<p>**Cuprate—anindependentMoneronode—isnowanapp.**Moneroconsensusvalidatedbyasecond,unrelatedcodebase(Rust),thesamelayerofsecurity-in-depthBitcoingetsfromKnots.Reviewcaughttwoproblemsbeforeanythingshipped:theunrestrictedRPCthatcanmovefundsstayedboundtothecontainer's loopback (never published to the node, let alone the LAN — anything on the node could previously have reached it), and its restricted RPC moved off port 18089 to avoid colliding with Penpot. Honest caveat: upstream has cut no stable release yet, so the pin tracks an exact preview build (0.1.0-preview-18-g618ff14) and moves to their first tagged release when there is one.</p>
<p>**A frozen node now explains itself — and comes back on its own.** The host now captures a memory dump into /var/crash when the kernel panics *or* wedges (a hung kiosk used to sit dead until someone power-cycled it; now it dumps, reboots itself, and leaves the evidence behind), and records failing-memory signals (ECC errors) into a database as they happen. This is the first change delivered by a new host-update channel: the node'sownupdaternowcarriesOS-levelpackagesandsettingstoalready-deployedmachines—thecrash-kernel's memory reservation is the one part that waits for a reboot, and the node says so rather than pretending.</p>
<p>**Uninstalling an app can no longer report success when it failed.** The declarative path used to swallow every teardown error and report the app uninstalled, leaving the tile behind and the truth in the logs. A failed uninstall now stops and shows the real per-app errors, so "still there" is never presented as "gone".</p>
<p>**Pictures to internet-only mesh contacts work now.** Sending an attachment inline always took the radio path and failed with "Peer is federation-only (no radio twin)" for contacts reachable only over the internet — and the size-adviser kept recommending a radio transfer those peers can'treceive.Bothfixed:inlinesendsrouteoverthefederationwhenthat's the only way to reach the peer, and the advice no longer offers radio-only transfers to radio-unreachable contacts.</p>
<p>**Disk cleanup finally has honest numbers.** Space "free" on a drive was counted including the slice the filesystem keeps reserved for root — roughly 5% of the disk, 92 GB on one dev box — so the automatic cleanup that'ssupposedtokickinat90%nevertriggeredandstalecontainerimagespiledupunnoticed.Reservedspacenowcountsasused,whichiswhatthethresholdwasalwaysmeanttomeasure.</p>
<p>**Threesmallscreensthatwerelyingtoyou,fixed.**The"Bitcoin is synced — fund your wallet"toastnolongerappearsonanodewherethewalletitmeans(LND)isn't installed — it points at installing LND instead. The seed-reveal screen hides its third prompt unless the password actually fails to decrypt (the backup passphrase only exists if you set one). And multi-version store cards stop quoting a version number you'llbeaskedtochooseonthenextscreenanyway.</p>
<p>**Meshnotificationssurvivearefresh,andastalerouternolongerhidesthefix.**Radiomessageunreadcountsarenowrememberedpercontactinsteadofguessedfromsessionstate(the"one new message showed 11 unread"bug),coverMeshtastic,MeshCoreandReticulumalike,anddeep-linktotherightconversation;asinglenewmessageannouncesitselfonce.Separately,whenthecachedrouteraddressgoesstale,theerrorcardgainsa"Reconfigure router"actioninsteadofaRetryloopthatcanneversucceed.</p>
<p>**Theappupdaternowknowswhatupstreamshipped.**Everyapp's manifest records where it comes from — including the odd corners (GitLab-only projects, ghcr-only images) — and a checker sweeps all of them against upstream releases, so a pin that quietly rots for months is now visible instead of invisible. The first full sweep found 27 pins behind; the safe patch-level ones shipped with this release (strfry, BTCPay Server 2.4.3, the two nginx frontends), and the major jumps that may carry data migrations are deliberately held for their own careful passes.</p>
<p>**Apps with their own login can now skip the node'sloginscreen—GiteaandBTCPayServerdosooutofthebox.**Someappsbringacompleteaccountsystemoftheirown,andputtingthenode's password page in front of them broke real workflows: git clients can'tanswerabrowserlogin,andaBTCPaycheckoutlinkhandedtoacustomermustopenforthatcustomer.Theseappsarenowserveddirectlyontheirownlogin,whilethenodestillfrontstheconnectionforeverythingelseitdoes(embeddingfixes,the"app is restarting"page,Tor).Everyappgetsanew**Settings→app→Accesscontrol**switch,soyoucanputthenodeloginbackinfrontofanyapp—ortakeitawayfromone—withoneclick,effectiveimmediately.Appdevelopersdeclarethedefaultintheirmanifest(auth:open),documentedinthedeveloperguide.</p>
<p>**ThephoneremotenowworksinsideappsontheTV—tap,scroll,andtypeeverywhere.**Thecompanionremoteandkeyboarddrovethedashboardbeautifullybutdiedattheedgeofanyappscreen(Gitea,BTCPay,andfriends):forthebrowser,eachappisaseparatewebsiteembeddedinthepage,andsimulatedinputisforbiddenfromcrossingthatwall.Theon-screendisplaynowacceptstheremote's input the way a real mouse and keyboard arrive — below the page, through the browser itself — so it lands anywhere on screen, app screens and tabs included. Taps click, two-finger scrolling scrolls the app, and typing goes into whichever field you tapped. Existing kiosks pick this up with the update, no reinstall needed.</p>
<p>**While you'redrivingwiththephoneremote,theoldmousepointergetsoutoftheway.**Thecomputer's own pointer used to sit frozen wherever the physical mouse last left it — a second, dead cursor next to the live orange one. It now hides while the remote is in use and returns half a minute after the last remote input.</p>
<p>**"Are you sure?" questions no longer freeze the remote.** A handful of confirmations (clearing mesh history, rebooting, deleting a backup, uninstalling an app) used the browser'sbuilt-inpopup,whichstopsthewholepage—includingremoteinput—untilsomeoneclicksitwitharealmouse.Fromthecouch,thatmeantaskingaquestionyoucouldn't answer. All of them are now proper in-app windows in the house style, fully driveable by remote.</p>
<p>**A mesh radio now connects no matter which port it'spluggedinto—orrepluggedinto.**MovingaradiotoadifferentUSBportcouldleavethemeshsilentlydown:thenodeonlycheckedashortfixedlistofportnames(aradiolandingoutsideitwasinvisible),ahand-setserial-portoverridequietlyoutrankedthedeviceyou'd just approved in the "Radio detected" window, and one whole family of boards (Espressif-based radios like recent Heltec/T-Deck models) never received a stable device name at all — the exact combination found live on a fleet machine this week. All three are fixed: every serial port is scanned, choosing a radio in the detection window clears any stale override, and Espressif boards get the same stable name as everyone else.</p>
<p>**Mesh signal strength is honest now.** Every peer heard over Reticulum radio reported a signal strength of exactly 0 — which is also what you'dseewithnoradioatall,andwhatpeersreachedovertheinternetshowed.Realreceptionsnowshowtheirtruesignalreading,andanythingthatarrivedoverarelayortheinternetsayssobyshowingnone—so"the radio is working"and"the internet is doing the radio's job"nolongerlookidentical.(Thereadingdependsontheradio's firmware reporting it; boards that don'treportper-packetsignalstatsshow"unknown"ratherthanamade-upnumber,andthenewradiodiagnosticsshowataglancewhetheryoursreportsthem.)</p>
<p>**ThenetworkmaponTVs:nomoreblankpage,nomorefrozenpage—anditmovesagain.**Themap's entrance animation needed a smoothness that TV kiosk hardware can'talwaysdeliver,sothepagecouldsitblankuntilarefresh;thepreviousfixcuredthefreezebystoppingtheanimationentirely,whichwenttoofar.Nowthemapappearsinstantlywitheverythingalreadyinplace,thenresumesitscalmorbitalmotionatagentlerpacesuitedtoTVs.Resizingorrotatinganyscreenalsoredrawsthemapproperlyinsteadofleavingittiny,stretched,orempty.</p>
<p>**Thedashboard's corner logo is back to normal.** The new glossy paint finish was meant for the big emblem on the screensaver, intro, and login screens — it had quietly spread to the small logo in the dashboard header, where it looked wrong. Each screen now gets exactly the treatment intended for it.</p>
<p>**App icons no longer vanish in My Apps.** The freshly restyled Alby Hub and phoenixd icons could render as blank squares in some views — a subtlety in how the icon files declared their size. Fixed at the source, and the icon tool app developers use now produces immune files.</p>
<p>**An app that can'tbeshowninsidethedashboardnowbecomesatabappbyitself.**Afewappsrefusetorenderinsideanotherpagenomatterwhat—theybreakoutwiththeirowncodeorinsistonowningthewholebrowserwindow.Openingoneusedtomeanstaringatagreypane.Nowthedashboardnotices,offerstheappinitsowntab,andremembers:fromthenonthatapp's button opens a tab directly (with the little launch icon that tab apps carry), first click, every time. If a later update makes the app embeddable after all, the dashboard notices that too and goes back to embedding it.</p>
<p>**The logo emblem got its glossy black paint finish — properly this time.** The circle behind the A on the screensaver, intro, and login now wears a deep wet-paint look: warm light blooming from the top edge, fine grain so the dark tones stay smooth instead of banding, and no more ring border. (An earlier rougher version of this experiment briefly shipped by accident and then vanished depending on which screen you were on — this is the finished, deliberate one, everywhere.)</p>
<p>**New app icons now match the store'slook,oneveryscreen.**AlbyHubandphoenixdarrivedwithedge-to-edgelogosthatignoredthebreathingroomeveryotherappiconhas,andtheappdetailpageskippedtheiconbackdropentirely.Bothiconsarere-setonthestandardcanvas,thedetailpagenowappliesthesameicontreatmentasthestoretiles,andappdevelopersgetaone-commandtoolthatputsanylogoontothehousecanvasautomatically.</p>
<p>**Appsthatrefusedtoopeninsidethedashboardnowembedlikeeverythingelse.**Someappsshipbrowserheadersthatforbidbeingshowninsideanotherpage—correcthardeningontheopenweb,butinsideArchipelagoitproducedadeadgreypanewhenyouopenedthemfromMyApps(AlbyHubwasthefirsttohitit).Theappgate,whichalreadychecksyourloginoneveryrequesttoanapp,nowremovesjustthoseframingheadersonthewaythrough;eachapp's own content-security rules pass through untouched. No more per-app proxy workarounds.</p>
<p>**The network map no longer freezes kiosk TVs.** The animated federation map at 4K was too much for the deliberately conservative graphics settings the on-screen display used on every machine — settings chosen years back to stop audio crackle on much older hardware. Two fixes: on kiosk screens the map now opens in its flat 2D view (the 3D globe is one tap away, and remembered) and animates at half rate — invisible from the couch, half the work. And the display itself now recognizes what machine it runs on: older kiosk boxes keep the proven careful settings, modern ones finally get real GPU rendering.</p>
<p>**New Settings → Display → Graphics choice for the on-screen display.** Auto (recommended) picks the right rendering mode for the machine by itself; Compatibility forces the most conservative mode if a screen ever stutters, tears, or crackles; Quality forces full GPU rendering on hardware the automatic detection doesn'trecognize.Changingitrestartstheon-screendisplay,likethesizepresets.</p>
<p>**Installinganupdateisreliableagain,andtellsyouwhathappenedwhenitisn't.** Some nodes could download an update but never apply it — the button stayed on "Install", and no amount of retrying worked. The cause: applying the update consumed the downloaded files as it went, so if any one step hit a snag partway through, the leftover files were incomplete and every later attempt failed the safety re-check forever, needing a technician to recover. Applying no longer consumes the download — a failed apply can always be retried from the same files — and the pieces are now applied in a fixed order with the program itself last, so a hiccup can'tleaveahalf-swappednode.Whenanapplydoesfail,thescreennowshowstherealreasonandwhattodo("download the update again"),andoffersDownloadagaininsteadofadead"Install"button,ratherthanageneric"it failed".</p>
<p>**Videoonthekioskstopstearing.**Thekiosk's display had no vertical sync at all, so fast motion — IndeedHub films especially — showed horizontal tearing lines. The display driver now syncs every frame to the panel (no extra hardware needed, existing kiosks pick it up with this update), and on machines with a GPU, video decoding moves off the CPU onto the video hardware — smoother playback that also leaves more headroom for audio, not less.</p>
<p>**The Back button finally does what you expect.** Pressing Back — the mouse'ssidebuttononakiosk,aswipeonaphone,thetoolbarbuttoninanybrowser—usedtonavigatethescreenunderneathanopenwindow,orleavethedashboardentirely.Backnowclosesthetopmostopenwindowfirst,oneperpress,exactlylikeanativeapp;closingawindowyourselfneverleavesaphantomentrythatmakesyoupressBacktwice.</p>
<p>**NomorebareIPaddressesinyourupdateorapp-registrysettings.**Theupdatemirrorsandtheappregistryeachlistedthesameservertwice—oncebyitspropername,onceasarawhttp://146… address left over from before the domain existed. The raw-address entries are retired: new nodes never see them, and existing nodes clean them out of their saved lists automatically on the next read. Everything now goes through the named, TLS-protected origin — which was always the same machine.</p>
<p>**TheReceivewindownowtellsyouwhenthemoneyisonitsway.**PreviouslyitshowedaQRcodeandleftyoutocheckelsewherewhetheranythinghappened.Now,themomentthesender's transaction is broadcast, the QR gives way to a clock: the amount, the transaction ID (tap to copy), and a note that the funds arrive on their own — with a single Done button. If you keep the window open, the clock becomes a green check at the first confirmation. Verified live on a real node: payment detected within seconds of broadcast.</p>
<p>**Every app is now supervised the same way — the last stragglers moved under systemd.** Five apps (Jellyfin, Nextcloud, Home Assistant, Uptime Kuma, Vaultwarden) still ran outside the node'sper-appservicemanagementforatechnicalreason:theirnetworkingstylediedwithwhateverprocessstartedit,sotheywerekeptalivebyaseparateworkaround.Thatworkaroundisretired:theseappsnowmigratethemselvesontothesamemanagedunitsaseverythingelse—ownservice,restart-on-anything,aten-secondbreatherbetweenrestartssotheirnetworkingcanreleaseitsportscleanly.Themigrationhappensautomaticallyonthenode's next housekeeping pass, touches no app data, and was watched live on a real node: both test apps moved over on the first pass and came back healthy.</p>
<p>**Leftover companion screens are cleaned up again — driven by real records this time.** When an app is uninstalled, its helper screen (the UI tile that fronts it) should go too. That cleanup was switched off in an earlier release after it wrongly removed the Bitcoin screen from a node whose Bitcoin was installed — it had been guessing "installed" from what happened to be running, and a separate bug made a running app look absent. The node now keeps a durable record of what you have installed, written at install time and cleared only by a real uninstall, and the cleanup consults only that record. If the record can'tberead,thecleanupdoesnothingatall—"I couldn't check"isnevertreatedas"nothing is installed"—andahelpermustbeorphanedforasustainedperiodbeforeitistouched.</p>
<p>**Awarningthatfiredeveryminuteoneverynodeisgone.**TheappcatalogandthenodedisagreedaboutwhereGrafana's software comes from, so the node ignored the catalog'sanswerandloggedacomplaintroughlyevery75seconds,forever.Thecatalogwasright—Grafanaisservedfromthefleet's own registry, like Bitcoin Knots — and the node'srecordsnowagreewithit.</p>
