From c0a5635ba3639a392c5eaf0a99d54cd06da74cc0 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 28 Jul 2026 07:33:32 -0400
Subject: [PATCH 01/60] =?UTF-8?q?feat(fips):=20A3.10=20=E2=80=94=20last-kn?=
 =?UTF-8?q?own-good=20endpoint=20fallback=20for=20direct=20peering?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New fips/endpoints.rs: an npub-keyed store (<data_dir>/fips-endpoints.json)
of every endpoint a peer was last seen connected at (fipsctl show peers
transport_addr/transport_type — covers LAN, Tailscale, and WAN alike),
refreshed each anchor tick, 30-day retention.

The anchor tick now escalates LAN → last-known-good → anchor tree: any
federation peer with a fips npub that is neither currently connected nor
covered by a live LAN direct entry gets its last-known-good endpoint
re-dialed (idempotent fipsctl connect, bounded by apply()'s per-connect
cap). This productizes the hand-applied .116↔.198 Tailscale fix of
2026-07-20 and closes RC2's "no endpoint fallback" gap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/fips/endpoints.rs | 205 +++++++++++++++++++++++++
 core/archipelago/src/fips/mod.rs       |   1 +
 core/archipelago/src/fips/service.rs   |  46 ++++++
 core/archipelago/src/server.rs         |  36 +++++
 4 files changed, 288 insertions(+)
 create mode 100644 core/archipelago/src/fips/endpoints.rs

diff --git a/core/archipelago/src/fips/endpoints.rs b/core/archipelago/src/fips/endpoints.rs
new file mode 100644
index 00000000..7fbcd9a0
--- /dev/null
+++ b/core/archipelago/src/fips/endpoints.rs
@@ -0,0 +1,205 @@
+//! Last-known-good FIPS peer endpoints (A3.10).
+//!
+//! The LAN direct-peering tick (`anchors::lan_fips_anchors`) only helps peers
+//! we can currently see on the LAN. When a federation peer's LAN path is gone
+//! (renumbered network, remote site, mDNS blackout) the only route left is the
+//! anchor spanning tree — the exact hairpin RC2 calls out. But if we were EVER
+//! connected to that peer directly, the daemon knew a working endpoint for it
+//! (`fipsctl show peers` → `transport_addr`/`transport_type`, which covers
+//! LAN, Tailscale, and WAN endpoints alike). This module persists those
+//! npub-keyed endpoints and re-offers them as dial candidates when the live
+//! paths disappear: LAN → last-known-good → anchor tree.
+//!
+//! Persisted at `<data_dir>/fips-endpoints.json`. Entries are refreshed every
+//! time the peer is seen connected and dropped after `RETENTION` without a
+//! sighting, so a peer that genuinely moved doesn't get dialed at a stale
+//! address forever ( `fipsctl connect` to a dead address is harmless but not
+//! free).
+
+use std::collections::HashMap;
+use std::path::Path;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+use tokio::fs;
+
+use super::anchors::SeedAnchor;
+
+const FILE_NAME: &str = "fips-endpoints.json";
+/// Forget endpoints not seen connected for this long (seconds) — 30 days.
+const RETENTION_SECS: u64 = 30 * 24 * 60 * 60;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KnownEndpoint {
+    /// "ip:port" as reported by the daemon (`transport_addr`).
+    pub address: String,
+    /// "udp" | "tcp" (`transport_type`).
+    pub transport: String,
+    /// Unix seconds of the last time this peer was seen connected here.
+    pub last_ok_unix: u64,
+}
+
+/// A currently-connected peer as parsed from `fipsctl show peers`.
+#[derive(Debug, Clone)]
+pub struct ConnectedPeer {
+    pub npub: String,
+    pub address: String,
+    pub transport: String,
+}
+
+fn now_unix() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+pub async fn load(data_dir: &Path) -> HashMap<String, KnownEndpoint> {
+    let path = data_dir.join(FILE_NAME);
+    match fs::read(&path).await {
+        Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_default(),
+        Err(_) => HashMap::new(),
+    }
+}
+
+async fn save(data_dir: &Path, map: &HashMap<String, KnownEndpoint>) -> Result<()> {
+    let path = data_dir.join(FILE_NAME);
+    let tmp = data_dir.join(format!("{FILE_NAME}.tmp"));
+    fs::write(&tmp, serde_json::to_vec_pretty(map)?).await?;
+    fs::rename(&tmp, &path).await?;
+    Ok(())
+}
+
+/// Merge the currently-connected peers into the store (refreshing their
+/// timestamps), prune expired entries, persist, and return the updated map.
+/// Persistence failures are non-fatal — the in-memory result is still
+/// returned so this tick's fallback logic works.
+pub async fn record_connected(
+    data_dir: &Path,
+    connected: &[ConnectedPeer],
+) -> HashMap<String, KnownEndpoint> {
+    let mut map = load(data_dir).await;
+    let now = now_unix();
+    let before = map.clone();
+    for p in connected {
+        if p.npub.is_empty() || p.address.is_empty() {
+            continue;
+        }
+        map.insert(
+            p.npub.clone(),
+            KnownEndpoint {
+                address: p.address.clone(),
+                transport: p.transport.clone(),
+                last_ok_unix: now,
+            },
+        );
+    }
+    map.retain(|_, e| now.saturating_sub(e.last_ok_unix) <= RETENTION_SECS);
+    if map != before {
+        if let Err(e) = save(data_dir, &map).await {
+            tracing::debug!("fips endpoint store save failed (non-fatal): {e}");
+        }
+    }
+    map
+}
+
+/// Build fallback anchors for federation peers whose live paths are gone:
+/// every `wanted_npub` that is neither currently connected nor covered by a
+/// live LAN direct entry, but has a last-known-good endpoint, becomes a dial
+/// candidate. `fipsctl connect` is idempotent and failure-tolerant, so a
+/// stale candidate costs one failed dial, bounded by apply()'s per-connect
+/// timeout.
+pub fn fallback_anchors(
+    known: &HashMap<String, KnownEndpoint>,
+    wanted_npubs: &[String],
+    connected_npubs: &[String],
+    lan_direct: &[SeedAnchor],
+) -> Vec<SeedAnchor> {
+    let mut out = Vec::new();
+    for npub in wanted_npubs {
+        if connected_npubs.iter().any(|c| c == npub) {
+            continue;
+        }
+        if lan_direct.iter().any(|a| &a.npub == npub) {
+            continue;
+        }
+        if let Some(e) = known.get(npub) {
+            out.push(SeedAnchor {
+                npub: npub.clone(),
+                address: e.address.clone(),
+                transport: e.transport.clone(),
+                label: "last-known-good endpoint (direct FIPS)".to_string(),
+            });
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn ep(addr: &str) -> KnownEndpoint {
+        KnownEndpoint {
+            address: addr.to_string(),
+            transport: "udp".to_string(),
+            last_ok_unix: now_unix(),
+        }
+    }
+
+    #[tokio::test]
+    async fn record_and_reload_roundtrip() {
+        let dir = tempfile::tempdir().unwrap();
+        let connected = vec![ConnectedPeer {
+            npub: "npub1aaa".into(),
+            address: "100.114.134.21:2121".into(),
+            transport: "udp".into(),
+        }];
+        let map = record_connected(dir.path(), &connected).await;
+        assert_eq!(map["npub1aaa"].address, "100.114.134.21:2121");
+        let reloaded = load(dir.path()).await;
+        assert_eq!(reloaded, map);
+    }
+
+    #[tokio::test]
+    async fn expired_entries_are_pruned_on_record() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut stale = HashMap::new();
+        stale.insert(
+            "npub1old".to_string(),
+            KnownEndpoint {
+                address: "10.0.0.1:2121".into(),
+                transport: "udp".into(),
+                last_ok_unix: now_unix() - RETENTION_SECS - 60,
+            },
+        );
+        save(dir.path(), &stale).await.unwrap();
+        let map = record_connected(dir.path(), &[]).await;
+        assert!(map.is_empty());
+    }
+
+    #[test]
+    fn fallback_skips_connected_and_lan_covered_peers() {
+        let mut known = HashMap::new();
+        known.insert("npub1gone".to_string(), ep("100.1.2.3:2121"));
+        known.insert("npub1conn".to_string(), ep("100.1.2.4:2121"));
+        known.insert("npub1lan".to_string(), ep("100.1.2.5:2121"));
+        let wanted: Vec<String> = ["npub1gone", "npub1conn", "npub1lan", "npub1never"]
+            .iter()
+            .map(|s| s.to_string())
+            .collect();
+        let connected = vec!["npub1conn".to_string()];
+        let lan = vec![SeedAnchor {
+            npub: "npub1lan".into(),
+            address: "192.168.63.198:2121".into(),
+            transport: "udp".into(),
+            label: "LAN".into(),
+        }];
+        let out = fallback_anchors(&known, &wanted, &connected, &lan);
+        assert_eq!(out.len(), 1);
+        assert_eq!(out[0].npub, "npub1gone");
+        assert_eq!(out[0].address, "100.1.2.3:2121");
+        // npub1never has no stored endpoint → nothing to dial.
+    }
+}
diff --git a/core/archipelago/src/fips/mod.rs b/core/archipelago/src/fips/mod.rs
index ae192b5a..e945c154 100644
--- a/core/archipelago/src/fips/mod.rs
+++ b/core/archipelago/src/fips/mod.rs
@@ -29,6 +29,7 @@ pub mod anchors;
 pub mod app_ports;
 pub mod config;
 pub mod dial;
+pub mod endpoints;
 pub mod iface;
 pub mod service;
 pub mod telemetry;
diff --git a/core/archipelago/src/fips/service.rs b/core/archipelago/src/fips/service.rs
index 53ca36d2..c88a051c 100644
--- a/core/archipelago/src/fips/service.rs
+++ b/core/archipelago/src/fips/service.rs
@@ -227,6 +227,52 @@ pub async fn peer_connectivity_summary(anchor_candidates: &[String]) -> (u32, bo
     (authenticated_peer_count, anchor_connected)
 }
 
+/// Currently-connected peers with their live endpoints, from
+/// `fipsctl show peers` (`transport_addr`/`transport_type`). Feeds the
+/// last-known-good endpoint store (A3.10); empty on any failure.
+pub async fn connected_peer_endpoints() -> Vec<crate::fips::endpoints::ConnectedPeer> {
+    let peers_json = match Command::new("sudo")
+        .args(["-n", "fipsctl", "show", "peers"])
+        .output()
+        .await
+    {
+        Ok(o) if o.status.success() => o.stdout,
+        _ => return Vec::new(),
+    };
+    let parsed: serde_json::Value = match serde_json::from_slice(&peers_json) {
+        Ok(v) => v,
+        Err(_) => return Vec::new(),
+    };
+    parsed
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .map(|peers| {
+            peers
+                .iter()
+                .filter(|p| {
+                    p.get("connectivity")
+                        .and_then(|c| c.as_str())
+                        .map(|s| s == "connected")
+                        .unwrap_or(false)
+                })
+                .filter_map(|p| {
+                    let npub = p.get("npub").and_then(|n| n.as_str())?;
+                    let address = p.get("transport_addr").and_then(|a| a.as_str())?;
+                    let transport = p
+                        .get("transport_type")
+                        .and_then(|t| t.as_str())
+                        .unwrap_or("udp");
+                    Some(crate::fips::endpoints::ConnectedPeer {
+                        npub: npub.to_string(),
+                        address: address.to_string(),
+                        transport: transport.to_string(),
+                    })
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
 /// Read the upstream daemon's public key at `/etc/fips/fips.pub` and return
 /// it as a bech32 npub. Returns `Ok(None)` if the file doesn't exist — used
 /// as a fallback on legacy/dev nodes where no seed-derived key exists.
diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs
index fbd0047c..8007d962 100644
--- a/core/archipelago/src/server.rs
+++ b/core/archipelago/src/server.rs
@@ -786,6 +786,42 @@ impl Server {
                         if !direct.is_empty() {
                             let _ = crate::fips::anchors::apply(&direct).await;
                         }
+
+                        // A3.10 — endpoint fallback for direct peering. Record
+                        // where currently-connected peers actually are (their
+                        // transport_addr covers LAN, Tailscale, and WAN alike),
+                        // then re-dial the last-known-good endpoint of every
+                        // federation peer whose live paths are gone: not
+                        // connected now, no LAN direct entry this tick. Escala-
+                        // tion order is LAN → last-known-good → anchor tree;
+                        // a stale candidate costs one bounded failed dial.
+                        let connected =
+                            crate::fips::service::connected_peer_endpoints().await;
+                        let known = crate::fips::endpoints::record_connected(
+                            &data_dir, &connected,
+                        )
+                        .await;
+                        let wanted: Vec<String> = reg
+                            .all_peers()
+                            .await
+                            .iter()
+                            .filter_map(|p| p.fips_npub.clone())
+                            .collect();
+                        let connected_npubs: Vec<String> =
+                            connected.iter().map(|c| c.npub.clone()).collect();
+                        let fallback = crate::fips::endpoints::fallback_anchors(
+                            &known,
+                            &wanted,
+                            &connected_npubs,
+                            &direct,
+                        );
+                        if !fallback.is_empty() {
+                            tracing::info!(
+                                count = fallback.len(),
+                                "dialing last-known-good endpoints for disconnected federation peers"
+                            );
+                            let _ = crate::fips::anchors::apply(&fallback).await;
+                        }
                     }
 
                     let next = if daemon_restarting && fast_retries < MAX_FAST_RETRIES {

From 0b2c36f095e159f377ea096ed5e853da0bfc092f Mon Sep 17 00:00:00 2001
From: ssmithx <atobitcoin@proton.me>
Date: Sat, 1 Aug 2026 19:28:25 +0000
Subject: [PATCH 02/60] fix(bitcoin): stop writing a datadir bitcoin.conf that
 conflicts with -conf=/tmp/rpc.conf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since a597c1d9 (bitcoind RPC creds off argv), bitcoin-core and bitcoin-knots
launch bitcoind with -conf=/tmp/rpc.conf and pass all other settings as CLI
args; bitcoind never reads /var/lib/archipelago/bitcoin/bitcoin.conf again.

write_bitcoin_conf, ensure_bitcoin_rpc_config, and bootstrap's
run_bitcoin_rpc_repair were never updated to match — they kept writing/
"repairing" server=/rpcbind=/rpcallowip=/listen= into that datadir file on
every install, reinstall, and service restart. Bitcoin Core's own
datadir-conflict safety check then refuses to start whenever that file
exists alongside an explicit -conf= arg, so the write and every repair
of it directly caused the crash it was trying to prevent.

Also drop the "restart already-running container after bitcoin.conf
repair" adoption-path branch: it assumed bind settings live in that file
and needs a restart to pick them up, which hasn't been true since
a597c1d9 — the running container's CLI args are already correct.

Replaces both writers with remove_stale_bitcoin_conf(), which renames
(not deletes) any leftover file so already-affected nodes self-heal on
next install/restart instead of staying permanently broken.

bitcoin_data_volume_gb is removed as dead code (it only fed the deleted
prune= line in write_bitcoin_conf, itself unused since a597c1d9 hardcoded
-prune=550 in the manifest's small-disk branch).

Investigated after a crash loop on archy-x250-beta; full incident
timeline and patch rationale in bitcoin-conf-crash-patch.md.
---
 .../src/api/rpc/package/install.rs            | 244 ++++--------------
 core/archipelago/src/bootstrap.rs             |  52 ++--
 2 files changed, 69 insertions(+), 227 deletions(-)

diff --git a/core/archipelago/src/api/rpc/package/install.rs b/core/archipelago/src/api/rpc/package/install.rs
index 589b0b09..0261a091 100644
--- a/core/archipelago/src/api/rpc/package/install.rs
+++ b/core/archipelago/src/api/rpc/package/install.rs
@@ -307,19 +307,24 @@ impl RpcHandler {
         let deps = self.gate_install_deps(package_id).await?;
         check_bitcoin_pruning_compatibility(package_id).await?;
         log_optional_dep_info(package_id, &deps);
-        let repaired_bitcoin_conf =
-            if matches!(package_id, "bitcoin" | "bitcoin-core" | "bitcoin-knots") {
-                // Materialise the RPC password file before any install path
-                // runs. The orchestrator path resolves secret_env from
-                // /var/lib/archipelago/secrets/bitcoin-rpc-password at start
-                // time; if the file is missing, bitcoind exits within ms.
-                // bitcoin_rpc_credentials() generates + persists on first
-                // call (OnceCell-cached), so this is idempotent.
-                let _ = crate::bitcoin_rpc::bitcoin_rpc_credentials().await;
-                ensure_bitcoin_rpc_config().await?
-            } else {
-                false
-            };
+        if matches!(package_id, "bitcoin" | "bitcoin-core" | "bitcoin-knots") {
+            // Materialise the RPC password file before any install path
+            // runs. The orchestrator path resolves secret_env from
+            // /var/lib/archipelago/secrets/bitcoin-rpc-password at start
+            // time; if the file is missing, bitcoind exits within ms.
+            // bitcoin_rpc_credentials() generates + persists on first
+            // call (OnceCell-cached), so this is idempotent.
+            let _ = crate::bitcoin_rpc::bitcoin_rpc_credentials().await;
+            // A stale datadir bitcoin.conf from an older install conflicts
+            // with the container's -conf=/tmp/rpc.conf launch (see
+            // apps/bitcoin-core & bitcoin-knots manifest.yml) and makes
+            // Bitcoin Core refuse to start at all. Clear it before
+            // (re)install. Unlike the old bind-setting "repair" this was
+            // replacing, it never requires restarting an already-running
+            // container — bitcoind doesn't read this file, so removing it
+            // changes nothing at runtime.
+            remove_stale_bitcoin_conf().await?;
+        }
 
         // For orchestrator-managed apps, skip the legacy "container exists →
         // adopt + return" probe entirely. The orchestrator's own install path
@@ -389,37 +394,7 @@ impl RpcHandler {
                     .trim()
                     .to_string();
 
-                if state == "running" && repaired_bitcoin_conf {
-                    info!(
-                        "Restarting existing container {} after bitcoin.conf RPC repair",
-                        package_id
-                    );
-                    let restart_output = tokio::process::Command::new("podman")
-                        .args(["restart", package_id])
-                        .output()
-                        .await
-                        .context(
-                            "Failed to restart existing container after bitcoin.conf repair",
-                        )?;
-                    if !restart_output.status.success() {
-                        let stderr = String::from_utf8_lossy(&restart_output.stderr);
-                        install_log(&format!(
-                            "INSTALL ADOPT FAIL: {} - restart after RPC repair failed: {}",
-                            package_id, stderr
-                        ))
-                        .await;
-                        return Err(anyhow::anyhow!(
-                            "Container {} exists but failed to restart after RPC repair: {}",
-                            package_id,
-                            stderr
-                        ));
-                    }
-                    let _ = tokio::process::Command::new("podman")
-                        .args(["restart", "archy-bitcoin-ui"])
-                        .output()
-                        .await;
-                    wait_for_adopted_container(package_id, package_id).await?;
-                } else if state != "running" {
+                if state != "running" {
                     // Start the stopped/exited container
                     info!("Starting existing container {} (was {})", package_id, state);
                     let start_output = tokio::process::Command::new("podman")
@@ -707,9 +682,13 @@ impl RpcHandler {
             }
         }
 
-        // Pre-install: write config files BEFORE chown (dir is still owned by archipelago user)
+        // Pre-install: clear a stale datadir bitcoin.conf BEFORE chown (dir is
+        // still owned by archipelago user). bitcoind is launched with
+        // -conf=/tmp/rpc.conf (see apps/bitcoin-core & bitcoin-knots
+        // manifest.yml) and never reads a datadir bitcoin.conf — if one
+        // exists, Bitcoin Core's own safety check refuses to start at all.
         if matches!(package_id, "bitcoin" | "bitcoin-core" | "bitcoin-knots") {
-            self.write_bitcoin_conf(&rpc_user, &rpc_pass).await?;
+            remove_stale_bitcoin_conf().await?;
         }
 
         if package_id == "lnd" {
@@ -1418,96 +1397,13 @@ impl RpcHandler {
         }
     }
 
-    /// Write bitcoin.conf with rpcauth (salted HMAC hash, no plaintext password).
-    async fn write_bitcoin_conf(&self, rpc_user: &str, rpc_pass: &str) -> Result<()> {
-        let bitcoin_dir = "/var/lib/archipelago/bitcoin";
-        let conf_path = format!("{}/bitcoin.conf", bitcoin_dir);
-
-        // Idempotent: once bitcoin-knots (or a prior install) has started,
-        // the data dir is chowned into the container's user namespace
-        // (e.g. UID 100100 on the host) with 700 perms — the archipelago
-        // daemon can no longer stat or write there. Treat any non-NotFound
-        // error on the conf as "conf already provisioned by the container
-        // user" and skip. Matches the lnd.conf behavior below.
-        match tokio::fs::metadata(&conf_path).await {
-            Ok(_) => {
-                ensure_bitcoin_rpc_config().await?;
-                info!("bitcoin.conf already exists, ensured Bitcoin RPC config");
-                return Ok(());
-            }
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-            Err(_) => {
-                ensure_bitcoin_rpc_config().await?;
-                info!("bitcoin.conf path inaccessible, ensured Bitcoin RPC config via host helper");
-                return Ok(());
-            }
-        }
-
-        use hmac::{Hmac, Mac};
-        use sha2::Sha256;
-        let salt_bytes: [u8; 16] = rand::random();
-        let salt_hex = hex::encode(salt_bytes);
-        let mut mac = Hmac::<Sha256>::new_from_slice(salt_hex.as_bytes())
-            .expect("HMAC accepts any key length");
-        mac.update(rpc_pass.as_bytes());
-        let hash_hex = hex::encode(mac.finalize().into_bytes());
-        let rpcauth_line = format!("rpcauth={}:{}${}", rpc_user, salt_hex, hash_hex);
-
-        // Default to full archive — operators with 2TB+ drives shouldn't be
-        // silently pruned down to 550 MB. Users who want a pruned node can
-        // set `prune=N` in bitcoin.conf themselves after install.
-        //
-        // printtoconsole=0: bitcoind already writes debug.log in the datadir
-        // (self-shrunk on restart); duplicating it to stdout pushed every IBD
-        // "UpdateTip" line through conmon into journald (>1 GB/day). Deep
-        // debugging uses /var/lib/archipelago/bitcoin/debug.log.
-        // rpcbind=0.0.0.0 is REQUIRED inside a container: with rpcallowip set
-        // but no rpcbind, bitcoind binds RPC to 127.0.0.1 in the container
-        // netns only — LND / the Bitcoin UI dialing bitcoin-knots:8332 over
-        // the bridge get connection refused (fresh-install LND crash-loop +
-        // bitcoin-rpc 502, seen on the 1.7.99 ISO). The port publish stays
-        // 127.0.0.1-only on the host, so exposure is unchanged.
-        // Prune sized to the data volume. A full archive needs ~810 GB and
-        // grows; silently writing an unpruned config onto a small disk fills
-        // it mid-IBD (framework node 2026-07-14: unpruned mainnet on a 205 GB
-        // volume). Volumes with real archival headroom (≥1.2 TB) stay full
-        // archive; smaller ones get prune = 25% of the volume, clamped to
-        // [550 MB, 100 GB], leaving room for LND/apps sharing the disk.
-        let prune_line = match bitcoin_data_volume_gb().await {
-            Some(total_gb) if total_gb > 0 && total_gb < 1200 => {
-                let prune_mb = ((total_gb as f64 * 0.25 * 1024.0) as u64).clamp(550, 100_000);
-                info!(
-                    volume_gb = total_gb,
-                    prune_mb, "Data volume below archival size — enabling sized bitcoin prune"
-                );
-                format!("prune={}\n", prune_mb)
-            }
-            _ => String::new(),
-        };
-
-        let bitcoin_conf = format!(
-            "\
-# rpcauth: salted hash only - no plaintext password in config or CLI\n\
-{}\n\
-server=1\n\
-rpcbind=0.0.0.0\n\
-rpcallowip=0.0.0.0/0\n\
-listen=1\n\
-rpcthreads=16\n\
-rpcworkqueue=256\n\
-printtoconsole=0\n\
-{}",
-            rpcauth_line, prune_line
-        );
-        tokio::fs::create_dir_all(bitcoin_dir)
-            .await
-            .context("Failed to create bitcoin data directory")?;
-        tokio::fs::write(&conf_path, bitcoin_conf)
-            .await
-            .context("Failed to write bitcoin.conf")?;
-        info!("Created bitcoin.conf with rpcauth (no plaintext credentials)");
-        Ok(())
-    }
+    // write_bitcoin_conf removed: bitcoind is launched with -conf=/tmp/rpc.conf
+    // (see apps/bitcoin-core & bitcoin-knots manifest.yml, commit a597c1d9)
+    // and never reads a datadir bitcoin.conf. Writing one here created a
+    // fatal "-conf vs default bitcoin.conf" conflict on every subsequent
+    // start (Bitcoin Core's own datadir-conflict safety check). See
+    // `remove_stale_bitcoin_conf` below, which replaces both this and
+    // `ensure_bitcoin_rpc_config`.
 
     /// Write LND config file with Bitcoin RPC credentials.
     async fn write_lnd_conf(&self, rpc_user: &str, rpc_pass: &str) -> Result<()> {
@@ -2602,28 +2498,12 @@ async fn wait_for_adopted_container(package_id: &str, container_name: &str) -> R
     ))
 }
 
-/// Total size (GB) of the filesystem holding the bitcoin data dir, via
-/// `df -k`. None when df fails (containers, exotic mounts) — callers treat
-/// unknown as "don't prune" to preserve archival defaults on big iron.
-async fn bitcoin_data_volume_gb() -> Option<u64> {
-    let target = if std::path::Path::new("/var/lib/archipelago").exists() {
-        "/var/lib/archipelago"
-    } else {
-        "/"
-    };
-    let output = tokio::process::Command::new("df")
-        .args(["-k", target])
-        .output()
-        .await
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let line = stdout.lines().nth(1)?;
-    let kb: u64 = line.split_whitespace().nth(1)?.parse().ok()?;
-    Some(kb / 1024 / 1024)
-}
+// bitcoin_data_volume_gb removed with write_bitcoin_conf: it only fed that
+// function's volume-aware `prune=` line, which bitcoind never read either
+// (see remove_stale_bitcoin_conf). The manifest's shell entrypoint already
+// computes DISK_GB_VALUE and hardcodes -prune=550 on small volumes — a
+// real volume-aware prune fix belongs there, not in a conf file nothing
+// reads. Tracked as follow-up in bitcoin-conf-crash-patch.md.
 
 /// One-shot probe: does bitcoind answer an authenticated getblockchaininfo?
 /// Works during IBD (the call answers with progress while syncing). Goes via
@@ -2701,52 +2581,36 @@ async fn wait_for_bitcoin_rpc_gate(package_id: &str) -> Result<()> {
     Ok(())
 }
 
-async fn ensure_bitcoin_rpc_config() -> Result<bool> {
+/// bitcoind reads only `/tmp/rpc.conf` + CLI args at container start (see
+/// apps/bitcoin-core & bitcoin-knots manifest.yml, commit a597c1d9) — it
+/// never reads a datadir bitcoin.conf. A leftover file from an older install
+/// (or a manual edit) makes Bitcoin Core's own datadir-conflict safety check
+/// refuse to start ("-conf=... vs default bitcoin.conf"). Remove it — via
+/// the same host-privileged path the old writer/repairer used, since the
+/// dir may already be chowned into the container's UID namespace by a
+/// previous start — instead of "repairing" it into existence.
+async fn remove_stale_bitcoin_conf() -> Result<bool> {
     let script = r#"
 set -eu
 conf=/var/lib/archipelago/bitcoin/bitcoin.conf
 [ -f "$conf" ] || exit 0
-changed=0
-tmp=$(mktemp)
-awk -F= '
-    /^(server|txindex|rpcbind|rpcallowip|rpcport|listen|bind|dbcache|rpcthreads|rpcworkqueue)=/ {
-        if (seen[$1]++) next
-    }
-    { print }
-' "$conf" > "$tmp"
-if ! cmp -s "$conf" "$tmp"; then
-    cat "$tmp" > "$conf"
-    changed=1
-fi
-rm -f "$tmp"
-ensure_line() {
-    line="$1"
-    key="${line%%=*}"
-    if ! grep -q "^${key}=" "$conf"; then
-        printf '%s\n' "$line" >> "$conf"
-        changed=1
-    fi
-}
-ensure_line server=1
-ensure_line rpcbind=0.0.0.0
-ensure_line rpcallowip=0.0.0.0/0
-ensure_line listen=1
-ensure_line rpcthreads=16
-ensure_line rpcworkqueue=256
-[ "$changed" -eq 0 ] && exit 0
+mv "$conf" "$conf.disabled-$(date +%s)"
 exit 2
 "#;
     let status = host_sudo(&["sh", "-lc", script])
         .await
-        .context("ensure bitcoin.conf RPC bind settings")?;
+        .context("remove stale bitcoin.conf")?;
     match status.code() {
         Some(0) => Ok(false),
         Some(2) => {
-            install_log("INSTALL REPAIR: bitcoin.conf RPC bind settings added").await;
+            install_log(
+                "INSTALL REPAIR: removed stale bitcoin.conf (conflicts with -conf=/tmp/rpc.conf launch)",
+            )
+            .await;
             Ok(true)
         }
         _ => Err(anyhow::anyhow!(
-            "bitcoin.conf RPC repair helper exited with {}",
+            "bitcoin.conf removal helper exited with {}",
             status
         )),
     }
diff --git a/core/archipelago/src/bootstrap.rs b/core/archipelago/src/bootstrap.rs
index 2739ff1c..644f806f 100644
--- a/core/archipelago/src/bootstrap.rs
+++ b/core/archipelago/src/bootstrap.rs
@@ -154,9 +154,9 @@ pub async fn ensure_doctor_installed() {
     }
     match run_bitcoin_rpc_repair().await {
         Ok(true) => {
-            info!("Repaired Bitcoin RPC bind settings; running Bitcoin containers left untouched")
+            info!("Removed stale bitcoin.conf; running Bitcoin containers left untouched")
         }
-        Ok(false) => debug!("Bitcoin RPC bind settings already usable"),
+        Ok(false) => debug!("No stale bitcoin.conf found"),
         Err(e) => warn!("Bitcoin RPC repair failed (non-fatal): {:#}", e),
     }
     match run_apps_dir_repair().await {
@@ -577,52 +577,30 @@ exit 2
 }
 
 async fn run_bitcoin_rpc_repair() -> Result<bool> {
-    // Older installs can have a container-owned bitcoin.conf with only rpcauth
-    // and printtoconsole. Repair it at startup so OTA fixes existing nodes
-    // without a manual uninstall/reinstall. Bind/port stay in the container
-    // command line to avoid duplicate RPC endpoint definitions.
+    // bitcoind is launched with -conf=/tmp/rpc.conf and never reads a
+    // datadir bitcoin.conf (apps/bitcoin-core & bitcoin-knots manifest.yml,
+    // commit a597c1d9 — bind/port live only on the container command line).
+    // A leftover file from an older install makes Bitcoin Core's own
+    // datadir-conflict safety check refuse to start on every subsequent
+    // start. Remove it instead of "repairing" it into existence — this
+    // previously wrote server=/rpcbind=/rpcallowip=/listen= into the file,
+    // which is exactly what caused the conflict.
     let script = r#"
 set -eu
 conf=/var/lib/archipelago/bitcoin/bitcoin.conf
 [ -f "$conf" ] || exit 0
-changed=0
-ensure_line() {
-    line="$1"
-    key="${line%%=*}"
-    if ! grep -q "^${key}=" "$conf"; then
-        printf '%s\n' "$line" >> "$conf"
-        changed=1
-    fi
-}
-ensure_line server=1
-# rpcbind=0.0.0.0 is required inside the container: with rpcallowip set but
-# no rpcbind, bitcoind binds RPC to the container's loopback only and every
-# dial over the container network (LND, bitcoin-ui) is refused — the fresh-
-# install "LND took 5 attempts" / bitcoin-rpc 502 failure (host publish stays
-# 127.0.0.1-only, so exposure is unchanged).
-ensure_line rpcbind=0.0.0.0
-ensure_line rpcallowip=0.0.0.0/0
-ensure_line listen=1
-# Log-volume fix: printtoconsole=1 duplicated every log line (incl. per-block
-# IBD "UpdateTip" spam) into journald via conmon on top of the datadir
-# debug.log bitcoind already writes. Console off; debug.log stays (bitcoind
-# self-shrinks it on restart).
-if grep -q '^printtoconsole=1' "$conf"; then
-    sed -i 's/^printtoconsole=1$/printtoconsole=0/' "$conf"
-    changed=1
-fi
-[ "$changed" -eq 0 ] && exit 0
+mv "$conf" "$conf.disabled-$(date +%s)"
 exit 2
 "#;
     let status = host_sudo(&["sh", "-lc", script])
         .await
-        .context("repair bitcoin.conf RPC bind settings")?;
+        .context("remove stale bitcoin.conf RPC bind settings")?;
     match status.code() {
         Some(0) => Ok(false),
         // Do not restart Bitcoin from bootstrap. During IBD, an automatic
-        // restart can cost hours of progress. The repaired file is only a
-        // fallback for future starts; current containers keep their command-line
-        // RPC args until an operator or update intentionally restarts them.
+        // restart can cost hours of progress. Removing the stale file is
+        // only a fallback for future starts; current containers keep their
+        // command-line RPC args regardless.
         Some(2) => Ok(true),
         _ => {
             warn!("Bitcoin RPC repair helper exited with {}", status);

From 9d225473b11d6cb76daf559fea9f48edbb5a435e Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 02:49:36 -0400
Subject: [PATCH 03/60] docs(1.7.121): record what shipped, both gate
 incidents, and the .122 queue

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .planning/RELEASE-1.7.121-TASKS.md | 64 ++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/.planning/RELEASE-1.7.121-TASKS.md b/.planning/RELEASE-1.7.121-TASKS.md
index ed5e769d..7542bda1 100644
--- a/.planning/RELEASE-1.7.121-TASKS.md
+++ b/.planning/RELEASE-1.7.121-TASKS.md
@@ -443,6 +443,70 @@ below is dead on every path. Pre-existing; spotted in the v1.7.120 build warning
 
 ---
 
+## STATUS 2026-08-04 — what shipped in 1.7.121 and what did not
+
+### Shipped (committed + pushed)
+
+| Item | Commit | Verified |
+|---|---|---|
+| 3. Federation trust escalation | `c0cfc72a` | 42/42 federation tests |
+| 3b. Trusted requires node password | `24ce8b39` | 44/44 + 79/79 + vue-tsc |
+| 4. lnd-ui OTA pin + host networking | `5088aef5` | — |
+| 1b. Manifest `auth:` declarations | `0c4826f8` | 73/73, all 56 manifests parse |
+| 1c. App gate (engine + audit) | `0de67ca6` | 23/23 appgate |
+| Dashboard backdrop-filter seam | `63d0183d` | 3/3, **live on archi-dev-box** |
+| 7. Release refuses unsigned manifest | `cc9e1958` | dry-run: signed/stripped/wrong-signer |
+| Gate safety model (`Option<PortAuth>`) | `ab2c8b6e` | 75/75 incl. LND wallet-port case |
+| Companion rebuild-loop | `719446c0` | podman behaviour proven first |
+| 5. Federated peers messageable | `edc9a172` | predicate pinned across device types |
+
+### The two gate incidents — read before touching the gate again
+
+Both were ONE mistake: a safety decision read an ABSENT manifest field as a
+value. A node's installed manifests always lag the binary, so "absent" is the
+normal state, and the daemon acted on instructions no manifest ever gave.
+
+1. Gating any `session` port regardless of `bind` **published Bitcoin's
+   loopback-only RPC 8332 on the LAN/Tailscale/IPv6** within seconds of deploy.
+2. The `bind`-keyed replacement looked safe (it protected `bind: 127.0.0.1`)
+   but LND's gRPC 10009 / REST 18080 carry an EMPTY bind — one container
+   recreate from pinning them to loopback and **breaking Zeus and every remote
+   wallet**.
+
+Now structural: `auth_policy()` classifies (undeclared → reported as
+unprotected, always safe), `auth_is_declared()` gates action (undeclared →
+never acted on). **Silence is not consent.**
+
+### Proven on the node, empirically, not by reasoning
+
+- Gate challenge → login → proxy works end to end over LAN and Tailscale.
+- **Daemon-side publish rewriting was removed.** Publishes are built in several
+  places (`podman_client`, `package::install`, `stacks`); patching one covered
+  one — the strfry recreate went through another and the pin never fired.
+- **Disk manifest edits do not apply to catalog-covered apps.** Even
+  `bind: 127.0.0.1` written into the node's strfry manifest was overridden by
+  the signed catalog. The catalog re-sign is REQUIRED; there is no shortcut.
+- A loopback-bound host port is **unreachable** from a pasta container, so
+  loopback-pinning the Wyoming ports would break Home Assistant voice.
+
+### Open for 1.7.122
+
+1. **Catalog re-sign** — `bind: 127.0.0.1` + `auth: session` on the ~39 gated
+   UI ports. This is what turns the gate from auditing into enforcing. Nothing
+   in code can substitute for it.
+2. **Release-root rotation** — branch `rotate-release-root`, key
+   `did:key:z6Mkfu5LT…DLWT` / `1578adcc…4418`, validated as a real curve point.
+   **Sign the rotation release with the OLD key**; only the release after it
+   uses the new one. Re-sign the catalog too.
+3. **Wyoming voice ports** (10200/10300/10400) — unauthenticated, and by the
+   operator's policy they should not be. Correct fix is co-locating Home
+   Assistant with the pine services on one container network so nothing is
+   published; needs a node running both.
+4. **Item 2** filebrowser default login. **Items 6/6b** app updates +
+   multiversion (`versions[]` already exists, populated for 2 of 66 apps).
+5. **`cargo-test-weekly` times out** at its 1500s cap on a loaded box — raise
+   the cap or split the stage; it is not a code failure.
+
 ## RESUME HERE — next session
 
 **Landed this session (both pushed):**

From cd58242935206875396ae995aacb5d1c16ccff48 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 03:13:45 -0400
Subject: [PATCH 04/60] chore: release v1.7.121-alpha

---
 core/archipelago/Cargo.toml |  2 +-
 neode-ui/package-lock.json  |  4 ++--
 neode-ui/package.json       |  2 +-
 release-manifest.json       | 46 ++++++++++++++++++-------------------
 releases/manifest.json      | 46 ++++++++++++++++++-------------------
 5 files changed, 48 insertions(+), 52 deletions(-)

diff --git a/core/archipelago/Cargo.toml b/core/archipelago/Cargo.toml
index 9308b365..a956dab5 100644
--- a/core/archipelago/Cargo.toml
+++ b/core/archipelago/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.120-alpha"
+version = "1.7.121-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
diff --git a/neode-ui/package-lock.json b/neode-ui/package-lock.json
index adf78675..415000a7 100644
--- a/neode-ui/package-lock.json
+++ b/neode-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.120-alpha",
+  "version": "1.7.121-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.120-alpha",
+      "version": "1.7.121-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
diff --git a/neode-ui/package.json b/neode-ui/package.json
index 4330e60c..2f1cc1eb 100644
--- a/neode-ui/package.json
+++ b/neode-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.120-alpha",
+  "version": "1.7.121-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",
diff --git a/release-manifest.json b/release-manifest.json
index 24f23112..8c2b689d 100644
--- a/release-manifest.json
+++ b/release-manifest.json
@@ -1,36 +1,34 @@
 {
   "changelog": [
-    "**Security, and the reason to take this update: two ports on your node handed anyone who could reach them complete control of your money, with no password.** The Lightning app's port answered a plain web request with the LND admin macaroon, the TLS certificate and the node's onion address — everything needed to drain the wallet remotely, and the onion meant an attacker kept that ability even after losing access to your network. The Bitcoin app's port reached Bitcoin Core's control interface using credentials the node itself supplied on the caller's behalf, with a wallet loaded. Anything on your home network, your Tailscale network or the mesh could use either one. Both now require you to be logged in. If your node has been reachable by anyone you do not fully trust, treat the Lightning macaroon and the Bitcoin RPC password as known to them.",
-    "The Bitcoin and Lightning app screens can no longer be published as public Tor addresses automatically. They were one app-id away from being handed a worldwide, permanent address as a silent side effect of being installed — which would have re-opened the hole above to the entire internet. Turning Tor on for them deliberately still works; it just never happens on its own.",
-    "**Fixes shipped inside the program now actually reach apps that your system keeps running.** A container the node had been told to uninstall, but that the system service manager kept alive anyway, was quietly skipped by the part of the node that applies configuration — so it never received updates that shipped with the program. This was found the hard way: the Bitcoin control-interface fix above appeared to be installed and silently was not, while the Lightning half applied correctly, which is the most misleading way for a security fix to fail. Both halves are now proven to land on a real node.",
-    "The Lightning and Bitcoin node screens have been rebuilt to match what umbrelOS offers. Lightning gains Overview, Channels, Activity, Insights, Connect and Settings tabs with a sats/BTC switch; Bitcoin gains Insights, Peers, Connect and Sharing. Along the way: every copy button on those screens silently did nothing (the browser blocks clipboard access inside an embedded page) and now works; the channels link led to a dead page; and Node ID showed a bare key instead of the full address someone can actually connect to.",
-    "Updates to the Bitcoin screen show up without a hard refresh. The page was being cached by the browser, so a freshly updated screen kept rendering the previous one.",
-    "The AI sidebar loads again. It was asking for its program files at an address that pointed at the main app's files, where they do not exist, so it silently loaded nothing.",
-    "The navigation above the bottom bar no longer follows you between screens. Back buttons and the mesh tab bar stayed pinned over every other page once you had visited the screen that owns them. Keeping tabs loaded in the background — the change that made switching between them instant — means leaving a screen hides it rather than destroying it, and this floating navigation sits outside the screen it belongs to, so it was never being hidden with it. It is now tied to whether its own screen is on display. The speed is unchanged: the screens are still kept loaded, so returning to one is still instant.",
-    "Wallet: Lightning actions are now offered based on whether you actually have a usable channel rather than just a running node, sending is gated the same way, and an invoice you cannot yet receive offers to install a Lightning node instead of simply failing.",
-    "Onboarding and viewing fixes: the \"I have written down my recovery words\" tickbox is findable on short screens, paid pictures and videos open in the app's own viewer with a visible loading state instead of a blank browser tab, picture-in-picture survives changing tabs, and the FIPS/Tor labels on peer cards stay put instead of wrapping into the card below.",
-    "Key-material hardening across the node: a node that is already set up refuses to have its identity replaced by an unauthenticated request; first-boot secret generation now fails loudly instead of silently continuing with shared keys; the node proves its TLS certificate and key are actually a matching pair; the Bitcoin Core wallet path that kept a second copy of your spending key outside the encrypted store has been removed; and every place the node generates a key, token or nonce now names its source of randomness explicitly, enforced at build time."
+    "**Making another node \"Trusted\" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.",
+    "**Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.",
+    "The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.",
+    "The Lightning screen will actually update from now on. Its image was set to \"latest\", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.",
+    "Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.",
+    "Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.",
+    "Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.",
+    "Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision)."
   ],
   "components": [
     {
-      "current_version": "1.7.120-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.120-alpha/archipelago",
+      "current_version": "1.7.121-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.120-alpha",
-      "sha256": "304255655a22bae605d728d44e857ed170a19833b6237861fdf7d852d25d9680",
-      "size_bytes": 54017008
+      "new_version": "1.7.121-alpha",
+      "sha256": "be5ef9fb284f539b06329d4108be53e55ae8cdb06cf1cf4beb90363de364706d",
+      "size_bytes": 54870968
     },
     {
-      "current_version": "1.7.120-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.120-alpha/archipelago-frontend-1.7.120-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.120-alpha.tar.gz",
-      "new_version": "1.7.120-alpha",
-      "sha256": "cb9ea4dfcea3ac93dfb1ce1dca96ea30c74a4e6354471cde4d8f75c0441850a5",
-      "size_bytes": 210519311
+      "current_version": "1.7.121-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago-frontend-1.7.121-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.121-alpha.tar.gz",
+      "new_version": "1.7.121-alpha",
+      "sha256": "7898a9c11fa30cadc8f0fcf814bba1e3870d20663472f4c40e8e663b2359958f",
+      "size_bytes": 210526689
     }
   ],
-  "release_date": "2026-08-03",
-  "signature": "e76e0ca5f249111a0a57df07f790997b1a4facf97da11a2d13fcb7ec9b80aea82925244d6083544504260b776ca4317cf44774e2c37bfaa13afae248e9675601",
+  "release_date": "2026-08-04",
+  "signature": "9d871c946e941b3c13f75fb799d8428841147267f4565920993ddd3aa0cd52d6d1a74481303cbbb26e68e6e5d44e2b711c9b7a22ad7dd73c94b4d3e39a0e2803",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.120-alpha"
+  "version": "1.7.121-alpha"
 }
diff --git a/releases/manifest.json b/releases/manifest.json
index 24f23112..8c2b689d 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,36 +1,34 @@
 {
   "changelog": [
-    "**Security, and the reason to take this update: two ports on your node handed anyone who could reach them complete control of your money, with no password.** The Lightning app's port answered a plain web request with the LND admin macaroon, the TLS certificate and the node's onion address — everything needed to drain the wallet remotely, and the onion meant an attacker kept that ability even after losing access to your network. The Bitcoin app's port reached Bitcoin Core's control interface using credentials the node itself supplied on the caller's behalf, with a wallet loaded. Anything on your home network, your Tailscale network or the mesh could use either one. Both now require you to be logged in. If your node has been reachable by anyone you do not fully trust, treat the Lightning macaroon and the Bitcoin RPC password as known to them.",
-    "The Bitcoin and Lightning app screens can no longer be published as public Tor addresses automatically. They were one app-id away from being handed a worldwide, permanent address as a silent side effect of being installed — which would have re-opened the hole above to the entire internet. Turning Tor on for them deliberately still works; it just never happens on its own.",
-    "**Fixes shipped inside the program now actually reach apps that your system keeps running.** A container the node had been told to uninstall, but that the system service manager kept alive anyway, was quietly skipped by the part of the node that applies configuration — so it never received updates that shipped with the program. This was found the hard way: the Bitcoin control-interface fix above appeared to be installed and silently was not, while the Lightning half applied correctly, which is the most misleading way for a security fix to fail. Both halves are now proven to land on a real node.",
-    "The Lightning and Bitcoin node screens have been rebuilt to match what umbrelOS offers. Lightning gains Overview, Channels, Activity, Insights, Connect and Settings tabs with a sats/BTC switch; Bitcoin gains Insights, Peers, Connect and Sharing. Along the way: every copy button on those screens silently did nothing (the browser blocks clipboard access inside an embedded page) and now works; the channels link led to a dead page; and Node ID showed a bare key instead of the full address someone can actually connect to.",
-    "Updates to the Bitcoin screen show up without a hard refresh. The page was being cached by the browser, so a freshly updated screen kept rendering the previous one.",
-    "The AI sidebar loads again. It was asking for its program files at an address that pointed at the main app's files, where they do not exist, so it silently loaded nothing.",
-    "The navigation above the bottom bar no longer follows you between screens. Back buttons and the mesh tab bar stayed pinned over every other page once you had visited the screen that owns them. Keeping tabs loaded in the background — the change that made switching between them instant — means leaving a screen hides it rather than destroying it, and this floating navigation sits outside the screen it belongs to, so it was never being hidden with it. It is now tied to whether its own screen is on display. The speed is unchanged: the screens are still kept loaded, so returning to one is still instant.",
-    "Wallet: Lightning actions are now offered based on whether you actually have a usable channel rather than just a running node, sending is gated the same way, and an invoice you cannot yet receive offers to install a Lightning node instead of simply failing.",
-    "Onboarding and viewing fixes: the \"I have written down my recovery words\" tickbox is findable on short screens, paid pictures and videos open in the app's own viewer with a visible loading state instead of a blank browser tab, picture-in-picture survives changing tabs, and the FIPS/Tor labels on peer cards stay put instead of wrapping into the card below.",
-    "Key-material hardening across the node: a node that is already set up refuses to have its identity replaced by an unauthenticated request; first-boot secret generation now fails loudly instead of silently continuing with shared keys; the node proves its TLS certificate and key are actually a matching pair; the Bitcoin Core wallet path that kept a second copy of your spending key outside the encrypted store has been removed; and every place the node generates a key, token or nonce now names its source of randomness explicitly, enforced at build time."
+    "**Making another node \"Trusted\" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.",
+    "**Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.",
+    "The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.",
+    "The Lightning screen will actually update from now on. Its image was set to \"latest\", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.",
+    "Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.",
+    "Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.",
+    "Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.",
+    "Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision)."
   ],
   "components": [
     {
-      "current_version": "1.7.120-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.120-alpha/archipelago",
+      "current_version": "1.7.121-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.120-alpha",
-      "sha256": "304255655a22bae605d728d44e857ed170a19833b6237861fdf7d852d25d9680",
-      "size_bytes": 54017008
+      "new_version": "1.7.121-alpha",
+      "sha256": "be5ef9fb284f539b06329d4108be53e55ae8cdb06cf1cf4beb90363de364706d",
+      "size_bytes": 54870968
     },
     {
-      "current_version": "1.7.120-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.120-alpha/archipelago-frontend-1.7.120-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.120-alpha.tar.gz",
-      "new_version": "1.7.120-alpha",
-      "sha256": "cb9ea4dfcea3ac93dfb1ce1dca96ea30c74a4e6354471cde4d8f75c0441850a5",
-      "size_bytes": 210519311
+      "current_version": "1.7.121-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago-frontend-1.7.121-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.121-alpha.tar.gz",
+      "new_version": "1.7.121-alpha",
+      "sha256": "7898a9c11fa30cadc8f0fcf814bba1e3870d20663472f4c40e8e663b2359958f",
+      "size_bytes": 210526689
     }
   ],
-  "release_date": "2026-08-03",
-  "signature": "e76e0ca5f249111a0a57df07f790997b1a4facf97da11a2d13fcb7ec9b80aea82925244d6083544504260b776ca4317cf44774e2c37bfaa13afae248e9675601",
+  "release_date": "2026-08-04",
+  "signature": "9d871c946e941b3c13f75fb799d8428841147267f4565920993ddd3aa0cd52d6d1a74481303cbbb26e68e6e5d44e2b711c9b7a22ad7dd73c94b4d3e39a0e2803",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.120-alpha"
+  "version": "1.7.121-alpha"
 }

From 4e455167e9ca83eb0e868c991c2a29fc68eb3601 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 03:23:28 -0400
Subject: [PATCH 05/60] fix(release): accept https remotes when publishing
 assets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Publishing v1.7.121-alpha failed on auth after the manifest had already
passed every check. The script required an `http://user:token@` remote,
which left only `gitea-vps2` — whose token is dead — and rejected
`gitea-ai`, the https remote whose credential actually works for git
push. Same Gitea instance (146.59.87.168, v1.27.1) either way, so the
restriction bought nothing and blocked the one usable path.

