v1.2.31 — cloudflared security pin, pledges that return, keeper pause, front doors, one Market card

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.31
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      # Uncomment only to let linked nodes dial this node:
      # - "4001:4001"
      # - "4002:4002"
    volumes:
      - ./data:/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• Phone: app links name no single community, only beanpool.org and every *.beanpool.org address by @martyinspace in #2319
• Tests: the members speed test allows twice its budget on CI, where the test machine is slower even when quiet by @martyinspace in #2315
• Phone: version 1.2.73 (Android 295, iPhone 237) by @martyinspace in #2317
• Enterprises: the limit is the bigger of the opening line or the pledges, never both; only earned pledges clear a line by @martyinspace in #2324
• Known floor: on by default — a mixed community needs no setup; no limit changes until an admin confirms someone by @martyinspace in #2310
• Publish the guide: members' guide v150 → v151, operator manual v145 → v146 by @martyinspace in #2326
• Phone: the global community opens its guest view first, like the web (tier A) by @martyinspace in #2320
• Tests: the standby refusal suite compares the Commons pool's balance, not its flush stamp by @martyinspace in #2322
• Phone: version 1.2.74 (Android 296, iPhone 238) by @martyinspace in #2323
• Tests: the group-chat timing check runs alone at the end, so a busy test machine can't fail it by @martyinspace in #2328
• Phone: the Ledger's 'sent' message timer stops when you leave the screen by @martyinspace in #2327
• Tools (T0.4): a private copy on your community's server — on in both apps, one phone at a time, off means gone by @martyinspace in #2297
• Phone: the group invite sheet shows who has asked to join, and doesn't let you invite them by mistake by @martyinspace in #2330
• Settings: a member's role panel names the last owner only when there is one, and shows only the actions you can take by @martyinspace in #2331
• Chat: after 15 minutes, your own message says why it can't be edited any more by @martyinspace in #2329
• Tests: the restore-points suite's 'nothing moved' check survives a busy test machine, and names what moved by @martyinspace in #2325
• Website: a 🌐 language button in the top menu, on every page and at phone width by @martyinspace in #2321
• Accessibility: screen readers hear the global guest visit's busy state and the 15-minute edit note by @martyinspace in #2333
• Words: machine drafts in 24 languages for the confirmation dial, the global guest view and enterprise limits, plus 4 guide pages each by @martyinspace in #2332
• Publish the guide: members' guide v151 → v152, es guide v4 → v5, pt guide v4 → v5, hi guide v4 → v5, bn guide v4 → v5, fr guide v4 → v5, ar guide v4 → v5, id guide v4 → v5, ru guide v4 → v5, zh-Hans guide v4 → v5, zh-Hant guide v4 → v5, it guide v4 → v5, de guide v4 → v5, tr guide v4 → v5, sw guide v4 → v5, ml guide v4 → v5, ta guide v4 → v5, uk guide v4 → v5, ur guide v4 → v5, fa guide v4 → v5, vi guide v4 → v5, el guide v4 → v5, fil guide v4 → v5, ja guide v4 → v5, ko guide v4 → v5 by @martyinspace in #2346
• Phone: version 1.2.75 (Android 297, iPhone 239) by @martyinspace in #2347
• Tests: the restore-points suite's 2FA switch-off can't be refused by the admin rate limit by @martyinspace in #2344
• Words: machine drafts in 24 languages for tool copies, the 15-minute edit note and 'Asked to join' by @martyinspace in #2348
• 🗺️ Atlas: [manager tests] add unit tests for node-client automation token, auth failure, and read limits helpers by @martyinspace in #2336
• 🎨 Pixel: [native a11y] add dynamic accessibilityLabel and busy state to unlock old words button by @martyinspace in #2337
• 🎨 Palette: [a11y] add ARIA live region, label, and i18n to FormerAddressBanner by @martyinspace in #2339
• 🔎 Scout: [test coverage] host kinds helper logic by @martyinspace in #2342
• Jules register: the 22 Oct batch's six closures by @martyinspace in #2349
• Phone: Edit on a message you just sent keeps its text instead of emptying a second later by @martyinspace in #2350
• chore(native): bump to v1.2.76 (android 298 / ios 240) by @martyinspace in #2351
• fix(pwa): the web app asks for location only when the member taps a location control by @martyinspace in #2352
• Link a device works when the phone's copy of the account has no name by @martyinspace in #2353
• Market distance picker: opens on the community's place, asks for your location only when you tap the button by @martyinspace in #2354
• chore(native): bump to v1.2.77 (android 299 / ios 241) by @martyinspace in #2355
• Phone: other members' reviews show the month, like the web, not a made-up day by @martyinspace in #2357
• Owners get a daily count when an admin moves a member's account to a new phone by @martyinspace in #2360
• Registrar: the key vault's locked alert is never cleared while the vault is still locked by @martyinspace in #2362
• Phone app: the last English-only words go through translation by @martyinspace in #2358
• Pulse: Instagram posts show as a clear card with one 'Open on Instagram' button by @martyinspace in #2365
• Tool tests wait for the open sync before counting a write's requests by @martyinspace in #2356
• Web app: the last English-only words go through translation by @martyinspace in #2361
• CI: browsers installed once before the parallel checks; restore-points well inside its time limit by @martyinspace in #2371
• Tools T1.1: the Tool shed's core (manifest, document, counts, loans maths) by @martyinspace in #2366
• Enterprises open their own page everywhere, never a member's Trust Profile by @martyinspace in #2367
• CI: a 15-minute timeout on the browser install step by @martyinspace in #2374
• Phone at small sizes: no cut-off titles, a readable edit note, and the welcome screen honours dark mode by @martyinspace in #2369
• Shops S1: the server side of a shop (a front window on an account) by @martyinspace in #2368
• Tunnel connector test waits for the child to record itself instead of sleeping 200 ms by @martyinspace in #2382
• Message someone straight from their profile, and from the Community list by @martyinspace in #2370
• Near-me searches send your position only as precisely as the search needs by @martyinspace in #2363
• Shops S4′: your shop on the phone by @martyinspace in #2372
• Signed requests: the server's nonce store has a ceiling and says 'busy' when full by @martyinspace in #2359
• Words 1023: tonight's new phrases in all 24 languages (phone, web, core, guide pages) by @martyinspace in #2385
• Publish the guide: members' guide v152 → v153, operator manual v146 → v147, es guide v5 → v6, pt guide v5 → v6, hi guide v5 → v6, bn guide v5 → v6, fr guide v5 → v6, ar guide v5 → v6, id guide v5 → v6, ru guide v5 → v6, zh-Hans guide v5 → v6, zh-Hant guide v5 → v6, it guide v5 → v6, de guide v5 → v6, tr guide v5 → v6, sw guide v5 → v6, ml guide v5 → v6, ta guide v5 → v6, uk guide v5 → v6, ur guide v5 → v6, fa guide v5 → v6, vi guide v5 → v6, el guide v5 → v6, fil guide v5 → v6, ja guide v5 → v6, ko guide v5 → v6 by @martyinspace in #2389
• 🗺️ Atlas: [manager tests] add unit tests for forgetStandby and passwordNeeds2faError by @martyinspace in #2379
• 🔎 Scout: [test coverage...

