# 01 — join-flow copy: three doors into one shared picture *Commissioned 2026-07-24 by Stephen's verbatim directive on the landing page's mailto CTA cards ("let's build out a skeleton here instead of email where they can select an incident in their time and space based on sharing location. or they can submit imagery and we figure out the space-time and match event based on exif. or they can use the set-space-time for any imagery that doesn't have exif. and the incidents as a STAC are on a leaflet map"). Author: John, rhetoric persona ([bead `6715f286`](../../about.md)). Registers carried from [note 00 §2 per-tab registers](../../2026-07-23/notes/00-alert-live-new-site-messaging.md) and copy reused where marked from [note 01, incident contribution narratives](../../2026-07-23/notes/01-incident-contribution-narratives.md). This note does NOT touch the landing page; the CTA retarget is a separate edit in flight.* *House rules for every blockquoted **COPY** block (deployed-grade, lift verbatim): no em dashes; no "not X, but Y" construction; witness, never gore; no capability claim beyond what is built. This note's own prose uses bead-doc idiom.* *Honesty spine, binding on all copy below: (1) SKELETON HONESTY. The page says plainly what works today (the leaflet map of STAC incidents, client-side EXIF reading, space-time matching, credited deposits into each incident's public contribution box) and what is stubbed (no accounts by design; per-person permissions and official-naming workflows land with the access layer; a no-match produces a downloadable founding deposit plus hand-off guidance and never creates a new incident collection). The 302-degradation pattern from note 01 §4 applies: never a faked success. (2) PRIVACY. EXIF is parsed client-side only; the consent screen shows exactly what was read (pin plus timestamp) BEFORE any matching UI celebrates and BEFORE any deposit; geolocation fires only on an explicit click; nothing leaves the browser until the user submits; the deposit states plainly that it lands in a public credited log. (3) Chelan Hills appears only in lessons-learned support grammar per the [incident bead's limitation](https://redfish.acequia.io/guerin/.agents/68d88c38-e223-4385-b8c9-f929eea309a3/about.md).* --- ## 1. The page standfirst One breath, under the page title, above the map. Three doors into one shared picture; the map is the front door. (COPY): > Every incident on this map keeps a public record, and every record has room for what you saw. Three doors in: share your location and pick the incident near you in space and time, or add a photo and let the time and place your camera wrote find its incident, or place and time it yourself. The map is the front door. What you add joins the record credited to you, and nothing leaves your browser until you say so. Rationale (logos): one causal chain, per the one-spine rule: the map holds the records, the records have room, the three doors are three ways of answering the same two questions (where, when). The privacy promise sits in the standfirst because it is load-bearing, and it is only there because it is true (client-side EXIF, click-gated geolocation, no network writes before submit). --- ## 2. The three lanes Lane order on the page: SELECT, EXIF, NO-EXIF. Each lane is a card; each card is one header, one deployed paragraph, one action. ### 2a. SELECT — share your location, pick your incident Card header and body (COPY): > **Pick your incident.** > Share your location and the map sorts itself around you: the incidents near you in space and time rise to the top. Pick yours and its record opens with a place for your contribution. Action button (COPY): `Share my location` The quiet privacy line, directly under the button (COPY): > Your location is read once, when you tap, and only in your browser. It sorts this map and does nothing else. It is never stored and never sent. The closed-incident label, shown on any incident whose fire is out (Stephen's phrasing, fixed) (COPY): > Record open for contributions; the fire is contained. Rationale: geolocation on explicit click only is the privacy gate made visible; the copy states the whole lifecycle of the reading in one line so no policy page is needed. The closed-incident label does double work: it keeps Maria 2019 and any contained fire honestly labeled while saying the record itself never closes. Memory keeps arriving after the smoke stops. ### 2b. EXIF — the photo places itself Card header and body (COPY): > **Let the photo place itself.** > Add a photo and we read the location and time your camera wrote into the photo, right here in your browser, and show you before anything else happens. Nothing uploads. You see exactly what the photo says, then you decide. Action button (COPY): `Add a photo` The match proposal line, shown on the map AFTER the consent screen (§3) and only after it (COPY, `{incident}` from the collection title, `{distance}` and `{offset}` computed client-side): > Your photo places itself {distance} from {incident}, {offset} inside its record window. If that looks right, confirm the match. The photo proposes; you decide. The own-photo rights declaration, a required check before any deposit, with this exact text (COPY): > I took this photo, or I hold the rights to it, and I choose to add it to this incident's public record under my name. Rationale (ethos): "we read... right here in your browser, and show you before anything else happens" is the lane's whole standing, so it goes in the first paragraph, verbatim from the directive's intent. The proposal line keeps the machine in its chair: matching is arithmetic on coordinates and timestamps, and the copy never lets arithmetic impersonate verification. The rights line is the individual form of the newsroom declaration in note 01 §2c; same declared-interest move, first person singular. ### 2c. NO-EXIF — the set-space-time lane Card header and body (COPY): > **Place it yourself.