The honest build map
Safe enough for two people to start living in it.
e-f has a useful web workspace, Zola’s first action loop, private accounts, and durable personal data. Personal records now refuse stale writes and show both versions when two devices disagree. Every task now has a way forward — the one destination it refers to, or focus, or a move — one tap away. Shared household conflict protection is now built and locally verified. What is left before native clients: prove that shared protection with two real accounts, and add a durable catch-up feed for devices that were asleep.
Last updated
Whole journey
32of 59 milestones landed
The useful short version
Active work comes first. “Next” means queued—not secretly abandoned.
Widgets have grips, edge and corner resize handles, and keyboard layout controls. The first-drag resizing jump and overlapping widgets on a fresh workspace are fixed. Local browser checks cover resize handles, first load, reload, and tablet width; regression tests also cover scrolling, cancelled gestures, and older saved layouts. Next: verify the feel on an actual iPad before calling the layout finished.
Focus audio now has three sources behind one volume slider: the original browser-made noise, Streams — internet-radio and other audio you add yourself by name and https address (there is deliberately no built-in station list: a SomaFM terms check showed curated lists need the provider's written permission) — and Library — your own music played straight off a self-hosted Subsonic-compatible server like Navidrome, with the password stored encrypted and the audio proxied so seeking works without the password ever reaching the browser. Library tracks report to last.fm under its own play-length rules, with failures that can never interrupt the music; streams carry no track metadata and say so. A security pass has since hardened the plumbing: the server address must be a public internet host (private, loopback, and link-local addresses are refused and re-checked through DNS before every fetch), and the last.fm connect flow binds its callback to a short-lived cookie so a cross-site page can't link the account. The pieces are built and unit-verified: what remains is proving live audio against a real connected Navidrome, and Apple Music stays a documented plan until a real MusicKit developer token exists.
Shared saves now refuse stale versions, combine independent record edits, and show both versions when the same item changed in two places. Pending drafts survive reload and failed requests, and a choice is checked again if another edit arrives before it saves. Isolated Postgres and two-browser fixtures pass; deployment and verification with two real signed-in accounts are still needed.
Every data route is now checked automatically for a missing sign-in check or a query that forgets whose data it is. The matching proof against the live database is written and waiting on its first run.
Mail starts with hygiene: accounts are added right in the app — passwords encrypted before they touch the database — and a hosted engine reads them over IMAP each morning, quarantines marketing into its own folder, sends one-click unsubscribes you approve once, and reclaims server space in resumable batches. A training screen shows every call it made and takes your correction: approve or decline an unsubscribe per message or per sender, watch each attempt move through requested to completed or failed with the last attempt time, test an account's connection before trusting it, and read per-account counts after every run. Each person's accounts stay their own. The engine is built and verified against fixtures; checking it against the live mail servers is the next step before the first real sweep.
Texting a thought to the household number can land it in the right person's inbox like any other capture: the webhook proves Twilio, checks the owned destination, resolves a verified mobile number to that signed-in person's account, answers provider retries exactly once, and files the text with the same protected write every capture gets. The number, production credentials, saved webhook, per-account linking, database table, settings, documentation, and tests are in place. One account has started linking but has not yet sent the exact one-time LINK message, so no production capture has passed end to end. The settings checker now refreshes that pending state without flashing the panel. A verified real text into each account is still needed before this is complete; A2P registration stays separate unless e-f later sends replies.
Just landed
The technical work, translated into why it matters.
Shared saves now check the version a device read before replacing anything. Edits to different records combine automatically; competing versions of the same record stay visible until someone chooses, including a deletion versus an edit. Pending drafts survive reload, saves run one at a time, and reconnecting or returning to the page checks for newer shared work. Local Postgres tests prove stale writes are refused, while two browser fixtures prove the comparison, reload recovery, choice, and catch-up flow. Deployment and a check with two real signed-in accounts remain before this is called complete.
