Waukesha, Wisconsin · what’s new
What’s new.
Living log of what shipped. Launch is the deadline and the gates — charge the walk Friday, September 25, 2026. This page is the diary. Harborline is the demo plant, not a customer.
Thursday, September 24, 2026
this ship
Changelog opens by area; the full log stays
The public log and the operator log start as area cards (Floors, Air, Free edition, Plant, Jobs, Electric, Site, Ops). Open a card for every ship in that area, or Full log for the whole diary. Nothing was deleted. Field pages do not load this log.
- ●https://lantern.enlightenstudios.us/changelog — areas first. Full log is the long page.
- ●Search, audience, and tag filters still open the matching notes. Password hashes untouched.
this ship
Signed-in pages load faster; free seats stay a house map
After two days of new features, every signed-in click was re-running launch-board stamps and re-parsing lantern.json. That work now happens once when Node starts. Free testers with leftover shop flags see Ask to upgrade on Jobs/Billing, not a contractor ledger.
- ●Find, Floors, Air, and the rest of the panel skip the stamp list after boot. Public /changelog is still a large page.
- ●Free package caps Jobs, Billing, Docs, Team, Tests, and Electric even if the org row still has those flags. Harborline demo is unchanged. Password hashes untouched.
Tuesday, September 22, 2026
this ship
Make 2D plan finds the stitch script after deploy
An 88 MB Home clip uploaded, then Make 2D plan showed a python path under /root/Lantern.stage-…. That stage tree is deleted after release. The plate script now lives at /root/Lantern/scripts and inside the live run tree. Tap Make 2D plan again — the clip is still stored. No new APK.
- ●Stitch never opens Lantern.stage-* . Deploy copies scripts/floor-video-plate.py into /root/Lantern/scripts and standalone.
- ●Floors shows a short inline error, not python stderr mashed into the film copy. Password hashes untouched.
this ship
88 MB floor clips upload without a hiccup
An 88 MB Home clip from the Android app no longer dies on Fault / The tool hiccuped. Live Next was truncating POST /map at 10 MB (middleware body clone) even though the shop cap is 250 MB and nginx is 260m. Clips now POST to /api/plans/video, store first, then stitch.
- ●proxyClientMaxBodySize and server action limit are 260 MB. Nginx proxy/body timeouts are 15 minutes for the clip route.
- ●Floors stays on screen with an inline error. After a good plate the original clip is still removed. Password hashes untouched.
Monday, September 21, 2026
this ship
Floor clip upload no longer fakes a Harborline crash
A Home / free clip that failed while uploading showed Fault / The tool hiccuped and said the Harborline map was still on the device. That copy was wrong. The clip may not have been stored. Cap is 32 MB. The 2D plate stitches after the upload returns so Floors stays up.
- ●Honest fault: upload failed, timed out, or the file is too big. Try again. Harborline/controller lines stay off a real org.
- ●ffmpeg stitch runs after the response. Make 2D plan still works. Password hashes untouched.
Thursday, September 17, 2026
this deploy
Correction: Mike's todo list was stale
The first mike-todos card and email were stale. Cream City 23G is deleted (~49G free). Phone location dropdown is live. Home tier is not blocked on a paid shop check. LAN scan is a second Windows agent on a house PC.
- ●Cream City 23G dump DELETED. / has ~49G free (31%). Never delete enlightenstudios.us or midwestlvp.com without OK.
- ●Location dropdown on a phone is LIVE. Home tier is not blocked on a paid shop check.
- ●LAN scan = second Windows agent (WiFiman-style) from a house PC. UniFi is official Integration API at the house UniFi controller.
this deploy
Mike's todo is on the launch board
Doing cards now show honest device-path work: typed Cobus plant at ~90, floors still in progress. UniFi is not fake-done. Mike's todo is on the board so he does not scrape chat.
- ●plant-manual-add is Doing ~90 — forms live; Cobus cameras/switches/APs still need typing.
