blockyard 0.0.9 → 0.1.0

package/CHANGELOG.md

@@ -6,7 +6,256 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
-Nothing yet.
+## [0.1.0] — 2026-09-16
+
+The first minor release, two days after the initial 0.0.9, and everything since it in one place:
+the 0.0.10 that was prepared on 2026-09-15 was never published, and its changes ship here. Four
+things shaped it. The **first outside review** of 0.0.9 on bitcointalk, which called out a monitor
+that bound every interface with no sign-in: 0.1.0 ships hardened — this machine only, sign-in on,
+HTTPS with a certificate it makes itself, and no outbound connection at all until the exchange
+feed is switched on. A day of **use on a laptop screen**, which found every tab a scroll: every
+page now packs to one screen at 1093×945, and the Mining tab follows mempool.space's dashboard
+with its **View more** panels. **Appearance**: the layout's colours are a setting — light or
+dark, five themes, or nine colours of your own. And the **DOS Diversions**: Wolfenstein 3D, DOOM
+and Quake, unmodified shareware on a PC emulated in the browser, written here with no
+dependencies, because "can it run DOOM?" deserved a straight answer. 945 tests, from 862.
+
+Upgrading from 0.0.9: [docs/INSTALL.md §11](docs/INSTALL.md#11-updating) — the first start after
+the update serves HTTPS, creates the `admin` account and prints its password once.
+
+### Security
+
+- **Hardened defaults** (after the first outside review of 0.0.9): the monitor binds `127.0.0.1`
+  and requires sign-in out of the box — the first start creates the `admin` account and prints its
+  password once (or takes `BLOCKYARD_ADMIN_PASSWORD`). Reach it from elsewhere over an SSH tunnel,
+  or bind a LAN address with `BLOCKYARD_BIND` / `server.hosts`; open read-only access is a choice
+  (`BLOCKYARD_AUTH=0`), announced at boot. The boot banner says how to reach a loopback-only
+  monitor. Existing installs keep whatever `config/local.json` says.
+- **HTTPS by default.** Every listener serves HTTPS; with no certificate named, the first start
+  makes the monitor its own self-signed one under `<data>/tls/` — written without dependencies
+  (`server/tls/selfsigned.js`: a v3 X.509 certificate assembled in DER and signed with ECDSA P-256
+  over SHA-256), naming the bound hosts, this machine's addresses and hostname — and remakes it
+  near expiry or when a bound address is missing from it. `blockyard tls` remakes it by hand
+  (`--san` to add names, `--print` to export it). Your own certificate still replaces it;
+  `BLOCKYARD_TLS=0` serves plain HTTP behind a proxy. The installer's summary and port probe know
+  both schemes.
+- **The installer asks twice before a non-loopback bind.** A LAN or wildcard address is written
+  only when the operator types it and confirms it; the default it offers is `127.0.0.1`.
+- **Market polling is off by default** — a new checkbox, **Display settings → Markets & Price →
+  Enable market polling**, shared by every screen. A fresh install makes no outbound connection
+  but to the node: the Markets and Kiosk tabs say that polling is off and where the switch is,
+  Overview's price line stays hidden and the explorer shows no dollar figures. Ticking it takes
+  effect at once; unticking parks the feed at once. `BLOCKYARD_MARKETS=0` still removes the feed
+  so that the checkbox cannot turn it on. Existing installs tick the box once.
+
+### Appearance
+
+- **A first tab in Display settings for the colours of the layout.** A theme mode — Light, Dark,
+  or System, which follows the operating system and changes with it — and theme cards with swatch
+  strips of the face the mode picks: **BlockYard** (the shipped look, the default; its dark face
+  is value for value what the monitor drew before), **Mono** (clean grayscale), **Nous** (GitHub's
+  chrome with a Nous blue accent), **GitHub** (Light Default and Dark Default) and **Catppuccin**
+  (Latte and Mocha). **Custom** is nine colour pickers — page, panels, text, muted text, accent,
+  lines, good, warning, bad — with the rest of a face derived from them (a raised panel, the
+  softer rules, the fainter text, the darker accent of a pressed button), and whether Custom is
+  light or dark read off its page colour; **customise <theme>** copies the theme on screen into
+  the pickers so a custom scheme starts from a look. Saved on the server with the other settings,
+  so every screen of the monitor draws the same; the sign-in page draws in the theme the browser
+  last saw.
+- The theme is applied through the CSSOM (the page's custom properties rewritten on `<html>`),
+  which the content-security policy permits where a style attribute is refused. The charts' axis
+  text, grid lines and tooltips, the order-book depth chart's two sides and the market charts'
+  grounds follow the theme — they were literals of the dark look, and a light theme would have
+  drawn grey-on-grey. The 3D boards stay space, and the Explorer's block and transaction pages
+  keep their own dark cards.
