Skip to content
hello@sentinelapp.solar
Sign in Apply for access
Changelog

Changelog

Every meaningful change to Sentinel — new capabilities, fixes, and anything that touches the read-only/consent safety model — recorded in the open. We build against real installs, so this is the honest running record. Dates are month-level; the desktop apps are in beta, the iOS app is live on the App Store and Android is coming.

2026-10-18 The charge and discharge schedule no longer shows a battery limit your inverter does not have, and each time slot can be read on its own; the battery card uses its chart’s colours for a battery’s cells, and is clearer on a battery that has charged to the top

  • These changes are to the engineer dashboard only. Nothing needs updating on your device.
  • On the engineer’s charge and discharge schedule, each time slot showed a battery limit of its own: how full a charge slot fills the battery, or how low a discharge slot lets it go. Only some GivEnergy inverters have a separate limit for each slot. On the others, including AC-coupled systems and older hybrid inverters, the slot often showed 0%, which is not a setting there at all, and made a charge slot look as though it would not charge the battery.
  • Each slot now shows its own limit only on inverters that have one. Where a slot’s own limit reads 0, the page shows 0% and says that we have not yet confirmed what 0 does there; on a charge slot it may stop that slot charging. On inverters without a limit for each slot, the page says that the overall charge and discharge limits apply. Where we cannot yet tell which kind an inverter is, the page says that too, rather than guessing.
  • Every time slot now has its own Read button, like every other setting on that page, and is laid out the same way, with a line showing what your inverter holds now. That includes the slots the engineer cannot change from here. Read asks your inverter again for that slot’s start and end times, its own limit where it has one, and for a charge slot whether charging from the grid is switched on. It updates those wherever they appear on the page, and nothing else.
  • When the engineer changes a slot, or switches charging from the grid on or off, the schedule now shows the new setting as soon as your inverter confirms it, and again after the check made about half a minute later. Before, a charge slot could still say that grid charging was off after it had been switched on, until the page read it again.
  • Reading a setting no longer clears a time or a choice the engineer has entered on another one but not yet sent, or the result of a change shown under it.
  • On the schedule page, the Read button on each of the other settings now asks your inverter for that one setting, as it already did on the settings page, instead of reading every setting again and redrawing the whole page.
  • If your inverter answers a read of one setting with an error, which is what happens when it does not have that setting, the page now says so on that setting straight away, rather than reporting a problem with the connection to your inverter.
  • Settings that can only be on or off now show On or Off beside their value, as their switch does.
  • A charge slot with its times set was marked as scheduled even when charging from the grid was switched off on the inverter, and a slot does not run while it is off. The slot now says that its times are set and that grid charging is off. If the page has not read that switch, it does not say either way.
  • When the engineer switched between inverters on the same site, the schedule could go on showing the previous inverter’s times until it was read again. It is now cleared when they switch.
  • Each battery’s grid of cell voltages now uses the colours of the cell voltage chart under it: the highest cell is blue and the lowest is red. Before, the grid showed both in amber while the chart showed them in blue and red. They are coloured when the cells are more than 50 mV (0.05 V) apart, and each is labelled “highest” or “lowest” either way, so the colour is never the only sign.
  • A cell above 3.6 V or below 2.4 V now shows its voltage in orange, with a small arrow, as a sign it is worth a closer look. These are levels we chose for the screen, not ones taken from the battery: a cell can pass them without anything being wrong, and cells above 3.6 V are usual at the very end of a full charge.
  • When one of the battery’s charge or discharge switches was open and the battery had not recorded an instruction to open it, the card said the battery had been told to close it. That was wrong: the battery has no reading that we know of that says “close”. The card now says which of the three things we have seen alongside it is there: a protection warning from the battery, the battery being full, or nothing at all.
  • The card compares the voltage on the inverter side of the battery’s switches with the battery’s own total. A difference of a volt or more with nothing flowing means the battery is cut off from the inverter on one side or both, so the inverter-side figure is not the battery’s own voltage. The card only recognised this when the inverter side read lower than the battery. It now recognises it either way round, and says which side is cut off when the battery reports it.
  • When a battery had cut off its discharge but not its charge, and nothing was flowing, the engineer’s low-battery warning said the battery’s switch readings did not fit what it was doing. We read this as what such a battery looks like while nothing is charging it, so the warning now says that it can still take charge, which is how it recovers.
  • When the inverter side of a battery’s switches read a volt or more above the battery’s own voltage and nothing was flowing in, although the battery reported its charge switch closed, the engineer’s low-battery warning took that reading at its word. Those readings do not fit together, as the card’s figure for the battery’s own voltage already said, so the warning now says that they do not fit.
  • If you have given 48-hour access from an older version of the Sentinel app, one that cannot make some changes that way, the engineer’s dashboard now says which ones before your engineer tries, and how to get the current app. Before, your engineer found out only when your app turned the change down.
  • On the engineer’s settings page, slot 1’s own charge limit could be changed on every inverter, including those that do not have one. It can now be changed only on inverters that have a limit for each time slot. On single-phase AC-coupled and older hybrid inverters, and on other models where we have not confirmed that they have one, the page shows the setting without a way to change it, and says why. Where it can be changed, the page takes 0% to 100%, GivEnergy’s own range for it, although we have not confirmed what 0% does on a slot that is in use.
  • A battery setting the engineer’s settings page called “Battery cable impedance alarm” is now called “Enable Impedance Alarm”, the name GivEnergy’s own app gives it. Its note now says what it checks on a low-voltage battery: the voltage at the inverter’s battery terminals against the battery’s own; a difference implies high resistance in the connection between them (the DC MCB), which can damage the inverter.
  • On a GivEnergy Gen 3 hybrid inverter, the engineer’s charge and discharge schedule showed one charge slot and two discharge slots, and said that this is all GivEnergy offers on that generation. A Gen 3 on firmware with GivEnergy’s 10-slot schedule has ten of each, so the page now shows all ten; the extra slots are shown for reading only. Where we cannot tell from the inverter’s firmware which schedule it has, the page shows all ten slots and does not say how many GivEnergy offers.

