🤖 Eleven onboarding flows — review boardEvery way someone arrives in Eleven, step by step. Built from main @ 7312ce3a (with #1554, #1555 and #1556) on 2026-10-03, for review and discussion. The copy is quoted from source and each step cites its file. The screenshots come from a throwaway local build. Fake sign-in doors were enabled for the capture, so no real ceremony was completed. Click any screenshot to see it full size.
Best-case count from tapping the link to the first chat surface. "Screens" counts distinct cards or screens before the chat. "Taps" excludes the identity provider’s own sheet and biometric prompts, which are listed separately. Eleven’s conversation after landing is counted on its own.
| Flow / path | Surface | Screens before chat | Taps | Plus | Then in Eleven’s conversation |
|---|---|---|---|---|---|
| 1 · Invite, sign-in-first (new person, Apple) | Web · iPhone Safari | 4 | 3 | Apple sheet + biometrics ×2 (sign-in, key step) | name chip, photo skip, “Done for now” = 3 |
| 1 · Invite, sign-in-first (new person, Apple) | Web · desktop | 3 | 2 | Apple sheet + biometrics ×2 | 3 |
| 1 · Invite, “…” → without signing in | Web · iPhone Safari | 3 | 4 | — | access “Not now”, name, photo, done = 4 |
| 1 · Invite, classic card (self-host / old home) | Web · iPhone Safari | 2 | 2 | — | 4 |
| 3 · Invite opened in the app, signed out (iOS 18+) | iPhone | 2 | 1 | Safari “Open in Eleven?” + Apple sheet | type a name (no suggested-name chip natively), done = 2 |
| 3 · Invite opened in the app, already signed in | iPhone | 1 | 1 | — | 2 |
| 4 · Invite via universal link, signed in | Mac | 1 | 1 | — | 2 |
| 4 · Spaces › Add from link… (paste) | Mac | 1 | 3 | menu, paste, Add Space | 2 |
| 5 · Create a space (signed in, has a space, under quota) | Web · home | 4 | 4 | slide-to-create gesture | about 10 answers: name, space name, email, photo, invites, extras, AI, plan*, key, finish |
| 5 · Create a space (over the free quota or pool full) | Web · home | 7 | 6+ | Stripe Checkout form before the space exists | about 10 |
| 5 · Create a space | iPhone / Mac | 2 | 2 | slide gesture | about 6: name auto-recorded, no photo, plan or key step |
| 6 · New browser, returning member | Web · home | 2–3 | 2 | provider sheet + passkey for “Unlock” | — |
* The plan step only appears on web, for a free space, when the home server serves a price book (web/static/apps/setup.js:139-158).
home.js:2792, 2833, enforced in home/provision.go:248-263). The first free create goes straight through. The second one, or any create while the free pool is full, bounces to a plan picker and then Stripe Checkout before the space exists (home.js:3881-3888, cloud.go:325-333, default LCHAT_CLOUD_QUOTA=1). Setup already has a web-only plan step that defers payment (“payment waits at the finish line”, then a “Set up your plan” chip at the finish). So “move payment to the end” is partly built. What’s left: replace the over-quota bounce, move the plan step after the key step, and give native the same step. See flow 5.cnz.11ch.at). Every join card’s sub-line names the raw host instead of the space.alert().home/web/pages/index.html:929).setup_complete when it’s claimed, so web never resumes its setup.The invite link (/join/join#e1.<T>~<name>) opens on the space’s own origin. If a home server answers join_return ≥ 2 within 3 seconds, the space hands straight over to home with no card. Home parks the return address and strips the hash, so only home.elevenmessenger.com/ shows in the address bar. After sign-in, home returns to <space>/join/join?su=<nonce>[&key=1 | &anon=1], which claims the invite without showing a card.
