0.1.3 — four digits, and the key writes itself

   ·  ✦   ·        ╭──────────────╮       ·   ✦
 ✦    ·      ·     │  0 . 1 . 3   │  ·        ·
   ·    ✦          ╰──────────────╯     ✦   ·

Nobody should have to invent a passphrase under the pressure of a setup screen — and everybody who does invents a bad one.

⌨ A first run is now a name and four digits. The key is drawn for you: six words from a frozen list, 66 bits, never shown and never typed. The digits wrap it; the passphrase underneath is stronger than anything a person would have thought up while waiting to get in. The code is asked for twice, because a mistyped one loses no data but loses the easy way in — and you would find that out at the worst possible moment.

◈ Carry your own key if you prefer. The long way in is one click away, on the same screen it always was, and it now confirms what you typed before it makes anything.

👤 On the phone, your face can open it. Offered once, after you set a code, never again. The key is minted so the hardware itself refuses to decrypt until the sensor has just seen you — not a check the app makes and could forget to. StrongBox where the handset has one. Adding a new fingerprint to the phone destroys the seal, so nobody inherits it.

Turning it on forgets the remembered passphrase, and that is the whole feature: an app that was already open before the sensor was asked would be a gate with a hole beside it.

⌁ The keypad has a feel now. A tick under each digit, a different one for a correction, a longer one for a refusal — through the system’s own touch feedback, so a phone told to stay quiet stays quiet.

✧ Reactions: one gesture on every device. A tap opens the palette everywhere. Under a thumb the choice is two beats — the first tap on a meaning plays it and picks it, the second sends — because a tap used to win the race against the long-press timer and stamp the first slot before anyone saw a choice. On a desktop, hover still previews.

⚑ A phone paired on 0.1.2 could see nobody. Its own words synced and every room was empty: no history, no member cards, no media. One cause — a computer that migrated remembers the friends it knew before devices were certified, and a phone paired afterwards was born without that memory, so those friends’ messages sat in its hold forever waiting for proof that will never exist. That knowledge belongs to the person, not to one machine, and it now travels with you when you pair. Pair again after updating and the rooms fill in.

⬇ The interface lives in the binary — needs the new build, not a reload. macOS · Linux · Android.

⚠ Still true: four digits are hardware on the phone and a shortcut on the desktop — a copied data folder is about an hour of guessing there, and the passphrase remains the real secret · no media over LoRa · a relay sees sizes and timing · public spaces are signed plaintext · no Windows build · a lost keystore is a lost space.

🐛 Broken, or claiming more than it can prove? → Field notes.