A reminder can't be sealed.

A derived output

The house doctrine gives a PNA exactly two ways of touching another person: the gate is how others read you; message transport is how you speak. A reminder touches no one: no envelope, no verb, no pairing, no roster. So we name it a derived output, the same family as derived/event.ics (the archive compiling what it already holds into a form that reaches its own owner at the right moment).

Sovereignty is symmetric. When three archives confirm a Saturday walk, each derives its own reminders, under its own rules, on its own channels. Nothing about reminding crosses the wire: not the ladder you chose, not a snooze, not whether your archive had to nag you three times. How much reminding a person needs is health data: memory, vigilance, executive function. The rail already refuses to share completion (I9, enforced); this design extends the refusal to the nag itself (R1).

The central asymmetry

Text-message transport could demand the e2e rung because a machine receives the envelope and decrypts before any human looks. A reminder has no decrypt step to hide behind. The whole point is that a person can read it at arm's length, on whatever surface she actually looks at. It cannot be sealed, ever, by construction.

Therefore the only privacy controls that exist for a reminder are what it says and which road carries it. The whole design is those two controls made explicit and enforced:

• The postcard rule, generalized (from the text-message transport page's §6): every operator-carried reminder is a postcard. It may say only what you would write on the back of a postcard the mail carrier reads, because the mail carrier does read it.
• Payload follows rung. One reminder renders differently per channel class: full detail on hardware you hold, postcard through anyone else's servers, by default. Escalation is per-channel, explicit, and faced with one plain sentence.

The channel registry

Every delivery road is declared once in Reminders/channels/<id>.yaml and judged by the message transport catalog's one question: who operates this road, and what do they see? Two rungs only: device (renders on hardware you hold) and operator(<who>) (a named company's servers carry and can read the text).

Payload follows rung (R2, R3)

Composed fields only (R3) — the utterance-only rule, turned inward: a reminder's outbound text contains only what was composed or derived for it at set-time. The archive may know the medication's dose; the SMS says what you wrote for exposure. Nothing is ever auto-attached.

Two sources, one queue

Together-derived (automatic). When CONFIRM lands and event.yaml shows agreed, replay derives reminder occurrences from the agreed UTC instant plus standing rules. These are never originals. Delete every derived reminder and pna remind rebuild reconstructs them from the signed exchange plus rules.yaml. CANCEL, WITHDRAW, and DONE quiesce pending occurrences on replay (R9): a tombstoned walk never nags.

Composed life items (originals). Medication at 8:00 daily, the car inspection August 1, call mamá on Sundays. One YAML per item in Reminders/items/: title, note, when, channels, urgency, and optionally a postcard line composed in the knowledge it travels exposed.

Current limit: a reminder must be machine-readable to fire, so the floor is C1. A C0-sealed item cannot have reminders because the scheduler cannot read it. Blind reminders for sealed items ("something at 10:00") are outside v0.1.

Doctrine lands intact: originals are canonical; the queue is an index. rebuild reconstructs derived/ byte-identically from items + rules + the Together exchange replay + the delivery log (fired marks are history, and history is original). A Together-derived reminder never appears under items/, because its original is the signed agreement.

Timing and recurrence

• A moment is a UTC instant + IANA zone name. An offset is never stored; DST cannot fork a reminder any more than it could fork the agreement (the rail's law, inherited).
• Two anchor kinds: offset — an ISO-8601 duration before the source instant (PT1H); local-clock — a named wall-time in the owner's zone ("the evening before at 19:00 your time"), computed in zone-name space so it stays 19:00 through any DST edge.
• Default ladder for Together events: evening-before 19:00 local + PT1H; life items default to the instant. Per-source rules; per-item overrides. (Founder sign-off pending on the defaults; recorded. Work continues while it waits.)
• Quiet hours are law (R8). Default 22:00–07:00 local: a non-urgent reminder due inside the window defers to the morning edge, one log line, labeled as deferred on arrival. Only urgent: true crosses, set by the owner at compose-time. The machine never promotes it. Sleep is health.
• Recurrence, the narrow subset: life items may repeat DAILY or WEEKLY (by weekday, with interval), local-clock anchored, chosen because medication adherence is the core case and 365 one-taps would be misleading UX. Maps one-to-one onto RFC 5545 (FREQ=DAILY|WEEKLY;INTERVAL;BYDAY) so the .ics stays portable. Together events don't recur: DUPLICATE remains the "same time next week" (decided in the sharing spec, and left as decided). Occurrences materialize over a rolling horizon (default 14 days), each keyed (rem-id, occurrence-utc), the idempotency key for everything downstream.

Delivery — the awake question

The design's engineering split, stated before anyone asks why SMS didn't fire while the laptop was closed:

Semantics: at-least-once attempts, at-most-once effect. The delivery log is the dedupe truth: the agent consults it before every send; a double-run no-ops; a rebuild consults it so a fired occurrence can never re-arm (R6). Logging is fail-closed: no log line, no delivery, and no artifact compile either (R5). Channel credentials live under the archive's secrets discipline at C0. They are read at fire time and at no other moment, and they appear in no queue, artifact, or log line (R10). No delivery receipt of any form leaves the archive: nobody learns whether your archive had to remind you (R1).

