Changelog

• 💵 A rig now reports what it earns even with its window closed. The desktop computed its $/day figure in the interface and handed it to Pasiv Cloud, while the rest of a rig's report came from the app's core — so a machine mining perfectly with no window open published everything except the money, and the fleet total was quietly short rather than visibly wrong. The figure now comes from the core, the way the headless node has always done it, using the same shared formula.
• 🔢 The Verus lane is priced as Verus. It was valued at the CPU coin's rate, and VerusHash and RandomX hashrates are not the same kind of quantity, so the result was meaningless rather than slightly off. Only affected machines mining Verus alongside a CPU coin.
• 📱 The phone says when it can't value a rig. A mining rig with no coin rate used to render as a missing line, indistinguishable from a healthy one. It now says "earnings unavailable — no coin rate", and the fleet total says how many rigs it excludes.

• 📊 Anonymous measurement that can answer whether Pasiv is worth running. A once-ever first-open marker, a once-per-day marker recorded only when a machine has actually had a share accepted, and a bucketed graphics-card class (none / low / mid / high) from the best eligible card. No model names, no serials, nothing that identifies a person or a machine — and the single opt-out in Settings governs all of it.
• 🧠 The Idle Compute beta is measured too — consent, the toggle, and a once-per-day marker when the machine actually served requests. It previously emitted nothing, so uptake of the beta was invisible.
• 🔒 A Secure Boot machine no longer reports a CPU boost it did not get. The diagnostic used to call the boost script's presence a pass; with Secure Boot on, the kernel forbids the writes the boost depends on. The check now reads kernel lockdown first and reports the truth, and the Linux warning names a fix you can act on.
• 🪟 Windows builds are built unsigned and signed in a separate, verified pass. Shipped installers remain Authenticode-signed and timestamped, and the updater signature is regenerated over the signed installer.

• 🖥️ A headless node now shows its CPU in the companion. A rig run by pasivd reported no hardware, so its tile showed no processor while every desktop rig did. It now publishes the same capability summary the desktop does — CPU model and thread count, no serial or identifier.
• 🐧 A Linux .deb rig can be updated from the phone. The Update button used to refuse on a .deb install and tell you to fetch a package by hand. It now triggers the machine's own signed updater, which verifies the download before installing. A rig installed before this needs its next update run once by hand to pick up the change.
• 🔗 Pearl's in-app wallet link stays on pasiv.network, pointing at its mine guide like every other coin, rather than a bare code-hosting page.
• 📱 The Android companion now comes from Google Play only. The signed APK download is retired now that Play is live worldwide — one distribution path, with Play's own update and integrity checks. Releases up to v0.4.41 keep their APK attached, so existing links still resolve.

• ⛏️ A GPU rig could mine for hours and earn nothing while the app said it was mining. Pearl's August hardfork made the previous miner's every share invalid, and a rig that still had that miner on disk kept submitting shares the pool threw away — on our own test rig, 5.5 hours, 587 shares, none accepted, with the app reporting Mining and an earnings estimate the whole time. The app had trusted a note about what it last installed rather than the miner actually present; Windows Defender's quarantine recovery had put the old one back and left the note untouched. Pasiv now checks the miner itself on every start.
• 🔏 Windows builds are code-signed. Installers and the app are signed with a Certum certificate and timestamped, so Windows can name the publisher instead of warning about an unknown one. Unsigned builds are what got the previous release quarantined by Defender on sight.

