Safety-Gate Architecture

The digital wellbeing field has spent the better part of a decade documenting what happens when people interact with connection platforms not designed with their wellbeing in mind. Loneliness has risen across populations saturated with digital communication tools (Murthy, 2023; Holt-Lunstad, 2017). The evidence on social media and adolescent mental health, while genuinely contested in its effect sizes, is the subject of active debate (Twenge et al., 2018; Orben & Przybylski, 2019).

The public-health framing of loneliness - articulated through Holt-Lunstad's work connecting social isolation to mortality risk - has moved from academic literature into policy language at the WHO, the UK government, and the US Surgeon General's office. The field has responded with individual-level interventions (screen-time tools, usage dashboards, notification controls, digital-detox frameworks) and with design-level and regulatory responses (dark-pattern rules, default privacy protections, the early contours of EU AI accountability). These are not useless. But the dominant individual-level responses share an assumption: that the problem is how much people use connection infrastructure, or what content flows through it. There is also a substantial design-ethics tradition that already challenges that assumption and to which this paper is indebted. Value-sensitive design (Friedman & Hendry, 2019) argues that human values can and should be designed into technical systems from the outset. Positive computing (Calvo & Peters, 2014) proposes designing explicitly for wellbeing and human potential. The critique of persuasive technology (Fogg, 2003) and the subsequent humane-technology movement have named the harms of engagement-optimised design directly. Choice-architecture and nudge theory (Thaler & Sunstein, 2008) supply a vocabulary for how design shapes decisions. This paper does not claim to invent the idea that platforms should be designed for wellbeing; that idea has a literature. What it claims to contribute is narrower and, precisely because it is narrower, testable: a specific architectural mechanism - a session-level, behaviourally-updated readiness inference used as a structural pre-condition to connection events, with explicit suppression logic - that these traditions motivate but have not, for connection platforms, operationalised. The structural question this mechanism addresses is: how should a connection platform be architected if its goal is appropriate connection rather than connection frequency? Safety-gate architecture positions emotional-readiness assessment as a structural prerequisite for connection events. It does not optimise for connection frequency. It optimises for connection appropriateness - connection occurring in the presence of behavioural indicators suggesting a state conducive to genuine relational engagement - while reserving outright blocking for a small set of explicit safety conditions. The paper grounds this in a concrete implementation. Wouch is a connection platform in closed beta, built from the premise that the dominant architecture of dating and social-connection apps is structurally misaligned with what connection requires. It implements a working version of the framework: a Bayesian inference model seeded by a structured psychological assessment and updated by behavioural observation; an intervention library grounded in established psychological frameworks; and explicit suppression logic specifying when the gate should not activate. Wouch is used here the way a thought experiment is used - to make an abstract design argument tractable - but Wouch is not a thought experiment. It exists, and its design decisions can be examined, challenged, replicated, or improved. Where the implementation is partial or differs from the idealised framework, this paper says so. One paragraph deserves to stand without theoretical framing. Wouch was not designed in a product meeting. It was built by someone who spent eight years homeschooling a son while a marriage broke down - not from absence of love, but because two adults with unexamined psychological wounds could not sustain a partnership built without understanding those wounds. When the marriage ended, the question that replaced grief was not why this had happened, but what architecture could exist so that the next person reaching toward connection would have something better to navigate by than attraction and hope. That origin does not validate the framework; the framework stands or falls on the evidence. But it explains why the design question at the centre of this paper is not abstract. Section 2 examines the engagement-optimisation paradigm before critiquing it.Section 3 develops theoretical foundations across four frameworks.Section 4 introduces safety-gate architecture formally, with Wouch as a case study and an explicit account of where the implementation is partial.Section 5 distinguishes it from adjacent interventions and situates it within existing design-ethics traditions.Section 6 proposes a pre-registerable empirical agenda and an explicit collaboration invitation.Section 7 connects the framework to three policy initiatives.Section 8 states limitations without softening.Section 9 concludes.

The Engineering Logic of Engagement Optimisation

The dominant consumer-platform revenue model — advertising — requires large, persistent, demographically characterisable audiences. Network effects require high connection frequency to generate the reciprocal engagement that attracts new users. The product metrics available to engineering teams — time on app, connection events initiated, messages sent, daily active users — are quantifiable, A/B-testable, and tied to revenue. Connection quality is not quantifiable in those terms, not A/B-testable, and does not appear in the dashboard. Given these constraints, engagement optimisation is the predictable output of a rational process. The incentive structure selects for it; the measurement infrastructure supports it; the competitive environment rewards it. Platform designers are not, as a class, indifferent to wellbeing. But a paradigm built on optimisable metrics optimises for those metrics, and the metrics chosen — for structural reasons that preceded any individual decision — do not include emotional readiness, relational safety, or connection appropriateness. This is the problem. Not malice. Architecture.

