Playing

Consent and the safeword

Who else may see or do anything on your box — your AI Handler, a pack's Handler, your pack-mates — how much of it a day, the ceiling over all of them, the safeword that stops everything, and what can never be granted.

Latch is yours. Nobody but you can do anything on it until you say so, one tick at a time, on one page: /consent (Settings → System → who else may act, or the 🛑 bar on the dashboard once somebody holds a grant).

Everything here is about other voices: your local AI Handler, a pack's Handler, your pack-mates. Your own game — locking, the wheel, training, reflections — never asks this page for anything.

Who is acting

Every line in your log says who did it. The ones that are you:

The ones that are not you:

Only your own voices count toward your streak and the heatmap. A day on which only your Handler or your AI acted is an empty day on the calendar — they cannot keep a streak alive for you. They never earn you XP either. Their time on your clock still counts toward the lifetime totals, because it was really on your clock.

Principals and the menu

You grant things to a principal: your AI Handler, a pack's Handler, or a pack's members as a group. Each gets its own section on /consent, and each section lists only what that kind of principal can be given:

One of the app's own achievements says a number as well as a name — Long Haul is a lock of a week or more and its paper says how long, Good Dog counts verified training — so under Your papers each rides only beside the permission that would show that number: Long Haul, A Year Under and Let the Wheel Decide need the clock; Good Dog, Said Out Loud and Still Here today's duties; First Latch the lock status, the streak ones the streak, On the Record the photos. Pack-mates can never be given the clock or the duties, so those six never reach them. The chat room is shown less than any of those permissions — today's duties as done or not, the clock as time left — so it names one only when it is shown the number itself: First Latch always, Long Haul and A Year Under with Show the clock, the rest never.

A playset's badge answers to the same rule, read from its rule: locked on N days and a count of spins need the clock, a count of training, reflections or check-ins today's duties, a count of locks the lock status; a finished badge needs the permission for every number its rule states — locked on 25 of 31 days the clock, and reflected on 20 today's duties as well; joined and granted need Your papers alone — so pack-mates get an event's joined badge, and a count of locks only if you gave them the lock status — never one that states the clock or your duties (a finished badge states the days you were locked). One that counts anything else (your kit, your health, a refusal) — or whose rule can no longer be read — is shown to nobody. So is a badge from a part of Latch this one does not know (a module removed since, or one a later version adds): nothing can say what its number is, so nobody else sees it. The pack's own two, Collared and A week in the pack, state no number and need Your papers alone.

Some kit badges say a lock's length too. With a cage in service every lock is a stretch of wearing it, so Well worn and Second skin (all the time you have spent in gear, locks included) and Workhorse or Veteran on the cage (its bouts and their time are your locks) need the clock beside Badges earned with kit — pack-mates never get them. Hands free and Well trained (you came while caged) need the lock status. The rest of the kit's badges ride under Badges earned with kit alone.

Nothing is ever ticked for you. A new principal starts with nothing; each permission is its own tick, and each one can be revoked with one tap. Revoke everything is at the bottom.

A grant is a row that is never edited: changing a limit revokes the old grant and writes a new one, so the page's history is exactly what you allowed, and when.

Training they assign

Training somebody else assigns is a one-off: it is not added to your library, it never comes back on the wheel, and it carries no reward and no penalty — completing it earns you the usual XP, letting it expire costs you nothing. It may ask for a verification photo, like any training. When they leave (or take the collar off), their open training is withdrawn.

While your timer is hidden, training whose title or description talks about time — "10 minutes", "until 9:30", "…left" — is refused: you have to be able to read your training, so it cannot be hidden from you, and it must not tell you the time you chose not to know.

A prompt written for you

A prompt somebody writes is for one later day — never today — and is a reflection, a check-in or a mantra (the questions a day has). On that day it replaces the library's question, but only while their permission to write prompts is still live, they are still the one holding it (a pack's next Handler does not inherit the last one's prompts), and you are not paused. Revoke it, leave the pack or say the safeword, and the prompt is gone from the page at once; resume and it comes back. Nothing about it is deleted either way. While a hidden lock runs, prompts somebody else wrote are not shown at all.

Limits

Every per day permission has a limit you set when you tick it. The day is your day, midnight to midnight in your timezone.

• Per actor and per principal. A limit holds for each voice and for the principal as a whole — two pack-mates share one kudos allowance, they do not get one each.
• Undo does not refund. If you undo something your Handler did, it still counts toward their day.
• The ceiling. However much each principal is allowed, together they can never put more than the ceiling on your clock in one day — added time and freezes, everybody combined. The default is 4 hours; set it on /consent.
• A hard day. On a day your health data says you are struggling (a short night, a low mood — see Health), nobody can add time or freeze your clock. The Handler that eases off is the same one that noticed.

