Platform · capability register

What is not built

What runs today, what is built but blocked, what is designed, and what is ruled out.

Most platforms describe the finished version and let you discover the gaps. Each capability listed here carries one of five states, and this page is the register. If a page you are reading claims something this register contradicts, the register is right and the page is a bug.

WorkingYou can use it today, on invented data. The flow completes end to end.

Blocked upstreamBuilt and proven up to a boundary. The blocker is named, and so is what is waiting on it. A boundary we do not control reads Blocked upstream; one we chose reads On hold: our decision.

PreviewThe page exists and renders the design, with a banner at the top saying so. Nothing behind it runs. It is on the list of things to finish before launch.

Designed, not builtThe screens and rules exist and are decided. Nothing behind them runs.

Ruled outDeliberately not doing this. The reason is stated, and it is not a roadmap item.

How this page stays true

Every row below names the thing that must exist — or must not — for it to be in the list it is in, and a check reads those names against the codebase on every push. A feature that ships while still listed as not built fails the automatic checks on the change that ships it. That is the only reason to believe a page like this.

Your record

57 capabilities, each in the state its own evidence supports.

Working
The tick-bite workflowSeven steps, no account. What to record, what to hand a clinician, and what to watch for. Names no medicine and no amount.
Working
The tick-bite calendar reminder — a file made on your deviceOn the tick-bite page’s last step: one all-day calendar event across CDC’s window for a rash or a fever, counted from the day you found the tick if you recorded one and otherwise from today, made in your browser as a file you save to your own calendar. No email address is asked for, and nothing is stored or sent.
Working
Guided setup — your basics, records, first check-in, costs and care team, then what you shareThe first thing a new account sees: six steps in order, each saying done or not yet, and skipped where a step can be skipped — no score, no percentage and no count of steps left. The first five can be skipped and come back to; a skip is remembered, and whether a step is done is read from what your record holds. Where you start is your own answer: it chooses the first step, and a recent bite goes to the tick-bite page first. The last step explains what can be shared, with whom and until when, links to the consent page and has one button that changes no switch: sharing is decided on the consent page and beside the thing it governs, never here, and the dashboard opens once you have continued from that step. Patients only, whoever else is signed in.
Working
Timeline, check-in, daily logFive words, three taps. A day not logged stays a gap, and nothing is interpolated across it. The timeline draws every day of the stretch it lists as one square — recorded, marked too unwell to record, or no entry — and counts the three apart.
Working
Too unwell to record — a reason for an empty dayOn a day you could not describe, you can mark it too unwell to record instead of leaving it empty: today, or any day in the last thirteen weeks, and later if you could not at the time. A mark is never a sixth word and never a gap: it sits under no word, is averaged into nothing, and is counted on its own wherever days are summarised, apart from days with no entry. A day holds a check-in or a mark, not both: the record refuses a mark beside a check-in answer and removes a mark when an answer arrives. A journal note does not stop a mark and is left alone. Your own screens, the printed record, the appeal packet and the export show it; the export carries the day with no value and the reason “too unwell to record”. A clinician you share with sees how many such days there are in the last thirteen weeks and in the thirty days either side of each dated treatment’s start, and never when you marked them. The pre-visit brief, research and Beacon do not read it.
Working
Your progress — the month counted in your own wordsThe figures are counts over your own check-ins: how many days the window holds, the longest stretch with no entry and no mark, and for each question how many of the last 30 days you chose each of its words — never an average, a difference or a direction. No model writes about them: they are shown as counts, for you to read. The last 90 days and the whole record are drawn below, with gaps drawn as gaps and days you marked too unwell to record counted apart. No score, no streak.
Working
Findings on the body, on the timelineSomething you saw on your body, dated, with where and your own measurement if you took one — never graded. No photo: a picture carries more than was asked for, and holding one safely is its own design. Private to you: no clinician reads it and no research does. Added from the timeline, in a short form under the list: a date in the future is refused and a blank answer is left empty rather than stored.
Working
Visits, in your own wordsA visit you had — the setting, why you went and what came of it, as you wrote it. No clinician is named: the record has no place for one, so it can never become a list of doctors. Private to you. A visit you have had is not an appointment to come; the dashboard’s next-visit card stays designed. Added from the timeline, in a short form under the list: a date in the future is refused and a blank answer is left empty rather than stored.
Working
Where you werePlaces and stretches as you wrote them — the garden, a walking week, a trip. Text, never a coordinate: nothing maps a place, and no research reads one. Added from the timeline, in a short form under the list: a date in the future is refused and a blank answer is left empty rather than stored.
Working
The cost-of-illness ledgerOut-of-pocket, lost work days, caregiver hours, travel and unpaid hours as a ledger, not a budget — every line dated, in its kind’s own unit, saying where it came from; totals by kind and by year are arithmetic over the lines, hours never converted, nothing projected; a line can be removed. The plan’s figures stay on the claims timeline, linked. A printable sheet of one year’s lines, by kind and each in its own unit, is made from the ledger for an HSA or FSA administrator or a tax preparer; it prints no note, converts nothing, and does not say what any plan or return will accept. The plan-year bars, the superbill export and the fund hook are designed, and the fund states no figure.
Working
