<p><strong>Companion0.5.28isincludedinthenodedownloadthistime,withtheworkthatmissedv1.8.5.</strong>Thecompanionhubcanbackupandrestoreitsnodelist,actasaNIP-46remotesigner,andshowseachpairednode's FIPS mesh address with tap-to-copy. For Termux users, the included fipssh helper turns a durable node npub into its mesh address, so fipssh user@npub1… can reach SSH once that node has explicitly allowed port 22. The node-side “SSH over mesh” firewall toggle is not claimed here—it still needs implementation and remains off by default.</p>
<p><strong>Areleasecannolongeradvertiseitselfbeforeitsfilesexist.</strong>Newreleasesarepreparedbehindapendingmanifest;thepublisheruploadsthebackendandfrontend,downloadsbothbackandverifiestheirsizeandhash,andonlythenpromotesthesignedmanifesttothepathnodesread.ThemanifestgeneratoralsoincludeseverycuratedWhat's New item instead of silently stopping after the first ten physical changelog lines.</p>
<p><strong>Cuprate — an independent Monero node — is now an app.</strong> Monero consensus validated by a second, unrelated codebase (Rust), the same layer of security-in-depth Bitcoin gets from Knots. Review caught two problems before anything shipped: the unrestricted RPC that can move funds stayed bound to the container'sloopback(neverpublishedtothenode,letalonetheLAN—anythingonthenodecouldpreviouslyhavereachedit),anditsrestrictedRPCmovedoffport18089toavoidcollidingwithPenpot.Honestcaveat:upstreamhascutnostablereleaseyet,sothepintracksanexactpreviewbuild(0.1.0-preview-18-g618ff14)andmovestotheirfirsttaggedreleasewhenthereisone.</p>
<p><strong>Afrozennodenowexplainsitself—andcomesbackonitsown.</strong>Thehostnowcapturesamemorydumpinto/var/crash when the kernel panics <em>or</em> wedges (a hung kiosk used to sit dead until someone power-cycled it; now it dumps, reboots itself, and leaves the evidence behind), and records failing-memory signals (ECC errors) into a database as they happen. This is the first change delivered by a new host-update channel: the node's own updater now carries OS-level packages and settings to already-deployed machines — the crash-kernel's memory reservation is the one part that waits for a reboot, and the node says so rather than pretending.</p>
<p><strong>Picturestointernet-onlymeshcontactsworknow.</strong>Sendinganattachmentinlinealwaystooktheradiopathandfailedwith"Peer is federation-only (no radio twin)"forcontactsreachableonlyovertheinternet—andthesize-adviserkeptrecommendingaradiotransferthosepeerscan't receive. Both fixed: inline sends route over the federation when that'stheonlywaytoreachthepeer,andtheadvicenolongeroffersradio-onlytransferstoradio-unreachablecontacts.</p>
<p><strong>Diskcleanupfinallyhashonestnumbers.</strong>Space"free"onadrivewascountedincludingtheslicethefilesystemkeepsreservedforroot—roughly5%ofthedisk,92GBononedevbox—sotheautomaticcleanupthat's supposed to kick in at 90% never triggered and stale container images piled up unnoticed. Reserved space now counts as used, which is what the threshold was always meant to measure.</p>
<p><strong>Three small screens that were lying to you, fixed.</strong> The "Bitcoin is synced — fund your wallet" toast no longer appears on a node where the wallet it means (LND) isn'tinstalled—itpointsatinstallingLNDinstead.Theseed-revealscreenhidesitsthirdpromptunlessthepasswordactuallyfailstodecrypt(thebackuppassphraseonlyexistsifyousetone).Andmulti-versionstorecardsstopquotingaversionnumberyou'll be asked to choose on the next screen anyway.</p>
<p><strong>Mesh notifications survive a refresh, and a stale router no longer hides the fix.</strong> Radio message unread counts are now remembered per contact instead of guessed from session state (the "one new message showed 11 unread" bug), cover Meshtastic, MeshCore and Reticulum alike, and deep-link to the right conversation; a single new message announces itself once. Separately, when the cached router address goes stale, the error card gains a "Reconfigure router" action instead of a Retry loop that can never succeed.</p>
<p><strong>The app updater now knows what upstream shipped.</strong> Every app'smanifestrecordswhereitcomesfrom—includingtheoddcorners(GitLab-onlyprojects,ghcr-onlyimages)—andacheckersweepsallofthemagainstupstreamreleases,soapinthatquietlyrotsformonthsisnowvisibleinsteadofinvisible.Thefirstfullsweepfound27pinsbehind;thesafepatch-levelonesshippedwiththisrelease(strfry,BTCPayServer2.4.3,thetwonginxfrontends),andthemajorjumpsthatmaycarrydatamigrationsaredeliberatelyheldfortheirowncarefulpasses.</p>
