1. The AI writes a one-time dictionary. For each message the AI generates a set of ordinary, native-language phrases — a throwaway codebook that exists only for this one message. Nothing in it looks secret; it reads like normal chatter about everyday things.

2. The key binds the dictionary. A random one-time key is generated and tied to this exact dictionary (by its SHA-256 fingerprint). The same dictionary + key can read the message back; anything else produces nothing. The key is never reused.

3. Encode. Your real message is turned into bytes, and each byte is swapped for its phrase from the dictionary — so the message rides inside what looks like an ordinary conversation. (In short-message mode the AI instead writes a single cover text, and your message is sealed with AES-256-GCM using a key derived from that cover — same idea, one line instead of many.)

4. The server stays blind. The relay holds only the dictionary/cover and the one-time key — never your real message. It is released only to someone who already has the exact text, so the server alone can never read a thing.