Changelog

A new shimmer theme, one-click qID sign-in, a livelier balance, and a batch of polish. The post-quantum send core, coin selection and artifact protection are byte-unchanged, and every change was adversarially re-verified before release. Transparent funds only.

• Sign in to a site with one click. Clicking “Open in BTX PQ wallet” on a site like btc2btx.com now opens a focused sign-in card the moment a wallet is open: the site up top, one Sign button, and the exact request behind “Verify request” if you want to inspect it before signing. The proof is sent back automatically and success shows in green: you’re signed in, return to your browser tab. You can switch which wallet signs right on the card; only that one address is disclosed. If the site cannot be reached you can retry or drop to the manual copy-paste flow, unchanged in Settings → qID Sign-In. A login proof can never move funds. Also fixed: on macOS, clicking a sign-in link while the wallet was closed opened the app but never showed the request; it now appears the moment you open a wallet.
• A new “style of bonuz” appearance. Settings → Appearance → Color adds a fifth option. It keeps the clean green layout, but every brand-green accent (buttons, the balance frame, active tabs, links and the logo) comes alive as the bonuz orange-to-pink shimmer. Your money colours never change: received stays green, sent stays red. Reduced-motion users get the same palette without the animation.
• The balance reload is dramatic again. Pressing refresh on your wallet list now spins the whole balance, the digits and the “BTX” unit together, and settles over about a second, so even a small or zero balance clearly reacts. The button also rests briefly after a few quick presses so it cannot be spammed.
• Tap an incoming artifact to open it. In History, an artifact you received is now tappable and opens the same detail card as the Artifacts tab, with its artwork, type and identifiers.
• Clearer message when a wallet holds only an artifact. If a wallet’s only coin is the one an artifact rides on, Send now explains the balance is held inside an artifact and cannot be sent as ordinary BTX without destroying it, instead of a confusing “no confirmed funds”. The coin was always kept safe; only the wording was misleading.
• A tidier wallet-list footer. The long backup sentence is now a short line with an info button that opens the full master-key backup explanation.

Your relics finally show their real artwork, the qID sign-in proof is readable again, and adding a passphrase can no longer brick a wallet — after three independent adversarial security passes. No change to the post-quantum send core or key derivation (qid.bundle.js byte-identical). Transparent funds only.

• Your relics show their real artwork. The Last Relic, the Vintage Seal and the attribute collections now display their actual picture in the wallet, both as a thumbnail in the Artifacts list and full-size when you open one, loaded from btxscan.io. A missing picture falls back to the on-chain sigil, never a broken image.
• Turn artwork off if you want. Settings → General → Artifact artwork. Choose “Sigil only” and the wallet fetches nothing at all and shows the pattern drawn from the blockchain instead.
• The qID sign-in proof is readable again. After signing, the proof used to appear as black text on a black panel in dark themes. It is now clearly readable in every colour and light/dark combination, with a green frame that pulses when your proof arrives.
• Forwarding stops honestly if the chain stops carrying artifacts. When a server refuses a forward because BTX has removed the transaction field artifacts ride on, the wallet says so plainly instead of offering a button that can only fail. Your artifacts stay yours, stay visible, and their coins stay protected.
• “Set passphrase” can no longer brick a wallet. Adding or changing a passphrase now proves the new encrypted seal can be reopened before it replaces the old one. If anything is wrong, nothing is written and the wallet is left exactly as it was.
• Unencrypted wallets are clearly flagged. A wallet with no passphrase now reads “Unencrypted” in amber in the wallet list, with a tooltip pointing at Settings → Security → Set passphrase.
• Security. Three independent adversarial review passes over everything that changed. Among the fixes: the master key no longer lingers in a text field after auto-lock, and the artwork fetch is locked to a single trusted host in the app’s Rust core.

The wallet now gets its chain data from our own server first, with automatic failover behind it — plus a cleaner artifact detail page, a fresh look, clickable fix guides, and a batch of self-custody hardening.