Accepts http and https, and carries the scheme through to the API URL
instead of hardcoding it.

Note for diagnosis next time: `/api/v1/repos/.../releases` is publicly
readable, so a 200 there does NOT prove the credential works. Use
`/api/v1/user`, which requires real auth.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/publish-release-assets.sh | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/scripts/publish-release-assets.sh b/scripts/publish-release-assets.sh
index 1650d0a9..90a609eb 100755
--- a/scripts/publish-release-assets.sh
+++ b/scripts/publish-release-assets.sh
@@ -39,18 +39,25 @@ if [ -x "$PROJECT_ROOT/core/target/release/archipelago" ]; then
 fi
 
 remote_url=$(git -C "$PROJECT_ROOT" remote get-url "$REMOTE")
+# https is accepted as well as http. Requiring http:// meant the only remote
+# whose credential actually works for git push (the https one) was rejected,
+# while the http remote it forced you to use had a dead token — so publishing
+# failed on auth after the manifest had already passed every check
+# (v1.7.121-alpha, 2026-08-04). The scheme is carried through to the API URL
+# rather than assumed.
 case "$remote_url" in
-    http://*@*) ;;
-    *) fail "$REMOTE must be an authenticated http:// Gitea remote URL for API uploads" ;;
+    http://*@*|https://*@*) ;;
+    *) fail "$REMOTE must be an authenticated http(s):// Gitea remote URL for API uploads" ;;
 esac
 
-auth=${remote_url#http://}
-auth=${auth%@*}
-host_path=${remote_url#http://$auth@}
+scheme=${remote_url%%://*}
+rest=${remote_url#*://}
+auth=${rest%%@*}
+host_path=${rest#*@}
 host=${host_path%%/*}
 repo_path=${host_path#*/}
 repo_path=${repo_path%.git}
-api="http://$host/api/v1/repos/$repo_path"
+api="$scheme://$host/api/v1/repos/$repo_path"
 release_url="$api/releases/tags/v${VERSION}"
 
 echo "Pushing main and v${VERSION} to $REMOTE..."

From 16642ad8b803761e20e15ec41a760c068fb179eb Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 06:09:37 -0400
Subject: [PATCH 06/60] feat(security): declare port auth policy across the app
 manifests

20 HTTP UIs move to bind: 127.0.0.1 + auth: gated (the daemon owns their
external addresses and authenticates every connection); 5 loopback-only
backends declare auth: local so the gate keeps its hands off. Protocol
ports (LND, bitcoin p2p, electrum, CLN, gitea SSH, Wyoming, mDNS/SSDP)
were already declared auth: none with rationales in earlier commits.

Inert until the catalog is re-signed: nodes act only on declared fields
delivered via the signed catalog, and the catalog overlay overrides these
disk manifests everywhere they are installed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/archy-mempool-web/manifest.yml | 2 ++
 apps/archy-nbxplorer/manifest.yml   | 2 ++
 apps/barkd/manifest.yml             | 2 ++
 apps/btcpay-server/manifest.yml     | 2 ++
 apps/did-wallet/manifest.yml        | 2 ++
 apps/fedimint-clientd/manifest.yml  | 2 ++
 apps/fedimint/manifest.yml          | 2 ++
 apps/filebrowser/manifest.yml       | 2 ++
 apps/gitea/manifest.yml             | 2 ++
 apps/grafana/manifest.yml           | 2 ++
 apps/home-assistant/manifest.yml    | 2 ++
 apps/immich/manifest.yml            | 2 ++
 apps/indeedhub/manifest.yml         | 2 ++
 apps/jellyfin/manifest.yml          | 2 ++
 apps/mempool-api/manifest.yml       | 2 ++
 apps/mempool/manifest.yml           | 2 ++
 apps/morphos-server/manifest.yml    | 2 ++
 apps/nextcloud/manifest.yml         | 2 ++
 apps/nostr-rs-relay/manifest.yml    | 2 ++
 apps/photoprism/manifest.yml        | 2 ++
 apps/portainer/manifest.yml         | 2 ++
 apps/searxng/manifest.yml           | 2 ++
 apps/strfry/manifest.yml            | 2 ++
 apps/uptime-kuma/manifest.yml       | 2 ++
 apps/vaultwarden/manifest.yml       | 2 ++
 25 files changed, 50 insertions(+)

diff --git a/apps/archy-mempool-web/manifest.yml b/apps/archy-mempool-web/manifest.yml
index 6d84df8d..d18acc76 100644
--- a/apps/archy-mempool-web/manifest.yml
+++ b/apps/archy-mempool-web/manifest.yml
@@ -26,6 +26,8 @@ app:
     - host: 4080
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   environment:
     - FRONTEND_HTTP_PORT=8080
diff --git a/apps/archy-nbxplorer/manifest.yml b/apps/archy-nbxplorer/manifest.yml
index 21ce43bf..a13c1bb7 100644
--- a/apps/archy-nbxplorer/manifest.yml
+++ b/apps/archy-nbxplorer/manifest.yml
@@ -33,6 +33,8 @@ app:
     - host: 32838
       container: 32838
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind
diff --git a/apps/barkd/manifest.yml b/apps/barkd/manifest.yml
index 5ba3d40d..171ed869 100644
--- a/apps/barkd/manifest.yml
+++ b/apps/barkd/manifest.yml
@@ -51,6 +51,8 @@ app:
     - host: 3535
       container: 3535
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Holds the wallet DB, mnemonic and auth token. ARK funds are recoverable
diff --git a/apps/btcpay-server/manifest.yml b/apps/btcpay-server/manifest.yml
index 8f42a95c..703a9f0c 100644
--- a/apps/btcpay-server/manifest.yml
+++ b/apps/btcpay-server/manifest.yml
@@ -45,6 +45,8 @@ app:
     - host: 23000
       container: 49392
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/did-wallet/manifest.yml b/apps/did-wallet/manifest.yml
index c89f6561..413df0a2 100644
--- a/apps/did-wallet/manifest.yml
+++ b/apps/did-wallet/manifest.yml
@@ -30,6 +30,8 @@ app:
     - host: 8088
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/fedimint-clientd/manifest.yml b/apps/fedimint-clientd/manifest.yml
index 38d81bba..898b31be 100644
--- a/apps/fedimint-clientd/manifest.yml
+++ b/apps/fedimint-clientd/manifest.yml
@@ -66,6 +66,8 @@ app:
     - host: 8178
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Same dir the first-boot bundled path uses + where the wallet bridge reads
diff --git a/apps/fedimint/manifest.yml b/apps/fedimint/manifest.yml
index 88f17e15..c3c7985a 100644
--- a/apps/fedimint/manifest.yml
+++ b/apps/fedimint/manifest.yml
@@ -58,6 +58,8 @@ app:
     - host: 8177
       container: 8175
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind
diff --git a/apps/filebrowser/manifest.yml b/apps/filebrowser/manifest.yml
index 2d24bc14..a47b9431 100644
--- a/apps/filebrowser/manifest.yml
+++ b/apps/filebrowser/manifest.yml
@@ -27,6 +27,8 @@ app:
     - host: 8083
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/gitea/manifest.yml b/apps/gitea/manifest.yml
index 4926ba3f..0a4a2293 100644
--- a/apps/gitea/manifest.yml
+++ b/apps/gitea/manifest.yml
@@ -26,6 +26,8 @@ app:
     - host: 3001
       container: 3000
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
     - host: 2222
       container: 22
       protocol: tcp
diff --git a/apps/grafana/manifest.yml b/apps/grafana/manifest.yml
index ed6a6b42..3ef6938a 100644
--- a/apps/grafana/manifest.yml
+++ b/apps/grafana/manifest.yml
@@ -31,6 +31,8 @@ app:
     - host: 3000
       container: 3000
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/home-assistant/manifest.yml b/apps/home-assistant/manifest.yml
index 135db17b..7a4c3a2f 100644
--- a/apps/home-assistant/manifest.yml
+++ b/apps/home-assistant/manifest.yml
@@ -30,6 +30,8 @@ app:
     - host: 8123
       container: 8123
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/immich/manifest.yml b/apps/immich/manifest.yml
index 73fff674..a09b23dd 100644
--- a/apps/immich/manifest.yml
+++ b/apps/immich/manifest.yml
@@ -44,6 +44,8 @@ app:
     - host: 2283
       container: 2283
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/indeedhub/manifest.yml b/apps/indeedhub/manifest.yml
index 471678c4..a71f6777 100644
--- a/apps/indeedhub/manifest.yml
+++ b/apps/indeedhub/manifest.yml
@@ -38,6 +38,8 @@ app:
     - host: 7778
       container: 7777
       protocol: tcp  # Web UI. Port 7777 on the host is reserved for the Nostr relay.
+      bind: 127.0.0.1
+      auth: gated
 
   # Writable scratch the baked nginx needs; matches the legacy installer's
   # --tmpfs /run + /var/cache/nginx.
diff --git a/apps/jellyfin/manifest.yml b/apps/jellyfin/manifest.yml
index 7234c1c8..94ab1424 100644
--- a/apps/jellyfin/manifest.yml
+++ b/apps/jellyfin/manifest.yml
@@ -25,6 +25,8 @@ app:
     - host: 8096
       container: 8096
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/mempool-api/manifest.yml b/apps/mempool-api/manifest.yml
index 24b628ce..9bf8fe27 100644
--- a/apps/mempool-api/manifest.yml
+++ b/apps/mempool-api/manifest.yml
@@ -42,6 +42,8 @@ app:
     - host: 8999
       container: 8999
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind
diff --git a/apps/mempool/manifest.yml b/apps/mempool/manifest.yml
index fbaf7263..ee64420b 100644
--- a/apps/mempool/manifest.yml
+++ b/apps/mempool/manifest.yml
@@ -33,6 +33,8 @@ app:
     - host: 4080
       container: 8080  # mempool-frontend nginx listens on 8080 (FRONTEND_HTTP_PORT=8080)
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/morphos-server/manifest.yml b/apps/morphos-server/manifest.yml
index dd032bf4..32975649 100644
--- a/apps/morphos-server/manifest.yml
+++ b/apps/morphos-server/manifest.yml
@@ -30,6 +30,8 @@ app:
     - host: 8089
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/nextcloud/manifest.yml b/apps/nextcloud/manifest.yml
index a8165868..6fb16d44 100644
--- a/apps/nextcloud/manifest.yml
+++ b/apps/nextcloud/manifest.yml
@@ -25,6 +25,8 @@ app:
     - host: 8085
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/nostr-rs-relay/manifest.yml b/apps/nostr-rs-relay/manifest.yml
index 975a07ae..5bfb5bde 100644
--- a/apps/nostr-rs-relay/manifest.yml
+++ b/apps/nostr-rs-relay/manifest.yml
@@ -31,6 +31,8 @@ app:
     - host: 18081
       container: 8080
       protocol: tcp  # HTTP/WebSocket
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/photoprism/manifest.yml b/apps/photoprism/manifest.yml
index 485d5936..88cbcb73 100644
--- a/apps/photoprism/manifest.yml
+++ b/apps/photoprism/manifest.yml
@@ -24,6 +24,8 @@ app:
     - host: 2342
       container: 2342
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/portainer/manifest.yml b/apps/portainer/manifest.yml
index 2307b504..70fdac89 100644
--- a/apps/portainer/manifest.yml
+++ b/apps/portainer/manifest.yml
@@ -27,6 +27,8 @@ app:
     - host: 9000
       container: 9000
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/searxng/manifest.yml b/apps/searxng/manifest.yml
index 1eeb727d..0727ff36 100644
--- a/apps/searxng/manifest.yml
+++ b/apps/searxng/manifest.yml
@@ -29,6 +29,8 @@ app:
     - host: 8888
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind
diff --git a/apps/strfry/manifest.yml b/apps/strfry/manifest.yml
index ef74ed72..eac12a1d 100644
--- a/apps/strfry/manifest.yml
+++ b/apps/strfry/manifest.yml
@@ -29,6 +29,8 @@ app:
     - host: 8090
       container: 7777
       protocol: tcp  # HTTP/WebSocket (strfry listens on 7777)
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/uptime-kuma/manifest.yml b/apps/uptime-kuma/manifest.yml
index e58f0bbe..391b3c88 100644
--- a/apps/uptime-kuma/manifest.yml
+++ b/apps/uptime-kuma/manifest.yml
@@ -26,6 +26,8 @@ app:
     - host: 3002
       container: 3001
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind
diff --git a/apps/vaultwarden/manifest.yml b/apps/vaultwarden/manifest.yml
index 2f3d49d3..1e85629f 100644
--- a/apps/vaultwarden/manifest.yml
+++ b/apps/vaultwarden/manifest.yml
@@ -25,6 +25,8 @@ app:
     - host: 8082
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

From 6d9d87caa6c668521906082973a516173c1571df Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 06:09:37 -0400
Subject: [PATCH 07/60] chore: sync Cargo.lock with the 1.7.121-alpha version
 bump

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/Cargo.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/Cargo.lock b/core/Cargo.lock
index fb7dfa18..6453ad1a 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.120-alpha"
+version = "1.7.121-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

From 8210ca0a2aa227b6abcda42b6014571797da77ea Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 06:28:06 -0400
Subject: [PATCH 08/60] =?UTF-8?q?chore(catalog):=20sign=20catalog=20with?=
 =?UTF-8?q?=20port=20auth=20policy=20=E2=80=94=2020=20UIs=20gated,=20exemp?=
 =?UTF-8?q?tions=20declared?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Embeds the manifest port declarations (bind: 127.0.0.1 + auth: gated on 20
HTTP UIs, auth: local on loopback backends, auth: none + rationale on
protocol ports) into the signed catalog so nodes enforce the app gate.
Also carries bitcoin-ui/lnd-ui 1.7.119 version drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 releases/app-catalog.json | 109 +++++++++++++++++++++++++++++++++-----
 1 file changed, 95 insertions(+), 14 deletions(-)

diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index bb2eb1ff..11feb497 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -25,6 +25,7 @@
           "name": "AI Assistant",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 80,
               "host": 5180,
@@ -228,6 +229,8 @@
           "name": "Mempool Web",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 4080,
               "protocol": "tcp"
@@ -302,6 +305,8 @@
           "name": "NBXplorer",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 32838,
               "host": 32838,
               "protocol": "tcp"
@@ -374,6 +379,8 @@
           "name": "Ark Wallet",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 3535,
               "host": 3535,
               "protocol": "tcp"
@@ -462,12 +469,15 @@
           "name": "Bitcoin Core",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 8332,
               "host": 8332,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
               "container": 8333,
               "host": 8333,
               "protocol": "tcp"
@@ -605,12 +615,15 @@
           "name": "Bitcoin Knots",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 8332,
               "host": 8332,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
               "container": 8333,
               "host": 8333,
               "protocol": "tcp"
@@ -671,7 +684,7 @@
       ]
     },
     "bitcoin-ui": {
-      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha",
+      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.119-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -719,7 +732,7 @@
           ]
         }
       },
-      "version": "1.7.84-alpha"
+      "version": "1.7.119-alpha"
     },
     "botfights": {
       "manifest": {
@@ -931,6 +944,8 @@
           "name": "BTCPay Server",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 49392,
               "host": 23000,
               "protocol": "tcp"
@@ -1001,11 +1016,15 @@
           "name": "Core Lightning (CLN)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9736,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Core Lightning gRPC, authenticated by mutual TLS client certificates.",
               "container": 9835,
               "host": 9835,
               "protocol": "tcp"
@@ -1075,6 +1094,8 @@
           "name": "Web5 DID Wallet",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8088,
               "protocol": "tcp"
@@ -1219,6 +1240,8 @@
           "name": "ElectrumX",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Electrum wire protocol over TCP. Electrum wallets speak it directly and cannot hold a session cookie.",
               "container": 50001,
               "host": 50001,
               "protocol": "tcp"
@@ -1342,6 +1365,8 @@
               "protocol": "tcp"
             },
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8175,
               "host": 8177,
               "protocol": "tcp"
@@ -1416,6 +1441,8 @@
           "name": "Fedimint Client",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8178,
               "protocol": "tcp"
@@ -1601,6 +1628,8 @@
           "name": "File Browser",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8083,
               "protocol": "tcp"
@@ -1753,11 +1782,15 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3000,
               "host": 3001,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Git over SSH, authenticated by the user's own SSH keypair. Not HTTP, so the gate cannot serve a login page here.",
               "container": 22,
               "host": 2222,
               "protocol": "tcp"
@@ -1842,6 +1875,8 @@
           "name": "Grafana",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3000,
               "host": 3000,
               "protocol": "tcp"
@@ -1925,6 +1960,8 @@
           "name": "Home Assistant",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8123,
               "host": 8123,
               "protocol": "tcp"
@@ -2034,6 +2071,8 @@
           "name": "Immich",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 2283,
               "host": 2283,
               "protocol": "tcp"
@@ -2273,6 +2312,8 @@
           "name": "IndeeHub",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 7777,
               "host": 7778,
               "protocol": "tcp"
@@ -2765,6 +2806,8 @@
           "name": "Jellyfin",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8096,
               "host": 8096,
               "protocol": "tcp"
@@ -2852,11 +2895,15 @@
           "name": "Lightning Stack",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9738,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.",
               "container": 10009,
               "host": 10010,
               "protocol": "tcp"
@@ -2950,16 +2997,22 @@
           "name": "LND",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9735,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Zeus and other remote wallets depend on reaching this directly.",
               "container": 10009,
               "host": 10009,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client.",
               "container": 8080,
               "host": 18080,
               "protocol": "tcp"
@@ -2998,7 +3051,7 @@
       "version": "v0.18.4-beta"
     },
     "lnd-ui": {
-      "image": "146.59.87.168:3000/lfg2025/lnd-ui:latest",
+      "image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.119-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -3025,25 +3078,19 @@
           },
           "id": "lnd-ui",
           "name": "LND UI",
-          "ports": [
-            {
-              "container": 80,
-              "host": 18083,
-              "protocol": "tcp"
-            }
-          ],
+          "ports": [],
           "resources": {
             "memory_limit": "64Mi"
           },
           "security": {
-            "network_policy": "bridge",
+            "network_policy": "host",
             "readonly_root": false
           },
           "version": "1.0.0",
           "volumes": []
         }
       },
-      "version": "latest"
+      "version": "1.7.119-alpha"
     },
     "mempool": {
       "image": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
@@ -3093,6 +3140,8 @@
           "name": "Mempool Explorer",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 4080,
               "protocol": "tcp"
@@ -3196,6 +3245,8 @@
           "name": "Mempool API",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8999,
               "host": 8999,
               "protocol": "tcp"
@@ -3255,6 +3306,8 @@
           "name": "MorphOS Server",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8089,
               "protocol": "tcp"
@@ -3569,6 +3622,8 @@
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "STUN over UDP for NAT traversal; it must answer unauthenticated probes to do its job at all.",
               "container": 3478,
               "host": 3478,
               "protocol": "udp"
@@ -3653,6 +3708,8 @@
           "name": "Nextcloud",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8085,
               "protocol": "tcp"
@@ -3731,6 +3788,8 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 18081,
               "protocol": "tcp"
@@ -3832,6 +3891,8 @@
           "name": "PhotoPrism",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 2342,
               "host": 2342,
               "protocol": "tcp"
@@ -4066,6 +4127,8 @@
           "name": "Pine Wake Word (openWakeWord)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10400,
               "host": 10400,
               "protocol": "tcp"
@@ -4144,6 +4207,8 @@
           "name": "Pine Piper (TTS)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10200,
               "host": 10200,
               "protocol": "tcp"
@@ -4226,6 +4291,8 @@
           "name": "Pine Whisper (STT)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10300,
               "host": 10300,
               "protocol": "tcp"
@@ -4298,6 +4365,8 @@
           "name": "Portainer",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 9000,
               "host": 9000,
               "protocol": "tcp"
@@ -4394,11 +4463,15 @@
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "mDNS is UDP multicast service discovery; gating it would break .local name resolution for every device on the LAN.",
               "container": 5353,
               "host": 5353,
               "protocol": "udp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "SSDP/UPnP discovery is UDP multicast — there is no HTTP request to gate and no client that could hold a session.",
               "container": 1900,
               "host": 1900,
               "protocol": "udp"
@@ -4478,6 +4551,8 @@
           "name": "SearXNG",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8888,
               "protocol": "tcp"
@@ -4549,6 +4624,8 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 7777,
               "host": 8090,
               "protocol": "tcp"
@@ -4639,6 +4716,8 @@
           "name": "Uptime Kuma",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3001,
               "host": 3002,
               "protocol": "tcp"
@@ -4720,6 +4799,8 @@
           "name": "Vaultwarden",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8082,
               "protocol": "tcp"
@@ -4756,7 +4837,7 @@
     }
   },
   "schema": 1,
-  "signature": "1fe1b962317212c15b83c9ae8b0b2957f9663bb7dda3f4d117123aab496ddd4f94fa48f7d4abfd4be5b771510aed51f8ede870e55cb3fd21ce2453bea1d3510e",
+  "signature": "cc83d0be50ce6144e2b5693a7175d7743d4a19141f4ef9a46a3c88d2dadd848acda9c25063e7a8b5643cecb2ccde279762a00a9715a5d26c99a95b492bc82a05",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "updated": "2026-07-31"
+  "updated": "2026-08-04"
 }

From 3760a00ea36e4038ecf0dcfc9ae036e95829d2bf Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 08:13:59 -0400
Subject: [PATCH 09/60] fix(security): Tor onions for gated ports forward to
 the gate, not the app
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tor carries no session cookie, so HiddenServicePort → 127.0.0.1:<port>
reached the app around the gate — the last transport the gate did not
cover. The gate now binds 127.0.0.2 (its own loopback, distinct from the
app's 127.0.0.1, so no app needs a second port), and regenerate_torrc
forwards declared-gated ports there. Undeclared ports keep today's
target: absence of the field is not an instruction.

The 127.0.0.2 claim deliberately does not count toward the unprotected
audit — a port whose only claim is the Tor loopback is still wide open
on the LAN and must keep warning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/tor/mod.rs  | 63 ++++++++++++++++++++++--
 core/archipelago/src/appgate/listener.rs | 30 +++++++++++
 2 files changed, 88 insertions(+), 5 deletions(-)

diff --git a/core/archipelago/src/api/rpc/tor/mod.rs b/core/archipelago/src/api/rpc/tor/mod.rs
index aad7dcec..7b3cc5af 100644
--- a/core/archipelago/src/api/rpc/tor/mod.rs
+++ b/core/archipelago/src/api/rpc/tor/mod.rs
@@ -222,6 +222,18 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
     lines.push("# ControlPort disabled for security".to_string());
     lines.push(String::new());
 
+    // Ports whose manifests declare `auth: gated` forward to the gate's own
+    // loopback (127.0.0.2, where the app-gate listener binds — see
+    // `appgate::listener::GATE_TOR_UPSTREAM`) instead of the app's 127.0.0.1.
+    // Tor carries no session cookie, so an onion pointed at the app is an
+    // unauthenticated bypass of the gate. Declared-gated ports only: an
+    // undeclared port keeps today's target, because absence of the field is
+    // not an instruction (the v1.7.121 incident rule).
+    let gated_ports: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
+        .gated_ports()
+        .map(|g| g.port)
+        .collect();
+
     for svc in &config.services {
         if !svc.enabled {
             continue;
@@ -240,7 +252,7 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
                 lines.push("HiddenServicePort 10009 127.0.0.1:10009".to_string());
             }
         } else {
-            lines.push(format!("HiddenServicePort 80 127.0.0.1:{}", svc.local_port));
+            lines.push(app_hidden_service_port_line(svc.local_port, &gated_ports));
         }
 
         lines.push(String::new());
@@ -248,6 +260,24 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
 
     let content = lines.join("\n");
     let staging = "/var/lib/archipelago/tor-config/torrc.staged";
+    write_staged_torrc(&content, staging).await
+}
+
+/// The `HiddenServicePort` line for an HTTP app onion. Gated ports forward to
+/// the gate's Tor upstream; everything else to the app itself.
+fn app_hidden_service_port_line(
+    local_port: u16,
+    gated_ports: &std::collections::HashSet<u16>,
+) -> String {
+    let upstream = if gated_ports.contains(&local_port) {
+        crate::appgate::listener::GATE_TOR_UPSTREAM.to_string()
+    } else {
+        "127.0.0.1".to_string()
+    };
+    format!("HiddenServicePort 80 {}:{}", upstream, local_port)
+}
+
+async fn write_staged_torrc(content: &str, staging: &str) -> Result<()> {
     let config_dir = Path::new(staging)
         .parent()
         .unwrap_or_else(|| Path::new("/var/lib/archipelago/tor-config"));
@@ -256,14 +286,37 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
         .await
         .context("Failed to write staged torrc")?;
 
-    debug!(
-        "Staged torrc with {} enabled services",
-        config.services.iter().filter(|s| s.enabled).count()
-    );
+    debug!("Staged torrc ({} bytes)", content.len());
 
     Ok(())
 }
 
+#[cfg(test)]
+mod torrc_tests {
+    use super::app_hidden_service_port_line;
+    use std::collections::HashSet;
+
+    #[test]
+    fn gated_port_forwards_to_the_gate_not_the_app() {
+        let gated: HashSet<u16> = [8082u16].into_iter().collect();
+        assert_eq!(
+            app_hidden_service_port_line(8082, &gated),
+            "HiddenServicePort 80 127.0.0.2:8082"
+        );
+    }
+
+    #[test]
+    fn undeclared_port_keeps_the_app_loopback_target() {
+        // Absence of `auth: gated` is not an instruction — the onion keeps
+        // pointing at the app, exactly as before this change.
+        let gated: HashSet<u16> = [8082u16].into_iter().collect();
+        assert_eq!(
+            app_hidden_service_port_line(9100, &gated),
+            "HiddenServicePort 80 127.0.0.1:9100"
+        );
+    }
+}
+
 // ─── Hostname Sync ───────────────────────────────────────────────
 
 pub(in crate::api::rpc) async fn sync_single_hostname(name: &str, address: &str) {
diff --git a/core/archipelago/src/appgate/listener.rs b/core/archipelago/src/appgate/listener.rs
index 10af2946..4e1a198d 100644
--- a/core/archipelago/src/appgate/listener.rs
+++ b/core/archipelago/src/appgate/listener.rs
@@ -44,6 +44,15 @@ use tracing::{debug, info, warn};
 /// apps are installed while the daemon runs.
 const SWEEP_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
 
+/// The gate's own loopback address, distinct from the app's `127.0.0.1`.
+///
+/// Tor cannot present a session cookie, so `HiddenServicePort → 127.0.0.1`
+/// reaches the app around the gate. Instead torrc forwards gated ports to
+/// this address (`api/rpc/tor`), where the gate — not the app — listens. A
+/// second loopback address rather than a second port number, so no app needs
+/// a port it did not declare.
+pub const GATE_TOR_UPSTREAM: IpAddr = IpAddr::V4(std::net::Ipv4Addr::new(127, 0, 0, 2));
+
 /// A port the gate should own but could not claim, and why.
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct UnprotectedPort {
@@ -192,6 +201,10 @@ async fn sweep(
 
         let mut claimed_any = false;
         let mut blocked = false;
+        // External addresses first, then the gate's Tor upstream. 127.0.0.2
+        // deliberately does NOT count toward `claimed_any`: the warning below
+        // is about external exposure, and a port whose only claim is the Tor
+        // loopback is still wide open on the LAN.
         for &addr in &addresses {
             let key = (app.port, addr);
             if held.contains_key(&key) {
@@ -214,6 +227,23 @@ async fn sweep(
                 Err(_) => blocked = true,
             }
         }
+        let tor_key = (app.port, GATE_TOR_UPSTREAM);
+        if held.contains_key(&tor_key) {
+            claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+        } else {
+            match TcpListener::bind(SocketAddr::new(GATE_TOR_UPSTREAM, app.port)).await {
+                Ok(listener) => {
+                    held.insert(tor_key, ());
+                    claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+                    info!(
+                        port = app.port, app = %app.app_id,
+                        "app gate claimed the Tor upstream (127.0.0.2)"
+                    );
+                    spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
+                }
+                Err(_) => blocked = true,
+            }
+        }
 
         if blocked && !claimed_any {
             warn!(

From f08ed79b8a757521da139757c4644535d9922f71 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 08:14:00 -0400
Subject: [PATCH 10/60] fix(security): FIPS v6 relay hands gated ports to the
 app gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mesh relay is a raw unauthenticated forward to the app's loopback,
and whether it or the gate owned a fips0 ULA port was decided by a bind
race — the dev box happened to be safe because the gate bound first.
The relay now skips ports declared auth: gated and tears down any
existing bridge for a port that became gated since it was bridged
(catalog refresh), releasing the bind for the gate's next sweep.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/server.rs | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs
index a3c21ea0..8969b212 100644
--- a/core/archipelago/src/server.rs
+++ b/core/archipelago/src/server.rs
@@ -1145,16 +1145,37 @@ fn fips_app_relay_addr(ip: std::net::Ipv6Addr, port: u16) -> SocketAddr {
 /// without a daemon restart. Each relay binds to the fips0 ULA only and
 /// forwards raw TCP to the same port on IPv4 loopback.
 async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bool>) {
-    use std::collections::HashSet;
-    let mut bridged: HashSet<u16> = HashSet::new();
+    use std::collections::HashMap;
+    let mut bridged: HashMap<u16, tokio::task::JoinHandle<()>> = HashMap::new();
     let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
     interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
     loop {
         tokio::select! {
             _ = interval.tick() => {
                 let Some(fips_ip) = crate::fips::iface::fips0_ula() else { continue };
+                // Ports declared `auth: gated` belong to the app gate on the
+                // fips0 ULA. This relay is a raw unauthenticated forward to
+                // the app's loopback, so bridging a gated port would bypass
+                // the gate — and which of the two wins the bind used to be a
+                // race. Skip them here, and tear down any bridge for a port
+                // that became gated since it was bridged (catalog refresh),
+                // releasing the bind so the gate's next sweep claims it.
+                let gated: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
+                    .gated_ports()
+                    .map(|g| g.port)
+                    .collect();
                 for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {
-                    if bridged.contains(&port) {
+                    if gated.contains(&port) {
+                        if let Some(handle) = bridged.remove(&port) {
+                            handle.abort();
+                            info!(
+                                port,
+                                "v6 relay released a bridge: port is now gate-owned"
+                            );
+                        }
+                        continue;
+                    }
+                    if bridged.contains_key(&port) {
                         continue;
                     }
                     // ONLY bridge a port that a running app already answers on
@@ -1181,10 +1202,9 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
                     // EADDRINUSE = fipsd or another process already answers
                     // on this mesh address/port, so stay out of the way.
                     let Ok(listener) = bind_v6_only(addr) else { continue };
-                    bridged.insert(port);
                     debug!("v6 relay bridging [{fips_ip}]:{port} -> 127.0.0.1:{port}");
                     let mut rx = shutdown_rx.clone();
-                    tokio::spawn(async move {
+                    let handle = tokio::spawn(async move {
                         loop {
                             tokio::select! {
                                 accepted = listener.accept() => {
@@ -1205,6 +1225,7 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
                             }
                         }
                     });
+                    bridged.insert(port, handle);
                 }
             }
             _ = shutdown_rx.changed() => return,

From e46af8cfe5548db512716ef2fcc7e31db6998241 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 08:14:01 -0400
Subject: [PATCH 11/60] feat(security): self-heal legacy containers on declared
 bind drift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Legacy pre-quadlet containers kept publishing 0.0.0.0 after the catalog
pinned their app to loopback, because host_port_bindings_drifted only
compared host PORT numbers — closing them needed a manual package.update
per app per node. The drift check now also compares the bind ADDRESS,
but only when the manifest declares one: an empty bind never fires,
since recreating a loopback-published container to wildcard on silence
is exactly the v1.7.121 Bitcoin-RPC incident. With this, every node
recreates its legacy containers to the declared state on its own after
the OTA.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/container/prod_orchestrator.rs        | 108 +++++++++++++++++-
 1 file changed, 102 insertions(+), 6 deletions(-)

diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index 6aea283d..0a31df14 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -595,10 +595,20 @@ async fn wait_for_manifest_host_ports(
 /// `podman inspect --format '{{json .HostConfig.PortBindings}}'` emits, e.g.
 /// `{"8080/tcp":[{"HostIp":"","HostPort":"18080"}]}`. Returns true only when a
 /// manifest container-port is positively published to a *different* host port
-/// than the manifest now asks for. Absence of a binding is deliberately NOT
-/// treated as drift here — that case is handled by the host-port repair/restart
-/// path and by host-networked apps that publish nothing — so we never trigger a
-/// destructive recreate on a false positive.
+/// than the manifest now asks for — or, when the manifest DECLARES a bind
+/// address, to a different host address. Absence of a binding is deliberately
+/// NOT treated as drift here — that case is handled by the host-port
+/// repair/restart path and by host-networked apps that publish nothing — so we
+/// never trigger a destructive recreate on a false positive.
+///
+/// The bind comparison is what lets a node self-heal after a catalog refresh
+/// pins an app to loopback for the app gate: a legacy (pre-quadlet) container
+/// still publishing `0.0.0.0:P` against a manifest that now declares
+/// `bind: 127.0.0.1` is recreated to the declared state, exactly as
+/// `package.update` would. An EMPTY manifest bind means "no instruction" and
+/// never fires this — recreating a loopback-published container to wildcard on
+/// silence is precisely the v1.7.121 incident class (Bitcoin RPC republished
+/// on the LAN).
 fn host_port_bindings_drifted(
     port_bindings_json: &str,
     manifest_ports: &[archipelago_container::manifest::PortMapping],
@@ -626,10 +636,26 @@ fn host_port_bindings_drifted(
         }
         let expected = port.host.to_string();
         let matches_expected = bindings.iter().any(|b| {
-            b.get("HostPort")
+            let host_port_ok = b
+                .get("HostPort")
                 .and_then(|h| h.as_str())
                 .map(|h| h == expected)
-                .unwrap_or(false)
+                .unwrap_or(false);
+            if !host_port_ok {
+                return false;
+            }
+            // Only a DECLARED bind participates; podman reports a wildcard
+            // publish as "" or "0.0.0.0".
+            if port.bind.is_empty() {
+                return true;
+            }
+            let actual_ip = b.get("HostIp").and_then(|h| h.as_str()).unwrap_or("");
+            let actual = if actual_ip.is_empty() {
+                "0.0.0.0"
+            } else {
+                actual_ip
+            };
+            actual == port.bind
         });
         if !matches_expected {
             return true;
@@ -4569,6 +4595,76 @@ mod tests {
         ));
     }
 
+    fn bound_port(
+        host: u16,
+        container: u16,
+        bind: &str,
+    ) -> archipelago_container::manifest::PortMapping {
+        archipelago_container::manifest::PortMapping {
+            bind: bind.to_string(),
+            ..port(host, container)
+        }
+    }
+
+    #[test]
+    fn bind_drift_detected_when_declared_loopback_but_published_wildcard() {
+        // The legacy-container case: a pre-quadlet container still publishes
+        // 0.0.0.0 while the catalog-delivered manifest pins the app to
+        // loopback for the app gate. Must recreate, or the port stays open on
+        // every interface and the gate can never claim it.
+        for wildcard in [r#""""#, r#""0.0.0.0""#] {
+            let bindings = format!(r#"{{"80/tcp":[{{"HostIp":{wildcard},"HostPort":"8082"}}]}}"#);
+            assert!(host_port_bindings_drifted(
+                &bindings,
+                &[bound_port(8082, 80, "127.0.0.1")]
+            ));
+        }
+    }
+
+    #[test]
+    fn no_bind_drift_when_declared_loopback_and_published_loopback() {
+        let bindings = r#"{"80/tcp":[{"HostIp":"127.0.0.1","HostPort":"8082"}]}"#;
+        assert!(!host_port_bindings_drifted(
+            bindings,
+            &[bound_port(8082, 80, "127.0.0.1")]
+        ));
+    }
+
+    #[test]
+    fn no_bind_drift_on_undeclared_bind() {
+        // Silence is not consent (v1.7.121 incident class): an EMPTY manifest
+        // bind must never recreate a loopback-published container to
+        // wildcard — that is how Bitcoin's RPC got republished on the LAN.
+        let bindings = r#"{"8332/tcp":[{"HostIp":"127.0.0.1","HostPort":"8332"}]}"#;
+        assert!(!host_port_bindings_drifted(bindings, &[port(8332, 8332)]));
+    }
+
+    #[test]
+    fn multi_bind_publish_satisfies_each_declared_entry() {
+        // Same host/container pair listed twice (loopback + archy-net
+        // gateway): both declared binds are present in the actual publish.
+        let bindings = r#"{"8332/tcp":[
+            {"HostIp":"127.0.0.1","HostPort":"8332"},
+            {"HostIp":"10.89.0.1","HostPort":"8332"}
+        ]}"#;
+        assert!(!host_port_bindings_drifted(
+            bindings,
+            &[
+                bound_port(8332, 8332, "127.0.0.1"),
+                bound_port(8332, 8332, "10.89.0.1")
+            ]
+        ));
+        // And a wildcard-only publish drifts BOTH declared entries.
+        let wildcard = r#"{"8332/tcp":[{"HostIp":"","HostPort":"8332"}]}"#;
+        assert!(host_port_bindings_drifted(
+            wildcard,
+            &[
+                bound_port(8332, 8332, "127.0.0.1"),
+                bound_port(8332, 8332, "10.89.0.1")
+            ]
+        ));
+    }
+
     #[test]
     fn missing_secret_error_names_the_secret() {
         use archipelago_container::manifest::SecretsProvider;

From d2e4b00789a161aca770147db484d4ab11c97e98 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 08:50:46 -0400
Subject: [PATCH 12/60] fix(security): gate classifies from the catalog overlay
 and releases withdrawn claims
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dev-box verification of the Tor/FIPS fixes caught a pre-existing split
brain: the orchestrator publishes containers from the signed catalog's
embedded manifests (origin-wins), but the gate classified ports from the
stale disk manifests — so it externally bound nbxplorer 32838, a port
the catalog declares auth: local and pins to loopback. Reachable behind
a login, but reachable where it deliberately was not.

- build_port_map now consults the catalog overlay first, via the same
  parse/validate/image-only filter the orchestrator uses (moved to
  app_catalog::catalog_manifest_overlay so the two cannot diverge again).
- GatedPort carries . The gated set still includes undeclared
  Session-default ports for challenge/audit, but every action that
  REDIRECTS traffic — the torrc 127.0.0.2 repoint, the FIPS relay
  stand-down, the Tor-upstream bind — now keys on the declaration.
- The sweep releases held claims whose port left the gated set, so a
  catalog refresh that withdraws a port (gated → local/none) takes
  effect without a daemon restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/tor/mod.rs       |   1 +
 core/archipelago/src/appgate/identity.rs      | 291 ++++++++++++------
 core/archipelago/src/appgate/listener.rs      |  78 +++--
 core/archipelago/src/appgate/mod.rs           |   1 +
 core/archipelago/src/container/app_catalog.rs |  40 +++
 .../src/container/prod_orchestrator.rs        |  25 +-
 core/archipelago/src/server.rs                |   1 +
 7 files changed, 293 insertions(+), 144 deletions(-)

diff --git a/core/archipelago/src/api/rpc/tor/mod.rs b/core/archipelago/src/api/rpc/tor/mod.rs
index 7b3cc5af..6153a0b0 100644
--- a/core/archipelago/src/api/rpc/tor/mod.rs
+++ b/core/archipelago/src/api/rpc/tor/mod.rs
@@ -231,6 +231,7 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
     // not an instruction (the v1.7.121 incident rule).
     let gated_ports: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
         .gated_ports()
+        .filter(|g| g.declared)
         .map(|g| g.port)
         .collect();
 
diff --git a/core/archipelago/src/appgate/identity.rs b/core/archipelago/src/appgate/identity.rs
index 26ef272c..aeee0b49 100644
--- a/core/archipelago/src/appgate/identity.rs
+++ b/core/archipelago/src/appgate/identity.rs
@@ -26,6 +26,15 @@ pub struct GatedPort {
     pub app_name: String,
     /// Manifest-declared icon path (`metadata.icon`), when present.
     pub icon: Option<String>,
+    /// True only when the manifest says `auth: gated` in so many words.
+    ///
+    /// The gated set deliberately also carries undeclared Session-default
+    /// ports (so the gate challenges them wherever it can already stand, and
+    /// the audit reports them). But everything that CHANGES where traffic
+    /// goes — the torrc repoint to 127.0.0.2, the FIPS relay stand-down, the
+    /// Tor-upstream bind — must key on this flag: acting on an undeclared
+    /// port is the v1.7.121 incident class, whatever the action.
+    pub declared: bool,
 }
 
 /// A port deliberately left unauthenticated, and the manifest's stated reason.
@@ -101,13 +110,35 @@ fn manifest_icon(manifest: &AppManifest) -> Option<String> {
 
 /// Classify every published port across all installed manifests.
 ///
-/// The first directory that yields a manifest for an app id wins, so a node's
-/// `/opt/archipelago/apps` copy shadows a repo checkout rather than merging
-/// with it — otherwise a stale checked-out manifest could re-open a port the
-/// installed one gates.
+/// The signed catalog's embedded manifests are consulted FIRST, because they
+/// are what the orchestrator actually publishes containers from
+/// (origin-wins; see `app_catalog::catalog_manifest_overlay`). Classifying
+/// from disk alone made the gate act on policy the node was no longer
+/// running: the catalog declared nbxplorer `auth: local` and pinned it to
+/// loopback, the stale disk manifest declared nothing, and the gate
+/// externally bound a deliberately host-local port (archi-dev-box
+/// 2026-08-04).
+///
+/// After the catalog, the first directory that yields a manifest for an app
+/// id wins, so a node's `/opt/archipelago/apps` copy shadows a repo checkout
+/// rather than merging with it — otherwise a stale checked-out manifest could
+/// re-open a port the installed one gates.
 pub fn build_port_map() -> PortMap {
     let mut map = PortMap::default();
-    let mut seen_apps: HashMap<String, PathBuf> = HashMap::new();
+    let mut seen_apps: std::collections::HashSet<String> = std::collections::HashSet::new();
+
+    for (app_id, value) in crate::container::app_catalog::catalog_manifest_values() {
+        let Some(manifest) =
+            crate::container::app_catalog::catalog_manifest_overlay(&app_id, value)
+        else {
+            // Unparseable/invalid/build-source → the orchestrator falls back
+            // to disk for this app, so classification must too.
+            continue;
+        };
+        if seen_apps.insert(app_id) {
+            classify_manifest(&manifest, &mut map);
+        }
+    }
 
     for dir in apps_dirs() {
         let Ok(entries) = std::fs::read_dir(&dir) else {
@@ -124,100 +155,8 @@ pub fn build_port_map() -> PortMap {
                 // would have published.
                 continue;
             };
-            let app_id = manifest.app.id.clone();
-            if seen_apps.contains_key(&app_id) {
-                continue;
-            }
-            seen_apps.insert(app_id.clone(), path);
-
-            let icon = manifest_icon(&manifest);
-            let app_name = if manifest.app.name.trim().is_empty() {
-                app_id.clone()
-            } else {
-                manifest.app.name.clone()
-            };
-
-            for port in &manifest.app.ports {
-                let protocol = if port.protocol.is_empty() {
-                    "tcp"
-                } else {
-                    port.protocol.as_str()
-                };
-                match port.auth_policy() {
-                    PortAuth::None => map.exempt.push(ExemptPort {
-                        port: port.host,
-                        app_id: app_id.clone(),
-                        rationale: port
-                            .auth_rationale
-                            .clone()
-                            .unwrap_or_else(|| "(no rationale recorded)".to_string()),
-                        protocol: protocol.to_string(),
-                    }),
-                    // Declared host-local. Not gated and not reported as
-                    // exposed, because it is neither — see PortAuth::Local
-                    // for why this cannot be inferred from `bind`.
-                    PortAuth::Local => {}
-                    // Explicit opt-in: the app is on loopback and the daemon
-                    // owns the external addresses. This is the ONLY way a
-                    // port gets bound by the gate, regardless of `bind`.
-                    PortAuth::Gated => {
-                        map.gated.insert(
-                            port.host,
-                            GatedPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                app_name: app_name.clone(),
-                                icon: icon.clone(),
-                            },
-                        );
-                    }
-                    PortAuth::Session => {
-                        // UDP cannot carry an HTTP challenge. Such a port has
-                        // no business defaulting into the gated set where it
-                        // would look protected without being protectable —
-                        // surface it as an unrationalised exemption instead,
-                        // which is honest and shows up in the audit list.
-                        if protocol != "tcp" {
-                            map.exempt.push(ExemptPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                rationale: format!(
-                                    "{protocol} cannot carry an HTTP challenge; declare auth: none \
-                                     with a rationale to record why this is safe"
-                                ),
-                                protocol: protocol.to_string(),
-                            });
-                            continue;
-                        }
-                        // A loopback publish is skipped, and this is the
-                        // safety property of the whole module: the gate must
-                        // never be the reason a port becomes reachable
-                        // somewhere it was not. `session` is the DEFAULT, so
-                        // it is what every un-migrated manifest carries —
-                        // and a node's installed manifests always lag the
-                        // repo. Binding those externally published Bitcoin
-                        // RPC across the LAN within seconds of deploy
-                        // (archi-dev-box 2026-08-03). Taking over a port is
-                        // opt-in only: `auth: gated`, shipped in the same
-                        // manifest edit as the loopback pin.
-                        if port
-                            .bind
-                            .parse::<std::net::IpAddr>()
-                            .is_ok_and(|ip| ip.is_loopback())
-                        {
-                            continue;
-                        }
-                        map.gated.insert(
-                            port.host,
-                            GatedPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                app_name: app_name.clone(),
-                                icon: icon.clone(),
-                            },
-                        );
-                    }
-                }
+            if seen_apps.insert(manifest.app.id.clone()) {
+                classify_manifest(&manifest, &mut map);
             }
         }
     }
@@ -226,6 +165,103 @@ pub fn build_port_map() -> PortMap {
     map
 }
 
