Rand Wallet v0.8.0

Built for Rand testnet chain 21 (cut 2026-10-12 on fullnode v0.8.0, c0878c3; genesis ca76c2766ed6090ac6ba5dad86b724dd5d2b80c0edfaed287cd8b129e663ca9a), on fullnode v0.8.0 (c0878c3), which this wallet core vendors. Chain 21 runs constraint set 9, so this is the first wallet that can send on it: 0.7.x wallets refuse chain 21, and this one refuses chain 20, which stopped at the cut. Fixes for chain 20 go to the release/chain20 branch.

Your keys, addresses and viewing keys carry over unchanged; chain 21 was cut from chain 20's state. The wallet's note store does not: a wallet that scanned chain 20 opens on a "This node is on a different chain" banner once — choose Rescan and it reads chain 21 from its genesis. On iOS and Android a saved chain id of 20 becomes 21 by itself; the extension, the desktop app and the web wallet never stored one. A custom RPC URL is kept only if the node behind it answers chain 21.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.8.0-macos-arm64.dmg
macOS, Intel	rand-wallet-0.8.0-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.8.0-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.8.0-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.8.0-linux-x86_64.rpm
any other Linux	rand-wallet-0.8.0-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.8.0.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.8.0.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.8.0-android.apk
to build it yourself	rand-wallet-0.8.0-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.8.0-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.8.0-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

A device that can make a proof (the desktop app, about 8 GiB) makes it. One that cannot — a browser, most phones — uses the RandProtocol prover by default (https://prover.randprotocol.org, four machines run by the validators, no fee), after a one-time notice: like any prover it is sent the wallet's viewing key, so its operators can read the wallet's whole history, and it can never spend. Settings → Prover chooses your own prover instead (the desktop app's Prove for my other devices, or your own server), or none (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.7.3

• Chain 21, fullnode v0.8.0. The core vendors fullnode's v0.8.0 tag (c0878c3): constraint set 9, the randprotocol-msig crate, and the verified fold in the node's verify cache. The bundle and authorisation guests the wallet proves with are unchanged, so the RandProtocol provers and a paired desktop app keep working. DEFAULT_CHAIN_ID is 21 in every client.
• Private multisig signing, in every wallet app. A member of a private multisig account (fullnode v0.8.0's Dilithium2 M-of-N accounts) can sign a proposal from the extension, the desktop app, the web wallet, iOS and Android: Settings → Multisig signers adds a signer profile from its policy and key files (kept in the app's existing secure store — the vault, the Keychain behind user presence, the Keystore behind a per-use key); then open a proposal from a file or by pasting it, enter the intended payments — one row per payee, address and RAND amount —, check it and review its lines verbatim, confirm with the last four characters of the account fingerprint, authenticate again for this one signature (password, Face ID or passcode, fingerprint or screen lock), and share the i:hex share as a file. Preparing, proving and submitting the signed proposal stay in the rand command line. The same refusals hold everywhere and in the core itself: a paying output that is not change must match an entered payee and its pinned amount; a payee without an amount is allowed only when it is paid solely in a non-RAND asset; a malformed proposal, a missing node, a node on another chain or genesis, and a proposal within 16 blocks of its expiry are refused; exactly the text and payments that were checked are signed, and an edit disarms Sign; proposals are never stored, and the seed is decrypted for one signature and zeroed. Twenty languages.
• Fullnode v0.8.0's RPC reads. The wallet's RPC method table and reply validators cover the seven reads v0.8.0 added (perps, multisig and the RAND price among them), and tolerate the new rand_getLimits sections on chain 21 or their absence.
• The wallet against the real node. A new end-to-end suite runs the real wasm core and engine, with real fetch, against a rand-node from the fullnode v0.8.0 release on a Test-profile chain it cuts itself: chain identity, the whole client-side RPC contract, faucet → scan → balance → activity → rescan, a proved spend through a real rand-prover, failover and submit rules, and a node restart. It is the real-node CI job on every push.
• Coverage: wallet-ffi and wallet-wasm fully covered, the core's refusals, the ui's pure-logic suites (core 93.2 % → 95.7 %).