Our own chain server, with failover. Balance, history, and sends now talk to our own BTX Esplora node (api.btxscan.io) first, and fall back automatically to two independent community servers (Byron Bay, minebtx) when it cannot be reached:

• If the current server stops answering, the wallet advances to the next one on its own and says so in a banner with a one-click "Try next server" — reads keep working even when a server (or your own DNS cache) has a bad day.
• Sending is deliberately different: a broadcast is never quietly re-sent to a different server, and a failed send stays on screen for you to re-confirm yourself — a flaky network can never turn one payment into two.
• The free-text server field is gone. Settings offers the three official servers only, and the app's network layer refuses everything else: only those three origins (or your own machine, for self-hosters) can ever be reached, and nothing inside the app can widen that at runtime.
• Honest small print: the Byron Bay fallback does not index unconfirmed transactions yet, so while it is the active server a just-sent payment can show up ~90 seconds late, and very long histories show only the most recent pages. Your money is unaffected — the wallet only ever spends confirmed coins, and anything it cannot verify it sets aside instead of spending.

A cleaner artifact detail page. Opening a relic or NFT now leads with its artwork in a square frame and lays the rest out so it is obvious what everything is:

• Artwork shows in a square frame that fits any picture without cropping or stretching it: a tall image gets bars on the sides, a wide image gets bars above and below, and a square one fills the frame. The quantum sigil holds the frame until you tap "Show artwork", which still fetches and verifies the image against the on-chain record before it appears, so nothing loads on its own.
• The three identifiers are now clearly labelled and no longer look alike: the artifact's own fingerprint, the IPFS address where its artwork and traits live, and the on-chain transaction that carries it, each with a one line description so it is never a guess which hash is which.
• The wall of explanatory text is gone; the facts (chest value, type, schema, minted or transferred) sit in a tidy grid.

Everything else in this release:

• A fresh look: the PQ hexagon is now the default logo on new installs, and the logo picker shows the real logos instead of describing them in words. The window is titled "PQ wallet for BTX".
• When a newer version exists, a blinking banner on the start screen points to pq-wallet.com/download. Updating stays manual and verifiable — there is still no auto-updater, on purpose.
• Every network-flavored error now carries a clickable fix guide (pq-wallet.com/fixbugs), so a DNS hiccup gets a one-click way out instead of a screenshot of a scary red message.
• Artifact protection is stricter: if the wallet cannot fully verify that a coin is not carrying a relic or NFT — say, the server's transaction data is incomplete — that coin is set aside rather than spent. A send can no longer burn an artifact because a server had a bad day.
• .btxwallet files now import AND export in the official full-seed descriptor format, byte-identical to what btx.dev and the node tools produce — a bundle written here restores anywhere, and theirs restore here.

No change to the post-quantum send core or key derivation (qid.bundle.js byte-identical). Transparent funds only.

Sign in to a website straight from the desktop wallet, no copy-paste. When a site (btx.best) offers "Open in BTX PQ Wallet", it now launches the installed wallet with the sign-in request. The wallet shows you which site is asking, you pick which of your wallets signs, and on your click the login proof is sent back to that site automatically. You never copy or paste anything, and the site never sees a key.

• The wallet registers the btxqid:// link scheme and opens a dedicated "Sign in to <site>" screen that reuses the exact qID Sign-In picker you already have: the proof discloses only the one address you choose, your other wallets stay private, and the seed is unlocked in place and wiped right after.
• Nothing is ever signed automatically. A link only pre-fills the request and shows you the site, you still review the origin, choose a wallet, and click Sign. Every incoming link is treated as untrusted: a malformed request, or a proof URL whose origin does not match the site, is refused and nothing is signed. A qID proof is a login signature in a separate domain from transactions; it can never move funds.
• One new, tightly-scoped network action returns the proof. It refuses to send anything that is not a well-formed login proof, will only post to an https address whose origin matches the origin named inside that proof, refuses redirects and embedded credentials and cleartext http, times out fast, and discards the response, the same hardening the chain and artwork fetches already use. Copy-and-paste still works everywhere as a fallback.

Two hardening fixes from a release audit. No change to the send core or the crypto.

• The recovery and bundle sweep now protects your artifacts the same way ordinary Send already does. A sweep re-emits no artifact commitment, so a relic or NFT coin caught in a sweep would be burned. The sweep now spots artifact carrier coins from the address history and keeps them back (shown as "kept safe"), and fails closed on any coin it cannot verify, so a sweep can never burn an artifact. This closes the last path where a carrier could be spent as a plain input.
• Recovery files and wallet bundles are now created owner-only (0600) from the first byte, instead of being written under the default file mode and tightened a moment later, so the plaintext master key is never briefly readable by another local user on a shared machine.

