blockyard 0.0.9 → 0.1.0

package/docs/ARCHITECTURE.md

@@ -192,8 +192,9 @@ it directly; running the file as a script calls it and prints the banner.
    missing is skipped with a logged reason rather than kept as a permanently
    offline panel. `wireMonitor()` connects each monitor's events to the SSE hub
    and coalesces pushes to one snapshot per second.
-8. `MarketFeed` is created if `markets.enabled` is set. It stays idle until the
-   Markets API is requested.
+8. `MarketFeed` is created if `markets.enabled` is set. It stays idle until the Markets
+   API is requested with the **Enable market polling** setting on (off by default; read from
+   the shared settings file per request, `marketsPollingOn` in `http/api.js`).
 9. One HTTP(S) server is created per bound address, all sharing the same `app`.
    An address missing at boot is skipped with a warning. Boot is fatal only when
    none of the configured addresses exist.
@@ -346,7 +347,9 @@ Bitstamp, Bitfinex and OKX.
   with its error, never zero-filled. Tickers older than three intervals are marked
   `stale`.
 
-`BLOCKYARD_MARKETS=0` (or `markets.enabled: false`) disables all of it.
+Polling is off by default — the **Enable market polling** Display setting turns it on, and a
+request with it off parks the feed. `BLOCKYARD_MARKETS=0` (or `markets.enabled: false`)
+removes the feed altogether.
 
 ### 2.4 The RPC lane (`server/rpc/client.js`)
 
@@ -523,11 +526,12 @@ flowchart LR
 
 ### 2.7 Auth (`server/auth/*`)
 
-- **Open by default.** With `auth.enabled: false` (the default), every request is
+- **Sign-in by default** (since 2026-09-15; it shipped open in 0.0.9), bound to
+  `127.0.0.1`. With `auth.enabled: false` (`BLOCKYARD_AUTH=0`), every request is
   served as a frozen anonymous user with role `viewer`. That ceiling is hardcoded,
   not configurable. Admin routes return 403 in both modes, CSRF is not needed
   because there is no cookie to ride, and rate limits apply per client address.
-- **Accounts.** `BLOCKYARD_AUTH=1` turns on:
+- **Accounts** (the default; `BLOCKYARD_AUTH=1` restores them after an override):
   - scrypt password hashes (upgraded to current parameters on login)
   - session tokens that are stored hashed, with idle and absolute TTLs
   - double-submit CSRF (the token in a header or body is compared with the
@@ -659,6 +663,7 @@ loaded from the same origin. There is no build step and no framework.
 | `settings.js` | display settings: `DEFAULTS`, the `PANEL` rows of the settings dialog, `normalise()`, and the option builders (`spaceOptions`, `enabledEffects`, ...) the boards read; stored on the server (`/api/settings`) with a `localStorage` copy |
 | `about.js` | the About page (version, system and node info) |
 | `tetris.js` / `tetrust.js`, `breakout.js` / `blockout.js`, `arkanoid.js` / `blockanoid.js`, `tetsound.js` | the Diversions: pure game rules in the first file of each pair, the tab drawn on the 3D engine in the second, and Tetrust's sound |
+| `x86.js`, `dospc.js`, `soundcard.js`, `dosworker.js`, `dosaudio.js`, `dosio.js`, `dosgame.js`, `doom.js`, `quake.js` | the DOS Diversions: an i386 interpreter, the PC around it (DOS/4GW for DOOM, the go32 stub and CWSDPMI for Quake), a Sound Blaster Pro 2 with an OPL3, the worker the machine runs in, the AudioWorklet it plays through, the pure keyboard/config/text-mode helpers, the shared tab, and each game's own few lines (section 3.4) |
 | `fmt.js` | formatters: decimal units (as the node prints them), `–` for anything absent |
 | `login.js` | the login page (a separate file because of the CSP) |
 
@@ -790,6 +795,88 @@ What this means for front-end code:
 
 ---
 
+### 3.4 The DOS Diversions: Wolfenstein 3D, DOOM and Quake
+
+The shareware `WOLF3D.EXE` v1.4, `DOOM.EXE` v1.9 and `QUAKE.EXE` v1.06 run unmodified on a PC emulated in
+the browser.
+Nothing is ported and no dependency is used; every layer is this repository's own:
+
+```
+wolf3d.js / doom.js / quake.js -> dosgame.js (page)  --scancodes, mouse, run/pause-->  dosworker.js (Worker)
+      ^                                                                      |
+      |  frames (320x200 indices + palette), text-mode cells, stats          |  createPC()      dospc.js
+      +----------------------------------------------------------------------+    createCpu()   x86.js
+dosaudio.js (AudioWorklet) <--stereo PCM over a MessagePort-----------------+    soundcard.js  (SB Pro 2 + OPL3)
+```
+
+- **`x86.js`** is a user-mode i386 with an x87, interpreted. No paging or rings: a DOS extender's
+  program runs in protected mode, and segment registers carry a base and a size. EIP is
+  kept linear and converted at the edges (a pushed return address, a loaded jump target) against
+  the code segment's base, ESP is an offset in SS: DOS/4GW's segments are all at 0, DJGPP's at the
+  program's memory block. A code segment whose descriptor is 16-bit decodes 16-bit (DJGPP's
+  start-up and exit run small 16-bit helpers in DOS memory). **Real mode** is a switch
+  (`cpu.realMode`) for Wolfenstein 3D: a segment's base is its value times sixteen, code is 16-bit,
+  the stack pointer is SP and wraps inside its segment, the string instructions count with SI, DI
+  and CX, and an interrupt pushes a 16-bit frame and goes through the vector table at 0:0. Real-mode
+  code runs through `step()` rather than the decoded cache: it needs about a third of the speed it
+  gets. The page's CSP forbids eval, so there
+  is no JIT; speed comes from keeping every value an int32 (a `>>> 0` above 2^31 is a double and,
+  in a closure variable, an allocation), lazy flags recorded in an `Int32Array`, one try/catch
+  around the loop rather than each instruction, and 32-bit fast paths for the instructions
+  compilers emit most. The FPU keeps its stack in a Float64Array and converts operands through
+  typed-array views. **Decoded instructions are cached**: each is decoded once into three int32s
+  (a handler number with its registers packed beside it, a displacement, an immediate) in an
+  Int32Array per 4 KB page, and `run()` dispatches on the handler number with one switch; the forms
+  it does not specialise run through `step()`. Not closures -- a closure per instruction made every
+  call megamorphic and ran slower than the interpreter. Writes into a page holding decoded code
+  clear only the instructions they overlap (DOOM and Quake both patch constants into their own span
+  drawers on every call), and the machine calls `cpu.invalidate()` after it writes memory directly.
+  The ALU operations have a handler each (their flag bookkeeping inline, not one shared routine
+  branching on the operation), so do the x87 forms Quake runs most, and the loop forms a memory
+  operand's address inline before the switch: the switch is too big for V8 to inline helpers into
+  every case, and those calls were most of what was left. About 141 million instructions a second on
+  Quake headless on one core and 115-118 in a Chromium worker; Quake's timedemo 52.5 fps of wall time
+  (MEASUREMENTS §32-35).
+- **`dospc.js`** is the machine, and it plays whichever DOS extender the program was bound to.
+  `boot()` tells them apart by the file: an EXE with neither an LE nor a COFF image inside is a
+  plain DOS program, and `bootMZ` loads it as DOS did -- a PSP, the image after it with its segment
+  relocations applied, the rest of conventional memory its block, the vector table filled with
+  pointers at stubs the machine answers (a program that installs its own handler gets it called),
+  and DOS's allocator behind INT 21h 48h/49h/4Ah, which Wolfenstein 3D uses to shrink itself and
+  claim the rest. `loadLE` finds DOOM's LE executable inside the DOS/4GW
+  stub, loads it at +1 MB and applies its fixups; `parseCoff`/`bootCoff` find Quake's COFF image
+  behind the go32 stub and do what that stub leaves behind -- a memory block with the sections in
+  it, selectors based at it, a transfer buffer with the PSP right below it (DJGPP's libc finds the
+  PSP by subtracting 100h), and the "stubinfo" crt0 reads through FS. The extenders themselves never
+  run; this file answers INT 21h (files from an in-memory, case-insensitive directory tree, written
+  files handed to the host on close, and a real system file table, because DJGPP's `fstat` walks
+  it), INT 31h DPMI (descriptors with base and size, memory blocks, protected-mode vectors,
+  simulated real-mode interrupts), INT 10h/16h/33h, and the hardware a DOS game programs directly:
+  the 8259s, the 8254 (with the BIOS tick count kept in step with it, which DJGPP's `uclock` reads),
+  the keyboard controller, and a VGA with planar memory, unchained mode, write mode 1's latched copy
+  (Wolfenstein 3D and DOOM copy between pages with it) and CRTC page flipping (how DOOM and
+  Wolfenstein 3D draw) as well as the linear window (how Quake does). The clock is injected (`now()`): wall
+  time in the worker, instruction count in tests, so a headless boot is the same run every time.
+- **`soundcard.js`** is a Sound Blaster Pro 2 at 220h/IRQ 7/DMA 1 — the DSP's command set and the
+  8237 DMA controller it pulls samples through — and an OPL3 modelled as operators with
+  documented envelope rates. `tick(t)` produces output for the machine time that passed and raises
+  the end-of-block interrupt from inside the same loop.
+- **`dosworker.js`** takes a game's name, fetches its files (`dosio.js` `GAMES`), and runs the
+  machine in ~10 ms slices, yielding between them so input arrives. It sends a frame when the CRTC
+  start address or the palette changed, or once the linear window has been written and a slice has
+  passed without more writes (never half of Quake's copy). The frame buffer bounces between the
+  worker and the page so no frame allocates. Savegames and configs are kept in IndexedDB, one
+  database a game.
+- **`dosgame.js`** is a game's tab: it draws, captures input, pauses when the tab is not on screen
+  (the worker's clock stops, so nothing moves), and uses a ScriptProcessor when `audioWorklet` is
+  unavailable — a plain-HTTP LAN address is not a secure context. `doom.js` and `quake.js` give it
+  names, key lists and switches, and so does `wolf3d.js`.
+
+The game files are served from `games/<game>_dos/` by `server/http/games.js`
+(`/games/<game>/<path>`: a game it names, at most one directory and 8.3 names of `.EXE`, `.WAD`,
+`.PAK`, `.CFG` and `.WL1`, behind the session when accounts are on) rather than from `public/`, whose every
+file feeds the build id.
+
 ## 4. The 3D engine
 
 The 3D viewer turns a set of transactions, or any caller-supplied tiles, into

package/docs/CONFIGURATION.md

@@ -95,18 +95,20 @@ Durations are in milliseconds unless the name says otherwise (`retentionHours`).
 
 | key | default | meaning |
 |---|---|---|
-| `server.host` | `"0.0.0.0"` | Address to listen on. Kept for compatibility; `server.hosts` wins when both are set. |
+| `server.host` | `"127.0.0.1"` | Address to listen on — this machine only, by default. Kept for compatibility; `server.hosts` wins when both are set. |
 | `server.hosts` | *(unset; falls back to `host`)* | Addresses to listen on: an array (`["192.0.2.10", "2001:db8::10"]`), or a single string with commas (`"192.0.2.10,198.51.100.7"`). One HTTP server is started per address, and all of them share sessions, rate limits and monitors. Entries must be address literals: IPv4, IPv6, `0.0.0.0`, `::`, or `localhost`. Hostnames are refused. See [Binding](#binding-to-specific-addresses). |
 | `server.port` | `21000` | TCP port. It is the same port on every address. It must be an integer from 1 to 65535. |
 | `server.allowCidrs` | `[]` | Client allowlist. Empty means every client that can reach the port is admitted. Otherwise only addresses inside one of the networks connect, and everyone else gets HTTP 403 (the reason goes to the server log). Entries are CIDRs or bare addresses (a bare address means `/32` or `/128`), IPv4 or IPv6, compared bit by bit. An entry that cannot be parsed stops the boot. |
 | `server.trustProxy` | `false` | When `true`, the client address is the **first** entry of the `X-Forwarded-For` header instead of the socket's peer address. That address feeds the CIDR allowlist, the rate limits and the audit log. Turn it on only when a reverse proxy you control is the sole way in and it sets that header. Otherwise any client can pick its own address and walk past `allowCidrs`. |
-| `server.tls.cert` | `null` | Path to a PEM certificate. TLS is on only when `cert` and `key` are both set, and then every listener serves HTTPS. |
+| `server.tls.enabled` | `true` | HTTPS on every listener. With no `cert`/`key` named, the server makes its own self-signed certificate under `<data>/tls/` on first start (see INSTALL §9). `false` serves plain HTTP, for a reverse proxy that terminates TLS. |
+| `server.tls.cert` | `null` | Path to a PEM certificate of your own, used instead of the made one. Set it together with `key`. |
 | `server.tls.key` | `null` | Path to the PEM private key for `cert`. This file is secret. |
 | `server.tls.hstsMs` | `172800000` (2 days) | `max-age` of the `Strict-Transport-Security` header. It is sent on TLS responses only. `0` turns it off. `includeSubDomains` and `preload` are never sent. |
 
 When TLS is on, `auth.secureCookie` is forced to `true`. At startup the server logs
 the certificate's SHA-256 fingerprint and whether it is self-signed. It also warns
-when the certificate expires within 14 days.
+when the certificate expires within 14 days — and remakes its own, if it made it, at that
+point or when the certificate no longer names a bound address.
 
 ### nodes
 
@@ -340,17 +342,18 @@ Available actions:
 The Markets tab fetches public BTC/USD prices, hourly candles and order books from
 five exchanges over HTTPS: Coinbase, Kraken, Bitstamp, Bitfinex and OKX (OKX quotes
 BTC/USDT). The fetches run on the server, not in the browser. This is BlockYard's
-only outbound connection other than the node. Exchanges see this server's IP
-address and a User-Agent, nothing about the node. Polling starts when a browser asks
-for market data -- the Markets and Kiosk tabs, and Overview's price line, which is on by
-default (Display settings → Markets & Price → Price line on Overview) -- and stops
-`idleAfterMs` after the last request, so an unwatched monitor makes no exchange traffic.
-With that line switched off, only Markets and Kiosk start it. The exchange list is fixed
-in code.
+only outbound connection other than the node, and **polling is off by default**: a fresh
+install makes no request to anyone but the node until someone ticks **Display settings → Markets & Price → Enable market polling** in the browser (a Display
+setting, stored in `config/blockyard.json` and shared by every screen; no restart).
+Exchanges then see this server's IP address and a User-Agent, nothing about the node. Polling starts when a browser asks for market data
+-- the Markets and Kiosk tabs, and Overview's price line (Display settings → Markets &
+Price → Price line on Overview) -- and stops `idleAfterMs` after the last request, so an
+unwatched monitor makes no exchange traffic. With that line switched off, only Markets
+and Kiosk start it. The exchange list is fixed in code.
 