<p><strong>Appswiththeirownlogincannowskipthenode's login screen — Gitea and BTCPay Server do so out of the box.</strong> Some apps bring a complete account system of their own, and putting the node'spasswordpageinfrontofthembrokerealworkflows:gitclientscan't answer a browser login, and a BTCPay checkout link handed to a customer must open for that customer. These apps are now served directly on their own login, while the node still fronts the connection for everything else it does (embedding fixes, the "app is restarting" page, Tor). Every app gets a new <strong>Settings → app → Access control</strong> switch, so you can put the node login back in front of any app — or take it away from one — with one click, effective immediately. App developers declare the default in their manifest (auth: open), documented in the developer guide.</p>
<p><strong>The phone remote now works inside apps on the TV — tap, scroll, and type everywhere.</strong> The companion remote and keyboard drove the dashboard beautifully but died at the edge of any app screen (Gitea, BTCPay, and friends): for the browser, each app is a separate website embedded in the page, and simulated input is forbidden from crossing that wall. The on-screen display now accepts the remote'sinputthewayarealmouseandkeyboardarrive—belowthepage,throughthebrowseritself—soitlandsanywhereonscreen,appscreensandtabsincluded.Tapsclick,two-fingerscrollingscrollstheapp,andtypinggoesintowhicheverfieldyoutapped.Existingkioskspickthisupwiththeupdate,noreinstallneeded.</p>
<p><strong>Whileyou're driving with the phone remote, the old mouse pointer gets out of the way.</strong> The computer'sownpointerusedtositfrozenwhereverthephysicalmouselastleftit—asecond,deadcursornexttotheliveorangeone.Itnowhideswhiletheremoteisinuseandreturnshalfaminuteafterthelastremoteinput.</p>
<p><strong>"Are you sure?"questionsnolongerfreezetheremote.</strong>Ahandfulofconfirmations(clearingmeshhistory,rebooting,deletingabackup,uninstallinganapp)usedthebrowser's built-in popup, which stops the whole page — including remote input — until someone clicks it with a real mouse. From the couch, that meant asking a question you couldn'tanswer.Allofthemarenowproperin-appwindowsinthehousestyle,fullydriveablebyremote.</p>
<p><strong>Ameshradionowconnectsnomatterwhichportit's plugged into — or replugged into.</strong> Moving a radio to a different USB port could leave the mesh silently down: the node only checked a short fixed list of port names (a radio landing outside it was invisible), a hand-set serial-port override quietly outranked the device you'djustapprovedinthe"Radio detected"window,andonewholefamilyofboards(Espressif-basedradioslikerecentHeltec/T-Deckmodels)neverreceivedastabledevicenameatall—theexactcombinationfoundliveonafleetmachinethisweek.Allthreearefixed:everyserialportisscanned,choosingaradiointhedetectionwindowclearsanystaleoverride,andEspressifboardsgetthesamestablenameaseveryoneelse.</p>
<p><strong>Meshsignalstrengthishonestnow.</strong>EverypeerheardoverReticulumradioreportedasignalstrengthofexactly0—whichisalsowhatyou'd see with no radio at all, and what peers reached over the internet showed. Real receptions now show their true signal reading, and anything that arrived over a relay or the internet says so by showing none — so "the radio is working" and "the internet is doing the radio'sjob" no longer look identical. (The reading depends on the radio's firmware reporting it; boards that don't report per-packet signal stats show "unknown" rather than a made-up number, and the new radio diagnostics show at a glance whether yours reports them.)</p>
<p><strong>A background error that repeated every 90 seconds, forever, is gone.</strong> After setting up a node from its recovery phrase, the node kept introducing itself to its federation partners with its old temporary identity papers while signing with its new ones — every partner rejected the introduction, and both sides logged an error about it every minute and a half until the next restart. The identity switch now updates everything at once, a rejected introduction is no longer misreported as delivered, and a partner who has already answered is no longer re-asked on every cycle.</p>
<p><strong>The network map on TVs: no more blank page, no more frozen page — and it moves again.</strong> The map's entrance animation needed a smoothness that TV kiosk hardware can't always deliver, so the page could sit blank until a refresh; the previous fix cured the freeze by stopping the animation entirely, which went too far. Now the map appears instantly with everything already in place, then resumes its calm orbital motion at a gentler pace suited to TVs. Resizing or rotating any screen also redraws the map properly instead of leaving it tiny, stretched, or empty.</p>
