What’s new with Murph

Monthly sponsorship and one-time contributions now return to the same group-funding flow when checkout needs to resume, reconcile, or explain what happened.

A verified payment still owns the credit grant, an uncertain checkout stays recoverable without a second charge, and group usage can continue independently of optional public creative output.

Group-room memory maintenance now preserves the latest trustworthy room context when a long conversation needs compaction or a background refresh fails.

The room keeps one trusted, limited history. A maintenance failure does not replace known context with an empty or misleading status.

When several scheduled jobs become due together, Murph can collect and clear the limited backlog in one coordinated pass instead of repeatedly waking around the same work.

Each occurrence keeps its existing approval and delivery path. Capacity stays limited, and one busy lane cannot silently create duplicate work.

Referral, experiment, biomarker, and other shareable pages now trace their social-preview assets correctly instead of losing the image during route rendering.

If a sync update briefly collides with another write, Murph releases the contested step quickly and asks the wearable service to try again.

The retry stays with the same sync job and cannot turn one update into a second import or duplicate health event.

Before sending a proactive group update, Murph now verifies that the saved conversation route belongs to that exact room.

It cannot borrow another member's route or guess a room from private identity. If the room is ambiguous, nothing sends.

Scheduled work can generate an image where the route supports image delivery, show an explicitly requested response card in a private direct chat, and offer a Clinical Records handoff that begins only after you open it.

Email delivery stays text-only, private and group boundaries stay intact, and Clinical Records sign-in does not start until you open its launcher.

In an authenticated group chat, a current participant can ask Murph to make one bounded public-venue or service call for the room without a special second approval step when the request is already complete.

Murph still asks for any missing commitment bound or requester fact. Participant, current-message, membership, privacy, and transfer checks remain in place, and a call start never claims the later outcome.

Private structured responses can once again arrive as interactive iMessage cards, with the existing static layout or deterministic text recovery when the extension is unavailable.

Murph now grounds a group reply in the room's learned norms and recent shared context without dropping that context when the prompt grows.

Room memory remains separate from private member memory. It guides how Murph participates but never creates identity, permission, or health-data sharing authority.

Paused, lapsed, or recently changed subscription states now resolve through one clearer access-recovery path instead of leaving Home or a browser return in a contradictory state.

Stripe remains the billing authority. Settings and conversational recovery wait for that projection, preserve scheduled plan changes, and avoid creating a second checkout while the first result is still uncertain.

Murph can now cancel a pending generated-file delivery before the send begins, without deleting the underlying private file or affecting a delivery that already started.

Rapidly enabling and disabling meal-photo capture now preserves the newest explicit choice even when an older setup or closeout operation finishes later.

A delayed operation cannot silently re-enable capture, duplicate a daily closeout, or override a later opt-out.

Settings now gives health-data consent actions a clearer hierarchy. Deep sleep and REM sleep now each use one clear permission, with source details included in that stage's choice instead of appearing as a second version.

Pausing processing remains distinct from export or account deletion. The app keeps the consequence visible before a change and does not hide the recovery action when processing is paused.

First contact now uses the faster welcome path and starts preparing the conversation after enrollment, reducing avoidable work before Murph's first useful reply.

Consent and activation still finish before the assistant can use member data. A failed prewarm quietly falls back to the ordinary durable message path.

A nutrition card or generated image that finishes late now resumes in its exact originating conversation and session instead of attaching to newer work.

Attachment transfer retries only before the send could have started. If delivery is ambiguous, Murph will not make a blind second attempt or duplicate the media.

After an explicit request in a verified private conversation, the support email can include a short model-written problem summary instead of attaching the raw conversation or service response.

The email stays linked to the member for follow-up and can contain free-form issue context. Recognizable shaped identifiers and secrets receive deterministic scrubbing, but the route does not guarantee that every private meaning is removed or promise a response time or ticket status.

Daily nutrition cards now use the supported iMessage layout, so the compact totals appear directly in the private conversation.

The card keeps the date, logged-meal count, every available total, one exact saved goal and status, and a visible partial-totals marker when meal support is incomplete. Text fallback remains available when the card route cannot be used.

On mobile, the one-time group contribution flow now opens as a focused bottom drawer with the amount and next action in reach; desktop keeps the dialog treatment.

Monthly sponsorship remains primary, a one-time contribution stays explicitly separate, and no payment starts until the contributor chooses the amount and continues.

Editing or reviewing one scheduled reminder no longer borrows authority from another reminder or loses an independently approved occurrence.

Each reminder keeps its own audience, schedule, and approval evidence. A review regression cannot silently send, suppress, or rewrite a different reminder.

Onboarding follow-up now expires after three days, and a group join can recover after activation without replaying setup that already finished.

The companion sync status also uses the server time for a trustworthy freshness comparison. Recovery resumes the existing activation and sync instead of starting a second one.

The model choice now states, in shorter language, that Venice can use included AI capacity faster before you commit the setting.

The explanation applies to future usage and keeps the actual model-rate accounting already introduced on the previous day.

When you share product feedback, Murph now clarifies the underlying problem and impact before jumping to a proposed solution.

The conversation stays user-facing and concise, and an escalation still requires the separate explicit support path.

The empty Environment panel now lines up with the rest of the dashboard instead of sitting inside a second, narrower page cap.

The existing voice walkthrough, chat alternative, report preview, desktop columns, and mobile stack keep their current behavior.

The public website footer now links directly to Murph's verified status page in a new tab.

Murph can keep ordinary replies, saved conversations, attachments, and uploads available while its saved data moves safely.

If Murph cannot confirm that the new storage is ready, the move stops safely. Messages already received remain available when the conversation resumes.

Murph now looks up a nutrition label or food-database match for each identifiable part of a meal before estimating its nutrients.

Portions still come from the photo and conversation, while sauces, fats, drinks, and exact supplement labels stay explicit. A general estimate is used only when database and official-source lookup cannot resolve the food.

When you provide a destination for an approved physical note, Murph can temporarily complete a missing city, state, or ZIP code from the address you supplied.

The lookup cannot discover where someone lives, saved prompts and notes never gain the address, and Murph's platform-owned return address stays separate from the recipient destination.

Murph no longer turns remaining AI capacity into a guessed number of messages, even when you ask how many replies are left.

Usage answers use the known percentage, reset date, trial date, or day-level forecast instead. They do not pretend that differently sized requests consume a predictable message count.

Replies sent through Venice now consume included AI capacity at the underlying provider rate instead of using the managed-model price.

Settings explains that this choice can use capacity faster. The change applies to new usage only and does not reprice earlier replies.

A temporary failure while saving a replay-safe device-sync artifact now retries through the existing sync job instead of ending the import immediately.

Only safe transient writes retry. Permanent errors still stop with their specific failure, and the retry does not create a second import or duplicate user action.

A newly accepted message now keeps foreground priority when it arrives just after Murph wakes from a saved checkpoint.

The change is invisible when timing is normal. In the race it fixes, the new message reaches the ordinary reply path instead of waiting behind restored background work.

Murph now keeps a bounded room index of captions, positions, and corrections for recent group photos, then checks it before asking for another upload.

References stay tied to the conversation and do not use face recognition. Corrections can update which known photo the group means without turning the image into an identity record.

When managed AI usage is exhausted, accepted work stays safely pending instead of being mislabeled as a runtime failure during a background wake.

Murph does not consume the conversation or call a metered model while access is denied. The existing usage message explains the block, and the existing continuation path can resume after capacity changes.