Build 90 — the photo stopped blocking waves and messages

• At the edge of range, a person was on the radar but a message would not leave. Our own distance test on 31 October found why: every time two phones reconnected, the profile photo went first — the same photo, fourteen times in thirteen minutes — and the connection died in the middle of it, so the wave and the messages queued behind it never left. Now the small things go first and the photo last, and it is sent once to each person. Found by reading the phone’s own counters.
• Everything in 89 is in 90; 89 was only ever on this website.

Build 89 — Bluetooth that comes back by itself

• Switch Bluetooth off and on, and Ahoy carries on. Until now you stayed invisible until you pressed Exit and AHOY again.
• When two phones could not agree a larger packet size, they could not connect at all: our pieces were one byte too big for the default size. Found by arithmetic while reusing this code elsewhere.
• A connection that keeps failing now hangs up and tries again, instead of retrying for ever; pieces of a message can no longer go out of order; Exit also cancels calls still being placed; blocking cuts every link to that person at once.

Build 88 — Android 11 and older, and Anonymous kept anonymous

• On Android 11 and older, Ahoy never found anybody. Two permissions those versions need for Bluetooth were missing from the app since the start, and the notification still said it was discovering. Found by reading the app's own package, not a report. Fixed; a phone without Bluetooth is no longer offered the app on Google Play.
• «See who» could reveal a wave sent while Anonymous if its sender switched Anonymous off later, still nearby. Now a wave is judged when it arrives; waves received before 88 can no longer be revealed at all.
• A bought Super Wave was spent even when the hourly limit then refused to send it. Not any more.
• Smaller: the permission dialog in Greek on Greek phones; an unreadable photo says so; a brief Android Keystore hiccup is retried before anything on the phone is treated as lost; fewer duplicate messages; invites point at blacktree.app; the Terms no longer call this download a test version.

Build 87 — follow us

• At the foot of the menu, «Follow us» and our Instagram, TikTok and Facebook.

Build 86 — «See who»

• A wave still does not say who sent it, but «See who» on the waves card shows you, for a small price on Google Play (open in this test build). Never anyone who was Anonymous, and never a wave sent from a build before 86.
• The Terms and Privacy Policy are at version 4, so the app asks you to accept them again.

Build 85 — the Greek pass

• All the Greek was read again against the English; 25 lines were corrected or made natural.

Build 84 — a change to what goes over the air

• Phones on 83 or older cannot see phones on 84 or newer, and the other way round. If you see nobody, ask whether the other phone has updated.

Build 83 — on is green

• Anything that is switched on is green: Anonymous, Boost and the megaphone on the radar while they run, a chosen megaphone line, a chosen interest.

Build 82 — green buttons, two tabs in the basket, and «Μπουστ»

• Every main button is green, the colour of AHOY.
• The basket has two tabs: Offers, and One at a time. It now scrolls wherever you touch it; before, it scrolled only over the price buttons.
• The switches: the round icon with the «+» buys more, and only that; the switch turns it on or off. Switching on for the first time asks only whether to switch it on.
• In Greek, Boost is «Μπουστ». The welcome reads «Σε απόσταση αναπνοής», the first button «Ξεκίνα εδώ»; bigger back arrows; and while you type your name the keyboard no longer shares the screen with «Continue».
• In Greek, a wave is a «γουέιβ» and the megaphone a «μεγάφωνο». The wave and Super Wave buttons are a hand, and a waving hand.
• No empty cards: someone who wrote nothing about themselves gets one line from the app, in italics, so their card never looks blank.

Build 81 — a cleaner home screen, and one at a time in the basket

• Home: AHOY in the middle; your profile and the logo top left; the basket and the menu top right; Anonymous and Boost bottom left and bottom right.
• Waves and chats live in the radar. Outside the room your conversations are in the menu, so you can read them without becoming visible.
• The basket sells each item on its own as well as the offers.

Build 80 — two switches on the home screen

• The home screen is AHOY, the basket, and two switches: Anonymous and Boost. Super Wave and the megaphone are on the radar, where they are used.
• Your four hours are yours. Once Anonymous or Boost has started, you can switch it off and on as often as you like until its four hours end, free. Boost used to be unstoppable once started.
• Hearing a megaphone: «See their card» opens the sender’s card, and «Close» simply closes the message, on every version of it.

Build 78 — wave or Super Wave back

• A megaphone heard offers «Wave», «Super Wave» (while you have one) and «Not now».
• The radar tour says «You are in the centre».

Build 77 — the megaphone, redesigned

• The megaphone works like the other round buttons: a tap opens a comic pop-up (send a line, see the offers, not now), then you pick one of six ready-made lines, and it goes to everyone around you for five minutes.
• Hearing one: the line fills the screen with two answers, «Wave» (an ordinary, secret wave) and «Not now». You see the sender’s face and name only if your phone already has them on its radar.
• No more speech bubbles on the radar. While someone’s line is live, their face carries a small red megaphone; tap it to see the line again.
• Settings is shorter: backup, export and erase stay, under «Backup & your data».

Build 76 — the megaphone could not be sent

• Your own face in the middle of the radar, in a ring that breathes green while people can see you.
• The megaphone button shows how many you can send.

What was wrong: a megaphone only went out if someone you had not matched with was in range, so a room of matches counted as nobody. «Start and send» sent in the same instant it started listening, before the radar had seen anyone. And when nothing went out, the app said nothing. All three fixed.

Build 75 — a paid megaphone that never arrived

• A megaphone you hear fills the screen, the way a match does. Two lines a second apart no longer overwrite each other.
• You stay in the room until you press Exit, even if the app is closed or restarts: it opens straight back onto the radar.
• Grey «No Ahoy» dots no longer blink at the edge of the room.

What was wrong — the worst mistake so far: in the Google Play version, builds 71 to 74, a bought megaphone was never added. Google took the payment and the app recorded the purchase as done, so it cannot be recovered on that phone. We found it with our own purchase, which is to be refunded; if you bought megaphones on those builds, write to info@blacktree.app. Fixed, and every product is now bought once and three times in an automatic test that checks it arrives.

Build 74 — «It’s a match!»

• A match is a full-screen moment: your two faces meet, hearts rise, «It’s a match!», then «Say hi» or «Later».
• A new look: headings in Inter, a soft green glow behind AHOY, more of our own drawn icons, and a basket that shows amounts big.
• Anonymous asks before it uses a bought credit, as Boost already did.

What was wrong on the way: the new font was inside the app but headings still showed the old one, and the hearts were drawn in a box of zero size. Our file checks passed both; only looking at the screen found them.

Build 73 — our own icons, and the megaphone keeps its name

• The round buttons are drawn by us — a mask, a flame, a star, a megaphone, a basket — instead of emoji, which look different on every phone.
• The word «papyrus» is gone from the app, the terms and the privacy policy. It is the megaphone everywhere.

Build 72 — Greek phones got English

• Ahoy now speaks the phone’s language.
• Six megaphone lines instead of eight.

