eleven / ocho Public

Joiner onboarding: Eleven welcomes new members (#278)

* web: Eleven welcomes joiners — chat-first user onboarding

Claiming an invite lands a new member straight in a conversation with
Eleven (no name form): name (with the inviter's suggested name as a
chip), a profile photo sent through the chat (decrypted and re-encrypted
under the instance key — never plaintext), saving their profile behind a
passkey (softer joiner copy, same resume-on-return and stayed-in-place
paths as setup), and a finish offering the inviter's DM and the tour.
Gated by a local pending marker the join page writes (suggested name
included; never sent to a server) and cleared on completion. The native
add-chat webview keeps its form (it hands a named identity to the
shell). The sidecar's welcome DM stands down — one voice. Nameless
senders fall back to 'New member' (not 'Admin').

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* server: LCHAT_SKIP_SETUP — test instances skip first-run onboarding

A dev/test convenience: mark the setup conversation complete on boot and
seed workable defaults (group name from LCHAT_GROUP_NAME or 'Test
Space'; member invites on) — the setup link still makes its claimer the
admin, they just skip the conversation. Only unset values are seeded, so
restarts never clobber in-test edits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: spent action chips, a fuller welcome intro, join-card caveat spacing

- A chip whose step has resolved renders SPENT: disabled, quiet, and
  the tapped one shows its past-tense label (Skip for now → Skipped,
  Keep → Kept). The script's step guard (go.taken) is the source of
  truth; staleness folds into the notice vrev so the keyed feed
  rebuilds rows when chips go stale. Tour chips get the same guard.
- Eleven's joiner greeting assumes nothing: what the space is (private,
  invite-only), who runs it (the admin's name when set), and what the
  encryption means — in lock-and-key terms.
- The join card's browser-only caveat gets clear air under the button
  (.card .welcome-caveat so it outranks the generic .card p margin).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: photo descriptions (encrypted alt), contextual composer placeholders

- A message sent with a profile photo becomes its description: encrypted
  under the instance key like the display name (users.avatar_alt_blob —
  the server stores an opaque blob), set and cleared with the photo,
  surfaced as the avatar's aria-label. The welcome photo prompt says so;
  a profile-editor photo swap preserves the existing description.
- The composer placeholder follows the conversation: a scripted question
  carries a hint — 'Type your name', 'Type a name for this space',
  'Optional: describe your photo' — that replaces 'Message' when the
  question renders and resets on the next hint-less reply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: Eleven's conversations persist as real history; passkey comes first

- makeSay (apps/eleven.js, shared by setup + welcome): each line Eleven
  says is emitted as an app event — encrypted and stored like any thread
  event — and folds into the chat view as a real bubble, so the
  conversation survives reloads as history instead of vanishing. Chips
  and composer hints ride a client-only row (they need the live script);
  on resume a line already in history re-arms its chips instantly, no
  duplicate bubble, no typing beat. Chips-only rows render no bubble.
- The welcome flow saves ACCESS first: the passkey ceremony leads, so
  the round-trip back lands mid-conversation with name and photo still
  ahead — never straight onto 'all done'.
- 'This is the start of your chat with X' intro rows: Eleven's threads
  and person-to-person DMs (no blank void under a first typing beat).
- Composer hints refined: sending resets the placeholder to 'Message'
  immediately; a photo question's hint is attach-gated — it appears only
  once a file is actually staged.
- join.js reloads on hashchange (a second invite link pasted into an
  open join tab used to leave a stale card doing nothing).
- Fix a pre-existing TDZ: route() runs at module top level before
  CUSTOM_APPS_TIMEOUT_MS initialized, so custom apps silently skipped on
  every synchronous boot.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web+server: welcome polish from the first two-device test