The diagnostic odyssey, with the exposure overlayExposure, symptom onset, every lab result’s date and every medication’s start on one line, each a day counted from the exposure — a fact about timing, never a verdict on any test, and no interval stated. The antibody-window band the design draws is not shown until it has been read against its source. The two dates are the patient’s own, entered on the page and never computed; the six kinds of entry read held or not held from the record, a kind not held drawn as a dashed mark. Every mark is listed in words with the drawing’s own shape beside it. The date lookup and the one-page export are designed.
Working
Print the whole record — one paginated documentEvery check-in as words, every lab result with its values as the laboratory printed them, every medication as recorded, the two dates, and every consent line the database wrote — in date order, ISO dates, provenance beside every section, a page number on every sheet, as disability assessors and new clinicians ask for it. The journal’s text is never in it (a note is marked, never printed); a result’s interpretation and a clinician’s notes are never in it; no number for a day is in it.
Working
Quick mode — one question on the days the dashboard is too muchFive words, one tap, and that is the whole thing: today’s overall word written to the record and nothing else on the row touched. No sidebar, no tab bar, no counts, no gaps, no asks; “Not today” writes nothing and the day stays a gap; a word already recorded opens on the done screen with a way to change it and an explicit way back to no word. Reached from the dashboard’s action row, never from the sidebar. Each word is a key in its own shade of one green, Rough the deepest and Clear the palest, with the word printed on it; the key holding today’s answer is pressed, with an inset ring, so the choice reads without colour. The worst-day principle made a page.
Working
The insurance fight kit — the appeal packet, assembled from your recordThe packet is assembled from facts the record already holds and never written for you: every imported claim and every ledger line with a plan’s or a receipt’s figure as dates of service, every lab result with its date and its values as the laboratory printed them, how long this has taken as a counted span, what has been tried as names and dates with no dose anywhere, and a request for a letter of medical necessity addressed to your clinician — the denial letter’s own words pasted in stay on this device and are sent nowhere. It prints as one document. SSDI, FMLA and 504 are described as processes with their agency sources, never as whether you qualify. Appeals tracked and the dismissal log are real: an appeal is your own record of a fight with a payer — the plan, the letter’s date, the letter’s deadline typed from the letter and never computed from a window, and where it stands — and the log records what was said, when and how it felt, in a table with no column for a name so it cannot become a list of doctors. Neither is in the packet; neither leaves. Nothing is sent from here and no reminder runs. The drafted letters are designed; the fund line promises nothing.
Working
The consent ledger and receiptsYour switches, and the history the database writes when one changes — every line since the record was born, with what follows from each. A dated, printable receipt of what is shared with whom and until when. Deletion stays a request to a person, and the page says what it erases and what it keeps. In the history, on and off are the same mark, with no colour on either.
Working
Add a lab report — your document kept, the values typed by you or read from a portal fileA PDF or a photo of the report is kept exactly as sent, with a fingerprint of its bytes, and is only ever offered back as a download. You type each value beside it exactly as printed; nothing reaches your record until you confirm it, and nothing of ours is added — no flag, no score, no conversion. No clinician sees a report you have not confirmed. A file from a patient portal (a C-CDA document or a FHIR JSON bundle) is read by a fixed parser, no model: each final lab report in it arrives filled in exactly as the file states it, for you to check and confirm one at a time, and the file's page lists what was not imported. Reports not yet confirmed wait as cards at the top of the page (the first five, then a count; each is listed under its file), and the review screen numbers the three steps. Once confirmed, a value reads as it does on the labs page: in ink unless the laboratory flagged it, and then with the laboratory's own flag beside it, in the flag's colour, or in ink for a flag that means as expected (NEG, ND, NR). Turned off on the shared demo account.
Working
Lab results — your panels, the bands that changed, and each band over timeEach report you have added, with where each came from; the bands that changed between your two newest panels; the same band over time; and which organisms your record holds a test for, read from the panels’, laboratories’ and tests’ names. The comparison is arithmetic over stored rows, never a model’s output. A reading in words is written only when you press for it and Beacon is on, and it is checked before it reaches you. A result is plotted and named, never scored. Reports arrive through “Add a lab report”, which is its own row.
Working
Medications — a record, not an engineWhat you take and when you started. No interaction checking, by rule rather than by omission.
Working
Pre-visit brief, patient and provider sidesThe same document both people see. Figures and dates, no interpretation.
Working
Beacon — talks through your own record, off until you switch it onOff until you turn its switch on, and the first message after you turn it off is refused. Each reply is written in full on the server and checked before any of it reaches you: one that names a diagnosis, gives a dose or a course length that is not read back from your own medication list, suggests changing a treatment, or scores you is not shown, and the page says why. That check is a list of patterns tested on fixed examples, not a guarantee. Calls are capped each day per account, per network address and overall; when a cap is reached, or the count cannot be read, Beacon says so instead of answering. On the shared demo seat everyone shares one account’s cap.
Working
Findings returned, with suppression shownGroup figures only, each with its n beside the counting rule. A finding cannot be published with a group under five, and one stored with one is not shown at all, so the floor is stated under every table rather than drawn as a blank row. The ones about a group your record is in come first, matched on your own record each time you open the page.
