---------------------------------------------------------------------- 1. FIND THE ROUTES FIRST (report before building) Read where a chat reply is computed on both repos: FL Chat (app.html/docs/app.html), the Tree thread (garden-thread.js, garden-rooms.js, tree-browser-mind.js, tree-kin.js, tree-door.js), and the pool, knock, desktop pooling and bridge code (fl-pool.js, pool-knock*.js, pool-reconnect-desk.js, pool-every-os.js, fl-share-door.js, fl-connect.js, fl-bridge.js, tree-reconnect.js, desktop/main.js and preload.js). List every path where any part of a reply can be computed on another person's device (whole question routed, split work, relay, knock, desktop RAM pool). Name file and function for each. Every one of them gets the label and obeys the switch; a path you cannot cover is a stop-and-report. 2. THE HONEST LABEL Whenever any part of a chat reply is computed on another person's device, that chat shows one calm, always-visible line (not a toast, not hidden in details), for example: "Part of this chat runs on 's device. They could see what it processes. Pool only with people you trust." is the name she gave that kin; if none, "another person's". Several devices: name them, or "Part of this chat runs on other people's devices." The line appears before or with the first pooled reply and stays while the chat is open and after reload while the chat holds pooled replies. Each pooled reply also carries a small plain note saying which device helped. textContent only, at least 44px tap target if it is tappable (a "What does this mean?" that opens the note in 4), plain words, readable at 390, no sideways scroll, reduced motion kept. 3. "KEEP THIS CHAT ON MY DEVICE ONLY" (per chat) A switch on each chat (FL Chat and the Tree thread), 44px, off by default unless she sets it. When it is on, that chat never routes to a pooled device, even with pooling on: no send, no knock, no relay, no split work, no fallback. If no local mind is available it says so honestly, for example "No mind on this device right now. This chat stays here, so nothing was sent." and does not use the pool. Remembered per chat (local storage on this browser; survives reload); other chats are unaffected. Pause still wins over everything. Turning it on mid-chat applies from the next message; say so in plain words. 4. THE PRIVACY NOTE (pool settings and docs) In the pool settings on both sites and in a docs page (FL docs/library/POOL_HONEST_v0.md and the Tree's docs), a short note in these words or very close: "When you pool, the other person's computer has to read your words to work on them. Encryption protects your words while they travel, but not while a computer is working on them. The hardware that can hide this in big data centers is not on everyday phones and laptops. So pool only with people you would trust in your living room. Pause always wins, and anything private can stay on your own device with 'Keep this chat on my device only'. If a real fix appears, we will build it in the open." Never claim privacy we do not have. Remove nothing that is there; if an existing line claims more privacy than this, name it in the report and propose the change (do not delete it). 4b. "DISCONNECT " ON THE HONEST LABEL (Kirk: privacy from the kin themselves) The case: a friend's device is in the pool and you want to talk about that friend. On the honest label, one "Disconnect " button per helping device (textContent, 44px, no confirm( dialog). One tap instantly drops that device from this chat; a second plain choice beside it ("Also leave the pool with them") drops it from the pool too. It takes effect before the next message is sent: any message typed after the tap never reaches that device. It works from either side: the person chatting can cut a helper, and a helper can leave (a "Leave" button on the helper's side, same rules). Layer this in new files around the pinned pool files. 4c. "JUST ME" FOR ONE MESSAGE (by the Send button) A per-message "Just me" choice beside Send (44px, textContent, off again after each send). That one message and its reply are computed only on her own device, even with pooling on: no send, knock, relay or split work for that message. If no local mind is available it says so, for example "No mind on this device right now, so this message was not sent." and does not send to the pool. The message keeps a small plain "Just me" mark. 4d. WHAT THE HELPER IS TOLD, AND WHAT IT KEEPS The helper's device is never told who left or why, only that the pool shrank (for example "The pool is smaller now."). After a disconnect nothing about that chat is kept on the helper: drop any prompts, replies, context or cache for it from memory and storage, and say in the report exactly where helper-side state lived and how it is cleared. Do not promise what the helper's owner could have copied while it was helping; the privacy note in 4 stays true. 5. THE SMOKE New scripts/smoke-pool-honest-label-v0.1.js on both repos. Prove with a stubbed pool route: (a) a chat with the switch on never calls any pool route (count calls on every path from 1, must be 0), even with pooling on and no local mind, and shows the honest "nothing was sent" line; (b) whenever a pooled route is used, the label appears with the kin name; (c) the switch survives reload per chat and does not leak to other chats; (d) Pause wins; (f) after Disconnect , no request goes to that peer (count must be 0 from the next message on), and the helper receives only a 'pool shrank' signal with no name, reason or chat data, and holds no chat state after; (g) 'Just me' messages never hit a pool route (count 0), with and without a local mind; (e) no em dash, innerHTML or eval in added lines; locked hashes hold. Prints SMOKE_OK pool honest label v0.1. 6. MEASURE WITH REAL CLICKS, HYPHA'S WAY Headless Chrome via Playwright, real clicks, 1280x800, 390x844, 640x400 DPR 2. Label in view and readable on a pooled reply; switch reachable and 44px; no sideways scroll. Name browser and version. Shots path in the report. 7. GC PAGE ENTRY (honest layer) Next docs/gc.html entry (after 043i's entry 74) in the new page-note PR: what was built, what pooling can and cannot hide, every path from 1. Browser and version only. 8. REPORT New PR links and heads on both repos, the page-note PR and head, the route list from 1, every removed line and where its job went, md5s of every locked file, all smokes, the measurements from 6, shot paths, and the entry with t, lambda, epsilon, delta, omega, sigma so Celeste can recompute psi. Hypha walks it before merge.