(spinner — aria-label “Loading”)
Only a spinner shows while the page calls GET <home>/api/features (3-second timeout). The link preview says “You're invited to The Commons” / “Private, end-to-end encrypted chat.”
web/pages/join.html:14-19, 71 · web/static/join.js:471-476 · prejoin.js:31-35
The door shown is the last-used method. Otherwise it’s the platform default: Apple on Apple devices, Google on Android/ChromeOS, Microsoft on Windows, else email.
Join The Commons
Sign in to join. You’ll head straight back to localhost:18802.
Under the card: No signup required, we don't store your email or any personal details. We can't spam what we don't have.
home/web/static/home.js:1185-1190, 331-375 · home/web/pages/index.html:840-872, 1291-1293
Use your Apple Account to sign in to Eleven.
Continue(system sheet / Face ID)
Apple goes through appleid.apple.com → /siwa/return. Google, Microsoft and GitHub go through /oidc/return. Email stays on home.
Confirming it’s you…
home.js:379, 565, 773 (status) · 587, 791 (errors)
Join The Commons
Keep your access to The Commons safe on this device. Your device will ask you to confirm with Face ID, Touch ID or your screen lock — then you can get back in from anywhere you sign in.
ContinueNot nowShown when the sign-in was through a provider or email, there’s no saved list yet, WebAuthn is available, and a fresh proof exists. Otherwise it’s skipped silently, and Eleven asks later (2.2).
One more step
Keep your access to The Commons safe on this device. Your device will ask you to confirm with Face ID, Touch ID or your screen lock — then you can get back in from anywhere you sign in.
Status: Waiting for your device… / Done — taking you back… / This device can’t keep your access safe here — tap Not now to carry on.
home/web/pages/index.html:969-973 · home.js:1315-1349, 1376-1403
One moment…
Saving your access…
Saved — taking you back…
The space claims the invite without a card. With key=1 it bounces through /enroll to save the key into the account. If that can’t happen silently, the full “Keep your access to this chat” card appears.
Plugging in…
prejoin.js:55-79 · join.js:556-581, 729 · home/web/pages/enroll.html:20 · enroll.js:402, 463
Shown before the chat when needsHomeScreen() is true and the card hasn’t been dismissed.
Add The Commons to your Home Screen
On iPhone & iPad, add this to your Home Screen so it opens like an app — and can send you notifications.
… Open The Commons from your Home Screen, then paste your invite link to join.
The invite was used one step earlier, so pasting it won’t work.
web/pages/index.html:307-321 · shell.js:994
This capture took the anonymous branch, so the access pitch shows. A signed-in joiner instead sees “Great — you're signed in, so your access is safe. 🔒 Let's continue.” Continues in flow 2.
onboardingui.js:55-80 · welcome.flow.js
Other ways to sign in
We don't store your data no matter what method you use.
For those oppressed by convenience…
GitHub rendered even though the local home had no GitHub door configured.
home/web/pages/index.html:918-933
Sign in with email
We never keep your email address. No spam, ever.
Status: Sending your code… / Check your email for a 6-digit code.
index.html:894-911 · home.js:1025-1118
Check your email for a 6-digit code.
Checking your code… / That code didn’t work — try again.
Magic link: That sign-in link has expired — request a fresh code.
home.js:1025-1118, 1113, 4595
The menu covers the “Join The Commons” heading.
index.html:858-863
Continue without signing in?
Without signing in, your access to The Commons lives only in this browser. If it’s cleared or lost, you’ll need a new invite to get back in.
No back arrow (the “somewhere else” step has one).
index.html:937-944 · home.js:1193-1194, 4463-4471
Returns with &anon=1. Eleven’s access step then asks the person to sign in again.
welcome.flow.js:83-117
Sign in somewhere else
Keep your Eleven sign-in on a different server? Enter its address and sign in there instead.
Status: Enter the server’s web address, like home.example.com. / That’s this page — sign in here instead. / Taking you there…
index.html:949-961 · home.js:1273-1285
Join The Commons
Unlock your spaces on this device to finish joining The Commons. Your device will ask you to confirm it’s you.