Everything anybody else does happens now: a request that claims another time — a command queued hours ago, or dated into yesterday to use yesterday's allowance — is refused as expired, and nothing they do is ever stamped before a pause you have already said.

When something is refused, your log gets one line saying who tried what and why — at most twenty per voice, and twenty per Handler, pack or AI, a day, so a door somebody keeps knocking on does not flood it. The other side only hears a short code; a hard day and the ceiling both reach them as a plain "refused".

The safeword

🛑 Pause everyone — on /consent, on the dashboard, from your API token (POST /api/v1/pause) and from the chat bot's token — suspends every grant at once, reads included: nobody can see your clock, your photos or your streak, and nobody can act. It never asks why, it never needs a fresh page, and saying it twice is the same pause.

• Only you can resume, and only on /consent — never from the API or the bot. A pause a relayed voice could lift would not be a safeword.
• A 🛑 paused chip sits in the header of every page while it holds.
• Your own game carries on as normal while paused.
• A pause takes effect the moment you say it and is never dated earlier than something already in your log — nothing that happened before it can be made to look as if it happened under it.
• A box restored from a backup (python -m latch.restore) starts paused whenever anybody held a grant, so nothing acts on it until you have looked here and resumed. The rows and the pause land together: there is no moment when the restored grants are live and the pause is not. A box whose clock is behind the backup's newest record is refused, so a resume the backup carries can never outrank that pause later.
• While you are packing to move, every command from anybody else is refused too — they are told paused, never why.
• A command a Handler sent while you were paused (or packing to move) never lands, however late it reaches your box — and the answer does not say when you paused. Your box judges each command against a stretch between two of its syncs with that den, never against the moment the den claims: if a pause touched that stretch, every command sent in it is refused alike (before, during or after the pause) and, once the pause is over, answered expired like any stale command. A command that waited behind a full batch is judged against the stretch before that the same way, and one older than that is expired whatever happened back then. So a den learns at most which stretch between two syncs a pause touched — never when inside it, however it dates its commands. When a command was sent is read on your box's clock (the den's is read off its own answers), so a den whose clock runs fast or slow changes none of this.

What can never be granted

These are not switches that happen to be off. They do not exist, so there is nothing to tick and nobody — no Handler, no pack, no AI — can ever be given them:

• unlocking early, or the emergency key;
• taking time off your clock (a Handler can add; only you can remove);
• undo — and you cannot silently undo a pack member's act either: that was theirs;
• locking you;
• spinning the wheel;
• writing your words — reflections, notes, check-ins, recordings — or reading them anywhere but your own AI's chat and, only if you tick it, your own AI's posts on its profile — and there only under those grants;
• changing what you granted, or resuming after you paused;
• anything from your health data.

The emergency key always works — whatever you granted, whether or not you are paused, whoever else is acting at that moment.

The chat bot

The chat bot is you, relayed — a program on your own machine that reads what is due today, reminds you in a chat room, and can say the safeword for you. It gets its own token, made on /consent (The chat bot): shown once, stored only as a fingerprint, revoked with one tap. It is never a principal — there is nothing to grant it — but it relays into a room, and whoever runs that room's server can read everything it posts, and could send commands as you. So what it reaches is a short list, and six switches on the same page widen it:

It never carries your words, anybody's name, a training title, your kit or anything from your health data — a badge earned by your kit, your health or a refusal reaches it only as a badge — unless you switch on Talk to your AI Handler here: then your AI's answers carry whatever you granted your AI, because that is the conversation you asked to have there. The model is yours and so is the choice; the room is somebody's server. It can pause but never resume. While a token is live the footer says so: reaches out: bot. The routes themselves are on the API page; setting the bot up, its commands and the room rules it checks on every sync are on its own page.

Why health never leaves

Health readings steer the game on your box (see Health): a short night eases the Handler off. None of it is ever sent anywhere. Anything that leaves your box — a pack card, an AI's context, the bot — is worked out as if the health module did not exist, so there is nothing health-shaped in it to leak: no "recovery" reason, no forced check-in, no readings. Even a refusal caused by a hard day reaches the other side only as "refused".

This page also ships inside the app, at /guide — so your own instance always serves the guide for the version you are running, with the internet unplugged. Get Latch · Something wrong here? Tell me.