"The composer stopped being the only door. Every new door had to sign the same contract to get in."
Capture Leaves the Desk
Until mid-September 2026, Forge was one screen — the office web app. On 2026-09-10 it grew a phone half: one universal iOS app, SwiftUI over the family's shared kit core, delivered through TestFlight, with a watch riding in the same bundle. The reason was the capture contract, not vanity: symptoms arrive mid-flare, in waiting rooms, on the bike — and the desk is where crumbs get typed, not where they happen. But a new door is not a bolt-on feature. Each one had to prove it keeps the two rules this track is built on: capture stays free prose with no required picker, and the local write commits first, always.
Four Doors, One Contract
Scan. The phone's document camera turns a check-up printout into one deskewed, multi-page PDF, size-fitted on the device against the engine's 25 MB media cap — the page photographed at the clinic is a crumb before you reach the car. Dictate. Speech recognition runs on-device, and when a locale has no offline model the door refuses rather than falling back to a server — the family's line that no third party ever carries symptom text off the machine is made of code here, not promises. Share. The check-up PDF that arrives in Mail weeks later lands in a share extension that writes the App Group inbox and never touches the engine itself; the phone half files it on next open. The wrist. The watch-face complication is a door — tap it and dictate — and module taps record a workout in two touches. One honesty note on that dictation: watchOS gives an app no recognizer of its own, so the wrist uses the system's dictation screen, and code cannot prove where it listens. That door opened on Dad's explicit, recorded decision — the privacy line's own escape clause, exercised in writing. This is where "mumble and move on" stops being a metaphor.
Offline Is the Shape, Not a Mode
The outbox from the last lesson runs on the phone as the kit's CaptureOutbox: attachment bytes stage locally, client_request_id is the idempotency key so a retry can never mint a crumb twice, and an uploaded media id is written back the moment it lands. The whole phone half sits behind Face ID, and its files stay encrypted whenever the device is locked. Delivery is TestFlight on one family pipeline — a health app on Dad's phone is still family infrastructure.