UnlockNot nowThe provider sign-in (or a 30-day cold open) finds an existing list. “Unlock” runs a passkey sign-in. Errors go to the general status line, not the join card.
Unlock your spaces on this device to finish joining The Commons. Your device will ask you to confirm it’s you.
Errors: That sign-in can't unlock these spaces. / Signed in, but this browser didn't return a PRF result, so your spaces can't be unlocked here.
home.js:1129-1164, 1338-1340, 406, 414
… to finish joining The Commons. Approve it from a device you already use, or confirm it’s you here.
Approve from a device you already useUnlockWith #1557, a browser that already holds a device key lands unlocked and skips this. #1559 adds approval from another device (see flow 6).
branch approve-from-device: home.js:1475, 1499-1500 · index.html:996
That invite’s sign-in step timed out — open the invite link again to finish joining.
home.js:1354-1361, 4470
Shown when the home is old (join_return < 2), unreachable or slow, when there’s no home at all (self-host renders the same card, then the add-to-Home-Screen card), when the page has no storage, inside the native wrapper, or with ?src=home. The capture used a dead home URL with a space named “Test Space”.
You're invited to Test Space
Private, end-to-end encrypted chat.
Joining in the browser keeps your access in this browser only — if it's cleared or lost, you'll need a new invite.
web/pages/join.html:128-144 · join.js:190, 401, 444-447
This link doesn't work
This invite has been used or is no longer valid. Ask for a new one.
Other bodies: This link is missing its secret. / Couldn't reach the server. Try again. / Couldn't unlock this link (wrong or corrupt secret). / This invite was just used. Ask for a new one.
“Already a member? Sign in” lands on the home root, not on this space.
join.html:106-115 · join.js:106, 144, 155, 222, 516, 737-754
The same flow document drives web (web/static/welcome.flow.js, hosted by apps/welcome.js) and native (LChatCore/Flows/welcome.json, via FlowEngine.swift). A deep comparison found the copy identical. Every difference comes from host flags and which actions each side has wired up. The events are the resume state, so a fresh run on any surface picks up at the first unanswered step. Full web transcript (screenshot) →
Skipped when resuming. On resume Eleven says instead: “Welcome back — let's pick up where we left off.”
Welcome! 👋 I'm Eleven, your guide here.
You've been invited to The Commons (or “{inviterName} invited you to …”) — a private, invite-only chat space. It isn't a big platform with accounts and feeds: it's a small server run by one of its members, just for the people in it.
Everything here — messages, photos, even names — is locked with keys only members hold, so nobody outside a chat can ever read it. Not the server, and not whoever runs it.
welcome.flow.js:11-37 · welcome.json:18-52
Skipped with a recorded line in three cases:
• Native and signed in: “Your access is already secured by your Eleven sign-in”.
• Enrolled: “Great — you're signed in, so your access is safe. 🔒 Let's continue.”
• No home: “Your access lives in this browser/on this device”.
Before anything else, let's make sure you can't lose your way in. 🔑
Your access to this space lives in a key that exists only in this browser — there's no username or password, and nobody can reset it for you. If this browser's data is cleared, your access goes with it.
Sign in with Eleven and your access is safe — one tap, your face or fingerprint, and you'll be brought straight back so we can carry on.
“Not now” replies: “No problem — I'll nudge you again in a day or so.” Tapping sign-in leads to a waiting step: “I'll wait here while you finish signing in. When you're done, tap Continue.” with the buttons Continue and It didn't work — skip for now.
welcome.flow.js:38-149 · welcome.json:53-219
Skipped if a name is already known. The “I'm {suggested}” chip uses the name the inviter put in the link; it never appears natively. An answer that looks like an email gets a confirmation step: “That's an email address — is that what you'd like to be called here?…”
First things first — what should folks here call you? Reply with your name.
Composer: Your name: (e.g. Finn Wolfhard)
Reply: Lovely to meet you, Sam! 🤝
welcome.flow.js:150-204 · welcome.json:220-282
Skipped natively without recording it, so a later web session asks again. After a photo is sent, a preview step offers Keep this photo Use a different photo.
