"The quest said the screens were replaceable. Then a whole new family of screens arrived in one week — and nothing underneath moved."
The Canary Flew
Back in Track 1, this quest made a promise: Waystone is an engine, and the screens — the mobile capture surface, the desktop plan editor, the map — are replaceable clients of one canonical state. On 2026-09-10 that promise stopped being posture and became a receipt. Waystone's architecture document had named the native app in advance: the family's first native canary — "the narrow Waystone Breadcrumb client, not a parallel implementation of the full Waystone interface." One universal SwiftUI target, no plan editing, no brain picker, no parallel Pippa: brain and effort stay central, and the phone is a capture client. And it was built natively rather than as a web shell over the React client, on Dad's call — a WKWebView wrapper would have dragged the desktop's bundling and map-library decisions onto the phone, and narrow was the whole point.
Every New Surface Is a Mouth on the Same Drop Box
What shipped in that first week is a list of surfaces, and the lesson is how boring each one is allowed to be. The share extension lets Safari, Photos, or Books leave a Crumb in two taps — and it writes a complete Crumb, with its own ULID and the capture truth of that exact moment, because an extension that records only "something was shared" would force the engine to reconstruct the travel day later, which the two-truths rule forbids. Share a link at 21:04 in Grindelwald, open the app the next morning in Wengen, and the Crumb still reads 21:04 on the 14th. Siri, the Action Button, and Spotlight leave crumbs through App Intents. The Control Centre and Lock Screen control deliberately opens the app rather than capturing silently — a button has no way to ask for a sentence, and what actually costs time with a phone in one hand is unlock-find-tap, not typing. A Home Screen widget carries the unsynced count, because the moment that number matters is the moment you're standing somewhere with signal and not thinking about Waystone at all.
None of these is a new pipeline. Each writes the same Crumb shape into the same inbox, rides the same outbox, and gets the same idempotent answer from the same engine. The surfaces multiply; the discipline does not subdivide.
The Outbox, Proven
The Local-First Outbox lesson taught the state machine; the native client is where it got proven. The honest ledger entry before this read: after twenty Switzerland Crumbs, "offline outbox behavior remains unproven." Making it true took three decisions. The device mints the ULID — the engine used to mint it, which meant a POST whose reply was lost could only be retried by creating a second Crumb; the precondition for an outbox was missing entirely. A replay is answered from the raw op log, never the fold — the fold pops a tombstoned id out of existence, and a phone still retrying a Crumb you deleted on the desktop must be told "already known," never allowed to resurrect it. And the drain parks a rejected Crumb and steps past it instead of halting the whole queue: in a browser a halted queue is survivable, but in a cable car it is a day of memories held hostage by one bad payload. (That divergence was later judged right and became the kit's policy for every app — Track 7's story continues.)
The Wrist Is the Same Argument, Smaller
The watch app is the narrow-client argument with less room to be wrong about it: one control — speak, and it is a Crumb. No stream, no map, no journey picker. There was briefly a second button — an "Other language" shortcut — and it died on Dad's actual wrist: the language switch on watchOS is a swipe-up on the system dictation screen itself, a gesture no app needs to provide a door for. A button that duplicates a system gesture badly is worse than no button on a surface with room for one control. The watch is not on the tailnet and never will be — there is no engine it can reach, so the phone is its engine: one hop further out, same posture. Commit locally, hand over, let go only on acknowledgement, with one ULID riding all three layers. Even the watch-face complication is a decision rather than an omission: it is a button and shows no count, because a face refreshes on watchOS's budget, not on capture — a number there would be confidently stale within minutes, on the one surface people actually read at a glance.
What the Engine Didn't Have to Do
Here is the receipt the whole quest was pointing at. A whole new client family — phone, watch, share sheet, intents, widgets — and everything the engine had to add was the honesty half a durable client needs: the device-minted Crumb ULID answered idempotently on replay, replayable media staging, route segments as their own append-only record — and one field, source, finally reaching the wire, so a native capture is distinguishable from a browser one for the life of the log. What the engine did not add is the point: no parallel state, no second sync protocol, no native-only records the PWA cannot read. The Track 5 contract — commit locally before the network, two truths, foreground-only, capture now and assemble later — did not bend to fit the new screens. The new screens fit the contract. That is what "the screens are replaceable" was always buying: you can change what the traveler carries without renegotiating what the engine owns.