- The greeting says who runs the space: roster entries carry role
  (metadata; it already gates the admin API), the client derives the
  admin's name from their DECRYPTED label — never plaintext config —
  and the welcome waits briefly for the instance-key grant so it can
  actually say it. Names stay E2E.
- A successful invite claim broadcasts {type:joined}: the inviter's tab
  swaps the pending-invite card for the live DM and picks up the new
  member without a reload (it used to show copy/cancel-link forever).
- A keyless joiner polls for the instance key for ~1min, not 15s — the
  cause of the other side rendering as 'Someone' until reload.
- The passkey ask is ONE bubble (context + question + chips attached),
  so the opening run is two messages, not three.
- Chips flip to their spent state the instant they're tapped, not at
  the next feed render; a chips-only row hugs the bubble it belongs to;
  action lines get vertical breathing room.
- makeSay retries emits until the fold confirms them — the first line
  raced the socket opening and silently vanished — and falls back to a
  client-only notice if persistence is truly unavailable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: Enter saves the Edit-profile name

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* server+web: fix the instance-key grant for fresh joiners; passkey-return ack

THE 'Someone' BUG: a keyless joiner's nudge asked holders to wrap the
instance key, but holders granted via their own connections() roster —
which doesn't include a joiner they share no thread with, so the very
person asking was silently skipped (always for bare invites; racy for DM
invites). Without the key the joiner can't decrypt anyone's name OR
publish their own — both sides render 'Someone' forever. The nudge now
carries the requester's user id + public key and holders wrap straight
to it. Verified live: granted in ~1.5s, unwraps clean (was: never).

Also:
- Back from the passkey ceremony, Eleven acknowledges properly ('Great —
  welcome back. 🔒 Now that your access is secure, let's continue.') as
  its own bubble, then asks the name — no generic pick-up line on top.
- Name question copy: 'First things first — what should folks here call
  you?'
- The chips row tucks tight under its bubble (was still floating too
  low).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the welcome shows your profile photo back before keeping it

Same shape as the admin setup's preview: the adopted photo renders in
the reply (decrypted object URL — an encrypted blob can't ride a
persisted event, so the preview is a client-only notice) with Keep /
Use-a-different chips; the step records and advances only on an
explicit keep.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: Eleven wears the app icon; keyless tabs keep retrying for the key

- Apps can ship an avatar image (in-code URL only): Eleven's setup and
  welcome threads show the app icon in the thread list and header
  instead of the clock glyph.
- A keyless tab re-nudges for the instance key on window focus and on a
  slow timer until it lands — a member whose first poll expired used to
  stay 'Someone' (and see everyone as 'Someone') until a full reload.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: greeting credits the inviter (label reads moved after the key wait); round photo preview

The greeting said 'run by Paul' but not 'Paul invited you': the inviter
name was computed from the DM BEFORE the instance-key wait/decrypt that
was added for the admin name, so it read a still-encrypted label. All
label-derived reads now happen after the wait. Verified with a live
two-party repro (node inviter answering nudges + browser joiner):
'Paul invited you to Test Space — … run by Paul', sidebar shows Paul.

Also: the profile-photo preview renders as the circle it will actually
be.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: renaming in Edit profile publishes the label immediately

The save only wrote session.name locally; the encrypted label_blob was
only ever published as a boot side-effect, so after a rename every
other member kept seeing 'Someone' until the renamer's next reload.
This is THE remaining 'Someone' on real devices: the skip-setup admin
renames via Edit profile and invites without ever reloading. Verified
against the live canary: rename left users.label_blob empty; with the
fix it publishes on Save.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the joined event actually clears the pending-invite card

openThread(activeId) hits the already-open guard and returns before
updatePendingBanner — so the inviter kept staring at 'hasn't joined
yet' + copy/cancel until they navigated away. Refresh the banner
directly. Reproduced live on the canary: joiner fully in (claimed,
keyed, labelled) while the card sat stale.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: staged-attachment strip takes real layout space; chips hug their bubble

- The staging preview floated ABSOLUTELY over the feed's bottom — with a
  photo staged it sat exactly on top of the welcome's 'Skip for now'
  chip, turning it into dead text (reproduced pixel-for-pixel on the
  canary). Per the repo rule that nothing overlays content someone may
  tap, the strip is in-flow now: the feed shrinks above it.
- The chips-row tightening never applied: the rules sat ABOVE the
  .local-notice/.chip-row base rules with equal specificity, so source
  order killed them (verified via computed styles: 6px/8px, not -4/0).
  Re-placed after the base rules with a doubled class; the chips row
  now tucks under its bubble.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: keep the feed pinned when the staging strip grows

