- NEW
Habits — a third system project for what you keep doing.
Open from the sidebar or with G H. Pick a name, pick a cadence (daily, specific weekdays, or N times a week), and start checking in. Each year gets its own broadsheet — a vertical almanac column on the left that fills as you keep things, and a 365-square ledger below today, one row per habit. Retro-tick within the last seven days. Sharing is off, by design — this one stays yours.
- NEW
Imagine the rest of the year, in six seconds.
A button on the Habits page paints an aspirational future across your ledger and almanac — about 90% of your remaining scheduled days, filled in over a 6-second reveal. The page stays scrollable while it plays: pan the almanac to watch summer arrive, scroll the ledger to read months you have not lived yet. ESC or Stop to come back. Nothing writes; it is strictly a vision.
- NEW
Today's check-ins live on the Workbench too.
A new Habits subpanel sits beside Open Loops, Today, Scratch, and the Session Journal. Same list as the Habits page Today section — one click to tick or skip without leaving whatever you were doing. The almanac and ledger stay on the Habits page itself.
- POLISH
Weekly-target runs credit the current week the moment you tick.
If you set a habit to three times a week, you used to see RUN · 0 all week until Monday rolled over. Now the first tick of the week ticks RUN to 1 — optimistic credit. If the week closes short, next Monday quietly drops it back. The number now matches what your eyes are doing.
What we shippedwhile you were reading.
A periodical, not a changelog. Each edition collects the work of a week or so — features, refinements, and the occasional set-right of something that wasn’t. Filed at the desk; printed in the order it arrived.
- NEW
@paperjot/mcp — a local MCP server for your vault.
npx @paperjot/mcp pairs once with your account (Settings → MCP access, type an 8-character code), wraps your identity keys with a device key from your OS keychain, and serves the vault to any MCP-compatible client through filesystem-shaped tools. list_dir, read_file, write_file, edit_file — the same shape LLMs are best at. Tasks are markdown with frontmatter; notes are markdown body, sealed. The process holds your keys in RAM and seals every byte before it hits the cloud. Subscriber feature.
- NEW
Shelve a note instead of deleting it.
A new Shelve action sits where Delete used to. The Notes view drops a Shelved chip into the meta strip when there’s anything on the shelf — click it for a quiet list with Restore and Delete forever beside each note. The daily count excludes shelved, so the headline stays about today.
- POLISH
MCP locks destructive ops behind the human.
The agent can mark a task abandoned (status: wont-do, reversible via reopen_task) but cannot hard-delete. Notes shelve instead of vanish. Permanent deletion stays a deliberate, in-app gesture — the agent can’t reach it.
- INFRA
A smoke test on the MCP surface caught nine bugs.
Bracket-escaped task lists, a Yjs fragment-name mismatch that silently emptied note bodies in the web editor, etag staleness on freshly-created files, scratch queries Firestore refused to list. All fixed; round-trip between MCP write and web TipTap read is clean.
- NEW
Workbench — what’s still open, all on one page.
Open it from the sidebar or with G W. Three panels in one tray: Open Loops along the top, Today on the left, Scratch on the right. Tasks you’ve started and notes you’re working on live together, sorted by what you touched last.
- NEW
Open Loops, in a tray that nudges you to triage.
The most recently touched loop carries a thin accent rule on its left edge — the page’s quiet “you are here.” Stale loops drift onto Today on their own after a few days. Hit five open loops and a soft hint surfaces; eight and a firmer banner asks you to wrap a few up before starting more. The thresholds live in Settings.
- NEW
A session journal that opens in place, on the loop.
Click the journal glyph on a loop and an embedded editor unfolds beneath the row — no leaving the page. Compact toolbar (bold, italic, headings, lists, links) with the rarer actions tucked behind a … overflow. The loop card already names what’s open, so the editor lets it.
- NEW
On the phone, the session journal takes the whole screen.
Same glyph, different surface. Below 880px the journal-icon hands off to a focus route at /app/workbench/loop/:id — top bar with a back-to-Workbench chevron, body filled by the editor, toolbar pinned where the keyboard expects it. The page gets the room it needs to be written in.
- NEW
Sessions now have their own corner of the Notes page.
Session notes auto-create on every task you start, and they used to crowd the regular list. Now an Everything / Notes / Sessions chip narrows the view, closed-loop sessions roll into a quiet “Past sessions” details footer, and every session row carries a mono lifecycle subtitle — “Active loop · 2h” or “Closed loop · 3d” — so the kind on the row is glanceable.
- POLISH
The populated workbench, redrawn after a design pass.
Eyebrow headers above the inline editors are gone — the loop card already names what’s open. The “current” loop’s full-bleed tint became a single hairline left-rule. The expanded body merges visually into the loop card instead of floating as a bordered island. Plus smaller things: a caret on Done today, Today/Scratch eyebrows aligned to the same baseline, and the Add-for-today button anchored to the row’s checkbox column.
