What’s new.

Monday, September 21, 2026

1. this ship

   Free signup stays open — isolated from Enlighten’s network

   Anyone can still create a free account at /signup. That seat gets its own empty building. It never sees Enlighten, Cobus, Harborline, operator UniFi lastPull, shop Computers, or shop ARP.

   • ●Signup is not locked, not invites-only, and the Free package stays on.
   • ●Plant, buildings, and UniFi are scoped to the new org. Others / scan agent / Integrations stay off on Free. Floors, Air, Switches, Computers, and Lens stay on the user’s own site.
   • ●free-account-signup and free-launch-lockdown are checked off. Did not restamp UniFi AP 8-port or heatmap. Frozen lockup and rail except hiding leaky Others on Free.
   • packages
   • plant
   • auth

Sunday, September 20, 2026

1. this ship

   Sign up for a free account

   Public /signup creates a real Free package seat: Find, Floors, Air, Switches, Computers, and Lens on one building. Jobs, Billing, Team, SOP, Fluke, and Electric Pro stay paid. Cable Pro remains the shop cash path.

   • ●free-account-signup is checked off. free-residential-tier is Doing at 70% — house breaker map stays Electric Pro.
   • ●Caps: 1 org, 1 location, 1 user, 5 computers, 2 floor plans. Complimentary — no Net 30. /coming-soon waitlist stays.
   • ●Sign up on /login and /signup. Harborline demo passwords stay on the demo card only.
   • packages
   • auth
   • launch

Thursday, September 17, 2026

1. this deploy

   SQL-primary and honest Air/Stats are checked off

   Doing cards durable-client-db, auth-sql-opt-in, and wifi-stats close honestly. Live Sign in already reads Postgres. Air and Stats count walk samples, not Tacoma fiction on a real building. Replica stays unused. First-building still waits on Michael’s street.

   • ●durable-client-db — SQL-primary. JSON backup never deleted. LANTERN_DATABASE_REPLICA_URL parsed and unused.
   • ●auth-sql-opt-in — LANTERN_SQL_READ=1 dual-read is the shipped opt-in. No second auth system.
   • ●wifi-stats — walk-sample quality / band / SSID. Harborline labeled. Controller AP airtime not this phase. Not first-building.
   • store
   • auth
   • air
   • launch

Wednesday, September 16, 2026

1. this deploy

   Sessions, logins, and idle timeout

   Enlighten and company admins can see who is signed in, a login audit, and revoke a seat. Quiet seats time out after 12 hours. Sign in still works. No passwords or hashes in the log.

   • ●Account lists this device and last seen. /admin/sessions is the operator list plus the login audit.
   • ●Idle default is 12 hours (LANTERN_SESSION_IDLE_HOURS). Revoke writes the registry; the next page signs that cookie out.
   • ●SQL-primary store, JSON backup. Did not flip dual-read off. Did not restyle frozen OG, rail, or plant lists.
   • auth
   • sessions

2. this deploy

   Store runs on Postgres — JSON is the backup

   Sign in and getStore read local Postgres after a dual-read proof. mutateStore writes the full store (tickets, plants jsonb, boards) to SQL; lantern.json stays on disk as backup and is never deleted.

   • ●LANTERN_SQL_READ=1 in the systemd drop-in. Password stays in /etc/lantern/database.env (0600, not git).
   • ●Ten seats, operator scrypt hash unchanged. Empty or mismatched SQL falls back to JSON.
   • ●Roll back by running deploy/postgres-sql-read.sh off — JSON remains source of truth.
   • store
   • auth
   • ops

3. this deploy

   Postgres loaded — Sign in still JSON

   Client data is copied into local Postgres. mutateStore dual-writes when LANTERN_DATABASE_URL is set. Live Sign in still reads lantern.json. JSON stays the backup until a dual-read is proven.

   • ●Least-privilege role lantern, database lantern, password in /etc/lantern/database.env (0600, not git).
   • ●Importer copies stored password hashes unchanged. Verify compares user counts and the operator hash without printing hashes.
   • ●LANTERN_SQL_READ is unset. Do not point Sign in at an empty database.
   • store
   • auth
   • ops

4. this release

   Need to do: sessions, logins, timeouts

   Michael asked for a board card to track and manage user sessions. It sits in Need to do after first-building, before chrome / logo / print. Not shipped. Sign in still reads lantern.json.

   • ●auth-sessions — session list, login audit, idle timeout, revoke, no secrets in the log.
   • ●Did not install Postgres. Did not restyle frozen OG, rail, or plant lists.
   • launch
   • auth

5. this deploy

   Store SQL map — still JSON Sign in

   The opt-in Postgres schema now covers users, orgs, and the rest of the shop store (buildings, tickets, jobs, plants as jsonb, collector token hashes). Live Sign in still reads lantern.json. Production stays on JSON until LANTERN_DATABASE_URL is set and a dual-read is proven.

   • ●Importer copies stored password hashes unchanged. Re-import does not overwrite a hash already in SQL.
   • ●Generic DATABASE_URL is ignored so a stray env cannot cut Sign in over.
   • ●Least-privilege grants live in deploy/postgres-grants.sql with no password. Disk is tight — no dumps in the web root, Postgres not installed on the Plesk box this pass.
   • store
   • auth
   • ops

6. this deploy

   Opt-in Postgres schema for auth — Sign in still JSON

   JSON on a root-only VM is not insecure because it is JSON. SQL is better later for concurrent writes and backups. Live Sign in still reads lantern.json. Hashes stay scrypt strings; Postgres does not encrypt them.

   • ●LANTERN_DATABASE_URL unset = no-op. mutateStore still writes /root/Lantern/data/lantern.json.
   • ●Schema covers orgs, users, password resets, and a reserved sessions table (cookies today).
   • ●Importer copies stored password hashes unchanged. Fixture tests, not live hashes in git.
   • ●Turn on later: install Postgres off the login path, apply deploy/postgres-auth.sql, dry-run the importer, then the systemd drop-in. Do not point Sign in at an empty database.
   • store
   • auth
   • ops