What was wrong: the app asked its JavaScript engine for the language instead of asking Android, and the engine always answered English. Every Greek user who had not changed it in Settings got English, notifications included.

Build 71 — Ghost is gone

• Ghost is removed. It and Anonymous answered the same question in two ways, which was easy to confuse. To leave the room there is Exit, free and instant. A phone that was in Ghost when it updated comes out of it.
• The basket moves to the top-left corner.
• The megaphone can be bought in the Google Play version; one a day stays free.
• New terms and privacy policy, accepted once more, because the old ones described Ghost.

Builds 69 and 70 — the shop becomes real

• The Google Play version checks Google’s signature on every purchase; one that does not verify is not credited. The first real purchase went through on a phone on 24 September.
• Field metrics are in every build, under Settings → Diagnostics. They used to be only in the website’s build, so the Google Play testers could not send a single number.
• Invented people speak Greek when the app does (the website build’s «Simulate people»).

Build 68 — the app’s final name

• The app’s internal name is now app.blacktree.ahoy, the name it keeps on Google Play for good. It was gr.ahoy.app.
• If you already have Ahoy (build 67 or older), this one installs beside it, not over it. In this order: in the old app save a backup (Settings → Save a backup), uninstall the old app, install this one, and on its first screen tap “Used Ahoy before?”. Two copies on one phone look like two people to everyone around.

Why now: a Google Play app’s internal name is fixed by its first upload and can never change afterwards. Nothing had been uploaded yet, so this was the last moment it cost one reinstall rather than the whole listing.

Build 67 — people stay on the radar

• People no longer disappear from the radar after a couple of minutes. Two phones lying still next to each other vanished from each other’s radar and did not come back, although each could still hear the other. Fixed: the radar is now told every few seconds that someone is still there.
• Smaller «No Ahoy» dots, so the people stand out.
• Boost has its own label, top left on the profile card. It used to be a 🔥 after the name, which anyone could type into their own name.
• A light vibration when you press a button, which you can turn off in Settings. If touch vibration is off for your whole phone, it stays off in Ahoy too.

What was wrong: the radar only heard «still here» when someone’s distance changed. While a connection was open that did not matter, and until build 65 a fault kept reopening connections all the time — so it never showed. When build 65 fixed that fault, the hidden keep-alive went with it, and people who stood still faded out once their connection went quiet. The two-phone test of build 66 found it the same day.

Build 66 — build 65’s connections, fixed

• The first connection no longer fails. In build 65 the first call to every phone the radar had just heard failed, and went through only when it was tried again a few seconds later. Fixed.
• What build 65 promised now reaches the screen: the «Someone» faces are merged into the person, and a named megaphone line arrives with the name.
• Not yet explained: in the same test one photo arrived whole but could not be opened. It happened while both phones were retrying those failed calls at once, so it may go away with this fix. The next test will say.

What was wrong: build 65 added a new notice from the Bluetooth side to the app — «this address belongs to this person» — without registering it. The app framework refuses an unregistered notice by raising an error, and this one is sent in the middle of connecting, so the connection failed. Our checks found the notice inside the finished app and took that as proof; they could not show it was registered. The two-phone test found it the same day. A test now stops any build in which a notice is not registered, and a notice that cannot be delivered can no longer break a connection.

Build 65 — one face per person, and Ghost and Block that really hide you

• No more random «Someone» faces. Android advertises from one address and connects from another, so the radar could show the same person twice: once with their name, once as an unknown «Someone». The phone now works out that both are the same person and shows them once.
• Steadier connections. Two phones that met kept calling each other again every time a conversation went quiet, resending profile and photo each time (five handshakes in three minutes in the last test). Fixed.
• A named megaphone line arrives with the name instead of anonymously, when the listener already knows the sender.
• Ghost hides you from everyone, including people already connected. A hidden phone no longer connects to anyone and no longer answers calls. The honest cost: in Ghost you see how many people are around and how close, not who, because learning who someone is would tell them who you are. Writing to a match connects you to that person only.
• Block is silent for real: the person you blocked is no longer told you are nearby.

What was wrong before: the review of 17 September found that a phone in Ghost could still reappear on other radars, and that a blocked person could still be told «nearby again», because both only stopped the phone advertising — it kept calling. And the «Someone» faces, the repeated connections and the anonymous megaphone line all had one cause: the app learned who a person was only at the address their connection came from.

Build 64 — terms and privacy that describe the app as it is

• The Privacy Policy and Terms of Use were brought up to date where they had fallen behind the app: purchases through Google Play (what Google handles, what stays on your phone, how credits are used, what happens when you change phone, the right of withdrawal), the update check that only the website version makes, the full list of what a phone broadcasts, what a report contains, and that a block can be undone. The app asks everyone to accept them once more.
• Privacy fix: every phone now broadcasts the same categories. A profile made in the earliest versions could still broadcast «dating» unencrypted, with no way left to switch it off.
• The megaphone: a line added by a future version no longer reaches a notification as a code word.
• The Child Safety Standards now describe the report buttons as they are in the app.

What we got wrong: the Privacy Policy said a phone broadcasts «the modes you have chosen». There has been no screen to choose modes for a long time, and old profiles were still broadcasting them. Found while rewriting that paragraph.

Build 63 — pages that describe the app as it is, and offers ready for Google Play

• blacktree.app is live. The address now shows the BlackTree Software page, and /ahoy (Greek: /ahoy/el) describes Ahoy as it is today: the home screen and its icons, the radar with its grey device dots, the megaphone, what is free forever and what is sold.
• The interactive demo was rebuilt to match the app, in Greek and English: home, radar, cards, waves and chats, the megaphone and the basket.
• For the coming Google Play version: offers can be changed from Google Play Console without a new build — a discount with an end date shows up in the basket, and extra offers can be switched on and off.
• The Super Wave button no longer says «free for now»: one a day is free for good.

What was wrong in 62: it read only Google Play’s old single price for each product, so a discount set in the Console would have been ignored and the full price charged. Found while answering the question «can’t I run offers whenever I want?», before anything was on sale.

Build 62 — a basket of offers

• A basket on the home screen. A 🛒 icon between Ghost and Anonymous opens a comic panel with the offers: a night out, five Super Waves, three Boosts, Ghost three times.
• In this website version everything stays open. Purchases will happen only in the Google Play version, once it exists: single purchases, never a subscription, and what you buy stays on your phone and in your backup. Exit, Block and Report are free, always.
• Fixed: switching Ghost on while Anonymous was on turned Anonymous off on the screen but not on the air, so after Ghost your name could stay hidden while the switch said it was shown.

What we caught on the emulator before shipping: «Ghost, three times» and «Try again» drawn cut short in Greek, and a star split from its count on a small phone with large text. None of it was wrong in the code; all of it was wrong on the screen.