 | key | default | meaning |
 |---|---|---|
-| `markets.enabled` | `true` | `false` removes the feed entirely, and no request is ever made. |
+| `markets.enabled` | `true` | `false` removes the feed entirely: no request is ever made, Markets and Kiosk say so, and the **Enable market polling** checkbox cannot turn it on. |
 | `markets.tickerMs` | `15000` | Ticker (last, bid, ask, 24 h volume) refresh. |
 | `markets.candleMs` | `300000` | Hourly candle refresh. |
 | `markets.bookMs` | `30000` | Order book refresh, for the depth chart. |
@@ -378,12 +381,13 @@ Environment variables override `config/local.json`.
 | variable | sets | type | default | meaning |
 |---|---|---|---|---|
 | `BLOCKYARD_CONFIG` | *(which file is read)* | path or `none` | `<repo>/config/local.json` | Configuration file to read. `none`/`off`/`no`/`-` reads no file. |
-| `BLOCKYARD_BIND` | `server.host` | list | `0.0.0.0` | Listen address(es), for example `127.0.0.1` or `192.0.2.10,2001:db8::10`. If both are set, this wins over `BLOCKYARD_HOST`. Ignored when the file sets `server.hosts` (see [Known quirks](#known-quirks)). |
-| `BLOCKYARD_HOST` | `server.host` | list | `0.0.0.0` | Same as `BLOCKYARD_BIND`. |
+| `BLOCKYARD_BIND` | `server.host` | list | `127.0.0.1` | Listen address(es), for example `0.0.0.0` or `192.0.2.10,2001:db8::10`. If both are set, this wins over `BLOCKYARD_HOST`. Ignored when the file sets `server.hosts` (see [Known quirks](#known-quirks)). |
+| `BLOCKYARD_HOST` | `server.host` | list | `127.0.0.1` | Same as `BLOCKYARD_BIND`. |
 | `BLOCKYARD_PORT` | `server.port` | number | `21000` | Listen port. |
 | `BLOCKYARD_ALLOW_CIDRS` | `server.allowCidrs` | list | *(empty: everyone)* | Client allowlist, for example `192.0.2.0/24,2001:db8::/32`. |
 | `BLOCKYARD_TRUST_PROXY` | `server.trustProxy` | boolean | `false` | Take the client address from `X-Forwarded-For`. |
-| `BLOCKYARD_TLS_CERT` | `server.tls.cert` | path | unset | PEM certificate. Set it together with `BLOCKYARD_TLS_KEY`. |
+| `BLOCKYARD_TLS` | `server.tls.enabled` | boolean | `true` | `0` serves plain HTTP (behind a TLS-terminating proxy). |
+| `BLOCKYARD_TLS_CERT` | `server.tls.cert` | path | unset | PEM certificate of your own, instead of the made one. Set it together with `BLOCKYARD_TLS_KEY`. |
 | `BLOCKYARD_TLS_KEY` | `server.tls.key` | path | unset | PEM private key. Set it together with `BLOCKYARD_TLS_CERT`. |
 | `BLOCKYARD_NODE_URL` | `nodes[0].rpcUrl` | URL | `http://127.0.0.1:8332` | RPC endpoint of the first node. |
 | `BLOCKYARD_DATADIR` | `nodes[0].datadir` | path | `/home/bitcoin/.bitcoin` | Data directory of the first node. It also **clears** `nodes[0].cookieFile`, so the cookie is looked up under the new datadir. |
@@ -404,7 +408,7 @@ Environment variables override `config/local.json`.
 | `BLOCKYARD_ALLOW_WRITES_WITHOUT_AUTH` | `actions.allowWritesWithoutAuth` | boolean | `false` | Permit actions while accounts are off. |
 | `BLOCKYARD_LOG_SOURCE` | `log.enabled` | boolean | `false` | `1` tails node log files; `0` (or unset) runs on RPC alone. |
 | `BLOCKYARD_LOG_LEVEL` | `log.level` | string | `info` | `debug`, `info`, `warn` or `error`. |
-| `BLOCKYARD_MARKETS` | `markets.enabled` | boolean | `true` | `0` turns the Markets feed off. |
+| `BLOCKYARD_MARKETS` | `markets.enabled` | boolean | `true` | `0` removes the Markets feed; the polling checkbox then cannot turn it on. |
 | `BLOCKYARD_MINING` | *(none)* | `0` or anything | on | `0` turns off miner attribution, which decodes each block's coinbase to show the pool tag. Block sizes, fees and weights are unaffected. Only the literal `0` disables it. |
 | `BLOCKYARD_MINING_BACKFILL` | *(none)* | number | `36` | How many recent blocks are attributed to miners at startup. |
 | `BLOCKYARD_MINING_TEMPLATE` | *(none)* | `0` or anything | on | `0` turns off the "block being built" card. Since 2026-09-13 the template is **assembled from the mempool this monitor already reads**, so leaving it on costs your node no RPC call at all — it costs this process ~50-70 ms of CPU per assembly. Before that it was a `getblocktemplate` worth over a second of the node's single RPC thread, which is why the switch exists. Only the literal `0` disables it. |
@@ -577,10 +581,10 @@ instead:
 BLOCKYARD_ADMIN_PASSWORD='choose-a-long-passphrase' npm start
 ```
 
-Then create personal accounts with `npm run user -- create <name> <role>`. Without
-TLS, the startup log warns that the session cookie crosses the network in clear
-text. Pair accounts with one of the TLS options below, or with a loopback bind and
-an SSH tunnel.
+Then create personal accounts with `npm run user -- create <name> <role>`. HTTPS is on by
+default with the monitor's own certificate; if you turn it off (`BLOCKYARD_TLS=0`) on a bind
+that crosses the LAN, the startup log warns that the session cookie crosses the network in
+clear text. Pair that with a TLS-terminating proxy, or with a loopback bind and an SSH tunnel.
 
 Accounts plus two node writes that operators may run:
 
@@ -596,7 +600,8 @@ Accounts plus two node writes that operators may run:
 
 ### TLS
 
-Built-in HTTPS on every listener:
+HTTPS is on by default, with a certificate the server makes for itself. A certificate of your
+own, on every listener:
 
 ```json
 {
@@ -632,9 +637,9 @@ matters here too: it makes the proxy the only way in.
 
 ### Binding to specific addresses
 
-The default `0.0.0.0` listens on every IPv4 interface the machine has, including VPN
-tunnels and container bridges. To serve exactly one LAN address and one VPN
-address, and admit only clients from those networks:
+The default `127.0.0.1` answers this machine only. `0.0.0.0` listens on every IPv4
+interface the machine has, including VPN tunnels and container bridges. To serve exactly
+one LAN address and one VPN address, and admit only clients from those networks:
 
 ```json
 {
@@ -661,9 +666,11 @@ Things to know about specific binds:
 - For this machine only, use `"hosts": ["127.0.0.1"]` and reach it with
   `ssh -L 21000:127.0.0.1:21000 user@monitor-host`.
 
-### Markets off
+### Markets off, for good
 
-No outbound connections except to the node:
+Out of the box there are no outbound connections except to the node, because market polling is
+a checkbox that ships unticked (**Display settings → Markets & Price → Enable market polling**). To be certain a machine never reaches out whatever anyone
+ticks, remove the feed from the server:
 