Move a wallet in and out as a portable file. You can now restore a .btxwallet.json bundle, the kind the website, a node, or btx-cli writes, straight into the wallet, and export the open wallet back out as the same kind of file. Both directions are fully offline: the file is read through the native open/save dialog and parsed on your own machine, with no new network calls anywhere.

• Restore adopts the bundle's master key as an ordinary wallet and takes you straight to the one-time master-key backup screen, exactly like restoring any other key. The file is refused unless it is a mainnet bundle whose seed, fingerprint, and first address all agree, a corrupt or tampered file is turned away with a plain reason, and no key material is ever put on screen.
• Because a bundle is HD but this wallet watches a single address, a quiet background check looks a few addresses ahead on both change branches after you restore. If any coins sit somewhere the adopted address wouldn't see, a banner offers to sweep them with the existing recovery wizard, nothing moves on its own, and the check never blocks or slows the backup step.
• Export lives in Settings → Backup. A .btxwallet.json has no passphrase, that is the format, it stores your master key in plain text, so exporting takes a deliberate second click that spells out the risk, then writes the file to disk only (never the clipboard) with owner-only permissions.

No new cryptography and no new network endpoints: the same key derivation the wallet already uses both writes and checks the file, and the background address check reuses the balance lookup every screen already makes.

History now says when an artifact moved. A transaction carrying a BZA1 payload used to render as a bare "RECEIVED +0.001 BTX", no hint that a relic changed hands. Each such history row now carries a small marker naming what happened and to what: "Artifact minted to you: …", "Artifact received: …", "Artifact sent: …", a state update says "Artifact updated" (even when the same transaction also pays someone else) and a send-to-self "Artifact sent to yourself", so a row's caption can never contradict its own header (soulbound ones get a violet accent). The tag is decoded by the same parser the Artifacts tab already uses, only from transaction data the history view already fetched, no new network calls anywhere, and a pre-computed tag arriving in explorer JSON is ignored: fresh transactions always decode locally. One naming rule now covers every view: an artifact from a collection the wallet doesn't know by name (like RELICLAB) shows its raw collection tag in the Artifacts tab, the detail page, and the history line alike, so the same artifact never carries two different names. A malformed or oddly-shaped transaction from the explorer can never blank the history view, it simply renders without a tag. Cached history rows keep no script data, so the tag is computed when the cache is written and stored with the row; the cache key was bumped (v1 → v2), which forces one ordinary re-fetch of your recent history on first open.

Artwork, inside the wallet, without trusting anyone. An artifact's detail page now has a "Load artwork" button that fetches the off-chain record and image through the wallet's own hardened network path and shows the picture right in the page.

• Nothing loads on its own: artwork is fetched only when you press the button, one artifact at a time, never while the list renders. Once loaded, it reappears instantly for the rest of the session.
• The gateway is not trusted. Every byte fetched must hash to the exact record hash written on chain (and the image to the address inside that verified record), or nothing is shown. A tampered or wrong response cannot be displayed, only refused.
• Only plain image formats (PNG, JPEG, GIF, WebP) are accepted, checked by their actual bytes, never by what the server claims. Anything that looks like a web page or SVG is refused outright, oversized responses are cut off rather than trimmed, and images that declare absurd dimensions are refused before your machine ever tries to draw them.
• On any problem you keep the artifact's sigil and see one plain line: "Artwork could not be loaded and verified." Even a verified image that turns out to be undisplayable puts the button back so you can simply try again, nothing can wedge the page for the session. The existing "open the record in your browser" link is unchanged.

Hardening from an adversarial audit of the send path.

• Closed a rare artifact-burn hole: on a wallet with a very large number of coins whose transactions sit beyond the history page, coins past the coverage limit are now set aside rather than treated as ordinary spendable, so a held relic can never slip through and be spent. A coin whose transaction cannot be read is never spendable, in every case.
• "Send all" now says plainly when a coin could not be checked this round and is not included in the sweep, so a sweep is never silently short. Try again in a moment to include it.