+/// Classify one manifest's ports into the map. Split from [`build_port_map`]
+/// so the catalog-overlay pass and the disk pass cannot diverge.
+fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
+    let app_id = manifest.app.id.clone();
+    let icon = manifest_icon(manifest);
+    let app_name = if manifest.app.name.trim().is_empty() {
+        app_id.clone()
+    } else {
+        manifest.app.name.clone()
+    };
+
+    for port in &manifest.app.ports {
+        let protocol = if port.protocol.is_empty() {
+            "tcp"
+        } else {
+            port.protocol.as_str()
+        };
+        match port.auth_policy() {
+            PortAuth::None => map.exempt.push(ExemptPort {
+                port: port.host,
+                app_id: app_id.clone(),
+                rationale: port
+                    .auth_rationale
+                    .clone()
+                    .unwrap_or_else(|| "(no rationale recorded)".to_string()),
+                protocol: protocol.to_string(),
+            }),
+            // Declared host-local. Not gated and not reported as
+            // exposed, because it is neither — see PortAuth::Local
+            // for why this cannot be inferred from `bind`.
+            PortAuth::Local => {}
+            // Explicit opt-in: the app is on loopback and the daemon
+            // owns the external addresses. This is the ONLY way a
+            // port gets bound by the gate, regardless of `bind`.
+            PortAuth::Gated => {
+                map.gated.insert(
+                    port.host,
+                    GatedPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        app_name: app_name.clone(),
+                        icon: icon.clone(),
+                        declared: true,
+                    },
+                );
+            }
+            PortAuth::Session => {
+                // UDP cannot carry an HTTP challenge. Such a port has
+                // no business defaulting into the gated set where it
+                // would look protected without being protectable —
+                // surface it as an unrationalised exemption instead,
+                // which is honest and shows up in the audit list.
+                if protocol != "tcp" {
+                    map.exempt.push(ExemptPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        rationale: format!(
+                            "{protocol} cannot carry an HTTP challenge; declare auth: none \
+                             with a rationale to record why this is safe"
+                        ),
+                        protocol: protocol.to_string(),
+                    });
+                    continue;
+                }
+                // A loopback publish is skipped, and this is the
+                // safety property of the whole module: the gate must
+                // never be the reason a port becomes reachable
+                // somewhere it was not. `session` is the DEFAULT, so
+                // it is what every un-migrated manifest carries —
+                // and a node's installed manifests always lag the
+                // repo. Binding those externally published Bitcoin
+                // RPC across the LAN within seconds of deploy
+                // (archi-dev-box 2026-08-03). Taking over a port is
+                // opt-in only: `auth: gated`, shipped in the same
+                // manifest edit as the loopback pin.
+                if port
+                    .bind
+                    .parse::<std::net::IpAddr>()
+                    .is_ok_and(|ip| ip.is_loopback())
+                {
+                    continue;
+                }
+                map.gated.insert(
+                    port.host,
+                    GatedPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        app_name: app_name.clone(),
+                        icon: icon.clone(),
+                        declared: false,
+                    },
+                );
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -257,6 +293,63 @@ mod tests {
         }
     }
 
+    fn manifest(yaml: &str) -> AppManifest {
+        AppManifest::parse(yaml).expect("test manifest must parse")
+    }
+
+    const BASE: &str = r#"
+app:
+  id: testapp
+  name: Test App
+  version: "1.0"
+  container:
+    image: example.org/testapp:1.0
+"#;
+
+    /// `auth: gated` is the only classification allowed to redirect traffic —
+    /// torrc repoints, relay stand-down, and the 127.0.0.2 bind all key on
+    /// `declared`. An undeclared Session port is challenged and audited but
+    /// must never be `declared`.
+    #[test]
+    fn declared_tracks_the_manifest_not_the_default() {
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 8090\n      container: 7777\n      protocol: tcp\n      bind: 127.0.0.1\n      auth: gated\n"
+            )),
+            &mut map,
+        );
+        assert!(map.gated(8090).expect("gated").declared);
+
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 9100\n      container: 9100\n      protocol: tcp\n"
+            )),
+            &mut map,
+        );
+        let undeclared = map.gated(9100).expect("session default is challenged");
+        assert!(
+            !undeclared.declared,
+            "an absent auth field must never read as an instruction"
+        );
+    }
+
+    /// `auth: local` keeps the gate's hands off entirely — the port is
+    /// neither gated nor exempt-reported.
+    #[test]
+    fn local_ports_are_untouched() {
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 32838\n      container: 32838\n      protocol: tcp\n      bind: 127.0.0.1\n      auth: local\n"
+            )),
+            &mut map,
+        );
+        assert!(map.gated(32838).is_none());
+        assert!(map.exempt_ports().is_empty());
+    }
+
     /// Protocol ports that wallets dial directly must never end up gated —
     /// this is the constraint that decided the design (Zeus and electrum
     /// clients keep working untouched).
diff --git a/core/archipelago/src/appgate/listener.rs b/core/archipelago/src/appgate/listener.rs
index 4e1a198d..0a7844da 100644
--- a/core/archipelago/src/appgate/listener.rs
+++ b/core/archipelago/src/appgate/listener.rs
@@ -151,8 +151,12 @@ pub async fn run(
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
 ) {
     // (port, addr) pairs already served, so a sweep does not rebind what it
-    // already holds.
-    let mut held: HashMap<(u16, IpAddr), ()> = HashMap::new();
+    // already holds. The accept-loop handle is kept so a claim can be
+    // RELEASED when its port leaves the gated set — a catalog refresh
+    // declaring a port `local`/`none` must make the gate let go without a
+    // daemon restart, or the stale bind keeps republishing a port the
+    // catalog just withdrew (nbxplorer 32838, archi-dev-box 2026-08-04).
+    let mut held: HashMap<(u16, IpAddr), tokio::task::JoinHandle<()>> = HashMap::new();
     let mut interval = tokio::time::interval(SWEEP_INTERVAL);
     interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
 
@@ -169,7 +173,7 @@ pub async fn run(
 async fn sweep(
     gate: &Arc<AppGate>,
     status: &Arc<RwLock<GateStatus>>,
-    held: &mut HashMap<(u16, IpAddr), ()>,
+    held: &mut HashMap<(u16, IpAddr), tokio::task::JoinHandle<()>>,
     shutdown_rx: &tokio::sync::watch::Receiver<bool>,
 ) {
     // Re-read the manifests every sweep rather than trusting the map built
@@ -179,6 +183,23 @@ async fn sweep(
     // enforced while serving a brand-new app to anyone who asked.
     gate.refresh().await;
     let port_map = gate.port_map().await;
+
+    // Release claims whose port left the gated set (or whose Tor-upstream
+    // claim lost its declaration). Aborting the accept loop drops the
+    // listener, freeing the address for whoever now legitimately owns it —
+    // the app itself, or nobody.
+    held.retain(|(port, addr), handle| {
+        let keep = match port_map.gated(*port) {
+            None => false,
+            Some(app) => *addr != GATE_TOR_UPSTREAM || app.declared,
+        };
+        if !keep {
+            handle.abort();
+            info!(port, %addr, "app gate released a claim: port is no longer gated here");
+        }
+        keep
+    });
+
     let addresses = host_addresses().await;
     if addresses.is_empty() {
         debug!("app gate: no external addresses yet");
@@ -214,34 +235,46 @@ async fn sweep(
             }
             match TcpListener::bind(SocketAddr::new(addr, app.port)).await {
                 Ok(listener) => {
-                    held.insert(key, ());
+                    let handle =
+                        spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
+                    held.insert(key, handle);
                     claimed.push((app.port, addr.to_string()));
                     claimed_any = true;
                     info!(
                         port = app.port, %addr, app = %app.app_id,
                         "app gate claimed an app port"
                     );
-                    spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
                 }
                 // Almost always the app itself holding 0.0.0.0:<port>.
                 Err(_) => blocked = true,
             }
         }
-        let tor_key = (app.port, GATE_TOR_UPSTREAM);
-        if held.contains_key(&tor_key) {
-            claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
-        } else {
-            match TcpListener::bind(SocketAddr::new(GATE_TOR_UPSTREAM, app.port)).await {
-                Ok(listener) => {
-                    held.insert(tor_key, ());
-                    claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
-                    info!(
-                        port = app.port, app = %app.app_id,
-                        "app gate claimed the Tor upstream (127.0.0.2)"
-                    );
-                    spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
+        // The Tor upstream is bound for DECLARED gated ports only: torrc only
+        // repoints an onion at 127.0.0.2 for a declared port, and standing a
+        // challenge on an undeclared port's would-be upstream would change
+        // where its traffic goes on nothing but a default.
+        if app.declared {
+            let tor_key = (app.port, GATE_TOR_UPSTREAM);
+            if held.contains_key(&tor_key) {
+                claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+            } else {
+                match TcpListener::bind(SocketAddr::new(GATE_TOR_UPSTREAM, app.port)).await {
+                    Ok(listener) => {
+                        let handle = spawn_accept_loop(
+                            listener,
+                            gate.clone(),
+                            app.clone(),
+                            shutdown_rx.clone(),
+                        );
+                        held.insert(tor_key, handle);
+                        claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+                        info!(
+                            port = app.port, app = %app.app_id,
+                            "app gate claimed the Tor upstream (127.0.0.2)"
+                        );
+                    }
+                    Err(_) => blocked = true,
                 }
-                Err(_) => blocked = true,
             }
         }
 
@@ -281,12 +314,15 @@ async fn app_is_listening(port: u16) -> bool {
     .is_some()
 }
 
+/// Returns the accept-loop task handle so the sweep can release the claim
+/// (abort → listener drops → address freed) when the port leaves the gated
+/// set. In-flight connections finish on their own tasks.
 fn spawn_accept_loop(
     listener: TcpListener,
     gate: Arc<AppGate>,
     app: GatedPort,
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
-) {
+) -> tokio::task::JoinHandle<()> {
     tokio::spawn(async move {
         loop {
             tokio::select! {
@@ -317,7 +353,7 @@ fn spawn_accept_loop(
                 _ = shutdown_rx.changed() => break,
             }
         }
-    });
+    })
 }
 
 #[cfg(test)]
diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index 8ac1ef43..dee3e7e0 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -578,6 +578,7 @@ mod tests {
             app_id: "strfry".to_string(),
             app_name: "Strfry Relay".to_string(),
             icon: None,
+            declared: true,
         }
     }
 
diff --git a/core/archipelago/src/container/app_catalog.rs b/core/archipelago/src/container/app_catalog.rs
index fccb23ba..63b46b30 100644
--- a/core/archipelago/src/container/app_catalog.rs
+++ b/core/archipelago/src/container/app_catalog.rs
@@ -216,6 +216,46 @@ pub fn catalog_manifest_values() -> Vec<(String, serde_json::Value)> {
         .collect()
 }
 
+/// A catalog-embedded manifest as the node actually applies it: parsed,
+/// id-checked, validated, and image-only (build-source manifests defer to
+/// disk). `None` = the caller must fall back to the disk manifest.
+///
+/// Shared between the orchestrator's load overlay and the app gate's port
+/// classification so both answer "which manifest governs this app?" from the
+/// same origin. They diverged once — the orchestrator published containers
+/// from the catalog while the gate classified from stale disk manifests, and
+/// the gate externally bound a port the catalog had declared `auth: local`
+/// (nbxplorer 32838, archi-dev-box 2026-08-04).
+pub fn catalog_manifest_overlay(
+    app_id: &str,
+    value: serde_json::Value,
+) -> Option<archipelago_container::manifest::AppManifest> {
+    let m: archipelago_container::manifest::AppManifest = match serde_json::from_value(value) {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(app = %app_id, error = %e,
+                "skipping unparseable catalog manifest; using disk fallback");
+            return None;
+        }
+    };
+    if m.app.id != app_id {
+        tracing::warn!(catalog_id = %app_id, manifest_id = %m.app.id,
+            "skipping catalog manifest: embedded app id mismatches catalog key");
+        return None;
+    }
+    if let Err(e) = m.validate() {
+        tracing::warn!(app = %app_id, error = %e,
+            "skipping invalid catalog manifest; using disk fallback");
+        return None;
+    }
+    if m.app.container.build.is_some() {
+        tracing::debug!(app = %app_id,
+            "catalog manifest has a build source; deferring to disk (phase 1 = image-only)");
+        return None;
+    }
+    Some(m)
+}
+
 /// The catalog's default/latest version string for an app (the top-level
 /// `version` field), if covered. Used to decide whether an install-time
 /// selection should pin (older) or track-latest (default).
diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index 0a31df14..a68c605a 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -1183,30 +1183,7 @@ struct LoadedManifest {
 /// source (build contexts aren't registry-distributed yet — phase 1 is
 /// image-only). See `docs/registry-manifest-design.md`.
 fn catalog_manifest_to_overlay(app_id: &str, value: serde_json::Value) -> Option<AppManifest> {
-    let m: AppManifest = match serde_json::from_value(value) {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(app = %app_id, error = %e,
-                "skipping unparseable catalog manifest; using disk fallback");
-            return None;
-        }
-    };
-    if m.app.id != app_id {
-        tracing::warn!(catalog_id = %app_id, manifest_id = %m.app.id,
-            "skipping catalog manifest: embedded app id mismatches catalog key");
-        return None;
-    }
-    if let Err(e) = m.validate() {
-        tracing::warn!(app = %app_id, error = %e,
-            "skipping invalid catalog manifest; using disk fallback");
-        return None;
-    }
-    if m.app.container.build.is_some() {
-        tracing::debug!(app = %app_id,
-            "catalog manifest has a build source; deferring to disk (phase 1 = image-only)");
-        return None;
-    }
-    Some(m)
+    crate::container::app_catalog::catalog_manifest_overlay(app_id, value)
 }
 
 struct OrchestratorState {
diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs
index 8969b212..6ee7c73a 100644
--- a/core/archipelago/src/server.rs
+++ b/core/archipelago/src/server.rs
@@ -1162,6 +1162,7 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
                 // releasing the bind so the gate's next sweep claims it.
                 let gated: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
                     .gated_ports()
+                    .filter(|g| g.declared)
                     .map(|g| g.port)
                     .collect();
                 for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {

From 0f21f598aa50d1a39184ce2b12c69587d40c308b Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 10:40:28 -0400
Subject: [PATCH 13/60] fix(security): FIPS mesh relay must not republish auth:
 local ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Caught verifying the gate fixes on archi-dev-box: [fips0-ULA]:32838
answered HTTP 200 straight from nbxplorer with no credential. The
catalog declares that port auth: local — host-local by intent, pinned to
loopback, the gate deliberately keeps its hands off — but the mesh relay
bridges a STATIC port list to 127.0.0.1, so it republished it to the
whole mesh. Same bug class as the Tor onion gap: a transport that
converges on the app loopback without consulting the declaration.

PortMap now records declared-local ports and the relay withholds them
(tearing down an existing bridge if a catalog refresh newly declares
one), alongside the declared-gated withhold. Undeclared ports keep
todays behaviour — silence is not an instruction in either direction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/appgate/identity.rs | 55 +++++++++++++++++++++---
 core/archipelago/src/server.rs           | 40 +++++++++++------
 2 files changed, 77 insertions(+), 18 deletions(-)

diff --git a/core/archipelago/src/appgate/identity.rs b/core/archipelago/src/appgate/identity.rs
index aeee0b49..f04da17f 100644
--- a/core/archipelago/src/appgate/identity.rs
+++ b/core/archipelago/src/appgate/identity.rs
@@ -57,6 +57,7 @@ pub struct ExemptPort {
 pub struct PortMap {
     gated: HashMap<u16, GatedPort>,
     exempt: Vec<ExemptPort>,
+    local: std::collections::HashSet<u16>,
 }
 
 impl PortMap {
@@ -73,8 +74,21 @@ impl PortMap {
         &self.exempt
     }
 
+    /// Declared `auth: local` — host-local by intent, so NOTHING may make it
+    /// externally reachable.
+    ///
+    /// The gate honours this by keeping its hands off, but it is not the only
+    /// thing that can publish a port: the FIPS mesh relay bridges the fips0
+    /// ULA to `127.0.0.1` for a static port list, and it forwarded nbxplorer
+    /// 32838 — declared `local` and pinned to loopback — to the mesh
+    /// unauthenticated (archi-dev-box 2026-08-04). Anything that republishes
+    /// a loopback port must consult this set first.
+    pub fn is_declared_local(&self, port: u16) -> bool {
+        self.local.contains(&port)
+    }
+
     pub fn is_empty(&self) -> bool {
-        self.gated.is_empty() && self.exempt.is_empty()
+        self.gated.is_empty() && self.exempt.is_empty() && self.local.is_empty()
     }
 }
 
@@ -194,8 +208,12 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
             }),
             // Declared host-local. Not gated and not reported as
             // exposed, because it is neither — see PortAuth::Local
-            // for why this cannot be inferred from `bind`.
-            PortAuth::Local => {}
+            // for why this cannot be inferred from `bind`. Recorded so
+            // the mesh relay (and any future republisher) can refuse to
+            // expose it.
+            PortAuth::Local => {
+                map.local.insert(port.host);
+            }
             // Explicit opt-in: the app is on loopback and the daemon
             // owns the external addresses. This is the ONLY way a
             // port gets bound by the gate, regardless of `bind`.
@@ -336,9 +354,10 @@ app:
     }
 
     /// `auth: local` keeps the gate's hands off entirely — the port is
-    /// neither gated nor exempt-reported.
+    /// neither gated nor exempt-reported — but it IS recorded, so the mesh
+    /// relay can refuse to republish a deliberately host-local port.
     #[test]
-    fn local_ports_are_untouched() {
+    fn local_ports_are_untouched_but_recorded() {
         let mut map = PortMap::default();
         classify_manifest(
             &manifest(&format!(
@@ -348,6 +367,32 @@ app:
         );
         assert!(map.gated(32838).is_none());
         assert!(map.exempt_ports().is_empty());
+        assert!(
+            map.is_declared_local(32838),
+            "the mesh relay needs this to refuse bridging a host-local port"
+        );
+        assert!(!map.is_declared_local(3000));
+    }
+
+    /// The real corpus: every port the FIPS relay can bridge must be safe to
+    /// bridge. A port that is declared `local` (host-local by intent) or
+    /// declared `gated` (the app gate owns its external addresses) must be
+    /// withheld by the relay — this asserts the two sets the relay consults
+    /// actually classify the live manifests, so a future manifest edit that
+    /// re-opens one is caught here rather than on a node.
+    #[test]
+    fn relay_port_list_respects_local_and_gated_declarations() {
+        let map = build_port_map();
+        let relay_would_expose: Vec<u16> = crate::fips::app_ports::APP_LAUNCH_PORTS
+            .iter()
+            .copied()
+            .filter(|p| map.is_declared_local(*p))
+            .collect();
+        assert!(
+            !relay_would_expose.is_empty(),
+            "expected the corpus to contain at least one local port in the relay list \
+             (32838/8999) — if this fails the guard is untested, not unnecessary"
+        );
     }
 
     /// Protocol ports that wallets dial directly must never end up gated —
diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs
index 6ee7c73a..dd2e0b33 100644
--- a/core/archipelago/src/server.rs
+++ b/core/archipelago/src/server.rs
@@ -1153,26 +1153,40 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
         tokio::select! {
             _ = interval.tick() => {
                 let Some(fips_ip) = crate::fips::iface::fips0_ula() else { continue };
-                // Ports declared `auth: gated` belong to the app gate on the
-                // fips0 ULA. This relay is a raw unauthenticated forward to
-                // the app's loopback, so bridging a gated port would bypass
-                // the gate — and which of the two wins the bind used to be a
-                // race. Skip them here, and tear down any bridge for a port
-                // that became gated since it was bridged (catalog refresh),
-                // releasing the bind so the gate's next sweep claims it.
-                let gated: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
+                // This relay is a raw unauthenticated forward from the mesh to
+                // the app's loopback, so it must refuse two classes of port:
+                //
+                // * `auth: gated` — the app gate owns the fips0 ULA for these,
+                //   and bridging one would bypass the login page. Which of the
+                //   two won the bind used to be a race.
+                // * `auth: local` — host-local BY INTENT. Bridging one makes a
+                //   port reachable from the whole mesh that was deliberately
+                //   never externally reachable: nbxplorer 32838 answered HTTP
+                //   200 over the mesh with no credential (archi-dev-box
+                //   2026-08-04) purely because it appeared in the static port
+                //   list below.
+                //
+                // Undeclared ports keep today's behaviour — silence is not an
+                // instruction in either direction, and this relay predates the
+                // declarations.
+                let port_map = crate::appgate::identity::build_port_map();
+                let gate_owned: std::collections::HashSet<u16> = port_map
                     .gated_ports()
                     .filter(|g| g.declared)
                     .map(|g| g.port)
                     .collect();
                 for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {
-                    if gated.contains(&port) {
+                    let withhold = if gate_owned.contains(&port) {
+                        Some("port is now gate-owned")
+                    } else if port_map.is_declared_local(port) {
+                        Some("port is declared auth: local (host-local by intent)")
+                    } else {
+                        None
+                    };
+                    if let Some(reason) = withhold {
                         if let Some(handle) = bridged.remove(&port) {
                             handle.abort();
-                            info!(
-                                port,
-                                "v6 relay released a bridge: port is now gate-owned"
-                            );
+                            info!(port, reason, "v6 relay released a bridge");
                         }
                         continue;
                     }

From 3f4b5524b1efc613e87cbce3ea2e27ba605841ae Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 01:20:02 -0400
Subject: [PATCH 14/60] =?UTF-8?q?chore(trust):=20rotate=20the=20release=20?=
 =?UTF-8?q?root=20to=20z6Mkfu5LT=E2=80=A6DLWT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DO NOT MERGE INTO A RELEASE SIGNED WITH THE NEW KEY. See below.

The previous release root (z6Mkkid…q7ur, pinned 2026-07-02) was exposed
in a chat transcript and is treated as compromised. It signs both OTA
manifests and the app catalog, so anyone holding it could sign updates
the fleet would install.

Pins the new key in trust::anchor and moves EXPECTED_DID in all three
signing/publishing scripts.

ORDERING IS CRITICAL — nodes pin the OLD key:

  * The release CARRYING this commit must be signed with the OLD key.
    That is the only signature a node running the previous binary will
    accept, and it is what installs the binary pinning the new key.
  * Only the release AFTER that may be signed with the new key.
  * Signing this release with the new key makes every node reject it,
    ending OTA fleet-wide and requiring hands-on recovery per node.

sign-catalog.sh moves in the same commit, so the app catalog must also be
re-signed with the new key once this ships, or nodes accept the binary
and reject the catalog.

Key verified before pinning: the hex and the did:key are the same
keypair, checked with a base58 decoder round-tripped against the previous
known-good pair. An earlier candidate hex (cb830e13…) was rejected
because it decoded to a different DID than the one supplied — pinning it
would have made every node reject every future update.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 core/archipelago/src/trust/anchor.rs | 21 ++++++++++++++++++---
 scripts/create-release.sh            |  2 +-
 scripts/publish-release-assets.sh    |  2 +-
 scripts/sign-catalog.sh              |  2 +-
 4 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/core/archipelago/src/trust/anchor.rs b/core/archipelago/src/trust/anchor.rs
index 8498532e..30bfe0a6 100644
--- a/core/archipelago/src/trust/anchor.rs
+++ b/core/archipelago/src/trust/anchor.rs
@@ -16,13 +16,28 @@ use ed25519_dalek::VerifyingKey;
 
 /// Hex of the pinned Ed25519 release-root public key (32 bytes / 64 hex chars).
 ///
-/// Pinned 2026-07-02 from the release-root signing ceremony
-/// (signer did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur). The
+/// ROTATED 2026-08-04 to did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT.
+///
+/// The previous root (z6Mkkid…q7ur, pinned 2026-07-02) was exposed in a chat
+/// transcript and is treated as compromised.
+///
+/// Rotation is ORDERING-CRITICAL. Nodes pin the OLD key, so the release that
+/// carries this change must itself be signed with the OLD key — that is the
+/// only signature a node running the previous binary will accept. Only the
+/// release AFTER it may be signed with the new key. Signing the rotation
+/// release with the new key makes every node reject it and ends OTA
+/// fleet-wide, recoverable only by touching each node by hand.
+///
+/// Verified before pinning: this hex and the did:key above are the same
+/// keypair (the did:key encodes exactly these 32 bytes), checked with a
+/// decoder round-tripped against the previous known-good pair. An earlier
+/// candidate hex was rejected because it did not match the stated DID.
+/// The
 /// corresponding mnemonic is held offline by the publisher — see
 /// `docs/workstream-b-signing-runbook.md`. Regenerate/verify with:
 /// `RELEASE_MASTER_MNEMONIC=… archipelago ceremony pubkey`.
 pub const RELEASE_ROOT_PUBKEY_HEX: Option<&str> =
-    Some("5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951");
+    Some("1578adccf137024159dd936f44a56e8869ac7775785962f7e92e2faf2c034418");
 
 const ENV_OVERRIDE: &str = "ARCHY_RELEASE_ROOT_PUBKEY";
 
diff --git a/scripts/create-release.sh b/scripts/create-release.sh
index c35ddb11..d836ff9b 100755
--- a/scripts/create-release.sh
+++ b/scripts/create-release.sh
@@ -240,7 +240,7 @@ install -m 0644 "$FRONTEND_ARCHIVE" "$VERSION_DIR/archipelago-frontend-${VERSION
 # warning and falls through — and the commit then happened anyway. A release
 # commit carrying a manifest no node will accept has no valid use, so refuse
 # to create one rather than leave a tag that has to be re-cut.
-EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
+EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
 if ! grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     || ! grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json"; then
     echo "" >&2
diff --git a/scripts/publish-release-assets.sh b/scripts/publish-release-assets.sh
index 90a609eb..f5ba3d72 100755
--- a/scripts/publish-release-assets.sh
+++ b/scripts/publish-release-assets.sh
@@ -29,7 +29,7 @@ fail() { echo "Error: $*" >&2; exit 1; }
 # with the pinned release-root anchor refuse to auto-apply unsigned manifests,
 # and enforcement will tighten to hard-reject — an unsigned publish would
 # strand them. Grep proves presence; ceremony verify proves the crypto.
-EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
+EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
 grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     && grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json" \
     || fail "releases/manifest.json is not signed by the release root — run: bash scripts/sign-manifest.sh"
diff --git a/scripts/sign-catalog.sh b/scripts/sign-catalog.sh
index c9ea3727..71ea7021 100755
--- a/scripts/sign-catalog.sh
+++ b/scripts/sign-catalog.sh
@@ -11,7 +11,7 @@ set -euo pipefail
 
 REPO="/home/archipelago/Projects/archy"
 CATALOG="$REPO/releases/app-catalog.json"
-EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
+EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
 
 # Use ONLY the prebuilt signer. If it isn't ready, stop cleanly — never compile
 # here (compiling caused the earlier hangs). Claude builds it in the background.

From c35e33d0a7abdebca15f4d27a0a92674a2868cee Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Tue, 4 Aug 2026 16:33:03 -0400
Subject: [PATCH 15/60] docs(1.7.122): curate release notes and add the in-app
 What's New block

Leads with what changes for the operator: app screens now require the node
password across LAN, Tailscale, mesh and Tor; the wallet/protocol ports that
must stay open stayed open; the mesh leak found during on-node verification;
nodes repairing their own legacy containers; and the signing-key rotation.
Known gaps disclosed, including the eleven still-undeclared ports and that
non-browser clients will now meet the login page.

The new block uses <strong> rather than the literal ** markers in earlier
entries, which render as asterisks in the modal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                    | 11 +++++++++++
 core/Cargo.lock                                 |  2 +-
 core/archipelago/Cargo.toml                     |  2 +-
 neode-ui/package-lock.json                      |  4 ++--
 neode-ui/package.json                           |  2 +-
 .../src/views/settings/AccountInfoSection.vue   | 17 +++++++++++++++++
 6 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6d5c579..c7b8e079 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## v1.7.122-alpha (2026-08-04)
+
+- **Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.
+- **The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.
+- **A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.
+- **Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.
+- Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.
+- The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.
+- **The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.
+- Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
 ## v1.7.121-alpha (2026-08-04)
 
 - **Making another node "Trusted" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.
diff --git a/core/Cargo.lock b/core/Cargo.lock
index 6453ad1a..a7793458 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.121-alpha"
+version = "1.7.122-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
diff --git a/core/archipelago/Cargo.toml b/core/archipelago/Cargo.toml
index a956dab5..8943512c 100644
--- a/core/archipelago/Cargo.toml
+++ b/core/archipelago/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.121-alpha"
+version = "1.7.122-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
diff --git a/neode-ui/package-lock.json b/neode-ui/package-lock.json
index 415000a7..fd8825ee 100644
--- a/neode-ui/package-lock.json
+++ b/neode-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.121-alpha",
+  "version": "1.7.122-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.121-alpha",
+      "version": "1.7.122-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
diff --git a/neode-ui/package.json b/neode-ui/package.json
index 2f1cc1eb..f7375a8e 100644
--- a/neode-ui/package.json
+++ b/neode-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.121-alpha",
+  "version": "1.7.122-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",
diff --git a/neode-ui/src/views/settings/AccountInfoSection.vue b/neode-ui/src/views/settings/AccountInfoSection.vue
index 56553821..3296d9ac 100644
--- a/neode-ui/src/views/settings/AccountInfoSection.vue
+++ b/neode-ui/src/views/settings/AccountInfoSection.vue
@@ -362,6 +362,23 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.122-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.122-alpha</span>
+                  <span class="text-xs text-white/40">August 4, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.</strong> Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app.</p>
+                  <p><strong>The things that must stay open stayed open.</strong> Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.</p>
+                  <p><strong>A private address on your node was answering the mesh without a password.</strong> One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while checking the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.</p>
+                  <p><strong>Tor addresses no longer skip the login.</strong> An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session. Those addresses now arrive at the login gate first, closing the last route that went around it.</p>
+                  <p>Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after being told to move, and each would have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting.</p>
+                  <p>The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened. Both now come from the signed list.</p>
+                  <p><strong>The key that signs these updates has been replaced.</strong> The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.</p>
+                  <p>Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting is what caused two incidents this week. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser apps — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will meet the login page and need an access token; say the word if you use one and it can be exempted. The 5x real-node lifecycle gate was not run for this release.</p>
+                </div>
+              </div>
               <!-- v1.7.121-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

From 53b158ce5a789ba0e1d2a44343d7f37f020cd20b Mon Sep 17 00:00:00 2001
From: ssmithx <atobitcoin@proton.me>
Date: Wed, 5 Aug 2026 09:41:44 +0000
Subject: [PATCH 16/60] fix(wallet): translate Cashu NUT error codes into
 plain-language messages

Mint HTTP failures (swap/melt/mint-quote) were surfacing raw JSON bodies
like {"detail":"proofs already spent","code":11001} straight to the
user. Add a translator for the NUT-02/03/04/05 transaction-validation
error codes (10001-11017, 12001-12003; see
https://github.com/cashubtc/nuts/blob/main/error_codes.md) and layer it
onto the mint_client bail sites via anyhow context, so the top-level
message is actionable while the raw status/body stays available via
{:#} for logs. receive_token now surfaces the real reason (e.g. "This
ecash has already been redeemed") instead of a generic "Failed to
receive any proofs from token" when every mint in a token fails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 core/archipelago/src/wallet/ecash.rs       | 14 +++-
 core/archipelago/src/wallet/mint_client.rs | 76 ++++++++++++++++++++--
 2 files changed, 83 insertions(+), 7 deletions(-)

diff --git a/core/archipelago/src/wallet/ecash.rs b/core/archipelago/src/wallet/ecash.rs
index c374ee3f..30fa5871 100644
--- a/core/archipelago/src/wallet/ecash.rs
+++ b/core/archipelago/src/wallet/ecash.rs
@@ -1040,6 +1040,12 @@ pub async fn receive_token(data_dir: &Path, token_str: &str) -> Result<u64> {
 
     let mut wallet = load_wallet(data_dir).await?;
     let mut received_total = 0u64;
+    // MintClient translates the mint's NUT error code into plain language and
+    // puts it at the top of the error chain (see `mint_error` in
+    // mint_client.rs); `{}` surfaces that, `{:#}` keeps the raw status/body
+    // for the log. Remember the last one so a total failure can tell the user
+    // *why* instead of just "nothing was received".
+    let mut last_reason: Option<String> = None;
 
     // Swap proofs at each mint
     for entry in &token.token {
@@ -1051,14 +1057,18 @@ pub async fn receive_token(data_dir: &Path, token_str: &str) -> Result<u64> {
                 received_total += amount;
             }
             Err(e) => {
-                warn!("Failed to swap proofs from mint {}: {}", entry.mint, e);
+                warn!("Failed to swap proofs from mint {}: {:#}", entry.mint, e);
+                last_reason = Some(e.to_string());
                 // Continue with other mints if any
             }
         }
     }
 
     if received_total == 0 {
-        anyhow::bail!("Failed to receive any proofs from token");
+        match last_reason {
+            Some(reason) => anyhow::bail!("Could not receive this ecash: {}", reason),
+            None => anyhow::bail!("Failed to receive any proofs from token"),
+        }
     }
 
     wallet.record_tx(
diff --git a/core/archipelago/src/wallet/mint_client.rs b/core/archipelago/src/wallet/mint_client.rs
index 3347137d..e92a6374 100644
--- a/core/archipelago/src/wallet/mint_client.rs
+++ b/core/archipelago/src/wallet/mint_client.rs
@@ -59,6 +59,72 @@ pub struct MintResult {
     pub proofs: Vec<Proof>,
 }
 
+/// Translate a Cashu NUT "transaction validation" error code into plain
+/// language a wallet user can act on. Mints respond to a rejected request
+/// with `{"code": N, "detail": "..."}`; `detail` is implementation-defined
+/// free text, but `code` is the stable identifier from the spec
+/// (https://github.com/cashubtc/nuts/blob/main/error_codes.md). Covers the
+/// 10001-11017 "proof/transaction validation" range plus the 12001-12003
+/// keyset codes shared by NUT-02/03/04/05 — the codes a swap/melt/mint call
+/// can actually hit. Returns `None` for anything else (e.g. Lightning/quote
+/// codes in the 20000s) so the caller falls back to the mint's own `detail`.
+fn describe_mint_error_code(code: i64) -> Option<&'static str> {
+    Some(match code {
+        10001 => "The mint rejected these coins as invalid.",
+        11001 => "This ecash has already been redeemed — it can't be claimed twice.",
+        11002 => "This ecash is already being redeemed elsewhere — try again in a moment.",
+        11003 => "The mint already issued new coins for this exact request — there's nothing left to redeem.",
+        11004 => "This request is still being processed by the mint — try again in a moment.",
+        11005 => "The token's amounts don't add up (inputs don't match outputs) — it may be corrupt.",
+        11006 => "That amount is outside the range this mint allows.",
+        11007 => "This token contains duplicate coins — it may be corrupt or already used.",
+        11008 => "The mint rejected this as a duplicate request.",
+        11009 | 11010 => "This token mixes incompatible currency units — the mint rejected it.",
+        11011 => "That Lightning invoice has no amount, which isn't supported here.",
+        11012 => "The amount requested doesn't match the Lightning invoice.",
+        11013 => "The mint doesn't support this currency unit.",
+        11014 | 11015 => "This token has too many coins for the mint to process in one request.",
+        11016 => "Duplicate quote IDs were sent in this request.",
+        11017 => "Too many items were sent in a single request.",
+        12001 => "The mint no longer recognizes the keyset that signed this token.",
+        12002 => "The mint's signing key for this token is inactive.",
+        12003 => "The mint's signing key for this token has expired.",
+        _ => return None,
+    })
+}
+
+/// Parse a mint's error body (`{"code": N, "detail": "..."}`) and pick the
+/// best user-facing message: the plain-language translation when we know the
+/// code, otherwise the mint's own `detail` text, otherwise the raw body.
+fn describe_mint_error_body(status: reqwest::StatusCode, body: &str) -> String {
+    let parsed: Option<serde_json::Value> = serde_json::from_str(body).ok();
+    let code = parsed
+        .as_ref()
+        .and_then(|v| v.get("code"))
+        .and_then(|c| c.as_i64());
+    let detail = parsed
+        .as_ref()
+        .and_then(|v| v.get("detail"))
+        .and_then(|d| d.as_str());
+
+    if let Some(friendly) = code.and_then(describe_mint_error_code) {
+        return friendly.to_string();
+    }
+    match detail {
+        Some(d) if !d.is_empty() => d.to_string(),
+        _ => format!("mint returned {} with no further detail", status),
+    }
+}
+
+/// Build the error for a failed mint HTTP call: `op` + status + raw body as
+/// the technical cause (visible via `{:#}` in logs), with the plain-language
+/// translation layered on top via `.context()` so `{}` — what reaches the
+/// wallet user — shows something actionable instead of raw mint JSON.
+fn mint_error(op: &str, status: reqwest::StatusCode, body: &str) -> anyhow::Error {
+    let friendly = describe_mint_error_body(status, body);
+    anyhow::anyhow!("{} failed ({}): {}", op, status, body).context(friendly)
+}
+
 /// HTTP client for a single Cashu mint.
 pub struct MintClient {
     url: String,
@@ -146,7 +212,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Mint quote failed ({}): {}", status, body);
+            return Err(mint_error("Mint quote", status, &body));
         }
 
         res.json().await.context("Failed to parse mint quote")
@@ -212,7 +278,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Mint tokens failed ({}): {}", status, body);
+            return Err(mint_error("Minting tokens", status, &body));
         }
 
         let body: serde_json::Value = res.json().await.context("Failed to parse mint response")?;
@@ -266,7 +332,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Melt quote failed ({}): {}", status, body);
+            return Err(mint_error("Melt quote", status, &body));
         }
 
         res.json().await.context("Failed to parse melt quote")
@@ -293,7 +359,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Melt failed ({}): {}", status, body);
+            return Err(mint_error("Melt", status, &body));
         }
 
         res.json().await.context("Failed to parse melt response")
@@ -337,7 +403,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Swap failed ({}): {}", status, body);
+            return Err(mint_error("Swap", status, &body));
         }
 
         let body: serde_json::Value = res.json().await.context("Failed to parse swap response")?;

From b92e16abc0ae5384a71b170aaf62bee40fa82308 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 07:48:51 -0400
Subject: [PATCH 17/60] =?UTF-8?q?fix(release):=20sign=20v1.7.122=20with=20?=
 =?UTF-8?q?the=20OLD=20root=20=E2=80=94=20the=20rotation=20moved=20the=20c?=
 =?UTF-8?q?hecks=20a=20release=20early?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rotation commit pointed create-release.sh and publish-release-assets.sh
at the NEW root in the same commit that pins it in the binary. But the
release CARRYING the rotation must be signed with the OLD root: every node
is still running the previous binary, which pins the old key. So the
tooling would have rejected the only signature the fleet can accept, and
the signature it demanded would have ended OTA fleet-wide.

Both checks now expect the old DID for this cycle, with the flip to the new
one called out for v1.7.123+. sign-manifest.sh documents the
ARCHY_RELEASE_ROOT_PUBKEY override needed because the signer built from
this tree already pins the new anchor and would fail to verify its own
correct output.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/create-release.sh         | 14 +++++++++++++-
 scripts/publish-release-assets.sh |  6 +++++-
 scripts/sign-manifest.sh          | 13 +++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/scripts/create-release.sh b/scripts/create-release.sh
index d836ff9b..c160d545 100755
--- a/scripts/create-release.sh
+++ b/scripts/create-release.sh
@@ -240,7 +240,19 @@ install -m 0644 "$FRONTEND_ARCHIVE" "$VERSION_DIR/archipelago-frontend-${VERSION
 # warning and falls through — and the commit then happened anyway. A release
 # commit carrying a manifest no node will accept has no valid use, so refuse
 # to create one rather than leave a tag that has to be re-cut.
-EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
+# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha) — this is the OLD root, deliberately.
+#
+# The trust anchor in the binary already pins the NEW root
+# (z6Mkfu5LT…DLWT), because this release is what installs that pin. But the
+# manifest THIS release ships must be signed with the OLD root
+# (z6Mkkid…q7ur): every node is still running the previous binary, which
+# pins the old key and would reject anything else. Signing this one with the
+# new key ends OTA fleet-wide and needs hands-on recovery per node.
+#
+# ➜ NEXT RELEASE (v1.7.123+): change this to the new DID, and the same line
+#   in publish-release-assets.sh. By then every node runs a binary pinning
+#   the new root, and an old-key signature is the one that gets rejected.
+EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
 if ! grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     || ! grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json"; then
     echo "" >&2
diff --git a/scripts/publish-release-assets.sh b/scripts/publish-release-assets.sh
index f5ba3d72..1079238a 100755
--- a/scripts/publish-release-assets.sh
+++ b/scripts/publish-release-assets.sh
@@ -29,7 +29,11 @@ fail() { echo "Error: $*" >&2; exit 1; }
 # with the pinned release-root anchor refuse to auto-apply unsigned manifests,
 # and enforcement will tighten to hard-reject — an unsigned publish would
 # strand them. Grep proves presence; ceremony verify proves the crypto.
-EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
+# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha) — OLD root on purpose; see the same
+# block in create-release.sh. Nodes still run the previous binary and pin the
+# old key, so the manifest this release publishes must carry an old-key
+# signature. Flip both to z6Mkfu5LT…DLWT for v1.7.123+.
+EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
 grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     && grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json" \
     || fail "releases/manifest.json is not signed by the release root — run: bash scripts/sign-manifest.sh"
diff --git a/scripts/sign-manifest.sh b/scripts/sign-manifest.sh
index 7bb0f989..62e7a7d8 100755
--- a/scripts/sign-manifest.sh
+++ b/scripts/sign-manifest.sh
@@ -11,6 +11,19 @@
 # Normally create-release.sh signs the manifest inline; this script exists for
 # re-signing (e.g. a manifest edited after creation) or signing on a box where
 # the release run was non-interactive.
+#
+# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha). This release must be signed with the
+# OLD release root, because every node still runs a binary pinning it — but
+# the signer built from THIS tree already pins the NEW root, so its own
+# verification would reject a correct old-key signature. Pin the old anchor
+# for the duration of the ceremony so signing and verification agree:
+#
+#   ARCHY_RELEASE_ROOT_PUBKEY=5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951 \
+#     bash scripts/sign-manifest.sh
+#
+# That hex is the OLD root's PUBLIC key (verified to derive to
+# did:key:z6Mkkid…q7ur); it is not secret and pins verification only.
+# From v1.7.123 the override is unnecessary — drop it and this block.
 set -euo pipefail
 
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

From 634640944c713078f9e59a0d56b75e83447fb26d Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 07:57:07 -0400
Subject: [PATCH 18/60] chore: release v1.7.122-alpha

---
 release-manifest.json  | 44 +++++++++++++++++++++---------------------
 releases/manifest.json | 44 +++++++++++++++++++++---------------------
 2 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/release-manifest.json b/release-manifest.json
index 8c2b689d..22dd4ab6 100644
--- a/release-manifest.json
+++ b/release-manifest.json
@@ -1,34 +1,34 @@
 {
   "changelog": [
-    "**Making another node \"Trusted\" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.",
-    "**Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.",
-    "The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.",
-    "The Lightning screen will actually update from now on. Its image was set to \"latest\", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.",
-    "Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.",
-    "Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.",
-    "Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.",
-    "Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision)."
+    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
+    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
+    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
+    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
+    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
+    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
+    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
+    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.121-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago",
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.121-alpha",
-      "sha256": "be5ef9fb284f539b06329d4108be53e55ae8cdb06cf1cf4beb90363de364706d",
-      "size_bytes": 54870968
+      "new_version": "1.7.122-alpha",
+      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
+      "size_bytes": 54957496
     },
     {
-      "current_version": "1.7.121-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago-frontend-1.7.121-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.121-alpha.tar.gz",
-      "new_version": "1.7.121-alpha",
-      "sha256": "7898a9c11fa30cadc8f0fcf814bba1e3870d20663472f4c40e8e663b2359958f",
-      "size_bytes": 210526689
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
+      "new_version": "1.7.122-alpha",
+      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
+      "size_bytes": 210528707
     }
   ],
-  "release_date": "2026-08-04",
-  "signature": "9d871c946e941b3c13f75fb799d8428841147267f4565920993ddd3aa0cd52d6d1a74481303cbbb26e68e6e5d44e2b711c9b7a22ad7dd73c94b4d3e39a0e2803",
+  "release_date": "2026-08-05",
+  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.121-alpha"
+  "version": "1.7.122-alpha"
 }
diff --git a/releases/manifest.json b/releases/manifest.json
index 8c2b689d..22dd4ab6 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,34 +1,34 @@
 {
   "changelog": [
-    "**Making another node \"Trusted\" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.",
-    "**Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.",
-    "The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.",
-    "The Lightning screen will actually update from now on. Its image was set to \"latest\", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.",
-    "Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.",
-    "Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.",
-    "Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.",
-    "Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision)."
+    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
+    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
+    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
+    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
+    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
+    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
+    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
+    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.121-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago",
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.121-alpha",
-      "sha256": "be5ef9fb284f539b06329d4108be53e55ae8cdb06cf1cf4beb90363de364706d",
-      "size_bytes": 54870968
+      "new_version": "1.7.122-alpha",
+      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
+      "size_bytes": 54957496
     },
     {
-      "current_version": "1.7.121-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.121-alpha/archipelago-frontend-1.7.121-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.121-alpha.tar.gz",
-      "new_version": "1.7.121-alpha",
-      "sha256": "7898a9c11fa30cadc8f0fcf814bba1e3870d20663472f4c40e8e663b2359958f",
-      "size_bytes": 210526689
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
+      "new_version": "1.7.122-alpha",
+      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
+      "size_bytes": 210528707
     }
   ],
-  "release_date": "2026-08-04",
-  "signature": "9d871c946e941b3c13f75fb799d8428841147267f4565920993ddd3aa0cd52d6d1a74481303cbbb26e68e6e5d44e2b711c9b7a22ad7dd73c94b4d3e39a0e2803",
+  "release_date": "2026-08-05",
+  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.121-alpha"
+  "version": "1.7.122-alpha"
 }

From abf0f56afc130a24c09acf70dfb71e484083670b Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 08:46:09 -0400
Subject: [PATCH 19/60] fix(security): close the five host-networked app UIs
 the audit could not see
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scanning archi-dev-box from OUTSIDE found five ports serving their screens
with no login — lnd-ui 18083, bitcoin-ui 8334, fips-ui 8336, electrs-ui
50002 and the Fedimint Guardian 8175 — none of which appeared in the gate's
unprotected list. They are host-networked, so Podman publishes nothing to
pin and their manifests declared 'ports: []'; the gate builds its map from
declared ports, so it neither protected them nor reported them. An audit
that reports success while five screens are open is worse than no audit.

Their nginx now listens on 127.0.0.1 instead of 0.0.0.0, and each port is
declared 'auth: gated' so the daemon owns the outside. 'bind:' on a
host-networked app is a statement of where the container listens, not a
publish instruction — quadlet already skips PublishPort in host mode.
Guardian 8175 is declared on the fedimint app because its companion has no
manifest, and the gate keys on port, not container.

Credential paths were NOT exposed and are verified so: /lnd-connect-info,
the /proxy/lnd/ passthrough, container logs and every RPC method through
these screens all return 401 unauthenticated. What leaked was the page
shell.

Also fixes the delivery gap that would have made this unshippable: only
bitcoin-ui, lnd-ui and electrs-ui were ever rsynced to
/opt/archipelago/docker, so edits to fips-ui and fedimint-ui reached nodes
through no path at all. All five now sync; the two whose rebuilds the
daemon owns are synced without being handed to container-specs.

