Places & Charities, live CGW access and a stronger GardenApp
CoinGarden now connects real environmental reports, community support and verified completion evidence in Places & Charities. This release also brings the verified CGW mainnet experience into the Token Portal, expands flower community and care tools, and strengthens wallet, AI and Admin reliability.
New
Places & Charities lets people report polluted or endangered locations with photos and map coordinates, follow public progress, support campaigns with CGW, submit before/after proof and see verified outcomes.
Every submitted place receives a fresh AI evidence review. Clear reports can publish directly, while uncertain, duplicate, inconsistent or unsafe reports remain with human moderators; AI never opens funding or moves CGW.
Environmental achievements now reflect reporting, community support, confirmed contributions, verified cleanup and environmental rewards across Profile, Achievements and Admin.
Public flower sharing now includes richer flower cards, owner descriptions, public gardener profiles, follows, featured badges, copy/share controls and continuous discovery scrolling.
Garden Plus checkout, billing management, usage limits and renewal reminders are available through the existing account and payment flows.
The Token Portal now supports Google sign-in, linked wallet profiles, a Ledger ownership-signing option, shared Admin reward drafts, and direct access to verified CGW trading and liquidity destinations.
Improved
The Token Portal and Admin Center read the canonical live Solana mainnet CGW mint, pool, balances, holders, transactions, authorities and market links instead of legacy pre-launch or placeholder state.
GardenApp adds direct watering actions, clearer garden and flower hierarchy, theme-aware subscription benefits, homepage shortcuts, compact mobile cards and more useful Profile activity summaries.
Flower identification and care use an expanded curated plant catalog with reviewed names, care profiles, confidence and provenance while keeping corrections in the gardener's control.
Admin Center adds deeper user/content activity, Places moderation and funding oversight, environmental badge evidence, shared reward workflows, analytics and more resilient translation operations.
All three public sites expose consistent, read-only agent discovery documents and Google Analytics measurement without expanding access to private account data.
Fixed
Restored desktop Ledger transaction signing and corrected verification for wallet-added priority settings while retaining exact challenge, signature and replay checks. Android Mobile Wallet Adapter retains native sign-in and ordinary extension wallets retain message signing.
AI requests use the central provider-configured gateway with corrected timeout and fallback behavior; flower identification never substitutes a fabricated result when providers are unavailable.
Public place photos load for anonymous direct-link visitors, including older cached media URLs; temporary private-photo errors are not cached after approval, and place social previews use the real cover photo.
Places cards now keep large photos, long titles, locations and action controls in separate bounded rows on narrow screens; Profile impact cards link to Places & Charities.
CI, mainnet manifest checks, token data fallbacks, mobile navigation, catalog pagination, translations and public-page reliability were repaired across the September updates.
Security
Wallet authentication verifies the server-issued challenge and selected address cryptographically and consumes each nonce once; native SIWS fields remain exact and Ledger proofs retain strict Memo-only verification. No authentication transaction is broadcast.
CGW contributions remain user-signed and are counted only after on-chain verification; project payouts and environmental rewards remain explicit Squads multisig operations with no application-held signing key.
Public place and flower views expose only allow-listed public fields, sensitive locations stay coarse where required, and stored AI/provider credentials remain non-readable and server-side.
Docs
Product, architecture, AI, database, Places & Charities, token and operational documentation now reflect the verified Solana mainnet deployment and the current shipped application behavior.
Restores the website menu on phones, improves the existing mobile wallet connector and shows wallets already added to the account. Admin catalog pages fit narrow screens and paginate correctly. Current documentation reflects the two-program ceremony; mainnet remains not deployed.
Improved
The token and flower apps use their existing mobile connector. Already linked wallets are shown without asking users to add them again; the extra Phantom browser-handoff buttons were removed.
Closed Admin navigation is excluded from keyboard focus and the menu control identifies its drawer.
Fixed
The public website menu is visible and opens on phones, with larger touch targets and Escape to close.
Android wallet sign-in waits for a prepared challenge before enabling the signing action, and failed attempts prepare a fresh challenge for retry.
Admin plant catalog pages use the console's responsive cards, filters and tables; catalog pagination now follows the requested offset.
Docs
Current guidance reflects the owner's recorded removal of the upgrade timelock: two programs with Squads Vault 0 as upgrade authority. Older release notes remain historical records.
The release plan distinguishes completed application checks from the unresolved ceremony control and execution evidence. No CGW mainnet launch is authorized by this update.
Timelock in the ceremony, three-way reproduced builds, mobile wallet sign-in
cgw-timelock gets a real mainnet identity, an 11-case LiteSVM suite and a place in the genesis sequence; all three program binaries are reproduced byte-for-byte by two verifiers and CI at ceremony commit 9c6e0f8; the Mobile Wallet Adapter links on Android through native Sign-In-With-Solana; the Admin authorities page reads program and metadata authorities live. The ceremony verdict remains NO_GO: legal review is waived by the issuer, operational gates O1/O5/O6/O7 and C3 stay open, and no mainnet-beta write has occurred.
New
cgw-timelock declares the ceremony identity EGu8yPEf…s48qi1M; tests-integration/tests/timelock.rs runs the 11 required cases against the real binary, including a real BPF-loader upgrade executed through the timelock PDA.
The mainnet ceremony tooling deploys three programs: @cgw/chain-config gains timelockProgram/timelockConfig, verify-mainnet-invariants.mjs asserts vesting/rewards upgrade authority == the TimelockConfig PDA (Vault 0 directly is a MISMATCH) and cgw-timelock upgrade authority == Vault 0, and the operator console, launch runbook, ceremony pack and genesis ceremony describe the same sequence.
build-attestation.mjs covers all three programs and rejects partial attestations; Pavel A, Ivan G and CI reproduce cgw_vesting.so 84c85be2…, cgw_rewards.so 10ec7188… and cgw_timelock.so 8de82668… at 9c6e0f8.
