2: density regimes at 40/400/5k objects, size-by-degree, label LOD + collision, workspace gravity, stream capsules, ego-focus, Arrange lenses (Force/Time/Orbit/Heat) with a list-twin per lens. Vanilla JS, self-contained like v1. Ported from the frozen prototype branch (PR #185, relay KTVANV) — not yet ratified against v1, see MEMORY.md.

From v2-3: the journey view (handoff moment, Owner lens) plus remaining edge cases — 3+ hop truncation, tombstone mid-chain, revoked upstream, re-homing, personal→org promotion, same-object dedupe. Ported from the frozen prototype branch (PR #185, relay KTVANV).

Interactive map of the workspace graph — relays, Streams, Sessions and Series joined by typed connections (the object_edges substrate). Guided tour + legend under ?, workspace lens across orgs (fail-closed envelope visibility), envelope spec view, drill-down search, exact ticking timestamps, phone shell with bottom sheets and pinch zoom.

The gc-* kit behind the Context Map and every graph surface after it — node shapes and states, relation lines, object chips, envelope overlay and spec, workspace rows, feed rows, mobile chips, tour card. The hand-off contract for @relay/ui.

Motion on the gc-* grammar: one live SVG canvas with arrange-lens morphs (Force/Time/Orbit/Owner), node arrival with a #00D9C8 ring, edge draw settling to the law dash arrays, focus dim, hot breathe, journey seam glint. Ported from the frozen prototype branch (relay FMZRNG).

A proposal and a working specimen in one, answering EC (2026-09-10): “Not feeling the decks we have — explore our slide builder and flesh out how we can make this amazing.” The governance model (M-IDs, gate tiers, flows, speaker-note stamps, master-first) is kept whole; the execution is replaced. Opens on the finding: today’s master reproduced beside the same slide rebuilt — one text layout thirty-seven times, a Syne eyebrow (retired), the side-stripe the guide bans, teal on every slide, no figures anywhere, and a PDF export that embeds Arial, Calibri, Comfortaa and Syne with no JetBrains Mono at all. Then the system: one slide model in git, two renderers (HTML for page · present · PDF; Apps Script regenerating the Slides master from the same model), one checker that makes the gate a build failure. Flow 9 rendered live at the guide’s type scale with drenched bookends and a real figure on every slide that has one, and a working present mode (keyboard, speaker notes, one beat per slide, every keyframe transform or opacity, complete resting frame under reduced motion). The slide-model and flow-file specs, the T01–T16 archetype map, the checker rules, the phased plan and the five calls that gate it. Concept — proposal, not canon; record on the board at docs/operations/deck-system-next.md.

How the in-app Support screen becomes a self-service panel and then an external portal, built on an audit rather than a wish: six support doors already ship — public contact form, feedback screen, rating widget, the agent, docs, and the app screen — and the only one inside the product is the only one that reaches nobody. Three findings read straight from main, each with its file: F1 the contact form carries a diagnostic ref and the feedback intake has no field for one, so the brief’s “surface the last CE- ref” step has nowhere to put it; F2 POST /feedback silently coerces any source outside {widget, web}, so an app panel is filed as an anonymous rating — trip it live in the composer; F3 the app screen calls no API at all. Then the spine (one intake, one submission, one triage, two back offices, N faces), four laws the faces obey, and S1 · S2 · S3 live with a signed-in / signed-out / locked-out viewer switch that makes the asymmetric gate testable — the screen is gated, the help never is, because a user who cannot reach the app is exactly the user who most needs support. Closes with an additive contract v2, the desk seam (the wire is write-only today, which is the real gap between panel and portal), the core/product cut for the framework, and five open calls. Concept — S1 mirrors what shipped; S2 and S3 are drawn, not built.

Headline and callout motion as working specimens K01–K08: the mask rise, word-stagger against line-rise as an open pick, a Code sealing on a share panel, scroll-keyed lines that answer the reader instead of a clock, the in-place word swap, the reduced-motion resting frame you can force and inspect, the page-header entrance kept live as the rejected pattern, and the assembled callout at the one-loud-piece budget. Every keyframe is transform or opacity, nothing loops, and nothing autoplays. The specimens leg of guidelines/GUIDE.motion-register.md; the feedback tier lives in brand/motion-lab.html.

The lead-capture kit as working specimens F01–F08: label law (with the placeholder-as-label anti-pattern proving itself), the per-field error lifecycle, hints with aria-describedby, autocomplete hygiene, bot-check gating that never traps, the consent lock that never plays dead, the confirmation with role=status and a focus move, and the assembled form. Trip the states, copy the wiring. The specimens leg of guidelines/GUIDE.forms.md’s enforcement triangle; the gate is scripts/check_forms.py.

The shell laws as a working prototype at full scale: one document that folds from the 220↔56px desktop rail to an off-canvas drawer at ≤860px — same groups, same stripe, no bottom tabs. Real Transfers list with DEC-025 cards (Code as head and the one teal moment; head closes up when unshared), a two-row control budget with everything else in a transform-only filter sheet, and a console twin sharing the same CSS where dense tables become cards on a phone. Reference implementation for the component-kit brief.