2026-10-16 What the 1.2.0 app update brings, All-in-One and Gateway systems read more truthfully, gaps shown as gaps on the 48-hour graph, and the App Store link

  • These first changes are to the engineer dashboard, our relay server and this website. Nothing needs updating on your device for them.
  • The engineer’s 48-hour graph of your inverter drew a straight line across any stretch of time Sentinel has no readings for, such as a night your app was closed, as though there were readings there. It now leaves a gap, as the graph of an energy management unit already does.
  • An All in One 2 was shown on the engineer’s dashboard as an unrecognised inverter until its model had been read. It is now named as a GivEnergy All-in-One straight away.
  • This site now links to Sentinel Quick on the App Store, and the page for customers says it can show your installer the code on an iPhone, iPad or Mac.
  • This site’s pages for customers and engineers now describe the two ways you can let an engineer change settings: a change window you open during a call, and 48-hour access. They also say what your engineer can see as soon as they connect, before you let them look at your readings: which inverter it is and any fault alert it raises. Our terms of service and privacy policy are not changed by this, and each shows the date it was last changed.
  • When an inverter reports its battery moving power but measures no battery current, and no battery reports a current that agrees, the dashboard now shows that power figure as unconfirmed. It keeps the number, but shows no charging or discharging direction, draws no arrow and works out no current from it. Before, it was shown as the battery charging or discharging.
  • On a system whose solar panels feed a separate solar inverter, such as an All-in-One, the power-flow arrow from the inverter to the home no longer counts that solar as the inverter’s own.
  • On an All-in-One, the battery module cards no longer show a cycle count of 0, and the power-flow strip no longer shows 0 %, 0.00 V and 0.0 °C for each module. A module does not report these figures, and the dashboard now says so instead.
  • With a GivEnergy Gateway, the dashboard no longer shows the figures a Gateway does not measure as 0 W of solar, grid and home use. It lists the Gateway as a Gateway rather than as an inverter, and opens on the inverter rather than the Gateway. A register download from a Gateway now includes the Gateway’s own figures, and says that the battery modules it finds belong to the All-in-One behind it.
  • The 48-hour history now also records, each minute, the battery current the inverter measures and whether the inverter is running, so a stored battery figure can be checked in the same way as a live one.
  • The changes from here on need the next update of the app on your device: Sentinel Quick 1.2.0 on iPhone, iPad and Mac, and the Mac and Windows downloads that come with it. Until you have it, your app works as before.
  • The app now remembers which battery packs each inverter has between runs, and asks for those first when it starts, so their cards come back sooner. It still looks for every pack, in case the batteries have been changed.
  • A battery pack that missed the app’s first look, while the pack beside it answered, could stay missing for 10 minutes after the app started or reconnected, which looked like a battery fault. It is now looked for again within the first minute, and the packs already found are kept when the app reconnects to our relay.
  • A battery pack that stops answering is now asked less often, at most every 40 seconds, so it does not hold up the readings from the rest of your system. It is asked again at once when the battery shows signs of coming back.
  • On systems with several battery packs, or an All-in-One, the battery history on the engineer’s screen could fail to arrive, because the app sent it in pieces too big for our relay to pass on. It now sends it in smaller pieces.
  • When the app loses its connection to our relay, it no longer shows a code that would not work. It says your code will show again when the connection is back.
  • If our relay keeps turning your code away, the app now stops trying it at the usual pace after a few refusals and says so. It tries that code again every 15 minutes, and Try again starts again with a new code.
  • In Sentinel Quick on a Mac, the status dot is now amber while the app is reconnecting to our relay, as it already is in the Mac and Windows downloads.
  • The app now recognises more GivEnergy units by their serial numbers, including the All in One 2 and some All-in-One, hybrid and high-voltage hybrid units. On those it no longer says the serial is “not in GivEnergy’s expected format”, and on a site with an energy management unit, the ones the unit lists are now counted among its inverters.
  • The engineer’s alert that your export limit may be holding back your solar was raised at a fixed 3500 W, whatever your limit was. It now uses your own export limit, read from the inverter, and only while export limiting is switched on, and it is not raised on an inverter that cannot export enough to reach that limit.
  • When you give 48-hour access on a Mac or Windows PC, the screen now also says “RVTC’s administrator can also connect during these 48 hours, to help your engineer.” Access you give with the updated app lets RVTC’s administrator connect too, under the same permission, and anything they do is recorded against them. Access you gave before you update stays your engineer’s alone.
  • While RVTC’s administrator is connected on 48-hour access you have given, the app on your Mac or Windows PC now says “RVTC’s administrator is connected”, rather than only that someone is connected. This also needs an update to our relay server; until both are in place, the app shows the connection as it does now.
  • On a system whose solar panels feed a separate solar inverter, such as an All-in-One, the power-flow arrow from the inverter to the home now uses the inverter’s own measurement of the power it is sending out.
  • This is also the update that several changes listed on 10 and 15 October below say they need, such as changing an energy management unit’s settings from the engineer’s dashboard.