New workspaces now receive widget positions before their first render, so their panels no longer pile up in the top-left corner until a layout edit or reload. Older saved widths and columns still migrate correctly. Regression tests cover the starting layout and legacy settings; a local browser check found no overlapping visible widgets on first load, after reload, or at tablet width. Actual iPad touch verification remains open for the broader free-move layout.
Resizing now starts from the widget’s original size and follows how far you drag, so grabbing an edge or corner no longer suddenly shrinks it. Scrolling is included in the calculation, a second pointer cannot take over, and cancelling or leaving the dashboard cleans up the gesture. Regression tests reproduce the old jump and pass with the fix; local browser checks cover all three handles at desktop and tablet widths. The broader layout work stays open: a fresh local workspace showed overlapping starting widgets, and a real iPad touch check is still needed.
The settings sheet no longer opens as one very long document. Appearance, theme, dopamine break, account connections, editing, and widget visibility are native collapsible sections with short descriptions, and links that open settings still expand the right destination automatically. Account details take less room too: sync is one quiet status row, Google access can fold away, duplicate scope labels are removed, and large calendar collections sit in a collapsed multi-column grid instead of a full-width card for every calendar.
The household SMS number, production credentials, and inbound webhook are now in place, and the app no longer funnels every text into one globally configured account. Each signed-in person can link their own mobile number, then prove possession by texting the exact short-lived LINK message shown on screen; normal thoughts are accepted only after that step. Verification codes are hashed, expire after fifteen minutes, and are consumed rather than filed as thoughts. The first production account has reached the pending-link stage with Twilio and the app configured, but no phone has completed verification or produced a capture yet. The settings checker now refreshes quietly instead of making the panel flash every four seconds. Twilio describes the remaining A2P registration as a requirement for sending, not this receive-only path; a verified real text into each account is the remaining proof before this can be called complete.
A security review of the recent work, with its findings fixed: a saved Subsonic server address must now be a public internet host — loopback, private, and link-local addresses (including the cloud metadata service), localhost, and dotless LAN names are refused, and hostnames are resolved and re-checked before every server call, with upstream redirects refused rather than followed. The last.fm connect flow now plants a short-lived HttpOnly cookie that its callback demands before exchanging any token, so a cross-site page can no longer link someone's e-f account to a stranger's last.fm. Smaller catches from the same review: an invalid focus-audio source is now actually stripped from saved snapshots, IMAP connection errors also redact URL-encoded and case-mangled credentials, and two docs now describe what the code really does (transient unsubscribe states, the SMS webhook's replay protection and dedup trade-off).
The Focus widget grew a source picker alongside the noise generator: Streams plays internet-radio and other audio you add yourself by https address — an early built-in station list was removed the same day it shipped, after a terms check found SomaFM does not permit third-party clients or embedded streams, so the widget now carries only streams you add and vouch for — and it stops itself loudly when a stream dies instead of playing silent dead air. Library connects to a self-hosted Subsonic-compatible server (Navidrome-ready) — credentials are proven against the server before saving, sealed with AES-256-GCM, and the audio streams through e-f so seeking works while the password stays in the database. Library tracks scrobble to last.fm under its 50%-or-4-minute rules with a fire-and-forget client that can never interrupt playback. Only one sound plays at a time across noise, streams, and library, sharing one volume. Apple Music remains a written plan, not a promise, until a real MusicKit developer token exists; live audio against a real connected Navidrome is the remaining verification.
The workspace can finally go light: Paper is a calm daylight theme built on warm paper tones rather than white glare, and Moss and Plum join the dark side of the wardrobe. On top of any theme, a new accent picker recolors buttons, highlights, and active edges — eight curated swatches, each carrying its own dark and light variant plus a matching ink so contrast holds everywhere, verified by tests that check every accent against every theme's real surfaces. The theme chips in settings, the type system, and the stylesheet now read from one shared catalog, and the invalid pre-hydration default theme that could render the wrong look has been corrected.
