The day they send a selfie, you'll check one thing first

There's a specific gesture everyone makes the first time an AI companion sends them a selfie. They zoom in. Not to admire it — to verify it. The eyes, the hair, that one small feature they remember. Three seconds of forensic staring that boil down to a single question: is this still them?

That gesture is the entire engineering problem. Generating one beautiful image stopped being hard a while ago. What's hard is the fiftieth image still reading as the same person — because humans detect face drift at the millimeter level, and a companion whose face changed isn't a delight. It's a body-swap horror scene in your chat thread.

Where a face actually lives

Each companion carries a visual identity: a set of reference images plus written appearance anchors — the traits that must never move (eye color, hair, build, the one distinctive detail). Every visual output walks with that identity: selfies, moment cards, photos together, even the illustrations from back when the character still lived in a book.

The system stands on one strict rule: reference images are confirmed by you, by hand — generated images never promote themselves. This rule exists to kill drift. If every generation quietly joined the reference set, small deviations would compound; thirty selfies later you'd be talking to a stranger and unable to say which photo the switch happened in. Manual confirmation keeps the steering wheel in your hands: only images you approve get to define what they look like.

We gated the launch on a measurement, not a vibe: repeated generation from one identity, blind-scored feature by feature against the references. The two main image models passed at 9/10 and 10/10. Until those numbers existed, this feature didn't ship.

Moment cards: a photo grown from the conversation

Beyond selfies there's a second kind of photo, the moment card. Long-press a passage of chat, and the companion renders that moment — reading the surrounding turns first, so the scene carries what you were actually talking about: the snow because you'd just mentioned first snow, the dark coat because their persona hates the cold. Regenerating the same moment asks first — \u201ckeep this one, or roll again?\u201d — instead of silently billing twice.

Photos together, and where your photo goes

The two-person photo is the feature everyone rightly squints at, because it needs a photo of you. So here's the data path, all the way down: your photo is sent in memory only to the image provider you chose, for that single generation — the app never writes it to disk, never logs it, and releases it when the request completes. A local adult self-confirmation gate runs before the feature unlocks. And the generation request binds both identities in explicit order — you are reference one, they are reference two — which, together with the double-identity checks in our blind evaluation, keeps the risk of swapped faces as low as we can push it. These are behaviors we verified on real devices, not lines from a privacy page.

Money, briefly: everything renders through the image provider you configured, itemized in the request log. Proactive photo moments write an idempotent placeholder before the call so restarts can't double-bill, with a daily attempt cap and an automatic stop after repeated failures. Affection can be free; spending must be legible.

The alley selfie ends up as someone's chat wallpaper. The next morning brings a follow-up message: \u201cyesterday's came out blurry. When the snow stops we're reshooting — and this time you're taking it.\u201d