OSL — V1 features and status

Platform and release

Windows product

Feature	Status	Where it actually is
Windows desktop client OSL runs as an installed Windows desktop application.	Partly there Needed for V1	The Windows client is built, but the full V1 release gate is still open.
Windows-only V1 V1 is offered to Windows users only.	Built, never proven Needed for V1	The canonical client and release contract contain this requirement.
English V1 interface V1 ships in English while keeping user-facing text ready for later translation.	Partly there Needed for V1	English is present, but complete string externalization is not established.
Eight-gigabyte target machine OSL states that its minimum target computer has 8 GB of memory.	Scaffolding only Needed for V1	The canonical client and release contract contain this requirement.

Packaging and integrity

Feature	Status	Where it actually is
Unsigned Windows distribution The release installs without an Authenticode publisher signature.	Built, never proven Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Unknown Publisher warning The app plainly warns that Windows may show Unknown Publisher or SmartScreen.	Partly there Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Signed release manifest People can verify the release against an independently signed manifest.	Partly there Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Offline manifest verification commands The release gives commands for checking the signed manifest without trusting the app.	Built, never proven Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Authenticated first-install key The first verification key comes through a channel separate from the download.	Scaffolding only Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Signed updater payload Downloaded updates carry a minisign integrity signature.	Built, never proven Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Compatibility disclosure The release names the tested Windows scale, language, theme, browser zoom, and carrier versions.	Partly there Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Update check and status The About area checks for updates and reports the result.	Built, never proven Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Install and restart update A confirmed update can install and restart OSL.	Partly there Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
Update rollback A failed update can return to the previous working build.	Scaffolding only Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.
No false security-review claim The release does not claim an independent security review that never happened.	Built, never proven Needed for V1	Release docs and About/update surfaces contain code, while several end-to-end release proofs remain open.

Operations and safety

Feature	Status	Where it actually is
Single-region best-effort service V1 honestly describes one service region without an enterprise uptime promise.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Daily encrypted backup The service backs up ciphertext and key records every day.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Tested service restore Operators can restore the encrypted service state from backup.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Retention cleanup retry Expired relay material is cleaned up again after a temporary failure.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Unrecoverable cleanup alert Operators are alerted when retention cleanup cannot recover by itself.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Protected-download malware scan Downloaded protected files are checked for malware.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.
Protected-download quarantine A suspicious protected file is isolated instead of opened normally.	Scaffolding only Needed for V1	These are release and service contracts; no complete production demonstration is recorded.

Performance ceilings

Feature	Status	Where it actually is
Memory ceiling The app aims to use no more than 750 MiB of working memory.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Cold-start ceiling The app aims to open within two seconds.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Idle CPU ceiling The app aims to use no more than one percent CPU while idle.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Protected-key response ceiling Protected typing should normally respond within 100 ms and never exceed 250 ms provisionally.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Long-run memory ceiling Eight hours of use should add no more than ten percent working memory.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Local-disk ceiling The app aims to use no more than 5 GB of local disk outside chosen content.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.
Large Scrub run ceiling A 100,000-item Scrub run has a provisional 30-minute ceiling.	Scaffolding only Needed for V1	The ceilings are specified acceptance targets, not current performance claims.

Account, access, and onboarding

Entry and return

Feature	Status	Where it actually is
Create account A new person can create a local OSL identity.	Built, never proven Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Returning-user sign in A returning person can sign in to an existing local identity.	Built, never proven Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Warm return An already authenticated person can return without repeating first-run setup.	Built, never proven Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Unlock local account A locked local account can be reopened with its password.	Built, never proven Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Forgot-password recovery Password recovery material can set a new main password.	Partly there Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Restore account from kit Identity recovery material and a kit file can restore the account on a new installation.	Partly there Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.
Key-lost state A device with missing keys refuses normal use and directs the person to recovery.	Built, never proven Needed for V1	The routes and state code exist; recovery is missing the full durable save-and-transition proof.

Thirteen-step first run

Feature	Status	Where it actually is
Step 1 — Recovery kit First run creates and requires saving the current recovery kit.	Partly there Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 2 — Identity choice First run chooses a searchable public identity or a private path.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 3 — Main password First run sets and confirms the main password.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 4 — Burn password First run optionally sets the destructive sign-in password.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 5 — Pro code First run redeems a Pro code or skips it and preserves the result.	Partly there Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 6 — Privacy and send checks First run explicitly chooses local checks for risky sends and metadata.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 7 — Tor or Direct First run makes the person choose Tor or Direct without a hidden choice.	Partly there Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 8 — Old-message policy First run chooses whether old messages stay locked forever or readable.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 9 — Sending behavior First run chooses Clipboard, Double Enter, or Single Enter.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 10 — Cover insertion First run chooses immediate insertion or the Pro natural-typing presentation.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 11 — Device cleanup First run chooses how unsent private material and old messages are cleaned locally.	Built, never proven Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 12 — Browser profiles First run grants access to individual supported browser profiles.	Partly there Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.
Step 13 — Detected apps First run shows supported native apps as Detected or Not detected.	Partly there Needed for V1	The current route spine and most screens exist, but a clean packaged run through all steps is not established.

Passwords and recovery kit

Feature	Status	Where it actually is
Twelve-character password floor The main password must contain at least twelve characters.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Password strength level The main password must reach strength level three.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Password confirmation The main password must be typed the same way twice.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Separate identity recovery material The kit keeps identity recovery separate from password recovery.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Separate password recovery material The kit contains material specifically for resetting the password.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
User-chosen recovery Copy Pressing Copy may place the displayed recovery value on the clipboard.	Partly there Needed for V1	The ruled behavior is allowed, but canonical Copy still reports unavailable.
Recovery-kit file download The current kit can be saved as a real file.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Durable kit verification OSL flushes, reopens, and authenticates the saved kit before accepting it.	Partly there Needed for V1	The screen exists, but the flush/reopen/authenticate sequence was not found.
Successor-before-revocation ordering A replacement kit is safely saved before old recovery authority becomes invalid.	Partly there Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Recovery limits warning Recovery explains that message history is not restored and total device-plus-kit loss is permanent.	Partly there Needed for V1	The required complete warning phrases are missing from canonical onboarding.
Public-name tombstone after total loss Permanent unrecoverable loss prevents the old public name from being claimed again.	Scaffolding only Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.
Burn-password ERASE acknowledgement Setting the burn password requires typing ERASE and names the local-data loss.	Built, never proven Needed for V1	Recovery UI and primitives exist, but the complete durable recovery transaction has not been demonstrated.

Two-device account

Feature	Status	Where it actually is
Two-device maximum One V1 account supports at most two synchronized devices.	Scaffolding only Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Pair second device A one-time code can authorize a second device.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Pairing-code comparison Both devices show a human-comparable code before pairing completes.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Device list Settings shows the devices authorized for the account.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Name a device A person can give an authorized device a recognizable name.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Remove a device A person can remove an exact device after confirmation.	Partly there Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Future-access cutoff A removed device loses all future messages and authorization.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Honest remote-erase request Removal calls remote deletion a best-effort request rather than confirmed erasure.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Optional history copy Pairing can copy chosen old history without giving the service old keys.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Pairing-forward traffic A new device receives new traffic only from its accepted pairing point.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Encrypted device sync Allowed sync payloads remain end-to-end encrypted.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Delete-wins merge A deletion wins when two devices merge conflicting ordinary changes.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Safer-wins security merge Conflicting security choices converge toward less access.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.
Offline edit reconciliation Longer offline edit chains are preserved for manual reconciliation.	Built, never proven Needed for V1	The device and sync machinery exists, but the packaged two-device V1 journey is not demonstrated.

Identity, friends, and trust

Public identity and scoped profile

Feature	Status	Where it actually is
Globally unique public name A searchable OSL name belongs to only one identity.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Exact-name search Discovery matches the exact public name without a browseable directory.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Private identity option A person can choose not to be searchable by public name.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Thirty-day rename lock A public name can be changed only once every thirty days.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Scoped display name A person can show a different encrypted display name in each permitted scope.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Scoped avatar A person can show an encrypted avatar only to its chosen audience.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Scoped status and bio Status and biography fields are encrypted to the friend, group, or Enclave scope.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.
Cross-scope profile unlinkability The same profile does not reuse identical ciphertext across different audiences.	Built, never proven Needed for V1	Identity and profile records exist; public-name validation still has an unresolved authority conflict.

Adding people and requests

Feature	Status	Where it actually is
One-use contact link Friends can create a link that works once.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Twenty-four-hour contact-link expiry An unused contact link expires after one day.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Replace abandoned contact link Creating a new link invalidates the earlier unused link.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Copy contact link A person can knowingly copy their own contact link.	Partly there Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Save contact invite file A contact invitation can be saved and opened as a file.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Send friend request A person can request a trusted OSL relationship.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Receive friend request Incoming friend requests appear for a decision.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Accept friend request An incoming request can become an OSL friend.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Decline friend request An incoming request can be refused without creating a relationship.	Built, never proven Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Separate friends and Chats contacts OSL friends and OSL Chats contacts remain two independent lists.	Partly there Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Who may add you Privacy settings choose who can send OSL and OSL Chats requests.	Partly there Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.
Accounts friends may see A person chooses which connected accounts are visible to friends.	Partly there Needed for V1	Records and parent screens exist, but several request/list states were never shown as working.

Verification and key change

Feature	Status	Where it actually is
Identity-code exchange Two people exchange OSL identity information before trust.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Sixty-digit safety number Verification shows 60 digits in twelve groups of five.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Safety-number QR The same safety value can be compared with a QR code.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Out-of-band verification The app asks people to compare the safety value through another channel.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Verified-friend send gate Protected direct sending is allowed only after verification.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Loud key-change warning A changed identity key removes the verified state and clearly warns both people.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Key-change send block Protected sending remains blocked until the changed identity is verified again.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Reverification A person can verify the new key and restore trusted sending.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.
Unmodified-build mark OSL distinguishes build-integrity evidence from personal safety-number trust.	Built, never proven Needed for V1	The trust records and gates exist, though several shipping dialog states were never independently reviewed.

Blocking and whitelisting

Feature	Status	Where it actually is
Block person A person can locally stop another person from contacting them.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Unblock person A local block can be reversed.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
No reporting system OSL offers blocking without reports, reputation, or central content review.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Per-service whitelist Permission to send protected content is recorded separately for each service.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Per-place whitelist Permission is limited to the exact person and conversation, group, server, or channel.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Silent whitelist toggle Changing a whitelist does not notify the other person.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Immediate whitelist state The screen immediately makes allowed and refused states visually distinct.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
Whitelist key-change revocation A changed key automatically returns the place to refused.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.
No whitelist safety bypass A whitelist never overrides a wrong account, room, key, or cryptographic failure.	Built, never proven Needed for V1	The underlying records and controls exist; carrier-specific enforcement is inventoried separately below.

Shared protection engine

Cryptographic message path

Feature	Status	Where it actually is
Authenticated protected payload Private content is encrypted and authenticated for its exact intended identities and scope.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Opaque retrieval reference Cover text carries an opaque lookup reference instead of private content.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Sender and recipient binding A received payload is accepted only for its named sender and recipient.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Service and conversation binding A payload is accepted only in its authenticated service and conversation scope.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Sequence and replay refusal Old or repeated protected payloads are rejected.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Expiry and message-ID validation Opening validates expiry and the unique message identity before revealing content.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
No silent plaintext fallback A failed protected transaction never falls back to sending the private text.	Built, never proven Needed for V1	The shared broker and IPC code contain these protections; carrier delivery is assessed separately.
Relay stores ciphertext The deployed OSL service stores protected message bodies only as ciphertext.	Working Needed for V1	A deployed OSL Chats proof demonstrated ciphertext-only storage.

Cover text

Feature	Status	Where it actually is
Word-choice cover The default cover carries information through ordinary word choices.	Built, never proven Needed for V1	Cover generation is built; live-carrier delivery and the classifier bar are not established.
Safe cover alphabet Default cover uses correctly spelled ASCII words and single spaces without URLs or emoji.	Built, never proven Needed for V1	Cover generation is built; live-carrier delivery and the classifier bar are not established.
Bounded cover capacity The app reports a carrier limit and refuses instead of truncating private data.	Built, never proven Needed for V1	Cover generation is built; live-carrier delivery and the classifier bar are not established.
Bounded multi-message cover A long protected message may use only a stated maximum number of cover rows.	Built, never proven Needed for V1	Cover generation is built; live-carrier delivery and the classifier bar are not established.
No hidden clipboard placement OSL never uses the clipboard as invisible workspace for carrier cover.	Built, never proven Needed for V1	Cover generation is built; live-carrier delivery and the classifier bar are not established.
No character-by-character placement OSL places a complete cover through a proved direct mechanism.	Partly there Needed for V1	The rule exists, but only Telegram has a live placement receipt.
Exact stored-cover readback Success requires reading back exactly what the carrier stored.	Partly there Needed for V1	Readback code exists, but no complete carrier delivery has proven it.
Machine-classifier target Wordbank cover aims for no more than fifty percent machine recognition.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	The recorded classifier recognized 100 percent, so the target currently fails.

Timers, view once, and burn semantics

Feature	Status	Where it actually is
One-minute to thirty-day timer range A protected message can expire from one minute through thirty days.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Relay-send timer One timer starts when the encrypted relay object is sent.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
After-open timer A separate timer starts only when the protected message is first opened.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Key-only expiry default Expiry normally destroys decryption authority while leaving carrier cover behind.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Both-endpoint key destruction Expiry removes the sender and recipient ability to decrypt.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Offline expiry reconciliation A device that was offline applies pending expiry when it returns.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Atomic first view Only one first opener can consume a view-once message.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Second-view refusal A consumed view-once message cannot be opened again.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
View-once capture warning The recipient is warned that screenshots or a camera cannot be guaranteed away.	Partly there Needed for V1	The rule and code fragments exist, but no complete reviewed recipient journey exists.
Sender-owned carrier deletion Where allowed, expiry may also request deletion of the sender-owned carrier row.	Partly there Needed for V1	Provider-specific deletion paths are not proven.
Message burn A person can revoke one protected message within the honest endpoint limits.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Conversation burn A person can burn the selected conversation without widening the target.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
App burn A person can remove one connected app and its local protected history.	Built, never proven Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.
Account-scoped burn A confirmed account burn erases the local account and requests bounded remote cleanup.	Partly there Needed for V1	Shared lifecycle records exist, but every external carrier needs its own proof below.

Reliability and self-healing

Feature	Status	Where it actually is
Shared carrier transaction order A carrier transaction binds, places, reads back, sends, receives, restores, and records a result in order.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Durable send-attempt journal A crash-resistant record can describe a carrier send attempt and its outcome.	Partly there Needed for V1	A reusable journal exists but no production carrier calls it.
Behavioral drift detection OSL notices when a carrier control or layout has changed.	Partly there Needed for V1	Telegram and Discord have defensive checks, but the requirement is not universal.
Visual drift detection OSL notices when its carrier overlay no longer matches the carrier.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Measured automatic repair OSL repairs only a carrier variant it has measured and proved.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Visible refusal on uncertainty OSL refuses and explains uncertainty instead of guessing a target.	Partly there Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Carrier-close reconciliation A send interrupted by closing the carrier resumes or reports its exact truthful state.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Network-loss reconciliation A send interrupted by the network distinguishes accepted, rejected, and unknown outcomes.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Crash recovery for carrier sends After a crash OSL reconciles the carrier before offering Retry.	Scaffolding only Needed for V1	Defensive fragments exist, but there is no universal production recovery state machine.
Partial-placement cleanup OSL removes only a span it can prove it owns and otherwise requests manual cleanup.	Partly there Needed for V1	Discord may leave a partial prefix and hard kill skips cleanup.
Queue idempotency Retries do not create duplicate relay or carrier rows.	Partly there Needed for V1	The local queue has a key, but the ordinary relay path does not preserve it.

External carriers and mail providers

Exact chat and social scopes

Feature	Status	Where it actually is
Discord — Direct message One verified peer can exchange protected Discord direct messages.	Built, never proven Needed for V1	DM is the only native Discord scope actually modeled; it remains unproven end to end. Discord DM Built, never proven — DM is the only native Discord scope actually modeled; it remains unproven end to end.
Discord — Group DM A fixed set of verified people can exchange one protected Discord group DM.	Partly there Needed for V1	A group-shaped UI exists, but recipient-set encryption and multi-author attribution are missing. Discord Group DM Partly there — A group-shaped UI exists, but recipient-set encryption and multi-author attribution are missing.
Discord — Server text channel A protected Discord server-channel message is bound to its guild, channel, and audience.	Partly there Needed for V1	A generic composer can match, but guild/channel IDs and group audience encryption are missing. Discord Server text channel Partly there — A generic composer can match, but guild/channel IDs and group audience encryption are missing.
Discord — Thread reply A protected reply stays bound to its exact Discord thread.	Partly there Needed for V1	The scope is named, but there is no protected thread send. Discord Thread Partly there — The scope is named, but there is no protected thread send.
Telegram — Private chat A protected Telegram private message completes send, stored-row readback, receive, and reveal.	Partly there Needed for V1	Live composer placement exists; Send, provider row, independent receive, and reveal are missing. Telegram Private chat Partly there — Live composer placement exists; Send, provider row, independent receive, and reveal are missing.
Telegram — Basic group A protected Telegram basic-group message is encrypted to the exact member set.	Scaffolding only Needed for V1	Generic group shapes exist, but no exact roster, key scope, send, receive, or overlay is wired. Telegram Basic group Scaffolding only — Generic group shapes exist, but no exact roster, key scope, send, receive, or overlay is wired.
Telegram — Supergroup A protected Telegram supergroup message binds the supergroup and posting identity.	Scaffolding only Needed for V1	Registries name the scope inconsistently and no product path sends or decrypts it. Telegram Supergroup Scaffolding only — Registries name the scope inconsistently and no product path sends or decrypts it.
Telegram — Channel A protected Telegram channel post proves posting rights, identity, row, and subscriber receipt.	Partly there Needed for V1	A generic channel reader/composer matcher exists; rights, Send, receive, and overlay are missing. Telegram Channel Partly there — A generic channel reader/composer matcher exists; rights, Send, receive, and overlay are missing.
Telegram — Saved Messages A person can protect a message in their own Telegram Saved Messages scope.	Scaffolding only Needed for V1	A helper exists, but the backend omits the scope and rejects the same account/workdir. Telegram Saved Messages Scaffolding only — A helper exists, but the backend omits the scope and rejects the same account/workdir.
Signal — Direct message A protected Signal DM uses the selected isolated OSL Signal profile.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	UIA cannot drive the composer and the separate signal-cli sender is not the ruled screen route. Signal DM Blocked or failed — UIA cannot drive the composer and the separate signal-cli sender is not the ruled screen route.
Signal — Group A protected Signal group binds the exact group and members.	Scaffolding only Needed for V1 Large job	Only task and UI concepts exist; no production group carrier path is wired. Signal Group Scaffolding only — Only task and UI concepts exist; no production group carrier path is wired.
Signal — Note to Self A person can protect a message in the distinct Signal Note to Self scope.	Scaffolding only Needed for V1 Large job	The scope is named in task registries but has no working product route. Signal Note to Self Scaffolding only — The scope is named in task registries but has no working product route.
Signal — Story A Signal Story uses a separate protected audience and composer.	Scaffolding only Needed for V1 Large job	A story-composer module exists without a live carrier, final design, or review. Signal Story Scaffolding only — A story-composer module exists without a live carrier, final design, or review.
WhatsApp — Direct message A protected WhatsApp DM reaches the real message document and another identity.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	The attempted real placement changed accessibility state but left the document empty. WhatsApp DM Blocked or failed — The attempted real placement changed accessibility state but left the document empty.
WhatsApp — Group A protected WhatsApp group message binds the exact group and recipient roster.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	The base composer route already fails and no exact group-roster path exists. WhatsApp Group Blocked or failed — The base composer route already fails and no exact group-roster path exists.
WhatsApp — Community and channel Protected WhatsApp community, community-group, announcement, and channel messages keep distinct audiences.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	The tasks name these places, but there is no working carrier or audience binding. WhatsApp Community/channel Scaffolding only — The tasks name these places, but there is no working carrier or audience binding.
WhatsApp — Status A protected WhatsApp Status uses its chosen audience without falling back to a chat.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	A distinct task contract exists, but no production Status composer or receive path does. WhatsApp Status Scaffolding only — A distinct task contract exists, but no production Status composer or receive path does.
Instagram — Direct message A protected Instagram Direct message reaches and returns from the real private thread.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Only cover preparation and an in-memory inbox exist. Instagram Direct DM Scaffolding only — Only cover preparation and an in-memory inbox exist.
Instagram — Public post A protected Instagram post publishes to its explicitly chosen post audience.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	The higher-authority V1 boundary excludes public social posting and no production post route is allowed to ship. Instagram Post Blocked or failed — The higher-authority V1 boundary excludes public social posting and no production post route is allowed to ship.
Messenger — Direct message A protected Messenger DM reaches a real private thread and returns from a second identity.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Only a fixed URL and in-memory MessengerTestMachine exist. Messenger DM Scaffolding only — Only a fixed URL and in-memory MessengerTestMachine exist.
X — Public post A protected X post publishes only after an explicit public-audience decision.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	Public posting is outside the V1 promise and the allowed automation route is not established. X Public post Blocked or failed — Public posting is outside the V1 promise and the allowed automation route is not established.