Build 61 — a welcome with a face, and a reviewed app

• A new first run. Four short screens instead of six walls of text: a comic panel where someone calls «Ahoy!» and you answer; two ticks (18+ and the terms); your name written on a «HELLO, my name is» sticker; and, before Android asks anything, exactly what the room learns about you and what each permission is for.
• The whole app was reviewed screen by screen, in Greek and English. Texts that promised something the app does not do were corrected — your photo goes to the Ahoy phones around you, not only to people you have matched; a message says «Sent» until delivery is known.
• Safer by default: restoring a backup and reporting someone now ask first; backup passwords are hidden; notices appear on every screen; interests show in Greek.

What we caught on the emulator before shipping: about twenty things a screen showed wrongly although the code was right — Greek accents cut off at the start of a line, the send arrow invisible in the dark theme, the name field hidden under the keyboard, words broken in half at large text sizes. All fixed and looked at again. No Bluetooth change.

Build 60 — bigger buttons, friendlier dots, bubbles you can close

• The round buttons on the home screen are bigger, and the megaphone sits at the bottom, between Boost and Super Wave.
• Devices without Ahoy look almost like people on the radar: a grey face with a question mark, «No Ahoy» and how close it is — instead of an empty dashed circle. Only devices in the room are drawn now, at most six; a weak signal is usually a neighbour’s TV or phone through the wall.
• Megaphone bubbles can be closed with their ×. A small «📣 2» stays in the corner and brings them back while they are still live.

What we caught on the emulator: once device dots were the size of people, a «very close» device landed on top of the closest people. Dots are now a little smaller and placed where there is most room. No Bluetooth change.

Build 59 — getting ready to move house

• The app now also accepts updates from blacktree.app, the company's own address. Nothing moves yet: updates still come from here. A phone only learns to trust a new address by installing a build that already names it, so this has to go out before the site moves, not after.
• The warning before Ghost or Anonymous ends says how many minutes are really left. It used to say «ten minutes» whatever the clock said, so a phone that had been asleep could say ten beside a countdown showing five.

No Bluetooth change. The two-phone test for 57 and 58 can be run on 59, which contains both.

Build 58 — devices around you, on the radar

• Bluetooth devices without Ahoy now appear on the radar as small grey dotted circles labelled «No Ahoy», at roughly the distance they are — never with a name or photo, and never looking like a person, because a device is often a laptop or a TV and one person can carry several. Tap one to invite someone.
• They sit between people, never on top of them. Nothing about any device is kept; the dots vanish when you close the radar.

What we caught on the emulator: the first version squeezed people onto one side of the radar to make room for devices, and under distant people «Σε εμβέλεια» had been drawing as «Σε» for a long time without anyone noticing. Both fixed and looked at again. Like 57, this build changes Bluetooth and needs a two-phone test.

Build 57 — the megaphone, and devices around you

• The megaphone («ντουντούκα»). Pick one of eight ready-made lines — «Who’s up for a drink?», «Hi everyone!» — and send it to everyone around you for five minutes, with your name or anonymously. It shows on their radar as a comic speech bubble, and as a notification if Ahoy is closed. Once every ten minutes. Never free text: only our own lines go out, as a number, so there is nothing to moderate.
• It reaches everyone nearby with Ahoy, not only people you are connected to: it travels in the Bluetooth signal every Ahoy phone already listens for. Older builds simply ignore it.
• Devices around you. With the radar open and nobody there yet, Ahoy says whether there are Bluetooth devices around without Ahoy — «a few», «several», «lots» — so you know when inviting someone is worth it. Headphones, speakers and trackers that say what they are are not counted. It counts; it never lists or remembers any device. Switch it off in Settings.

What we caught on the emulator: «Start and send» started the radar but did not send the line — the check for «is discovery running» looked at the moment before it started. Fixed and seen working. What only two phones can show: the shout actually crossing between two phones, and whether the device count holds discovery steady. This build changes Bluetooth; please test it on two phones and send the metrics.

Build 56 — unread messages, and a new icon

• Unread messages are marked. A red count on the Chats button and on each conversation, the name and last line in bold, until you open it. A message that arrives while you are elsewhere in the app now says so: «New message from Marios».
• A new app icon: the green dot of the wordmark, sending out two waves. Ahoy!
• Two Greek labels that were cut off now show in full: «Μηδενισμός ταυτότητας και διαγραφή όλων» in Settings and «Super Χαιρετισμός» on a person’s card.

Checked on the emulator with simulated people: the badge appeared when a reply arrived with the conversation closed, disappeared when it was opened, and the notice appeared on the radar. Nothing in this build touches Bluetooth — build 50’s fix for lost waves is still waiting for its two-phone test, and this build is a good one to run it on.

Build 55 — a stronger breath, and Settings in one shape

• The AHOY button breathes deeper: a glow that swells with it and three rings that reach twice as far. Same calm rhythm, one breath every four seconds. «Remove animations» still stops it.
• Ghost, Anonymous and Boost look the same in Settings: icon and name, one line saying what it does or how long is left, and one button — Start, or Stop while it runs.

A sentence that was no longer true: Settings still said Ghost and Anonymous «are free and always will be». Both have been on the paid list since the pricing decision, and the Terms of Use say so. It now says what really is free forever: Exit, Block and Report. Nothing in this build touches Bluetooth.

Build 54 — a menu, and the terms

• The settings button is now a menu: Settings, About us, FAQ, Contact, Privacy Policy, Terms of Use and Child safety. All of them open inside the app, in Greek and English.
• A Privacy Policy, Terms of Use and Child Safety Standards, written for a public release and published at /privacy, /terms and /child-safety. The app and these pages are made from one file, so they cannot say different things.
• Accepting the terms is now required before first use — Google Play requires it for any app where people send each other messages and photos. If you already use Ahoy, you are asked once. Exit stays available on that screen.
• The home icons moved to the corners, away from AHOY, with no words underneath — only the countdown while something is running. The radar’s icons lost their words too.
• The battery card in Settings is gone. The «keep looking when Ahoy is closed» switch now fixes it by itself: if the phone still stops Ahoy, pressing it explains why and opens the phone’s battery settings.

What we caught on the emulator before it reached you: the title «Όροι Χρήσης» drew as «Όροι» (the build-49 fault once more, now fixed for every screen title); the child-safety entry was cut off in the menu; and switching Ghost on pushed the bottom icons upwards. All three fixed and looked at again. Nothing in this build touches Bluetooth.

Build 53 — round icons, and a pop-up

• AHOY is in the middle of the home screen, with Ghost, Anonymous, Boost and Super Wave around it as round icons. A running mode lights up and counts down to the second; Super Wave shows how many are left today.
• A locked feature explains itself in a small comic-style pop-up — what it does, and a button to get it. Nothing can be bought yet, so that button opens the page that says what Ahoy will sell. The Ghost and Anonymous pop-ups also say that Exit is free, always, and instant.
• The radar shows the same icons, so you can see what you have from inside the room. They show; they do not switch — modes are still switched on from home.

What we caught on the emulator before it reached you: «Όχι τώρα» drew as «Όχι» — the same Greek-label fault as build 49 — and a locked Ghost showed a padlock beside a running clock. Both fixed and looked at again. Nothing in this build touches Bluetooth.

