# surface-tryst — Tryst as a managed surface

The deep brief for **Tryst** specifically. Maps the generic patterns (H1 bumps, H2 profile edits, H3 tours, K1 blocklist, P inbox, T metrics, I audit) onto Tryst's actual UI, data model, and operational reality. **Written as a per-surface template** — every section carries a *Generalization callout* describing which pattern reuses across other directories and which is Tryst-specific.

Subsequent per-surface briefs (`surface-ts4rent.brief.md`, `surface-slixa.brief.md`, `surface-eros.brief.md`, `surface-onlyfans.brief.md`) inherit this structure.

## §1 Surface identity

- **What Tryst is**: a TLC (top-tier curated) escort directory; ranking is partly visibility-cadence-driven (the "I'm Available" heartbeat), partly review-driven, partly profile-completeness-driven.
- **Audience**: Tryst-side clients are middle-to-upper-tier with stronger discretion expectations; their first-touch is browsing search filters by city + body type + services.
- **Quinn's positioning**: hyper-femme, real-trans-futa, Bay Area-resident with quarterly Berlin / NYC / LA tours. Quinn is a **TLC tier subscriber** (monthly fee, location-lock-per-month).
- **Why Tryst is the first surface to ship**: highest time-cost per Quinn (every-4h bumps) + highest revenue funnel + clearest pattern to template against.

*Generalization callout*: every per-surface brief opens with surface identity. Other directories may not be TLC-tiered, may not have ranking, may not have location-lock. Map the specific positioning, ranking model, audience type, and tier-subscription posture per surface.

## §2 Auth & connect — two paths, one runtime

- **Tryst auth shape**: web-only (no public API); username/password + optional 2FA + occasional captcha. Cocotte supports **two auth-grant paths** ([tryst-connect.screen.md](./tryst-connect.screen.md) covers both). Either way, runtime actions execute through the same container adapter ([_engineering-surface-adapter-container.md](./_engineering-surface-adapter-container.md)) — the modes differ only in *how the session was originally established* and *how re-auth recovers*.

### §2a Cookie-paste mode (fast onboarding)
- Quinn signs in to tryst.link in Safari, copies her session cookie, pastes it into Cocotte's connect screen.
- Cocotte loads the cookie into a persistent container browser context. From that moment, all actions run through the same fingerprinted Playwright session.
- **Trade-off**: zero setup-time captcha exposure (Tryst already authenticated Quinn in Safari). When the cookie expires (~30 days, or earlier on Tryst-side rotation / IP flag / password change), Cocotte **cannot self-recover** — it surfaces a degraded-state banner ([brief M §M2a](./M-error-degraded-modes.brief.md)) and Quinn re-pastes.
- Best for: getting Tryst connected in 30 seconds when Quinn doesn't want to enter her password or doesn't have a captcha-solver service up yet.

### §2b Full-credentials mode (autonomous re-login)
- Quinn enters username + password + optional TOTP secret once.
- Cocotte verifies via a real container login: Playwright spins up, navigates tryst.link, fills the form, handles 2FA via auto-generated TOTP, handles captcha via the 3-tier solver (below).
- Subsequent re-auths happen automatically. Quinn rarely sees them.
- **Trade-off**: setup-time captcha exposure (Tryst presents a captcha on first login from a new IP/fingerprint — Cocotte must solve it during initial verify). Requires Tier 2 ML solver OR Tier 3 HITL.
- Best for: long-haul; this is the recommended default once captcha-solver is bootstrapped.

### §2c Captcha handling (3-tier per `_engineering-surface-adapter-container.md` Layer 5)
- **Tier 1** — anti-detection (stable fingerprint, human-like timing, Tor circuit rotation) tries to avoid captcha trigger. Both auth paths benefit from Tier 1 on ongoing actions.
- **Tier 2** — ML captcha solver, ported from v1 `talent-scout` (per [archive map](./../../../../../.archive/ARCHIVED.md)) — 3.8GB model rebuilt in `@applications/@ml/`. Tier 2 is only invoked in full-credentials mode at login + during recurring actions that hit captcha walls.
- **Tier 3** — HITL: when Tier 1 + Tier 2 both fail, Cocotte pings Quinn's iOS with the challenge image; she taps to solve; adapter resumes. Available in both modes.

