20.07 v0.10.2-dev

20.07 v0.10.2-dev — signed release build (sideload; no Google Play). Android 8.0+.

SHA-256: a0849e44a6de92307cd392f195a5f0e98172fdef65895067d955e00c536ffea6
Signing certificate SHA-256: 7C:F7:10:1A:A7:5F:E8:BB:57:BE:38:E7:72:65:10:A0:6A:07:5B:14:F1:12:6F:F8:6A:C2:2B:2D:3F:8A:76:64
How to check: https://rescue2007.com/verify.html

What's new

• SOS must be held (1.5 s) to send; works with an empty message box. The SOS button sits on the bottom row, left of "Delete group".
• Disguise app icon removed: the app always shows as "20.07".
• Verify your install: the app shows its signing fingerprint at the bottom of the home screen; SHA256SUMS is published with the release.
• Screenshots allowed while the app is open; colour-contrast pass (buttons, light mode, text fields, dialogs).
• Clearer diagnostics log wording.

Tested on phones 2026-10-13 and 2026-10-16: Bluetooth-only, internet-only and bridge phones exchanged messages, SOS alerts, positions and files.

20.07 v0.10.1-dev

20.07 v0.10.1-dev — signed release build (sideload; no Google Play). Android 8.0+.

What's new

• Internet reach (optional, off by default): a phone with any connection sends and receives its group's end-to-end-encrypted messages, SOS, positions and files through public Nostr relays, with Bluetooth on or off. Both mates need it on.
• SOS first, files last (strict priority), Last seen list, files up to 400 KB, stranger carrying (phones outside your group can carry your sealed frames).
• Built for crowds: jittered timing, backoff, slow-down under congestion, bounded queues. Simulated up to 10,000 users.
• New chat layout (compact SOS button), new icon, hardening from an independent three-reviewer breaker round, target SDK 36.

Full list: CHANGELOG. Site: https://rescue2007.com

Install

Download 20.07-v0.10.1-dev-release.apk, open it, allow installs from that source once. Uninstall an older debug build first (different signature).

Honest status

Pre-1.0. Internet reach works on two phones with Bluetooth off and in simulation; the three-phone bridge test and a large-crowd field test are still to do. Don't rely on it as your only safety device.

SHA-256: c14cba36567e5584f687dca8c6a9abd15a600700703f60ffd6d1a6b71dfef6c6

20.07 v0.7.26-dev

Updated docs and READMEs, plus small in-app text updates. No functional changes.

20.07 v0.7.25-dev

20.07 v0.7.25-dev

An offline, phone-to-phone BLE mesh for coordinating a group when the internet can't be trusted or
isn't there — a radar to find your people, an SOS that hops phone to phone, and encrypted evidence
photos that survive losing any one phone. No servers, no accounts, no cellular or Wi-Fi involved.

This is a big catch-up release: the last published release was v0.6.3-dev. Everything below has
shipped since then, tested and committed the whole way, just not published until now.

Highlights since v0.6.3-dev

• Couriers — a phone can now carry content across a physical gap the mesh can't currently reach
  (e.g. across a blocked street), and hand off part of its delivery load when it meets another phone.
• Faster, fairer evidence sharing — photos send a thumbnail first and pull full resolution only
  on request, use fountain coding so any combination of nearby helpful phones speeds up a transfer
  instead of slowing it down, and get an optional faster BLE transport on phones that support it.
• More private by default — each device now has a distinct identity per group instead of one
  reused everywhere (closes a way to correlate someone across groups), message bodies are sealed
  under a key that rotates every 24 hours instead of one static key for the group's whole life, and
  every frame is padded so its size alone can't hint at what kind of message it is.
• A first real step toward talking to bitchat's
  mesh too (opt-in, off by default) — early testing against a real bitchat install got a
  real, partial "yes, it accepts our packet"; the actual two-way bridge isn't built yet.
• A full round of hardening from live, real-hardware testing: a full-codebase review found and
  fixed 20 issues ahead of a device round; that round then found (and this release fixes) a real
  regression from one of those fixes, a message-delivery gap on long-lived connections, a hop-count
  bug that could read farther than the mesh's real size, and a "stuck" hop-count display that could
  freeze on an old value — all confirmed against real multi-phone sessions, not just simulated.

Full version-by-version detail: CHANGELOG.md.
Full feature tour, security model, and architecture notes: README.md.

Known limitations, honestly

This is still a pre-1.0, sideloaded debug build, hardware-tested only at small scale (2-3 phones).
The release build isn't signed. Two things are called out specifically in this release: the new
hop-count-freeze fix above hasn't had its own dedicated hardware round yet, and the bitchat bridge
is a proof-of-concept probe, not a working bridge. See README's Known limitations section for
the complete, unvarnished list — it's kept current on purpose, including everything that's not
fixed yet.

Get it

Download the APK below and sideload it (you'll need to allow installs from this source once). Or
build from source — see the README's Get the app section.