Working
Household record and the pet sentinelA dog positive says ticks are present where you live. It never says a person is infected.
Working
Export everythingOne file, FHIR. No wait, no request, no reason required.
Working
Who you shared with, in the export — FHIR R4 ConsentEach sharing switch and each care-team grant is a Consent in your export, with its dates; a grant you revoked is marked inactive with the time you revoked it, and a lapsed one keeps its real end date. Checked against the R4 JSON Schema — schema validation, not the full HL7 validator. A research cell is written as a Group only when it holds five or more records; the demo record’s does not, so it carries none. Caregiver mapping not built: there is no caregiver account, and the export has no mapping for one.
Working
Delete your accountOn request, not a button: email privacy@lymehq.com from the address you signed up with, and a person runs it. Your record is erased, including uploaded files, connection credentials and the login, and the household with its pets when you were its only member. What stays: the history of your consent choices and the log of who accessed what, both append-only, against an internal identifier that no longer names you; and any note a clinician wrote about their own reasoning while you shared with them, with its link to you cut.
Working
The recovery archive — if something changed, in your wordsOptional and quiet: how much changed, what changed, what you did — written, listed and removable, with “I can’t tell you what caused this” printed on every entry and held in no column, because a line the archive can stop saying is not the archive’s face. Where it goes is asked as two equal answers and nothing publishes: there is no reading room and no path from the archive to a clinician, a researcher, the brief, the export or the print, so the second answer records what you would want and the entry says it has not been acted on. The kit’s prompt — a comparison of two six-week windows of your own words — is a trajectory this product does not compute on a daily surface, so its trigger is a decision, shown as the design and fired by nothing.
Working
Tell it once, and the waiting-room stateOne narrative in your words, rendered for a clinician, an employer or a family member; a letter to one skeptic; a 21-day packet for a clinician who has never seen you; and, while you wait for a specialist, the baseline as a list, never a meter. The narrative is real: written, edited, printed as its own one-page document and removable, in a table no clinician can read — not the brief, not the export, not the packet, not the printed record, because handing it over is something you do rather than something the page does for you. Nothing composes it: a model writing in your voice from your record is the narrated form this product does not license, and the letter’s control says that rather than soon. The renderers are designed — what they add is a facts block chosen for the reader, and assembling one is the pre-visit brief’s mechanism. The grant has an end date since Migration 07; nothing here writes it. Visits you have had are recorded now; an appointment still to come is not.
Blocked upstream
Canine positives aggregated into a local presence signalA household can record its own dog result today, and county context is a sourced lookup to CAPC.Waiting on · Aggregating across households needs veterinary practices contributing results, and that portal is not built.
Preview
The caregiver seat — observations under your own name, never as the patientThe kit’s caregiver dashboard at /seats/caregiver: a stream attributed to the carer, hours for the patient’s ledger, the carer’s own check-in. No caregiver role exists in users.role, no seat table, no grant between seats — every figure is withheld and every control is designed.
Preview
The Access Fund — the public page and the rulesWhat it pays for (a denied lab, a first visit, an uncovered prescription), paid to the payee and never the person; the whole of the rules; the ledger, empty because no fund has opened. No pool, cap or award figure appears anywhere on it.
Preview
Ask the fundThe seven-step request as designed — category, payee, what, the invoice, fight-the-denial-first, the paper, one sentence — every control inert. No cap is stated and nothing can be sent.
Preview
The fund committee — a blind read by three of fiveThe conflict-of-interest declaration, the sealed request, the arithmetic already run, the four grounds and no fifth, the 72-hour clock. No committee exists and no request has ever been read.
Preview
Give to the fundOnce or monthly, a capped earmark, named or anonymous, the fee to the cent on the receipt, a follow-up on the payee class reached. No amount presets, no balance, and nothing can be charged.
Preview
Fund admin — payouts, reconciliation and the close, never an awardThe staff side as designed, on the public tree beside the pages it serves because no fund-admin role exists: W-9 gates, duplicate flags, the refund path, the monthly close, an append-only audit log. Every queue is empty; the two-admin threshold is marked illustrative.
Preview
The red-flag card and its escalationA printable handover for an emergency room, and a screen that looks like nothing else in the app. Detection is not built and nothing fires: the page shows the card’s shape as a specimen about nobody, links the emergency guidance that exists, and keeps the citation a citation. It stays a preview through the 15 October submission by decision (founder, 2026-09-18): what would fire is a clinical rule, and a card that may never look like an alert is a better argument as a design than as a half-built detector.
Designed, not built
Logging a day you missedToday the record takes an entry only for the day it is written — the server sets the date, so an earlier day cannot be rewritten quietly. As designed, a past day carries its own date and an added-later mark, so the record stays honest about when it was written. The table has no such mark yet.
Designed, not built
A state you set — flare, steady, remissionThe check-in draws the selector. Nothing holds a state the patient sets, so nothing records one, and nothing on the page infers one from the words.
Designed, not built
The nine check-in words with no place in the recordThe kit asks fifteen words. Six have a place in the record: five are asked as their own chip and fatigue is the Energy row, asked once. The other nine have none, so they are drawn dashed and cannot be tapped. Adding them widens what the record means, which is a schema change, and the list of symptoms stays six (founder, 2026-09-23).
Designed, not built