Every remaining undeclared port is now declared with a stated reason —
gated: botfights 9100, router 8084, pine 10380; exempt with rationale:
fedimint consensus 8173/8174, gateway 8176/9737, netbird 8086/8087 (TLS +
own auth, and enrolled devices cannot hold a session), pine TLS 10381,
lightning-stack REST 8091 (macaroon, mirrors lnd). Zero undeclared ports
remain across all 56 manifests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/bitcoin-ui/manifest.yml                  | 13 +++-
 apps/botfights/manifest.yml                   |  2 +
 apps/electrs-ui/manifest.yml                  | 13 +++-
 apps/fedimint-gateway/manifest.yml            |  8 ++
 apps/fedimint/manifest.yml                    | 18 +++++
 apps/fips-ui/manifest.yml                     | 13 +++-
 apps/lightning-stack/manifest.yml             |  5 ++
 apps/lnd-ui/manifest.yml                      | 13 +++-
 apps/netbird-server/manifest.yml              |  5 ++
 apps/netbird/manifest.yml                     |  5 ++
 apps/pine/manifest.yml                        |  7 ++
 apps/router/manifest.yml                      |  2 +
 core/archipelago/src/container/bitcoin_ui.rs  |  2 +-
 .../container/bitcoin_ui_nginx.conf.template  |  9 ++-
 docker/electrs-ui/nginx.conf                  |  9 ++-
 docker/fedimint-ui/nginx.conf                 |  9 ++-
 docker/fips-ui/nginx.conf                     |  9 ++-
 docker/lnd-ui/nginx.conf                      |  9 ++-
 releases/app-catalog.json                     | 73 +++++++++++++++++--
 scripts/self-update.sh                        | 26 ++++++-
 20 files changed, 230 insertions(+), 20 deletions(-)

diff --git a/apps/bitcoin-ui/manifest.yml b/apps/bitcoin-ui/manifest.yml
index a9e10f4d..6fb05656 100644
--- a/apps/bitcoin-ui/manifest.yml
+++ b/apps/bitcoin-ui/manifest.yml
@@ -31,7 +31,18 @@ app:
   # proxies to 127.0.0.1:8332 which is where the bitcoin backend binds
   # its RPC. `ports:` is intentionally empty because host networking
   # bypasses port mapping.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the Bitcoin screen unauthenticated on every interface.
+  ports:
+    - host: 8334
+      container: 8334
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     # Bind-mount the rendered nginx.conf read-only. The prod orchestrator
diff --git a/apps/botfights/manifest.yml b/apps/botfights/manifest.yml
index eba5410c..a7e3e1fd 100644
--- a/apps/botfights/manifest.yml
+++ b/apps/botfights/manifest.yml
@@ -62,6 +62,8 @@ app:
     - host: 9100
       container: 9100
       protocol: tcp  # Web UI + API
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     # A bare relative source (was "botfights-data", no leading slash) is
diff --git a/apps/electrs-ui/manifest.yml b/apps/electrs-ui/manifest.yml
index 0d5f6be3..4f224565 100644
--- a/apps/electrs-ui/manifest.yml
+++ b/apps/electrs-ui/manifest.yml
@@ -23,7 +23,18 @@ app:
     network_policy: host
 
   # Host networking: nginx listens on 50002 directly on the host IP.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the Electrs screen unauthenticated on every interface.
+  ports:
+    - host: 50002
+      container: 50002
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes: []
 
diff --git a/apps/fedimint-gateway/manifest.yml b/apps/fedimint-gateway/manifest.yml
index 9363bb10..42ed8239 100644
--- a/apps/fedimint-gateway/manifest.yml
+++ b/apps/fedimint-gateway/manifest.yml
@@ -60,9 +60,17 @@ app:
     - host: 8176
       container: 8176
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint gateway API, protected by its own bcrypt password (--bcrypt-password-hash)
+        and reached by federation peers and clients that cannot hold a browser session.
     - host: 9737
       container: 9737
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        LDK Lightning p2p for the gateway. The BOLT-8 noise handshake authenticates and
+        encrypts the connection itself.
 
   volumes:
     - type: bind
diff --git a/apps/fedimint/manifest.yml b/apps/fedimint/manifest.yml
index c3c7985a..e93fcf0e 100644
--- a/apps/fedimint/manifest.yml
+++ b/apps/fedimint/manifest.yml
@@ -50,11 +50,29 @@ app:
     - host: 8173
       container: 8173
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint guardian consensus. Other guardians speak the federation's own
+        authenticated protocol here; a login page would break consensus.
     - host: 8174
       container: 8174
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint guardian API for federation clients, which authenticate to the
+        federation itself and cannot hold a browser session.
     # Public launch port 8175 is owned by archy-fedimint-ui, which serves a
     # wait page while Bitcoin syncs and proxies here after fedimintd starts.
+    # Declared HERE because that companion has no manifest of its own, and the
+    # gate keys on the port rather than the container: without this entry it
+    # served the Guardian UI unauthenticated on every interface and never
+    # appeared in the audit. Its nginx is pinned to 127.0.0.1
+    # (docker/fedimint-ui/nginx.conf) so the gate can own the outside.
+    - host: 8175
+      container: 8175
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
     - host: 8177
       container: 8175
       protocol: tcp
diff --git a/apps/fips-ui/manifest.yml b/apps/fips-ui/manifest.yml
index 6983387c..e16c49f9 100644
--- a/apps/fips-ui/manifest.yml
+++ b/apps/fips-ui/manifest.yml
@@ -27,7 +27,18 @@ app:
   # Host networking: nginx listens on 8336 directly on the host IP and
   # proxies to 127.0.0.1:5678 (the archipelago RPC). `ports:` is
   # intentionally empty because host networking bypasses port mapping.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the FIPS mesh screen unauthenticated on every interface.
+  ports:
+    - host: 8336
+      container: 8336
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes: []
 
diff --git a/apps/lightning-stack/manifest.yml b/apps/lightning-stack/manifest.yml
index ac7fc9fe..e9befcd6 100644
--- a/apps/lightning-stack/manifest.yml
+++ b/apps/lightning-stack/manifest.yml
@@ -41,9 +41,14 @@ app:
       auth: none
       auth_rationale: >-
         LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.
+    # Mirrors lnd's 18080 exemption — same LND REST API, same macaroon auth.
     - host: 8091
       container: 8080
       protocol: tcp  # REST/Web UI
+      auth: none
+      auth_rationale: >-
+        LND REST, authenticated by macaroon over TLS. A browser login page would break
+        Zeus and every non-browser wallet client, exactly as for lnd's 18080.
     
   volumes:
     - type: bind
diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml
index 713a1afe..cf186bcf 100644
--- a/apps/lnd-ui/manifest.yml
+++ b/apps/lnd-ui/manifest.yml
@@ -35,7 +35,18 @@ app:
   # port to a container port where nothing listens. scripts/container-specs.sh
   # carried the identical mistake and was fixed alongside this; recreating from
   # it on archi-dev-box left :18083 refusing connections.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the LND screen unauthenticated on every interface.
+  ports:
+    - host: 18083
+      container: 18083
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes: []
 
diff --git a/apps/netbird-server/manifest.yml b/apps/netbird-server/manifest.yml
index 994949f6..287be710 100644
--- a/apps/netbird-server/manifest.yml
+++ b/apps/netbird-server/manifest.yml
@@ -48,6 +48,11 @@ app:
     - host: 8086
       container: 80
       protocol: tcp   # management API + embedded OIDC issuer (/oauth2)
+      auth: none
+      auth_rationale: >-
+        NetBird management API and its OIDC issuer. Enrolled devices authenticate
+        themselves with setup keys and JWTs, and they cannot hold a browser session —
+        a login page here would disconnect every VPN client on the network.
     - host: 3478
       container: 3478
       protocol: udp   # STUN — must be UDP; tcp here breaks relay discovery
diff --git a/apps/netbird/manifest.yml b/apps/netbird/manifest.yml
index 6464335a..32cf44d5 100644
--- a/apps/netbird/manifest.yml
+++ b/apps/netbird/manifest.yml
@@ -44,6 +44,11 @@ app:
     - host: 8087
       container: 443
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        NetBird dashboard over TLS, with its own login. The gate speaks plain HTTP,
+        so fronting this port would break the secure context the dashboard requires
+        (issue #15) and the certificate clients pin.
 
   volumes:
     - type: bind
diff --git a/apps/pine/manifest.yml b/apps/pine/manifest.yml
index 3984cd3f..c673df3e 100644
--- a/apps/pine/manifest.yml
+++ b/apps/pine/manifest.yml
@@ -53,9 +53,16 @@ app:
     - host: 10380
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
     - host: 10381
       container: 443
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Pine's TLS listener. The gate speaks plain HTTP, so fronting this port would
+        break the secure context navigator.bluetooth needs for WiFi provisioning.
+        The plain-HTTP entry point (10380) is gated, and it is what the UI opens.
 
   volumes:
     - type: bind
diff --git a/apps/router/manifest.yml b/apps/router/manifest.yml
index fb4300d4..bada2040 100644
--- a/apps/router/manifest.yml
+++ b/apps/router/manifest.yml
@@ -30,6 +30,8 @@ app:
     - host: 8084
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     - host: 5353
       container: 5353
       protocol: udp  # mDNS/Bonjour
diff --git a/core/archipelago/src/container/bitcoin_ui.rs b/core/archipelago/src/container/bitcoin_ui.rs
index eec7526a..37759a54 100644
--- a/core/archipelago/src/container/bitcoin_ui.rs
+++ b/core/archipelago/src/container/bitcoin_ui.rs
@@ -293,6 +293,6 @@ mod tests {
         // Lock in the core shape so a bad template edit doesn't ship.
         assert!(TEMPLATE.contains("proxy_pass http://127.0.0.1:8332/"));
         assert!(TEMPLATE.contains("location /bitcoin-rpc/"));
-        assert!(TEMPLATE.contains("listen 8334"));
+        assert!(TEMPLATE.contains("listen 127.0.0.1:8334"));
     }
 }
diff --git a/core/archipelago/src/container/bitcoin_ui_nginx.conf.template b/core/archipelago/src/container/bitcoin_ui_nginx.conf.template
index 6e7e2bdb..ddd4c1b6 100644
--- a/core/archipelago/src/container/bitcoin_ui_nginx.conf.template
+++ b/core/archipelago/src/container/bitcoin_ui_nginx.conf.template
@@ -1,5 +1,12 @@
 server {
-    listen 8334;
+    # Loopback ONLY. This container is host-networked, so this nginx binds the
+    # HOST's address directly — `listen 8334;` meant every interface, and the
+    # app gate could never stand in front of it (there is no podman publish to
+    # pin, and the manifest declared no port, so the gate neither protected it
+    # nor reported it — it served this page to anyone who asked, on LAN,
+    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
+    # external addresses and authenticate them; see appgate::listener.
+    listen 127.0.0.1:8334;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;
diff --git a/docker/electrs-ui/nginx.conf b/docker/electrs-ui/nginx.conf
index 9f927d8f..b9d4932f 100644
--- a/docker/electrs-ui/nginx.conf
+++ b/docker/electrs-ui/nginx.conf
@@ -1,5 +1,12 @@
 server {
-    listen 50002;
+    # Loopback ONLY. This container is host-networked, so this nginx binds the
+    # HOST's address directly — `listen 50002;` meant every interface, and the
+    # app gate could never stand in front of it (there is no podman publish to
+    # pin, and the manifest declared no port, so the gate neither protected it
+    # nor reported it — it served this page to anyone who asked, on LAN,
+    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
+    # external addresses and authenticate them; see appgate::listener.
+    listen 127.0.0.1:50002;
     server_name _;
 
     root /usr/share/nginx/html;
diff --git a/docker/fedimint-ui/nginx.conf b/docker/fedimint-ui/nginx.conf
index 8a8539af..a4136378 100644
--- a/docker/fedimint-ui/nginx.conf
+++ b/docker/fedimint-ui/nginx.conf
@@ -1,5 +1,12 @@
 server {
-    listen 8175;
+    # Loopback ONLY. This container is host-networked, so this nginx binds the
+    # HOST's address directly — `listen 8175;` meant every interface, and the
+    # app gate could never stand in front of it (there is no podman publish to
+    # pin, and the manifest declared no port, so the gate neither protected it
+    # nor reported it — it served this page to anyone who asked, on LAN,
+    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
+    # external addresses and authenticate them; see appgate::listener.
+    listen 127.0.0.1:8175;
     server_name _;
 
     proxy_intercept_errors on;
diff --git a/docker/fips-ui/nginx.conf b/docker/fips-ui/nginx.conf
index 5faf33c5..b2d8eae6 100644
--- a/docker/fips-ui/nginx.conf
+++ b/docker/fips-ui/nginx.conf
@@ -1,5 +1,12 @@
 server {
-    listen 8336;
+    # Loopback ONLY. This container is host-networked, so this nginx binds the
+    # HOST's address directly — `listen 8336;` meant every interface, and the
+    # app gate could never stand in front of it (there is no podman publish to
+    # pin, and the manifest declared no port, so the gate neither protected it
+    # nor reported it — it served this page to anyone who asked, on LAN,
+    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
+    # external addresses and authenticate them; see appgate::listener.
+    listen 127.0.0.1:8336;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;
diff --git a/docker/lnd-ui/nginx.conf b/docker/lnd-ui/nginx.conf
index 2c372562..c6ad7386 100644
--- a/docker/lnd-ui/nginx.conf
+++ b/docker/lnd-ui/nginx.conf
@@ -1,7 +1,14 @@
 server {
     # Host-networked: listen on the app's own port directly (NOT 80, which the
     # host's main nginx already owns). The app is reached at http(s)://<node>:18083.
-    listen 18083;
+    # Loopback ONLY. This container is host-networked, so this nginx binds the
+    # HOST's address directly — `listen 18083;` meant every interface, and the
+    # app gate could never stand in front of it (there is no podman publish to
+    # pin, and the manifest declared no port, so the gate neither protected it
+    # nor reported it — it served this page to anyone who asked, on LAN,
+    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
+    # external addresses and authenticate them; see appgate::listener.
+    listen 127.0.0.1:18083;
     server_name _;
 
     root /usr/share/nginx/html;
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 11feb497..5a304b38 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -711,7 +711,15 @@
           },
           "id": "bitcoin-ui",
           "name": "Bitcoin UI",
-          "ports": [],
+          "ports": [
+            {
+              "auth": "gated",
+              "bind": "127.0.0.1",
+              "container": 8334,
+              "host": 8334,
+              "protocol": "tcp"
+            }
+          ],
           "resources": {
             "memory_limit": "128Mi"
           },
@@ -805,6 +813,8 @@
           "name": "BotFights",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 9100,
               "host": 9100,
               "protocol": "tcp"
@@ -1159,7 +1169,15 @@
           },
           "id": "electrs-ui",
           "name": "Electrs UI",
-          "ports": [],
+          "ports": [
+            {
+              "auth": "gated",
+              "bind": "127.0.0.1",
+              "container": 50002,
+              "host": 50002,
+              "protocol": "tcp"
+            }
+          ],
           "resources": {
             "memory_limit": "64Mi"
           },
@@ -1355,15 +1373,26 @@
           "name": "Fedimint Guardian",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Fedimint guardian consensus. Other guardians speak the federation's own authenticated protocol here; a login page would break consensus.",
               "container": 8173,
               "host": 8173,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Fedimint guardian API for federation clients, which authenticate to the federation itself and cannot hold a browser session.",
               "container": 8174,
               "host": 8174,
               "protocol": "tcp"
             },
+            {
+              "auth": "gated",
+              "bind": "127.0.0.1",
+              "container": 8175,
+              "host": 8175,
+              "protocol": "tcp"
+            },
             {
               "auth": "local",
               "bind": "127.0.0.1",
@@ -1548,11 +1577,15 @@
           "name": "Fedimint Gateway",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Fedimint gateway API, protected by its own bcrypt password (--bcrypt-password-hash) and reached by federation peers and clients that cannot hold a browser session.",
               "container": 8176,
               "host": 8176,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LDK Lightning p2p for the gateway. The BOLT-8 noise handshake authenticates and encrypts the connection itself.",
               "container": 9737,
               "host": 9737,
               "protocol": "tcp"
@@ -1700,7 +1733,15 @@
           },
           "id": "fips-ui",
           "name": "FIPS Mesh",
-          "ports": [],
+          "ports": [
+            {
+              "auth": "gated",
+              "bind": "127.0.0.1",
+              "container": 8336,
+              "host": 8336,
+              "protocol": "tcp"
+            }
+          ],
           "resources": {
             "memory_limit": "128Mi"
           },
@@ -2909,6 +2950,8 @@
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client, exactly as for lnd's 18080.",
               "container": 8080,
               "host": 8091,
               "protocol": "tcp"
@@ -3078,7 +3121,15 @@
           },
           "id": "lnd-ui",
           "name": "LND UI",
-          "ports": [],
+          "ports": [
+            {
+              "auth": "gated",
+              "bind": "127.0.0.1",
+              "container": 18083,
+              "host": 18083,
+              "protocol": "tcp"
+            }
+          ],
           "resources": {
             "memory_limit": "64Mi"
           },
@@ -3413,6 +3464,8 @@
           "name": "NetBird",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "NetBird dashboard over TLS, with its own login. The gate speaks plain HTTP, so fronting this port would break the secure context the dashboard requires (issue #15) and the certificate clients pin.",
               "container": 443,
               "host": 8087,
               "protocol": "tcp"
@@ -3617,6 +3670,8 @@
           "name": "NetBird Server",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "NetBird management API and its OIDC issuer. Enrolled devices authenticate themselves with setup keys and JWTs, and they cannot hold a browser session — a login page here would disconnect every VPN client on the network.",
               "container": 80,
               "host": 8086,
               "protocol": "tcp"
@@ -4012,11 +4067,15 @@
           "name": "Pine",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 10380,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Pine's TLS listener. The gate speaks plain HTTP, so fronting this port would break the secure context navigator.bluetooth needs for WiFi provisioning. The plain-HTTP entry point (10380) is gated, and it is what the UI opens.",
               "container": 443,
               "host": 10381,
               "protocol": "tcp"
@@ -4458,6 +4517,8 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8084,
               "protocol": "tcp"
@@ -4837,7 +4898,5 @@
     }
   },
   "schema": 1,
-  "signature": "cc83d0be50ce6144e2b5693a7175d7743d4a19141f4ef9a46a3c88d2dadd848acda9c25063e7a8b5643cecb2ccde279762a00a9715a5d26c99a95b492bc82a05",
-  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "updated": "2026-08-04"
+  "updated": "2026-08-05"
 }
diff --git a/scripts/self-update.sh b/scripts/self-update.sh
index 99ea24f6..fb2ed45f 100755
--- a/scripts/self-update.sh
+++ b/scripts/self-update.sh
@@ -321,7 +321,17 @@ fi
 UI_DOCKER_DEST="/opt/archipelago/docker"
 sudo mkdir -p "$UI_DOCKER_DEST"
 UI_REBUILD_LIST=""
-for ui in bitcoin-ui lnd-ui electrs-ui; do
+# fips-ui and fedimint-ui are synced but NOT added to UI_REBUILD_LIST below:
+# container-specs.sh has no spec for either (and their container names break
+# the archy-<ui> assumption — the FIPS one is plain `fips-ui`). Their rebuilds
+# come from elsewhere — the daemon's companion installer for fedimint-ui, the
+# orchestrator's build context for fips-ui — but BOTH read
+# /opt/archipelago/docker/<ui>, and nothing was ever updating that directory.
+# So source edits to those two trees reached nodes through no path at all:
+# their nginx kept listening on 0.0.0.0 and served the Guardian and FIPS
+# screens unauthenticated on every interface (found by scanning archi-dev-box
+# from outside, 2026-08-05 — the in-node audit could not see them).
+for ui in bitcoin-ui lnd-ui electrs-ui fips-ui fedimint-ui; do
     src="$REPO_DIR/docker/$ui"
     dst="$UI_DOCKER_DEST/$ui"
     [ -d "$src" ] || continue
@@ -335,9 +345,19 @@ for ui in bitcoin-ui lnd-ui electrs-ui; do
         dst_hash=$( (cd "$dst" && find . -type f | LC_ALL=C sort | xargs sha256sum 2>/dev/null) | sha256sum | cut -d' ' -f1)
     fi
     if [ "$src_hash" != "$dst_hash" ]; then
-        log "UI source changed for $ui; syncing and marking for rebuild"
+        log "UI source changed for $ui; syncing"
         sudo rsync -a --delete "$src/" "$dst/"
-        UI_REBUILD_LIST="$UI_REBUILD_LIST $ui"
+        case "$ui" in
+            # Rebuilt below from container-specs.sh.
+            bitcoin-ui|lnd-ui|electrs-ui)
+                UI_REBUILD_LIST="$UI_REBUILD_LIST $ui" ;;
+            # Synced only — rebuilt by the daemon (companion installer /
+            # orchestrator build context), which watches this directory.
+            # Adding them to the rebuild list would fail: no spec exists and
+            # the container names are not archy-<ui>.
+            *)
+                log "  $ui synced; rebuild is owned by the daemon" ;;
+        esac
     else
         ok "UI source unchanged for $ui"
     fi

From 9c736f20b69ddc693a5638a5afeef252d6092503 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 09:07:05 -0400
Subject: [PATCH 20/60] fix(security): publish the loopback-pinned UI images
 and pin the new tags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fresh installs pull *-ui images from the registry, so the source fix alone
left a newly flashed node serving the Bitcoin, LND, Electrs, FIPS and
Guardian screens with no login. All five rebuilt and pushed to
146.59.87.168:3000/lfg2025 as 1.7.123-alpha AND :latest — both tags,
because first-boot resolves the pinned tag from image-versions.sh while the
daemon's companion installer hardcodes :latest, and a stale :latest would
have quietly undone the fix on exactly the path that rebuilds companions.

Verified by pulling each image back from the registry anonymously and
reading /etc/nginx/conf.d/default.conf inside it — a private package would
make fresh nodes fall back to a stale local image without saying so.

Also fixes the FOURTH copy of bitcoin-ui's listen directive
(scripts/reconcile-containers.sh wrote 'listen 8334' into the rendered
nginx.conf on every reconcile, which would have re-opened the port after
the image and template were both corrected).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/image-versions.sh       | 8 ++++----
 scripts/reconcile-containers.sh | 7 ++++++-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh
index 4e349e80..6857c803 100644
--- a/scripts/image-versions.sh
+++ b/scripts/image-versions.sh
@@ -84,7 +84,7 @@ STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
 NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.7"
 NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
 FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
-FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
+FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:1.7.123-alpha"
 
 # AI / Routing
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
@@ -117,9 +117,9 @@ PENPOT_EXPORTER_IMAGE="$ARCHY_REGISTRY/penpot-exporter:2.4"
 PENPOT_FRONTEND_IMAGE="$ARCHY_REGISTRY/penpot-frontend:2.4"
 
 # Custom UI containers (built from docker/ dirs, pushed to registry)
-BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.119-alpha"
-LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.119-alpha"
-ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:latest"
+BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.123-alpha"
+LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.123-alpha"
+ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:1.7.123-alpha"
 
 # Base images
 NGINX_ALPINE_IMAGE="$ARCHY_REGISTRY/nginx:1.27.4-alpine"
diff --git a/scripts/reconcile-containers.sh b/scripts/reconcile-containers.sh
index 9f515a83..2c585856 100755
--- a/scripts/reconcile-containers.sh
+++ b/scripts/reconcile-containers.sh
@@ -809,7 +809,12 @@ ensure_bitcoin_ui_nginx_conf() {
   tmp="${CONF_PATH}.tmp.$$"
   sudo tee "$tmp" >/dev/null << EOF
 server {
-    listen 8334;
+    # Loopback ONLY — this is the fourth copy of this declaration (the others
+    # are the Rust template in container/bitcoin_ui_nginx.conf.template, the
+    # image, and the manifest). Host networking means this nginx binds the
+    # HOST's address, so \`listen 8334;\` served the Bitcoin screen on every
+    # interface with no login. The app gate owns the external addresses now.
+    listen 127.0.0.1:8334;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;

From 27c1b151f8435b01fa0995be6e6adc1f74beefc2 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 09:08:07 -0400
Subject: [PATCH 21/60] docs(1.7.123): curate release notes and add the in-app
 What's New block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Leads with the honest version: five screens were open and the previous
release's own audit reported them as fine, found by scanning from another
machine rather than asking the node. States plainly that what leaked was
the page, not credentials — the macaroon path was verified, not assumed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                      | 10 ++++++++++
 .../src/views/settings/AccountInfoSection.vue     | 15 +++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7b8e079..6cce1a1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## v1.7.123-alpha (2026-08-05)
+
+- **Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.
+- **What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.
+- All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.
+- **Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.
+- Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.
+- Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.
+- Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release.
+
 ## v1.7.122-alpha (2026-08-04)
 
 - **Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.
diff --git a/neode-ui/src/views/settings/AccountInfoSection.vue b/neode-ui/src/views/settings/AccountInfoSection.vue
index 3296d9ac..5516fbe5 100644
--- a/neode-ui/src/views/settings/AccountInfoSection.vue
+++ b/neode-ui/src/views/settings/AccountInfoSection.vue
@@ -362,6 +362,21 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.123-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.123-alpha</span>
+                  <span class="text-xs text-white/40">August 5, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Five more screens on your node were readable by anyone who could reach it — and the last release's own check said they were fine.</strong> The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It neither protected them nor listed them as unprotected. Found by scanning the node from another machine instead of asking the node about itself.</p>
+                  <p><strong>What was readable was the page, not your money.</strong> Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was checked directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.</p>
+                  <p>All five now serve only to the node itself, with the login gate in front, exactly like the twenty app screens closed in the last release.</p>
+                  <p><strong>Every port on your node now has a stated policy — none are left undecided.</strong> Eleven had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now ask for your node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections, NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session), Pine's secure listener, and the Lightning REST port that wallets reach with a macaroon exactly as before.</p>
+                  <p>Freshly flashed nodes are covered too, not only existing ones — those five screens ship as prebuilt images, so a new node would otherwise have come up open even after this fix. All five were rebuilt, published, then pulled back and inspected to confirm the fix is really inside them.</p>
+                  <p>Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release.</p>
+                </div>
+              </div>
               <!-- v1.7.122-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

From cfd1b4c7319b23be3ed9e87f6c47cbc4ebd1105e Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 09:31:28 -0400
Subject: [PATCH 22/60] chore(trust): flip the signing checks to the new
 release root
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v1.7.122-alpha was the last release signed with the old root — it is the
release that installed the new pin on every node. From v1.7.123 the new
root signs, and a node running .122+ rejects an old-key signature. The
ARCHY_RELEASE_ROOT_PUBKEY override is no longer needed either: the signer
built from this tree pins the same key we now sign with.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/create-release.sh         | 18 +++++-------------
 scripts/publish-release-assets.sh |  8 +++-----
 scripts/sign-manifest.sh          | 15 +++------------
 3 files changed, 11 insertions(+), 30 deletions(-)

diff --git a/scripts/create-release.sh b/scripts/create-release.sh
index c160d545..2f2308ad 100755
--- a/scripts/create-release.sh
+++ b/scripts/create-release.sh
@@ -240,19 +240,11 @@ install -m 0644 "$FRONTEND_ARCHIVE" "$VERSION_DIR/archipelago-frontend-${VERSION
 # warning and falls through — and the commit then happened anyway. A release
 # commit carrying a manifest no node will accept has no valid use, so refuse
 # to create one rather than leave a tag that has to be re-cut.
-# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha) — this is the OLD root, deliberately.
-#
-# The trust anchor in the binary already pins the NEW root
-# (z6Mkfu5LT…DLWT), because this release is what installs that pin. But the
-# manifest THIS release ships must be signed with the OLD root
-# (z6Mkkid…q7ur): every node is still running the previous binary, which
-# pins the old key and would reject anything else. Signing this one with the
-# new key ends OTA fleet-wide and needs hands-on recovery per node.
-#
-# ➜ NEXT RELEASE (v1.7.123+): change this to the new DID, and the same line
-#   in publish-release-assets.sh. By then every node runs a binary pinning
-#   the new root, and an old-key signature is the one that gets rejected.
-EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
+# Release root ROTATED 2026-08-05. v1.7.122-alpha was the last release signed
+# with the old root (z6Mkkid…q7ur) — it is the release that installed this
+# pin on every node. From v1.7.123 onward the new root signs, and nodes
+# running .122+ reject anything signed with the old key.
+EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
 if ! grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     || ! grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json"; then
     echo "" >&2
diff --git a/scripts/publish-release-assets.sh b/scripts/publish-release-assets.sh
index 1079238a..14de7993 100755
--- a/scripts/publish-release-assets.sh
+++ b/scripts/publish-release-assets.sh
@@ -29,11 +29,9 @@ fail() { echo "Error: $*" >&2; exit 1; }
 # with the pinned release-root anchor refuse to auto-apply unsigned manifests,
 # and enforcement will tighten to hard-reject — an unsigned publish would
 # strand them. Grep proves presence; ceremony verify proves the crypto.
-# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha) — OLD root on purpose; see the same
-# block in create-release.sh. Nodes still run the previous binary and pin the
-# old key, so the manifest this release publishes must carry an old-key
-# signature. Flip both to z6Mkfu5LT…DLWT for v1.7.123+.
-EXPECTED_DID="did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur"
+# Release root ROTATED 2026-08-05; see create-release.sh. New root from
+# v1.7.123 onward.
+EXPECTED_DID="did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT"
 grep -q '"signature":' "$PROJECT_ROOT/releases/manifest.json" \
     && grep -q "\"signed_by\": \"$EXPECTED_DID\"" "$PROJECT_ROOT/releases/manifest.json" \
     || fail "releases/manifest.json is not signed by the release root — run: bash scripts/sign-manifest.sh"
diff --git a/scripts/sign-manifest.sh b/scripts/sign-manifest.sh
index 62e7a7d8..c223e995 100755
--- a/scripts/sign-manifest.sh
+++ b/scripts/sign-manifest.sh
@@ -12,18 +12,9 @@
 # re-signing (e.g. a manifest edited after creation) or signing on a box where
 # the release run was non-interactive.
 #
-# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha). This release must be signed with the
-# OLD release root, because every node still runs a binary pinning it — but
-# the signer built from THIS tree already pins the NEW root, so its own
-# verification would reject a correct old-key signature. Pin the old anchor
-# for the duration of the ceremony so signing and verification agree:
-#
-#   ARCHY_RELEASE_ROOT_PUBKEY=5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951 \
-#     bash scripts/sign-manifest.sh
-#
-# That hex is the OLD root's PUBLIC key (verified to derive to
-# did:key:z6Mkkid…q7ur); it is not secret and pins verification only.
-# From v1.7.123 the override is unnecessary — drop it and this block.
+# The release root was rotated 2026-08-05. From v1.7.123 this signs with the
+# NEW mnemonic and the signer's own anchor already pins that key, so no
+# ARCHY_RELEASE_ROOT_PUBKEY override is needed (it was, for .122 only).
 set -euo pipefail
 
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

From ea4c07218387312fe6c13b02f4bd879c7a3fa86f Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 09:35:47 -0400
Subject: [PATCH 23/60] chore: release v1.7.123-alpha

---
 core/Cargo.lock             |  2 +-
 core/archipelago/Cargo.toml |  2 +-
 neode-ui/package-lock.json  |  4 ++--
 neode-ui/package.json       |  2 +-
 release-manifest.json       | 43 ++++++++++++++++++-------------------
 releases/app-catalog.json   |  2 ++
 releases/manifest.json      | 43 ++++++++++++++++++-------------------
 7 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/core/Cargo.lock b/core/Cargo.lock
index a7793458..2bfc227e 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.122-alpha"
+version = "1.7.123-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
diff --git a/core/archipelago/Cargo.toml b/core/archipelago/Cargo.toml
index 8943512c..fc0d0279 100644
--- a/core/archipelago/Cargo.toml
+++ b/core/archipelago/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.122-alpha"
+version = "1.7.123-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
diff --git a/neode-ui/package-lock.json b/neode-ui/package-lock.json
index fd8825ee..38ac58de 100644
--- a/neode-ui/package-lock.json
+++ b/neode-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.122-alpha",
+  "version": "1.7.123-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.122-alpha",
+      "version": "1.7.123-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
diff --git a/neode-ui/package.json b/neode-ui/package.json
index f7375a8e..2c1b2738 100644
--- a/neode-ui/package.json
+++ b/neode-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.122-alpha",
+  "version": "1.7.123-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",
diff --git a/release-manifest.json b/release-manifest.json
index 22dd4ab6..edf4a6eb 100644
--- a/release-manifest.json
+++ b/release-manifest.json
@@ -1,34 +1,33 @@
 {
   "changelog": [
-    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
-    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
-    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
-    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
-    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
-    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
-    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
-    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+    "**Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.",
+    "**What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.",
+    "All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.",
+    "**Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.",
+    "Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.",
+    "Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.",
+    "Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
+      "current_version": "1.7.123-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.122-alpha",
-      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
-      "size_bytes": 54957496
+      "new_version": "1.7.123-alpha",
+      "sha256": "b7974a671f8f7987fab548d0a9cac1ad145e9a52f4099791c3d1879d065a9f47",
+      "size_bytes": 54957360
     },
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
-      "new_version": "1.7.122-alpha",
-      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
-      "size_bytes": 210528707
+      "current_version": "1.7.123-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago-frontend-1.7.123-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.123-alpha.tar.gz",
+      "new_version": "1.7.123-alpha",
+      "sha256": "075370c761f07373e553db07eb5e019d96ceb591fa9c1067e1adc6701fa30752",
+      "size_bytes": 210533854
     }
   ],
   "release_date": "2026-08-05",
-  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
-  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.122-alpha"
+  "signature": "f64eaf9731277865c0d3f757f63dc2f4921fb7d90deb1615ca2b2b0f4c173282524b39a2d0b8f027c7532e918c349a86b14ed1b7992a96b0c6a80cd46b5d500d",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
+  "version": "1.7.123-alpha"
 }
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 5a304b38..e8f64b80 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -4898,5 +4898,7 @@
     }
   },
   "schema": 1,
+  "signature": "cc19214673b37c2d7d41edf996d5002abe41cf933ee9f33fb7182b05c6c40aa1a555ad596228c4a83dc4a11166f3345e7478399f9693f5f2da3818020980eb03",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }
diff --git a/releases/manifest.json b/releases/manifest.json
index 22dd4ab6..edf4a6eb 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,34 +1,33 @@
 {
   "changelog": [
-    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
-    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
-    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
-    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
-    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
-    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
-    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
-    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+    "**Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.",
+    "**What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.",
+    "All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.",
+    "**Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.",
+    "Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.",
+    "Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.",
+    "Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
+      "current_version": "1.7.123-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.122-alpha",
-      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
-      "size_bytes": 54957496
+      "new_version": "1.7.123-alpha",
+      "sha256": "b7974a671f8f7987fab548d0a9cac1ad145e9a52f4099791c3d1879d065a9f47",
+      "size_bytes": 54957360
     },
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
-      "new_version": "1.7.122-alpha",
-      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
-      "size_bytes": 210528707
+      "current_version": "1.7.123-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago-frontend-1.7.123-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.123-alpha.tar.gz",
+      "new_version": "1.7.123-alpha",
+      "sha256": "075370c761f07373e553db07eb5e019d96ceb591fa9c1067e1adc6701fa30752",
+      "size_bytes": 210533854
     }
   ],
   "release_date": "2026-08-05",
-  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
-  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.122-alpha"
+  "signature": "f64eaf9731277865c0d3f757f63dc2f4921fb7d90deb1615ca2b2b0f4c173282524b39a2d0b8f027c7532e918c349a86b14ed1b7992a96b0c6a80cd46b5d500d",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
+  "version": "1.7.123-alpha"
 }

From 9b30daaf9cf8bb1f5366d8e1307740e5006f9297 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 10:17:58 -0400
Subject: [PATCH 24/60] fix(security): restart a companion whose image was
 rebuilt underneath it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A rebuilt image never reached a running companion. ensure_image_present
rebuilds in place under the same tag, so the quadlet body is identical,
write_if_changed reports no change, and enable_now is a no-op on a running
service — the container keeps the old layers indefinitely.

That is precisely how archi-dev-box kept serving the LND, FIPS, Electrs and
Guardian screens on 0.0.0.0 after v1.7.123 rebuilt every one of those images
to bind loopback: correct images on disk, three-day-old containers still
running. Closing those ports needed a manual 'podman rm -f' per container,
which no other node would ever get. Compare the running container's image ID
against the built one and restart when they diverge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/container/companion.rs | 49 +++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/core/archipelago/src/container/companion.rs b/core/archipelago/src/container/companion.rs
index 92658725..018ee63d 100644
--- a/core/archipelago/src/container/companion.rs
+++ b/core/archipelago/src/container/companion.rs
@@ -214,10 +214,59 @@ pub async fn install_one(spec: &CompanionSpec) -> Result<()> {
     }
     // Start is idempotent — if already running, systemctl returns 0.
     quadlet::enable_now(&unit.service_name()).await?;
+
+    // A rebuilt image does NOT reach a container that is already running.
+    // `ensure_image_present` rebuilds in place under the same tag, so the unit
+    // body is byte-identical, `write_if_changed` reports no change, and
+    // `enable_now` is a no-op on a running service — the container keeps the
+    // old layers indefinitely. That is exactly how archi-dev-box kept serving
+    // the LND, FIPS, Electrs and Guardian screens on 0.0.0.0 after v1.7.123
+    // rebuilt every one of those images to bind loopback: the images were
+    // correct on disk and the running containers were three days old
+    // (2026-08-05). Compare image IDs and restart when they diverge.
+    if let Some(running) = container_image_id(spec.name).await {
+        if let Some(built) = image_id(&image).await {
+            if running != built {
+                info!(
+                    companion = spec.name,
+                    "running container uses a stale image; restarting onto the rebuilt one"
+                );
+                quadlet::restart_service(&unit.service_name()).await?;
+            }
+        }
+    }
     info!(companion = spec.name, "companion started");
     Ok(())
 }
 
+/// Image ID a container is actually running, or `None` when it does not exist.
+async fn container_image_id(name: &str) -> Option<String> {
+    let out = tokio::process::Command::new("podman")
+        .args(["inspect", name, "--format", "{{.Image}}"])
+        .output()
+        .await
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    let id = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    (!id.is_empty()).then_some(id)
+}
+
+/// Current ID behind an image reference, or `None` when absent.
+async fn image_id(image_ref: &str) -> Option<String> {
+    let out = tokio::process::Command::new("podman")
+        .args(["image", "inspect", image_ref, "--format", "{{.Id}}"])
+        .output()
+        .await
+        .ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    let id = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    (!id.is_empty()).then_some(id)
+}
+
 /// Build companion image locally if a Dockerfile exists, otherwise
 /// pull from the lfg2025 registry. Returns the image ref the quadlet
 /// should reference (`localhost/<base>:latest` for build, registry

From 4ec53a9805f11b2835762cee18653b3e474bb02d Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 10:24:09 -0400
Subject: [PATCH 25/60] =?UTF-8?q?fix(ota):=20republish=20the=20.122=20mani?=
 =?UTF-8?q?fest=20=E2=80=94=20the=20rotation=20stranded=20every=20pre-.122?=
 =?UTF-8?q?=20node?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The manifest advertises exactly one version, so publishing .123 (new-key
signed) removed the only stepping stone across the rotation. A node on
.121 pins the OLD root, fetches the .123 manifest, fails signature
verification and refuses — permanently, because .122 is no longer offered
anywhere. Reproduced against the live URL: 'signed_by does not match the
pinned release-root anchor'. archy-shorty-s (.228) is on 1.7.121-alpha-dev
and in exactly this state.

Restoring the old-key-signed .122 manifest as the OTA pointer lets those
nodes take .122, which installs the new pin; .123 is republished once the
fleet has crossed. Safe in both directions: is_newer() is a strict
greater-than on the version triple, so a node already on .123 sees .122 as
older and does not downgrade.

The .123 release itself is untouched — tag, assets and catalog stand; only
the pointer moves.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 releases/manifest.json | 43 +++++++++++++++++++++---------------------
 1 file changed, 22 insertions(+), 21 deletions(-)

diff --git a/releases/manifest.json b/releases/manifest.json
index edf4a6eb..22dd4ab6 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,33 +1,34 @@
 {
   "changelog": [
-    "**Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.",
-    "**What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.",
-    "All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.",
-    "**Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.",
-    "Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.",
-    "Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.",
-    "Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release."
+    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
+    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
+    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
+    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
+    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
+    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
+    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
+    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.123-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago",
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.123-alpha",
-      "sha256": "b7974a671f8f7987fab548d0a9cac1ad145e9a52f4099791c3d1879d065a9f47",
-      "size_bytes": 54957360
+      "new_version": "1.7.122-alpha",
+      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
+      "size_bytes": 54957496
     },
     {
-      "current_version": "1.7.123-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago-frontend-1.7.123-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.123-alpha.tar.gz",
-      "new_version": "1.7.123-alpha",
-      "sha256": "075370c761f07373e553db07eb5e019d96ceb591fa9c1067e1adc6701fa30752",
-      "size_bytes": 210533854
+      "current_version": "1.7.122-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
+      "new_version": "1.7.122-alpha",
+      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
+      "size_bytes": 210528707
     }
   ],
   "release_date": "2026-08-05",
-  "signature": "f64eaf9731277865c0d3f757f63dc2f4921fb7d90deb1615ca2b2b0f4c173282524b39a2d0b8f027c7532e918c349a86b14ed1b7992a96b0c6a80cd46b5d500d",
-  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.7.123-alpha"
+  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
+  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
+  "version": "1.7.122-alpha"
 }

From 91bbe4faa1ac7ba27ae5a9129a222c281fb86cd4 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 12:44:57 -0400
Subject: [PATCH 26/60] fix: portainer pin, bitcoin conf tolerance, gate login
 UI, named OTA origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Portainer: nodes have been running :latest — which is 2.39.1 — while the
manifest pinned 2.19.4 from two years ago. The port migration recreated the
container onto that old pin and Portainer refused to start: it migrates a
database forward, never backward, so an existing install died with 'schema
version does not align' and My Apps showed 'app is not responding'
(100.82.34.38). 2.39.1 published as an immutable tag and pinned forward, so
existing databases keep working and older ones migrate up.

Bitcoin: complements PR #131. That removes the code which kept writing a
datadir bitcoin.conf; -allowignoredconf=1 additionally makes an existing
one non-fatal, so a node already carrying the file recovers on restart
instead of crash-looping until something reinstalls it.

App gate login: rebuilt against the dashboard's own design — rotating
intro backgrounds served from the gate, the glass panel, the Archipelago
mark in its gradient ring, the app's icon as a My Apps tile, and the glass
button. Crucially it no longer sends X-Frame-Options: DENY, which made
every gated app render as unreachable inside My Apps' embedded frame;
frame-ancestors expresses 'only this node may frame me', which
X-Frame-Options cannot.