- ●pc-temps and pc-agent-ticket-form stay done on live. Re-download the EXE from Computers.
- ●unifi-controller-pull, PoE, unmanaged scan, other L2, floor video, Home tier, collapse-done stay Need to do.
- ●mike-todos card + email: PC Agent, map Cobus, OK before any enlightenstudios.us or midwestlvp.com delete, Cream City 23G dump, Plesk FTP still on.
this deploy
PC Agent installer runs when PowerShell is Restricted; inventory stays hidden
Garage install failed with “running scripts is disabled on this system,” and the first EXE popped a PowerShell window on every 15-minute check-in. Re-download lantern-pc-agent-*.exe. Install is one visible console. After that, inventory and auto-update run hidden.
- ●Installer stub: powershell.exe -NoProfile -Sta -ExecutionPolicy Bypass -File Install-LanternPcAgent.ps1
- ●LanternPcAgentInventory (15 min) and LanternPcAgentUpdate (6h) use -WindowStyle Hidden.
- ●No encoded command. Password hashes untouched.
this deploy
PC Agent install OK dialog is the install, not Harborline
After Yes on UAC, the OK box says the agent is installed, writes ProgramData, a tray icon, and a 15-minute scheduled task, then refresh Locations → Computers. Harborline and the shop-token lecture are gone from that box.
- ●Same MessageBox for every EXE. Installed. %ProgramData%\Lantern\pc-agent. Tray. Scheduled task. Refresh Computers.
- ●Re-download after this deploy. The old stub still named Harborline demo has no token.
- ●Did not restyle the rail, OG cards, or frozen plant lists. Password hashes untouched.
this deploy
mike@ Download agent bakes the Enlighten token
Sign in as mike@enlightenstudios.us after Cobus Household is on the operator login. Download agent writes lantern-pc-agent-*.exe with the Enlighten/Cobus shop token. The success dialog never mentions Harborline on that install. Refresh Locations → Computers — this PC should show hostname / last seen.
- ●GET /api/computers/agent as Enlighten admin always uses org-enlighten and bakes lnrpc_. Harborline demo still has no token.
- ●OK dialog is installed, ProgramData, tray, scheduled task, refresh Computers — not Harborline, not a token lecture.
- ●Re-download after this deploy. The EXE that said Harborline demo has no token was the old stub dialog, not proof he was on Harborline.
this deploy
PC Agent installer no longer looks like a dropper
Windows Defender on the garage PC quarantined the unsigned EXE as Trojan:Win32/Sabsik.EN.D!ml (ML heuristic). That was a false positive on the old packed stub. Re-download lantern-pc-agent-*.exe from lantern.enlightenstudios.us. If the old file is still quarantined, Allow on device — do not turn Defender off.
- ●Setup is a visible console installer. It writes Install-LanternPcAgent.ps1 and lantern-icon.ico into %ProgramData%\Lantern\pc-agent, then runs that script in a visible PowerShell window.
- ●No ZIP self-extractor overlay, no EncodedCommand, no hidden powershell, no ShellExecute runas. UAC is requireAdministrator in the manifest. VERSIONINFO says Enlighten Studios / Lantern PC Agent Setup. No fake Authenticode.
- ●HTTPS-out check-in unchanged. Did not replace lantern-icon.png, OG, or the rail. Password hashes untouched.
this deploy
PC Agent EXE asks Windows for administrator
After SmartScreen Run anyway, double-clicking lantern-pc-agent-*.exe opens the UAC prompt instead of failing with “Run the .exe as Administrator.” Being the Windows Administrator is enough — re-download the EXE; the old file still has the bug.
- ●Stub manifest stays requireAdministrator. If SmartScreen starts the process unelevated, the EXE relaunches itself with runas.
- ●Install-LanternPcAgent.ps1 does the same Verb RunAs check before writing ProgramData. It does not fail only because the first process was not elevated yet.
