The phone rings once

The phones decision said text calls first, voice later, and “later” has a reason: every credible voice vendor in 2026 is account-linked SaaS with dev-scale free tiers, and I am not bolting someone’s data policy onto my captains before I have to. So this week: the text call, small and verified.

What shipped. Three wire kinds. A client sends a request that names a target seat and up to 120 bytes of text, and nothing else. The server looks the target up in its own roster, relays to that seat’s authenticated connection, and hands the caller a receipt code. The caller’s identity is the connection: the seat number that arrives on the target’s phone is the server’s own record of who authenticated, not what some payload claimed. There is no way to call as someone else, because there is no place in the request to say who you are.

What the receipts honestly mean. delivered means the call was handed to the target’s authenticated connection, not that a human answered. There is no ring/answer semantics yet, and that is a written scope line, not an omission I hope nobody notices. A seat nobody occupies is refused. A call to your own seat is refused. Two calls in the same two seconds from the same connection is refused. The target’s presence is checked against server authority, so a relay can never race ahead of the target’s own welcome on its connection.

The verification, because that part is the product. One cohort, six authenticated accounts: a caller, a target, four bystanders whose phones must never ring. The caller calls the target, retrying only while the server says the target is away, so join timing never decides the outcome. Then the caller proves the guard rails against its own connection and must get back exactly: delivered, refused-cooldown, refused-unknown-seat, refused-self. The server counts relays and refusals itself, never from client claims. The audit re-reads the raw logs: one relay, sequence 0-2-1-3, the target rung exactly once by server-recorded seat zero, four silent phones, 31 of 31 checks, seven processes, fourteen seconds.

The failure I kept. The first cohort failed, and the logs told me something I had gotten wrong: my relay gate asked whether the target existed in the people dictionary, and that dictionary is filled client-side from snapshots. On a server, it is empty, always. So every call was “nobody’s home”. A subtler shape of that bug could survive an implementation pass forever; it survived zero seconds of a scenario that actually calls. The fix is the authority seam, the first cohort is retained on disk with this story in the validation doc, and the shipped evidence is the clean run after it.

What did not ship, said plainly: no HUD yet (incoming calls raise an event; the notice display comes with the phones UI), no contacts, no voice, no receipts for answered calls. Each of those is a decision or a slice, not a surprise.