Want to add a profile photo? Only members of this space can see it — like everything else here, it's encrypted.
Send me a photo — tap the + next to the message box, or just drag a picture into the chat, and hit send. If you type a message with it, I'll keep that as the photo's description. Or skip for now.
welcome.flow.js:205-280 · welcome.json:316-373
No problem — you can add one anytime from your profile.
That's it — you're all set. 🎉 Enjoy The Commons!
One more reminder before you go: you haven't signed in yet, so your access to this space lives only in this browser — if it's cleared or lost, there's no way back in. Sign in any time and you're safe.
Eleven also has an app for your iPhone. Once it's installed, tap Open the app and I'll hand this space straight over to it.
Where would you like to start?
The device is iPhone, iPad or Mac, detected from the user agent (ui.js:80-87). “Get the iPhone app” opens TestFlight. “Done for now” replies: “You're all set. 👍 I'm here whenever you want me — just say hello, or type `/` to see what I can do.” At 390px wide the last chip sits under the composer.
welcome.flow.js:281-385 · apps/welcome.js:112-146 · ui.js:67-87
Access is recorded automatically. Photo is skipped without being recorded. There’s no suggested-name chip, no tour and no app links. It always says “run by one of its members” because native never gets an admin name.
ElevenConversationModel.swift:124-167, 544-566 · welcome.json:64, 422-566
| Photo + preview | Web only. Native skips without recording, so web re-asks later. |
| “I'm {suggested}” | Web only (native suggested = ""). |
| Admin name in hello | Web only. Native always says “run by one of its members”. |
| Inviter | Web uses the invite’s own DM and excludes agents. Native takes the first non-app DM, which can be a bot. |
| App offer + chips | Web only. The saved bubble still shows in native transcripts. |
| Take the tour | Web only. |
| Quick form | Web: “Introduce yourself”, fields Sign in / Cancel, records a name and skips the photo. Native: “Save”, name only. |
| Device wording | Native says “on this device” for access and the reminder. The “Signed in (in this browser)” label can still appear natively. |
onboardingui.js:109-118, 318-345 · ElevenQuickFormView.swift:32-129
The join copy shared with the Mac lives in LChatCore/AddFromLinkCopy.swift (cited as ALC below). {device} is iPhone, iPad or Mac. The iPhone first-run screen is a real simulator capture. Everything after it needs taps on system prompts, so those steps are mocks.
One door at a time: the last-used door, otherwise Apple. When the account is sealed, the passkey door leads.
Welcome to Eleven
Secure group chat
ios/LChat/Views/SignInWithEleven.swift:524-536, 656-717, 697
“Continue with {Google|Microsoft|GitHub}” only appears for doors the server enables. Once signed in or sealed, the link reads “Sign in a different way”.
SignInWithEleven.swift:679, 747, 769, 793, 801-805
‹ Back
We never keep your email address. No spam, ever.
SignInWithEleven.swift:823-852
‹ Back
Check your email for a 6-digit code.
SignInWithEleven.swift:857-877
Syncing your spaces…
✓ 2 spaces restored.
If the account has no saved spaces, it shows the line quoted below.
Signed in — nothing saved on this account yet. Join a space in your browser first.
Partly stale: the apps can now join from a link.
SignInWithEleven.swift:558-594
Eleven
When the restore brings back the whole list and exactly one space has an unfinished welcome, the app opens it. It stands down if an invite sheet is up or the user has already navigated.
LChatApp.swift:561-564, 616-632 · WelcomeLanding.swift:78-98
You opened an invite for thecommons.11ch.at. Sign in to Eleven first, and this space stays with you on all your devices.
Continue with AppleOther ways to sign inCancelOpens at the large detent. After sign-in the join continues automatically. If the restore already brought this space back, the app opens it instead.
Add this space?
You opened an invite for {host}. Sign in to Eleven first, and this space stays with you on all your devices.