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: stable say keys (no duplicate questions on resume); Say-hi survives reloads

- Ack-carrying questions dedupe on a stable key, so a mid-step reload
  doesn't re-emit the same question with a different ack prefix.
- The finish's 'Say hi to <inviter>' chip survives a mid-welcome reload:
  fall back to the joiner's sole person-DM when the one-load join marker
  is already consumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: a 6px breath between a bubble and its chips (not glued, not floating)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: Eleven's messages glide in — no more scroll jumps between beats

The slide-up animation was already there (.msg.appear), but two INSTANT
scrollTop snaps sandwiched every smooth glide: the typing-indicator hook
pinned with a hard jump on each beat, and the chips-only notice row
force-snapped (pinNext) right after its bubble's glide. Typing beats now
scroll smoothly (reduced-motion honoured) and chips rows ride their
bubble's glide.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the typing beat never flashes — 1s minimum, still scaling with length

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: scene-setting loading lines under the boot spinner

A fresh member's first load genuinely takes a few seconds — fill it with
shuffled lock-and-key one-liners ('Cutting your keys…', 'Sweeping for
eavesdroppers… all clear.') that ease in and out. The reveal waits until
the current line has been readable (≥1.1s); fast boots reveal before the
first line fires and keep the plain spinner.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: fix the boot-breaking TDZ in the loading lines; typing row holds until the bubble lands

- LOADING_LINES/loadingMsg state were declared BELOW route()'s
  synchronous module-level boot() call — startLoadingMessages threw,
  boot aborted, and hideLoading threw too, leaving the spinner forever.
  The 6f085d5 canary was broken for every boot because of this. All
  boot-touched state now lives above the route() call, next to
  CUSTOM_APPS_TIMEOUT_MS, which learned the same lesson.
- The typing indicator stays up until Eleven's bubble has actually
  folded into the feed — dropping it at emit time collapsed the list
  and then re-grew it when the message arrived a beat later.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the boot loader is a clock dial that fills 1→10, then clicks to 11

A conic-gradient dial with faint hour ticks: the pie sweeps from 1
o'clock asymptotically towards 10 while the app loads (fast at first,
easing off, never arriving), and the moment everything's ready it snaps
decisively to 11 with a little scale pulse, holds a beat, and the app
fades in. The scene-setting one-liners are gone — the dial going to
eleven IS the scene.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the boot loader is an amp knob that goes to eleven

Modelled on an amplifier volume pot: labels 1–11 around a 300° sweep (1
at 7 o'clock, 11 at 5), a pointer notch on the knob, and a pie arc
filling behind it. While loading it eases from 1 towards 10 and starts
to SHAKE as the volume climbs. The finish is choreographed to feel like
a human turning it, never instant: even a fast load gets a minimum turn
to 10, a beat of pause, a decisive snap to eleven, then a glow (the 11
lights up) while the tremble dies down — and only then does the chat
fade in. Reduced motion: no shake, no glow pulse.

(An earlier uncommitted version of this spliced OUT route()/boot() by
anchoring the replacement past them — the app defined everything and
called nothing. Caught by driving a real boot; splice anchors now sit
tight around the engine block.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: hitting eleven POPS the knob off the amp face (glow retired)

The glow read as nothing (a box-shadow pulsing on a gradient circle).
Instead: tremble dies, then the whole knob scales up with a lifted
drop-shadow and springs back — a physical pop — while the 11 stays lit
in accent. Reduced motion skips the pop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: one loader story — spinner, 'Plugging in…', then the amp knob

The claim page keeps its radial spinner; when the claim lands it flashes
'Plugging in…' (fades in, holds a second, fades out) before navigating,
and the amp knob fades in on the far side to run its turn-to-eleven
choreography. No more two-loader whiplash on the way into a new space.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: no pop — hit eleven, light the 11, breathe, fast fade

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the knob stays hidden until posed at 1 — no unposed pre-JS flash

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: typing rows stay in view; tour gets beats; Say-hi focuses the composer