- POLISH
Hover tray slimmed to the four that earn their seat.
Date, priority, comment, and a ⋯ overflow. Labels, sections, recurrence, assignee, project move, source-note jump and delete moved into the overflow with their keyboard hints printed alongside. The row reads as a row again.
- POLISH
An always-on due-line, coloured by urgency.
When a task has a date, the date sits beneath the title in mono — coral when overdue, sage when today, ink for the rest. No more hunting through chips for the one that matters most.
- NEW
Tap a row on a phone, get a proper detail sheet.
Slides up from the bottom — title, description, every picker, subtasks, comments, delete, all in thumb reach. Drag the handle down or swipe to dismiss. The cramped inline icon strip the row used to wrap below itself is gone.
- INFRA
Every tray picker is now portaled.
A shared FloatingPanel anchors fixed coords off the trigger and paints into the document body. Popovers opened from inside the mobile sheet — or anywhere with a scroll boundary — no longer get clipped.
- POLISH
Inbox-empty knows it’s the inbox.
When the inbox has nothing in it, the empty state speaks the inbox’s language — half-formed thoughts, errands, links — instead of the generic “all caught up.”
- POLISH
Show-sidebar moved into the topbar.
When the sidebar is hidden, the toggle now lives next to the rest of the topbar controls instead of floating at the canvas’ top-left. One less visual orphan on the page.
- NEW
System, Light, Dark — pick one in Settings → Appearance.
Default follows your operating system and flips when it does. Pin it to one register in the new Theme row.
- POLISH
A matte-warm palette, not slate.
The light theme is warm cream paper; the dark is its inverse — ink-stock with a cream-off-white foreground. Same identity, flipped. No Twitter-blue, no purple gradients, no compromise on the typeset register.
- POLISH
Paper grain that survives the dark.
The unlock stage, the app shell and the journal page each carry a faint paper grain. On a near-black surface it would have read as flat — so the noise inverts, the blend mode flips, and the texture stays in both registers.
- POLISH
PIN ink, re-stamped in pearl.
On the dark unlock screen the four PIN dots arrive as a warm pearl gradient instead of the cream-paper near-black, so the stamp still reads as a stamp.
- INFRA
Marketing surfaces stay in their light register.
Dark applies inside the app only. The home page, the sign-in flow and these editions keep their printed-page palette by design.
- NEW
Journal — one entry per day, kept under the same lock.
Open it from the sidebar or with ⇧J. Today’s page is waiting; arrow keys (or the almanac strip) walk you through the month. Entries are real notes under a hidden, undeletable system project — every byte runs through the existing crypto.
- NEW
An almanac strip and a marginalia of the day.
A horizontal calendar with a dot under days that have an entry. Below the page: what you finished today and what notes you touched, both linking back to where they live.
- POLISH
Editorial almanac aesthetic.
Fraunces masthead, Source Serif body, hairline spine, paper grain. The empty page asks once, in italics, then dissolves into prose the moment you start typing.
- POLISH
Note formatting bar, refit for the thumb.
Feather icons throughout, larger hit targets on phones, and the row scrolls horizontally when the glyphs run wider than the screen. The journal toolbar inherits all of it.
- NEW
Undo and redo at the head of the formatting bar.
Two glyphs (↶ ↷), set ahead of bold and italic. The keyboard chords — ⌘Z, ⇧⌘Z, ⌘Y — already worked; now the buttons match.
- FIX
Note undo, no longer silently inert.
A lifecycle race had the editor wiring its history stack to a torn-down doc on first mount; edits flowed through but never landed in the undo log. Both the buttons and the keyboard chords now hold their stack across re-renders.
- NEW
Quick unlock with a PIN, on this device.
Split-key: half on you, half on the server. Five wrong tries and the server forgets its half — the wrapped vault becomes uncipherable, and the device falls back to your password. Argon2id still does the heavy lifting.
- NEW
PIN enrollment, as a three-step wizard on phones.
One keypad per sheet, auto-advances on the fourth digit, shakes when the confirmation doesn’t match.
- POLISH
Unlock screen, reframed for the phone.
The editorial intro stays on desktop; on mobile, just the wordmark and the keypad, where the thumb already lives.
- POLISH
Working-state feedback while a PIN is being sealed.
The fourth dot finishes its stamp, the title swaps to “Sealing your PIN,” and the body explains the Argon2id wait — so the second-long compute reads as intentional, not a freeze.
- POLISH
Modal shells learn to scroll.
A safety net: if a dialog ever outgrows the viewport, it now scrolls instead of clipping.
- INFRA
A small server appears.
Cloud Functions, deployed to Iowa. Five callables for enrolling, recording success and failure, and revoking devices. Capped at five instances each — a ceiling on any runaway, well above expected load.
- FIX
CSP allowlist trimmed and tuned.
Callable endpoints now permitted; service-worker font fetches now permitted via connect-src rather than font-src. Two production-only blockers, retired.
- NEW
Responsive across mobile, iPad, desktop.