** > Some imagery carries no location or time: screenshots, scans, video frames, photos with the data stripped out. Open set-space-time, drop the pin where you stood, and set the clock to when you saw it. Action button (COPY): `Open set-space-time` The paste-back instruction, shown beside the button and repeated inside the tool's hand-back screen (COPY): > When you finish, set-space-time hands you a small stamp of that place and time. Copy it and paste it back here. It becomes your file's time and place, marked in the record as set by you, and the map matches from there exactly as it would from a camera's own numbers. Rationale: "marked in the record as set by you" is provenance honesty at zero extra cost; a hand-placed stamp and a camera-written one match the same way but must never be confused in the record. The lane's grammar stays invitation: the person who placed themselves on the map did the camera's job, and the copy treats that as competence. --- ## 3. The consent screen Shown after EXIF parse (or after a set-space-time paste-back), BEFORE the match proposal renders and BEFORE any deposit control exists. The pin sits on the map; the timestamp sits beside it; the copy sits under both. What was read (COPY): > **Here is what your photo told us.** > The pin is the location your camera wrote. The clock is the time it wrote. That is everything we read, it was read here in your browser, and nothing has left this page. What publishing means (COPY): > **Publishing means public.** If you continue, your file goes into this incident's contribution box: a public credited log that anyone can open. Your name travels on it as the credit line, along with the time and place above. There are no accounts here by design; the credit line is the whole identity. The blast-radius declared-intent line, reused verbatim from note 01 §1, shown under the (preselected, Public) radius indicator (COPY): > Today the blast radius travels with your file as your declared intent, recorded in its envelope. Per-person enforcement arrives with the access layer. Until then, treat each radius like a radio channel: say only what belongs on the widest net you picked. Buttons (COPY): `Continue to matching` · `Remove photo` The remove line, under the second button (COPY): > Remove wipes the photo and everything read from it out of this page's memory. Nothing was sent, so there is nothing to delete anywhere else. Deposit success, after submit (COPY, per note 01 §4 pattern): > **Deposited.** > Your file is in the {incident} contribution box with its envelope: what it is, when and where, and your name on the credit line. This log is public. Open the record, or add another. Buttons (COPY): `Open the record` · `Add another` Honest degradation, when the PUT fails (the 302 pattern, adapted verbatim in structure from note 01 §4) (COPY): > **The deposit didn't land.** > Nothing was lost, and nothing here pretends otherwise. We packaged a deposit bundle instead: your file plus a small envelope file recording what it is, when and where, and your credit line. Download it and hand it to the incident's record keeper, or try again. Buttons (COPY): `Download deposit bundle` · `Try again` Rationale: consent precedes celebration; the match proposal (§2b) is the first pleasurable beat in the flow and it is deliberately gated behind the plainest screen in the flow. "Publishing means public" carries the whole weight in three words because the flow has exactly one radius; the verbatim radius line still ships because it is the one honest sentence about access this workspace has ratified, and it applies at Public exactly as written. The degradation screen may not resemble success in color, iconography, or verbs. --- ## 4. Role variants (`?role=citizen|crews|em`) The role parameter swaps the hero line and one paragraph above the standfirst; the lanes, consent, and deposit copy never vary. Registers carried from note 00 §2. ### `?role=citizen` (register: Tab 1, invitation; pathos plus eros) (COPY): > **It starts with you.** > Every fire is seen by someone before it is seen by the system. If that someone is you, this page is where what you saw becomes part of what everyone knows: on the record, on the map, under your name. ### `?role=crews` (register: Tab 2, doctrine; ethos) (COPY): > **Gather citizen intel. Name it official.** > The community's eyes are already on your incident. This map is where their views land, each one timed, placed, and credited, so the picture on your screen carries the ground truth around your line. The honest stub line for official naming, directly under, quiet styling (COPY): > Today, marking a contribution official is recorded in its envelope as your declared intent. The official-naming workflow, with per-person authority behind it, arrives with the access layer. ### `?role=em` (register: Tab 3, dual flow; ethos plus logos) (COPY): > **Steward the two-way channel.