- The photo preview's image loads after its notice was pinned, growing
  the feed ~180px — everything after it (the next typing row included)
  hid below the fold, which read as 'the typing indicator is missing
  after I update my photo'. Images re-pin the feed on load.
- Tour replies get the same short typing beat as Eleven's script when
  launched from setup/welcome (one queued wrapper around respond).
- Tapping 'Say hi to <inviter>' focuses the composer in the opened DM.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: after eleven, the knob fades out before the chat appears

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: linger at 10 a beat longer before the snap to eleven

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: intent-aware feed glide (typing row never below the fold); shake goes to eleven

- Follow checks used to read scrollTop mid-glide and conclude we'd
  scrolled away — the typing row then skipped its pin and sat below the
  fold (reported after the name answer and the photo step). A shared
  feedGlideToBottom now chases the growing bottom and counts as
  at-bottom while in flight; user wheel/touch cancels the chase. The
  render, typing row, staging strip, and the conversations' typing hook
  all ride it.
- The snap to 11 no longer calms the knob: the shake RAMPS through the
  snap and goes wild at eleven (2.3× the 10-tremble), rattling right
  through the fade-out bow.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the move from 10 to 11 is a true SNAP — no travel, one frame

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: longer tremble at 10 before the snap

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: photo prompts mention drag-and-drop

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: tutorial's reminder example reads naturally (/remind me to call mum…)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: stage dust — particles on the loader floor that dance to the volume

A canvas strip along the bottom of the boot cover: ~60–110 little balls
(muted ink, a few accent) resting on the floor. The same loudness level
that shakes the knob kicks them — still at 1, hopping by 7, full popcorn
at the cranked eleven, and still airborne through the bow. Gravity,
floor bounce with level-scaled restitution, wrap at the edges. Skipped
entirely under prefers-reduced-motion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: heavier dust — sharp kicks, real gravity, crisp bounces (no floating)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: only scroll intent cancels the feed glide (touchmove, not touchstart)

Tapping an action chip is a touchstart inside the feed — on touch
devices every chip tap killed the in-flight glide, so the next bubble
or typing row landed below the fold (reported after 'I'm X').

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: friendlier try-another-photo prompts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web: the join claim is single-fire — a double tap can't burn its own invite

The welcome card's first tap could feel dead (pre-hydration), inviting a
second tap: the first claim succeeded silently while the duplicate hit
'already used' and THAT error is all the person saw — a working session
painted over as a spent link (reproduced from the canary DB: claim 19s
after mint, session minted, user staring at the error). The Continue
button now disables on first press and onContinue can only run once.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* web+server: fixes from the high-effort branch review (10 confirmed)

Regressions / data loss / security:
- hideLoading only runs the amp-knob choreography when the dial was
  actually shown — bootEmbed/showNoInvite/showA2HS blanked the cover for
  ~2.4s otherwise (a dialStarted guard, not just 'knob markup exists').
- uploadAvatar caps alt text (280 chars) and CHECKS the /api/avatar
  response — a long photo caption over the 4096-char blob cap 400'd and
  the client showed the photo as kept while nothing saved.
- The 'joined' broadcast moved from claim time to setPubkey (first key
  only): the inviter's pending card now clears because the joiner is
  actually keyed when it fires; firing at claim raced the pubkey POST.
- makeSay emits ONCE it confirms the frame sent (transport returns true)
  instead of re-emitting on a slow echo — no more duplicated Eleven
  lines permanently in the transcript.
- The instance-key nudge handler no longer wraps to a public key handed
  to it in a raw WS frame: it reloads the roster and wraps only to the
  server-published key for that claimed member (a forged nudge can't
  harvest names/photos; the inviter shares the DM so grants still flow).

UX correctness:
- The photo step distinguishes 'still waiting on the space key' from a
  bad photo, so a not-yet-keyed joiner isn't sent into a futile retry.
- Re-prompts at the photo step are client-only notices, so a second
  text-only reply isn't swallowed by say-dedupe.
- A failed claim clears lchat_welcome_pending, so a stale marker can't
  hijack a later add-device sign-in into fresh-joiner onboarding.
- feedGlideToBottom bails when the user scrolls up against it (scrollbar
  drag / keyboard), not only on wheel/touchmove.

Verified: full go+node+js test suites, a deterministic two-party harness
(joined-after-pubkey, roster-validated grant, joiner sees the admin's
real name), and a clean browser boot of the merged tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>