Rand Wallet v0.7.1

Built for Rand testnet chain 20 (cut 2026-10-01 on fullnode v0.6.8, c9c9bd3), on fullnode v0.7.0 (806ed34), which this wallet core vendors — the same as 0.7.0. Your wallet and its history carry over.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.7.1-macos-arm64.dmg
macOS, Intel	rand-wallet-0.7.1-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.7.1-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.7.1-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.7.1-linux-x86_64.rpm
any other Linux	rand-wallet-0.7.1-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.7.1.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.7.1.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.7.1-android.apk
to build it yourself	rand-wallet-0.7.1-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.7.1-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.7.1-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

A device that can make a proof (the desktop app, about 8 GiB) makes it. One that cannot — a browser, most phones — now uses the RandProtocol prover by default (https://prover.randprotocol.org, four machines run by the validators, no fee), after a one-time notice: like any prover it is sent the wallet's viewing key, so its operators can read the wallet's whole history, and it can never spend. Settings → Prover chooses your own prover instead (the desktop app's Prove for my other devices, or your own server), which is then always preferred, or none (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.7.0

• Swap on Android and iOS. The phone apps get the Swap screen the browser extensions and the desktop app have had since 0.7.0: trade RAND and tokens through the durian.market pools from the wallet. The phone makes the program call's proof and the spend authorisation itself and the RandProtocol provers make the large proof; the amount you receive is exact, and a pool that moves first means a new quote, never a worse fill. Swap takes Faucet's place on the home screen; the faucet is under Activity.
• A swap needs about 1.5 GB of memory on the phone for its own proofs. A phone without it is told so before anything starts, rather than the app being stopped half-way.
• Android: activity rows show each token as itself (a swap's DUR reads as DUR, with its own decimals), and a swap's row says Swap.

Rand Wallet v0.7.0

Built for Rand testnet chain 20 (cut 2026-10-01 on fullnode v0.6.8, c9c9bd3), on fullnode v0.7.0 (806ed34), which this wallet core vendors. Same chain as 0.6.9: your wallet and its history carry over.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.7.0-macos-arm64.dmg
macOS, Intel	rand-wallet-0.7.0-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.7.0-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.7.0-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.7.0-linux-x86_64.rpm
any other Linux	rand-wallet-0.7.0-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.7.0.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.7.0.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.7.0-android.apk
to build it yourself	rand-wallet-0.7.0-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.7.0-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.7.0-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

A device that can make a proof (the desktop app, about 8 GiB) makes it. One that cannot — a browser, most phones — now uses the RandProtocol prover by default (https://prover.randprotocol.org, four machines run by the validators, no fee), after a one-time notice: like any prover it is sent the wallet's viewing key, so its operators can read the wallet's whole history, and it can never spend. Settings → Prover chooses your own prover instead (the desktop app's Prove for my other devices, or your own server), which is then always preferred, or none (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.6.9

• Swap, in the wallet. The home screen's Faucet button is now Swap: trade RAND and tokens through the durian.market pools without leaving the wallet. Pick what you pay and what you receive; the wallet reads the pool from the chain and quotes the exact amount, the rate, the price impact and the 0.3% pool fee, then proves and sends the swap itself (the same program call durian.market asks for). The amount you receive is exact — if the pool moves before the swap lands, nothing is sent and you get a new quote. In the browser extensions, the desktop app and the web wallet; not yet in the phone apps. (The faucet is still one tap away from an empty activity list.)
• Fullnode v0.7.0 inside: the audit v7 fixes, the incremental token root, and the RandProtocol provers' per-member keys. The proof programs are unchanged, so nothing about sending changes.

Rand Wallet v0.6.9

Built for Rand testnet chain 20 (cut 2026-10-01 on fullnode v0.6.8, c9c9bd3; its nodes now run v0.6.9, 3f43101, which this wallet core vendors). Same chain as wallet 0.6.8: no new chain, no new keys, your wallet and its history carry over. Update: 0.6.8's built-in prover stops working when 0.6.9 ships — 0.6.8 reaches the RandProtocol provers through one shared key, which is retired with this release. Until you update, a 0.6.8 browser wallet or phone cannot send unless you pair your own prover.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.6.9-macos-arm64.dmg
macOS, Intel	rand-wallet-0.6.9-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.6.9-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.6.9-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.6.9-linux-x86_64.rpm
any other Linux	rand-wallet-0.6.9-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.6.9.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.6.9.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.6.9-android.apk
to build it yourself	rand-wallet-0.6.9-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.6.9-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.6.9-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

A device that can make a proof (the desktop app, about 8 GiB) makes it. One that cannot — a browser, most phones — now uses the RandProtocol prover by default (https://prover.randprotocol.org, four machines run by the validators, no fee), after a one-time notice: like any prover it is sent the wallet's viewing key, so its operators can read the wallet's whole history, and it can never spend. Settings → Prover chooses your own prover instead (the desktop app's Prove for my other devices, or your own server), which is then always preferred, or none (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.6.8

