2026.8.1

Release Notes

This release is about trusting what's on screen. The alarm path got a
correctness pass — the newest reading is now genuinely the newest, alerts no
longer re-fire every time a value hovers on a threshold, a flat glucose no
longer predicts a low, and a bad token says so and stops retrying instead of
looking like a network outage. Saving settings can no longer lose your
Nightscout token, the site URL and token are now editable in the app (masked,
and no longer echoed by the setup wizard), and an unencrypted http:// site is
called out rather than accepted silently. The stats panel turned clinical —
five-band time-in-range with time-below-range and CV variability, over a fixed
14-day window — and history is now fully navigable from the keyboard.

Added

• Keyboard navigation for the overview strip — H / L (or PgUp /
  PgDn) pan a whole window at a time and End jumps to the oldest edge of the
  overview, so moving through history no longer needs a mouse.
• Clinical time-in-range. The stats panel now splits readings across the
  five consensus bands (very low / low / in range / high / very high) instead of
  three, calls out the time below range percentage — the number that changes
  treatment — and reports CV, the standard measure of glycaemic variability,
  highlighted when it exceeds the 36% consensus target.
• Content-free notifications — a new Notification detail setting
  (notify_content) keeps desktop notifications free of your reading and alert
  state, for lock screens and shared displays. They still fire, and urgent ones
  are still critical.
• Unsaved settings are visible. Settings apply live but only w writes them
  to config.toml; the settings header now says · unsaved changes (w to save)
  so quitting can't silently discard them.
• Fix a bad site without leaving the app — the settings screen gains a
  Site section with the Nightscout URL and read-only token. Press Enter on
  a row to edit it; the app reconnects immediately, and w saves as usual. The
  token is masked while typing and never rendered back (the row reads
  set · ••••••).
• Unencrypted sites are called out. A plain http:// site sends your token
  and readings in the clear, so the dashboard footer now says so and the setup
  wizard asks you to confirm before accepting one. Loopback addresses
  (localhost, 127.0.0.1) are exempt — they never leave the machine.
• Push alerts are now a settings row (Alarm → Push alerts) — toggle the
  urgent-alert webhook on or off in the app without deleting the configured
  push_url. The row shows only the host, never the full topic/path, and the
  new push_enabled config key persists the choice.

Fixed

• Esc no longer quits the app. From the dashboard it returns to the live
  edge (and closes the help overlay or a prompt, as before) — quitting is q,
  which is what every other screen already did.
• The current-value pane keeps its range label when compact. On a short
  terminal the colour-independent label (LOW, in range) was pushed onto a
  line that got clipped, leaving colour as the only cue; it now sits on the
  headline next to the reading.
• The overview strip says why it's empty — "loading overview…" before the
  first fetch, "no readings in this window" after — instead of drawing a bare
  box.
• The audible alarm falls back to the terminal bell when no system audio
  player is available (headless boxes, minimal containers, a bare SSH login),
  instead of failing silently — silence is indistinguishable from "glucose is
  fine".
• The setup wizard no longer echoes your token to the terminal — it's masked
  as you type, so it doesn't survive in the scrollback.
• URLs are normalized instead of failing mysteriously. A bare
  mysite.example.com, a trailing slash, or a pasted
  …/api/v1/entries.json?count=10 now resolves to the right base URL, in the
  wizard, in the settings editor, and when loading an existing config.toml.
• A partly-failed refresh now says so. When the readings arrive but a
  companion fetch doesn't, the affected panels (IOB/COB, treatment markers,
  forecast, sensor age, history, overview) were left showing old values with
  the connection still reading as healthy. The footer now names what's stale.
• The connection recovers while you're browsing history. Backoff retries
  were skipped unless you were at the live edge, so an outage that started
  while you were panning stayed until you refreshed by hand. The backoff also
  now actually reaches its documented 60s ceiling (it stopped at 40s).
• No more "heading low in ~0 min" from a stale forecast. Uploader forecasts
  are timestamped when the pump published them; an old one is entirely in the
  past, and its points were being reported as an imminent crossing. Past points
  are now skipped.
• A delta too small to show no longer renders as -0.0 in the dashboard or
  the Waybar module — the sign follows the value as displayed, so a flat trend
  reads flat.
• The predict-horizon setting is honest about its reach — above 30 minutes
  it notes that the local (AR2) forecast only projects that far, so a longer
  horizon needs uploader predictions from Loop or OpenAPS.
• Saving settings can no longer lose your token. config.toml is now
  written to a temp file (created owner-only, flushed to disk) and renamed into
  place, instead of being truncated and rewritten — so a crash, a full disk, or
  a power cut mid-save leaves the old config intact rather than an empty file
  with the only copy of your Nightscout token gone.
• The setup wizard no longer builds config.toml by string interpolation —
  values are serialized by the TOML library, so a URL or token containing a
  quote or newline can't corrupt the file or inject extra settings into it. The
  file is also created with 0600 from the start, rather than being chmodded
  after the token was already written.
• The audible alarm no longer leaks processes. Each alarm spawns a system
  audio player; those were never reaped, so a long overnight urgent state piled
  up hundreds of zombie processes. Finished players are now cleaned up on every
  play.
• Alert thresholds can't cross any more — urgent-low ≤ low ≤ high ≤
  urgent-high is enforced while editing, so you can't silently disable a band
  by dragging one threshold past its neighbour.
• The newest reading is now always the newest reading — entries are sorted
  by timestamp on arrival instead of trusting the order Nightscout (or a proxy
  or mirror in front of it) happened to return, so the current value, delta,
  staleness check, and forecast can't silently key off an older reading.
• Alerts no longer flap on a threshold. A reading hovering on a boundary
  (69 → 71 → 69, well inside CGM noise) used to re-fire the notification, the
  audible alarm, and the push webhook every single time. Clearing an alert now
  requires moving 4 mg/dL past the threshold; raising one is unchanged, so a
  real low still alarms on the first reading that crosses.
• A flat glucose no longer predicts a low. The predictive alert and its ETA
  now follow the centre of the forecast rather than the edge of the uncertainty
  cone, which widens with the horizon and so crossed a threshold even when
  glucose was perfectly steady.
• A bad token or URL now says so and stops retrying instead of being
  retried forever as if it were a network outage. After three consecutive
  authentication (401/403) or not-found (404) responses, automatic fetching
  pauses with an explanatory message; press r, or switch/edit the site, to
  resume.
• Stats are now clinical, not cosmetic — time-in-range, mean, and GMI are
  computed over a fixed window of the last N days (the AGP days setting,
  default 14 — the clinical standard) instead of whatever slice of the graph
  happened to be on screen, so panning or zooming no longer changes them. The
  stats panel title names the window (e.g. stats · 14d).