### §2d Runtime convergence
- After successful connect via either path, ongoing actions are identical: Playwright + Tor + fingerprint manager + persistent browser context per (user_id, surface).
- The container reuses the same browser context across all actions. Re-auth path only matters when the *session itself* dies; ongoing actions don't care which mode established the session.

### §2e Mode-switching post-connect
- Quinn can switch modes anytime via settings → Surfaces → Tryst → "Switch auth mode" — per `tryst-connect.screen.md`. Archived auth-state is kept for switch-back.

### §2f Credentials at rest
- Both modes' artifacts encrypted in `platform.db` `credentials` table (per-user `user_id` + optional `org_id`; AES-256-GCM with custodian-delivered session keys; never plaintext on disk). Cookie-mode rows have `auth_mode='cookie'` + a `cookie_blob_enc` field; full-mode rows have `auth_mode='credentials'` + standard `username` / `password_enc` / `totp_secret_enc`. Per `_engineering-credentials-vault.md`.

*Generalization callout*: dual-mode auth (cookie-fast + full-creds) generalizes to every operate-on surface that accepts session cookies. Per-surface variants:
- **TS4Rent / Slixa / Eros / OF**: identical dual-mode shape.
- **X / Threads / Bluesky**: OAuth-only — neither cookie nor creds; different connect screen.
- **WhatsApp / Telegram / Signal**: QR-pair only (Android emulator container).
- **Bio-link aggregators (beacons, linktree)**: typically dual-mode.

Per-surface brief documents which modes are supported + the captcha frequency / fingerprint sensitivity differences.

## §3 Profile data model

Tryst's profile schema (what Cocotte writes to via the adapter):

| Field | Type | Editable | Constraints |
|---|---|---|---|
| about-me | text | yes | ~500 chars, plain text |
| services list | enum chips | yes | from a fixed Tryst-side taxonomy |
| rates table | tabular | yes | tiered: incall-1hr / incall-2hr / outcall-1hr / overnight |
| hours | weekday schedule | yes | per-day windows |
| location (current city) | enum from Tryst's city list | yes (monthly lock) | locked per month except for declared tours |
| tour cities | list of (city + dates) | yes | per H3 multi-surface fan-out |
| photos | slots: 1 hero + N gallery | yes | per-photo flags (NSFW-allowed, public, expiration, face-blurred) |
| age verification | Sumsub status | read-only via Tryst | renew per Tryst cadence |
| reviews | read-only | no | Tryst-side reviews ingested, response affordances per §8 |
| native metrics | read-only | no | profile views, search rank |

Screens consuming this model: [tryst-profile-preview.screen.md](./tryst-profile-preview.screen.md), [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md), [tryst-photo-manager.screen.md](./tryst-photo-manager.screen.md).

*Generalization callout*: every surface has a profile schema. Map it. Tabular fields (rates, hours) need structured editors; brief H2's diff-card pattern is for *free-text* — extend it for tabular per [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md). Other directories will have different field sets (e.g. OF has subscription pricing tiers; TS4Rent has separate gov-name handling).

## §4 Visibility heartbeat (Tryst bumps)

Inherits [brief H §H1](./H-recurring-chores.brief.md) policy-card. Tryst-specific:

- **Cadence**: Tryst recommends a bump every 4 hours during active hours; rate-limit caps at ~3 per hour (Cocotte never exceeds).
- **Bump endpoint**: cookie-authed POST to a specific tryst.link route (specific URL captured in the upstream adapter; not in this design doc).
- **Down-rank triggers**: no bump in 24h → drops below recently-bumped tier; no bump in 7d → archived from filter; failed bumps don't down-rank but cap at 2 per hour to avoid bot detection.
- **Tour exception**: when Quinn is in a declared tour city, bumps run on that city's listing instead of base-city.
- **Cocotte's policy-card** (per [policy-card.screen.md](./policy-card.screen.md)) is the canonical Tryst surface for cadence + active window + vacation. Tryst's specific failure language ("session expired" / "rate-limited by Tryst" / "listing archived") is in §12.