** > Community views come in here with time and place attached, credited and public, ready to stand behind the warnings you send out. The channel stays two-way, and your county's picture belongs to your county. Rationale: one hero swap per role keeps the skeleton one page instead of three. The crews stub line is the same shape as the radius line (declared intent now, enforcement with the access layer) so the whole site tells the access-layer truth in a single recognizable grammar. The EM line reuses the ratified dual-flow doctrine without the word "collect" anywhere near it. --- ## 5. The no-match edge: the founding deposit Shown when a photo's (or hand-set) space-time falls inside no incident on the catalog. Invitation grammar throughout; never a dead end, never a faked event. (COPY): > **No incident on this map matches your time and place.** > That can mean you are early. Records start when a person starts them, and this page does not start incident records; it keeps its promises smaller than that. So we packaged your view as a founding deposit: your file, its envelope, the time and place, and your credit line, ready to be a record's first entry. > Download it and hand it to whoever keeps the record where you are: your local fire district, your county emergency manager, or the incidents catalog keeper. If a record opens for what you saw, your deposit goes in with it, unchanged and still yours. Buttons (COPY): `Download founding deposit` · `Check the map again` Rationale: "this page does not start incident records; it keeps its promises smaller than that" is skeleton honesty said with pride instead of apology. The founding deposit reuses the degradation bundle's mechanics (file plus envelope, download, hand-off, a named next actor) so one honest pattern serves both edges. "You are early" is the invitation register doing the work "you are the first to see it" does on the citizen tab, without promising that a fire exists; early is checkable, first is a claim. --- ## 6. What NOT to say - **No surveillance grammar.** Never "harvest," "collect," "crowdsource," "turn your phone into a sensor," "citizen reporting network," "submit a report." Members add to a record they belong to. Carried verbatim from note 00 §5 and note 01 §6. - **No capability inflation.** Never "reported," "authorities notified," "help is on the way," "real-time," or any delivery promise; the record promises custody and provenance, never receipt. The EXIF match is arithmetic on coordinates and never "verified," "authenticated," or "confirmed by alert.live." - **No faked success.** Never "sent," "submitted," "pending," "queued," or a green check when the PUT did not land; never an event created when nothing matched. The degradation screen (§3) and the founding deposit (§5) are the only alternatives to success and neither may resemble it. - **No privacy theater.** Never "anonymous" (the credit line is a name), never "secure upload," never "your data is safe with us." Say what happens: read in the browser, shown before anything else, sent only on submit, public after that. - **No account grammar.** Never "sign up," "log in," "create a profile," "your account." There are no accounts by design; the copy says so once (§3) and implies them nowhere. - **The Chelan respect gate (hard).** The Chelan Hills card on this map carries only the lessons-learned support frame from note 01 §5, RLS named first and authoritative; no entrapment detail as color, no drama, no product sentence on or adjacent to the card, no line that reads as the incident selling something. - **No counterfactual salvation.** No lane, consent screen, or empty state may claim a deposit would have saved anyone, anywhere. - **House rules in all deployed copy:** no em dashes; no "not X, but Y" construction; numbers only from the served collections' own records. --- ## 7. Builder notes (non-copy, binding) - **Tokens.** Two PUBLIC-BY-DESIGN scoped keys, one per incident, each write-only to its own `contributions/*`: Chelan tokenId `zsc8a6j5c330ppghlkho6fjd`, Maria tokenId `p6ww04gab2xa635d79l7xx9b`. Both are wallet-recorded. The owner mint token appears nowhere: no source, no comment, no copy, no error message. - **Privacy mechanics.** EXIF parsing client-side only (no file bytes on the wire before submit); geolocation behind the explicit `Share my location` click, never on load; no network call carries user data before the consent screen's submit; the consent screen renders before any match proposal or deposit control exists in the DOM. - **Skeleton honesty panel.** The page carries one quiet panel, footer-adjacent, with this copy (COPY): > **What this page is.** A working skeleton, honest about its bones. Working today: this map and its incident records, reading a photo's time and place in your browser, matching against the records, and credited deposits into each incident's public contribution box. Stubbed on purpose: no accounts, by design; per-person permissions and official naming arrive with the access layer; and when nothing matches, you get a founding deposit to hand off, because a page cannot start an incident record. A person does that. - **House.** alert.live dark palette; one live accent per page (role accent follows `?role`: green citizen, ember crews, cyan em; default green); type floors 15/14/13; `prefers-reduced-motion` respected on every map and morph animation; no trackers, no analytics, no third-party fonts phoning home. - **This workflow does not touch the landing page.** The mailto CTA retarget to this page happens in the separate edit already in flight. --- *2026-07-24 · © 2026 RedfishGroup · author: John (rhetoric persona, bead 6715f286) / CE for Stephen Guerin · all rights reserved (unless otherwise specified)*