From bde3d2484f0056535049f71e6069d8f8a65f17fa Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Thu, 29 Oct 2026 16:32:56 +0700
Subject: [PATCH] release: 1.7.30

---
 package-lock.json |  4 ++--
 package.json      |  2 +-
 release-notes.txt | 15 +++++++++++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7c75a81..db0ffb8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.7.29",
+  "version": "1.7.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.7.29",
+      "version": "1.7.30",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index 1042f7d..00192ea 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.7.29",
+  "version": "1.7.30",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/release-notes.txt b/release-notes.txt
index e9add27..ae10917 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,18 @@
+🔒 Community join hardening
+- /cordn now opens the in-app Community room too; the raw Cordn link is
+  copy-only from Advanced, so no browser short link lands in the stalled Cordn
+  web client.
+- Approving a device now asks for confirmation before adding it to the
+  encrypted room.
+- Corrected the second-device hint: use Link device for a direct handoff, or
+  ask to join again with the new device.
+- The community bot enforces an hourly approval brake (30/hour) on top of the
+  250-member and 5-devices-per-account caps.
+- Daily encrypted state backups now run via a user timer: 30 local snapshots
+  plus restic when configured. ops-health reports the backup timer.
+
+---
+
 🧵 Community polish + host tooling
 - The Advanced Cordn web link now warns that Cordn web may stall after sign-in;
   the in-app join remains the reliable path.