What we shipped this week — the discouragement architecture, Honest Letters, a bounded Ember carve-out, and voice/video calls

A heavier week than the previous one, on the brand-level rather than the feature-level. Three of the four items below are commitments about what ConKarma is — the kind of thing competitor family apps can't credibly copy without rewriting their growth model first. The fourth is the plumbing that makes a couple of long-promised surfaces finally work. This is the build-in-public log entry.

1. The discouragement architecture — published as a meta-promise on /promises

ConKarma has fifteen Promises, and a question we've kept getting from outside the team — privately and at length — is what the underlying principle is. This week we wrote it down and put it on the surface: "ConKarma's stick is the absence of a stick. We don't shame you, score you, or surveil you. We change how the surfaces work, not how you should feel about yourself." The line now sits as a preamble paragraph at the top of /promises, framing all fifteen.

Concretely, that principle shows up as five aligned mechanics — surfaces that nudge by changing the option set rather than by punishing the person — and six hard avoids (no red Xs, no streak guilt, no public friend graph, no per-user scoring, no engagement-prediction loops, no "you missed X" prompts). The long-form architecture decision is ADR-089; the summary entry is on /build-in-public. It's the kind of commitment that's easy to write and hard to keep — which is why we wrote it down where you can hold us to it.

2. Honest Letters — the surface for the hard message you can't say to their face

Honest Letters shipped this week, and the design question we kept relitigating was the same one we always come back to: which receiving-condition asymmetry actually keeps the sender in control? The version we shipped is this. The sender writes to one person in their cell. Before sending, they pick the channel: respond-in-writing-only, save-for-our-next-check-in, or read-only-no-response. The app enforces the choice — the recipient cannot reply outside the channel the sender opened, and they can't escalate to a face-to-face talk unless the sender said it's OK. The conditions are structural, not advisory.

Around that core are four other commitments we wrote into the surface. Composing is scaffolded — the writer is prompted to name a feeling, a request, and a wish, in their own words, instead of facing a blank page. Sending requires a receiving-conditions affirmation — the sender ticks the channel they're opening, deliberately, after seeing what each one means. Dual aftercare prompts both sides — the sender on send, the recipient on read — to take a moment before doing anything next. And the distress router catches the cases where Honest Letters is the wrong tool: if the content describes immediate danger or crisis, the app routes to the in-cell trusted-adult network and the per-region helpline numbers, plainly. Honest Letters is not a helpline replacement, and the surface is explicit about that on every screen.

Three help articles went up alongside the feature — one in kid voice, one in parent voice, one in partner voice — so each audience can read about the receiving-conditions concept and the boundary in the register that fits. They're at /help/honest-letters-for-kids, /help/honest-letters-for-parents, and /help/honest-letters-for-partners. ADR-091 is the architecture decision; the public commitment lives on /promises and /trust.

3. The bounded Ember carve-out — couple-authored playful consequences, not platform punishment

ADR-090 is the strictest carve-out we've written. ConKarma does not punish users. Period — that's the discouragement architecture from section 1. The carve-out is narrow and adult-only: inside the Ember (adult-tier) zone, a couple can author their own playful consequences inside a structure they both opted into. The platform never assigns a consequence; the couple does, mutually, in advance, and only on a deck where both sides ticked the same item under the consent-first double-blind pattern we shipped last week.

The guardrails on this are deliberately heavy. The Mutual Deck cross-check is the gate — a consequence can only fire from an item where both partners independently opted in, with the items shared only in their intersection. The safeword always overrides — at any point, either partner can lift the structure entirely and the surface respects it instantly, no countdown, no negotiation. If one partner pauses and the other is still engaged, the asymmetry triggers a soft-pause for both with an anti-shame prompt to the partner who paused — explicit "this is about pace, not failure" framing. Nothing about the carve-out is platform-driven; everything is couple-authored, opt-in, and reversible. The architecture decision is ADR-090; the public posture lives on /build-in-public under the Ember consent-infrastructure thread.

4. WebRTC voice / video calls + the MCP servers FE

Last shipment, much smaller in commitment terms: voice and video calls between cell members landed this week as a WebRTC integration, finally closing the loop on cross-generational calls (grandparent ↔ kid, sandwich-generation cells, long-distance partners). Calls are end-to-end encrypted, peer-to-peer where the network allows, never recorded, and don't appear in any cell timeline by default. The MCP servers FE (ADR-049) also shipped — the integration-grants surface that lets cells authorize narrow, scoped read access to third-party services (Spotify playlists for ceremonies, Hue/Sonos for ambience cues, Apple Health daily totals for fitness-tagged missions) one grant at a time, all revocable from one Settings screen. Architecture and trade-offs on /build-in-public.

What this week didn't do

Worth naming, again. The discouragement-architecture promise didn't come with a launch campaign — it went onto /promises quietly, where commitments belong. Honest Letters didn't get a "letters sent today" counter or any other engagement metric on the surface. The Ember carve-out doesn't appear in the main app at all — zone-isolated, opt-in, and off by default on every device. Calls didn't get a "missed call" badge designed to pull you back in. None of these are oversights.

If you want the underlying commitments, /promises is the canonical list — third-party audited yearly. The engineering decisions behind this week's four are on /build-in-public; the broader posture is on /trust.

Quiet week of shipping. Loud commitments.

— Stas