Build 52 — an invite you can scan

• The invite screen is written for the person you show it to. «Someone’s already here.» — a QR code set in the radar’s own rings, «Scan to get Ahoy», and a share button. The long explanation aimed at the phone’s owner is gone; they already know why they opened it.
• The link carries a random code that changes every ten minutes. It is made from nothing about you — not your name, your phone or your identity — and nothing records who invited whom. Nothing reads it yet: it is there so a Google Play version can tell an invited install apart, without the link ever naming the person who invited.
• The link now points at /ahoy, and opens in Greek when your app is in Greek. The site’s front page will become the Blacktree company page; a code scanned then should still land here.
• Checked on the emulator, not assumed: the code on screen was compared square by square with the link in the share sheet (1089 of 1089 matched; a link one letter different mismatched 68), and with the clock moved eleven minutes ahead the code changed, while two minutes without a move left it unchanged.

Nothing in this build touches Bluetooth. Build 50’s fix for lost waves is unchanged and still waiting for its two-phone test.

Build 51 — the room only shows the clock

• Ghost and Anonymous are switched on from the home screen, before the room opens. The radar no longer carries buttons for them. It shows what is on and exactly how long it has left, to the second — «Αόρατος 03:59:47» — and the clock is checked ticking on screen, not assumed.
• No message now tells anyone to tap a button that is not there. When Ghost ends, the notice says to tap Exit to disappear at once — Exit is on every radar screen, free, and makes you invisible immediately, which is a faster answer than any renew button. The ten-minute warnings say to leave and switch the mode on again from home.
• A small Greek fix on the way: those notices used to say «Πάτα Ghost», an English word in a Greek sentence.

Nothing in this build touches Bluetooth. Build 50’s fix for lost waves is unchanged and still waiting for its two-phone test.

Build 50 — not idle, just busy

• Build 49’s field test showed the loop from build 47 was gone — four handshakes instead of seven — and a match on one phone that the other phone never saw. One wave arrived; the other did not. Roughly four pieces in ten were lost, in both directions.
• The cause was the rule that frees connections for other people. In a busy room a connection that has gone quiet for four seconds is closed so the next person can be reached. “Quiet” was measured from the moment data was handed to the connection, not from when it finished leaving. A photograph is handed over in an instant and takes seconds to go out, so the connection was judged idle while still sending — and closing a connection throws away whatever is still waiting. The rest of the photograph went, and the wave queued behind it went with it.
• A connection with something left to send is no longer closed, and neither is one waiting for the other phone to confirm a wave. A connection that is stuck rather than slow is still closed after ninety seconds, so it can never hold a place for ever.

Pieces thrown away on close are now counted. They were invisible before, which is why this took a field test to see. If it happens again, one number will say so.

Build 49 — a word that was not there

• On the first screen a new Greek user sees, a button read «Εχω» instead of «Εχω αντίγραφο». Android measured the label narrower than it then drew it, so the second word wrapped onto a line the button had no height for and vanished. Nothing reported a problem anywhere: the text was right in the source, right inside the installed app, and Android itself reported the full label when asked. Only the pixels were wrong.
• This is a hole in the checking habit, not an exception to it. Checking the built app rather than the source has found nearly every real defect in this project — but it proves a word is present, and present is not the same as drawn. Screens have to be looked at.
• The first attempt at a fix did not work, and a screenshot is the only reason that is known rather than assumed. The second one does. Every button in the app now keeps its label on one line, so a word can never again disappear silently — at worst it is visibly shortened, and a fault you can see is worth far more than one you cannot.

Then every Greek screen was walked through by hand — the welcome, sign-up start to finish, home, the room. The rest are correct, and build 48's two additions were confirmed by eye at the same time: the welcome screen draws and hands over cleanly, and Ghost and Anonymous sit side by side in the room with a live countdown.

Nothing in this build touches Bluetooth. Build 48's fix for waves and matches is unchanged and still needs two phones in one room to confirm.

Build 48 — ask who, never where

• Build 47’s fix was wrong, and the field test said so in one line. Seven handshakes with one person in under two minutes, and not a single wave counter on either phone. Closing the spare connection was right; looking the surviving one up by its Bluetooth address was not. Addresses rotate every quarter of an hour, so the connection that survived was frequently at an address this phone had never seen. The wave queued instead of sending, the queue pushed that person to the front of the dialling list, the redial produced another spare connection, and round it went.
• Two rules came out of it and both are now in the code. Ask who somebody is, never where they are. And never dial a person you already have an open connection with.
• A message that is thrown away now leaves a mark. The “wave sent” counter only moved once a message reached the radio, so a wave refused before that produced no counter at all — indistinguishable from a wave nobody ever sent. That cost a whole round trip to diagnose. A missing number is a reading, not an absence.

A welcome screen on launch. Instead of a bare spinner: the name, the radar’s own breathing rings, and the sentence that is the argument for this app existing — no account, no internet, nobody’s server. Held long enough to be seen rather than flicker past.

Anonymous now sits beside Ghost on the radar. They are the two ways of being in a room without being fully in it, and that decision is made standing in the room — not on the screen before discovery starts.

Build 47 — sent is not the same as arrived

• The photograph works. Two phones, both directions, confirmed in the field — one phone’s bytes received matched the other’s bytes sent exactly. Capping Bluetooth pieces at 180 bytes was the fault, and the eight builds it took to find it were spent debugging a delivery mechanism that was discarding the parcel before it ever left the building.
• The same counters then found the next fault, and it explains the matches exactly. One phone reported a wave sent. The other reported no wave received at all. The sender had queued forty pieces into a Bluetooth link that had already gone — the session still looked healthy, because “the handshake finished” and “we are still connected” were being treated as the same question. One person had a match. The other had nothing, and nothing ever tried again.
• A wave is now finished only when the other phone says so. The protocol has always sent an acknowledgement for waves and messages, and nothing has ever listened to it. A wave stays in the outbox until that confirmation comes back, and is simply sent again the next time the two people are near each other.
• One connection per person, instead of two. Both phones scan and both advertise, so two people who meet each dial the other and end up holding two encrypted sessions. Everything happened twice — the field test shows three profiles and three photographs where one of each was needed — and a wave could be written into the session the other phone was not reading. Both sides now drop the same spare link, decided from the two identities without any extra message.
• Exit removes you from the other person’s radar again. Nothing told the app when a connection had ended, so “connected” was a latch that never flipped back — and the radar reads it as proof somebody is present. It flips back now, and presence returns to what it should always have been: whether the phone can still hear them, which stops within about forty-five seconds of pressing Exit.

Three faults, one habit. Each is a place where the app believed its own report instead of the other phone’s — the same mistake as trusting the advertised packet size in build 46. Worth naming as a pattern rather than fixing a fourth time.

