The Steward referral flow

Yesterday’s post ended with a face. This one is about a leaf — the small Steward marker that sits beside a handle, and the new way to earn it.

Steward has always been meant to have two doors: chip in a few pounds a month, or bring five people into the forest who stay. The paid door isn’t open yet. The other one now is.

One tier, and why it exists

Steward is ForestLynk’s only tier. There is no ads business here, no investors, no algorithm deciding who you hear from — just a small product and a server bill, and Stewards are how the bill gets paid. The leaf beside a Steward’s handle marks someone who keeps the place running.

And it comes with real things. The clearest of them is control over your own audience: a photo on your identity mark instead of the drawn one, with the choice of who gets to see it — show your face only to your Close folk while everyone else sees the tree mark — and a different face for each forest, so the room you were tapped from decides which version of you turns up. Around that sit the quieter comforts: five tree-mark species beyond the standard rings, six pinned roots instead of four, and photos that land full-size, with less compression and more resolution. More control over who sees what is on its way; none of it will ever be about being seen more.

The referral door is also, deliberately, the entire growth strategy. There is no growth team and there will be no contact-book upload — every person in the forest was brought by someone already in it. Making that act the way to earn the supporter tier means growth and funding are the same gesture: five people who come and stay is worth more to the product than the subscription, and it’s treated as the same debt settled.

A code that turns into a person

It starts at sign-up. The claim screen grows one quiet line under the handle field — collapsed by default, so the majority who weren’t invited never think about it. Open it, type the handle of whoever brought you here, and the code resolves into a person: their face, when they rooted, how many forests they tend.

Their handle is their invite code — no separate code to type

There is no invite code to copy, because the handle is the code. And nothing about this field can block the claim — an unknown handle, a typo, your own handle entered out of curiosity: you can always still sign up.

Arrive through a link instead and the order inverts. The person who invited you is the reason you’re here, so they appear above the fold, already resolved.

Arriving by link — the referrer above the fold, dismissible if it wasn't them

The one moment the system spends on ceremony is right after the claim. The newcomer learns they arrived through a person, by name — and then they’re walked into the forest.

The post-claim welcome beat — a breathing mark, the new handle in monospace, and a pill reading '@wren-bell brought you in'. — The one ceremonial beat — who brought you in, credited by name

A sapling, not a scoreboard

On your own profile, progress lives in one row: a small sapling and a sentence. Each person you brought who stayed puts out a tip. Five tips within the six-month window and the crown lights.

A sentence with a shape in front of it — never a bar, never a percentage

The counts are words, not digits, and the shape carries the state — lopsided, balanced, crowned — before any tip is individually readable. We rejected progress bars, rings and leaderboards for the same reason: this is a record of people, and people don’t belong on scoreboards. Visitors see none of it. Who you brought in is not public information.

Tapping the row opens the full picture: the window and its end date, a slot for each of the five, the empty ones dashed and waiting.

The Steward sheet mid-window — headline 'Two more before 4 March', a window strip showing the time remaining, three filled arrival rows and two dashed empty ones, the fifth labelled 'the one that lights the crown'. — Five slots, the window clock, and honesty about what happens if you come up short

The Steward sheet with all five arrivals in — 'The crown's lit — until 4 March', five solid rows, and the invite-code row showing the owner's own handle with a Copy button. — Earned — and the date it will need earning again is right there in the headline

Every surface names the clock, because nothing here is permanent. The leaf is re-earned each window or it rests. Coming up short costs you nothing you made — nothing is deleted, no forest closes — just the marker, until you earn it back.

It ticks both ways

A tip appears when your person arrives and stays, and you hear about it — a quiet notification per arrival, a beam of sunlight in the feed, and the crown moment itself when the fifth lands. If someone you brought goes quiet for a month, their tip rests, and you hear about that too — not as guilt, but as a nudge to say hello. If they come back, the tip returns, and so does the leaf if it had slipped. The count breathes with the people behind it.

What the leaf buys is the same through either door. What it never buys is reach. No boost, no ranking, no priority — bringing five friends makes you a Steward, not a louder voice. A referral engine is exactly how a calm network turns into a growth machine, and that line is the rail that stops it.

Tech notes

A ledger, not a counter. The naive version of this feature is a number on a row that goes up. It fails the first time someone deletes their account, returns after a quiet month, or the server restarts mid-count. So every credit is a row with a history — when the person arrived, which window it counted toward, whether it currently stands — and the number anyone sees is derived from the ledger, never stored as a total. The jobs that move credits are written so that running them twice changes nothing, which is what lets a fresh deployment pick up exactly where the last one stopped.

A lookup that says too much. The field that resolves a handle into a person is, from an attacker’s point of view, a machine for asking “does this account exist” very fast. The response gives away nothing but existence — no identifiers, nothing private — and the rate of asking is capped per caller, with the cap tuned so that a person typing never feels it and a script enumerating handles hits a wall in seconds. The interesting part was the tension between the two: a debounced field typing at human speed produces more requests than you’d guess, and the first budget we picked punished slow typists. Found on a real device, fixed on both sides.

Notifications as state transitions. Each notification here corresponds to exactly one transition in the ledger — a credit landing, the cap being crossed, a credit resting. The transition row itself records that its notification was sent, so a job re-run or a redeploy can never say the same thing twice. The discipline matters in the other direction too: the window quietly ending is deliberately not a notification. Some state changes deserve a push; some deserve one line in the feed you find the next time you look; and deciding which is which is product design, not plumbing.