<p>**Anappthat's mid-restart shows a page that says so — and comes back by itself.** When an app'sscreenwasbrieflyunreachablebehindthegate,thebrowsergotabareerror;itnowgetsanamedpageforthatappthatretriesonitsownuntiltheappanswers.</p>
<p>**Thediscoveryliststopsshowingghosts.**Everyreinstallofanodemintsanewdiscoveryidentity,andtheoldidentity's announcement could never be removed from the public relays — nothing holds its key anymore — so the "Discoverable nodes" list slowly filled with entries that led nowhere. Announcements now expire: your node re-announces itself twice a day, each announcement carries a 48-hour expiry that relays honour, anything older than that is ignored when reading, and switching discovery off — or factory-resetting the node — actively overwrites the announcement before it can become a ghost. Old ghosts from earlier versions stop being shown immediately and age off the relays on their own.</p>
<p>**You can name your node when you make it discoverable.** Turning discovery on now asks for an optional display name — it travels inside the public announcement, so other nodes'discoverylistsshow"Dorian's basement node"insteadofabarenpub.Thenameispublicbyconstruction,cappedat32characters,andblankisfine:youlistasnpubonly.Togglingdiscoveryoffandonremembersthename;youcanclearitthesamewayyousetit.</p>
<p>**Thediscoverabilitypanelnowshowswhatthenetworkactuallysees:yournode's npub.** It previously showed your Tor address — which is precisely the thing the announcement never contains (your address stays private until you approve a peer). The npub, the identity other nodes discover you by and send peering requests to, is now displayed there with a copy button.</p>
<p>**The seed screen stops flashing while the node starts.** During first boot, the lock icon and "server starting" text blinked in and out every few seconds while the node came up — each silent retry briefly emptied the screen. The waiting state now holds steady, with its elapsed timer, until the node answers.</p>
<p>**A node that already has an identity now explains itself on the seed screen.** Reaching seed creation on a provisioned node used to surface a developer message about "the authenticated system.factory-reset". It now says what you can actually do: sign in normally, or factory-reset the node from Settings to start it over.</p>
<p>Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release; the changes were verified by operator UAT on a live node.</p>
<p>**Your node now has its own assistant.** This is the first release to ship AIUI: a conversational screen that can answer from your node'sowncontent—yourfilms,musicandfilescomefirst,theopenwebsecond—andcanactonthenodeitself:installorremoveanapp,checkwhat's running, or queue up your media, all through a fixed list of vetted actions rather than free rein. It is off-limits to your data until you say otherwise: every data category starts closed, grants are made in Settings → AI Data Access and live on the node itself, and anything that changes the node asks you to confirm in the dashboard'sownchromefirst—adeclinedactionstaysdeclined.Whatleavesthenodeisscreened:yourAPIkeyisstoredencryptedandneverwritteninplaintext,credential-shapedstringsarescrubbedfromapplogsbeforethemodelseesthem,yourpublicaddressandWi-Finamearestrippedfromnetworkanswers,websearchisgatedbehindyourloginsession,andcloud-boundtextpassesasecretscanonthewayout.Threemodelbackendsaresupported—Anthropic's API, a local Ollama, and pay-per-use Routstr with a hard prepaid budget ceiling — and mesh peers can reach the same loop with !ai.</p>
<p>**Tor now tells you the truth, heals itself, and the Restart button really restarts it.** Three nodes ran for days with Tor completely dead while the dashboard said "Connected" — the indicator was reading a leftover address file, not the daemon, and the restart button reported success without checking. The cause was a configuration line Tor can never bind on our systems; a node could re-break itself from a single settings change. The node now refuses to write that line, checks Tor with a real connection instead of a leftover file, repairs its own Tor configuration at every start, and the Restart button only claims success once Tor is actually answering. Onion addresses that had silently never been published (BTCPay'sincluded)comebackwithit.</p>
<p>**Themempoolexploreractuallyconnectsnow.**Thepageloadedbutsatemptyforever.Threeseparatecausesstackedup:theblockindexhadspentdaysrebuildingwithoutanythingsayingso,andthentwodifferentlayersofthenode's plumbing were dropping the live-data connection the page depends on — so everything reported healthy while your screen showed nothing. All three are fixed, and the node'sownhealthchecksnowtesttherealconnectionabrowsermakes,sothiscannotpassunnoticedagain.</p>
<p>**Appsnolongervanishafterstoppingcleanly.**Astoppedapp's container is deleted by design, but the restart policy meant an app that exited cleanly was never brought back — it simply disappeared until reinstalled. Backends now restart in every case, the node remembers what you have installed so a missing app is recreated rather than forgotten, and this release repairs the incorrect policy on apps installed by earlier versions.</p>
<p>**Your Bitcoin node will not silently change software versions anymore.** "Latest" previously meant different things in different places — one path installed a newer build that deliberately halts until you make a network-rules decision, which froze one node'ssyncatafixedblockwhileitreporteditselffullysynced.BitcoinKnotsisnowpinnedtoanexplicit,known-goodversion;changingitisadecisionyoumake,neverasideeffectofanupdate.</p>
<p>**Smallerfixes:**theAIdata-accesssettingsnowsayplainlywhichcategoriestheassistantcanseebutnotacton;thetransactionswindow's tab bar is transparent glass instead of a black block; BTCPay logins no longer fail with a server error when the node is under heavy load right at that moment.</p>
<p>**You can now replace your Lightning connection keys from Settings, without touching a terminal.** The tokens wallet apps like Zeus use to reach your node are bearer keys: anything that has ever seen one can spend from your node until they are replaced, and there is no way to cancel one individually. Replacing them was previously a script you had to SSH in and run, which in practice meant it never happened. Settings → Lightning credentials now shows when yours were issued, which node they belong to and how many channels must survive, then does the whole job behind your node password — with a step-by-step progress list, and a refusal to call it a success unless it has confirmed your node identity and every channel came back. Your coins and channels are not touched: nothing is closed, and the wallet is never re-created. Afterwards you re-pair Zeus by scanning the Lightning app'sQRcodeagain.</p>
<p>**ReplacingthosekeysnolongersilentlybreaksBTCPayServer.**BTCPayholdsitsowncopyofthekey,andthatcopycannotrepairitself—soanodethatreplaceditskeysendedupwithBTCPayrunning,healthy,andunabletotakeasingleLightningpayment,withnothinganywheresayingwhy.ThedashboardnowupdatesBTCPay's copy as part of the run and restarts it around its existing data, and the Settings screen warns you if it finds a node already stuck in that state. The command-line script fixes the same gap.</p>
<p>**Lightning stops getting stuck locked on a busy node.** Lightning opens its databases before it will accept the password that unlocks the wallet, and on a loaded node that took nearly three minutes — longer than the node was willing to wait. Giving up restarted Lightning, which started the slow open again, so the wallet stayed locked forever and everything depending on it stayed broken. The node now waits as long as it takes. A genuinely wrong password still fails immediately.</p>
<p>Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The full 5x real-node lifecycle gate was not run for this release; reboot survival was verified directly on a live node — all installed apps returned after a cold reboot, uninstalled apps stayed gone, and restart policy was confirmed on every managed unit.</p>
<p><strong>The most important fix in this release: the update button could take you backwards onto a version withdrawn for a security hole.</strong> BTCPay Server published 2.4.2 to close a flaw that was being actively exploited — a way past two-factor authentication. Nodes that had already moved to 2.4.2 were then shown an "Update" button offering 2.3.9, the very release being withdrawn, and taking it would have rolled the node back onto the vulnerable version. The cause was that the node only asked whether the two version numbers differed, never which was newer, so any stale record anywhere could present a rollback as an upgrade. It now refuses to offer a lower version as an update, so a stale record fails safe instead of becoming a trap. BTCPay itself is on 2.4.2, and every place that still named the old version — including the fallback installer, which would have installed it outright — has been corrected.</p>
<p><strong>An app now reports its own version, not a helper's.</strong>Whereanappismadeofseveralparts,thenodecouldreadtheversionofthewrongpart:BTCPayshowedas"15.17",whichistheversionofitsdatabase,whileofferinganupdateto2.4.2.Thatisthenumberupdatedecisionsaremadefrom,soanonsensicalpairwasbeingpresentedasalegitimateupgrade.Whenthenodecannotidentifyanapp's own container it now says so rather than guessing at a neighbour.</p>
<p><strong>Your node issues its own certificate, so apps stop being flagged as insecure.</strong> Each node now has its own certificate authority, with a one-step install from Settings, and app screens are served over the same secure connection as the dashboard rather than dropping back to an unprotected one. Apps answer on both the secure and plain address on the same port, so nothing that worked before stops working.</p>
<p><strong>An app that is still starting says "starting".</strong> It previously reported "App not reachable", which reads as a failure when the app is simply warming up.</p>
<p><strong>Updates and app downloads now come from a proper domain name.</strong> They previously used a bare numeric address over an unprotected connection. Downloads are now encrypted in transit, and the old address is kept as an automatic fallback for nodes whose clock or name lookup is off — the signature, not the address, is what makes either source safe.</p>
<p>Also in this release: the tool app developers run to check their app description no longer rejects every valid file, and the node'sownsecurityaudit—whichhadbeenreportingall-clear—nowactuallyinspectsthefileswherecredentialshadbeensitting.</p>
<p>Housekeeping,disclosedratherthanburied:thisreleaseremovesArchipelago's own infrastructure details from the published source ahead of the code being opened to the public. No behaviour changes for your node.</p>
<p>Known gaps, unchanged from the last release: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.</p>
<p><strong>The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.</strong> Since the gate went up, those screens would load their frame and then show every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node'sownscreens,whichneedthatlogintofetchyourdata.Thegatenowremovesonlyitsowncredentialandthenode's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.</p>
<p><strong>IndeeHub heals itself.</strong> Three separate faults: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted about ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — the node would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. All three are fixed, and the storage fault fixes the same trap for every future multi-part app.</p>
<p><strong>Send and Receive open clean every time.</strong> Whatever you typed last — an address, an amount, and above all an armed "send all funds" toggle — no longer quietly carries over into the next payment. And choosing "send all funds" now shows the amount being swept instead of a confusing 0.</p>
<p><strong>The camera scanner option no longer vanishes on desktop.</strong> Browsers only allow the live camera on secure (HTTPS) pages, and the scan window used to silently hide the camera choice on plain connections, which read as "the scanner is gone". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app'sbuilt-inscannerisuntouched.</p>
<p><strong>Theapploginscreenlookslikethenode's own now:</strong> same rotating artwork, same panel, the Archipelago mark, and the app'srealiconasatilethewayMyAppsshowsit,insteadofaplainboxwithaletter.</p>
<p><strong>Fivemorescreensonyournodewerereadablebyanyonewhocouldreachit—andthelastrelease's own check said they were fine.</strong> The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they run directly on the node'snetworkratherthanbehinditscontainerplumbing,sotherewasnoaddresstopinandtheirdescriptionslistednoportatall—andthenodebuildsitslistofwhattoprotectfromexactlythosedescriptions.Itneitherprotectedthemnorlistedthemasunprotected.Foundbyscanningthenodefromanothermachineinsteadofaskingthenodeaboutitself.</p>
<p><strong>Everyportonyournodenowhasastatedpolicy—noneareleftundecided.</strong>Elevenhadnoinstructioneitherwayandstayedopenbydefault.TheBotFightsarena,therouterscreenandthePinevoicescreennowaskforyournodepassword.Theonesthatgenuinelycannottakealoginpagestayopenwithawrittenreason:Fedimint's guardian and gateway connections, NetBird'smanagementanddashboardports(yourVPNdevicescarrytheirowncredentialsandcannotholdabrowsersession),Pine's secure listener, and the Lightning REST port that wallets reach with a macaroon exactly as before.</p>
<p>Freshly flashed nodes are covered too, not only existing ones — those five screens ship as prebuilt images, so a new node would otherwise have come up open even after this fix. All five were rebuilt, published, then pulled back and inspected to confirm the fix is really inside them.</p>
<p>Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release.</p>
<p><strong>Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.</strong> Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app.</p>
<p><strong>The things that must stay open stayed open.</strong> Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.</p>
<p><strong>A private address on your node was answering the mesh without a password.</strong> One app'sportwasmarkedasbeingforthismachineonly,andthepartofthenodethatcarriesmeshtrafficdidnotknowthat—itforwardedrequestsfromthewholemeshstraighttoit.Foundwhilecheckingtheworkaboveonarealnode,notintesting.Thatpathnowrefusesanythingmarkedmachine-only,andtheappisreachableonlyfromthenodeitself,asintended.</p>
<p>Knowngaps,disclosedratherthanburied:elevenappportsstillhavenostatedpolicy—BotFights,theFedimintgateway,NetBird,thevoiceassistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting is what caused two incidents this week. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser apps — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will meet the login page and need an access token; say the word if you use one and it can be exempted. The 5x real-node lifecycle gate was not run for this release.</p>
<p>**Making another node "Trusted" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.</p>
<p>**Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh'sinternettransports—soonanodewithadifferentradio,ornoradioatall,messagingapeeryouhadjustfederatedwithsimplyfaileduntilaradiocontacthappenedtoappear.Peerednodesarereachablewithoutradiobydefinition,sothatchoicenolongerdependsonthehardware.Radioisstillpreferredwhentheothernodeisactuallyinrangeandthemessagefits.</p>
<p>Thedashboardnolongerflickersaverticallineacrossitscards.Arenderingseamappearedatrandomwhilemovingthemouse,becausethetwolargecardsusedabackground-blureffectthatthissystemalreadydisableseverywhereelseonthedashboard—thatbrowsermis-drawsitinsidethedashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.</p>
