diff --git a/instructions.md b/instructions.md
index fa0a795..25618b4 100644
--- a/instructions.md
+++ b/instructions.md
@@ -15,15 +15,15 @@ Threshold signing needs enough devices online at the same moment. Phones sleep a
 3. **Restart the service.** Once a share is present, restarting starts the co-signer. It announces itself on the FROST relay, but stays in standby until you enable co-signing.
 4. **Enable co-signing.** Use the kill switch in the Web Admin to turn co-signing on (it ships off, fail-closed). The setting persists across restarts.
 
-After that, the Web Admin shows the bunker connection string (npub), the group, the threshold, and a live feed of signing activity.
+After that, the Web Admin shows the bunker connection string (npub), the group, the threshold, and a live feed of signing activity. If you import shares for more than one group, the Shares section marks the active group and lets you switch which one the co-signer serves.
 
 ## Configuration
 
 Use the **Configure** action to set:
 
-- **Bunker Relays:** where Nostr clients reach this signer over NIP-46. Default `wss://nos.lol`.
-- **FROST Relays:** where signing rounds are coordinated with your other devices. These must match the relays your other devices use. Default `wss://nos.lol`.
-- **Group (npub):** optional. Leave blank to auto-detect the single imported share's group; set it only if the vault holds shares for more than one group.
+- **Bunker Relays:** where Nostr clients reach this signer over NIP-46. Default `wss://bucket.coracle.social`.
+- **FROST Relays:** where signing rounds are coordinated with your other devices. These must match the relays your other devices use. Default `wss://bucket.coracle.social`.
+- **Group (npub):** optional override. Leave blank and the co-signer serves your share's group automatically. If the vault holds shares for more than one group it auto-selects one (no crash) and you can switch which group is served from the Web Admin's Shares section. Set this only to pin a specific group.
 
 Saving the configuration restarts the service.
 
diff --git a/keep b/keep
index f306f68..9462727 160000
--- a/keep
+++ b/keep
@@ -1 +1 @@
-Subproject commit f306f68967ca5234014a7b9c56a112ba007eff8c
+Subproject commit 94627278a84937d6938a19ae135137999a99219c
diff --git a/startos/actions/configure.ts b/startos/actions/configure.ts
index a0956b8..371d165 100644
--- a/startos/actions/configure.ts
+++ b/startos/actions/configure.ts
@@ -20,7 +20,7 @@ const inputSpec = InputSpec.of({
         ),
         default: [defaultBunkerRelay],
       },
-      { patterns: [relayPattern], placeholder: 'wss://nos.lol' },
+      { patterns: [relayPattern], placeholder: 'wss://bucket.coracle.social' },
     ),
   ),
   frostRelays: Value.list(
@@ -32,7 +32,7 @@ const inputSpec = InputSpec.of({
         ),
         default: [defaultFrostRelay],
       },
-      { patterns: [relayPattern], placeholder: 'wss://nos.lol' },
+      { patterns: [relayPattern], placeholder: 'wss://bucket.coracle.social' },
     ),
   ),
   frostGroup: Value.text({
diff --git a/startos/utils.ts b/startos/utils.ts
index 6728f7a..6f5ab0e 100644
--- a/startos/utils.ts
+++ b/startos/utils.ts
@@ -1,4 +1,6 @@
 export const uiPort = 8080
 
-export const defaultBunkerRelay = 'wss://nos.lol'
-export const defaultFrostRelay = 'wss://nos.lol'
+// coracle's relay reliably delivers the rapid ephemeral (kind 24242) FROST
+// signing traffic; nos.lol drops it, stalling signing rounds.
+export const defaultBunkerRelay = 'wss://bucket.coracle.social'
+export const defaultFrostRelay = 'wss://bucket.coracle.social'
diff --git a/startos/versions/index.ts b/startos/versions/index.ts
index 0e8444b..7d191b8 100644
--- a/startos/versions/index.ts
+++ b/startos/versions/index.ts
@@ -1,7 +1,13 @@
 import { VersionGraph } from '@start9labs/start-sdk'
 import { v0_4_0_0 } from './v0.4.0_0'
+import { v0_4_1_0 } from './v0.4.1_0'
+import { v0_4_2_0 } from './v0.4.2_0'
+import { v0_4_3_0 } from './v0.4.3_0'
+import { v0_4_5_0 } from './v0.4.5_0'
+import { v0_4_6_0 } from './v0.4.6_0'
+import { v0_4_7_0 } from './v0.4.7_0'
 
