Four things changed this week
Two of these are surfaces you work on. One is a way a group settles something. The fourth added nothing you can screenshot and is the one the other three depend on.
The canvas became a place you compose in
Every space has its own canvas, each app opens that space's things, the conversation sits beside the work, and a line you draw is a real relationship.
Your outside networks arrive in one place, with the gaps drawn in
Messages from the networks you already use show up here tagged with where they came from, beside a table naming exactly what each network can and cannot do.
The phone stopped being a smaller version of the desktop
Apps stack as swipeable cards under one bottom toolbar that stays put, each remembering where you left it, and your files browse and open there.
More than a hundred defects were fixed at the root and sealed shut
Each was traced to its cause and then locked down with a permanent test, so the same crack cannot reopen. Two of them touched core promises.
A canvas you can actually compose in
The feature: a working surface for each space you belong to — your own, and every shared channel — rather than one blank sheet you decorate.
Before: the canvas was a place to arrange things you dragged onto it. It had shapes and a pencil, which made it read as a whiteboard, and a whiteboard is something you draw on rather than something you work in.
Now: every space carries its own canvas, already holding that space's things and, in a shared one, the people you share it with. What you open on it shows you that space's material rather than everything you own.
That last sentence is the whole move. Open the photos app inside a shared channel and you see the photos that channel has shared. Open it in your own space and you see your own. The app is the lens and the space decides what you are looking at.
Search behaves the same way. Point it at a space and it reaches across everything in it — files, photos, contacts, notes — and hands back matches you can pull straight onto the surface, as a real query rather than a list somebody prepared earlier.
A space is a room rather than a sheet. The distinction sounds like vocabulary and decides the whole interface: a sheet starts empty and waits for you to bring things to it, while a room already contains what belongs there and waits for you to arrange it.
You can also spin a live view — a table, a list, a grid — over a selection, for the times when the same things read better organised than scattered. The arrangement is still yours; the view is a second way of looking at it rather than a replacement for it.
The conversation sits beside the work
Because a shared channel is a place with other people in it, the chat lives right there — a panel you slide in alongside your windows, showing that channel's live conversation.
Your own personal space has no chat, and the absence is deliberate rather than unfinished. You are not there to talk to yourself, and a feature that appears where it would mean nothing teaches people to distrust it where it does.
A line you draw can be a real relationship
The drawing tools grew a real set of hands this window: triangles, hexagons and stars, smooth curves you bend by their handles, a freehand pencil, and connectors that link one thing to another and follow them when they move.
Every one of those is an object rather than ink. Select it, move it, resize it, restyle it — and drop an actual thing from your data onto the surface beside them, then draw a connection from that thing to a shape, or from one thing to another.
The line between two real things is a stored relationship rather than a doodle. That is the difference between decorating a picture of your data and laying out the actual shape of it, which is the only reason to put your things on a surface at all.
What lands is the real thing, checked
Drag a photo out of its window and what lands is a live reference card rather than a copy. It points back at the real thing and is checked against what you are actually allowed to see, so a thing you cannot see says so instead of quietly appearing.
Select something on the surface and you can hand it to a person or a channel, or open it inside the web of everything it connects to. A cluster that belongs together can be bundled into a signed, shareable collection of those things with the links between them intact.
What the assistant will and will not do here
The assistant on the canvas acts rather than only answering. Ask it to bring up your files or show the calendar and it opens that app as a window on your canvas, with a brief moment to cancel if you did not mean it.
It also fetches — searching your material, pulling up a contact or a result — and hands what it finds back as cards you drag into place.
What it does not do is draw, create or move objects on the canvas itself. It will not arrange your cards into a grid or sketch a diagram for you on the surface. That step is still being wired, and the honest version of a big idea is worth more than an implied magic wand.
Every network in one place, and a table that says where it stops
The feature: the conversations you already have on other services arriving here, in the same list as everything else, rather than in six apps you carry a map of in your head.
Before: you opened one app to check a friend, another for a group, another for work, and came back unsure which of the three you had seen a thing in.
Now: a message from an outside network shows up as an ordinary chat bubble in the same calm list — a note from one service, a thread from another, a room you follow — arriving rather than waiting to be fetched.
Every bubble keeps an honest tag of where it truly came from. A message's origin is never rewritten to make the list look tidier, because the tag is the truth of that message's journey and it stays with it.
The table is as much the feature as the inbox
Alongside the surface sits a table laying out every network against every capability, with the gaps left visible rather than coloured in.
A mark means a real wire path to that network exists. A half mark means a real, named limit. A cross means the network permanently cannot do that thing. Nothing is filled in that does not actually work.