Discord

Feature	Status	Where it actually is
Discord — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — View once A carrier message can carry content that becomes unreadable after its first open.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Built, never proven Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Built, never proven — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.
Discord — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Partly there Needed for V1	Discord is assessed here for DM, group DM, server text channel, thread. Shipping code exists, but no recorded packaged two-identity round trip proves this dimension. Discord DM, group DM, server text channel, thread Partly there — Shipping code exists, but no recorded packaged two-identity round trip proves this dimension.

Feature	Status	Where it actually is
Telegram — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Built, never proven Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Built, never proven — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Partly there Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Built, never proven Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Built, never proven — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Working Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. A live receipt proves composer carry and composer readback only; it does not prove Send or delivery. Telegram private chat, basic group, supergroup, channel, Saved Messages Working — A live receipt proves composer carry and composer readback only; it does not prove Send or delivery.
Telegram — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Partly there Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. The live receipt reads the unsent composer document, not a provider-stored sent row. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — The live receipt reads the unsent composer document, not a provider-stored sent row.
Telegram — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Built, never proven Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Built, never proven — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Partly there Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Telegram — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1	Telegram is assessed here for private chat, basic group, supergroup, channel, Saved Messages. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Telegram private chat, basic group, supergroup, channel, Saved Messages Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.

Signal

Feature	Status	Where it actually is
Signal — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Partly there Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Partly there Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Partly there Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Blocked or failed — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Blocked or failed — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Blocked or failed — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Blocked or failed — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Partly there Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Partly there Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Signal — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Large job	Signal is assessed here for DM, group, Note to Self, Story. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Signal DM, group, Note to Self, Story Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.

Feature	Status	Where it actually is
WhatsApp — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Built, never proven Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Built, never proven — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. The measured accessibility write did not reach the real WhatsApp message document. WhatsApp DM, group, channel, community, community group, broadcast list, Status Blocked or failed — The measured accessibility write did not reach the real WhatsApp message document.
WhatsApp — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. The measured accessibility write did not reach the real WhatsApp message document. WhatsApp DM, group, channel, community, community group, broadcast list, Status Blocked or failed — The measured accessibility write did not reach the real WhatsApp message document.
WhatsApp — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. The measured accessibility write did not reach the real WhatsApp message document. WhatsApp DM, group, channel, community, community group, broadcast list, Status Blocked or failed — The measured accessibility write did not reach the real WhatsApp message document.
WhatsApp — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Blocked or failed Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. The measured accessibility write did not reach the real WhatsApp message document. WhatsApp DM, group, channel, community, community group, broadcast list, Status Blocked or failed — The measured accessibility write did not reach the real WhatsApp message document.
WhatsApp — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
WhatsApp — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Partly there Needed for V1 Tried and failed / platform forbids it	WhatsApp is assessed here for DM, group, channel, community, community group, broadcast list, Status. Only scaffolding, models, or unproved fragments exist for this carrier dimension. WhatsApp DM, group, channel, community, community group, broadcast list, Status Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.

Instagram

Feature	Status	Where it actually is
Instagram — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Partly there Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Partly there Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Partly there — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Instagram — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram is assessed here for Direct DM and group DM. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Instagram Direct DM and group DM Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.

Messenger

Feature	Status	Where it actually is
Messenger — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Carrier-row delete option Where the service permits it, the sender may request deletion of their own carrier row.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.
Messenger — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger is assessed here for private DM, group chat, community. Only scaffolding, models, or unproved fragments exist for this carrier dimension. Messenger private DM, group chat, community Scaffolding only — Only scaffolding, models, or unproved fragments exist for this carrier dimension.

Gmail

Feature	Status	Where it actually is
Gmail — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Partly there Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Partly there — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Partly there Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Partly there — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Built, never proven Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Built, never proven — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Carrier-row delete option Gmail expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
Gmail — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Gmail — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Gmail — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Gmail — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Gmail — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Gmail — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Gmail — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Partly there Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. A genuine OAuth Inbox GET reader exists, but it is unwired and has no live product proof. Gmail Web: compose, reply, forward, threads, labels Partly there — A genuine OAuth Inbox GET reader exists, but it is unwired and has no live product proof.
Gmail — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1	Gmail is assessed here for Web: compose, reply, forward, threads, labels. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Gmail Web: compose, reply, forward, threads, labels Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

Outlook — Web

Feature	Status	Where it actually is
Outlook Web — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Carrier-row delete option Outlook expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. Outlook Web Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
Outlook Web — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1	Outlook is assessed here for Web. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Web Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Web — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Web — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1	Outlook is assessed here for Web. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Web Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

Outlook — Windows desktop

Feature	Status	Where it actually is
Outlook Desktop — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Carrier-row delete option Outlook expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. Outlook Windows desktop Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
Outlook Desktop — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Outlook Windows desktop Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Outlook Desktop — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Outlook Desktop — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1	Outlook is assessed here for Windows desktop. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Outlook Windows desktop Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

Proton Mail

Feature	Status	Where it actually is
Proton Mail — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Carrier-row delete option Proton Mail expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
Proton Mail — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Proton Mail — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Proton Mail — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1 Large job	Proton Mail is assessed here for Web: floating composer, folders, labels, threads. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Proton Mail Web: floating composer, folders, labels, threads Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

Yahoo Mail

Feature	Status	Where it actually is
Yahoo Mail — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Carrier-row delete option Yahoo Mail expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
Yahoo Mail — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. Yahoo Mail Web: compose, folders, Trash Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
Yahoo Mail — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
Yahoo Mail — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1 Large job	Yahoo Mail is assessed here for Web: compose, folders, Trash. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. Yahoo Mail Web: compose, folders, Trash Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

AOL Mail

Feature	Status	Where it actually is
AOL Mail — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Carrier-row delete option AOL Mail expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. AOL Mail Web: compose, folders, provider delete Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
AOL Mail — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. AOL Mail Web: compose, folders, provider delete Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
AOL Mail — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
AOL Mail — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1 Large job	AOL Mail is assessed here for Web: compose, folders, provider delete. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. AOL Mail Web: compose, folders, provider delete Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

iCloud Mail

Feature	Status	Where it actually is
iCloud Mail — Connection and profile OSL connects only to the chosen signed-in app or browser profile.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Destination proof OSL proves the exact account, conversation, recipients, and scope before touching the composer.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Protected composer The private draft stays in an OSL-controlled composer instead of the carrier.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Lock and protection state The carrier surface clearly shows whether OSL can safely reach and protect its composer.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Cover placement OSL places complete cover text into the real carrier composer without exposing private text.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Chosen send trigger The selected Clipboard, Double Enter, or Single Enter behavior controls the carrier send.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Protected text delivery A second owner-controlled identity receives and decrypts the protected text.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Stored-output readback OSL reads the exact provider-stored row before calling the send successful.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Inbound row and author detection OSL binds a received carrier row to its exact author and conversation.	Partly there Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Partly there — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Wake-up and catch-up receive After sleep or restart OSL resumes only the approved carrier scope and catches up safely.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Eye reveal A click hides or locally reveals authenticated private content over the carrier row.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Protected attachments Private attachments travel encrypted while the carrier receives only cover.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — View once A carrier message can carry content that becomes unreadable after its first open.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Timer and key expiry A carrier message can expire by destroying decryption authority on both endpoints.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Carrier-row delete option iCloud Mail expiry leaves the recipient email in place and may delete only a separately selected sender-owned copy.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox. iCloud Mail Web: compose and mailbox rows Scaffolding only — Mail is key-only for the recipient copy; no sender can delete mail from the recipient mailbox.
iCloud Mail — Burn scopes Message, conversation, app, and account burns stay within the selected carrier scope.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Per-scope whitelist Protected sending is enabled only for the exact approved person and carrier place.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Per-place allowance Data used through this carrier is charged to the exact protected place and shown honestly.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Cover integrity Carrier limits and transformations are checked before the irreversible send.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Behavioral self-healing Carrier control drift is detected, repaired when proved, or refused visibly.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Visual fidelity The composer and reveal overlay are compared with the live carrier and match its appearance.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier. iCloud Mail Web: compose and mailbox rows Scaffolding only — The provider path is a model, trait, snapshot, or unwired reader rather than a live two-account carrier.
iCloud Mail — Recipient validation OSL proves the exact To, CC, and BCC recipients before sending protected mail.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Protected reply A protected reply stays bound to the proved thread and recipients.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Reply All without hidden BCC Reply All never silently adds a hidden BCC recipient from the earlier message.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Protected forward warning Forwarding warns that a non-OSL recipient will receive only ordinary cover.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Visible-subject warning The subject is plainly described as visible carrier metadata and never contains private facts.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Consented mailbox catch-up OSL reads only approved folders or labels and catches up without fetching unnecessary content.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.
iCloud Mail — Pointer attachment size independence The protected pointer attachment stays small regardless of the private file size.	Scaffolding only Needed for V1 Large job	iCloud Mail is assessed here for Web: compose and mailbox rows. Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior. iCloud Mail Web: compose and mailbox rows Scaffolding only — Only provider contracts, fixtures, snapshots, or task interfaces exist for this mail behavior.

Scrub and AutoScrub

Consent and attended discovery

Feature	Status	Where it actually is
Automation risk disclosure Scrub says it controls the app, reads messages, may violate provider rules, may cause suspension, and cannot remove that risk.	Built, never proven Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Account-specific consent Scrub reads only an explicitly selected account.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Profile-specific consent Scrub reads only an explicitly selected browser or native-app profile.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Folder-specific consent Mail scanning reads only explicitly selected folders or labels.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
No saved-password reading Scrub never reads stored passwords or signs in for the person.	Built, never proven Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Streaming local discovery Findings and progress are produced locally as the provider is read.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Truthful readable count The run reports how many provider items it actually read.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Truthful exposure count The run reports apparent public exposures without synthetic totals.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
Truthful zero and error states No findings and provider failures are shown as different honest outcomes.	Scaffolding only Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.
No discovery deletion A discovery run cannot delete anything.	Built, never proven Needed for V1	The UI and contracts exist, but the shipping backend reads only a local registry and no live provider.

Review and delete

Feature	Status	Where it actually is
Finding list Possible matches wait in a local review list.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Exact message preview The review shows the real provider message selected for possible deletion.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Individual selection Each delete candidate is selected separately.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Real affected counts The confirmation names real item and account counts.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Survivor disclosure The confirmation says what remains at the provider and on other devices.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Separate destructive confirmation Discovery and delete approval are two different decisions.	Built, never proven Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Provider delete result Success, partial failure, and failure remain different outcomes.	Scaffolding only Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.
Sender-owned items only Scrub never claims it can delete somebody else’s carrier copy.	Built, never proven Needed for V1	Safety contracts and screens exist, but no provider-wired delete has been established.

AutoScrub

Feature	Status	Where it actually is
Scheduled discovery Pro can schedule a discovery scan.	Scaffolding only Needed for V1	AutoScrub is specified as find-only; conflicting product copy remains.
Find-only classifier A classifier may add a possible match to review but cannot authorize deletion.	Partly there Needed for V1	The base contract blocks unattended deletion, but canonical copy still says Find and delete/can delete.
AutoScrub review set Scheduled findings wait for the person in the same review workflow.	Scaffolding only Needed for V1	AutoScrub is specified as find-only; conflicting product copy remains.
No automatic delete AutoScrub never creates, queues, approves, or performs a delete action.	Partly there Needed for V1	Higher-authority behavior is clear, but conflicting deletion copy remains in code.
Finished-run notification A completed scheduled scan can create a local alert.	Built, never proven Needed for V1	AutoScrub is specified as find-only; conflicting product copy remains.