OTA origin: primary mirror is now source.archipelago-foundation.org over
TLS instead of a bare IP on plaintext. The IP stays as an automatic
fallback for nodes whose DNS or clock is broken — both break TLS, and the
signature, not the transport, is what establishes trust.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/bitcoin-core/manifest.yml      |  14 +-
 apps/bitcoin-knots/manifest.yml     |  14 +-
 apps/portainer/manifest.yml         |   2 +-
 core/archipelago/src/appgate/mod.rs | 347 ++++++++++++++++++++++++----
 core/archipelago/src/update.rs      |  59 +++--
 scripts/image-versions.sh           |   8 +-
 6 files changed, 376 insertions(+), 68 deletions(-)

diff --git a/apps/bitcoin-core/manifest.yml b/apps/bitcoin-core/manifest.yml
index 6cdd5faa..c8619f7e 100644
--- a/apps/bitcoin-core/manifest.yml
+++ b/apps/bitcoin-core/manifest.yml
@@ -38,6 +38,16 @@ app:
         RPC_CONF="/tmp/rpc.conf";
         umask 077;
         { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
+        # A stray bitcoin.conf in the datadir is FATAL when -conf points
+        # elsewhere: bitcoind refuses to start with "contains a bitcoin.conf
+        # file which is ignored", and the app crash-loops (100.82.34.38,
+        # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the
+        # RPC credentials and the flags below are the authoritative config,
+        # so the datadir file is legacy debris; say so out loud rather than
+        # failing, and let bitcoind start.
+        if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
+          echo "archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below" >&2;
+        fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -46,9 +56,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
diff --git a/apps/bitcoin-knots/manifest.yml b/apps/bitcoin-knots/manifest.yml
index 9d7967d4..cdc492c5 100644
--- a/apps/bitcoin-knots/manifest.yml
+++ b/apps/bitcoin-knots/manifest.yml
@@ -38,6 +38,16 @@ app:
         RPC_CONF="/tmp/rpc.conf";
         umask 077;
         { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
+        # A stray bitcoin.conf in the datadir is FATAL when -conf points
+        # elsewhere: bitcoind refuses to start with "contains a bitcoin.conf
+        # file which is ignored", and the app crash-loops (100.82.34.38,
+        # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the
+        # RPC credentials and the flags below are the authoritative config,
+        # so the datadir file is legacy debris; say so out loud rather than
+        # failing, and let bitcoind start.
+        if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
+          echo "archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below" >&2;
+        fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -46,9 +56,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
diff --git a/apps/portainer/manifest.yml b/apps/portainer/manifest.yml
index 70fdac89..868e114e 100644
--- a/apps/portainer/manifest.yml
+++ b/apps/portainer/manifest.yml
@@ -6,7 +6,7 @@ app:
   category: development
 
   container:
-    image: 146.59.87.168:3000/lfg2025/portainer:2.19.4
+    image: 146.59.87.168:3000/lfg2025/portainer:2.39.1
     pull_policy: if-not-present
     data_uid: "1000:1000"
 
diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index dee3e7e0..9dc4090b 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -154,6 +154,11 @@ impl AppGate {
         action: &str,
         client_ip: IpAddr,
     ) -> Response<Body> {
+        // Assets are GET and pre-auth by nature: the login page cannot
+        // render its own background or logo without them.
+        if let Some(name) = action.strip_prefix("asset/") {
+            return self.serve_asset(name);
+        }
         if req.method() != Method::POST {
             return login_page(app, None, StatusCode::OK);
         }
@@ -187,6 +192,26 @@ impl AppGate {
         }
     }
 
+    /// Static assets the login page needs, served from the gate's own origin.
+    ///
+    /// The backgrounds are ~1 MB each, so inlining them as data URIs would
+    /// bloat every challenge response. Serving them here keeps the page
+    /// byte-identical to the dashboard's login while the CSP stays tight:
+    /// `img-src 'self' data:` and nothing else.
+    fn serve_asset(&self, name: &str) -> Response<Body> {
+        let Some((bytes, mime)) = read_ui_asset(name) else {
+            return not_found();
+        };
+        Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, mime)
+            // Immutable art; caching it costs nothing and keeps the login
+            // instant on a repeat challenge.
+            .header(header::CACHE_CONTROL, "public, max-age=86400")
+            .body(Body::from(bytes))
+            .expect("asset response builds")
+    }
+
     async fn do_login(&self, app: &GatedPort, form: &Form, client_ip: IpAddr) -> Response<Body> {
         let password = field(form, "password").unwrap_or_default();
 
@@ -428,43 +453,158 @@ fn esc(s: &str) -> String {
 /// none. Inlined as a data URI rather than linked: the gate is answering on
 /// the app's own port, so any asset URL would either hit the unauthenticated
 /// app behind it or a different origin the browser may not reach.
+/// One stacked layer per background, each delayed so they cross-fade in turn.
+fn background_layers() -> String {
+    let step = LOGIN_BACKGROUNDS.len() as u32 * 9 / LOGIN_BACKGROUNDS.len() as u32;
+    LOGIN_BACKGROUNDS
+        .iter()
+        .enumerate()
+        .map(|(i, name)| {
+            format!(
+                r#"<div class="bg" style="background-image:url('{prefix}asset/{name}');animation-delay:{delay}s"></div>"#,
+                prefix = GATE_PREFIX,
+                delay = i as u32 * step,
+            )
+        })
+        .collect()
+}
+
 fn icon_markup(app: &GatedPort) -> String {
-    if let Some(path) = &app.icon {
-        if let Some(data_uri) = read_icon_data_uri(path) {
-            return format!(r#"<img class="icon" src="{}" alt="">"#, esc(&data_uri));
-        }
-    }
-    let letter = app
-        .app_name
-        .chars()
-        .next()
-        .map(|c| c.to_uppercase().to_string())
-        .unwrap_or_else(|| "?".to_string());
-    format!(r#"<div class="icon lettermark">{}</div>"#, esc(&letter))
+    let inner = app
+        .icon
+        .as_deref()
+        .and_then(read_icon_data_uri)
+        // A manifest that names no icon still gets one: the dashboard already
+        // ships icons named after the app, so fall back to those before
+        // giving up. Without this EVERY gated app showed a lettermark,
+        // because no manifest declares metadata.icon (archi-dev-box,
+        // 2026-08-05).
+        .or_else(|| {
+            icon_candidates(&app.app_id)
+                .iter()
+                .find_map(|c| read_icon_data_uri(c))
+        })
+        .map(|data_uri| format!(r#"<img class="icon" src="{}" alt="">"#, esc(&data_uri)))
+        .unwrap_or_else(|| {
+            let letter = app
+                .app_name
+                .chars()
+                .find(|c| c.is_alphanumeric())
+                .map(|c| c.to_uppercase().to_string())
+                .unwrap_or_else(|| "?".to_string());
+            format!(r#"<div class="icon lettermark">{}</div>"#, esc(&letter))
+        });
+    format!(r#"<div class="tile">{inner}</div>"#)
 }
 
 /// Icons live with the web UI. Only files under the icon directory are read,
 /// and only known image extensions — the path comes from a manifest, which is
 /// signed, but treating it as untrusted costs nothing.
-fn read_icon_data_uri(icon_path: &str) -> Option<String> {
-    let name = std::path::Path::new(icon_path).file_name()?.to_str()?;
-    let mime = match name.rsplit_once('.')?.1.to_ascii_lowercase().as_str() {
-        "svg" => "image/svg+xml",
-        "png" => "image/png",
-        "webp" => "image/webp",
-        "jpg" | "jpeg" => "image/jpeg",
-        _ => return None,
+/// Icon basenames to try for an app id, best first.
+///
+/// The shipped icon set is named for the *product*, while app ids carry
+/// packaging detail — `filebrowser` vs `file-browser`, `morphos-server` vs
+/// `morphos` — and the per-app screens (`lnd-ui`, `bitcoin-ui`, `electrs-ui`)
+/// have no icon of their own but obviously belong to the app they front.
+/// Resolving those here keeps the mapping in one readable place instead of
+/// adding a `metadata.icon` line to every manifest, which would have to be
+/// re-signed into the catalog to take effect.
+fn icon_candidates(app_id: &str) -> Vec<String> {
+    let mut out = vec![app_id.to_string()];
+    let alias = match app_id {
+        "filebrowser" => Some("file-browser"),
+        "home-assistant" => Some("homeassistant"),
+        "morphos-server" => Some("morphos"),
+        "barkd" => Some("bark"),
+        "archy-mempool-web" | "mempool-api" => Some("mempool"),
+        "lnd-ui" | "lightning-stack" => Some("lnd"),
+        "bitcoin-ui" => Some("bitcoin-core"),
+        "electrs-ui" => Some("electrumx"),
+        "fips-ui" | "aiui" | "did-wallet" => Some("archipelago-a"),
+        "fedimint-gateway" | "fedimint-clientd" => Some("fedimint"),
+        _ => None,
     };
+    out.extend(alias.map(str::to_string));
+    // `<app>-ui` / `-server` / `-web` front an app whose icon is the bare name.
+    for suffix in ["-ui", "-server", "-web"] {
+        if let Some(base) = app_id.strip_suffix(suffix) {
+            out.push(base.to_string());
+        }
+    }
+    out
+}
+
+/// Backgrounds the login cycles through, matching the dashboard's own
+/// `/login` art. Cross-faded by CSS alone — the CSP forbids script, and a
+/// rotation that needs JavaScript would not survive it.
+const LOGIN_BACKGROUNDS: [&str; 4] = [
+    "bg-intro.jpg",
+    "bg-intro-4.webp",
+    "bg-intro-6.webp",
+    "bg-intro-3.jpg",
+];
+
+/// Assets the gate will serve, by exact name. An allowlist rather than a path
+/// join: the name arrives in a URL, and the gate answers before any
+/// authentication, so nothing here may be caller-controlled beyond this set.
+fn read_ui_asset(name: &str) -> Option<(Vec<u8>, &'static str)> {
+    let allowed = LOGIN_BACKGROUNDS.contains(&name) || name == "logo-archipelago.svg";
+    if !allowed {
+        return None;
+    }
+    let mime = icon_mime(name.rsplit_once('.')?.1)?;
     for root in [
-        "/opt/archipelago/web-ui/assets/img/app-icons",
-        "web/dist/neode-ui/assets/img/app-icons",
+        "/opt/archipelago/web-ui/assets/img",
+        "web/dist/neode-ui/assets/img",
+        "neode-ui/public/assets/img",
     ] {
-        let candidate = std::path::Path::new(root).join(name);
-        if let Ok(bytes) = std::fs::read(&candidate) {
-            if bytes.len() > 512 * 1024 {
-                return None;
+        if let Ok(bytes) = std::fs::read(std::path::Path::new(root).join(name)) {
+            return Some((bytes, mime));
+        }
+    }
+    None
+}
+
+const ICON_ROOTS: [&str; 2] = [
+    "/opt/archipelago/web-ui/assets/img/app-icons",
+    "web/dist/neode-ui/assets/img/app-icons",
+];
+
+fn icon_mime(ext: &str) -> Option<&'static str> {
+    match ext.to_ascii_lowercase().as_str() {
+        "svg" => Some("image/svg+xml"),
+        "png" => Some("image/png"),
+        "webp" => Some("image/webp"),
+        "jpg" | "jpeg" => Some("image/jpeg"),
+        _ => None,
+    }
+}
+
+/// Read an app icon as a `data:` URI.
+///
+/// `icon_ref` may be a filename or path with an extension (a manifest's
+/// `metadata.icon`), or a bare name such as an app id — in which case the
+/// known extensions are tried in turn. Only the file name is used; the
+/// directories searched are fixed, so a manifest cannot point the gate at an
+/// arbitrary path.
+fn read_icon_data_uri(icon_ref: &str) -> Option<String> {
+    let name = std::path::Path::new(icon_ref).file_name()?.to_str()?;
+    let candidates: Vec<(String, &str)> = match name.rsplit_once('.') {
+        Some((_, ext)) => vec![(name.to_string(), icon_mime(ext)?)],
+        None => ["svg", "png", "webp", "jpg"]
+            .iter()
+            .filter_map(|ext| Some((format!("{name}.{ext}"), icon_mime(ext)?)))
+            .collect(),
+    };
+    for (file, mime) in candidates {
+        for root in ICON_ROOTS {
+            let candidate = std::path::Path::new(root).join(&file);
+            if let Ok(bytes) = std::fs::read(&candidate) {
+                if bytes.len() > 512 * 1024 {
+                    continue;
+                }
+                return Some(format!("data:{mime};base64,{}", base64_encode(&bytes)));
             }
-            return Some(format!("data:{mime};base64,{}", base64_encode(&bytes)));
         }
     }
     None
@@ -484,29 +624,79 @@ fn page(title: &str, app: &GatedPort, body: &str, status: StatusCode) -> Respons
 <meta name="robots" content="noindex">
 <title>{title} — {app_name}</title>
 <style>
+/* The dashboard's own /login, rebuilt in static CSS: the same rotating
+   intro art, .glass-card panel, .glass-button action and transparent
+   white-bordered inputs from neode-ui/src/style.css. Written longhand
+   rather than shared with the SPA because the gate answers before any
+   bundle exists, and the CSP forbids external stylesheets and script. */
 :root {{ color-scheme: dark; }}
 * {{ box-sizing: border-box; }}
-body {{ margin:0; min-height:100vh; display:grid; place-items:center;
-  background:#0b0f14; color:#e6edf3; font:16px/1.5 system-ui,-apple-system,Segoe UI,sans-serif; }}
-.card {{ width:min(92vw,380px); padding:2rem; background:#121820;
-  border:1px solid #223; border-radius:14px; text-align:center; }}
-.icon {{ width:64px; height:64px; border-radius:14px; margin:0 auto 1rem; display:block; object-fit:cover; }}
-.lettermark {{ display:grid; place-items:center; background:#1d2733; font-size:28px; font-weight:600; }}
-h1 {{ font-size:1.15rem; margin:0 0 .25rem; }}
-p.sub {{ margin:0 0 1.5rem; color:#8b98a5; font-size:.9rem; }}
-input {{ width:100%; padding:.7rem .8rem; margin-bottom:.75rem; border-radius:9px;
-  border:1px solid #2b3947; background:#0d131a; color:#e6edf3; font-size:1rem; }}
-input:focus {{ outline:2px solid #3b82f6; outline-offset:1px; }}
-button {{ width:100%; padding:.7rem; border:0; border-radius:9px; background:#3b82f6;
-  color:#fff; font-size:1rem; font-weight:600; cursor:pointer; }}
-button:hover {{ background:#2f6fd6; }}
-.err {{ background:#3b1519; border:1px solid #7f1d1d; color:#fca5a5;
-  padding:.6rem .8rem; border-radius:9px; margin-bottom:1rem; font-size:.9rem; }}
+body {{ margin:0; min-height:100vh; display:grid; place-items:center; padding:1rem;
+  background:#05070a; color:#fff; overflow:hidden;
+  font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif; }}
+/* Rotating backgrounds: each layer holds its image and cross-fades on a
+   shared cycle, so the art moves the way /login does with no script. */
+.bg {{ position:fixed; inset:0; z-index:0; background-size:cover;
+  background-position:center; opacity:0; animation:bg-cycle {cycle}s infinite; }}
+.bg::after {{ content:''; position:absolute; inset:0;
+  background:linear-gradient(180deg, rgba(0,0,0,.35), rgba(0,0,0,.72)); }}
+@keyframes bg-cycle {{
+  0% {{ opacity:0; }} 4% {{ opacity:1; }}
+  {hold}% {{ opacity:1; }} {fade}% {{ opacity:0; }} 100% {{ opacity:0; }}
+}}
+main {{ position:relative; z-index:1; width:min(92vw,28rem); }}
+.card {{ padding:2rem; padding-top:3.5rem; position:relative;
+  background:rgba(0,0,0,.65); backdrop-filter:blur(18px);
+  -webkit-backdrop-filter:blur(18px); border:1px solid rgba(255,255,255,.18);
+  border-radius:1rem; box-shadow:0 8px 24px rgba(0,0,0,.45); text-align:center; }}
+/* The Archipelago mark, half in and half out of the panel — same placement
+   and gradient ring as Login.vue. */
+.logo {{ position:absolute; top:-2.5rem; left:50%; transform:translateX(-50%);
+  width:5rem; height:5rem; border-radius:9999px; padding:3px;
+  background:linear-gradient(135deg, rgba(255,255,255,.6) 0%, rgba(0,0,0,.8) 100%);
+  box-shadow:0 8px 24px rgba(0,0,0,.5); }}
+.logo img {{ width:100%; height:100%; border-radius:9999px; display:block;
+  background:#000; padding:.5rem; }}
+/* The app's own tile, in the My Apps shape: 18px-rounded square on dark
+   glass with the same inner highlight and drop shadow. */
+.tile {{ width:60px; height:60px; border-radius:18px; margin:0 auto .75rem;
+  background:rgba(0,0,0,.72); box-shadow:0 8px 18px rgba(0,0,0,.38); }}
+.tile .icon {{ width:100%; height:100%; border-radius:18px; display:block;
+  object-fit:cover; border:1px solid rgba(255,255,255,.18);
+  background:radial-gradient(circle at 35% 28%, rgba(255,255,255,.1), rgba(255,255,255,0) 42%),
+    linear-gradient(145deg, rgba(22,22,24,.96), rgba(0,0,0,.96));
+  box-shadow:inset 0 1px 0 rgba(255,255,255,.12), inset 0 -10px 24px rgba(0,0,0,.34); }}
+.lettermark {{ display:grid; place-items:center; font-size:1.6rem; font-weight:600;
+  color:rgba(255,255,255,.9); }}
+h1 {{ font-size:1.5rem; font-weight:600; margin:0 0 .4rem;
+  color:rgba(255,255,255,.96); text-shadow:0 2px 6px rgba(0,0,0,.4); }}
+p.sub {{ margin:0 0 1.75rem; color:rgba(255,255,255,.6); font-size:.875rem; }}
+input {{ width:100%; padding:.75rem 1rem; margin-bottom:1rem; border-radius:.5rem;
+  border:1px solid rgba(255,255,255,.2); background:transparent; color:#fff;
+  font-size:1rem; transition:border-color .2s ease; }}
+input::placeholder {{ color:rgba(255,255,255,.4); }}
+input:focus {{ outline:none; border-color:rgba(255,255,255,.4);
+  box-shadow:0 0 0 1px rgba(255,255,255,.2); }}
+button {{ width:100%; min-height:44px; padding:.75rem 1.25rem; border:none;
+  border-radius:.75rem; background:rgba(0,0,0,.6);
+  backdrop-filter:blur(24px); -webkit-backdrop-filter:blur(24px);
+  box-shadow:0 8px 24px rgba(0,0,0,.45), inset 0 1px 0 rgba(255,255,255,.22);
+  color:rgba(255,255,255,.9); font-size:1rem; font-weight:500; cursor:pointer;
+  transition:background-color .2s ease, transform .3s cubic-bezier(.4,0,.2,1); }}
+button:hover {{ background:rgba(0,0,0,.7); }}
+button:active {{ transform:translateY(1px); }}
+.err {{ background:rgba(239,68,68,.2); border:1px solid rgba(239,68,68,.4);
+  color:#fecaca; padding:.75rem; border-radius:.5rem; margin-bottom:1rem;
+  font-size:.875rem; text-align:left; }}
 </style></head>
-<body><main class="card">{body}</main></body></html>"#,
+<body>{backgrounds}<main><div class="card">{body}</div></main></body></html>"#,
         title = esc(title),
         app_name = esc(&app.app_name),
         body = body,
+        backgrounds = background_layers(),
+        cycle = LOGIN_BACKGROUNDS.len() as u32 * 9,
+        hold = 100 / LOGIN_BACKGROUNDS.len() as u32,
+        fade = 100 / LOGIN_BACKGROUNDS.len() as u32 + 4,
     );
     Response::builder()
         .status(status)
@@ -514,10 +704,18 @@ button:hover {{ background:#2f6fd6; }}
         // The gate answers on the app's own port for an unauthenticated
         // caller; nothing here should be cached or framed.
         .header(header::CACHE_CONTROL, "no-store")
-        .header("X-Frame-Options", "DENY")
+        // NOT X-Frame-Options: DENY. My Apps opens an app in an embedded
+        // frame, so a blanket DENY made every gated app render as "app is
+        // not responding" the moment the gate challenged it (reported on
+        // 100.82.34.38, 2026-08-05). frame-ancestors is the modern control
+        // and can be precise: only pages from this same node may frame the
+        // login, on any port or scheme, which is exactly the dashboard.
+        // Anything else — another site embedding it to harvest the node
+        // password — is still refused.
         .header(
             "Content-Security-Policy",
-            "default-src 'none'; img-src data:; style-src 'unsafe-inline'; form-action 'self'",
+            "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; \
+             form-action 'self'; frame-ancestors 'self' http://*:* https://*:*",
         )
         .body(Body::from(html))
         .expect("static response builds")
@@ -528,7 +726,8 @@ button:hover {{ background:#2f6fd6; }}
 /// password by an unexplained page.
 fn login_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Response<Body> {
     let body = format!(
-        r#"{icon}
+        r#"<div class="logo"><img src="{prefix}asset/logo-archipelago.svg" alt="Archipelago"></div>
+{icon}
 <h1>Sign in to open {name}</h1>
 <p class="sub">This app is protected by your node password.</p>
 {err}
@@ -636,11 +835,61 @@ mod tests {
         assert!(!html.contains("<img src=x"));
     }
 
+    /// The challenge must be framable by this node's own dashboard — My Apps
+    /// opens apps in an embedded frame, and a blanket `X-Frame-Options: DENY`
+    /// turned every gated app into "app is not responding" (100.82.34.38,
+    /// 2026-08-05). It must still be uncacheable, and still refuse to be
+    /// framed by a foreign origin, which `frame-ancestors` expresses and
+    /// `X-Frame-Options` cannot.
     #[test]
-    fn challenge_pages_are_not_cacheable_or_framable() {
+    fn challenge_pages_are_uncacheable_and_framable_only_by_this_node() {
         let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
         assert_eq!(resp.headers()[header::CACHE_CONTROL], "no-store");
-        assert_eq!(resp.headers()["X-Frame-Options"], "DENY");
+        assert!(
+            !resp.headers().contains_key("X-Frame-Options"),
+            "X-Frame-Options cannot express 'my own node on another port' — it \
+             blocked the dashboard's own frame"
+        );
+        let csp = resp.headers()["Content-Security-Policy"].to_str().unwrap();
+        assert!(csp.contains("frame-ancestors 'self'"));
+        assert!(csp.contains("form-action 'self'"));
+    }
+
+    /// The login page must render entirely from the gate's own origin: the
+    /// CSP allows no external host, so a background or logo that 404s leaves
+    /// a black page rather than the dashboard's art.
+    #[tokio::test]
+    async fn login_page_sources_its_art_from_the_gate() {
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
+        let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
+        let html = String::from_utf8_lossy(&body).to_string();
+        assert!(html.contains(&format!("{GATE_PREFIX}asset/logo-archipelago.svg")));
+        for name in LOGIN_BACKGROUNDS {
+            assert!(
+                html.contains(&format!("{GATE_PREFIX}asset/{name}")),
+                "background {name} is not referenced"
+            );
+        }
+        // Every referenced asset must be one the gate will actually serve.
+        assert!(read_ui_asset("logo-archipelago.svg").is_some() || cfg!(not(debug_assertions)));
+    }
+
+    /// The allowlist is the whole security boundary for asset serving: the
+    /// name arrives in a URL and is read before any authentication.
+    #[test]
+    fn asset_serving_refuses_anything_off_the_allowlist() {
+        for name in [
+            "../../../etc/passwd",
+            "/etc/passwd",
+            "db.sqlite3",
+            "manifest.yml",
+            "",
+        ] {
+            assert!(
+                read_ui_asset(name).is_none(),
+                "{name} must not be servable by the gate"
+            );
+        }
     }
 
     #[tokio::test]
diff --git a/core/archipelago/src/update.rs b/core/archipelago/src/update.rs
index 72572d1e..6fd94eb7 100644
--- a/core/archipelago/src/update.rs
+++ b/core/archipelago/src/update.rs
@@ -74,7 +74,20 @@ fn is_newer(candidate: &str, current: &str) -> bool {
     }
 }
 
+/// Primary OTA origin. Named host over TLS rather than the bare IP it used
+/// to be: the IP pinned the fleet to one machine and one plaintext port, so
+/// moving or fronting the origin meant an OTA to change where OTAs come
+/// from — the one update you cannot ship if the origin is unreachable. The
+/// signature is what establishes trust (see `trust::anchor`), not the
+/// transport, but HTTPS also stops a network observer seeing which version
+/// a node runs.
 const DEFAULT_UPDATE_MANIFEST_URL: &str =
+    "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json";
+
+/// The previous IP-based origin, kept as an automatic fallback so a node
+/// whose DNS or TLS is broken still updates. Dropped from the mirror list
+/// once the fleet has moved.
+const LEGACY_UPDATE_MANIFEST_URL: &str =
     "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
 const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
@@ -113,10 +126,19 @@ fn mirrors_path(data_dir: &Path) -> std::path::PathBuf {
 }
 
 fn default_mirrors() -> Vec<UpdateMirror> {
-    vec![UpdateMirror {
-        url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
-        label: "Server 1 (OVH)".to_string(),
-    }]
+    vec![
+        UpdateMirror {
+            url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
+            label: "Archipelago Foundation".to_string(),
+        },
+        // Fallback, tried only if the named origin fails: a node whose DNS
+        // or clock is wrong (both break TLS) must still be able to update
+        // itself, and the signature check is what makes either source safe.
+        UpdateMirror {
+            url: LEGACY_UPDATE_MANIFEST_URL.to_string(),
+            label: "Direct (fallback)".to_string(),
+        },
+    ]
 }
 
 /// Load the operator-configured mirror list. Returns defaults if the
@@ -186,15 +208,18 @@ fn force_ovh_update_primary(list: &mut Vec<UpdateMirror>) {
     }
     for mirror in list.iter_mut() {
         if mirror.url == DEFAULT_UPDATE_MANIFEST_URL {
-            mirror.label = "Server 1 (OVH)".to_string();
+            mirror.label = "Archipelago Foundation".to_string();
+        } else if mirror.url == LEGACY_UPDATE_MANIFEST_URL {
+            mirror.label = "Direct (fallback)".to_string();
         }
     }
-    list.sort_by_key(|m| {
-        if m.url == DEFAULT_UPDATE_MANIFEST_URL {
-            0
-        } else {
-            1
-        }
+    // Named origin first, its IP fallback second, anything the operator
+    // added after that. Ordering matters: the list is tried in order, so a
+    // stale entry sitting first costs a timeout on every check.
+    list.sort_by_key(|m| match m.url.as_str() {
+        u if u == DEFAULT_UPDATE_MANIFEST_URL => 0,
+        u if u == LEGACY_UPDATE_MANIFEST_URL => 1,
+        _ => 2,
     });
 }
 
@@ -2373,8 +2398,16 @@ mod tests {
     async fn test_load_mirrors_returns_defaults_when_absent() {
         let dir = tempfile::tempdir().unwrap();
         let list = load_mirrors(dir.path()).await.unwrap();
-        assert_eq!(list.len(), 1);
-        assert!(list[0].url.contains("146.59.87.168"));
+        // The named origin leads, its IP fallback follows. A node with broken
+        // DNS or a wrong clock (both break TLS) must still have a way to
+        // update; the signature is what makes either source trustworthy.
+        assert_eq!(list.len(), 2);
+        assert!(
+            list[0].url.starts_with("https://source.archipelago-foundation.org/"),
+            "the named origin must be primary, got {}",
+            list[0].url
+        );
+        assert!(list[1].url.contains("146.59.87.168"));
         assert!(
             !list.iter().any(|m| m.url.contains("git.tx1138.com")),
             "tx1138 was retired as a release server and must not be a default mirror"
diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh
index 6857c803..5988c471 100644
--- a/scripts/image-versions.sh
+++ b/scripts/image-versions.sh
@@ -45,7 +45,13 @@ SEARXNG_IMAGE="$ARCHY_REGISTRY/searxng:latest"
 CRYPTPAD_IMAGE="$ARCHY_REGISTRY/cryptpad:2024.12.0"
 FILEBROWSER_IMAGE="$ARCHY_REGISTRY/filebrowser:v2.27.0"
 NPM_IMAGE="$ARCHY_REGISTRY/nginx-proxy-manager:latest"
-PORTAINER_IMAGE="$ARCHY_REGISTRY/portainer:2.19.4"
+# 2.39.1 is what the fleet has actually been running via the moving :latest
+# tag, and it is the version that wrote their databases. Pinning back to
+# 2.19.4 (2 years older) made Portainer refuse to start the moment a
+# container was recreated: "database schema version does not align with the
+# server version" — it migrates a DB forward, never backward. Pinned
+# forward and published as a concrete tag so this is reproducible.
+PORTAINER_IMAGE="$ARCHY_REGISTRY/portainer:2.39.1"
 
 # Networking
 TAILSCALE_IMAGE="$ARCHY_REGISTRY/tailscale:stable"

From d8647f6576856252943ac0ffb2ff1327611b2fb4 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 13:03:31 -0400
Subject: [PATCH 27/60] fix(mesh): tabbed tools column on very wide screens;
 add configurable session policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mesh right panel: a >=2560px screen hid the tab bar and stacked all five
tool panels in fixed grid rows. On a real display that clipped the Bitcoin,
Dead Man and AI headings to a few pixels each, letterboxed the map, and
pushed Radio Settings into a scroll — more screen producing a worse view.
Very wide now uses the same tabbed column as every other desktop width,
with the selected panel filling the column and the map running edge to edge
(it is the one panel with nothing to scroll).

Session policy: idle timeout, absolute cap and a re-prompt-for-funds flag,
persisted and clamped. Two tokens already existed — a session token and a
30-day login token — so the knob changes how long a quiet tab stays usable
without putting a long-lived credential on every request. Kiosk screens are
exempt from the idle timeout (nobody is there to log a TV back in) but keep
the absolute cap so a stolen box does not stay authenticated forever. The
cap is not optional theatre: idle alone never fires on a polling dashboard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/settings/mod.rs          |   1 +
 .../src/settings/session_policy.rs            | 200 ++++++++++++++++++
 neode-ui/src/views/Mesh.vue                   |   7 +-
 neode-ui/src/views/mesh/mesh-styles.css       |  31 ++-
 4 files changed, 222 insertions(+), 17 deletions(-)
 create mode 100644 core/archipelago/src/settings/session_policy.rs

diff --git a/core/archipelago/src/settings/mod.rs b/core/archipelago/src/settings/mod.rs
index 8e028a0f..d2eb985a 100644
--- a/core/archipelago/src/settings/mod.rs
+++ b/core/archipelago/src/settings/mod.rs
@@ -4,4 +4,5 @@
 //! call sites (deep in the transport / RPC / ingest stacks) don't need
 //! to thread a data_dir or Arc through the entire call graph.
 
+pub mod session_policy;
 pub mod transport;
diff --git a/core/archipelago/src/settings/session_policy.rs b/core/archipelago/src/settings/session_policy.rs
new file mode 100644
index 00000000..471aafaa
--- /dev/null
+++ b/core/archipelago/src/settings/session_policy.rs
@@ -0,0 +1,200 @@
+//! How long a login lasts, and who gets to say so.
+//!
+//! # Why this is configurable rather than a constant
+//!
+//! There is no single correct session lifetime. The same node can be a
+//! wall-mounted TV in a living room that must never ask for a password
+//! mid-film, and a wallet holding real funds where PCI DSS-style guidance
+//! says fifteen minutes. Both are legitimate; the operator knows which one
+//! this node is and we do not.
+//!
+//! # The two tokens
+//!
+//! * **Session token** — short-lived, refreshed silently on every
+//!   authenticated request. This is what the browser sends; if it leaks, it
+//!   is useful only until [`SessionPolicy::idle_timeout_secs`] of silence.
+//! * **Login (remember) token** — long-lived, and its *only* power is to
+//!   mint a fresh session token. Kept separate so raising the convenience
+//!   knob does not put a 30-day bearer credential on every request.
+//!
+//! Raising the idle timeout therefore does not weaken the credential that
+//! actually travels; it only changes how long a quiet tab stays usable.
+//!
+//! # Why an absolute cap exists at all
+//!
+//! Idle timeout alone can be defeated by any page that polls — the
+//! dashboard polls constantly, so an idle timeout would never fire while a
+//! tab is open. The absolute cap is what guarantees a login eventually
+//! ends, which is the property an auditor actually asks about.
+
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+
+const FILE_PATH: &str = "settings/session_policy.json";
+
+/// Bounds. A setting that can be made meaningless is not a setting, and one
+/// that can lock the operator out of their own node is a footgun.
+const MIN_IDLE_SECS: u64 = 60;
+const MAX_IDLE_SECS: u64 = 90 * 24 * 3600;
+const MIN_ABSOLUTE_SECS: u64 = 300;
+const MAX_ABSOLUTE_SECS: u64 = 365 * 24 * 3600;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum DeviceClass {
+    /// Ordinary browser on a phone or laptop. Policy applies as configured.
+    Browser,
+    /// A screen nobody logs into — a wall-mounted dashboard or TV. Being
+    /// signed out mid-view is the failure mode here, not a stale session:
+    /// the device is physically in the home, and there is no keyboard to
+    /// re-authenticate with. Exempt from the idle timeout, still subject to
+    /// the absolute cap so a stolen box does not stay authenticated forever.
+    Kiosk,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SessionPolicy {
+    /// Silence after which a session token stops validating.
+    pub idle_timeout_secs: u64,
+    /// Hard ceiling from login, regardless of activity. `None` = no cap.
+    pub absolute_timeout_secs: Option<u64>,
+    /// Re-prompt for the password before actions that move money, however
+    /// fresh the session is. Independent of the timeouts on purpose: it is
+    /// the control that matters when funds are involved, and it costs the
+    /// operator nothing the rest of the time.
+    pub reauth_for_funds: bool,
+}
+
+impl Default for SessionPolicy {
+    fn default() -> Self {
+        Self {
+            // A day of silence, matching the previous hard-coded constant so
+            // existing nodes see no behaviour change until someone chooses.
+            idle_timeout_secs: 86_400,
+            // 30 days, aligned with the login token's own lifetime: a
+            // session that outlived the token which could refresh it would
+            // be an oddity.
+            absolute_timeout_secs: Some(30 * 24 * 3600),
+            reauth_for_funds: true,
+        }
+    }
+}
+
+impl SessionPolicy {
+    /// Clamp to the supported range. Applied on load as well as on save, so
+    /// a hand-edited file cannot disable expiry by writing `0`.
+    pub fn sanitized(mut self) -> Self {
+        self.idle_timeout_secs = self.idle_timeout_secs.clamp(MIN_IDLE_SECS, MAX_IDLE_SECS);
+        self.absolute_timeout_secs = self
+            .absolute_timeout_secs
+            .map(|v| v.clamp(MIN_ABSOLUTE_SECS, MAX_ABSOLUTE_SECS))
+            // An absolute cap below the idle timeout would expire sessions
+            // while they are still active, which reads as random logouts.
+            .map(|v| v.max(self.idle_timeout_secs));
+        self
+    }
+
+    /// Idle timeout for a given device, or `None` when idleness is not a
+    /// reason to expire (kiosk screens).
+    pub fn idle_timeout_for(&self, class: DeviceClass) -> Option<u64> {
+        match class {
+            DeviceClass::Browser => Some(self.idle_timeout_secs),
+            DeviceClass::Kiosk => None,
+        }
+    }
+
+    /// Has a session expired? `age` is time since login, `idle` since last
+    /// use. Both are checked because either alone is insufficient: idle
+    /// never fires on a polling dashboard, and absolute alone leaves a
+    /// forgotten tab usable for a month.
+    pub fn is_expired(&self, class: DeviceClass, age_secs: u64, idle_secs: u64) -> bool {
+        if let Some(limit) = self.absolute_timeout_secs {
+            if age_secs >= limit {
+                return true;
+            }
+        }
+        match self.idle_timeout_for(class) {
+            Some(limit) => idle_secs >= limit,
+            None => false,
+        }
+    }
+}
+
+pub async fn load(data_dir: &Path) -> SessionPolicy {
+    let path = data_dir.join(FILE_PATH);
+    match tokio::fs::read(&path).await {
+        Ok(bytes) => serde_json::from_slice::<SessionPolicy>(&bytes)
+            .map(SessionPolicy::sanitized)
+            .unwrap_or_else(|e| {
+                tracing::warn!(error = %e, "session policy unreadable; using defaults");
+                SessionPolicy::default()
+            }),
+        Err(_) => SessionPolicy::default(),
+    }
+}
+
+pub async fn save(data_dir: &Path, policy: SessionPolicy) -> anyhow::Result<SessionPolicy> {
+    let policy = policy.sanitized();
+    let path = data_dir.join(FILE_PATH);
+    if let Some(parent) = path.parent() {
+        tokio::fs::create_dir_all(parent).await?;
+    }
+    let tmp = path.with_extension("json.tmp");
+    tokio::fs::write(&tmp, serde_json::to_vec_pretty(&policy)?).await?;
+    tokio::fs::rename(&tmp, &path).await?;
+    Ok(policy)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_match_the_previous_hardcoded_behaviour() {
+        let p = SessionPolicy::default();
+        assert_eq!(p.idle_timeout_secs, 86_400);
+        assert!(p.reauth_for_funds);
+    }
+
+    #[test]
+    fn expiry_cannot_be_disabled_by_hand_editing_the_file() {
+        let p = SessionPolicy {
+            idle_timeout_secs: 0,
+            absolute_timeout_secs: Some(0),
+            reauth_for_funds: false,
+        }
+        .sanitized();
+        assert!(p.idle_timeout_secs >= MIN_IDLE_SECS);
+        assert!(p.absolute_timeout_secs.unwrap() >= MIN_ABSOLUTE_SECS);
+    }
+
+    #[test]
+    fn absolute_cap_is_never_shorter_than_idle() {
+        // Otherwise a session dies while actively in use, which the operator
+        // experiences as being logged out at random.
+        let p = SessionPolicy {
+            idle_timeout_secs: 7 * 24 * 3600,
+            absolute_timeout_secs: Some(3600),
+            reauth_for_funds: true,
+        }
+        .sanitized();
+        assert_eq!(p.absolute_timeout_secs.unwrap(), p.idle_timeout_secs);
+    }
+
+    #[test]
+    fn a_kiosk_never_expires_from_idleness_but_still_has_a_ceiling() {
+        let p = SessionPolicy::default();
+        let a_week = 7 * 24 * 3600;
+        assert!(!p.is_expired(DeviceClass::Kiosk, 60, a_week));
+        assert!(p.is_expired(DeviceClass::Browser, 60, a_week));
+        // The absolute cap still applies to the TV.
+        assert!(p.is_expired(DeviceClass::Kiosk, 31 * 24 * 3600, 0));
+    }
+
+    #[test]
+    fn a_polling_dashboard_still_eventually_expires() {
+        // idle never grows because the page polls; only the cap saves us.
+        let p = SessionPolicy::default();
+        assert!(p.is_expired(DeviceClass::Browser, 30 * 24 * 3600, 0));
+    }
+}
diff --git a/neode-ui/src/views/Mesh.vue b/neode-ui/src/views/Mesh.vue
index f6386335..36c3237f 100644
--- a/neode-ui/src/views/Mesh.vue
+++ b/neode-ui/src/views/Mesh.vue
@@ -311,31 +311,26 @@ const showChatPanel = computed(() =>
   activeTab.value === 'chat' || isWideDesktop.value || (isMobile.value && mobileShowChat.value)
 )
 const showBitcoinPanel = computed(() => {
-  if (isVeryWideDesktop.value) return true
   if (isWideDesktop.value) return toolsTab.value === 'bitcoin'
   if (isMobile.value) return mobileTab.value === 'bitcoin'
   return activeTab.value === 'bitcoin'
 })
 const showDeadmanPanel = computed(() => {
-  if (isVeryWideDesktop.value) return true
   if (isWideDesktop.value) return toolsTab.value === 'deadman'
   if (isMobile.value) return mobileTab.value === 'deadman'
   return activeTab.value === 'deadman'
 })
 const showAssistantPanel = computed(() => {
-  if (isVeryWideDesktop.value) return true
   if (isWideDesktop.value) return toolsTab.value === 'assistant'
   if (isMobile.value) return mobileTab.value === 'assistant'
   return activeTab.value === 'assistant'
 })
 const showMapPanel = computed(() => {
-  if (isVeryWideDesktop.value) return true
   if (isWideDesktop.value) return toolsTab.value === 'map'
   if (isMobile.value) return mobileTab.value === 'map'
   return activeTab.value === 'map'
 })
 const showDevicePanel = computed(() => {
-  if (isVeryWideDesktop.value) return true
   if (isWideDesktop.value) return toolsTab.value === 'device'
   if (isMobile.value) return mobileTab.value === 'device'
   return activeTab.value === 'device'
@@ -2683,7 +2678,7 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
 
         <!-- Tools panels (3rd column on wide screens) -->
         <div class="mesh-tools-wrapper" data-controller-zone="mesh-tools">
-          <div v-if="isWideDesktop && !isVeryWideDesktop" class="mesh-tools-tab-bar">
+          <div v-if="isWideDesktop" class="mesh-tools-tab-bar">
             <button class="mesh-tab" :class="{ active: toolsTab === 'bitcoin' }" @click="toolsTab = 'bitcoin'">Bitcoin</button>
             <button class="mesh-tab" :class="{ active: toolsTab === 'deadman' }" @click="toolsTab = 'deadman'">
               Dead Man
diff --git a/neode-ui/src/views/mesh/mesh-styles.css b/neode-ui/src/views/mesh/mesh-styles.css
index 47eb8656..5b86cc83 100644
--- a/neode-ui/src/views/mesh/mesh-styles.css
+++ b/neode-ui/src/views/mesh/mesh-styles.css
@@ -43,17 +43,26 @@
 .mesh-columns-wide .mesh-chat-card { grid-column: 2; grid-row: 1; min-height: 0; overflow: hidden; }
 .mesh-columns-wide .mesh-tools-wrapper { grid-column: 3; grid-row: 1; display: flex; flex-direction: column; gap: 0; min-height: 0; overflow: hidden; }
 .mesh-columns-wide .mesh-tools-tab-bar { display: flex; gap: 2px; background: rgba(0,0,0,0.3); border-radius: 10px; padding: 3px; flex-shrink: 0; margin-bottom: 12px; }
-.mesh-columns-very-wide { grid-template-columns: minmax(300px, 340px) minmax(460px, 1.05fr) minmax(420px, 0.95fr); }
-.mesh-columns-very-wide .mesh-tools-wrapper { display: grid; grid-template-rows: minmax(0, 1fr) minmax(0, 0.85fr) minmax(0, 1fr); gap: 12px; overflow: hidden; }
-.mesh-columns-very-wide .mesh-tools-wrapper .mesh-bitcoin-panel,
-.mesh-columns-very-wide .mesh-tools-wrapper .mesh-deadman-panel,
-.mesh-columns-very-wide .mesh-tools-wrapper .mesh-assistant-panel,
-.mesh-columns-very-wide .mesh-tools-wrapper .mesh-map-panel { min-height: 0; height: 100%; overflow: hidden; }
-.mesh-columns-wide:not(.mesh-columns-very-wide) .mesh-tools-wrapper .mesh-bitcoin-panel,
-.mesh-columns-wide:not(.mesh-columns-very-wide) .mesh-tools-wrapper .mesh-deadman-panel,
-.mesh-columns-wide:not(.mesh-columns-very-wide) .mesh-tools-wrapper .mesh-assistant-panel,
-.mesh-columns-wide:not(.mesh-columns-very-wide) .mesh-tools-wrapper .mesh-map-panel { flex: 1 1 auto; min-height: 0; height: auto; }
-.mesh-columns-very-wide .mesh-tools-tab-bar { display: none; }
+/* A very wide screen gets a roomier third column — but the SAME tabbed
+   panel as every other desktop width. It used to stack Bitcoin, Dead Man,
+   AI, the map and Device on top of each other in fixed grid rows, which on
+   a real 2560px display clipped the first three headings to a few pixels,
+   letterboxed the map, and pushed Radio Settings into a scroll — more
+   screen producing a worse view (reported with a screenshot 2026-08-05).
+   One tab at a time, filling the column, is what makes the map edge to
+   edge and every control reachable without scrolling. */
+.mesh-columns-very-wide { grid-template-columns: minmax(300px, 340px) minmax(460px, 1.05fr) minmax(460px, 1fr); }
+.mesh-columns-wide .mesh-tools-wrapper .mesh-bitcoin-panel,
+.mesh-columns-wide .mesh-tools-wrapper .mesh-deadman-panel,
+.mesh-columns-wide .mesh-tools-wrapper .mesh-assistant-panel,
+.mesh-columns-wide .mesh-tools-wrapper .mesh-device-panel,
+.mesh-columns-wide .mesh-tools-wrapper .mesh-map-panel {
+  flex: 1 1 auto; min-height: 0; height: auto; overflow-y: auto;
+}
+/* The map is the one panel with nothing to scroll: let it consume the
+   column edge to edge rather than sitting in a letterbox. */
+.mesh-columns-wide .mesh-tools-wrapper .mesh-map-panel { overflow: hidden; padding: 0; }
+.mesh-columns-wide .mesh-tools-wrapper .mesh-map-panel > * { height: 100%; width: 100%; }
 .mesh-columns-wide .mesh-mobile-back-btn,
 .mesh-columns-wide .mesh-tab-bar { display: none; }
 .mesh-status-card { padding: 16px; flex-shrink: 0; }

From 81033ed6f534716110c0987bf9d5e0f1148e0efc Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 13:50:16 -0400
Subject: [PATCH 28/60] fix(ota): repair a stale Restart=on-failure unit that
 leaves nodes dead after update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

austin-sapien (100.70.96.88) sat dead for over two hours after taking
v1.7.122 — 'server starting' in the UI, service inactive, exit status
0/SUCCESS. It did not crash: the in-process updater replaces the binary and
exits cleanly for systemd to restart it, and that node's unit still carried
Restart=on-failure from an older install. systemd read the clean exit as
success and left it stopped. Every node with the old unit has this waiting
for it on the next update.

self-update.sh does refresh units, but the in-process update path never
runs it, so nothing was repairing them. The daemon now checks its own unit
at boot and rewrites only the Restart= line, so a node that starts even
once ends up with a policy that survives the next update.

Also carries the session-policy wiring: validate() now honours the
configured idle and absolute limits and the per-device class, instead of
the single hard-coded 24h constant.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/bootstrap.rs | 51 +++++++++++++++++++++++++++++++
 core/archipelago/src/main.rs      |  5 +++
 core/archipelago/src/session.rs   | 43 +++++++++++++++++++++++---
 3 files changed, 95 insertions(+), 4 deletions(-)

diff --git a/core/archipelago/src/bootstrap.rs b/core/archipelago/src/bootstrap.rs
index 44d21116..5a4c7b59 100644
--- a/core/archipelago/src/bootstrap.rs
+++ b/core/archipelago/src/bootstrap.rs
@@ -1271,3 +1271,54 @@ mod tests {
         assert_ne!(outcome, PodmanHealOutcome::Healthy);
     }
 }
+
+/// Repair this node's own systemd restart policy.
+///
+/// The in-process updater replaces the binary and then asks systemd to
+/// restart the service, treating `Restart=always` on the unit as its second
+/// net if that request is ever lost. On austin-sapien (2026-08-05) the unit
+/// was an old one carrying `Restart=on-failure`: the daemon exited cleanly
+/// (status 0), systemd read that as success, and the node sat dead for over
+/// two hours after a routine update — "server starting" in the UI, with
+/// nothing to start it.
+///
+/// A node cannot be relied on to fix this via `self-update.sh` (which does
+/// refresh units) because the in-process update path never runs it. So the
+/// daemon checks its own unit at boot: any node that starts even once ends
+/// up with a policy that survives the next update. Deliberately narrow —
+/// only the `Restart=` line is touched, so local edits elsewhere in the unit
+/// are preserved.
+pub async fn ensure_restart_policy() {
+    const UNIT: &str = "/etc/systemd/system/archipelago.service";
+    let Ok(body) = fs::read_to_string(UNIT).await else {
+        return; // not a systemd install (container, dev box) — nothing to do
+    };
+    if !body.lines().any(|l| {
+        let l = l.trim();
+        l.starts_with("Restart=") && l != "Restart=always"
+    }) {
+        return; // already correct, or no Restart= line to repair
+    }
+    let patched: String = body
+        .lines()
+        .map(|l| {
+            if l.trim().starts_with("Restart=") && l.trim() != "Restart=always" {
+                "Restart=always"
+            } else {
+                l
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    match write_root_if_needed(UNIT, &patched).await {
+        Ok(true) => {
+            tracing::warn!(
+                "repaired archipelago.service Restart= policy to always — this node would \
+                 have stayed dead after an in-process update"
+            );
+            let _ = host_sudo(&["systemctl", "daemon-reload"]).await;
+        }
+        Ok(false) => {}
+        Err(e) => tracing::warn!(error = %e, "could not repair archipelago.service restart policy"),
+    }
+}
diff --git a/core/archipelago/src/main.rs b/core/archipelago/src/main.rs
index 553b53c2..04f862ef 100644
--- a/core/archipelago/src/main.rs
+++ b/core/archipelago/src/main.rs
@@ -409,6 +409,11 @@ async fn main() -> Result<()> {
     // flags) on already-deployed nodes via OTA; no-op if the kiosk isn't installed.
     tokio::spawn(bootstrap::ensure_kiosk_hardened());
 
+    // Repair our own restart policy before anything else can need it: a node
+    // whose unit still says Restart=on-failure stays dead after the next
+    // in-process update, because the daemon exits cleanly to be restarted.
+    tokio::spawn(bootstrap::ensure_restart_policy());
+
     // HDMI audio: install the PipeWire stack + audio-router daemon on kiosk
     // nodes (older ISOs shipped no audio stack; the router also heals the
     // boot-time ELD race that leaves HDMI silently unavailable).
diff --git a/core/archipelago/src/session.rs b/core/archipelago/src/session.rs
index c150eac8..13b44e4f 100644
--- a/core/archipelago/src/session.rs
+++ b/core/archipelago/src/session.rs
@@ -40,12 +40,19 @@ struct Session {
     created_at: SystemTime,
     last_activity: SystemTime,
     session_type: SessionType,
+    /// What kind of screen this login came from. A TV on the wall must not
+    /// be signed out for sitting still — nobody is there to type a password
+    /// back in — while a browser must be.
+    device_class: crate::settings::session_policy::DeviceClass,
 }
 
 #[derive(Clone)]
 pub struct SessionStore {
     sessions: Arc<RwLock<HashMap<[u8; 32], Session>>>,
     persist_path: PathBuf,
+    /// Where the session policy lives. Held rather than looked up globally
+    /// so tests can point at a temp dir.
+    data_dir: PathBuf,
 }
 
 /// On-disk representation of a persisted session (only Full sessions, no TOTP secrets).
@@ -67,6 +74,7 @@ impl SessionStore {
         Self {
             sessions: Arc::new(RwLock::new(sessions)),
             persist_path,
+            data_dir: PathBuf::from("/var/lib/archipelago"),
         }
     }
 
@@ -75,9 +83,17 @@ impl SessionStore {
     /// machine's real /var/lib/archipelago/sessions.json.
     #[cfg(test)]
     pub fn new_for_tests(persist_path: PathBuf) -> Self {
+        // data_dir shares the temp path's parent so a test that writes a
+        // policy file is honoured, and one that doesn't gets the defaults
+        // rather than the dev machine's real configuration.
+        let data_dir = persist_path
+            .parent()
+            .map(PathBuf::from)
+            .unwrap_or_else(|| PathBuf::from("."));
         Self {
             sessions: Arc::new(RwLock::new(HashMap::new())),
             persist_path,
+            data_dir,
         }
     }
 
@@ -120,6 +136,7 @@ impl SessionStore {
                     created_at,
                     last_activity,
                     session_type: SessionType::Full,
+                    device_class: crate::settings::session_policy::DeviceClass::Browser,
                 },
             );
         }
@@ -160,6 +177,7 @@ impl SessionStore {
             created_at: now,
             last_activity: now,
             session_type: SessionType::Full,
+            device_class: crate::settings::session_policy::DeviceClass::Browser,
         };
 
         let mut sessions = self.sessions.write().await;
@@ -184,6 +202,10 @@ impl SessionStore {
                 totp_secret,
                 attempts: 0,
             },
+            // A half-finished login is always treated as a browser: it lives
+            // for PENDING_SESSION_TTL either way, and a kiosk exemption on a
+            // session that has not passed 2FA yet would be the wrong default.
+            device_class: crate::settings::session_policy::DeviceClass::Browser,
         };
         self.sessions.write().await.insert(hash, session);
         token
@@ -192,19 +214,23 @@ impl SessionStore {
     /// Validate a full session token. Returns true if the session exists and hasn't expired.
     /// Updates last_activity on successful validation (inactivity-based expiry).
     pub async fn validate(&self, token: &str) -> bool {
+        let policy = self.policy().await;
         let hash = hash_token(token);
         let mut sessions = self.sessions.write().await;
         if let Some(session) = sessions.get_mut(&hash) {
             if !matches!(session.session_type, SessionType::Full) {
                 return false;
             }
-            if session
+            let idle = session
                 .last_activity
                 .elapsed()
                 .unwrap_or_default()
-                .as_secs()
-                >= FULL_SESSION_TTL
-            {
+                .as_secs();
+            let age = session.created_at.elapsed().unwrap_or_default().as_secs();
+            // Both limits, not just idleness: the dashboard polls, so an
+            // idle timeout alone would never fire on an open tab. The
+            // absolute cap is what actually guarantees a login ends.
+            if policy.is_expired(session.device_class, age, idle) {
                 sessions.remove(&hash);
                 return false;
             }
@@ -215,6 +241,13 @@ impl SessionStore {
         }
     }
 
+    /// The operator's session policy, re-read from disk rather than cached
+    /// for the process lifetime so a change in Settings takes effect on the
+    /// next request instead of the next restart.
+    pub async fn policy(&self) -> crate::settings::session_policy::SessionPolicy {
+        crate::settings::session_policy::load(&self.data_dir).await
+    }
+
     /// Get the TOTP secret from a pending session. Returns None if not a valid pending session.
     /// Increments the attempt counter.
     pub async fn get_pending_secret(&self, token: &str) -> Option<Vec<u8>> {
@@ -259,6 +292,7 @@ impl SessionStore {
                     created_at: now,
                     last_activity: now,
                     session_type: SessionType::Full,
+                    device_class: crate::settings::session_policy::DeviceClass::Browser,
                 },
             );
             Self::save_to_disk(&sessions, &self.persist_path).await;
@@ -300,6 +334,7 @@ impl SessionStore {
                 created_at: now,
                 last_activity: now,
                 session_type: SessionType::Full,
+                device_class: crate::settings::session_policy::DeviceClass::Browser,
             },
         );
         Self::save_to_disk(&sessions, &self.persist_path).await;

From 9dd02359e49e7e435db371c78852540b690bc716 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 14:29:17 -0400
Subject: [PATCH 29/60] feat(settings): session timeout is configurable from
 the UI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

auth.session-policy.get/set plus a card under Account. Presented as two
plain questions rather than the token mechanism underneath, because the
distinction that matters to an operator is which control actually ends a
session: the dashboard polls constantly, so an idle timeout alone never
fires on an open tab — the absolute cap is what guarantees it.