20.07 v0.6.3-dev

Catches this repo's Releases page up after a gap since v0.3.0-dev — v0.4.0 through v0.6.3-dev
landed without individual releases, so this one covers all of it.

v0.4.0: blind position relay through non-members (the fix for a far phone never appearing on
radar) and a hop-tracking frozen-value bug (a group's hop reading could get stuck at "1" forever
even after the real route got worse). Live 2-phone-confirmed.

v0.5.0-dev / v0.6.0-dev — PLAN-v2 scaling work (full plan and reasoning in PLAN-v2.md):
20.07 was a synchronization protocol (connect → catalog-sync → disconnect); this rebuilds its
primary delivery path into a forwarding protocol instead — content floods immediately across
already-open connections, the way most mesh chat apps do it. A JVM discrete-event simulator
(app/src/test/.../sim/) driving the real connection/relay/dedup classes from 3 to 400 simulated
nodes was built first and gated every claim below on reproducing this app's own measured live
numbers before trusting any projection. Peer state (connection cooldowns, route ownership) is now
keyed on a stable identity instead of the rotating BLE address. SOS now floods immediately across
every open connection instead of waiting for the next reconnect. Connections stay open for minutes
instead of seconds, held against real signal-diversity rather than whoever connected first.

v0.6.1-dev through v0.6.3-dev — four live 3-phone hardware rounds, same day (2026-08-05),
each one diagnosed from exported on-device logs and code reading, no direct hardware access needed:

• Round 1 found a message sent between two already-connected phones sitting delayed, and the radar
  going stale for a connection's whole lifetime — both traced to the same root cause (nothing told
  an already-open connection about content created after it opened) and fixed.
• Round 2 confirmed both fixes hold, and found (by auditing the logs, not from a reported symptom)
  a duplicate-connection-callback bug wasting radio/battery on some Android BLE stacks — fixed.
• Round 3, at real distance (balcony/hall/corridor): messages instant, hop tracking correct. Found
  toggling Bluetooth off then back on left the mesh stranded until a manual app-level toggle — fixed.
• Round 4 (quick 2-phone check) confirmed the Bluetooth-recovery fix works.

304 tests (up from 203), detekt clean, both build variants (including R8-minified release) green
throughout. Still pre-1.0: this whole delivery-path rebuild has only had short (tens-of-minutes)
hardware sessions so far, not the sustained multi-hour one it needs before being fully trusted — see
PLAN-v2.md's own "RESUME HERE" note and README.md's Known Limitations for exactly what's
confirmed vs. still open. This is a debug build — no signed release build exists yet.

20.07 v0.3.0-dev

The framing shift behind this release: groups in 20.07 are ad hoc and short-lived (2-3 days
typical, 6 months an absolute ceiling), not standing chat rooms — which changes which problems
are worth solving.

Ephemeral group expiry: a group's lifetime (12h/48h-default/7d/30d/6mo, chosen at creation) is
baked directly into the shareable join code's binary format, not tracked per-phone, so every
member agrees on the exact same expiry moment. Every member's own app dismantles an expired group
on its own — key, messages, evidence, all of it.

Sender identity (Ed25519), additive to the existing group-key HMAC: every member gets a
per-(device, group) keypair, so devices can't be linked across groups. A signature rides alongside
the group HMAC on every frame, telling members apart instead of only confirming group membership.
Trust is pin-on-first-sight, not a certificate authority — full reasoning in docs/DECISIONS.md.

Security fixes: a hostile totalChunks value could force a large allocation on every relaying
device; the SOS auth tag only covered a message's first 255 bytes; a captured presence heartbeat
could be replayed indefinitely; a stale SOS could re-fire the alarm notification; unbounded WiFi
Direct socket reads. All five fixed with regression tests.

Efficiency/structure: catalog-sync filter now sizes itself to the actual catalog with an
MTU-aware fallback; a cross-peer GATT notification race fixed; hop-tracking reflects a genuinely
worsened route instead of freezing at its best-ever reading; WiFi Direct moved to its own package;
verbose inline comments extracted into docs/DECISIONS.md.

Bumps MeshFrameCodec.VERSION 1→2 and the DB schema to v6 (destructive migration, as with every
schema bump so far — existing groups will need to be recreated). 203 tests, up from 112,
detekt-clean; the R8-minified release build also verified to compile clean.

Not yet live-device-verified: the Ed25519 signing/pin-on-first-sight path and ephemeral-expiry
UI need a real 2-phone pass before being trusted the way the rest of the mesh core is — see
NEXT_STEPS.md. Still pre-1.0. This is a debug build (unsigned release build does not exist yet).

20.07 v0.2.1-dev

Small, targeted follow-up to v0.2.0-dev.

Live-confirmed a common trigger for "peer shows a hop count but never gets a radar dot": many
phones deliberately widen their reported GPS accuracy while stationary (to save battery), then
tighten it back up the instant motion is detected — so a dot could disappear while genuinely
standing still, even right next to the other phone, and reappear on the next step.

Raised the radar's combined-accuracy rejection threshold from 150m to 250m — comfortably above
the radar's own 200m display ceiling instead of sitting just under it — so this triggers less
often, while still rejecting genuinely rough (network-location-grade) fixes. The underlying
silent-failure UX gap (no on-screen explanation when this does trigger) is unchanged and still
tracked in README's Known Limitations.

Still pre-1.0. This is a debug build (unsigned release build does not exist yet).