- ●Did not replace lantern-icon.png, OG, or the rail. Password hashes untouched.
this deploy
PC Agent double-click install as Administrator
Download agent EXE unpacks, writes ProgramData, a scheduled task, and the Lantern tray even if the first HTTPS push fails. SmartScreen: More info → Run anyway. Then Yes on UAC. No paid code-sign cert.
- ●Hidden PowerShell is STA. Shortcuts, task, and first push cannot abort the install after files copy.
- ●requireAdministrator manifest + Win10/11 compatibility. Unsigned PE is still a real GUI EXE.
- ●Enlighten admin still has no Locations dropdown — names on /admin/locations. Company org_admin keeps the header switcher.
this deploy
Download agent 500 is fixed
GET /api/computers/agent no longer throws on the live standalone server. Michael can click Download agent and get lantern-pc-agent-*.exe. Harborline still has no token.
- ●Root cause: webpack standalone has no import.meta.dirname; path.join(undefined) 500ed after sign-in.
- ●Stub EXE and lantern-icon.png resolve from process.cwd() first. Unsigned GET stays 401.
- ●Did not replace lantern-icon.png, OG, or the rail. Password hashes untouched.
Wednesday, September 16, 2026
this deploy
Need to do: Ops forms fit a phone
Mike caught Jobs, Billing, Tickets, Account, Team, and admin ops fields running past the screen on a phone. Card is on the board. Same wrap idea as Phone/Camera chassis. Not L3.
- ●ops-mobile-fields — Ops forms must stay inside 320 / 375 / 390 / 430.
- ●Keep Phone/Camera six-port wrap. Buttons stay 10px corners, orange gradient.
this deploy
Launch board cards back, buttons 10px again
Concurrent deploys had wiped Need-to-do cards and turned orange buttons back into pills. Catalog is whole again. Buttons match the 10px fields. Computers lists, collector, and six-port chassis stay.
- ●Need-to-do restored: L3 / plant-data-source, phone RSSI, RMM CSV then shop APIs, SMART / tray tickets / RDP-after-launch, first building, ops Guide, org plant, heatmap, price book polish.
- ●.btn-lantern is 10px square-round with the orange gradient — not a pill. Phone/Camera chassis still wrap six wide.
- ●Did not mark plant-data-source done. Did not invent a first-building address. Did not live-bind LDAP. Password hashes untouched.
this deploy
Store runs on Postgres — JSON is the backup
Sign in and getStore read local Postgres after a dual-read proof. mutateStore writes the full store (tickets, plants jsonb, boards) to SQL; lantern.json stays on disk as backup and is never deleted.
- ●LANTERN_SQL_READ=1 in the systemd drop-in. Password stays in /etc/lantern/database.env (0600, not git).
- ●Ten seats, operator scrypt hash unchanged. Empty or mismatched SQL falls back to JSON.
- ●Roll back by running deploy/postgres-sql-read.sh off — JSON remains source of truth.
this deploy
Postgres loaded — Sign in still JSON
Client data is copied into local Postgres. mutateStore dual-writes when LANTERN_DATABASE_URL is set. Live Sign in still reads lantern.json. JSON stays the backup until a dual-read is proven.
- ●Least-privilege role lantern, database lantern, password in /etc/lantern/database.env (0600, not git).
- ●Importer copies stored password hashes unchanged. Verify compares user counts and the operator hash without printing hashes.
- ●LANTERN_SQL_READ is unset. Do not point Sign in at an empty database.
this deploy
Store SQL map — still JSON Sign in
The opt-in Postgres schema now covers users, orgs, and the rest of the shop store (buildings, tickets, jobs, plants as jsonb, collector token hashes). Live Sign in still reads lantern.json. Production stays on JSON until LANTERN_DATABASE_URL is set and a dual-read is proven.
- ●Importer copies stored password hashes unchanged. Re-import does not overwrite a hash already in SQL.
- ●Generic DATABASE_URL is ignored so a stray env cannot cut Sign in over.