BeanPool for Android 1.2.83 (APK)

The BeanPool phone app for Android, as a direct download, for phones without Google Play (for example GrapheneOS) or where Play is hard to reach.

This is the same app as on Google Play, signed by the same key. It installs over a Play install and the other way round, and keeps your account.

• Most people should use Google Play.
• An APK install does not update itself. Come back here for the next version.
• Keep your 12 words safe. They are the only way back into your account on a new phone.

Version	1.2.83 (305)
File	BeanPool-1.2.83-305.apk
File SHA-256	ef6112f14891ad653e7ad0d06cc0aa061fa5a97907c84b9055cfdd6229c06089
Signing certificate SHA-256	46:AA:D0:CB:A8:9D:1F:E7:EF:F0:60:99:77:CE:06:5D:85:DD:7E:AC:13:57:D4:48:97:EC:70:AF:B2:02:6C:81

Check it: apksigner verify --print-certs BeanPool-1.2.83-305.apk should print the certificate digest above.

v1.2.30

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.30
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      # Uncomment only to let linked nodes dial this node:
      # - "4001:4001"
      # - "4002:4002"
    volumes:
      - ./data:/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• Refuse outside photo URLs at route level (own only) (#2082) by @martyinspace in #2091
• Private preview: a key may ask whether it is a member (S1) by @martyinspace in #2093
• feat(server): photo upload daily budget and free disk floor (P7) by @martyinspace in #2092
• Publish the guide: operator manual v131 → v132 by @martyinspace in #2094
• Global entry W2: the web app reads a preview or closed account as 'not a member', not 'offline' by @martyinspace in #2097
• Install: warn when the phone can't reach the claim address; silent compose; set up with an AI assistant by @martyinspace in #2095
• Publish the guide: operator manual v132 → v133 by @martyinspace in #2103
• Phone: the Market says a private preview's or a closed account's refusal (P3) by @martyinspace in #2096
• Global entry P1: the not-recognised screen knows open doors; a failed Reconnect changes nothing (Damo's case) by @martyinspace in #2098
• Publish the guide: members' guide v138 → v139 by @martyinspace in #2104
• W1: the app first on a phone's browser at global, one account on the phone, Global community in Settings by @martyinspace in #2102
• Publish the guide: members' guide v139 → v140, operator manual v133 → v134 by @martyinspace in #2107
• Global entry follow-ups: the sync sentence stays on screen; Force Resync says a refusal; a bare public IP is https (tier B, address parsing) by @martyinspace in #2106
• Claim screen: an example code box with a hint; Scan the code before the address; Set up a new community server by @martyinspace in #2100
• Publish the guide: members' guide v140 → v141, operator manual v134 → v135 by @martyinspace in #2108
• registrar /admin: tables fit their cards; released names collapsed; Remove from the list by @martyinspace in #2099
• Website: beanpool.org/global, the app-first link to the global community (Web1) by @martyinspace in #2101
• Phone: a bare public IP gets https:// in Settings, People's invite box and a deep link's server= (#2106's three other callers) by @martyinspace in #2109
• Test: the NB5 junk-chain test does no curve math (2.4 s → 0.19 s; it timed out at 30 s on CI) by @martyinspace in #2110
• registrar /admin: Cloudflare Access sign-in verified in the Worker (no secret box), actor by email; Free all and remove (tier A) by @martyinspace in #2111
• Global entry P2: one global row in the sheet, always; the first screen always draws both doors by @martyinspace in #2105
• Publish the guide: members' guide v141 → v142 by @martyinspace in #2120
• 🔎 Scout: [test coverage] break-glass-code by @martyinspace in #2112
• 🗺️ Atlas: [manager tests] add component unit tests for InPageConfirm by @martyinspace in #2113
• 🎨 Palette: [a11y] Add keyboard navigation and ARIA button semantics to HeaderTitle by @martyinspace in #2115
• chore(native): bump to v1.2.66 (android 288 / ios 230) by @martyinspace in #2121
• jules: register the 18 Oct closes (#2114, #2116, #2117, #2118) by @martyinspace in #2123
• 🛡️ Sentinel: [security] enforce participant authorization on private conversations by @martyinspace in #2119
• Global entry P4: the smart link opens the global door; Play's global=1; restore chips (tier A) by @martyinspace in #2122
• Publish the guide: members' guide v142 → v143 by @martyinspace in #2126
