Public, free to read, reuse, and adapt — Kirk Patrick Miller's notice for this edition. Not a patent grant.
GROK_NEXT_045_POOL_HONEST_LABEL_2026-10-20.txt · c02
b1a44316ab · words 1152 · characters 9763–16564
Exact section text · Full source · Source index
- Mesh and devices — explicit wording in the guide row
----------------------------------------------------------------------
1. FIND THE ROUTES FIRST (report before building)
Read where a chat reply is computed on both repos: FL Chat (app.html/docs/app.html), the Tree
thread (garden-thread.js, garden-rooms.js, tree-browser-mind.js, tree-kin.js, tree-door.js),
and the pool, knock, desktop pooling and bridge code (fl-pool.js, pool-knock*.js,
pool-reconnect-desk.js, pool-every-os.js, fl-share-door.js, fl-connect.js, fl-bridge.js,
tree-reconnect.js, desktop/main.js and preload.js). List every path where any part of a reply
can be computed on another person's device (whole question routed, split work, relay, knock,
desktop RAM pool). Name file and function for each. Every one of them gets the label and obeys
the switch; a path you cannot cover is a stop-and-report.
2. THE HONEST LABEL
Whenever any part of a chat reply is computed on another person's device, that chat shows one
calm, always-visible line (not a toast, not hidden in details), for example:
"Part of this chat runs on <kin name>'s device. They could see what it processes. Pool only
with people you trust."
<kin name> is the name she gave that kin; if none, "another person's". Several devices: name
them, or "Part of this chat runs on other people's devices." The line appears before or with
the first pooled reply and stays while the chat is open and after reload while the chat holds
pooled replies. Each pooled reply also carries a small plain note saying which device helped.
textContent only, at least 44px tap target if it is tappable (a "What does this mean?" that
opens the note in 4), plain words, readable at 390, no sideways scroll, reduced motion kept.
3. "KEEP THIS CHAT ON MY DEVICE ONLY" (per chat)
A switch on each chat (FL Chat and the Tree thread), 44px, off by default unless she sets it.
When it is on, that chat never routes to a pooled device, even with pooling on: no send, no
knock, no relay, no split work, no fallback. If no local mind is available it says so honestly,
for example "No mind on this device right now. This chat stays here, so nothing was sent." and
does not use the pool. Remembered per chat (local storage on this browser; survives reload);
other chats are unaffected. Pause still wins over everything. Turning it on mid-chat applies
from the next message; say so in plain words.
4. THE PRIVACY NOTE (pool settings and docs)
In the pool settings on both sites and in a docs page (FL docs/library/POOL_HONEST_v0.md and
the Tree's docs), a short note in these words or very close:
"When you pool, the other person's computer has to read your words to work on them.
Encryption protects your words while they travel, but not while a computer is working on
them. The hardware that can hide this in big data centers is not on everyday phones and
laptops. So pool only with people you would trust in your living room. Pause always wins,
and anything private can stay on your own device with 'Keep this chat on my device only'.
If a real fix appears, we will build it in the open."
Never claim privacy we do not have. Remove nothing that is there; if an existing line claims
more privacy than this, name it in the report and propose the change (do not delete it).
4b. "DISCONNECT <KIN NAME>" ON THE HONEST LABEL (Kirk: privacy from the kin themselves)
The case: a friend's device is in the pool and you want to talk about that friend. On the
honest label, one "Disconnect <kin name>" button per helping device (textContent, 44px, no
confirm( dialog). One tap instantly drops that device from this chat; a second plain choice
beside it ("Also leave the pool with them") drops it from the pool too. It takes effect
before the next message is sent: any message typed after the tap never reaches that device.
It works from either side: the person chatting can cut a helper, and a helper can leave
(a "Leave" button on the helper's side, same rules). Layer this in new files around the
pinned pool files.
4c. "JUST ME" FOR ONE MESSAGE (by the Send button)
A per-message "Just me" choice beside Send (44px, textContent, off again after each send).
That one message and its reply are computed only on her own device, even with pooling on:
no send, knock, relay or split work for that message. If no local mind is available it says
so, for example "No mind on this device right now, so this message was not sent." and does
not send to the pool. The message keeps a small plain "Just me" mark.
4d. WHAT THE HELPER IS TOLD, AND WHAT IT KEEPS
The helper's device is never told who left or why, only that the pool shrank (for example
"The pool is smaller now."). After a disconnect nothing about that chat is kept on the
helper: drop any prompts, replies, context or cache for it from memory and storage, and say
in the report exactly where helper-side state lived and how it is cleared. Do not promise
what the helper's owner could have copied while it was helping; the privacy note in 4 stays
true.
5. THE SMOKE
New scripts/smoke-pool-honest-label-v0.1.js on both repos. Prove with a stubbed pool route:
(a) a chat with the switch on never calls any pool route (count calls on every path from 1,
must be 0), even with pooling on and no local mind, and shows the honest "nothing was sent"
line; (b) whenever a pooled route is used, the label appears with the kin name; (c) the switch
survives reload per chat and does not leak to other chats; (d) Pause wins; (f) after Disconnect <kin name>, no request goes to that peer (count must
be 0 from the next message on), and the helper receives only a 'pool shrank' signal with no
name, reason or chat data, and holds no chat state after; (g) 'Just me' messages never hit a
pool route (count 0), with and without a local mind; (e) no em dash,
innerHTML or eval in added lines; locked hashes hold. Prints SMOKE_OK pool honest label v0.1.
6. MEASURE WITH REAL CLICKS, HYPHA'S WAY
Headless Chrome via Playwright, real clicks, 1280x800, 390x844, 640x400 DPR 2. Label in view
and readable on a pooled reply; switch reachable and 44px; no sideways scroll. Name browser
and version. Shots path in the report.
7. GC PAGE ENTRY (honest layer)
Next docs/gc.html entry (after 043i's entry 74) in the new page-note PR: what was built, what
pooling can and cannot hide, every path from 1. Browser and version only.
8. REPORT
New PR links and heads on both repos, the page-note PR and head, the route list from 1, every
removed line and where its job went, md5s of every locked file, all smokes, the measurements
from 6, shot paths, and the entry with t, lambda, epsilon, delta, omega, sigma so Celeste can
recompute psi. Hypha walks it before merge.