- ●Least-privilege grants live in deploy/postgres-grants.sql with no password. Disk is tight — no dumps in the web root, Postgres not installed on the Plesk box this pass.
this deploy
Launch board: durable store on top; JSON still live
Doing and Need to do now sort most important first. P1 is a durable client database (JSON→Postgres path already in the tree). Live Sign in still reads lantern.json. No production cutover. Frozen lists, rail, and OG are not workstreams.
- ●Doing: durable-client-db → auth-sql-opt-in → collector / plant-data-source → floors imported plant (function) → ten-day-beta. Samples and chrome sit below.
- ●Need to do: first-building first, then function work. Logo pick, print leave-behind, residential floors, samples, and styling sit lower. Hold chrome at the bottom.
- ●Remote replica is a later step on durable-client-db after dual-read is proven. Password hashes untouched. rsync still excludes data/.
this deploy
Launch board timer ticks every 10 minutes
systemd lantern-launch-tick.timer on the Plesk VM curls loopback /api/internal/launch-tick every 10 minutes so launchBoard.tickedAt stays current. Not a job-queue product. Password hashes untouched.
- ●OnUnitActiveSec=10min. Deploy copies the unit, daemon-reloads, and enable --now.
- ●Loopback or X-Lantern-Tick secret. Remaining still computes from clock + deadline if the timer is down.
this deploy
Opt-in Postgres schema for auth — Sign in still JSON
JSON on a root-only VM is not insecure because it is JSON. SQL is better later for concurrent writes and backups. Live Sign in still reads lantern.json. Hashes stay scrypt strings; Postgres does not encrypt them.
- ●LANTERN_DATABASE_URL unset = no-op. mutateStore still writes /root/Lantern/data/lantern.json.
- ●Schema covers orgs, users, password resets, and a reserved sessions table (cookies today).
- ●Importer copies stored password hashes unchanged. Fixture tests, not live hashes in git.
- ●Turn on later: install Postgres off the login path, apply deploy/postgres-auth.sql, dry-run the importer, then the systemd drop-in. Do not point Sign in at an empty database.
this deploy
Launch board shows honest percent and time left
Cards, phases, and the whole board average stored progress (0–100) instead of only 0 / 50 / 100. The board shows days left to charge day, and an hourly timer on the server keeps the stamp current.
- ●In-progress cards can set 1–99%. Done is 100. Not done is 0.
- ●Time remaining is live from the published deadline. Overdue is labeled overdue.
- ●systemd lantern-launch-tick.timer curls loopback /api/internal/launch-tick each hour. No job-queue product. Password hashes untouched.
this deploy
Computers, Phones, and Cameras lists are frozen
Michael confirmed the inventory lists are correct. Deploy refuses a SUPERSET from a behind branch that would drop Plant → Computers / Phones / Cameras or revert DeviceInventory to cards. Operator → Note stays with the same restore set.
- ●Checksums in deploy/frozen-files.sha256. scripts/check-frozen-files.sh plus deploy-production.sh abort on mismatch or a non-SUPERSET of live .deploy-sha.
- ●Rule .cursor/rules/lantern-plant-lists-freeze.mdc. Enlighten rail lockup left to the rail agent — not frozen here.
this deploy
Restored Computers, cameras/phones lists, and the family note
Michael was not crazy. Concurrent SUPERSET thrash wiped Plant → Computers, the DeviceInventory Phones/Cameras/Air lists, and Operator → Note from product source while another build was still live. Restored from the known-good tip. OG card freeze untouched.
- ●Plant → Computers is back on the IT rail (MSP / Advanced). Harborline demo rows stay.
- ●Phones, Cameras, and Air use the same list chrome again — floor, up/down, VLAN, search.
- ●Operator → Note (/admin/projections) is back for the family projections sheet.
this deploy
SMS card cache-bust for capital-P Professionals
og:image now points at /lantern-og-v2.png?v=professionals-cap-p (same frozen capital-P PNG). SMS/iMessage were still showing lowercase p from the old /lantern-og.png URL.
- ●Live PNG was already capital P; SMS clients cache the bare image URL aggressively.