• test(server): DM participant-only reads pinned in both read-auth modes (#2119 follow-ups) by @martyinspace in #2124
• ACME S1: the node's own certificates over http-01 (names + shortlived IP), SNI, hourly renewal (tier A) by @martyinspace in #2129
• Registrar tests: no test reaches the network — a fetch trap in the harness (tier B) by @martyinspace in #2133
• fix(native): the Market retries a failed first sync once before "trouble connecting"; a slow key is read again before an unsigned sync by @martyinspace in #2127
• Global entry P5: the door screen takes any open-door community, global by default; the not-recognised screen's Join goes to the community it reached (tier A) by @martyinspace in #2131
• Publish the guide: members' guide v143 → v144, operator manual v135 → v136 by @martyinspace in #2136
• Registrar S1: a pending auto name is 'provisioning', finished whoever listens; the node waits 25 s and asks again by @martyinspace in #2125
• Global limits: listings archived after 90 days, the four caps in one place and published (tier A-lite) by @martyinspace in #2130
• Publish the guide: members' guide v144 → v145, operator manual v136 → v137 by @martyinspace in #2141
• chore(native): bump to v1.2.67 (android 289 / ios 231) by @martyinspace in #2137
• test(native): Damo's reconnect test preloads the probe's modules (load-sensitive flake) by @martyinspace in #2139
• Members' guide G1: every way into the global community with the account you have; what it is for, in the sheet, web app and website (tier B) by @martyinspace in #2128
• Publish the guide: members' guide v145 → v146, operator manual v137 → v138 by @martyinspace in #2145
• HTTPS S2: beanpool claim --ip / --address, the node's own address store, and the ACME pre-write (tier A) by @martyinspace in #2135
• Registrar S3: claim sources, held never refused, probation, private settings (tier A; stacked on #2125) by @martyinspace in #2132
• test(registrar): claim-answers-first measures 'never waits for ntfy' (red on every CI run since S1, Node 22) by @martyinspace in #2144
• chore(native): eas submit knows the iOS app id by @martyinspace in #2147
• CI: "Timeout calling onTaskUpdate" fixed at its cause — backport vitest#8297 to 3.2.7; native back to 2 CI workers (tier B) by @martyinspace in #2134
• test(server): no-mothership suite: a local community's members walk §2.4 with our domains unresolvable (mothership A4, tier A, test only) by @martyinspace in #2143
• No-mothership follow-ups: DISABLE_APP_STORE_CHECK, and a standby has no claim (#2143 items 2 and 4, tier A) by @martyinspace in #2149
• Publish the guide: operator manual v138 → v139 by @martyinspace in #2154
• HTTPS S7: certificate alerts (renewal late, expiring, fallback on any expired address) and the IP-only take-over line (tier A) by @martyinspace in #2146
• Publish the guide: operator manual v139 → v140 by @martyinspace in #2155
• Mothership A2 (server): the listing promise in the directory push, the mirror, the card and the order (tier A) by @martyinspace in #2142
• fix(server): S7's alert and take-over sentences name their language (core words N11 red on main) by @martyinspace in #2156
• HTTPS S3: the phone takes a server's public number over https, and follows its community to a new address after checking it is the same community (tier A) by @martyinspace in #2138
• HTTPS S4: Settings → Public Address "Your own address", GET /tls/status, remove with fresh proof (tier A) by @martyinspace in #2148
• Mothership A8: status.json of our servers in the registrar's KV, served publicly; beanpool.org/status draw...

v1.2.29 — link a device from the camera, the real global previews, photo and notification safety

Before you upgrade

• Phone app first. This release refuses device linking from apps older than 1.2.63. Update the BeanPool app on your
  phones (Play internal: 1.2.65) before your node takes this image, or "Link a device" stops working until they do.
• Node-to-node ports are now opt-in. The example compose no longer publishes 4001/4002. Open them only if you link your
  node to other communities and want them to dial you.
• Links typed as host:port remember the node that first answers. After the upgrade, each existing host:port link to
  another community records whichever node answers it next, and refuses a different one afterwards. If a linked community
  legitimately moves to a new key, remove the link in Settings and add it again.

