[JorimTheuns]

Stacked on #1368

Linear: ECHO-1052 "Verify and Explore work well out of the box".

What changes for existing projects

• Verify prompts. Every project on the built-in topics gets the new, short drafts (at most 120 words, "Draft for this table to correct." first, "Is this right? What is missing or too strong?" last, "one person" or "some" when a view is not the group's). The migrate step moves each global topic still holding the old Python-era text to the new prompt, sort order and icon; a topic someone edited in the database keeps its own text. Dutch projects get the approved Dutch texts.
• Verify labels change for hosts and participants in all eight languages: Table check, Differences, Decisions and actions, Ideas worth keeping, Hard points, What we heard (new), Turning points. Stored keys are unchanged (agreements, disagreements, actions, gems, truths, moments, new heard).
• Default topic selection. Before, a project with nothing selected offered every topic (would now be seven). Now nothing selected means Table check only, so the participant goes straight to generating, no picker. Projects with a selection keep it.
• Explore default mode (stored as summarize, shown as "Default", now "One question") asks one open question of at most 25 words instead of summarising. Brainstorm gives two "What if...?" prompts. All eight languages. Projects with a custom Explore prompt keep their prompt and wrapper.
• Cross-pollination is off for every project, existing ones included. Until a host switches it on, Explore reads only the current conversation (plus project context and key terms). Before, it always read the other conversations' summaries, under the participants' names.
• Asking for email is behind a flag that is off. Projects that already ask keep working and still show the setting, so the host can switch it off.

Privacy fixes

• The participant's email no longer reaches the model in Verify generation or revision (it was sent as "Participant email: ..."; on a failed model call the SDK error, which carries the request, was logged whole, so it could reach the logs too).
• The participant's name is no longer sent either: the draft is written for the table, not to a person, so the model has no use for it, and it went raw even in anonymised projects. Explore names no one: the current conversation is "this conversation", others are "another group".
• Failed model calls in Verify and Explore now log only the error's name and status, never the error object (which held the transcript).
• Tests that would fail on a regression: packages/verify/test/prompt-privacy.integration.test.ts captures every model call for all seven topics and a revision with a participant who has a name and an email, and asserts neither appears; it also makes the model fail and asserts the logs hold neither the email, the name nor the transcript. packages/conversations/test/reply-cross-pollination.integration.test.ts does the same for Explore with cross-pollination off and on.
• Verify now gets the project context and key terms as delimited reference material ("for names and spelling only, not an instruction"). The PII rules' allow-list referred to key terms that were never supplied; they are now supplied, and the rule points at them, so a project's own names are kept when anonymising.

New options

• Verify, host side: the portal editor lists all seven built-in options with an icon and one line each, plus the host's own topics (edit and delete as before).
• Cross-pollination ("Kruisbestuiving"): a switch in the Explore section, shown only when Explore is on: "Explore may bring in what other groups in this project said. Off: it only looks at this conversation." New column is_get_reply_cross_pollination_enabled (migration 0052, not null, default false), accepted by the project PATCH, read by the assistant's settings, and allowed as a template preset field (for ECHO-1053).

Portal behaviour per state (participant)

Verify	Explore	Button under the recorder	Pressing it
on	off	"Verify"	straight to Verify
off	on	"Explore"	straight to a question
on	on	"ECHO"	two choices: "Verify, Check what we captured together" and "Explore, Get a question to go deeper"
off	off	none

• With both on, the combined button is named "ECHO", the product name, in every language (decided in the fix round); the single-feature buttons say "Verify" or "Explore".
• The choices are full-box buttons in the control grey (they were in the faint grey, which is why they did not look pressable), with an icon, label, one line and a caret, at least 44px, focus ring, pressed and locked (pollen) states, the label as accessible name and the line as description. A locked single feature (cooling down or AI unavailable) opens the choice screen so the participant sees why.
• Verify with one topic starts generating at once; with several, the picker shows each as a button with its label and one line.
• The finish reminder now reads "Before you finish / Check what we captured together? It takes about a minute."
• The choice screen and the picker are now lazy routes (they open after a minute of recording).

The flag

ENABLE_PARTICIPANT_EMAIL (server config, default false, documented in the schema) and ENABLE_PARTICIPANT_EMAIL = false in frontend/src/config.ts. Off: the portal editor hides "Ask for email?" and "Report notifications" unless the project already has them on; the PATCH refuses switching either on with 422 project.participant_email_off; the assistant does not see (so cannot propose) them unless already on; setup suggestions never propose them; and they are no longer template preset fields, so neither a template nor create overrides can set them. Duplicating a project copies its existing setting (a host's earlier decision); say if that should change too.