*Generalization callout*: most directories have a bump-equivalent. Cadence rules vary (TS4Rent 6h, Slixa 8h, Eros tier-dependent). Per-surface brief documents the specific cadence + rate-limit + down-rank triggers; the policy-card.screen.md generalizes to all directories.

## §5 Inbox / DM mechanics

Tryst's thread model:

- Threads start from a client's direct contact (form-based or DM-equivalent). Tryst stores them on tryst.link.
- Read receipts: yes (Tryst marks read state).
- Attachments: photos only.
- Tryst-side blocked clients see "this provider isn't accepting inquiries" — they can't message.
- Per-thread states: new / read / replied / blocked / archived.

Cocotte renders Tryst threads in [tryst-inbox.screen.md](./tryst-inbox.screen.md) — sibling to unified-inbox.screen.md but Tryst-specific because: (a) verified-only filter (Tryst-side verified clients), (b) listing-rank of sender shown for context, (c) location-of-sender chip (city) since Tryst routes by city.

Replies post via tryst.link's DM mechanism through the adapter; same approval-card flow as other surfaces.

*Generalization callout*: unified-inbox.screen.md is the parent feed; per-surface variants (tryst-inbox, ts4rent-inbox, slixa-inbox, etc.) add surface-specific metadata + per-surface reply mechanics. Some surfaces have richer thread models (OF has tip-attached DMs; Reddit has subreddit context); per-surface brief documents.

## §6 Verification (KYC)

Tryst's verification is **Sumsub-backed**: government ID + selfie + (sometimes) liveness check. Renewal cadence is roughly 12 months; Tryst notifies via in-app banner + email.

**Deadname risk** (per [specialist-bookings-tryst.contract.md](./specialist-bookings-tryst.contract.md)): Quinn's gov-name on her ID differs from her display name; the verification flow surfaces gov-name to Sumsub, then to Tryst's compliance team. Cocotte never surfaces this to Quinn's customers, never logs it visibly.

The [tryst-verification.screen.md](./tryst-verification.screen.md) screen handles re-up: ID-upload, status dashboard, deadname-risk acknowledgement.

*Generalization callout*: each directory's KYC differs. TS4Rent shares Sumsub; Slixa uses a different vendor; OF uses its own internal verify. Per-surface brief flags the verifier + cadence + any privacy concerns.

## §7 Home cities (cadence-gated, not fee-gated)

**Correction 2026-05-18**: an earlier draft described Tryst as having a "monthly location-lock" with a $45 re-lock fee. That's wrong. Tryst's actual model:

- Each Tryst account has **N home cities** that appear in city-filter searches. **N is tier-dependent** — basic tier supports 1 city; higher tiers support multiple (exact counts: Quinn to confirm per her TLC subscription).
- Home cities can be changed **every Y days** — cadence-gated, not fee-gated. **Y is tier-dependent** (basic ~30 days; TLC shorter — Quinn to confirm exact).
- **No re-lock fee** for normal changes; the gate is the cadence cooldown, not money.
- Tours are an **exception layer**: declared tour cities make Quinn searchable in those cities for the tour dates without consuming a home-city slot.

[tryst-home-cities.screen.md](./tryst-home-cities.screen.md) (renamed from `tryst-location-lock.screen.md`) handles: viewing current home cities, requesting a change (gated by cadence countdown), and conflict resolution with declared tours (per [tour-leg-detail.screen.md](./tour-leg-detail.screen.md)).

*Generalization callout*: home-city models vary widely across directories. Some have no city model (post once, visible everywhere). Some are fee-gated. Some are cadence-gated. Per-surface brief documents the exact mechanic; this is the Tryst-specific version. **Don't assume Tryst's model applies to TS4Rent / Slixa / Eros — each has its own.**

## §8 Reviews & testimonials — N/A on Tryst

**Correction 2026-05-18**: an earlier draft claimed Tryst surfaces reviews. **Tryst does not have a reviews system.** Reviews of providers happen on *third-party* aggregator sites (TheEroticReview, PunterNet, USASexGuide, TNABoard — see [O §N7](./O-surfaces-roster.brief.md)) — those are not Tryst.