• 🔐 The headless installer now always checks its signature. pasivd.sh used to verify the minisign signature only if minisign happened to be installed, and otherwise fell back to a checksum served from the same place as the binary — which proves the download arrived intact, not that we published it. It now installs minisign from your distribution's own repositories when it's missing, and refuses to install rather than fall back to the weaker check.
• 📱 The sideloaded Android APK can be verified. It ships a signature made with the same key the desktop updater trusts, and it shipped alongside a one-line minisign check. Android pins an app's signing certificate only on upgrades, so a first sideload previously had nothing to check against.
• 🔑 The release pipeline no longer exposes its signing key. The key was passed on the command line — readable by anything else on the build machine — and dependency install scripts ran in the same step that held it. Both fixed, and every third-party build action is now pinned to an exact revision.
• ⛓️ A tampered update to the open core can't silently redirect mining. The app already pinned the fee address, the pool and the billable states; it now also pins the miner-control contract itself, so a change there fails the build rather than shipping.
• 🐧 Linux auto-updates work again. The updater's own sandbox made /usr read-only — the very place a package install writes — so every attempt failed quietly and the machine simply stayed on its current version. Machines already on 0.4.38 need one manual sudo /usr/lib/pasiv/pasiv-update.sh, because the fix arrives inside a package the old updater can't install; automatic updates are self-sustaining from then on.

• 🔓 This is the first release built from the open core. The 4% fee engine, the enforcement that stops mining rather than leave you parked on the fee address, the coin and pool roster, every payout validator, the profit ranking, the $/day estimate, and the entire in-process Verus mining engine are now public GPL-3.0 code at github.com/hash-rate/pasiv-core — and this build pins the exact revision it was compiled against. The pasivd binary attached to this release is built from that repository.
• 💵 One formula for $/day, everywhere. The interface used to carry its own copy of the earnings estimate; the desktop app, the headless node, and the open crate now share a single open implementation.
• 🧠 Idle Compute now recommends Qwen — the model that actually earns. The old default was the smallest download, not the best outcome: the provider's own catalogue rates Qwen at roughly eight times the usage of it. The quoted figures moved with the change and are honest about the cost — a 21 GB download and a 32 GB memory floor, stated up front.
• 🍎 Switching to Settings no longer freezes the app on macOS. The tab ran a slow status check on the interface thread; it now runs in the background and the switch is instant.

• 🔓 The code that touches money is now open source. The fee engine (the published fee address, the structural 4% time-slice schedule, the append-only ledger), the coin/pool roster, every payout validator, the mining state machine, the take-home profit-ranking math, and the entire pasivd headless daemon are public at github.com/hash-rate/pasiv-core under GPL-3.0 — readable, buildable, and pinned by tests anyone can run.
• 📜 One canonical never-list. The binding commitments now live versioned in the open repository (docs/FEES.md); the whitepaper mirrors the same eight items.
• 🖥️ pasivd builds from source — and its cloud endpoint and pool are overridable by environment, so an auditor (or a fork) can point it anywhere. The binaries attached to releases are built from this repository at a pinned revision.
• What stays private, said plainly: the desktop GUI, the Pasiv Companion apps, the cloud, and release signing — the product. Open core, not open everything.

• 📱 Pasiv Companion is on Google Play — worldwide. Watch every rig live — per-lane hashrate, state, and estimated $/day — and start, stop, or update any of them from your phone. Headless pasivd nodes are approved from the same screen.
• 🔑 Signs in with your wallet, not a password. The same Sign-In with Ethereum as the desktop, performed in your own wallet app — non-custodial, and Pasiv never sees your keys. No wallet handy? "See a demo" shows the whole product on a sample fleet.
• 🚫 Nothing mines on the phone — ever. It's a remote for machines you already run. Remote control is deliberately limited to start, stop, and update: nothing can change a rig's coin, pool, or payout address from anywhere.
• 🍏 iOS: available today via TestFlight; the App Store release is in review. Android without Play services can still sideload the signed APK.

• 🧠 Idle Compute (beta) — earn from AI inference instead of mining, on Apple Silicon Macs. Serve private AI workloads through a Darkbloom provider you install yourself. It's off unless you turn it on, and it tells you the cost first: about 12 GB downloads before it earns anything, and it needs 20 GB of free memory to serve at all. Mining and inference compete for the same memory, so on most Macs this is a choice between them, not an addition.
• 🧭 Setup walks you through it. Every step that's blocking you is a button — get the provider, link your account (the code appears in the app), choose a model. Each model shows its real download size and memory floor; the smallest is 12.1 GB, and there's no smaller option hiding behind a vague "download".
• 📈 It says why staying online matters. Work goes to providers that stay up: leaving the Mac running and trusted builds its reputation and brings more offers — while being eligible still never guarantees a job.
• 💸 And it says what it can't tell you. Darkbloom counts your earnings in its own console and gives Pasiv no way to read them, so Pasiv shows the work your Mac has done and points you at the right place rather than inventing a figure.

