Tlon Messenger, a Product Case Study

I have led product development at Tlon for five years, through a full rewrite, a team cut in half, a long stretch of instability, and a pivot to agents. We build on a bet that decentralized networks can carry real conversation, with no middlemen and no advertisers.

Tlon's product is a personal server: each user runs their own real-time messaging service on a decentralized network. Our native smartphone clients talk to that server and handle push notifications, app badges, and background sync. Users can let Tlon host the server in a single-tenant environment, or run it themselves and connect with the same apps.

Every one of those servers runs on an operating system rewritten from the ground up, so failures arrive in shapes nobody has seen before. Uptime is not a promise we can make. What we can control is how fast a user’s messages come back once something breaks, so the metric I own above every other is mean time to recovery. People trust a messenger that recovers quickly and leave one that stays broken. The 2022 migration took months to repair. By the 2025 protocol upgrade, a kernel sync fault that broke the upgrade for hosted users was diagnosed and fixed within the hour. The 2026 agent harness brought a new class of failure, and it is why we now build observability before features.

Five years in, the results that matter:

Recovery from a network-wide fault fell from months in 2022 to under an hour during the 2025 protocol upgrade
Push notification reliability reached 99% and monthly bugs fell 75% after the 2025 stability turnaround
Releases moved from daily hotfixes to a biweekly or monthly cadence
Agent cohorts in 2026 roughly doubled 7-day retention, and day-5 retention reached 50%, the best in the product’s history
Shipped a network-wide rewrite in 2022, native iOS and Android clients in 2023 and 2024, and an agent integration accepted upstream into OpenClaw in 2026

Product positioning:

For the people who keep a group running — the family thread, the book club, the small team — who need real conversation and useful AI without handing their messages, their social graph, and their agent’s memory to a platform that mines them, Tlon Messenger is a messenger you own, with a personal AI inside, so that what your group builds with its agents stays yours. Export it, host it yourself, outlive the company.

Unlike Signal, Telegram, or Discord, where your account lives on the company’s servers, and unlike ChatGPT or Alexa — agents you rent — Tlon Messenger provides the whole stack: leave anytime and take your identity, your history, and your agent with you.

The Groups 2.0 rewrite

In early 2022 we rewrote the social product that had drawn a crowd to the decentralized web during the 2020 pandemic. The rewrite replaced both the back-end architecture and the client, and added the table-stakes features Discord and Slack users expect. The architecture change meant the migration would take major groups offline and could break software across the network.

Concept mock of Groups as a desktop environment: a notifications panel, a group with themed channels, chat with sticker packs, and an in-chat payment request — Initial investor pitch. Groups as a desktop environment, with notifications, sticker packs, and payments inside a channel.

We rolled out in three stages: a developer alpha in July 2022, so third-party builders could port their applications; a public beta in November, so early adopters could report back; and an over-the-air update to the entire live network that December. The team worked the release in shifts across time zones, from Australia to Europe to both US coasts.

Desktop Groups client showing the Find Groups screen with pending invites in three privacy states — Polish for the public beta, late 2022: the desktop Find Groups screen, with public, private, and secret invites pending.

Flow diagram of the Groups 2 over-the-air migration, branching on whether a user or their group host has upgraded, with failure states highlighted — November 2022, four weeks before the network-wide release: the migration flow, mapping what each user would see as they and their hosts upgraded in either order. The failure states sit at the far right.

Unfortunately, the rush cost our users data as we ran into a minefield of edge cases. We had a naive picture of what user data actually looked like across the network, and the migration scripts missed anomalies, resulting in dropped inserts, dead subscriptions, and crash loops.

We spent months repairing the damage and longer rebuilding the trust with our users. We learned an expensive lesson: know the shape of your users' data before you migrate it. Those months were the worst recovery time in the product’s history, and from then on it was the number I watched.

A long winter of jank and churn

Commercial product quality on a peer-to-peer back end met its limits fast: joining a group loaded the entire unpaginated backlog, connections dropped constantly, and events failed to propagate through group hosts. Our team shrank from twelve to six.