Build 46 — the big packets never left

• The counters in 45 answered the question, and the answer was not the one on the list. Not a single byte of a photograph has ever arrived. Not a corrupted one, not a partial one — none. The handshake (72 bytes) arrives every time. The profile (145 bytes) arrives every time. The photograph (514 bytes) has never arrived once.
• 514 bytes is the theoretical maximum these phones advertise. The receiving phone’s own log shows the pieces it actually accepts average 214 bytes. The app was believing the number the phone advertised instead of the number the phone honours, and the oversized pieces were being dropped silently — no error, no failure, nothing to catch.
• So this build stops trusting that number. Pieces are now capped at 180 bytes, comfortably inside what has been observed to pass, regardless of what the connection claims it can carry. A photograph takes more pieces and slightly longer; it arrives.

Eight theories, and this is the first one measurement pointed at rather than reasoning. The previous seven were each argued from how the code ought to behave. This one came from counting bytes by message type and finding a category with a permanent zero.

The prediction, in advance and in writing: photographs received above zero, bytes received close to bytes sent on the other phone, and zero failed photo decryptions. If the photograph still does not appear, there will be no ninth theory — the approach changes instead, to sending the photograph in acknowledged instalments rather than trusting Bluetooth to deliver them.

Build 45 — one measurement, two answers

• The photograph arrives whole and then refuses to open. Counters in 44 showed three complete photographs reassembled and all three failing to decrypt — three out of three, every time. That is not congestion or bad luck; something is wrong in a way that happens identically each run.
• The only structural difference between a photograph and a profile is that one is cut into pieces and the other is not. Profiles have never once failed.
• So this build measures instead of guessing again. The sender records how large the sealed message was before cutting; the receiver records how large it was after rebuilding. Equal means every byte came back correctly and the fault is in the sequence the messages were sealed in. Different means the rebuilding is losing or duplicating pieces — possibly because of the retry added two builds ago.

Seven wrong theories, and the flow-control fix in 44 was the seventh. It was a real fault and it stays fixed, but it was not this one. Predicting the result out loud beforehand is the only reason that is clear rather than arguable: the prediction was that the byte totals would match, and they did not.

Everything else is downstream of this. Matches are not forming because a failed decryption kills the connection, so the reply never comes back. There is no point fixing that separately while the floor is still broken.

Build 44 — sending with the brakes on

• We were sending faster than Bluetooth could carry, and the phone was quietly throwing the rest away. Counters added two builds earlier measured it exactly: one phone sent 68,802 bytes and the other received 1,940. Those 1,940 were almost exactly the six profiles — every photograph had evaporated in between.
• The app now waits for the other phone to confirm each piece before sending the next. It had been using a mode with no flow control at all, on the written assumption that the system took care of it. The system does not, and the assumption was written as a certainty.
• This is why a profile always arrived and a photograph never did. A profile is one piece and fits in the buffer. A photograph is seventeen, and everything after the first few was discarded before it left the phone.

Seven wrong theories, and the honest lesson is about method rather than Bluetooth. The photograph was too big; the format check rejected it; a privacy rule hid it; nobody was listening; the connection size failed to negotiate; pieces were being dropped on refusal; pieces were being dropped on failure. Every one was investigated and every one was wrong. Three of them were real bugs that were fixed and stayed fixed — they simply were not this.

What ended it was measuring instead of reasoning. The counter that answered the question in one reading was added two builds before the fix, and should have been the first thing built rather than the seventh thing tried. A day of guessing lost to an hour of instrumentation not written.

Build 43 — the order, not the bytes

• The photograph was never being lost. It was arriving scrambled. Counters added in 42 proved it: the whole picture reached the other phone intact, and then failed to unlock. Nothing was missing — the two phones simply disagreed about the order it came in.
• Six different parts of the app could send at the same moment, and none of them took turns. Encryption numbers every message and the receiver refuses anything out of sequence. Two overlapping sends took numbers five and six and arrived as six and five — or their pieces interleaved, and the receiver built one message out of two.
• This is exactly why a profile always worked and a photograph never did. A profile is one piece and cannot interleave with itself. A photograph is seventeen. Sending is now one indivisible act.

Three separate faults, one symptom, and two earlier fixes that were right but insufficient. 41 stopped the phone throwing away a piece it refused to send. 42 stopped it throwing away a piece it failed to send. Both were real and both stayed fixed — but the photograph still did not arrive, because the third fault was not loss at all. Chasing it produced six wrong theories in a row: the picture was too big, the format check rejected it, a privacy rule hid it, nobody was listening, the connection size had failed to negotiate. Every one was checked. Every one was wrong.

What actually ended it was measurement. Guessing had a run of six; the first build that shipped counters instead of a theory answered the question on its first try. That lesson cost a day and is worth more than the fix.

Build 42 — the other half of the same lost byte

• Build 41 fixed half of this, and the half it missed was still throwing photographs away. A Bluetooth send can fail in two ways: the phone can refuse it immediately, or it can accept it and report a failure a moment later. 41 fixed the first. The second still reported the problem and moved on to the next piece — and the piece it gave up on was already gone from the queue.
• Every piece is now held until the phone confirms it arrived, on both sides of the link, in all four places this could go wrong.
• New counters, so the next test cannot be ambiguous. The app now records how many pieces it sent and how many it received, and what size the two phones agreed on. If one sends more than the other receives, the loss is on the air; if they match, the fault is somewhere else. That distinction has been guessed at five times and measured none.

Five wrong theories before this one, and the reason is worth admitting. The photograph was too big; the format check was rejecting it; the privacy rule was hiding it; nobody was listening for it; the connection size had failed to negotiate. Every one was checked and every one was wrong. They were guesses because there was no instrument that could tell them apart — so this build ships the instrument as well as the fix.

A number that looks like bad news and is not. Connecting went from about 1.3 seconds to 15. Nothing got slower: data that used to be silently dropped is now actually sent, so for the first time that figure is the real one.

Build 41 — what two phones in one room found

• Photographs reach the other person. They never had. When Android refused a Bluetooth write — ordinary congestion — the app threw that piece of data away instead of sending it again. The stream carried on with a hole in it, so the receiving phone read a length from the middle of a message and discarded everything. A profile is one piece and always arrived; a photograph is dozens, so it only took one refusal.
• Exit now removes you from other people’s radar. It did not. Nothing in the app asked whether somebody was still there — being on the radar meant “we have matched”, not “they are here”. This was the most serious defect this app has had: leaving is the one thing that has to work.
• Anonymous hides your name immediately, including from people already connected to you. Before, they kept the name they were handed and only forgot it if one of you restarted.

All three were found by the founder, with two phones, in about two minutes — and none of them could be found any other way. An emulator has no Bluetooth, so every one of these paths had been untestable since build 18. The evidence was already in the app: counters showed two profiles sent and two received, two photographs sent and none received, followed by “write refused”, a failed decryption, and an impossible message length. One dropped piece of data wearing three costumes.

One thing is still wrong and we would rather say so. Switching on Anonymous removes your name from someone already connected, but they keep the photograph they were already given — there is no way in the protocol to say “forget that”. It needs a real change rather than a quick patch.