The energy envelope — where the day’s energy wentRest, home, work and people, each in five words. Nothing holds where the energy went, so nothing is recorded. As designed it describes a day and never budgets one for you.
Designed, not built
A photo on the check-in — a rash, a tick, a jointNothing takes a photograph yet. A picture carries a face, a home and a timestamp as well as the thing it shows, so it is built only when it can stay on the device until the patient chooses where it goes, with every sharing switch off.
Designed, not built
Calling a word what you call itRenaming any of the five words to the one you actually use. Your screen would show yours and the record would keep the position, so nothing counted or shared changes. Nothing holds your label yet.
Designed, not built
Who has ever seen each part of the record — the ledger turned aroundThe access log organised by what was opened, under the counting rule on the consent ledger. The log is append-only and exists; a patient cannot read it yet, so the section is the design.
Designed, not built
Journal highlights for a clinicianBeacon drafts a short set of highlights from the journal notes a patient chooses. The patient reads, edits or deletes every line and approves each one before a clinician they named can read it in the visit summary. Designed and decided, not built: nothing is drafted, nothing is shared, and the journal itself is never sent.
Designed, not built
The molecular record — organism by organism, assay and windowThe kit’s patient-side view: every organism, the assay that looked for it, the window it was drawn in and the result as the laboratory reported it, with a test that was never run said outright rather than left blank, whether the method is cleared for diagnosis or for research use only, and sequencing beside it. The lab-results page already shows which organisms a record holds a test for, read from the panels’, laboratories’ and tests’ names; nothing holds a per-organism assay, window, method status or sequencing result, so there is no page and the sidebar row is drawn inert.
Designed, not built
My protocol — what you take and when, as a daily pageThe kit’s page for the medication list as a day: each item with its timing and the date you started it, today’s doses ticked as facts with the server’s time, and reminders that are off until asked for. The medication list is real and is its own row, a record and not an engine. No page treats it as a daily protocol and nothing reminds you to take anything, so the sidebar row and the phone bar’s Protocol tab are drawn inert. A missed dose would be a fact, never a score.
Designed, not built
A page of its own for each pet’s sentinel recordA pet’s tests are recorded and read on the household page, which works and is its own row. The kit also draws a page for pets — each animal’s preventive calendar, the ticks found on it and its tick-panel results — and it does not exist, so the sidebar row is drawn inert. A positive would still say where ticks are and never what anyone has.
Designed, not built
Inviting a caregiver to part of your recordThe kit’s page: who you are inviting, what they could see and for how long — a pending grant that exists only once they accept, their observations attributed to them, one tap to end it. There is no caregiver account, so there is nobody to invite and the sidebar row is drawn inert. The caregiver seat’s preview is its own row.
Designed, not built
Beacon reading a tick photoSpecies and engorgement as observations to hand a clinician, never a risk number. Needs image input and the same output floor as every other Beacon reply.
Designed, not built
First sign-in — one question, once per accountSets the default seat for an account holding more than one. It never grants a verified seat; options that need a grant say so and open as pending.
Designed, not built
A narrated pre-visit brief, edited by youBeacon phrasing the thirty-day figures INTO the short printed brief a clinician reads, with a provenance stamp and the patient’s edits. The brief today is figures and dates and calls no model; the narrated form needs a branded disclosure, a causal-calibration floor and an injection backstop, and building it is a founder decision not yet taken. The reading Beacon gives you on the brief page is for you and never leaves.
Designed, not built
Beacon on the public guides — a reading aid for a strangerThe kit puts Beacon on every education guide. Deferred (founder, 2026-09-18): a stranger asking on a public page is a different risk surface from a patient asking about her own record, and the output floor has no public-page arm — building one under a deadline puts a hole in the floor. The guides carry the "explain it like I’m exhausted" toggle, which changes the type and calls no model.
Designed, not built
A phone’s health app — steps, sleep and resting heart rateDesigned, not built: nothing reads a phone. As designed, it is off until you turn it on, and steps, sleep and resting heart rate are each chosen on their own. A day’s readings sit beside your five words, never in their place; the phone’s own counts are never averaged and never turned into a trend, and nothing scores them or says what they mean. They are shared only through the sharing switches you already have, until the end date you set; research sees them only in groups of five or more. Disconnect, and delete what came in, at any time.
Designed, not built
A watch or a band — steps, sleep and resting heart rateDesigned, not built: nothing reads a watch or a band. It follows the same rules as a phone’s health app: off until you turn it on, each stream chosen on its own, shown beside your five words, counts never averaged, no score and no reading of what they mean, shared only through your sharing switches and their end date, research only in groups of five or more, and disconnect and delete at any time.
Designed, not built
A smart ring — steps, sleep and resting heart rateDesigned, not built: nothing reads a ring. It follows the same rules as a phone’s health app: off until you turn it on, each stream chosen on its own, shown beside your five words, counts never averaged, no score and no reading of what they mean, shared only through your sharing switches and their end date, research only in groups of five or more, and disconnect and delete at any time.
Ruled out
A wellness score, a streak, or any number that grades youColour here encodes verified, shared or flagged. It never encodes how well you are doing.
Ruled out
Drug-interaction checkingWe hold the record. We are not the engine that decides what is safe to combine.
Ruled out
Any risk score or probability about a personA place gets a presence lookup. A person never gets a meter.

