Konclave v0.15.0

The app

Fixed

• An amount typed with a comma is accepted. In Portuguese the payment screen refused 0,0005
  and asked for a dot, although the Portuguese number format uses the comma. A comma used as
  the decimal point now reads as one, on the payment screen and in each payroll line, and the field
  keeps what was typed. The preview shows the amount as it will be proposed, and the dollar estimate
  under the amount no longer reads 0,5 as zero. An amount with two separators (1.000,5) is still
  refused rather than guessed, and so is a dot or a comma before exactly three digits when the
  whole part is not zero (1.500 or 1,500, which reads as 1.5 or as 1500), on the payment screen,
  in each payroll line and in a receive request: each refusal says what to type instead. 0.001 and
  0,0005 are read as before. The amount in a receive request follows the
  same rule, so its link and QR code never carry more than 8 decimals.
• Creating a vault no longer asks the coordinator for proposals it cannot have. Every member got
  an error in the browser console during creation, because the list of payments was read before the
  vault was registered. It is read once the vault is registered.

The desktop shell and shared parts

Services deployed when this was cut (2026-10-26): coordinator c08c935, relay f8dc88d0970337a3.
The web app is this release's own commit. The two services are deployed by hand and may be
older than it - recording what they were ANSWERING is the point, not what they should have been.

Security

• The hosted send takes no practice run. The coordinator used to accept a send request that
  asked for a practice run. It no longer does: a request that asks for one, or does not say which it
  wants, is answered 400 before anything is built or asked of a device, and only a request for the
  send itself goes on. The app's send always asks for the send itself, so a member sees no
  difference. This changes the hosted coordinator only. The hosted coordinator has run this since
  2026-10-24.
• The coordinator reads hex in one place, and answers a request it cannot handle with an error.
  Hex that arrives from outside is now read by one function that accepts hex digits and nothing
  else. A request the coordinator cannot handle is answered with an error and logged by file and
  line. Each device's sealed key is filed under one spelling of the device's key. A member sees no
  difference, unless a vault's device list holds a key that is not a key: a send is then refused
  with a message. The hosted coordinator has run this since 2026-10-24.

Fixed

• A send looked at one candidate answer per poll. While a send waits for the devices, the
  coordinator and the operator's command line now look at more than one candidate message in a
  poll. The hosted coordinator has run this since 2026-10-24; the command line has it when next
  built.
• A call to the relay that never answered could leave a send waiting indefinitely. The operator's
  command line and the coordinator now give every call to the relay a time limit: 10 seconds to
  connect and 30 in all. A poll that runs past it counts as a failed poll, which ends the wait, as
  any failed poll already did. The hosted coordinator has run this since 2026-10-24; the command
  line has it when next built.

Commits

Fixed

• 087427a [ui] amounts typed with a comma decimal are read, and ambiguous amounts are refused (#705)
• cf38c5a [seal] read hex in one place and answer an unplanned failure with an error (#712)
• c47d711 [helper] the hosted send takes no practice run (#713)
• fb81b0e [helper] how long a send waits for the devices is the operator's setting (#714)
• 293d29c [orchestrator] look at more than one candidate answer in a poll (#715)

Maintenance

• 4fd504e [engine] record the 0.15.0 coordinator deploy in the lock (#716)
• ed8ac49 [release] v0.15.0

Desktop installers (Windows / macOS / Linux) are attached below.