2026-10-15 An energy management unit’s own settings, read-only engineers, two battery warnings read correctly, the whole-site view says importing when it is importing, and settings notes in Sentinel’s own words

  • These changes are to the engineer dashboard, our relay server and this website only. Nothing needs updating on your device.
  • On a system where Sentinel is connected to a GivEnergy energy management unit, the engineer’s dashboard can now show the unit’s own settings: whether it is set to manage the site, its timed charge, timed discharge and timed export slots with the battery level each one works to, the limit on how much power the site may send to the grid, and the unit’s clock.
  • The engineer reads them by pressing a button, and only while you are letting the engineer see your system: while you have allowed read access during a call, or during 48-hour access you have given. After any change the engineer makes, they are also read again to check that the change held. They are never read on a regular timer.
  • With the Sentinel apps out today, the dashboard only shows these settings, and says so. From the next Sentinel app update, your engineer can also change them from the dashboard. Each change is sent on its own and read back by the app before the next one goes, the limit on how much power the site may send to the grid and switching off the unit’s control of the site have to be typed in again to confirm, and the settings as they were before the first change can be put back in one go.
  • It also warns the engineer about slots that cross midnight or overlap, about an export slot whose battery level has been reached, which GivEnergy says stops the batteries discharging until that slot is cleared by hand, and about a unit clock that is wrong.
  • On each inverter the unit manages, the engineer’s settings page now says which of its settings the unit sets itself, so the engineer knows a change made there may not last.
  • Three settings the engineer’s settings page could only read can now be changed: which type of meter the inverter is set up for (on single-phase inverters), the direction setting for the second type of meter, and the battery capacity the inverter holds. This needs the next Sentinel app update on your device; until then the three can be read but not changed, and the page says so.
  • When the engineer reads a setting and it cannot be read, the settings page now says why, for example that read access has not been allowed or that the inverter did not answer. Before, it always asked whether read access had been allowed, whatever the reason was.
  • On a system with a GivEnergy energy management unit, the engineer’s whole-site view said “exporting” beside the grid figure when the site was importing, and “importing” when it was exporting. The figure itself was right. The word now matches it.
  • The whole-site view can now say how old the energy management unit’s figures are, once they are more than 15 seconds old. It needs the next Sentinel app update to know when the figures were read, so until then nothing changes on screen.
  • On a system with a GivEnergy energy management unit, the engineer’s whole-site view now also shows a graph of the unit’s own grid, battery, load and average charge over the last 48 hours. Sentinel starts keeping those figures with this update while your engineer is connected, and for the whole of any 48-hour access from the next Sentinel app update, so the graph fills in from now on.
  • A setting that does not apply to your inverter is still shown greyed out on the engineer’s settings page. Where the Sentinel app has an explanation written for that setting, the reason beside it is now the one the app gives if anyone tries to change it, and the engineer’s dashboard now refuses that change itself, whichever version of the Sentinel app you have.
  • On single-phase inverters with a high-voltage battery, such as the All-in-One, the battery’s nominal power and current can be changed from the engineer’s settings page again, as on three-phase inverters, with the same limits as on other systems. Those limits are sized for a low-voltage battery, so the page now asks the engineer to read the value already set before changing it.
  • Some GivEnergy All-in-One and high-voltage hybrid units were shown on the engineer’s dashboard as an unrecognised kind of inverter until their model had been read. They are now named as GivEnergy units straight away.
  • The admin console now describes your agreement for RVTC’s administrator to connect in the exact words the Sentinel app will show you, not a summary of them. No app shows those words yet, so all 48-hour access stays your engineer’s alone.
  • RVTC’s administrator can now make an engineer read-only from the admin console. A read-only engineer can still see your system, read its settings and history and search your network again, but Sentinel refuses every change they try, during a call and on 48-hour access alike, including any session they already have open, whatever access you gave them. Their dashboard says so and offers no way to change a setting. Each change of this kind is written to the permanent record first, with who made it, when and why.
  • An engineer could see, in Sentinel’s record of the changes made to their own account, the reason RVTC’s administrator gave for each one and the administrator’s email and network address. Those are now shown to administrators only.
  • A GivEnergy battery raises a warning when one of its cells falls below a set voltage, and another when the battery as a whole does. The engineer’s battery card had the first one wrong: it read it as one cell sitting half a volt below the others, and as the battery switching itself off. Neither is right. So on a battery whose cells were all low together, the card said its own readings disagreed with the battery when in fact they agreed.
  • The card now names both warnings, shows the lowest cell’s voltage and the battery’s total voltage beside them, and compares those with the voltages we have seen each warning at. GivEnergy does not publish the exact levels, and the card says so.
  • Whether the battery’s charge and discharge switches are open or closed is still shown from the battery’s own reading, as before. Neither warning on its own means they have opened.
  • Until now the second warning, for the whole battery, was shown only as “a warning we cannot name”, and not at all when the first one was showing too.

2026-10-14 Ending one engineer’s sign-in, a ceiling on changes during 48-hour access, and plainer settings cards

  • These changes are to the engineer dashboard, our relay server and this website only. Nothing needs updating on your device.
  • When an engineer reads a single setting from your inverter, that is now written to the permanent record too, on both kinds of access. If they read the same setting again within 10 minutes, those reads are counted rather than written down one by one, and the count goes on the next entry for that setting. If there is no next entry, the record shows the first read but not how many followed it.
  • During 48-hour access, changes to your inverter are limited to 30 a minute for each access you have given. Nobody working by hand gets near that; it is there to stop a runaway script. If it is reached, the engineer’s dashboard says so plainly, the change is not sent to your inverter, and the engineer can send it again within the minute.
  • RVTC’s administrator can now end a single engineer’s sign-in from the admin console. That sign-in stops working and its connections close, and the engineer has to sign in again.
  • The admin console can connect to a system on 48-hour access only where the customer, on their own device, agreed to “RVTC’s administrator can also connect during these 48 hours, to help your engineer.” No Sentinel app asks that question yet, so all 48-hour access, including any you have already given, stays your engineer’s alone.
  • A setting that is greyed out on the engineer’s settings page now keeps its Read button, so the engineer can still see the number stored there, but it cannot be changed from that page.
  • This site now says the iOS app is live on the App Store, and that the Android app is coming.

2026-10-11 Corrections to the engineer dashboard, and two September changes we had not listed

  • These changes are to the engineer dashboard and this website only. Nothing needs updating on your device.
  • When readings from your system stop arriving, the engineer dashboard now says “no new data since” and the time of the last one. Before, it could say “waiting for first packet”, which made a system that had stopped sending look as though it had never connected.
  • The engineer’s 48-hour graph of your system now adds a new reading every minute while they are connected. Before, it showed what had been stored when they connected, and did not move after that.
  • A fault your inverter is still reporting could appear in the engineer’s log with a green tick when its details changed, as though it had cleared. It now shows as still active.
  • The note beside the engineer’s grid code reset said the reset would be cancelled if the copy of your settings taken first could not be saved. Since 29 September the reset has gone ahead in that case, after telling the engineer that no copy was saved. The note now says so.
  • Some labels on the engineer dashboard were wrong. Two settings were listed as today’s grid import and export, which they are not, and another was named as the switch for the meters when it is the limit on how much power the inverter can put out. Several notes also said that features already there were still to come, and one promised a reading that Sentinel does not take. All are corrected. Today’s grid import and export were already shown correctly elsewhere on the dashboard.
  • The description of this site’s “page not found” page mentioned an install guide and a help section that do not exist. It now names the pages it links to.
  • Two engineer dashboard changes from 26 September were not listed here at the time. An engineer writing a single setting by hand can enter the value in decimal, hex or text, and the dashboard shows it in all three forms before it is sent. And when an engineer’s sign-in had run out, their first press of Connect with the six-character code you give them made the screen blink and do nothing. The page now signs them in first, and says so.

2026-10-10 Clearer charts, Search again from your engineer, and an engineer code to check for 48-hour access

  • These first changes are to the engineer dashboard and this website only. Nothing needs updating on your device for them.
  • On some inverters the battery current reading stays at zero even while the battery is charging or discharging. The battery chart now shows the current reported by the batteries themselves in that case, or works it out from power and voltage, and says which one it is showing.
  • The grid chart now says where each reading comes from: power is the grid meter reading, passed on by the inverter, and voltage, current and frequency are as the inverter reports them. Whether the inverter measures those at its own connection or takes them from the meter is still being checked.
  • Settings that do not apply to an inverter model are now shown greyed out on the engineer’s settings page with the reason, instead of disappearing.
  • On sites with a GivEnergy EMS, an inverter the EMS lists but Sentinel is not connected to is now marked “Via EMS only” on the engineer’s whole-site view, instead of “Waiting for this inverter to report”. Its figures there come from the EMS. Until your app has the update below, Search again in the app is the way to connect to it. After it, the app keeps looking for that inverter by itself, unless the inverters’ addresses were typed into it by hand, and your engineer can press Search again too.
  • The privacy policy now says 48-hour access can be given from a Mac or a Windows PC, and lists what the app keeps on your own phone or computer.
  • The changes from here on need the next update of the app on your device. Until you have it, your app works as before, and your engineer does not see the new Search again button.
  • If an inverter on your network has not been picked up, your engineer can now ask the app on your device to search again, instead of asking you to press the button. It is the same search: your pairing code stays the same, and the connection pauses for a moment only if something new is found.
  • It only works while you are letting the engineer see your system: while you have allowed read access during a call, or during 48-hour access you have granted. Each search is written to the permanent record with the engineer’s name and the time.
  • A search can be started at most once every 30 seconds, so it cannot keep your network busy.
  • Engineers now reach the systems you have given them 48-hour access to with the same sign-in they use for everything else, an emailed six-digit code. They no longer need Touch ID or Windows Hello for it.
  • Every engineer now has their own engineer code. From the next Mac and Windows update, the app shows it beside the engineer’s name when you enter their 12-digit code. Check it matches the one they give you before you approve. It tells you who the engineer is; it is not a password, and it is safe to read out.
  • When you give 48-hour access on a Mac or Windows PC, the app now also says that your engineer can ask it to search your network again for your inverters during the 48 hours. On a Mac, Sentinel Quick now calls the code beside the engineer’s name the engineer code, as the download app does.
  • Until you update, 48-hour access works as before: your app shows the longer verification code, and the engineer approves with Touch ID or Windows Hello when they connect. Access you have already given keeps working, and you do not need to authorise anyone again.
  • What changes in who we trust: the Sentinel relay, behind our sign-in, now confirms which engineer is connecting, rather than your app checking a passkey signature itself. Only the engineer you authorised can connect on your access, you can still end it at any time from the app, and every change they make is still recorded against their own account.

2026-10-09 Battery type and the grid settings are back on the engineer’s settings page

  • This is a change to the engineer dashboard only. Nothing needs updating on your device.
  • Since 4 October, the setting that switches a battery between lithium-ion and lead-acid, and the grid settings card, could be missing from the engineer’s settings page on single-phase inverters. They are shown again, and the page now redraws as soon as it knows which model your inverter is.
  • Settings that do not apply to your inverter are still refused by the app on your device, which reads the model from the inverter itself.