Devnet end-to-end team test: team-vesting-check.mjs (read-only; showed the only Team schedule was never claimed because its beneficiary is a disposable key), team-claim-devnet.mjs (devnet-only claim with a test keypair), and URL parameters on team-test-schedule-tool-gr2.html for a team-controlled beneficiary.
Mobile: the Mobile Wallet Adapter registers on Android and links through native solana:signIn — one wallet session that authorizes and signs. apps/api issues an unbound SIWS challenge and verifies the wallet-built signed bytes (domain, address, statement, nonce, request id).
Admin token authorities: program upgrade authorities and the metadata update authority are now read live (ProgramData PDA and Metaplex account) instead of reporting Unknown; the expected authority follows the manifest (timelock config PDA where recorded, else Vault 0).
Fixed
ceremony.mjs repository.anchor asserted the absence of a mainnet program mapping, a pre-T8 invariant; it now asserts the mapping exists, matches every compiled declare_id! and reuses no devnet id.
verify-fresh-program-identity.mjs rejects wallet addresses (signer candidates, deployer, fee payer) proposed as program identities.
cgw-rewards generated constants are load-bearing via const assertions, fixing the rustc 1.98 dead_code failure; LiteSVM error-code constants corrected in both suites; CI caches the Solana/Anchor toolchain.
Security
T8 §2 custody recorded: all three program keypairs on a BitLocker-encrypted external drive with a second encrypted copy; no key material ever transmitted.
Legal gates G2/G3 and the signer-independence gate O3 remain WAIVED_BY_OWNER (2026-08-25) and still block the verdict; the public documents page discloses signer independence as none at present.
Developer
Attestation, invariant, manifest-consistency, controller and HTML-tool guards all run through the new three-program paths and report NOT_DEPLOYED; the operator console was verified live in Chrome from C:\projects at c8af8ca.
Not verified in the authoring sandbox: pnpm typecheck/tests for @cgw/api, @cgw/mobile and @cgw/chain-config, and a device pass of the Android sign-in flow — CI and a phone are the guards.
Mainnet code-completable gap closure (T7-T9, invariant engine, ceremony PREPARE tooling)
Closes every code-completable item from the mainnet-readiness review and replaces the retired third-party-report gate with mandatory internal findings disposition, adversarial testing, two independent build reproductions, simulation and final invariants. The ceremony verdict remains NO_GO.
New
scripts/mainnet/verify-program-authorities.mjs (T7): independently derives each production program's ProgramData PDA and compares its live upgrade authority against an operator-supplied expected value.
scripts/mainnet/verify-fresh-program-identity.mjs + docs/token/CGW_MAINNET_PROGRAM_ID_CEREMONY.md (T8): guards against reusing a devnet/localnet program keypair as a mainnet identity; self-tested.
scripts/mainnet/manifest-transition.mjs + verify-manifest-consistency.mjs (T9): CANDIDATE -> DEPLOYED -> INDEPENDENTLY_VERIFIED -> CANONICAL state machine; the canonical manifest.ts file is never auto-edited at any state.
scripts/mainnet/verify-mainnet-invariants.mjs: single-command final invariant engine covering genesis hash, both programs, Squads, mint, metadata, all six vaults, RewardsConfig/VestingConfig PDAs, and readiness-gate cross-check; JSON out, exit 0/1, no warnings-as-pass.
scripts/mainnet/evidence-record.mjs: standard evidence-record schema and append-only writer for every irreversible ceremony step, with a secret-material field-name guard.
scripts/mainnet/prepare-mint-metadata-mainnet.mjs, prepare-vaults-mainnet.mjs, prepare-squads-mainnet.mjs, prepare-rewards-vesting-mainnet.mjs: PREPARE + SIMULATE + VERIFY only, public-keys-only (no private key ever loaded), modeled directly on the proven devnet Genesis Rehearsal #2 / canonical Squads creation scripts. Deliberately no submission path, per this repository's existing no-one-click-deploy design.
scripts/mainnet/signer-ceremony-state.mjs: IDENTIFIED -> OWNERSHIP_PROVEN -> APPOINTED -> INDEPENDENCE_VERIFIED -> RECOVERY_VERIFIED -> CEREMONY_READY state machine per signer, order-of-operations enforced and self-tested.
scripts/mainnet/authority-transition-matrix.mjs: OBJECT/CURRENT/EXPECTED/STATUS for every governed mainnet authority, CURRENT always read live.
scripts/mainnet/verify-transaction-safety.mjs: static safety audit over every prepare-*-mainnet.mjs script (fresh blockhash, no durable nonce, no broadcast, no private-key loading, simulation-gated, evidence outside repo).
scripts/mainnet/mainnet-readiness-score.mjs: non-gating ENGINEERING/CUSTODY/LEGAL/OPERATIONS readiness summary, explicitly never overriding ceremony.mjs's verdict.
scripts/mainnet/mainnet-rpc-lib.mjs: shared, dependency-free RPC/manifest/base58 primitives reused by every new script above.
scripts/mainnet/package.json: isolates the new PREPARE/VERIFY scripts' @solana/web3.js, @solana/spl-token, @metaplex-foundation/mpl-token-metadata and @sqds/multisig dependencies, mirroring scripts/devnet's own isolation rationale.
docs/token/CGW_DEVNET_MAINNET_GAP_MATRIX.md: the full devnet-to-mainnet operational checklist across all 30 ceremony capabilities.
Security
Removed retired readiness gate G5 and the corresponding private-control approval field. Current mandatory evidence is internal findings disposition, adversarial tests, reproducible SBF/IDL hashes from two independent verifiers, transaction simulation and final on-chain invariants.
Five witnessed Solflare + Ledger Nano S Plus ownership proofs promote O4 to PASS; signer appointment, independence and recovery remain separate gates.