• The RandProtocol provers, each with its own key. The default prover is now a pinned list of four machines (a, archive2, nyc3, sfo3), each holding its own key rather than one key shared by all. A proof job is sealed to the one machine that makes it; a machine that is busy or away is skipped and the next one asked, and Settings → Prover shows which machines the wallet trusts, by fingerprint. Wallet 0.6.8's shared key is retired with this release (audit v7 VK-9).
• Proving shows how far along it is: a ring fills towards the time a send usually takes on this device (RAND, an RPL token, a withdrawal, a durian.market swap each learned separately), with the time left.
• The transaction hash can be copied on the Sent screen, and Open in randscan goes to randscan.org/transactions/<hash>.
• Touch ID is offered after a password unlock in the Chrome extension, so it becomes the way in without a trip to Settings.
• Fee notes from bridge withdrawals are found by the phone apps too.

Rand Wallet v0.6.8

Built for Rand testnet chain 20, cut 2026-10-01 on fullnode v0.6.8 (c9c9bd3): programs that hold state (RPL-2), transactions bound to their chain's genesis (BIND-1), and a bridge fee taken in zUSD. The wallet core vendors that very build. A wallet from this release refuses any other chain; a v0.6.7 wallet refuses chain 20, so update.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.6.8-macos-arm64.dmg
macOS, Intel	rand-wallet-0.6.8-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.6.8-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.6.8-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.6.8-linux-x86_64.rpm
any other Linux	rand-wallet-0.6.8-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.6.8.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.6.8.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.6.8-android.apk
to build it yourself	rand-wallet-0.6.8-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.6.8-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.6.8-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

A device that can make a proof (the desktop app, about 8 GiB) makes it. One that cannot — a browser, most phones — now uses the RandProtocol prover by default (https://prover.randprotocol.org, four machines run by the validators, no fee), after a one-time notice: like any prover it is sent the wallet's viewing key, so its operators can read the wallet's whole history, and it can never spend. Settings → Prover chooses your own prover instead (the desktop app's Prove for my other devices, or your own server), which is then always preferred, or none (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.6.7

• The RandProtocol prover is the default wherever the device cannot prove — every browser wallet and most phones can send out of the box. A one-time notice before the first send says what it sees (the viewing key: the whole history, never the spend key); Settings → Prover picks your own prover or none. A submit that never reached the prover is offered again (three tries), and a busy pool is said plainly. Firefox asks its data-collection consent first.
• window.rand.invoke in the browser extensions: a site (durian.market) asks the wallet to call a program; the wallet's own window shows what leaves the wallet and what comes back, the fee and the site, and on Approve proves and submits. Everything a swap can be refused for — a stale pool, a vault that cannot pay, notes that cannot pay in, a chain without programs — is refused before any proof, with a code the site understands.
• Bridge fees (chain 20): the chain keeps 0.1% of each deposit and each withdrawal, in zUSD. A deposit arrives net of it; the withdraw review shows the fee and what arrives. The fee recipient's wallet finds its fee notes (they carry no envelope) by rebuilding them.
• BIND-1: on every chain after 19 a transaction binds its chain's genesis hash, so it is valid there and on no other chain. Every client sends the genesis with each proof.
• Unlock with Touch ID (Chrome extension): a passkey seals your password; the lock screen asks for your fingerprint first, and the password still works.
• The side panel is the extension's home: the toolbar button opens it, in Chrome and Firefox alike.
• The desktop prover host carries the fullnode's Plonky3 fixes (a spin lock held across parallel work, in two places) — with the newer fullnode's parallel proving, without them a desktop proof could hang.
• A new store summary.

Rand Wallet v0.6.7

The first release with packages for every platform. Built for Rand testnet chain 19, which is chain 18's build (fullnode v0.6.7, constraint set 8, split authorisation) cut again with a new bridge section; the wallet core vendors that very build, fullnode v0.6.7 (86941a1). A wallet from this release refuses any other chain.

Testnet software: not audited, not for real value.