2026-10-04 Battery readings that looked wrong, fault codes we no longer guess at, and settings refused where they do not belong

  • These changes are in the Mac and Windows downloads. The iPhone and iPad app follows with its next update; until then it behaves as before.
  • A healthy battery could briefly look disconnected. Now and then a battery answers with a reading that is all zeros apart from its cells, and that made it show 0% with its switches open. Those readings are now ignored, and the battery keeps its last good reading until a proper one arrives.
  • When a battery’s individual cells cannot be read at all, the app no longer draws a grid of red cells as though every one had failed.
  • The same battery could appear twice, as two “Pack 1” cards. Each battery now appears once, and on sites that mix All-in-One modules with separate batteries the modules are named “Module 1”, “Module 2” and so on.
  • Typing your inverter’s address while the app is still searching now works, and Search again tells you what it found.
  • On iPad, the tiles now size to fit what they show.
  • The wording shown while 48-hour access is switched on has been corrected: it no longer says the engineer can only look.
  • Pressing Stop on 48-hour access now keeps trying until our relay confirms the access has ended.
  • An extra “consent given” record was being filed when an engineer made a change under 48-hour access. It was wrong, and it is no longer filed.
  • The grid code can now only be written back with the value your inverter already holds, so it cannot be changed to a different one.
  • Our build now refuses to produce an app that is out of date or only partly built, rather than letting it ship.
  • On systems where solar is measured by a meter on a separate solar inverter, such as AC-coupled and All-in-One systems, the app no longer warns “Solar string producing no power”. There is no solar string on those systems to produce anything.
  • An All-in-One battery could raise a false temperature fault from a reading that was not a temperature at all. That reading is no longer treated as one.
  • The inverter’s total running time is now reported in hours. It had been read as seconds, which made it look thousands of times too small.
  • When your inverter reports a fault, it is now shown as the code the inverter itself reports. Before, we translated that code into fault names, and those names could be wrong.
  • High-voltage battery systems no longer show battery pack cards for parts of the battery we cannot confirm are packs.
  • Some settings live at different addresses on three-phase inverters. Changes to them are now refused on those inverters instead of being written to the wrong place. The same goes for the battery pause time slot on systems that do not have one: the change is refused rather than sent.

2026-09-29 We audited ourselves and found six things worth fixing

  • We ran a full security review of the whole platform — the app on your machine, the relay it talks to, and the engineer console — and then had every finding independently checked before we believed it. Twenty-six things were raised; eight survived that checking. The other eighteen did not hold up, which is the point of checking. Here is what the eight were.
  • The second factor on OUR admin console could be guessed at. The limit of ten wrong codes per fifteen minutes did not actually hold when attempts arrived at the same moment, so many more got through than we intended. It never affected a customer account and no admin had switched the second factor on yet, but the protection we believed we had was not the protection we had. It is now enforced by the database rather than counted in a cache.
  • Deleting one system’s data on a site with several inverters would have permanently flagged that site’s records as tampered with — by an administrator doing exactly what the button said. The permanent record is designed to be impossible to alter quietly, and this would have made it accuse us of altering it. Fixed, and the record now stays intact when only part of a site is removed.
  • A connection that was REFUSED could still take over who got credited in the permanent record. Work done by one engineer could have been recorded against another. Nothing was lost or altered, but a record that names the wrong person is worth less than one that names nobody, so this one mattered more than its size suggests.
  • On the engineer console, the grid-code reset could take a snapshot that captured nothing and still tell the engineer a full record existed, and — separately — could write one inverter’s settings to a different inverter if the engineer switched machines while the confirmation was open. Both are fixed. The confirmation now also states plainly that the reset clears your charge slots, export limit, reserve and eco mode, because it does, and that is the whole purpose of it.
  • One badly-formed request from an engineer could hold a customer’s inverter for over an hour, during which your own app would have sat frozen on its last reading while looking connected. Requests are now bounded.
  • The app now tells the engineer whether it is actually keeping your machine awake, rather than only trying to. A 48-hour grant is worthless if the machine goes to sleep — the engineer arrives to find nothing there, and it looks like a fault somewhere else. On the platforms where no such thing is possible it now says so instead of staying quiet.
  • Also on the battery page: the hottest and coldest individual cell, which the battery has always reported and we were discarding. The four sensors shown before are group averages, so a single hot cell was diluted among the three it shares a sensor with. And the manufacturing date now reads out of the serial number, so a replaced module is obvious at a glance instead of needing the numbers decoded by hand.

2026-09-27 What an engineer can change while you are out — stated plainly, and corrected

  • A correction first, because it matters more than anything else on this page. On 19 September we told you that the settings an engineer can change on a 48-hour grant were "deliberately smaller" than the ones they can change while you are on the phone, and that your export limit, your battery chemistry and the switch that turns the inverter off were outside it. That was true when we wrote it and stopped being true four days later, on 23 September, when the two sets were deliberately made the same. The page was not updated at the time. That was our mistake and this entry is the fix.
  • What is true today: an engineer working on a 48-hour grant can change the same settings they could change with you on the phone. There is no longer a smaller set. That includes your export limit, your battery chemistry and the inverter on/off switch — and, since 26 September, the grid-protection settings as well: anti-islanding and the voltage and frequency trip limits your installation was commissioned to.
  • Nothing here changes who decides. A 48-hour grant only exists because you created it on your own device, it expires by itself, and revoking it takes effect immediately — not at the end of a session, not after a delay. If you have not granted access, nothing can be changed at all, and the app is read-only by default.
  • What did change is WHEN you consent rather than WHETHER you do. On a call you approve the session and watch the work. On a 48-hour grant you approve 48 hours of access up front, and the engineer works without you there. We think the honest way to put that is: you approve the access, not each individual change — and we should have said so on 23 September rather than leaving the older wording in place.
  • Every change is still written to the permanent record BEFORE it reaches your inverter, and read back from the hardware afterwards, so the record says what your inverter actually did rather than what it was asked to do. Each one carries the engineer who made it and the time. That has not changed and is not affected by which consent route was used.
  • The app also now keeps your screen awake for the whole of a support session. Previously it did not on the six-digit route, so a screen going dark mid-call could drop the connection — which is exactly what it did to us during one.