Per-service operations

Feature	Status	Where it actually is
Discord — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1	Discord account and approved conversations is assessed separately. A named hosted adapter exists but the shipping path never calls a live Discord reader. Discord Scrub: account and approved conversations Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Discord reader.
Discord — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1	Discord account and approved conversations is assessed separately. A named hosted adapter exists but the shipping path never calls a live Discord reader. Discord Scrub: account and approved conversations Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Discord reader.
Discord — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1	Discord account and approved conversations is assessed separately. A named hosted adapter exists but the shipping path never calls a live Discord reader. Discord Scrub: account and approved conversations Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Discord reader.
Discord — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1	Discord account and approved conversations is assessed separately. A named hosted adapter exists but the shipping path never calls a live Discord reader. Discord Scrub: account and approved conversations Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Discord reader.
Telegram — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1	Telegram profile and approved chats is assessed separately. A named hosted adapter exists but the shipping path never calls a live Telegram reader. Telegram Scrub: profile and approved chats Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Telegram reader.
Telegram — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1	Telegram profile and approved chats is assessed separately. A named hosted adapter exists but the shipping path never calls a live Telegram reader. Telegram Scrub: profile and approved chats Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Telegram reader.
Telegram — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1	Telegram profile and approved chats is assessed separately. A named hosted adapter exists but the shipping path never calls a live Telegram reader. Telegram Scrub: profile and approved chats Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Telegram reader.
Telegram — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1	Telegram profile and approved chats is assessed separately. A named hosted adapter exists but the shipping path never calls a live Telegram reader. Telegram Scrub: profile and approved chats Scaffolding only — A named hosted adapter exists but the shipping path never calls a live Telegram reader.
Signal — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Large job	Signal profile and approved conversations is assessed separately. Signal appears only in adjacent allowlists; no shipping provider reader runs. Signal Scrub: profile and approved conversations Scaffolding only — Signal appears only in adjacent allowlists; no shipping provider reader runs.
Signal — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Large job	Signal profile and approved conversations is assessed separately. Signal appears only in adjacent allowlists; no shipping provider reader runs. Signal Scrub: profile and approved conversations Scaffolding only — Signal appears only in adjacent allowlists; no shipping provider reader runs.
Signal — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Large job	Signal profile and approved conversations is assessed separately. Signal appears only in adjacent allowlists; no shipping provider reader runs. Signal Scrub: profile and approved conversations Scaffolding only — Signal appears only in adjacent allowlists; no shipping provider reader runs.
Signal — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Large job	Signal profile and approved conversations is assessed separately. Signal appears only in adjacent allowlists; no shipping provider reader runs. Signal Scrub: profile and approved conversations Scaffolding only — Signal appears only in adjacent allowlists; no shipping provider reader runs.
WhatsApp — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp profile and approved conversations is assessed separately. WhatsApp has reader abstractions but no shipping provider scan. WhatsApp Scrub: profile and approved conversations Scaffolding only — WhatsApp has reader abstractions but no shipping provider scan.
WhatsApp — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp profile and approved conversations is assessed separately. WhatsApp has reader abstractions but no shipping provider scan. WhatsApp Scrub: profile and approved conversations Scaffolding only — WhatsApp has reader abstractions but no shipping provider scan.
WhatsApp — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp profile and approved conversations is assessed separately. WhatsApp has reader abstractions but no shipping provider scan. WhatsApp Scrub: profile and approved conversations Scaffolding only — WhatsApp has reader abstractions but no shipping provider scan.
WhatsApp — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	WhatsApp profile and approved conversations is assessed separately. WhatsApp has reader abstractions but no shipping provider scan. WhatsApp Scrub: profile and approved conversations Scaffolding only — WhatsApp has reader abstractions but no shipping provider scan.
X — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	X account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached. X Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached.
X — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	X account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached. X Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached.
X — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	X account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached. X Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached.
X — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	X account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached. X Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit X and no live reader is reached.
Instagram — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached. Instagram Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached.
Instagram — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached. Instagram Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached.
Instagram — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached. Instagram Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached.
Instagram — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Instagram account and approved places is assessed separately. Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached. Instagram Scrub: account and approved places Scaffolding only — Task contracts exist, but the shipping Scrub registries omit Instagram and no live reader is reached.
Messenger — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger account and approved conversations is assessed separately. Messenger appears only in adjacent allowlists and its reader is not a shipping route. Messenger Scrub: account and approved conversations Scaffolding only — Messenger appears only in adjacent allowlists and its reader is not a shipping route.
Messenger — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger account and approved conversations is assessed separately. Messenger appears only in adjacent allowlists and its reader is not a shipping route. Messenger Scrub: account and approved conversations Scaffolding only — Messenger appears only in adjacent allowlists and its reader is not a shipping route.
Messenger — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger account and approved conversations is assessed separately. Messenger appears only in adjacent allowlists and its reader is not a shipping route. Messenger Scrub: account and approved conversations Scaffolding only — Messenger appears only in adjacent allowlists and its reader is not a shipping route.
Messenger — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Tried and failed / platform forbids it	Messenger account and approved conversations is assessed separately. Messenger appears only in adjacent allowlists and its reader is not a shipping route. Messenger Scrub: account and approved conversations Scaffolding only — Messenger appears only in adjacent allowlists and its reader is not a shipping route.
Gmail — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1	Gmail browser profile, labels, and threads is assessed separately. Gmail is a named preload fragment, but the shipping scan reads no provider. Gmail Scrub: browser profile, labels, and threads Scaffolding only — Gmail is a named preload fragment, but the shipping scan reads no provider.
Gmail — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1	Gmail browser profile, labels, and threads is assessed separately. Gmail is a named preload fragment, but the shipping scan reads no provider. Gmail Scrub: browser profile, labels, and threads Scaffolding only — Gmail is a named preload fragment, but the shipping scan reads no provider.
Gmail — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1	Gmail browser profile, labels, and threads is assessed separately. Gmail is a named preload fragment, but the shipping scan reads no provider. Gmail Scrub: browser profile, labels, and threads Scaffolding only — Gmail is a named preload fragment, but the shipping scan reads no provider.
Gmail — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1	Gmail browser profile, labels, and threads is assessed separately. Gmail is a named preload fragment, but the shipping scan reads no provider. Gmail Scrub: browser profile, labels, and threads Scaffolding only — Gmail is a named preload fragment, but the shipping scan reads no provider.
Outlook Web — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1	Outlook Web profile and folders is assessed separately. No provider-wired Scrub reader or delete route is registered. Outlook Scrub: Web profile and folders Scaffolding only — No provider-wired Scrub reader or delete route is registered.
Outlook Web — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1	Outlook Web profile and folders is assessed separately. No provider-wired Scrub reader or delete route is registered. Outlook Scrub: Web profile and folders Scaffolding only — No provider-wired Scrub reader or delete route is registered.
Outlook Web — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1	Outlook Web profile and folders is assessed separately. No provider-wired Scrub reader or delete route is registered. Outlook Scrub: Web profile and folders Scaffolding only — No provider-wired Scrub reader or delete route is registered.
Outlook Web — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1	Outlook Web profile and folders is assessed separately. No provider-wired Scrub reader or delete route is registered. Outlook Scrub: Web profile and folders Scaffolding only — No provider-wired Scrub reader or delete route is registered.
Outlook Desktop — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1	Outlook Desktop profile and folders is assessed separately. Only read-only desktop models exist; Scrub does not drive them. Outlook Scrub: Desktop profile and folders Scaffolding only — Only read-only desktop models exist; Scrub does not drive them.
Outlook Desktop — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1	Outlook Desktop profile and folders is assessed separately. Only read-only desktop models exist; Scrub does not drive them. Outlook Scrub: Desktop profile and folders Scaffolding only — Only read-only desktop models exist; Scrub does not drive them.
Outlook Desktop — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1	Outlook Desktop profile and folders is assessed separately. Only read-only desktop models exist; Scrub does not drive them. Outlook Scrub: Desktop profile and folders Scaffolding only — Only read-only desktop models exist; Scrub does not drive them.
Outlook Desktop — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1	Outlook Desktop profile and folders is assessed separately. Only read-only desktop models exist; Scrub does not drive them. Outlook Scrub: Desktop profile and folders Scaffolding only — Only read-only desktop models exist; Scrub does not drive them.
Proton Mail — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Large job	Proton Mail browser profile, folders, labels, and threads is assessed separately. Only provider contracts/fixtures exist, with no shipping scan. Proton Mail Scrub: browser profile, folders, labels, and threads Scaffolding only — Only provider contracts/fixtures exist, with no shipping scan.
Proton Mail — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Large job	Proton Mail browser profile, folders, labels, and threads is assessed separately. Only provider contracts/fixtures exist, with no shipping scan. Proton Mail Scrub: browser profile, folders, labels, and threads Scaffolding only — Only provider contracts/fixtures exist, with no shipping scan.
Proton Mail — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Large job	Proton Mail browser profile, folders, labels, and threads is assessed separately. Only provider contracts/fixtures exist, with no shipping scan. Proton Mail Scrub: browser profile, folders, labels, and threads Scaffolding only — Only provider contracts/fixtures exist, with no shipping scan.
Proton Mail — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Large job	Proton Mail browser profile, folders, labels, and threads is assessed separately. Only provider contracts/fixtures exist, with no shipping scan. Proton Mail Scrub: browser profile, folders, labels, and threads Scaffolding only — Only provider contracts/fixtures exist, with no shipping scan.
Yahoo Mail — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Large job	Yahoo Mail browser profile and folders is assessed separately. The provider adapter is an in-memory model, not a signed-in scan. Yahoo Mail Scrub: browser profile and folders Scaffolding only — The provider adapter is an in-memory model, not a signed-in scan.
Yahoo Mail — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Large job	Yahoo Mail browser profile and folders is assessed separately. The provider adapter is an in-memory model, not a signed-in scan. Yahoo Mail Scrub: browser profile and folders Scaffolding only — The provider adapter is an in-memory model, not a signed-in scan.
Yahoo Mail — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Large job	Yahoo Mail browser profile and folders is assessed separately. The provider adapter is an in-memory model, not a signed-in scan. Yahoo Mail Scrub: browser profile and folders Scaffolding only — The provider adapter is an in-memory model, not a signed-in scan.
Yahoo Mail — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Large job	Yahoo Mail browser profile and folders is assessed separately. The provider adapter is an in-memory model, not a signed-in scan. Yahoo Mail Scrub: browser profile and folders Scaffolding only — The provider adapter is an in-memory model, not a signed-in scan.
AOL Mail — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Large job	AOL Mail browser profile and folders is assessed separately. The provider boundary is a trait/fake page, not a signed-in scan. AOL Mail Scrub: browser profile and folders Scaffolding only — The provider boundary is a trait/fake page, not a signed-in scan.
AOL Mail — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Large job	AOL Mail browser profile and folders is assessed separately. The provider boundary is a trait/fake page, not a signed-in scan. AOL Mail Scrub: browser profile and folders Scaffolding only — The provider boundary is a trait/fake page, not a signed-in scan.
AOL Mail — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Large job	AOL Mail browser profile and folders is assessed separately. The provider boundary is a trait/fake page, not a signed-in scan. AOL Mail Scrub: browser profile and folders Scaffolding only — The provider boundary is a trait/fake page, not a signed-in scan.
AOL Mail — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Large job	AOL Mail browser profile and folders is assessed separately. The provider boundary is a trait/fake page, not a signed-in scan. AOL Mail Scrub: browser profile and folders Scaffolding only — The provider boundary is a trait/fake page, not a signed-in scan.
iCloud Mail — Scrub Discovery OSL finds possible exposed messages in only the exact approved account and place.	Scaffolding only Needed for V1 Large job	iCloud Mail browser profile and mailbox folders is assessed separately. Only shared snapshot readers exist, with no shipping scan. iCloud Mail Scrub: browser profile and mailbox folders Scaffolding only — Only shared snapshot readers exist, with no shipping scan.
iCloud Mail — Scrub Stop and resume A person can stop an attended scan and later resume without inventing progress.	Scaffolding only Needed for V1 Large job	iCloud Mail browser profile and mailbox folders is assessed separately. Only shared snapshot readers exist, with no shipping scan. iCloud Mail Scrub: browser profile and mailbox folders Scaffolding only — Only shared snapshot readers exist, with no shipping scan.
iCloud Mail — Scrub Finding preview Review shows the exact provider message and its scope before any destructive choice.	Scaffolding only Needed for V1 Large job	iCloud Mail browser profile and mailbox folders is assessed separately. Only shared snapshot readers exist, with no shipping scan. iCloud Mail Scrub: browser profile and mailbox folders Scaffolding only — Only shared snapshot readers exist, with no shipping scan.
iCloud Mail — Scrub Reviewed deletion Only a separately selected and confirmed provider message is submitted for deletion.	Scaffolding only Needed for V1 Large job	iCloud Mail browser profile and mailbox folders is assessed separately. Only shared snapshot readers exist, with no shipping scan. iCloud Mail Scrub: browser profile and mailbox folders Scaffolding only — Only shared snapshot readers exist, with no shipping scan.

OSL Chats

Shell, navigation, and empty states

Feature	Status	Where it actually is
Open OSL Chats Home opens the first-party encrypted messenger.	Built, never proven Needed for V1 Tried and failed / platform forbids it	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Friends dropdown The Chats shell can open and manage the Friends list.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Direct, Groups, and Enclaves filters The conversation list can be narrowed to each native conversation type.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Start Something A single picker starts a direct chat, group, or Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pinned conversations Pinned threads remain separate from recent conversations.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pin or unpin conversation A conversation menu changes whether it is pinned.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Mute conversation A conversation can stop creating local alerts.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Leave group or Enclave The conversation menu can leave a selected multi-person space.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Mention badge Unread mentions have a distinct badge.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Key-change list warning A conversation row indicates that trust needs review.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Expandable Enclave channel tree An Enclave row expands into its channels.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Remembered personal layout Collapsed state and ordering remain personal to the device.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No-friends state Chats plainly explains when no eligible friends exist.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Groups-empty state The Groups view has a specific empty state.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Enclaves-empty state The Enclaves view has a specific empty state.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No-active-thread state The reading pane explains when no conversation is selected.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Empty-message-thread state An existing conversation with no messages has its own empty state.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Offline state Chats distinguishes being offline from an empty conversation.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Relay-unavailable state Chats distinguishes service failure from being offline.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Loading and error states Chats exposes loading and named failure states.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Direct messages

Feature	Status	Where it actually is
Create exact two-person DM A direct conversation contains exactly two verified people.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Always-protected DM send OSL Chats refuses an unprotected direct-message send.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Two-way protected DM delivery Two OSL identities can exchange protected direct messages through the deployed service.	Working Needed for V1	This path has a recorded QA-build two-way service proof, though not a release-build proof.
Local DM history Delivered direct messages persist in the encrypted local archive.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Typing indicator A direct conversation shows when the other person is typing.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Reply to message A reply quotes and cryptographically binds its target.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Edit own message A sender can edit their own message and the row is marked edited.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Reaction A person can add or remove an authenticated emoji reaction.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pin message A selected message can be pinned in the conversation.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Search conversation A person can search permitted local direct-message history.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Direct-message timer A direct message can use the native expiry rules.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Direct-message view once A direct message can be consumed once.	Partly there Needed for V1	Atomic consumption exists, but the complete recipient UI is missing.
Safety-number panel A direct chat can open its exact safety number.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Key-change banner and composer gate A loud banner blocks sending until the changed identity is verified.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Block from conversation A direct chat can locally block or unblock the other person.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Message request An eligible non-contact can ask to begin a conversation.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Direct voice call A direct chat can start an encrypted voice call.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Direct video call A direct chat can start an encrypted video call.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Linked-device view A direct chat can show which authorized devices are involved.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Proof and receipt view A person can inspect protected-send proof and receipt facts.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Groups

Feature	Status	Where it actually is
Create group A person can create a native encrypted group from selected verified people.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Twenty-person group cap A native group accepts at most twenty people.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Signed group invitations Invitations are bound to the exact invited identity and group.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group member roster The group shows its exact current members.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Invite existing friend A group can invite another eligible verified friend.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Remove group member An authorized group change removes a member and updates access.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Encrypted group delivery One group message encrypts to every exact current recipient.	Partly there Needed for V1	Multi-recipient machinery exists, but a packaged group lifecycle is not established.
Group attachments A group can exchange encrypted attachments.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group typing Group typing state is scoped to the group.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group reactions Reactions in a group authenticate the reacting member.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group replies Replies stay bound to the original group and message.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group edits Only the original sender can edit a group message.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group pins Authorized members can pin and unpin group messages.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group search Permitted local group history is searchable.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group timer A group message can expire for the group.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Group view once A group view-once message follows one-open rules per intended recipient.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Leave-and-rekey group Leaving updates the recipient set for future messages.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Composer and messages

Feature	Status	Where it actually is
Protected text composer The native composer accepts private text without carrier cover.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Send action The native Send control commits only a protected payload.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Reply mode Selecting Reply adds a clear target banner to the composer.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Edit mode Editing an own message adds an edit banner and revision state.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Blocked-user banner A blocked conversation replaces sending with an honest refusal and Unblock action.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Chosen-audience banner Selective visibility is shown above the draft before send.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Attachment plus menu One plus menu exposes file, GIF, poll, visibility, spoiler, and timer actions.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Emoji picker The composer can insert an emoji or choose a reaction.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
GIF as encrypted media OSL downloads a chosen GIF once and then sends it as encrypted media.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Poll composer A poll contains a question and two or three encrypted voting choices.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Poll vote and totals Members can vote or unvote and see totals without a false anonymity claim.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Selective visibility include list A message can be limited to chosen members.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Selective visibility exclude list A message can hide from chosen members.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Spoiler reveal Spoiler content remains hidden until the recipient chooses to reveal it.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Next-message timer A timer may apply only to the next message.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Custom timer A person can enter an allowed custom expiry.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Message context actions The row menu offers reactions, Reply, Pin, own-message Edit, Block, and message facts.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Sent/delivered/read status A message row distinguishes the available delivery states.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
End-to-end marker A message row exposes its protected status.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Mention highlighting A mention of the current person is visually distinct.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pinned-message strip The active thread exposes pinned content in a dedicated strip.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Composer refusal state A blocked, offline, or invalid send names why it did not send.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Attachments and media

Feature	Status	Where it actually is
Encrypted file attachment A file is encrypted before it leaves the device.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Encrypted text-note attachment Typed text can be carried as an encrypted attachment rather than an unencrypted carrier file.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Sixteen-file tray One message accepts at most sixteen attachments.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Free 25 MB file limit A Free sender can attach files up to 25 MB each.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pro 1 GB file limit A Pro sender can attach files up to 1 GB each.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Drag-and-drop files Files can be dragged into the attachment tray.	Partly there Needed for V1	Installed folder drag-and-drop is explicitly unsupported.
Folder-drop refusal Dropping a folder refuses without silently attaching its contents.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Clipboard image intake A knowingly pasted image can enter the native composer.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Remove one attachment A person can remove one file without clearing the rest of the tray.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Upload progress and resume A large encrypted upload reports progress and can resume safely.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Received attachment open An authorized recipient can open the decrypted file locally.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Attachment expiry Expired attachment keys make the file unreadable under the selected policy.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Attachment view once An attachment can be consumed once.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Metadata stripping Selected file metadata is removed before protected upload.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Free attachment custody disclosure Free files are described as encrypted at rest, not falsely called service-opaque E2EE.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Paid client-only custody Paid attachment custody keeps file plaintext from the OSL operator.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Malware scan before open Received protected files are scanned before normal opening.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Requests, safety, and states

Feature	Status	Where it actually is
Accept message request A reviewed request can become a Chats contact.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Decline message request A request can be refused without opening a conversation.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Empty request state The request list plainly shows when nothing is waiting.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No central reports Chats contains no report-to-OSL action or evidence upload.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No central bans OSL has no central plaintext ban or moderation path.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No relay content review The relay cannot read Chats content to enforce policy.	Working Needed for V1	The deployed ciphertext-only proof demonstrates this storage boundary.

Enclaves and community

Enclave lifecycle

Feature	Status	Where it actually is
Create Enclave A person can create an uncapped encrypted community space.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Join by invitation An exact signed invitation can add a person to an Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Two-approval joining An Enclave may require two existing-member approvals.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Joining questions Approvals can be bound to the applicant’s exact answers.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Leave Enclave A member can leave and lose future access after rekey.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Uncapped membership contract The product imposes no fixed member cap and instead refuses at measured limits.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Owner and co-owner An Enclave can have owners and explicitly warned co-owners.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Grant co-owner warning Granting co-owner clearly says they may remove owners or delete the Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Delete Enclave confirmation Deletion names real member, channel, and item counts.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Membership rekey Join and removal operations rotate future access keys.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Visible rekey progress A long rekey shows measured progress before access changes are claimed complete.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Removed-member cutoff A removed member cannot read or write new content after successful rekey.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Encrypted Enclave export/import An Enclave can be ported without exposing protected content.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Categories, channels, and interaction types

Feature	Status	Where it actually is
Category tree Channels can be grouped in arbitrary named categories.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Create, rename, delete category Authorized members can maintain the category tree.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Reorder categories and channels A person can drag categories and channels into a chosen order.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Text channel An Enclave can contain encrypted text channels.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Voice channel An Enclave can contain encrypted voice rooms.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel topic A channel can show a scoped topic.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel icon A channel can use a chosen icon.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Locked-channel reason A visible but inaccessible channel explains why it is locked.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel read/post permissions Each text channel controls who can view and post.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Voice join/speak permissions Each voice room controls who can join and speak.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel override precedence A channel rule overrides the Enclave default.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Slow mode Text channels offer Off, 10 seconds, 1 minute, or 10 minutes.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
NSFW blur A channel can blur marked sensitive content by default.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Spoiler by default A channel can hide all new content behind an explicit reveal.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Thread A channel can open a permission-inheriting side thread.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Forum channel An Enclave can organize discussions as forum posts.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Event and RSVP An Enclave can schedule an event and collect encrypted RSVPs.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Stage voice Selected speakers address a listen-only audience.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Pinned messages Authorized members can maintain channel pins.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Scheduled messages An authorized message can be scheduled for later delivery.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
One-way broadcast A channel can publish a one-way announcement.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Roles and local governance

Feature	Status	Where it actually is
Custom roles Enclaves can create roles beyond the default names.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Default Steward role Steward is a default role, not a hard-coded permission ceiling.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Default Builder role Builder is a configurable default role.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Default Everyone role Everyone supplies baseline permissions.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Create, edit, delete role Authorized members can maintain role names, colors, order, and permissions.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Role hierarchy A role holder can change only lower-ranked roles.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Permission catalogue Posting, inviting, managing roles, burning, channel access, and similar actions resolve through one catalogue.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel-scoped role override A role can have different access in one channel.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Self-assign role An Enclave may expose approved roles members can choose themselves.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Member removal An authorized local action removes a member only from the selected Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Member mute An authorized local action mutes a member only in the selected Enclave or voice room.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Channel restriction An authorized local action limits posting or access in one channel.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Signed local message delete An authorized role holder may delete a message within their own Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No effect outside Enclave Enclave governance cannot alter the person’s account, other Enclaves, or DMs.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No report action Governance menus do not send reports or plaintext evidence to OSL.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Local AutoMod and bots