The Documented Mental Health Costs: What the Evidence Actually Shows

The relationship between social-media use and mental-health outcomes is one of the most contested empirical questions in contemporary psychology, and intellectual honesty about that contest is essential for anyone making design arguments on its basis. Twenge and colleagues (2018) found significant associations between smartphone/social-media use and depressive symptoms, particularly among adolescents, with longitudinal analyses suggesting the relationship is not purely correlational. Haidt and Allen (2020) argue that the convergence of evidence across methodologies warrants treating the association as meaningful even absent a definitive causal study. On the other side, Orben and Przybylski (2019), in a pre-registered analysis of large datasets, demonstrated that typically-cited effect sizes are modest — comparable to the association between wellbeing and wearing glasses — and that analytic flexibility has likely inflated reported effects. The honest summary: the evidence that current platform architecture causes significant population-level mental-health harm is suggestive but not definitive. What is definitively missing from the literature — the gap this paper inhabits — is any study of whether connection mediated through readiness-aware architecture produces different outcomes than connection mediated through engagement-optimised architecture. That question has not been studied because platforms implementing such architecture have not existed. That condition is beginning to change.

The Missing Variable: Readiness at the Moment of Connection

Research on digital connection and mental health has extensively studied what users do on platforms and what happens to them over time. It has not systematically studied the emotional state of users at the moment of connection initiation, or whether that state is architecturally relevant to outcomes. This absence is a consequence of the paradigm. Within engagement optimisation, all connection moments are equivalent. A user initiating a conversation at the end of a regulated, socially connected day is treated identically, at the architectural level, to one initiating the same action in acute loneliness or dysregulation. The platform does not distinguish them because it has no incentive to. Connection frequency is the metric, maximised regardless of state. Safety-gate architecture proposes that this equivalence is the foundational error: the assumption that the moment of connection initiation carries no architecturally relevant information about the quality of the connection likely to result.

Attachment Theory: Readiness Is Not a Fixed State

Bowlby's foundational work (1969, 1973) and Ainsworth's elaboration of individual differences (Ainsworth et al., 1978) generated one of developmental psychology's most robust literatures. Attachment anxiety and avoidance — the two dimensions measured by the Experiences in Close Relationships scale (Brennan, Clark, & Shaver, 1998) — are not fixed traits but activation states. Mikulincer and Shaver (2007) have shown that attachment-system activation is context-dependent, responding to perceived threat, safety cues, prior interaction patterns, and recent emotional load. A predominantly secure person can experience temporary hyperactivation under stress; a predominantly anxious person can experience relative deactivation in environments signalling safety. The implication for design is specific: a user's capacity for genuine relational engagement varies across and within sessions and in response to the prior context of their day. A platform indifferent to this variation is betting that the variation is not architecturally relevant. Safety-gate architecture bets that it is. Critically, the framework uses attachment theory as a design heuristic, not a clinical measurement framework: it does not assess or diagnose attachment style. It observes behavioural patterns consistent with elevated readiness or dysregulation and uses them to modulate timing. The distinction is non-negotiable in research and clinical contexts.

Polyvagal Theory and the Nervous-System Prerequisite

Porges's polyvagal theory (1995, 2011) offers a neurobiological rationale for why safety is a physiological prerequisite for genuine social engagement: the ventral-vagal complex supports the regulated states in which nuanced communication and attentive listening are possible, while sympathetic activation or dorsal-vagal shutdown functionally compromise the social-engagement system. Platform architecture cannot measure autonomic state, and safety-gate architecture does not claim to. But the framework provides the theoretical rationale for why the moment of connection matters: a user whose behavioural signals are consistent with dysregulation is likely operating from a state that limits connection quality, regardless of intention. The gate's inference is behavioural, not physiological.

