First minute

• Land. The browser makes a keypair, then redirects to a random name such as brave-otter-42.your.os. The key is the account.
• First boot. Three panes: the welcome note, Add a machine, Your devices.
• Keep it. Pick a name and add a passkey in one step; the page reloads at alice.your.os. Until then the account is one browser's storage, and clearing site data loses it; this is the moment to fix that, not before the first wow.
• Switch user. This browser's account names, never their keys.

#One origin per personKeeps 3

A browser node's key is bytes any script on its origin can read, and storage, service workers and cookies are all per origin. On a shared origin one XSS reaches every account used in that browser. So your.os is on the Public Suffix List, like github.io, apps get origins of their own inside yours, and your own domain is a setting, later.

Renaming is the hard case. A plain reload at the new name lands on empty storage with no key, so the old page opens the new one as a top-level window (an embedded frame would get partitioned storage) and hands over the grant by postMessage, checking origin both ways; the data arrives by sync, as it would to a new device.

#Adding a machineKeeps 1

The install line carries a pairing code (pairing/one-key): the machine makes its own key, joins with the code through the relay, and appears in Your devices with what it may do. Its terminal is the first service the browser calls (terminal/reattach).