<p><strong>The dashboard's corner logo is back to normal.</strong> The new glossy paint finish was meant for the big emblem on the screensaver, intro, and login screens — it had quietly spread to the small logo in the dashboard header, where it looked wrong. Each screen now gets exactly the treatment intended for it.</p>
<p><strong>App icons no longer vanish in My Apps.</strong> The freshly restyled Alby Hub and phoenixd icons could render as blank squares in some views — a subtlety in how the icon files declared their size. Fixed at the source, and the icon tool app developers use now produces immune files.</p>
<p><strong>An app that can't be shown inside the dashboard now becomes a tab app by itself.</strong> A few apps refuse to render inside another page no matter what — they break out with their own code or insist on owning the whole browser window. Opening one used to mean staring at a grey pane. Now the dashboard notices, offers the app in its own tab, and remembers: from then on that app's button opens a tab directly (with the little launch icon that tab apps carry), first click, every time. If a later update makes the app embeddable after all, the dashboard notices that too and goes back to embedding it.</p>
<p><strong>The logo emblem got its glossy black paint finish — properly this time.</strong> The circle behind the A on the screensaver, intro, and login now wears a deep wet-paint look: warm light blooming from the top edge, fine grain so the dark tones stay smooth instead of banding, and no more ring border. (An earlier rougher version of this experiment briefly shipped by accident and then vanished depending on which screen you were on — this is the finished, deliberate one, everywhere.)</p>
<p><strong>New app icons now match the store's look, on every screen.</strong> Alby Hub and phoenixd arrived with edge-to-edge logos that ignored the breathing room every other app icon has, and the app detail page skipped the icon backdrop entirely. Both icons are re-set on the standard canvas, the detail page now applies the same icon treatment as the store tiles, and app developers get a one-command tool that puts any logo onto the house canvas automatically.</p>
<p><strong>Apps that refused to open inside the dashboard now embed like everything else.</strong> Some apps ship browser headers that forbid being shown inside another page — correct hardening on the open web, but inside Archipelago it produced a dead grey pane when you opened them from My Apps (Alby Hub was the first to hit it). The app gate, which already checks your login on every request to an app, now removes just those framing headers on the way through; each app's own content-security rules pass through untouched. No more per-app proxy workarounds.</p>
<p><strong>The network map no longer freezes kiosk TVs.</strong> The animated federation map at 4K was too much for the deliberately conservative graphics settings the on-screen display used on every machine — settings chosen years back to stop audio crackle on much older hardware. Two fixes: on kiosk screens the map now opens in its flat 2D view (the 3D globe is one tap away, and remembered) and animates at half rate — invisible from the couch, half the work. And the display itself now recognizes what machine it runs on: older kiosk boxes keep the proven careful settings, modern ones finally get real GPU rendering.</p>
<p><strong>New Settings → Display → Graphics choice for the on-screen display.</strong> Auto (recommended) picks the right rendering mode for the machine by itself; Compatibility forces the most conservative mode if a screen ever stutters, tears, or crackles; Quality forces full GPU rendering on hardware the automatic detection doesn't recognize. Changing it restarts the on-screen display, like the size presets.</p>
<p><strong>Archipelago is now open source.</strong> The full source code of the node you are running — the orchestrator, the dashboard, the app platform, the mesh, the release tooling — is published for anyone to read, build and audit at source.archipelago-foundation.org/lfg2025/archy. A node that holds your money, your files and your communications should not ask to be taken on faith: from this release onward you, or anyone you trust, can see exactly what it does and follow every change we make in the open.</p>