What's new for members

• Linking a new phone uses a four-digit confirm and works from the camera's QR code.
• On the global community: the Ledger, Commons (Decide and enterprises), Invites and web My Deals are the real screens, filled
  with Example Valley and clearly marked as examples.
• Events: "Not going" works on cancelled and ended events; event chats stop listing people who left; edits and RSVPs no longer
  fail in the minute after a repeating date ends.
• Photos: no picture is stored with more pixels than phones can safely draw; a chat photo opens only for the people in that chat.
• Notifications: repeating a request or a let-in no longer pushes the other person over and over.

For node owners

• Owner alerts for removals and restores, the fresh-proof check on sensitive Settings actions, and an owner-delete flow.
• A standby trusts its main server only through a pairing code (beanpool pair).
• Federation hardening (stream limits, origin binding), connector URL edits keep a peer's listings, and removing a link
  removes its cached listings.

---

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.29
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      # Uncomment only to let linked nodes dial this node:
      # - "4001:4001"
      # - "4002:4002"
    volumes:
      - ./data:/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• Standby keeps transfers with unusual notes; a half-finished photo move no longer blocks the Market by @martyinspace in #1736
• Directory snapshots are counted at their real memory cost by @martyinspace in #1740
• Group chats, step 1: the locks (shared code only, not switched on) by @martyinspace in #1749
• 🎨 Palette: [a11y] improve post-release review modal accessibility in MarketplacePage by @martyinspace in #1751
• ✨ Flow: [manager UX] add loading indicator for AlertsPanel by @martyinspace in #1752
• 🛡️ Shield: [native security] enforce device-only accessibility options on secure store writes by @martyinspace in #1755
• 🎨 Pixel: [native a11y] add dynamic accessibilityLabel and busy state to welcome flow action buttons by @martyinspace in #1757
• 🔎 Scout: [test coverage] post-sight by @martyinspace in #1756
• 🗺️ Atlas: [manager tests] signOutEverywhere, shutdown, disk health and decision actions in node-client by @martyinspace in #1758
• 👁️ Watchman: [regression] fix test-door-work failure by @martyinspace in #1759
• Group chats, step 1 follow-ups: tighter locks from the review by @martyinspace in #1760
• Enterprise keepers can vote to pay out, with a 7-day Decision by @martyinspace in #1750
• Revert #1759 (door-work timing) and add three Jules register entries by @martyinspace in #1761
• Global on the web: the Market and Map start from your area by @martyinspace in #1763
• The server compresses its answers, so a first sync downloads about a sixth by @martyinspace in #1764
• Group chats, step 2: the server keeps only locked lines by @martyinspace in #1762
• Global: a rough area at signup, and Settings → Your area by @martyinspace in #1766
• Publish the guide: members' guide v118 → v119, operator manual v112 → v113 by @martyinspace in #1771
• Global: new and changed listings reach only the phones nearby by @martyinspace in #1765
• Enterprise keepers see and cast their votes in both apps by @martyinspace in #1767
• Publish the guide: members' guide v119 → v120 by @martyinspace in #1773
• Two small follow-ups: open-deals index, the Map's area note by @martyinspace in #1774
• Group chats, step 2b: keys that hold up over time by @martyinspace in #1772
• Chat groups can vote on their lead, rules and closing (server; the apps follow) by @martyinspace in #1777
• Group chats: a newcomer learns nothing about lines from before they joined by @martyinspace in #1782
• Search finds words in Chinese, Japanese and Thai text by @martyinspace in #1776
• Global on the phone: keep the listings near your area by @martyinspace in #1778
• Owners are alerted when someone gains power on their server by @martyinspace in #1779
• Publish the guide: operator manual v113 → v114 by @martyinspace in #1786
• Idle connections hold less memory by @martyinspace in #1775
• Global on the phone: a listing gone from the node says so; an odd tied list never stops the sync by @martyinspace in #1787
• Guide: the worldwide community shows you what's near your area by @martyinspace in #1789
• Publish the guide: members' guide v120 → v121 by @martyinspace in #1790
• Chat group members see and cast their votes in both apps by @martyinspace in #1784
• Publish the guide: members' guide v121 → v122 by @martyinspace in #1795
• 🎨 Pixel: [native a11y] add dynamic accessibilityLabel and hint to propose vote submit buttons by @martyinspace in #1797
• 🎨 Palette: [a11y] add focus ring to ConsentText summary by @martyinspace in #1799
• 📱 Expo: [compatibility] Export ErrorBoundary in edit-project.tsx by @martyinspace in #1800
• 🛡️ Shield: [native security] configure SecureStore options for app lock preferences by @martyinspace in #1804
• ⚡ Bolt: [perf] O(1) usage lookup in appAddressesReport by @martyinspace in #1803
• 🗺️ Atlas: [manager tests] token fetch guard unit tests by @martyinspace in #1798
• 🔎 Scout: [test coverage] home answer parseLands by @martyinspace in #1796
• Jules register: #1802 was a re-file of #1728 by @martyinspace in #1806
• The nightly audit no longer freezes the server by @martyinspace in #1793
• Group chats on the phone are end-to-end encrypted by @martyinspace in #1788
• Trust floors read ratings by index, and the audit's slicing has tests by @martyinspace in #1813
• Pushes by area look only at the sockets near a listing by @martyinspace in #1809
• A member's new phone can take over their account with the admin's code by @martyinspace in #1783
• Global: the nearby list is sent once, and not at all when it hasn't changed by @martyinspace in #1805
• Search finds words between Chinese punctuation, never errors on odd characters, and hides people you've blocked by @martyinspace in #1808
• Global: a changed nearby list is sent as what changed, not the whole list by @martyinspace in #1810
• ⚡ Bolt: [perf] pre-compute treasury accounts set in marketplace feed handler by @martyinspace in #1825
• 🗺️ Atlas: [manager tests] add unit tests for reportSubject, formatResolverName, and isManagerApi in node-client by @martyinspace in #1824
• Jules register: batch #1817–#1825 by @martyinspace in #1829
• Pushes by area skip people who blocked the author, as the nearby list does b...

