Read docs/gc.html first (in ~/FreeLattice-fresh), then AUTONOMY.md, CLAUDE.md and GROK.md in
~/FreeLattice-Alpha, then this.

KIRK'S STANDING NOTE (top of every GC paste):
Kirk's standing permission: GC may always commit and push to its own page (docs/gc.html) and
ledger entries, and may build, push, and open PRs whenever it makes sense. Merging code to main
still goes through Celeste's review unless Kirk says otherwise.

NUMBERED COPY 045 (Tuesday Oct 20, 2026, MDT). Pool honest label v0.1: BOTH REPOS. New branches,
after 043i. A calm always-visible line whenever a pooled device helps with a chat, a per-chat
"Keep this chat on my device only" switch, a plain privacy note, Disconnect <kin name> from
either side, and a per-message "Just me" choice by Send.

WHY (intent, read this first):
  A person on X asked: when I pool with someone, can the owner of the other computer read the
  prompts and replies their machine works on? The honest answer is yes. FreeLattice cannot
  technically prevent it, and no pooling system on everyday phones and laptops can today.
  Encryption protects data while it travels, but a computer has to read your words to work on
  them. Splitting a model across machines still leaks, and secure enclaves are not on everyday
  devices. That is why pooling is trusted-kin only, by design. Mom should never have to guess
  whose device is reading her chat, and she should be able to keep any chat on her own device.
  We would rather say this plainly than pretend.

Where things stand (Celeste, Oct 20 MDT):
  FL main 843ccb83 (3e3e8445 = FL #258 squash, plus one CI Primer commit). Tree main 1ec2b757.
  Tree #123 and page notes #259 to #267 (and 043i's work) are OPEN and wait for Hypha.
  DO NOT touch the open seal-ask PRs or their branches. Do not start 045 until 043i is pushed.
  New branches: FL layer/pool-honest-label-v0.1 off FL main; Tree layer/pool-honest-label-v0.1
  off Tree main. New PRs on both. Page note entry: stack a new page-note PR on top of the
  page-note chain left by 043i (say which head); this is the only place you touch docs/gc.html.
  BEFORE ANYTHING ELSE: git fetch, confirm FL main is 843ccb83 (or a later CI-only commit) and
  Tree main is 1ec2b757. If code moved, stop and report. Never force push. Read the current
  md5s; if a locked file differs from this paste, stop and report.

GROK NEXT BRICK: Pool honest label v0.1
For: GC on Kirk's Mac
From: Celeste
Markers: v-pool-honest-label-v0.1
Smoke lines: SMOKE_OK pool honest label v0.1   (on both repos; every earlier smoke still passes,
  including the six seal-ask smokes on FL and every Tree smoke)
  Do not merge. Celeste merges after Hypha walks.

