Three doorways into a forest

A forest in ForestLynk can be entered three ways. The shape of the doorway is part of what the place says about itself — whether it’s open to anyone walking past, run by a steward who reads each request, or known only to people given a key.

The act is the same. The contract is different.

The open door

You see the forest in the directory, you tap “Join — one tap”, and you’re in. A small confirmation moment plays — a check drawing itself, a sunlight ripple, the forest greeting you by name. Then you’re on the inside, looking out.

The right shape for a place where the membership question is “are you here yet?” rather than “should you be?”

Preview hero, live peek of recent roots, mutual-folk strip, 'Join — one tap'

A note for the steward

Some forests are run. A steward reads each request and decides who comes in.

The reader sees the same preview but with a different call to action — a secondary button asking for a short note about why they’d plant there. The screen then settles into a pending state, the note quoted back. If the steward welcomes you, a sunlight notification arrives. If they decline, nothing arrives — the silence is deliberate. A steward shouldn’t have to face the reader to say no.

Same preview plus the moderator info box and 'Request to join · with a note'

A four-character key

The third door doesn’t appear in the directory at all. The forest is unlisted, reachable only by typing a code given to you by someone already inside. Four small boxes; as each fills, the next focuses on its own. When the last fills, the forest preview slides up underneath.

Four 56×64 boxes; reveal of the matched forest preview when the last fills

Three contracts

A doorway carries a question. “Anyone in?” “Will you let me in?” “Did someone tell you about this?” The shape of the question is the shape of the room behind it.

Tech notes

The interesting tradeoff in the join machinery is the invite-only doorway’s codespace. Four alphanumeric characters across the standard set works out to about 1.7 million possible codes — small enough to read over a phone call or match from a screenshot, large enough that the casual user experience is “type four things and you’re in” rather than “paste a long blob”. The friction of typing by hand is the whole point; longer codes break the share-it-aloud usage.

What keeps 1.7M codes from being trivially brute-forceable is rate limiting on the redemption endpoint. Attempts are capped per (user, IP) at a rate where burning through the keyspace takes long enough for the codes being guessed to age out before any hit a live one. Valid codes are consumed atomically on first use, so the same code can’t be redeemed twice while a slow brute-force is in flight.

The moderated flow’s submission endpoint has its own cap for the same reason from the opposite direction — 30 requests per user per hour, generous for a person (people rarely request more than a handful of forests in a session) and deliberately small for a bot trying to spam-request the entire directory.