Feature	Status	Where it actually is
Local AutoMod rules Members can configure Enclave-scoped patterns checked only after authorized decryption.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Withhold behind reveal A local AutoMod match can hide content until an authorized person reveals it.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No server plaintext inspection AutoMod does not give the relay or OSL operator message plaintext.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No central appeals or reputation AutoMod creates no central evidence, appeal, or reputation system.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Signed bot participant A bot has its own signing key and is an explicit protected participant.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Bot package digest The bot record binds the exact code package digest.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Add or remove bot An authorized member can add or remove the bot participant.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Bot key-sharing warning Adding a bot names the operator, channels, and history it can read.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Per-channel bot permissions READ, POST, and COMMANDS are granted separately by channel.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No bot admin path A bot cannot receive an administrative shortcut around the permission resolver.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
One-way Discord bridge bot A signed bot can copy from one named Discord channel in one direction.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

History, beacons, and voice

Feature	Status	Where it actually is
New-member history off by default Joining an Enclave does not reveal old messages unless the Enclave explicitly enables history.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Post-epoch history only A joiner can receive only messages after the chosen history-setting epoch.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Current-member history re-share A current online member re-encrypts allowed history to the joiner.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Named history sharer The joiner can see which member supplied the history.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No relay old keys The service never keeps old group keys for future joiners.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Create beacon An authorized member can create a one-way Enclave beacon.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Subscribe without joining A person can follow a beacon without joining the Enclave.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Beacon unsubscribe A follower can stop future beacon delivery.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Beacon discussion thread Members may discuss a beacon in its Enclave side thread.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Join and leave voice A member can enter and leave an encrypted voice channel.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Per-speaker media keys Each voice speaker uses separately managed encrypted media keys.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Voice room rekey Joining, leaving, or vanishing rotates the voice-room keys.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Screen sharing An authorized voice participant can share their screen.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Docked voice panel Voice remains controllable while the person continues using Chats.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Stage listen-only audience A stage can separate speakers from listeners.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Voice audience ceiling The room refuses the next listener rather than silently degrading after a measured limit.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
No voice recording OSL does not provide a built-in recording path.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Profiles, feed, posts, and stories

Profiles

Feature	Status	Where it actually is
Edit display name A person can change the display name shown to a chosen scope.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Avatar or profile photo A person can set an image avatar.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Profile bio A person can add scoped biography text.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Profile status A person can add a current status line.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Profile background A profile card can use a selected background.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Per-scope profile override A person can present different profile fields in different audiences.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Open profile from avatar Any message, member rail, header, picker, or self-avatar opens the correct permitted profile.	Partly there Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Profile visibility enforcement A viewer receives only profile fields their relationship permits.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

OSL Feed and posts

Feature	Status	Where it actually is
OSL Feed surface A separate encrypted feed shows chosen-audience native posts.	Scaffolding only Needed for V1	The design and post records exist, but the standalone Feed route is not established as a working product.
Feed empty state The Feed plainly shows when no permitted posts are available.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Feed audience chooser A post can target verified friends, a close circle, or one Enclave.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Create text post A person can publish an encrypted text post to the chosen audience.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Attach post image A real image can be encrypted with the post.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Edit own post A post author can change their own post.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Delete or burn own post A post author can remove or expire their own post.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Post expiry A post can stay or expire after 24 hours or seven days.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Post reactions Authorized viewers can react to a post.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Post replies Authorized viewers can reply according to the selected reply scope.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Post echo An allowed viewer can echo a post within the permitted model.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Saved posts A person can keep a local saved-post list.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Feed profile view The Feed opens the permitted profile and that person’s posts.	Scaffolding only Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Stories

Feature	Status	Where it actually is
Create story A person can create a scoped encrypted story.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Text story A story may contain text only.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Image story A story may contain a decoded local image.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Color story A story may use a selected color background.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Story audience Each story is encrypted only to its chosen audience.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Story expiry A story can expire after one, twelve, or twenty-four hours.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Story viewer Authorized viewers can move through story frames.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Named viewer mode The viewer is named to the poster by default.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Anonymous user mode The viewer may appear to the poster only as the literal word user.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Hidden viewer mode The viewer may be omitted from both the viewer list and count.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Viewer choice before open The viewer identity mode is fixed before the story opens.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Non-retroactive viewer choice Changing the viewer mode does not rewrite earlier views.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Relay-blind viewer identity The relay does not learn the viewer identity choice.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.
Story archive The person can keep the ruled local story archive.	Built, never proven Needed for V1	The feature has code or task-backed UI, but D68 rejected the Chats screens and no packaged two-identity proof covers it.

Settings

Account

Feature	Status	Where it actually is
Public/private account state Switch whether the identity is publicly discoverable.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Edit public username Change the public username subject to its lock.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Thirty-day username lock Show when another username change becomes available.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Private invite link Create and knowingly copy the private friend link.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Pro code Redeem a prepaid Pro code.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Recovery kit View and replace recovery material.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Relay allowance meter Show data relayed through OSL this period.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Local encrypted storage meter Show encrypted history and attachment storage.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Enclave media meter Show storage used by Enclave media.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Buy more data Open the data-pack purchase flow.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Overage policy Explain that OSL slows or refuses instead of surprise billing.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Device list and removal Manage the two authorized devices.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Account reset Reset selected local account state after confirmation.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Account burn Permanently stop and burn the account after exact confirmation.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Account loading/locked/unavailable states Show honest account states rather than a fake populated page.	Partly there Needed for V1	The Account design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Apps

Feature	Status	Where it actually is
Connected account list Show every connected service account and profile.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Import or sign in Add an already signed-in browser or native-app profile.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Native app profile choice Choose the exact native-app profile OSL may use.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Browser profile choice Choose the exact browser profile OSL may inspect.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Desktop versus Web choice Choose Desktop or Web independently where both exist.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Outlook Web versus Desktop Treat Outlook Web and Outlook Desktop as separate capability surfaces.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Connected state Show whether the selected profile is actually connected.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Honest unavailable state Keep an unproved carrier visible only as unavailable.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Disconnect local state Remove local tokens, mapping, cached geometry, and pointers for one connection.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
No remote retraction claim Disconnect explains that already-sent carrier records remain.	Partly there Needed for V1	The Apps design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Privacy

Feature	Status	Where it actually is
Tor or Direct route Choose the OSL network route.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Mullvad route status Show Mullvad only when its installed control is provable.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Start Mullvad on launch Optionally launch and connect Mullvad with OSL.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Clipboard send mode Use person-controlled copy and paste without OSL touching the clipboard.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Double Enter send mode Use the second Enter as the selected protected send trigger.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Single Enter send mode Use one Enter only after the required danger acknowledgement.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Insert-on-send cover Place cover when the protected send is committed.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Natural-typing cover Use the Pro natural-typing presentation where proved.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Unprotected-message check Warn before a risky unprotected send.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Protected-message check Check protected policy before placement.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Attachment metadata check Strip or warn about selected file metadata.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Incoming link and scam warning Apply local warnings after authorized receipt.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Carrier discovery visibility Choose Anyone, Allowed people, or Never for being seen as an OSL user.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Reply to discovery pings Choose whether OSL answers mutual-discovery probes.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Separate friend/contact lists Keep OSL friends and Chats contacts independent.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
OSL addability Choose invite-only, public-ID, or nobody.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Chats addability Choose friends, username, or nobody.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Profile visibility Choose private, friends, or link-visible profile access.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Transfer requests Allow or refuse friend-to-Chats transfer requests.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Message requests Allow or refuse message requests.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Required request note Require a one-line identity note with requests.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Auto-mirror friends Optionally add matching entries to the other list.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Old-message forward secrecy Choose locked-forever or readable old messages.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Low Data mode Require live reachability and keep zero parked relay bytes.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Tor and OSL LAN exclusion Prevent Tor and OSL LAN from being enabled together and explain why.	Partly there Needed for V1	The Privacy design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Security

Feature	Status	Where it actually is
Change main password Replace the local main password.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Stealth password Set a password that opens a clean-slate but fully working OSL workspace.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Burn password Set or revoke the destructive sign-in password.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Safety number and reverification Open trust details and resolve a key change.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Device security Review and remove authorized devices.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Timer defaults Choose default expiry behavior.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Delete unsent private material Choose cleanup when OSL locks.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Delete expired old messages Choose local cleanup after expiry.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Capture-protection request Request best-effort capture protection without promising prevention.	Partly there Needed for V1	The Security design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Whitelist

Feature	Status	Where it actually is
Default deny New people and places begin refused.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Person-and-place scope A DM permission never silently covers a server or group.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Verify before allow Whitelist becomes available only after safety-number trust.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Auto-revoke on key change A changed key removes the allow state.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Loud refusal A refused protected send names the reason and never sends plaintext.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Default expiry Never Keep a whitelist until manual revoke.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Default expiry Conversation Remove permission when the conversation ends.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Default expiry 24 hours Use a temporary one-day permission.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Exposure roster List the exact allowed places and their exposure context.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Per-place revoke Remove one allowed place without changing siblings.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Empty and no-match states Show no conversations and search misses honestly.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Saved and unsaved states Show whether whitelist edits are persisted.	Partly there Needed for V1	The Whitelist design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Notifications

Feature	Status	Where it actually is
Friend-request alerts Choose whether local friend-request alerts appear.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Whitelist-change alerts Choose whether local whitelist alerts appear.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Scrub-finished alerts Choose whether a completed Scrub run alerts.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Per-Scrub-service alerts Choose completed-run alerts by supported service.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Notifications off state Show that alerts are disabled without losing underlying events.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Notifications empty state Show when no local events are waiting.	Partly there Needed for V1	The Notifications design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Appearance

Feature	Status	Where it actually is
System theme Follow the supported system appearance.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Dark theme Use the approved dark appearance.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Light theme Use the approved light appearance.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Accent presets Choose from approved accent swatches.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Custom accent hex Enter a valid custom accent color.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Accent color picker Choose the accent with a color picker.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Background presets Choose an approved background swatch.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Custom background Enter or pick a custom background color.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Profile display name Preview the scoped display name.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Profile status line Preview the profile status or vibe.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Avatar color Choose the avatar fallback color.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Avatar image upload/remove Choose or remove a real avatar image.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Profile-card background Choose the profile card background.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Connected-account visibility Choose which account identities appear on the profile.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Live friend-card preview See the result before saving.	Partly there Needed for V1	The Appearance design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Window and sounds

Feature	Status	Where it actually is
Remember window position and size Reopen exactly where the local window was left.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Centered default window Reopen centered at the default size.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Maximized window Reopen maximized on the chosen screen.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Master alert-sound switch Enable or silence every local OSL sound.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Pulse sound Select and preview the Pulse alert.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Glass sound Select and preview the Glass alert.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Knock sound Select and preview the Knock alert.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
No sound Choose silence for new-message sounds.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Quiet-hours switch Enable a local quiet schedule.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Quiet-hours start and end Choose the local start and end times.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Queue alerts while quiet Hold notifications locally without queuing messages.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Release alerts after quiet hours Deliver queued local alerts when the quiet period ends.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Save local settings Apply window and sound changes only to this machine.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Reset local defaults Restore the default local window and sound choices.	Partly there Needed for V1	The Window and sounds design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

About

Feature	Status	Where it actually is
Version Show the installed OSL version.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Check for updates Ask the update service for a newer release.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Update result Show current, available, failed, and deferred update states.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Unsigned-build disclosure Explain the lack of Authenticode signing.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Compatibility tuple Show the exact tested environment.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Release limitations Name carrier, accessibility, and review limitations honestly.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Support information Show the supported help path.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Legal information Show applicable terms and privacy information.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.
Device status Show an honest local readiness state without promoting carriers.	Partly there Needed for V1	The About design and parent surface exist, but real shipping controls are hidden or incompletely wired, so this is not marked working.

Home, notifications, and connected surfaces

Home launcher

Feature	Status	Where it actually is
Launcher, not dashboard Home opens product areas without a persistent sidebar.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
OSL Chats tile Home opens the native encrypted messenger.	Built, never proven Needed for V1 Tried and failed / platform forbids it	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Carrier tiles Home shows each carrier only with its honest capability state.	Partly there Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Scrub tile Home opens attended cleanup.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Friends entry Home opens friend adding, requests, and trust controls.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Settings and account entry Home opens Settings and the local account state.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Notification bell A bell opens re-homed local notifications.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Hide and arrange tiles A person can change launcher layout without changing capabilities.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Carrier unavailable state An unproved carrier refuses honestly instead of opening a fake Ready surface.	Partly there Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Home empty state Home has a specific state when no actionable tiles are available.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.
Toast Short local results can appear without becoming permanent dashboard content.	Built, never proven Needed for V1	Home is implemented, but its latest owner review remained unapproved and carrier truth is inconsistent.

Notifications

Feature	Status	Where it actually is
Local event feed Friend requests, Scrub results, and other private events stay local.	Built, never proven Needed for V1	Notification and quiet-hour code exists, though transient states have limited review.
Quiet-hours queue Quiet hours hold alerts locally and never queue protected sends.	Built, never proven Needed for V1	Notification and quiet-hour code exists, though transient states have limited review.
Post-quiet release Queued alerts appear when quiet hours end.	Built, never proven Needed for V1	Notification and quiet-hour code exists, though transient states have limited review.
Notification empty state The popover shows when no events are waiting.	Built, never proven Needed for V1	Notification and quiet-hour code exists, though transient states have limited review.
Notification-off state The popover explains when notifications are disabled.	Built, never proven Needed for V1	Notification and quiet-hour code exists, though transient states have limited review.

Retired sidebar guarantee

Feature	Status	Where it actually is
No Inbox route The retired global Inbox is not a shipping navigation route.	Built, never proven Needed for V1	Useful content was re-homed into Home notifications and Settings.
No People route The retired global People screen is not a shipping navigation route.	Built, never proven Needed for V1	Useful content was re-homed into Home notifications and Settings.
No Privacy route The retired global Privacy screen is not a shipping navigation route.	Built, never proven Needed for V1	Useful content was re-homed into Home notifications and Settings.
No Activity route The retired global Activity screen is not a shipping navigation route.	Built, never proven Needed for V1	Useful content was re-homed into Home notifications and Settings.
No Connections route The retired global Connections screen is not a shipping navigation route.	Built, never proven Needed for V1	Useful content was re-homed into Home notifications and Settings.

Local data, network, export, and destructive exits

Local-first storage

Feature	Status	Where it actually is
Encrypted local archive Retained messages and settings remain encrypted on the device.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Zero-allowance local reading Existing local messages remain readable when data allowance is empty.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Zero-allowance local search Existing permitted local history remains searchable at zero allowance.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Zero-allowance attachment open Already downloaded attachments still open at zero allowance.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Unmetered local data Keeping and reading local data does not consume relay allowance.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
No read-only downgrade Running out of allowance does not silently damage the local archive.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Ordinary offline-send refusal An offline send refuses immediately and leaves the draft local.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Low Data zero parking Low Data keeps exactly zero unsent protected bytes at the relay.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Low Data reachability gate Low Data sends only while the recipient is reachable.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
No Low Data fallback Low Data never silently falls back to ordinary parked delivery.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Free seven-day relay retention Free relay objects expire after seven days.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Pro thirty-day relay retention Pro relay objects may remain available for thirty days.	Partly there Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Downgraded-file seven-day rule A file returns to seven-day retention after Pro ends.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.
Stored-versus-moved meters The UI separates local storage from data moved through OSL.	Built, never proven Needed for V1	Storage and metering rules are implemented in pieces; the complete release proof is still open.

Tor, Mullvad, and network behavior

Feature	Status	Where it actually is
OSL-owned Tor sidecar OSL manages its own Tor connection rather than borrowing an unknown proxy.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Tor bootstrap states The UI shows starting, ready, failed, and retry states.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Tor fail closed A Tor-selected send never silently escapes to Direct.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Tor-specific timeout Tor operations use honest longer timeouts.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Tor bridge support A person can configure a bridge where needed.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Direct route A person can deliberately use the direct OSL network route.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Tor and LAN mutual exclusion Tor and local-LAN mode cannot run together and the UI explains why.	Built, never proven Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Mullvad detection Settings detects whether a controllable Mullvad install exists.	Partly there Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Mullvad startup control OSL may launch/connect Mullvad only after the real installed control is proved.	Partly there Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.
Voice-over-Tor limitation Voice clearly explains when it cannot remain on Tor or requires an explicit route change.	Scaffolding only Needed for V1	Tor code and settings exist; Mullvad and voice-route behavior are not fully proven.

Export and import

Feature	Status	Where it actually is
Encrypted personal export A person can create an encrypted portable archive.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Export exclusions list The export names every category deliberately left out.	Built, never proven Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Export identity and keys The archive includes enough identity and key material for the promised restore.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Export friends and conversations The archive includes relationship and conversation structure.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Export content and attachments The archive includes selected protected content and files.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Export settings and memberships The archive includes settings and community membership state.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Exclude payment and vouchers Payment facts and voucher state never enter the personal archive.	Built, never proven Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Clean-install import A new installation can import the encrypted archive.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.
Functional export round trip After import the restored account can actually use its content and relationships.	Partly there Needed for V1	Export/import code and UI states exist, but the complete clean-install functional round trip was never shown.

Destructive exits

Feature	Status	Where it actually is
Local burn-password wipe Using the correct burn password permanently erases local OSL data.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Wrong burn password harmless An incorrect burn password does not erase data.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Message burn confirmation A message burn names its exact target and survivors.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Conversation burn confirmation A chat burn names real counts and affected people.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Enclave burn confirmation An Enclave burn names members, channels, and items.	Partly there Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
App burn confirmation An app burn names local connection/history removal and remote limits.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Account burn confirmation An account burn states permanence and remote best-effort limits.	Partly there Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Back is no-op Leaving a destructive confirmation without approval changes nothing.	Built, never proven Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Stop-account seven-day cleanup Stopping an account schedules bounded deletion of messages, files, keys, settings, sessions, and the account record.	Scaffolding only Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.
Permanent name tombstone Stopping the account leaves the public name permanently unavailable.	Scaffolding only Needed for V1	Local burn code exists; broad account and remote cleanup remain only partially established.