+
+### Mining
+
+- **The Mining tab has the network row**: reward stats over the last 144 blocks, the difficulty
+  period (blocks remaining, the estimated and the previous change, the next halving), a week of
+  pools with luck and counts, a year of hashrate with the difficulty's steps, and the last twelve
+  adjustments as a table — every figure from this node alone (`server/collect/network.js`:
+  `getblockstats` for the reward window, block headers for the periods and a daily sample, the
+  week's coinbases read in the background at the lowest RPC priority).
+- **mempool.space's layout**: two columns in its order (reward stats, difficulty adjustment;
+  pools, hashrate; recent blocks, adjustments) under the block flow, our own panels beneath, and
+  **View more »** on four cards opening that card full screen — the whole week of pools as a
+  table, the year's chart large, the whole attributed window of blocks, a year of adjustments.
+- **The pool chart is a labelled pie**: every pool named beside its slice and joined to it by a
+  leader in the slice's colour, the small ones stacked, slices under half a percent gathered as
+  "Other" — and the "Other" threshold rises until every label fits the card, so no name runs off
+  the bottom at any window height. The pie and the year chart size themselves to the window.
+- **Dollar figures** on the reward stats while market polling is on, from a new `/api/price` that
+  answers the cached spot price and never starts the exchange polling itself.
+- The Mempool space viewer left this page — it is on Overview, Block space and Mempool — and with
+  it the full-pool poll the page used to ask for. The reward window is exactly 144 blocks.
+- At a narrow window the block flow spans the width and is thinner, and the packages table scrolls
+  inside its card instead of bleeding into the neighbour; the three stacks become two below 1400px.
+- **A streak of stale drops of the full-pool poll is one story**: one warning event when it
+  starts, a counter on Node & RPC while it lasts, one event when the poll answers again with the
+  count and the span. On a day the node answered slowly for thirteen hours, each drop had been its
+  own event, 188 of the feed's 200 rows.
+
+### Every tab on one screen
+
+Measured at 1093×945 and 1600×1000 with a dead-height probe, page by page:
+
+- **Globally**: tighter card padding and heading spacing, and a short card beside a tall one keeps
+  its own height instead of being stretched to match (Chain & Sync's drill-down card had a
+  thousand pixels of nothing under its input; Node & RPC's poll cadence and connection cards
+  hundreds).
+- **Overview**: the block flow card a quarter shorter, and the Block space board capped to the
+  viewport (it set the whole right column's height), so the events are on the first screen.
+- **Block space**: the card tighter and the board sized so the whole page, note included, fits the
+  viewport without a scroll.
+- **Markets**: the board takes what the window leaves, and the exchange table and the order-book
+  depth sit side by side beneath it (under 1400px the table drops the pair, 24 h range and volume
+  columns; all still in the summary line and on the Kiosk) instead of the depth chart starting a
+  thousand pixels down.
+- **Kiosk**: tighter heads and gaps, the price panel's padding trimmed, the Block flow strip a
+  quarter shorter, and the full-screen button in that strip's head instead of floating over its
+  cards.
+- **Mempool**: keeps its two columns down to 900px (it stacked from 1100), and the room over goes
+  to its time-series charts, a fifth taller.
+- **Explorer**: a smaller title, the block strip's padding and scrollbar band trimmed, tighter
+  table rows and the table reaching the window's bottom edge — three more blocks on the first
+  screen.
+- **Peers**: a long onion or i2p address no longer makes the whole page scroll sideways (it clips
+  with an ellipsis and carries the full text as its title; a wide table scrolls inside its card),
+  rows and service badges tighter, the top strip's cards at their own heights.
+- **Network**: Throughput beside a stack of Upload and Traffic accounting, the throughput chart
+  taller, and the sources table taking the rest of the window.
+- **Events**: the feed reaches the window's bottom edge (it stopped a hundred pixels short).
+- **Chain & Sync**: one-line notes under the block-size and tip charts (the longer sentences are
+  their tooltips), the transaction-rate figures as one wrapping line, values that keep to their
+  line, and a shorter uptime label — the first three rows sit level and the drill-down and indexes
+  reach the first screen.
+- **Node & RPC**: two stacks (RPC etiquette with its figures in two columns, Data quality and Node
+  connection; Poll cadence, self-telemetry beside the log tail, Panel sources and the RPC
+  console) instead of grid rows that left holes beside the short cards.
+- **Admin**: two stacks (Users over the audit log; Node actions over Change own password, whose