Clinicians and research

21 capabilities, each in the state its own evidence supports.

Working
The clinician read pageOpened from a QR code the patient creates on the tick-bite page’s handoff step, no login: the short read of the six patient-entered facts and the symptoms line, never the photo, with its own minimal chrome. The link lasts fourteen days and the patient can withdraw it — the withdraw page renders on GET and only its button consumes; an unknown, expired or withdrawn code renders one identical ended state that never echoes the code. Every read is audited. The county feed is not wired and the citations are marked for review.
Working
Pre-visit delta — what changed since last visitThe last seven days as counts and dates, never arrows: days with an entry, days by the patient’s own overall word, new lab results, medication starts and stops, and the journal as a count with its content never included. The first section of the pre-visit brief, composed on the same path and behind the same switch, so the patient reads it before the clinician can; the panel links each patient’s delta beside their brief. Outcome capture, serology bands, the coverage gap and the handoff are designed; the kit’s invoice line is not drawn. Where the patient was is not drawn either: the places a patient records in their account are private to them.
Working
Shared with me, scoped to what was grantedExactly what the patient shared, for exactly as long as they shared it. The panel opens with the kit’s welcome card — what you see, what you never see, and the one thing to do now — each a statement a named check proves; it shows on every visit, because nothing stores a dismissal. A grant’s end date is not shown to the clinician.
Working
Provider verification and directoryAn approval means a person read one named document about that clinician. The listing says which, and what that covered: a licence document, or a provider-registry record that matches an identity and says nothing about a licence (F09, 2026-09-19). Per-facet evidence with its own dates and expiry is a separate designed row.
Working
Cohort counts, k of at least five enforced before displayCounts only, each beside its counting rule: a count is the sum of a cohort’s cells of five or more, so it reads “At least N”, and where no cell reaches five it reads “Count withheld: no group reaches 5” — never a number under five, on the cohort and on every saved cohort. The threshold is enforced in the database function, not in the template.
Working
The research access queue — an administrator’s verdict is what the export checksAn administrator sees every request a researcher has submitted and records a verdict: approve, with an end date or with none as a deliberate choice; deny, with a reason that must be written; or later revoke an approval. The verdict is the same record the research export reads, so an approved request returns cells for its one dataset, for that researcher, until its end date, and a denied or revoked one stops returning them on the researcher’s very next query. Nothing here lowers the floor of five: it belongs to the dataset, whatever is recorded on this screen. The protocol number and institution are what the researcher typed and nothing checks them against a registry, so a verdict records that a named administrator read what was submitted. Admin only.
Working
The clinical reasoning recordBoard-defensible documentation: the reasoning, the patient’s consent to the plan, the monitoring plan and the guideline versions in effect, frozen into the row at save — written and read here, append-only by trigger with no update or delete grant for anyone, so a correction is a new entry. The row is the author’s: writing one needs a patient you currently share with, checked by the database at the moment you save, and what you wrote stays yours after that share ends — which the patient is told where they decide to share, not in a policy page. ⛔ No field for a regimen, a dose or a duration, and nothing aggregates conformance: it is a description of where a plan sits under a named guideline set, never a grade and never a comparison with anyone — the three words are the same neutral chip on the form and on every entry, with no colour saying which is right. The dated export is designed; the parked tools are named as parked.
Working
The protocol library — reasoning and citations, versionedNotes on how a clinician approaches a presentation — the reasoning, the guideline it sits against as one of three words, the evidence leaned on — written and read here, with every version kept and none overwritten: an edit is a new row and there is no update or delete grant on either table, for the author or for us. ⛔ No regimen, dose, duration or outcome column anywhere, and the evidence field says why — how your patients did would make this a comparison between treatments. The network view stays designed: usage counts need a usage table, and a count of the clinicians who used a variant is a roster of clinicians by approach, which is not designed under a deadline. Every earlier version is one disclosure away on the note itself. Regimen composition, dose targets and stop criteria stay parked pending legal review.
Working