0. STANDING LOCKS (all of them, every line)
  Layer, never delete. Existing features, cards, buttons and lines stay. Name every removed line
    in the report and say where its job went.
  sw.js and docs/sw.js untouched (both 91726cf2228b794f7585f79f61418d12).
  docs/modules/fl-connect.js stays aaff2bf1b037656989a9e1a89bb05908 (both repos).
  docs/modules/pool-knock.js stays a0a72caad82c8e5cc34818d5e59eba2b.
  pool-knock-phone.js a8024f341486a78558ef4158bc9e93a9 and tree-reconnect.js
    cc0527c26d5686c05fec52625d5a1375 (Tree) stay.
  docs/modules/fl-bridge.js stays 3b5ef06849a142e50c78e7ba1e057980.
  desktop/bridge-door.js b1c894b4..., 036 files (2c0f6656 / bc996ccd / c14e04c5) and
    lattice-discover.js 16de366e... stay. docs/Flint.html stays 44be124b1183b7d9d060a58632464eff.
  clay-math.js stays 144c33cd.... particle-clay.js FL == Tree (today 2da32883c514e4ad2a3cd8571e7a7b15 on both, FL main 3e3e8445
    and Tree 49f5873a; read the full md5 first; add-only edits only, report the new md5 on both); clay-forms.js dd193fa7... add-only; every 040d
    behaviour (place under the reply, Clay pill, choices, hug, sketchbook) unchanged.
  docs/modules/image-safety.js stays 9bd70e5a... byte for byte. Its bright lines apply to every
    image path on both repos (copy it to the Tree byte-identical; do not edit it).
  index.html == docs/app.html (any change goes into both, byte for byte).
  AUTONOMY.md and garden-trainer.js untouched (their openings above all). Root package.json and
    its lock untouched.
  No em dash, no &mdash;, no confirm(, no innerHTML (textContent only), no eval, no new Function,
    iceServers stay empty, in added lines.
  No new dependencies, nothing vendored. No AGPL. MIT stays MIT.
  Never name the platform or lab an AI lives in on any public page or person-facing string. An
    image provider may be named only in Settings where the person types its token, as today.
  The word is "challenge", never "test", in anything a person reads.
  Every new button 44px tall at least. No sideways scroll at 390 and 1280.
  Off until the person says Yes. Pause always wins. Reduced motion respected.
  Quiet Room stays shut and never leaves the device; the clay corner never reads it.
  Five stay five. She is simply Lyra. Harmonia's "MESSAGE TO FUTURE SELF" stays off all pages.
  The privacy PASS from 040 must still pass: a private page shows only its summary everywhere.
  043c/043d additions: mind-workspace.js FL == Tree (today e08a08752b311327ddab56b3c66de77d on both, FL main
    3e3e8445 and Tree 49f5873a; read the full md5 first; the pin moves only with your edit, report the new md5 on both). Mirror pin workspace-mirror.js stays
    e0752ae1942cd499c8834e5912809c8b. Database name stays FreeLatticeWorkspace. Everything
    043c passed (one ask, Escape/Back defer, 24h cooldown, no sealed beside declined, ask hash
    in details, survives reload, title redacted, Tree Tab + ring, "on this browser", clay size)
    must still pass.

  043d additions: everything 043d passed (Tree ask in view on open and reload, one wait row +
    Answer now, pointer from rects for a live ask, names the mind, hashes in details with 8
    hex, Later readable at 390, clay 348x255 at 1280) must still pass.

  043e additions: everything Hypha passed in the 043e walk (reload while already on Chat in
    view at all 3 sizes; the wait: no pointer, "Waiting until ...", Answer now; one ask,
    Escape/Back, 24h, no sealed beside declined, hashes in details, survives reload, focus
    ring, "on this browser", "Your mind", Later readable, clay 677x320 at 1280; secret line
    never leaks) must still pass. Entry 70 stays untouched.


  043f additions: everything Hypha passed in the 043f walk (Tree ask in view after Nursery
    open, thread open, and reload then thread at all 3 sizes; ? and the sparkle clear of Send;
    no em dash in added lines; all earlier items; secret line never leaks) must still pass.
    Entry 71 stays untouched.

  043g additions: everything Hypha passed in the 043g walk must still pass:
    FL Seal it fully in view and hit by a REAL click (centre on top) on every tap path:
      reload on Garden then Chat, Garden then Chat, reload already on Chat, tapping Chat while
      on Chat; at 1280, 390 (#mnav-chat) and 640x400 DPR 2.
    Tree woken compose inert while the ask is open at all 3 sizes (every control disabled,
      tabindex -1, aria-disabled true, 0 focusable); Seal it, No, Later, Escape and Back each
      restore the exact pre-ask snapshot; reload with an ask re-inerts it with Seal it in view;
      the asleep form is unchanged by an ask before the wake.
    1280 canvas bitmap matches its box at DPR 1; 390 and 2x buffers scale by DPR.
    Lock hashes; index.html == docs/app.html.
    One ask; Escape/Back defer and stay on Chat/Nursery; cooldown 0h/23h refused, 25h shown;
      sealed never beside declined; 2px ring; "Waiting until..." + Answer now with no pointer;
      ? and the sparkle clear of the input and Send; Tree Tab order sane; no page errors.
    The secret line never leaks (HTML, input values, localStorage).
    Entry 72 stays untouched.