Fixes the send that stayed stuck. Sending plain BTX from a wallet that holds an artifact was blocked with "could not check your coins", because the coin check tried a per-transaction lookup the wallet's own network guard does not permit, so every check failed and every coin was set aside.

• The Send screen now spots artifact coins from your transaction history, the same data the Artifacts tab already reads, instead of a blocked per-coin lookup. A wallet with no artifacts does no artifact work at all: the Send screen is plain BTX, end to end. Your relics stay protected: their coins are never spent as an ordinary input, verified against every artifact this wallet holds.
• Added the single-transaction lookup to the network guard as a well-formed, read-only route, so the Artifacts tab and the coin check can pull in an older artifact whose mint is beyond the recent history page.
• The Artifacts tab now appears only in a wallet that actually holds an artifact. Switching wallets no longer carries the previous wallet's state over, and a fast switch always re-checks the wallet you landed on.

Sending plain BTX no longer stops when an artifact check hiccups. The Send screen protects your relics and NFTs by never spending an artifact's coin, but it used to verify every coin in one all-or-nothing pass, so a single flaky network read could pause an otherwise ordinary send with a scary "could not check your artifacts" message.

• The check is now per coin. A coin is spendable only once its transaction is read and confirmed not to be an artifact carrier. A coin that cannot be verified right now is quietly set aside for this attempt, never spent, so an artifact can never be burned, while the rest of your balance stays fully spendable. One slow network read no longer blocks a send that has plenty of plain BTX behind it.
• The Send and Receive screens stay plain BTX and never mention artifacts. All artifact handling lives in the Artifacts tab. In the rare case nothing can be verified at all, you see a plain "try again in a moment", not artifact wording.

Artifacts become tappable. Every relic or NFT in the Artifacts tab now opens a full detail page on top: the big quantum sigil, all its properties, the chest value it carries, its record hash, and a link to the off-chain record on IPFS (copy or open, behind a plain safety notice). Soulbound status is unmistakable, with a lock badge and a one-line explanation.

• Forward an artifact to another wallet, straight from its detail page. The forward is carrier-preserving: the artifact's coin (and any chest value inside it) travels to the recipient untouched, and the network fee is paid from your ordinary balance, never skimmed from the chest. Soulbound artifacts are refused. Paste an address or pick a saved contact. This lives only in the Artifacts tab; the plain BTX Send screen is untouched and never mentions artifacts.
• Fixed a scan bug: a forwarded artifact is no longer shown as still held by the sender (it was mis-reading the sender's change coin), which also stops that change coin from being needlessly held back from ordinary sends. The carrier is now anchored to its fixed position (the first non-OP_RETURN output), which also correctly handles a chest carrier larger than the change.
• A forwarded artifact now keeps its collection and item number in the recipient's wallet (the TRANSFER record is decoded the same way as a mint).
• The off-chain record's IPFS address is derived directly from the on-chain commitment, with no network call: the record is a single raw IPFS block, so its CID is the commitment itself.

No change to the post-quantum send core or key derivation (qid.bundle.js byte-identical). The forward reuses the same signing path as an ordinary send. Transparent funds only.

A big polish pass: an update-available pill, help built into the app, an AI onboarding guide, a balance that resolves like a number, a setting for the Artifacts tab, a clearer Settings menu, and a batch of UX, copy, and accessibility refinements across every screen. No change to the post-quantum send core or key derivation (qid.bundle.js byte-identical). Transparent funds only.