The dopamine break's image sources now have a visual editor: every animal gets its own section where a source is picked by kind — a template URL with a live size preview, a list of direct images, or an album page that resolves when you save — with add, reorder, and remove controls and a small preview that admits when a picture doesn't load. Suggested starting points cover the animals that had none. Anyone who preferred the raw JSON keeps it behind an Advanced panel that stays in step with the form.
Approving or declining an unsubscribe now happens right where the mail is — on each quarantined message and on every sender in the ledger — and the engine records the attempt itself: requested while the one-click is in flight, completed or failed once the sender answers, with the last attempt time shown on the sender. Each mail account gains a connection test that proves the sign-in and lists the folders before anything is swept, and Run now reports classified, quarantined, purged, and unsubscribe counts per account instead of one quiet line. Checking it all against the live mail servers is still the step before the first real unsubscribes go out.
Mail accounts can now be added in a settings screen — passwords sealed with AES-256-GCM before they touch the database — so the junk filter runs hosted on a daily schedule for anyone with an account, no local setup. The engine runs in serverless-sized passes that resume where the last one stopped, and the same verdicts-always-win rules govern both the hosted runner and the local command-line path.
The mail work opens with junk, not composing: a nightly engine connects to any IMAP account, sorts bulk mail from receipts and renewals using rules that a person's verdicts always outrank, and holds suspects in a quarantine folder before anything is deleted. One-click unsubscribes go out only to senders approved once in the new /app/mail screen, real spam is never unsubscribed at all, and a resumable backlog mode clears years of old mail in batches a slow server can survive. Live-account verification is next.
Every task card now carries Focus and Move, plus one slot for the destination specific to that task — open the brief, hand it to Zola. Zola proposes that step when a thought already says where it goes, drops anything that looks invented rather than guessing, and marks her suggestion as a suggestion. Setting it by hand lives in the edit panel.
Transcription will live on the device itself in the phone and Mac apps — nothing sent away, nothing metered, nothing to keep running. In a browser it stays limited by what that browser allows, and e-f now says which ones can't do it at all rather than failing quietly.
Recording waits through a pause instead of stopping the moment you go quiet, a meter shows that sound is actually arriving, and stopping tells you how many words were caught rather than leaving you to guess.
Recording used to end by itself after a few seconds of quiet, because that is what browsers do. It now keeps listening through a pause and only stops when you say so. Choosing which microphone is still not possible in a browser; e-f now says so plainly instead of leaving you hunting for a setting that does not exist.
Make a list of anything — books, packing, films — and choose what it records: text, one-of options, tags, dates, numbers, or a link to a task. Every list lives in one place.
Bugs and Ideas are built-in shared lists with their own page, so anything that misbehaves or any wish either of us has gets written down in seconds instead of forgotten.
Drag a task anywhere, on a touchscreen as much as a laptop, or move it with the arrow keys. Everything about a task is editable in one visible place, and a wrong move can be undone.
Every personal record now carries a revision, so a phone that was offline cannot silently replace a newer edit made on a laptop.
When two versions collide, both stay on screen — quietly, without a popup — until a person picks one. Neither version is thrown away first.
Every data route is audited on each change for a missing sign-in check or an unscoped query, with a separate proof that runs against the real database.
This page now turns the technical build into an honest visual journey and updates from one checked-in source.
Personal events now carry revisions so a stale phone or browser cannot silently replace a newer edit.
Twenty-two existing events were reconciled into normalized storage while the compatibility snapshot stayed intact.
e-f.online is public, /app is protected, and returning signed-in people go directly to their workspace.
The full journey
Open a layer when you want the details. The current backend layer stays open for you.
Layer in motion
Make e-f useful and pleasant enough to leave open all day.
Widgets have grips, edge and corner resize handles, and keyboard layout controls. The first-drag resizing jump and overlapping widgets on a fresh workspace are fixed. Local browser checks cover resize handles, first load, reload, and tablet width; regression tests also cover scrolling, cancelled gestures, and older saved layouts. Next: verify the feel on an actual iPad before calling the layout finished.