 ```json
 {
@@ -713,7 +720,7 @@ sudo systemctl edit blockyard
 
 ```ini
 [Service]
-Environment=BLOCKYARD_AUTH=1
+Environment=BLOCKYARD_BIND=192.0.2.10
 Environment=BLOCKYARD_DATA=/var/lib/blockyard
 ```
 

package/docs/GETTING-STARTED.md

@@ -158,12 +158,15 @@ existing `config/local.json` (with a backup).
 npm start
 ```
 
-The log says `BlockYard 0.0.9 listening on http://127.0.0.1:21000`, then `address index: building
+The log says `BlockYard 0.1.0 listening on https://127.0.0.1:21000` (its own self-signed
+certificate, made on this first start; the browser warns once and remembers it), then `created the
+first admin account (admin)` with a generated password **shown once** — copy it, or set
+`BLOCKYARD_ADMIN_PASSWORD` before the first start to choose it — then `address index: building
 /Users/you/blockyard/data/index from main's block files with 4 workers -- the Overview shows the
 progress` (and `address index build: paused while the node's RPC is answering in … s` /
 `resumed` if the node struggles) and, when that is done, `address index built: … rows to block N
 in … min -- address pages are live` followed by `address index /Users/you/blockyard/data/index:
-following main from block N`. Open <http://127.0.0.1:21000>. The
+following main from block N`. Open <https://127.0.0.1:21000> and sign in as `admin`. The
 Overview fills in within about thirty seconds; Block space lands a little after. Open Explorer,
 click the latest block, then any output address: while the index is building the page says so
 with the progress; once it is built, its balance, history and unspent outputs appear.

package/docs/INSTALL.md

@@ -12,7 +12,7 @@ machines you choose. Every setting mentioned here is described in full in
 - [6. Run it as a service](#6-run-it-as-a-service)
 - [7. Decide who can reach it](#7-decide-who-can-reach-it)
 - [8. Accounts (optional)](#8-accounts-optional)
-- [9. HTTPS (optional)](#9-https-optional)
+- [9. HTTPS (on by default)](#9-https-on-by-default)
 - [10. Behind a reverse proxy (optional)](#10-behind-a-reverse-proxy-optional)
 - [11. Updating](#11-updating)
 - [12. Uninstalling](#12-uninstalling)
@@ -146,9 +146,10 @@ Balances are checked against the node: 40 of 40 sampled addresses equal `scantxo
 satoshi (`node scripts/index-benchmark.js` runs that check and the lookup timings against your
 own build).
 
-**Outbound network access** is needed only for the Markets and Kiosk tabs and for the
-explorer's dollar figures (HTTPS to five exchanges' public APIs). Everything else talks only
-to your node. See [SECURITY.md](SECURITY.md#outbound-connections).
+**Outbound network access**: none, out of the box — everything talks only to your node. The
+Markets and Kiosk tabs and the explorer's dollar figures need the exchange feed (HTTPS to five
+exchanges' public APIs), which is off until you tick **Display settings → Markets & Price → Enable market polling**
+in the browser. See [SECURITY.md](SECURITY.md#outbound-connections).
 
 ## 2. Get the code
 
@@ -240,8 +241,8 @@ real-time explorer data over RPC was a failed idea.
 
 `rpcUser` / `rpcPassword` are still accepted, for a node that authenticates with `rpcauth` rather
 than the cookie file (see [Configuration](CONFIGURATION.md#nodes)). The web UI's node-connection
-form takes no password on purpose -- taking one over an endpoint that is open by default is not
-something to add quietly -- so credentials go in `config/local.json`.
+form takes no password on purpose -- taking one over a web endpoint is not something to add
+quietly -- so credentials go in `config/local.json`.
 
 ##### `bitcoin.conf` settings worth having
 
@@ -284,17 +285,20 @@ npm run check       # every configured node: RPC, credentials, txindex, getblock
 npm start
 ```
 
-Watch the start-up lines. You should see the addresses it listens on, a line per node,
-and — because accounts are off by default — a warning that names who can read the monitor. If
-the node entry names an `addressIndex` directory with no index in it, `address index: building
-… with N workers -- the Overview shows the progress` follows, and the build runs on in the
-background (see [Building the address index](#building-the-address-index)). Then open
-<http://127.0.0.1:21000>.
+Watch the start-up lines. You should see `listening on https://127.0.0.1:21000` (the first start
+makes the monitor its own self-signed certificate under `data/tls/`; the browser warns once per
+address and remembers it), a line per node, and — because accounts are on by default — `created
+the first admin account (admin)` with a generated password **shown once** (set
+`BLOCKYARD_ADMIN_PASSWORD` before the first start to choose it; `blockyard user` changes it
+later). If the node entry names an `addressIndex` directory with no index in it, `address index:
+building … with N workers -- the Overview shows the progress` follows, and the build runs on in
+the background (see [Building the address index](#building-the-address-index)). Then open
+<https://127.0.0.1:21000> and sign in.
 