v1.2.28 — owner alerts, sealed off-box backups, global by area, Home cards

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.28
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      - "4001:4001"
      - "4002:4002"
    volumes:
      - ./data:/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• test(server): author-off-board suite stops the pricing aggregator that raced its plan check by @martyinspace in #1347
• Key vault V3: image and releases (reproducible boot file, two-signature releases, API handover, custodian tool) by @martyinspace in #1314
• One public-URL resolver for every caller; the open door's counters on the Onboarding screen by @martyinspace in #1345
• chore(tests): test-all gives native and core vitest a 30 s timeout under load by @martyinspace in #1351
• Publish the guide: operator manual v79 → v80 by @martyinspace in #1352
• fix(photos): key the photos of group and direct listings on public-read nodes by @martyinspace in #1348
• Publish the guide: operator manual v80 → v81 by @martyinspace in #1353
• Key vault V4: the phone deposits and restores its sign-in copy with the vault by @martyinspace in #1336
• C12: the open door's key leaves the database for a file, like the recovery seal's key by @martyinspace in #1350
• Publish the guide: members' guide v89 → v90, operator manual v81 → v82 by @martyinspace in #1355
• Small follow-ups: pricing guide counts board listings only, photo-key comments, C12 rollback key limit by @martyinspace in #1356
• Key vault: sign releases, deposit receipts and every answer the phone acts on (gate 4 of V4) by @martyinspace in #1354
• Paged copies P2: the standby builds each whole copy in pages in a staging database and swaps it in at a restart by @martyinspace in #1334
• Publish the guide: operator manual v82 → v83 by @martyinspace in #1358
• test: split test-standby-paged-copies into the copy steps and the swap-at-boot steps by @martyinspace in #1359
• Vault phone gates: finding 3, N1 and N2 (a vault build's restore falls back on a signed "no copy"; "no copy" lasts a week) by @martyinspace in #1357
• fix(pricing): the guide skips listings hidden by reports, paused or cancelled by @martyinspace in #1365
• Paged copies P4: listing photos travel by reference; the accounts' bytes don't block deltas by @martyinspace in #1370
• Publish the guide: operator manual v83 → v84 by @martyinspace in #1373
• test(server): money-limits flake — a new connection per request, and a failed fetch says why by @martyinspace in #1372
• fix(server): re-key, invite and pairing codes stay out of the logs by @martyinspace in #1375
• Money: a late pledge is never stranded; an open deal's price is frozen by @martyinspace in #1374
• Publish the guide: members' guide v90 → v91 by @martyinspace in #1380
• Local communities: the remaining people reads become members-only (privacy F1, F2, F3, F5) by @martyinspace in #1376
• 📱 Expo: [compatibility] Export ErrorBoundary in node-mismatch.tsx by @martyinspace in #1360
• ✨ Flow: [manager UX] add loading indicator for ReplicationAccessPanel by @martyinspace in #1361
• 🎨 Pixel: [native a11y] add dynamic accessibilityLabel to invite people button by @martyinspace in #1362
• 🔨 Forge: [reliability] catch errors in bulk post deletion route by @martyinspace in #1371
• chore(jules): register the 2026-10-01 batch's closes by @martyinspace in #1383
• 🗺️ Atlas: [manager tests] add SuggestChangePanel component tests by @martyinspace in #1366
• P4 follow-ups: a take-over stops every fetch path; one scrypt per password copy; a failed first copy waits and keeps its photos by @martyinspace in #1378
• docs(operators): what a visitor's live-updates socket still hears by @martyinspace in #1382
• Publish the guide: operator manual v84 → v85 by @martyinspace in #1385
• fix(money): a listing edit can't poison balances with NaN; ledger, schema and importer refuse non-finite amounts by @martyinspace in #1379
• Admin auth: the break-glass code only enrols; key sign-in 2FA braked; invite redeem signed by the key it registers by @martyinspace in #1377
• Publish the guide: operator manual v85 → v86 by @martyinspace in #1386
• DoS hardening: WebSocket caps, the signature claim bucket, cached peer reads, a bounded nearest-first pass, server timeouts by @martyinspace in #1384
• Backups: restore, download and replication tokens are owner-only; restore checks what it's given by @martyinspace in #1381
• Publish the guide: operator manual v86 → v87 by @martyinspace in #1387
• Honest wording: who can open the sign-in copies a community and the vault hold by @martyinspace in #1389
• deploy.sh packs only git-tracked files; add .dockerignore by @martyinspace in #1388
• Expo pushes carry our access token when the node has one by @martyinspace in #1390
• Publish the guide: members' guide v91 → v92, operator manual v87 → v88 by @martyinspace in #1395
• Global node: invites off, so the sign-in door is the only way in by @martyinspace in #1391
• Post photos: no key collisions between posts, and members-only photos aren't cached publicly by @martyinspace in #1393
• V5 PR 2: the phone uses the global door's advertised vault keys, with a one-time backstop by @martyinspace in #1396
• Groups: a suspended convenor's powers rest until the suspension ends; no Decision removes or suspends an owner or admin by @martyinspace in #1394
• V5 PR 1: global's door accepts key vault tickets (server) by @martyinspace in #1397
• Delete account blanks the member's group, enterprise, event and DM lines and photos, and empties the WAL by @martyinspace in #1392
• Publish the guide: members' guide v92 → v93, operator manual v88 → v89 by @martyinspace in #1400
• Notifications say nothing private and carry the community's signature (push design steps 1 and 3) by @martyinspace in #1398
• One phone, several communities: own cache file each, no signature downgrade, no membership oracle by @martyinspace in #1399
• Community modes slice 1: the door (who may invite), with Invite / Known presets in Settings by @martyinspace in #1401
• Join the global community from an account you already have (phone; server keeps a joining federation visitor local) by @martyinspace in #1402
• Publish the guide: members' guide v93 → v94, operator manual v89 → v90 by @martyinspace in #1409
• Data at rest: snapshots on the main server only and capped; the log keeps 30 days and loses a deleted member; their picture gone from memory by @martyinspace in #1404
• The phone blanks a deleted member's older direct messages itself by @martyinspace in #1407
• Registrar: ?n= vouches only for a live name, capped fields, 3 names per key, a v2 nonce, no Cloudflare ids in errors by @martyinspace in #1410
• The app checks a notice's signature before acting on it, and posts local notices from its own sync (push design step 4) by @martyinspace in #1406
• test: fix two flaky tests (guide-versions cleanup, wash-trading first-send) by @martyinspace in #1412
• Tier A (replication): a stopped whole copy no longer deletes the next copy's staging; standby suite flakes by @martyinspace in https:...