• See when a new version is out. The header shows a small "Update available" pill when a newer build exists, and it opens pq-wallet.com to download it. The check runs once per launch through a pinned, hardened Rust request to pq-wallet.com/version.json (https only, size capped, no redirects, no input from the webview), so the webview still makes no network calls of its own. There is no auto-update: you always download and verify the build yourself. When the wallet is current, nothing is shown.
• Windows and Linux no longer say "Touch ID." The passkey prompts and buttons now name your platform's method, so it reads "Windows Hello" on Windows, "your passkey" elsewhere, and "Touch ID" only on a Mac.
• Unlock is keyboard friendly. The passphrase field is focused when you open a wallet and Enter submits, and the Settings dialog now closes with Escape and moves focus into itself.
• Clearer messages. The pending line no longer doubles the word "confirming, " an empty Send amount asks you to enter one instead of showing "invalid amount, " cancelling a passkey during qID signing reads cleanly, and the broadcast-blocked help suggests toggling your VPN either way plus a phone hotspot test.
• Signing-wallet unlock is fair. Unlocking a wallet to sign a qID proof no longer counts a paused wallet or a tamper refusal as a wrong passphrase, and it shows wait times as "5 min" like the rest of the app.
• Artifacts you hold always show. The Artifacts tab now finds a held relic even when its mint is older than the recent history window, by reading it straight from your current coins.
• Recovery files with punctuation in the wallet name parse correctly. A brace in the wallet name no longer truncates an EasyBTX recovery file.
• The Artifacts "View" link now follows a custom explorer, the History open-transaction arrow is keyboard operable, and the in-app "Get the latest version" button points at pq-wallet.com.
• Built-in help, on demand. Small info buttons open a clear explanation right where you are (how your wallet is protected, network fees, qID Sign-In, how updates work), so the screens stay uncluttered and the detail is one tap away.
• Get guided by your own AI. A new "Guide me with your own AI" option gives you a ready-made prompt to paste into any AI you trust. It knows the whole wallet and walks you through anything, by text or voice. Nothing leaves the app: you copy, you paste.
• Your balance resolves like a number. The decrypt animation on the balance now spins digits with the decimal point held steady, so it reads as a value locking in rather than random characters.
• Choose when the Artifacts tab shows. A new setting in Appearance keeps the Artifacts tab always visible, shows it only when you hold one, or hides it.
• A clearer Settings menu. Bigger and easier to read, with a clear marker for the section you are in, and clicking a category now jumps straight to it.
• Consistent, more accessible controls. A visible keyboard focus ring on every control, hover feedback on the tabs and fee buttons, better empty states, and clearer labels throughout.
• Quantum sigil for your artifacts. Each relic or NFT now shows a distinct, glowing "quantum sigil" drawn from its on-chain fingerprint, the same on every device. A held artifact keeps its sigil when it moves to another wallet. Fully on-chain glyphs still show their real pixels.
• Artifacts are safe from an accidental send. Send and Send-All now never spend an artifact coin as a fee, so a relic or NFT can never be burned by an ordinary transaction. If the wallet cannot check your artifacts at that moment, the send pauses rather than risk one.

qID Sign-In gets a signing-wallet picker, and a new Artifacts tab shows the on-chain relics and NFTs this wallet holds. No change to the post-quantum send core or key derivation (qid.bundle.js byte-identical). Transparent funds only.

• Choose which wallet signs a qID Sign-In. A qID proof discloses exactly one address, so the Settings, qID Sign-In screen now shows the signing wallet and lets you pick any of your wallets. Your other wallets stay private. Picking a locked wallet unlocks it in place; the choice is transient and never switches your active wallet.
• Artifacts tab: see your relics and NFTs. A new tab lists the BZA1 artifacts (Genesis relics, NFTs, attestations) this wallet holds on chain, decoded straight from the transactions, with the item number, collection, soulbound flag, and a link to the carrier transaction on BTXScan. Read-only: the wallet never mints or moves an artifact, and keeping the artifact coin here means it is never spent as a fee.

Safer backups by default, BTXScan as the block explorer, smart fee presets, and hardened key handling. No change to the vendored post-quantum crypto core or the transaction signing path.

• Encrypted backups are now the default: the recovery-file encrypt checkbox is pre-ticked (Argon2id + AES-GCM); saving an unencrypted key file takes a deliberate second click after a plain warning.
• BTXScan (btxscan.io) is the wallet's block explorer for every transaction and address link; chain data still loads from the same source, so balances and sending are unchanged.
• Smart fee presets: Normal (2 sat/vB) and Priority (4) buttons next to a compact custom rate field. When the mempool is busy the tiers come from the live fee histogram; on a clear network they stay low on purpose because a higher fee cannot confirm faster.
• The master key stays hidden until you reveal it: the backup screens show dots plus a Reveal button, and Settings asks you to confirm nobody can see your screen first.
• Wrong-passphrase throttling: repeated wrong unlock attempts pause unlocking with escalating delays (1 minute from the third try, 5 minutes from the eighth), resetting an hour after the last wrong try or on a successful unlock.
• Sends survive hostile networks: if antivirus web protection, a VPN or a firewall drops the broadcast, the wallet retries automatically, reports the real cause, and correctly shows success when the network already accepted the transaction. Safe by design: a BTX PQ transaction is deterministic, so a retry can never double spend.
• Hardening: explorer responses are size-capped in the Rust proxy; one read-only mempool route added to the network allowlist for the fee presets.

qID Sign-In polish. No change to the crypto core or the proof format (still v1).