Developer
The Ledger ownership-proof page now mirrors the devnet tools with one Connect and one Sign action. Solflare + Ledger Nano S Plus produced all five exact v0 signatures; a subsequent witnessed pass supplied distinct screen-witness and second-channel confirmation records, and offline verification closed 5/5 hardware-clear-signed key-control proofs while live. Phantom rejected the same payload as transaction-shaped, so the page recommends the proven Solflare path. Appointment, independence, recovery and final custody approval remain separate gates.
Every new script passes node --check; verify-fresh-program-identity.mjs, signer-ceremony-state.mjs and verify-transaction-safety.mjs each carry and pass a real self-test/regression run (not just syntax checks).
verify-manifest-consistency.mjs was actually run against the live repository and correctly reports 11/11 structural checks passing while mainnet-beta remains NOT_DEPLOYED.
mainnet-readiness-score.mjs was actually run and correctly reports 13/26 without altering the hard verdict.
The complete pnpm lint, typecheck, build and package-test suite passed. Cargo and Anchor remain unavailable on this host. The isolated Solana dependencies install from a lockfile, but their inherited advisories still require disposition and the builders require a disposable devnet dry run.
The obsolete third-party engagement package and gate were removed. Legal, tokenomics, signer appointment/recovery, build, network, monitoring and execution-authorization evidence remain open — 13 of 26 readiness gates remain incomplete.
ceremony.mjs's verdict remains NO_GO; nothing in this release can sign or broadcast a mainnet-beta transaction.
Lets the read-only localhost console follow a private controller record by absolute server-side path without exposing it to browser code or enabling transactions.
Improved
The loopback service accepts --control with an existing absolute private control.json path and renders the controller's evidence checks in the ceremony workspace.
Overview reports attachment status and keeps preparation incomplete until the control schema and repository commit binding pass.
Security
The private path and record contents remain server-side; the browser still has no upload, signing, transaction construction, RPC write or broadcast capability.
Adds a sequential five-wallet identification roster and a complete controller-derived ceremony map while every mainnet transaction action remains locked.
Improved
The local mainnet console now retains recognized Ledger candidate addresses across account switches and ceremony-page navigation for the browser session.
Overview now provides a twelve-stage preparation map linking every launch phase to its evidence page and honest controller-derived status.
Security
Session identification remains separate from custody and authorization, and no message signing, transaction construction, RPC write or broadcast capability was added while mainnet is NO_GO.
Records and verifies the distinct Squads fee-payer candidate, bringing current ceremony funding to 7 SOL while mainnet execution remains locked behind the other launch gates.
Improved
The local mainnet console now derives and finalized-reads both ceremony payer candidates alongside the five Ledger signer candidates.
Funding readiness now reports the observed 5 SOL deployer and 2 SOL Squads fee payer separately, with a 7 SOL combined preparation balance.
Security
Generated ceremony packs are bound to both reviewed payer candidates and reject payer substitution, overlap with each other or any signer, and balances below the current funding floors.
Records the operator-designated mainnet deployer candidate, verifies its funding read-only in the local console, and strengthens ceremony checks without enabling any mainnet write.
Improved
Private ceremony packs are now bound to the reviewed deployer candidate and reject a substituted payer, payer-role overlap, or combined funding below the current preparation budget.
The local mainnet operator console now reads the candidate deployer account and balance alongside the five Ledger candidates while keeping every transaction action disabled.
Security
The candidate payer remains separate from canonical deployment addresses, signer custody, the future Squads fee payer and all on-chain authority claims; mainnet remains NOT_DEPLOYED.
Replaces browser evidence uploads with a self-loading, devnet-style mainnet operator console that automatically checks repository, manifest, network and signer state while all writes remain locked.
New
A loopback-only read service verifies mainnet identity and all five candidate accounts while keeping any approved RPC credential outside browser code.
Phantom and Solflare can identify a connected public address against the candidate roster without exposing any signing or transaction method.
Improved
All 13 mainnet pages now open directly into automatic network, manifest, signer, prerequisite, blocker and log views with no browser file uploads or RPC setup form.
The page structure now matches the successful devnet tools: hard-lock notice, signer panel, numbered action step, proposal status and one-click refresh.
Adds a production-safe HTML counterpart for every devnet operator filename, plus mainnet-specific program, mint/vault and vesting evidence pages that remain fail-closed until reviewed ceremony evidence exists.
New
The Solana mainnet folder now includes 13 locally served operator pages covering programs, Squads, mint/metadata/vault genesis, protocol initialization, vesting, lockups and controlled rewards operations.
Each page can review sanitized ceremony control, preflight and candidate-manifest files locally in the browser, with an optional redacted session-only RPC identity check.
Improved
Every devnet HTML filename has an explicit mainnet counterpart; GR2 and disposable-test pages say NOT APPLICABLE instead of inviting devnet code or addresses to be copied.
A regression guard proves the pages contain no devnet address, wallet integration, signing library, transaction construction or broadcast capability, and browser validation covers desktop and phone widths.
Adds an operator-ready private ceremony pack and a machine-checked NO-GO gate that cannot sign or broadcast, so mainnet preparation cannot be mistaken for launch authorization.
New
The Solana workspace now has one ordered mainnet ceremony guide, a private evidence-pack generator, and a controller that checks all 27 readiness gates plus witnessed roles, approvals, signer proofs, audited build hashes, independent RPC views, funding and explicit authorization.
Improved
Ledger ownership challenges must now be written to an absolute private directory outside Git, keeping signer and custody records out of the source tree.
The ceremony controller is structurally read-only: it reports NO-GO while gates are open and contains no wallet, signing, deployment or broadcast code.
Production signer readiness and mainnet launch safeguards
Records the five funded production Ledger candidates without overstating custody, adds the missing signer gate to the public MiCA report, and strengthens the evidence required before any mainnet launch.
Improved
Treasury, Security, Roadmap and MiCA readiness now agree: five funded Ledger addresses are the operator-designated production candidates, while ownership, independence, recovery and formal appointment remain open gates.
