# 0011 · Public demo mode

- **Status:** accepted (2026-09-30)

## Context

People should be able to try Tilework without asking for an invite, then self-host it from the repository or the Docker image. A public instance cannot keep production's invite-only rule, but it must not hand out administrator rights or keep growing user-written content forever.

## Decision

- `TILEWORK_DEMO=1` (only meaningful with `TILEWORK_ENV=production`, whose guard rails stay on) lets `/api/join` succeed without an invite. Demo joins are **always** forced to the member role: the store's rule that the first member of an empty office becomes admin does not apply to them. Invites keep working, so the operator bootstraps an administrator with the CLI.
- Anonymous demo sign-ups use their own per-IP limiter (0.2/s, burst 5), separate from `TILEWORK_JOIN_RATE`.
- Every `TILEWORK_DEMO_RESET_HOURS` (default 6) on wall-clock boundaries, the server restores the starter map, deletes the office chat history and every whiteboard in one transaction, then applies the same to the running world (map hot-swap, open boards closed, chat history cleared). Members and sessions are kept; the reset is audited as `demo.reset`.
- `/api/me` returns `demo: {resetHours, nextReset}` so the client can warn visitors on the join screen and in the top bar.

## Consequences

- Performance: none on the hot path; one timer and one transaction per reset period.
- Maintenance: new persisted, user-written content types must be added to `ResetDemoContent`.
- Install: two new optional variables in `deploy/.env` (`DEMO`, `DEMO_RESET_HOURS`).
- Limits: users and memberships accumulate between resets (sessions expire after `SESSION_DAYS`); there is no CAPTCHA, so a determined abuser can still create many accounts slowly; direct and conversation chat are never stored, so a reset does not need to touch them.