AddFromLinkConfirm.swift:123-159 · ALC:63
Without signing in, your access to thecommons.11ch.at lives only on this iPhone. If you lose it, you'll need a new invite to get back in.
Sign in insteadContinue without signing inAddFromLinkConfirm.swift:181-214 · ALC:71-76
You opened an invite for thecommons.11ch.at. It joins this iPhone and syncs to your Eleven account.
Add SpaceCancelSigned in: … It joins this {device} and syncs to your Eleven account.
Sealed: … It joins this {device}, and syncs to your Eleven account once you unlock your spaces.
Anonymous / iOS < 18: … It joins this {device} only — you're not signed in to Eleven.
Title case: “Add Space”.
AddFromLinkConfirm.swift:92-119 · ALC:40-44 · SpaceCreate.swift:79-153 (errors)
Update your iPhone to sign in to Eleven — or use your space in the browser meanwhile.
There are no buttons. On iOS 17, an invite link skips the doors and the warning, and goes straight to an anonymous join.
LChatApp.swift:778-781 · AddFromLinkConfirm.swift:47-54
All mocks. The Mac app wasn’t built or launched for this review: it shares the keychain group with the real signed-in app, so a dev build would see real spaces. Copy is quoted from ios/LChatMac/.
Secure group chat
Continue with AppleOther ways to sign inShown when the rail is empty. The doors and email strings match iPhone. A comment in RootView.swift:300 promises “the invite link as the secondary path”, but there is no such link.
MacHomeSignIn.swift:615-674, 689-1002
Finishing sign-in in your browser…
Providers use an ASWebAuthenticationSession sheet (“Confirming it’s you…”). The passkey door falls back to the default browser through /restore.
Finishing sign-in in your browser…
Failures: The browser handoff didn't match this app's request — try again. / The browser sent an unusable session — try again.
The locked pane (4.6) has no browser-wait copy, so the button comes straight back with no feedback.
MacHomeSignIn.swift:182-236, 583, 671
You opened an invite for thecommons.11ch.at. Sign in to Eleven first, and this space stays with you on all your devices.
No link yet: Paste an invite link, then sign in to Eleven — your spaces stay with you on all your devices.
No OS gate here; below macOS 15 it falls back to the browser.
AddFromLinkSheet.swift:134-195 · ALC:63, 68
Without signing in, your access to thecommons.11ch.at lives only on this Mac. If you lose it, you'll need a new invite to get back in.
The button order is the reverse of iPhone and web (the primary button is on the right, per macOS convention).
AddFromLinkSheet.swift:201-225
Paste an invite link — the space joins this Mac and syncs to your Eleven account.
…syncs to your Eleven account once you unlock your spaces. (sealed)
Paste an invite link — the space joins this Mac only. (anonymous)
Errors: That doesn't look like an Eleven invite link. / Couldn't add that space.
Entry points: Spaces menu “Add from link…”, File menu “New space” (⇧⌘N), and Spaces menu “Create a space”. The rail’s “+” only creates; its tooltip is “Create a New Space”.
AddFromLinkSheet.swift:93-121, 228-284 · LChatMacApp.swift:119, 173-190 · Sidebar.swift:152
This space can't be unlocked on this Mac yet. Sign in with Eleven to bring its key back, link it from another device, or ask a member for a fresh invite.
Sign In with Eleven…Link from Your iPhone…Ask for a New Invite…Remove from This MacLink hint: On your iPhone (or anywhere you're already in this space), open the space menu, choose Add a device, and bring the link here — it signs this Mac in as you, with your history.
Invite hint: Any member of this space can send you a fresh invite link — add it here. You'll rejoin as a new member.
Signed in without a key: You're signed in, but that account doesn't hold a key for this space. Link it from a device that's already in, or ask a member for a fresh invite.
Title case: four of the button labels.