• The Sign-In screen now shows the request's canonical site origin, so a challenge cannot dress up its "Site" line with a misleading path or embedded credentials.
• The pasted request and the generated proof are cleared when you close Settings or lock the wallet, so nothing lingers on screen.

Connectivity fix for networks that inspect HTTPS. No change to the send path or the crypto core.

• Explorer connection now uses the operating system's certificate store. The wallet trusts the same certificates the system browser does, so it connects on networks behind a VPN, a corporate proxy, or antivirus that inspects HTTPS. Before this, the app trusted only a bundled root set, so on those networks the balance could not load (it showed "Explorer offline") even though the browser reached the same explorer fine. Under the hood: reqwest now uses rustls with native OS roots. This does not weaken anything: the wallet never sends keys over the network, and the transaction sighash commits to the amounts, so a proxied or lying explorer still cannot forge a wrong-amount spend.
• Clearer connection error. When the explorer cannot be reached, the wallet now shows the real reason (for example a rejected certificate or a timeout) instead of a generic "offline", so a proxy or antivirus problem is identifiable at a glance.

The in-wallet qID Sign-In, plus release chores. No changes to the vendored PQ crypto core (qid.bundle.js) or the transaction signing path.

• qID Sign-In (new). Prove you control a wallet to an app or service without exposing any key. An app gives you a one-time challenge, you paste it into Settings → qID Sign-In, check which site it is for, and sign. The wallet produces a standard ownership proof (a v1 ML-DSA-44 login signature) that you paste back. This is the wallet side of the Sign-In With BTX standard (qID), the BTX equivalent of Sign-In With Ethereum. A sign-in signature is domain-separated from spending (BTX-qID/login-v1 vs TapSighash), so it can never move funds. The screen shows the site and challenge before you sign, and read-only wallets cannot sign.
• Under the hood: the challenge parsing and proof assembly are a new pure, unit-tested module (ui/signin.js), and the whole-frontend sha256 integrity gate pins it too, so everything ships byte-for-byte as reviewed. Signing reuses the existing signLogin primitive in the crypto core, unchanged. GitHub Actions Node bumped from 20 to 24.

Security hardening plus readability and multi-wallet UX. No changes to the vendored PQ crypto core (qid.bundle.js) or the signing path.

• Auto-lock (new). The wallet now locks itself after a period of inactivity and returns to the wallet list, so an unlocked wallet, whose seed and spend keys live in memory while it is open, is not left exposed if you step away. You re-open it the same way as always (passphrase, Touch ID, or Windows Hello). Configurable in Settings → Security → Auto-lock after inactivity: Off / 1 min / 5 min / 15 min (default 5 min). It never locks a watch-only wallet (no key to protect) and never interrupts a send that is broadcasting. Following a full re-audit of the v0.18 hardening, this closes the last ranked open item: the previous lock was manual-only, leaving the in-memory keys exposed for the whole session.
• Network proxy tightened. The chain proxy is now constrained to the exact Esplora routes the wallet uses (address lookups, UTXOs, history, broadcast), query strings, arbitrary paths and methods, and non-hex broadcast bodies are refused. Defense-in-depth on top of the existing egress pin.
• Readable settings. Each Settings section header (General, Appearance, Security, …) now reads at full size and in full-strength text instead of the same faint grey as its fields, and every field label is white, so the panel is legible at a glance.
• Never miss a deposit, even from the wallet list. When a wallet receives while you're on the wallets overview, it now chimes and marks that wallet with a small gold hexagon next to its balance (and a brief gold flash on the amount). The marker lingers ~30 minutes, so you can tell exactly which wallet changed even if you missed the sound.
• Copy. Dropped the "test build" framing across the app while keeping the honest facts (not yet code-signed, on mainnet, verify the SHA-256); the at-rest KDF is correctly described as Argon2id.
• Under the hood: the auto-lock timing decision is a new pure, unit-tested module (ui/autolock.js), and the whole-frontend sha256 integrity gate pins it too, so everything ships byte-for-byte as reviewed.

