PerchAnton · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.0-beta.2
+
+- Record the twelve measured tasks from the single-participant manual-entry pilot. In this pilot the participant entered both the existing number and the short alias faster than RefMint.
+- Explain the beta API, frozen v1 identifiers and npm distribution tags separately. See [when to use an existing identifier](docs/when-not-to-use.md) and the [pilot results](docs/manual-entry-pilot.md).
+
 ## [0.1.0-beta.1](https://github.com/PerchAnton/refmint/releases/tag/v0.1.0-beta.1)
 
 - Define the beta API and unchanged wire-format contract, migration checks and dependency approval boundaries.

diff --git a/README.md b/README.md
@@ -6,16 +6,16 @@ generate random references. It works in Node.js 22+ and browsers with Web Crypto
 
 [![CI](https://github.com/PerchAnton/refmint/actions/workflows/ci.yml/badge.svg)](https://github.com/PerchAnton/refmint/actions/workflows/ci.yml)
 ![Runtime dependencies: 0](https://img.shields.io/badge/runtime_dependencies-0-087d5d)
-[![npm beta](https://img.shields.io/npm/v/refmint/beta)](https://www.npmjs.com/package/refmint/v/0.1.0-beta.1)
+[![npm beta](https://img.shields.io/npm/v/refmint/beta)](https://www.npmjs.com/package/refmint/v/0.1.0-beta.2)
 
 ```sh
-npm install --save-exact refmint@0.1.0-beta.1
+npm install --save-exact refmint@0.1.0-beta.2
 ```
 
-[Beta release and checksum](https://github.com/PerchAnton/refmint/releases/tag/v0.1.0-beta.1) ·
+[Beta release and checksum](https://github.com/PerchAnton/refmint/releases/tag/v0.1.0-beta.2) ·
 [API compatibility and frozen v1 format](docs/beta-contract.md).
 
-**Try an invoice lookup.** The [sample PDF](https://github.com/PerchAnton/refmint/blob/v0.1.0-beta.1/examples/workflows/sample-invoice.pdf)
+**Try an invoice lookup.** The [sample PDF](https://github.com/PerchAnton/refmint/blob/v0.1.0-beta.2/examples/workflows/sample-invoice.pdf)
 shows `INV-2026-000042`, the short alias `D1042` and the 21-character printed
 reference `INVOICE_1PQP2-UYWU-CW` for the same record. In the
 [lookup demo](docs/workflows.md#try-the-workflow), compare the one-symbol change
@@ -56,15 +56,15 @@ If people already find records reliably with your current search, keep it.
 The GitHub package archive remains available as an alternative:
 
 ```sh
-npm install --allow-remote=root https://github.com/PerchAnton/refmint/releases/download/v0.1.0-beta.1/refmint-0.1.0-beta.1.tgz
+npm install --allow-remote=root https://github.com/PerchAnton/refmint/releases/download/v0.1.0-beta.2/refmint-0.1.0-beta.2.tgz
 ```
 
-npm 12 requires explicit permission for URL dependencies. Pass `--allow-remote=root` on later `npm install` / `npm ci` runs for a project that keeps this URL dependency, too; the flag does not change global settings. Alternatively, download the `.tgz` asset and run `npm install ./refmint-0.1.0-beta.1.tgz`. [npm's URL dependency setting](https://docs.npmjs.com/cli/v12/commands/npm-install/#allow-remote).
+npm 12 requires explicit permission for URL dependencies. Pass `--allow-remote=root` on later `npm install` / `npm ci` runs for a project that keeps this URL dependency, too; the flag does not change global settings. Alternatively, download the `.tgz` asset and run `npm install ./refmint-0.1.0-beta.2.tgz`. [npm's URL dependency setting](https://docs.npmjs.com/cli/v12/commands/npm-install/#allow-remote).
 