The mainnet cutover and ceremony evidence now distinguish signer wallets from the future Squads multisig and Vault 0, and require proof hashes, independence checks, recovery rehearsal and separate deployer funding evidence.
Every public Token route is now browser-tested in CI at production build time, including complete internal-link crawling, responsive overflow, landmarks and runtime console/network failures.
Fixed
The public MiCA readiness table now includes the production-custody workstream referenced by its own launch stop line, and stale claims that no production key had been nominated were removed.
The canonical-address leakage guard now covers future Squads Vault 0, member keys and the metadata PDA in addition to the mint, programs and vaults.
Whitepaper references now resolve to real Token Portal routes, route-specific structured data no longer inherits the homepage identity, and optional Google linking fails safely when production credentials are absent.
The same-origin wallet RPC boundary now applies a privacy-preserving per-visitor hourly limit before consuming dedicated Solana provider capacity.
Fixed CGW Explorer metadata, added a canonical identity module, and linked every Admin token address
Root-caused and fixed Solana Explorer showing the CGW devnet token as 'Unknown' by replacing the mint with one that carries real on-chain metadata from the moment it was created, added one canonical function every app now uses for token identity, and made every wallet/program address on Admin's token pages a working Explorer link.
New
@cgw/chain-config now exports getTokenIdentity(cluster) — one function that composes token name/symbol/network/decimals with each cluster's mint/program/metadata deployment state, so no app has to import both the token specification and the deployment manifest and combine their fields by hand.
Fixed
Solana Explorer no longer shows the CGW devnet token as 'Unknown Token' / 'No symbol' / 'Not verified'. Root cause: the original devnet mint had its mint authority revoked before any on-chain Metaplex metadata account existed for it, which makes attaching metadata permanently impossible — not an indexing delay or a missing registry entry.
Replaced the canonical devnet mint (Genesis Rehearsal #2) with metadata attached in the same transaction as mint creation, before mint authority was ever touched. New mint, six vaults funded to exact token-spec allocations summing to the full 1B supply, mint authority revoked, and metadata update authority transferred to the Squads Vault0 multisig — all independently re-verified against live RPC reads afterward, never trusted from a script's own log.
Every address on every Admin token page (mint, vaults, authorities, Squads multisig/Vault0/members, program ids/upgrade authorities, vesting/rewards config/vault/beneficiary/claimant addresses, holders' token-account/owner addresses — about 20 addresses across 7 pages) is now a real Explorer link instead of plain shortened text.
Developer
New identity.test.ts keeps the token icon URL constant in sync with the token portal's own real metadata JSON file, so the two can never silently drift apart again.
Makes Stripe checkout and webhook recovery idempotent, enforces photo limits, preserves work at plan limits, and shows only paid features that are actually available.
Improved
Plan-limit prompts keep the selected photo or flower form intact and link to Subscription without replacing the draft page.
Per-flower photo limits are enforced atomically, and Garden Plus lists only features with working product behavior.
The Colors sheet now waits for the menu to close fully and supports Escape, contained keyboard focus, and focus restoration.
Fixed
Stripe checkout now reuses one durable purchase intent and existing Stripe customer, preventing concurrent duplicate subscription sessions.
Interrupted and out-of-order Stripe webhooks can recover safely without marking entitlement granted too early.
Checkout return links no longer claim payment success until active Stripe-backed Garden Plus access is confirmed by the server.
Monthly and Annual controls now have a clear selected state, and personalized Discover caches are removed on logout.
Admin payment history, a subscription-card fix, and Stripe webhook hardening
The Admin Subscription card now shows a user's full payment history, a bug that made it always report 'Unavailable' regardless of the real subscription state is fixed, and the Stripe payment webhook is now rate-limited against abuse.
New
Admin Center: a user's Subscription card now shows their full payment history — every order (status, payment method, amount, dates) with its related events, plus subscription-level events like renewals that aren't tied to a single order.
Improved
The Stripe payment webhook endpoint is now rate-limited per connecting address, closing out the security hardening planned for the subscriptions/billing system.
Fixed
Admin Center: a user's Subscription card previously always reported 'Unavailable', regardless of their real plan, status or usage — even though granting and revoking complimentary access worked correctly the whole time. It now shows accurate, live data.
Guest access, garden management, flower photo timeline, and translation reliability
Signed-out visitors can now see the badge catalog and local weather, your profile links straight to your gardens/flowers/badges, gardens can be safely deleted with or without their flowers, flowers now support a full photo timeline with captions, and the Admin Translations page's stuck-at-0% bug is fixed.
New
Signed-out visitors can see the full contribution badge catalog and their coarse local weather, with a themed sign-in prompt instead of a hard wall.
A persistent "Install App" entry in the mobile sidebar, with themed iOS instructions where the platform has no native install prompt.
Garden deletion now offers two explicit, clearly explained options: delete the garden only (flowers kept, reassigned to no garden) or delete the garden and every flower in it, with a stronger second confirmation for the destructive option.
A new "Flowers without a garden" section with real pagination, plus a move-to-garden action.
Flowers now support a full photo timeline: multiple photos per flower, ordered chronologically, each with an optional caption and a settable cover image, and safe per-image deletion.
Improved
The Profile page is reordered so Achievements, Gardens, Flowers and Badges are the first things you see, each a real link to its own page.
The Admin AI review queue's false-positive "page may state a price or a sale" flag was verified and cleared.
The Admin Overview, Token Transactions and Token Holders pages no longer claim "no CGW mint exists" when the real cause is a temporary RPC outage.
Fixed
The Admin Translations page no longer gets languages permanently stuck at 0% coverage. A translation that was mid-flight when its Worker instance recycled is now retried automatically instead of staying stuck forever, and the "Retry failures" button no longer makes a stuck translation worse.
A missing translation API key is now a clear, actionable status instead of a silent, unexplained gap in coverage.