<p>The Lightning screen will actually update from now on. Its image was set to "latest", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.</p>
<p>Apps that provide their own screens stop rebuilding themselves in a loop. On this system'sownnodeoneofthemrebuilteverythirty-fivesecondsindefinitely,burningprocessortimeandrestartingtheappeachround.Thenodedecidedarebuildwasneededbycomparingfiledatesagainsttheimage's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.</p>
<p>Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin'speerconnectionsforsyncingthechain,Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.</p>
<p>Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.</p>
<p>Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision).</p>
<p>**Security, and the reason to take this update: two ports on your node handed anyone who could reach them complete control of your money, with no password.** The Lightning app'sportansweredaplainwebrequestwiththeLNDadminmacaroon,theTLScertificateandthenode's onion address — everything needed to drain the wallet remotely, and the onion meant an attacker kept that ability even after losing access to your network. The Bitcoin app'sportreachedBitcoinCore's control interface using credentials the node itself supplied on the caller'sbehalf,withawalletloaded.Anythingonyourhomenetwork,yourTailscalenetworkorthemeshcoulduseeitherone.Bothnowrequireyoutobeloggedin.Ifyournodehasbeenreachablebyanyoneyoudonotfullytrust,treattheLightningmacaroonandtheBitcoinRPCpasswordasknowntothem.</p>
<p>TheAIsidebarloadsagain.Itwasaskingforitsprogramfilesatanaddressthatpointedatthemainapp's files, where they do not exist, so it silently loaded nothing.</p>
<p>The navigation above the bottom bar no longer follows you between screens. Back buttons and the mesh tab bar stayed pinned over every other page once you had visited the screen that owns them. Keeping tabs loaded in the background — the change that made switching between them instant — means leaving a screen hides it rather than destroying it, and this floating navigation sits outside the screen it belongs to, so it was never being hidden with it. It is now tied to whether its own screen is on display. The speed is unchanged: the screens are still kept loaded, so returning to one is still instant.</p>
<p>Wallet: Lightning actions are now offered based on whether you actually have a usable channel rather than just a running node, sending is gated the same way, and an invoice you cannot yet receive offers to install a Lightning node instead of simply failing.</p>
<p>Onboarding and viewing fixes: the "I have written down my recovery words" tickbox is findable on short screens, paid pictures and videos open in the app'sownviewerwithavisibleloadingstateinsteadofablankbrowsertab,picture-in-picturesurviveschangingtabs,andtheFIPS/Torlabelsonpeercardsstayputinsteadofwrappingintothecardbelow.</p>
<p>Knowngaps,disclosedratherthanburied:the5xreal-nodelifecyclegatewasnotrunforthisrelease.TwonodesonthefleetstillshareSSHhostkeyswitheachother(detectionshipped,rotationisadeliberateoperatordecisionandhasnotbeenperformed).BitcoinCorecannowreachTorfromitscontainer,butisnotyetroutedthroughit—thenetworkmodeisbecomingasettingyouchoose,anduntilthenCore's peers remain on the clear internet.</p>
<p>Wallet payments now work on nodes whose channels are private/unannounced. Every invoice-creation call site — the wallet'sownReceiveflow,andtheseller-sidepaid-content/peer-filesflow—onlyeversentLNDtheamountandmemo,soLNDdefaultedprivatetofalseandreturnedinvoiceswithnoroutehints.Anynodewhoseonlyusablechannelisprivateorunannounced(thecommonshapeforachannelsomeoneopenedtoyou)wassilentlyunpayablethroughthewallet,andunpayablethroughpaidfile/contentsalestoo.BothcallsitesnowsetLND's private flag correctly; this was broken in the field and is the main reason for this release.</p>
<p>Tor and the mesh'sTorfallbackarereliableagain.Thenode's background "doctor" health-checker was fighting Tor over the permission bits on its own hidden-service directory: it compared the directory'smodeagainsttheliteralstring"700",butTor's own setgid hidden-service mode is 2700 — a value the doctor'scheckneverrecognizedascorrect.Every~5minutesit"corrected"themodebackto700andrestartedTortoapplyit,andTorimmediatelyreasserted2700—apermanentrestartloopthatmeantTorcouldneverholdontoitsconsensus/HSDircachelongenoughtobeuseful,breakingthemesh's Tor fallback path entirely. The check now compares only the owner/group/other bits that actually matter (both 700 and 2700 pass; genuinely wrong modes like 750 or 2755 are still corrected and restart Tor), plus a 30-minute restart backoff so no future condition can reproduce the storm.</p>
<p>Wallet balances and your node'sownFIPSidentitykey(npub)arenolongerwrittentothebrowser's sessionStorage — caught by an audit of the page-caching work below. Every cache call site in the app now makes an explicit, reviewed decision about whether its data is allowed to persist across a reload, and a one-time migration purges any legacy, unaudited snapshot left behind by an older build.</p>
<p>Server, Home, Mesh, Chat/AI chat, and the secondary screens (app details, marketplace, cloud, federation, monitoring, router/OpenWrt) now load instantly from cache when you revisit them and refresh quietly in the background, instead of blanking and re-fetching everything on every tab switch — this closes out the page-performance work started back in v1.7.116/117.</p>
<p>App updates (including this one) now apply automatically in the background instead of waiting on a tap-to-update prompt, matching how kiosk/TV installs already behaved — the reload still waits for any in-progress splash/dashboard animation to finish first, so it won'tlandmid-motion.Thiswasadirect,explicitdecisionmadewiththemid-payment-reloadriskspelledoutinadvance;revertingtoaconfirmationpromptforbetaisaone-linechangeifwantedlater.</p>
<p>Knowngap,disclosedratherthanburied:theproject's 5x production lifecycle gate (install/UI/stop/start/restart/reinstall/reboot-survive/archipelago-restart-survive/uninstall, run on a real node — CLAUDE.md'sowndefinitionofdonebeforeareleasetag)wasNOTrunforthisrelease,becauseitstargetnodewasunreachableandrunningitherewouldhaverequiredrebootingashared,livebuildmachineoutfromunderotheractivework.Thisrelease's own automated gates (release-gate harness, strict catalog-drift check, the full cargo test suite, a mount-level ISO smoke test, and a headless QEMU boot test) all still ran and passed — this is specifically about the separate 5x real-node lifecycle gate, which is still outstanding and should be run as soon as the node is reachable again.</p>
<p>Fixes mesh radios dropping off on nodes that took the v1.7.117 update. Updates only ever replaced the main program, never the packaged radio helpers — so updated nodes were left running an older radio daemon that didn'tunderstandanewoptionandquietlygaveup,showing"device not connected"withaConnectbuttonthatdidnothing.Thenodenowcheckswhatitsradiodaemonsupportsbeforeusingnewoptions,andupdatesfinallycarrytheradiohelpersthemselves,soeverynodegetscurrentradiosupportwiththeupdateinsteadofonlyfromafreshinstall.</p>
<p>Thein-app"Flash LoRa"flowworksonupdatednodes.TheRNodeflashingtoolwasonlyeverincludedonfreshlyinstallednodes;everywhereelseflashingfailedwithacryptic"No such file or directory".Thetoolnowshipswithupdatesandisincludedonnewinstallimages,andifit's somehow still missing the error says exactly what to do instead.</p>
<p>Message notification badges finally remember what you'veread.Unreadcountswereonlykeptinmemory,soeveryvisitre-countedoldmessagesasnew—includingaphantombadgeforchatswithnothingnewinthem.Read-stateisnowsavedonthedevice,openingachatmarksallitslinkedconversationsread,andhistorynolongerre-badgesafterareload.</p>
<p>FlashyourLoRaradiofrominsidetheapp.TheMeshpagenowhasa"Flash LoRa"buttonthatopensaguidedflow:pickthefirmwarefamily(MeshCore,Meshtastic,orReticulumRNode)andyourboard,andthenodedownloadsthelatestreleaseandflashesitwithliveprogress—noexternalflasherwebsite,nocablestoacomputer.Thesameflowappearswhenafreshlyplugged-inradioisdetected,andalonglistofflashingpitfallswasfixedalongtheway:radiosnolongerboot-loopafteraflash,failuresshowtherealerrorinsteadofsilentlybouncingback,wedgedflashjobscan't get stuck forever, and board auto-detection no longer misidentifies Heltec boards.</p>
<p>Every Archipelago node now acts as a Reticulum relay. Nodes forward mesh traffic and re-broadcast peer announcements, so two radios that can'theareachotherdirectlycanstilldiscoverandmessageeachotherthroughanyArchipelagonodeinbetween—yournodesbecomeinfrastructureforthewholeneighbourhoodmesh,includingnon-ArchipelagoappslikeSideband.</p>
<p>Reticulum(RNode)radiosarenowfirst-classmeshcitizens.Radiosarereliablydetectedonnodestartup(aboot-timingraceusedtoleavethemunclaimed),settingschangesapplylivewithoutarestart,yournode's name propagates over the Reticulum network so other apps like Sideband see it properly, and a crashed Reticulum daemon is detected and restarted automatically. Photo and file attachments sent over Reticulum now actually arrive — four separate delivery bugs were found and fixed, verified end-to-end over real radio hardware.</p>
<p>Messages to contacts that exist on both the internet mesh and a LoRa radio now prefer the radio when it'slive,andattachmentsfollowthesamepath—soco-locatednodestalkovertheairevenwhentheinternetpathexists.</p>
<p>Meshchatpolish:eachmessageintheimageviewershowswhichtransportcarriedit,anewhop-routeviewshowsthepathamessagetook,reactionsmovedintoatidydropdown,andread-trackingnowreflectswhatyou've actually seen. The Refresh and Broadcast buttons give real feedback, and the radio-setup modal shows honest probe progress instead of freezing.</p>
<p>The wallet transactions list works properly on phones now: it scrolls (it silently couldn'tontouchscreensbefore),andtheAll/On-chain/Lightning/Ecashfiltertabsstaypinnedatthetopwithasubtleblurwhilethelistscrollsunderneath.</p>
<p>Lightningpaymentsthattakeawhile(slowmulti-hoproutes)arenolongerreportedasfailedwhilethey're still in flight. The wallet now waits properly, shows an honest "pending" state, and reports the true final outcome.</p>
<p>Server pages feel instant: Server, Federation, Lightning channels, Monitoring, wallet, Cloud, and Credentials screens now render immediately from a shared cache and refresh live in the background (including push updates over the node'swebsocket),insteadofblankingwhileeverypanelrefetches.</p>
<p>FIPSmeshuptimehardeningcontinues:thenode's peer port is opened explicitly everywhere, LAN anchors use the right port, direct peering between co-located nodes works again, dials fail fast instead of hanging, and a connectivity watcher re-applies anchors immediately when the network comes back.</p>
<p>FIPS startup is more reliable on nodes that have the packaged fips.service instead of Archipelago'sarchipelago-fips.service.Startupself-heal,onboarding,dashboardStart,andreconnectnowusethesystemdunitthenodeactuallyhas,soFIPSnolongerlookslikeitneedstobeinstalledwhenitonlyneedstobestarted.</p>
<p>AppscreensovertheFIPSmeshnowbindtheirrelayonlytothenode's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.</p>
<p>Companion app 0.5.25: a redesigned settings hub (three-finger tap opens it over the dashboard), seamless transport handoff with FIPS mesh settings, the wallet scanner reads dense invoice QR codes, app webviews clear the phone status bar with an HTTPS toggle on add/edit, and off-LAN loads fall back to the mesh URL instead of a dead LAN address.</p>
<p>Public-source preparation now includes a Nostr Git hosting plan using ngit, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.</p>
<p>Nodes no longer get stuck on "server starting up" after an update or reboot. The backend now reports ready immediately and recovers its apps in the background, and it always restarts itself if it ever goes down — the days-long "server starting up" hang is gone.</p>
<p>Installing apps no longer crashes the node. A recent change that made app screens reachable over the mesh was holding onto every app'sportinadvance,soinstallinganappcollidedwithitandtheport-cleanuptookthebackenddownandrolledtheinstallback.Installsarecleannow.</p>
<p>Thecompanionappcanreachyournode's screen from anywhere again. The recent security hardening locked down the node'smeshinterfacesotightlythatthedashboarditselfwasblocked—thephonewouldpairandconnect,thensitonablankscreen.Thenodenowexplicitlyopensitsownwebinterface(andonlythat)throughthemeshfirewalloneveryinstallandupgrade,sothephone's view of your node works out of the box, on any network, and can'tsilentlybreakinafutureupdate.</p>
<p>Thenode's web interface also answers on IPv6 everywhere it answers on IPv4 — the mesh runs entirely on IPv6, and one v4-only listener was enough to make a working connection show nothing.</p>
<p>Nodes now come back onto the mesh in seconds instead of minutes after their rendezvous anchor restarts: the fast-reconnect tuning proven on the phone this week is now baked into every node'smeshconfiguration,anditsurvivesupgrades.</p>
<p>Plugginginameshradionolongertrapsitinanendlessrebootloop.Thedevicedetectoritselfwascausingit:everyscanpulsedtheradio's reset line, the same board was probed twice under two names, and retries came so fast the radio never finished booting before the next reset hit. Detection now gives the board real time to boot, probes it once, backs off properly between attempts, and no longer fights the "device detected" popup for the port. Radios that could never connect now come up within a minute of being plugged in.</p>
<p>The Lightning channels screen now has All / Active / Pending / Closed tabs. Pending gathers everything in motion (opening, closing, force-closing — each with its own status dot and a link to the closing transaction), and Closed is a real history: how each channel ended, what settled back to you, and the closing transaction for each.</p>
<p>Sending bitcoin on-chain now puts you in charge of the network fee: pick Fast, Standard, or Slow (Standard is the default), or set your own target blocks or sats-per-vByte. The confirmation step shows the estimated fee for your chosen speed before any money moves.</p>
<p>Type on-chain amounts in whichever unit you think in — a sats/BTC switch on the amount field converts as you type.</p>
<p>Back up your seed by scanning it. Every recovery-phrase screen (onboarding, Settings, and the Lightning wallet seed) now has Words and QR code tabs — words always shown first. The QR for your node'srecoveryphraseusestheSeedQRstandard,sohardwarewalletslikePassportPrime,SeedSigner,andKeystonecanimportitwithasinglescan(aplain-textoptionremainsforwalletsthatreadthephraseastext).TheLightningseed's QR is plain text with an honest note: it'sanLND-formatseedthatrestoresintoLightningwalletslikeZeusorBlixt,notintohardwarewallets.</p>
<p>Thecompanionphoneapp(0.5.15)connectsdramaticallyfasterawayfromhome:acoldconnectover5Gdroppedfrom40+secondstoabout5.Firstconnectsnolongerstallonunreachablemeshdialhints,freshjoinsfailfastandretryinsteadofwaitingoutlongtimeouts,andthephonere-announcesitselfthemomentthenetworkarounditchanges.Thenodeside's mesh-join handling was hardened to match.</p>
<p>Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.</p>
<p>Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.</p>
<p>The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone'snativecamerahandlesQRscanning,andabrandedfull-screenloadershowswhilethemeshconnects.</p>
<p>MeshParty:twophonesscaneachother's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.</p>