Download

you have	file
macOS, Apple silicon	rand-wallet-0.6.7-macos-arm64.dmg
macOS, Intel	rand-wallet-0.6.7-macos-x64.dmg
Windows 10 / 11	rand-wallet-0.6.7-windows-x64.msi (or …-setup.exe, the same app)
Debian, Ubuntu	rand-wallet-0.6.7-linux-x86_64.deb
Fedora, openSUSE	rand-wallet-0.6.7-linux-x86_64.rpm
any other Linux	rand-wallet-0.6.7-linux-x86_64.AppImage, or the bare binary in …-linux-x86_64.tar.gz
Linux on arm64	the same four, named …-linux-arm64.…
Chrome, Edge, Brave	rand-wallet-chrome-0.6.7.zip — unzip, then Load unpacked at chrome://extensions
Firefox 140+	rand-wallet-firefox-0.6.7.zip — Load Temporary Add-on… at about:debugging
Android 8+	rand-wallet-0.6.7-android.apk
to build it yourself	rand-wallet-0.6.7-source.tar.gz — this repository and its submodule

iOS has no download (Apple installs only from TestFlight or the App Store); build it in Xcode from the source. rand-wallet-0.6.7-android.aab is the bundle submitted to Google Play, attached for the record; a phone installs the .apk.

Check it

shasum -a 256 -c SHA256SUMS --ignore-missing     # macOS
sha256sum -c SHA256SUMS --ignore-missing         # Linux

Get-FileHash .\rand-wallet-0.6.7-windows-x64.msi -Algorithm SHA256

First launch

Nothing here is signed with a paid developer certificate yet.

• macOS: System Settings → Privacy & Security → Open Anyway, or xattr -dr com.apple.quarantine "/Applications/Rand Wallet.app".
• Windows: SmartScreen → More info → Run anyway.
• Linux AppImage: chmod +x it first.
• Android: signed with this project's upload key, certificate SHA-256 75:22:2E:BF:22:D3:95:80:A5:11:2A:AC:B7:EC:2E:03:93:91:07:77:96:E0:45:1D:7B:CF:E3:7E:FA:06:53:52.

The desktop app proves transfers on your computer (about 8 GiB of memory) and can prove for the browser extension on the same machine: Settings → Prove for my other devices. A paired prover — that one, or anybody's — is sent the wallet's viewing key, never its spend key: it can read the wallet's whole history and cannot spend (docs/prover.md). Details, and how to build every client from source: the README and https://randprotocol.org/clients.

Since v0.6.5

• The wallet is aimed at chain 19: fullnode v0.6.7, constraint set 8, the bundle gas-limit pin and the envelope-format pin in every shell.
• Split authorisation (fullnode v0.6.3, every chain since 17 — without it, every send on chain 18 was refused AuthMissing). A transaction carries two proofs: the bundle proof, made from the wallet's viewing key and a one-time salt, and a small authorisation proof made from the spend key. The wallet makes the authorisation proof itself, on the device, always — natively in seconds, in a browser in about half a minute — and only the bundle proof can be delegated. So a paired prover is sent the viewing key, can read the wallet's whole history and cannot spend, and need not be the user's own: the pairing warning now says that, a pairing not marked own is used (it was "saved; not usable") and shown as "Paired prover", and the desktop app's Prove for my other devices takes viewing-key jobs only. A prover that quotes a fee is not used: this release pays none. In the core (prove_*, prepare_*, the new chain_guests), the shared engine, iOS, Android and the desktop.
• The core refuses, before anything is proved, a chain whose bundle guest is v3 but whose node names no auth guest (or another build's), and an auth guest beside an older bundle guest.
• A bundle proof now peaks at about 6.2 GB (measured on fullnode v0.6.7: 6.12 GB for a transfer and 6.15 GB for a withdrawal at the production profile); the 8 GiB device gate is unchanged.
• A first sync finishes on a rate-limited endpoint. Every client looked for bridge deposits by opening every block, one request each — a hundred thousand requests on a chain that makes a block a second, against a public endpoint that allows about a hundred and then one a second. A new wallet never finished its first scan. The search now pages block headers (rand_getBlocks, 1024 a request) and opens only the blocks that carry a transaction, spends at most 96 requests a scan on it, and no longer fails the scan when the node will not answer; and a read refused with HTTP 429 is repeated after a wait instead of ending the scan. In the shared engine (extensions, desktop, web wallet), Android and iOS alike.
• A scan of a busy chain no longer fails half-way. The extensions, desktop app and web wallet read the tree's leaf count once and refused any page past it as a node lying about the tree; a block landing mid-scan made an honest node look like one. The count is now read again when a page reaches past it (found on chain 19's first release check).
• Android targets API 36, pads its screens for edge-to-edge display, and the lock screen's Back handling moved to the back dispatcher.
• The submodule is fetched over https, so a clone needs no GitHub SSH key.
• A release pipeline: scripts/release/, .github/workflows/release.yml, Jenkinsfile.