# Changelog

All notable user-facing changes to ObsidianDragon are documented here. The format loosely
follows [Keep a Changelog](https://keepachangelog.com/); the project uses Conventional Commits.

## [Unreleased]

### ⚠️ Breaking changes

- **Remote RPC over plain HTTP is now refused by default.** If your wallet is configured to
  reach a **remote** `rpchost`/`rpcconnect` **without TLS**, it will no longer connect — it
  previously sent your `rpcuser`/`rpcpassword` in cleartext (capturable by anyone on the
  network path) after only a dismissible warning. To reconnect, either:
  - add **`rpctls=1`** to `DRAGONX.conf` (preferred, if your daemon supports TLS), or
  - add **`rpcallowplaintext=1`** to `DRAGONX.conf` to explicitly accept the plaintext link.

  Local and embedded daemons (`127.0.0.0/8`, `localhost`, `::1`) are unaffected.

### Security

- Refuse remote plaintext RPC credential transmission by default (see Breaking changes above).
- Tightened localhost detection: a hostname that merely *starts* with `127.` (e.g.
  `127.evil.com`) is no longer mistaken for a loopback address, so it can no longer bypass the
  plaintext-RPC protection.
- Sapling parameters are now integrity-checked (SHA-256) against pinned canonical digests
  before use, instead of only checking that the files exist. A truncated or corrupt parameter
  file is caught up front rather than surfacing later as a confusing shielded-operation failure.
  (Cached via a `size:mtime` marker so it doesn't re-hash ~48 MB on every launch.)

### Fixed

- Daemon crashes are no longer occasionally missed: a race between the UI thread and the
  process monitor could consume the daemon's exit status, hiding a crash and defeating the
  automatic-restart cap. The monitor is now the sole reaper.
- A daemon that fails to launch (missing execute permission, wrong architecture, corrupt
  binary) now reports a precise error immediately instead of briefly showing "running" and
  then a generic "exited unexpectedly (exit code 127)".
- A quick stop→start no longer triggers a restart storm: the wallet now waits briefly for a
  previous daemon to release the data-directory lock and shows a clear, non-crash message
  instead of exhausting the crash-restart budget.
- Failures while writing the daemon binaries or Sapling parameters (disk full, permission
  denied) are now surfaced clearly up front instead of failing opaquely when the daemon later
  can't start.
- Directory-creation failures on startup (read-only home, permission denied) now produce a
  clear "Cannot create <dir>" message instead of a confusing downstream "config missing" /
  "binary not found" error (or, in one path, an uncaught exception).

### Added

- A "Taking longer than expected" notice now appears if the daemon is reachable but hasn't
  finished initializing after ~45 s (configurable via `ui.toml`), with guidance to restart the
  daemon or open the Console — instead of an indefinite silent spinner. It clears itself
  automatically once the daemon connects.

---

Engineering detail and the finding-by-finding rationale for this batch live in
`docs/daemon-startup-hardening.md`.