v5.1.3-beta.4

Sentinel — Dojo Bay Edition, staging build 5.1.3-beta.4 (versionCode 59).

This is the largest beta so far. It brings in 52 pull requests of community work from
tetragrammalol/sentinel-android-dojobay
— 112 commits — on top of the in-app Rescan Xpub feature added here. Nearly all of the
credit for this release belongs to @tetragrammalol.

Installing

This installs straight over beta.3. No backup-and-uninstall needed — versionCode 59
replaces 58, and the signing key is unchanged.

adb install -r sentinel-staging-v5.1.3-beta.4.apk

Or copy the APK to the phone and open it. Verify what you downloaded against
SHA256SUMS.txt on this release before installing.

If you are coming from a build older than beta.3, you may hit
INSTALL_FAILED_UPDATE_INCOMPATIBLE — those were signed with a different key. Export a
backup from Settings, uninstall, install this, then import.

What changed

Privacy — log redaction

Onion hostnames, xpubs/upubs, txids and HTTP traffic are masked in logcat, and direct
android.util.Log calls were routed through Timber so redaction can see them. Previously
a debug build could write your Dojo's onion address and your public keys to the log.

Dojo pairing, substantially reworked

Pairing no longer commits silently. You now get labelled detail rows before pairing —
Jurisdiction, Dojo URL, Dojo version, Explorer — an explicit acknowledgment step, and a
"Dojo paired" receipt or a clear failure message afterwards. The community Dojo list
shows the URL you are actually pairing against rather than the block explorer's. Also
fixed: a lockout when re-pairing, a stuck connect spinner, and pairing payloads that
bypassed the Tor gate or the network guard.

State restoration after process death

A process Android relaunches onto a screen other than the lock screen is now sent back to
the lock screen before anything reads the wallet. This fixes three separate bugs: Home
failing with "Could not load collections", Settings silently exporting a backup containing
0 collections and no Dojo, and the UTXO screen crashing outright. Collection
fragments, dialogs, scanned payloads and the sweep preview now all survive recreation.

Sync correctness

An empty fetch no longer wipes transaction history unless the round is healthy. A failed
automatic sync no longer deletes all UTXOs and clears do-not-spend marks while reporting
success. Balances re-render when street mode or the exchange rate changes, and the
transaction and UTXO sync paths each emit once instead of racing.

Labels (BIP-329)

UTXO label chips, correct label rendering on first scope, the label engine running after
inserts rather than before, TX0 label casing, and remix transactions routed hands-off so
they keep the upstream presentation.

Tor and TLS

Tor plumbing now fails closed rather than falling back to a direct connection. TLS policy
is host-scoped, and the explorer proxy host handling was corrected.

Backup and import

The legacy v2 import now uses the same PBKDF2 iteration count as export, so older backups
decrypt. Imports no longer drop entries silently, and a backup from the wrong network is
refused rather than half-applied.

Rescan Xpub (this repo's own addition)

If a Dojo returns an empty balance because it was never tracking your key, you can fix it
from the phone: Settings → Rescan Xpub, the collection overflow menu, or a single key
from the collection editor. The confirmation dialog states the privacy cost plainly — a
Dojo you hand an xpub to sees every address in that wallet. Each key then has a 15-minute
cooldown, because a rescan is expensive for the node and invisible to you while it runs.

Platform

minSdk is now 24 (Android 7.0+). Also: keychain transaction history on first open,
Ashigaru branding on wallet-imported keychains, a network switch on the Network page,
scanner sheets that no longer drop a decode, and a corrected fee-tier label.

Known issues — please don't re-report these

Fixes exist for all of these but are not in this build:

• Crash: Settings → Import Labels on a device with no file picker (#292)
• ANR: occasional freeze on cold start, caused by an oversized toolbar icon (#295)
• Privacy: "Erase all Sentinel data" leaves encrypted .bak payload files and one
  tx_entropy row behind (#298)
• Security: Export Backup and Erase all data are not PIN-gated (#288)
• Privacy: OkHttp can log the raw Dojo onion address in a connection-leak warning
  (#293, #304)
• Home can show a blank total and a 00.00 fiat figure during the first sync (#303)
• A valid xpub pasted with surrounding whitespace is rejected (#297)

What is most useful to test

1. Pair a Dojo — the pairing flow absorbed the most change. Check the detail rows and
   the receipt appear.
2. Switch between Dojos and back, confirming balances stay correct across the switch.
3. Rescan Xpub from all three entry points; retry one immediately and confirm the
   cooldown refuses it and names the wait.
4. Cold start repeatedly, with and without a PIN, and after force-stopping the app.
5. Export a backup, erase, reinstall, import — the restoration work touched this path.