Data packs, Pro, and payments

Plans and allowances

Feature	Status	Where it actually is
Free tier Free use retains its stated subsidy and daily-message cap.	Built, never proven Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Pro tier Pro unlocks creation-side features and larger retention without charging recipients.	Built, never proven Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Starter pack Starter costs $2.99 for 5 GB of data.	Partly there Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Standard pack Standard costs $5.99 for 50 GB of data.	Partly there Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Archive pack Archive costs $11.99 for 150 GB of data.	Partly there Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
No paid daily-message cap Paid packs limit data, not the number of messages per day.	Partly there Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Ninety-percent warning The meter warns before the allowance is exhausted.	Built, never proven Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Hard-cap refusal or slowing At the cap OSL refuses or slows honestly and never surprise-bills.	Built, never proven Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.
Itemized usage Relay, storage, download, voice, second-device, and background-cover costs are shown separately.	Partly there Needed for V1	Plan UI/models exist, but code still contains conflicting monthly labels and no live cost proof.

Purchase rails

Feature	Status	Where it actually is
Card purchase choice A person may buy a voucher by card through Stripe.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Bitcoin purchase choice A person may buy a voucher with Bitcoin.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Monero purchase choice A person may buy a voucher with Monero.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Stripe identity disclosure The card flow says Stripe knows the payer.	Built, never proven Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Bitcoin public-ledger disclosure The Bitcoin flow says the payment is publicly visible.	Built, never proven Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Monero privacy disclosure The Monero flow explains its private payment property without linking it to the account.	Built, never proven Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
No refunds Every purchase flow clearly says purchases are non-refundable.	Built, never proven Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Crypto address and amount Crypto purchase shows the exact address and amount.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Confirmation progress Crypto purchase distinguishes pending confirmations from success.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Purchase failure A failed rail reports failure without issuing allowance.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Underpayment A short crypto payment remains distinct from success.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Overpayment An excess crypto payment is handled under the stated no-refund policy.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.
Payment network error Network failure remains different from payment rejection.	Scaffolding only Needed for V1	Only in-memory purchase models exist; no live processor or chain integration is established.

Anonymous voucher

Feature	Status	Where it actually is
Opaque one-use voucher A purchase returns a voucher rather than adding credit directly to an account.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Separate voucher redemption The voucher is redeemed in a later step separate from payment.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Unlinkable purchase and account OSL cannot link the payment event to the account that redeems the voucher.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
No OSL payment storage OSL stores no card or cryptocurrency payer data.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Redeem data allowance A valid voucher adds exactly its purchased data.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Empty voucher state Blank voucher input has its own refusal.	Built, never proven Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Invalid voucher state An unknown voucher is rejected.	Built, never proven Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Used voucher state A redeemed voucher is permanently rejected on reuse.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Voucher network-failure state A connectivity failure is not shown as an invalid code.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.
Voucher success state Successful redemption names the allowance added.	Scaffolding only Needed for V1	The models are local/in-memory and therefore do not establish real anonymous redemption.

Every screen, popup and overlay

Your rule: a surface is not done until you have approved it here — including popups, overlays, the composer and the eye. "design" says whether a design page exists; "you" says whether you have ever approved it.

First run

Account

Surface	Status	Where it actually is
001 Create account The entry screen for someone opening OSL without an unlocked account. It offers two paths: create a new OSL identity, or use recovery material for an identity they already have.	Built, never proven Needed for V1	Accepted in D62. design: yes · you: approved
002 Create a password This page asks a new person to create and confirm the main password that will unlock OSL on this device. The current rule is a minimum of 12 characters with a strong enough password, and eye controls let the person check what they typed before continuing.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved

Recovery

Surface	Status	Where it actually is
003 Recovery-protection refusal This belongs to a superseded design that refused to reveal recovery words when the operating system could not guarantee screen-capture protection. It was replaced by the Recovery kit page, which always shows the recovery material while OSL merely requests whatever capture protection the operating system provides.	Scaffolding only Superseded — not V1 work	D48/D55 delete it; it must not return. design: retired · you: seen not approved
004 Recovery kit This page presents the two parts of the recovery kit: an identity phrase for recovering who the person is and a password phrase for recovering their protected data. The person can copy or download the kit, is warned that both parts are needed, and must acknowledge saving it before continuing.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved
005 Recovery-word check This belongs to a superseded design that asked the person to prove they had saved their recovery words by re-entering selected words on a separate page. It was replaced by the Recovery kit page and the requirement to save, reopen, and authenticate the actual kit rather than pass a standalone word quiz.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
021 Password recovery This is the password-reset path opened when a returning person chooses that they forgot their password. They enter the twelve-word password recovery phrase or load it from a recovery-kit file, verify it locally, and use it to choose a new main password.	Built, never proven Needed for V1	Accepted in D56. design: yes · you: approved
022 Key lost This terminal page appears when the current device no longer has a key capable of opening the account. It explains that ordinary sign-in cannot continue and offers the recovery-phrase route needed to restore access on the device.	Built, never proven Needed for V1	Accepted in D58 and listed again in D67. design: yes · you: approved
023 Restore account This page restores an existing OSL identity on a replacement or reset device. The person enters the identity recovery phrase or uploads a recovery kit, creates and confirms a new local password, and then starts the account-restoration process.	Built, never proven Needed for V1	Accepted in D56. design: yes · you: approved

Identity

Surface	Status	Where it actually is
006 Identity choice, State A This onboarding page asks how other people should be able to find the new identity. The person can claim an exact searchable public name, subject to the displayed naming rules, or continue without a public profile and remain unavailable to public search.	Built, never proven Needed for V1	Accepted in D56 after 006/007 were combined. design: yes · you: approved
006/007 minted-link State B This belongs to a superseded onboarding design that minted a one-use invitation link, displayed its 24-hour expiry, and let the person copy or replace it. That link-making flow was removed from onboarding and replaced by the invitation controls in the Friends add panel.	Scaffolding only Superseded — not V1 work	D53 removes State B from onboarding. design: retired · you: seen not approved

Privacy passwords

Surface	Status	Where it actually is
008 Stealth password This optional page creates a separate stealth password for use at sign-in. The person confirms their current password, enters the new stealth password twice, and can either save it or skip; using it is meant to open an ordinary empty OSL workspace instead of the real account.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved
009 Burn password This optional page creates a separate burn password that permanently erases local OSL data when entered at sign-in. The person confirms their current password, enters the burn password twice, and types ERASE before enabling it, or skips the feature.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved

Tier

Surface	Status	Where it actually is
010 Pro code entry This onboarding page is where a person enters a Pro or voucher code. They can continue with the code for checking and redemption, or skip the step and keep using the free tier.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved
011 Pro active morph This is the success state of the Pro-code page after a code has been submitted. The entry control changes through checking to a clear Code activated confirmation, after which the person continues onboarding; before activation, the same surface also offers Skip.	Built, never proven Needed for V1	Accepted in D46. design: yes · you: approved

Privacy

Surface	Status	Where it actually is
012 Onboarding privacy / send checks This page sets the local checks OSL should perform before a message leaves the device. The person chooses whether to check unprotected messages, protected messages, and file metadata, with the metadata choice offering Always, Ask, or Never so no privacy default is hidden.	Built, never proven Needed for V1	Accepted in D46 after the authority pairing was corrected. design: yes · you: approved
017 Visibility onboarding This belongs to a superseded onboarding design that asked whether other people could tell the person used OSL, using Silent and Visible choices. The separate step was removed; current discovery and profile-visibility choices belong in Settings → Privacy instead of first run.	Scaffolding only Superseded — not V1 work	D43 deletes it; the spec says no Visibility onboarding page, but its manifest still says routed. design: retired · you: seen not approved

Connection

Surface	Status	Where it actually is
013 Choose connection This page asks how OSL should connect to its relay services. The person chooses either Tor, with the slower travel-time estimate shown, or a faster direct connection; neither route should be silently chosen for them.	Built, never proven Needed for V1	Accepted in D56. design: yes · you: approved

Defaults

Surface	Status	Where it actually is
014 Old-message defaults This page sets what happens to older messages if someone later gets access to the computer. The person chooses between keeping old messages locked, which limits what a break-in can read but may lose an in-transit message during a badly timed restart, and keeping them readable, which favors continuity but exposes more stored history.	Built, never proven Needed for V1	Accepted in D46; earlier accepted in D43. design: yes · you: approved

Sending

Surface	Status	Where it actually is
015 Sending behavior This page chooses the universal action used to send through outside chat and mail apps: Clipboard, Double Enter, or Single Enter. The two automatic Enter modes show prominent risk warnings and require an explicit acknowledgement that an app change could otherwise target the wrong conversation.	Built, never proven Needed for V1	Accepted in D56. design: yes · you: approved

Cover

Surface	Status	Where it actually is
016 Cover insertion This page chooses how harmless cover text is placed into an outside app when a protected message is sent. The free option inserts it at send time, while the Pro option presents it as natural typing; animated examples show the visual difference before the person continues.	Built, never proven Needed for V1	Accepted in D56. design: yes · you: approved

Cleanup

Surface	Status	Where it actually is
031 Cleanup / Device Storage This first-run page sets local cleanup preferences for unsent private drafts and old messages kept on the device. The person toggles each kind of data independently, with a reminder that retained material stays encrypted and deletion still requires confirmation.	Working Needed for V1	Accepted in D68 after slider behavior was fixed; D46(b) places it in first run after Cover. design: yes · you: approved

Browser import

Surface	Status	Where it actually is
018 Browser import This page lists supported browser profiles that OSL may inspect for already signed-in accounts without opening saved passwords or login stores. The person selects individual profiles, can choose more than one from the same browser, and may continue with the selection or defer the import with Not now.	Working Needed for V1	D68 accepts it only after the multi-profile behavior was demonstrated. design: yes · you: approved
Browser profile dropdown This popover opens when the person clicks Choose profiles on a browser card that has more than one profile. It lists profiles such as Default, Work, or School with separate checkboxes so consent applies only to the accounts the person selects.	Scaffolding only Needed for V1	D68 accepts numbered screen 018 after this behavior was proven, but does not separately accept the open dropdown UI. design: yes · you: seen not approved
Browser “none found” This state replaces the browser cards when no supported browser profiles are detected. It says that none were found and lets the person continue without importing anything, so an empty scan is not mistaken for a broken selector.	Scaffolding only Needed for V1	The approved ruling proves the real multi-profile path, not this synthetic empty state. design: yes · you: seen not approved

Detected apps

Surface	Status	Where it actually is
019 Detected apps This onboarding page lists supported desktop messaging apps and labels each one Detected or Not detected. Detected rows can be selected for use, while missing apps remain visibly unavailable, allowing the person to choose from what is actually present before continuing.	Working Needed for V1	Accepted in D68 after the Telegram/logo defect was repaired. design: yes · you: approved
Merged “Set up your apps” This belongs to a superseded design that combined detecting supported apps, selecting them, and offering installation controls on one Set up your apps page. It was replaced by the status-only Detected apps page, while browser profiles are handled separately on Browser import and missing apps are not installed from this screen.	Scaffolding only Superseded — not V1 work	Its manifest calls it retired and lists unpaired runtime routes. design: retired · you: never seen
Onboarding Mullvad This belongs to a superseded onboarding design that offered to install Mullvad or open an existing Mullvad session before first run could finish. Mullvad is no longer an onboarding step; any optional start-with-Mullvad control belongs in Settings and is shown only when OSL can honestly control the installed app.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Onboarding apps route This belongs to a superseded design lineage for choosing and setting up native apps during onboarding. It was replaced by the current Detected apps page, with browser accounts handled on Browser import, so there is no separate current Apps route in first run.	Scaffolding only Superseded — not V1 work	EDITS says the page was deleted; the live union still lists it. design: retired · you: never seen
Onboarding install route This belongs to a superseded design lineage that provided a separate installation stage for apps OSL did not find. It was replaced by Detected apps, which reports only Detected or Not detected and does not create a second install route.	Scaffolding only Superseded — not V1 work	The manifest calls the merged design retired and route accounting calls runtime install unreferenced. design: retired · you: never seen
Onboarding decoy route This belongs to a superseded design in which first run could create or enter a decoy workspace intended to conceal the real account. That behavior was removed; the separate stealth password now opens an ordinary empty OSL workspace instead, and there is no decoy onboarding page.	Scaffolding only Superseded — not V1 work	Spec says no decoy workspace; code still lists decoy. design: retired · you: never seen

Welcome and unlock

Surface	Status	Where it actually is
020 Unlock This is the unlock screen for a returning person with an account on the device. Choosing Sign in opens the password field in place, while Use recovery phrase branches to recovery when the ordinary password or local key is unavailable.	Built, never proven Needed for V1	Accepted in D62. design: yes · you: approved
Returning-user welcome This is a returning-user landing page that presents the OSL mark and two clear routes before any account is opened. The person can proceed to sign in with local credentials or choose a recovery phrase when they need to restore access.	Scaffolding only Needed for V1	This is a distinct rendered design surface, not the approved 020 unlock page. design: yes · you: never seen

Other first-run states

Surface	Status	Where it actually is
Onboarding silent-visible This belongs to a superseded onboarding design that asked the person to choose Silent or Visible and saved whether an OSL-use marker should appear. The standalone route was replaced by current privacy and profile-visibility controls in Settings → Privacy, so first run no longer stops here.	Scaffolding only Superseded — not V1 work	Current code union still lists it while EDITS says deleted. design: retired · you: never seen
Onboarding tutorial route This belongs to a superseded design that inserted a tutorial-card sequence into onboarding. It was removed in favor of the current first-run pages themselves and contextual guidance at the feature being explained, so there is no separate tutorial route to complete.	Scaffolding only Superseded — not V1 work	EDITS deletes the tutorial set, yet code still lists the route. design: retired · you: never seen
Onboarding forward-secrecy picker, empty This belongs to a superseded old-rail design that showed an empty Protect with picker and told the person to verify a friend before opening OSL's private panel. It is not a current onboarding page: old-message policy is chosen on Old-message defaults, while selecting a verified friend belongs to the current Friends and carrier flows.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Home

Layout

Surface	Status	Where it actually is
024 Home base Home is OSL's launcher after sign-in, not a statistics dashboard. It presents large entries for OSL Chats, OSL Mail, OSL Notes, and Scrub, followed by supported social and email carriers; the top bar opens notifications and Settings, and the side control opens Friends.	Partly there Needed for V1	D68 accepts how it looks but still says the notification-bell click is wrong; it is not in D68’s accepted list. design: yes · you: seen not approved
Burn-account confirmation This belongs to a superseded old-rail design and opened from its Burn local data action. It asked the person to choose the destructive scope—this chat, this app, or the entire local account—and whether it applied to this device or all devices; current burn actions instead start from the relevant current context or Settings → Account and use a current confirmation that names the real scope and consequences.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Notifications

Surface	Status	Where it actually is
Home notifications popover This popover opens when the person clicks the notification bell in Home's top bar. It lists recent local events, such as a friend request or completed Scrub run, and each row takes the person to the Friends or Scrub area where that event can be handled.	Scaffolding only Needed for V1	The outstanding bell behavior is exactly this surface boundary. design: yes · you: seen not approved
Home notifications empty This belongs to a superseded old-rail notification design and represented the state reached from Home's notification control when alerts were enabled but no local activity had occurred. It was replaced by the current Home bell popover, where an empty condition belongs inside the popover rather than on a standalone rail page.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Home notifications off This belongs to a superseded old-rail notification design and told the person that notifications were off, with a route to turn them on in Settings. It was replaced by the current Home bell popover and the notification controls in Settings, not a separate Home page.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Empty states

Surface	Status	Where it actually is
Home empty This belongs to a superseded old-rail Home design for a device with no configured supported app accounts. It showed the OSL Chat, OSL Mail, OSL Notes, Scrub, and Supported apps entries; the current Home launcher replaces it and represents absent or unavailable capabilities honestly without routing to this standalone empty page.	Scaffolding only Superseded — not V1 work	Standalone state was not one of the numbered review screens. design: retired · you: never seen

Carrier tiles

Surface	Status	Where it actually is
Home tile customize/hide mode This inline editing mode opens when the person clicks the tune/sliders icon near the upper-right of Home's launcher. Each module and carrier tile gains a minus or plus control so the person can hide it from, or restore it to, their launcher without changing whether that capability is available.	Scaffolding only Needed for V1	The 69-review manifest points to a subject route, but no owner acceptance exists. design: yes · you: seen not approved
Arrange tiles This dedicated customization page is opened from Home's tile-arrangement control. It lets the person reorder launcher tiles, hide one, restore it, and finish with those choices saved so frequently used places appear where they expect them.	Not planned at all Needed for V1	Route manifest marks it unreferenced; owner-review entry is not an approval. design: no · you: seen not approved
Tile status detail This detail page opens from a Home tile's status entry and explains what that particular service can currently be used for. It names the service, its current generated status and last update, then breaks out claims for messages, friends, and pictures so a person can see the limits behind a short tile label.	Not planned at all Needed for V1	The subject points at screen 024 rather than the status page. design: no · you: seen not approved
Mullvad workspace This workspace opens when a person chooses to use an existing Mullvad session from OSL, including an allowed start-with-Mullvad handoff. It frames the separate Mullvad window with a Back to Home control and states that OSL does not read the Mullvad account or VPN state and that OSL's capture resistance does not cover that foreign window.	Built, never proven Needed for V1	Live route is unreferenced in the route/design manifest. design: no · you: never seen
OSL Notes status This status surface opens when the person selects OSL Notes from Home while the product remains held for a later release. It explains that Notes is intended as a local encrypted workspace for writing and project files, but offers no note-editing workspace from this holding page.	Built, never proven Needed for V1	This Home workspace route exists in code but has no design or owner review. design: no · you: never seen

Friends panel

Surface	Status	Where it actually is
Home Friends panel closed/open The Friends drawer is opened and closed with the people icon at the upper-right of Home's launcher area. When open, it occupies the right side without leaving Home and provides the add, pending, verified-friend, profile, and outgoing-invitation views used to manage trusted contacts.	Scaffolding only Needed for V1	TASK 0833’s review entry points at generic Home rather than a driven panel state. design: yes · you: seen not approved
Home Friends add/list/pending These are the main states inside the Friends drawer after it is opened from Home. The person can type an exact public username or invitation, accept or decline pending requests, and open someone from the verified-friends list; the separation shows which contacts still need a trust decision.	Scaffolding only Needed for V1	No numbered review surface or verdict names these states. design: yes · you: never seen
Home friend detail/profile This profile view opens when the person clicks a verified friend in the Home Friends drawer. It shows the friend's verification state, display details, a private note field, public accounts, and per-service accounts whose whitelist permission can be toggled without notifying the friend.	Scaffolding only Needed for V1	TASK 0841 points at screen 027, not the actual Home friend detail. design: yes · you: seen not approved
Home outgoing invitations This view opens when the person clicks Outgoing at the top of the Home Friends drawer. It lists invitations they have sent, identifies whether each was a username or friend code, shows how long it has been waiting, and lets the sender cancel an invitation that is no longer wanted.	Scaffolding only Needed for V1	No review screen or ruling names it. design: yes · you: never seen