Weather-aware plant care, admin reliability, and Solana RPC hardening
GardenApp now warns when a real forecast puts one of your own flowers at frost or heat risk, weather refreshes hourly through a shared cache instead of every six hours, and several admin/reliability issues were fixed across the platform.
New
A flower's care recommendations now include a live weather-care alert (frost risk, heat stress, or a heavy-rain watering note) grounded in your own current forecast and that flower's own species — advisory only, never a toxicity or medical claim.
Improved
Weather now refreshes every hour instead of every six, sharing one provider call across every user in the same area instead of one call per user.
The weather card's location title no longer repeats the city as its own region ("Plovdiv, Plovdiv") and now always shows the country.
The Admin AI Runs page clearly labels a run that made no model call, and can be filtered by trigger.
The Admin Health page explains a degraded status caused by unreachable Solana RPC instead of showing five green checkmarks with no explanation.
Fixed
The Admin Badges page no longer 404s.
The public Token Portal's rewards and vesting pages now use the same dedicated Solana RPC configuration as the rest of the platform, instead of silently falling back to a different endpoint.
A Places autocomplete outage is now reported as an error instead of looking like "no results found".
Two internal misconfiguration failures (a missing internal API token, a missing native sign-in configuration) are now recorded as exceptions instead of failing silently.
The Token Portal now has an error boundary, so a page crash there is visible to operators instead of showing a bare default error screen.
GardenApp now translates into Bulgarian, Spanish, German and French on demand, lets a garden's owner search for its real location with Google Places, and shows pollen levels for that location.
New
GardenApp interface can be shown in Bulgarian, Spanish, German or French, translated on demand and cached, with an instant English fallback while a translation is in flight.
A garden's location can now be searched and selected via Google Places autocomplete, instead of only hand-typed text.
A garden with a selected place shows nearby pollen levels (grass/tree/weed) on its detail page.
Admin Center: a new Translations page reports per-language cache coverage and lets an operator invalidate a language's cache or retry failed translations.
Improved
Admin Center reports whether each of the three optional Google integrations (Translation, Places, Pollen) is configured, without ever exposing the key.
Local weather preserves the user's coarse area during a forecast outage and can recover through an independent fallback provider.
Improved
Scheduled weather failures now report privacy-safe categories so operators can distinguish timeout, network, provider response and persistence failures without logging user or location data.
Admin now separates the location update time from the last successful forecast refresh time.
Fixed
GardenApp no longer hides an already-saved coarse location when a first forecast refresh fails.
Weather refresh falls back to MET Norway when Open-Meteo is unavailable and gives the mobile proxy enough time to complete both bounded attempts.
Local weather now keeps an otherwise usable forecast when the provider omits an optional metric, and the app captures its privacy-preserving Cloudflare location context earlier in each refresh.
Improved
Weather failures now leave a bounded privacy-safe server diagnostic and a detected/unavailable response signal, without exposing an IP address, coordinates or private location data.
Fixed
GardenApp no longer throws away an entire local forecast because one optional weather metric is null or missing.
Weather refresh captures Cloudflare's coarse request-location context before authentication work, reducing the chance of losing the edge context across an async boundary.
Flower links now open for everyone, with native sharing, copy-link controls, creator profiles, featured badges and community follows. Weather also retries cleanly after a reload.
New
Copy or share a flower's public link with its name from flower profiles and Discover.
Follow community growers and see follower counts plus their featured earned badges.
Fixed
QR codes now open the public community flower instead of an owner-only page.
Unavailable weather is no longer cached across reloads, and each reload rechecks the current coarse IP location.
The reminders shortcut now uses a recognizable bell icon.
Security
Public sharing and follows use public post identifiers; private flower, garden, care, reminder and account identifiers remain outside shared links.
Open CoinGarden browser apps now detect each newly deployed build and move safely onto it automatically, while waiting for active saves and wallet confirmations to finish.
Improved
Open browser tabs automatically refresh onto a stable newly deployed build.
Updates wait for active forms, saves, wallet signatures and claims, with the existing manual update control retained as a fallback.
Fixed
Code deployments are detected by immutable commit identity even when the human-facing version number does not change.
A one-shot per-build guard and service-worker activation prevent repeated reloads or stale PWA shells.
Flower identification never shows a placeholder result again
Flower identification no longer ever falls back to a placeholder result if AI is briefly unavailable. If a real identification can't be produced right now, you'll see a clear "couldn't identify this plant" message with a Try again button instead — never a guessed answer standing in for a real one. This applies on the web app, the mobile app, and the native iOS/Android app, for both signed-in and guest identification.
Improved
Native app: the Identify screen now shows the plant's name, scientific name, confidence, and alternative matches in a readable layout, instead of a raw technical result.
Fixed
Flower identification (signed-in, guest, and native app) no longer ever returns a placeholder result when the AI service is unavailable. It now shows a clear, friendly message and a working Try again button instead.
A guest's daily free identification is no longer spent when identification is unavailable — the attempt is refunded automatically.
Developer
Removed the last production code path that could serve a fabricated identification result; the mock provider used during development now exists only in the test suite.
Added automated tests that scan the mobile and native app source for the old placeholder-result copy, so it can't silently come back.
Rewrote the AI/identification documentation to match this behavior.
Fixed a bug where the Token Portal's Whitepaper page could fail to load with a server error. The page's content is now built directly into the app instead of being fetched from disk when someone visits the page, which is more reliable and loads faster.
Fixed
Token Portal: the Whitepaper page (/whitepaper) no longer intermittently fails to load with a server error. Its content is now compiled into the app at build time instead of being read from a file at request time, which also makes the page load slightly faster.
Fixed: flower identification failing with a connection error
Fixed a bug where identifying a flower could fail with "We couldn't connect to CoinGarden right now," even though the identification itself was actually succeeding — the app was giving up and showing an error before a normal, slightly-slower AI response had a chance to come back.
