4.3 KiB
2.1.21 beta application update acceptance
OTA hold — 2026-11-13: The public update feeds were restored to the previous signed release after a fresh 1.9.1-alpha ISO installation failed 2.1.21 admission. Its existing web files matched the signed historical archive, but the ISO legitimately omitted the archipelago-runtime subtree bundled in the OTA archive. The guard rejected that layout before creating an owner transaction. The previous working code pair was restored and preservation checks passed.
The successful upgrades recorded below remain valid for those tested installations; they do not qualify this newly identified ISO layout. Version 2.1.22 adds strict historical-ISO layout coverage and requires separate artifact and actual-node acceptance before rollout. Published 2.1.21 assets and its tag remain unchanged; the Companion APK is unaffected.
Release source is frozen at commit dc6fbc50d9d2b931c080b4cf9605c56b4ad60e07 and annotated tag v2.1.21. The production application update uses signed manifest SHA256 e8bb5663ffd8f45b96460f68a8ad01be893bb1fdce202dae0ecb56be8f9bcfac, backend SHA256 8691588761a2ff7fdcf493b1c945c68c1f22640baa2dd1bea1f44c596aba96c7, and full frontend archive SHA256 8ebe0ad7eb7cfadb7a196f7be757840096d6f6677c752d25588bf4c8cb729352. The manifest was authenticated against the installed pinned release root. Source and artifact gates are recorded separately from installed checks.
An actual first-generation 1.9.1-alpha device completed the signed compatibility upgrade, including owner admission and independent preservation checks. A newer public-owner device completed the signed update. Supported recovery and repeat application were verified separately on the UAT node described below. These are two distinct installed update paths; neither stands in for the other.
Two private 2.1.2-beta UAT nodes used the installed public-owner prepare protocol and exactly one owner submission per attempt. One committed with its 29 prior installed-app decisions intact and one additive entry for an already existing, adopted container. The other node's initial update committed, but an independent coarse registry hash check failed because its pre-update receipt contained only a hash. That first check remains a failure; it was not retrospectively accepted. Supported recovery restored the exact old application pair and protected state. A controlled repeat captured the registry's raw preimage and passed independent verification with the same 35 registry entries byte-for-byte. Both final installed checks bound the signed backend, served dashboard and provider, transaction-owned frontend tree, runtime record and local routing. Wallet, identity, payment, valid session, container and peer trust/removal state was preserved. The signed release intentionally replaces app and container recipe files; owner snapshots verified the installed replacement and retention of any private-only entries. The existing dashboard layout and payment behavior are unchanged; the dashboard version label identifies 2.1.21.
Companion Bump28 is the previously qualified APK and is reused without Android code changes. Its earlier phone acceptance remains bound to that payload; this note makes no new phone or physical-device claim.
Publication verification
The signed backend, full frontend and manifest passed complete public download/hash verification. The mandatory historical compatibility gate authenticated all 24 manifest/frontend assets for the 12 declared versions, including the original historical URL where available. The reused Companion APK and metadata passed public readback and version/certificate/hash checks. Canonical source and annotated release-tag mirror parity were verified before publication. This feed change writes the exact signed manifest to both supported feed paths after those gates.
Compatibility assets cover 1.8.13-alpha through 1.8.22-alpha, 1.9.0-alpha and 1.9.1-alpha. The actual 1.9.1-alpha success does not constitute installed acceptance of every other historical version; versions outside the declared inventory are not qualified here. The retained first-attempt failure and controlled repeat remain separate evidence.
ISO build and clean-install acceptance are separate. The proposed first-install account, password and Wi-Fi setup flow is deferred. No ISO qualification or rollout is claimed here.