Report with your Android version, device, whether Tor was on, and whether the Dojo was
your own or a community node.

Disclaimer

Experimental community software, provided as-is, with no affiliation to Samourai
or Dojo Bay operators. Watch-only: Sentinel holds no private keys. This is a
staging build for testing, not a release.

What's Changed

• Rescan Xpub: hold a per-key cooldown between rescans by @btcwrestle in #11
• Merge tetragrammalol/sentinel-android-dojobay master (112 commits) by @btcwrestle in #12
• Bump staging to versionCode 59 / 5.1.3-beta.4 by @btcwrestle in #13

Full Changelog: v5.1.3-beta.3...v5.1.3-beta.4

v5.1.3-beta.3

What's Changed

• Dojo onboarding, BIP84 default, UTXO labels, staging CI, and Network screen fixes by @tetragrammalol in #3
• CI: repair the staging build (retired SDK package, fork-PR keystore) by @btcwrestle in #7
• Community continuation arc: Tor/Dojo hardening, BIP-329 labels, Bad Bank, release pipeline (130+ commits since 36a7e27) by @tetragrammalol in #6
• README: correct the lineage after merging #6 by @btcwrestle in #8
• Restore the release pipeline lost in #6's merge; bump staging to beta.3 by @btcwrestle in #9
• Add "Rescan Xpub" — in-app Dojo rescan from Settings, the collection menu, and per key by @btcwrestle in #4
• Let the release job upload into an existing release by @btcwrestle in #10

New Contributors

• @tetragrammalol made their first contribution in #3

Full Changelog: v5.1.3-beta.2...v5.1.3-beta.3

Sentinel Beta 5.1.3-beta.2

Sentinel Beta 5.1.3-beta.2

Community beta adding a browsable directory of community-run Dojos, plus
balance-troubleshooting help and several UI/UX fixes.

Installs as a separate app — "Sentinel Beta" — alongside your existing
Sentinel. Your current wallet is not touched.

---

⚠️ Read before installing

Important

This is a debug-signed community build, not an official release.
It is signed with an automatically generated debug key, so it cannot be
verified as coming from the original repository and cannot be upgraded in place from
an official release. Install it only if you understand and accept that.

Important

It installs side by side. The package ID is
com.samourai.sentinel.staging, so it appears as its own app called
"Sentinel Beta" and will not replace, modify, or read your existing
Sentinel install. You will need to add your public keys to the beta
separately — it starts empty and does not import from the real app.

Note

Sentinel is watch-only. It stores public keys, never spending keys, so it
cannot move funds. Still treat your xpubs as private: they reveal your full
transaction history.

---

Install

File	sentinel-beta-5.1.3-beta.2.apk
SHA256	431d36d1dad81a9d15782f6c2b724e43fc04db35dc9ff9061348d655a1371173
Size	46 MB
Package	com.samourai.sentinel.staging
Min Android	5.0 (API 21)

Verify before installing:

sha256sum -c SHA256SUMS.txt

Then allow install from your browser or file manager when prompted.

If you already have a previous beta installed, this one has the same package
ID and can be installed over it as an update.

---

What's new since 5.1.3-beta.1

Community Dojo directory (Dojo Bay) picker

Network settings → Dojo Full Node → Connect to existing Dojo → Browse
Community Dojos (Dojo Bay). Instead of only pairing to a Dojo you already
have connection details for, you can now browse a live, Tor-fetched directory
of community-run Dojos and pair to one directly, or copy its pairing JSON.

• A privacy warning is always shown first: connecting to someone else's Dojo
  shares your transaction history and addresses with its owner, and running
  your own Dojo remains the recommended option.
• Each entry now shows a country flag next to its name, plus online/offline
  status, version, and jurisdiction.
• Several bugs found while wiring this up are fixed in this build: the
  directory fetch was hitting the wrong onion path, it briefly ran on the
  main thread (NetworkOnMainThreadException), and a nullable-Boolean crash
  in the network filter.

Balance/rescan-xpub help (new)

If your balance doesn't show up after connecting to a Dojo, it usually means
the Dojo needs to rescan your xpub. This is now explained automatically the
first time you connect a Dojo during initial setup, and is available any time
from Settings → Troubleshooting & Debug → Help querying correct balance.

Custom block explorer

Settings → Explorer now has a Custom option alongside Blockstream and
Blockchair, so you can point transaction links at your own onion block
explorer instead.

Initial setup no longer stacks popups

On a fresh install, the notification-permission, camera-permission, and Dojo
setup prompts could all appear on top of each other. They now show one at a
time, in sequence.

Smaller fixes

• Community Dojo privacy warning: fixed a grammar error ("share's" →
  "shares") and strengthened the wording to "IT IS HIGHLY RECOMMENDED TO RUN
  YOUR OWN DOJO"
• "Browse Community Dojos" button color now matches "Connect to Dojo" instead
  of standing out in green

---

Please test

Highest value first:

1. Dojo Bay picker. Browse the community directory, pair to one, confirm
   the flag/status/version info looks right, and confirm the privacy warning
   appears before you can browse.
2. Balance help. On a fresh install, connect to any Dojo and confirm the
   rescan-xpub reminder appears once, with a working copy/tap link to Dojo
   Bay. Also check it from Settings → Troubleshooting & Debug.
3. Initial setup flow. Fresh install (or Settings → "Erase all Sentinel
   data"), and confirm the notification/camera/Dojo-setup prompts appear one
   after another, not stacked.
4. Custom explorer. Set a custom onion explorer URL in Settings →
   Explorer and confirm transaction links use it.
5. Everything from the previous beta remains in scope: Dojo balances over
   time, wallet persistence across restarts, sweep/broadcast, QR scanning,
   and sync feedback under airplane mode.

Reporting problems

Open an issue with: what you did, what you expected, what happened, your device
and Android version, and whether Tor/Dojo was connected.

Logs help:

adb logcat -d | grep -i sentinel > sentinel-log.txt

Caution

Redact logs before sharing. Debug builds log your xpubs, addresses, and
Dojo .onion URL. Search for xpub, ypub, zpub, bc1, and .onion and
remove those lines.

---

Build from source

git clone https://github.com/btcwrestle/sentinel-android.git
cd sentinel-android
git checkout claude/dojo-dropdown-privacy-warning-xz4s6o
./gradlew :app:assembleStagingDebug

Output: app/build/outputs/apk/staging/debug/

Builds on JDK 17–24 with no configuration. Room uses KSP instead of kapt,
which removes the JDK-version workarounds the project previously needed.

Known gaps

• PIN encryption edge cases are lightly tested. Failures should surface as
  errors, not silent data loss — but back up your collections first.
• Sweep and broadcast were verified as compiling and launching, not
  end-to-end with real funds.
• The Dojo Bay directory depends on a third-party site being reachable over
  Tor; if browsing fails, it doesn't affect manually pairing to a Dojo you
  already have details for.

Sentinel Beta 5.1.3-beta.1

Sentinel Beta 5.1.3-beta.1

​
Community beta with fixes for wallet data loss, crashes, sync UX, and a bug
that stopped balances loading for everyone using a Dojo.
​
Installs as a separate app — "Sentinel Beta" — alongside your existing
Sentinel. Your current wallet is not touched.
​

​

⚠️ Read before installing

​

Important

This is a debug-signed community build, not an official release.
It is signed with an automatically generated debug key, so it cannot be
verified as coming from the original repository and cannot be upgraded in place from
an official release. Install it only if you understand and accept that.
​
[!IMPORTANT]
It installs side by side. The package ID is
com.samourai.sentinel.staging, so it appears as its own app called
"Sentinel Beta" and will not replace, modify, or read your existing
Sentinel install. You will need to add your public keys to the beta
separately — it starts empty and does not import from the real app.
​
[!NOTE]
Sentinel is watch-only. It stores public keys, never spending keys, so it
cannot move funds. Still treat your xpubs as private: they reveal your full
transaction history.
​

---

​

Install

​

File	sentinel-beta-5.1.3-beta.1.apk
SHA256	3ac766f7d049dadb045abceb7147373f75a744e1c0e9d8c84ced886eadcf756c
Size	46 MB
Package	com.samourai.sentinel.staging
Min Android	5.0 (API 21)
​
Verify before installing:
​

sha256sum -c SHA256SUMS.txt

​
Then allow install from your browser or file manager when prompted.
​

​

What's fixed

​

Wallets no longer randomly disappear

​
A failed read of the encrypted payload was indistinguishable from "you have no
wallets", and that empty state got written back over real data — permanently
deleting collections. Writes are now atomic with a .bak copy, and the app
refuses to save over a payload it could not read.
​

Balances now load when using a Dojo

​
If your balance stopped showing after pairing a Dojo, this is the fix.
​
Dojo access tokens expire after 15 minutes. The token refresh path was broken
in four separate ways, so once that window passed every wallet request was
rejected and no balance could load again until you re-paired. This is why it
happened on every Dojo server, and why it looked fine for the first few minutes.
​

No more endless spinner

​
The loading indicator could spin forever with nothing actually running. Cached
balances now appear immediately, the banner reports real progress, and failures
show a reason plus a Retry button.
​
There is deliberately no sync timeout — Tor can legitimately take minutes,
and the old build cancelled healthy-but-slow syncs and reported a false
"timed out" error.
​

Network status traffic light

​

Colour	Meaning
🟢 Green	Tor connected and all collections synced
🟡 Yellow (flashing)	Connecting / bootstrapping / syncing
🔴 Red	Tor off, or sync failed
​

Dojo pairing credentials viewer (new)

​
Network settings → Dojo Full Node → Details. Shows a QR of your pairing
payload plus URL, API key, type and version, all selectable with copy buttons —
so you can pair another device without the original QR.
​

Caution

That QR contains your Dojo's API key, which grants access to your node.
Never share a screenshot of that screen. The app blocks screenshots there, so
screen recorders will show it blank.
​

Crash fixes

​

• Tapping "New" then dismissing the camera permission dialog by tapping outside
  it used to crash reliably
• Coroutines tied to destroyed screens could crash on rotation or fast
  navigation
• Several null-handling crashes in Dojo setup, broadcast, and sweep
  ​

Other

​

• The "New" button no longer overlaps the sync banner
• Silent failure swallowing in UTXO fetching now logs properly
• Two runBlocking calls removed from the sweep flow that could freeze the UI
  ​

---

​

Please test

​
Highest value first:
​

1. Dojo balances over time. Pair a Dojo, then leave the app open for 20+
   minutes and pull to refresh. This is the main fix and the scenario that
   was broken.
2. Wallet persistence. Add collections, force-stop, reopen. Repeat 5–10
   times. Set a PIN, restart, unlock. Remove the PIN, restart.
3. Sweep and broadcast. These paths had threading changes and are the least
   exercised.
4. QR scanning. Scan a pubkey, and try rotating or backing out mid-scan.
5. Sync feedback. Airplane mode, then refresh — you should get an error with
   Retry, never an endless spinner.
   ​

Reporting problems

​
Open an issue with: what you did, what you expected, what happened, your device
and Android version, and whether Tor/Dojo was connected.
​
Logs help:
​

adb logcat -d | grep -i sentinel > sentinel-log.txt

​

Caution

Redact logs before sharing. Debug builds log your xpubs, addresses, and
Dojo .onion URL. Search for xpub, ypub, zpub, bc1, and .onion and
remove those lines.
​

---

​

Build from source

​

git clone https://github.com/btcwrestle/sentinel-android.git
cd sentinel-android
git checkout fix/dojo-balance
./gradlew :app:assembleStagingDebug

​
Output: app/build/outputs/apk/staging/debug/
​
Builds on JDK 17–24 with no configuration. Room now uses KSP instead of
kapt, which removes the JDK-version workarounds the project previously needed.
​

Credits

​
Coroutine scope and logging fixes were identified and originally written by
MightyMercurian and
ported here with adaptations.
​

Known gaps

​

• PIN encryption edge cases are lightly tested. Failures should surface as
  errors, not silent data loss — but back up your collections first.
• Sweep and broadcast were verified as compiling and launching, not
  end-to-end with real funds.