Our sprints also outran our manual test coverage. Every release added surface area, the new bugs ate the time we would have spent testing, and we shipped the next feature instead. The loop tightened on itself for the better part of two years.

Through 2023 and early 2024 we treated the loop as a speed problem. We launched mobile apps, in-app signup, role-based permissions, rich media embeds, and a Contacts system. We answered complaints, checked roadmap items, and hit OKRs.

Dozens of grey-box phone wireframes covering channels, group creation, invites, and notifications — March 2024: grey-box wireframes for the native mobile app’s core messaging flows.

Autumn 2024: in-app signup from install through first run, annotated for handoff. Scroll sideways to follow it.

Flow map connecting group editing, member management with roles, channel management, invites and privacy, and notification settings, with design annotations — Mid-2024: the group management hub mapped screen by screen, from roles and moderation to channels, invites, and privacy.

The Contacts system in progress, late 2024: flows for adding contacts, overriding nicknames, and the app settings that moved in with them.

The scaling work told the real story. A mid-2023 refactor to separate publisher and subscriber roles was scoped at three weeks; we shelved it again and again to ship the next feature, and it ran for months. The v5 and v6 mobile releases through mid-2024 went more smoothly, but we were still stacking weight on a foundation that could not hold it.

Finally, a modicum of stability

By mid-2025 the recurring bugs read as symptoms. Missing sequence numbers, full-history loads, and ad-hoc push notifications all traced back to the 2022 architecture, where each flaw fed the next. In August 2025 we stopped feature work.

Two rows of phone mockups studying message delivery states: sending, failed to send, confirming, and delivered, shown in the input bar and on tap-and-hold — June 2025, delivery reliability as a design problem: a study of sent, confirmed, and delivered states in the message row, the input bar, and a tap-and-hold detail view.

First we built the end-to-end testing framework we had skipped for three years. Nothing else made releases predictable.

Then we root-caused every issue instead of patching it. That cost us time on each bug and stopped the same bugs from coming back.

The August 2025 protocol upgrade was the first test. We staged it on fresh servers, then on the internal group, then on new signups, and caught seven showstoppers before production. When the first batch of hosted servers failed to upgrade, we traced it within the hour to infrastructure servers that had synced to a pre-release kernel, and fixed it. Where the 2022 migration took months to recover from, this one took sixty minutes.

From September to December 2025, releases v7.1.0 through v8.1.0 shipped stable push notifications, app icon badging, group templates, privacy and safety controls, and group management, none of it destabilizing:

Push notification reliability hit 99%
Monthly bug count dropped by 75%
Releases moved from daily hotfixes to a biweekly or monthly cadence

Desktop client mockups of group creation with templates: quick group, custom group, and prefilled templates like Book Club — Group templates for the desktop client, September 2025, a v7–v8 feature that shipped in a single release. Scroll sideways for the variants.

Blocking, role management, and join requests each shipped in a single release rather than over months. Stuck channels and navigation loops stopped happening.

A written design brief for uploaded file treatments, split into a minimal phase one and a research-informed phase two — What stopping looked like in the design file: briefs before pixels. This one, from December 2025, scopes file uploads to a minimal phase one and demands research before phase two.

Tlon learned that six people can outbuild a larger team, but only by moving decisively and with extreme focus.

This is what the product was by the time agents showed up: a messenger steady enough to carry an ordinary group through an ordinary season.

Yours Truly: The Secret Society, March 2025. The case for the product before agents, made without a feature list: a garden co-op gathers, and the channel is where the photos, the chatter, and the harvest log end up. Sound on.

The pivot to agentic messaging

In January 2026, agents arrived at Tlon the way most real product directions do: sideways. A teammate built a working chatbot over a weekend that listened for mentions in channels and replied on its own; an MCP server I had written for Groups could already read messages and manage contacts in natural language.

Within two weeks our integration was accepted upstream into OpenClaw, an open-source agent harness, as an official channel type alongside Telegram and Matrix. The team was split on whether any of this was a growth vector or a distraction.

The case for it was that agents made our architecture legible. For years we had described the personal server as the "computer underneath" the messenger and struggled to explain why that mattered.