  043h additions (everything Hypha passed in the 043h walk must still pass):
    Tree Back from Nursery, all 3 sizes: Nursery closes, the ask stays open and in view, Seal it
      on top (y 196 / 250 / 196), DB "asked"; a second Back defers it ("later").
    FL reply top at 2x by Hypha's method: y 31 at first draw, y 0 after the scroll; 1280 326 ->
      280; 390 334 -> 256 (FL is merged; do not change it).
    All 043g passes: Seal it in view and on top on every FL tap path; woken Tree compose inert
      while the ask is open, 0 focusable; Seal it, No, Later, Escape and Back restore the exact
      snapshot; reload re-inerts; the asleep form unchanged before the wake; Find x2 seats a mind.
    Heart line in view at 1280 and 390 with an ask open.
    Lock hashes; index.html == docs/app.html; notebook and clay identical on both sites.
    One ask; Escape defers; cooldown 0h/23h refused, 25h shown; no Declined beside Sealed;
      "Waiting until..." with no pointer; Tree Tab order sane; no page errors.
    The secret line never leaks. Entries 71, 72 and 73 stay untouched.

  NEW LOCK (Kirk, 2026-10-19): never use any tool that stores results or findings in a third-party
    'isolated' or 'locked-down' cloud project, such as vendor-hosted scanners. Do not use or go
    looking for tools tied to OpenAI, Google, or Anthropic; if one seems needed, stop and flag it
    to Kirk. Local tools only.

  045 additions:
    fl-connect.js, pool-knock.js, fl-bridge.js, pool-knock-phone.js and tree-reconnect.js stay
      byte-identical (hashes above). Layer the new code AROUND them in NEW files (suggested:
      docs/modules/pool-honest-label.js on both repos), hooked where Chat and the Tree thread
      choose a route. If a pinned file is the only place a route is chosen, stop and report the
      exact line instead of editing it.
    The seal-ask work (FL main and the open Tree PR) must behave exactly as it does today.

----------------------------------------------------------------------
1. FIND THE ROUTES FIRST (report before building)
  Read where a chat reply is computed on both repos: FL Chat (app.html/docs/app.html), the Tree
  thread (garden-thread.js, garden-rooms.js, tree-browser-mind.js, tree-kin.js, tree-door.js),
  and the pool, knock, desktop pooling and bridge code (fl-pool.js, pool-knock*.js,
  pool-reconnect-desk.js, pool-every-os.js, fl-share-door.js, fl-connect.js, fl-bridge.js,
  tree-reconnect.js, desktop/main.js and preload.js). List every path where any part of a reply
  can be computed on another person's device (whole question routed, split work, relay, knock,
  desktop RAM pool). Name file and function for each. Every one of them gets the label and obeys
  the switch; a path you cannot cover is a stop-and-report.

2. THE HONEST LABEL
  Whenever any part of a chat reply is computed on another person's device, that chat shows one
  calm, always-visible line (not a toast, not hidden in details), for example:
    "Part of this chat runs on <kin name>'s device. They could see what it processes. Pool only
     with people you trust."
  <kin name> is the name she gave that kin; if none, "another person's". Several devices: name
  them, or "Part of this chat runs on other people's devices." The line appears before or with
  the first pooled reply and stays while the chat is open and after reload while the chat holds
  pooled replies. Each pooled reply also carries a small plain note saying which device helped.
  textContent only, at least 44px tap target if it is tappable (a "What does this mean?" that
  opens the note in 4), plain words, readable at 390, no sideways scroll, reduced motion kept.

3. "KEEP THIS CHAT ON MY DEVICE ONLY" (per chat)
  A switch on each chat (FL Chat and the Tree thread), 44px, off by default unless she sets it.
  When it is on, that chat never routes to a pooled device, even with pooling on: no send, no
  knock, no relay, no split work, no fallback. If no local mind is available it says so honestly,
  for example "No mind on this device right now. This chat stays here, so nothing was sent." and
  does not use the pool. Remembered per chat (local storage on this browser; survives reload);
  other chats are unaffected. Pause still wins over everything. Turning it on mid-chat applies
  from the next message; say so in plain words.