The Together rail's existing derived/event.ics (built, tested at A2) gains VALARM blocks inside the same build_ics boundary, inheriting its sanitization: the adversarial pass's bare-CR ICS-injection fix and _sanitize_display apply to alarm DESCRIPTION fields exactly as to SUMMARY (I10).

Privacy invariants (spec §9)

• R1 — Reminders address only the owner. No reminder, receipt, snooze, or completion signal crosses to another person, ever. Reminding someone else belongs to message transport and requires a human choice. Automation never does it.
• R2 — Payload follows rung. full renders only at device; every operator channel gets postcard unless explicitly escalated, facing the plain sentence; escalations recorded, exposed sends logged.
• R3 — Composed fields only. Outbound text is what was composed or derived at set-time. Archive contents are never auto-attached.
• R4 — The queue is derived. Delete derived/*; rebuild reconstructs byte-identically from originals + rules + log.
• R5 — Log or fail closed. One log line per arm/fire/defer/deliver/expire/cancel; unwritable log ⇒ the operation doesn't happen.
• R6 — Idempotent effect. (rem-id, occurrence-utc, channel) delivers at most once across agent re-runs, replays, and rebuilds.
• R7 — Late is labeled; stale expires. A post-due delivery says it's late; past the staleness bound it retires with a log line. A late delivery is never labeled on time.
• R8 — Quiet hours are law; urgency is the owner's word. Deferrals logged; only compose-time urgent crosses. The machine may never promote urgency.
• R9 — Cancellation follows the source. Tombstoned, withdrawn, or DONE events quiesce pending occurrences on replay. Nothing rewrites fired history.
• R10 — Credentials are C0 and fire-time-only. A secret never lands in a queue, an artifact, or a log.

Enforced versus future: the full table

The status labels follow the builders page: ENFORCED means a current test refuses the violation. The build ran the same day as the specification, every acceptance criterion passed, and an independent adversarial pass reviewed the result. FUTURE means designed for a later version. The first four rows were already enforced by the rail; the C-rows belong to this build.

Never in scope

• Reminding other people, as automation. Nudging Marta through message transport is a human act: a scheduler that messages your friends is a different product, and a worse one.
• Streaks, scores, gamification. The archive keeps your word. It never grades you on it.
• Adaptive timing that changes itself. The local AI may suggest a ladder from your patterns (C1 data — its right). It may never silently change one.
• Any delivery receipt leaving the archive. R1 is absolute.

Attack here (pre-registered before the build — and the list earned its keep)

These targets were published before any code existed; the build's independent adversarial pass then ran them. Outcome: the VALARM-injection target yielded two real injections (anchor durations reaching TRIGGER; RRULE BYDAY unvalidated), the postcard target yielded the kind/rung coherence hole (an operator-by-nature channel claiming device), the dedupe target yielded the ctrl-C fake-delivery, plus one class the list missed: WEEKLY-without-BYDAY over-firing seven days a week. All five fixed and pinned; details in pna/PNA-REMINDERS-BUILD-REPORT.md. The list stands for the next attacker. Good-faith security research is welcome through the main site's Write to us → security door — a safe harbor written into our Terms, §15.

• VALARM field injection — a hostile title reaching alarm DESCRIPTION despite the inherited sanitizers (the rail's defect #1, retried at the new boundary).
• Postcard leakage — any path by which full fields, archive paths, or un-composed content reach an unescalated operator channel (C2's serialization assertion is only the floor).
• Quiet-hours bypass — zone-name lies, DST-edge arithmetic, or machine-promoted urgency (R8 says only the owner's compose-time word crosses).
• Dedupe races — two agent runs firing the same occurrence on the same channel; rebuild resurrecting a fired occurrence (R6 vs. a hostile or truncated delivery log).
• Credential exposure — secrets appearing in queue, artifact, log, or error text at any point in a full pass (C10).
• Staleness-boundary abuse: deliveries wedged to fire absurdly late, or expiries used to silently suppress reminders that should have fired late-and-labeled (R7's two halves against each other).

Where it sits

This is the Together rail's first inward derivation — the plan-making is built (the sharing rail, 126 tests of its own); the reminding is designed against it. For the delivery channels we inherit the message transport catalog's verdicts — calendars as derived-output targets, uniform distrust of messaging operators. The product tether is the PRD's Care Calendar (P3), which promised "recurring rhythms… reminders"; this is the mechanism underneath the promise. Working documents, in the repository: pna/REMINDERS-SPEC-v0.1.md · pna/SHARING-SPEC-v0.1.md · pna/COURIER-SMS-SPEC-v0.1.md · pna/COURIER-CONCEPT-v0.1.md.

Where this stands