A network that holds as little as a network can.

A phone opens a slot on a relay with a random number and a key that only it holds. A contact deposits sealed blocks into that slot; the phone collects them. Every block is the same size, 4,096 bytes, whatever it carries, and a block of cover traffic is indistinguishable from a message. The relay keeps the slots in memory and writes nothing to a disk. Seize the machine and you hold the present moment's queue of sealed bytes, and nothing of the past.

What a relay operator can see, said plainly: that a connection arrived from the Tor network, that it opened or polled a numbered slot, when, and how many bytes. What it cannot see: who the person is, who the contact is, what the bytes say, or whether a block was a message or cover. There is no account, no phone number, no email, no address book, and nothing to hand over when asked.

Which relays exist is not something a phone asks a server to tell it. It is a signed document: a list of relay records, each with the relay's identity, its onion address, its clear address if it offers one, its operator, its network and its jurisdiction, and, for a company's relay, the company's key. The document carries a version number that only rises, and it is signed by a roster of keys the app pins. Two of the three must have signed, or the phone keeps the relay it already has.

The keys are the founder's, generated and kept off every build machine. The directory mechanism, the verification, the rollback refusal and the client's choice of relay from it are built and tested; the signed document itself is published the day the keys are used, and until then the app runs on its one pinned relay and says so on its own screen.

A conversation is two slots: yours, on the relay you chose, and your contact's, on theirs. When the directory lists relays under different operators, the phone that accepts an invitation chooses a relay for its own slot that is run by a different operator from the inviter's. One operator then holds one direction of a conversation and never both, so a seized or compelled relay yields half of a picture that it cannot complete.

Every piece of this is built: the per-relay transport, the choice at acceptance, the wakeups that follow the slot to its relay. It is dormant until a signed directory with a second operator's relay exists, and the app's own screen says "one relay" until that day rather than claiming a split it does not have.

The messenger reaches the network over Tor, built into the app, with the relay published only as an onion service: the relay never learns a phone's address. That is the Strict posture, and it is the default. The Simple posture is a choice a person makes on the Shield screen: the phone dials the relay's clear address directly through a handshake that checks the relay's certificate, which is faster to connect and costs the one thing Tor hides, the phone's address at the relay. The app says exactly that before the switch is turned.

The direct road exists in the app and is tested; the relay's clear door, with its certificate, is a deployment step on the relay that has not been taken. Until it is, a Simple phone goes to Tor at once, as before.

A relay that charges per account knows its customers. Avano's relays can charge per block instead, in tokens a phone mints by itself: the phone does a small amount of work, blinds the result, has the relay sign it without seeing it, and spends it later as a token the relay can verify but cannot connect to the minting. One token buys exactly one block, so padding a deposit buys nothing. The relay sees a valid token; it does not see whose.

The machinery is in both the relay and the app, and the live relay does not meter today: the tokens sit minted and unspent until an operator turns metering on. When one does, the same rail is what a company's seat and a paid tier would ride, and nothing in it names a person.

A relay has a byte budget for queued mail, a memory ceiling for everything it holds, and headroom so that a drain can always run. When it fills, it refuses new deposits first, sheds the conveniences next (cover slots, profile pictures, backups), and keeps the mail queues to the last. The order is written in the source, tested, and the relay prints one health line an operator can read from the machine itself: queued bytes against the budget, total bytes against the ceiling, live connections against the cap.

The running record of the network, row by row with the date each row was last true, is the infrastructure status page. What the apps can do on each phone is on limits. If a row here says live, that page says where; if it says built, that page says since when and what it waits on.