Harm Reduction as a Design Epistemology

Safety-gate architecture does not claim to optimise positive connection outcomes. It claims to reduce the probability of harmful ones. This is not a weaker claim — it is a different epistemological stance, with a clearer evidential bar. Harm reduction (Marlatt & Witkiewitz, 2002) was developed for substance use: rather than demanding abstinence, it reduces the probability of the most dangerous outcomes without requiring elimination of the behaviour. The framework transfers with precision. Safety-gate architecture does not prevent connection; it reduces the probability that connection initiated in a low-readiness state will produce the adverse outcomes — rejection hypersensitivity, compulsive reassurance-seeking, parasocial substitution, confirmation of negative relational beliefs — that the attachment and loneliness literatures associate with insecure connection patterns. This sets the evidential bar correctly. The agenda in Section 6 does not ask 'does the architecture improve wellbeing?' It asks: does it reduce connection events in demonstrably low-readiness states, and does that reduction correlate with wellbeing outcomes on validated instruments? That is testable without outcome data that does not yet exist.

Loneliness as Infrastructure, Not Individual Failure

Holt-Lunstad, Smith, and Layton's (2010) meta-analysis — associating social isolation and loneliness with a 26–32% increased likelihood of premature mortality — established the foundation for treating loneliness as a structural public-health concern. The policy response has been predominantly individual or environmental: social prescribing, urban-design interventions, befriending services, national loneliness strategies. These are not wrong, but they share a blind spot: the digital infrastructure through which billions now attempt to connect has been categorised as a consumer-product sector subject to consumer protection, rather than examined as connection infrastructure whose design could be subject to wellbeing standards. This paper proposes that the architecture of connection platforms warrants consideration as a public-health-relevant design question — not that platforms are equivalent to regulated health infrastructure, a claim the current evidence cannot support, but that what a platform does at the moment of connection initiation is plausibly where a meaningful share of the wellbeing outcome is determined, and therefore deserves design attention and study.

Defining the Safety Gate

Four properties define it. First: it assesses rather than assumes readiness. The gate treats connection moments as differentiated by behavioural context, which requires an inference model, observable signals, and a response protocol. Platforms without such a model are not making a neutral choice; they are implicitly assuming readiness is constant. The gate replaces that assumption with an assessment. Second: it modulates by default, and blocks only under explicit safety conditions. The gate's primary function is calibration — slowing, resequencing, or restructuring a connection event rather than prohibiting it — because a gate that routinely refuses connection substitutes the system's judgment for the user's autonomy. However, a responsible connection platform must also block outright in a narrow, pre-specified set of safety conditions. The Wouch implementation contains both: a readiness-modulation layer that delays/modifies and honours override, and a distinct safety-block layer that pauses connection under explicit, documented thresholds. Modulation preserves autonomy; the safety-block layer deliberately overrides it for harm-prevention reasons, is restricted to pre-specified conditions, and is itself subject to review. Third: it is transparent to the user. A hidden gate that modulates behaviour without the user's knowledge is a dark pattern, manipulative regardless of its effects, because manipulation is defined by the absence of informed consent to the process, not by outcomes. An explicit gate — one the user knows exists, understands in general terms, and can partly configure — is informed consent by design. Fourth: it includes suppression logic. A gate without suppression logic over-intervenes, damaging trust and autonomy. Suppression logic specifies, in advance, the conditions under which the gate explicitly does not activate.

Wouch as Case Study: How the Architecture Operates in Practice

Wouch was built on a premise the founder arrived at through experience and then tested against the clinical and developmental literature: that the patterns people bring to adult relationships are shaped substantially by early relational experience, and that a platform designed without account of those patterns will match people on surface attributes while ignoring the psychological architecture that determines whether a relationship can sustain itself. The onboarding implements this premise. Rather than beginning with photographs or biographical summaries, users encounter a structured psychological assessment — currently 29 questions — designed to surface attachment orientation, emotional-maturity indicators, and core relational values. The assessment was initially constructed from a larger set of psychological and behavioural rules developed in consultation with licensed therapists, then rationalised against established validated instruments: the ECR-R (Brennan, Clark, & Shaver, 1998) for attachment, the UCLA Loneliness Scale v3 (Russell, 1996) for social connection, and the PHQ-4 (Kroenke et al., 2009) for baseline wellbeing. Items already captured by these instruments were removed; the current 29-item onboarding represents the non-redundant assessment the validated scales do not already cover. An honest account of the inference mechanism. The readiness model is Bayesian, but it is important to describe what it actually does rather than an idealised version. Its primary evidence base is the structured assessment: the model maintains posterior estimates over a small set of latent relational factors, updated by the user's responses, with a convergence criterion that withholds a readiness determination when the accumulated evidence is insufficient. Behavioural signals observed over time supplement and update these estimates but are not, in the current implementation, the primary driver. The model does not diagnose, does not classify users by attachment type, and produces session-level readiness estimates, not user-level psychological judgments. When the readiness layer modulates — when the estimate falls below threshold — the user experience does not communicate rejection or pathology. The platform offers an alternative sequence: reflection prompts, non-interpersonal community content, or a simple delay with an option to return. The gate is visible, the user can override it, and the override is itself observed and incorporated.