+  two fields share a row). **Sign-in** and **404**: the same tighter card.
+- **Display settings**: the tabs in three labelled rows — Boards (Appearance, Block space, Sky,
+  Markets & Price), Effects, and the Diversions last; rows, note and groups tighter, the sheet a little wider so hints wrap
+  less, and on the two effects tabs the switches run two across with each hint as the row's
+  tooltip — the Space effects tab is under half the scrolling it was. The price line on Overview
+  switch sits directly under the polling switch it depends on.
+- **About**: the sky runs to the bottom edge with the credit line at its foot, and the GitHub
+  link and the tip pill share a row.
+- **The Diversions pages take the window**: the wells of Tetrust, Blockout and Blockanoid grow to
+  the window's height (they stopped at 600px), and the DOS screen is always 4:3 and as large as
+  the window allows — at a 1093px window the 320×200 picture had been drawn squashed into a
+  761×720 box.
+
+### DOS Diversions
+
+- **DOOM.** The shareware `DOOM.EXE` v1.9 and `DOOM1.WAD` from `games/doom_dos/`, unmodified,
+  running on a PC emulated in the browser with no dependencies: an i386 interpreter
+  (`public/js/x86.js`), the DOS/4GW machine around it — DOS, DPMI, BIOS, PIC, timer, keyboard and
+  a planar VGA (`dospc.js`) — and a Sound Blaster Pro 2 with an OPL3 for the effects and the music
+  (`soundcard.js`), in a worker. Demos, menus, savegames and ENDOOM all work; 35 frames a second.
+  Mouse capture, WASD keys by default (the switch rebinds the running game at once), smoothing,
+  full screen; pauses when you look away; savegames and DOOM's config stay in the browser.
+- **Wolfenstein 3D.** The shareware `WOLF3D.EXE` v1.4 and its `.WL1` files from
+  `games/wolf3d_dos/`, unmodified, on the same emulated PC — which now also runs a 16-bit real-mode
+  DOS program: real mode in the CPU (segments times sixteen, a wrapping SP, 16-bit string
+  instructions and interrupt frames), a plain MZ loader with its relocations, DOS's memory
+  allocator, the interrupt vector table, and VGA write mode 1. Menus, demos, AdLib music,
+  digitised sound effects, savegames and high scores kept in the browser, at its full 70 frames a
+  second. It sits before DOOM and Quake in the Diversions menu.
+- **Quake.** The shareware `QUAKE.EXE` v1.06 and `PAK0.PAK` from `games/quake_dos/`, unmodified,
+  on the same emulated PC — which now also plays the go32 stub and CWSDPMI for a DJGPP program:
+  segment bases and 16-bit code in the CPU, a COFF loader, a directory tree, DOS's system file
+  table, the BIOS tick count. Demos, menus, savegames, sound effects through the Sound Blaster,
+  and the order screen on quit. W A S D and mouse look on the first start, Quake's own bindings
+  after. Quake starts with a smaller view (`viewsize 80`); **−** and **=** change it and Quake
+  keeps the choice.
+- **The emulated PC is fast.** Each instruction is decoded once and cached rather than decoded
+  every time it runs (writes into cached code clear what they overlap, because both games patch
+  their own drawing code), the arithmetic and the x87 forms Quake runs most have handlers of their
+  own, and memory addresses are formed inline: Quake from 77 to about 141 million instructions a
+  second, its `timedemo demo1` from 29.7 fps to over 50; in the browser Quake plays at 40–50
+  frames a second.
+- **A way out of full screen**: an **exit full screen** button in the top corner while full
+  screen, and holding **Esc** for a second (a tap of Esc stays the game's menu, which is what the
+  keyboard lock is for); leaving unlocks the keyboard and releases the mouse.
+- The game files are served at `/games/<game>/<path>` (`server/http/games.js`); the shareware
+  packages live under `games/` (DOOM's moved from `doom_dos/` at the repository root).
+
+### Markets and the effects
+
+- **Black hole**, a Markets effect (modelled on NASA's visualisation, svs.gsfc.nasa.gov/14576): a
+  point of darkness opens and grows to a horizon over 26 s, the price line bends round it as
+  through a lens (the Einstein-radius push), the candles it reaches stretch and lean toward it and
+  shrink away into it, and an accretion disk seen nearly edge-on — a thin band white-yellow at its
+  inner edge through orange to a dark red rim, five hundred fibres spiralling inward sheared by
+  the Keplerian flow, its far side lensed into an arch over the shadow and a smaller one beneath,
+  a photon ring hugging the horizon, starlight bent into arcs. **It crosses the board**: it opens
+  a fifth of the way in on one side and runs a straight line through the chart to a fifth from the
+  other, from one height to another, so the line is seen bending round it as it passes; the
+  candles' orbits ride along at a quarter of the first cut's speed. It finishes its crossing before
+  it lets go, and lets go evenly, every candle gliding home and growing back smoothly. It hovered
