Tapping the Recipient row pushes this page inside the same sheet — back
chevron, no new modal. Tap a row = select and pop straight back; there is
no confirm step, so rows are 60pt and the chevron is decoration.
Direction glyphs are muted mono, never accent: ⇄ mutual, → you can send
to them only. no daemon is a quiet fact, not a warning — they can still
receive and review a handoff from a phone.
The connect row sits in the footer, separated by the hairline: it is the
only surface in the whole flow that still shows a QR.

Empty state carries the whole mental model in one sentence, then a single
primary. No secondary “skip” — there is no handoff without a contact.

Nothing else moved: session card, Role segment, expiry pills, boundary
card and brief are the shipped components, unchanged. Two deltas only —
the recipient field now holds a contact chip (28pt avatar + label + direction
glyph, whole chip tappable, Change re-opens Frame 1), and the primary
reads Send to Frank: the offer is delivered over the existing link, so
there is no artefact for the user to carry anywhere.
Expiry now labels the Grant, not the link — hence the hint. The link outlives
every handoff; the grant dies on return, decline or timeout.

A collaborator ticket, not an invite: it carries a public key and a delivery
address, no session id and no scope. Short code is the fallback for
anyone who can't scan — same 8-char alphabet as the shipped invite.
“waiting for scan…” uses the neutral dot; nothing is running, and it must
not read as presence. Ticket TTL is short (10 min) because it is a
one-shot introduction, unlike the link it creates.

“Connected” is green because the binding succeeded — it is a completion,
not a presence light. The primary returns to the interrupted draft with
Aiko pre-selected; Done exists for people who came from Settings.

The fingerprint is the whole point of the screen, so it gets the largest
type on it (16px mono, two lines of four words) on a raised card. Word
groups beat hex: people read them aloud correctly.
Direction is stated in the second person and includes the negative half —
the recipient's first question is always “what can they see of mine?”.
Cancel is a plain secondary; refusing a connection is not dangerous.
Hit targets: both footer buttons 48pt, spaced 8pt.

Reached from Settings; the header QR glyph is the second (and last) entry
to Frame 3. Rows carry facts only — when the link was made and how
many handoffs have run over it. No avatars-with-status, no “last seen”:
we don't have presence and won't imply it.
Swipe reveals a single Remove action — the only danger colour on the
screen. Removed contacts fall to a terminal group at 45%: past handoffs
still reference them, so the row can't just disappear.

Same empty grammar as the shipped Handoffs empty state — glyph,
one sentence, ghost button.

Shown from the recipient's side, where the link is one-directional and the
reverse leg is disabled with a reason rather than hidden — the mono hint
tells them exactly what's missing.
History reuses the shipped status chips verbatim, so the colour law reads
identically here and in Session info.
Remove is the last row, states its consequence in one line, and is the only
red on the screen. No confirmation dialog is drawn here — it exists,
and it repeats this same sentence.

The push is deliberately content-free — “you have a new handoff offer”,
no project name, no sender detail — because notification payloads leave
the E2E envelope. Everything specific arrives over the link and renders
in-app.
Two pending offers stack (the peek behind); three or more collapse into
a counted group. View is terracotta: this is a needs-you moment. It opens
the shipped accept preview unchanged — the card is a doorway, not a
second trust screen, so it never lists scope details.

Tapping the push lands on the offer, never straight in the session —
the accept preview must always be crossed on purpose. Same card,
bigger buttons, plus one line explaining that View is safe.

Same card, same neutral dot, same 44pt buttons — only the strings and
the left action change. The mono line drops the short code (there is no
code any more) and states delivery instead: offer sent · Frank notified.
“Notified” is honest about what we know — the push was accepted by
the service; it does not claim Frank saw it, and never claims he is online.
Resend notify re-pings over the same link and rate-limits to once a
minute; it does not mint anything new. Recall keeps its danger tint and
stays the rightmost, destructive option.

The picker is a type-ahead popover anchored to the field, matching the model popover:
340px, raised, hairline, same group labels as mobile. Typing filters; ↑↓ moves; ⏎ selects.
The connect row is pinned to the popover footer so the QR path is reachable without
abandoning the draft — choosing it opens Frame 3 as a small dialog and returns here.
Desktop footer keeps the shipped cost-restatement chip; only the primary verb changed.

List left, detail right — the same 340px + fluid split the draft modal uses, so Settings and
dialogs share one rhythm. Selection is a raised row, not a tinted one: terracotta stays
reserved for needs-you moments.
Mutual links collapse to a single row with a Both ways chip rather than two entries;
the pane never implies presence — “connected 12d ago” is when the binding was made.
Remove gets an explicit button on desktop (no swipe affordance) and states both halves of
the consequence for a mutual link.