Ariadne 0.1.2: install.ps1 no longer dies on PS 5.1 stderr quirk; layered TLD-source cascade

install.ps1 root-cause fix
- Every `& $node ... 2>&1` had been tripping PS 5.1's "$ErrorActionPreference=Stop +
  native-command stderr = terminating error" quirk. Trap-and-log added in 0.1.1 EXPOSED
  the bug (0.1.0 died at the exact same line -- silently). 0.1.2 routes both node calls
  through a new Invoke-NodeCapture helper that uses Start-Process
  -RedirectStandardOutput/Error to file, so PS 5.1 never touches the streams.

Multi-source TLD cascade with on-disk cache
- -Indexer now accepts a comma-separated list; default "https://navigate.st,https://silentmode.st".
- Cascade (first hit wins): indexer[s] HTTPS  ->  local cache
  (C:\ProgramData\Ariadne\tlds-cache.json)  ->  electrum WSS (fetchTldList / legacy
  fetchBcnrTlds)  ->  bundled ariadne.config.json snapshot  ->  bootstrap [bch].
- Authoritative fetches (indexer or electrum) refresh the cache. Second install on a
  machine that has ever succeeded before is instant + always works offline.
- Per-source deadlines kept tight (5s for indexer HTTPS) so a slow source can't stall
  the install.

Upgrade over live install
- .iss CurStepChanged(ssInstall) stops "BNS Resolver Daemon" + "BNS Sia Bridge" via
  schtasks + 1.5s pause before file replacement. Fixes "DeleteFile failed; code 5.
  Access is denied" on runtime\node.exe when upgrading a machine where the daemon is
  currently running.

CA import
- Switched Import-Certificate -CertStoreLocation Cert:\... to direct X509Store('Root',
  'LocalMachine').Add(). Cert: PSDrive is not always loaded in -NoProfile elevated
  shells, which had broken the standalone unblock scripts.

Verified end-to-end on this box: silent install -> exit 0, clean install.log,
BNS Resolver Daemon running, 127.0.0.1:53 open, 9 NRPT rules (all TLDs including .bch),
coinspectrum.bch resolves system-wide, tlds-cache.json populated.

Deployed
- dl.silentmode.st/AriadneResolver-Setup-0.1.2.exe
- s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.2.exe
- silentmode.st + navigate.st/bns/silentmode.bch manifests advertise 0.1.2
- sha256 5a2c9e4f3c5e1a162008641019f5ffc35968751c0440f94d3c5fe67aafb8cc5e

Local Dev <noreply@localhost>

releases-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "silentmode-releases/2",
-  "updated": "2026-09-09c",
+  "updated": "2026-09-09",
   "mirrors": [
     "https://dl.silentmode.st/"
   ],
@@ -8,14 +8,14 @@
     {
       "id": "ariadne-resolver",
       "product": "Ariadne Resolver (Windows)",
-      "version": "0.1.1",
-      "date": "2026-09-08",
+      "version": "0.1.2",
+      "date": "2026-09-09",
       "platform": "win-x64",
       "signed": false,
       "signingAuthority": null,
-      "changes": "NRPT rules and CA constraints now driven by silentmode.st /api/tlds (HTTPS) with electrum/config fallback -- silent installs no longer break when WSS fails. install.ps1 writes a persistent transcript to C:\\ProgramData\\Ariadne\\install.log and a separate install-error.log on any uncaught exception, so /VERYSILENT failures leave forensics. Inno's own log is copied there too. Fixes the class of bug where the resolver appeared installed but the BNS Resolver Daemon scheduled task was never registered.",
+      "changes": "install.ps1 no longer dies at the CA-rotation probe on PS 5.1 (native subprocess stderr no longer trips $ErrorActionPreference=Stop; node calls go through Invoke-NodeCapture using OS-level stream redirection). Multi-source TLD cascade: comma-separated indexer list (default navigate.st,silentmode.st) then C:\\ProgramData\\Ariadne\\tlds-cache.json then electrum WSS then bundled ariadne.config.json then bootstrap; authoritative fetches refresh the cache automatically. CA import switched to X509Store direct so Cert: PSDrive doesn't have to be loaded. Inno now stops the running daemon before file replacement so upgrades no longer roll back with \"DeleteFile access denied\" on node.exe.",
       "files": {
-        "AriadneResolver-Setup-0.1.1.exe": "be1fa8841919b321841d90f8147abe1b1d7604fe7fff6c2e271dc47c4c24a2b6"
+        "AriadneResolver-Setup-0.1.2.exe": "5a2c9e4f3c5e1a162008641019f5ffc35968751c0440f94d3c5fe67aafb8cc5e"
       }
     },
     {