A real dopamine break is part of the product, not an afterthought — and its image streams are edited visually now, one section per animal with live previews, suggested sources, and an advanced JSON panel for anyone who liked the old way.
Brown, pink, and white noise work without an account or subscription.
Messy input can land quickly and become a manageable next step.
Drag a task to a new position or a different lane — with a finger on a tablet as readily as a mouse — or move it with the arrow keys and hear where it landed.
Title, project, due date, lane, and effort all change in one visible panel instead of hiding behind a right-click.
Type a whole brain-dump without re-clicking, move a batch of tasks at once, and take back a mis-tap without hunting for it.
Create a list and choose its fields — text, one-of options, tags, dates, numbers, checkboxes, or a link to a task — then drill into any entry for the details and notes.
Two shared lists and a page of their own, so a thing that broke or a wish either of us has takes seconds to record while we are still using the app.
Recording no longer stops itself the moment you go quiet to think. It keeps listening until you press stop, and a pause is treated as thinking rather than as something going wrong.
While recording, a small meter shows sound arriving and says so in words — including when nothing is arriving at all, which is usually a microphone chosen somewhere else rather than anything wrong with e-f. Stopping now says how many words were caught and what to do with them.
Brave deliberately leaves out the service that turns speech into text, but still looks like it supports it — so recording appeared to work and silently produced nothing. e-f now checks for this and says so before you press record, instead of letting you hunt through microphone settings that were never the problem.
The browser's speech recognition gives a website no say in which microphone it listens to, so for now e-f explains where to change the system default rather than offering a picker that would not work. A real choice needs a different recording engine — the same one the phone and desktop apps will need.
Opening a task for editing now turns it into a full-width block, with the grip, tick box and buttons moving into a header above it, instead of squeezing a whole form into a column one word wide.
Each task gets a button for whatever comes next — hand it back to Zola, open the thing it refers to, start focusing on it, or send it somewhere else — with Zola proposing the one that fits when she can tell, and quietly saying so when the button came from a guess.
Start the clock on a task, stop it later, and get a total per project you can bill against — including a gentle check when a timer has clearly been left running, because forgetting to stop it is the thing that will actually happen.
Focus audio now has three sources behind one volume slider: the original browser-made noise, Streams — internet-radio and other audio you add yourself by name and https address (there is deliberately no built-in station list: a SomaFM terms check showed curated lists need the provider's written permission) — and Library — your own music played straight off a self-hosted Subsonic-compatible server like Navidrome, with the password stored encrypted and the audio proxied so seeking works without the password ever reaching the browser. Library tracks report to last.fm under its own play-length rules, with failures that can never interrupt the music; streams carry no track metadata and say so. A security pass has since hardened the plumbing: the server address must be a public internet host (private, loopback, and link-local addresses are refused and re-checked through DNS before every fetch), and the last.fm connect flow binds its callback to a short-lived cookie so a cross-site page can't link the account. The pieces are built and unit-verified: what remains is proving live audio against a real connected Navidrome, and Apple Music stays a documented plan until a real MusicKit developer token exists.
Layer in motion
Let nonlinear thoughts become safe, reviewable actions without guessing.
Type or dictate the all-over-the-place version first.
Zola says what she understood and asks before creating anything.
Retries cannot accidentally create the same task twice.
Restarts, pauses, corrections, asides, and trailing thoughts are part of the test set.
Zola waits through real pauses and keeps the thread during long, nonlinear speech.
Layer landed
Make sign-in feel normal while keeping the public story and private workspace distinct.
Visitors see the product; signed-in people go straight to their own workspace.
An e-f account exists independently from whether Calendar is currently connected.
Two people using the same browser cannot inherit one another’s private workspace cache.
Older local work is offered for review instead of silently adopted or deleted.
Keep Auth.js now; revisit Clerk when native clients need it instead of migrating accounts just for fashion.
Layer in motion
Keep every device current without losing edits, duplicating actions, or crossing accounts.