Two cohorts compared over timeBuilt: a researcher picks each cohort from fixed choices — region, age band, how soon after the bite they began recording, days logged, whether a treatment start is recorded — and reads the rule back in plain words with its version. Each week from the bite is drawn as how many people ended it on each of the five words a patient answers a day with (Rough, Hard, OK, Good, Clear), or with no overall word recorded. Every number shown is at least five: a band with fewer says “fewer than 5”, and where subtraction would reveal it one more band says “withheld”; no band is joined to another. No average, no line, no single person, nothing counted from a treatment start, and two cohorts that differ on treatment are not drawn side by side. It counts only a synthetic SAMPLE population, and only in demo mode. Real participants are never counted through a page like this one, because one cohort can be subtracted from another: counts about real people come only through the research-request queue — cohort definitions registered and reviewed before anything runs, every query recorded, a floor of five with protection against comparing overlapping queries, and reviewed results returned rather than a live query.
On hold: our decision
Medications and start dates, per patientEach medication with the start date the patient reported.Waiting on · Day counts before and after a start are held until clinical review.
Preview
Claiming a directory listingThe kit’s claim flow at /provider-directory/claim, drawn in full: the chosen listing, the three routes that would verify a clinician is who the listing names (a licence number against the state registry, a one-time link to a practice-domain address, a callback to the registry’s number), the fields a claim would fill, what claiming would never let them do, and what would happen after. Nothing writes. The submit is present and disabled with the reason beside it, no step states a turnaround, and three separate things stop a claim being served: there is no submission surface, a listing is read-only to every signed-in account at two layers, and one module is the only writer with its actor re-resolved from the database.
Preview
Provider plan and billingThree plans and what each includes, with the rule that a subscription buys a listing and never a verification. No payment processor is connected, so the prices are marked placeholders and nothing can be bought.
Preview
The Research Priority CommonsQuestions with a disposition — answered, not yet answerable, or closed with a reason — including the gap card that names the missing data element, deposits that must carry their plan and their contributors, and the four rules. No question or deposit table exists; the page is the design, with the one real thing named: the floor of five, in the database. It stays a preview through the 15 October submission by decision (founder, 2026-09-18): a public submission surface needs a moderation design first — submission is not publication — and the design is the argument.
Preview
The recruitment bridgePull, never push: a researcher composes an invitation and sees how many a cohort holds, never who; patients who match see it in their own record and answer with two equal buttons; the count of yes is withheld below five. No invitation table, no broadcast, no response channel — every control is designed, and the industry label is the one line that derives, from the session’s role. It stays a preview through the 15 October submission by decision (founder, 2026-09-18): a response row per patient is the roster the findings ruling refuses to store, and the ethics gate is not designed under a deadline.
Designed, not built
What a check covered, facet by facet, with its own date and expiryF09's other half (founder, 2026-09-19). The four facets — identity match, jurisdictional licence, practice details, availability — are separated on the listing today and the badge no longer says “licence” over a registry record. What is NOT held is a row per facet: today one evidence row carries a KIND and no jurisdiction and no expiry, so a licence that was read cannot say which state it licenses or whether it is still current. The model would be one evidence row per facet with its own document, jurisdiction, checked-on date and expiry, and a listing whose licence evidence has expired would drop that facet rather than the whole listing. It is a schema change and the schema is frozen.
Designed, not built
Search this area — the map as a live filterThe kit defines the contract (a `care-bounds` message from the map, a `care-map-cmd` message back); nothing in the directory handles it yet. Nothing is wired to a tile server and nothing draws a map — the directory shows an empty frame — so searching an area is the design. Listings do carry a place, and a listing’s page shows the practices closest to it as a straight line, but nothing lets a map set the search.
Designed, not built
Outcome capture on the pre-visit delta — a clinician’s three tapsThe kit’s delta lets a clinician record an outcome in three taps, "nothing changed today" one of them. Not built, and held out of Migration 06 on purpose (founder, 2026-09-18): a provider-written row the patient must be able to read is a disclosure direction this schema does not have, and inventing a consent model under a deadline is how a consent model gets invented badly. The delta’s READ half is on the plan; the write half waits for its own consent design.
Ruled out
Ratings and reviews of cliniciansA listing will never mean a star rating.
Ruled out
Any export that could identify a personNot a setting, not an admin override, not a research exception.
Ruled out
Benchmarking clinicians against each other
Ruled out
Regimen composition — doses, durations, stop criteriaNot parked pending a better idea. Not our decision to make.

Data and standards

18 capabilities, each in the state its own evidence supports.