One layout, three sensibilities. The compose strip, sidebar, and note surface all relearn themselves at each breakpoint.
- NEW
Add to home screen.
Manifest, apple-touch metadata, and the standalone display mode wired up. Launch the vault from your dock.
- NEW
Priority picker on tasks.
P1 through P4, set without leaving the keyboard. The picker remembers what you reached for last.
- NEW
Time on a due date.
Pick a date alone, or a date with a time. We keep a sentinel for the date-only case so 3:00 pm doesn’t haunt every all-day reminder.
- NEW
Group saved views by project or priority.
Two new grouping modes, persisted with the view. The list reorganises without forgetting where you scrolled.
- NEW
A felt-block tick when a task is done.
A short, woody tone, synthesised on the page — no sample shipped. Off-by-toggle in Settings, silent when the tab is hidden.
- POLISH
Mobile note toolbar, anchored to the thumb.
Format actions slid to the bottom of the screen on phones, where the hand already lives.
- POLISH
Upcoming, reframed.
Today is Today. Upcoming now begins at tomorrow — not at this morning’s leftovers.
- POLISH
Task project chip, pinned.
A fixed-width slot on the right of every row. Lines no longer shift as you read down a list.
- POLISH
Vault unlock, tightened.
Halo clipped to the viewport, trailing whitespace collapsed, padding revisited.
- POLISH
Editorial column cap on wide screens.
A measure that doesn’t exhaust the eye, even on a 32-inch display.
- POLISH
Sidebar-hides-in-focus, driven by the DOM.
A small refactor: the rule now reads from the DOM rather than a body dataset, so focus mode stops fighting itself.
- POLISH
Completed tasks settle before they leave.
The strikethrough draws across the title, the row holds for a beat, then collapses out — long enough to undo, short enough to not feel laggy. Bulk-clearing tightens the dwell automatically.
- FIX
iOS Safari note editor crash.
A Safari quirk in the editor’s schema diff, worked around.
- FIX
"Back to notes" on mobile no longer snaps to the first note.
The list opens where you left it.
- FIX
Date picker no longer clears sectionId or subtasks.
The encrypted-side patch was reading a stale snapshot. It now merges, instead of overwriting.
- FIX
Wide-screen background and mobile close button.
Two cosmetic regressions, returned to spec.
- INFRA
Firebase config moved to the repo root.
And the access.memberUid index widened so the cross-project views can fan out at full speed.
- INFRA
Maximised note lifts above the sidebar layer.
A z-index tidy-up. The full-screen note no longer peeks through the chrome.
- NEW
Files.
Encrypted attachments. Every file is sealed to the project key on your device before a single byte leaves it.
- NEW
Comments and notifications.
Threaded discussion on tasks and notes. An in-app inbox surfaces replies that mention you, decrypted on read.
- NEW
V2 data model.
A schema redesign that paves the way for shared workspaces, richer linking, and the next year of work.
- NEW
Notes inbox + unified search.
Every project, every note — searched across keys you actually hold. The server sees nothing but ciphertext queries.
- NEW
A wordmark and a pulse.
Cipher becomes Paperjot. The new mark, set in Fraunces, ships with the encrypted-client-side pulse you see in the corner.
- INFRA
Pre-launch security hardening + rules audit.
A sweep of every read, write, and key-wrap path. Rules tightened where they could be; tests added where they couldn’t.
- POLISH
Editor refresh.
The note surface, restyled. Quieter chrome, kinder line-height.
- POLISH
Drop the "No project" built-in view.
It was scaffolding. Down it comes.
- NEW
Project sharing.
Invite a teammate by email. Their public key receives a wrapped copy of the project key. Revoke access and you really revoke it — past ciphertext was sealed to keys we never held.
- NEW
Notes editor.
TipTap, with the body of every note encrypted as a single payload — formatting, attachments, and all.
- NEW
Biometric unlock.
WebAuthn PRF + an IndexedDB cache. Touch ID or Windows Hello in lieu of typing your vault password each visit.
- NEW
End-to-end vault.
Sign-up derives an Argon2id key in your browser, wraps your project secrets, and writes only ciphertext to Firestore. Sign out, and the vault auto-locks.
- NEW
Tasks, captured fast.
Quick-add, toggle done, inline-edit, delete. The bones of a list, refined to one keystroke each.
- NEW
Projects.
Create, switch, delete. Each project gets its own key, wrapped to your vault.
- NEW
Natural-language due dates.
“Tomorrow 3pm,” “next Friday,” “in a week” — parsed in your browser, not on a server.
- NEW
Today and Upcoming.
Cross-project views that read from every project key at once, decrypted on the fly.
- INFRA
Firestore + storage rules with an emulator-backed test suite.
Every rule we write has a test that proves it bites.
- INFRA
Landing chunk, split.
Firebase, libsodium, and chrono no longer load until you reach for them. The front door stays light.
The next edition files when there is something worth filing. In the meantime —