+  over Block space for a day and its cubes never came home cleanly enough, so it is a Markets
+  effect only.
+- **Supernova** (the solar flare, renamed and remade on NASA Goddard's animation,
+  svs.gsfc.nasa.gov/20413): the star is a glint — halo, hot core, diffraction spikes — growing and
+  blue-shifting as it goes; the opening explosion is a **white-hot flash**, held and washing far
+  out, that throws **a hundred and twenty-eight plumes of white gas** in every direction, each
+  flying and growing on its own out to nine star radii and drifting on until the effect is nearly
+  done (drawn on a half-resolution layer to keep the frame cheap); the debris is a volume of gas in
+  three layers — a blue cloud out in front, a white one behind it into which **violet grows patch
+  by patch from a tenth of the run**, and a deep violet heart — with a soft shock band throwing
+  and shaking the candles it crosses; and as the cloud dims a **pulsar** beats seven times a
+  second at the centre, two thin beams sweeping round, inside a nebula of the same gas that holds
+  its violet weight until four fifths of the run. 16 s (24 on Markets).
+- **Fireworks are a display**, on both boards: every shell drawn — the rocket's arc, a white flash
+  and a shockwave ring at the burst, seven shell kinds by turn (peony, chrysanthemum, willow, ring,
+  crossette, strobe and more), sixty to ninety sparks each a curved trail, a lens flare at every
+  burst, glitter rain, and a nebula of smoke that drifts up and lingers; up to ten shells on
+  Markets over 14 s (five on Block space), each lighting the candles under it in its own colour.
+  **Off by default** on both boards, kept for special occasions.
+- **X-ray**, on both boards: a front sweeps the board and everything behind it goes x-ray — bodies
+  dimmed to glass, every edge lit, a raster of thin lines across each face — then develops back.
+- **Breathe** and **Light saber**, on the price line: three slow swells from the plain wire to
+  white heat and back; and the line igniting from its left end, blue, green, red or purple by the
+  run, humming with a breathing glow, spitting sparks, retracting to the hilt.
+- **The energy pulse is heat, not blue, and its head is a crackling ball of plasma**; **the scan
+  line is a light curtain** standing on the board floor to the chart's top; **ball lightning is a
+  light source**, its arcs discharges built by midpoint displacement rather than zigzags, a quarter
+  of its size and a third of its speed on Markets; the scanner's cone is dimmer on both boards.
+- **The Markets board keeps its price fit across refreshes**: the last fit is kept while the data
+  still sits inside it and fills at least two-thirds of it, so a refresh no longer re-scales the
+  whole chart unanimated. Whatever a head pulls is painted last, nearest the head on top; a held
+  pool refresh waits a moment and a half after an idle effect ends, with the board whole and still.
+- **Layered soft fills add up correctly** (`softStops`): each nested disc carries only its
+  increment, so a stop's cumulative opacity is exactly the stop's; measured on the Kiosk, the
+  supernova's peak opacity fell from about 0.9 to about 0.45 and the chart shows through it.
+- **The no-repeat window holds from the first pick** on both boards: every effect plays once
+  before any repeats (a negative slice index had let one come round at the tenth pick). The
+  searchlight and the tractor beam, which fly the same saucer, share the window.
+- **A Kiosk test suite** (`test/kiosk.test.js`): every Markets and Block space effect plays through
+  the frame loop on a Kiosk-sized panel; the supernova, the black hole and the fireworks are
+  bounded by the board's width so no panel is covered.
+
+### Fixed
+
+- **The donation QR shows on Safari.** It was an inline SVG of 800 module rects, and Safari on
+  the first Mac install painted its white ground and none of the rects. It is a PNG now, painted
+  the same everywhere.
+- **A dead index worker fails the build instead of hanging it.** A worker killed outright (out of
+  memory, with four beside the node) left its job unanswered and the build sat at "scan 5,720 of
+  5,721, about 1 s left" for an hour and a half on the first Mac install. The run now rejects the
+  moment a worker exits or throws, naming the job and the fix (fewer `addressIndexWorkers`); the
+  progress flag says *no progress for N min* when nothing has moved.
+- The 0.0.9 release notes' test count corrected (862, not 864).
+
+### Documentation
+
+- INSTALL, GETTING-STARTED, SECURITY, CONFIGURATION, API, TROUBLESHOOTING and the README describe
+  the hardened defaults, HTTPS and the polling switch; INSTALL §11 has the notes for updating a
+  0.0.9 install; the USER-GUIDE has the Appearance section, the Mining row and the packed layouts;
+  TROUBLESHOOTING explains a streak of stale pool-poll drops. Screenshots re-shot at 0.1.0, with a
+  Mining shot added. The announcement for the bitcointalk thread is in `docs/announcement/0.1.0/`.
 