releases/index.html

@@ -63,12 +63,12 @@
   </div>
 
   <div class="rel">
-    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.1</span></h2>
-    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-08 · <b>NRPT list from the BNS indexer + install-log-on-disk</b> — TLD discovery now hits <code style="display:inline">silentmode.st/api/tlds</code> over HTTPS (electrum/config kept as fallbacks) so silent installs no longer get stuck when WSS is blocked. install.ps1 writes a persistent transcript at <code style="display:inline">C:\ProgramData\Ariadne\install.log</code>, plus a separate <code style="display:inline">install-error.log</code> on any uncaught exception, and Inno's own log is copied there too — so a <code style="display:inline">/VERYSILENT</code> failure always leaves forensics. Fixes the class of bug where the resolver appeared installed but the <code style="display:inline">BNS Resolver Daemon</code> scheduled task was never registered.</div>
+    <h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.2</span></h2>
+    <div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-09 · <b>Actually works this time</b> — 0.1.1's persistent install log caught the bug 0.1.0 had had silently all along: install.ps1 died at the CA-rotation probe because PowerShell 5.1's <code style="display:inline">$ErrorActionPreference=Stop</code> plus a native subprocess writing to stderr = "NativeCommandError", killing the script before it could register the daemon or add the last NRPT rule. 0.1.2 routes every node call through <code style="display:inline">Invoke-NodeCapture</code> (Windows-level stream redirection, PS 5.1 doesn't touch the streams). TLD list now cascades: comma-separated indexer list → local cache → electrum WSS → bundled snapshot → bootstrap, and any authoritative fetch refreshes <code style="display:inline">C:\ProgramData\Ariadne\tlds-cache.json</code>. CA import via .NET X509Store direct (no <code style="display:inline">Cert:</code> PSDrive dependency). Upgrades stop the running daemon before file replacement so <code style="display:inline">node.exe</code> is no longer held open during install.</div>
 
     <div class="file">
-      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.1.exe">AriadneResolver-Setup-0.1.1.exe</a> — ~24 MB</div>
-      <code>be1fa8841919b321841d90f8147abe1b1d7604fe7fff6c2e271dc47c4c24a2b6</code>
+      <div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.2.exe">AriadneResolver-Setup-0.1.2.exe</a> — ~24 MB</div>
+      <code>5a2c9e4f3c5e1a162008641019f5ffc35968751c0440f94d3c5fe67aafb8cc5e</code>
     </div>
   </div>
 

tools/index.html

@@ -234,14 +234,14 @@
          TLDs to the local daemon, imports one root certificate <b>name-constrained</b>
          to those TLDs — the root cannot vouch for <code class="inline">.com</code>.
          Everything reverses with the bundled uninstaller.</p>
-      <div class="meta">Windows 64-bit · v0.1.1 · bundled Node runtime · unsigned build</div>
+      <div class="meta">Windows 64-bit · v0.1.2 · bundled Node runtime · unsigned build</div>
     </div>
     <div class="act">
-      <a class="btn" href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.1.exe">Installer</a>
+      <a class="btn" href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.2.exe">Installer</a>
     </div>
     <div class="hashes">
       <div style="color:var(--mut);font-size:12.5px">SHA-256 — verify before elevating:</div>
-      <div class="h"><b>Installer</b><code>be1fa8841919b321841d90f8147abe1b1d7604fe7fff6c2e271dc47c4c24a2b6</code></div>
+      <div class="h"><b>Installer</b><code>5a2c9e4f3c5e1a162008641019f5ffc35968751c0440f94d3c5fe67aafb8cc5e</code></div>
     </div>
   </div>
 </section>