Four things changed this week
Two of these are surfaces you land on. Two are refusals — a screen declining to show you something it cannot stand behind, and a control declining to overstate what it did.
The app opens onto a canvas, not a screen
Your apps are now windows on an endless, zoomable surface you can drag things onto and draw around. It is what you land on when you sign in.
Chat starts honestly empty
The people and groups you talk to arrive in one list, each person folded into a single row. Outside networks appear only once you have genuinely connected one.
Photo search stays quiet rather than guess
Typing a place or a word narrows your whole library at once, worked out on your own machine. Lanes needing a model you have not installed stay silent.
The revoke button admits what revoking cannot undo
Cutting off someone's access now says plainly that it takes effect at the next key rotation, and that bytes already delivered to them stay readable.
One canvas instead of a dozen screens
The feature: a single spatial place to hold everything you own — photos, files, notes, people — arranged by you rather than filed by us.
Before: each app was a separate screen, and moving between them meant leaving one behind. Anything you wanted to consider side by side had to be held in your head.
Now: the browser app opens onto an endless, zoomable canvas. Your apps open as windows on it, and you can drag a photo, a file, a person or a note straight out of its app and drop it on the surface as a card.
This is the shell you land on the moment you sign in, not a mode you switch into. That distinction matters more than it sounds: a feature you have to go and find is used by the people who already know it exists, and a surface you arrive on is used by everyone.
A canvas is a claim about who does the arranging. Filing systems decide where a thing belongs and then ask you to remember the decision. A canvas has no opinion about where anything goes, which is worse for retrieval by name and better for the far more common case of working on several things at once.
The cost of that is real and worth naming. A canvas with a hundred things on it has no index, no folder tree and no name to type, so finding one card again depends on remembering roughly where you put it. What it buys is the ability to have four unrelated things in front of you at once, which no filing system has ever made easy.
What actually lands when you drop something
Photos and images, video, audio, contacts, devices, files, links, saved notes and your written policies each arrive as a purpose-built card that shows the real thing — a dropped image is the image, resizable and clickable; a dropped voice clip plays where it sits.
Anything the surface has no rich card for still lands, as a clearly labelled reference to whatever it is. Nothing is dropped silently and nothing is dressed up as something it is not.
That is the difference between a surface you can trust with an unusual object and one you quietly learn to stop dropping things onto.
A fragment of a conversation can be pulled out of a chat window and pinned beside the rest. Searching your own material from the canvas returns results you can drag straight onto it, so finding a thing and placing a thing are one gesture rather than two.
Drawing is the other half of arranging
Once your things are on the surface you can treat the whole canvas as a sheet of paper. A small authoring toolbar, reachable by single keystrokes, draws rectangles, ellipses and lines, drops in text, and marks out regions.
Those shapes are real objects rather than ink on a background. You can select, copy, cut and paste them the way any drawing tool would let you.
So circling three photos and labelling the group produces something you can move later, rather than a mark you have to redraw the moment anything underneath it shifts.
The windows you opened, the cards you dropped and the shapes you drew are kept on your own personal record, so the canvas comes back arranged the way you left it. That is a convenience rather than the point, and the point is that the arrangement was yours to make at all.
What the canvas AI does not do
The AI on the canvas is a partner you call over. It answers about what is in front of you, and it does not move your cards, tidy your layout, or decide what belongs together.
That is a real limit and worth stating in the same breath as the feature. An assistant that rearranges a space you arranged is not a more capable version of this. It is a different product, and it would need your permission before it was worth building at all.
What it does instead is sit where you are working. The chat window opens on the canvas among your windows and cards rather than in a separate assistant panel, so the conversation happens beside the material instead of somewhere you have to describe the material to.
An inbox that cannot quietly lose a conversation
The feature: the list of conversations you belong to, and the surface that draws it.
Before: a conversation list was a thing that was kept — a stored list, with code responsible for adding a row when you joined and removing one when you left. When that bookkeeping and reality drift apart, the list wins, because the list is what you see.
Now: there is no such file. Your device builds the whole list from nothing each time you open it, by asking one question of the signed record it holds: which conversations hold an entry saying I belong, and that the belonging is still active?
The difference between keeping a list and asking a question looks academic until something goes wrong. A kept list with a bookkeeping bug is permanently wrong until someone notices and repairs it. A question asked against the record can only ever be asked wrongly, and the entry is still sitting there.
