diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a14eec..6af74bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,41 @@
 # Changelog
 
+## 1.9.29-rc1
+
+**BrightSign port.** The player on BrightSign is the ordinary web player running in an
+`roHtmlWidget` — that part already worked. This release adds the host around it, which covers what a
+page cannot do for itself, and a per-group choice of synchronisation protocol.
+
+Release candidate: cut for testing on alpha, not for production fleets.
+
+### Added
+- **`brightsign/autorun.brs` — a supervised host, not a URL wrapper.** It owns the widget lifecycle,
+  because a page-initiated `location.reload()` does not reliably bring an `roHtmlWidget` back: a
+  deploy on 2026-07-28 reloaded every connected player and the BrightSign was the only one that never
+  returned. The page now posts `{type:"restart"}` and the host rebuilds the widget. It also retries
+  `load-error` with backoff, falls back to a local page, and runs a heartbeat watchdog that catches a
+  page which loaded fine and then wedged — the case `load-error` never reports.
+- **`brightsign/st-bridge.js` — the page's half of that contract**, over `@brightsign/messageport`.
+  Registry-backed identity (the registry outlives `localStorage` on this platform),
+  restart-instead-of-reload, heartbeat, and sync-backend reporting. Every method degrades to a no-op
+  off-platform, so it is served to every player rather than gated on a user agent.
+- **`brightsign/st-sync.js` — native SyncManager support.** Frame-accurate video sync between
+  BrightSign players via `setSyncParams` on the standard `<video>` element.
+- **`server/lib/sync-backend.js` — whose protocol a group runs.** `auto` picks BrightSign's native
+  sync when every member is a BrightSign and ours otherwise. Native sync selected for a mixed group,
+  or for players on different subnets, downgrades and reports why: BrightWall is multicast and
+  cannot cross networks, and a half-synced group looks perfectly healthy on the dashboard while one
+  panel drifts alone.
+- **Boot from internal flash.** A player will run `FLASH:/autorun.brs` with no card present at all,
+  confirmed on an XT245 whose microSD interface is physically dead. `StorageRoot()` probes for it and
+  falls back to `SD:`, so a failed card slot no longer ends a player's life.
+
+### Changed
+- The web player restarts through a single `restartPlayer()` path instead of four separate
+  `location.reload()` call sites. Off BrightSign the behaviour is unchanged.
+- Storage keys carry a per-output suffix so a dual-output player's two widgets, which share an origin
+  and one `localStorage`, cannot collapse into a single device row.
+
 ## 1.9.28
 
 **Platform-wide QA sweep — 25 fixes.** Findings from an audit of the Android player, the browser and
diff --git a/VERSION b/VERSION
index d5580fe..1a78dba 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.9.28
+1.9.29-rc1
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 9e5a1e6..aeef52b 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -13,8 +13,8 @@ android {
         targetSdk = 34
         // Env-overridable so device-owner reinstalls (which require an ever-increasing
         // versionCode — downgrades are blocked) don't churn this file each build.
-        versionCode = (System.getenv("VERSION_CODE") ?: findProperty("VERSION_CODE") as String? ?: "97").toInt()
-        versionName = System.getenv("VERSION_NAME") ?: findProperty("VERSION_NAME") as String? ?: "1.9.28"
+        versionCode = (System.getenv("VERSION_CODE") ?: findProperty("VERSION_CODE") as String? ?: "98").toInt()
+        versionName = System.getenv("VERSION_NAME") ?: findProperty("VERSION_NAME") as String? ?: "1.9.29-rc1"
     }
 
     signingConfigs {
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 5157cd6..097da3e 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: ScreenTinker Public API
-  version: 1.9.28
+  version: 1.9.29
   description: |
     Public, token-scoped REST API for ScreenTinker digital signage.
 
diff --git a/server/package-lock.json b/server/package-lock.json
index cbd6be0..abc847f 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "screentinker",
-  "version": "1.9.28",
+  "version": "1.9.29-rc1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "screentinker",
-      "version": "1.9.28",
+      "version": "1.9.29-rc1",
       "dependencies": {
         "@azure/msal-node": "^5.2.1",
         "archiver": "^7.0.1",
diff --git a/server/package.json b/server/package.json
index fe6f43a..47c31d1 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "screentinker",
-  "version": "1.9.28",
+  "version": "1.9.29-rc1",
   "description": "ScreenTinker - Digital Signage Management Server",
   "main": "server.js",
   "scripts": {
diff --git a/tizen/config.xml b/tizen/config.xml
index e8b63a1..4c5f02c 100644
--- a/tizen/config.xml
+++ b/tizen/config.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <widget xmlns="http://www.w3.org/ns/widgets" xmlns:tizen="http://tizen.org/ns/widgets"
-        id="http://screentinker.com/player" version="1.9.28" viewmodes="maximized">
+        id="http://screentinker.com/player" version="1.9.29" viewmodes="maximized">
     <tizen:application id="ScrnTinkr1.ScreenTinker" package="ScrnTinkr1" required_version="2.4"/>
     <tizen:profile name="tv"/>
     <name>ScreenTinker</name>