 ## [0.0.9] — 2026-09-14
 
@@ -676,4 +925,5 @@ are an original implementation (`public/js/blockpack.js`, `public/js/feepalette.
 Internal first version: multi-user monitor with charts, sync viewer, mempool view, peers and
 event feed.
 
+[0.0.10]: https://github.com/BobClawblaw/blockyard/releases/tag/v0.0.10
 [0.0.9]: https://github.com/BobClawblaw/blockyard/releases/tag/v0.0.9

package/README.md

@@ -5,8 +5,8 @@ A live, multi-user web monitor and block explorer for
 
 Point it at your node and open a browser: live charts, a 3D block-space viewer,
 a block / transaction / address explorer, exchange prices with order-book depth, and a
-kiosk view for a wall screen. No dependencies to install, no CDN, no telemetry, and
-read-only toward your node by default.
+kiosk view for a wall screen. No dependencies to install, no CDN, no telemetry, no outbound
+connection but to your node out of the box, and read-only toward your node by default.
 
 **This is 100% machine-generated code, directed by a human operator.** Every line of the
 server, the browser app, the 3D engine, the tests and these documents was written by an AI
@@ -21,18 +21,19 @@ bugs.**
 
 | | |
 |---|---|
-| **Block space, in 3D.** The next block's worth of the mempool as a board of glowing tiles: area is vbytes, colour is feerate. Refreshes are choreographed — blocks lift, travel in collision-free lanes and land under gravity — and the board comes alive at rest with **30 idle effects**, from ripples and light cycles to a lightning ball, ball lightning, a UFO's tractor beam, Missile Command, fireworks, code rain and a demoscene plasma. Two viewer modes: **Simple** (the richest few hundred transactions as cubes) and **Detailed** (every transaction in the block). | ![Block space, Detailed mode](docs/images/block-space-mode2.jpg) |
-| **A board you can tune.** Neon-tube blocks, a metallic sheen or a chrome finish that mirrors a horizon, a movable lamp, a touch of perspective, a spiral galaxy behind the board, and a switch for every one of the 30 effects — in a tabbed settings panel. Stored on the server (`config/blockyard.json`), so every screen sees the same board; they change how things are *drawn*, never what is measured. | ![Neon blocks and the metallic sheen](docs/images/block-space-neon.jpg) |
+| **Block space, in 3D.** The next block's worth of the mempool as a board of glowing tiles: area is vbytes, colour is feerate. Refreshes are choreographed — blocks lift, travel in collision-free lanes and land under gravity — and the board comes alive at rest with **34 idle effects**, from ripples and light cycles to a lightning ball, ball lightning, a UFO's tractor beam, Missile Command, fireworks, code rain and a demoscene plasma. Two viewer modes: **Simple** (the richest few hundred transactions as cubes) and **Detailed** (every transaction in the block). | ![Block space, Detailed mode](docs/images/block-space-mode2.jpg) |
+| **A board you can tune.** Neon-tube blocks, a metallic sheen or a chrome finish that mirrors a horizon, a movable lamp, a touch of perspective, a spiral galaxy behind the board, and a switch for every one of the 34 effects — in a tabbed settings panel. Stored on the server (`config/blockyard.json`), so every screen sees the same board; they change how things are *drawn*, never what is measured. | ![Neon blocks and the metallic sheen](docs/images/block-space-neon.jpg) |
 | **An explorer that looks the part.** Search a height, block hash, txid or address. Transaction pages with fee, fee rate and dollar value, feature badges, a flow diagram from inputs to outputs, and links to where every coin came from and went. **Address pages with full history and balance** — Bitcoin Core has no address index, so BlockYard builds its own from the node's block files (**a few hours** on first start, 124 GB) and keeps it current as blocks arrive. | ![Explorer transaction](docs/images/explorer-tx.jpg) |
-| **Markets.** Five exchanges' public prices: a 3D candle chart with a neon price line, a precise flat candlestick chart, an exchange table, and a bitcoinity-style order-book depth chart with change bars. Fetched by the server only while someone is looking. | ![Markets](docs/images/markets.jpg) |
+| **Markets.** Five exchanges' public prices: a 3D candle chart with a neon price line, a precise flat candlestick chart, an exchange table, and a bitcoinity-style order-book depth chart with change bars. Off until you tick **Enable market polling** — it is the one thing that talks to anyone but your node — and, once on, fetched by the server only while someone is looking. | ![Markets](docs/images/markets.jpg) |
 | **Kiosk.** The 3D markets board, a price panel and the block-space board side by side, full screen with one click. | ![Kiosk](docs/images/kiosk.jpg) |
-| **Tetrust, Blockout and Blockanoid.** Three playable games built on the same 3D engine — trust, but verify. Tetrust is Tetris: the well is the block-space board and the music is synthesised in the browser. Blockout is Breakout, where the wall is made of block-space stones and the bat follows your mouse. Blockanoid is Arkanoid: a different wall every level, silver bricks that take more than one hit, gold that takes none, and capsules that fall out of what you break — laser, wide, catch, slow, three balls, a life. All three pause when you look away and keep high scores per browser. | ![Tetrust](docs/images/tetrust.jpg) |
+| **Tetrust, Blockout and Blockanoid.** Three playable games built on the same 3D engine — trust, but verify. Tetrust is Tetris: the well is the block-space board and the music is synthesised in the browser. Blockout is Breakout, where the wall is made of block-space stones and the bat follows your mouse. Blockanoid is Arkanoid: a different wall every level, silver bricks that take more than one hit, gold that takes none, and capsules that fall out of what you break — laser, wide, catch, slow, three balls, a life. All three pause when you look away and keep high scores per browser. And **Wolfenstein 3D**, **DOOM** and **Quake**: the real shareware `WOLF3D.EXE` (1992), `DOOM.EXE` (1993) and `QUAKE.EXE` (1996), unmodified, on a PC emulated in the browser — processor in real and protected mode, FPU, DOS and both extenders, VGA and Sound Blaster written from scratch, still with no dependencies. So if anyone asks *"well, can it run DOOM?"*, the answer is an emphatic **"Naturally. What sort of AI slop generator do you take me for?"** | ![Tetrust](docs/images/tetrust.jpg) |
 
 Also on board: a sync viewer with an honest ETA, Block flow (projected blocks, the block
 being built, recent blocks), mempool and fee charts, a peer table, bandwidth, the node's
 event stream, a provenance table for every figure, a read-only RPC console behind a
 default-deny allowlist, and a tabbed **Display settings** panel (the gear) that tunes every
-board without a reload.
+board without a reload and picks the layout's colours — light or dark, the shipped look, Mono,
+Nous, GitHub, Catppuccin, or nine colours of your own.
 
 ## Quick start
 
@@ -46,9 +47,10 @@ top of the node's own ~875 GB of block files.
 ```bash
 git clone https://github.com/BobClawblaw/blockyard.git
 cd blockyard
-npm test            # optional: 862 unit tests, all built in
+npm test            # optional: 945 unit tests, all built in
 npm run setup       # reads the node's bitcoin.conf, checks the node, writes config/local.json
-npm start           # builds the address index in the background (a few hours); open http://127.0.0.1:21000
+npm start           # builds the address index in the background (a few hours); open https://127.0.0.1:21000
+                    # and sign in as admin with the password the first start prints once
 ```
 
 `npm run setup` asks for the node's data directory, reads its `bitcoin.conf` for the rest,
@@ -107,15 +109,23 @@ design rests on) and [docs/DEFECTS.md](docs/DEFECTS.md) (known limits).
 
