Update package icon

Makefile

@@ -33,6 +33,12 @@ ifeq (,$(wildcard node_modules/@start9labs/start-sdk/s9pk.mk))
 $(error node_modules missing — run 'npm ci' first)
 endif
 
+# start-cli 1.1.0 resolves a StartOS host on every command, even local ones
+# like `s9pk pack`, and defaults to a Start9 dev host that does not resolve
+# here. bin/start-cli injects a resolvable one. This must precede the include:
+# s9pk.mk runs `start-cli s9pk list-ingredients` at parse time.
+export PATH := $(CURDIR)/bin:$(PATH)
+
 # overrides to s9pk.mk must precede the include statement
 include node_modules/@start9labs/start-sdk/s9pk.mk
 

instructions.md

@@ -8,6 +8,7 @@ Kamado is a solo Bitcoin mining pool built on a patched fork of CKPool-solo, wit
 - **A real-time dashboard** with live hashrate, per-miner stats, hardware detection, block history, best-share leaderboards, and a transaction accelerator.
 - **Direct LAN stratum access**: StartOS 0.4.0 exposes the stratum TCP port on your network — no router port-forward or proxy needed (this was a 0.3.x limitation).
 - **Stratum TLS on both sides of the network**: a Let's Encrypt certificate issued by StartOS for miners connecting over a clearnet domain, and a persisted self-signed certificate for miners on the LAN — each on its own port, both alongside the plaintext endpoint.
+- **Verifiable proof of work**: the actual block header behind your best share, with a full-screen walkthrough of the SHA-256 that anyone can repeat for themselves.
 
 ## Setup
 
@@ -61,6 +62,16 @@ Two things worth knowing if a certificate never appears:
 - **Issuance validates on port 443 of your domain**, using the TLS-ALPN-01 challenge, regardless of which port the pool itself runs on. If your server isn't reachable on 443 for that name, issuance fails and StartOS falls back to a self-signed certificate that public clients reject.
 - **A hostname that has failed validation repeatedly gets rate-limited** by Let's Encrypt (5 failures per hostname per hour), and StartOS retries roughly every minute — so a name that failed early can stay stuck long after the original cause is fixed. Check `start-cli server logs | grep -i acme`; if you see `ACME order failed` looping, remove the domain to stop the retries, wait for the hour to clear, then re-add it. Using a fresh hostname sidesteps it entirely.
 
+## Proving your best share
+
+Every share that sets a new record is stored with the block header behind it — version, previous block, merkle root, time, bits and nonce — plus the coinbase transaction and merkle branches needed to rebuild that merkle root. The dashboard's **best share** tile opens an analysis page, and **Show PoW** there opens the header itself, drawn as a block with every field in place.
+
+This is worth having because a screenshot of a big difficulty number proves nothing — anyone can edit one, and a picture cannot show whether the work was ever done. The raw 80 bytes on that page are the share hash's exact preimage: anyone can hash them and see for themselves both that the hash is genuine and that finding it took the work claimed. Because the header commits to the previous block, and through the merkle root to the coinbase transaction that pays you, the proof cannot be lifted from another miner's share or replayed from a different block.
+
+Press **Verify** and the page takes over the screen to replay the entire verification in your browser, from the real computation: rebuilding the merkle root fold by fold, padding the header into two 512-bit message blocks, then every SHA-256 compression round with a live view of all 256 bits of the working state, ending on the block hash and its comparison against the share and network targets. A copyable one-line terminal command is on the page too, if you would rather check it outside the browser entirely.
+
+Headers are recorded from version 0.2.3 onward. A best share found before that cannot be reconstructed — CKPool discards job data once work moves on — so until a new record is set, the page shows the best share since the update and says so plainly.
+
 ## Configuration
 
 Everything lives in the **Configure** action: the three stratum ports (plaintext, local-network TLS, public-domain TLS), vardiff (starting/min/max difficulty), idle-client disconnect, the coinbase tag embedded in solved blocks, ZMQ, local-network TLS, log level, and an optional self-hosted mempool explorer URL for dashboard links.
@@ -71,16 +82,20 @@ Changing a port rebinds the interface without restarting the pool, so miners alr
 
 ## Actions
 
-- **Pool Status** — full text snapshot: Bitcoin Core sync, ckpool health, miners, hashrate, found blocks, submit-gap diagnostics.
+- **Pool Status** — full text snapshot: Bitcoin Core sync, ckpool health, miners, hashrate, found blocks, submit-gap and proof-of-work capture diagnostics.
 - **Stratum TLS Certificate** — fingerprint + PEM for miner setup.
 - **Regenerate TLS Certificate** — clears the cert; a fresh one is generated on next start.
 - **Reset Block Latency** — zeroes the block-update latency counters after tuning.
+- **Rebuild Share Statistics** — recounts the all-time difficulty distribution and rejection reasons by rereading CKPool's log, for when those totals look wrong.
 
 ## Troubleshooting
 
 - **No miners appear after connecting**: check the Stratum interface for the right port, and confirm the miner reaches it (`telnet <server> <port>`). Check the Kamado logs.
 - **Bitcoin Core RPC errors**: make sure Bitcoin Core is running and fully synced; Kamado's *Bitcoin Core RPC* health check shows the current state.
 - **Best share resets to 0 after a block is found**: upstream CKPool zeroes the "current round" best diff on solve. Kamado ships a patch that also exposes the all-time best, so the dashboard has both columns.
+- **The proof-of-work page is empty**: headers are only recorded from 0.2.3 onward, and only for shares accepted after the service restarted into that version — nothing earlier can be reconstructed. The next accepted share fills it in. If it stays empty, the **Pool Status** action traces the capture pipeline link by link and names which one is broken.
+- **All-time share statistics look wrong or reset**: run the **Rebuild Share Statistics** action. It recounts them from CKPool's log, and only replaces the stored totals when the log accounts for more shares than they hold — so it can restore history but never erase it.
+- **A burst of rejected shares right after restarting**: fixed in 0.2.3. Earlier versions sent miners work before telling them the difficulty and reset every miner to the pool's starting difficulty, so the first shares after each restart came back rejected. If you still see it, confirm the service is on 0.2.3 or later.
 - **Miner rejects the TLS certificate**: re-check that the PEM was pasted completely (including the BEGIN/END lines), or pin the SHA-256 fingerprint, or disable verification in the miner.
 - **A miner set to system certificates rejects the public-domain endpoint** (`No matching trusted root certificate found`, mbedTLS `-0x2700`/`-0x3000`): StartOS is serving its own self-signed certificate because Let's Encrypt never issued one. Check `start-cli server logs | grep -i acme` for `ACME order failed`, and confirm your server is reachable on **port 443** for that domain — that is where the TLS-ALPN-01 challenge is performed, whatever port the pool runs on. A hostname that failed repeatedly may also be rate-limited; see *Reaching the pool from the internet* above. Verify what is actually served with: