v0.1.18

What's new

• Fixed: an unreliable or dishonest relay could make a node catching up after being offline (resync) silently lose track of a real payment. If a peer answering that catch-up request left a payment out of its reply, the receiving node had no way to notice — it would never credit that payment's value, and would get permanently stuck rejecting every further payment from whoever sent it. The node now independently verifies nothing was left out before trusting a peer's response, and refuses (automatically retrying with another peer) if anything looks incomplete.

This release changes what every member of a hyperedge cryptographically signs for every checkpoint — upgrade every member together, not one at a time. A member still running an older version will never be able to agree on a signed checkpoint with members on this version; any round it's drawn into will simply stall (safely — no funds are ever at risk) until it also upgrades. See the README's Safety notes for the full migration note.

v0.1.17

What's new

Reliability/liveness fixes found and fixed during an extended live 5-node signet cluster test. No new CLI surface or protocol wire changes.

• Fixed: a node's console could freeze permanently after a checkpoint finalized. Snapshot() (the state-persistence hook fired after every finalized checkpoint on a funded hyperedge) re-acquired a lock its caller already held, causing an unrecoverable self-deadlock — every command (bal, send, even a graceful quit) would hang forever the moment any checkpoint finalized. Fixed by removing the redundant lock; the node now stays fully responsive across repeated checkpoint rounds.

• Fixed: a node that missed one broadcast could get permanently stuck rejecting a sender's further payments. The rejection itself (a chain-continuity check) was correct, but nothing followed it — the node would stay stuck until an unrelated code path happened to notice the same gap. It now immediately asks peers to catch it up via the existing resync mechanism, instead of waiting.

• Fixed: a misconfigured Bitcoin RPC host could silently hang a node for up to an hour before crashing it. An unset COALESCE_BTC_HOST at startup used to build a broken RPC client that failed on every attempt, but the node kept retrying blindly for a full hour before finally giving up and exiting. It now detects a misconfigured host immediately, and no longer exits outright over a merely slow (not broken) confirmation wait — it keeps retrying instead.

• Fixed: -verbose didn't gate everything it claimed to. Networking-layer diagnostics (hole-punch/relay attempts) used to print unconditionally regardless of the flag. -verbose off now gives a fully clean, operator-facing console.

No protocol or fund-safety semantics changed: checkpoint finalization, revocation-chain verification, and closure/penalty transaction formats are all unchanged — these are liveness and diagnostics fixes only.

v0.1.16

What's new

• New: automatic NAT traversal. Nodes now fall back on their own — no
  flags, no relay/STUN server to run — to hole-punching or relaying through
  an already-connected peer when a direct connection isn't reachable. Peers
  behind home routers/CGNAT connect more reliably without manual port
  forwarding. For best connectivity, still forward your advertised
  -addr host:port for both TCP and UDP; COALESCE_RELAY_PORT pins the
  relay listener to a fixed port if your firewall needs one.

• Fixed: a restarted node now recognizes a close it missed. Startup
  checks on-chain whether the funding output has been spent, even with no
  local closed-state record. A recognized cooperative close is reported and
  bal shows the final settled payouts immediately. An unrecognized spend
  quarantines the cluster (send/propose/coopclose refused) instead of
  serving stale balances.

No protocol or fund-safety semantics changed: cooperative-close settlement
still pays the last checkpointed balances, and all closure/penalty
transaction formats are unchanged.

v0.1.15

What's new

• Fixed: bal no longer serves stale balances after a close. The node now
  records a durable closed state once the cooperative close it co-signed
  confirms on-chain. After that, bal reports the final payouts actually paid
  by the close transaction, labeled "(final, paid on-chain)", instead of
  silently repeating the last off-chain checkpoint figures; coopclose,
  send, cond, and propose all refuse with a clear "closed" message; and
  the closed state survives a node restart (a CLOSED banner is printed on
  startup instead of re-opening the channel as live).

• Fixed: dfund deposit preparation no longer stalls under signet
  congestion. When your wallet needs to prepare an exact-amount deposit
  coin, the transaction now bids your own node's fee estimate (bounded to a
  sane 2–25 sat/vB band) instead of a fixed 2 sat/vB — which sat unconfirmed
  for the better part of an hour during a signet spam wave. While waiting for
  the deposit to confirm, the prompt now warns every 10 minutes if it is
  still unconfirmed, and a timeout tells you whether it is a fee stall (bump
  it with CPFP of the change output) or an eviction (rebroadcast).

• Fixed: send failures now tell you why. An over-balance send reports
  the exact committed / pending / available / requested amounts immediately,
  instead of a generic "peer unreachable or rejected" after a 2-second
  timeout.

• New: attach-wallet <name> prompt command. If your node is running
  without -wallet (for example after the automatic post-keygen restart of
  a node that was started without one), you can now wire up your bitcoind
  wallet live at the prompt and proceed straight to dfund — no restart
  needed.

No protocol or fund-safety semantics changed: cooperative-close settlement
still pays the last checkpointed balances (unconfirmed sends are deliberately
excluded), and all closure/penalty transaction formats are unchanged.

v0.1.14

What's new

• Fixed: bootstrap no longer exits after setup. Previously it wrote
  your cluster config and exited, requiring you to separately run
  coalesce-node run -config ... -wallet ... -enforce to actually start the
  node. Now bootstrap continues directly into running the node in the same
  process — pass -wallet/-enforce (and -verbose/-auto-root-depth/
  -auto-root-fallback if you use them) right on the bootstrap command
  line, and keygen becomes immediately typeable at the prompt that
  appears. No second command, no exiting terminal.

• Fixed a subtle correctness issue this surfaced: keygen/dfund trigger an
  automatic self-restart on completion — verified this restart now correctly
  relaunches as a normal running node, not by re-running the entire
  bootstrap network ceremony from scratch.

No protocol/fund-safety changes — this is a pure setup-flow UX fix.

v0.1.13

What's new

• Fixed: -enforce no longer requires a manual restart after funding.
  Previously, passing -enforce before the cluster was funded caused an
  immediate fatal exit telling you to restart manually once funded — this
  contradicted the project's own "no manual restarts" pattern (keygen and
  dfund already self-restart automatically) and the already-documented
  usage, which tells you to pass -enforce at the very first run, before
  keygen/dfund even happen.

  Now -enforce is accepted at any time. If the cluster isn't funded yet,
  the node runs normally and prints a notice that enforcement will activate
  once dfund completes — and it does, automatically, on the same restart
  dfund already triggers. No manual restart, no re-typing -enforce.

No protocol/fund-safety changes — this is purely a startup-sequencing fix.

v0.1.12

What's new

No functional/protocol changes from v0.1.11 — this release exists to publish
a fresh, immutable tag that picks up the install.sh fixes merged after
v0.1.11 was cut:

• install.sh now shows a real single-line progress bar during download
  (rendered with a bare carriage return only — no terminal-width queries or
  cursor-control codes, unlike curl's own -# progress meter, which could
  render corrupted through curl | bash).
• Added --retry/--connect-timeout/--max-time so a genuinely stuck
  download fails clearly within 3 minutes with a direct fallback URL,
  instead of hanging indefinitely with no feedback.

If you installed v0.1.11 and saw garbled progress-bar output during
download, this release (or re-running install.sh now) fixes that.

v0.1.11

What's new

• New: bootstrap command. Fully automatic networked cluster setup —
  every participant runs one command with a shared peer address list, one
  is deterministically elected coordinator (no election round needed), and
  identity bundles/cluster configs are exchanged automatically over the
  network. No manual file passing at all.

• New: pubkey-pinned authentication. Every bootstrap connection now
  proves, via a signed challenge-response, that whoever is on the other end
  really holds the private key for the address they claim — an attacker
  without that key cannot complete the proof no matter how good their
  network position is.

• New: bootstrap -discover. Find other participants you've never met
  via public Nostr relays instead of a pre-agreed address list — the same
  way a brand-new Lightning node can open a channel with a stranger found
  on the public network. Proves you're talking to whoever holds a given
  key; does not vet that they're a specific real-world person (the same
  trust ceiling a first-time Lightning peer has).

• Renamed: the root prompt command is now propose. Same behavior
  (finalizes a checkpoint) — root was internal DAG terminology that
  didn't mean anything to an operator.

No changes to the group Bitcoin signing key (keygen), still genuinely
dealerless, or to fund-safety guarantees.

v0.1.10

What's new

• New: identity + assemble subcommands for fully distributed cluster
  setup. Each participant now generates their own identity/transport
  keypair locally (coalesce-node identity -dir ./me -addr <host:port>) —
  the private key never leaves their machine. Public bundles
  (self.pub.json) are then collected and assembled into the cluster
  config (coalesce-node assemble -dir ./cluster -bundles a.json,b.json,...)
  with no private key material ever read or written by the assembler.

• This closes a previously-documented gap: init -distributed (still
  available, unchanged, as a quicker single-operator/demo path) has the
  member running it transiently hold every participant's identity private
  key before manually distributing it. identity+assemble removes that
  exposure entirely for real, multi-operator deployments.

No changes to the group Bitcoin signing key (keygen), which was already
genuinely dealerless — this release only affects the lower-stakes
transport/identity key used for peer authentication.

v0.1.9

What's new

• All interactive prompt output now consistently says "cluster" instead of
  the internal protocol term "hyperedge" — this includes the close
  confirmation message, dfund/coopclose availability checks, the funding
  confirmation message, the send-failure explanation, the settlement
  migration error, and the watch command output.

No behavior changes in this release — wording only, so non-technical
operators never see internal protocol terminology during normal use.