 ## Security at a glance
 
-- **Open, read-only access by default** — like a block explorer, anyone who can reach the
-  port can look. Accounts, roles, sessions, CSRF protection and a per-user audit trail turn
-  on with `BLOCKYARD_AUTH=1`.
-- **Where it listens is your decision** — bind to `127.0.0.1`, a LAN address, a VPN
-  address, or several. Built-in HTTPS with `BLOCKYARD_TLS_CERT` / `BLOCKYARD_TLS_KEY`.
-- **Outbound connections are limited and on demand**: exchange APIs only while someone has
-  the Markets, Kiosk or Overview tab open — Overview's price line is on by default, so the landing
-  page reaches out unless you switch it off — plus a cached spot price for the explorer's dollar
-  figures. `BLOCKYARD_MARKETS=0` turns all of it off.
+- **Hardened out of the box** — it listens on `127.0.0.1` only and requires sign-in: the
+  first start creates an `admin` account and prints its password once. Accounts, roles,
+  sessions, CSRF protection and a per-user audit trail are on. Reach it from another machine
+  over an SSH tunnel, or bind a LAN address (`BLOCKYARD_BIND`) when you decide the LAN may
+  see it; open, read-only access with no account is a choice (`BLOCKYARD_AUTH=0`), announced
+  at boot.
+- **HTTPS by default** — the first start makes the monitor its own certificate (no
+  dependencies: the X.509 is written by hand), and every listener serves it; a certificate of
+  your own with `BLOCKYARD_TLS_CERT` / `BLOCKYARD_TLS_KEY`, or `BLOCKYARD_TLS=0` behind a
+  proxy that terminates TLS.
+- **Where it listens is your decision** — `127.0.0.1`, a LAN address, a VPN address, or
+  several.
+- **No outbound connections out of the box**: a fresh install talks to nothing but your node.
+  The one exception is opt-in — a checkbox, **Display settings → Markets & Price → Enable
+  market polling**, turns on the exchange feed for the Markets and Kiosk tabs, Overview's price
+  line and the explorer's dollar figures, and even then the server asks the exchanges only while
+  someone is looking. `BLOCKYARD_MARKETS=0` removes the feed so that no checkbox can turn it on.
 