2026-09-19 You can now see your own cells, not just your own totals

  • The Windows and Mac app has a "Detailed status" button next to the live figures. It opens a read-only readout of what your battery is actually doing: every cell's voltage, the temperature sensors, each solar string's volts and amps, and whether each pack's charge and discharge switches are closed. Until now the app showed you four numbers — solar, home, battery, grid — while the same agent was sending your engineer considerably more about your own system.
  • It works whether or not you have given anyone access. The permission buttons decide what your ENGINEER can see; they were never meant to stop you looking at your own battery, and asking you to grant yourself permission to do that would be nonsense. Nothing in this screen leaves your computer, and there is nothing in it to press — no settings, no controls.
  • A number we do not have is shown as a dash, never as zero. That distinction matters more than it sounds: a battery cell that has dropped below about 2 volts is not reported by the battery at all, so printing "0.000 V" would turn the most serious thing a pack can do into a confident-looking reading. The same applies to a pack whose current we cannot read, and to a pack that has stopped answering — that one shows how long ago it last replied, in amber, instead of quietly showing you old numbers that look current.
  • Where the switch state cannot be read at all — All-in-One batteries do not report it, and older versions of the app did not send it — the app shows nothing rather than guessing. An unread switch is not an open switch, and telling someone their healthy battery had disconnected itself would be the worst mistake this screen could make.
  • It is on the desktop app only. The iPhone and iPad app is the one you use with an engineer on the phone, and it is limited in how long it can keep running in the background; a cell-by-cell readout belongs on the app you leave running.

2026-09-19 48-hour access can now change settings — and is deliberately not allowed to change everything

  • Until now, 48-hour access could look but not touch. An engineer working on your system while you were out could read every value and change none of them, so anything that needed a setting moved had to wait for a call where you were on the phone to allow it. That is now lifted: a 48-hour grant covers changing settings as well as looking.
  • A 48-hour grant covers both looking and changing. There was briefly a per-engineer toggle between the two; it went, because it implied you had to grant a second thing before the engineer could do the job you had just let them in for — and it left access sitting read-only that nobody meant to be read-only. Revoking still takes effect immediately, as it always has, and the grant still expires by itself.
  • CORRECTED 27 September 2026 — this entry originally said the set of settings changeable with nobody present was "deliberately smaller", and that your export limit, battery chemistry and the inverter on/off switch were outside it. That stopped being true on 23 September, four days after this entry was published, when the two sets were deliberately made the same; it was our mistake that the page was not updated with the change. The paragraph is left here rather than quietly rewritten, because a changelog that edits its own history is worth less than one that admits a correction. What is true now is set out in the 27 September entry above.
  • Every change is written to the permanent record before it is sent to your inverter, not after. If that record cannot be written, the change is refused and nothing reaches the hardware — which is the right way round, because a change nobody can account for afterwards is worse than a change that did not happen. Each one is also read back from the inverter afterwards, so the record says what the hardware actually did rather than what it was asked to do.
  • We do not send you a notification for each individual change, which is a deliberate choice rather than an oversight: an engineer working through a schedule can touch a dozen settings in a minute, and a dozen alerts would train anyone to ignore them. They appear in your system's record instead, with who made each one and when.
  • One thing that was not true before and is now: the emergency stop that pauses all remote changes across every system takes effect at once. It used to be read from a store that can hold a stale answer for up to a minute at any given location — survivable during a phone call where someone can just say "stop", and not good enough for a session running while you are asleep.

2026-09-19 The settings screen now uses GivEnergy's own words — and two of them were the wrong shape

  • Every setting has been renamed to match what GivEnergy calls it in their own portal: "Grid Export Limit" rather than "Export power limit", "Battery Reserve % Limit" rather than "Battery reserve SoC", "Inverter Charge Power Percentage" rather than "Inverter charge power %", and about thirty more. An engineer working both screens on one job was translating between two vocabularies for no reason, and a name that is nearly the same is worse than one that is obviously different — it invites you to assume two settings are the same thing when they are not.
  • Two settings were not merely named differently, they were modelled wrongly. "Meter direction" was offered as a single reversed yes/no. GivEnergy actually carries TWO meters, each with its own Positive or Negative direction — four combinations — so our switch could not express half the states the inverter can be in. It is now the four real options. The CT clamp direction was the same mistake on a smaller scale: it is Positive or Negative, not "reversed", and now says so. Getting either wrong swaps import for export while leaving every figure on screen looking plausible, which is why these two were worth fixing properly rather than relabelling.
  • Several settings whose values we had partly guessed are now confirmed: Export Power Priority really is Load First / Battery First / Grid First in that order, Pause Battery has four states rather than three, and "Activate Battery" — the control used to wake a dormant pack — was our single least-evidenced register and is now the best-evidenced one. All of it was established by comparing GivEnergy's own record of settings changes against the raw traffic on the same inverter at the same moment, so what is written down is what the hardware actually did.
  • The charge and discharge schedule no longer shows ten slots to a system that only offers one. The registers for all ten answer on every generation, so the app had been drawing ten cards everywhere and marking nine of them "not read" — which reads as a fault rather than as a machine that simply has fewer slots. It now shows what your generation actually has.
  • Authorising 48-hour access now asks for your full name, and will not proceed without it. The grant is a record of someone giving a stranger access to their home system, and until now that record named only the engineer. It names both parties now.

