@@ -1299,7 +1308,7 @@ td.k { font-family: var(--f-code); font-size: 11.5px; color: var(--ink-2); }
1The account is on the bar. Decisions are stored per account, so the screen should say whose it is — and switching accounts should switch the lists.
2Policy cards become a plain radio group. Each description is one clause and adds a fact the title doesn't have; the mode formerly called Custom is named for what it does.
3The group header carries the grammar — "Log in without asking when…" — so each row is a completion, three or four words, no descriptions. The one row with a non-obvious default keeps a single short line.
- 4Exceptions contains only explicit overrides, so the header is true. A two-way segmented control replaces the ambiguous chip: a relay is here because you put it here, and clearing both segments removes the row.
+ 4Exceptions contains only explicit overrides, so the header is true. A two-way segmented control replaces the ambiguous chip — a relay is here because you put it here, and the control shows which way. ✕ removes the exception, dropping the relay back to your rules so it can ask again; an undo snackbar names what just happened. This is the old Forget, kept but disambiguated: it no longer sits beside a red chip that also looks like a block, and it no longer wipes the usage history, which now lives in its own list.
5Block-list relays get their own locked group. They outrank every control above them and were previously invisible.
@@ -1385,14 +1394,14 @@ td.k { font-family: var(--f-code); font-size: 11.5px; color: var(--ink-2); }
relay_auth_prompt_title
Confirm it's you to this relay?
-
Log in as %1$s? — now constant across all states; %1$s is the account, with its npub rendered beneath
+
Log in as %1$s? — now constant across all states; %1$s is the account handle
relay_auth_prompt_message
This relay wants to confirm it's really you first. Its operator will see which account you are.
-
"log in" already means "identify yourself" — the npub under the title shows what is handed over, which is more concrete than a sentence about it and doesn't have to be re-read on every prompt
+
"log in" already means "identify yourself", and the title names the account. Nothing replaces it — an npub under the title was tried and dropped: truncated, it can't be verified by eye, so it is decoration on every single prompt
@@ -1538,8 +1547,16 @@ td.k { font-family: var(--f-code); font-size: 11.5px; color: var(--ink-2); }
Nothing here yet — your global policy applies to every relay.
No exceptions yet. Every relay follows the rules above.
-
relay_auth_decision_allow
relay_auth_decision_deny
relay_auth_forget
-
Allow · Deny · Forget
Always · Never — a segmented control; clearing both removes the row, so "forget" disappears as a separate action
+
relay_auth_decision_allow
relay_auth_decision_deny
+
Allow · Deny
Always · Never — a two-way segmented control, so "allowed by policy" is no longer drawn as an explicit allow
+
relay_auth_last_used
diff --git a/amethyst/plans/2026-08-03-auth-permissions-redesign.md b/amethyst/plans/2026-08-03-auth-permissions-redesign.md
index 1ba03c79d1..87ec23b428 100644
--- a/amethyst/plans/2026-08-03-auth-permissions-redesign.md
+++ b/amethyst/plans/2026-08-03-auth-permissions-redesign.md
@@ -125,7 +125,6 @@ Further problems:
asks who you are
Log in as @vitor? (constant title; names the account — new)
-npub1vp3k9qz…q8x4k (the concrete thing handed over)
It won't accept your message for ⬤Alice Nakamoto from someone
it can't identify. (the ONE variable line; avatar inline)
@@ -140,11 +139,12 @@ The one reason sentence replaces the old title + purpose label + avatar row +
consequence line. Four buttons become two plus a switch. Nothing in the dialog
writes a global setting; the link navigates to the settings screen instead.
-`relay_auth_prompt_message` is **cut, not shortened**. "Log in" already means
-"identify yourself", so a sentence explaining that is boilerplate on every state —
-the same duplication this proposal is removing everywhere else. The npub under the
-title does the job better: it is the concrete value handed over rather than a
-description of it, and it doesn't have to be re-read on the fifth prompt.
+`relay_auth_prompt_message` is **cut, not shortened**, and nothing replaces it.
+"Log in" already means "identify yourself" and the title names the account, so a
+sentence explaining the disclosure is boilerplate on every state — the same
+duplication this proposal removes everywhere else. An npub under the title was
+tried and dropped for the same reason: truncated, it can't be verified by eye, so
+it is decoration that costs a line on every single prompt.
Reason sentence per state (P1′–P12′, incl. the two new kinds and the
never-reachable `MY_OWN_RELAY`) — see the copy deck in the HTML.
@@ -162,8 +162,12 @@ fixed height and the buttons never leave the fold.
- Toggle group header carries the grammar — "Log in without asking when…" — so each
row is a three-to-four-word completion with no description.
- The single mislabelled list splits into what it actually contains:
- **Exceptions** (explicit overrides only, two-way segmented `Always`/`Never`;
- clearing both removes the row, so "Forget" disappears as a separate action),
+ **Exceptions** (explicit overrides only, two-way segmented `Always`/`Never`,
+ plus **✕ Remove exception** — today's `Forget`, kept and retitled: it clears the
+ override so the relay drops back to your rules and asks again next time,
+ confirmed by an undo snackbar. It is unambiguous now in a way it wasn't: it no
+ longer sits beside a red chip that also reads as "block", and it no longer wipes
+ the usage history, which has its own list),
**Blocked by your block list** (locked, kind 10006 — previously invisible),
**Recent logins** (the log, with `SubPurpose` chips — "your inbox",
"a conversation", "reading 4 follows" — instead of an unlabelled facepile).