Build 40 — waves work again, and hiding warns you before it stops

• Waving works, all the way through. Somebody you have waved at now leaves the cards instead of coming round again, and swiping moves between people rather than deciding for you — left is the next person, right is the one before. Waving at somebody, matching with them and the conversation opening was watched end to end before this went out.
• The ✕ button is gone. Moving to the next card already meant “not now”, and having both made a room full of people feel like a judgement. Block and report are still in the corner of the card, where a real refusal belongs.
• Photographs appear on other people’s cards.
• Ghost Mode and Anonymous now last four hours and tell you when they end. Exit is unchanged: one press, permanent, free, and it always will be.
• Every one of those clocks now says how much is left, on the home screen, in Settings and on the radar — and the number actually counts down.
• You are warned ten minutes before hiding ends, not only once it already has. It appears once, not every half minute.
• The room screen has a Ghost button. Until now the only way back into hiding was Settings or the home screen — and the message telling you to tap Ghost appeared on a screen that had no Ghost on it.
• Boost shows a small mark on your card so people can see it is why you are first, and it has a row of its own in Settings.
• Ghost and Anonymous can no longer both be on. Being invisible and nameless was the same state with a switch that did nothing.

What we got wrong, and it was one bug wearing two costumes. Waves looked broken and photographs looked broken, and they were reported as two problems for days. Waving: a person you waved at stayed in the deck, so they came round again — and a second wave at the same person is silently converted to a pass, because you cannot wave twice. You swiped, the card left, nothing happened. Photographs: the invented people used for testing on a single phone had no photo field at all, so a peer photograph could never appear no matter how well the real code worked. Neither was a fault in sending anything. Both were only visible by using the app rather than reading it.

Two more we got wrong, and only using the app found them. Nothing on the Settings screen redrew itself on a timer, so every countdown there was worked out once and then frozen — including Boost’s, silently, since the day Boost shipped. A stale number looks exactly like a live one, which is why nobody noticed. And the radar — the screen you are actually looking at while you are hidden — had no countdown at all. Both now run the same half-minute clock as the home screen.

A whole build was thrown away. Build 39 was started and then three lines of text were edited while it was still compiling. The result passed every check we make and was an app matching no version of our own code — which is worse than a build that fails, because it looks trustworthy. It was discarded and rebuilt. It was caught only because the check included something that had to be found, and that was the thing that came back missing.

And one we are choosing with our eyes open. Ghost Mode ending on a timer means somebody who hid becomes visible again on their own. That reverses an earlier decision that Ghost is a safety control and permanent. It is defensible only because Exit — which stops discovery outright — is untouched, free, and cannot be sold; and because the app now says out loud when hiding has ended, rather than letting you find out by being approached. Both missing parts of that promise are now in place, and they were the reason this build exists: the warning before hiding ends, and a one-tap way back into hiding from the screen you are actually looking at. It took five failed attempts to measure the warning properly — every one of them a mistake in how we tested, not in the app — and we would rather record that than pretend it went smoothly.

Build 37 — the app's real name

• The app's internal name is now gr.ahoy.app. It was com.near.poc — “poc” as in proof of concept — through thirty-six builds of a product called Ahoy.
• Nothing else changed. This build exists for that one line.

Why now, and what it costs you. That name becomes permanent the moment an app is first published on Google Play: it is part of the store URL and it can never be changed afterwards, only abandoned for a new listing with no installs and no reviews. So it had to be fixed before the Play account exists, not after. The cost lands on anyone already running build 36: Android treats a renamed app as a different app, so this one cannot upgrade it. Save a backup, uninstall, install, restore — the steps are on the download page. This is the only Ahoy update that will ever do this.

And one we nearly shipped. The tool that checks every release against the compiled package had the old name written into it, in the list of permissions an Ahoy package is allowed to declare. Renaming the app without it would have failed that check — correctly. It was found by searching for every occurrence of the old name before the rename rather than after the build, which is the only order in which that search is worth anything.

Build 36 — the basket has a door

• The small count above the buttons on the home screen now opens the packs. It already showed what you are carrying; now it is also the way in.

What we got wrong. Build 36 exists because build 35 shipped the packs screen with no ordinary way to reach it. Every route to it opened only when a feature was locked — and nothing is locked, because there is no billing. The one button that always worked was inside Settings, in a collapsed section called Development, under a line that reads “Tools for building this. They will not be here when it is finished.” We shipped the basket inside a room we had told people we were going to demolish, and the release notes said it had shipped.

And how it was found. Not by reading the code. Three separate searches through the source pointed at it being unreachable entirely, which was also wrong. It took installing the release build on a device and walking the screens — the same lesson as the photo two builds ago, where the code said one thing and the running app said another.

Build 35 — a promise we were not keeping, and what you are carrying

• Packs: several Super Waves or Boosts at once, cheaper than one at a time. Nothing here can be bought. There is no billing of any kind in the app, so a pack shows what it will cost and has no buy button at all — rather than a button that is there and silently does nothing.
• Prices shown are indicative. The real figure will come from Google Play in your own currency, which is why no number in the app is allowed to be treated as the price.
• A backpack on your profile showing what you actually hold, and a small count above the buttons on the home screen. The numbers are real: today's free Super Wave, and a Boost if one is running. A badge that invents inventory is worse than no badge.
• Bought Super Waves stack on top of the free daily one, and the free one is spent first — it is the one that expires at midnight.

What we got wrong. The Store screen told you “Three a day are free and always will be.” You get one, and have since the day the allowance changed. The same sentence was in the website’s own FAQ, in English and in Greek, and was corrected a build earlier than the app itself — so for one release the site was honest and the app was not. It was found by grepping for the claim after correcting a different document, not by anybody reading the screen.

Build 34 — the profile photo works

• You can set a profile photo. It then travels to the people you meet and appears on their cards, which is what it was always meant to do.

What we got wrong. It had never worked — not on old phones, not on new ones, not for anybody. Before opening the picker the app asked Android for permission to read your photo library. It does not need that permission: the picker hands back the one file you choose. And we deliberately strip that permission from the app to keep the promise that Ahoy cannot read your storage — so Android answered “denied” to a request we had made impossible, and we gave up before the picker ever opened. Reported as “I tried on an older phone and the photo still did not load”; the age of the phone had nothing to do with it. The permission is still not requested and still not in the app.

Build 33 — a photo is checked before it is opened

• A photo arriving from somebody else is now checked to be a photo before your phone tries to open it. Image decoders are among the most attacked parts of a phone, and this one can be reached by anyone you connect to.
• A wording fix the day it started mattering: the counter read “1 Super Waves left today” as soon as the daily allowance became one.

What this is not. It checks the shape of the file, not the picture. Nothing in Ahoy judges what an image contains — there is no moderation, and calling a format check moderation would be worse than admitting that.

Build 32 — a limit on what a stranger can send you

• Until this build, anyone within Bluetooth range could send you waves and messages without any limit at all, and while Ahoy was in the background every one of them raised a notification. Now there is a ceiling on what one phone can deliver to yours, and anything past it is dropped in silence — you are never told, and neither are they.
• The limits that existed before only governed what you send, which is the half that an attacker simply does not run.