The Organising-Principle Inversion

Conventional design treats connection as the desired outcome and maximises its occurrence. Safety-gate architecture treats appropriate connection as the desired outcome and distinguishes it from premature or low-readiness connection. This is a different organising principle, requiring different success metrics and engineering priorities. We use the word 'paradigm' advisedly and in a limited sense — an organising design principle and stance — and explicitly not in the strong Kuhnian sense of an established scientific revolution (Kuhn, 1962). Naming an organising principle is a precondition for studying it; it is not a claim that the principle has been validated or adopted. The metric change is specific. Engagement-optimised platforms measure connection frequency. Safety-gate architecture proposes a connection appropriateness rate — the proportion of connection events occurring in the presence of assessed readiness signals. A candid limitation must be stated immediately: as defined, this metric is partly circular, because the gate both defines readiness and is then evaluated by it. The metric is therefore only meaningful once the readiness signal has been validated against external constructs. Absent that external validation, the appropriateness rate is an internal engineering quantity, not evidence of benefit. We state this plainly rather than resting weight on a self-referential metric.

Intervention Suppression Logic

A safety-gate system without suppression logic is paternalistic; suppression logic is what differentiates the framework from digital gatekeeping. It specifies, in advance, when the gate does not activate. Three canonical conditions are implemented in Wouch. First, when the user has stated explicit intent to connect and readiness-signal ambiguity is below a defined minimum, the gate defers to the stated intention. Second, when the readiness gate has already activated once in the current session, further activation is suppressed — a gate that fires repeatedly is harassing, not protecting; the once-per-session limit is an ethical constraint, not a technical convenience. Third, when the user invokes an override, it is honoured and the override behaviour is incorporated as a signal. Suppression logic and transparency are mutually dependent: suppression conditions can only be understood and exercised by users who know the gate exists.

The Transparency Requirement as Ethical Architecture

Safety-gate architecture is ethically coherent only if users know it exists. This is a design argument before it is a legal one, though the EU AI Act's transparency requirements (Articles 13, 52) make it both. A platform that assesses users' emotional states — even behaviourally, even probabilistically — without their knowledge makes a decision about them they have not consented to. The assessment may be accurate and the intervention beneficial; the architecture is manipulative regardless, because manipulation is the absence of informed consent to the process. Telling users the platform will not always facilitate immediate connection, explaining why in general terms, and providing a mechanism to engage with or override that logic transfers the locus of control back to the user. We note a design-team observation from closed beta — that users who understand the gate tend to engage with its prompts reflectively rather than attempting to bypass them — only to motivate a research question, and explicitly flag it as a non-systematic observation, not evidence. It is reported as a hypothesis to test, not a finding.

Within the Design-Ethics Tradition

Value-sensitive design (Friedman & Hendry, 2019) supplies the principle that values belong in the architecture; positive computing (Calvo & Peters, 2014) supplies the goal of designing for wellbeing; the persuasive-technology literature and its humane-technology critics (Fogg, 2003) supply the diagnosis of engagement-optimised harm; choice architecture (Thaler & Sunstein, 2008) supplies a vocabulary for how design shapes decisions, and a caution — that readiness modulation is a form of choice architecture and therefore carries the ethical obligations that attach to nudging, including transparency and the preservation of agency. The specific contribution claimed here is not the value or the goal, both of which are well-established, but the mechanism: a session-level, behaviourally-updated readiness inference operating as a structural pre-condition to connection, with explicit, pre-committed suppression logic. That specific mechanism, applied to connection platforms, is what the prior traditions motivate but have not operationalised.

vs. Content Moderation

Content moderation assesses what is shared; safety-gate architecture assesses the state of who is sharing. These are orthogonal. A platform can implement sophisticated moderation and still deliver every connection event with no account of the readiness of the user initiating it. Policy frameworks that treat platform safety as synonymous with content moderation address a necessary but not sufficient condition.