Key vault 1.0.1

Key vault 1.0.1: replaces 1.0.0, whose image was built with unreadable file modes and cannot run (fixed by #1681); same vault program, same three custodian keys. Boot-tested before signing: hygiene ALL PASS.

Built with --network static:89.126.250.9/24,89.126.250.1 (1984 VPS #1 has no DHCP).
Check: build apps/vault/image/build.sh with the custodian keys in vault-release.json, --version 1.0.1 and that --network, and compare image.json.

Key vault 1.0.0

Do not use. This image cannot run: it was built with unreadable file permissions (keyholder, API and Caddy cannot read their files; no network). Fixed by #1681; use vault-v1.0.1.

---

Key vault 1.0.0: the first release.

Built with --network static:89.126.250.9/24,89.126.250.1 (1984 VPS #1 has no DHCP).
Check: build apps/vault/image/build.sh with the custodian keys in vault-release.json, --version 1.0.0 and that --network, and compare image.json.

v1.2.27 — privacy by default, standby copies that match, money limits

233 commits since v1.2.26. The highlights for people who run a community server:

Privacy by default

• Balances and trades are private, local listings are members-only, and polls are anonymous by default (#1286).
• Community servers keep no one's internet address past 7 days, and their logs never record one (#1289).
• A direct message is never sent readable: there's no plaintext fallback in either app, and the server refuses one (#1288).
• Delete account wipes the words, photos and places of the member's posts, leaves only this community, and removes the key only at the last one (#1302, #1303).
• A hidden group's posts and chat confirm nothing to outsiders (#1333).
• Web visits are counted without cookies, and nobody is identified (#1332).

Money and safety

• There are daily money limits per member, with higher limits for an enterprise or project (#1329). What one key can write in a day is bounded (#1312).
• Federation settlement keys can't name another account's escrow, and caller-chosen ids never name money (#1344).

Standby servers and take-over

• A standby copies its main server's ledger, listings, deals, standing, settings and in-flight money exactly (standby PRs 0–7).
• A refused copy never leaves less than there was (#1304).
• Owners are told when copying stops or goes wrong (#1274).
• Tombstones are kept 30 days (#1315).
• The main server serves copies in pages from one snapshot (#1316).