2026-09-11 The battery card now says whether the MOSFETs are open

  • The two cells on each pack card that have read "not mapped" since August now show Closed or Open for the charge and discharge MOSFETs, read from the BMS itself. An isolated pack — one the BMS has taken off the bus — is the single most common reason a battery "isn't working" while every cell reads healthy, and until now the card could only hint at it through a voltage gap. It says it outright now, in amber.
  • The meanings were established the honest way: by watching the bits move against what the pack was physically doing during a full calibration cycle, on four packs across three systems, with the inverter-side voltage confirming each change. One combination — charge open with discharge closed — has never actually been seen on a real pack, so if the card ever shows it, it says "inferred" rather than presenting it as a reading.
  • The raw status-bit grid below now names the six bits that are known when you hover them, and leaves the rest unnamed rather than guessed. An older agent that does not send the status bytes gets "no data" rather than a value that looks like a measurement.

2026-09-08 The desktop app was a tall, half-empty column

  • The Windows and Mac app opened as a narrow vertical strip with everything stacked down it and a large blank area at the bottom that never filled. It now opens as a wider landscape window with the two things you actually do — connecting your system, and deciding what your engineer may see — sitting side by side where both are visible at once, instead of one pushing the other off the screen. Shrink the window and it folds back to a single column, so nothing is lost on a small laptop.
  • The sample-data preview moved below both of those rather than between them, because it is the thing you are least likely to want and it was separating the two things you are most likely to want.
  • Several labels and hints were too faint to read against the dark background. They have been lifted to a contrast you can actually read, and the buttons now show a visible outline when you move through them with the keyboard.

2026-09-08 We were hiding the reason your connection failed

  • When the Windows or Mac app could not reach your inverter, it showed you three words — "Couldn't connect" — and nothing else. The actual reason was being written to the screen every time and then hidden by a styling rule meant for something else entirely, so nobody had ever seen it. You now get the real explanation, which is usually the useful one: another app on your network is holding your inverter's single connection, and closing it fixes the problem in seconds.
  • The two buttons that let your engineer look at your system, or change a setting, no longer appear before there is anything to agree to. They used to sit on screen from the moment the app opened — through startup, through the search for your inverter — offering to share a system that was not connected to anyone. They now appear when a session actually exists, which is what the iPhone and iPad app has always done.
  • "Preview with sample data" is now only offered before you connect. Previously it stayed available during a live call, and pressing it would quietly end the session, close any permission you had granted, and issue a new code — while your engineer sat looking at a screen that had gone blank. The button that ends a preview is of course still there while a preview is running.

2026-09-07 Two controls you should never have been shown

  • The app no longer asks whether to look for an EMS. If your site has one, Sentinel finds it — there is nothing to tick. The old switch was never a search option: the scan always found the EMS, and the switch only decided whether to throw it away afterwards. It was added in June as a safety catch while an EMS reading fault was being chased, that fault was fixed the following day, and the switch simply outlived it. Nobody with a dual AC3 system should have needed to know what an EMS was to see their own equipment.
  • One thing genuinely changed underneath: an EMS on its own no longer ends the search. An EMS answers like an inverter but carries none of an inverter's readings, so if it were treated as the main device you would be looking at a screen of zeros. Sentinel now keeps looking for the actual inverter first and only falls back to showing an EMS alone once it is clear the inverter is switched off.
  • The 48-hour access panel no longer offers to accept a long pasted key. Engineers send a twelve-digit code; the key was the older way of doing the same thing and it had already been removed from the desktop app in August. Keeping the field in one app meant the two could disagree about which key was being approved while the verification code on screen described the other — the exact thing that panel exists to prevent.
  • Three error messages told you to ask your engineer to send a key instead, and one of them named a box to paste it into. That box did not exist in either app. Those messages now point at the six-character code, which is a thing you can actually do.

2026-09-06 Correcting what this site told you about access

  • This page said Sentinel had "no standing access" and that closing the app left nothing behind. That stopped being true when the 48-hour engineer window shipped, and we did not update the page. A 48-hour window is exactly that — a permission that waits for you between sessions. Closing the app still stops everything dead, and nobody can reach your system while it is not running, but reopening it inside those 48 hours resumes the window without asking you again. The page now says so, and explains the difference between that and a live six-character code.
  • The download page named a button, "Allow read access", that the app has not had since August. It is now called "Let your engineer look at your system", and the page says that instead. Being told to look for a control that is not there is the fastest way to make someone doubt the whole thing.
  • Install notes now cover the cases that actually stop people. On Windows: what to do when there is no "Run anyway" button at all (that is Smart App Control, which only allows signed apps), and that the app needs Microsoft's WebView2 runtime. On Mac: the local-network permission is not optional — your inverter is a device on your local network — and how to switch it back on if you declined it by mistake. We also say plainly that the warnings appear because we have not yet bought a code-signing certificate.
  • The example code in the illustration showed five characters. Codes are six.

2026-08-29 Battery readings that admit when they disagree

  • Battery packs are now read on a flat battery. Previously we only looked for packs once the battery reported a charge level above zero — which meant a battery that was deeply discharged, recovering, or simply had not reported yet appeared to have no battery management system at all. That is exactly the state an engineer is called out to look at. Found on a customer's second inverter, where the manufacturer's own portal showed the battery talking normally while Sentinel showed nothing.
  • Where two battery readings contradict each other, the dashboard now says so instead of picking one. A pack showing no current while the inverter measures real power flowing used to be labelled "idle", which is the one thing it definitely was not. It now shows both figures side by side and says which is corroborated.
  • The raw battery-management page now does the detective work itself. Per-pack current has never been documented by the manufacturer, so finding it meant reading fifty-nine unlabelled numbers by eye. Given a current the inverter has already measured, Sentinel now highlights which registers carry that value and at what scale — clearly marked as candidates to confirm, not conclusions.
  • Each pack now shows when it was last read successfully, so a pack whose management system has gone quiet is no longer indistinguishable from a healthy one showing its last known values.