• 🍎 macOS: the app comes back after updating. It used to install the new version and then simply vanish — the update landed, the app never restarted, and your phone showed "Updating…" until you opened it by hand. It was relaunching by re-running its own file, which the update had already replaced. It now restarts in about two seconds.
• 🐧 Linux: a .deb install updates itself. It couldn't before — a .deb is owned by the system, so the app can't replace itself, and rigs sat on old builds until someone ran dpkg by hand. A background timer now does it daily, verified against a published checksum before installing, and it won't move you backwards.
• 🩺 A diagnostic that finished but never exited — pasiv --doctor ran all its checks and then hung, so anything scripting it waited forever. Fixed.

• ⛏️ Ergo (ERG) — a third GPU coin. Autolykos2 on the same engine as Pearl and Ravencoin. ASIC-resistant, with a measured 6 GB memory floor. Guide at pasiv.network/mine/ergo.
• 🎛️ A start control that says what a press will do. Start, Stop and Retry are labelled for the action available right now, and warm-up shows its real phases with an honest expectation instead of a spinner that could mean anything.
• 🛑 Stopping is a real state. Press stop and the app says Stopping, and keeps saying it until the miner has actually exited — no more claiming Idle over a process that's still running.
• 📊 Two miners, two rows. When CPU and GPU are both running you see a rate per lane. They're never added together: the two algorithms differ by eleven orders of magnitude, so a total would be a lie.
• 🚫 A coin your GPU can't run is now listed and disabled, with the reason — "needs 6 GB" — instead of silently vanishing from the picker.

• 🖥️ Headless nodes now show their hashrate and est. $/day in the companion. A pasivd server used to appear on the phone as just "Mining" with no numbers; it now reports its per-lane hashrate and an estimated daily value like every other rig, computed from the same public price and network data the desktop uses.
• 🔧 Fixed a fresh node that mined nothing (0.1.1). The daemon launched its miner in a mode that blocked its own fee-return step, so a safety check stopped mining rather than risk sticking on the fee address. Both fixes are live on the one-line installer — new nodes get them automatically.

The headless node versions independently of the desktop app.

• 🩺 A built-in doctor. Settings → Diagnostics → Run checks answers in one pass what used to need detective work: is the hardware up to it, is every payout address the right shape, can this machine reach each pool, are the price feeds up, and what exactly failed last. The same checks run from a terminal — pasiv --doctor on any machine, pasivd doctor on headless nodes — exiting non-zero on failure so scripts can watch a fleet.
• 🛑 A stop is now proven, never assumed. "Stopping…" holds until the miner process has actually exited; if it won't die, the app force-kills it after a few seconds, and if even that fails you're told the truth instead of shown a fake "Not mining".
• 💡 Every idle state says why — "Stopped" when you stopped it, "Stopped after repeated crashes" when the app gave up — and the idle screen now tells you exactly what Start will do: your coin, how many threads, and where it pays.
• ⛏️ Mining on CPU and GPU at once now shows both lanes, one line each with its coin, state, and speed — and if one lane breaks while the other keeps earning, the status says so plainly.
• 🎛️ Coins your graphics card can't handle say so up front, with the real numbers ("needs about 6 GB of GPU memory; the largest GPU here has 4.0 GB") instead of a start that fails mysteriously. Plus: "Mine anyway" on a battery pause, honest warm-up progress from the mining engine itself, and errors that show the miner's actual words.