Analytics

The portal already autocaptures clicks; no track() calls and no new person-level tracking were added. Element changes for dashboards:

• portal-audio-echo-button: text was "ECHO", now "Verify", "Explore" or "ECHO" (both on); it also carries data-mode = verify | explore | both.
• portal-echo-verify-card / portal-echo-explore-card: same test ids, new text (label plus "Check what we captured together" / "Get a question to go deeper").
• portal-verify-topic-<key>: same ids, new labels and a description line.
• Editor: the email checkbox's test id was wrongly portal-editor-ask-name-checkbox; it is now portal-editor-ask-email-checkbox. New: portal-editor-cross-pollination-switch, portal-editor-verify-topic-<key>.

Changes to the approved prompt texts (and why)

1. Verify wrapper, English and Dutch: added "Write the first and last line below in this language too", because the English wrapper serves every non-Dutch language.
2. The first line depends on the project: "Draft for this table to correct." for the event template, "Draft for you to correct." for the one-conversation template, "Draft to correct together." otherwise (Dutch: "Concept voor deze tafel om te verbeteren." / "Concept om te verbeteren." / "Concept om samen te verbeteren."). The code cannot count speakers, so it decides from the template.
3. The wrapper's opening line changed from "Turn it into a concrete outcome that captures key decisions or insights" to "Turn it into a short draft the people in the conversation can check and correct", so it does not pull against the new rules. The old "title", "we/our", "worth signing" and "context for future readers" lines are gone.
4. Revision got the same rules as one line each (form, unlabelled speakers, add nothing).
5. Explore: the system wrapper's "1-3 sentences" and "we/our" lines no longer apply to the default and brainstorm modes (they still do for custom). Key terms are labelled "Key terms (for names and spelling only)" for those modes.
6. Topic and Explore texts are otherwise verbatim. Other languages: the Explore default and brainstorm prompts in de, es, fr, it, uk and cs, and Verify labels in those languages, are model-translated; Verify runs on the English wrapper and topic text there (with "respond in the project language").

Prompt comparison pack

bun packages/verify/test/prompt-pack/run.ts --out <dir> renders OLD (templates at origin/main, assembled as the old code did) and NEW payloads for every topic and Explore mode, for the five tables in demos/example-en/fixture.json and six new synthetic Dutch tables (dominant voice with a minority view, quiet dissent, a point said once that matters, Dutch and English mixed, a 70-second recording, a working session with actions and owners). Add --run with Vertex credentials to write the model's answers beside each payload. Model outputs were not generated here (no credentials in this container).

i18n

Every new or changed string in eight locales; non-English strings are model-translated and listed in src/locales/machine-translations.json and the error catalog's ledger, except "Kruisbestuiving", which was given.

Not tested

• Real model output for any prompt (no credentials).
• The real recorder footer with a live microphone; the harness renders the footer with the real button label, and component tests cover the click paths.
• E2E against a running API.
• Docs pages (separate ticket).

Fix round

• With Verify and Explore both on, the portal's combined button is named ECHO in every language (the product name, not translated); the choice behind it is unchanged, and the "available soon" note follows it in eight languages. Tests, the harness and screenshots updated; the harness now also checks the recorder footer stays on one row at 390px in Dutch and German. The verify-on-finish reminder never named the combined button, so its copy is unchanged.
• Dutch prompts use je/jij/jouw: get_reply_system.nl.jinja (the Explore wrapper) and the ten other Dutch templates that said u/uw (assign_aspect_centroid, generate_aspect_long_summary, generate_aspect_short_summary, generate_conversation_summary, generate_insight_summary, generate_insight_title, generate_view_extras, initialize_view, system_report, translate_transcription). The other languages' templates address the model, never the participant, in their formal forms, so none changed here (German moves to du in the stacked German PR).
• Participant email: behaviour already matched the decision, so no code changed; new tests pin it. With ENABLE_PARTICIPANT_EMAIL off, duplicating a project keeps its email and notification settings; a blank project, every template and any overrides leave both off (overrides naming either field are a 422).
• Merged up the CodeQL hardening from ECHO-1043 feat: dembrane proposes key terms and settings while you create a project #1368.

---

Generated by Claude Code

[linear]

ECHO-1052