<p>Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.</p>
<p>The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.</p>
<p>Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.</p>
<p>Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.</p>
<p>Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.</p>
<p>Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.</p>
<p>Apps keep running when you change how they'redisplayed.Switchinganappbetweenwindowedandfullscreenusedtoreloaditfromscratch(stoppinganyplayingmedia);theappnowstayslivethroughtheswitch,andeachappremembersitsownpreferreddisplaymode.</p>
<p>Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.</p>
<p>If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.</p>
<p>Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat'sbackgroundartworkshowsthroughagain.</p>
<p>PluginanyLoRaradioandthenodewalksyouthroughit.Asetupwindowappearseverytimearadioisconnected,showswhatfirmwareisalreadyonit(MeshCore,Meshtastic,orReticulumRNode—withitscurrentname,region,andchannelswhereavailable),andofferstwohonestchoices:"Set Up with Archipelago Settings"(apreviewscreenshowsexactlywhatwillbewrittenbeforeanythingtouchestheradio)or"Keep As Is"(theradioisuseduntouched,andyoucanhot-swapradiosfreely).Swappingsticksmid-sessionnowjustworks—includingReticulumRNodes,whichfreshinstallerimagesnowsupportoutofthebox.</p>
<p>OpeningaLightningchannelrightafterthenodestartsnolongerfailswithascaryrederror.ThenodequietlyretrieswhileLightningfinisheswakingup,andifit's still not ready you get a calm "still finishing its startup — try again shortly" notice instead.</p>
<p>Viewing a transaction works on every node now, including small ones. Nodes with pruned bitcoin storage can'truntheMempoolexplorerapp;transactionlinksnowopenyourchoiceofexternalexplorerinstead(tx1138.combydefault)—afteraclearone-timewarningthatathird-partyserverwillseewhichtransactionyoulookedup.SetyourpreferredexplorerinWalletSettings→thenewOn-chaintab.</p>
<p>ScanningaLightninginvoicewithyourphone's camera is far more reliable — dense invoice QR codes that the photo scanner missed are now read by the phone'snativebarcodeengine.</p>
<p>Thecompanionapp's pairing QR always contains an address your phone can actually reach. If you manage your node over a VPN (Tailscale), the QR used to embed the VPN address, and pairing silently failed; it now advertises the node'shome-networkaddress.</p>
<p>TheConnectedNodeslistrefreshesinstantly.Itpreviouslyfrozeforupto30secondsperofflinepeerwhilecheckingwho's reachable, one peer at a time; the checks now run all at once in the background while the list shows immediately.</p>
<p>Apps opened from inside a window (like a transaction from the wallet) now animate smoothly on top instead of loading invisibly underneath.</p>
<p>Settings-style windows keep their tabs pinned at the top and their buttons pinned at the bottom; only the middle scrolls. The wallet'stabsarenowChannels/Cashu/Fedi/Ark/On-chainsoallfivefit.</p>
<p>OntheTVscreen,menusnolongerflashopenandinstantlyclose.Andtheinterfaceneverfollowsyourcomputer's light/dark preference anymore — dropdowns and other native controls stay dark on every device.</p>
<p>Error messages tell you what'sactuallywrong:"Insufficient balance: need 80 sats, have 0 sats"nowreachesyourscreeninsteadof"Operation failed. Check server logs."</p>
<p>Muchquieterlogs:thenodenolongertriestostartcontainersthatarealreadyrunning(hundredsofharmless-but-alarmingerrorsperday),andanodethat's offline stops hammering unreachable servers every 30 seconds with rebuild attempts.</p>
<p>Phones pairing with the companion app connect over the node'sembeddedmeshforremoteaccess,withinstantQRpairingandper-deviceaccesstokens(contributedalongsidethisrelease).</p>
<p>Askyournodeanything,outloud.InstallPine(thevoiceassistantapp)alongsideHomeAssistantandeverythingwiresitselfautomatically:speechrecognition,thespeakingvoice,andaClaude-poweredbrain.Questionsaboutyournode—"what's the block height?","how many peers am I connected to?","is bitcoin synced?","what's my Lightning balance?"—areansweredinstantlyfromthenodeitselfwithoutcostinganything;anythingelsegoestoClaudeforarealconversation.Newmeshradiomessagesarereadoutonyourspeakerastheyarrive.</p>
<p>Pine's launcher page shows your node'slivestatusataglance:softwareversion,uptime,bitcoinsyncprogress,andmeshpeers.</p>
<p>Fixed:installingPinecouldsendHomeAssistantintoacrashlooponstartup(arecordtheinstallerwrotewasmissingatimestampfieldHomeAssistantrequires).TwonoisywarningsthatrepeatedinHomeAssistant's log every half minute are silenced too.</p>
<p>The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.</p>
<p>Turning on federation discovery now shows you exactly what you'reabouttosign:apanelexplainstheannouncementbeforeyourkeysignsit,youcanreviewthesigningdetailsanytimefromthediscoverabilitystrip,andthepanelfitsandscrollsproperlyonsmallphones.</p>
<p>Fixedabugonnodesusingthenewerapp-managementenginewhereBitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text "/bin/bash"), which broke the node'sBitcoinstatusdisplay,Lightning's connection to the chain, and any app that reads Bitcoin data.</p>
<p>Bitcoin'saccesscredentialsalsomovedoutoftheprocesscommandlineintoaprotectedfile,sothey're no longer visible to other software on the node.</p>
<p>Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.</p>
<p>On the phone home screen, the wallet card moved up to sit right under My Apps.</p>
<p>Home Assistant updated to 2026.7.3, which keeps voice satellites (like Pine'sspeaker)connectedreliably.</p>
<p>Paybypointingyourcamera:thewallethasanewScanbutton(onthewalletcardandinsideboththeSendandReceivewindows)thatreadsanypaymentQRcode—Lightninginvoices,Bitcoinaddresses,Cashutokens,andFedimintinvites—andtakesyoustraighttotherightsendorredeemscreenwitheverythingfilledin.Italsounderstandstheanimated,multi-partQRcodessomewalletsshowforlongpayloads.Ifyourbrowsercan't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone'scameraandreadsthecodefromthephotoinstead.</p>
<p>TheTVscreengotacompleteoverhaul.Adeepbugmadethedisplayfreezeontheintroartworkon4KTVs—that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.</p>
<p>You can now choose how big the interface renders on your node'sattachedscreen:Settings→DisplayoffersAuto(recommended),LargeUI,Balanced,andNative—changingitappliesimmediately.</p>
<p>TheLightningsetupguidancenowreadsthesameeverywhere:"Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."</p>
<p>MeetPine,yournode's voice assistant: a new app in the App Store that gives your node ears and a voice — speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.</p>
<p>Your node can now program its MeshCore radio'sRFsettings—frequency,bandwidth,spreadingfactor,andcodingrate—fromMesh→Devicesettings.Radiosthatwereflashedwithmismatchedsettingscouldhearthatotherradiosexistbutneverdecodetheirmessages,anduntilnowtheonlyfixwasaseparatephoneapp.Setthevaluesonceandthenodeprogramstheradioautomatically(itrestartsoncetoapply);everyradioonyourmeshmustusethesamevaluestotalktoeachother.</p>
<p>Wi-Fisetupnowhealsitselfonoldernodes.Somenodessetupbeforeamid-yearfixcouldn't connect to a Wi-Fi network from the screen — it failed with a permissions error — because the piece that lets the node manage networking on your behalf was missing. Nodes now put that piece in place automatically on startup, so "scan, pick a network, type the password, connect" works without reinstalling.</p>
<p>Your node rejoins the mesh within seconds after an update. Applying an update briefly restarts the mesh service, and previously a node could sit disconnected from other nodes for up to five minutes before it retried.</p>
<p>The TV screen now fits your television. On a large or 4K TV the interface rendered tiny with no way to zoom on a keyboard-less screen; it now sizes itself to a comfortable, readable scale automatically (and small laptop panels are left unchanged).</p>
<p>More TV-screen polish: the built-in assistant shows its dark theme instead of bright white panels, the on-screen hint for switching between the kiosk and a terminal now points at the right keys, the welcome logo no longer occasionally renders as garbled characters, and an accidental tap of the power button no longer shuts the node down — hold it to power off on purpose.</p>
<p>Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle.</p>
<p>Wi-Fi setup now heals itself on older nodes. Some nodes set up before a mid-year fix couldn'tconnecttoaWi-Finetworkfromthescreen—itfailedwithapermissionserror—becausethepiecethatletsthenodemanagenetworkingonyourbehalfwasmissing.Nodesnowputthatpieceinplaceautomaticallyonstartup,so"scan, pick a network, type the password, connect"workswithoutreinstalling.</p>
<p>Onaphone,thepeerfilesscreentellsyouhowyou're connected again. The badge showing whether a peer'sfilesarearrivingoverthefastmeshoroverTorwasonlyvisibleondesktop—onnarrowscreensitdisappearedentirely.Itnowappearsnexttothepeernameonmobiletoo.</p>
<p>Yournode's mesh settings can no longer be written in a way that breaks the mesh. The configuration file used to be assembled as free-form text, where one wrong setting would stop the mesh service from starting and quietly drop your node off the network. It'snowgeneratedfromacheckeddescriptionofthefile,withteststhatverifytheexactoutput.</p>
<p>Whenyournodehastroublereachinganothernode,thelogsnowrecordtherealreasoninsteadofagenericsummary.Afailuretoopenapeer's files previously logged only "Failed to connect to peer" and threw away the actual cause, which made these problems very hard to diagnose. Nothing changes on screen, and no internal detail is exposed.</p>
<p>Behind the scenes: the installer image now builds its mesh component at a fixed, known version instead of whatever upstream had published that day, so two images built from the same source are identical.</p>
<p>Fixed a failure loop where a node that lost power or was moved could get stuck on a blank "can'treachyournode" screen forever: startup recovery no longer spends minutes retrying containers that no longer exist, and a genuinely large recovery is no longer cut off half-way and forced to start over. The node now reaches its login screen even after the messiest shutdown.</p>
<p>Phone tunnel setup (WireGuard) is now dependable: the QR screen automatically retries while a fresh install is still settling instead of dead-ending at "failedtofetch", and if your node has moved to a different network the QR and downloadable config now carry the node's current address instead of the old one.</p>
<p>Fixed the white screen some laptop displays showed right after the intro on v1.7.104.</p>
<p>The companion phone app no longer suggests installing the companion app from inside itself.</p>
<p>The Tor page now lists onion addresses only for apps you actually have installed — fresh installs no longer come with six pre-made addresses for apps that were never set up.</p>
<p>Running archipelago --version or --help on the command line now prints and exits instead of silently starting a second copy of the node, which could briefly disrupt running apps.</p>
<p>Behind the scenes: installer image builds now stop loudly if VPN components are missing instead of producing a broken image, and a background file-permission sweep runs far less often, reducing disk churn on busy nodes.</p>
<p>Software updates are now much safer to receive: the node will never install an update that isn't completely downloaded and verified byte-for-byte, closing a rare bug where an interrupted or cancelled download could leave a node unable to start.</p>
<p>If a freshly installed update does fail to start, the node now notices and automatically restores the previous working version by itself — no manual rescue needed.</p>
<p>The Electrum server now works with whichever Bitcoin you run: it finds Bitcoin Knots or Bitcoin Core automatically instead of assuming Knots.</p>
<p>While the Electrum server is first building its index, its waiting screen now shows the ElectrumX app icon and live progress.</p>
<p>Connecting from the phone app no longer replays the intro cinematic on a loop: signing in after scanning the pairing QR could accidentally trigger "ReplayIntro" instead of logging you in. The companion app now lands you straight on your dashboard, and the Android app waits for the login screen to be ready before it types your password.</p>
<p>Pressing Enter in any password box now does what you expect — it signs you in or moves to the next field, and can no longer "click" a nearby button by mistake when using a controller or the companion app.</p>
<p>The public demo no longer interrupts you with an "UpdateAvailable" popup that reset the site back to the intro — demo visitors simply get the newest version on their next visit.</p>
<p>The password you choose during setup is now truly your node's password: it also becomes the system login for console and SSH access, instead of leaving the factory default in place. If you ever renamed your node and the TV screen went black on the next boot, that's fixed too — renaming no longer breaks the kiosk display.</p>
<p>Setting up Lightning is now a guided journey: a fund-your-wallet step that shows a live countdown while Bitcoin syncs, suggested channels you can open straight into the Zeus mobile wallet with one tap, and a "finishsetup" prompt that walks you to the end — goals now complete when you've actually done the steps, not just when apps happen to be running.</p>
<p>Pair your phone by pointing it at the screen: the companion app now connects by scanning a QR code — scan, and it fills in your node's address and logs you in. The App Store has a banner to grab the Android app, and the pairing flow can now also set up secure remote access so your phone reaches home from anywhere.</p>
<p>First installs are far more dependable: app downloads that stall now retry instead of hanging forever (the old "firstinstallfails,thesecondworks" pattern), big multi-part apps show their real download progress instead of sitting at "Preparing", Lightning no longer fails its first install over temporary hiccups, and a brand-new node now comes up with its core apps — file cloud and ecash wallet — even with no internet connection.</p>
<p>The installer image is about 160MB smaller and gets to a working screen faster, because the apps bundled for offline setup are now compressed.</p>
<p>The first-run experience keeps its magic: the typing intro is back on fresh installs and can no longer be cut short by a mid-play refresh — updates now politely wait for the cinematic to finish — and dark backgrounds stay dark instead of flashing black or white.</p>
<p>Your backups now include your secrets — including the key that protects your Lightning wallet's recovery seed — and there's a Download button to take a copy off the node; the seed-backup reminder now actually opens the backup flow when you tap it.</p>
<p>Networking Profits grew into a full dashboard, network cards keep their action buttons in reach on every screen size, "ConnecttoMesh" goes to the right page instead of a dead end, and the identity pages got a round of mobile polish.</p>
<p>Behind the scenes: apps that report their own health are no longer second-guessed by a port probe (fewer false "restarting" states), and pressing arrow keys or a gamepad is once again the only thing that shows the controller focus ring.</p>
<p>The wallet speaks Ark: a new Ark tab shows your Ark balance and history, you can send and receive over the Ark protocol, pay Lightning invoices from your Ark balance, and Ark payments appear in the transactions view with their own filter chip.</p>
<p>Every app you install now automatically gets its own private .onion address — your apps are reachable over Tor a few seconds after install, with no manual "AddService" step.</p>