• 🐦 Ravencoin — a new coin for graphics cards. Alongside Pearl, you can now mine Ravencoin (KawPow) on the GPU: Settings → "Also mine on the GPU" → Ravencoin. It's an ASIC-resistant coin, so an ordinary graphics card still earns a real share of the network, and the app shows its live estimated $/day like every other coin. Hardware-verified on our own rig before shipping. No Pasiv fee on RVN — the 4% applies to Monero only.
• 🔘 The Start button tells the truth. The pearl is now a clearly labelled control — Start mining when idle, Stop mining while running. Starting shows honest warm-up steps instead of pretending to earn before the first share lands, and if something goes wrong the app says what to do and the pearl becomes a Retry.
• 🌀 Smoother, calmer mining animation that pauses entirely when the window is hidden — a tray-resident miner uses no extra power drawing an animation nobody's watching.

• 🔒 Pasiv no longer sends your payout addresses anywhere. With Pasiv Cloud switched on, earlier versions included your payout addresses in the status each machine reported — even though nothing ever read them. They have been deleted from the server, this version stops sending them, and the server now discards them whatever version sends them. Payout addresses belong on your machine and at your pool, which is what our privacy policy always said.
• 🧾 Headless nodes keep a fee ledger too. A pasivd node now writes every fee slice to fee-ledger.jsonl in the same format the desktop uses, so a rack of screenless machines can be audited exactly like a desktop one. A fee is only auditable if it is auditable everywhere it is charged.

• 🪪 Signing in with MetaMask no longer looks unsafe. The address-normalising fix in 0.4.8 had a side effect we missed: it wrote the wallet address in a form that is not valid under the sign-in standard, so wallets could not read the request as a sign-in at all. Instead of a clear "sign in to Pasiv" card you were shown a raw message and a warning. Fixed properly — the sign-in card is back, and one wallet still means one account. Signing in only ever proves you own the wallet; it cannot move funds.
• 🛡️ GPU mining blocked on Windows is now explained. Smart App Control — on by default on new Windows 11 installs, and separate from antivirus — can block the bundled GPU miner. Pasiv now detects this and says so instead of appearing to do nothing. There is deliberately no button to switch Smart App Control off: it cannot be re-enabled without reinstalling Windows, and that is not a trade worth making for a few cents a day. CPU mining is unaffected.
• 🔐 Security. Closed a hole that let a stranger claim someone else's wallet address and lock the real owner out of signing up; removed a wallet component carrying four high-severity advisories on a path that never worked; tightened what the app may load at runtime; and the headless daemon now verifies the miner it downloads before running it.

• 📦 One-line installs. brew install --cask hash-rate/pasiv/pasiv on macOS, and a single command to turn a Linux server into a mining node. Downloads and updates now come from a project-owned home; existing installs are unaffected.

• 🪪 A second computer no longer vanishes from Pasiv Companion. A capitalisation difference in how wallets report their address could split the same wallet into two accounts, so rigs signed in on one machine never appeared alongside the other. Sign-in now normalises the address, and every machine lands on the same account. If a machine went missing: update, sign out, and sign in again.

• 📱 Your rigs' earnings, on your phone. The desktop now publishes its on-screen earnings estimate (USD/day) to Pasiv Cloud alongside the rig's state, so Pasiv Companion shows — and totals — the same number you see on the desktop. Rides the existing opt-in uplink; nothing new leaves your machine if Pasiv Cloud is off.

• 🔗 "Verify on pool" opens your Monero wallet stats. The link needed MoneroOcean's full wallet route, not just your address — it now lands on your wallet overview.
• 🐧 Linux: a large-pages CPU boost. The same one-time, opt-in RandomX speed-up already on the other platforms. The Linux tray now reflects the whole fleet, and Full power no longer oversubscribes the CPU — it runs the right number of threads and says how many.
• ☁️ Groundwork for Pasiv Companion. An opt-in remote monitor you can turn on in Settings — it publishes your rig's live state to your account and can accept start/stop. It's off by default and changes nothing until the companion app ships, so this is just the foundation for what's next.

• 🐧 Linux tray fixes. The menu-bar icon is white now (it was black on the dark GNOME panel), so the miner's state shows clearly, and the tray menu gained a Hide window item so the window can be tucked back to the tray.

• 🐧 Linux is fully dark now. GNOME drew a light title bar across the top and the language dropdown was light-on-light; Pasiv now runs without the system title bar on Linux (its own dark header is the top, draggable) and native controls are drawn dark to match. macOS and Windows are unchanged.