Working
CDC tickborne surveillance, 1992 to 2023Pulled under fixed published controls: if the 2019 figures do not match the published numbers, the extractor refuses to write. Case-definition changes are drawn into the charts rather than smoothed over.
Working
Lyme disease by county on the Lyme MapEvery county CDC counts, 2001 to 2023, coloured by its reported cases for the year chosen, on one green scale from 0 to 500 or more. Once the Census population file is loaded, a second view colours counties by cases per 100,000 residents for 2020 on: LymeHQ’s calculation from CDC’s count and the Census Bureau’s July 1 estimate for the same year, said beside the figure, with counties under 20 cases greyed and no rate shown for them. A county with no count in CDC’s file is drawn as no data, never as zero. 2022 is a break: from that year high-incidence states report on laboratory evidence alone, so no line or bar joins it to earlier years. A county’s panel gives its cases by year, its rate beside its state’s, and a link into the tick-bite steps; the device’s location and the state and county lists find a county on the device, and so does a ZIP code once the Census ZIP code table is loaded; nothing about a place is sent anywhere or put in the page’s address. The same readings are a sortable table. Until the two Census files are loaded into a build, counts show, rates say they are not loaded, and the ZIP field says its table is not loaded.
Working
The element set and codebookWhat each field means, and what a patient’s own export carries for it. There is no code-system column, because this platform holds no code-system field — and /standards names the places no existing standard reaches rather than filling them.
On hold: our decision
The home page in SpanishThe kit’s own Spanish home strings, a hand-written Spanish header and footer (lib/i18n/chrome.ts: navigation copy only, with check:es-chrome asserting every rendered string has an entry and no entry is dead) and the /es routes are all in the tree. While it is hidden, /es and /es/* answer a temporary redirect to the English page, the language toggle does not render, and no page declares a Spanish alternate. One constant (lib/i18n/availability.ts) puts all of it back.Waiting on · Hidden until the full journey is translated and reviewed by a person (founder, 2026-10-01). Today only the home’s own strings and the chrome are Spanish; the doors, the systems, the flow and every page behind them are English.
On hold: our decision
Platform pages in Spanish, machine-translated at build timeBuilt, and switched off with the rest of the Spanish site: with it on, every page with no clinical claims is served at /es/<route> from lib/i18n/es-pages.json under the pill “traducción automática · sin revisar”, and clinical pages show the bar and are never translated. scripts/build-es.ts is the DeepL build step and refuses to write without a key.Waiting on · Hidden until the full journey is translated and reviewed by a person (founder, 2026-10-01): /es/<route> answers a temporary redirect to the English page and the language toggle does not render. Separately, there is no DEEPL_API_KEY in this environment, so the cache holds no page and every guide and platform page would show the “not yet generated” bar; a route that is neither — a tool — answers not found there by design. One run of `npm run build:es` with a key fills the cache; the review is what is missing.
Blocked upstream
CMS Blue Button 2.0 — your own Medicare claimsThe connect flow — the consent gate, the PKCE exchange and the redirect chain to CMS — is built and proven to the boundary against CMS’s sandbox. The production patient-access path CMS publishes is different: CMS Aligned Networks, a client_credentials grant with SMART asymmetric authentication and a cms_smart JWT extension modelled on TEFCA’s tefca_smart, carrying an IAL2 ID token from CLEAR or ID.me, with no medicare.gov login (bluebutton.cms.gov/cms-aligned-networks-documentation). That path is designed, not built.Waiting on · The sandbox fails on CMS’s side: its synthetic beneficiary logins fail at medicare.gov SSO, re-tested 24 September 2026 and reproduced on CMS’s own v3 test client in a clean browser with CMS’s published credentials. The production path needs a Medicare App Library listing and a registered JWK Set, and we have neither. No claims data has ever moved.
On hold: our decision
CDC’s county tick tables on the mapThe extractor reads CDC’s two county tables (blacklegged and western blacklegged tick status, and pathogens found in host-seeking ticks, through 31 December 2025), checks them against each other and against CDC’s counties, and refuses to write while they are held. Each county’s panel names the tables, quotes CDC’s terms and links CDC’s own maps of the same statuses.Waiting on · Held for a decision of ours: the tables’ first sheet says the downloaded data “should not be provided to other persons” and asks for a copy of any publication derived from them, so no county row is shown here and the page links CDC’s own maps of the same statuses instead.
Blocked upstream
Pathogen presence at block-group levelThe geography and the withholding rule are built — nothing under five is ever shown.Waiting on · The data needs a sharing agreement we do not have.
Preview
The health-official seat — block-group aggregates under a data-sharing agreementThe kit’s official dashboard at /seats/health-official: nightly files, cells withheld under five, the agreement that decides geography. Nothing exports to a county today; the research commons is the only aggregate surface and it is ZIP3 at k ≥ 5.
Preview
The admin seat’s dashboard — every queue and job, worst firstThe kit’s admin home at /seats/admin. The admin ROLE is real (AAL2 at the middleware; /admin/provider-verification and /admin/research-access run today) and has no quick-select by rule; the aggregated overview, the incident queue and the platform-health card are the design, not a screen anything feeds.
Designed, not built
The integrative guide inside your accountThe guide itself is a public page and it works. The kit’s account sidebar also draws a row for it, and the app never links out to a public page, so an in-app copy is what that row would open. No such page exists and the sidebar row is drawn inert; the public guide is where it is read.
Designed, not built
Lyme news, local firstThe kit’s news page: public feeds and journals indexed for Lyme and the tick-borne illnesses, ranked by distance and recency, every story showing its source type, with a weekly digest that is off by default. Nothing indexes a feed, so there is no page and the sidebar row is drawn inert.
Designed, not built
The audit log, readable by an administratorThe kit’s admin page: a log in which every entry names who acted, what they did, when and under which grant or rule, filtered by actor, action and window, with no edit and no delete. The log itself is real: it is append-only, and access to a record is written to it. No page reads it back for an administrator, so the sidebar row is drawn inert. The patient’s own view of it is a separate designed row, “Who has ever seen each part of the record”.
Designed, not built
Patient portal importThe live connection: signing in to a portal from here and pulling records with no file in between. The route is Individual Access Services under TEFCA, through a record vendor’s own programme — patient-directed, USCDI v3. Designed, not built. A C-CDA or FHIR JSON file you download from a portal already works: it is read into pending lab reports for you to check and confirm, under “Add a lab report — your document kept, the values typed by you or read from a portal file”.
Designed, not built
A dated changelog of what changed on the siteEvery entry a date and the decision behind it, with a correction route. Until it exists, the commit history is the changelog.
Designed, not built
A fourth review state — published without clinical sign-offThe kit marks some guides "published without clinical sign-off": shipped deliberately, unreviewed, because withholding them helped nobody — a statement about editorial policy that the three states here cannot make. Worth adopting, and a post-submission change (founder, 2026-09-18), since three surfaces render the review vocabulary; until then those guides read "pending clinical review", which is the honest mapping.
Ruled out
NHANES as a population baselineProbed and retired in August: no released cycle carries Borrelia content, and the API path we had cited does not exist. It was named as a live source in two prototypes before that check ran.
Ruled out
CURE ID as a sourceIt is a destination, not a source — there is no API in either direction. The honest verb is to prepare a submission.