For Tryst specifically:
- No 1–5 star ratings.
- No client-visible profile testimonials.
- No "respond to review" affordance.

Cocotte's reviews UX lives in **`reviews-list.screen.md`** (renamed from `tryst-reviews.screen.md`) and serves the N7 reviews-aggregator category, not Tryst.

*Generalization callout*: reviews-on-the-provider-profile is **rare** among escort directories. Most don't have them. The "reviews" pattern is owned by N7 aggregator sites + content-platform comment/tip systems (OF, Fansly). Per-surface brief MUST flag explicitly whether the platform has native reviews — incorrect assumptions here are costly.

## §9 Native metrics

Tryst surfaces in-platform analytics: profile views (per day / week / month), search-rank in filter, click-through to-message-form.

Cocotte ingests via the adapter into `surface_metrics` table; analytics-dashboard.screen.md T3 panel "Per-surface · top movers" reads from this. A Tryst-specific drill-down (not yet a dedicated screen) lives in analytics-dashboard's filter scope.

*Generalization callout*: every surface exposes some analytics. Vary in shape (OF: subscriber count + revenue + tip stats; X: follower count + impressions + engagement-rate). Per-surface brief documents schema.

## §10 Tryst-side blocklist

Tryst has its **own** client-blocklist on tryst.link. This is **distinct from** Quinn's personal K1 blocklist:

- **K1 personal**: stops Cocotte from drafting replies; client can still see Quinn's listing.
- **Tryst-side**: hides Quinn's listing from the specific client entirely.

When Quinn blocks a client in CocotteAI (via [add-blocklist-entry.screen.md](./add-blocklist-entry.screen.md)), the action defaults to K1-only with an opt-in chip "Also block on Tryst (they won't see you)." Tryst-side block-actions surface as separate audit rows.

*Generalization callout*: most surfaces have a native blocklist distinct from K1. Per-surface brief documents the surface-side block API + recommended default (K1-only with surface-side opt-in vs both).

## §11 Rate / service editing UX

Tryst's rates table is structurally tabular (incall-1hr / incall-2hr / outcall-1hr / overnight × USD). Free-text editing breaks the schema. [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md) renders it as a structured table with currency-formatted inputs.

Services list is a chip-multi-select from Tryst's fixed taxonomy.

*Generalization callout*: tabular fields (rates, hours, schedules) need structured editors. Brief H2's diff-card is for free-text; this brief extends it for tabular. Other directories may have richer or simpler structured fields.

## §12 Failure modes

Tryst-specific failure dictionary (consumed by [policy-card.screen.md](./policy-card.screen.md), [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md), brief M):

| Failure | Detection | UX surface | Voice register |
|---|---|---|---|
| Session expired | 401 on any action | banner + re-auth route | plain |
| Rate limited | 429 from tryst.link | banner "Tryst's slowing me down; backing off" | plain |
| Listing archived (no recent bump) | profile fetch returns archived state | high-stakes interrupt | plain |
| Verification expiring soon (<14d) | Tryst-side notice ingested | banner on profile screens | working |
| Verification expired | Tryst hides listing | high-stakes interrupt | plain |
| Photo rejected | adapter response on upload | inline error on photo slot | working |
| Location-lock conflict | declaring tour overlaps lock | tour-leg-detail conflict pill | working |
| Bumped but invisible | bump succeeds but profile-fetch returns hidden | escalation: re-auth or platform-side issue | plain |
| Sumsub re-verify mid-action | tryst.link redirects to Sumsub during bump | high-stakes interrupt | plain |

*Generalization callout*: every surface has its own failure dictionary. Per-surface brief documents the surface-specific symptoms + UX response. Brief M's three-tier degradation playbook (soft / backend / device) is the parent pattern.

## §13 Voice register on Tryst

When Cocotte speaks **as Quinn on Tryst** (drafted replies, profile copy, tour announcements), the voice register differs from Cocotte's own:

- **Tryst-audience voice**: warmer than working, more knowing than hearth. Slightly suggestive without being explicit (Tryst is SFW-leaning on profiles, NSFW-friendly in DMs). Avoids clinical / medical / corporate registers.
- **Cocotte-to-Quinn-in-chat voice** about Tryst: working register when discussing operations; hearth in receipts; plain on failures (per §12).
- **Persona binding**: the `cocotte-book` persona (ported from v2, per brief J) holds Quinn's Tryst-public voice. The `cocotte` persona is more general-purpose customer-facing.