• ⛏️ It says "Mining" as soon as it's actually mining. After you pressed Start, Pasiv used to sit on "warming up" with a blank hashrate until the pool credited your first share — minutes, at a laptop's hashrate — so a working machine looked stuck. It now switches to "Mining" the moment the miner is producing hashes, showing the live hashrate and earnings right away.

• 🪙 "Need a wallet?" points at the right wallet per coin — each coin links to its own guide, and Pearl links only to the official Pearl Research Labs wallet, with a note to avoid the look-alike "Pearl wallet" sites in search.
• ✅ Clearer payout-address feedback — instead of a blank "invalid", Pasiv tells you what's wrong: an email or exchange entry, a Verus VerusID where the pool needs your R-address, or an integrated Monero address where a standard 4… or subaddress 8… is what pays.

• ⚙️ Change settings while mining — auto-pause (battery / fullscreen) and Auto / Max-Profit now apply live, so toggling them no longer makes you stop mining first.

• 🎮 GPU mining on Windows — Pearl (PRL) mines on an NVIDIA card, set up on demand, with its earnings shown in the Coins tab and on the status screen.
• 🚀 Boost CPU mining — a one-time action in Settings turns on large memory pages for a meaningful RandomX speed-up.
• 🔎 Verify on pool, per coin — every coin in the Coins tab links straight to its own pool dashboard.

• 🪙 A dedicated Coins tab — the main screen is just Start/Stop and what you're earning; coin choice, Auto mode and wallets moved to their own tab, with Auto the default.
• ✨ Onboarding asks for nothing — no forced wallet address, no sign-up; you're dropped straight in on Auto and add a wallet in the Coins tab when you're ready.
• 🔗 Working links — "Verify on pool" and the fee check now open pages that actually show data.

• ⛏️ Mine Monero and Pearl at the same time — your CPU mines RandomX while an eligible NVIDIA GPU mines Pearl, in parallel, neither slowing the other down.

• 💎 Pearl (PRL) GPU mining — a modern NVIDIA card mines Pearl on Windows and Linux via the bundled SRBMiner engine, detected automatically.
• 🐧 A real Linux governor — pause-on-battery and thermal backoff now work on Linux, not just macOS.

• 💰 See what you're earning — the status screen shows what your hashrate is worth per day, from live prices and network difficulty.
• 🪟🐧 Windows and Linux builds — both mine Monero, Zephyr and Salvium on your CPU; Verus stays macOS-only, and each build only offers what it can actually mine.

• ⛏️ Verus (VRSC), native to Apple Silicon — a second algorithm your Mac is genuinely great at. VerusHash is AES-accelerated, so an M-series chip does far more of it per watt than RandomX. Mined in-process, no extra binary.
• ⚡ Auto / Max-Profit mode — opt-in: Pasiv mines whichever supported coin is most profitable for your machine, re-ranking every 15 minutes from live price and difficulty, and shows you what it picked and why.
• 🌍 Now in seven languages — the whole app is localized (English, Español, Português, Deutsch, Français, 日本語, Русский), auto-detected from your system with a picker in Settings.
• 🎛️ Simpler Settings — the old Pro and Settings tabs are one clean, grouped Settings tab; live logs tuck into a Diagnostics section.
• ♿ Accessibility — full keyboard focus states and screen-reader announcements for mining state and errors.
• 💎 Transparent fee — a time-sliced fee that accrues only while you're actively mining, to a published fee address you can check on its pool. Nothing else leaves your machine.

• New tabbed interface: Status / Tokens / Pro.
• Mining toggle in the menu-bar tray.
• Signed auto-update: the app now verifies and installs releases itself.

• First release: one-button RandomX mining on Apple Silicon, signed and notarized.
• Multi-coin roster — Monero (XMR), Zephyr (ZEPH), Salvium (SAL) — with per-coin payout addresses and address validation.
• Direct pool payouts (non-custodial), thermal/battery governor, menu-bar tray, optional wallet sign-in.