-Check it from the shell:
+Check it from the shell (`-k`, because the certificate is self-signed):
 
 ```bash
-curl -s http://127.0.0.1:21000/api/health
+curl -sk https://127.0.0.1:21000/api/health
 ```
 
 If a node shows as offline, see [TROUBLESHOOTING.md](TROUBLESHOOTING.md#a-node-shows-offline).
@@ -356,10 +360,10 @@ Where the monitor listens is a security decision. Set `server.host` in `config/l
 
 | bind | who can connect | typical use |
 |---|---|---|
-| `"127.0.0.1"` | this machine only | reach it with an SSH tunnel: `ssh -L 21000:127.0.0.1:21000 you@host` |
+| `"127.0.0.1"` (the default) | this machine only | reach it with an SSH tunnel: `ssh -L 21000:127.0.0.1:21000 you@host` |
 | `"192.0.2.10"` (a LAN address) | anything that can route to that address | a home or office LAN |
 | `["192.0.2.10", "198.51.100.7"]` | exactly those addresses | LAN plus a VPN such as Tailscale or WireGuard |
-| `"0.0.0.0"` (the default) | every interface | behind a firewall you control |
+| `"0.0.0.0"` | every interface | behind a firewall you control |
 
 Notes:
 
@@ -377,15 +381,17 @@ Notes:
 - `server.allowCidrs` (or `BLOCKYARD_ALLOW_CIDRS=192.0.2.0/24,2001:db8::/32`) makes the
   monitor itself refuse clients outside those networks, as a second line of defence.
 
-## 8. Accounts (optional)
+## 8. Accounts (on by default)
 
-By default anyone who can reach the port reads the monitor as a `viewer` — charts, the
-explorer, the event stream, the read-only RPC console. User administration, the audit trail
-and every node write stay closed.
+Sign-in is required out of the box. The first start with an empty data directory creates an
+`admin` account and prints its password **once** in the log (under systemd: `journalctl -u
+blockyard`). Set your own instead with `BLOCKYARD_ADMIN_PASSWORD` for that first start.
 
-To require sign-in, set `"auth": { "enabled": true }` or `BLOCKYARD_AUTH=1` and restart. The
-first start with an empty data directory creates an `admin` account and prints its password
-**once** in the log. Set your own instead with `BLOCKYARD_ADMIN_PASSWORD` for that first start.
+To open the monitor to readers with no account, set `"auth": { "enabled": false }` or
+`BLOCKYARD_AUTH=0` and restart: anyone who can reach the port then reads it as a `viewer` —
+charts, the explorer, the event stream, the read-only RPC console — while user
+administration, the audit trail and every node write stay closed. The boot log names the
+addresses that leaves readable.
 
 Manage accounts from the Admin page, or from the shell — for example, to reset the admin
 password:
@@ -398,17 +404,35 @@ Roles: `viewer` reads; `operator` may also run node actions that you have enable
 also manages users and reads the audit trail. Node actions are off unless you enable them
 explicitly — see [SECURITY.md](SECURITY.md#node-writes).
 
-## 9. HTTPS (optional)
+## 9. HTTPS (on by default)
 
-Name a certificate and key and every listener serves HTTPS:
+Every listener serves HTTPS out of the box. With no certificate of your own named, the first
+start makes one: a self-signed certificate and key under `<data>/tls/` (`data/tls/cert.pem` and
+`key.pem`, the key readable by the service account only), naming the addresses the monitor is
+reached on — the bound hosts, this machine's addresses and hostname, `localhost`. It is remade
+by itself when it nears expiry (825 days) or stops naming a bound address. Browsers warn once
+per address about a self-signed certificate and then remember it; the start-up log prints its
+fingerprint so you can compare.
+
+To add a name or address (say, a DNS name you gave the machine) or start over:
+
+```bash
+blockyard tls --san monitor.lan.example        # or: node scripts/tls.js --san ...
+blockyard tls --force                          # a fresh key and certificate
+blockyard tls --print > blockyard.crt          # the certificate, for another machine's trust store
+```
+
+To use a certificate of your own instead, name it and every listener serves that:
 
 ```bash
 BLOCKYARD_TLS_CERT=/etc/blockyard/cert.pem BLOCKYARD_TLS_KEY=/etc/blockyard/key.pem npm start
 ```
 
-or in `config/local.json`: `"server": { "tls": { "cert": "...", "key": "..." } }`.
+or in `config/local.json`: `"server": { "tls": { "cert": "...", "key": "..." } }`. To serve plain
+HTTP — behind a reverse proxy that terminates TLS (section 10) — set `BLOCKYARD_TLS=0` or
+`"server": { "tls": { "enabled": false } }`.
 