- ●Meta + twitter image use the v2 twin. nginx httpdocs serves both lantern-og.png and lantern-og-v2.png under the freeze guard.
this deploy
SMS / OG card frozen so SUPERSET cannot overwrite it
public/lantern-og.png is frozen at sha256 8a14e0a0… (lockup + MSP / IT / Cabling / Electrician Professionals). Deploy and remote-release refuse a different file unless Michael unfreezes.
- ●deploy/lantern-og.sha256 + scripts/deploy-production.sh + deploy/remote-release.sh assert_og_freeze.
- ●Rule .cursor/rules/lantern-og-freeze.mdc. Launch board sms-og-card done. Generator refuses regenerate without LANTERN_OG_UNFREEZE=1.
this deploy
SMS / OG card restored after rail SUPERSET overwrite
Rail lockup deploy 54e13fc re-shipped the older lowercase professionals PNG over the capital-P card from d819f63. Restored current Lantern lockup + Professionals.
- ●public/lantern-og.png matches the capital-P Professionals card again (a0340ddc).
- ●Generator, OG_IMAGE_ALT, description, and tests lock Professionals so a later SUPERSET cannot quietly restore lowercase.
this deploy
Ops forms wrap on a phone
Jobs, Billing, Tickets, Account, Team, and the Enlighten admin tools no longer shove input rows past the screen. Fields shrink and stack. Phone and Camera switch grids stay six ports wide.
- ●Native selects and inputs are min-w-0 max-w-full. Ticket kind/severity/building stack. Launch deadline dropped the 12rem min-width.
- ●PageFrame keeps overflow-x-hidden and safe-area padding. Buttons stay 10px, not pills. Orange gradient unchanged.
- ●ops-mobile-fields is live on lantern.enlightenstudios.us. Did not bump L3 or plant-data-source.
this deploy
Mike’s Merge click did not break the live site
Merging a Cloud Agent draft on Origin does not rsync the Plesk VM. Publish deadline is 10px again after a later remainder rsync had put the pill back. Computers, six-port chassis, and Need-to-do cards stay. plant-data-source stays Doing.
- ●Only #39 (Computers/MSP cards) and #30 (plant CSV export) actually landed on origin/main. The heat tree with conflict markers was never deployed.
- ●btn-square-radius — .btn-lantern uses --radius-control (10px), not a 999px pill. Chrome test refuses the pill.
- ●Need-to-do catalog restored (shop tickets, collector/L3, invoice email, RMM switch-in, Computers). plant-data-source stays in progress — not done.
Tuesday, September 15, 2026
this deploy
Launch, Changelog, plan, and health skip Sign in
Shop pages stay public: /launch, /changelog, /plan (business plan), and GET /api/health. Enlighten /admin/health and /admin/errors stay behind the operator seat. Live hashes stay put.
- ●Middleware lets /launch, /changelog, /plan, /api/health, and /api/ops/report through without a session.
- ●/plan redirects to /for-contractors/plan so the business plan is one short URL.
- ●/admin/health and /admin/errors stay Enlighten-only. Did not rewrite password hashes.
this deploy
Launch, Changelog, and health are public
What's new is a public living log. Launch shows finish-speed dates. Enlighten health watches the public pages so a 5xx or unstyled shop page is a report, not a screenshot.
- ●Public /changelog and footer What's new. Audience admin rows stay on the Enlighten board only.
- ●Public /launch plus Enlighten /admin/launch. Finish-speed: chrome Tuesday 15 Sep 2026, then plant CSV → price book → invoice PDF → first building before charge Friday 30 Oct 2026. No fake weekly calendar. No Stripe.
- ●GET /api/health is public JSON. POST /api/ops/report is public. /admin/health is the same board as /admin/errors. Nav badge is open reports.
Waukesha
The log stays current. The deadline stays on Launch.
Mike Cobus · Enlighten Studios. First day in this book is Tuesday, September 15, 2026. Every later ship adds a row here in the same commit.