General popups

Surface	Status	Where it actually is
Generic toast This transient banner appears automatically near the top of the current screen after an action needs brief confirmation, refusal, or next-step guidance; it is not opened as a destination of its own. The design example tells the person to start a conversation from a verified friend's profile, then disappears so it does not replace the underlying Chats screen.	Scaffolding only Needed for V1	A design leaf exists; no reviewed screen or approval names it. design: yes · you: never seen
Update dialog This belongs to a superseded old-rail design and opened when OSL reported that a software update was available. It showed the new version, restart warning, GitHub release-details link, Not now, and Install & restart actions; current update information and controls belong in Settings → About instead of this retired modal.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Public Website Home This belongs to a superseded app-surface mapping: it is an external early-access marketing website, not a screen inside the OSL desktop app. Visitors could read plain explanations of message protection and Scrub and choose Free or a one-month Pro code; the current desktop equivalents are the Home launcher and Settings → Appearance, while the public site remains outside app navigation.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

OSL Chats

Direct messages

Surface	Status	Where it actually is
036 OSL Chats active thread The main OSL Chats screen with a selected conversation. A person reads the encrypted message history, checks the other person's verification state, and writes or sends messages from OSL's own composer.	Partly there Needed for V1	D68 still says Chats is too far left and not 1:1. design: yes · you: seen not approved
Chats friends dropdown A short friends list opened by the people icon in the top bar. It shows each friend's online and verification state, lets the person jump straight into a direct chat, and links back to Home for managing friends.	Scaffolding only Needed for V1	No independent verdict; parent Chats remained rejected. design: yes · you: seen not approved
Chats conversation filters/sidebar The left side of OSL Chats, where conversations are searched, filtered as Direct, Groups, or Enclaves, and selected. Enclave conversations can also be organized into collapsible, reorderable categories and channels so a person can find the right place to talk.	Partly there Needed for V1	The shared left offset is the outstanding D68 defect. design: yes · you: seen not approved
Chats category context menu A menu opened from a category's three-dot button or by right-clicking its heading in the Chats sidebar. It lets an enclave organizer rename the category, add a channel inside it, or delete the category.	Scaffolding only Needed for V1	Rename/new channel/delete menu has no independent review. design: yes · you: seen not approved
Chats conversation context menu A menu opened by right-clicking a conversation in the Chats sidebar. It provides conversation-level actions such as pinning or unpinning, muting, opening enclave settings when applicable, and leaving the group or enclave.	Scaffolding only Needed for V1	No verdict names it. design: yes · you: seen not approved
Chats pinned-message strip A narrow strip above the message history that appears after a message is pinned. It keeps the pinned text visible for quick reference and provides an × control to unpin it.	Scaffolding only Needed for V1	No independent approval. design: yes · you: seen not approved
Chats bot disclosure strip A disclosure strip above a conversation with a bot participant. It warns that the bot can read every message in this chat to do its job, while making clear that the bot sees nothing outside this chat.	Scaffolding only Needed for V1	No independent approval. design: yes · you: seen not approved
Chats header overflow A menu opened by the three-dot button in the active chat's header. It gathers less-frequent conversation actions, including chat settings, safety-number review, search, media, mute, linked devices, capability and proof explanations, and destructive burn choices.	Scaffolding only Needed for V1	No review evidence shows it opened. design: yes · you: never seen

Chat settings

Surface	Status	Where it actually is
037 OSL Chats chat settings A conversation-specific settings dialog opened from Chat settings in the active chat's three-dot header menu. It puts message lifetime, view-once defaults, cover text, notifications, receipts, typing, safety-number and device information, blocking, local history removal, and chat burning in one place.	Partly there Needed for V1	It appeared as a named scene but remained in the rejected six-scene Chats set. design: yes · you: seen not approved
Chats app customization: Background A customization pane opened by choosing Chat background in the profile/customization sheet. A person can choose or upload a background, adjust blur and motion, and decide whether the choice applies only to this chat, every chat, or also to the other participant.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats app customization: Messages A customization pane opened by choosing Messages in the profile/customization sheet. It lets a person change message density, bubble display, font, text size, corner rounding, spacing, and the color of their own messages.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats tutorial/replay pill A guided overlay started from the “How this works” pill in the lower-right corner of OSL Chats. It spotlights the logo, conversation list, new-chat control, verification states, composer, proof, and burn choices, with Back, Next, and Skip controls; the pill remains available to replay it.	Scaffolding only Needed for V1	No independent review. design: yes · you: never seen

Empty states

Surface	Status	Where it actually is
038 OSL Chats no friends The Direct tab when the person has no friends available to message. The sidebar says “No friends yet,” while the main pane explains that a conversation must be selected before messages can be read or written.	Partly there Needed for V1	D46 says the single click-through page is authority; D68 rejects Chats. design: yes · you: seen not approved
039 OSL Chats no active thread The OSL Chats screen when conversations exist but none is open. The person sees recent direct chats in the sidebar and a central prompt to select one before reading or writing messages.	Partly there Needed for V1	Same rejection. design: yes · you: seen not approved
Shipping Chats no selected conversation The shipping direct-message view before a friend has been selected. It leaves the conversation area empty except for a “Select a friend” prompt, directing the person to choose a verified friend from the list.	Partly there Needed for V1	D68 rejects Chats. design: yes · you: seen not approved
Shipping Chats empty conversation/no messages The shipping conversation view after a friend is selected but the chat has no messages. It shows the friend's readiness and verification state above a “No messages yet” placeholder, with the composer below for starting the conversation when permitted.	Built, never proven Needed for V1	No independent review. design: yes · you: seen not approved

Groups and enclaves

Surface	Status	Where it actually is
040 OSL Chats groups empty The Groups tab when the person does not belong to any group conversations. The sidebar says “No group yet,” and the main pane remains a conversation-selection prompt rather than pretending there is a thread to open.	Partly there Needed for V1	Same rejection. design: yes · you: seen not approved
041 OSL Chats enclaves empty The Enclaves tab when the person does not belong to any Enclave. The sidebar says “No enclave yet,” and the main pane explains that a conversation must be selected before anything can be read or written.	Partly there Needed for V1	Same rejection. design: yes · you: seen not approved
Chats voice participant moderation A participant menu opened by clicking another person's name in the docked voice panel. It lets an authorized person mute or unmute that participant or remove them from the voice channel without leaving the call view.	Scaffolding only Needed for V1	No review evidence shows it opened. design: yes · you: never seen
Chats member role/moderation A member menu opened by right-clicking a person in a group or Enclave's member rail. It exposes role assignment and moderation actions such as setting Steward, Builder, or Member, muting or kicking from voice, and banning from the Enclave.	Scaffolding only Needed for V1	No actual driven subject in the review manifest. design: yes · you: never seen
Chats group/enclave invite An invitation dialog opened by the add-person icon in a group or Enclave chat header. It lists friends and their verification state, lets the person invite them directly to a group or propose them for an Enclave, and explains any approval rule before a key is issued.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats enclave settings A large settings dialog opened from an Enclave's gear icon or its sidebar context menu. It is the administration hub for the Enclave's identity, roles, channels, joining and moderation rules, cleanup defaults, and bot access.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats role/permission editor The Roles section inside Enclave settings, reached by opening that dialog from the Enclave gear or context menu. It shows roles ranked from highest to lowest and lets an authorized person add or remove roles and grant permissions such as posting, inviting, managing lower roles, or burning content.	Scaffolding only Needed for V1	Review entry does not drive this exact editor. design: yes · you: seen not approved
Chats enclave customization The Customization section inside Enclave settings. It lets an authorized person change the Enclave's name, description, icon, and accent color so members can recognize the space; the design states that these details are visible only to members.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats channel settings An expandable channel editor inside Enclave settings, opened by selecting a channel row. It lets an authorized person choose the channel icon and category, set who can view, post, join, or speak, configure slow mode and spoiler or sensitive-media flags, or remove the channel.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats create channel The new-channel form opened from the Channels section of Enclave settings or the plus control beside a sidebar category. A person names the channel, chooses text or voice, and creates it so the Enclave has another organized place for conversation.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats moderation/joining The Moderation & Joining section inside Enclave settings. It lets an authorized person choose how members join, set local AutoMod strictness, allow self-assigned roles, decide who can moderate voice, and pause or resume the invite link.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats housekeeping The Housekeeping section inside Enclave settings. It controls Enclave-wide defaults for automatic message deletion, wiping a departing member's messages, and read receipts, while noting that a channel-specific setting can override them.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats bot permissions The Bots section inside Enclave settings. It lists each bot's channel scope and lets an authorized person grant only read, post, or command permissions, or add a Discord bridge with access limited to its named channel.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Start Something: group The group-creation step reached by pressing the new-chat button and choosing Group from “Start something.” A person names the group, selects friends with their verification states visible, and creates a shared conversation in which every member sees every message.	Built, never proven Needed for V1	Separate group scene. design: yes · you: never seen
Start Something: enclave The Enclave-creation step reached by pressing the new-chat button and choosing Enclave from “Start something.” A person names the Enclave, selects its initial members, chooses whether an invite link or two approvals governs joining, and creates a channel-based space sealed to its member list.	Built, never proven Needed for V1	Separate enclave scene. design: yes · you: never seen

Calls

Surface	Status	Where it actually is
Chats docked voice panel A voice-call panel docked beneath the Enclave channel list after the person joins a voice channel. It shows who is present and provides mute, screen-share, shared-browser, and leave controls so the call can be managed without covering the chat.	Scaffolding only Needed for V1	No verdict names the joined-call state. design: yes · you: seen not approved
Chats full-screen voice/video call A full-screen call overlay opened by the phone or camera icon in the active chat header. It identifies the session as an encrypted voice or video call and provides microphone, camera, and hang-up controls while the conversation is connecting or underway.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen

Blocking and trust

Surface	Status	Where it actually is
Chats key-change block A blocking composer state shown when the selected person's identity key has changed since verification. It replaces normal sending with an amber warning and a Verify action, preventing the person from addressing new encrypted messages to an identity they have not checked again.	Scaffolding only Needed for V1	Correct re-home of key-change behavior, but unapproved UI. design: yes · you: seen not approved
Chats safety-number verification A dialog opened by clicking the verification badge, choosing Safety number from the chat-header menu or settings, or following a key-change warning. It shows the conversation's 60-digit number in six blocks, explains how to compare it over a channel already trusted, and offers “Mark as verified” only for a number not previously checked.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats proof/capabilities A conversation-information dialog opened from “What OSL can do” or “Proof” in the chat-header overflow menu. It explains the protections and limits available in this chat and, for proof, lists local events such as encrypted sends, timers, refusals, and verification without including message text.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats burn-size picker The first Burn dialog opened from the chat-header menu or Chat settings. It asks the person to choose between removing this chat, every OSL conversation carried over the service, or the local account and keys, while warning that opened recipient copies and carrier history are outside its reach.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats burn confirmation The confirmation step shown after a burn size is chosen. It names the exact destructive scope and requires the person to type a matching phrase before the final Burn action is enabled, reducing accidental deletion.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Shipping Chats blocked-send The shipping composer when the selected friend is unverified, has a pending key change, has not been approved for this chat, or is otherwise not ready. It explains why sending is unavailable and keeps the send control disabled so the person can resolve the trust or permission problem first.	Built, never proven Needed for V1	No independent review. design: yes · you: never seen

Composer and messages

Surface	Status	Where it actually is
Chats message menu + emoji row A message action menu opened by right-clicking a message, with a row of common emoji reactions above it. The person can react, reply, pin, edit their own message, or block the sender without leaving the thread.	Scaffolding only Needed for V1	No review verdict names it. design: yes · you: seen not approved
Chats typing indicator A small animated line above the composer that appears while someone else is entering a message. It names who is typing so the reader can tell that a reply may be imminent without exposing the unfinished text.	Scaffolding only Needed for V1	A live active thread does not establish this timed state appeared. design: yes · you: seen not approved
Chats chosen-audience banner A banner above the composer after the person chooses a restricted audience for the next group or Enclave message. It states exactly who will receive the message or who is excluded and can be cleared before sending, preventing a selective post from looking like an ordinary all-member post.	Scaffolding only Needed for V1	No review evidence establishes this composer state. design: yes · you: never seen
Chats blocked-user composer banner A banner that replaces the normal composer after the person blocks someone in the conversation. It names the blocked person, explains that they cannot message or see the blocker's activity, and offers an Unblock control to reverse the choice.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats reply composer banner A banner above the composer opened by choosing Reply from a message's context menu. It quotes the message being answered and provides an × control to cancel, making clear what the next message will be attached to.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats edit composer banner A banner above the composer opened by choosing Edit on one of the person's own messages. It identifies the message being changed, loads its text into the composer, and provides an × control to abandon the edit.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats composer The message-writing area at the bottom of an active OSL conversation. A person types text, adds files, GIFs, polls, spoilers, audiences or disappearing timers, sees reply or edit context and trust restrictions, and presses Send to address the protected message to the selected chat.	Scaffolding only Needed for V1	The owner’s rule explicitly says the composer is its own surface; Chats was rejected. design: yes · you: seen not approved

Requests and people

Surface	Status	Where it actually is
Chats members rail The right-hand rail shown for a group or Enclave conversation. It groups people by role and online state, identifies bots and the current person, and opens a member's profile or moderation menu so participants and authority are visible beside the thread.	Scaffolding only Needed for V1	TASK 1379 points at 036 but does not prove the permissions screens were driven. design: yes · you: seen not approved
Chats profile card A profile card opened by clicking a message avatar or a person in the members rail. It shows the person's display name, handle, verification state, bio, and recent profile content, with actions to message, view posts, block, or edit the profile when it is the viewer's own.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats new-conversation picker A “Start something” dialog opened by the new-chat button at the top of the conversation sidebar. It asks whether the person wants a direct message, a small group, or a channel-based Enclave, then routes them to the appropriate participant and setup fields.	Scaffolding only Needed for V1	Picker, DM, group and enclave scenes have no independent review. design: yes · you: never seen
Chats app customization: Profile A profile customization pane opened from the person's avatar/profile entry in OSL Chats. It lets them change the display name, bio, status, card background, avatar image and colors globally or create a separate presentation for one chat, group, or Enclave without changing their cryptographic identity.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Start Something: direct The direct-message step reached by pressing the new-chat button and choosing Direct message from “Start something.” It asks for the other person's invite or username and explains that finding that identity does not verify it; the two people still need to compare safety numbers.	Built, never proven Needed for V1	Separate direct-chat scene. design: yes · you: never seen

Attachments and pickers

Surface	Status	Where it actually is
Chats attachment/message preview states The collection of message-row forms shown inside an active thread. It covers ordinary text, encrypted attachment cards, view-once items before and after consumption, replies, GIFs, polls, spoilers, bot commands, reactions, timers, encryption labels, delivery state, and other metadata so each message's content and rules are legible.	Partly there Needed for V1	Includes attachment preview, consumed placeholder, comments, poll, spoiler, bot commands, reactions and metadata. design: yes · you: seen not approved
Chats plus menu A menu opened by the plus button beside the message composer. It is the entry point for attaching a file, sending a GIF, creating a poll, choosing who sees the next message, marking it as a spoiler, or setting a disappearing timer.	Scaffolding only Needed for V1	No evidence it opened on the review site. design: yes · you: never seen
Chats attachment sheet A file-preparation dialog opened by choosing Attach a file from the composer's plus menu. A person drops or browses for a file, reviews its name and size, chooses view-once, text-only, or expiry options, and then sends it; the dialog says metadata is stripped first.	Scaffolding only Needed for V1	Sender options exist, but no independent review. design: yes · you: never seen
Chats view-once sender toggle A VIEW ONCE switch inside the attachment sheet, reached after choosing Attach a file from the composer's plus menu. The sender uses it to mark that attachment for a single opening, with the design warning that it then disappears and that a screenshot should notify the sender.	Scaffolding only Needed for V1	This sender control is distinct from the recipient open and consume journey. design: yes · you: never seen
Chats audience picker A “Who sees this message” dialog opened from the composer's plus menu in a group or Enclave. The sender chooses everyone, only named members, or everyone except named members, then applies that audience to the next message so excluded people receive nothing.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats custom timer A disappearing-timer popover opened by the clock control or the corresponding item in the composer's plus menu. It offers presets and a custom duration from one second to 24 hours for the next message, while warning that deletion cannot prevent a screenshot.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats GIF picker A media picker opened by the GIF control or Send a GIF in the composer's plus menu. It shows a grid of choices and sends the selected item as encrypted media into the current conversation.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats poll composer A poll builder opened by choosing Create a poll from the composer's plus menu. The person enters a question and at least two answer choices, then posts a poll whose votes are encrypted and visible only to the current chat.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats shared browser A shared-browser dialog opened from the Browser control in the docked voice panel. It presents one synchronized page to everyone in the call, with the host's device rendering and streaming it so other participants' browsers, cookies, and IP addresses do not contact the site.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Shipping Chats attachment refusal/offline/receipt/drop/display The shipping attachment area and its outcome messages around the OSL Chats composer. A person chooses an encrypted file, sees pending items with name, size and view-once status, opens received items in the appropriate viewer, and gets explicit feedback when selection, delivery, opening, capture resistance, or connectivity prevents the requested action.	Built, never proven Needed for V1	Current code renders these states; no owner verdict names them. design: yes · you: never seen