What we got wrong. Our own security document claimed these limits were enforced on both ends. They were not, and had never been. It was found by reading the code against the document rather than trusting either. The limit is per phone, so somebody running many fake identities could still flood a room — without a server there is no way to tell a hundred strangers from one person with a hundred installs, and we would rather say that than imply otherwise.

Build 31 — Boost, one Super Wave a day, and what a review found

• Boost. One press puts you first in the room for four hours. When several people are boosted at once they appear in the order they started.
• One Super Wave a day, and when it is gone the button says so and explains itself instead of quietly doing nothing.
• You choose whether Ahoy keeps looking when you close it. It always could; now it asks.
• Privacy fixes from an internal review. Released builds were writing the rotating ID this phone broadcasts, and the Bluetooth addresses of people nearby, into the phone's system log. Both are gone, twice over.

What we got wrong. The Super Wave lock could never have appeared: two separate counters existed and the one the lock consulted was never increased by anything. And our own security document described a library we do not use and a frame limit eight times smaller than the real one. Both are corrected in the open.

Build 30 — the same app, 7 MB smaller

• The download is 40.6 MB instead of 47.3 MB. Nothing was removed from the app itself: the compiler now leaves out library code that nothing in Ahoy ever calls — about seventeen megabytes of it before compression, which is 6.7 MB off what you actually wait for.
• Proved on a phone rather than in a build log — the cryptography self-test passes 59 of 59 on the smaller build, and a password-protected backup written by it still opens.

Build 29 — what we will sell, and what we never will

• A page in the app that says both halves out loud: Ghost, Anonymous, extra Super Waves and Boost will one day be paid — and leaving a room, blocking, reporting, the safety numbers, waving, matching and every message you have already exchanged never will be.
• Nothing can be bought yet, and every feature stays unlocked for everyone while Ahoy is being tested. The locks are built now so that the day a shop exists, nothing about the app has to be rewritten.

What we got wrong. The first version of the lock only covered the switches in Settings — the two on the home screen, which are the ones people actually use, walked straight past it. Found by looking at the home screen, not by reading the code.

Build 28 — a backup you can actually keep

• One encrypted file now holds your identity, your matches and every conversation. You choose the password; without it the file is unreadable — to a thief, and to you.
• It saves to Downloads, so you can put it on Drive, in an email or on a cable. Restoring goes through Android's own file picker, so the app never sees a file you did not choose.

What we got wrong. The old backup was your identity as plain text — anyone who saw it could become you — and restoring it brought back no matches and no messages. We called it a backup anyway.

Build 27 — a deleted chat goes, and matches leave the cards

• Deleting a conversation takes it out of your chats until one of you writes again. The match stays.
• People you have matched with are no longer in the cards. They stay on the radar.

What we got wrong. Delete did delete the messages, but left the conversation in the list, so it looked as if nothing had happened. That was the design, and the design was wrong.

Build 26 — an encrypted database

• The people you know and every message between you now live in an encrypted SQLite database (SQLCipher). A save writes only what changed, and either all of it lands or none of it does.
• The move from the old storage happens once: everything is written, counted back out, and the old copy is removed only if the counts agree. Otherwise the app stays on the old storage and tries again next time.
• The self-test in Settings now also checks the database — including that its file on the phone is not readable and that a different key cannot open it.
• The download is larger, 47.2 MB: the encryption is a native library.

Build 25 — the privacy rule gets a test

• Who may see your name — nobody from an ordinary wave behind Anonymous, a person you match, anyone you Super Wave — now has a test with two simulated phones that checks, step by step, whose name each one has received. To prove the test tests something, the mistake from build 19 was put back on purpose: four of its eight scenarios failed.
• A ceiling of ten on the links other phones can hold open to yours, chosen in the simulated room of two hundred where it costs almost nothing.
• Adding something to a person that is not saved now stops the build, instead of being forgotten the next time the app closes.

Build 24 — what is saved, and how often

• The app saves at most a few times a second, and only what changed. It used to re-encrypt every photo and every message whenever anyone's proximity changed — strangers included.
• Each photo and each conversation is saved on its own. When someone was last near you is kept to the hour, not the minute.

What we got wrong. Five things were forgotten every time the app closed: the safety number and the ✓ from verifying someone in person, a muted conversation, and both sides of a Super Wave. The save wrote a fixed list of fields that nobody had updated as the app grew. It was reproduced on an emulator — mute, close, reopen, no longer muted — before it was fixed.

Build 23 — for people who do not look at the screen the way we do

• Every control tells TalkBack what it is and what state it is in — the settings gear, the counters, Back, the conversation menu, the send button, every conversation, the avatar colours, the interest chips.
• The dark layer behind a sheet or the spotlight no longer reads out as a row of invisible buttons.
• With Android's Remove animations on, the radar's pulses and the breathing button stand still. The radar's slow turn does not, on purpose: it is what shows that the angle someone sits at means nothing.

What we got wrong. Three labels were written in English inside the code, so TalkBack read them in English to people using the app in Greek. And for eleven builds nobody had checked what a screen reader actually hears. It has now been checked by reading the accessibility tree — not yet by someone who uses TalkBack every day, which is the check that counts.

Build 22 — two hundred phones, simulated

• The decisions about whom to connect to and when to let go now live in code with no Android in it, and a test puts two hundred simulated phones through them — failing connections, hung handshakes, half the room dialling in — in about ten seconds.
• A finished conversation gives up its connection slot after 4 seconds instead of 15 when someone is waiting. In simulation that reaches a busy room of two hundred in about five minutes instead of eleven.

What we got wrong. Two ways a person could be abandoned for as long as they stood in the room. After six failed connections in a row nobody tried them again; and a connection that succeeded but then hung was not counted as a failure at all, so it could spend the last try without anyone noticing. The simulation found three of two hundred stranded by the first and one by the second. Both are fixed. None of this has been in a real room yet — it is a model, and the model is published next to the numbers.

Build 21 — a crash you can send

• When Ahoy closes on its own, the build, the time and where the code failed are written down on the phone. The next time you open Settings it offers the report — to share by hand, or to throw away. Nothing is sent anywhere by itself; there is nowhere to send it.
• A matched person's card says matched rather than connected.

Build 20 — anonymous means anonymous until the match

• From behind Anonymous, a wave now sends nothing about you. Your name and photo go to a person at the moment the wave becomes mutual — with your wave if they waved first, straight back if they wave second — or when you Super Wave, which is meant to be seen.
• The day's three Super Waves are kept on the phone, so closing the app no longer hands them back.

What we got wrong. Build 19 made waves secret in the interface and nowhere else. An anonymous person's wave still carried their name, and the card of the person who waved showed a name where everyone else anonymous said Someone Nearby — which gave the secret away. We wrote it down as a known limitation the same day, and this build closes it.