Security hardening + send/receive UX polish. No changes to the vendored PQ crypto core (qid.bundle.js) or the signing path.

• Security: mainnet-only send guard, rejects tbtx/btxrt (testnet/regtest) addresses that decode to the same mainnet scriptPubKey; a CI "no DOM-sink" guardrail that fails the build if any HTML/JS-injection sink is introduced (locks in the "safe DOM only" property); the vendored-bundle integrity gate is now a fail-closed whole-frontend sha256 gate (every shipped ui/ file pinned) and CI runs it, plus the anti-XSS gate, by name.
• Send: fixed the "send twice in a row" failure (bad-txns-inputs-missingorspent) by excluding a pending send's already-spent inputs from the next send, with a clear "previous send is still confirming" message instead of the raw node error; removed the confusing change and size rows from the send preview.
• Receive: a continuous slow "coins arriving" animation now runs on the amount while a deposit confirms, plus a new double confirm chime when it becomes final; the incoming/confirming line is now white.
• Receipt: bigger animated Sent badge + the sent amount shown big and white, with the saved contact name.
• Wallets list: a force-refresh button.
• Copy: removed the shielded (SMILE) line from the wallet screen. Version metadata reconciled to 0.18.0 (Cargo.toml was lagging at 0.16.0).

A polish release. The post-quantum send core and qid.bundle.js are byte-unchanged; all new logic is unit-tested (full suite now 117 green). Transparent-only.

A recovery-and-usability release. The post-quantum send core and qid.bundle.js are byte-unchanged (same key derivation and P2MR sighash); all new logic is unit-tested (full suite now 109 green). Transparent-only.

A usability and correctness release focused on transaction history, pending funds, and the send screen. The post-quantum send core and qid.bundle.js are unchanged (byte-identical key derivation and P2MR sighash). Transparent-only, and unaffected by the BTX block-125, 000 shielded sunset; verified against the BTX 0.32.x series through 0.32.11.

A security-hardening release from an independent round-3 super-audit plus an exhaustive follow-up sweep of the wallet and the qID library (every finding independently re-verified). No new features. The post-quantum send core and qid.bundle.js are unchanged, byte-identical key derivation and P2MR sighash, pinned by the offline vectors, and verified compatible with BTX v0.32.8.

Shows the app version in the header on the wallet-selector and create/unlock screens, and records a compatibility check against the current BTX node. No new crypto; qid.bundle.js and the send core are unchanged. (v0.14.1 was a local-only build; its header-version change ships here.)

Rebrand to BTX PQ wallet, a full theming system, and a batch of send/privacy UX fixes. The post-quantum send core and qid.bundle.js are unchanged, no new crypto, and the money-critical identifiers (the macOS Keychain service, the BTX-WALLET-RECOVERY file magic) are untouched, so existing wallets and recovery files keep working. (Supersedes the internal-only v0.13.0.)

Recover node-era funds from an EasyBTX/btxd pqhd (post-quantum HD) descriptor wallet, from either the recovery .txt or the binary wallet.dat. The post-quantum send core and qid.bundle.js are unchanged; no new crypto.

Pre-release security-hardening update. Driven by an internal adversarial security audit (.gstack/security-reports/) and its fixes. The post-quantum send core and qid.bundle.js are unchanged. 40 node:test + 18 Rust tests green.

• Re-vendored hardened qID crypto bundle. Native macOS Touch ID unlock (dormant until the app is signed). Opt-in code-signing wiring (macOS entitlements + gated Windows CI signing). Address book for public addresses. Argon2id replaced PBKDF2 for new seals; legacy PBKDF2 seals lazy-upgrade to Argon2id on unlock.

• Multiple wallets (start-screen list, add / forget / rename, lossless migration of the legacy single wallet). Settings security: set / change / remove passphrase. Save / Restore checksummed recovery files via native dialogs. Argon2id KDF for new seals.

The first public release, the build you can actually download, on macOS and Windows, with passkey unlock and a full transaction history.

The first build where the whole loop works: receive, hold, and send real BTX on mainnet.

The first build: a native desktop wallet on the node-verified post-quantum send core.