Tasks are real database records, not only one giant browser snapshot.
Inbox thoughts keep their lifecycle, source, snooze state, and Zola provenance.
Personal and Google-projected events have their own safe, queryable records.
Stale clients get a conflict instead of silently overwriting a newer calendar edit.
Tasks and inbox thoughts now carry the same revision shield calendar events have.
Both versions stay visible and you choose; nothing is thrown away first, and it never interrupts with a popup.
Shared saves now refuse stale versions, combine independent record edits, and show both versions when the same item changed in two places. Pending drafts survive reload and failed requests, and a choice is checked again if another edit arrives before it saves. Isolated Postgres and two-browser fixtures pass; deployment and verification with two real signed-in accounts are still needed.
A phone that slept for a week can ask what changed and recover without a fragile always-on connection.
Every data route is now checked automatically for a missing sign-in check or a query that forgets whose data it is. The matching proof against the live database is written and waiting on its first run.
Lists currently ride in the compatibility snapshot rather than having their own rows, so they do not yet get the conflict protection tasks and calendar events have.
Shared items get equally explicit ownership rules before native devices can change them.
Planned layer
A fast native companion for capture, Today, decisions, Zola, and notifications.
Catch the thought before the thought disappears.
Do the small daily work without carrying the whole dashboard in your pocket.
Continue the same safe proposal and confirmation loop away from the web app.
Planned layer
Put the smallest useful version exactly where attention already is.
See what matters without opening a tiny dashboard.
Save a short thought or finish the current step in one tap.
A compact widget for Now/Next, capture, timer, focus audio, and Zola status.
The Mac app can remember a folder you chose without uploading hundreds of gigs of MP3s.
Planned layer
Help Zola remember with sources and work across the services life actually uses.
Prepare a useful overview without turning it into a nagging loop.
Remember why something matters and show where that memory came from.
Mail starts with hygiene: accounts are added right in the app — passwords encrypted before they touch the database — and a hosted engine reads them over IMAP each morning, quarantines marketing into its own folder, sends one-click unsubscribes you approve once, and reclaims server space in resumable batches. A training screen shows every call it made and takes your correction: approve or decline an unsubscribe per message or per sender, watch each attempt move through requested to completed or failed with the last attempt time, test an account's connection before trusting it, and read per-account counts after every run. Each person's accounts stay their own. The engine is built and verified against fixtures; checking it against the live mail servers is the next step before the first real sweep.
Texting a thought to the household number can land it in the right person's inbox like any other capture: the webhook proves Twilio, checks the owned destination, resolves a verified mobile number to that signed-in person's account, answers provider retries exactly once, and files the text with the same protected write every capture gets. The number, production credentials, saved webhook, per-account linking, database table, settings, documentation, and tests are in place. One account has started linking but has not yet sent the exact one-time LINK message, so no production capture has passed end to end. The settings checker now refreshes that pending state without flashing the panel. A verified real text into each account is still needed before this is complete; A2P registration stays separate unless e-f later sends replies.
Every draft remembers its source account; sending always requires a separate confirmation.
Layer in motion
Push the design further without making a noisy brain work harder.
The app already has shared colors, surfaces, type, density, and time-of-day shifts.
A matter-of-fact progress view makes the invisible backend journey followable.
Paper is the first real light theme, Moss and Plum extend the dark family, and a picked accent recolors buttons and highlights while staying readable in every theme. Settings, types, and the stylesheet share one catalog, checked by tests.
Turn the current foundations into a coherent dimensional system across the product.
The fun version and the quiet version are both first-class—not a compromise.
Planets, aliens, a toaster, the TARDIS, Cheez-Its, and friends drift by slowly and sparingly.
Planned layer
Explain the product beautifully with real proof instead of speculative promises.
The root site already explains the core promise and routes returning people into /app.
Use real screenshots, working features, and purposeful animation when the product is ready to show off.
Tell the design and engineering story—including the hard invisible parts—in a way you can proudly share.