<p>"AddService" in the Tor panel now works for every app, not just a fixed list — the node reads the app's actual web port, so apps like Gitea, Jellyfin, Nextcloud, and Uptime Kuma no longer fail with "seeserverlogs".</p>
<p>Renaming your node now genuinely renames it everywhere: the machine's hostname, its .local network name (re-announced immediately), the local hosts file, and the HTTPS certificate all follow — so http and https links using your node's name keep working right after a rename.</p>
<p>The node no longer mistakes a VPN tunnel for its own address. On fresh installs with NetBird, apps could launch on an internal 10.x address instead of your LAN IP; the node now reads its address from the actual network route, fixing app launch links, generated app configs, and VPN setup.</p>
<p>Your cloud got a real layout: Apps-style tabs with categories for Folders, My Files, and Peer Files, readable file rows, a search that also finds files shared by your federated peer nodes — and music now opens in the bottom-bar player instead of a broken preview window.</p>
<p>The first-login experience flows again: the dashboard entrance animation is back — and you can actually hear it now (its sound was silently swallowed before, including on replays) — "ReplayIntro" in Settings actually replays it, opening a direct link to an inner page no longer detours through the splash screen, the login screen keeps the intro video until your first login (switching to rotating backgrounds after), and the intro video streams three times lighter so it starts instantly.</p>
<p>Changing DNS settings no longer blanks the page, and the DNS and WiFi dialogs now cover the whole app instead of only the right panel.</p>
<p>The public demo is richer and truer: the intro plays on every fresh visit, Ark wallet flows, working DNS and Tor service management, and a library of peer content with previews that never break.</p>
<p>Assorted fixes: failed installs clean up after themselves properly, and the transactions view fits mobile screens (capped at 60% of the visible viewport).</p>
<p>Bitcoin now supports multiple versions of both Bitcoin Core and Bitcoin Knots: install the version you want, switch between them, pin a version, or let it auto-update — and switching is designed to be safe, with no surprise resyncs.</p>
<p>Lightning grew up: your LND wallet's recovery seed is captured at setup and kept as an encrypted backup you can reveal from Settings, there's a new Channels tab with a fee control when opening channels, and on-chain and Lightning balances now show side by side.</p>
<p>Installing Lightning (and other Bitcoin-dependent apps) on a fresh node no longer fails repeatedly — the node now waits until Bitcoin is genuinely ready to answer before starting them, and Bitcoin sizes its storage to your actual disk and its memory cache to your RAM, so small machines stop swapping and stalling.</p>
<p>The wallet understands more money: Cashu v4 tokens are supported, you can pay for a peer's files from either your Cashu or Fedimint ecash, and the Transactions view now shows your Lightning, Cashu, and Fedimint activity together — with a payment confirmation screen and an automatic refund if a purchase fails.</p>
<p>Mesh radios got a major upgrade: Meshtastic direct messages are now true end-to-end-encrypted radio messages that interoperate with off-the-shelf Meshtastic phone apps, your radio's region and a shared channel are provisioned automatically, and a new setup window appears when a radio is plugged in — with board pictures, full radio settings, and signal-strength indicators.</p>
<p>Reticulum joins as a third mesh radio protocol with RNode LoRa hardware support, including sending images and voice messages over the radio — and every chat message now carries a small pill showing how it travelled (Mesh, FIPS, or Tor).</p>
<p>Your node can manage an OpenWrt router: set up its internet uplink from the UI with a Wi-Fi network scan, turn it into a TollGate pay-for-Wi-Fi hotspot with a real captive portal, and sweep the router's earnings into your node's wallet. The gateway's status appears on the Home screen's Network tile.</p>
<p>Peering is now trust-aware: "InviteaPeer" grants view-only Observer access while "LinkYourNodes" grants Trusted access, incoming requests ask for your confirmation with an optional message, Node Visibility is a single clear switch plus a list of discoverable nodes you can peer with, and the Fleet view shows your trusted nodes' health.</p>
<p>Updates and apps are verified end-to-end: release updates are cryptographically signed and checked against a key baked into your node, app definitions arrive via the signed catalog, and container images are checked against trusted sources before anything installs or runs.</p>
<p>Dozens of reliability fixes: failed installs no longer leave phantom app cards, uninstalling can't hang forever, apps you stopped stay stopped, crashed apps heal themselves (even "running" containers whose process actually died), the login page no longer refresh-loops, and the mobile layout fits real phone screens instead of hiding the last row behind the browser bar.</p>
<p>Ask your node things over the radio: send "!archy" for node status with no AI involved, or "!ai<yourquestion>" in a direct message for an AI answer that comes back on the same path it arrived — with a model dropdown (Haiku, Sonnet, or Opus) and an "alwaysallow" list in the Mesh AI Assistant panel.</p>
<p>The off-grid mesh radio no longer posts cryptic identity codes ("ARCHY:") to the shared public channel every minute, and mesh contacts take care of themselves: new radios you hear are added automatically, "ClearAll" really removes contacts (they return when in range), each contact shows a reachability dot, and the Peers list has a search box.</p>
<p>You can message standard meshcore phone apps and they can message you — readable text both ways, private replies instead of public-channel broadcasts. Federated Archipelago nodes now appear on the Mesh Map.</p>
<p>Apps open as an overlay on top of whatever page you're on, in every display mode, instead of yanking you to a different screen; the Services tab groups apps by category with proper icons.</p>
<p>BTCPay Server keeps its plugins across restarts, connects to your node's own LND out of the box, and its invoices stay payable over private Lightning channels.</p>
<p>Fedimint federations show up in Wallet Settings again (the client app's configuration error is fixed), and Wallet Settings has tabbed sections for Cashu and Fedimint.</p>
<p>The phone companion app can upload and download files, edit saved server entries, opens non-embeddable apps in an in-app browser, and got a proper round launcher icon.</p>
<p>Six placeholder "apps" that were just web bookmarks are gone from the store, the Bitcoin dashboard works fully offline, Gitea opens on the right port, and mempool, strfry, and Electrum stopped their restart loops.</p>
<p>Kiosk displays: HDMI audio no longer stutters, and a bad display-clone state no longer sticks after reboot.</p>
<p>Consistent dropdowns, toggles, tabs, and modal styling across the UI; in Mesh chat, scrolling the conversation no longer also scrolls the contact list; "AppUpdates" and "AppRegistry" sit directly under Account in Settings; and a fresh node no longer reinstalls apps just because their definition file exists on disk.</p>
<p>Your node can now hold Fedimint ecash as well as Cashu. Wallet Settings now has tabbed sections for each: keep your list of trusted Cashu mints, or paste a Fedimint invite code to join a federation, and the home wallet card shows both your Cashu and Fedimint balances side by side. A new "FedimintClient" app in the catalog powers the federation side.</p>
<p>You can now buy files shared by another node, right from their cloud. When you open a peer's paid file you get a simple "Buythisfile" picker with several ways to pay — instantly from this node's ecash balance, from your node's own Lightning wallet, on-chain from your node, or by scanning a Lightning QR code with any outside wallet. Once payment settles, the file downloads automatically.</p>
<p>Your node can now act as an AI assistant on the off-grid mesh radio network. If your node has a local AI model available (via Ollama), other people on the mesh can ask it a question by starting their message with "!ai" and get an answer back over the radio — handy where there's no internet. A new Mesh assistant panel lets you turn this on or off and shows whether a local AI model was detected.</p>
<p>You can now view your node's 24-word recovery phrase whenever you need it. Settings has a new "Recoveryphrase" option that, after you confirm your password (and 2FA code if you use one), reveals the words behind a tap-to-show blur with a copy button — so you can write them down and store them safely offline.</p>
<p>Setting up a brand-new node is smoother and less alarming. If the node is still starting up while you generate or confirm your recovery phrase, it now quietly waits and retries instead of flashing a scary error, and offers a clear "Tryagain" button only when something genuinely goes wrong. The final setup screen also shows a gentle "securingyourprivateconnection…" status that turns to "ready" on its own, so you can tell the encrypted transport is coming up rather than stuck.</p>
<p>The NetBird VPN app now actually logs in. It was failing to reach its sign-in screen because the dashboard needs a secure (HTTPS) connection that wasn't being provided; the node now serves it over HTTPS and opens it in a browser tab, so the login flow completes.</p>
<p>When you use your phone to remote-control a node's attached screen, two-finger scrolling now works inside apps and panels, not just the main page. And tapping an app that's meant to open in an external browser now hands the link to your phone to open there, instead of trying to open it on the (often unattended) attached display.</p>
<p>You can now choose whether your node shares Bitcoin block headers over the mesh. The Mesh Bitcoin panel has new switches to announce headers to peers and to accept headers from them, and your choices are remembered.</p>
<p>Version numbers now display cleanly everywhere. In a few places the interface was showing a doubled "v" (like "vv1.7.98"); it now always shows a single, tidy version label.</p>
<p>The "Back" buttons throughout the cloud and other detail screens now look and behave consistently on both desktop and mobile, including when browsing another node's files.</p>
<p>For advanced testing, Settings now includes an optional "update&appsource" choice between the usual trusted origin and an experimental peer-to-peer (DHT swarm) mode that pulls updates and app content from other nodes first, falling back to the origin automatically. The trusted origin remains the default.</p>
<p>Apps that crash now recover on their own. Multi-part apps like Immich and IndeedHub could have one of their pieces stop and stay stopped until the whole node was rebooted; the node now checks every couple of minutes and restarts any crashed piece automatically (while still leaving apps you deliberately stopped alone).</p>
<p>The on-screen kiosk display can no longer slow the whole node down. On machines without a graphics chip the kiosk browser could spin a CPU core at full tilt, starving everything else (including the wallet, which then timed out); it's now capped and uses lighter rendering on those machines.</p>
<p>If an update download fails, you're taken back to the Download button to retry, instead of being stranded on an Install button for an update that didn't actually finish downloading.</p>
<p>Your node's identity is clearer and always visible: Settings now shows your Node DID on every node (it previously only appeared if your browser had cached it) plus your node's npub, both with copy buttons. There's also a terminal tool to cryptographically prove all your node's keys come from your one seed phrase.</p>
<p>The "allnodesoverTor" group chat sends quickly now — the "sending" spinner clears as soon as the reachable nodes have the message, instead of hanging on a slow or offline node.</p>
<p>Message notifications now have a close button and open the relevant chat when tapped.</p>
<p>The encrypted mesh transport (FIPS) turns itself on automatically after setup — no button to press — and connects to peers more reliably (it retries and keeps connections warm), so node-to-node features use the fast path more often instead of falling back to Tor.</p>
<p>Your chat history with other nodes is saved reliably and now encrypted on disk, so it survives restarts and updates and can't be read from a stolen drive (only clearing chat removes it).</p>
<p>Peer media shows a "connecting" loader before a video or audio file plays, and audio errors are accurate instead of blaming File Browser.</p>
<p>The Fedimint app now displays with its proper styling, and the Connected Nodes screen stays compact — it shows a few nodes and scrolls, you can tap a node to jump to it in Federation, or tap Message to open its chat.</p>
<p>App updates can now arrive on their own without waiting for a full system release, so individual apps can be improved and shipped faster.</p>
<p>The Bitcoin sync status on the home screen no longer disappears for a moment when it refreshes. If the node was briefly busy, the panel used to vanish and pop back; it now stays put and simply shows "Updating…" until the next reading arrives, while a genuinely stopped node still correctly shows as not running.</p>
<p>Bitcoin sync progress on the home screen now updates more promptly, so the percentage and block height keep pace with the node instead of lagging behind.</p>
<p>The Lightning wallet "connectyourwallet" screen loads its details and QR code again across all nodes, instead of failing to fetch them.</p>
<p>Your list of trusted nodes is now clean: the same node no longer appears several times under different names, and removed nodes stay removed. In chat, a node that previously showed up as two separate contacts now appears just once.</p>
<p>Browsing another node's cloud is smoother: music and video files from a peer now preview and play properly (including seeking partway through), and the connection now shows a small badge telling you whether it's using the fast encrypted mesh or the slower Tor network.</p>
<p>Opening "MyFolders" in the cloud now shows a clear, friendly message when the file app isn't running, instead of a confusing error.</p>
<p>The Electrum server app opens on its own once it's ready, instead of sometimes leaving a loading spinner stuck on top of the screen.</p>
<p>The Fedimint app now displays with its proper styling and icons, instead of appearing unstyled with a missing image.</p>
<p>The Mempool app now connects to your Bitcoin node whether the node is Bitcoin Core or Bitcoin Knots, instead of only working with one of them.</p>
<p>Nodes start up cleanly after a reboot. On some boots the node's main service was trying to start before its data drive had finished mounting, so it failed and retried about twenty times over roughly five minutes — showing a wall of "Failedtostart" messages — before finally coming up. It now waits for the data drive to be ready first, so it starts on the first try.</p>
<p>The background images throughout the interface now load faster — they've been made significantly smaller with no loss of quality.</p>
<p>The screen attached to your node now shows the normal Archipelago interface and your dashboard after you sign in, instead of a separate, stripped-down grid of app icons that could appear in its place. That extra screen has been removed so the attached display matches what you see everywhere else.</p>