Feed and stories

Surface	Status	Where it actually is
Chats story settings A settings panel opened from the gear on a person's profile/story area. It lets that person choose the default story audience and lifetime, turn screenshot shielding on or off, and decide whether viewers are identified through receipts.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats post composer/image/reply/burn The post-writing area on an OSL Chats profile, opened by visiting the profile and using its post controls. A person writes text, adds an image, chooses visual styling, limits who may reply, sets whether the post burns, and publishes it to the selected encrypted audience rather than to the public web.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats story viewer A full-screen story overlay opened by selecting a story ring on a person's profile. It shows the current story with time remaining and audience context, provides previous and next navigation, and lets an eligible viewer register a like before closing it.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
Chats new-story composer/audience A story composer opened by pressing New Story on the profile screen. The person enters text or uploads an image, chooses a background and audience, reviews the visibility, burn, and screenshot-shield summary, then publishes or cancels.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
OSL Feed main feed/stories/composer The main OSL Feed page, a stream of encrypted posts and story rings from people the viewer is allowed to see. A person can choose an audience, write a post, browse stories and posts, react or save items, and open profiles; the page exists for social sharing inside verified circles rather than public broadcasting.	Scaffolding only Needed for V1	Design README says OSL Mail was cut; no D46-D68 approval names Feed. design: yes · you: never seen
OSL Feed saved empty The Saved view in OSL Feed before the person has kept any posts. It explains that saved copies live only on this device and prompts the person to like a post to retain a local copy beyond that post's timer.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
OSL Feed saved populated The Saved view in OSL Feed after posts have been kept. It lists the device-local copies with their authors and activity details and provides a Remove action, giving the person a private place to revisit or discard saved material.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
OSL Feed profile A person's OSL Feed profile page, opened by selecting their name or avatar in the feed. It shows the profile identity, bio, stories, and posts that the viewer is permitted to see, with controls to move among that person's content.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
OSL Feed profile edit The editing state of the viewer's own OSL Feed profile, opened from the profile page's edit control. It lets the person change their display name, handle, bio, avatar color, and banner, while explaining that the profile is shown only to verified people and is not published publicly.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen
OSL Feed story viewer A full-screen viewer opened by selecting a story ring in OSL Feed. It displays one story at a time with progress, author and remaining-time information, and previous, next, or close controls so the person can move through that author's permitted stories.	Scaffolding only Needed for V1	No review evidence. design: yes · you: never seen

Retired servers

Surface	Status	Where it actually is
042 OSL Servers This page belongs to the superseded OSL Servers design and was replaced by Enclaves inside OSL Chats. It presented a standalone community workspace with spaces, text and voice channels, an active channel thread, and a member list; it is recorded here to explain the old design, not as current missing work.	Scaffolding only Superseded — not V1 work	D46 corrected the numbering and removed 042; it was never accepted. design: retired · you: seen not approved
OSL Servers normal channel This channel page belongs to the superseded OSL Servers design and was replaced by Enclave channels inside OSL Chats. It showed the channel topic, encrypted message history and composer so a member could read and post in an ordinary Enclave discussion.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
OSL Servers announcement channel This one-way channel belongs to the superseded OSL Servers design and was replaced by Enclave beacon or announcement channels inside OSL Chats. It showed owner-authored notices and allowed the reader to consume or react to them without exposing a normal reply composer.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
OSL Servers read-only composer This composer state belongs to the superseded OSL Servers design and was replaced by read-only Enclave channel rules inside OSL Chats. It occupied the normal writing area but explained that the selected system or announcement channel could not accept posts, making the one-way permission visible.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
OSL Servers members rail This member rail belongs to the superseded OSL Servers design and was replaced by the group and Enclave members rail inside OSL Chats. It listed subscribers and members by role and presence so the reader could see who belonged to the space and open a person's profile.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
OSL Servers member profile This profile modal belongs to the superseded OSL Servers design and was replaced by the OSL Chats profile card opened from an Enclave's member rail. It showed a selected member's identity and role details and offered actions such as viewing their page or starting a message.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Settings

Account

Surface	Status	Where it actually is
025 Settings Account page	Working Needed for V1	Accepted in D67. design: yes · you: approved
Settings Account empty empty-state	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Settings Account loading page	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Settings Account locked page	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Settings Account unavailable page	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Settings change-password modal: main modal	Scaffolding only Needed for V1	No reviewed ID or ruling names the modal. design: yes · you: never seen
Settings change-password modal: stealth modal	Scaffolding only Needed for V1	Parent-region approval cannot be inherited. design: yes · you: never seen
Settings change-password modal: burn modal	Scaffolding only Needed for V1	Parent-region approval cannot be inherited. design: yes · you: never seen
Settings account populated identity list page	Scaffolding only Needed for V1	Only the parent Account region is approved. design: yes · you: seen not approved
Account export warning/reauthorize banner	Not planned at all Needed for V1	No owner verdict names this export journey. design: no · you: never seen
Account export writing/verifying page	Not planned at all Needed for V1	No owner verdict names them. design: no · you: never seen
Account export success/failure page	Not planned at all Needed for V1	No owner verdict names them. design: no · you: never seen
Remove Everything page	Built, never proven Needed for V1	A distinct screen exists in canonical code. design: no · you: never seen

Apps

Surface	Status	Where it actually is
026 Settings Apps page	Working Needed for V1	Accepted in D67 after behavior work. design: yes · you: approved

Friends

Surface	Status	Where it actually is
027 Settings Friends page	Working Needed for V1	Accepted in D67. design: yes · you: approved
Settings Friends requests empty empty-state	Not planned at all Needed for V1	Parent 027 approval does not cover this state. design: no · you: never seen
Settings Friends friends/accounts empty empty-state	Not planned at all Needed for V1	Parent 027 approval does not cover these tab states. design: no · you: never seen
Settings Friends requests/friends/accounts populated page	Not planned at all Needed for V1	Parent 027 approval does not prove each populated tab state. design: no · you: seen not approved

Privacy

Surface	Status	Where it actually is
028 Settings Privacy page	Working Needed for V1	Accepted in D67. design: yes · you: approved

Security

Surface	Status	Where it actually is
Settings Security page	Built, never proven Needed for V1	It was missing from the numbered pack; D57 says it ships. design: yes · you: never seen
Settings “Resist screenshots” control page	Scaffolding only Needed for V1	Current spec says this switch was removed. design: yes · you: seen not approved

Whitelist

Surface	Status	Where it actually is
029 Settings Whitelist page	Working Needed for V1	Accepted in D67. design: yes · you: approved
Whitelist no conversations/no match empty-state	Not planned at all Needed for V1	Parent 029 approval does not prove these states. design: no · you: never seen
Whitelist saved/unsaved page	Not planned at all Needed for V1	Parent 029 approval does not prove both mutation states. design: no · you: seen not approved

Scrub

Surface	Status	Where it actually is
030 Settings Scrub page	Partly there Needed for V1	Accepted in D46, with behavior explicitly still needing real wiring. design: yes · you: approved

Notifications

Surface	Status	Where it actually is
032 Settings Notifications page	Built, never proven Needed for V1	Accepted in D62. design: yes · you: approved
Notifications Scrub-scope expansion page	Scaffolding only Needed for V1	Approval of 032 does not prove this expansion was opened. design: yes · you: seen not approved

Window and sounds

Surface	Status	Where it actually is
033 Settings Window and sounds page	Built, never proven Needed for V1	Accepted in D62 after the owner’s design added it. design: yes · you: approved

Appearance

Surface	Status	Where it actually is
034 Settings Appearance page	Built, never proven Needed for V1	Accepted in D67. design: yes · you: approved
Appearance profile/account-visibility editor page	Scaffolding only Needed for V1	The parent Appearance region passed, but no ruling names this editor state. design: yes · you: seen not approved

About

Surface	Status	Where it actually is
035 Settings About page	Built, never proven Needed for V1	Accepted in D62. design: yes · you: approved
About update banner banner	Scaffolding only Needed for V1	035 approval does not establish this transient banner. design: yes · you: seen not approved

Schedule

Surface	Status	Where it actually is
Settings schedule page	Scaffolding only Needed for V1	D65 says it ships; TASK 7997 does not render the actual schedule surface. design: no · you: seen not approved

The strip and overlays

Strip

Surface	Status	Where it actually is
043 Discord OSL strip, default face overlay	Working Needed for V1	Accepted in D68 after its works-to-spec condition was met. design: yes · you: approved
Strip synthetic carrier window page	Scaffolding only Needed for V1	Synthetic carrier content is not the product and cannot prove real carrier UI. design: yes · you: seen not approved
Strip cover wrap/slice preview composer	Scaffolding only Needed for V1	No review verdict names it. design: yes · you: seen not approved
Strip proof/readback modal	Scaffolding only Needed for V1	No verdict names it. design: yes · you: seen not approved
Discord checking overlay	Scaffolding only Needed for V1	No numbered review ID or approval names it. design: yes · you: never seen

Quick settings and tutorial

Surface	Status	Where it actually is
Strip coach tour overlay	Scaffolding only Needed for V1	D68 later accepts numbered screen 043 but does not say the owner saw or accepted the tour. design: yes · you: never seen
Strip quick settings popover	Partly there Needed for V1	D62 names quick-settings parity; D68 accepts numbered screen 043, not this popover separately. design: yes · you: seen not approved

Composer and refusals

Surface	Status	Where it actually is
Strip carrier composer composer	Scaffolding only Needed for V1	The owner says the composer counts separately; D68 does not name it as an approved surface. design: yes · you: seen not approved
Strip composer-unreachable warning composer	Partly there Needed for V1	No review verdict names the warning state. design: yes · you: seen not approved
Native Discord attachment tray composer	Built, never proven Needed for V1	Shipping overlay exposes a distinct attachment surface; no approval names it. design: no · you: never seen
Strip failed-send banner banner	Built, never proven Needed for V1	Current overlay contains the banner; 043 approval does not prove it. design: no · you: never seen
Strip composer lock/off/busy/refused/unavailable composer	Partly there Needed for V1	The current matrix is broader than the reviewed default strip. design: yes · you: never seen
Strip unreachable-plaintext warning, shipping implementation banner	Partly there Needed for V1	The current warning must be reviewed in its real overlay, not inherited from HTML. design: yes · you: seen not approved

Eye and reveal

Surface	Status	Where it actually is
Strip eye closed/open reveal overlay	Scaffolding only Needed for V1	The eye is explicitly its own surface. design: yes · you: seen not approved
Native Discord protected transcript rows overlay	Built, never proven Needed for V1	Canonical renders pending/revealed rows inline; 043’s synthetic design does not prove them. design: no · you: never seen
Telegram eye/reveal state overlay	Not planned at all Needed for V1	Only code/tests establish the control; no owner review. design: no · you: never seen
Instagram eye/reveal controls overlay	Not planned at all Needed for V1 Tried and failed / platform forbids it	No design/review verdict. design: no · you: never seen
Email reading overlay overlay	Built, never proven Needed for V1	Code defines a distinct reading overlay. design: no · you: never seen

Timer and burn

Surface	Status	Where it actually is
Strip burn modal modal	Scaffolding only Needed for V1	D68 accepts numbered screen 043, not this modal separately. design: yes · you: never seen
Strip timer editor modal	Scaffolding only Needed for V1	No verdict names this editor. design: yes · you: seen not approved
Strip timed-message log modal	Scaffolding only Needed for V1	No verdict names it. design: yes · you: never seen
Timer editor overlay overlay	Not planned at all Needed for V1	Code has a scrim/panel; screenshots are fixtures, not owner approval. design: no · you: never seen

Whitelisting

Surface	Status	Where it actually is
Strip whitelist modal modal	Partly there Needed for V1	D56 names the full-popup defect; D68 accepts numbered screen 043, not this modal separately. design: yes · you: seen not approved
Strip duplicate whitelist markup page	Scaffolding only Superseded — not V1 work	Delete the duplicate; preserving it buys no safety or product function. design: retired · you: seen not approved
Strip whitelist-revoked warning banner	Not planned at all Needed for V1	No verdict names it. design: no · you: never seen

View-once

Surface	Status	Where it actually is
Strip view-once sender settings modal	Scaffolding only Needed for V1	D56 names the incorrect settings; D68 later accepts numbered screen 043. design: yes · you: seen not approved
Recipient view-once: tap-to-open page	Partly there Needed for V1	Design has sender settings and a consumed placeholder only. design: no · you: never seen
Recipient view-once: open image/video page	Partly there Needed for V1	Shipping uses a bare native Win32 image viewer, not the reviewed generic fixture. design: no · you: never seen
Recipient view-once: countdown/open timer page	Partly there Needed for V1	Native timer starts after first paint and closes the window but draws no countdown. design: no · you: never seen
Recipient view-once: close/consumed page	Partly there Needed for V1	"VIEWED ONCE — GONE" is demo copy, not an audited transition. design: no · you: never seen
Recipient view-once: second-open refusal page	Scaffolding only Needed for V1	No complete rendered recipient journey exists. design: no · you: never seen
Recipient view-once: screenshot notice/result page	Scaffolding only Needed for V1	Task requires an honest notice; no reviewed UI surface exists. design: no · you: never seen
Generic view-once overlay fixture overlay	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
Generic view-once player fixture page	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
Strip composer warning/counter/attachment/view-once/send composer	Partly there Needed for V1	The owner explicitly counts composer states separately. design: yes · you: never seen

Carrier-specific states

Surface	Status	Where it actually is
WhatsApp overlay empty empty-state	Scaffolding only Needed for V1 Tried and failed / platform forbids it	No review verdict. design: yes · you: never seen
WhatsApp overlay draft/composer composer	Scaffolding only Needed for V1 Tried and failed / platform forbids it	No review verdict. design: yes · you: never seen
WhatsApp overlay error overlay	Scaffolding only Needed for V1 Tried and failed / platform forbids it	No review verdict. design: yes · you: never seen
Telegram private composer/box composer	Not planned at all Needed for V1	No carrier-specific design/review surface exists. design: no · you: never seen
Signal private composer/box composer	Not planned at all Needed for V1 Large job	No carrier-specific design/review surface exists. design: no · you: never seen
Signal story composer composer	Built, never proven Needed for V1 Large job	Implemented surface has no design/review verdict. design: no · you: never seen
Instagram attachment tray composer	Not planned at all Needed for V1 Tried and failed / platform forbids it	No design/review verdict. design: no · you: never seen
Instagram story composer composer	Not planned at all Needed for V1 Tried and failed / platform forbids it	No design/review verdict. design: no · you: never seen
X attachment tray composer	Not planned at all Needed for V1 Tried and failed / platform forbids it	No design/review verdict. design: no · you: never seen
X reply composer composer	Not planned at all Needed for V1 Tried and failed / platform forbids it	No design/review verdict. design: no · you: never seen
Email draft overlay/composer composer	Built, never proven Needed for V1	Code defines a full draft, attachment and send-review surface; design folder has none. design: no · you: never seen
Gmail-specific carrier states composer	Not planned at all Needed for V1	No carrier-specific rendered page exists; provider screenshot tasks are not owner UI approval. design: no · you: never seen
Outlook web/desktop states composer	Not planned at all Needed for V1	No carrier-specific rendered page exists. design: no · you: never seen
Proton/Yahoo/AOL/GMX/Mail.com/iCloud states composer	Not planned at all Needed for V1 Large job	No carrier-specific rendered page exists. design: no · you: never seen

Privacy shields

Surface	Status	Where it actually is
Native Discord shield overlay	Not planned at all Needed for V1	It is a separate native window, not the reviewed Strip HTML. design: no · you: never seen

Scrub

Deletion confirmation

Surface	Status	Where it actually is
Timed-delete scheduler The scheduling page for messages that should be deleted at a chosen time. A person reviews the affected messages, timing, and consequences here before authorizing the schedule, so deletion is never implied by merely setting a timer elsewhere.	Scaffolding only Needed for V1	Owner ruled it ships but did not approve its UI. design: no · you: never seen

Discovery

Surface	Status	Where it actually is
Auto-whitelist rules This was a superseded proxy design that showed a people-in-chat dialog in place of the intended Auto-whitelist rules page. The current journey belongs in its own rules surface, where a person would choose the exact services, conversations, and conditions OSL may approve automatically; the old people dialog is not that screen.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
Behaviour screen The page for choosing how Scrub behaves while examining local message exports or connected accounts. It explains the limits of the scan and lets a person set the permitted behavior before starting, so discovery cannot silently turn into deletion or unattended automation.	Partly there Needed for V1	This is a concrete mislabeled old/wrong-UI review entry. design: no · you: seen not approved
Scrub what-to-find The step where a person tells Scrub what kinds of private information or exposure patterns to look for. It presents the available categories and scope controls before a scan, keeping the resulting suggestions tied to choices the person made.	Not planned at all Needed for V1	TASK 1415 points at generic Scrub, not the driven subject. design: no · you: seen not approved

Consent and start

Surface	Status	Where it actually is
Scrub idle The resting state of Scrub before a discovery scan begins. It shows the allowed accounts and scan mode, an empty local console, and a Run discovery control so the person can review the scope before OSL reads anything.	Scaffolding only Needed for V1	D46 approved 030 visually, not each operational state. design: yes · you: seen not approved
Scrub running The live discovery view after the person presses Run discovery. The console streams which allowed accounts are being read and what possible public exposures were found, while a Stop control lets the person halt further scanning; discovery itself deletes nothing.	Scaffolding only Needed for V1	No ruling names the running state. design: yes · you: seen not approved
Scrub stopped The Scrub console after the person presses Stop during discovery. It records that the scan was halted and that no more accounts will be read, making the effect of stopping visible instead of leaving the person to guess whether work continues.	Scaffolding only Needed for V1	No ruling names the stopped state. design: yes · you: seen not approved
Scrub start choices The choice shown when a person starts Scrub, before any account or file is examined. It distinguishes a local discovery-only run from scheduled Pro assistance and presents the required consent and automation warnings so the person knows exactly what is about to happen.	Not planned at all Needed for V1	TASK 1420 points at generic Scrub. design: no · you: seen not approved

Review

Surface	Status	Where it actually is
Scrub empty review This empty review dialog belongs to a superseded Scrub design and was meant to appear after a scan found nothing to review. The current replacement is the results area inside Scrub, which shows an explicit no-suggestions state after the person chooses an export and scan categories.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Scrub populated review The review opened by selecting findings in Scrub and pressing Review selected. It shows each suggested item, why OSL flagged it, where to find the original message, and whether the person really sent it, so they can verify the evidence before following any deletion directions.	Not planned at all Needed for V1	Only the empty design exists; actual selection/review is a distinct state. design: no · you: never seen

Scheduling and activity

Surface	Status	Where it actually is
AutoScrub activity The history page for scheduled AutoScrub discovery runs. A person uses it to see when a scan ran, which accounts it covered, what it suggested for later review, and whether it stopped or encountered a limit; it does not represent automatic deletion.	Not planned at all Needed for V1	TASK 1479’s entry points at generic Scrub. design: no · you: seen not approved

Purchase and packs

Purchase and upgrade

Surface	Status	Where it actually is
AutoScrub purchase/Pro path The upgrade journey opened when a person chooses the Pro-only AutoScrub option. It explains the feature and data-pack choices, lets them select Card, Bitcoin, or Monero, shows the payment-specific result, and then provides a separate one-use voucher redemption step without presenting a purchase as account credit.	Not planned at all Needed for V1	TASK 1510’s review entry substitutes onboarding Pro Code. design: no · you: seen not approved