Fixed
Identifying a flower (both signed-in and guest) no longer fails with a connection error for a normal-speed AI response. The app's own internal request timeout was shorter than the time a real identification can legitimately take, so a genuinely successful result was sometimes thrown away and shown to the user as a failure.
Solana program compile fixes, and a vault-tracking bug fix
Fixed three real compile bugs in the on-chain vesting and rewards programs caused by an untracked dependency version, and fixed a bug that would have let two of CGW's six vaults silently share one tracked address.
Fixed
The on-chain cgw-vesting and cgw-rewards programs failed to compile against the anchor-lang library version that was actually being resolved (1.1.2, not the intended 1.0.2 — no lockfile had ever been committed for this workspace). Fixed the three resulting API breaks and committed a lockfile so this cannot silently happen again.
CGW's deployment tracking previously had only one address slot for two distinct vaults (the Liquidity Vault and the Community Vault, each a separate 5% allocation per the token specification). Each now has its own tracked slot, so a real deployment can never have one vault's balance read as if it were the other's.
Developer
Verified the on-chain programs compile and lint cleanly (cargo check, cargo clippy with warnings-as-errors) in this environment; full on-chain build/deploy remains blocked by this sandbox's available disk space, tracked separately.
Google account linking on the Token Portal, and a wallet connection fix
The Token Portal's profile page can now actually link a Google account to your wallet as an optional backup identity, and a bug that made the wallet-connect flow fail with "No wallet connected." right after a real wallet had connected is fixed.
New
Token Portal: the profile page's Google section now works — sign in with Google, then link it to your wallet profile as an optional backup identity, or unlink it later. Wallet sign-in remains fully independent and never requires Google.
Fixed
Token Portal: connecting a wallet in the "Connect a wallet" modal no longer incorrectly shows "No wallet connected." immediately after the wallet extension has genuinely connected.
Cleaner UI, a smarter AI model picker, and the groundwork for native apps
A round of UI and copy fixes across the Admin Center and Token Portal, a rebuilt mobile About page that actually describes the current app, a searchable model picker for choosing which AI model powers each assistant, and the first working scaffold of native iOS/Android apps — not yet available to install, but the sign-in and core screens now run end to end against CoinGarden's real servers.
New
Admin Center: choosing which AI model powers an assistant is now a searchable list grouped by whether a model is compatible and verified, needs verification, or isn't compatible — instead of one long dropdown with no explanation
Mobile app: the About page was rewritten to describe what the app actually does today (plant care, identification, badges, the Token Portal) instead of outdated feature descriptions
The first working version of CoinGarden's native iOS/Android apps exists as an internal engineering build: sign in with Google, see your gardens and flowers, identify a plant with the camera. It is not yet published to the App Store or Play Store.
Improved
Mobile app: your profile page now shows your real garden, flower, and badge counts instead of a leftover placeholder panel
Admin Center and Token Portal: several layout and copy fixes, including a Token Portal diagram that could overlap on narrower screens
Security
Closed a gap where pinning an AI model to an assistant did not check that the model actually supported what that assistant needs (for example, image understanding for plant identification) the same way the main configuration screen already did
Developer
CoinGarden's servers now support a real, revocable sign-in session for native apps, separate from the website's sign-in system, since a phone app has no server of its own to hold a shared secret the way the website does
The Admin Center's Token pages now read CGW's real status directly from Solana instead of a static placeholder, and refresh themselves automatically while you have them open — showing the truth as it stands today: CGW is approved for implementation but not yet deployed on any cluster.
New
Admin Center Token pages (Overview, Holders, Treasury, Security, Transactions) now read CGW's live deployment state, mint details, supply, vault balances and mint/freeze authorities directly from Solana over a read-only, server-side RPC connection — never from the browser
Every Token page now auto-refreshes while open (5s on token pages, 10-15s on the global shell), pausing while the tab is hidden, catching up immediately on focus, and backing off automatically after repeated failed reads — labelled honestly as polling, never as a live socket connection it isn't
A clear five-state deployment reading (not deployed, configured but unreachable, configured but the account is missing, deployed and healthy, or deployed with a mismatch against the approved specification) replaces the old always-false placeholder
Improved
Holder and transaction figures are now always labelled by what was actually read — "Top token accounts" rather than an implied full holder list, and an honest "unavailable from configured RPC" rather than a fabricated zero — and never guess a value the read-only RPC connection cannot actually confirm
The Token Portal link is now derived from configuration instead of a hardcoded local address
Token Overview language now consistently distinguishes an approved-but-not-yet-built decision from an actually deployed one, replacing several places that still read like an open design proposal
Security
Solana RPC connection details and provider credentials are confirmed, by an automated test, to never appear in the Admin Center's browser bundle, its API responses, or its logs
If plant identification can't reach CoinGarden's servers, you'll now see a plain-language message with a Try again button — never a raw error code — and the app never blocks the photo form while it quietly checks your free daily count in the background.
Improved
A failed connection to CoinGarden's servers is now recorded with a short reference code you can quote to support, and shows up in the operations team's error monitoring — previously it was invisible outside that failure
Fixed
The Identify page could show a raw internal error code ("upstream_unavailable") if a photo identification briefly couldn't reach CoinGarden's servers — replaced with plain-language copy and a Try again button that resubmits the same photo
That background connection is now retried once automatically before giving up, for the read-only checks (like your free daily count) where a retry can't cause any duplicate action
The mobile app's top and bottom navigation now morph as you scroll — a compact floating bar at the top of a page, smoothly widening into a full sticky bar as you read further, and shrinking back the moment you return to the top.
Improved
Mobile app: the top header and bottom navigation now animate between a compact floating card (top of page) and a wide, edge-attached bar (once you've scrolled), instead of staying floating everywhere — matching the app's original navigation feel
The transition only ever triggers on a real, deliberate scroll — a small buffer zone around the switch point stops it flickering between the two states
Every animated element still respects a system-level request for reduced motion, switching states instantly instead of animating
A new Achievements page recognizes real activity — membership milestones, plant contributions, care streaks, identifications, and community participation — with clear progress toward what's next. Feature a few badges on your profile, and see one next to a creator's name on their shared flowers.