 Details in [docs/SECURITY.md](docs/SECURITY.md). To report a vulnerability, see
 [SECURITY.md](SECURITY.md).
@@ -126,7 +136,7 @@ Details in [docs/SECURITY.md](docs/SECURITY.md). To report a vulnerability, see
 npm run dev          # fake node doing a simulated sync, port 18088
 npm run setup        # interactive install: read bitcoin.conf, check the node, write config/local.json
 npm run check        # the same checks (every call timed) against every configured node; exits 1 on a FAIL
-npm test             # 862 unit tests (node:test, no dependencies)
+npm test             # 945 unit tests (node:test, no dependencies)
 npm run smoke        # boots the real server and checks the HTTP contract
 npm run counts:fix   # keep the documented test count in step with the suite
 ```
@@ -136,13 +146,22 @@ RPC etiquette) and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for how it fits
 
 ## Status
 
-Version **0.0.9** — the initial release, and pre-release software: the word is meant literally. The test suite is
-comprehensive (862 tests, plus a live smoke run), the monitoring side is solid, and the
+Version **0.1.0** — the first minor release, two days after the initial 0.0.9, and pre-release
+software: the word is meant literally. Published 2026-09-16: on [npm](https://www.npmjs.com/package/blockyard)
+as `blockyard`, as a [GitHub release](https://github.com/BobClawblaw/blockyard/releases/tag/v0.1.0),
+and announced on
+[bitcointalk](https://bitcointalk.org/index.php?topic=5594141.msg67144312) — questions, bug
+reports and reviews are welcome there and in [issues](https://github.com/BobClawblaw/blockyard/issues).
+It ships **hardened**: bound to this machine, sign-in on, HTTPS with a certificate it makes itself,
+and **zero telemetry** — no outbound connection to anyone but your node until you tick the market
+polling switch yourself.
+The test suite is
+comprehensive (945 tests, plus a live smoke run), the monitoring side is solid, and the
 explorer's biggest gap is closed: **address history and balances**, which Bitcoin Core cannot
 answer at any setting, now come from an **address index BlockYard builds itself** from the
 node's block and undo files and keeps current as blocks arrive. It is checked against the node
-(every balance equal to `scantxoutset`, to the satoshi) and costs ~30 minutes on 16 workers and
-124 GB of disk, built in the background the first time BlockYard starts and paced so the node's
+(every balance equal to `scantxoutset`, to the satoshi) and costs a few hours on the default four
+workers (~30 minutes on 16) and 124 GB of disk, built in the background the first time BlockYard starts and paced so the node's
 RPC stays responsive; without one, the address page says *not indexed* rather than showing a
 zero. An address's unspent outputs are listed too (for a history of up to 100 transactions).
 What it does not yet have: an address's mempool transactions.

package/bin/blockyard.js

@@ -27,11 +27,12 @@ const COMMANDS = {
   start: 'server/main.js',
   'index-build': 'scripts/index-build.js',
   users: 'scripts/manage-users.js',
+  tls: 'scripts/tls.js',
 };
 const cmd = process.argv[2];
 if (!COMMANDS[cmd]) {
   const version = JSON.parse((await import('node:fs')).readFileSync(path.join(root, 'package.json'), 'utf8')).version;
-  process.stdout.write(`BlockYard ${version}\n\n  blockyard setup          ask where the node is, check it, write the config, build the index\n  blockyard start          run the monitor\n  blockyard check          the same checks as setup, any time\n  blockyard index-build    build the address index by hand (--out <dir> [--workers N])\n  blockyard users          manage accounts\n\nconfig ${process.env.BLOCKYARD_CONFIG}\ndata   ${process.env.BLOCKYARD_DATA}\n`);
+  process.stdout.write(`BlockYard ${version}\n\n  blockyard setup          ask where the node is, check it, write the config, build the index\n  blockyard start          run the monitor\n  blockyard check          the same checks as setup, any time\n  blockyard index-build    build the address index by hand (--out <dir> [--workers N])\n  blockyard users          manage accounts\n  blockyard tls            remake this monitor's own HTTPS certificate (--san to add names)\n\nconfig ${process.env.BLOCKYARD_CONFIG}\ndata   ${process.env.BLOCKYARD_DATA}\n`);
   process.exit(cmd ? 2 : 0);
 }
 // the scripts decide "am I being run directly?" by comparing argv[1] to their own path, so hand

package/docs/API.md

@@ -89,7 +89,7 @@ Other statuses: `204` for `OPTIONS` on any path (`Allow: GET,POST,DELETE,HEAD`).
 
 Each route in the table has one of three auth levels:
 
-| Level | Accounts off (default) | Accounts on (`BLOCKYARD_AUTH=1`) |
+| Level | Accounts off (`BLOCKYARD_AUTH=0`) | Accounts on (the default) |
 |---|---|---|
 | `none` | Open. | Open. No session needed. |
 | `any` | Served as the built-in anonymous user (`role: "viewer"`). | Any valid, non-disabled session. Without one: `401`. |
@@ -97,14 +97,14 @@ Each route in the table has one of three auth levels:
 
 The roles are `viewer` < `operator` < `admin`. No route in the table requires `viewer` or `operator` by itself. Those two roles matter in two places only: each node action names a minimum role (section 14), and `POST /api/password` needs `admin` to change *another* user's password.
 
-**Open mode (the default, `auth.enabled=false`).** No sign-in. Anyone who can reach the port can read everything (state, charts, events, peers, mempool, explorer, markets, the read-only RPC console) as `viewer`. The ceiling is fixed and nothing can raise it. As a result:
+**Open mode (`auth.enabled=false`, a choice; the default is accounts on).** No sign-in. Anyone who can reach the port can read everything (state, charts, events, peers, mempool, explorer, markets, the read-only RPC console) as `viewer`. The ceiling is fixed and nothing can raise it. As a result:
 
 - user administration, `/api/audit` and password changes are closed;
 - node writes (`/api/action`) are refused unless `BLOCKYARD_ALLOW_WRITES_WITHOUT_AUTH=1` was set deliberately;
 - `/api/login` answers `403 accounts_disabled`;
 - `GET /login` redirects (`302`) to `/`.
 
-**Accounts mode (`BLOCKYARD_AUTH=1`).** Sign-in, roles, sessions, CSRF protection and a per-user audit trail. On first start with no users, an `admin` account is created. Its password comes from `BLOCKYARD_ADMIN_PASSWORD`, or is generated and printed once to the server log.
+**Accounts mode (the default).** Sign-in, roles, sessions, CSRF protection and a per-user audit trail. On first start with no users, an `admin` account is created. Its password comes from `BLOCKYARD_ADMIN_PASSWORD`, or is generated and printed once to the server log.
 
 ### Session cookie
 
@@ -224,8 +224,8 @@ Auth `none`, not rate limited. Built for uptime probes. `ok` is `true` when at l
 {
   "ok": true,
   "degraded": [],
-  "version": "0.0.9",
-  "build": "0.0.9-fd620adc52",
+  "version": "0.1.0",
+  "build": "0.1.0-fd620adc52",
   "scheme": "http",
   "tls": false,
   "uptimeSec": 1519,
@@ -242,7 +242,7 @@ Auth `none`, not rate limited. Built for uptime probes. `ok` is `true` when at l
 What the About page shows: the monitor's version and live build, and the **shape** of the machine it runs on.
 