Recovery and devices

Protected devices

Surface	Status	Where it actually is
Native protection picker, populated This picker belongs to the superseded sidebar-and-Service design and opened when a person chose Protect from a carrier page. It listed verified friends who could open the protected text and an on-this-device alternative; the replacement is the current Protect sheet reached from the active carrier context.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Owned confirmation / verification This verification dialog belongs to a superseded onboarding route and asked two friends to compare a numeric code over a different channel before accepting a key. That job now belongs to the verify-friend confirmation opened from the current Friends surface, not to recovery onboarding.	Scaffolding only Superseded — not V1 work	Its manifest points at the deleted recovery-check lineage. design: retired · you: never seen
Local protected sheet: write/open/capsule/plaintext/view-once modes These sheet modes belong to the superseded Service-shell design and covered naming a local chat, writing private text, choosing expiry or view once, producing encrypted text, and pasting encrypted text back to open it. The current replacement is the local Protect sheet opened from a carrier and then by choosing Only this device; it keeps the manual copy-and-paste boundary visible.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Service connections

Surface	Status	Where it actually is
Service page This was the superseded sidebar route for opening a connected app such as Signal in a separate OSL profile. It showed the chosen service and an Open button; the replacement begins from that app's tile on Home and continues through the current account-opening guide or hosted app view.	Scaffolding only Superseded — not V1 work Large job	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
Service local-protected sheet: initial This initial sheet belongs to the superseded Service design and opened when a person chose local protection before a chat context had been named. It asked for a local chat label and a Start action; the current replacement is the first state of the carrier's Protect locally sheet.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service local-protected sheet: prepared This prepared sheet belongs to the superseded Service design and appeared after a local chat had been named. It let the person switch between Write and Open, enter private text, and prepare an encrypted capsule; the current replacement is the equivalent ready state inside the carrier's local Protect sheet.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service local-protected sheet: ready This so-called ready state belongs to the superseded Service design and shows the carrier launch card rather than a distinct protection result. The replacement is split honestly between the current carrier account-opening view and the local Protect sheet's encrypted-text result, so this old combined state should not be recreated.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service unavailable This unavailable state belongs to the superseded Service-route family and was meant to appear when OSL could not open or prove the selected carrier or account. Its replacement is the current carrier setup or Home-tile refusal, which names the failed boundary and gives the person a safe way back without pretending the app opened.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service setup guide/card This setup guide belongs to the superseded Service route and was opened from a carrier's launch card before the app itself. It explained the available account-opening choices and let the person select an existing session, a separate profile, or an eligible browser path; the current replacement is the guide reached from the app tile on Home.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service existing native session This status page belongs to the superseded Service route and appeared after a person chose to reuse an already signed-in native app window. It identified the reused session and offered to bring it forward or reopen it; the current replacement is the existing-session companion state reached from the Home app tile.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service hosted native viewport This embedded viewport belongs to the superseded Service route and was the frame where a separately opened native carrier app appeared inside OSL. The current replacement is the hosted-app view entered after choosing a carrier tile and its account-opening mode, with the surrounding controls kept outside the carrier content.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service browser-companion viewport This browser viewport belongs to the superseded Service route and represented a web carrier opened in a normal browser-profile companion. It told the person that the browser window was separate and not capture-protected or shortcut-locked by OSL; the replacement is the current browser companion opened from the carrier's Home tile.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service embedded-loading skeleton This loading skeleton belongs to the superseded Service route and occupied the hosted viewport while a selected app or web surface was opening. The replacement is the transient loading state inside the current carrier host reached from Home, giving the person a visible boundary before the real surface is ready to be shown.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Service account picker This account picker belongs to the superseded Service route and opened after a person chose a carrier that had more than one saved OSL profile. It listed those profiles and offered Add another profile; the current replacement is the profile choice within the Home-launched carrier setup journey.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Friends and verification

Surface	Status	Where it actually is
Friend page This friend page used a superseded standalone dialog as a proxy for a person's relationship details. It was meant to show identity, verification, key-change, and conversation controls; the replacement is the current Friends panel opened from Home, with chat-specific details living in OSL Chats rather than on the retired sidebar route.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: seen not approved
Peer protected sheet: friend-empty/approval/write/open/receipt/opened-once The sheet opened from a carrier's Protect control when the person wants another verified friend to open the text. It first handles no-friend and app-plus-friend approval states, then provides Write and Open tabs, expiry and view-once choices, encrypted copy output, decrypted text, and sent or opened-once receipts.	Not planned at all Needed for V1	Distinct current surfaces with no design or verdict. design: no · you: never seen
Verify-friend confirmation The confirmation opened by choosing Verify for a friend whose key has not yet been trusted. It shows this device's verification code, asks the person to enter the code the friend reads back over another channel, and explains that accepting trusts that key without approving every conversation.	Not planned at all Needed for V1	Separate confirmation state. design: no · you: never seen
Remove-friend confirmation The destructive confirmation opened by pressing Remove friend on that person's profile or detail view. It names the friend, explains that their keys and conversation approvals will be removed from this device, and requires a deliberate final Remove friend action.	Not planned at all Needed for V1	Separate confirmation state. design: no · you: never seen
Clear-activation confirmation The confirmation opened by pressing Clear activation in the account's Pro activation area. It warns that Pro features will be unavailable on this device until another code is activated, then offers Cancel or a deliberate Clear activation action.	Not planned at all Needed for V1	Separate confirmation state. design: no · you: never seen
Safety-number dialog The dialog opened from a friend's verification or key-change warning to compare the long safety number held for that relationship. It gives both people a value to check over an independent channel and a clear accept-or-cancel decision, preventing a changed key from being trusted silently.	Built, never proven Needed for V1	No verdict names the shipping dialog. design: yes · you: never seen

Retired mail

Surface	Status	Where it actually is
OSL Mail status This was the status page for the superseded OSL Mail client, showing whether its private mailbox was provisioned and available. OSL Mail was removed as a destination; the replacement is to launch supported external mail carriers such as Gmail or Outlook from Home and use their carrier-specific protection surfaces.	Scaffolding only Superseded — not V1 work	This belongs to the retired OSL Mail product, so it is not missing current UI work. design: retired · you: never seen
OSL Mail loading/unavailable These were the waiting and refusal states for the superseded OSL Mail client while its mailbox data loaded or could not be reached. The client was replaced by Home-launched external mail carriers, whose own setup and error surfaces now explain whether a selected account can be opened.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail provisioning This was the account-creation and mailbox-setup step for the superseded OSL Mail client. It would have shown provisioning progress before the inbox became available; the replacement is connection setup for a person's existing external mail account from its Home tile.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail inbox/empty/refusal These were the main mailbox list, no-message state, and access-refusal state of the superseded OSL Mail client. They let a person browse mail or understand why no mailbox could be shown; the replacement is the real provider's mailbox with OSL's carrier overlay, opened from Home.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail no-thread-selected This was the blank reading pane in the superseded OSL Mail client before a person selected a thread. It prompted them to choose a conversation from the inbox; the replacement is the selected provider's own mail list and OSL's reading overlay when protected content is present.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail thread reader This was the message-reading pane of the superseded OSL Mail client, showing a selected thread and its messages. The replacement is the external provider's thread view with OSL's mail reading overlay used to reveal protected content locally.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail compose This was the new-message composer in the superseded OSL Mail client, where a person chose recipients, wrote a subject and body, and added attachments. The replacement is the real provider's compose window with OSL's protected email composer layered into that carrier journey.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail settings This was the settings area for the superseded OSL Mail client, covering its mailbox and notification preferences. The replacement is OSL's shared Settings plus the selected external provider's own account settings; there is no separate OSL Mail destination to configure.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
OSL Mail error strip This was the inline error banner across the superseded OSL Mail client when a mailbox action failed or became unavailable. The replacement is a carrier-specific refusal or status message beside the external mail surface that triggered it, so the person can see which account or action was affected.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Device confirmations

Surface	Status	Where it actually is
Link-disconnect confirmation The confirmation opened when a person chooses Disconnect for a linked app profile in Settings. It names the exact connection being removed and explains that OSL will forget the local link while messages, login data, and history already held by the provider remain.	Not planned at all Needed for V1	Separate modal, no approval. design: no · you: never seen
Native fresh-start confirmation The operating-system confirmation shown when opening a native carrier would require a fresh OSL-specific app session instead of reusing the person's current one. It explains the session change and asks the person to continue or cancel before OSL starts a separate profile.	Not planned at all Needed for V1	Separate native confirmation. design: no · you: never seen
Native sending-mode confirmation The operating-system confirmation opened when a person selects the experimental Double Enter or Single Enter sending mode. It warns that apps can change, lists the exact app, account, chat, and composer checks required before any action, and lets the person decline without changing the mode.	Not planned at all Needed for V1	Separate native confirmation. design: no · you: never seen
Native protected-fallback confirmation The confirmation shown on first use of an experimental send mode for a particular carrier account. It states that OSL will send nothing unless it can re-verify the exact account, chat, and composer, and asks whether the person accepts falling back to a safe manual copy instead.	Not planned at all Needed for V1	Separate native confirmation. design: no · you: never seen
Native reopen-app confirmation The confirmation opened when OSL finds that the person's existing native carrier app must be closed and reopened inside OSL. It says the login and conversations will remain untouched, then lets the person approve that restart or leave the running app alone.	Not planned at all Needed for V1	Separate native confirmation. design: no · you: never seen
Native borrow-open-app confirmation The confirmation shown when a native carrier app refuses to close, often because it is still running in the system tray. It offers to use the already-open window instead and makes clear that borrowing it does not change the person's account or conversations.	Not planned at all Needed for V1	Separate native confirmation. design: no · you: never seen
In-DOM tooltip system The small explanatory bubble opened by hovering or focusing a control that needs more context. It stays anchored to that control, supplies a short label or consequence without navigating away, and disappears when the person leaves or dismisses the target.	Not planned at all Needed for V1	Tooltips count as surfaces under the owner rule. design: no · you: never seen

Errors and refusals

Startup

Surface	Status	Where it actually is
“Opening OSL” boot shell The first window shown while OSL starts and waits for its local security core and interface to become available. It gives the person a clear Opening OSL state instead of a blank application window, and then yields to onboarding, unlock, or Home once startup has decided where they belong.	Built, never proven Needed for V1	This is a shipping entry surface outside the numbered review. design: no · you: never seen
Bootstrap failure/retry The startup refusal shown when OSL's local security core does not respond. It says OSL could not open and offers a Retry button, giving the person a bounded recovery action without exposing internal error details or dropping them into an unsafe partial workspace.	Not planned at all Needed for V1	No review verdict names it. design: no · you: never seen
Render-recovery screen The full-page recovery view shown when the interface encounters an error while rendering. It pauses the normal view, withholds error details from the screen, and offers Reload interface so the person can restart the presentation layer without being shown a misleading half-rendered workspace.	Not planned at all Needed for V1	No review verdict names it. design: no · you: never seen
JavaScript-loading state The placeholder visible while the application's JavaScript interface is still loading. It tells the person that OSL has not finished opening yet and prevents the empty window from looking like a usable workspace before the code can choose the correct startup route.	Not planned at all Needed for V1	No review verdict names it. design: no · you: never seen

Privacy shields

Surface	Status	Where it actually is
Capture shield window A separate, intentionally black window placed over sensitive OSL content when that content must be hidden from screen capture or an untrusted display path. The person does not operate controls on it; its only purpose is to cover the protected region rather than let private text flash through during a shielded state.	Built, never proven Needed for V1	It is a distinct shipping window and cannot inherit Strip approval. design: no · you: never seen

QA-only surfaces

Surface	Status	Where it actually is
WhatsApp QA window An internal test window for driving WhatsApp-specific protection states without presenting it as the normal customer journey. A tester can select fixture conditions, enter protected-composer content, and inspect the resulting overlay, refusal, or status output so carrier behavior can be checked in isolation.	Built, never proven Needed for V1 Tried and failed / platform forbids it	README excludes QA-failed harnesses; QA UI is not product approval. design: no · you: never seen
Signal QA protected-composer page An internal Signal test page that presents the protected composer and controls for exercising its carrier-specific states. A tester uses it to enter a draft and drive success or refusal scenarios; it exists for verification and is not the composer a person reaches from the normal Home-to-Signal journey.	Partly there Needed for V1 Large job	A QA surface cannot inherit 043 approval. design: yes · you: never seen

Retired and internal

Activity

Surface	Status	Where it actually is
Activity This page belongs to the superseded sidebar design and showed a local log of OSL events, account changes, and items needing attention, such as a friend's changed key. The dedicated Activity destination was removed; current replacements put urgent notices in Home notifications or beside the affected friend, chat, or Scrub run.	Scaffolding only Superseded — not V1 work	The route is retired; matching it buys no working product. design: retired · you: seen not approved
Activity empty This empty state belongs to the superseded Activity page and told the person that no local events had been recorded yet. Because the standalone Activity destination was removed, current surfaces show their own empty notification or history state where the relevant event would be reviewed.	Scaffolding only Superseded — not V1 work	Retired surface. design: retired · you: never seen
Activity off This off state belongs to the superseded Activity page and explained that future local events would not be recorded until activity logging was enabled. The dedicated page was replaced by notification and privacy controls in Settings, with any remaining history shown inside the feature that produced it.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Connections

Surface	Status	Where it actually is
Connections This page belongs to the superseded sidebar design and gathered connected accounts, carrier launch controls, network tools, and planned device surfaces into one destination. It was replaced by actionable app tiles on Home and connection/account controls in Settings Apps, so there is no separate Connections workspace to restore.	Scaffolding only Superseded — not V1 work	Explicitly retired. design: retired · you: seen not approved
Connections empty This empty state belongs to the superseded Connections page and appeared before any service account had been connected. It prompted the person to connect an app from Home; the replacement is Home's own empty or unavailable tile state plus the setup journey opened directly from that tile.	Scaffolding only Superseded — not V1 work	Explicitly retired. design: retired · you: never seen

Inbox

Surface	Status	Where it actually is
Inbox This page belongs to the superseded sidebar design and combined native OSL conversations, connected carrier conversations, and requests behind filters such as All, OSL, and Connected. It was replaced by OSL Chats for OSL-native messaging and separate carrier tiles on Home for external conversations.	Scaffolding only Superseded — not V1 work	Explicitly retired. design: retired · you: seen not approved
Inbox empty This empty state belongs to the superseded Inbox page and appeared when there were no connected conversations or requests. The combined inbox no longer exists; current replacements are the empty OSL Chats conversation list and the setup or unavailable states reached from each external carrier's Home tile.	Scaffolding only Superseded — not V1 work	Explicitly retired. design: retired · you: never seen

People

Surface	Status	Where it actually is
People This page belongs to the superseded sidebar design and listed trusted people, pending verification, key changes, and open requests. Its functions were re-homed to the Friends panel opened from Home and to the relevant OSL Chats profile or member surface.	Scaffolding only Superseded — not V1 work	Explicitly retired; features were re-homed. design: retired · you: seen not approved
People empty This empty state belongs to the superseded People page and told a new person that no friends had been added, with an action to add someone by OSL code or public name. The replacement is the empty Friends panel opened from Home, where searching or creating a one-use contact link begins the current flow.	Scaffolding only Superseded — not V1 work	Retired route state. design: retired · you: never seen
People key-change page This full page belongs to the superseded People design and warned that a friend's verification code had changed, then offered a Review change action. It was replaced by a compact key-change banner beside the affected chat composer, where protected sending stays blocked until the person opens the verification dialog and checks the new key.	Scaffolding only Superseded — not V1 work	TASK 6892 says do not ship it as a page; keep the key-change banner near the composer. design: retired · you: never seen
Friends dialog empty This empty Friends dialog belongs to the superseded People/sidebar shell and opened from Home when no trusted people had been added. It showed an Add friend action; the replacement is the current Home Friends panel's empty state, which leads into exact-name search or one-use contact-link exchange.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
Friends dialog populated This populated Friends dialog belongs to the superseded People/sidebar shell and opened from Home to list friends who were verified, awaiting verification, or needed re-verification after a device change. The replacement is the current Home Friends panel, with each row opening that person's detail and verification actions.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
People-in-chat dialog empty This empty dialog belongs to the superseded People/sidebar design and opened when someone asked which friends were present in a supported chat before any usable chat context or friend could be shown. The replacement is the current OSL Chats members rail or carrier-specific Protect picker, each tied to the exact conversation that opened it.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen
People-in-chat dialog populated This populated dialog belongs to the superseded People/sidebar design and opened to show which verified friends were associated with the current chat. It was also incorrectly used as an Auto-whitelist proxy; the replacement is the OSL Chats members rail for native chats or the carrier's exact-scope Protect and whitelist controls for external conversations.	Scaffolding only Superseded — not V1 work	This belongs to a retired design, so it is not missing current UI work. design: retired · you: never seen

Privacy

Surface	Status	Where it actually is
Privacy destination This page belongs to the superseded sidebar design and summarized the selected privacy posture, device-local policy, and a review entry for planned Scrub changes. It was replaced by the Privacy and Security sections in Settings, with Scrub review kept inside Scrub rather than in a separate Privacy destination.	Scaffolding only Superseded — not V1 work	Explicitly retired; settings owns privacy now. design: retired · you: seen not approved

Platform and release

Windows product

Packaging and integrity

Operations and safety

Performance ceilings

Account, access, and onboarding

Entry and return

Thirteen-step first run

Passwords and recovery kit

Two-device account

Identity, friends, and trust

Public identity and scoped profile

Adding people and requests

Verification and key change

Blocking and whitelisting

Shared protection engine

Cryptographic message path

Cover text

Timers, view once, and burn semantics

Reliability and self-healing

External carriers and mail providers

Exact chat and social scopes

Discord

Telegram

Signal

WhatsApp

Instagram

Messenger

Gmail

Outlook — Web

Outlook — Windows desktop

Proton Mail

Yahoo Mail

AOL Mail

iCloud Mail

Scrub and AutoScrub

Consent and attended discovery

Review and delete

AutoScrub

Per-service operations

OSL Chats

Shell, navigation, and empty states

Direct messages

Groups

Composer and messages

Attachments and media

Requests, safety, and states

Enclaves and community

Enclave lifecycle

Categories, channels, and interaction types

Roles and local governance

Local AutoMod and bots

History, beacons, and voice

Profiles, feed, posts, and stories

Profiles

OSL Feed and posts

Stories

Settings

Account

Apps

Privacy

Security

Whitelist

Notifications

Appearance

Window and sounds

About

Home, notifications, and connected surfaces

Home launcher

Notifications

Retired sidebar guarantee

Local data, network, export, and destructive exits

Local-first storage

Tor, Mullvad, and network behavior

Export and import

Destructive exits

Data packs, Pro, and payments

Plans and allowances

Purchase rails

Anonymous voucher