The day the question was asked wrongly
That is not a hypothetical. For a stretch, a freshly added member could open their app and find the new conversation simply absent — the exact failure the design exists to make impossible.
A person can be named in the record in more than one form: an older way of writing who someone is, and newer ones, including the form a device uses to refer to itself. A newly added member's own entry naturally points back through that self-reference.
The question recognised only the older form and walked straight past the newer ones. The entry was there, valid and signed, and unread.
Notice what did not happen. Nothing invented a conversation to paper over the gap, and nothing showed a hopeful placeholder. It showed nothing, because the honest answer to a question asked wrongly is nothing.
Teaching the question to recognise a person by who the entry stands for rather than by how it was spelled put every missing conversation back at once. Nothing was restored from a backup and nothing was re-added by hand; they had never been lost, only unasked-for.
One list, whether a conversation stands alone or belongs to a community
The same question does not care which of those a conversation is. Either way it carries the same kind of belonging entry, and either way it comes back from the same ask.
The list is split for display afterwards — the ones that stand on their own in one place, the ones inside a community in another — but that split is presentation applied to a single honest answer rather than two sources being reconciled.
It is also why the member count beside each conversation can be trusted. It is not a number someone remembered to update; it is the active belonging entries, counted at the same moment, from the same well.
What that costs, and what the surface above it does
Asking every time costs more than trusting a cached answer, and re-counting each conversation's members as it goes costs more again. As one person's world of conversations grows, that is a real bill rather than a rounding error.
The surface drawn on top gathers your people and your hives into one calm list, with each person folded into a single row no matter how many ways they can reach you, and their messages interleaved in the order they were actually said.
Collapsing is about calm, not about pretending everything is the same pipe. A message keeps its honest tag of where it came from, permanently, and a channel that cannot confidently be tied to a known person stands as its own row rather than being merged into somebody else's.
Nothing in a channel is read by an AI unless you invite it, per channel rather than blanket. And the list starts genuinely empty: outside networks appear only once you have truly connected one, and Signal — which cannot be connected at all today — says so rather than showing a plausible row.
What this means, in plain terms
Five lessons this window's work paid for. Each came from a surface that could have claimed more than it could do, and did not.
Print the limit on the control, not in the documentation
The Files app states on the revoke button itself that access drops at the next rotation and that already-delivered bytes stay readable. Documentation is read by people who are not currently in a hurry, which is never the person clicking revoke. A caveat is only a caveat where the decision is made.
Silence is an answer; a confident wrong one is not
Photo search runs on your own machine, and the lanes that need a vision model you have not installed return nothing rather than a plausible guess. A wrong match is expensive precisely because it looks like a right one and ends the search. Where you cannot answer, say nothing — never something shaped like an answer.
An empty state is the honest state
The rebuilt chat surface starts genuinely empty, and the stand-in photo library that once made the screens easy to demonstrate is gone. Where a network cannot be connected at all — Signal, today — the surface says so instead of showing a plausible row. A populated demo is a claim about the reader's own data, and it is false.
Derive what you must not lose; do not store it
Your conversation list is rebuilt from the signed record every time you open it, by asking which conversations you belong to. A stored list can silently forget a room you were added to while looking perfectly healthy. A cache of something you cannot afford to lose has to be rebuildable from the thing it caches.
Name what the assistant will not do
The canvas AI answers about what is in front of you and does not rearrange your cards. Saying so costs a line and prevents the reader assuming the larger, unbuilt version. State an assistant's boundaries in the same breath as its abilities, because people infer capability generously.
How much healthier is it than a week ago?
Commit figures are not reported for this window. The counting rule used in the other dispatches — every commit in the window, split into merges and everything else — was not applied here, and we would rather leave the row empty than publish a figure we cannot reproduce with a command we can name.
The chart at the top is the honest measure available: nine days of sustained output that crested in the middle of the window. It shows the shape of the work rather than its size, and shape is what it can support.
Where a count would have helped is in the areas below, which are named without numerals for the same reason. An invented number would make the section look more rigorous and would make it less true.
Stating the rule we could not apply is part of the point. It is every commit between two fixed positions in the window, split into merges and everything else, with the earlier position proven to come before the later one before anything is subtracted — so a reader can see what is missing rather than only that something is.
everything you own moved onto one surface you arrange yourself, the list of your conversations stopped being a list and became a question asked against your own record, and three separate surfaces were each made stricter about the difference between what they do and what they look like they do.