New
Achievements page (/badges): every badge you've earned and every badge still open, grouped by Membership, Plant Contributions, Plant Care, Identification, Community and Special, each showing real progress toward the next milestone — never a fabricated percentage
Membership badges award automatically by account age, from joining through six-plus years
Plant Contribution badges award at real save milestones (1 through 2,000 flowers saved), not raw AI identification attempts
Plant Care badges reward logged care events and genuine 30- and 100-day care streaks
Identification badges reward confirmed identifications, not every AI call
Community badges reward your first shared flower and real appreciation received from others
Special badges (System Guardian, Harmony Keeper, Community Beacon, Blossom Benefactor, Rare Plant Curator) are hand-awarded by CoinGarden and can't be earned automatically
A badge detail page explains exactly what's required and how close you are
Feature up to five earned badges on your profile — you choose which ones are visible, and unfeatured badges stay private
A featured badge now appears next to a creator's name on their public flower posts
A polished, reduced-motion-aware “Achievement unlocked” notification appears once per badge, whether you earned it yourself or someone else's like earned it for you
Admin Center gained Ecosystem → Badges: view every badge and how many people hold it, enable or disable a badge, assign or revoke a Special badge with a required reason, and run a one-time reconciliation that awards every existing account every badge it already qualifies for — not just the newest one
Security
Only an administrator can assign or revoke a Special badge, and every assignment, revocation, enable/disable toggle and reconciliation run is written to the audit log with a reason
Automatic badges have no admin override path that bypasses the real evaluation — an administrator can only enable/disable the badge itself, never hand-grant or hand-revoke an automatically-earned one
Developer
Badge catalog is fully data-driven (metric + threshold read from the database), so a new badge never requires a code change
Badge progress is always computed live from the same source tables the rest of the product trusts (flowers, care_events, identifications, flower_posts, flower_post_likes) — no separate progress table to drift out of sync
Unlock notifications are delivered by polling an unseen/acked flag rather than a push channel, so a badge earned by your own action, someone else's action (a like), or an admin reconciliation run all surface the same way
Fixed the mobile app's share preview image being blocked from crawlers
The mobile app's new share preview image (0.7.5) was itself unreachable by Facebook, X and other link-unfurling crawlers — they were redirected to the login page instead of seeing the image, because those crawlers never sign in. Fixed.
Fixed
Mobile app: the opengraph-image and twitter-image routes were not on the public-route allowlist, so the sign-in-required default for personal pages redirected every crawler request to the login page instead of serving the image — confirmed live (HTTP 307) and fixed by adding both routes to the same allowlist that already covers robots.txt and sitemap.xml
Fixed a deployment failure in the 0.7.4 share-image release
The previous release's share-preview images built and worked locally, but failed to deploy on the website, mobile app and token portal because of a Cloudflare-specific incompatibility. Fixed, and the images are now live.
Fixed
The website, mobile app and token portal failed to deploy after 0.7.4 shipped — the preview-image pages declared a runtime setting the Cloudflare build step rejects outright. Removed the setting (each app already runs in that runtime regardless of the declaration), confirmed against the real deployment build rather than only the local one this time
Real share previews for the website, mobile app and token portal
Sharing a CoinGarden link on Facebook, X or anywhere else previously showed no image and a Facebook warning about a missing og:image. Every public app now generates a branded preview image, and the mobile app gained the social title/description it never had.
New
Branded Open Graph and Twitter/X preview images for the marketing site, mobile app and token portal — each in that app's own colors, generated on the fly rather than a static file to keep in sync
Fixed
The mobile app had no social preview metadata at all (no og:title, og:description, or og:image) — a shared Discover or flower-post link showed a bare, generic preview. It now carries the app's name, description and the new preview image
The marketing site's Twitter Card type was set to a small "summary" layout, which doesn't display a large image even when one is provided — corrected to "summary_large_image" now that a real image exists
Signed-in users saw "We couldn't load community flowers" on every visit to Discover — a broken link between the app and the personalized-picks feature, not a real outage. Fixed, so signed-in users now see their picks, or the community's popular flowers if there aren't any yet.
Fixed
Discover feed: signed-in users no longer see a permanent "couldn't load" error — the personalized feed now loads correctly, falling back to the community's popular flowers when there isn't a personalized pick yet
The previous fix for the user-edit page crash didn't work — saving still crashed the page. This one does: the redirect after saving now matches the exact pattern already proven to work everywhere else in the Admin Center.
Fixed
Admin Center: changing a user's role, status, or display name no longer crashes the page after saving — this time confirmed by re-testing the exact failing action live, not just by a clean build
Fixed a crash when saving a user edit in the Admin Center
Saving a role, status, or display name change on a user's account page could crash the page instead of showing the result. The save itself was never the problem — the page just didn't reload correctly afterward. Fixed.
Fixed
Admin Center: changing a user's role, status, or display name no longer crashes the page after saving — the confirmation now shows correctly
Admin user administration, and two real bugs fixed
Administrators can now edit a display name, change a role, and enable or disable an account directly from the Admin Center, with every change written to the audit log. The audit log itself is fixed — it was never actually loading — and the Health page's version-mismatch warning is fixed to stop false-alarming while a deployment is still rolling out.