The usual version of this product shows a wall of green and lets you find the holes yourself, mid-conversation, when a message silently fails. Publishing the holes up front is a worse-looking table and a better one to rely on.
That is what the phrase "one honest inbox" is doing. It does not claim everything works everywhere. It claims you can see, before you depend on it, exactly what each network can and cannot carry.
The limits, stated rather than discovered
Today this is where your networks arrive. Sending a reply back out to them from here is the next thing being wired, and until it is, calling this an inbox is a statement about arrival and nothing else.
Delivery and read are observed into a ledger for several networks and are not shown to you, so what you see when sending lands is a single sent mark rather than a receipt nobody can stand behind yet.
One network — Signal — has a send path that is written and proven in code and has never run against a live linked device. It shows a blocked state and says so, rather than offering a cheerful thread that would fail on use.
And firing real messages at live accounts is gated on purpose across every network, because getting somebody's account banned is a real risk. A built path means the route exists and is proven in code, not that we have tested it by spraying your actual accounts.
One journey proven all the way through
Of the networks wired, one — Matrix — has been followed end to end, from the outside service to the bubble you read. The others are wired and render, and that is a weaker claim, stated as the weaker claim.
A single proven path is worth more than five asserted ones, because it is the one that tells you the shape of the whole route actually works. The remaining networks are then a question of coverage rather than of whether the idea holds.
One further thing landed beside this. A person you add to a shared conversation can sign and take part from the moment they join, rather than waiting on somebody to grant them a voice — so bringing a person in actually brings them in.
What this means, in plain terms
Five lessons this stretch paid for. Each came out of something that had already gone wrong, and each survives outside this codebase.
A fix without a test is a fix with an expiry date
More than a hundred defects were fixed at the root this stretch and each was then sealed with a permanent test. Nothing else stops a later change quietly undoing a repair nobody wrote down as a requirement, and the test is the only part of the work that outlives the person who did it. Write down what must stay true, or you have written down nothing.
Name the format you are writing, rather than implying it
The picture-to-PDF path let the output filename decide the encoder, and the system's own generated filenames carry no extension at all — so image bytes were stored under a label saying PDF. The format is now stated outright on the command line. A format inferred from a name you control loosely is a guess, and it fails on the day the name has nothing in it.
Append the durable thing before discarding the convenient one
A long conversation is folded by summarising its middle. The summary is written to the record first, with a marker for how far it reaches, and only then is the in-memory copy rebuilt. Write the record, prove it is written, and only then reclaim what it replaced — so a failure costs you a retry rather than the material.
A machine being able to do something is not an argument that it should
Devices now describe themselves twice: what each has detected it is capable of, with a freshness limit, and what a trusted machine has signed a declaration about. The two are never blurred, and a guess is never promoted into a vouched fact. Capability and permission answer different questions and get confused constantly.
State the direction of anything that looks two-way
Messages from your outside networks arrive here and cannot yet be sent from here. An inbox showing both sides of a conversation implies you can reply, because every other inbox in the world can. When a feature resembles a familiar one, its differences have to be stated rather than discovered.
How much healthier is it than a week ago?
| Metric | This window | What it counts |
|---|---|---|
| Bugs fixed at the root | more than 100 | Distinct defects traced to a cause, fixed there, and sealed with a permanent test |
| Of those, touching a core promise | 2 | Files written in the clear; identity keys overwritable |
| Commit figures | not reported | See the counting rule below |
Commit figures are not reported for this window. The counting rule used in the other dispatches — every commit in the window, split into merges and everything else — was not applied here, and we would rather leave the row empty than publish a figure we cannot reproduce with a command we can name.
The bug figure is the one number this stretch genuinely supports, and it is stated as "more than a hundred" rather than as a precise total, because that is the resolution the underlying record actually has.
Stating the rule we could not apply is part of the point. It is every commit between two fixed positions in the window, split into merges and everything else, with the earlier position proven to come before the later one before anything is subtracted — so a reader can see what is missing rather than only that something is.
For the same reason the areas below carry no per-area numerals. A number there would make the section look more rigorous while making it less true.
the canvas became the place shared work actually happens, the networks you already use started arriving in one list under a table that names their limits, the phone stopped being a shrunken desktop, and a hundred repairs nobody can see went in underneath all of it.
Five honest notes
You cannot upload a file from your phone. Browsing and opening work. The phone is where you go through your files, not yet where you add them, and that gap is being worked on rather than designed away.
The inbox reads but does not send. Messages from your outside networks arrive here and are tagged with their origin. Replying from here is still being wired, so this is a reading surface today, and delivery and read receipts are observed without being shown.