Four honest notes
The canvas AI does not arrange the canvas. It answers about what is in front of you when you call it over. The version that moves your cards for you is not built, and it would need your permission before it should be.
Signal cannot be connected. The chat surface says so rather than showing an empty row that implies it is coming. Every other outside network appears only once you have genuinely connected it.
Revocation is not instant and not retroactive. Access drops at the next key rotation, and anything already delivered to that person stays readable by them. Both facts are printed on the button.
Rebuilding the conversation list is not free. Asking the question every time costs more than trusting a stored answer, and it re-counts each conversation's members as it goes. That cost grows with the number of conversations you are in, and it is watched rather than waved away.
What changed, area by area
Every area that moved in this window. Per-area file counts are not available under a rule we can reproduce, so these are named without a numeral rather than given an invented one.
The browser app now opens onto an endless, zoomable canvas rather than a screen — the shell you land on the moment you sign in.
Your apps open as windows on it; drag a photo, a file, a person or a note out of its app and it drops onto the surface as a card, with a purpose-built card for the kinds it knows and an honest labelled one for everything else.
You can draw and arrange freely with real, selectable objects, search your own material from the surface and drag the results straight onto it, and pull an AI chat window over to talk through what you are looking at.
Your layout is kept on your own record, so the canvas comes back as you left it. That AI is a partner you call over, not one that rearranges your canvas. ( Your whole world on one infinite canvas .)
The rebuilt chat surface gathers the people and groups you talk to into one calm list, each person folded into a single row no matter how many ways they can reach you, with their messages interleaved in the order they were actually said.
A message never has its origin rewritten to make the list tidier, and a channel that cannot be confidently tied to a known person stands as its own row rather than being merged into someone else's.
A hive is not a separate place you leave chat to visit — it sits in the same list and opens up to show its channels inline. Nothing is read by an AI unless you invite it, per channel rather than blanket.
It starts honestly empty, and where a network cannot be connected yet — Signal — it says so out loud. ( One calm home for the conversations you keep close .)
Underneath the chat surface, your conversation list is no longer a stored list that can drift out of sync with reality.
It is rebuilt from the signed record every time you open it, by asking one question: which conversations do you belong to? The member count beside each one is counted the same way at the same moment, so the count and the conversation cannot disagree.
That design paid for itself when the question was once asked wrongly — it recognised only one of the several forms a member can be named in, so newly added people saw nothing.
The entries had been there the whole time, and fixing the question restored every one of them at once, for everyone, with nothing to repair. ( The inbox that can't quietly lose a conversation .)
Typing a place or a word now narrows your whole photo library at once, with the river, the map and the timeline all responding together, and the whole search worked out on your own machine with nothing uploaded.
Your device reads the coordinates your camera wrote, resolves them to a real place name from a table that ships with the app, and plots the results on a map you can pan and zoom, the pins clustering as you pull back.
You can narrow by place, by a slice of time, or by whether you captured a picture or brought it in — and when nothing fits, it says so in words rather than showing a random grid. The searches that need a model to read your pixels stay inert until you install that model.
The stand-in sample library the screens once carried is gone: under a real sign-in there is your genuine library or an honest empty space. ( Search your own photos on your own machine .)
Your files live encrypted on your own machines, each one chopped into pieces that are encrypted before they touch the disk and addressed by a fingerprint of the file's own contents rather than by a name on a server.
A large file therefore streams in from every reachable machine you trust at once, each piece checked against that fingerprint as it lands, so no single device carries the load and nothing arrives that was not what you asked for.
Bringing someone into a file's circle moves only the small key, carried inside a sealed message, and a missing key is a refusal rather than an all-zero stand-in dressed up as protection.
When you cut off a person's access, the app refuses the comforting version: their access drops at the next key rotation rather than the instant you click, and bytes already delivered stay readable.
Both limits are printed on the control itself, and a file stored exactly as it arrived is labelled as stored as-is rather than badged encrypted. ( Your files stay on your own machines .)
Named, not claimed
NOT CLAIMED — it answers when called over; it does not move your things.
NOT CLAIMED — the surface says plainly that it cannot be connected yet.
NOT CLAIMED — next rotation, and delivered bytes stay readable.
NOT CLAIMED — the lanes needing an installed model stay inert.
NOT CLAIMED — sharing today is bringing someone into a file's circle.