2026-08-17 A longer window for changes, and the iPhone app takes shape

  • The window you open for an engineer to change a setting now lasts one hour instead of fifteen minutes. Fifteen was too short for real work: a diagnosis often means changing something, watching how the system settles, then adjusting again — and being asked to re-approve halfway through teaches people to tap "allow" without reading it. Nothing else changed: the window is still opened by you, on your own device, still closes itself, and no change can be made without it.
  • Solar string current was being reported ten times too low on the dashboard. Fixed, and the reading now shows one decimal place.
  • Replies from the inverter are now checked for corruption before we trust them. On a noisy connection a garbled reply could previously have been shown as a real reading; now it is discarded and re-requested, and the dashboard tells the engineer if the link is unhealthy.
  • Changes sent to AC-coupled inverters were being addressed to the wrong place on the inverter. Corrected.
  • An iPhone and iPad app is in preparation, sharing the same code as the Mac app.

2026-07-05 Mobile navigation, a proper sign-out, and a tighter admin console

  • The site now has a working menu on phones and small screens — tap the menu button to reach every page and the sign-in / apply buttons, instead of the nav vanishing below a certain width.
  • Sign out now fully ends your session: it clears the sign-in cookie so the next visit asks you to sign in again, rather than quietly signing you straight back in.
  • The admin console is now locked to administrators end to end — an engineer who is only pending approval, or who is not an admin, no longer sees the kill switch or the engineer roster at all (previously those were only hidden, not withheld).

2026-07-03 Multi-inverter sites, safer writes, and a simpler way in

  • Sentinel now finds and monitors every inverter on a site, not just the first — it keeps searching the network for more even after it connects to one, so multi-inverter and plant setups are read in full.
  • Writes to an inverter setting are now rate-limited to protect the hardware from wear, and the sleep control changes only the sleep state without touching other flags.
  • New customer page: your installer can send you a single link to download Sentinel, run it and read them the code — with a plain-English explanation of why it stays read-only and in your control.
  • Clearer access for installers: apply and sign in to join the approval queue, with the read window (6 hours) and write window (15 minutes) now spelled out in the app.
  • The engineer dashboard now shows a clear banner the whole time write access is switched on — with a live countdown of the time left — so it is always obvious when changes are possible, mirroring the read-access banner.
  • The desktop and mobile apps now switch straight back to "waiting for an engineer" the moment the engineer disconnects, instead of staying on "engineer connected" until the session ends.
  • Connecting is smoother: live data now appears the instant you open the dashboard — even when the customer allowed access before you connected — and a reconnect after a short break quietly re-authenticates instead of dead-ending on "sign in required".
  • Admin console: an engineer can now be removed from the roster entirely (not just disabled) — their access is revoked immediately and the removal is itself recorded, while their past audit history is preserved. The Approve/Disable actions, which were failing to reach the backend, are fixed too.

2026-07-02 Security hardening + admin console

  • Ran a full security review of the sign-in, audit-log and admin paths and closed everything it found — including making sure hostile data from a paired system can never run code in the engineer dashboard.
  • Sign-in tokens now travel in a request header instead of the URL, so they never land in server logs; sessions have a hard renewal cap, and there is now a Sign out control.
  • Admin console: approve or disable engineers, see connected and recent systems, search the full fleet changelog, and permanently erase all data for one system (for example a test rig) — every erasure is itself recorded.

2026-07-01 Engineer sign-in + permanent audit log of every write

  • Engineers now sign in with their approved work email, secured by Cloudflare Access. There is no open signup — Ron approves each installer and can disable an account at any time from an admin console.
  • Every remote change is now recorded to a permanent, append-only, hash-chained audit log before the command reaches the inverter, keyed to the signed-in engineer and the system it targets.
  • The write path is fail-closed: if a change can't be written to the log, the write is refused. No log, no write.

2026-06 History tab

  • Added a persistent history view to the engineer dashboard: scrub back through power flow, battery, solar and grid over time to see what a system was doing when a fault hit.
  • Per-cell battery voltages retained in the rolling diagnostic window so you can spot cell imbalance without being on the system at the moment it drifts.

2026-06 Multi-inverter discovery

  • The local agent now discovers and lists multiple GivEnergy inverters on the same network automatically, so multi-unit sites, including three single-phase inverters on a three-phase supply, pair once and surface every unit.
  • Each discovered unit is labelled by model and serial in the dashboard picker.

2026-06 EMS visibility

  • Surfaced Energy Management System state (plant status, per-inverter power/SoC/temperature, site calculated and measured load, grid CT power and total battery power) read-only in the dashboard, so you can confirm how a system is configured before touching anything.

2026-06 Write allowlist + on-device consent

  • Hardened the write path: only an explicit allowlist of registers can ever be written, and only during a customer-armed access window after on-device “Allow”.
  • Every attempted and completed write is now recorded to a permanent, tamper-evident audit log that no engineer can alter or delete.

2026-05 Desktop apps (beta)

  • Shipped ad-hoc-signed Mac (universal) and Windows (64-bit) desktop builds — the current way approved engineers run Sentinel.
  • Six-character ephemeral pairing over a Cloudflare relay: no inbound ports, encrypted outbound only.
  • iOS and Android apps entered development toward App Store / Play Store review.