Build 19 — Super Wave, secret waves, and notifications for all of it

• Waves are secret until they are mutual. You are told someone waved, never who; their faces are blurred. Wave at the people you like to find out.
• Super Wave 🌟: the one wave that is seen — named, and first in their cards. It does not skip the match. Three a day, free.
• The profile card has ✕, 👋 and 🌟, and report and block moved to a ! in its corner. Passing on someone keeps them in the cards, which now go round in a circle.
• Conversations have options: verify, mute, delete, block, report.
• Notifications for waves (never who), Super Waves, matches and messages (who wrote, never what), with four switches in Settings. A warmer tone, Dating and Friendship as interests, and an 18+ confirmation before anything else.

What we got wrong. Builds 15, 16 and 17 all told the phone they were build 14. The local build had been failing quietly at one step on a locked folder and carrying on. The update banner compares that number with this website's, which is why it never went away however many times the update was installed. The build script now refuses to finish when the numbers disagree.

Build 18 — photos that never arrived, and a block that did not block

• A home screen with AHOY, Ghost and Anonymous, and a separate radar with an Exit. The phone's Back button walks back through the app instead of closing it, and asks before leaving the radar.
• A radar that looks like one — a lit screen, a turning dial, pulses from the centre — and still no sweep beam, because a beam would draw a direction.
• Block now happens in the radio: a blocked person never completes a connection, never receives your name or photo, and everything of theirs is deleted from your phone.
• The keyboard no longer covers what you type.

What we got wrong. Photos had never reached another phone. The radio engine was created by the first press of start, so every setting sent before that — your photo, Ghost, Anonymous — went to an engine that did not exist yet, and start itself did not pass them either. Ghost was additionally switched off by pressing start, on purpose. Block had only ever hidden people from your own screen.

Build 17 — your photo, everywhere

• Your photo replaces the coloured initial in the corner of the room, in conversations and on the field — and so do other people's.

Build 16 — the first real round of test feedback

• Settings reorganised into groups in the order people reach for them. Ghost and Anonymous became one-tap pictures. "Open to" left the app for the fourth and last time.
• A notice is a moment, not a state: it no longer follows you from screen to screen. The update banner re-checks when you come back to the app and can be put away.
• A notification when people are around you while the app is in your pocket — a count, never who.

What we got wrong. The download returned 404 twice. The second time, committing to the repository triggered a website deployment built from the repository, where the app file is deliberately not kept. The site is now published only by a script that uploads it and then downloads the app back to prove it is there.

Build 15 — the self-test grows teeth

• The on-device cryptography self-test went from thirty checks to fifty-one. The new ones are attacks rather than the happy path: a replayed message must be rejected the second time, a skipped message must break the chain, a session must not be able to decrypt its own ciphertext, truncated and empty ciphertexts must be refused, and a stranger's session must not read a conversation it was not part of.
• The identity too, because it is the one thing a person cannot be given back: the same seed reproduces exactly the same identity, a short seed is refused, and the seed cannot be recovered from the public id. If any of that were false, restoring a backup would silently make you a different person.

What we got wrong. The fragmentation test reported a missing guard for the second time, and for the second time the guard was fine. The first version fed 16 KB against a 32 KB cap; the fix then compared a fragment count against a byte total, so the loop gave up after a single 256-byte fragment. The protocol has been correct throughout. The test has now been wrong twice.

Build 14 — the thing that would have silently ruined the first field test

• Android is allowed to stop a background service when the screen goes off, and several manufacturers do it whatever the documentation says. On an app that lives in a pocket that is the difference between working and not — and it fails silently. Settings now shows a card when this phone is going to do it, with a button to the right screen and the exact wording to look for. It appears only when something is wrong; a settings screen full of green ticks teaches people to stop reading it.
• Phones from Xiaomi, Huawei, Honor, Oppo, Vivo and Samsung get one more line, because they add a second killer that no documented interface can reach and no API can detect. Naming it beats pretending it does not exist.
• One tap now produces a full test report — build, device, Android version, battery state and every metric — because a measurement with no device attached to it is not a measurement.

Build 13 — a dark theme, as a choice

• Daylight stays the default; Dusk is there for dark rooms, where a bright screen is worse than a dark one. Auto follows the phone.
• Two people could land on top of each other in the proximity field and neither name could be read. Each picked their own angle and drifted at random, so eventually two collided. Seats are now shared evenly across the whole dial, ordered by proximity, with a wander bounded by a third of the gap to the neighbour — enough to make it obvious the angle means nothing, not enough for anyone to share a spot.

Build 12 — Daylight, and a crash an emulator found in ten minutes

• The app is no longer black. A product whose whole promise is there are people near you, go and say hello should not look like a radar screen.
• It crashed on start if the Bluetooth permissions had not been granted. A foreground service of this type requires a granted permission, and starting one without it throws — uncaught, that kills the app. Anyone who tapped past the permission screen and then pressed start got "Ahoy keeps stopping" and no explanation. Now the service fails quietly, the engine refuses early, and the room asks for the permissions at the moment it needs them.
• "Open chat" on a matched person's card did not open the chat. It called the back handler.
• The chat was rewritten: grouped turns, day separators, times, delivery status under the bubble, and a strip that says plainly when messages are waiting for you to be near each other — which is the mechanic the whole product turns on and was hidden in a subtitle.
• Half the size: 39 MB instead of 70, by dropping the two architectures that exist only for emulators, which have no Bluetooth radio.

What we got wrong. Two process failures worth more than the build. The tool that reads permissions out of the compiled package was caching one download under a fixed filename, so three builds were "verified" against the first one's bytes. And a build can silently not contain what you wrote: an architecture filter was added, the build succeeded, and the package came back with all four anyway. Both are fixed, and the tool now also proves the compiled JavaScript contains the feature the release claims to add.

Build 11 — reachable buttons

• The chat's text field sat underneath the phone's navigation buttons and could not be tapped at all. Reported from a friend's phone. Everything anchored to the bottom of a screen now measures the system bars instead of guessing.
• Dating, friends, gaming, networking and just-chat left the first-run setup and the profile editor. They are a preference in Settings that shapes who you are shown to — never printed on a card for a stranger to read.

Build 9 — a room, not three people

• In a crowded room the app would have met three people and stopped. Nothing ever closed a connection after the profile exchange, so three concurrency slots were held by the first three people met, forever. Connections now release their slot when the conversation goes quiet, dials in flight are counted against the cap, and whoever has a message waiting is dialled first.
• Safety numbers: both phones derive the same twenty characters from the two keys, and two people read them to each other. A machine in the middle holds two key pairs and cannot make both screens agree.

Earlier

• Greek throughout, including the notifications the system posts while the app is closed.
• Identity backup and restore, reachable before the first run — otherwise a reinstall makes you a stranger to everyone you have met.
• Encrypted storage on the phone, with the key held by Android.

What we got wrong, and published. We claimed a build had no network permission. It had one: deleting a permission from your own manifest does not remove it from the finished app, because the build system merges in the permissions every library declares. We found out by opening the package and reading it, published a correction, and wrote the tool that now checks every release. The rule that replaced the removal is narrower and easier to check: the network is never required to discover, wave, connect or talk.