RootView.swift:240-272
The first free create is not pay-gated. The create slider calls requestSpace() unless a plan was already picked:
// home/web/static/home.js:3875-3878
onEleven: () => {
$("create-back").classList.add("hidden");
return planChoice && planChoice.tier ? requestPaidSpace() : requestSpace();
},
Payment moves to the front only when a free create is refused. That happens when the account is over its free quota (default 1 free space, cloud.go:653) or the free pool is full. The person is bounced to a plan picker, then Stripe Checkout, and the space is created after payment:
// home/web/static/home.js:3884-3887
if ((code === "quota_exceeded" || code === "free_pool_full") && billingTiers.length) {
openPlanBounce((err && err.message) || "");
return;
}
// cloud.go:331 — "this account already has %d free %s (the limit) — upgrading a space frees its slot, and so does deleting one you no longer use"
// pool.go:263 — "The free pool is full right now. Paying supports free spaces for those who can't — as more people upgrade, the pool grows. Check back soon, or upgrade to create a space now."
The paid branch’s sub-line: “Slide, and we'll take you to the payment — your space is created the moment it's paid.” (home.js:4031-4033).
The real front-door gate is membership, not money. “+” only appears once the account holds at least one space (home.js:2792-2794). The server enforces it with “You need at least one Eleven space before you can create a new one.” (home/provision.go:258-261). A signed-in account with no spaces sees “None (yet). Creating is invite-only for now.”
A plan step already exists, half-way through setup (web only, free spaces, when home serves a price book). It records “chose the {plan} plan — payment waits at the finish line”, and the finish offers a “Set up your plan” chip that opens home’s /#upgrade=<host>&tier=<key>. Paul’s target — always create free, then a plans step at the end of setup — is drawn as dashed cards below. The difference from today: the plan step currently sits before the key step, native has none, and the over-quota bounce still asks for payment first.
The “+” button (aria “Create a new space”) only shows when you hold at least one space. Never-signed-in visitors get a demo card instead: “👋 Just looking?” / “Try a demo space”.
home/web/pages/index.html:985-986, 1311-1315 · home.js:2792-2794
this account already has 1 free space (the limit) — …
Pick a plan to create it now:
Billed in euros — ≈ at the ECB rate of {date}.
ContinueThere is no free card on this screen. Prices come from config (LCHAT_STRIPE_PRICES); the figures shown are from docs/tier-economics.md. After this: slide → Stripe Checkout → return → claim-create.
index.html:1162-1174 · home.js:3646-3737, 3957-4020 · cloud.go:294-333
Your new space will be created immediately.
Then a building pane (“Hold on…” / “Building your space”). The back link hides once the create is in flight.
index.html:1178-1201 · home.js:3868-3924, 4024-4036
cnz.11ch.at
Set up your space →This one-time link is only for you.
DoneOpens /join/setup?src=home#… in the same tab. Without a setup link: “The setup link couldn't be created just now — head back and create again.”
home.js:3812-3857
The arrival from home (?src=home) skips sign-in-first and adds the space to the account when it’s claimed.
Welcome to your new space
This one-time link makes you its administrator. Continue, and we'll set things up together.
join.js:424-430, 556-581
Continue to localhost:18802
Sign in to join. You’ll head straight back to localhost:18802.
A creator is told to “join”, and the card names neither the space nor the admin role.
join.js:488 · home.js:1185-1190
Hi — I'm Eleven! 👋 This is your space now: everything in it is end-to-end encrypted, and you're its administrator.
Let's take two minutes to set things up.
First — what should everyone here call you? Reply with your name.
Natively the name is usually recorded automatically (“noted the name you go by”).
setup.flow.js:19-104 · setup.json:25-129
Lovely to meet you, Paul! 🤝
Next, this space needs a name. It's the one everyone sees — on the sign-in page, in invites, on the app icon.
What should we call it? Reply with a name. (or: It's currently “{name}” — keep that, or reply with a new name.)
setup.flow.js:105-138
Your contact email is shared with members — useful if someone's locked out, or something needs a human. It's optional.
How can people here reach you outside the chat? Reply with an email address, or skip it.
setup.flow.js:139-165
Want to give this space a face? The photo shows on the welcome page and when people join — you can always change it later.