<p><strong>Installing an update is reliable again, and tells you what happened when it isn't.</strong> Some nodes could download an update but never apply it — the button stayed on "Install", and no amount of retrying worked. The cause: applying the update consumed the downloaded files as it went, so if any one step hit a snag partway through, the leftover files were incomplete and every later attempt failed the safety re-check forever, needing a technician to recover. Applying no longer consumes the download — a failed apply can always be retried from the same files — and the pieces are now applied in a fixed order with the program itself last, so a hiccup can't leave a half-swapped node. When an apply does fail, the screen now shows the real reason and what to do ("downloadtheupdateagain"), and offers Download again instead of a dead "Install" button, rather than a generic "itfailed".</p>
<p><strong>Video on the kiosk stops tearing.</strong> The kiosk's display had no vertical sync at all, so fast motion — IndeedHub films especially — showed horizontal tearing lines. The display driver now syncs every frame to the panel (no extra hardware needed, existing kiosks pick it up with this update), and on machines with a GPU, video decoding moves off the CPU onto the video hardware — smoother playback that also leaves more headroom for audio, not less.</p>
<p><strong>The Back button finally does what you expect.</strong> Pressing Back — the mouse's side button on a kiosk, a swipe on a phone, the toolbar button in any browser — used to navigate the screen underneath an open window, or leave the dashboard entirely. Back now closes the topmost open window first, one per press, exactly like a native app; closing a window yourself never leaves a phantom entry that makes you press Back twice.</p>
<p><strong>No more bare IP addresses in your update or app-registry settings.</strong> The update mirrors and the app registry each listed the same server twice — once by its proper name, once as a raw http://146… address left over from before the domain existed. The raw-address entries are retired: new nodes never see them, and existing nodes clean them out of their saved lists automatically on the next read. Everything now goes through the named, TLS-protected origin — which was always the same machine.</p>
<p><strong>The phone companion app downloads over the proper domain.</strong> The download QR pointed at a raw address over plain HTTP; it now points at the same file on the https domain. Scanning it gets you an encrypted download from a named server.</p>
<p><strong>The Receive window now tells you when the money is on its way.</strong> Previously it showed a QR code and left you to check elsewhere whether anything happened. Now, the moment the sender's transaction is broadcast, the QR gives way to a clock: the amount, the transaction ID (tap to copy), and a note that the funds arrive on their own — with a single Done button. If you keep the window open, the clock becomes a green check at the first confirmation. Verified live on a real node: payment detected within seconds of broadcast.</p>
<p>All 12 pentest findings fixed. CSRF tokens now survive restarts. Password hashing upgraded to Argon2id. Bitcoin RPC gets a unique random password on every install. Federation messages require ed25519 signatures.</p>
<p>Random logouts fixed (P0). Uninstall dialog is now a proper full-screen modal with an "Uninstalling..." overlay. App cards no longer flicker between Start/Launch during container scans. ElectrumX index estimate corrected.</p>
</div>
<div>
<h4 class="text-whitefont-mediummb-1">Bitcoin Sync on Dashboard</h4>
<p>Homepage System card now shows Bitcoin Core sync progress, block height, and green/orange status indicator when Bitcoin is running.</p>
<p>Migrated all containers from root to rootless Podman. UID namespace mapping, volume ownership fixes, sysctl tuning. Bitcoin RPC verified, all web services confirmed healthy. 29 containers up and running.</p>
<p>Full systemd security sandbox restored now that containers run rootless. NoNewPrivileges, restricted namespaces, and system call filtering re-enabled. Session persistence and boot sequence fixes.</p>
<h4 class="text-whitefont-mediummb-1">Mesh Radio & Container Stability</h4>
<p>LoRa mesh radio auto-detects USB port changes with a new Connect button. Fixed container crash loops — all apps start cleanly and stay stable. Apps starting up show progress instead of re-appearing in the store. Tor routing enabled by default for Bitcoin and Lightning.</p>
<p>Receive Bitcoin block headers over mesh radio. Dead man's switch broadcasts location to trusted contacts if you go silent. GPS sharing is opt-in only.</p>
