Recovery from a failed update no longer leaves a container permanently missing. When an app update failed partway through, the rollback path tried to restart the old container by name even though the forward path had already deleted it, leaving a hole in the node that required manual intervention. The reconcile tool now supports a --create-missing flag that rebuilds any registered container from its canonical spec, giving the update flow a safe recovery path.
OTA self-updates now refresh the container-reconcile helper scripts alongside the backend and frontend. Previously, updates only shipped new versions of the backend binary and web UI while the reconcile scripts stayed frozen at whatever version was baked into the original ISO — which meant fixes to those scripts (including the two above) never actually reached existing nodes. Every self-update now installs the latest reconcile-containers.sh, container-specs.sh, and image-versions.sh to /opt/archipelago/scripts/.
The container-install audit log is now actually written to disk. The backend runs as an unprivileged user and was trying to append every install, update, and lifecycle event to /var/log/archipelago-container-installs.log — a path only root can create. Every write failed silently, so the log stayed empty on every node. Logs now land at /var/log/archipelago/container-installs.log, a directory pre-created at boot and on self-update with the right ownership, and they rotate daily under the existing logrotate rule.
+Mesh messages larger than one LoRa frame are no longer corrupted. The chunked-payload encoder was writing its 4-byte length header on top of the first 4 bytes of user data before running Reed-Solomon, so bytes 0 through 3 of every multi-chunk payload were lost in transit. The encoder now reserves the header up front, copies the data after it, and runs the forward-error-correction pass once, so chunked mesh payloads now round-trip intact.
+Avatars no longer crash the backend on certain identities. The hue and accent colour computation multiplied a 16-bit seed byte by 360, which overflows for any seed value of 182 or greater. Debug builds panicked outright, release builds silently wrapped and drew the wrong colour. The math now runs in 32-bit space so every possible seed renders correctly.
+Mesh outbox entries with a zero-second TTL now expire immediately instead of lingering forever. The expiry check used a strict greater-than comparison, so a message whose age had not yet ticked over one second was considered live even when its TTL was set to zero. It now uses greater-or-equal, matching the intuitive meaning of TTL.
+The pinned-image parser no longer treats arbitrary environment-style keys as container images. The loader retained every key ending in _IMAGE regardless of the value, which meant a stray variable like NOT_AN_IMAGE="something" would be registered as a pinned image and pollute version checks. The parser now requires the value to look like an actual image reference (a registry path with a tag) before accepting it.