Send me a photo — tap the + next to the message box, or just drag a picture into the chat, and hit send. Type a message with it if you want to include alt text.
The preview warns that the alt text is PUBLIC (“anyone with an invite link can see both”).
setup.flow.js:166-230
Who gets to bring people in? You can always invite people. The question is whether members can too, or whether new faces only arrive through you.
setup.flow.js:231-255
Nearly there. Your space comes with a couple of extras:
• Bots — little helpers members can create for reminders and jobs.
• Apps — to-dos, polls, whiteboards, and a studio for building your own.Everything essential works with these off, and you can change your mind anytime in Admin.
“Let me choose” asks two more questions: “Enable bots / No bots here”, then “Enable apps / No apps here”.
setup.flow.js:261-335
Last choice — AI. Say yes and Eleven, the built-in helper, joins this space: members can ask it things in plain language and it answers, builds, and helps out.
An honest note before you decide: Eleven's AI runs on Eleven Messenger's machines, and it can read the chats it's invited to — that's what lets it help. It never sees chats it isn't in, and you can switch it off anytime in Admin.
setup.flow.js:341-370
Not captured, because the local home had no price book. Choosing a plan records “chose the {plan} plan — payment waits at the finish line”. Skipped natively without being recorded.
setup.flow.js:368-470 · apps/setup.js:139-158
Now the most important thing of all. 🔑
Everything here is locked with a key that exists only on your devices. There's no password reset and no support desk — not even whoever runs the server can read your messages or recover that key. That's not a flaw; it's the whole point.
But it means: right now, this browser holds the only key to your space. If it's lost — cleared, broken, stolen — your space is gone with it, and nobody can get it back.
Sign in with Eleven and your key stays safe — one tap, your face or fingerprint, and you'll be brought straight back.
From home (?src=home) this becomes keys-home: “Last thing — the key. 🔑 This space is locked with a key that was just created here, in this browser. Your Eleven sign-in doesn't hold it yet…”. Natively and signed in, it’s recorded automatically.
setup.flow.js:471-585
I have to be straight with you: if you don't sign in, one lost or cleared browser means this space and everything in it is gone — permanently, for everyone, and no one can help. I'll remind you again in a day or so.
setup.flow.js:616-640
That's it — The Commons is ready! 🎉
Everything we just set up lives in your Admin panel — invite links, the space's name and photo, who can invite. Type /admin anywhere to open it; it's yours alone as this space's admin.
(not signed in) One more reminder before you go: … this browser holds the only key to this space…
(plan picked) And the plan you picked — tap below whenever you're ready to set up the payment. Your space runs free until then.
Where would you like to start?
setup.flow.js:642-698 · apps/setup.js:189-201 · full transcript
Your new space will be created immediately.
Over-quota or pool-full creates go through as “pending plan” rather than refusing. Open question: how to cap free spaces without a refusal, perhaps with a grace period before the reaper.
Suggestion: move the key step up, since the copy calls it “the most important thing of all”.
Reuses today’s plan step. It would move after the key step, add a native version, and replace the over-quota bounce. A plan picked here should pre-fill home’s upgrade picker so the choice isn’t made twice.
Your new space will be created immediately.
CancelSame copy as web. The slider’s VoiceOver label is “Volume slider — slide to eleven to create your space”. There is no paid branch: a refusal is shown inline (“…upgrade…”) with no way to upgrade. The space is claimed with setup_complete: true, so web never resumes setup.
CreateSpaceView.swift · SpaceCreate.swift:62-64, 307-309
On a fresh browser, the home page is the front door. A space visited while signed out redirects there too (shell.js:8874-8876), except in a standalone PWA or with ?stay=1.