 export const versionGraph = VersionGraph.of({
-  current: v0_4_0_0,
-  other: [],
+  current: v0_4_7_0,
+  other: [v0_4_0_0, v0_4_1_0, v0_4_2_0, v0_4_3_0, v0_4_5_0, v0_4_6_0],
 })
diff --git a/startos/versions/v0.4.1_0.ts b/startos/versions/v0.4.1_0.ts
new file mode 100644
index 0000000..7c09e4e
--- /dev/null
+++ b/startos/versions/v0.4.1_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_1_0 = VersionInfo.of({
+  version: '0.4.1:0',
+  releaseNotes: {
+    en_US:
+      'Peer presence (online/offline) now appears in the Web Admin activity feed.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})
diff --git a/startos/versions/v0.4.2_0.ts b/startos/versions/v0.4.2_0.ts
new file mode 100644
index 0000000..097f1a3
--- /dev/null
+++ b/startos/versions/v0.4.2_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_2_0 = VersionInfo.of({
+  version: '0.4.2:0',
+  releaseNotes: {
+    en_US:
+      'Reliable repeated bunker signing: imported shares now aggregate correctly (no more "Unknown identifier"), and a spurious "No nonces stored" failure is gone. Credential files are written atomically and fail closed if corrupted, so the bunker URL stays stable across restarts.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})
diff --git a/startos/versions/v0.4.3_0.ts b/startos/versions/v0.4.3_0.ts
new file mode 100644
index 0000000..774edf9
--- /dev/null
+++ b/startos/versions/v0.4.3_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_3_0 = VersionInfo.of({
+  version: '0.4.3:0',
+  releaseNotes: {
+    en_US:
+      'Web Admin UX: live co-signer presence with a readiness indicator (Ready to sign / Waiting for co-signers), a prominent approval bar with browser-tab and opt-in desktop alerts, a decluttered activity feed (repeated events collapse into one line), relative timestamps, and a signing log grouped by session with expandable detail.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})
diff --git a/startos/versions/v0.4.5_0.ts b/startos/versions/v0.4.5_0.ts
new file mode 100644
index 0000000..9b72854
--- /dev/null
+++ b/startos/versions/v0.4.5_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_5_0 = VersionInfo.of({
+  version: '0.4.5:0',
+  releaseNotes: {
+    en_US:
+      'Co-signer reliability: peers now report accurate online/offline presence, and signing rounds gracefully fall back to interactive mode when a pre-exchanged nonce is stale, preventing stuck or failed co-sign requests.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})
diff --git a/startos/versions/v0.4.6_0.ts b/startos/versions/v0.4.6_0.ts
new file mode 100644
index 0000000..e8971ed
--- /dev/null
+++ b/startos/versions/v0.4.6_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_6_0 = VersionInfo.of({
+  version: '0.4.6:0',
+  releaseNotes: {
+    en_US:
+      'Multiple key groups: the co-signer no longer crashes when the vault holds more than one FROST group. It serves one group at a time (auto-selected by default) and you can switch which group is served from the Web Admin. Default relay is now wss://bucket.coracle.social, which reliably delivers FROST coordination traffic.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})
diff --git a/startos/versions/v0.4.7_0.ts b/startos/versions/v0.4.7_0.ts
new file mode 100644
index 0000000..e73b003
--- /dev/null
+++ b/startos/versions/v0.4.7_0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v0_4_7_0 = VersionInfo.of({
+  version: '0.4.7:0',
+  releaseNotes: {
+    en_US:
+      'Bounded multi-event pre-approval cache (cap 100, TTL 5 min) and single-party FROST sign/ECDH refinements, so wallet descriptor coordination and multi-event signing flows no longer stall after a single pre-approval. Includes the automated fund sweep on descriptor migration.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})