vs. Trauma-Informed UX Design

Trauma-informed design is a surface-level UX framework guiding language, visual, and interaction choices to avoid re-triggering users. It is valuable and distinct. Safety-gate architecture is a backend structural decision about what the platform does, not how it presents itself. A platform can implement every trauma-informed UX principle and still connect users in high-activation states with no readiness assessment; a gate can operate within a platform with no trauma-informed UX. Wouch implements both, but they are independent decisions.

vs. Digital Wellbeing Interventions

Screen-time limits, dashboards, and timers manage connection volume. Safety-gate architecture manages connection quality at the moment of initiation. A user who connects infrequently but consistently in low-readiness states is invisible to a screen-time dashboard yet is exactly the pattern the gate is designed to address. These interventions can and should coexist; they address different variables.

Primary Research Questions

Two questions are designated primary, deliberately including a construct-validation question rather than resting solely on outcomes. P1 (construct validity). Do gate-activation patterns at session initiation correlate with independently measured ECR-R attachment-anxiety scores at baseline? A positive result provides evidence that the readiness signal tracks a validated psychometric construct — the external validation that the connection-appropriateness metric requires to be meaningful. This is the most tractable near-term result and the precondition for interpreting any outcome finding. P2 (outcome). Does connection mediated through safety-gate architecture correlate with change in attachment anxiety/avoidance (ECR-R; Brennan et al., 1998) and loneliness (UCLA-3; Russell, 1996) from baseline to follow-up? The predictor is the readiness-gate activation rate; outcomes are change scores on the ECR-R and UCLA-3, with WEMWBS (Tennant et al., 2007) secondary. The proposed design is a pre-registered, within-subjects observational cohort, baseline at onboarding and follow-up at 30 days, initial n = 50–100. The design's limitations are stated up front: a within-subjects pre-post design without a control group cannot separate the gate's effect from regression to the mean, novelty effects, or the simple passage of time, and 30 days is a short window for change in attachment dimensions. A null result on P2 is therefore plausible and will be reported as informative.

Secondary Research Questions

First, does user knowledge of the gate affect outcomes independent of activation rate (testing whether awareness is itself functional)? Second, do suppression-logic activation patterns correlate with user-reported trust (testing whether suppression is architecturally functional, not merely a UX concession)?

Methodological Commitments

Pre-registration on the Open Science Framework is a non-negotiable requirement for any study using this framework — not a concession to reviewer preference but a commitment about what kind of research this is: research designed to find out whether the architecture works, including where the finding is null. Post-hoc analysis of platform data has low credibility for good reason; the publication bias that has shaped the digital-mental-health literature is precisely what has made it hard to know what works. A pre-registered study with a committed analysis plan and published null results is more valuable than an unregistered study with positive findings.

Invitation for Research Collaboration

Wouch offers: a working safety-gate architecture that can be instrumented for research data collection; the 29-item onboarding assessment, designed around and mappable to the ECR-R, UCLA-3, and PHQ-4; and a development team willing to implement researcher-specified modifications to instruments, protocols, and procedures. Regarding existing closed-beta data: it will be made available for research only to the extent that participants' consent covers research use. Where the original consent did not, data will be collected prospectively under a fresh, separate research-consent basis approved by the partner's ethics committee. The platform will not repurpose product-consented data for research retrospectively. The author notes the current cohort is small (n = 33); the dataset's value is as a feasibility and instrument-mapping resource, not as a powered sample. What the collaboration requires from an institutional partner: IRB/ethics governance of the design; co-authorship with first-authorship available to the institutional lead; and the methodological expertise to design a pre-registerable, instrument-valid, publishable study. The author is not seeking validation of an existing design. The author offers a partnership in which the institutional collaborator governs the study and owns the publication jointly, whatever its findings.

"First-authorship on the outcome study. Researcher-governed design. A platform that will implement whatever measurement architecture a credible partner specifies. Findings published whatever they are."

The EU AI Act: Transparency and Oversight by Design

Safety-gate architecture was not designed as an AI Act compliance strategy; its alignment is a product of shared principles. Article 13 (transparency) is addressed by the gate's explicit disclosure and explained logic; Article 14 (human oversight) by the suppression logic and override; Article 52 by disclosure of AI interaction. The argument is not that Wouch is compliant, but that the framework is an existence proof that transparency and user-control requirements are not in tension with a functional, user-accepted product — contradicting the assumption that effective AI design requires opacity.