Your community's address

• A community never forgets a registrar name it held (#1247).
• A lost name comes back with the community's own key (#1273).
• Members still using an old address are told where it lives now (#1275).

Server hardening

• The tunnel runs inside the server, and no server is handed Docker's socket (#1285).
• deploy.sh never loses data and never hands fleet-wide secrets to servers (#1282, #1305).

Phone app (needs the matching app build)

• App Lock covers at most two minutes away, can't be skipped by changing the clock, and asks for the screen PIN too (#1290, #1307, #1309, #1311).
• The 12 words allow no screenshots, the clipboard clears, and the key stays on this device (#1284).
• Market photos come back for phones that synced before the photo keys changed (#1340).
• The social sign-in buttons keep their text and logos inside the border (#1338).
• GitHub is no longer a sign-in option (#1306).

Images: ghcr.io/beanpool-org/beanpool-node:1.2.27, :1.2 and :latest, for amd64 and arm64.

v1.2.26 — photos out of the database, escrow and offboarding fixes

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.26
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      - "4001:4001"
      - "4002:4002"
    volumes:
      - ./data:/app/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• Bump the app to v1.2.49 (android 271 / ios 213) by @martyinspace in #1090
• 🔨 Forge: [reliability] return 404 on non-existent project rejection by @martyinspace in #1084
• ⚡ Bolt: [perf] O(1) member lookups for keeper resolution in EconomySection by @martyinspace in #1082
• ✨ Flow: [manager DX] replace any assertions with typed parties on EscrowDisputeItem by @martyinspace in #1083
• 📱 Expo: [compatibility] Export ErrorBoundary and refine search params in unlock-keys screen by @martyinspace in #1086
• 🗺️ Atlas: [manager tests] IdlePausedBanner component tests by @martyinspace in #1088
• 🔎 Scout: [test coverage] message-tombstone by @martyinspace in #1089
• Event card: "Interested" never breaks mid-word by @martyinspace in #1091
• Market grid: no stretched cards, and the poll stops setting the row height by @martyinspace in #1092
• Jules register: a card Pressable is read from its text, so don't label it (#1087) by @martyinspace in #1093
• Bump the app to v1.2.50 (android 272 / ios 214) by @martyinspace in #1094
• Two flaky server suites: a clock read that straddles a tick, and an SSRF fetch timeout that covered one phase by @martyinspace in #1095
• 🎨 Palette: [a11y] PollCard focus rings and emoji hiding by @martyinspace in #1085
• A member-to-member send can't destroy Beans on a crash: make transfer()'s writes atomic by @martyinspace in #1096
• Two small follow-ups from #1096: a port-race flake, and a broadcast that fired before its transaction committed by @martyinspace in #1098
• An escrow can never pay out more than it holds by @martyinspace in #1099
• Images out of the database: a disk image store for post photos and attachments by @martyinspace in #1097
• Offboarding settles the exact balance, not the rounded one (regression from #1099) by @martyinspace in #1100
• chore(server): bump node version to v1.2.26 by @martyinspace in #1103

Full Changelog: v1.2.25...v1.2.26

v1.2.25 — one chat everywhere, events you can keep, and Settings that stop eating bandwidth

📦 How to Install / Upgrade

BeanPool is distributed as a Docker container. You can pull the latest version directly from the GitHub Container Registry.

Using Docker Compose:

services:
  beanpool:
    image: ghcr.io/beanpool-org/beanpool-node:1.2.25
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
      - "4001:4001"
      - "4002:4002"
    volumes:
      - ./data:/app/data

Using Docker CLI:

docker pull ghcr.io/beanpool-org/beanpool-node:latest

What's Changed

• Bump the app to v1.2.46 (android 268 / ios 210) by @martyinspace in #1008
• Write the value before the marker, or an interrupted move strands the device by @martyinspace in #1030
• Keep the old dark toggle when the seed write fails by @martyinspace in #1031
• 🎨 Pixel: [native a11y] add accessibilityLabel to submit button in TotpCodeDialog by @martyinspace in #1010
• 🎨 Pixel: [native a11y] add accessibility attributes to NewPostTypeSheet backdrop by @martyinspace in #1028
• ✨ Flow: [manager DX] replace any in EscrowDisputesPanel and DecisionsAdminPanel catch blocks by @martyinspace in #1013
• ✨ Flow: [manager DX] replace any in MemberDetailModal and ThreatReviewModal catch blocks by @martyinspace in #1025
• 📱 Expo: [compatibility] export ErrorBoundary and normalize group-post search params by @martyinspace in #1015
• ⚡ Bolt: [perf] remove redundant myMarketPosts computation in MarketplacePage by @martyinspace in #1023
• 🎨 Palette: [a11y] SuggestChangeForm decorative emoji hiding & focus-visible rings by @martyinspace in #1026
• 🛡️ Sentinel: [security] require admin auth for commons decision tick by @martyinspace in #1021
• 🔨 Forge: [reliability] catch unhandled errors in periodic commons balance persistence timer by @martyinspace in #1022
• 🔒 Vault: [manager security] route snapshot download through API proxy by @martyinspace in #1029
• 🛡️ Sentinel: [security] bound OAuth batch ingest item limit by @martyinspace in #1016
• 🔎 Scout: [test coverage] unlock-cancel by @martyinspace in #1012
• 🔎 Scout: [test coverage] admin-actor-name by @martyinspace in #1027
• 🗺️ Atlas: [manager tests] add sidebar-mode unit tests by @martyinspace in #1020
• Jules register: the 22 Sep batch's phantoms and closes by @martyinspace in #1032
• 🎨 Palette: [a11y] PricingGuideModal touch targets, focus rings, and emoji hiding by @martyinspace in #1011
• Jules: put the 22 Sep closes in each persona's do-not-re-file section by @martyinspace in #1042
• 🖥️ PWA: full-page views clear the desktop sidebar, keep the wallpaper, and cap the New Post panel by @martyinspace in #1043
• Node Settings: the Onboarding Funnel, in People & Safety by @martyinspace in #1044
• 🎨 Palette: [a11y] EventCard decorative emoji hiding and focus ring styling by @martyinspace in #1037
• 📱 Expo: [compatibility] export ErrorBoundary and support string array params in public-profile by @martyinspace in #1038
• 🔎 Scout: [test coverage] admin-queue by @martyinspace in #1039
• 🗺️ Atlas: [manager tests] add unit tests for SubTabStrip component by @martyinspace in #1040
• 🔨 Forge: [reliability] prevent unhandled promise rejection in periodic handshake loop by @martyinspace in #1033
• ✨ Flow: [manager UX] add loading state for DecisionsAdminPanel by @martyinspace in #1035
• docs(jules): register the 23 Sep batch's closes (#1034, #1036, #1041) by @martyinspace in #1046
• Bump the app to v1.2.47 (android 269 / ios 211) by @martyinspace in #1045
• Chat parity, server side: group chats get edit, reactions, reply and delete; DMs get delete by @martyinspace in #1048
• Your photo looks the same on every screen, updates when it changes, and is never overwritten by a link to itself by @martyinspace in #1047
• Groups get a lead convenor: other convenors cannot remove or demote the group's creator by @martyinspace in #1051
• Pulse: YouTube plays in the card, after a tap by @martyinspace in #1050
• Lead convenor follow-ups: honest refusal text, no dead end with observers, and a promotion cannot move a NULL lead by @martyinspace in #1052
• An enterprise can host an event: add the treasury event route, and stop "Post as" failing with "Signature validation failed" by @martyinspace in #1054
• Web app chat: paste or drag a picture in to send it as a photo by @martyinspace in #1053
• Chat parity: one chat experience for DMs, group chats and event chats by @martyinspace in #1049
• Event cards show the event's photo, as the offer cards beside them do by @martyinspace in #1055
• Onboarding Funnel: follow the people who joined, count the in-app steps once per person, drop the stale labels by @martyinspace in #1056
• Live Pulse: each item opens what it is about, and reveals more text on hover by @martyinspace in #1057
• Events, server side: "Your events", reminders each person can set, and delivery that never double-sends by @martyinspace in #1058
• Events, both apps: "Your events" in For you, reminder settings, Share, and Add to calendar by @martyinspace in #1060
• Instagram thumbnails recover again, and a failing item backs off instead of retrying every five minutes by @martyinspace in #1059
• Bump the app to v1.2.48 (android 270 / ios 212) by @martyinspace in #1061
• Group and event chats stop polling when nobody is looking by @martyinspace in #1064
• Groups, both apps: the quiet-lead vote gets its screens by @martyinspace in #1062
• Server: the dead POST /api/commons/decisions/tick route goes by @martyinspace in #1067
• Groups, both apps: a stale vote outcome stops printing under a new warning by @martyinspace in #1065
• A peer that fails oddly no longer skips the rest of the handshake round by @martyinspace in #1066
• A suspended sole owner no longer lets an admin make themselves owner (#1006) by @martyinspace in #1068
• Manager tests: Back waits for the popstate instead of 30ms on the clock by @martyinspace in #1071
• Test-All names the tests that failed, not just the last 150 lines by @martyinspace in #1069
• Web app: chat tests stop losing a 1-second race on a loaded CI runner by @martyinspace in #1072
• PWA: Pricing Guide rows read out their description and seasonal hint by @martyinspace in #1070
• Node Settings tests get the same wait budget the web app got in #1072 by @martyinspace in #1074
• Server declares multiformats, so the Docker image builds again by @martyinspace in #1075
• Node Settings stops downloading the whole node every few seconds by @martyinspace in #1063
• CI stops overloading its own runner by @martyinspace in #1073
• A stray rejected promise no longer restarts a node; a true crash still does, and both leave a record by @martyinspace in #1076
• Node Settings: controls you're not allowed to use say why, to keyboard and screen-reader users by @martyinspace in #1077
• The web app's chat paste/drop tests stop racing the conversation-open effect by @martyinspace in #1078
• Offboarding wizard: the Gift radio stops reading its reason twice by @martyinspace in #1080
• Test-All catches an undeclared server import before it breaks the Docker image by @martyinspace in #1079
• Bump to 1.2.25 ahead of the v1.2.25 tag by @martyinspac...