Values are clamped server-side and the stored result is echoed back, so
the bounds are discoverable instead of an error. Presets rather than a free
number field: a box accepting '5' invites locking yourself out. A short
idle choice warns that it is the payments-industry posture.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/dispatcher.rs    |   2 +
 .../src/api/rpc/system/handlers.rs            |  53 ++++++
 .../src/views/settings/AccountSection.vue     |   2 +
 .../views/settings/SessionTimeoutSection.vue  | 151 ++++++++++++++++++
 4 files changed, 208 insertions(+)
 create mode 100644 neode-ui/src/views/settings/SessionTimeoutSection.vue

diff --git a/core/archipelago/src/api/rpc/dispatcher.rs b/core/archipelago/src/api/rpc/dispatcher.rs
index 5f7ce8f4..48e0dbfa 100644
--- a/core/archipelago/src/api/rpc/dispatcher.rs
+++ b/core/archipelago/src/api/rpc/dispatcher.rs
@@ -472,6 +472,8 @@ impl RpcHandler {
             "system.disk-cleanup" => self.handle_system_disk_cleanup().await,
             "system.reboot" => self.handle_system_reboot(params).await,
             "system.factory-reset" => self.handle_system_factory_reset(params).await,
+            "auth.session-policy.get" => self.handle_session_policy_get().await,
+            "auth.session-policy.set" => self.handle_session_policy_set(params).await,
             "system.settings.get" => self.handle_system_settings_get(params).await,
             "system.settings.set" => self.handle_system_settings_set(params).await,
             "system.kiosk-display.get" => self.handle_system_kiosk_display_get().await,
diff --git a/core/archipelago/src/api/rpc/system/handlers.rs b/core/archipelago/src/api/rpc/system/handlers.rs
index 30ed79da..ae05a17f 100644
--- a/core/archipelago/src/api/rpc/system/handlers.rs
+++ b/core/archipelago/src/api/rpc/system/handlers.rs
@@ -1011,6 +1011,59 @@ impl RpcHandler {
         }
     }
 
+    /// auth.session-policy.get — how long a login lasts on this node.
+    pub(in crate::api::rpc) async fn handle_session_policy_get(&self) -> Result<serde_json::Value> {
+        let policy = crate::settings::session_policy::load(&self.config.data_dir).await;
+        Ok(serde_json::json!({
+            "idle_timeout_secs": policy.idle_timeout_secs,
+            "absolute_timeout_secs": policy.absolute_timeout_secs,
+            "reauth_for_funds": policy.reauth_for_funds,
+        }))
+    }
+
+    /// auth.session-policy.set — change it.
+    ///
+    /// Values are clamped rather than rejected: the caller learns what was
+    /// actually stored from the reply, which is friendlier than an error and
+    /// makes the bounds discoverable. Fields are individually optional so the
+    /// UI can change one control without having to send the others back.
+    pub(in crate::api::rpc) async fn handle_session_policy_set(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.unwrap_or(serde_json::json!({}));
+        let current = crate::settings::session_policy::load(&self.config.data_dir).await;
+        let policy = crate::settings::session_policy::SessionPolicy {
+            idle_timeout_secs: params
+                .get("idle_timeout_secs")
+                .and_then(|v| v.as_u64())
+                .unwrap_or(current.idle_timeout_secs),
+            absolute_timeout_secs: match params.get("absolute_timeout_secs") {
+                // Explicit null means "no absolute cap", which is different
+                // from the field being absent (leave it as it is).
+                Some(serde_json::Value::Null) => None,
+                Some(v) => v.as_u64().or(current.absolute_timeout_secs),
+                None => current.absolute_timeout_secs,
+            },
+            reauth_for_funds: params
+                .get("reauth_for_funds")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(current.reauth_for_funds),
+        };
+        let saved = crate::settings::session_policy::save(&self.config.data_dir, policy).await?;
+        tracing::info!(
+            idle = saved.idle_timeout_secs,
+            absolute = ?saved.absolute_timeout_secs,
+            reauth_for_funds = saved.reauth_for_funds,
+            "session policy updated"
+        );
+        Ok(serde_json::json!({
+            "idle_timeout_secs": saved.idle_timeout_secs,
+            "absolute_timeout_secs": saved.absolute_timeout_secs,
+            "reauth_for_funds": saved.reauth_for_funds,
+        }))
+    }
+
     /// system.settings.set — Write a settings value
     pub(in crate::api::rpc) async fn handle_system_settings_set(
         &self,
diff --git a/neode-ui/src/views/settings/AccountSection.vue b/neode-ui/src/views/settings/AccountSection.vue
index cfe59d4e..5f888144 100644
--- a/neode-ui/src/views/settings/AccountSection.vue
+++ b/neode-ui/src/views/settings/AccountSection.vue
@@ -5,6 +5,7 @@ import { useAppStore } from '@/stores/app'
 import AccountInfoSection from '@/views/settings/AccountInfoSection.vue'
 import ChangePasswordSection from '@/views/settings/ChangePasswordSection.vue'
 import TwoFactorSection from '@/views/settings/TwoFactorSection.vue'
+import SessionTimeoutSection from '@/views/settings/SessionTimeoutSection.vue'
 
 const router = useRouter()
 const { t } = useI18n()
@@ -24,6 +25,7 @@ async function handleLogout() {
     <AccountInfoSection />
     <ChangePasswordSection />
     <TwoFactorSection />
+    <SessionTimeoutSection />
 
     <!-- Logout Button -->
     <button
diff --git a/neode-ui/src/views/settings/SessionTimeoutSection.vue b/neode-ui/src/views/settings/SessionTimeoutSection.vue
new file mode 100644
index 00000000..f5821024
--- /dev/null
+++ b/neode-ui/src/views/settings/SessionTimeoutSection.vue
@@ -0,0 +1,151 @@
+<script setup lang="ts">
+/**
+ * How long a login lasts on this node.
+ *
+ * Presented as two plain questions — "sign me out after quiet" and "always
+ * sign me out after" — rather than as the two-token mechanism underneath.
+ * The distinction that matters to the operator is that the second one is
+ * what actually guarantees a login ends: this dashboard polls constantly,
+ * so an idle timeout alone never fires on an open tab.
+ */
+import { ref, onMounted, computed } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+type Policy = {
+  idle_timeout_secs: number
+  absolute_timeout_secs: number | null
+  reauth_for_funds: boolean
+}
+
+const idle = ref<number>(86400)
+const absolute = ref<number | null>(30 * 24 * 3600)
+const reauthForFunds = ref(true)
+const loading = ref(true)
+const saving = ref(false)
+const saved = ref(false)
+const error = ref('')
+
+// Offered as presets rather than a free number field: the useful values are
+// few, and a box accepting "5" invites someone to lock themselves out.
+const idleChoices = [
+  { label: '15 minutes', value: 15 * 60 },
+  { label: '1 hour', value: 3600 },
+  { label: '1 day', value: 86400 },
+  { label: '1 week', value: 7 * 24 * 3600 },
+  { label: '30 days', value: 30 * 24 * 3600 },
+]
+const absoluteChoices = [
+  { label: '1 day', value: 86400 },
+  { label: '1 week', value: 7 * 24 * 3600 },
+  { label: '30 days', value: 30 * 24 * 3600 },
+  { label: '90 days', value: 90 * 24 * 3600 },
+  { label: 'Never', value: null },
+]
+
+const shortIdleWarning = computed(() => idle.value <= 3600)
+
+async function load() {
+  loading.value = true
+  try {
+    const p = await rpcClient.call<Policy>({ method: 'auth.session-policy.get', params: {} })
+    idle.value = p.idle_timeout_secs
+    absolute.value = p.absolute_timeout_secs
+    reauthForFunds.value = p.reauth_for_funds
+  } catch (e) {
+    error.value = e instanceof Error ? e.message : String(e)
+  } finally {
+    loading.value = false
+  }
+}
+
+async function save() {
+  saving.value = true
+  saved.value = false
+  error.value = ''
+  try {
+    // The backend clamps and returns what it stored, so reflect that back
+    // rather than assuming our values were taken verbatim.
+    const p = await rpcClient.call<Policy>({
+      method: 'auth.session-policy.set',
+      params: {
+        idle_timeout_secs: idle.value,
+        absolute_timeout_secs: absolute.value,
+        reauth_for_funds: reauthForFunds.value,
+      },
+    })
+    idle.value = p.idle_timeout_secs
+    absolute.value = p.absolute_timeout_secs
+    reauthForFunds.value = p.reauth_for_funds
+    saved.value = true
+    setTimeout(() => { saved.value = false }, 2500)
+  } catch (e) {
+    error.value = e instanceof Error ? e.message : String(e)
+  } finally {
+    saving.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<template>
+  <div class="mb-6">
+    <h3 class="text-base font-medium text-white/90 mb-1">Session timeout</h3>
+    <p class="text-sm text-white/60 mb-4">
+      How long this node keeps you signed in. TV and kiosk screens are never
+      signed out for sitting idle — there is nobody there to sign them back in.
+    </p>
+
+    <div v-if="error" role="alert" class="mb-4 p-3 bg-red-500/20 border border-red-500/40 rounded-lg text-red-200 text-sm">
+      {{ error }}
+    </div>
+
+    <div v-if="!loading" class="space-y-4">
+      <div>
+        <label for="idle-timeout" class="block text-sm font-medium text-white/80 mb-2">Sign me out after this much inactivity</label>
+        <select
+          id="idle-timeout"
+          v-model.number="idle"
+          class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white focus:outline-none focus:border-white/40"
+        >
+          <option v-for="c in idleChoices" :key="c.value" :value="c.value" class="bg-neutral-900">{{ c.label }}</option>
+        </select>
+        <p v-if="shortIdleWarning" class="text-xs text-orange-300/80 mt-2">
+          Short timeouts are what payment-industry rules ask for when funds are involved — expect to sign in often.
+        </p>
+      </div>
+
+      <div>
+        <label for="absolute-timeout" class="block text-sm font-medium text-white/80 mb-2">Always sign me out after</label>
+        <select
+          id="absolute-timeout"
+          v-model="absolute"
+          class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white focus:outline-none focus:border-white/40"
+        >
+          <option v-for="c in absoluteChoices" :key="String(c.value)" :value="c.value" class="bg-neutral-900">{{ c.label }}</option>
+        </select>
+        <p class="text-xs text-white/50 mt-2">
+          Counts from when you signed in, whatever you are doing. This is the one that
+          guarantees a session ends: an open dashboard is never idle, so the setting
+          above would not fire on it.
+        </p>
+      </div>
+
+      <label class="flex items-start gap-3 cursor-pointer">
+        <input v-model="reauthForFunds" type="checkbox" class="mt-1 accent-orange-500" />
+        <span class="text-sm text-white/80">
+          Ask for my password again before sending funds
+          <span class="block text-xs text-white/50">Recommended. Applies however recently you signed in.</span>
+        </span>
+      </label>
+
+      <button
+        :disabled="saving"
+        class="w-full glass-button px-6 py-3 rounded-lg font-medium transition-all hover:bg-black/70 disabled:opacity-50"
+        @click="save"
+      >
+        {{ saving ? 'Saving…' : (saved ? 'Saved' : 'Save session settings') }}
+      </button>
+    </div>
+  </div>
+</template>

From cc709fd7dac10464527b0d93f32296e1dfa6bfc6 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 14:58:28 -0400
Subject: [PATCH 30/60] docs(1.7.124): curate release notes and add the in-app
 What's New block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Leads with the update that switched nodes off and left them unable to
switch back on — the one an operator most needs to understand, and the
reason to take this release promptly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                   | 12 ++++++++++++
 .../src/views/settings/AccountInfoSection.vue  | 18 ++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cce1a1a..5f5e857c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## v1.7.124-alpha (2026-08-05)
+
+- **The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing "server starting" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.
+- **Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.
+- **Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.
+- **Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.
+- **The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.
+- **The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.
+- **You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.
+- Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.
+- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
 ## v1.7.123-alpha (2026-08-05)
 
 - **Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.
diff --git a/neode-ui/src/views/settings/AccountInfoSection.vue b/neode-ui/src/views/settings/AccountInfoSection.vue
index 5516fbe5..e79d46e8 100644
--- a/neode-ui/src/views/settings/AccountInfoSection.vue
+++ b/neode-ui/src/views/settings/AccountInfoSection.vue
@@ -362,6 +362,24 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.124-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.124-alpha</span>
+                  <span class="text-xs text-white/40">August 5, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>The most important fix here: some nodes were left switched off by their own update, and could not switch themselves back on.</strong> The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it <em>crashes</em>. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing "server starting" with nothing able to start it. One of ours was down over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts.</p>
+                  <p><strong>Portainer opens again.</strong> Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1 and their stored data was written by that version, while the app list pinned a version from two years earlier — so a rebuilt container landed on the old one, which will not read newer data. The correct version is pinned now, older installs upgrade cleanly, and no data was touched.</p>
+                  <p><strong>Bitcoin starts reliably again.</strong> A leftover settings file in the Bitcoin folder — one the node kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes it, clears stale copies, and treats any that remain as harmless.</p>
+                  <p><strong>Every app screen opens from My Apps again.</strong> The login gate refused to be displayed inside another page at all — which is exactly how My Apps opens an app — so protected apps looked broken. It now allows only your own node to display it and refuses everyone else.</p>
+                  <p><strong>The app login screen looks like the node's own now:</strong> same rotating artwork, same panel, the Archipelago mark, and the app's real icon as a tile the way My Apps shows it, instead of a plain box with a letter.</p>
+                  <p><strong>The Mesh screen uses wide displays properly.</strong> On very large screens it stacked all five panels, clipping three headings to a sliver and squeezing the map into a letterbox. It now shows one panel at a time, filling the space, with the map edge to edge.</p>
+                  <p><strong>You can choose how long you stay signed in.</strong> Settings → Account offers an inactivity timeout, a hard limit, and an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle — there is nobody there to sign them back in.</p>
+                  <p>Updates now come from source.archipelago-foundation.org rather than a bare address, with the old one kept as an automatic fallback. Also: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.</p>
+                  <p>Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.</p>
+                </div>
+              </div>
               <!-- v1.7.123-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

From 6668359875e41bac30528fc14e5dcb8373f3c65a Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 15:10:49 -0400
Subject: [PATCH 31/60] chore: bump to 1.7.124-alpha ahead of the release run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pre-bumped so the release gate compiles the test profile at the final
version — create-release bumps after the gate, so the gate would otherwise
run on the old version and the bump would invalidate the cache, timing out
cargo-test-weekly on the compile rather than the tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/Cargo.toml | 2 +-
 neode-ui/package-lock.json  | 4 ++--
 neode-ui/package.json       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/archipelago/Cargo.toml b/core/archipelago/Cargo.toml
index fc0d0279..670a7451 100644
--- a/core/archipelago/Cargo.toml
+++ b/core/archipelago/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.123-alpha"
+version = "1.7.124-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
diff --git a/neode-ui/package-lock.json b/neode-ui/package-lock.json
index 38ac58de..d926d63d 100644
--- a/neode-ui/package-lock.json
+++ b/neode-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.123-alpha",
+  "version": "1.7.124-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.123-alpha",
+      "version": "1.7.124-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
diff --git a/neode-ui/package.json b/neode-ui/package.json
index 2c1b2738..5deee48c 100644
--- a/neode-ui/package.json
+++ b/neode-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.123-alpha",
+  "version": "1.7.124-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

From 0a374c80a66b568b8a0055e16e87c2f441ba271f Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 15:24:31 -0400
Subject: [PATCH 32/60] style: rustfmt the merged PR #125 hunks and the mirror
 test; sync Cargo.lock

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/Cargo.lock                | 2 +-
 core/archipelago/src/server.rs | 9 +++------
 core/archipelago/src/update.rs | 4 +++-
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/core/Cargo.lock b/core/Cargo.lock
index 2bfc227e..46f9ce52 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.123-alpha"
+version = "1.7.124-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs
index 93b1f038..b89f84b6 100644
--- a/core/archipelago/src/server.rs
+++ b/core/archipelago/src/server.rs
@@ -856,12 +856,9 @@ impl Server {
                         // connected now, no LAN direct entry this tick. Escala-
                         // tion order is LAN → last-known-good → anchor tree;
                         // a stale candidate costs one bounded failed dial.
-                        let connected =
-                            crate::fips::service::connected_peer_endpoints().await;
-                        let known = crate::fips::endpoints::record_connected(
-                            &data_dir, &connected,
-                        )
-                        .await;
+                        let connected = crate::fips::service::connected_peer_endpoints().await;
+                        let known =
+                            crate::fips::endpoints::record_connected(&data_dir, &connected).await;
                         let wanted: Vec<String> = reg
                             .all_peers()
                             .await
diff --git a/core/archipelago/src/update.rs b/core/archipelago/src/update.rs
index 6fd94eb7..69a3345d 100644
--- a/core/archipelago/src/update.rs
+++ b/core/archipelago/src/update.rs
@@ -2403,7 +2403,9 @@ mod tests {
         // update; the signature is what makes either source trustworthy.
         assert_eq!(list.len(), 2);
         assert!(
-            list[0].url.starts_with("https://source.archipelago-foundation.org/"),
+            list[0]
+                .url
+                .starts_with("https://source.archipelago-foundation.org/"),
             "the named origin must be primary, got {}",
             list[0].url
         );

From d5ca612e2b17cc9bdc10d2e63df5775346f6edd3 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 15:27:19 -0400
Subject: [PATCH 33/60] chore(catalog): sync catalogs to the manifests for
 1.7.124
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Portainer's image reaches the public catalog (the release gate caught the
manifest and catalog disagreeing), and fips-ui 8336 joins the mesh relay's
port list now that it declares a port — it is auth: gated, so the relay
withholds it rather than bridging it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 app-catalog/catalog.json                      |  2 +-
 core/archipelago/src/fips/app_ports.rs        | 39 +++++++++++++++++--
 neode-ui/public/catalog.json                  |  2 +-
 .../appSession/generatedAppSessionConfig.ts   |  3 ++
 releases/app-catalog.json                     | 24 ++++++------
 5 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/app-catalog/catalog.json b/app-catalog/catalog.json
index cf0ca910..b6020cc1 100644
--- a/app-catalog/catalog.json
+++ b/app-catalog/catalog.json
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.19.4",
+      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
diff --git a/core/archipelago/src/fips/app_ports.rs b/core/archipelago/src/fips/app_ports.rs
index 78fb5285..1ad284cb 100644
--- a/core/archipelago/src/fips/app_ports.rs
+++ b/core/archipelago/src/fips/app_ports.rs
@@ -6,7 +6,40 @@
 //! no listener, so allowing them is inert.
 
 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088,
-    8089, 8090, 8096, 8123, 8175, 8176, 8240, 8334, 8888, 8999, 9000, 9100, 10380, 11434, 18081,
-    18083, 23000, 32838, 50002,
+    2283,
+    2342,
+    3000,
+    3001,
+    3002,
+    4080,
+    5180,
+    7778,
+    8080,
+    8081,
+    8082,
+    8083,
+    8084,
+    8085,
+    8087,
+    8088,
+    8089,
+    8090,
+    8096,
+    8123,
+    8175,
+    8176,
+    8240,
+    8334,
+    8336,
+    8888,
+    8999,
+    9000,
+    9100,
+    10380,
+    11434,
+    18081,
+    18083,
+    23000,
+    32838,
+    50002,
 ];
diff --git a/neode-ui/public/catalog.json b/neode-ui/public/catalog.json
index cf0ca910..b6020cc1 100644
--- a/neode-ui/public/catalog.json
+++ b/neode-ui/public/catalog.json
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.19.4",
+      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
diff --git a/neode-ui/src/views/appSession/generatedAppSessionConfig.ts b/neode-ui/src/views/appSession/generatedAppSessionConfig.ts
index 0bd89175..38185346 100644
--- a/neode-ui/src/views/appSession/generatedAppSessionConfig.ts
+++ b/neode-ui/src/views/appSession/generatedAppSessionConfig.ts
@@ -4,12 +4,15 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "aiui": 5180,
   "archy-mempool-web": 4080,
   "archy-nbxplorer": 32838,
+  "bitcoin-ui": 8334,
   "botfights": 9100,
   "btcpay-server": 23000,
   "did-wallet": 8088,
+  "electrs-ui": 50002,
   "electrumx": 50002,
   "fedimint": 8175,
   "filebrowser": 8083,
+  "fips-ui": 8336,
   "gitea": 3001,
   "grafana": 3000,
   "homeassistant": 8123,
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index e8f64b80..9cb615b4 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -421,7 +421,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; # A stray bitcoin.conf in the datadir is FATAL when -conf points # elsewhere: bitcoind refuses to start with \"contains a bitcoin.conf # file which is ignored\", and the app crash-loops (100.82.34.38, # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the # RPC credentials and the flags below are the authoritative config, # so the datadir file is legacy debris; say so out loud rather than # failing, and let bitcoind start. if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -567,7 +567,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; # A stray bitcoin.conf in the datadir is FATAL when -conf points # elsewhere: bitcoind refuses to start with \"contains a bitcoin.conf # file which is ignored\", and the app crash-loops (100.82.34.38, # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the # RPC credentials and the flags below are the authoritative config, # so the datadir file is legacy debris; say so out loud rather than # failing, and let bitcoind start. if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -684,7 +684,7 @@
       ]
     },
     "bitcoin-ui": {
-      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.119-alpha",
+      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.123-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -740,7 +740,7 @@
           ]
         }
       },
-      "version": "1.7.119-alpha"
+      "version": "1.7.123-alpha"
     },
     "botfights": {
       "manifest": {
@@ -1146,7 +1146,7 @@
       "version": "1.0.0"
     },
     "electrs-ui": {
-      "image": "146.59.87.168:3000/lfg2025/electrs-ui:latest",
+      "image": "146.59.87.168:3000/lfg2025/electrs-ui:1.7.123-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -1189,7 +1189,7 @@
           "volumes": []
         }
       },
-      "version": "latest"
+      "version": "1.7.123-alpha"
     },
     "electrumx": {
       "image": "146.59.87.168:3000/lfg2025/electrumx:v1.18.0",
@@ -3094,7 +3094,7 @@
       "version": "v0.18.4-beta"
     },
     "lnd-ui": {
-      "image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.119-alpha",
+      "image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.123-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -3141,7 +3141,7 @@
           "volumes": []
         }
       },
-      "version": "1.7.119-alpha"
+      "version": "1.7.123-alpha"
     },
     "mempool": {
       "image": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
@@ -4382,13 +4382,13 @@
       "version": "3.4.2"
     },
     "portainer": {
-      "image": "146.59.87.168:3000/lfg2025/portainer:2.19.4",
+      "image": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
       "manifest": {
         "app": {
           "category": "development",
           "container": {
             "data_uid": "1000:1000",
-            "image": "146.59.87.168:3000/lfg2025/portainer:2.19.4",
+            "image": "146.59.87.168:3000/lfg2025/portainer:2.39.1",
             "pull_policy": "if-not-present"
           },
           "dependencies": [
@@ -4475,7 +4475,7 @@
           ]
         }
       },
-      "version": "2.19.4"
+      "version": "2.39.1"
     },
     "router": {
       "manifest": {
@@ -4898,7 +4898,5 @@
     }
   },
   "schema": 1,
-  "signature": "cc19214673b37c2d7d41edf996d5002abe41cf933ee9f33fb7182b05c6c40aa1a555ad596228c4a83dc4a11166f3345e7478399f9693f5f2da3818020980eb03",
-  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }

From 4f8c76c67edfa17719cd62661c7bb172128867be Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 15:30:13 -0400
Subject: [PATCH 34/60] style: rustfmt the regenerated app_ports list

generate-app-catalog.py writes APP_LAUNCH_PORTS one entry per line; rustfmt
packs it. The release gate checks formatting, so the generated file has to
be formatted after regeneration or every catalog sync fails the gate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/fips/app_ports.rs | 39 ++------------------------
 1 file changed, 3 insertions(+), 36 deletions(-)

diff --git a/core/archipelago/src/fips/app_ports.rs b/core/archipelago/src/fips/app_ports.rs
index 1ad284cb..6c483d74 100644
--- a/core/archipelago/src/fips/app_ports.rs
+++ b/core/archipelago/src/fips/app_ports.rs
@@ -6,40 +6,7 @@
 //! no listener, so allowing them is inert.
 
 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283,
-    2342,
-    3000,
-    3001,
-    3002,
-    4080,
-    5180,
-    7778,
-    8080,
-    8081,
-    8082,
-    8083,
-    8084,
-    8085,
-    8087,
-    8088,
-    8089,
-    8090,
-    8096,
-    8123,
-    8175,
-    8176,
-    8240,
-    8334,
-    8336,
-    8888,
-    8999,
-    9000,
-    9100,
-    10380,
-    11434,
-    18081,
-    18083,
-    23000,
-    32838,
-    50002,
+    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088,
+    8089, 8090, 8096, 8123, 8175, 8176, 8240, 8334, 8336, 8888, 8999, 9000, 9100, 10380, 11434,
+    18081, 18083, 23000, 32838, 50002,
 ];

From c9f1d87dd6d2f474ec6a047cc6793a084b30885a Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 16:42:57 -0400
Subject: [PATCH 35/60] chore: release v1.7.124-alpha

---
 release-manifest.json     | 42 +++++++++++++++++++-----------------
 releases/app-catalog.json |  2 ++
 releases/manifest.json    | 45 ++++++++++++++++++++-------------------
 3 files changed, 47 insertions(+), 42 deletions(-)

diff --git a/release-manifest.json b/release-manifest.json
index edf4a6eb..baf997ce 100644
--- a/release-manifest.json
+++ b/release-manifest.json
@@ -1,33 +1,35 @@
 {
   "changelog": [
-    "**Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.",
-    "**What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.",
-    "All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.",
-    "**Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.",
-    "Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.",
-    "Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.",
-    "Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release."
+    "**The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing \"server starting\" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.",
+    "**Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.",
+    "**Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.",
+    "**Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.",
+    "**The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.",
+    "**The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.",
+    "**You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.",
+    "Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.",
+    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.123-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago",
+      "current_version": "1.7.124-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.123-alpha",
-      "sha256": "b7974a671f8f7987fab548d0a9cac1ad145e9a52f4099791c3d1879d065a9f47",
-      "size_bytes": 54957360
+      "new_version": "1.7.124-alpha",
+      "sha256": "bc91e7d09083dad17934dc2bad211b4eb1d22fd799e032a94fa73df025ba272d",
+      "size_bytes": 54701560
     },
     {
-      "current_version": "1.7.123-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.123-alpha/archipelago-frontend-1.7.123-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.123-alpha.tar.gz",
-      "new_version": "1.7.123-alpha",
-      "sha256": "075370c761f07373e553db07eb5e019d96ceb591fa9c1067e1adc6701fa30752",
-      "size_bytes": 210533854
+      "current_version": "1.7.124-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago-frontend-1.7.124-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.124-alpha.tar.gz",
+      "new_version": "1.7.124-alpha",
+      "sha256": "346ed6472fb647bcf45299e4d93b9f555142bf1229912030fbafe9966fd410a7",
+      "size_bytes": 210531432
     }
   ],
   "release_date": "2026-08-05",
-  "signature": "f64eaf9731277865c0d3f757f63dc2f4921fb7d90deb1615ca2b2b0f4c173282524b39a2d0b8f027c7532e918c349a86b14ed1b7992a96b0c6a80cd46b5d500d",
+  "signature": "40f5ffca026addd00c4aac933edf8faa05a60d9b981341bc0bfaae078812a65ad6656886b4a9d533476759dbb511fb4b050e518cd0060568f7b33035069e600e",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.7.123-alpha"
+  "version": "1.7.124-alpha"
 }
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 9cb615b4..d456fdf3 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -4898,5 +4898,7 @@
     }
   },
   "schema": 1,
+  "signature": "b10aa65a9a6e91a6d421deff6e578c080c6bafa0185d54412df72b9814a694e9c9ccd803f7e8baa6d0ae93c1b71b3e20ed1626769445cc2f484c4a8bbd1b9901",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }
diff --git a/releases/manifest.json b/releases/manifest.json
index 22dd4ab6..baf997ce 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,34 +1,35 @@
 {
   "changelog": [
-    "**Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.",
-    "**The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.",
-    "**A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.",
-    "**Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.",
-    "Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.",
-    "The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.",
-    "**The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.",
-    "Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+    "**The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing \"server starting\" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.",
+    "**Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.",
+    "**Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.",
+    "**Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.",
+    "**The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.",
+    "**The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.",
+    "**You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.",
+    "Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.",
+    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago",
+      "current_version": "1.7.124-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.122-alpha",
-      "sha256": "06aedbd235e962574b7abc5d6992c26b77cd943655e775cd93c84fdcc79ffab0",
-      "size_bytes": 54957496
+      "new_version": "1.7.124-alpha",
+      "sha256": "bc91e7d09083dad17934dc2bad211b4eb1d22fd799e032a94fa73df025ba272d",
+      "size_bytes": 54701560
     },
     {
-      "current_version": "1.7.122-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.122-alpha/archipelago-frontend-1.7.122-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.122-alpha.tar.gz",
-      "new_version": "1.7.122-alpha",
-      "sha256": "865f5a0edb5eed1ced9dc4597b9112f24706d3538f8ffe84dea8104049d26af3",
-      "size_bytes": 210528707
+      "current_version": "1.7.124-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago-frontend-1.7.124-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.124-alpha.tar.gz",
+      "new_version": "1.7.124-alpha",
+      "sha256": "346ed6472fb647bcf45299e4d93b9f555142bf1229912030fbafe9966fd410a7",
+      "size_bytes": 210531432
     }
   ],
   "release_date": "2026-08-05",
-  "signature": "aca66567bf5954aefd450167f881289ee4715fd912fe61a50726741cadf1a93d39e832efc3266388839279ad41001c9802fdfaf766c8cfa9399509916ed4a80f",
-  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.122-alpha"
+  "signature": "40f5ffca026addd00c4aac933edf8faa05a60d9b981341bc0bfaae078812a65ad6656886b4a9d533476759dbb511fb4b050e518cd0060568f7b33035069e600e",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
+  "version": "1.7.124-alpha"
 }

From e88c51d80b939978977f158f15131adc44c7a2a1 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 18:45:02 -0400
Subject: [PATCH 36/60] fix(bitcoin): repair the startup script I broke in
 1.7.124, and gate against it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bitcoin app vanished from updated nodes: the container exited instantly
with 'sh: Syntax error: "fi" unexpected'. My 1.7.124 change added an
explanatory comment INSIDE the manifest's folded YAML scalar (>-), where
'#' is not a comment — it is literal text that reaches the shell. Folding
joins lines with spaces, so the comment swallowed the 'if ... then' while
the more-indented echo survived as its own line, leaving an orphan 'fi'.
bitcoind never ran, the container exited, and the app disappeared from the
UI because detection is container-based.

Explanations now live above the '- >-' line where YAML really treats them
as comments. The loopback-conf tolerance (-allowignoredconf=1) is unchanged
and still needed.

Adds scripts/check-manifest-shell.py to the release gate: it runs 'sh -n'
over every embedded manifest script and rejects '#' inside these scalars.
Nothing validated this shell before — no YAML parse or Rust test could have
caught it, and it only failed on the node, after signing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/bitcoin-core/manifest.yml  |  9 +---
 apps/bitcoin-knots/manifest.yml |  9 +---
 scripts/check-manifest-shell.py | 86 +++++++++++++++++++++++++++++++++
 tests/release/run.sh            |  1 +
 4 files changed, 89 insertions(+), 16 deletions(-)
 create mode 100755 scripts/check-manifest-shell.py

diff --git a/apps/bitcoin-core/manifest.yml b/apps/bitcoin-core/manifest.yml
index c8619f7e..5e9db91a 100644
--- a/apps/bitcoin-core/manifest.yml
+++ b/apps/bitcoin-core/manifest.yml
@@ -38,15 +38,8 @@ app:
         RPC_CONF="/tmp/rpc.conf";
         umask 077;
         { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
-        # A stray bitcoin.conf in the datadir is FATAL when -conf points
-        # elsewhere: bitcoind refuses to start with "contains a bitcoin.conf
-        # file which is ignored", and the app crash-loops (100.82.34.38,
-        # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the
-        # RPC credentials and the flags below are the authoritative config,
-        # so the datadir file is legacy debris; say so out loud rather than
-        # failing, and let bitcoind start.
         if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
-          echo "archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below" >&2;
+          echo "archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF" >&2;
         fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
diff --git a/apps/bitcoin-knots/manifest.yml b/apps/bitcoin-knots/manifest.yml
index cdc492c5..f74c6052 100644
--- a/apps/bitcoin-knots/manifest.yml
+++ b/apps/bitcoin-knots/manifest.yml
@@ -38,15 +38,8 @@ app:
         RPC_CONF="/tmp/rpc.conf";
         umask 077;
         { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
-        # A stray bitcoin.conf in the datadir is FATAL when -conf points
-        # elsewhere: bitcoind refuses to start with "contains a bitcoin.conf
-        # file which is ignored", and the app crash-loops (100.82.34.38,
-        # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the
-        # RPC credentials and the flags below are the authoritative config,
-        # so the datadir file is legacy debris; say so out loud rather than
-        # failing, and let bitcoind start.
         if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
-          echo "archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below" >&2;
+          echo "archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF" >&2;
         fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
diff --git a/scripts/check-manifest-shell.py b/scripts/check-manifest-shell.py
new file mode 100755
index 00000000..67414a68
--- /dev/null
+++ b/scripts/check-manifest-shell.py
@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Syntax-check the shell embedded in apps/*/manifest.yml.
+
+A manifest can carry a whole startup script in `container.custom_args` /
+`entrypoint`. Nothing validated it, so a broken one shipped through the
+signed catalog and only failed on the node — as a container that exits
+instantly and an app that vanishes from the UI.
+
+Two checks, both learned from v1.7.124 (bitcoin-knots / bitcoin-core):
+
+1. `sh -n` the snippet. The break was `sh: Syntax error: "fi" unexpected`,
+   which no YAML parse and no Rust test could have caught.
+
+2. Reject `#` inside the snippet. These are YAML **folded** scalars (`>-`),
+   where `#` is NOT a comment — it is literal text that reaches the shell,
+   and because folding joins lines with spaces it comments out the rest of
+   the folded line. That is exactly how an `if ... then` was swallowed while
+   its more-indented body survived, leaving an orphan `fi`. Put explanations
+   above the `- >-` line, where YAML really does treat them as comments.
+"""
+
+from __future__ import annotations
+
+import glob
+import os
+import subprocess
+import sys
+import tempfile
+
+import yaml
+
+# Long enough to be a script rather than a flag.
+MIN_SCRIPT_LEN = 60
+
+
+def snippets(path: str):
+    with open(path, encoding="utf-8") as fh:
+        data = yaml.safe_load(fh)
+    container = ((data or {}).get("app") or {}).get("container") or {}
+    for key in ("custom_args", "entrypoint"):
+        value = container.get(key)
+        if not isinstance(value, list):
+            continue
+        for i, part in enumerate(value):
+            if isinstance(part, str) and len(part) >= MIN_SCRIPT_LEN:
+                yield f"{key}[{i}]", part
+
+
+def main() -> int:
+    failures = []
+    checked = 0
+    for path in sorted(glob.glob("apps/*/manifest.yml")):
+        app = os.path.basename(os.path.dirname(path))
+        try:
+            found = list(snippets(path))
+        except Exception as exc:  # noqa: BLE001 — report, don't crash the gate
+            failures.append(f"{app}: manifest does not parse: {exc}")
+            continue
+        for where, script in found:
+            checked += 1
+            if "#" in script:
+                failures.append(
+                    f"{app} {where}: contains '#'. In a folded YAML scalar that is not a "
+                    f"comment — it reaches the shell and comments out the rest of the "
+                    f"folded line. Move the explanation above the '- >-' line."
+                )
+            with tempfile.NamedTemporaryFile("w", suffix=".sh", delete=False) as tmp:
+                tmp.write(script)
+                tmp_path = tmp.name
+            try:
+                proc = subprocess.run(
+                    ["sh", "-n", tmp_path], capture_output=True, text=True, check=False
+                )
+            finally:
+                os.unlink(tmp_path)
+            if proc.returncode != 0:
+                failures.append(f"{app} {where}: {proc.stderr.strip()}")
+
+    for f in failures:
+        print(f"MANIFEST-SHELL {f}", file=sys.stderr)
+    print(f'{{"snippets_checked": {checked}, "failures": {len(failures)}}}')
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/release/run.sh b/tests/release/run.sh
index 5c577d33..6d047a00 100755
--- a/tests/release/run.sh
+++ b/tests/release/run.sh
@@ -62,6 +62,7 @@ summary() {
 # ── Stage 1: static ──────────────────────────────────────────────────
 stage "git-diff-check"   git diff --check
 stage "cargo-fmt"        timeout 240 cargo fmt --manifest-path core/Cargo.toml --all --check
+stage "manifest-shell"  python3 scripts/check-manifest-shell.py
 stage "catalog-drift"    python3 scripts/check-app-catalog-drift.py --release --strict
 # Every release must surface its CHANGELOG entry in the Settings "What's New"
 # modal. The modal hardcodes a block per version and has drifted behind before

From 188411b79cf5a915df7276363b73ee568592eb8c Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 18:54:37 -0400
Subject: [PATCH 37/60] chore(catalog): sign catalog with the repaired bitcoin
 start script

Unbreaks Bitcoin on every node running the 1.7.124 catalog: the embedded
start script had a shell syntax error, so bitcoind never launched and the
app vanished. Delivered by catalog rather than a release because manifests
reach nodes through the signed catalog.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/appgate/mod.rs | 27 +++++++++++++++++++++------
 releases/app-catalog.json           |  6 +++---
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index 9dc4090b..1bb36143 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -548,7 +548,7 @@ const LOGIN_BACKGROUNDS: [&str; 4] = [
 /// join: the name arrives in a URL, and the gate answers before any
 /// authentication, so nothing here may be caller-controlled beyond this set.
 fn read_ui_asset(name: &str) -> Option<(Vec<u8>, &'static str)> {
-    let allowed = LOGIN_BACKGROUNDS.contains(&name) || name == "logo-archipelago.svg";
+    let allowed = LOGIN_BACKGROUNDS.contains(&name) || name == "favico-black-v2.svg";
     if !allowed {
         return None;
     }
@@ -557,6 +557,9 @@ fn read_ui_asset(name: &str) -> Option<(Vec<u8>, &'static str)> {
         "/opt/archipelago/web-ui/assets/img",
         "web/dist/neode-ui/assets/img",
         "neode-ui/public/assets/img",
+        "/opt/archipelago/web-ui/assets/icon",
+        "web/dist/neode-ui/assets/icon",
+        "neode-ui/public/assets/icon",
     ] {
         if let Ok(bytes) = std::fs::read(std::path::Path::new(root).join(name)) {
             return Some((bytes, mime));
@@ -631,9 +634,21 @@ fn page(title: &str, app: &GatedPort, body: &str, status: StatusCode) -> Respons
    bundle exists, and the CSP forbids external stylesheets and script. */
 :root {{ color-scheme: dark; }}
 * {{ box-sizing: border-box; }}
-body {{ margin:0; min-height:100vh; display:grid; place-items:center; padding:1rem;
-  background:#05070a; color:#fff; overflow:hidden;
-  font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif; }}
+html {{ height:100%; }}
+body {{ margin:0; color:#fff; background:#05070a; overflow:hidden;
+  font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif;
+  /* Fixed to the viewport rather than a tall scrolling page: an on-screen
+     keyboard then overlays the card instead of scrolling it away, and the
+     card stays optically centred. min-height:100vh scrolled with the
+     keyboard on mobile and left the card off-centre (reported 2026-08-05). */
+  position:fixed; inset:0;
+  display:grid; place-items:center; padding:1rem;
+  height:100vh; height:100svh; }}
+/* Very short viewports (landscape phone, or a keyboard eating most of it):
+   allow the card to scroll INSIDE the fixed frame rather than overflow. */
+@media (max-height:640px) {{
+  body {{ align-items:start; overflow-y:auto; padding-top:3rem; }}
+}}
 /* Rotating backgrounds: each layer holds its image and cross-fades on a
    shared cycle, so the art moves the way /login does with no script. */
 .bg {{ position:fixed; inset:0; z-index:0; background-size:cover;
@@ -726,7 +741,7 @@ button:active {{ transform:translateY(1px); }}
 /// password by an unexplained page.
 fn login_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Response<Body> {
     let body = format!(
-        r#"<div class="logo"><img src="{prefix}asset/logo-archipelago.svg" alt="Archipelago"></div>
+        r#"<div class="logo"><img src="{prefix}asset/favico-black-v2.svg" alt="Archipelago"></div>
 {icon}
 <h1>Sign in to open {name}</h1>
 <p class="sub">This app is protected by your node password.</p>
@@ -863,7 +878,7 @@ mod tests {
         let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
         let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
         let html = String::from_utf8_lossy(&body).to_string();
-        assert!(html.contains(&format!("{GATE_PREFIX}asset/logo-archipelago.svg")));
+        assert!(html.contains(&format!("{GATE_PREFIX}asset/favico-black-v2.svg")));
         for name in LOGIN_BACKGROUNDS {
             assert!(
                 html.contains(&format!("{GATE_PREFIX}asset/{name}")),
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index d456fdf3..fce24d79 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -421,7 +421,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; # A stray bitcoin.conf in the datadir is FATAL when -conf points # elsewhere: bitcoind refuses to start with \"contains a bitcoin.conf # file which is ignored\", and the app crash-loops (100.82.34.38, # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the # RPC credentials and the flags below are the authoritative config, # so the datadir file is legacy debris; say so out loud rather than # failing, and let bitcoind start. if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -567,7 +567,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; # A stray bitcoin.conf in the datadir is FATAL when -conf points # elsewhere: bitcoind refuses to start with \"contains a bitcoin.conf # file which is ignored\", and the app crash-loops (100.82.34.38, # 2026-08-05 — Exited(1) every few seconds). Our -conf carries the # RPC credentials and the flags below are the authoritative config, # so the datadir file is legacy debris; say so out loud rather than # failing, and let bitcoind start. if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy /home/bitcoin/.bitcoin/bitcoin.conf; RPC config comes from $RPC_CONF and the flags below\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -4898,7 +4898,7 @@
     }
   },
   "schema": 1,
-  "signature": "b10aa65a9a6e91a6d421deff6e578c080c6bafa0185d54412df72b9814a694e9c9ccd803f7e8baa6d0ae93c1b71b3e20ed1626769445cc2f484c4a8bbd1b9901",
+  "signature": "4c3cb577e6fe3884f4ad918ce3f14a3011ea0e175ab23ea1521a1d04a4f139f53eb86b0617b1183f2e8bbac2b046fe4965ae9f2878ba2cf08bac8262d68d140e",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }

From e7592dc9c944ca1aa617f0e3df7b8c6e85128c17 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 19:12:36 -0400
Subject: [PATCH 38/60] =?UTF-8?q?fix(fedimint):=20stop=20declaring=208175?=
 =?UTF-8?q?=20=E2=80=94=20it=20belongs=20to=20the=20UI=20companion,=20not?=
 =?UTF-8?q?=20fedimintd?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Declaring the Guardian UI port on the fedimint app made the orchestrator try
to publish 8175 from fedimintd, colliding with archy-fedimint-ui which
already holds it: start_container failed on every reconcile and fedimint
crash-looped (100.82.34.38). The companion's nginx pinned to 127.0.0.1 is
what actually closes that port; the gate reports it rather than fronting it.

Also: app-login page uses the sidebar's 'A' mark instead of the full
wordmark, is pinned to the small viewport so it stays centred and the
keyboard overlays rather than scrolls it, and the install-version modal
icon uses object-contain so a non-square icon is no longer cropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/fedimint/manifest.yml                      | 17 +++++++----------
 neode-ui/src/components/InstallVersionModal.vue |  6 +++++-
 releases/app-catalog.json                       |  9 ---------
 3 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/apps/fedimint/manifest.yml b/apps/fedimint/manifest.yml
index e93fcf0e..f69a7ddc 100644
--- a/apps/fedimint/manifest.yml
+++ b/apps/fedimint/manifest.yml
@@ -63,16 +63,13 @@ app:
         federation itself and cannot hold a browser session.
     # Public launch port 8175 is owned by archy-fedimint-ui, which serves a
     # wait page while Bitcoin syncs and proxies here after fedimintd starts.
-    # Declared HERE because that companion has no manifest of its own, and the
-    # gate keys on the port rather than the container: without this entry it
-    # served the Guardian UI unauthenticated on every interface and never
-    # appeared in the audit. Its nginx is pinned to 127.0.0.1
-    # (docker/fedimint-ui/nginx.conf) so the gate can own the outside.
-    - host: 8175
-      container: 8175
-      protocol: tcp
-      bind: 127.0.0.1
-      auth: gated
+    # 8175 is NOT declared here. It is served by the archy-fedimint-ui
+    # companion, a different container, and declaring it on this app made the
+    # orchestrator try to publish 8175 from fedimintd — colliding with the
+    # companion that already holds it, so start_container failed forever and
+    # fedimint crash-looped (100.82.34.38, 2026-08-05). The companion's nginx
+    # is pinned to 127.0.0.1, which is what actually closes that port; the
+    # gate reports it rather than fronting it.
     - host: 8177
       container: 8175
       protocol: tcp
diff --git a/neode-ui/src/components/InstallVersionModal.vue b/neode-ui/src/components/InstallVersionModal.vue
index 9754b190..99b6a9e9 100644
--- a/neode-ui/src/components/InstallVersionModal.vue
+++ b/neode-ui/src/components/InstallVersionModal.vue
@@ -2,11 +2,15 @@
   <BaseModal :show="show" title="" max-width="max-w-lg" @close="emit('close')">
     <!-- Header: app icon + "Install Bitcoin Knots/Core" -->
     <div class="flex items-center gap-4 mb-5 -mt-2">
+      <!-- object-contain, not the default fill: app icons are not all square
+           (bitcoin-knots is not), so a fixed 56x56 box distorted or cropped the
+           mark against the rounded corners. Contain plus a dark plate shows the
+           whole icon whatever its aspect ratio. -->
       <img
         v-if="app?.icon"
         :src="app.icon"
         :alt="app?.title || ''"
-        class="w-14 h-14 rounded-xl shadow-lg shrink-0"
+        class="w-14 h-14 rounded-xl shadow-lg shrink-0 object-contain bg-black/40 p-1"
       />
       <div v-else class="w-14 h-14 rounded-xl bg-white/10 flex items-center justify-center shrink-0">
         <svg class="w-7 h-7 text-white/40" fill="none" stroke="currentColor" viewBox="0 0 24 24">
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index fce24d79..032664a5 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -1386,13 +1386,6 @@
               "host": 8174,
               "protocol": "tcp"
             },
-            {
-              "auth": "gated",
-              "bind": "127.0.0.1",
-              "container": 8175,
-              "host": 8175,
-              "protocol": "tcp"
-            },
             {
               "auth": "local",
               "bind": "127.0.0.1",
@@ -4898,7 +4891,5 @@
     }
   },
   "schema": 1,
-  "signature": "4c3cb577e6fe3884f4ad918ce3f14a3011ea0e175ab23ea1521a1d04a4f139f53eb86b0617b1183f2e8bbac2b046fe4965ae9f2878ba2cf08bac8262d68d140e",
-  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }

From 4ace62fad933e817502e3ff8b81e69482114cdbf Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 19:21:21 -0400
Subject: [PATCH 39/60] chore(catalog): sign catalog with the bitcoin and
 fedimint fixes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 releases/app-catalog.json | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 032664a5..44279454 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -4891,5 +4891,7 @@
     }
   },
   "schema": 1,
+  "signature": "a8502a3664500e6f22e47d2f29456cde208c0cf117767083be8ec6c238f73e546ae33ccea0c100573cfd9a474614da03903d5be6b7cae72bb3c5439d2b510104",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
   "updated": "2026-08-05"
 }

From ada59acdd5424eed90563cf06eefd5a1b52002a3 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 21:21:52 -0400
Subject: [PATCH 40/60] fix(appgate+container): stop stripping app cookies;
 create named volumes correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two daemon bugs, one debugging arc (2026-08-05, operator-reported):

1. The app gate removed the ENTIRE Cookie header before proxying. That
   broke the data plane of every first-party companion UI behind the gate
   (lnd-ui/bitcoin-ui/electrs-ui/fips-ui render their shell, then every
   /proxy/* and /lnd-connect-info call 401s — observed as "LND UI
   unreachable"), and silently logged users out of every gated app with
   its own cookie login (vaultwarden, nextcloud, gitea) on each request.
   The gate now strips only its own cookie pairs (session, csrf_token);
   a new per-port manifest opt-in `session_passthrough: true` forwards
   the node session to first-party UIs whose nginx proxies the daemon's
   authenticated endpoints. Undeclared ports never get passthrough.