The same doors as the join card, with the Eleven lockup instead of a join heading and no “…” menu. Browsers that have never signed in also get the demo card. The loading tagline is “The group chat of dreams”. Mac-UA variant · cookie dialog (“There isn't one.”).
home/web/pages/index.html:823, 1291-1315
The only control is the button below. If no passkey is available, the person sees “Sign in was cancelled. If you didn't cancel, try again. (NotAllowedError)”, and the explainer is attached to a hidden element. Dead end.
index.html:1004-1006 · home.js:1153-1164, 1019-1023, 4381
None (yet). Creating is invite-only for now. (when empty)
The account menu has “Sign-in options” and “Sign out”. If the account is empty and you signed in with a provider: “Already have spaces? Sign in with your passkey to bring them over.”
index.html:985 · home.js:2830-2841, 3024-3032
Your face or fingerprint is the key. Not even this server can see inside your spaces.
Unlocked. Taking you back to your chat…
Tapping a row opens <space>/?restore=1, then /restore, then #lchat_restore. A failed unwrap bounces silently back to home.
Errors: Nothing saved for this sign-in yet. / That sign-in can't unlock these spaces. / Your Eleven account doesn't include {host}. Open the chat from an invite instead.
restore.html · restore.js · serverlist.js:16-24 · shell.js:973-977, 8865-8876
A passkey becomes optional. Each browser holds a non-extractable device key that the vault key is wrapped to. A provider sign-in on a browser that holds a wrap lands unlocked.
Nudge: Only this browser can open your saved spaces. Add another way to unlock them, so losing it never locks you out.
Your devices: Signing in proves it’s you. These devices hold the key that opens your saved spaces.
PR #1557 (vault-device-key)
Your spaces are saved, but this browser can’t open them yet. Approve it from a device you already use, or unlock with another way you’ve set up — once, and it’ll remember.
Approve from a device you already useUnlock your spaces with your passkeyOn a device where your spaces already open, go to the Eleven home page. It will ask to approve this browser.
Check the code matches on both screens.
approve-from-device: index.html:1032-1033 · home.js:1902-1910
Only approve it if you’re signing in there right now.
ReviewNot meApprove {label}? — Check the code matches on both screens.
{label} can open your spaces now.
approve-from-device: home.js:2054-2063
Approved — this browser can open your spaces now.
Also reachable from the join key step (1.6u+). Native parity: not yet. The Mac’s “Link from Your iPhone…” is the closest equivalent today.
Also available from the command palette. On a Mac browser, “Open in the Eleven app” appears too.
web/pages/index.html:150-160 · shell.js:2678
Add a device
Open this on another device to sign in there — or save it somewhere safe (like a password manager): it's a way back in if you lose this device. It works once, and anyone who uses it signs in as you.
At 390px wide the button row overflows and “Done” is clipped. Failure uses alert("Couldn't create a device link. Try again.").
web/static/adddevice.js:32-95
Never sign-in-first: a device link carries the private key.
Sign in to The Commons on this device
This link signs this device in as you.
join.js:405-410 · prejoin.js:33
The app opens with a one-time sign-in for this space — confirm it there and you're in as you. Nothing happened? You need the Eleven app (or its latest update); or copy the link below and paste it into the app's Add from link.
Copy the sign-in linkDoneadddevice.js:111-151
You're already in The Commons
Continue to open the new conversation on this device.
join.js:411-417
Become admin
You're already a member on this device. Continue to accept the admin role.
A new person opening an admin invite sees the plain “Join <name>” card, which never mentions admin.
join.js:418-423
⚠️ This is powerful
Anyone who claims this link becomes an admin with full control over this server.
Treat this link like a password — keep it private.
Delegate admin role — Create an invite that makes the claimer an admin. They can then access this console with their device token (no need to share your admin link)…
web/pages/admin.html:213-217 · admin.js:509-531 · apps/admin.js:1535-1570
docs/tier-economics.md.🤖 Generated 2026-10-03 for review. Screenshots: local throwaway lchat + home builds of 7312ce3a (headless Chromium at 390×844 @2x, an iPhone Safari user agent for the joiner and a desktop user agent for the creator) and one iOS 26.5 simulator capture. Back to top ↑