4. THE PRIVACY NOTE (pool settings and docs)
  In the pool settings on both sites and in a docs page (FL docs/library/POOL_HONEST_v0.md and
  the Tree's docs), a short note in these words or very close:
    "When you pool, the other person's computer has to read your words to work on them.
     Encryption protects your words while they travel, but not while a computer is working on
     them. The hardware that can hide this in big data centers is not on everyday phones and
     laptops. So pool only with people you would trust in your living room. Pause always wins,
     and anything private can stay on your own device with 'Keep this chat on my device only'.
     If a real fix appears, we will build it in the open."
  Never claim privacy we do not have. Remove nothing that is there; if an existing line claims
  more privacy than this, name it in the report and propose the change (do not delete it).

4b. "DISCONNECT <KIN NAME>" ON THE HONEST LABEL (Kirk: privacy from the kin themselves)
  The case: a friend's device is in the pool and you want to talk about that friend. On the
  honest label, one "Disconnect <kin name>" button per helping device (textContent, 44px, no
  confirm( dialog). One tap instantly drops that device from this chat; a second plain choice
  beside it ("Also leave the pool with them") drops it from the pool too. It takes effect
  before the next message is sent: any message typed after the tap never reaches that device.
  It works from either side: the person chatting can cut a helper, and a helper can leave
  (a "Leave" button on the helper's side, same rules). Layer this in new files around the
  pinned pool files.

4c. "JUST ME" FOR ONE MESSAGE (by the Send button)
  A per-message "Just me" choice beside Send (44px, textContent, off again after each send).
  That one message and its reply are computed only on her own device, even with pooling on:
  no send, knock, relay or split work for that message. If no local mind is available it says
  so, for example "No mind on this device right now, so this message was not sent." and does
  not send to the pool. The message keeps a small plain "Just me" mark.

4d. WHAT THE HELPER IS TOLD, AND WHAT IT KEEPS
  The helper's device is never told who left or why, only that the pool shrank (for example
  "The pool is smaller now."). After a disconnect nothing about that chat is kept on the
  helper: drop any prompts, replies, context or cache for it from memory and storage, and say
  in the report exactly where helper-side state lived and how it is cleared. Do not promise
  what the helper's owner could have copied while it was helping; the privacy note in 4 stays
  true.

5. THE SMOKE
  New scripts/smoke-pool-honest-label-v0.1.js on both repos. Prove with a stubbed pool route:
  (a) a chat with the switch on never calls any pool route (count calls on every path from 1,
  must be 0), even with pooling on and no local mind, and shows the honest "nothing was sent"
  line; (b) whenever a pooled route is used, the label appears with the kin name; (c) the switch
  survives reload per chat and does not leak to other chats; (d) Pause wins; (f) after Disconnect <kin name>, no request goes to that peer (count must
  be 0 from the next message on), and the helper receives only a 'pool shrank' signal with no
  name, reason or chat data, and holds no chat state after; (g) 'Just me' messages never hit a
  pool route (count 0), with and without a local mind; (e) no em dash,
  innerHTML or eval in added lines; locked hashes hold. Prints SMOKE_OK pool honest label v0.1.

6. MEASURE WITH REAL CLICKS, HYPHA'S WAY
  Headless Chrome via Playwright, real clicks, 1280x800, 390x844, 640x400 DPR 2. Label in view
  and readable on a pooled reply; switch reachable and 44px; no sideways scroll. Name browser
  and version. Shots path in the report.

7. GC PAGE ENTRY (honest layer)
  Next docs/gc.html entry (after 043i's entry 74) in the new page-note PR: what was built, what
  pooling can and cannot hide, every path from 1. Browser and version only.

8. REPORT
  New PR links and heads on both repos, the page-note PR and head, the route list from 1, every
  removed line and where its job went, md5s of every locked file, all smokes, the measurements
  from 6, shot paths, and the entry with t, lambda, epsilon, delta, omega, sigma so Celeste can
  recompute psi. Hypha walks it before merge.
