RyazanovAlexander · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
diff --git a/README.md b/README.md
@@ -16,7 +16,7 @@
 [![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=MathTrail_canvas-api&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=MathTrail_canvas-api)
 [![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=MathTrail_canvas-api&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=MathTrail_canvas-api)
 
-MathTrail Canvas is a math tutor for children in grades 1–6. A child solves a task by hand, with a stylus or a finger, on a squared draft sheet and writes the final answer in an answer box. On **Check**, an AI reads the answer and a program compares it with the task's key. When the answer is wrong, the tutor looks at the draft, frames the place where the reasoning went wrong and asks one short guiding question. It never gives the answer.
+MathTrail Canvas is a math tutor for children in grades 1–6. A child solves a task by hand, with a stylus or a finger, anywhere on a squared sheet and writes the final answer on the same sheet — there is no separate answer box. On **Send Answer**, one AI call reads the whole sheet: it finds the final answer, follows the reasoning and finds the first mistake. A program, not the AI, compares the answer with the task's key. When the answer is wrong, the tutor frames the place where the reasoning went wrong and asks one short guiding question. It never gives the answer.
 
 ![The task screen on a tablet, as the design draws it](docs/design/app.png)
 

diff --git a/RUN.md b/RUN.md
diff --git a/SECURITY.md b/SECURITY.md
@@ -35,10 +35,10 @@ Research in good faith is welcome, and nobody will be pursued for it. Two limits
 The service is still being built, in the order [`RUN.md`](RUN.md) sets; this is what it is designed to hold, and every change is held to it. The full register, in Russian, is section 4 of [`docs/privacy.md`](docs/privacy.md).
 
 - **About a child, only a pseudonym, an avatar from a set and the grade.** No name, photo, birth date, school or contacts is asked for or kept. The parent owns the account, and no child's data exists before the parent's consent is verified.
-- **The handwriting stays on the device.** The child's strokes live in the browser. On Check the app sends two pictures drawn from them, and the server keeps the pictures only in the memory of that request — never in the database, a log or a trace.
-- **The AI receives what is listed, and nothing more.** Gemini gets the answer box's picture to read it and, after a wrong answer, the draft's picture with the task, so that it can frame the mistake. No identifier, no pseudonym and no parent's data goes with them, and Gemini's caching is switched off.
+- **The handwriting stays on the device.** The child's strokes live in the browser. On Send Answer the app sends one picture of the whole sheet, drawn from them, and the server keeps it only in the memory of that request — never in the database, a log or a trace.
+- **The AI receives what is listed, and nothing more.** In one call, Gemini gets the picture of the sheet with the task, its key and its solution, so that it can find and read the final answer, frame the mistake and word one question; whether the answer is right is a program's comparison with the key, not the AI's. No identifier, no pseudonym and no parent's data goes with them, and Gemini's caching is switched off.
 - **No personal data in logs, metrics or traces.** They carry IDs, codes and timings: an ID is a UUID or the parent's Firebase UID, never an email, a name, a pseudonym, a picture, a read answer or the text of a hint.
-- **The task's answer stays hidden** until the task is solved: no endpoint returns it before then, and every hint the AI writes is checked for leaking it before the child sees it.
+- **The task's answer stays hidden** until the task is solved, and every hint the AI writes is checked for leaking it before the child sees it. No endpoint returns the answer before then, with one temporary exception: while the service is an experiment that only its author uses, behind a key, a check's response carries the AI's whole analysis — which saw the key and may name it — to the author's panel.
 - **No secrets in this repository.** Keys live in Google's Secret Manager and reach the service through its environment. The whole history is scanned for secrets on every pull request, and a key that was ever committed would be treated as leaked and rotated.
 
 ## Supported versions

diff --git a/docs/decisions.md b/docs/decisions.md
diff --git a/docs/privacy.md b/docs/privacy.md
diff --git a/docs/product.md b/docs/product.md
diff --git a/docs/spec.md b/docs/spec.md
diff --git a/docs/stack.html b/docs/stack.html