New
Admin Center: a user's account page now supports editing their public display name, changing their role (User / Moderator / Admin) and enabling or disabling the account — enforced server-side, with the same last-admin protection and self-disable confirmation the product has always had
Health page now shows a Service / Expected version / Deployed version / Commit / Status table, so a genuine deployment gap is visible at a glance instead of buried in a version list
Fixed
The Admin Center's audit log page always failed with “response this console did not recognise” — the API route never actually returned the paginated shape the page required. It now does, and the page loads real entries
The Health page's “version mismatch” warning fired constantly and incorrectly, because the API's own self-check reported a version literal that was never updated as releases shipped. It now reads the same shared version every other check does, and the warning only fires once a mismatch has genuinely outlasted a normal deployment, not while one is still rolling out
A stray, unreachable status endpoint on the API still described the pre-migration blockchain; corrected while in the same file for the version fix
Security
Every user-administration change (display name, role, status) is written to the audit log with an outcome and a correlation id, so it can be traced back to the exact request that made it
Developer
The audit log gained real server-side pagination and outcome tracking (`result`, `correlation_id`) instead of an unbounded, unpaginated list
Health checks now record a build commit when a service's health payload reports one, laying the groundwork for the new version table
The Discover feed now gets a daily AI-curated pick alongside its popular flowers, with a short description on every card. Identifying a plant is clearer end to end, and a handful of small but real bugs — a clipped “Remind me” button, a confusing feed error — are fixed.
New
The Discover feed's homepage gets a daily “Today’s Garden Pick,” curated once a day by CoinGarden AI from the community's popular flowers — with a plain, honest fallback to the popular-flowers order whenever AI curation isn't available
Every shared flower card now shows a short description drawn from the plant catalog
Identifying a plant now offers separate “Take Photo” and “Choose from Gallery” actions instead of one ambiguous button
A plant CoinGarden doesn't recognize yet no longer dead-ends — tapping it now searches the catalog for a match, or opens manual search pre-filled with what was suggested
Improved
Identification results show a clearer selected state — the whole card is tappable, with a check mark
Uploaded photos are now verified as real image files rather than trusted by file extension; an unsupported format like HEIC now says so plainly instead of failing silently
Fixed
The “Remind me” button on a flower's care recommendations no longer gets squeezed into an unreadable sliver on narrow phone screens
The Discover feed no longer shows “couldn’t load” and “nobody has posted yet” at the same time — a failed connection and an empty community are different situations, and the feed now says which one is actually happening, with a working “Try again”
Developer
Search-engine metadata corrected across every CoinGarden application — canonical links, sitemaps and robots.txt now point at the real deployed CoinGarden addresses rather than unrelated domains that happened to already be live
The Admin Center's private pages were confirmed fully excluded from search indexing in production
Searching for a plant by common name now works the way it should — including “rose.” The catalog grew from about twenty houseplants to hundreds of real species, genera and families, with old scientific names and common-name variants all finding the right result.
New
The plant catalog grew from ~20 hand-picked houseplants to a real taxonomy of roughly 440 species, genera and families, covering houseplants, garden flowers, roses, orchids, succulents and cacti, common trees and shrubs, herbs, vegetables and fruit
Searching an old or alternate scientific name now finds the right, currently-accepted species
Searching a genus name (e.g. “Rosa”, “Hibiscus”, “Monstera”) surfaces every species CoinGarden knows in that genus
Typo-tolerant search for common plant names
The Admin Center gained a Plant Catalog page: coverage statistics, where each entry's data came from, and which searches are turning up nothing — so gaps in the catalog are visible instead of silent
Improved
AI plant identification is more honest when it's only confident about the genus, not the exact species — it now says so instead of guessing a specific species
The “Search the plant catalog” screen explains what to type before you start, and suggests trying a broader term instead of just saying nothing matched
Fixed
Searching “Rose” (and many other common names) in the plant catalog no longer returns “No matching species found” — the catalog was missing the data in production, not just missing the search logic
CoinGarden opens up: browse the community's flowers and identify up to five plants a day without an account, share your own flowers when you choose to, and get an AI-personalized discovery feed when signed in.
New
A public Flower Discovery Feed on the Dashboard — the community's most-liked shared flowers, no account needed
Identify up to five plants a day as a guest; your free limit resets automatically every day
Share a flower to the community when you choose to — a clear confirmation shows exactly what becomes public, and you can unpublish at any time
Like flowers you love (sign-in required) and see what the community loves
Signed-in users get a personalized feed with short AI Garden Notes, grounded in the plant catalog
A public display name for sharing — until you pick one you appear as “CoinGardener”, never your Google name or email
My Gardens: your personal plant-care home — flowers, gardens, care due and reminders — moved from the Dashboard with a new summary
Improved
Bottom navigation now adapts to you: Discover, Identify, My Gardens and Profile when signed in; Discover, Identify, Home and Sign in as a guest
The sign-in page explains what an account actually adds — browsing and daily identifications stay free without one
Security
Your private flowers, gardens, notes, care history and reminders never appear publicly — sharing copies only the fields you approve, as a snapshot
The guest identification limit is enforced on the server against an anonymous, hashed visitor id — never an IP address or email
Like counts are computed on the server with a one-like-per-person guarantee in the database itself
All twelve CoinGarden AI agents now have real implementations, choose their own model on cost and capability, and run on a schedule.
New
All twelve AI agents are implemented and running: chat, CGW monitoring, daily system review, mobile insights, security triage, plant data quality, product insights, cost optimisation, release quality and CGW document validation
Agents choose their own model automatically — the cheapest one whose capabilities are verified and which passes that agent's acceptance test
Scheduled agents now actually run, on a fifteen-minute dispatcher with at-most-once delivery
A review queue for results that warrant a person's attention
A daily AI digest on the Admin Center homepage, built from real runs
Run any analytical agent on demand, with its estimated cost shown before you press the button
Improved
Every agent computes its figures in SQL and asks a model only to interpret them, which is both cheaper and harder to get wrong
Reports are scored against the evidence they were given, so a figure the model invented is flagged rather than published
Model capability checks no longer report a text-only model as unable to produce structured output
Model pricing is now known for OpenAI models, so cost comparisons are real rather than blank
Security
The chat assistant can only ever read the data of the person it is talking to, enforced in code rather than by instruction
CGW monitoring is read-only by construction: no signing key exists and no write path is provided