 The release also includes `SHA256SUMS`, package verification and a registry consumer check. To run the tagged browser demo with Node.js 22+ and pnpm 11.25.0:
 
 ```sh
-git clone --branch v0.1.0-beta.1 https://github.com/PerchAnton/refmint.git
+git clone --branch v0.1.0-beta.2 https://github.com/PerchAnton/refmint.git
 cd refmint
 pnpm install --frozen-lockfile --ignore-scripts
 pnpm check

diff --git a/SECURITY.md b/SECURITY.md
@@ -6,4 +6,4 @@ Keep a unique database constraint, retry conflicts with a limit, authorize looku
 
 Do not attempt to repair an invalid code automatically: a guessed correction can select the wrong record. The parser only normalizes the presentation differences documented in SPEC.md.
 
-For a potential vulnerability, use GitHub's private vulnerability reporting if available, or contact the repository owner through their GitHub profile without disclosing exploit details in a public issue. Ordinary reproducible bugs belong in issues. This alpha has not had an independent security audit.
+For a potential vulnerability, use GitHub's private vulnerability reporting if available, or contact the repository owner through their GitHub profile without disclosing exploit details in a public issue. Ordinary reproducible bugs belong in issues. The current beta has not had an independent security audit. See the [beta scope](docs/beta-contract.md) and [stability criteria](docs/stability.md); a beta label is not a security assurance.
diff --git a/docs/beta-contract.md b/docs/beta-contract.md
@@ -25,7 +25,7 @@ database migration, search endpoint or regulated invoice-number replacement occu
 
 ## Upgrade checks
 
-Pin `refmint@0.1.0-beta.1` to evaluate this release. Existing alpha.2/alpha.3 callers and identifiers need no
+Pin `refmint@0.1.0-beta.2` to evaluate this release. Existing alpha.2/alpha.3 callers and identifiers need no
 API or data migration. Keep the prior reader during application rollout and rerun
 the application's native lookup/permission tests on the exact installed archive.
 

diff --git a/docs/evidence.json b/docs/evidence.json
@@ -1,6 +1,6 @@
 {
   "generated_at": "2026-10-27T13:21:13.955Z",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "environment": {
     "node": "v24.19.0",
     "platform": "darwin",
@@ -113,6 +113,6 @@
   "measurement_version": "0.1.0-alpha.2",
   "carried_forward": {
     "reason": "Runtime JavaScript bytes are unchanged; original alpha.2 measurement timestamps, environment and samples are retained.",
-    "verified_date": "2026-10-28"
+    "verified_date": "2026-11-05"
   }
 }
diff --git a/docs/evidence.md b/docs/evidence.md
@@ -4,7 +4,7 @@ Run `pnpm check && pnpm evidence` from a clean checkout after installing the loc
 
 ## Correctness
 
-For alpha.3 and the beta.1 candidate, the timing/size snapshot is carried forward from alpha.2 because all
+For alpha.3, beta.1 and beta.2, the timing/size snapshot is carried forward from alpha.2 because all
 runtime JavaScript hashes are identical. `measurement_version` identifies the measured
 version; `version` identifies the package carrying the evidence. Original timestamps,
 environment and samples are retained. This is not a new performance measurement.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -6,4 +6,4 @@ Keep a unique database constraint, retry conflicts with a limit, authorize looku

		Do not attempt to repair an invalid code automatically: a guessed correction can select the wrong record. The parser only normalizes the presentation differences documented in SPEC.md.

		For a potential vulnerability, use GitHub's private vulnerability reporting if available, or contact the repository owner through their GitHub profile without disclosing exploit details in a public issue. Ordinary reproducible bugs belong in issues. This alpha has not had an independent security audit.
		For a potential vulnerability, use GitHub's private vulnerability reporting if available, or contact the repository owner through their GitHub profile without disclosing exploit details in a public issue. Ordinary reproducible bugs belong in issues. The current beta has not had an independent security audit. See the [beta scope](docs/beta-contract.md) and [stability criteria](docs/stability.md); a beta label is not a security assurance.