The universal rail (brand-mark collapse, active stripe, shipped group structure), app/console/mobile temperaments with a working drawer demo, the @relay/ui primitives inventory, and the seven shell laws. Ported from the frozen prototype branch (relay FMZRNG).

Split-screen “make it yours” concept, Attio-style — the handle (with an availability check) seeds the personal workspace name, pre-filled and editable, with a live Relay preview that personalises as you type. Now folded in-app: this make-it-yours step is realised inside the Sequential Onboarding storyboard’s Profile step (Activation v2 reconciliation), so it no longer lives on the /a/ ceremony.

Speculative, mostly-simulated exploration — nothing here is shipped. Everything in, one inbox: files and pasted text land directly; the slackbox pushes captures in on its own (the real integration's verbs — /relay capture · log · decision · action, and 📌 ✅ 🧠 reaction triggers); agent saves arrive over MCP with provenance. Items route down the line into transfers, Streams and Series — by hand, or via a simulated Relay AI proposal (title, tags, summary, routing). Includes a "simulate slackbox activity" lever to watch captures stream in live. Not to be confused with the "Send experience" card below, which documents the actual shipped Send screen.

Documents the shipped Send screen's agent-first redesign (RCTX-730/733/734) 1:1 — connected users get "Send it through your agent" (launcher buttons, send-intent prompt) with the manual form demoted behind a disclosure; not-connected users get a quiet inline connect prompt. Demo toggle simulates connection state. Also explores unshipped ideas on top of that base, clearly not part of the 1:1 mirror: a "Send"→"Capture" rename, Markdown Write/Preview tabs, and a .txt/.md upload dropzone (coming-soon). Not to be confused with the "Capture — full concept" card below — a much larger, separate, mostly-simulated unified-inbox concept.

The reimagined Connect screen: a two-act flow that unifies the MCP connector with the universal agent launcher. MCP-URL hero, inline client picker (Claude · Claude Code · Cursor · VS Code · ChatGPT · Other) tiered by install mechanism — one-click deep link, copy-a-command CLI, config snippet — a live handshake pulse with the activation spark payoff, then the shippable launcher as Act 2. Connected return-state cards + a ⌘K universal-launcher palette. Light/dark, motion toggle, mobile rail. Brief: BRIEF.connect-activation.

Public-facing relay landing — un-retired from _archive/ (the app-v35 obClaimPanel only covers onboarding self-claim, never the general external-claim flow this models). M0 gate/public-card, M1 signed-out states, and M2 signed-in set (#316–#321). Wrong-account bug-repro tab now reads "shipped" (relay-platform #1915/#1918) instead of live-incident, its before/after toggle kept for the record. Adds three new states matching what shipped Jul 18: self-claim vs. external-sender provenance (sender/org/visibility badges, relay-platform #1933 + relay-app #619) and the universal loading skeleton (relay-app #627) that replaced several blank-panel flashes app-wide.

Pixel/DOM-accurate reproduction of the live campaign-landing page (relay-app concepts/index.html #campaign-landing + requests.ts clInit() — dark/teal, own cl-* convention, not the v3.5 tokens) with its shipped states plus five gaps found in a live backend audit, each with a current/after-fix toggle wired straight to the tracked issue: draft-campaign servable (#1896), campaign expiring mid-flow (#1896), OTP send silently failing (#1897), no brute-force lockout on verify (#1898), and no capacity cap (#1899). Companion to the higher-level Campaign Path in Onboarding Flows below — this one is scoped to just the /x/ funnel, matched to the real DOM.

The invited-user first touch (the /a/ ceremony), mobile-first, on v3.5 — reconciled to the LOCKED Activation v2 (platform DESIGN-NOTE.activation-inflight-demo). /a/ goes LIGHT: name → handle → ToS → activate → hand off with a primary Open Relay. Handle stays here (resolved at activation; the welcome relay is addressed by first name, not handle). The activated screen shows the real welcome Code the server just minted — never a fixed length. Recovery codes, first claim, and connect all move in-app — the activated screen previews that order (connect → claim → save recovery codes; EC connect-first override of the note's claim-first order). Light + dark, desktop + mobile.

21 screens, 8 categories. Full source in relay-web@prototype.

Every surface served without a session — error pages, maintenance, link-expiry, claim gates — as one category on one chrome: the public .shell (mark → status strip → headline → body → actions → support ref) with a live state switcher and the /api/frontend-error triage beacon (category public, PB-… refs). New public-bound views start here.

Gallery of all HTTP error variants on @relay/ui v3.5 neutral-first — 404, 500, 503. Wired into deploy/Caddyfile via handle_errors blocks. The public .shell's error states model their next revision. v3.4 archived below.

Relay ID / invite link doesn't exist or expired. “This context didn't transfer.”

Unhandled server error, logged automatically. Context is safe.

Maintenance window or upstream failure.