<p>On a brand-new node, the attached screen now walks through the same welcome and setup steps you'd see on a phone or laptop, and shows the normal sign-in screen once the node is set up — so the on-device display always matches the rest of the interface.</p>
<p>When adding a FIPS network anchor, you can now choose whether it connects over TCP (for a public anchor reached across the internet) or UDP (for one on your local network), instead of it always assuming the local-network option.</p>
<p>Behind the scenes, a new automated two-node test now exercises real node-to-node features — browsing another node's shared files and handling a removed node — against live nodes before each release, so node-to-node problems are caught earlier.</p>
<p>Browsing another node's shared files now works over the fast encrypted mesh. Opening a peer's cloud could fail with a generic "Operationfailed" message because the request for their file list wasn't permitted over the mesh and came back as "notfound" — and it never retried over Tor. The mesh now serves the file list directly, and if a peer can't answer over the mesh the node automatically falls back to Tor instead of giving up.</p>
<p>Nodes you remove from your federation now stay removed. Previously a deleted node could quietly come back the next time you synced with another node that still listed it. Removed nodes are now remembered as removed and won't reappear on their own — only if you add them back yourself.</p>
<p>The app credentials pop-up now appears as a normal centred box with a dimmed background over the whole screen, instead of stretching to fill the entire screen.</p>
<p>Your node now joins the private encrypted mesh network on its own. A wrong built-in setting meant nodes were quietly never reaching the shared mesh meeting point, so everything between nodes fell back to the slower Tor network. Every node now connects to the mesh automatically on startup, so node-to-node features like file sharing use the faster encrypted mesh first and only fall back to Tor when a peer is genuinely offline. (Confirmed live: a node with its mesh setting wiped re-connected to the mesh by itself within a second of starting.)</p>
<p>You can now bring the mesh networking software up to the latest stable version straight from the node, with one action — it fetches the new version, checks it's genuine before installing, and restarts the mesh on its own. (Confirmed live end to end: a node on an older build was upgraded to the current stable release and rejoined the mesh automatically.)</p>
<p>The Lightning wallet screen connects again on nodes where it was showing a "failedtofetch" error instead of your balance and channels. The wallet app and the node now talk to each other correctly, and the connection quietly repairs itself if its details drift after a restart.</p>
<p>Receiving Bitcoin and Lightning works again on nodes where the Lightning wallet was stuck locked. After some updates the wallet could come back locked with a password the node no longer had, so "generateareceiveaddress" kept failing with a "walletislocked" message that nothing could clear. The node now detects this and repairs itself automatically.</p>
<p>Each node now secures its Lightning wallet with its own unique, randomly generated password instead of a shared built-in one, and remembers it safely so the wallet unlocks on its own after every restart or update — no more getting stuck locked.</p>
<p>If a wallet is found locked with an unrecoverable password, the node rebuilds it cleanly so Bitcoin and Lightning start working again. (On these early-access nodes the wallet holds no funds, so nothing is lost — a wallet locked with an unknown password was already inaccessible.)</p>
<p>The self-repair was validated end to end on live nodes: a stuck, locked wallet was detected, rebuilt, and came back unlocked on its own, and stayed unlocked across restarts.</p>
<p>The Electrum server app no longer flashes a "can't connect, try again" error over its loading screen while it'sstillcatchingup.IfElectrumXisbuildingitsindexorwaitingontheBitcoinnode,younowjustseethesyncprogress,andtheappopensonitsownonceit's ready.</p>
<p>Behind the scenes, the reboot-survival test now confirms the whole system is genuinely healthy after a restart — every app reachable, updates not stuck, core services answering — instead of only checking that containers came back, so update-related problems are caught before shipping.</p>
<p>Settings → What'sNewnowliststhenotesforeveryrecentreleaseagain.Thescreenhadquietlyfallenseveralversionsbehind,sothelasteightreleasesofchangesweren't showing up there — they'reallbacknow,andareleasecheckkeepsitfromdriftingagain.</p>
<p>Appsyou've installed now reliably show their "Open" button again. Some apps — including Jellyfin, BTCPay Server, Fedimint, Gitea and Portainer — were running fine but their launch link sometimes went missing, so there was no way to open them from the home screen. They now open correctly.</p>
<p>Receiving Bitcoin is more dependable: if the wallet'sinternalconnectiondetailsdriftafterarestart,itnowrepairsthemonitsown,andanyerroritdoeshitisreportedclearlyinsteadofasagenericfailureoramisleading"wallet locked"message.</p>
<p>"Open in a new tab"fromthecompanionappnowopenstheappinyourphone's browser, instead of doing nothing. The normal mobile browser keeps working as before.</p>
<p>The login/credentials pop-up on phones is once again a centered, properly sized window rather than stretching the full height of the screen.</p>
<p>The Electrum server now recovers on its own if its index ever gets corrupted, and shows a clear progress screen (with percent complete and block height) while it builds its index, instead of a blank or broken page.</p>
<p>Software updates are more reliable on slow internet connections — downloads are given much more time to finish before giving up.</p>
<p>The AI assistant looks the way it always did again: no extra back button or close button on phones, and the desktop view fills the whole screen without a gap at the bottom.</p>
<p>System updates are much more reliable: updates that previously got stuck partway or failed to install now complete cleanly, and a failed update can no longer block all future updates.</p>
<p>After an update, the system now checks itself correctly on every node type, so working updates are no longer mistakenly undone.</p>
<p>Generating a Bitcoin receive address works again on nodes where a network proxy previously got in the way.</p>
<p>The Lightning wallet now recovers and unlocks itself properly after restarts.</p>
<p>AIUI now loads immediately again instead of waiting on a production availability probe and cache-busted iframe URL, restoring the lighter launch behavior from before the regression.</p>
<p>Bitcoin receive now uses LND'sGET-basednewaddressflowwiththenativeSegWitaddresstype,fixingthe501MethodNotAllowedresponsefromthepreviousPOSTattempt.</p>
<p>BitcoinreceivenowcallsLND's on-chain address endpoint with the correct REST method, and backend failures keep the specific address-generation error instead of collapsing into the generic operation-failed message.</p>
<p>App launch credential interstitials now render as true full-screen overlays, and the launcher loading indicator uses the neutral brand palette instead of a blue spinner.</p>
<p>Fleet now preserves the last known node list, alerts, and selection locally while telemetry refreshes in the background, so the dashboard no longer blanks on tab switches or update scans.</p>
<p>Connected nodes and identities now reuse their last loaded data instead of reloading the visible list every time the user revisits the tab.</p>
<p>The Fleet matrix and detail views now show actual node names and host information instead of raw node id prefixes.</p>
<p>The network map only redraws when its graph data actually changes, which stops the D3 scene from visually resetting on every refresh tick.</p>
<p>Mobile federation and system-update actions now stack full width, and the ElectrumX app health check allows a long startup window so slow sync nodes do not restart mid-index.</p>
<p>ElectrumX now runs with less cache pressure and more memory headroom, reducing the restart loop seen during sync catch-up.</p>
<p>Portainer is pinned to 2.19.4 instead of latest, avoiding schema-drift restarts from surprise image updates.</p>
<p>LND receive-address creation now asks for a native SegWit address and returns clearer wallet/readiness failures when an address is not available.</p>
<p>Fleet telemetry now carries server name, hostname, and server URL, and the Fleet dashboard shows those names instead of hashed node ids.</p>
<p>Trusted federation peers are still auto-added transitively, but the local node no longer imports itself back into the fleet list.</p>
<p>Bitcoin trusted-node relay approvals now generate restricted txrelay credentials and restart the active Bitcoin backend so the new RPC whitelist is live.</p>
<p>Bitcoin Core now matches Bitcoin Knots for restricted relay RPC support, including txrelay secret injection and sendrawtransaction-focused permissions.</p>
<p>The Bitcoin UI companion image is pinned for OTA updates, and container scanning now avoids getting stuck busy after timeout or error paths.</p>
<p>App launch metadata now follows typed manifest launch interfaces more consistently, keeping catalog entries aligned with their runtime ports and launch surfaces.</p>
<p>Unsupported app surfaces were removed from the release path, including revoked OnlyOffice metadata and the unvalidated Saleor surface.</p>
<p>Mobile and desktop app surfaces received release polish: stricter production build typing, safer mesh desktop/tablet scrolling, improved mobile app layout, and a Home system card link that goes directly to Monitoring.</p>
<p>The Bitcoin UI avoids false stale/reconnecting messages when fresh block snapshots advance, and deploy tooling now skips local scratch/upload artifacts while bounding optional IndeedHub fixups.</p>
<p>Saleor storefront proxying forwarded the correct external host and media paths, fixing Server Actions origin checks and product image optimizer failures.</p>
<p>The storefront received an internal media origin so rewritten media URLs resolve inside the Podman network without exposing private API ports to browsers.</p>
<p>Saleor storefront installs switched to the prebuilt registry image instead of building Next.js on-device, avoiding build failures during stack installation.</p>
<p>Existing Saleor stacks were repaired on adoption by recreating missing storefront containers, forcing the app to bind on all interfaces, and resolving nginx upstreams after restarts.</p>
<p>Saleor storefront proxying falls back to the direct request scheme when forwarded protocol headers are absent, fixing direct local launches on port 9011.</p>
<p>Public proxy support remains intact by still honoring forwarded HTTPS headers for Nginx Proxy Manager domains.</p>
<p>Saleor was published as a recommended commerce stack with storefront, dashboard, API, worker, database, cache, Mailpit, and Jaeger services.</p>
<p>Saleor launches opened the storefront while dashboard credentials stayed visible in Archipelago, and public storefront domains received same-origin GraphQL proxying.</p>
<p>NetBird launches now stay on the unified dashboard/proxy origin at port 8087 instead of following stale server URLs on 8086.</p>
<p>NetBird proxy routing no longer depends on a hard-coded rootless Podman gateway IP and now includes the upstream management proxy gRPC path.</p>
<p>Mobile credential prompts keep long credential lists scrollable and the Cancel/Continue buttons reachable in both My Apps and the mobile icon grid.</p>
<p>Android app-session popups hand external login/signup windows to the system browser instead of dropping them inside the WebView.</p>
<p>Saleor first-use credentials are shown in Archipelago before launch and in App Details, instead of leaving users at an unexplained dashboard login.</p>
<p>NetBird embedded login now uses upstream-compatible signing-key behavior and sends ID tokens to the management API, fixing post-signup Unauthenticated states.</p>
<p>Transient unnamed Podman helper containers are hidden from My Apps so generated names no longer appear as user applications.</p>
<p>Apps with generated first-use credentials now show them in Archipelago before launch and in App Details.</p>
<p>NetBird API and OAuth routes now proxy through the stable host-published server port, and the embedded IdP keeps upstream-compatible signing-key refresh settings while the dashboard sends ID tokens to the API so signup no longer lands in an Unauthenticated dashboard state.</p>
<p>Transient unnamed Podman helper containers created during app installs are hidden from My Apps, so random generated names like eager_keldysh no longer appear as applications.</p>
<p>Mobile App Store categories are now visible as horizontal chips above the tab bar, Discover is reachable on mobile, category choices update the actual view, and apps that require a real tab open directly from the icon tap.</p>
<p>NetBird repair now rewrites the unified-origin config and recreates the browser-facing proxy/dashboard while preserving existing control-plane data.</p>
<p>Desktop dashboard scrolling hands focus back from the sidebar to the main content when the pointer or wheel moves over the main pane.</p>
<p>App-session right panels now re-focus the iframe after load and when the frame area is activated, so scrolling works immediately after selecting an app or switching tabs on shorter screens.</p>
<p>NetBird now uses a unified local launch origin on port 8087 that serves the dashboard and proxies auth/API routes to the server, fixing the Unauthenticated and 404 logout/login loop.</p>
<p>Existing NetBird installs are repaired during adopt/start by rewriting the config files and creating the missing dashboard/proxy containers while preserving data.</p>
<p>Mobile apps that block iframe embedding now open directly in a browser tab instead of first landing in a broken in-shell webview.</p>
<p>App Store search covers all apps while searching, My Apps search can surface matching installable App Store entries, and mobile My Apps/Websites tab switching updates the view reliably.</p>
<p>NetBird installs prefer a 100.x tailnet address when available, and app sessions gained iframe auto-focus plus a scroll host for right-frame scrolling.</p>
<p>Home status cards are calmer and more honest now. System, VPN, Bitcoin, and FIPS values keep their last known good state while route changes or short RPC failures are in flight, so the dashboard no longer flashes false "not configured" or "not running" states during normal refreshes.</p>
<p>Home, Web5 Monitoring, and the full Monitoring page now agree on the headline CPU, memory, disk, uptime, and load numbers. The UI uses one live system-stat snapshot for the visible cards while keeping the Monitoring page'shistoricalstoreforcharts,alerts,andcontainerhistory.</p>
<p>ThemissingWhat's New history is filled in through this release, including every curated entry from v1.7.44-alpha through v1.7.66-alpha.</p>
<p>Bitcoin lifecycle specs are aligned again across Rust, first boot, and reconcile. Bitcoin Core/Knots get the intended memory headroom on normal hosts, and pruned Knots uses a larger dbcache when the node has enough RAM, improving IBD throughput without raising pressure on low-memory machines.</p>
<p>ElectrumX/electrs lifecycle specs now use the same memory policy everywhere, reducing drift between fresh installs, app lifecycle actions, and reconciliation.</p>
<p>Nginx Proxy Manager stale-port repair now catches stopped or Created Podman records that still remember old port mappings. That means a stuck record can be removed and recreated before it blocks the current NPM ports.</p>