-A self-signed certificate is fine on a LAN (expect one browser warning per address):
+If you would rather make the certificate with openssl yourself:
 
 ```bash
 sudo mkdir -p /etc/blockyard
@@ -424,8 +448,8 @@ rather than silently serving plain HTTP.
 
 ## 10. Behind a reverse proxy (optional)
 
-If you already run nginx, Caddy or similar, bind the monitor to `127.0.0.1` and let the proxy
-terminate TLS. The live stream (`/api/stream`) is Server-Sent Events, so the proxy must not
+If you already run nginx, Caddy or similar, bind the monitor to `127.0.0.1`, set
+`BLOCKYARD_TLS=0` so it speaks plain HTTP to the proxy, and let the proxy terminate TLS. The live stream (`/api/stream`) is Server-Sent Events, so the proxy must not
 buffer it. An nginx example:
 
 ```nginx
@@ -468,8 +492,41 @@ Your `config/local.json` and `data/` directory are untouched by updates. Read
 up new front-end files on the next page load; the header shows a notice when the page you
 have open is older than the server.
 
+**Updating from 0.0.9.** The defaults hardened in 0.1.0, and a `config/local.json` written by
+0.0.9's installer does not name them, so the first start after the update behaves like a fresh
+install in three ways:
+
+- **HTTPS.** The monitor makes itself a self-signed certificate under `data/tls/` and serves
+  HTTPS on the same port; `http://…:21000` stops answering. Open `https://`, accept the
+  certificate once. Behind your own reverse proxy, set `BLOCKYARD_TLS=0` (§10).
+- **Sign-in.** Accounts are on. The first start creates the `admin` account and prints its
+  password **once** in the log (`journalctl -u blockyard` under systemd); set
+  `BLOCKYARD_ADMIN_PASSWORD` before that start to choose it. To keep the monitor open as before,
+  put `"auth": { "enabled": false }` in `config/local.json` or start with `BLOCKYARD_AUTH=0`.
+- **This machine only.** With no `server.host` in the config the bind is `127.0.0.1`. A
+  0.0.9 config written by the installer names the host it chose, so a LAN bind stays; if yours
+  does not, add `BLOCKYARD_BIND` or `server.hosts` (§7).
+- **Market polling is off** until someone ticks **Display settings → Markets & Price → Enable
+  market polling** — once, for every screen.
+
 ## 12. Uninstalling
 
+BlockYard touches nothing outside its own directories: it reads `bitcoin.conf` and never writes
+it, and it leaves the node as it found it. Removing it is deleting those directories.
+
+**Installed from npm** (`npm install -g blockyard`): stop it, then
+
+```bash
+npm uninstall -g blockyard
+rm -rf ~/.blockyard               # local.json, data/ (history, accounts, the audit trail) and data/index
+```
+
+**A checkout** run with `npm start`: stop it and delete the checkout; `config/` and `data/`,
+the index included, live inside it. If you pointed the index elsewhere at setup time
+(`addressIndex` in `config/local.json`), delete that directory too.
+
+**The systemd service** of section 6:
+
 ```bash
 sudo systemctl disable --now blockyard
 sudo rm /etc/systemd/system/blockyard.service && sudo systemctl daemon-reload
@@ -484,7 +541,7 @@ sudo userdel blockyard
 - [ ] `npm run check` passes: Core 25.0+, `txindex` synced, the block files readable, no pruning
 - [ ] the index directory has ~125 GB free and is writable by the service account
 - [ ] the start-up log shows the addresses you intended, and no node offline
-- [ ] you have decided who can reach the port (bind, firewall, `allowCidrs`)
-- [ ] accounts on if the port is reachable by people who should not see your node
-- [ ] HTTPS on, or a proxy / tunnel in front, if the network is not trusted
-- [ ] `BLOCKYARD_MARKETS=0` if the machine must make no outbound connections
+- [ ] you have decided who can reach the port: it binds `127.0.0.1` until you say otherwise (bind, firewall, `allowCidrs`)
+- [ ] accounts stay on (the default) if the port is reachable by people who should not see your node; you have the admin password from the first start
+- [ ] HTTPS is on by default with the monitor's own certificate; a certificate of your own, or a proxy / tunnel in front, if you want no browser warning
+- [ ] **Enable market polling** ticked in Display settings if you want the Markets and Kiosk tabs (off by default); `BLOCKYARD_MARKETS=0` on machines that must make no outbound connections at all