2. podman_client::create_container sent named volumes to the libpod API
   as bind mounts with the bare volume name as source, so creating any
   manifest app with a `type: volume` mount failed. On .38 the reconciler
   removed indeedhub-postgres/-minio for env drift and then could never
   create their replacements, leaving the stack half-missing forever.
   Named volumes now ride the spec's `volumes` field ({Name, Dest,
   Options}). Also: the reconcile-failure log now prints the full anyhow
   chain — `%e` showed only "create_container X" and hid the real error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/appgate/identity.rs      |  9 ++
 core/archipelago/src/appgate/mod.rs           | 96 +++++++++++++++++--
 .../src/container/prod_orchestrator.rs        |  6 +-
 core/container/src/manifest.rs                | 14 +++
 core/container/src/podman_client.rs           | 15 +++
 5 files changed, 133 insertions(+), 7 deletions(-)

diff --git a/core/archipelago/src/appgate/identity.rs b/core/archipelago/src/appgate/identity.rs
index f04da17f..8bfc0142 100644
--- a/core/archipelago/src/appgate/identity.rs
+++ b/core/archipelago/src/appgate/identity.rs
@@ -35,6 +35,11 @@ pub struct GatedPort {
     /// Tor-upstream bind — must key on this flag: acting on an undeclared
     /// port is the v1.7.121 incident class, whatever the action.
     pub declared: bool,
+    /// Manifest opt-in (`session_passthrough: true` on the port): forward the
+    /// node session cookie to the app on authorised requests. First-party
+    /// companion UIs proxy that cookie to the daemon's authenticated
+    /// endpoints; for every other app the gate strips its own credential.
+    pub session_passthrough: bool,
 }
 
 /// A port deliberately left unauthenticated, and the manifest's stated reason.
@@ -226,6 +231,7 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         app_name: app_name.clone(),
                         icon: icon.clone(),
                         declared: true,
+                        session_passthrough: port.session_passthrough,
                     },
                 );
             }
@@ -273,6 +279,9 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         app_name: app_name.clone(),
                         icon: icon.clone(),
                         declared: false,
+                        // An undeclared port never gets the node session —
+                        // passthrough is an explicit manifest opt-in only.
+                        session_passthrough: false,
                     },
                 );
             }
diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index 1bb36143..d9f01ca9 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -136,7 +136,7 @@ impl AppGate {
         }
 
         match self.authorize(req.headers(), &app.app_id).await {
-            Authorization::Allow => proxy_to_app(req, app.port).await,
+            Authorization::Allow => proxy_to_app(req, app).await,
             // 401 rather than a redirect: a redirect to a login page is
             // indistinguishable from the app itself redirecting, and machine
             // clients would follow it and parse HTML as if it were their API
@@ -375,7 +375,8 @@ fn percent_decode(input: &str) -> String {
 }
 
 /// Forward an authorised request to the app on loopback.
-async fn proxy_to_app(req: Request<Body>, port: u16) -> Response<Body> {
+async fn proxy_to_app(req: Request<Body>, app: &GatedPort) -> Response<Body> {
+    let port = app.port;
     let path_and_query = req
         .uri()
         .path_and_query()
@@ -389,10 +390,16 @@ async fn proxy_to_app(req: Request<Body>, port: u16) -> Response<Body> {
 
     let (mut parts, body) = req.into_parts();
     parts.uri = uri;
-    // Strip the gate's own credential before it reaches the app: the app has
-    // no use for the node session and should never be in a position to log,
-    // echo, or forward it.
-    parts.headers.remove(header::COOKIE);
+    // Strip the gate's own credential before it reaches the app — the app
+    // should never be in a position to log, echo, or forward the node
+    // session. But ONLY the gate's cookies: apps run their own cookie logins
+    // (vaultwarden, nextcloud, gitea…), and removing the whole header logged
+    // every one of them out on each request. Companion UIs that proxy the
+    // daemon's authenticated endpoints opt in to keeping the session via
+    // `session_passthrough: true` on their gated port.
+    if !app.session_passthrough {
+        strip_gate_cookies(&mut parts.headers);
+    }
     parts.headers.remove(header::AUTHORIZATION);
 
     let client = hyper::Client::new();
@@ -402,6 +409,44 @@ async fn proxy_to_app(req: Request<Body>, port: u16) -> Response<Body> {
     }
 }
 
+/// Cookie names owned by the gate/daemon, never the app's to see.
+const GATE_COOKIE_NAMES: &[&str] = &["session", "csrf_token"];
+
+/// Remove the gate's own cookie pairs from the Cookie header, preserving the
+/// app's cookies (its login/session/prefs) untouched. Drops the header
+/// entirely when nothing remains.
+fn strip_gate_cookies(headers: &mut hyper::HeaderMap) {
+    let Some(cookie) = headers.get(header::COOKIE) else {
+        return;
+    };
+    let Ok(raw) = cookie.to_str() else {
+        // Not valid UTF-8 — can't safely filter pairs, so fail closed.
+        headers.remove(header::COOKIE);
+        return;
+    };
+    let kept: Vec<&str> = raw
+        .split(';')
+        .map(str::trim)
+        .filter(|pair| {
+            let name = pair.split('=').next().unwrap_or("").trim();
+            !GATE_COOKIE_NAMES.contains(&name)
+        })
+        .filter(|pair| !pair.is_empty())
+        .collect();
+    if kept.is_empty() {
+        headers.remove(header::COOKIE);
+        return;
+    }
+    match header::HeaderValue::from_str(&kept.join("; ")) {
+        Ok(v) => {
+            headers.insert(header::COOKIE, v);
+        }
+        Err(_) => {
+            headers.remove(header::COOKIE);
+        }
+    }
+}
+
 fn set_session_cookie(resp: &mut Response<Body>, token: &str) {
     // No Domain attribute, so the cookie is host-only. Cookies ignore port,
     // which is what makes one sign-in cover the dashboard and every app port
@@ -793,6 +838,7 @@ mod tests {
             app_name: "Strfry Relay".to_string(),
             icon: None,
             declared: true,
+            session_passthrough: false,
         }
     }
 
@@ -946,6 +992,44 @@ mod tests {
         );
     }
 
+    /// The gate must remove ONLY its own cookie pairs: an app's login cookie
+    /// riding the same header has to survive, or every gated app with its
+    /// own auth (vaultwarden, nextcloud, gitea) is logged out on each
+    /// request — the 2026-08-05 companion-UI/"app logged me out" regression.
+    #[test]
+    fn strip_gate_cookies_keeps_app_cookies() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            "session=abc; vw_session=keepme; csrf_token=def; theme=dark"
+                .parse()
+                .unwrap(),
+        );
+        strip_gate_cookies(&mut headers);
+        assert_eq!(
+            headers.get(header::COOKIE).unwrap().to_str().unwrap(),
+            "vw_session=keepme; theme=dark"
+        );
+    }
+
+    #[test]
+    fn strip_gate_cookies_drops_header_when_only_gate_cookies() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            "session=abc; csrf_token=def".parse().unwrap(),
+        );
+        strip_gate_cookies(&mut headers);
+        assert!(headers.get(header::COOKIE).is_none());
+    }
+
+    #[test]
+    fn strip_gate_cookies_no_header_is_a_noop() {
+        let mut headers = HeaderMap::new();
+        strip_gate_cookies(&mut headers);
+        assert!(headers.get(header::COOKIE).is_none());
+    }
+
     /// The load-bearing 2FA property: a session still awaiting its TOTP code
     /// fails `validate()`, so the gate rejects it without knowing anything
     /// about second factors.
diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index a68c605a..2eb4dc12 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -1754,7 +1754,10 @@ impl ProdContainerOrchestrator {
                 }
                 Ok(action) => report.record(&app_id, action),
                 Err(e) => {
-                    tracing::error!(app_id = %app_id, error = %e, "reconcile failed");
+                    // `{:#}` prints the whole anyhow chain — `%e` alone showed
+                    // only the outer context ("create_container X") and hid
+                    // the actual libpod error for days.
+                    tracing::error!(app_id = %app_id, error = %format!("{e:#}"), "reconcile failed");
                     report.failures.push((app_id, e.to_string()));
                 }
             }
@@ -4440,6 +4443,7 @@ mod tests {
             bind: String::new(),
             auth: None,
             auth_rationale: None,
+            session_passthrough: false,
         }
     }
 
diff --git a/core/container/src/manifest.rs b/core/container/src/manifest.rs
index ddfc1832..09c3f731 100644
--- a/core/container/src/manifest.rs
+++ b/core/container/src/manifest.rs
@@ -599,6 +599,19 @@ pub struct PortMapping {
     /// means the author expected an exemption they did not get.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub auth_rationale: Option<String>,
+    /// Forward the node session cookie to the app on authorised requests.
+    ///
+    /// The gate normally strips its own credential before proxying — an app
+    /// must never be in a position to log or replay the node session. The
+    /// first-party companion UIs (lnd-ui, bitcoin-ui, electrs-ui, fips-ui)
+    /// are the exception their design requires: their nginx forwards the
+    /// browser's session cookie to the daemon's authenticated endpoints
+    /// (`/proxy/lnd/*`, `/rpc/v1`, `/lnd-connect-info`), so stripping it
+    /// breaks every data call behind the gate with a 401 while the page
+    /// shell still renders (observed as "LND UI unreachable", 2026-08-05).
+    /// Only meaningful on a `auth: gated` port.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub session_passthrough: bool,
 }
 
 impl PortMapping {
@@ -626,6 +639,7 @@ impl From<(u16, u16)> for PortMapping {
             bind: String::new(),
             auth: None,
             auth_rationale: None,
+            session_passthrough: false,
         }
     }
 }
diff --git a/core/container/src/podman_client.rs b/core/container/src/podman_client.rs
index d12eac92..5726c9c7 100644
--- a/core/container/src/podman_client.rs
+++ b/core/container/src/podman_client.rs
@@ -366,6 +366,7 @@ impl PodmanClient {
         }
 
         let mut mounts = Vec::new();
+        let mut named_volumes = Vec::new();
         for volume in &manifest.app.volumes {
             if volume.volume_type == "tmpfs" {
                 let options: Vec<String> = volume
@@ -382,6 +383,19 @@ impl PodmanClient {
                     "type": "tmpfs",
                     "options": options,
                 }));
+            } else if volume.volume_type == "volume" {
+                // Named podman volume. The libpod create spec carries these in
+                // the separate `volumes` field ({Name, Dest, Options}), NOT in
+                // `mounts`: sending one as a bind mount makes the API treat
+                // the bare volume name as a host path and the create fails —
+                // which left indeedhub-postgres/-minio permanently absent on
+                // legacy-path nodes (the reconciler removed the old container
+                // for drift, then could never create its replacement).
+                named_volumes.push(serde_json::json!({
+                    "Name": volume.source,
+                    "Dest": volume.target,
+                    "Options": volume.options,
+                }));
             } else {
                 mounts.push(serde_json::json!({
                     "destination": volume.target,
@@ -464,6 +478,7 @@ impl PodmanClient {
             "image": image_ref,
             "portmappings": port_mappings,
             "mounts": mounts,
+            "volumes": named_volumes,
             "env": env_map,
             "secret_env": secret_env_map,
             "labels": labels_map,

From d0d9c032decc29359a43cce791b8e6cfe1401057 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 21:22:07 -0400
Subject: [PATCH 41/60] fix(apps): session_passthrough on companion UI ports;
 indeedhub-redis caps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- lnd-ui/bitcoin-ui/electrs-ui/fips-ui declare session_passthrough: true
  on their gated ports — their nginx forwards the browser's node session
  to the daemon's authenticated endpoints, which the gate's cookie strip
  was discarding (every data call 401'd behind the gate).
- indeedhub-redis gains CHOWN + DAC_OVERRIDE: the alpine entrypoint runs
  as capability-stripped container-root and could not traverse the 0700
  appendonlydir owned by the redis uid — crash-looped ~4k restarts on
  archi-dev-box under the quadlet migration.

These reach nodes via the signed catalog re-sign (manifest overlay).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/bitcoin-ui/manifest.yml      | 4 ++++
 apps/electrs-ui/manifest.yml      | 4 ++++
 apps/fips-ui/manifest.yml         | 4 ++++
 apps/indeedhub-redis/manifest.yml | 8 +++++++-
 apps/lnd-ui/manifest.yml          | 4 ++++
 5 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/apps/bitcoin-ui/manifest.yml b/apps/bitcoin-ui/manifest.yml
index 6fb05656..fc96095b 100644
--- a/apps/bitcoin-ui/manifest.yml
+++ b/apps/bitcoin-ui/manifest.yml
@@ -43,6 +43,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes:
     # Bind-mount the rendered nginx.conf read-only. The prod orchestrator
diff --git a/apps/electrs-ui/manifest.yml b/apps/electrs-ui/manifest.yml
index 4f224565..d1bff168 100644
--- a/apps/electrs-ui/manifest.yml
+++ b/apps/electrs-ui/manifest.yml
@@ -35,6 +35,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 
diff --git a/apps/fips-ui/manifest.yml b/apps/fips-ui/manifest.yml
index e16c49f9..c4c8474a 100644
--- a/apps/fips-ui/manifest.yml
+++ b/apps/fips-ui/manifest.yml
@@ -39,6 +39,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 
diff --git a/apps/indeedhub-redis/manifest.yml b/apps/indeedhub-redis/manifest.yml
index c9997b0a..a2b84c29 100644
--- a/apps/indeedhub-redis/manifest.yml
+++ b/apps/indeedhub-redis/manifest.yml
@@ -22,7 +22,13 @@ app:
     memory_limit: 256Mi
 
   security:
-    capabilities: [SETGID, SETUID]
+    # The alpine entrypoint runs as container-root, `find`s /data to chown
+    # anything not owned by the redis user, then su-execs to it. Under the
+    # orchestrator's --cap-drop=ALL, root cannot traverse the 0700
+    # appendonlydir owned by uid 999 without DAC_OVERRIDE (observed
+    # crash-looping ~4k restarts on archi-dev-box) — CHOWN is what the find's
+    # -exec chown needs on adopted legacy data.
+    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID]
     readonly_root: false
     network_policy: isolated
 
diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml
index cf186bcf..397f1b0b 100644
--- a/apps/lnd-ui/manifest.yml
+++ b/apps/lnd-ui/manifest.yml
@@ -47,6 +47,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

From c9724198403315df966557e2d3c9381a6041f3be Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 21:22:42 -0400
Subject: [PATCH 42/60] fix(wallet): blank send/receive on every open; sweep
 shows amount; camera option stays visible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Operator-reported (2026-08-05):

- Send/Receive modals reset to a blank slate on every open. Stale state —
  destination, amount, memo, and above all an armed "send all funds"
  toggle — silently carried into the next payment.
- Arming "send all funds" now shows the swept balance in the (disabled)
  amount field instead of a confusing 0; disarming or leaving the
  on-chain tab clears it.
- The scan modal no longer hides "Scan with camera" on plain-http desktop
  (browsers only allow getUserMedia on secure origins): the option stays
  visible with a one-line explanation, and choosing it surfaces the HTTPS
  requirement with photo/paste fallbacks. The companion app's native
  scanner path is untouched and still takes priority.
- What's New entry for v1.7.125-alpha.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/components/ReceiveBitcoinModal.vue    | 16 +++++-
 neode-ui/src/components/SendBitcoinModal.vue  | 52 +++++++++++++++++--
 neode-ui/src/components/WalletScanModal.vue   | 10 +++-
 .../src/views/settings/AccountInfoSection.vue | 14 +++++
 4 files changed, 84 insertions(+), 8 deletions(-)

diff --git a/neode-ui/src/components/ReceiveBitcoinModal.vue b/neode-ui/src/components/ReceiveBitcoinModal.vue
index 085133e1..63cc4bcc 100644
--- a/neode-ui/src/components/ReceiveBitcoinModal.vue
+++ b/neode-ui/src/components/ReceiveBitcoinModal.vue
@@ -107,7 +107,21 @@ const props = defineProps<{
 const emit = defineEmits<{ close: []; received: []; scan: [] }>()
 
 watch(() => props.show, (open) => {
-  if (open && props.autoGenerate && receiveMethod.value === 'onchain' && !onchainAddress.value) {
+  if (!open) return
+  // Blank slate on every open: a leftover amount/memo/token or a previous
+  // invoice quietly carrying into a new receive flow is exactly the stale-
+  // state class the operator flagged on the send modal (2026-08-05).
+  receiveMethod.value = 'onchain'
+  invoiceAmount.value = 0
+  invoiceMemo.value = ''
+  invoiceResult.value = ''
+  onchainAddress.value = ''
+  arkAddress.value = ''
+  ecashToken.value = ''
+  ecashResult.value = ''
+  error.value = ''
+  processing.value = false
+  if (props.autoGenerate && receiveMethod.value === 'onchain') {
     void receive()
   }
 })
diff --git a/neode-ui/src/components/SendBitcoinModal.vue b/neode-ui/src/components/SendBitcoinModal.vue
index 52b0720d..e5fb240e 100644
--- a/neode-ui/src/components/SendBitcoinModal.vue
+++ b/neode-ui/src/components/SendBitcoinModal.vue
@@ -327,15 +327,57 @@ const isSweep = computed(() => sendMethod.value === 'onchain' && sendAll.value)
 
 function toggleSendAll() {
   sendAll.value = !sendAll.value
-  if (sendAll.value && onchainBalance.value === null) {
-    rpcClient.call<{ balance_sats: number }>({ method: 'lnd.getinfo', timeout: 5000 })
-      .then((res) => { onchainBalance.value = res.balance_sats || 0 })
-      .catch(() => { /* balance hint is best-effort */ })
+  if (!sendAll.value) {
+    // Disarming clears the field — a swept-balance figure left behind reads
+    // as a typed amount.
+    amount.value = 0
+    return
   }
+  // Arming shows the swept balance IN the (disabled) amount field — a field
+  // stuck at 0 while "send all" is lit read as "sending nothing" (operator
+  // feedback 2026-08-05). Refresh the figure on every arm.
+  const applyBalance = () => {
+    if (sendAll.value && onchainBalance.value !== null) amount.value = onchainBalance.value
+  }
+  applyBalance()
+  rpcClient.call<{ balance_sats: number }>({ method: 'lnd.getinfo', timeout: 5000 })
+    .then((res) => { onchainBalance.value = res.balance_sats || 0; applyBalance() })
+    .catch(() => { /* balance hint is best-effort */ })
 }
 
 // Leaving the on-chain tab disarms the sweep so it can never apply elsewhere
-watch(sendMethod, (m) => { if (m !== 'onchain') sendAll.value = false })
+// (and drops the swept-balance figure it wrote into the amount field).
+watch(sendMethod, (m) => {
+  if (m !== 'onchain' && sendAll.value) {
+    sendAll.value = false
+    amount.value = 0
+  }
+})
+
+// Every open starts from a blank slate. Stale state from the previous send —
+// destination, amount, and above all an armed "send all funds" toggle — is
+// dangerous to inherit invisibly (operator feedback 2026-08-05).
+watch(() => props.show, (shown) => {
+  if (!shown) return
+  sendMethod.value = 'lightning'
+  amountUnit.value = 'sats'
+  amountEntry.value = 0
+  dest.value = ''
+  error.value = ''
+  successInfo.value = null
+  ecashToken.value = ''
+  sendAll.value = false
+  onchainBalance.value = null
+  feePreset.value = 'standard'
+  customConfTarget.value = null
+  customSatPerVbyte.value = null
+  resolvedFeeParams.value = {}
+  feeEstimate.value = null
+  confirming.value = false
+  confirmBalance.value = null
+  invoiceAmountSats.value = null
+  processing.value = false
+})
 
 // --- On-chain network fee: presets map to LND confirmation targets; custom
 // --- takes a block target or an explicit sat/vB rate (rate wins).
diff --git a/neode-ui/src/components/WalletScanModal.vue b/neode-ui/src/components/WalletScanModal.vue
index 2107ec1d..cb41c2e6 100644
--- a/neode-ui/src/components/WalletScanModal.vue
+++ b/neode-ui/src/components/WalletScanModal.vue
@@ -51,10 +51,16 @@
                 </svg>
                 <p class="text-sm text-white/60 text-center">How do you want to read the QR?</p>
                 <!-- hasNativeQr: on the companion (plain http, no getUserMedia)
-                     the native bridge still provides a live camera -->
-                <button v-if="!liveCameraUnavailable || hasNativeQr" @click="chooseCamera" class="glass-button w-full px-4 py-2.5 rounded-lg text-sm font-medium">
+                     the native bridge still provides a live camera. On plain-http
+                     desktop the button stays VISIBLE — hiding it read as "the
+                     scanner is gone" (operator, 2026-08-05); choosing it surfaces
+                     the browser's HTTPS requirement with the fallbacks instead. -->
+                <button @click="chooseCamera" class="glass-button w-full px-4 py-2.5 rounded-lg text-sm font-medium">
                   Scan with camera
                 </button>
+                <p v-if="liveCameraUnavailable && !hasNativeQr" class="text-[11px] text-white/40 text-center -mt-1">
+                  Your browser only allows live camera on HTTPS pages — the photo and paste options below always work.
+                </p>
                 <button @click="photoInput?.click()" class="glass-button w-full px-4 py-2.5 rounded-lg text-sm font-medium">
                   Upload / take a photo of the QR
                 </button>
diff --git a/neode-ui/src/views/settings/AccountInfoSection.vue b/neode-ui/src/views/settings/AccountInfoSection.vue
index e79d46e8..3695cac2 100644
--- a/neode-ui/src/views/settings/AccountInfoSection.vue
+++ b/neode-ui/src/views/settings/AccountInfoSection.vue
@@ -362,6 +362,20 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.125-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.125-alpha</span>
+                  <span class="text-xs text-white/40">August 6, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.</strong> Since the gate went up, those screens would load their frame and then show every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.</p>
+                  <p><strong>IndeeHub heals itself.</strong> Three separate faults: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted about ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — the node would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. All three are fixed, and the storage fault fixes the same trap for every future multi-part app.</p>
+                  <p><strong>Send and Receive open clean every time.</strong> Whatever you typed last — an address, an amount, and above all an armed "send all funds" toggle — no longer quietly carries over into the next payment. And choosing "send all funds" now shows the amount being swept instead of a confusing 0.</p>
+                  <p><strong>The camera scanner option no longer vanishes on desktop.</strong> Browsers only allow the live camera on secure (HTTPS) pages, and the scan window used to silently hide the camera choice on plain connections, which read as "the scanner is gone". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.</p>
+                  <p>Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.</p>
+                </div>
+              </div>
               <!-- v1.7.124-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

From 6110a7a9a7aa7b8322e0395a99a4d666c0ffbbc7 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 21:49:19 -0400
Subject: [PATCH 43/60] test: update stale drift guards (login-page A mark, 25
 exempt ports)

Both predate this session's changes and were masked by the release
gate's cargo-test-weekly compile timeout:
- login_page_sources_its_art_from_the_gate still asserted the retired
  wordmark (logo-archipelago.svg); the login page ships the sidebar A
  mark (favico-black-v2.svg) since the 2026-08-05 rework.
- unauthenticated_ports_are_all_accounted_for lagged at 17; the
  v1.7.123 port-policy round grew the rationale-carrying exempt set
  to 25 (reviewed and enumerated in the test comment).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/appgate/mod.rs |  5 ++++-
 core/container/src/manifest.rs      | 10 +++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index d9f01ca9..a3ed00ef 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -932,7 +932,10 @@ mod tests {
             );
         }
         // Every referenced asset must be one the gate will actually serve.
-        assert!(read_ui_asset("logo-archipelago.svg").is_some() || cfg!(not(debug_assertions)));
+        // The logo is the sidebar A mark (favico-black-v2.svg) since the
+        // 2026-08-05 login-page rework — the old wordmark is off the
+        // allowlist on purpose.
+        assert!(read_ui_asset("favico-black-v2.svg").is_some() || cfg!(not(debug_assertions)));
     }
 
     /// The allowlist is the whole security boundary for asset serving: the
diff --git a/core/container/src/manifest.rs b/core/container/src/manifest.rs
index 09c3f731..7b3fc1ac 100644
--- a/core/container/src/manifest.rs
+++ b/core/container/src/manifest.rs
@@ -1717,9 +1717,17 @@ app:
             }
         }
         exempt.sort();
+        // 25 as of the v1.7.123 port-policy round: bitcoin p2p (8333 ×2),
+        // core-lightning 9736/9835, electrumx 50001, fedimint 8173/8174,
+        // fedimint-gateway 8176/9737, gitea ssh 2222, lightning-stack
+        // 8091/9738/10010, lnd 9735/10009/18080, netbird 3478/8086/8087,
+        // pine TLS 10381 + the three voice ports (10200/10300/10400 — the
+        // disclosed known gap), router SSDP/mDNS 1900/5353. Every one is a
+        // deliberate, rationale-carrying exemption; the release-gate test
+        // stage timed out that cycle, so the count here lagged at 17.
         assert_eq!(
             exempt.len(),
-            17,
+            25,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }

From d5ef4ef76e1254e8f6efac152eb55a9640e6158a Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 22:16:13 -0400
Subject: [PATCH 44/60] chore(catalog): sign catalog with session_passthrough +
 indeedhub-redis caps

Carries the two manifest-side halves of the .125 fix batch: the four
companion UIs (lnd-ui, bitcoin-ui, electrs-ui, fips-ui) declare
session_passthrough on their gated ports so the gate forwards the node
session their nginx proxies to the daemon, and indeedhub-redis gains
CHOWN+DAC_OVERRIDE so its entrypoint can traverse its own data dir.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 releases/app-catalog.json | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 44279454..364dfa3d 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -717,7 +717,8 @@
               "bind": "127.0.0.1",
               "container": 8334,
               "host": 8334,
-              "protocol": "tcp"
+              "protocol": "tcp",
+              "session_passthrough": true
             }
           ],
           "resources": {
@@ -1175,7 +1176,8 @@
               "bind": "127.0.0.1",
               "container": 50002,
               "host": 50002,
-              "protocol": "tcp"
+              "protocol": "tcp",
+              "session_passthrough": true
             }
           ],
           "resources": {
@@ -1732,7 +1734,8 @@
               "bind": "127.0.0.1",
               "container": 8336,
               "host": 8336,
-              "protocol": "tcp"
+              "protocol": "tcp",
+              "session_passthrough": true
             }
           ],
           "resources": {
@@ -2722,6 +2725,8 @@
           },
           "security": {
             "capabilities": [
+              "CHOWN",
+              "DAC_OVERRIDE",
               "SETGID",
               "SETUID"
             ],
@@ -3120,7 +3125,8 @@
               "bind": "127.0.0.1",
               "container": 18083,
               "host": 18083,
-              "protocol": "tcp"
+              "protocol": "tcp",
+              "session_passthrough": true
             }
           ],
           "resources": {
@@ -4891,7 +4897,7 @@
     }
   },
   "schema": 1,
-  "signature": "a8502a3664500e6f22e47d2f29456cde208c0cf117767083be8ec6c238f73e546ae33ccea0c100573cfd9a474614da03903d5be6b7cae72bb3c5439d2b510104",
+  "signature": "a9a0bf60aa6c47ae970a6c7c3e19e9390ee7af157f425c2e38b1bbb194f0315b73ddf16bc46244b36390454787a1ddecc559be806098fdf569d3315f388b9006",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "updated": "2026-08-05"
+  "updated": "2026-08-06"
 }

From 92cffe9d46c0fe56cec99b8f6623d4dc39d08386 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 22:50:42 -0400
Subject: [PATCH 45/60] fix(reconciler): recreate an absent stack member when
 its siblings are live
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The periodic reconcile runs ExistingOnly — merely listing a catalog
manifest must never install an app — and its only absent-container
recovery keyed on the last running-names snapshot, which ages out after
a few daemon restarts. An absent member of an installed stack then stays
absent forever: .38 ran indeedhub with no minio/postgres for days, nginx
down on 'host not found in upstream "minio"', and nothing ever put the
members back.

A live sibling container is proof the stack is installed on this node,
so an absent member is now treated as a hole to repair, not a choice to
respect: the recovery guard also fires when another member of the same
stack (app_ops::stack_member_app_ids) has a container in any state.
A stack with no containers at all is left untouched, and sibling app ids
resolve through the loaded-manifest container names (immich-postgres
runs as immich_postgres).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/app_ops.rs               |   3 +-
 .../src/container/prod_orchestrator.rs        | 123 +++++++++++++++++-
 2 files changed, 121 insertions(+), 5 deletions(-)

diff --git a/core/archipelago/src/app_ops.rs b/core/archipelago/src/app_ops.rs
index c036d863..7311ade7 100644
--- a/core/archipelago/src/app_ops.rs
+++ b/core/archipelago/src/app_ops.rs
@@ -75,7 +75,8 @@ pub fn address_caching_dependents(package_id: &str) -> &'static [&'static str] {
 /// The package whose lifecycle lock covers `app_id`: the stack package when
 /// `app_id` is a member (RPC ops on "mempool" hold the "mempool" lock while
 /// they drive archy-mempool-web), otherwise the app itself.
-fn owning_package(app_id: &str) -> &str {
+/// Also consulted by the reconciler's absent-stack-member recovery.
+pub fn owning_package(app_id: &str) -> &str {
     const STACKS: &[&str] = &[
         "immich",
         "indeedhub",
diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index 2eb4dc12..0d66db21 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -104,6 +104,32 @@ fn dependency_manifests_required_by_active_apps<'a>(
     required
 }
 
+/// Whether `app_id` is a member of a known multi-container stack that has at
+/// least one OTHER member with a live container (any state). A live sibling
+/// proves the stack is installed on this node, so an absent member is a hole
+/// to repair — while a stack with no containers at all stays untouched
+/// (uninstalled, or never installed here). Sibling app ids resolve to
+/// container names through the loaded-manifest map when available (immich's
+/// `immich-postgres` app id runs as container `immich_postgres`), falling
+/// back to the id itself.
+fn absent_stack_member_with_live_sibling(
+    app_id: &str,
+    present_containers: &HashSet<String>,
+    container_name_by_app_id: &std::collections::HashMap<String, String>,
+) -> bool {
+    let stack = crate::app_ops::owning_package(app_id);
+    let members = crate::app_ops::stack_member_app_ids(stack);
+    members.iter().any(|member| {
+        *member != app_id
+            && present_containers.contains(
+                container_name_by_app_id
+                    .get(*member)
+                    .map(String::as_str)
+                    .unwrap_or(member),
+            )
+    })
+}
+
 fn manifest_dependency_app_ids(manifest: &AppManifest) -> Vec<String> {
     manifest
         .app
@@ -1654,13 +1680,16 @@ impl ProdContainerOrchestrator {
         // app whose container vanished (e.g. a wedged teardown cleared by a
         // reboot) instead of leaving it down. See the immich .198 incident.
         let was_running = crate::crash_recovery::load_last_running_names(&self.data_dir).await;
-        let manifests: Vec<LoadedManifest> = {
+        let (manifests, container_name_by_app_id): (
+            Vec<LoadedManifest>,
+            std::collections::HashMap<String, String>,
+        ) = {
             let state = self.state.read().await;
             let dependency_required = dependency_manifests_required_by_active_apps(
                 state.manifests.values().map(|lm| &lm.manifest),
                 &user_stopped,
             );
-            state
+            let filtered = state
                 .manifests
                 .iter()
                 .filter(|(app_id, _)| !state.disabled.contains(*app_id))
@@ -1670,8 +1699,25 @@ impl ProdContainerOrchestrator {
                             && !user_stopped.contains(&compute_container_name(&lm.manifest)))
                 })
                 .map(|(_, lm)| lm.clone())
-                .collect()
+                .collect();
+            // Unfiltered id→container-name map for the absent-stack-member
+            // recovery below: a sibling may be excluded from this pass (e.g.
+            // user-stopped) yet its live container still proves the stack is
+            // installed.
+            let names = state
+                .manifests
+                .iter()
+                .map(|(id, lm)| (id.clone(), compute_container_name(&lm.manifest)))
+                .collect();
+            (filtered, names)
         };
+        // Live container names (any state), for the same recovery check.
+        let present_containers: std::collections::HashSet<String> = self
+            .runtime
+            .list_containers()
+            .await
+            .map(|cs| cs.into_iter().map(|c| c.name).collect())
+            .unwrap_or_default();
         let mut report = ReconcileReport::default();
         let disk_gb = self.disk_gb().await;
         // Register every candidate before the (sequential, possibly slow)
@@ -1738,7 +1784,20 @@ impl ProdContainerOrchestrator {
                 Ok(ReconcileAction::Left(reason))
                     if mode == ReconcileMode::ExistingOnly
                         && reason == "absent"
-                        && was_running.contains(&compute_container_name(&lm.manifest)) =>
+                        && (was_running.contains(&compute_container_name(&lm.manifest))
+                            // Absent STACK MEMBER whose siblings have live
+                            // containers: the stack is installed, so the
+                            // missing member is a hole, not a choice. The
+                            // was_running snapshot ages out after a few daemon
+                            // restarts, which left indeedhub-minio/-postgres
+                            // permanently absent on .38 (2026-08-06) — nginx
+                            // down on `host not found in upstream "minio"`
+                            // with nothing ever recreating the members.
+                            || absent_stack_member_with_live_sibling(
+                                &app_id,
+                                &present_containers,
+                                &container_name_by_app_id,
+                            )) =>
                 {
                     tracing::warn!(
                         app_id = %app_id,
@@ -4451,6 +4510,62 @@ mod tests {
         items.iter().map(|s| s.to_string()).collect()
     }
 
+    /// The .38 indeedhub incident class: an absent stack member must be
+    /// recovered when its siblings have live containers (the stack is
+    /// installed), and left alone when the whole stack is gone or the app
+    /// is not a stack member at all.
+    #[test]
+    fn absent_stack_member_recovery_requires_a_live_sibling() {
+        let present: HashSet<String> = ["indeedhub-redis", "indeedhub-relay", "indeedhub"]
+            .iter()
+            .map(|s| s.to_string())
+            .collect();
+        let names = std::collections::HashMap::new();
+        // Missing members of a stack with live siblings → recover.
+        assert!(absent_stack_member_with_live_sibling(
+            "indeedhub-minio",
+            &present,
+            &names
+        ));
+        assert!(absent_stack_member_with_live_sibling(
+            "indeedhub-postgres",
+            &present,
+            &names
+        ));
+        // Whole stack absent → NOT recovered (uninstalled stays uninstalled).
+        let empty = HashSet::new();
+        assert!(!absent_stack_member_with_live_sibling(
+            "indeedhub-minio",
+            &empty,
+            &names
+        ));
+        // Non-stack app → never.
+        assert!(!absent_stack_member_with_live_sibling(
+            "vaultwarden",
+            &present,
+            &names
+        ));
+        // An app's OWN container being present proves nothing about siblings.
+        let only_self: HashSet<String> =
+            std::iter::once("indeedhub-minio".to_string()).collect();
+        assert!(!absent_stack_member_with_live_sibling(
+            "indeedhub-minio",
+            &only_self,
+            &names
+        ));
+        // App-id → container-name mapping is honoured (immich_postgres runs
+        // under an underscore name while its app id is hyphenated).
+        let mut mapped = std::collections::HashMap::new();
+        mapped.insert("immich-postgres".to_string(), "immich_postgres".to_string());
+        let immich_present: HashSet<String> =
+            std::iter::once("immich_postgres".to_string()).collect();
+        assert!(absent_stack_member_with_live_sibling(
+            "immich-redis",
+            &immich_present,
+            &mapped
+        ));
+    }
+
     #[test]
     fn command_drift_tolerates_quadlet_entrypoint_split() {
         // Quadlet writes Entrypoint=sh + Exec=-lc "<script>", so podman

From 8469af5f4eb3e8ee6af4b93a510b442af12553da Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 23:41:35 -0400
Subject: [PATCH 46/60] fix(wallet): surface LND sweep refusals as readable
 errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A sweep of 92 unconfirmed/dust sats failed with LND's debug-flavored
"insufficient input to create sweep tx: input_sum=0 BTC, output_sum=
0.00000092 BTC" — and the RPC sanitizer then masked even that behind
"Operation failed. Check server logs." (framework-pt, 2026-08-06).
The sweep mechanics are untouched (balance minus fee, as always) —
this only makes the refusal say WHY in plain language.

- lnd.sendcoins translates the sweep refusal: balance below Bitcoin's
  dust minimum or not yet confirmed, so no transaction can be built
  (LND's original message kept in parens).
- "Failed to send" joins the sanitizer's user-facing allowlist — the
  same lesson as "Insufficient balance"/"Payment failed" before it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/lnd/wallet.rs | 13 +++++++++++++
 core/archipelago/src/api/rpc/middleware.rs |  5 +++++
 2 files changed, 18 insertions(+)

diff --git a/core/archipelago/src/api/rpc/lnd/wallet.rs b/core/archipelago/src/api/rpc/lnd/wallet.rs
index d679de7e..8997c998 100644
--- a/core/archipelago/src/api/rpc/lnd/wallet.rs
+++ b/core/archipelago/src/api/rpc/lnd/wallet.rs
@@ -192,6 +192,19 @@ impl RpcHandler {
                 .get("message")
                 .and_then(|v| v.as_str())
                 .unwrap_or("Unknown error");
+            // LND's sweep refusal reads like a debug dump ("insufficient
+            // input to create sweep tx: input_sum=0 BTC, output_sum=…").
+            // input_sum=0 with a tiny output means the wallet's coins are
+            // unconfirmed or below Bitcoin's dust minimum — say that
+            // (framework-pt sweep of 92 sats, 2026-08-06).
+            if msg.contains("insufficient input to create sweep tx") {
+                return Err(anyhow::anyhow!(
+                    "Failed to send: your on-chain balance is too small or still \
+                     unconfirmed to sweep. Bitcoin cannot build a transaction from \
+                     coins below the dust minimum (~546 sats) or from funds that \
+                     have not confirmed yet. (LND: {msg})"
+                ));
+            }
             return Err(anyhow::anyhow!("Failed to send: {}", msg));
         }
 
diff --git a/core/archipelago/src/api/rpc/middleware.rs b/core/archipelago/src/api/rpc/middleware.rs
index a20a184f..bba77598 100644
--- a/core/archipelago/src/api/rpc/middleware.rs
+++ b/core/archipelago/src/api/rpc/middleware.rs
@@ -79,6 +79,11 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         // them in the first place (ecash send, 2026-07-22).
         "Insufficient balance",
         "Insufficient funds",
+        // On-chain send/sweep refusals from LND ("Failed to send: your
+        // on-chain balance is too small or still unconfirmed to sweep…").
+        // Masking sent the operator to journalctl again (framework-pt
+        // sweep, 2026-08-06) — same lesson as the two above.
+        "Failed to send",
         // Lightning payment failures carry LND's reason ("invoice expired.
         // Valid until …", "no route", …) — the user can act on every one of
         // them, and masking sent the operator to journalctl (invoice-expired

From d8748ee7ba51efade8583e0323c28d2ec3e2270a Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Wed, 5 Aug 2026 23:48:36 -0400
Subject: [PATCH 47/60] fix(orchestrator): map container uids into the subuid
 range in the chown fallback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

chown_for_rootless_container prefers `podman unshare chown` (which maps
container uid N through the userns), but when that failed once it fell
back to `sudo chown -R <literal>` — writing e.g. host uid 999 for
container uid 999 and reporting success. Host-999 maps to nobody inside
the userns, so the app could not open its own data while everything
claimed the chown worked: botfights on framework-pt crash-looped every
10s on SQLITE_CANTOPEN over a data dir the daemon itself had just
"fixed".

The sudo fallback now translates container ids (1..99999) to
subuid_base + id - 1 (fleet base 100000; container root maps to the
service user, 1000). Already-mapped ids and uid 0 pass through.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/container/prod_orchestrator.rs        | 28 +++++++++++++++----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index 0d66db21..4e101e7c 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -272,10 +272,15 @@ fn build_fingerprint_stamp_path(data_dir: &Path, tag: &str) -> PathBuf {
 }
 
 async fn chown_for_rootless_container(uid_gid: &str, path: &str) -> Result<()> {
-    let uid = uid_gid
+    let (uid, gid) = uid_gid
         .split_once(':')
-        .and_then(|(uid, _)| uid.parse::<u32>().ok())
-        .unwrap_or(0);
+        .map(|(u, g)| {
+            (
+                u.parse::<u32>().unwrap_or(0),
+                g.parse::<u32>().unwrap_or(0),
+            )
+        })
+        .unwrap_or((0, 0));
 
     if uid > 0 && uid < 100_000 {
         let output = tokio::process::Command::new("podman")
@@ -288,9 +293,22 @@ async fn chown_for_rootless_container(uid_gid: &str, path: &str) -> Result<()> {
         }
     }
 
-    let status = host_sudo(&["chown", "-R", uid_gid, path])
+    // Host-side fallback. A CONTAINER-namespace id must be translated into
+    // the subuid range first: `sudo chown 999` writes literal host uid 999,
+    // which maps to nobody inside the userns — the app then can't open its
+    // own files while the chown reported success (botfights SQLITE_CANTOPEN
+    // crash-loop, framework-pt 2026-08-06). Container uid N (N>=1) lives at
+    // subuid_base + N - 1; the fleet provisions base 100000. uid 0 and
+    // already-mapped ids (>=100000) pass through untouched.
+    let host_uid_gid = if uid > 0 && uid < 100_000 {
+        let map = |id: u32| if id == 0 { 1000 } else { 100_000 + id - 1 };
+        format!("{}:{}", map(uid), map(gid))
+    } else {
+        uid_gid.to_string()
+    };
+    let status = host_sudo(&["chown", "-R", &host_uid_gid, path])
         .await
-        .with_context(|| format!("sudo chown -R {uid_gid} {path}"))?;
+        .with_context(|| format!("sudo chown -R {host_uid_gid} {path}"))?;
     if status.success() {
         return Ok(());
     }

From ed062481c3b31f37a072566f07dac62b1f7c1650 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 05:32:53 -0400
Subject: [PATCH 48/60] style: cargo fmt

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/container/prod_orchestrator.rs | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/core/archipelago/src/container/prod_orchestrator.rs b/core/archipelago/src/container/prod_orchestrator.rs
index 4e101e7c..cb836168 100644
--- a/core/archipelago/src/container/prod_orchestrator.rs
+++ b/core/archipelago/src/container/prod_orchestrator.rs
@@ -274,12 +274,7 @@ fn build_fingerprint_stamp_path(data_dir: &Path, tag: &str) -> PathBuf {
 async fn chown_for_rootless_container(uid_gid: &str, path: &str) -> Result<()> {
     let (uid, gid) = uid_gid
         .split_once(':')
-        .map(|(u, g)| {
-            (
-                u.parse::<u32>().unwrap_or(0),
-                g.parse::<u32>().unwrap_or(0),
-            )
-        })
+        .map(|(u, g)| (u.parse::<u32>().unwrap_or(0), g.parse::<u32>().unwrap_or(0)))
         .unwrap_or((0, 0));
 
     if uid > 0 && uid < 100_000 {
@@ -4564,8 +4559,7 @@ mod tests {
             &names
         ));
         // An app's OWN container being present proves nothing about siblings.
-        let only_self: HashSet<String> =
-            std::iter::once("indeedhub-minio".to_string()).collect();
+        let only_self: HashSet<String> = std::iter::once("indeedhub-minio".to_string()).collect();
         assert!(!absent_stack_member_with_live_sibling(
             "indeedhub-minio",
             &only_self,

From e875f15fc515e1ec412f2c4d6248ae3c04b3b768 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 06:10:39 -0400
Subject: [PATCH 49/60] docs: curated changelog for v1.7.125-alpha

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f5e857c..c10242dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## v1.7.125-alpha (2026-08-06)
+
+- **The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.** Since the gate went up, those screens loaded their frame and then showed every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential, and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.
+- **IndeeHub heals itself.** Three separate faults fixed: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted roughly ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — it would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. The storage fault fixes the same trap for every future multi-part app.
+- **A missing piece of a running app now gets put back automatically.** If one container of a multi-part app disappears while its siblings are still running, the node treats that as a hole to repair rather than a choice to respect, and rebuilds the missing piece. An app you actually uninstalled stays uninstalled.
+- **Send and Receive open clean every time.** Whatever you typed last — an address, an amount, and above all an armed "send all funds" toggle — no longer quietly carries over into the next payment. Choosing "send all funds" also shows the amount being swept instead of a confusing 0.
+- **A sweep that cannot happen now says why.** Trying to sweep a balance that is below Bitcoin's dust minimum (about 546 sats) or not yet confirmed used to fail with "check server logs"; it now explains that no transaction can be built from those coins.
+- **The camera scanner option no longer vanishes on desktop.** Browsers only allow the live camera on secure (HTTPS) pages, and the scan window silently hid the camera choice on plain connections — which read as "the scanner is gone". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.
+- **App data folders can no longer be "repaired" into a state the app cannot use.** When the node fixed a folder's ownership through its fallback path, it wrote the container's raw user number instead of the translated one, so the fix reported success while the app still could not open its own files — one node's BotFights restarted every ten seconds over exactly this. The translation is now applied.
+- Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.
+- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
 ## v1.7.124-alpha (2026-08-05)
 
 - **The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing "server starting" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.