<p>Live recovery on the field node preserved the existing Nginx Proxy Manager data directory while recreating only the stale container metadata with the current 8081, 8084, and 8444 host ports.</p>
<p>Orchestrator-backed app starts now run the same pre-start repair path as the legacy Podman start flow. Nginx Proxy Manager can clean up stale port metadata before the orchestrator tries to bring it online.</p>
<p>Diagnostics confirmed host nginx was healthy while Nginx Proxy Manager itself had no listeners on its expected ports, narrowing the outage to NPM container lifecycle repair instead of the system proxy.</p>
<p>Authenticated update applies are no longer throttled so aggressively during troubleshooting. The System Update page now allows legitimate retry flows without immediately running into 429 Too Many Requests.</p>
<p>The release still includes the corrected backend rebuild protection, so OTA artifacts are built from the fresh Rust binary instead of an older compiled version.</p>
<p>The release script now rebuilds the backend after bumping the version and before hashing artifacts. OTA manifests no longer point at a stale backend binary.</p>
<p>This corrected the previous stale-artifact issue and carries the Nginx Proxy Manager stale-port repair in a backend binary that nodes can actually install and run.</p>
<p>Nginx Proxy Manager start and restart now repair stale Podman containers that still publish the admin UI on host port 81, which conflicts with host nginx on updated nodes.</p>
<p>The repair recreates only NPM container metadata while preserving its persistent data and using the current 8081, 8084, and 8444 host mappings.</p>
<p>Multi-container stack installs stay in Installing for up to 20 minutes while dependency containers are being pulled and prepared. BTCPay no longer appears to vanish after two minutes while Postgres and NBXplorer are still being created.</p>
<p>Lifecycle stale-state recovery remains short for start, stop, restart, update, and removal actions, so genuinely wedged operations still clear quickly.</p>
<p>Meshtastic serial detection now rejects malformed handshakes and skips known non-mesh serial devices such as Sierra Wireless LTE modems and Zooz/Z-Wave sticks.</p>
<p>Meshtastic config sync sends the correct protobuf wire type, allowing node-info and contact ingestion to work reliably. The mesh udev rule also stops claiming every ttyACM device and now targets known mesh adapters/vendors.</p>
<p>MeshtastictextpacketsaretranslatedintoArchipelago's existing mesh frame pipeline, and Meshtastic node information appears as normal mesh contacts using stable synthetic public keys.</p>
<p>Frontend OTA behavior improved: hashed assets no longer fall back to index.html, the HTML shell revalidates on every load, and runtime promotion installs the bundled nginx config on update.</p>
<p>Nginx Proxy Manager now avoids privileged rootless Podman host port 81, preferring 8081 for its admin UI while host nginx keeps a compatibility proxy on :81 for stale launch buttons.</p>
<p>App installs allocate ports by checking live host bind availability, falling back to a free high port when preferred ports are occupied. Portainer-created launchable containers now appear in a Websites tab through their discovered host ports.</p>
<p>Fresh installs include the full Wi-Fi userspace stack and grant the Archipelago service user NetworkManager PolicyKit access, so Intel Wi-Fi scanning and connection changes work from the web UI.</p>
<p>Container health and reconciliation are more honest and resilient: stale alerts clear, Stopping containers can be recreated, health states come from Podman, and drifted Quadlet settings trigger proper restarts.</p>
<p>Bitcoin Knots and ElectrumX get more CPU and memory headroom, LND helpers tolerate container-owned files better, and the screensaver stays out of media-heavy app sessions.</p>
<p>Container reconcile can force-recreate Podman records stuck in Stopping while preserving bind-mounted app data, recovering wedged containers automatically.</p>
<p>Lifecycle audits on the hardened container layer passed on the validation node, with direct app probes returning healthy responses.</p>
<p>Existing installs now self-repair nginx backend proxy locations for Bitcoin status and app catalog calls, including hosts where the active config is a copied file rather than a symlink.</p>
<p>LND UI is consistently served on port 18083 across first boot, Tor config, Quadlet reconciliation, OTA runtime payloads, and ISO scripts. OTA frontend tarballs also carry a cleaner runtime payload so startup promotion does not reintroduce stale host assets.</p>
<p>Bitcoin Knots/Core config generation no longer duplicates RPC bind and port settings between bitcoin.conf and container command arguments, fixing startup failures from RPC endpoint binding conflicts.</p>
<p>Legacy Bitcoin healthchecks no longer depend on bitcoin-cli being present in current images. Update checks now prefer manifest OTA releases over stale git remotes unless git updates are explicitly enabled.</p>
<p>Tailscale now launches its local installed web UI on port 8240 and starts tailscaled before tailscale web, fixing unreachable installs after container creation.</p>
<p>Grafana lifecycle actions repair missing rootless host listeners on port 3000, and Debian 13 install paths pull security updates from trixie-security during image/install creation.</p>
<p>Stack installs now adopt containers that already exist instead of failing on them — a repair or reinstall over leftover containers completes, and the adopted container'sreadinessiswaitedonlikeanyfreshstart.</p>
<p>Failedinstallscomewithevidence:theinstallpathwaitsforitscontainers,andwhenonedoesn't become healthy it captures that container'slogs,sotheerroronscreennamestherealculpritinsteadofabaretimeout.</p>
<p>Thisisthereleasethatun-sticksthefleet's update pipeline: from here on, an OTA can carry more than the two artifacts, and app installs on updated nodes use the specs that match their backend.</p>
<p>Bitcoin Knots/Core UI now reports connection, reconnecting, syncing, and error states from a backend status bridge instead of showing stale connection failures while the node warms up.</p>
<p>ElectrumX exposes indexed height, local Bitcoin height, known headers, status, and progress source, making long initial indexing states readable. Bitcoin Core and Bitcoin Knots are now mutually exclusive variants with corrected install conflict handling.</p>
<p>IndeeHub launches only on its direct web UI port, and BTCPay/NBXplorer Postgres environment formatting was fixed to avoid malformed connection strings.</p>
<p>archipelago.service now creates /run/containers before startup, fixing systemd mount-namespace failures on nodes where that runtime directory did not already exist.</p>
<p>Bitcoin Knots/Core sync is significantly faster: containers now use every available core for script verification and have 8 GB of memory so the 4 GB UTXO cache has headroom.</p>
<p>ElectrumX initial indexing is faster too, with CPU caps removed, 4 GB of container memory, and a 3 GB internal cache.</p>
<p>Health monitoring no longer pages auto-restart failures for orphaned containers left behind after Bitcoin variant switches.</p>
<p>Apps no longer disappear from My Apps when an install fails, and multi-image stack pull progress now advances during the download phase instead of sticking at 20%.</p>
<p>Several docker.io images were mirrored into Archipelago registries, reducing first-boot install dependency on Docker Hub.</p>
<p>Bitcoin RPC auth is durable across container restart, image update, and reboot. The dashboard no longer fails because registry-pulled images shipped stale baked-in credentials.</p>
<p>Multi-container apps show real install progress, app cards stay visible while containers are being created, IndeedHub installs cleanly on fresh nodes, and Tailscale install no longer fails from a malformed command.</p>
<p>The installer now allocates swap on the encrypted data partition, capped at 8 GB, so image builds and memory spikes are less likely to OOM the system.</p>
<p>Container orchestration migration and release hardening continued, including OTA synchronization for rebuilt UI containers and aligned LND UI port handling across runtime specs.</p>
<p>Release packaging moved toward tarball-only artifacts with archived ISO build recipes, keeping update payloads focused on the files existing nodes need.</p>
<p>Installing, updating, and removing apps no longer freezes the UI. The backend now spawns the actual work in the background and returns immediately, so the progress bar starts moving right away instead of the whole page locking up for 30+ seconds while podman pulls an image.</p>
<p>Install progress bar actually reflects reality now. It previously stayed at 0% until the very end because podman doesn'temitparseableprogresswhenrunwithoutaTTY.Replacedbyte-countingwithsevenclearly-labelledphases—Preparing,Pullingimage,Creatingcontainer,Starting,Waitingforhealth,Finalizing,Done—eachmappedtoafixedpercentagesothebaronlymovesforward.</p>
<p>Thecontainer-installauditlogisnowactuallywrittentodisk.Thebackendrunsasanunprivilegeduserandwastryingtoappendeveryinstall,update,andlifecycleeventto/var/log/archipelago-container-installs.log — a path only root can create. Every write failed silently, so the log stayed empty on every node. Logs now land at /var/log/archipelago/container-installs.log, a directory pre-created at boot and on self-update with the right ownership, and they rotate daily under the existing logrotate rule.</p>
<p>TheAIAssistanttabnolongerdisappearsafterupdates.Self-updatesrebuiltthefrontendfromsourceandthenusedrsync--deletetoswapitintoplacewhilepassing--excludeaiuitopreservetheexistingbundle;thatworkedonlyaslongasapreviousinstallhadalreadyputAIUIondisk.AnynodewhosewebUIdirectorygotreplacedwholesale(includingbyamanualredeployofjustthedisttarball)lostAIUIentirelyandtheAIAssistanttabfellthroughtoa"needs to be enabled"placeholder.EveryupdateandeveryISObuildnowshipsthecanonicalAIUIbundlefromdemo/aiuiintherepo,soAIUIisafirst-classversionedpartofeachreleaseandcannotbewipedbyaswap.</p>
<p>Updatesnowself-check.Afteranupdatelands,thenodeprobesitsownwebUIthroughnginx—ifthefrontendisn't answering cleanly within 90 seconds, the node automatically rolls back to the previous version and restarts. A bad release can no longer leave the fleet stranded on an unreachable node.</p>
<p>Proper fix for the 500 / Internal Server Error after update. The v1.7.38 and v1.7.39 frontend archives had the wrong permissions baked into the archive itself — the tarball'srootdirectoryentrywasprivate,soeverynodethatextracteditendedupwithawebUIdirectorynginxcouldn't read. v1.7.40 packages the archive with correct world-readable permissions from the start, so no node ever sees the 500 again.</p>
<p>Hotfix for v1.7.38 — on some nodes the update landed with the web UI directory set to private file permissions, so nginx returned a 500 / "Internal Server Error" on every page. This release fixes the updater to set world-readable permissions on the new frontend, and the node also now self-heals on boot if it ever finds the UI directory in that state again.</p>
<p>Signing in is quiet now. The intro music, welcome voice, and transition sounds belong to the first-boot cinematic and only play before you'vefinishedonboarding—everyloginafterthatissilent.Typingsoundsinthesearchbarandonthedashboardareunaffected.</p>
<p>Fixedabugwhereclearingyourbrowsercache,updatingthenode,orrebootingcouldbounceyoubackthroughtheonboardingwizardeventhoughyournodewasalreadyfullysetup.Thenodenowself-heals:ifyourpasswordisset,itknowsyou've been through onboarding and takes you straight to the login screen. No more starting over.</p>
<p>Trimmed the App Store. FIPS, Nostr Relay, Nostr VPN, Routstr, and Penpot have been removed from the catalog and their container images deleted from our registries. Your node'snativeFIPStransportisuntouched—thisisjusttheapp-storeentriesgoingaway.</p>
<p>BitcoinCore(thereferenceimplementation)nowinstallsfromtheAppStoreandrunscleanlyalongsideBitcoinKnotsasafirst-classoption.Theinstallflowpullstheofficialdocker.io/bitcoinimagedirectlyifyourinternalmirrorsdon't carry it, and the node UI auto-detects which implementation is running so the logo, title, and version line all reflect Core vs. Knots without any manual config.</p>
<p>The node dashboard now shows a Storage indicator (Full Archive · X GB or Pruned · X GB) right next to Network, so you can tell at a glance whether your node is carrying the full chain history or the last ~550 MB. The Node Settings modal was stripped of its hardcoded Regtest/port-18443 placeholders and now shows real values — network mode, storage mode, transaction index, ZMQ publishing, and RPC port — all read from the running node.</p>
<p>Fresh installs no longer default to pruned mode. Previously, a new install would write <code>prune=550</code> into bitcoin.conf even on boxes with 2 TB of free space; now the default is full archive and you can opt into pruning by editing the conf yourself.</p>
<p>Bitcoin Core joins the App Store as its own entry, with the Umbrel community icon and a description that frames it as a reference alternative to Bitcoin Knots rather than a replacement. A Sovereignty Stack tile on the Discover page now groups your node options together so the choice is obvious.</p>
<p>The App Store catalog fetch now follows whichever container registries you'vesetasprimaryinSettings.PreviouslythecatalogURLwashardcodedtotwoservers;nowtheoperator's own mirror priority drives where the App Store pulls its listings from, so switching primary actually moves the catalog too.</p>
<p>Rootless-netns self-heal: if the container network loses its outbound tap (symptom: Bitcoin Knots and other outbound containers can'treachtheinterneteventhoughcontainer-to-containerstillworks),thenodenowdetectsitandrestartsthenetworkfromscratchonitsown.NomorehavingtoSSHinandbouncepodman.</p>
<p>Yournode's Web5 DID, Identities list, and peer-to-peer pubkey now all resolve to the same seed-derived identity instead of drifting apart after onboarding. The Node identity on fresh installs is mirrored from the onboarding seed rather than generated as a separate random keypair.</p>
<p>Bitcoin Knots (and the new Bitcoin Core slot) now run on bitcoin/bitcoin 28.4 with a realistic 4 GiB memory cap and uncapped CPUs so bitcoind can run -par=auto across every core on your box.</p>
<p>The login background now rotates through six atmospheric images, advancing one each time you land on the login screen, so returning to your node doesn'tkeepshowingthesamewallpaper.Thechosenindexisrememberedacrosslogouts.</p>
<p>Re-logginginisnoticeablysnappier.Thedashboardentryanimationusedtoreplaythefull1.2-secondzoomrevealoneverylogin;that's now reserved for the first entry after onboarding. Subsequent logins fade in with just the welcome typing in about 300 ms.</p>
<p>If you clear site data on a node you'vealreadyonboarded,theintrovideonolongerfiresagainontheloginscreen.Theonboardingcacheisre-seededfromthebackendautomatically,so/loginstaysquietinsteadofreplayingthewholeintrosequence.</p>
<p>Theonboardingwizardnolongergetsskippedongenuinely-freshnodeswhenyouconnectfromabrowserthatonboardedadifferentnodeearlier.Thebackendisnowthesourceoftruthfor"has this node been onboarded yet?"—thebrowser's local flag is the offline fallback, not the primary answer.</p>
<p>Already-onboarded nodes no longer show the "boot loader" or "server starting up" screens during an OTA update blip. The health check polls quietly for up to a minute before showing the boot screen, so a 10-second restart no longer looks like a catastrophic failure.</p>