A personal agent explains it instantly: it runs on a server you own, remembers everything you have told it, works with whatever model you choose, and answers to no one but you. Tlon runs a single-tenant server per user as a matter of course, the same infrastructure enterprises now stand up per-agent at great cost.

Diagram comparing three ways to run an agent: hosted by Tlon with guardrails, self-hosted on your own machine with full access, and a rented VPS talking to Telegram where identity and data live on someone else's platform — Summer 2026, from a video guide to self-hosting: three ways to run an agent. Hosted by Tlon with guardrails, self-hosted with full access, or a rented VPS where your identity and data live on someone else’s platform.

We bet on renting rather than building our own agent harness. We integrated OpenClaw and went from prototype to a waitlist beta in under a month: a small capability flag in the client, and a per-user agent sidecar with its own memory, personality, and scheduled jobs, launched publicly in February 2026.

Shipping agents to users made the case for turning them on our own work. I championed using the product itself to build the product. We built and iterated on the agent within the product, using it to manage our own development workflow. We also share coding agent skills across the org rather than letting each person rebuild them, in one repository anyone (or their agents) can contribute to and pull from.

Within the Tlon product itself, we now build and launch the mobile clients in simulators; investigate production incidents across our telemetry stack; review the fixes our own telemetry agents propose; keep work sessions tracked against Linear issues; and edit copy in the brand voice.

We also use agents to composite feature highlights with a video framework out of the app's own UI components, using the same agentic coding the product ships to users.

July 2026: a user asks their agent for new electronic releases every Friday morning within a group chat. The agent confirms the schedule and delivers the list at nine the next Friday.

Onboarding screens introducing Tlonbot, a friendly green agent illustration, alongside iterations of the welcome sequence — March 2026: iterations on the “Meet your Tlonbot” onboarding addendum. The agent gets its own identity, an illustration, and a place in the first-run tour.

The early cohorts were small, but they moved retention in a way no feature in five years had:

Day-5 retention for the first agent cohorts reached 50%, the best we had ever measured
Cohorts with an agent roughly doubled 7-day retention over cohorts without one

The numbers ended the argument. By March we had turned the company around that result: we repositioned the product as a messenger you own with personal AI inside, put unrelated initiatives on ice, and pointed the roadmap at agents.

The bet's costs arrived on schedule. In April 2026 a runtime regression in the harness pushed memory past seven gigabytes per server and knocked a third of the fleet offline on a Saturday, and no alert fired. In May a config change on the harness’s main branch took down every internal server on a Friday night; the servers came back after a one-line config change and a round of manual restarts for the ones stuck in crash loops. Failures were often silent, and the model’s quality read to users as our quality.

We answered with the discipline learned in 2025, building observability before features: a context lens showing every agent run's triggering message, output, and tool calls; production telemetry; and nightly model-graded evaluations. Customers stay on a pinned release while our own servers take upstream changes first, so a break lands on us before it lands on them. Renting got us to market in weeks and validated the thesis. It also showed us which parts of the stack we will eventually need to own.

Annotated proposal for message controls on agent messages, consolidating reactions, thread replies, context lens, and feedback buttons — In-flight work, August 2026: where the context lens and feedback buttons live on an agent’s messages. Present-day layout on the left, proposed consolidation beside it, single- and multi-message cases annotated.

The ship is still mid-turn. The clearest signal so far is that users who talk to both their agent and other people retain far better than users who do either alone: the agent gets someone in the door, and the people they meet keep them there. We are reshaping onboarding and the product's form around that insight, toward a shared workspace where people and their agents work together.

July 2026, markdown-compatible notebooks: the raw source types out, then resolves into headings, an embedded image, a linked list, and a quoted line.

Five years in, our mission is unchanged: durable personal communication tools you meaningfully own.

A group chat where two friends plan a trip to Lisbon and each asks their own agent to help: one bot finds flights and a place to stay, the other splits the cost and logs it — The product today, August 2026: two friends and their agents planning a trip in the same channel. One bot finds the flights; the other splits the stay.