Splash, log in, sign up, forgot, reset, verify, and the one honest chooser. Seven screens, no role selection and no plan picker — you buy a product and the account type follows. More than half the people this product serves never see any of it.
No continue with Google, no are you a homeowner or a builder, no plan comparison. Payment is what got them here, and the account they hold already knows which product it is.
Not a wizard. The house, the spaces and the two of you all get named later, inside the product, by 04-onboarding and 09-first-run — which are already drawn and already argue that the first run is a conversation rather than a form.
We won't ask you to add a number or a symbol. Composition rules make weaker passwords and irritate everybody, and stating that we do not have them is worth one line on the one screen where a person is bracing for them.
The company is still only a name, and the person creating it is the owner seat. The optional number belongs to that person, not the company or the seat; the builder seat only carries it to the homeowner's People screen. No org chart and no role matrix: roles are hats, at the median the person signing up is the owner, the estimator and the PM.
A second seat is added when there is a second person, never at signup — and at one to three homes a year there may never be one. A first-run flow asking who else is on the team teaches a solo builder in its first thirty seconds that the product is not for him.
Your jobs
Dave Marsh Builders · four live
Your house
The Marsh place · started April
A persistent role switch in the chrome would put the question on every screen for the handful of people who hold two accounts, and would teach everybody else that the product has modes. It does not. It has two products.
Renee Boothe and Nora Hollis never see this screen: one account each, held on somebody else's subscription, and they land straight in it. Holding a seat rather than the subscription changes what you can do, and changes nothing about how you get in.
If we have an account for that address. A screen that says no account with that email tells anybody who asks which of our customers exist. The hedge costs one word and it is the only place on this page where the copy is doing security work.
A confirm-password field catches a typo the reveal control catches better, and it doubles the work on the screen somebody reaches while already irritated. No strength meter either: a live judgment of what somebody is halfway through typing is the product being clinical at the exact moment it should be quiet.
The same mechanism as email verification, used at the moment it is worth something rather than at the door. Nobody is ever stopped on the way into their own house to prove they own the address they signed up with.
A code screen that does not restate the consequence is asking somebody to authorize a number. The amendment is on the screen above the field, in the same words the money screen used, so the confirmation is of a thing rather than of a session. It sat in a card until 2026-09-06 and does not need one: a card is an object you can act on or cite, and this is the sentence the code is about.
This frame was drawn with sam@hollishouse.com in the sentence, and 13-money frame 3 says plainly that a paid homeowner never sees this code, because being signed in is already the proof. Both cannot be right. The screen is correct and the reader was wrong: it belongs to somebody confirming an amendment without a session, which is Ben, Ana or Tom rather than Sam. It is drawn against the right person, on link chrome and leading with the builder, on 36 · Proving it was you. This one stays as the front door's own statement that verification is never an entry gate.
Time is information to Dave and anxiety to Sam, and a timestamp on a homeowner surface normally fails that test. This one passes it: the wait is the state, five minutes is short enough to be a fact rather than a sentence, and not saying when would leave somebody retrying into a wall.
Said outright, because it is the thing the reader is afraid of. And the message under the fields is we do not recognize that pair — not which half is wrong, which would be a free oracle, and not invalid credentials, which is the system naming itself.
Renee Okafor · Dave set your name, your email and what you can do. Nobody but you sets the password.
This link works once and it's yours. If it has already been used, ask Dave to send another rather than trying it again.
Everything about the company already exists: the jobs, the people, the contract types, her role and the capabilities that gate it. Asking her to name a company, pick a plan or choose which product she is in would be asking her to re-decide what Dave decided, and the other eight frames on this page are all about somebody who genuinely has those choices. She has exactly one, and it is a password.
One use, and a used one is spent rather than broken. The eight states on 30 cover this without extension: a claim link already used is answered by you, and a rescinded one is withdrawn. What it never becomes is invalid, which is the only 401 in the product and belongs to a token that never existed.
The same rule that governs every account-less surface. A year from now the register must be unable to tell whether Renee arrived by claim link or by signup, and must not care.
An account-less person must never meet any of it. More than half the people this product serves have no account and never will: subs, vendors, a homeowner whose builder is paying, a builder whose homeowner is. Somebody answering a text about a tile must never hit a login wall, a verify your email to continue, or a password reset they did not ask for. An action from a link proceeds, and only expensive consequences wait on identity — which is frame 7, and frame 7 is not on the way in.
There is no role picker, and adding one will feel reasonable. It will be proposed as a convenience the first time somebody signs up on the wrong product, and it will be wrong for the same reason it is wrong today: it asks a question the purchase already answered, of somebody who does not yet know our vocabulary. Two products, two front doors, one credential store. Where a login lands depends on what that person holds — one account goes straight in, a seat on somebody else's account lands in that account, and only the genuine two-account case is asked, once, at login.
Two-factor. It appears zero times across all six specs. The mechanism for it already exists here — frame 7 is a six-character code sent to an address, and it is the same code the signature confirmation uses — but whether an account may require it at login is an authority question rather than a drawing one.
Where the second seat's invitation lands. Nora and Renee both hold a seat rather than a subscription, and the screen that turns an emailed invitation into a login is drawn by 14-two-of-us for the homeowner side. The builder side reuses it, and neither is on this page, because an invitation is a product event and not a door.