The account, and being told

An answer is owed, or a fact about their house has changed that they did not already know. Dave's reply passes on the second clause — they went looking for it. Something settled fails it, because they are the ones who settled it.

Rather than being hidden or crossed out. It is the inert-capability treatment applied to a switch somebody may not throw: visible, quiet, and with the reason where the reader reaches for it.

A second seat quieting their own notifications must not quiet the first's. It is the same rule as the claim screen: a seat changes what they hold, and never what somebody else does.

It would record that they heard on Tuesday evening something they never saw — asserting the exact thing the ledger exists to prove. So heard-at is written from the delivery rather than from the send.

Sent Tuesday, not confirmed is worse evidence than a delivery receipt and infinitely better than a timestamp that means nothing. It is visible to both sides, because the builder is the one who will be asked about it.

Nothing has been ordered and nothing is decided. A variance arriving before an invoice is the product working, and the notification that announces it should not read like the thing it exists to prevent.

A previous navigation died on a project switcher in the chrome. Houses live under the account because a second house is rare and a permanent control for a rare thing costs every screen a slot. The finished one stays open, which is the whole argument for the paid tier at renewal.

Nora sees no ordinary billing row for a house whose payer is Sam. The sole exception is frame 14: after payer-removal cancellation leaves no billing seat, every active owner sees the recovery row. A trial row names its fixed end date and action; it is never collapsed into an account-wide renewal.

The Appearance group is drawn above account-owned sections and remains interactive while houses and subscriptions load or fail. On desktop it stays a single vertical group in the Account content column; support copy never collapses into a segmented control.

The active theme does not roll back. The message belongs directly below the group, is announced by a polite status region without moving focus, and clears only after the latest selection is stored.

A transfer that finishes with one tap hands somebody a recurring charge they did not agree to. So the act is an ask rather than a move: rung 2 says so plainly, the state stays exactly as it was until she enters a card, and frame 15 gives the sender a recoverable pending fact rather than asking memory to hold it.

The temptation is to make this screen feel weighty — it is billing, it is the one asymmetry, it reads as important. It is not: the binder, the money, the doors and the ability to remove a seat are identical before and after. Naming the two things that do move is more reassuring than a wall of consequences, and it is also true.

There is one subscription and it is per house. Putting a price, a term or an upgrade on the screen that moves it would turn a domestic arrangement between two people into a purchase decision, which is the wrong conversation at the wrong moment.

PDFs and a spreadsheet, not a JSON dump and not a file only this product can read. The export exists to answer what happens to two years of my house if you go away, and an export that needs the exporter is not an answer to that question.

The last callout is there because of where the reader most often arrives from. Frame 7 offers this as the way out of deleting everything, and a screen reached from a deletion flow reads as part of it unless it says otherwise. Taking a copy is an ordinary thing to do in the middle of a build.

Not Nora, not Dave. An export is a person reading their own record, which is activity rather than a record event — the same line frame 3 draws around read receipts. A notification saying Sam exported the binder would be the first surveillance in the product.

Sam's version of this screen has start it again and a payment route. Nora's says who holds it and stops there — because offering her a button that cannot work is worse than not offering one.

A house that quietly went read-only, with no explanation, is a person concluding the app is broken or that something has happened to the build. The rule is that every seat gets the notice once, properly, in its own right.

One line, where it is true, never again. That escalation-then-silence is how no nag survives a state that persists indefinitely — a polite banner on every screen for the rest of the account's life is a nag by duration even if it is gentle in tone.

Are you sure? is a question nobody has ever answered honestly, because at that moment the reader has no idea what they are being sure about. Three lines naming 47 decisions, the documents and the trust ledger do the work the confirmation was pretending to do. The typing step is for the other failure, the accidental tap, and it is the only part a second dialog could not replace.

Rung 2, because it interrupts, and it is not an error tone. What is worth interrupting for is not the deletion, which the reader chose, but that a second person on this house loses it without being asked. The way out offered is an export rather than a warning, because taking a copy is the only genuinely useful thing this screen can do for her.

It is a ghost rather than a filled button, and nothing on the screen is emerald. The design system has no red rung and does not acquire one here: the seriousness is carried by the list of what is lost and by the sentence about Nora, never by a color that would make every other screen look calm by comparison.

The product's posture is that nobody is stopped on the way into their own house — _ds/forms.css says it about the code entry itself, and 13-money says it about the session being the proof. A second factor that shipped on would contradict both, on the surface where the reader has the least to gain from it. What is gated by default is money, not entry.

Two people on one house differ in exactly one thing and it is the subscription. 24-people makes the same argument on the builder's side: change what somebody can do is a capability, and reaching into how a colleague signs in is a long way past it. An account-wide switch would be a third asymmetry, invented here, for a setting whose whole value is that the person choosing it is the person it protects.

On the ones you already use, nothing changes. The component rule is that a caption says what happens rather than restating the label, and here what happens is mostly nothing — which is the fact somebody deciding whether to turn this on actually wants. A caption reading Enable two-factor authentication would be the label repeated in worse words.

Login factors belong to Clerk. What the backend needs is not a factor implementation but the ability to read one: authcore.AppUser is {ID, Email, Name}, so today a handler cannot tell whether the caller used a second factor even when the provider demanded one. One field on the neutral contract, the matching read in the shim, and an account flag for the policy to hang off. The consequence gate on 36 · Proving it was you shares the concept and none of the code.