The canvas assistant does not draw. It opens apps and hands you cards. The version that arranges your surface or sketches on it for you is still being built.
Only one network's journey is proven end to end. The others are wired and render. That is a weaker claim and it is stated as the weaker one rather than folded into a single tick.
A summarised conversation is compressed, not redacted. The checkpoint ships marked with a conservative data class so nothing over-shares, and per-field redaction inside the summary is acknowledged work rather than a claim.
What changed, area by area
Every area that moved in this window. Per-area file counts are not available under a rule we can reproduce, so these are named without a numeral rather than given an invented one.
Every space you belong to now has its own canvas that already holds that space's things, and every app you open on it shows that space's material rather than everything you own.
In a shared channel the live conversation slides in beside your windows; your own space has no chat, on purpose.
The drawing tools gained triangles, hexagons and stars, curves you bend by their handles, a freehand pencil and connectors that follow what they join — all real objects rather than ink — and a line drawn between two things from your data is a stored relationship.
What you drag in is a live reference checked against what you are allowed to see, and a cluster can be bundled into a signed, shareable collection with its links intact. ( A canvas you can compose in .)
The mobile app stopped being a smaller version of the desktop.
Your apps now stack as swipeable cards under a single bottom toolbar that stays put, and each app remembers where you left it rather than starting over. Underneath, it is the same body of work as the larger screen wearing a second shape, which is why the two keep pace instead of drifting.
Your files come across too — you can browse and open them from a real mobile toolbar. Putting a file up from the phone is still being built, so for now the phone is where you go through your files rather than where you add new ones. ( NAOMS in your pocket .)
The conversations you already have elsewhere now arrive in one place, each message tagged with the network it came from, and that tag is never rewritten to make the list look tidier.
Alongside the inbox sits a table laying out every network against every capability, with the gaps left visible rather than coloured in — a real wire path, a named limit, or something the network permanently cannot do. Matrix is the one journey proven end to end today.
The direction is the honest caveat: this is where your networks arrive, not yet where you send from, Signal shows a blocked state rather than a fake thread, and firing messages at live accounts stays deliberately gated. ( Your networks, one honest inbox .)
Turning a picture into a PDF was added this window, handed to a tool installed on your own machine rather than to a service elsewhere, and the system probes for what is actually installed instead of advertising conversions it cannot perform.
It also produced the window's sharpest lesson: the tool picks its output format from the filename extension, the system's generated scratch paths have no extension, and so the stored file held a picture while the receipt beside it said PDF.
The format is now named outright on the command line, and a check builds a real image, converts it to an extension-less path and reads the first five bytes of the result back off disk.
On a machine without the tool that check is skipped, and a skip is visible as a skip rather than counted as a pass. ( Naming the format your machine writes .)
The machines you run this on learned to describe themselves twice over: what each has detected it can do, which carries a freshness limit and gets re-checked rather than trusted forever, and what has been declared about it by hand — a signed assertion only a machine you marked as a trusted primary may make.
When there is work to place, machines that cannot do the job are excluded outright rather than tried, and the rest are ranked by fit so the work lands on the best of them. Re-checking a machine partway through a long job is not built: the decision is made well, once, at dispatch.
( Your machines know what they can do .)
A long-running conversation now summarises and appends a signed checkpoint before it frees anything, so forgetting became a consequence of having remembered rather than a substitute for it.
The working memory is rebuilt from that record when a process comes back, which means the durable thing is the chain of summaries and the live window is a view of it.
What the checkpoint does not yet do is redact inside itself: it ships marked with a conservative data class so nothing over-shares, chosen over a cleverer scheme that had not been proven.
Separately, a request is compiled into a plan built only from operations the system really has, then put through a ladder of checks that each default to no — with a clarifying question or an out-loud refusal where the request cannot be grounded, rather than a plausible action nobody asked for.
( How it remembers, and how it reviews itself .)
More than a hundred distinct defects were tracked down, fixed at the root, and then sealed with a permanent test so the same crack cannot reopen.
Two touched promises the whole product rests on.
Files shared through a conversation could be written to disk in the clear, past the encrypted store meant to hold them; they now stay encrypted at rest, and the old unsafe path fails the checks on sight rather than merely going unused — which is what makes it a fix rather than a correction.
A background helper could overwrite the keys that prove you are you, the kind of mistake that locks a person out of their own identity with no way back; that write is now refused rather than permitted and audited.
Named, not claimed
NOT CLAIMED — browsing and opening only.
NOT CLAIMED — messages arrive; the reply path is unwired.
NOT CLAIMED — it opens apps and hands you cards; you place them.
NOT CLAIMED — observed into a ledger, not shown to you.