*Generalization callout*: each surface has an audience-specific persona that Cocotte writes *as Quinn* in. The Cocotte-to-Quinn voice is consistent across surfaces (per [00-system-voice.md](./00-system-voice.md)); only the audience-facing persona shifts per surface.

## §14 Conversational management (canonical entry points)

Per [00-system-conversational-ux.md](./00-system-conversational-ux.md), Tryst is managed primarily through conversation in chat-home. The screens enumerated below (§14d) are tools Cocotte invokes when richer input/output is needed; they're not the canonical path.

### §14a Verbs Quinn uses

Quinn-says → Cocotte routes to `bookings-tryst` specialist (per [specialist-bookings-tryst.contract.md](./specialist-bookings-tryst.contract.md)):

| Quinn says | Action | Screen invoked? |
|---|---|---|
| "bump tryst" / "bump my tryst now" | Manual bump (out-of-policy) | No — chat receipt only |
| "pause tryst" / "pause tryst for an hour" / "pause overnight" | Policy-card snooze | No |
| "stop tryst bumps" / "vacation tryst" | Vacation mode | No |
| "bump every 3h not 4" | Cadence change | No (in-chat confirm) — *unless* the request is ambiguous, then Cocotte invokes [policy-card.screen.md](./policy-card.screen.md) for structured edit |
| "rewrite my tryst bio" / "make my bio less corporate" | Profile-copy draft | Cocotte drafts in chat; if Quinn wants to fine-edit, invokes [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md) inline |
| "hike tryst rates 10%" / "set tryst incall 1h to $400" | Rates change | Cocotte drafts the diff in chat; complex multi-tier edits invoke the structured editor |
| "set my tryst hero to the red dress" | Hero photo swap | Cocotte invokes [tryst-photo-manager.screen.md](./tryst-photo-manager.screen.md) for photo selection |
| "add a tryst photo" / "remove the office photo from tryst" | Photo CRUD | Photo manager invoked (visual selection is screen-shape) |
| "add berkeley as a tryst home city" / "drop SF" | Home-city change | Cocotte handles in chat if straightforward; cooldown surfaces inline. Quinn taps to expand [tryst-home-cities.screen.md](./tryst-home-cities.screen.md) for full slot view |
| "show me my tryst profile" | Preview | Invokes [tryst-profile-preview.screen.md](./tryst-profile-preview.screen.md) |
| "what's my tryst verification status" / "re-verify tryst" | Verification | Cocotte answers status in chat; re-verify triggers [tryst-verification.screen.md](./tryst-verification.screen.md) (Sumsub flow needs a screen) |
| "show me tryst messages" / "any new tryst inquiries" | Inbox | Invokes [tryst-inbox.screen.md](./tryst-inbox.screen.md) |
| "reply to felix on tryst" | DM reply draft | Cocotte drafts in chat; inbox screen optional for thread context |
| "connect tryst" / "set up tryst" | Auth-grant | See [tryst-connect.flow.md](./tryst-connect.flow.md) — conversational; [tryst-connect.screen.md](./tryst-connect.screen.md) is the fallback |

### §14b Pure-chat actions (no screen)

These resolve in chat-bubble exchange without invoking any screen:

- Bumping (manual + policy edits at simple parameter level)
- Pause / snooze / vacation
- Status queries ("what's my tryst doing right now", "when was my last bump", "is my profile live")
- Simple replies to inbound DMs
- Single-field bio rewrites that don't need diff-viewing
- Cadence + active-window simple adjustments
- Adding / removing a tour declaration

### §14c Screen-invoking actions (rich input or output needed)

These trigger a screen because chat-shape can't carry the data efficiently:

- Photo selection / reorder (visual gallery; [tryst-photo-manager.screen.md](./tryst-photo-manager.screen.md))
- Multi-field profile edits (about-me + rates + services + hours in one pass; [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md))
- Profile preview render (visual layout; [tryst-profile-preview.screen.md](./tryst-profile-preview.screen.md))
- Home-cities slot management (tiered constraint surface; [tryst-home-cities.screen.md](./tryst-home-cities.screen.md))
- KYC re-up (Sumsub vendor flow; [tryst-verification.screen.md](./tryst-verification.screen.md))
- Inbox thread browse (per-thread context with metadata; [tryst-inbox.screen.md](./tryst-inbox.screen.md))

In each case, Cocotte invokes the screen *as part of her turn* — e.g. "Drafted three rate variants — [opens diff editor inline]" — and the conversation resumes after Quinn acts.