A house created twice can now leave the ordinary chooser without pretending it was finished or deleting a binder. It remains reachable behind the fold.

Archive changes list placement and write posture, not ownership. It is reversible by an owner and keeps every seat's read access intact.

The lake place proves the two timestamps are not aliases. A finished binder remains ordinary until a person separately archives it.

The count tells the reader the house still exists before they open the fold. The account chooser can therefore distinguish one active house plus one archived house from one house total.

The tone follows frame 6 because both preserve the binder and stop writes, but the cause and way out differ. Archive is project-scoped and an owner can restore it without payment.

On this phone still advances. A frozen archived copy presented as current would turn a list choice into a sync lie.

Cancellation is immediate with invoice_now=false and prorate=false. HouseChalk issues no Refund and requests no final Invoice.

An ambiguous provider result remains pending and reconciles in the worker. This result appears only when local and provider state agree. Any-owner restore is reserved for frame 14's payer-removal recovery, where no billing seat remains.

Every active owner can see this recovery row. On every other canceled project, billing controls remain private to the retained billing owner.

The sender read exposes request state, expiry and recipient seat only. SetupIntent, Session and Customer identifiers never cross this screen.

Pending, provider-ready and finalizing states all have a recovery path. Only verified setup and finalization move the billing seat.

Frame 7 is drawn on the phone that scheduled the deletion, and that phone knows because it holds the answer the write returned. A second phone holds nothing. This frame is the reason /me has to carry the two dates: without a read, a person who signs in somewhere else meets frame 7 again, blank, and the only way back is to ask to delete a second time and be handed the same window as a side effect. That works and it is a terrible sentence to have to write down.

Frame 7 refuses a filled button on purpose: the destructive act must not look like the recommended one. Ten frames later the recommended act is the reversal, so it is emerald and it is first. The two screens are the same subject drawn at opposite ends, and the button treatment is the whole difference.

No countdown, no color change at day 25, no second push. A person who scheduled this chose it, and a product that spends a month nudging them about it is arguing with a decision it already took. The date is a fact on the screen they came to; that is the whole telling.

Corrected 2026-09-04, and the correction is the interesting part. This read "one line on the screen the app opens on, and it is nowhere else — Jobs is his landing exactly as Now is hers." Both halves were wrong. Jobs is not his landing: his level-one doors are Today, Jobs and Send, and Today is the first. And the line is not on one screen anywhere in the deck — there are three .lapsed instances and the other two sit on Jobs (00-states frame 14) and Send (25 frame 5, When his account lapses), which are two different doors.

The sentence that went with the claim called a line on every read-only screen a nag by duration. Two doors carrying it is that alternative, in miniature and on purpose. It suggests "never again" in frame 6's third annotation is about the escalation — rung 3 once, rung 1 after — rather than about how many screens carry the rung-1 line, which is the reading states.css's own comment supports. On that reading her placement is not Now alone but every door where a write is stopped. Q161 asks, and this frame is the proposal for one of its three answers rather than the answer.

Settle it now does not disappear and is not replaced by an explanation. It goes inert, which is the component a lapsed account already shares with every other permission rule in the product. Removing it would make the screen look like a house with nothing to settle, which is the one thing that is not true. Q170 ruled on 2026-09-04 that this is right about the control and wrong about the screen, and corrected the frame by one screen rather than declining it. The component named here is real — HcCommit with a null onCommit and an unavailableReason, which the shell renders in place of the consequence, at fourteen call sites. It is not what Now draws: week_hero.dart builds Settle it now as an HcCta that navigates to /now/decision/:id, and the commit carrying this label is on that screen. So the line goes there, under the control that actually goes inert — which is what “it says why when she reaches for it” asks for, since reaching for it is arriving. Now keeps a live button, because the hero decision is excluded from every other lane and this is its only door.

Frame 6 splits the block by who can act. The rung-1 line does not split: it is a statement of fact, and a fact does not need a different sentence for the person who can fix it. What differs is what she finds when she reaches an inert control, and that is the account screen, which already knows who the payer is.

02 frame F sits one tap from Talk it through, “at the point where the answer is obviously yes because they have just said they want to talk.” Push has no equivalent, because nobody invokes a notification. So the moment is the nearest true thing: the first act that creates an expectation of being told — here, sending a question to the builder. Settling a decision that leaves somebody else’s move outstanding is the same shape and the same frame. Not first launch, and not the settings screen, where flipping a switch already assumes the permission this asks for.

The platform dialog cannot say which five things, and the five are the whole argument — frame 1’s switches are what this permission is in aid of. Tell me when he answers is what fires the real one, so declining here costs nothing: no system prompt fired, so nothing was permanently refused. That is what makes a second ask possible, and it is why the pre-prompt exists rather than firing the platform dialog bare.

I will come back and look carries the same weight as accepting, and the callout says where the answer lands anyway. Frame 1’s copy is the reason this matters more here than on 02: the locked switch says “the moment it reaches you is the moment the record says you were told”, so a person who declines must be able to see that nothing about the record turns on their answer. It does not: the hearing is stamped by delivery, and a house that is never pushed to is never recorded as told.

Which of the five kinds may trigger the moment, and whether a denial is re-askable through a Settings deep link. Both are frame 1’s, beside the switches, and Q178 leaves them there on purpose. A denied state is still undrawn.