 ```json
-{ "version": "0.0.9", "build": "0.0.9-a6ecedff3c", "platform": "linux", "release": "7.0.0-31-generic",
+{ "version": "0.1.0", "build": "0.1.0-a6ecedff3c", "platform": "linux", "release": "7.0.0-31-generic",
   "arch": "x64", "cpus": 32, "cpuModel": "AMD Ryzen 9 9950X3D 16-Core Processor",
   "totalMemGb": 132.3, "node": "v22.23.2", "uptimeSec": 2355 }
 ```
@@ -261,9 +261,9 @@ Auth `none`. Answers "is the code in my tab the code on disk?" The build id is `
 
 ```json
 {
-  "version": "0.0.9",
-  "build": "0.0.9-5223f98d84",
-  "bootBuild": "0.0.9-fd620adc52",
+  "version": "0.1.0",
+  "build": "0.1.0-5223f98d84",
+  "bootBuild": "0.1.0-fd620adc52",
   "matchesClient": null,
   "scheme": "http",
   "tls": false,
@@ -295,6 +295,7 @@ Top-level keys:
 ```
 id label color online chain ibd tip sync progress warnings difficulty hashrateEstEh hashrateNote
 avgBlockGapSec sizeOnDisk pruned chainwork uptimeSec network mempool peers net attribution blocks
+network (the Mining tab's network row: rewards over 144 blocks, adjustment, halving, adjustments[], hashrate { networkHashPs, series[] }, pools { blocks, luckPct, pools[], filled, todo }; collect/network.js)
 fees mining utxo chaintxstats indexes tips deployments rpcInfo log health series app user seq
 ```
 
@@ -331,7 +332,7 @@ Trimmed example:
   "health": { "rpc": { "online": true, "...": "..." }, "cadence": { "fast": { "configuredMs": 4000,
               "effectiveMs": 4000, "stretched": false, "lastRunMs": 120 } }, "quality": [] },
   "series": { "mempool": { "hour": [ { "t": 1789154820000, "v": 18780 } ], "...": "..." } },
-  "app": { "version": "0.0.9", "build": "0.0.9-fd620adc52", "scheme": "http", "uptimeSec": 1536,
+  "app": { "version": "0.1.0", "build": "0.1.0-fd620adc52", "scheme": "http", "uptimeSec": 1536,
            "sseClients": 5, "self": { "rssMb": 175.6, "heapMb": 42.8, "cpuPct": 2.71 }, "serverTime": 1789155688322 },
   "user": { "username": "anonymous", "role": "viewer", "id": "anonymous", "disabled": false, "lastLoginAt": null },
   "seq": 406
@@ -1029,8 +1030,9 @@ To poll incrementally, keep `maxSeq` and pass it back as `since`. The filters ar
 
 Exchange prices from the public REST APIs of Coinbase, Kraken, Bitstamp, Bitfinex and OKX. **This is the only outbound connection BlockYard makes that is not to the node.** It runs server-side, because the page's CSP allows `connect-src 'self'` only.
 
-- **On demand.** Nothing is fetched until someone calls `/api/markets` or `/api/markets/depth`. Each call "touches" the feed. The dashboard's Overview makes that call by default (Display settings → Markets & Price → Price line on Overview), so a monitor with anyone on its landing page is polling. While touched, it polls tickers every 15 s, hourly candles every 5 min and order books every 30 s. It stops 10 minutes after the last touch.
-- `BLOCKYARD_MARKETS=0` (or `markets.enabled=false`) turns it off. Both endpoints then answer `{ "ok": true, "enabled": false, "note": "market data is off on this monitor (...)" }`.
+- **Off by default.** Polling runs only while the Display setting **Markets & Price → Enable market polling** is on (`markets.polling` in the shared settings file, read per request). With it off, both endpoints answer `{ "ok": true, "enabled": false, "polling": false, "note": "market polling is off ..." }`, the call parks the feed, and the monitor makes no outbound connection but to the node.
+- `BLOCKYARD_MARKETS=0` (or `markets.enabled=false`) removes the feed altogether; both endpoints then answer `{ "ok": true, "enabled": false, "note": "market data is off on this server ..." }` whatever the setting.
+- **On demand.** With polling on, nothing is fetched until someone calls `/api/markets` or `/api/markets/depth`. Each call "touches" the feed. The dashboard's Overview makes that call by default (Display settings → Markets & Price → Price line on Overview), so a monitor with anyone on its landing page is polling. While touched, it polls tickers every 15 s, hourly candles every 5 min and order books every 30 s. It stops 10 minutes after the last touch.
 - An exchange that fails keeps its last data and reports `error`. It is never dropped or zero-filled.
 
 ### `GET /api/markets`
@@ -1222,7 +1224,7 @@ If the node refuses, the answer is `200` with `{ "ok": false, "action", "method"
 
 ## 15. Accounts, sessions, users and audit
 
-These routes are meaningful only with `BLOCKYARD_AUTH=1`. In open mode they answer as noted.
+These routes are meaningful only with accounts on (the default). In open mode they answer as noted.
 
 The user object returned by these routes (`publicUser`):
 
@@ -1378,7 +1380,7 @@ The monitor's own health: process, RPC client, log tail, stream clients and the
 ```json
 {
   "self": { "t": 1789155700000, "rssMb": 175.6, "heapMb": 42.8, "sseClients": 5, "usersActive": 0,
-            "cpuPct": 2.71, "eventRate": 0, "build": "0.0.9-fd620adc52" },
+            "cpuPct": 2.71, "eventRate": 0, "build": "0.1.0-fd620adc52" },
   "nodes": [
     { "id": "main",
       "rpc": { "nodeId": "main", "url": "http://127.0.0.1:8332", "cookieSource": "...", "online": true,