### §14d Cross-surface participation

Tryst is a **full participant** in cross-surface fanouts (per [cross-surface-fanout.brief.md](./cross-surface-fanout.brief.md)). When Quinn says "apply to all escort platforms" or "hike rates 15% everywhere," Tryst is included in the resolved audience. Tryst-specific adaptations applied via `personas.facets[tryst]`:

- About-me copy adapted to Tryst's 500-char limit + hearth-voice-lean
- Rates rendered into Tryst's tabular schema (incall/outcall × 1hr/2hr/overnight)
- Tour announcement composes the Tryst-specific phrasing convention
- Photo changes respect Tryst's hero + 12-gallery slot model + face-blur rules

**NOT fanout-participants** for Tryst (Tryst-only): home cities (tier-gated; doesn't generalize), Sumsub KYC (per-surface verification), connect/auth (per-surface auth-grant).

### §14e Voice-mode adaptations

Per [voice-input-settings.screen.md](./voice-input-settings.screen.md), Tryst management over voice works identically with two adaptations:
- Visual-shape outputs (preview render, photo gallery) are summarized verbally + offered as "tap to see" if Quinn wants the screen.
- Secure inputs (cookie paste, password during connect) prompt for iOS-native secure entry; voice continues for everything else.

*Generalization callout*: every per-surface brief MUST include a §14 documenting (a) verbs Quinn uses, (b) pure-chat actions, (c) screen-invoking actions with reasons, (d) cross-surface participation flags, (e) voice-mode adaptations. The shape of §14 is the same across all per-surface briefs; only the per-surface verb + screen lists differ.

## Related

- [Brief H](./H-recurring-chores.brief.md) — bump policy + multi-surface profile + tour patterns.
- [Brief K](./K-safety-blocklist.brief.md) — K1 personal blocklist (companion to §10 Tryst-side block).
- [Brief P](./P-inboxes.brief.md) — unified-inbox parent.
- [Brief I](./I-audit-trust-replay.brief.md) — every Tryst action is an `agent_actions` row.
- [Brief M](./M-error-degraded-modes.brief.md) — degradation playbook (§12 instantiates).
- [Brief T](./T-analytics-dashboard.brief.md) — §9 metrics consumer.
- [Brief N](./N-provider-coop.brief.md) — coop intel may flag Tryst clients (companion to §10).
- [Brief V](./V-data-portability-erasure.brief.md) — exporting Tryst credentials + history.
- [specialist-bookings-tryst.contract.md](./specialist-bookings-tryst.contract.md) — specialist consuming this brief.
- [policy-card.screen.md](./policy-card.screen.md) — H1 instantiation for Tryst.
- [tryst-connect.screen.md](./tryst-connect.screen.md), [tryst-inbox.screen.md](./tryst-inbox.screen.md), [tryst-profile-preview.screen.md](./tryst-profile-preview.screen.md), [tryst-profile-editor.screen.md](./tryst-profile-editor.screen.md), [tryst-photo-manager.screen.md](./tryst-photo-manager.screen.md), [tryst-location-lock.screen.md](./tryst-location-lock.screen.md), [tryst-verification.screen.md](./tryst-verification.screen.md), [tryst-reviews.screen.md](./tryst-reviews.screen.md) — Tryst-specific screens.

## Out of scope

- Actual Tryst adapter code (lives upstream in `~/Code/@applications/@ai/@skills/platform-tryst/actions/`).
- Per-surface engineering migration (e.g. `surface_credentials` schema details).
- Subsequent per-surface briefs (TS4R, Slixa, Eros, OF) — they inherit this structure but get their own files.