<p>Logging out and returning to <code>/login</code> no longer replays the full intro video — you get a quiet lock-screen background instead. The full welcome sequence is reserved for genuine first-time entries.</p>
<p>Upgrading nodes now pick up this release'sUIcleanlywithoutastalecachehangingon.Acache-versionbumptellsyourbrowser's service worker to ditch the old bundle on first load.</p>
<p>Updatesnowfinalizecleanlyinsteadofbeingforce-killedbysystemd.Previouslythenodelogged"shut down cleanly"duringanupdate,thensystemdwaited15secondsandSIGKILL'd the service because one of the internal threads wasn'treleasing.That's been tracked down and fixed, so the service exits promptly and the restart path is snappier.</p>
<p>IndeedHub install is now idempotent — re-running it after a failed first attempt no longer leaves orphaned containers blocking the retry with a "name already in use" error. The installer force-cleans leftover containers and the dedicated network before starting a fresh stack.</p>
<p>Server 3 (OVH) is now an automatic tertiary mirror for both system updates and app registries. Existing nodes pick it up on next restart without any manual config — another independent network path, so a single-provider outage can'tstalldownloads.</p>
<p>Appinstallsnowshowarealdownloadprogressbar—sameaccuracyasthesystemupdatebar.You'll see "Downloading: 50.5 / 200.0 MB (25%)" with a live percentage instead of a generic spinner. The bar keeps streaming even when the install falls back from one registry to another, so you'llneverseea"stuck at 0%"again.</p>
<p>Uninstallsnowshowwhat's actually happening: "Stopping containers (2/5)", "Cleaning up volumes", "Removing app data" — labelled per app so you can fire off multiple uninstalls in parallel and watch each one'sstageonitsowncard.</p>
<p>TheOVHmirrorisnowbakedinasServer3bydefaultforbothupdatesandtheappregistry—extramirror,completelyindependentnetworkpathsoasingle-provideroutagecan't take everything down.</p>
<p>New App registries page in Settings — same experience as Update mirrors, but for the container registries your node pulls app images from. Add a mirror, test reachability with one click, pick the primary.</p>
<p>New nodes default to the VPS registry as the primary for both app installs and the app catalog, with tx1138 as the automatic fallback if the VPS is slow or unreachable. Existing nodes keep whatever registry order they'vealreadyset.</p>
<p>Rebootscreennowshowstheanimated"a"logointhecenterofthering—matchingthescreensaver's look so you get something nice to watch while the node comes back up.</p>
<p>Reboot now shows a proper progress screen. Click Reboot and you'llseeafull-screenoverlaywiththefamiliarpulsingringanimation,arebooting/reconnecting/back-onlinestatus,andanelapsedcounter—nomoreblackscreenofmysterywhileyouwait.</p>
<p>NewnodesnowdefaulttotheVPSmirrorasServer1(primary)andtx1138asServer2(fallback).Existingnodeskeepwhatevermirrororderthey've already set — use Set Primary on the System Update page to change it.</p>
<p>The Update page now shows which mirror delivered your update — a small "Served by" line under the new version tells you whether Server 1, Server 2, or a custom mirror was the one your node actually reached. Great for spot-checking that mirror fallback is doing its job.</p>
<p>Every mirror row has a new lightning-bolt button that pings the mirror and shows whether it'sreachable,plustheround-triplatencyinmilliseconds.Nomoreguessingifamirroryoujustaddedisresponding.</p>
<p>Downloadsautomaticallyfollowthemirrorthatservedthemanifest.Previouslyeverymirrorservedthesamemanifest,andthemanifest's download URLs were hardcoded to a single server — so even picking a faster mirror couldn'tspeeduptheactualdownload.NowthebackendrewritesdownloadURLstomatchwhichevermirrorsucceeded.</p>
<p>Shipswithtwodefaults:Server1(tx1138)andServer2(VPS).AddtheURLformat<code>https://host/.../releases/manifest.json</code> for custom mirrors.</p>
<p>YournodecannowreachthebroaderFIPSpublicmesh,notjustyourownfederatedcluster.TheFIPSdaemonnowbindsbothUDP(fastmeshforwarding)andTCP(NAT-friendlybootstrap)transports—matchingtheupstreamfactorydefault.ThepublicanchorcurrentlyanswersonTCP,soUDP-onlynodescouldn't reach it; this fixes that without any action needed on your end.</p>
<p>Upgrading the config happens automatically. On next startup, if the installed FIPS yaml doesn'tmatchthenewtwo-transportschema,thenodereinstallsandrestartsthedaemonsotheTCPtransportcomesonline.NomanualReconnectrequired.</p>
<p>Frontendupdatesnowactuallyship.Sinceroughlyv1.7.17thereleasepipelinehadbeenrebuildingthebackendeveryversionbutsilentlyskippingthefrontendbundle—apermissionsissueonthebuildservermeantvue-tscfailedbeforeviteeverran,andnobodynoticedbecausethepublishedtarballsstillextractedcleanly.TheresultwasthebackendmovingforwardwhiletheUIstayedfrozenatitsv1.7.9-erastate,whichiswhytheFIPSgeariconandtheWhat's New entries for every release since then had been missing on your node.</p>
<p>Once this update applies, your node gets the real v1.7.24 frontend: the FIPS Seed Anchors modal (gear icon on the FIPS Mesh card), the current What'sNewhistory,thecancel-downloadbutton,andeveryotherUItouchfromthereleasesinbetween.</p>
<p>TheFIPSanchorstatusnolongershowsredjustbecauseonespecificpublicanchorisunreachable.Itnowlightsgreenwheneveranyauthenticatedpeerisarecognisedanchor—that's either the public anchor or something you added under Seed Anchors. A federated cluster that routes through its own seed anchor finally reports the truth.</p>
<p>Reconnect also re-pushes your seed anchors after the restart, so you don'thavetowaitfiveminutesforthebackgroundapplylooptore-dialthem.</p>
<p>Fixedacriticalbugwherenodesontheautomaticdaily-updateschedulecouldendupofflineaftertheirnightlyupdate.Theschedulerwaskillingtheserviceamomenttooearly,beforethebuilt-inrestarthandlerhadachancetobringthenewversionbackup—leavingthenodedeaduntilsomeoneSSH'd in and started it manually. The scheduler now hands off cleanly to the same restart path the 'InstallUpdate' button uses, so auto-applied updates come back online on their own.</p>
<p>Applies to any node configured for 'Check&ApplyDaily' — no change required on your end, the fix ships with this update.</p>
<p>Your node no longer offers a version you'vealreadypassedasan"available update".Ifyousideloadorskiparelease,anystoredpointertoanearlierversionisdroppedonnextrestart,andtheSystemUpdatepageoffersonlythegenuinelynewerrelease—nomoreseeinganolderversionlistedassomethingtoinstall.</p>
<p>Versioncomparisonisnownumeric,notalphabetic.1.7.10correctlyoutranks1.7.9(earliernaivestring-orderwouldhavegotthisbackwardsoncethepatchnumberhitsdoubledigits),soupdatepromptsand"up to date"checksstayaccuratepastthenines.</p>
<p>Astalemanifestfromaslowcacheorproxycannolongerdowngradeyournode.Ifthemanifestreportsaversionequaltoorbehindwhat's running, your node treats that as "up to date" rather than offering the older version as an update.</p>
<p>Nodes discovered through a trusted peer now land as Trusted instead of Observer. When your federated peer shares its own peer list with you, those nodes get the same trust level as a direct invite — the link they came through is already one you vetted, so you no longer need to promote them by hand before they can be used normally.</p>
<p>The update flow now writes clearer logs at every step. Start of download, cancel, and apply each emit a one-line entry to the system journal with the staging path and the affected files, so if a download misbehaves on your node it'seasytoseeexactlywhereitgotto.</p>
<p>Downloadsthatstallfor30secondsormorenowsayso.Theprogressbarturnsamberandshows'Download appears stuck — try Cancel and start again'insteadofjustsittingsilentlyatwhateverpercentitreached.</p>
<p>Cancelingisfast.Itnolongerhastowaitouttheretrytimer—thedownloadbailswithinhalfasecond,soyou're not stuck watching a stuck screen while you wait to unstick it.</p>
<p>Federation is now bidirectional and instant. When someone joins using your invite code, their node appears on your Federation page automatically — no need for the inviter to click Sync or wait for the next poll. Names and node details populate within seconds of the handshake finishing.</p>
<p>New nodes can no longer federate with themselves. Accepting an invite that points back at the local node (by DID, public key, or onion address) is rejected up front, so self-peering no longer clutters the node list with a duplicate card.</p>
<p>Transitive discovery: if nodes A and B are already federated and node C joins A, all three nodes now learn about each other. The new peer is pulled in as an Observer entry on existing federation members, so you can promote to Trusted with one click instead of trading a second invite code.</p>
<p>The Federation page auto-refreshes every five seconds while it'sopen.Statuschanges,newpeers,andincomingjoinrequestssurfaceontheirown—clickingSyncremainsavailableforanon-demandpull.</p>
<p>Updatecheckitselfretriesonslowresponses.Ifthereleaseserverismomentarilyoverloaded,thenodetriesthreetimeswithafive-secondwaitbetweenattemptsbeforeconcludingyou're up to date.</p>
<p>Installing an update now shows a full-screen progress overlay with the Archipelago logo, a status message, and an animated bar. The page reloads itself automatically once the new version is up — no manual refresh. If something stalls, a 'Reloadnow' button appears after a few minutes.</p>
<p>Download progress no longer looks frozen near the end. The bar pauses at 95% with a 'Finishingdownload—verifyingchecksum…' message and spinner while the last bytes arrive and are hashed.</p>
<p>FIPS Reconnect now genuinely tries to fix the anchor. It runs a proper recovery sequence (stop → start → wait for the bootstrap window → check peers) and tells you the likely reason it'sstillunreachable—corruptidentitykey,seednotunlocked,networkblockingUDP,ortheanchorserverbeingdown—insteadofageneric'try again'.</p>
<p>HealedalatentFIPSidentitybug:thepublic-keyfilewasbeingwrittenintextform(an'npub1…'string)onsomenodes,whichthedaemoncouldn't parse and silently authenticated with a garbage key. The Reconnect button now rewrites the file in the correct binary format and re-installs the config before restarting — nodes stuck with no peers for 'noreason' should come back online.</p>
<p>AIUI (Claude sidebar) is back. The installer now ships AIUI in the frontend bundle and preserves it across future updates — it was being wiped on every OTA because it lived outside the Vue build.</p>
<p>Installing a big app (IndeedHub, Bitcoin, Penpot) no longer gives up early and shows 'didn't work'whilethedownloadisstillrunninginthebackground.Theclientwaitsupto45minutesfortheinstallpipelinetofinish.</p>
<p>'Rollback to Previous'isnowlabelled'Rollback Available'—clearerthatit's a choice you have, not a status you'restuckwith.</p>
<p>Appcatalognowloadsreliably.Before,theMarketplace/Discoverpagecouldn't fetch the catalog of apps because the upstream host wasn'tsendingtherightCORSheadersandthenode's security policy didn'tallowthefallbackURLeither.Thenodenowfetchesthecatalogserver-sideandservesitsame-origintothebrowser—nomoreblankapplists.</p>
<p>InstallUpdateactuallyappliesnow.Theinstallerhadtowriteintosystemfoldersthatthebackendservicewassandboxedoutof—everyearlier'Failed to apply update'wasalayerofthatonion.Fixedbyrunningthefileswapsinaseparatesystemcontext.</p>
<p>FIPSstatusontheHomeandServerpagesnowreflectswhetherthepublicanchorisreachable.You'll see 'Active·Npeers' (green) when healthy or 'Noanchor' (orange) when the network is blocking the bootstrap — same signal as the full FIPS card.</p>
<p>Pasting an https://… URL into the profile picture or banner now previews correctly. Before, if the URL failed to load, the UI would silently blank out instead of showing your initial as a placeholder.</p>
<p>Uploaded profile pictures under 64 KB are now embedded directly in your Nostr profile (as a data URL), so any Nostr client can see them — not just ones routing over Tor. Larger uploads keep the onion URL for now, with a hint to paste a public URL for wider visibility.</p>
<p>OTA verification release — nothing new to see. Click Install Update, grab a coffee, and watch the sidebar flip to 1.7.9-alpha on its own. If this one works end to end, the pipeline is solid and future updates will flow the same way.</p>
<p>Install Update finally works end-to-end over the air. The installer was trying to overwrite the running backend binary with a tool that fails on in-use files (ETXTBSY) — swapped it for an atomic rename, which the kernel allows on a live executable. Every previous 'Failedtoapplyupdate' attempt was this one root cause.</p>
<p>Over-the-air update test — no feature changes, just a version bump so your node can walk through the whole update flow end-to-end using the new robust installer. Safe to apply; nothing to do afterwards.</p>
<p>Install Update is now more robust. Each install gets its own uniquely-named staging folder and then moves files into place — the previous version had a small cleanup step that could hit a transient filesystem hiccup and bail out halfway. You'llalsostillseearollbackfolderafterasuccessfulinstall.</p>
<p>InstallUpdateactuallyinstallsnow.Before,thefinalstepextractedthenewUIintothewrongfolderandbailedwith'Failed to apply update'—yournodeendedupbackingupcleanlybutneverswappinginthenewfiles.Fixed.</p>
<p>Downloadprogressnolongerovershoots100%.You'll see the bar climb smoothly to 95% and then jump to 100% when the download actually finishes.</p>
<p>The version number in the sidebar now always matches the actual running version — no more lying to you about being on an older release after an update.</p>
<p>FIPS Mesh card on the server page: cleaner layout on desktop (no more awkward gaps), and a one-click Reconnect button when the public anchor is unreachable — it restarts the FIPS daemon so it can re-bootstrap from the anchor.</p>
<p>Profile pictures now show correctly in the identity list and editor. Before, uploaded images silently failed to render because the URL was only reachable over Tor; the UI now rewrites them to a local path while keeping the external URL for other Nostr clients.</p>
<p>Identity rows now show your Display Name first (from your Nostr profile) with the internal identity name beside it in parentheses, so you see the name other people will see — not just the one you picked when creating it.</p>
<p>Install Update now actually installs. Before, the button would back up your current version then fail with 'Failedtoapplyupdate' because the installer couldn'twriteintosystemfolders.</p>
<p>Thebutton's also been renamed to 'InstallUpdate' (previously 'ApplyUpdate') and the node restarts itself a moment after you click it — no more manual restart step.</p>
<p>Your existing identities now show the generated avatar instead of just their initials — same look as freshly created ones.</p>
<p>Everything from 1.7.0-alpha and 1.7.1-alpha carries over (default avatars on creation, one-click Save publishes to Nostr relays, public blob URLs for profile pictures, 30-minute download window, VPN peer restore on reboot, reconciler-only-repairs, filebrowser fix).</p>
<p>Over-the-air update test — same features as 1.7.0, just a fresh version number so your node can try the new download-and-apply flow end-to-end. Safe to apply; nothing to do afterwards.</p>
<p>Every identity now gets a personal avatar the moment it'screated.Yourmainnodeidentitygetsadistinctivehexagonal-networkicon;otheridentitiesgetacolourfulgeneratedpatternuniquetoeachone.</p>
<p>Profileeditor:uploadaprofilepictureandabanner,thentapSave—yourNostrprofilenowgoesouttotherelaysinonestep.Nomore'Save'vs'Save & Publish'confusion.</p>
<p>NostrVPN is now a native system service. Peer discovery via Nostr relays, WireGuard tunnels. Auto-configured with your node'sidentityduringonboarding—nosetuprequired.</p>