Loneliness as a Public-Health-Relevant Design Question

The WHO Commission on Social Connection (2023), the UK loneliness strategy (2018), and the US Surgeon General's advisory (Murthy, 2023) have established loneliness as a policy-recognised public-health problem, framed structurally. None has examined the architecture of connection platforms as a design question with public-health relevance. This paper proposes that it is one — stated carefully: not that platforms should be regulated like pharmaceuticals or water treatment (an analogy the current evidence cannot support and which we withdraw from an earlier draft), but that the design of the moment of connection initiation plausibly bears on wellbeing outcomes and therefore merits study and, eventually, evidence-based design guidance. Naming the question is the contribution claimed here; resolving the regulatory form is beyond the paper's scope.

The Digital Services Act: From Content to Conditions

The DSA (European Commission, 2022) builds platform accountability on content and algorithmic-system risk. It does not require platforms to account for the structural conditions of connection — whether architecture reflects any account of users' readiness at the moment of initiation. This paper proposes that the regulatory question — what are platforms responsible for, architecturally, with respect to the psychological conditions of connection — deserves a place in the research agenda informing future iterations. It does not prescribe the regulatory form.

Behavioural-Signal Inference Is Not Emotional-State Measurement

The gate observes patterns and updates probabilities; it does not measure internal states and can be wrong about individuals, sessions, or the significance of signals. The study design must be built to detect systematic errors across user subgroups, not merely average effects; average positive outcomes from an architecture systematically wrong about particular subgroups would not constitute success.

This Is a Conceptual Contribution, Not an Outcome Study

The framework is untested. The theoretical arguments for why readiness matters are well-supported; whether an architecture built on them produces the predicted outcomes is the empirical question the proposed study exists to answer. The framework may not work.

The Implementation Is Partial and the Case Study Is Conflicted

The readiness model is currently assessment-driven more than behavioural-signal-driven (Section 4.2); the safety-block layer means the framework's 'modulate, don't block' ideal is only partially realised (Section 4.1); and the case study is the author's own conflicted product (see competing-interests statement). Independent replication on a platform the author does not control is necessary before the framework's generality can be claimed.

Cultural Variation

The behavioural signals were developed in a particular cultural context; attachment expression and connection behaviour vary cross-culturally. Any study extending beyond the development context must build in population diversity and test for cultural variance in model performance.

The Transparency Paradox

A gate users know about can be gamed; a user who knows certain patterns are read as low-readiness may perform readiness. This is not fatal — every assessment system is gameable — but it is a genuine limitation requiring ongoing design attention.

Design Without a Control Condition

As noted in Section 6.1, the proposed pilot cannot establish causality. Its purpose is feasibility, instrument mapping, and construct validation, not efficacy.

What This Paper Has Done

The argument here is not about Wouch. It is about what has been under-specified in the design of digital connection infrastructure, and whether that absence can be named precisely enough to study. Engagement optimisation is a coherent design paradigm with a clear goal and a track record of achieving it. The problem is not that it fails on its own terms; it is that its terms do not include the wellbeing of the people it connects — an exclusion that was a consequence of which metrics were chosen, and could in principle have been chosen differently. Safety-gate architecture names a different set of choices: a readiness assessment at the moment of connection, a probabilistic inference model, explicit suppression logic, a narrow and separate safety-block layer, and transparency about the system's operation. These are specifiable design decisions, partially implemented in a working platform, that can be studied, challenged, replicated, and improved.

The Question That Remains

The framework requires empirical validation that does not yet exist and that the author is not positioned to produce alone or credibly, given the conflict of interest. That is the purpose of Section 6, and the invitation there is genuine: first-authorship on the outcome study, researcher-governed design, and a platform that will implement whatever measurement architecture a credible partner specifies, with the findings published whatever they are. Safety-gate architecture is not the only possible answer to the design question this paper poses, and naming it is not the same as validating it. But a design principle that has not been named cannot be debated, tested, improved, or replaced with something better. This paper names one, situates it honestly within the traditions it builds on, describes its implementation including where that implementation is partial, and proposes how to find out whether it works. The question is not complicated: what would it mean to build a platform that takes the emotional state of its users seriously at the moment they reach toward connection? It is being asked here so that it can be answered by evidence.

"What would it mean to build a platform that takes the emotional state of its users seriously at the moment they reach toward connection? It is being asked here so that it can be answered by evidence."