Products

3 capabilities, each in the state its own evidence supports.

On hold: our decision
Products, shelves and the vendor seatOn hold by our decision.Waiting on · Paused for review after the demo.
Ruled out
Paid placement changing a grade or an orderCommission is disclosed and affects neither. If that ever changes, this line changes first.
Ruled out
Dosing guidance on a product pageWhat a thing is, and what the evidence says. Never how much to take.

The Tick Offensive

9 capabilities, each in the state its own evidence supports.

Preview
The veterinary-practice seat — every dog a sensor, results by block groupThe kit’s vet dashboard at /seats/veterinary-practice: contribute results, owner questions answered as the practice, the sentinel module. The pet sentinel that runs today is the household’s (check:sentinel); there is no practice seat and no block-group export.
Preview
The town-organiser seat — a Tick Offensive’s orders, roster and cash, never a recordThe kit’s organiser dashboard at /seats/town-organiser: pack night, captains, the county agreement. No campaign tables exist; every amount reads illustrative and every count is withheld.
Preview
The volunteer seat — a shift, a street, a phone treeThe kit’s volunteer dashboard at /seats/volunteer: doors knocked, a neighbour enrolled, the Saturday shift. No volunteer role and no campaign behind it; the page is the design with its figures withheld.
Preview
Property defense — the yard measured, not managedA profile of the place, a log of what was done to it, and the sentinel as the endpoint: the dog’s test and the block group’s sightings, never “fewer ticks seen”. The block group leaves the page; the parcel never does. No profile or log table exists, every figure is withheld, and choosing an acaricide entry would show a disclosure and never a rate, a mix, a timing or a place to spray.
Designed, not built
The Tick Offensive — landing, town page, trackerPets first, people second, yards last, then measure whether it worked.
Designed, not built
Organiser and volunteer coordinationTen further screens — enrolment, shifts, door cards, packing, backers, recognition. Designed in full. They only mean something with real towns in them.
Designed, not built
A published post-season result for every townThe campaign promises measurement. That promise is not yet kept anywhere.
Ruled out
Ranking towns or households against each otherStandings score participation on a street, and stop there.
Ruled out
Application instructions for any pesticideWe log what was done and measure what followed. We never tell anyone how to apply anything.

Everything about a person here is invented

The working flows complete, the states are real and the rules are enforced — but the people, labs, towns and results are not. Two things are not invented: the case counts come from CDC surveillance under fixed published controls, and the education library is written and published, with its clinical pages marked as pending clinical review.