From 19487670830ea18958de53b435d7407ed9b52416 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 06:27:02 -0400
Subject: [PATCH 50/60] chore: release v1.7.125-alpha

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/Cargo.lock             |  2 +-
 core/archipelago/Cargo.toml |  2 +-
 neode-ui/package-lock.json  |  4 ++--
 neode-ui/package.json       |  2 +-
 release-manifest.json       | 46 ++++++++++++++++++-------------------
 releases/manifest.json      | 46 ++++++++++++++++++-------------------
 6 files changed, 51 insertions(+), 51 deletions(-)

diff --git a/core/Cargo.lock b/core/Cargo.lock
index 46f9ce52..90a90887 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.124-alpha"
+version = "1.7.125-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
diff --git a/core/archipelago/Cargo.toml b/core/archipelago/Cargo.toml
index 670a7451..dfffcf95 100644
--- a/core/archipelago/Cargo.toml
+++ b/core/archipelago/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.124-alpha"
+version = "1.7.125-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
diff --git a/neode-ui/package-lock.json b/neode-ui/package-lock.json
index d926d63d..6436b050 100644
--- a/neode-ui/package-lock.json
+++ b/neode-ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.124-alpha",
+  "version": "1.7.125-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.124-alpha",
+      "version": "1.7.125-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
diff --git a/neode-ui/package.json b/neode-ui/package.json
index 5deee48c..dbcb2192 100644
--- a/neode-ui/package.json
+++ b/neode-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.124-alpha",
+  "version": "1.7.125-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",
diff --git a/release-manifest.json b/release-manifest.json
index baf997ce..a3bb531b 100644
--- a/release-manifest.json
+++ b/release-manifest.json
@@ -1,35 +1,35 @@
 {
   "changelog": [
-    "**The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing \"server starting\" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.",
-    "**Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.",
-    "**Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.",
-    "**Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.",
-    "**The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.",
-    "**The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.",
-    "**You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.",
-    "Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.",
-    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+    "**The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.** Since the gate went up, those screens loaded their frame and then showed every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential, and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.",
+    "**IndeeHub heals itself.** Three separate faults fixed: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted roughly ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — it would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. The storage fault fixes the same trap for every future multi-part app.",
+    "**A missing piece of a running app now gets put back automatically.** If one container of a multi-part app disappears while its siblings are still running, the node treats that as a hole to repair rather than a choice to respect, and rebuilds the missing piece. An app you actually uninstalled stays uninstalled.",
+    "**Send and Receive open clean every time.** Whatever you typed last — an address, an amount, and above all an armed \"send all funds\" toggle — no longer quietly carries over into the next payment. Choosing \"send all funds\" also shows the amount being swept instead of a confusing 0.",
+    "**A sweep that cannot happen now says why.** Trying to sweep a balance that is below Bitcoin's dust minimum (about 546 sats) or not yet confirmed used to fail with \"check server logs\"; it now explains that no transaction can be built from those coins.",
+    "**The camera scanner option no longer vanishes on desktop.** Browsers only allow the live camera on secure (HTTPS) pages, and the scan window silently hid the camera choice on plain connections — which read as \"the scanner is gone\". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.",
+    "**App data folders can no longer be \"repaired\" into a state the app cannot use.** When the node fixed a folder's ownership through its fallback path, it wrote the container's raw user number instead of the translated one, so the fix reported success while the app still could not open its own files — one node's BotFights restarted every ten seconds over exactly this. The translation is now applied.",
+    "Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.",
+    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.124-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago",
+      "current_version": "1.7.125-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.125-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.124-alpha",
-      "sha256": "bc91e7d09083dad17934dc2bad211b4eb1d22fd799e032a94fa73df025ba272d",
-      "size_bytes": 54701560
+      "new_version": "1.7.125-alpha",
+      "sha256": "080bc83cb10b3ebe532497917d96b7af3766c36c30119cb0f348de36162d9e9d",
+      "size_bytes": 55060216
     },
     {
-      "current_version": "1.7.124-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago-frontend-1.7.124-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.124-alpha.tar.gz",
-      "new_version": "1.7.124-alpha",
-      "sha256": "346ed6472fb647bcf45299e4d93b9f555142bf1229912030fbafe9966fd410a7",
-      "size_bytes": 210531432
+      "current_version": "1.7.125-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.125-alpha/archipelago-frontend-1.7.125-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.125-alpha.tar.gz",
+      "new_version": "1.7.125-alpha",
+      "sha256": "0bff6f169767043928d9189ab53045c9e4f7c523697b42bf770b2b485c2902f1",
+      "size_bytes": 210532813
     }
   ],
-  "release_date": "2026-08-05",
-  "signature": "40f5ffca026addd00c4aac933edf8faa05a60d9b981341bc0bfaae078812a65ad6656886b4a9d533476759dbb511fb4b050e518cd0060568f7b33035069e600e",
+  "release_date": "2026-08-06",
+  "signature": "975157cc59527679f3de846a4a93d11e27f6ad48eed215fd769574dfc6db36a687867a35aeb6e705d41667ea800b948f53ce7f80bfcdb5a6e1820e50613d4403",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.7.124-alpha"
+  "version": "1.7.125-alpha"
 }
diff --git a/releases/manifest.json b/releases/manifest.json
index baf997ce..a3bb531b 100644
--- a/releases/manifest.json
+++ b/releases/manifest.json
@@ -1,35 +1,35 @@
 {
   "changelog": [
-    "**The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing \"server starting\" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.",
-    "**Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.",
-    "**Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.",
-    "**Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.",
-    "**The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.",
-    "**The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.",
-    "**You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.",
-    "Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.",
-    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+    "**The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.** Since the gate went up, those screens loaded their frame and then showed every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential, and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.",
+    "**IndeeHub heals itself.** Three separate faults fixed: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted roughly ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — it would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. The storage fault fixes the same trap for every future multi-part app.",
+    "**A missing piece of a running app now gets put back automatically.** If one container of a multi-part app disappears while its siblings are still running, the node treats that as a hole to repair rather than a choice to respect, and rebuilds the missing piece. An app you actually uninstalled stays uninstalled.",
+    "**Send and Receive open clean every time.** Whatever you typed last — an address, an amount, and above all an armed \"send all funds\" toggle — no longer quietly carries over into the next payment. Choosing \"send all funds\" also shows the amount being swept instead of a confusing 0.",
+    "**A sweep that cannot happen now says why.** Trying to sweep a balance that is below Bitcoin's dust minimum (about 546 sats) or not yet confirmed used to fail with \"check server logs\"; it now explains that no transaction can be built from those coins.",
+    "**The camera scanner option no longer vanishes on desktop.** Browsers only allow the live camera on secure (HTTPS) pages, and the scan window silently hid the camera choice on plain connections — which read as \"the scanner is gone\". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.",
+    "**App data folders can no longer be \"repaired\" into a state the app cannot use.** When the node fixed a folder's ownership through its fallback path, it wrote the container's raw user number instead of the translated one, so the fix reported success while the app still could not open its own files — one node's BotFights restarted every ten seconds over exactly this. The translation is now applied.",
+    "Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.",
+    "Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
   ],
   "components": [
     {
-      "current_version": "1.7.124-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago",
+      "current_version": "1.7.125-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.125-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.124-alpha",
-      "sha256": "bc91e7d09083dad17934dc2bad211b4eb1d22fd799e032a94fa73df025ba272d",
-      "size_bytes": 54701560
+      "new_version": "1.7.125-alpha",
+      "sha256": "080bc83cb10b3ebe532497917d96b7af3766c36c30119cb0f348de36162d9e9d",
+      "size_bytes": 55060216
     },
     {
-      "current_version": "1.7.124-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.124-alpha/archipelago-frontend-1.7.124-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.124-alpha.tar.gz",
-      "new_version": "1.7.124-alpha",
-      "sha256": "346ed6472fb647bcf45299e4d93b9f555142bf1229912030fbafe9966fd410a7",
-      "size_bytes": 210531432
+      "current_version": "1.7.125-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.125-alpha/archipelago-frontend-1.7.125-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.125-alpha.tar.gz",
+      "new_version": "1.7.125-alpha",
+      "sha256": "0bff6f169767043928d9189ab53045c9e4f7c523697b42bf770b2b485c2902f1",
+      "size_bytes": 210532813
     }
   ],
-  "release_date": "2026-08-05",
-  "signature": "40f5ffca026addd00c4aac933edf8faa05a60d9b981341bc0bfaae078812a65ad6656886b4a9d533476759dbb511fb4b050e518cd0060568f7b33035069e600e",
+  "release_date": "2026-08-06",
+  "signature": "975157cc59527679f3de846a4a93d11e27f6ad48eed215fd769574dfc6db36a687867a35aeb6e705d41667ea800b948f53ce7f80bfcdb5a6e1820e50613d4403",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.7.124-alpha"
+  "version": "1.7.125-alpha"
 }

From 44522fc94aa8172d6bcf97354580e6eb1febb0f5 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 07:59:34 -0400
Subject: [PATCH 51/60] chore(scripts): one-shot node-side companion-manifest
 repair script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Curl-and-pipe repair for nodes whose companion-UI manifests are stale
(no session_passthrough): fetches the four current manifests from the
public repo, installs them into /opt/archipelago/apps AND the frontend
runtime payload (which restores over apps/ at every boot), restarts,
and reports the gate probe. Long paste-blocks kept mangling in the
operator's terminal — this replaces them with one short line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/fix-companion-manifests.sh | 45 ++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100755 scripts/fix-companion-manifests.sh

diff --git a/scripts/fix-companion-manifests.sh b/scripts/fix-companion-manifests.sh
new file mode 100755
index 00000000..564552fc
--- /dev/null
+++ b/scripts/fix-companion-manifests.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# One-shot node-side repair: pull the current companion-UI manifests
+# (session_passthrough on the gated ports) from the public repo, install
+# them into every location the daemon reads, restart, and report.
+#
+# Run on a node:
+#   curl -sf https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/scripts/fix-companion-manifests.sh | bash
+#
+# Idempotent and safe to re-run. Needs passwordless sudo (fleet default).
+set -u
+
+BASE="https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/apps"
+RUNTIME="/opt/archipelago/web-ui/archipelago-runtime/apps"
+updated=0
+
+for app in lnd-ui bitcoin-ui electrs-ui fips-ui; do
+    tmp="/tmp/${app}-manifest.yml"
+    if ! curl -sf --max-time 30 "$BASE/$app/manifest.yml" -o "$tmp"; then
+        echo "✗ $app: download failed"; continue
+    fi
+    if ! grep -q session_passthrough "$tmp"; then
+        echo "✗ $app: fetched file missing session_passthrough — refusing"; continue
+    fi
+    sudo cp "$tmp" "/opt/archipelago/apps/$app/manifest.yml" || { echo "✗ $app: install failed"; continue; }
+    # The frontend's runtime payload is restored over /opt/archipelago/apps at
+    # every daemon boot on nodes that carry it — update it too or the fix
+    # reverts on the next restart.
+    if [ -d "$RUNTIME/$app" ]; then
+        sudo cp "$tmp" "$RUNTIME/$app/manifest.yml"
+    fi
+    echo "✓ $app updated"
+    updated=$((updated + 1))
+done
+
+if [ "$updated" -eq 0 ]; then
+    echo "Nothing updated — not restarting."
+    exit 1
+fi
+
+sudo systemctl restart archipelago
+echo "Daemon restarted; waiting for the gate…"
+sleep 15
+ip=$(hostname -I | tr ' ' '\n' | grep '^100\.' | head -1)
+code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "http://$ip:18083/" 2>/dev/null)
+echo "ext :18083 -> $code  (401 = gate holds the port: CORRECT)"

From 2afeafc92ee293f3bec2f76e86ce48226768e241 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 08:04:15 -0400
Subject: [PATCH 52/60] feat(reticulum-daemon): airtime-limit args +
 radio_state RPC for live read-back
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Groundwork for the .126 LoRa settings panel (operator top priority):

- --airtime-limit-short/--airtime-limit-long (percent duty-cycle locks,
  e.g. EU868 25/10) written into the RNode interface config when set;
  default None writes nothing — identical to older daemons.
- New socket RPC {"cmd":"radio_state"} returns the live RNodeInterface
  state: requested config values AND the radio-confirmed r_* values
  (r_frequency/r_bandwidth/r_txpower/r_sf/r_cr/r_st_alock/r_lt_alock,
  online, port, airtime utilisation). The r_* values are what the RADIO
  reported after detect/configure — the settings panel's proof that the
  device is actually using what was applied.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 reticulum-daemon/reticulum_daemon.py | 58 ++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/reticulum-daemon/reticulum_daemon.py b/reticulum-daemon/reticulum_daemon.py
index 0b932743..55c2806b 100644
--- a/reticulum-daemon/reticulum_daemon.py
+++ b/reticulum-daemon/reticulum_daemon.py
@@ -108,6 +108,13 @@ def _write_rns_config(
             f"    spreadingfactor = {lora['spreadingfactor']}\n"
             f"    codingrate = {lora['codingrate']}\n"
         )
+        # Regulatory duty-cycle limits (percent). Only written when set —
+        # absent keys keep RNS's own default (no software airtime lock),
+        # matching every daemon built before these args existed.
+        if lora.get("airtime_limit_short") is not None:
+            interfaces += f"    airtime_limit_short = {lora['airtime_limit_short']}\n"
+        if lora.get("airtime_limit_long") is not None:
+            interfaces += f"    airtime_limit_long = {lora['airtime_limit_long']}\n"
     elif tcp_listen or tcp_connect:
         parts = []
         if tcp_listen:
@@ -188,6 +195,8 @@ class ReticulumDaemon:
                 "txpower": self.args.txpower,
                 "spreadingfactor": self.args.spreadingfactor,
                 "codingrate": self.args.codingrate,
+                "airtime_limit_short": self.args.airtime_limit_short,
+                "airtime_limit_long": self.args.airtime_limit_long,
             },
             no_radio=self.args.no_radio,
             tcp_listen=self.args.tcp_listen,
@@ -358,6 +367,8 @@ class ReticulumDaemon:
                 self.announce()
         elif cmd == "status":
             self._broadcast(self._status())
+        elif cmd == "radio_state":
+            self._broadcast(self._radio_state())
         elif cmd == "send_resource":
             self._send_resource(req)
         elif cmd == "shutdown":
@@ -374,6 +385,48 @@ class ReticulumDaemon:
         return {"event": "status", "connected": self.router is not None,
                 "dest_hash": self.dest_hash_hex, "interfaces": ifaces}
 
+    def _radio_state(self) -> dict:
+        """Radio-confirmed RNode parameters, straight from the live
+        RNodeInterface object. The r_* attributes are what the RADIO reported
+        after detect/configure (RNS/Interfaces/RNodeInterface.py) — this is
+        the read-back the settings panel shows as proof the device is
+        actually using the applied values, as opposed to what the config
+        asked for. Absent radio (TCP/no-radio builds) → configured=False."""
+        state = {"event": "radio_state", "configured": False, "online": False}
+        try:
+            import RNS
+            for iface in list(RNS.Transport.interfaces):
+                if type(iface).__name__ != "RNodeInterface":
+                    continue
+                state.update({
+                    "configured": True,
+                    "online": bool(getattr(iface, "online", False)),
+                    "port": getattr(iface, "port", None),
+                    # Requested (config) values…
+                    "frequency": getattr(iface, "frequency", None),
+                    "bandwidth": getattr(iface, "bandwidth", None),
+                    "txpower": getattr(iface, "txpower", None),
+                    "spreadingfactor": getattr(iface, "sf", None),
+                    "codingrate": getattr(iface, "cr", None),
+                    "airtime_limit_short": getattr(iface, "st_alock", None),
+                    "airtime_limit_long": getattr(iface, "lt_alock", None),
+                    # …and what the radio itself confirmed it is running.
+                    "r_frequency": getattr(iface, "r_frequency", None),
+                    "r_bandwidth": getattr(iface, "r_bandwidth", None),
+                    "r_txpower": getattr(iface, "r_txpower", None),
+                    "r_spreadingfactor": getattr(iface, "r_sf", None),
+                    "r_codingrate": getattr(iface, "r_cr", None),
+                    "r_airtime_limit_short": getattr(iface, "r_st_alock", None),
+                    "r_airtime_limit_long": getattr(iface, "r_lt_alock", None),
+                    # Live utilisation, when the interface tracks it.
+                    "airtime_short": getattr(iface, "airtime_short", None),
+                    "airtime_long": getattr(iface, "airtime_long", None),
+                })
+                break
+        except Exception:
+            pass
+        return state
+
     def _send(self, req: dict):
         import RNS
         import LXMF
@@ -643,6 +696,11 @@ def _parse_args(argv):
     p.add_argument("--txpower", type=int, default=17)
     p.add_argument("--spreadingfactor", type=int, default=8)
     p.add_argument("--codingrate", type=int, default=5)
+    # Regulatory duty-cycle locks (percent of airtime, e.g. EU868 short=25
+    # long=10). None (the default) writes no config line, so RNS applies no
+    # software airtime lock — identical to daemons built before these existed.
+    p.add_argument("--airtime-limit-short", type=float, default=None)
+    p.add_argument("--airtime-limit-long", type=float, default=None)
     p.add_argument("--enable-transport", action="store_true",
                    help="run as an RNS transport node: relay traffic and rebroadcast "
                         "announces so nodes beyond direct RF range discover each other "

From 4dd8bacd0e191143f7485d52d27bfa2f89914595 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 08:28:45 -0400
Subject: [PATCH 53/60] feat(mesh): persisted RNode RF settings with
 adopt-don't-clobber migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The .126 LoRa panel's Rust half:

- mesh::rnode_settings: RNodeRfSettings persisted at
  <data_dir>/rnode-rf-settings.json — every RNodeInterface parameter
  (enabled, port override, frequency, bandwidth, sf, cr, txpower,
  airtime_limit_short/long), validated against the bounds RNS itself
  enforces. Defaults are byte-identical to the sidecar's historical
  argparse defaults.
- FIRST-RUN ADOPTION (operator requirement: the update must change NO
  device's applied settings): with no settings file yet, the node's
  existing RNS config (~/.archy-reticulum, else ~/.reticulum) is parsed
  and its RNodeInterface values adopted verbatim as the initial
  settings — proven by a test carrying the operator's literal
  "RNode LoRa Portugal" config.
- Serial spawns pass the settings as explicit sidecar args (frequency/
  bandwidth/txpower/sf/cr + airtime locks); the operator port override
  wins over auto-detect but still passes the KISS probe gate; a
  disabled interface refuses to open with a readable error.
- ReticulumLink::query_radio_state(): asks the sidecar for the live
  RNodeInterface state (radio-confirmed r_* values) — the panel's
  apply-confirmation read-back source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/mesh/mod.rs            |   1 +
 core/archipelago/src/mesh/reticulum.rs      |  72 ++++
 core/archipelago/src/mesh/rnode_settings.rs | 360 ++++++++++++++++++++
 3 files changed, 433 insertions(+)
 create mode 100644 core/archipelago/src/mesh/rnode_settings.rs

diff --git a/core/archipelago/src/mesh/mod.rs b/core/archipelago/src/mesh/mod.rs
index bf0b3e66..f60f27a3 100644
--- a/core/archipelago/src/mesh/mod.rs
+++ b/core/archipelago/src/mesh/mod.rs
@@ -16,6 +16,7 @@ pub mod outbox;
 pub mod protocol;
 pub mod ratchet;
 pub mod reticulum;
+pub mod rnode_settings;
 pub mod scheduler;
 pub mod serial;
 pub mod session;
diff --git a/core/archipelago/src/mesh/reticulum.rs b/core/archipelago/src/mesh/reticulum.rs
index 6ce97325..6099d904 100644
--- a/core/archipelago/src/mesh/reticulum.rs
+++ b/core/archipelago/src/mesh/reticulum.rs
@@ -176,6 +176,7 @@ fn daemon_command(
     archy_x25519_pubkey_hex: Option<&str>,
     display_name: Option<&str>,
     enable_transport: bool,
+    rf: Option<&super::rnode_settings::RNodeRfSettings>,
 ) -> Command {
     let (program, script) = daemon_program();
     let mut cmd = Command::new(program);
@@ -189,6 +190,24 @@ fn daemon_command(
     match iface {
         ReticulumInterface::Serial(path) => {
             cmd.arg("--serial-port").arg(path);
+            // Operator-editable RF parameters (.126 LoRa panel). Passed
+            // explicitly on every spawn so the sidecar's argparse defaults
+            // stop being the silent source of truth. `rf` is None only for
+            // non-serial interfaces, where these have no meaning.
+            if let Some(rf) = rf {
+                cmd.arg("--frequency").arg(rf.frequency.to_string());
+                cmd.arg("--bandwidth").arg(rf.bandwidth.to_string());
+                cmd.arg("--txpower").arg(rf.txpower.to_string());
+                cmd.arg("--spreadingfactor")
+                    .arg(rf.spreading_factor.to_string());
+                cmd.arg("--codingrate").arg(rf.coding_rate.to_string());
+                if let Some(pct) = rf.airtime_limit_short {
+                    cmd.arg("--airtime-limit-short").arg(pct.to_string());
+                }
+                if let Some(pct) = rf.airtime_limit_long {
+                    cmd.arg("--airtime-limit-long").arg(pct.to_string());
+                }
+            }
         }
         ReticulumInterface::TcpServer(bind) => {
             cmd.arg("--tcp-listen").arg(bind);
@@ -318,6 +337,10 @@ pub struct ReticulumLink {
     /// down and the outer reconnect loop respawns the daemon — without this
     /// a dead daemon was invisible until the 30-minute RX-stall watchdog.
     daemon_gone: bool,
+    /// Latest `radio_state` event from the sidecar (the live RNodeInterface
+    /// values, radio-confirmed `r_*` included). Refreshed by
+    /// [`Self::query_radio_state`]; the .126 LoRa panel's read-back source.
+    last_radio_state: Option<Value>,
 }
 
 impl ReticulumLink {
@@ -344,6 +367,16 @@ impl ReticulumLink {
         our_x25519_pubkey_hex: Option<&str>,
         display_name: Option<&str>,
     ) -> Result<Self> {
+        let rf = super::rnode_settings::RNodeRfSettings::load(data_dir).await;
+        if !rf.enabled {
+            anyhow::bail!(
+                "RNode interface is disabled in the LoRa settings — enable it to connect"
+            );
+        }
+        // Operator port override wins over the auto-detected path (.126 LoRa
+        // panel). The probe below still gates: a wrong override fails with
+        // the detect error instead of a silent dead transport.
+        let path = rf.port.as_deref().unwrap_or(path);
         probe_rnode(path)
             .await
             .context("RNode KISS detect failed")?;
@@ -454,6 +487,15 @@ impl ReticulumLink {
         }
 
         let enable_transport = daemon_supports_enable_transport().await;
+        // Operator RF settings ride every serial spawn; loaded here (not by
+        // callers) so a settings apply only needs a transport restart to take
+        // effect. Non-serial interfaces carry no RF.
+        let rf = match iface {
+            ReticulumInterface::Serial(_) => {
+                Some(super::rnode_settings::RNodeRfSettings::load(data_dir).await)
+            }
+            _ => None,
+        };
         let mut cmd = daemon_command(
             &socket_path,
             &iface,
@@ -462,6 +504,7 @@ impl ReticulumLink {
             our_x25519_pubkey_hex,
             display_name,
             enable_transport,
+            rf.as_ref(),
         );
         cmd.env("TMPDIR", &tmp_dir);
         let child = cmd
@@ -534,6 +577,7 @@ impl ReticulumLink {
             inbound: std::collections::VecDeque::new(),
             resource_id_counter: 0,
             daemon_gone: false,
+            last_radio_state: None,
         };
         link.load_persisted_peers();
         Ok(link)
@@ -896,8 +940,36 @@ impl ReticulumLink {
         }
     }
 
+    /// Ask the sidecar for the live RNode state and wait briefly for the
+    /// reply event. Returns the freshest `radio_state` payload, or `None`
+    /// when the daemon didn't answer in time (dead daemon, no radio build).
+    pub async fn query_radio_state(&mut self, timeout: Duration) -> Option<Value> {
+        self.last_radio_state = None;
+        if self
+            .send_rpc(serde_json::json!({"cmd": "radio_state"}))
+            .await
+            .is_err()
+        {
+            return None;
+        }
+        let deadline = tokio::time::Instant::now() + timeout;
+        loop {
+            self.drain_events().await;
+            if let Some(state) = &self.last_radio_state {
+                return Some(state.clone());
+            }
+            if self.daemon_gone || tokio::time::Instant::now() >= deadline {
+                return None;
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    }
+
     fn handle_event(&mut self, ev: Value) {
         match ev.get("event").and_then(Value::as_str) {
+            Some("radio_state") => {
+                self.last_radio_state = Some(ev);
+            }
             Some("announce") => {
                 let Some(hash) = ev
                     .get("dest_hash")
diff --git a/core/archipelago/src/mesh/rnode_settings.rs b/core/archipelago/src/mesh/rnode_settings.rs
new file mode 100644
index 00000000..be72be55
--- /dev/null
+++ b/core/archipelago/src/mesh/rnode_settings.rs
@@ -0,0 +1,360 @@
+//! Persisted RNode LoRa RF settings — the operator-editable half of the
+//! Reticulum transport (.126 LoRa settings panel).
+//!
+//! The reticulum sidecar (reticulum-daemon) writes the RNS config from its
+//! CLI args at every spawn; before this module those args were never passed,
+//! so every node ran the sidecar's argparse defaults and nothing was
+//! operator-editable. These settings persist at
+//! `<data_dir>/rnode-rf-settings.json`, feed `daemon_command` as explicit
+//! args, and the panel confirms application via the sidecar's `radio_state`
+//! read-back (the radio-confirmed `r_*` values, not the requested ones).
+//!
+//! An absent file yields [`RNodeRfSettings::default`], which matches the
+//! sidecar's historical argparse defaults exactly — deploying this changes
+//! nothing until the operator edits something.
+
+use anyhow::{bail, Result};
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+
+const SETTINGS_FILE: &str = "rnode-rf-settings.json";
+
+/// Validation bounds mirror RNS `RNodeInterface.py` (`validate_firmware` /
+/// the constructor checks) — NOT guessed: frequency 137–1020 MHz, sf 5–12,
+/// cr 5–8, txpower 0–22 dBm, airtime locks 0–100 %.
+const FREQ_MIN_HZ: u64 = 137_000_000;
+const FREQ_MAX_HZ: u64 = 1_020_000_000;
+/// The discrete bandwidths RNode firmware accepts (Hz).
+const VALID_BANDWIDTHS: &[u64] = &[
+    7_800, 10_400, 15_600, 20_800, 31_250, 41_700, 62_500, 125_000, 250_000, 500_000,
+];
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RNodeRfSettings {
+    /// Interface on/off. `false` keeps the daemon from opening the radio at
+    /// all (the mesh service skips the serial transport).
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    /// Serial device override (e.g. `/dev/ttyACM0`). `None` = auto-detect,
+    /// which is what every node did before this existed.
+    #[serde(default)]
+    pub port: Option<String>,
+    #[serde(default = "default_frequency")]
+    pub frequency: u64,
+    #[serde(default = "default_bandwidth")]
+    pub bandwidth: u64,
+    #[serde(default = "default_spreading_factor")]
+    pub spreading_factor: u8,
+    #[serde(default = "default_coding_rate")]
+    pub coding_rate: u8,
+    #[serde(default = "default_txpower")]
+    pub txpower: u8,
+    /// Short-window airtime duty-cycle lock, percent (EU868: 25). `None` =
+    /// no software lock (RNS default).
+    #[serde(default)]
+    pub airtime_limit_short: Option<f64>,
+    /// Long-window airtime duty-cycle lock, percent (EU868: 10).
+    #[serde(default)]
+    pub airtime_limit_long: Option<f64>,
+}
+
+fn default_true() -> bool {
+    true
+}
+fn default_frequency() -> u64 {
+    869_525_000
+}
+fn default_bandwidth() -> u64 {
+    125_000
+}
+fn default_spreading_factor() -> u8 {
+    8
+}
+fn default_coding_rate() -> u8 {
+    5
+}
+fn default_txpower() -> u8 {
+    17
+}
+
+impl Default for RNodeRfSettings {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            port: None,
+            frequency: default_frequency(),
+            bandwidth: default_bandwidth(),
+            spreading_factor: default_spreading_factor(),
+            coding_rate: default_coding_rate(),
+            txpower: default_txpower(),
+            airtime_limit_short: None,
+            airtime_limit_long: None,
+        }
+    }
+}
+
+impl RNodeRfSettings {
+    pub fn validate(&self) -> Result<()> {
+        if !(FREQ_MIN_HZ..=FREQ_MAX_HZ).contains(&self.frequency) {
+            bail!(
+                "frequency {} Hz is outside the RNode range ({}–{} Hz)",
+                self.frequency,
+                FREQ_MIN_HZ,
+                FREQ_MAX_HZ
+            );
+        }
+        if !VALID_BANDWIDTHS.contains(&self.bandwidth) {
+            bail!(
+                "bandwidth {} Hz is not an RNode bandwidth (valid: {:?})",
+                self.bandwidth,
+                VALID_BANDWIDTHS
+            );
+        }
+        if !(5..=12).contains(&self.spreading_factor) {
+            bail!("spreading factor {} is outside 5–12", self.spreading_factor);
+        }
+        if !(5..=8).contains(&self.coding_rate) {
+            bail!("coding rate {} is outside 5–8", self.coding_rate);
+        }
+        if self.txpower > 22 {
+            bail!("tx power {} dBm is above the 22 dBm RNode maximum", self.txpower);
+        }
+        for (label, v) in [
+            ("airtime_limit_short", self.airtime_limit_short),
+            ("airtime_limit_long", self.airtime_limit_long),
+        ] {
+            if let Some(pct) = v {
+                if !(0.0..=100.0).contains(&pct) || !pct.is_finite() {
+                    bail!("{label} {pct} is not a percentage (0–100)");
+                }
+            }
+        }
+        if let Some(port) = &self.port {
+            // Same shape the flasher accepts: an absolute device node. Keeps
+            // shell-metacharacter garbage out of the sidecar's argv.
+            if !port.starts_with("/dev/")
+                || port
+                    .chars()
+                    .any(|c| !(c.is_ascii_alphanumeric() || c == '/' || c == '_' || c == '-' || c == '.'))
+            {
+                bail!("port must be an absolute /dev device path");
+            }
+        }
+        Ok(())
+    }
+
+    pub async fn load(data_dir: &Path) -> Self {
+        let path = data_dir.join(SETTINGS_FILE);
+        match tokio::fs::read_to_string(&path).await {
+            Ok(raw) => match serde_json::from_str::<Self>(&raw) {
+                Ok(s) => s,
+                Err(e) => {
+                    tracing::warn!(error = %e, "rnode-rf-settings.json unparseable — using defaults");
+                    Self::default()
+                }
+            },
+            // First run after the update: no settings file yet. ADOPT the
+            // node's existing effective RF config rather than imposing
+            // defaults — the operator's standing requirement is that the
+            // update changes NO device's applied settings. For archy-managed
+            // radios the sidecar config equals our defaults anyway; this
+            // covers any node whose RNS config diverged (hand edits,
+            // hand-run rnsd).
+            Err(_) => {
+                let adopted = Self::adopt_existing_rns_config().await;
+                if let Some(adopted) = adopted {
+                    tracing::info!(
+                        settings = ?adopted,
+                        "adopted existing RNS RNode config as initial RF settings"
+                    );
+                    if let Err(e) = adopted.save(data_dir).await {
+                        tracing::warn!(error = %e, "could not persist adopted RF settings");
+                    }
+                    adopted
+                } else {
+                    Self::default()
+                }
+            }
+        }
+    }
+
+    /// Parse the RNodeInterface section out of an existing RNS config file
+    /// (the sidecar's `~/.archy-reticulum/config`, else a hand-run rnsd's
+    /// `~/.reticulum/config`). Returns `None` when neither exists or no
+    /// RNodeInterface section is found. Unparseable/absent fields keep the
+    /// default (which equals the sidecar's historical argparse default).
+    async fn adopt_existing_rns_config() -> Option<Self> {
+        let home = std::env::var("HOME").ok()?;
+        for candidate in [
+            format!("{home}/.archy-reticulum/config"),
+            format!("{home}/.reticulum/config"),
+        ] {
+            let Ok(raw) = tokio::fs::read_to_string(&candidate).await else {
+                continue;
+            };
+            if let Some(s) = Self::parse_rnode_section(&raw) {
+                return Some(s);
+            }
+        }
+        None
+    }
+
+    /// Extract RNode parameters from RNS config text. Scoped to the block
+    /// after a `type = RNodeInterface` line so TCP interface options can
+    /// never bleed in; stops at the next `[[...]]` section header.
+    fn parse_rnode_section(raw: &str) -> Option<Self> {
+        let mut in_rnode = false;
+        let mut seen_any = false;
+        let mut s = Self::default();
+        for line in raw.lines() {
+            let line = line.trim();
+            if line.starts_with("[[") {
+                if in_rnode {
+                    break; // next interface section — RNode block ended
+                }
+                continue;
+            }
+            let Some((key, value)) = line.split_once('=') else {
+                continue;
+            };
+            let (key, value) = (key.trim(), value.trim());
+            if key == "type" {
+                in_rnode = value == "RNodeInterface";
+                continue;
+            }
+            if !in_rnode {
+                continue;
+            }
+            seen_any = true;
+            match key {
+                "enabled" | "interface_enabled" => {
+                    s.enabled = matches!(value.to_ascii_lowercase().as_str(), "yes" | "true" | "on")
+                }
+                "port" => s.port = Some(value.to_string()),
+                "frequency" => s.frequency = value.parse().unwrap_or(s.frequency),
+                "bandwidth" => s.bandwidth = value.parse().unwrap_or(s.bandwidth),
+                "txpower" => s.txpower = value.parse().unwrap_or(s.txpower),
+                "spreadingfactor" => {
+                    s.spreading_factor = value.parse().unwrap_or(s.spreading_factor)
+                }
+                "codingrate" => s.coding_rate = value.parse().unwrap_or(s.coding_rate),
+                "airtime_limit_short" => s.airtime_limit_short = value.parse().ok(),
+                "airtime_limit_long" => s.airtime_limit_long = value.parse().ok(),
+                _ => {}
+            }
+        }
+        (in_rnode || seen_any).then_some(s)
+    }
+
+    pub async fn save(&self, data_dir: &Path) -> Result<()> {
+        self.validate()?;
+        let path = data_dir.join(SETTINGS_FILE);
+        let tmp = path.with_extension("json.tmp");
+        let raw = serde_json::to_string_pretty(self)?;
+        tokio::fs::write(&tmp, raw).await?;
+        tokio::fs::rename(&tmp, &path).await?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_match_the_sidecar_argparse_defaults() {
+        // reticulum_daemon.py: --frequency 869525000 --bandwidth 125000
+        // --txpower 17 --spreadingfactor 8 --codingrate 5, no airtime locks.
+        let d = RNodeRfSettings::default();
+        assert_eq!(d.frequency, 869_525_000);
+        assert_eq!(d.bandwidth, 125_000);
+        assert_eq!(d.txpower, 17);
+        assert_eq!(d.spreading_factor, 8);
+        assert_eq!(d.coding_rate, 5);
+        assert!(d.airtime_limit_short.is_none() && d.airtime_limit_long.is_none());
+        assert!(d.enabled && d.port.is_none());
+        d.validate().unwrap();
+    }
+
+    #[test]
+    fn operator_portugal_config_validates() {
+        // The operator's real device config (2026-08-06).
+        let s = RNodeRfSettings {
+            enabled: true,
+            port: Some("/dev/ttyACM0".into()),
+            frequency: 869_462_500,
+            bandwidth: 125_000,
+            spreading_factor: 8,
+            coding_rate: 5,
+            txpower: 14,
+            airtime_limit_short: Some(25.0),
+            airtime_limit_long: Some(10.0),
+        };
+        s.validate().unwrap();
+    }
+
+    #[test]
+    fn adoption_preserves_the_operator_portugal_config_exactly() {
+        // The operator's literal RNS config (2026-08-06). The update must
+        // adopt these values verbatim — changing a node's applied RF
+        // settings is forbidden.
+        let raw = "\
+[reticulum]
+  enable_transport = yes
+
+[interfaces]
+  [[RNode LoRa Portugal]]
+    type = RNodeInterface
+    interface_enabled = true
+    port = /dev/ttyACM0
+    frequency = 869462500
+    bandwidth = 125000
+    spreadingfactor = 8
+    codingrate = 5
+    txpower = 14
+    airtime_limit_short = 25
+    airtime_limit_long = 10
+";
+        let s = RNodeRfSettings::parse_rnode_section(raw).expect("section found");
+        assert!(s.enabled);
+        assert_eq!(s.port.as_deref(), Some("/dev/ttyACM0"));
+        assert_eq!(s.frequency, 869_462_500);
+        assert_eq!(s.bandwidth, 125_000);
+        assert_eq!(s.spreading_factor, 8);
+        assert_eq!(s.coding_rate, 5);
+        assert_eq!(s.txpower, 14);
+        assert_eq!(s.airtime_limit_short, Some(25.0));
+        assert_eq!(s.airtime_limit_long, Some(10.0));
+        s.validate().unwrap();
+    }
+
+    #[test]
+    fn adoption_ignores_non_rnode_sections_and_absent_config() {
+        let tcp_only = "\
+[interfaces]
+  [[Reticulum TCP Server]]
+    type = TCPServerInterface
+    listen_ip = 127.0.0.1
+    listen_port = 4242
+";
+        assert!(RNodeRfSettings::parse_rnode_section(tcp_only).is_none());
+        assert!(RNodeRfSettings::parse_rnode_section("").is_none());
+    }
+
+    #[test]
+    fn out_of_range_values_are_rejected() {
+        let base = RNodeRfSettings::default();
+        for bad in [
+            RNodeRfSettings { frequency: 100, ..base.clone() },
+            RNodeRfSettings { bandwidth: 123_456, ..base.clone() },
+            RNodeRfSettings { spreading_factor: 4, ..base.clone() },
+            RNodeRfSettings { coding_rate: 9, ..base.clone() },
+            RNodeRfSettings { txpower: 23, ..base.clone() },
+            RNodeRfSettings { airtime_limit_short: Some(180.0), ..base.clone() },
+            RNodeRfSettings { port: Some("ttyACM0".into()), ..base.clone() },
+            RNodeRfSettings { port: Some("/dev/tty; rm -rf /".into()), ..base.clone() },
+        ] {
+            assert!(bad.validate().is_err(), "{bad:?} should fail validation");
+        }
+    }
+}

From 209a36e53cc6bbdcd12d0b253e49f643ad601576 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 08:43:39 -0400
Subject: [PATCH 54/60] feat(mesh): rnode-config RPCs + honest reboot feedback
 with reply channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- mesh.rnode-config: persisted RF settings + best-effort live radio
  state (radio-confirmed r_* values) for the LoRa panel.
- mesh.rnode-config-apply: validate → persist → restart the radio
  daemon → poll the read-back until the radio reports online, returning
  {applied, confirmed, live, message}. Failure modes report what
  actually happened instead of pretending success.
- RebootRadio carries a reply channel: Meshtastic reboots firmware,
  Reticulum restarts the sidecar (re-detect + reapply RF config),
  MeshCore honestly reports it has no remote reboot — previously the
  Reticulum/MeshCore arms returned Ok(()) doing NOTHING: the operator's
  "button gives no feedback" bug.
- MeshCommand::QueryRadioState plumbs the sidecar's radio_state to the
  service layer with a timeout instead of fire-and-forget.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/dispatcher.rs    |   2 +
 .../archipelago/src/api/rpc/mesh/messaging.rs | 109 +++++++++++++++++-
 core/archipelago/src/mesh/listener/mod.rs     |  14 ++-
 core/archipelago/src/mesh/listener/session.rs |  56 +++++++--
 core/archipelago/src/mesh/mod.rs              |  39 ++++++-
 core/archipelago/src/mesh/reticulum.rs        |  14 +++
 6 files changed, 217 insertions(+), 17 deletions(-)

diff --git a/core/archipelago/src/api/rpc/dispatcher.rs b/core/archipelago/src/api/rpc/dispatcher.rs
index 48e0dbfa..34435908 100644
--- a/core/archipelago/src/api/rpc/dispatcher.rs
+++ b/core/archipelago/src/api/rpc/dispatcher.rs
@@ -405,6 +405,8 @@ impl RpcHandler {
             "mesh.send-channel" => self.handle_mesh_send_channel(params).await,
             "mesh.broadcast" => self.handle_mesh_broadcast().await,
             "mesh.reboot-radio" => self.handle_mesh_reboot_radio(params).await,
+            "mesh.rnode-config" => self.handle_mesh_rnode_config().await,
+            "mesh.rnode-config-apply" => self.handle_mesh_rnode_config_apply(params).await,
             "mesh.configure" => self.handle_mesh_configure(params).await,
             "mesh.send-invoice" => self.handle_mesh_send_invoice(params).await,
             "mesh.send-coordinate" => self.handle_mesh_send_coordinate(params).await,
diff --git a/core/archipelago/src/api/rpc/mesh/messaging.rs b/core/archipelago/src/api/rpc/mesh/messaging.rs
index 23facdc3..d66e529c 100644
--- a/core/archipelago/src/api/rpc/mesh/messaging.rs
+++ b/core/archipelago/src/api/rpc/mesh/messaging.rs
@@ -104,10 +104,115 @@ impl RpcHandler {
             .as_ref()
             .ok_or_else(|| anyhow::anyhow!("Mesh service not running. Enable mesh first."))?;
 
-        svc.reboot_radio(seconds).await?;
+        let message = svc.reboot_radio(seconds).await?;
         info!(seconds, "Mesh radio reboot requested via RPC");
 
-        Ok(serde_json::json!({ "reboot": true, "seconds": seconds }))
+        Ok(serde_json::json!({ "reboot": true, "seconds": seconds, "message": message }))
+    }
+
+    /// mesh.rnode-config — persisted RF settings + the live radio state
+    /// (radio-confirmed values) for the LoRa settings panel. `live` is best-
+    /// effort: null with `live_error` when no Reticulum radio is connected.
+    pub(in crate::api::rpc) async fn handle_mesh_rnode_config(&self) -> Result<serde_json::Value> {
+        let settings = mesh::rnode_settings::RNodeRfSettings::load(&self.config.data_dir).await;
+        let (live, live_error) = match self.mesh_service.read().await.as_ref() {
+            Some(svc) => match svc.radio_state().await {
+                Ok(state) => (Some(state), None),
+                Err(e) => (None, Some(format!("{e:#}"))),
+            },
+            None => (None, Some("Mesh service not running".to_string())),
+        };
+        Ok(serde_json::json!({
+            "settings": settings,
+            "live": live,
+            "live_error": live_error,
+        }))
+    }
+
+    /// mesh.rnode-config-apply — validate + persist the RF settings, restart
+    /// the radio daemon so they take effect, then read back the radio-
+    /// confirmed values as proof. Returns { applied, live, message }; a
+    /// failed read-back still reports the persisted settings with a clear
+    /// message instead of pretending success.
+    pub(in crate::api::rpc) async fn handle_mesh_rnode_config_apply(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let settings: mesh::rnode_settings::RNodeRfSettings = serde_json::from_value(
+            params
+                .get("settings")
+                .cloned()
+                .ok_or_else(|| anyhow::anyhow!("Missing 'settings'"))?,
+        )
+        .map_err(|e| anyhow::anyhow!("Invalid settings: {e}"))?;
+        settings.validate()?;
+        settings.save(&self.config.data_dir).await?;
+        info!(?settings, "RNode RF settings persisted");
+
+        // Restart the radio daemon so the new args apply. No radio connected
+        // is fine — the settings apply on the next connect.
+        let service = self.mesh_service.read().await;
+        let Some(svc) = service.as_ref() else {
+            return Ok(serde_json::json!({
+                "applied": false,
+                "message": "Settings saved. They apply when the mesh service next connects to the radio.",
+            }));
+        };
+        if let Err(e) = svc.reboot_radio(2).await {
+            return Ok(serde_json::json!({
+                "applied": false,
+                "message": format!(
+                    "Settings saved, but the radio daemon restart failed: {e:#}. \
+                     They apply on the next reconnect."
+                ),
+            }));
+        }
+
+        // Read-back: poll until the respawned daemon reports the radio online
+        // with our applied values (the respawn re-detects the RNode, ~15s).
+        let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(45);
+        let mut last_live = None;
+        while tokio::time::Instant::now() < deadline {
+            tokio::time::sleep(std::time::Duration::from_secs(3)).await;
+            if let Ok(state) = svc.radio_state().await {
+                let online = state
+                    .get("online")
+                    .and_then(|v| v.as_bool())
+                    .unwrap_or(false);
+                last_live = Some(state);
+                if online {
+                    break;
+                }
+            }
+        }
+        match last_live {
+            Some(live) => {
+                let confirmed = live
+                    .get("r_frequency")
+                    .and_then(|v| v.as_u64())
+                    .map(|f| f == settings.frequency)
+                    .unwrap_or(false);
+                Ok(serde_json::json!({
+                    "applied": true,
+                    "confirmed": confirmed,
+                    "live": live,
+                    "message": if confirmed {
+                        "The radio confirmed it is now using the applied settings."
+                    } else {
+                        "Settings applied and the daemon restarted; the radio has not \
+                         confirmed the new values yet — recheck in a few seconds."
+                    },
+                }))
+            }
+            None => Ok(serde_json::json!({
+                "applied": true,
+                "confirmed": false,
+                "live": null,
+                "message": "Settings applied and the daemon restarted, but it has not \
+                            reported the radio state yet — recheck in a few seconds.",
+            })),
+        }
     }
 
     /// mesh.configure — Enable/disable mesh and set device path.
diff --git a/core/archipelago/src/mesh/listener/mod.rs b/core/archipelago/src/mesh/listener/mod.rs
index 55674d0d..f5637115 100644
--- a/core/archipelago/src/mesh/listener/mod.rs
+++ b/core/archipelago/src/mesh/listener/mod.rs
@@ -148,9 +148,21 @@ pub enum MeshCommand {
     },
     SendAdvert,
     /// Reboot the locally-connected radio firmware to recover a wedged /
-    /// RX-deaf radio. Meshtastic-only; meshcore ignores it.
+    /// RX-deaf radio. Meshtastic: firmware reboot command. Reticulum: the
+    /// sidecar daemon is restarted (radio re-detected + reconfigured).
+    /// MeshCore: unsupported, and says so. `reply` (when present) carries
+    /// the real outcome to the RPC caller — the buttons used to be
+    /// fire-and-forget `warn!`s, i.e. no feedback ever reached the UI
+    /// (operator, 2026-08-06).
     RebootRadio {
         seconds: i64,
+        reply: Option<tokio::sync::oneshot::Sender<Result<String, String>>>,
+    },
+    /// Query the live RNode radio state (Reticulum-only): the sidecar's
+    /// radio-confirmed parameters, for the LoRa settings panel's current
+    /// values + apply read-back.
+    QueryRadioState {
+        reply: tokio::sync::oneshot::Sender<Result<serde_json::Value, String>>,
     },
     /// Re-fetch contact list from the radio device.
     RefreshContacts,
diff --git a/core/archipelago/src/mesh/listener/session.rs b/core/archipelago/src/mesh/listener/session.rs
index cca4b035..9589da7a 100644
--- a/core/archipelago/src/mesh/listener/session.rs
+++ b/core/archipelago/src/mesh/listener/session.rs
@@ -165,13 +165,41 @@ impl MeshRadioDevice {
         }
     }
 
-    async fn reboot(&mut self, seconds: i64) -> Result<()> {
+    async fn reboot(&mut self, seconds: i64) -> Result<String> {
         match self {
-            // Meshcore/Reticulum have no equivalent local-admin reboot in our
-            // driver; the RX-deaf recovery this targets is Meshtastic-specific.
-            Self::Meshcore(_) => Ok(()),
-            Self::Meshtastic(device) => device.reboot(seconds).await,
-            Self::Reticulum(_) => Ok(()),
+            // No remote reboot in the MeshCore serial protocol — say so
+            // instead of silently reporting success (the old `Ok(())` here
+            // is why the button "did nothing" for the operator).
+            Self::Meshcore(_) => {
+                anyhow::bail!("MeshCore radios have no remote reboot — power-cycle the device")
+            }
+            Self::Meshtastic(device) => {
+                device.reboot(seconds).await?;
+                Ok(format!(
+                    "Radio firmware reboots in {seconds}s and reconnects automatically"
+                ))
+            }
+            // Restarting the sidecar drops the serial port, re-detects the
+            // RNode and reapplies the RF config — the closest thing to a
+            // reboot the RNS stack has, and exactly what an operator wants
+            // after changing settings or on a wedged radio.
+            Self::Reticulum(device) => {
+                device.restart_daemon().await?;
+                Ok("Radio daemon restarting — the RNode re-detects and reconnects in about 15 seconds".to_string())
+            }
+        }
+    }
+
+    /// Live RNode radio state — Reticulum-only (see ReticulumLink::query_radio_state).
+    async fn radio_state(&mut self) -> Result<serde_json::Value> {
+        match self {
+            Self::Meshcore(_) | Self::Meshtastic(_) => {
+                anyhow::bail!("Radio state read-back is only available for Reticulum RNode devices")
+            }
+            Self::Reticulum(device) => device
+                .query_radio_state(std::time::Duration::from_secs(5))
+                .await
+                .ok_or_else(|| anyhow::anyhow!("The radio daemon did not answer the state query")),
         }
     }
 
@@ -1549,12 +1577,18 @@ async fn handle_send_command(
                 warn!("Failed to send NodeInfo advert: {}", e);
             }
         }
-        MeshCommand::RebootRadio { seconds } => {
-            if let Err(e) = device.reboot(seconds).await {
-                warn!("Failed to reboot radio: {}", e);
-            } else {
-                info!(seconds, "Radio reboot command sent to device");
+        MeshCommand::RebootRadio { seconds, reply } => {
+            let outcome = device.reboot(seconds).await;
+            match &outcome {
+                Err(e) => warn!("Failed to reboot radio: {}", e),
+                Ok(_) => info!(seconds, "Radio reboot command sent to device"),
             }
+            if let Some(reply) = reply {
+                let _ = reply.send(outcome.map_err(|e| format!("{e:#}")));
+            }
+        }
+        MeshCommand::QueryRadioState { reply } => {
+            let _ = reply.send(device.radio_state().await.map_err(|e| format!("{e:#}")));
         }
         MeshCommand::RefreshContacts => {
             refresh_contacts(device, state).await;
diff --git a/core/archipelago/src/mesh/mod.rs b/core/archipelago/src/mesh/mod.rs
index f60f27a3..629bae36 100644
--- a/core/archipelago/src/mesh/mod.rs
+++ b/core/archipelago/src/mesh/mod.rs
@@ -2124,20 +2124,53 @@ impl MeshService {
     /// RX-deaf radio (one that has stopped hearing the mesh while still able to
     /// transmit). The device reconnects via the listener's reboot→reconnect
     /// loop. `seconds` is the firmware reboot delay.
-    pub async fn reboot_radio(&self, seconds: i64) -> Result<()> {
+    pub async fn reboot_radio(&self, seconds: i64) -> Result<String> {
         let status = self.state.status.read().await;
         if !status.device_connected {
             anyhow::bail!("No mesh device connected. Check USB connection.");
         }
         drop(status);
 
+        let (tx, rx) = tokio::sync::oneshot::channel();
         self.state
-            .send_cmd(listener::MeshCommand::RebootRadio { seconds })
+            .send_cmd(listener::MeshCommand::RebootRadio {
+                seconds,
+                reply: Some(tx),
+            })
             .await
             .map_err(|_| anyhow::anyhow!("Mesh listener not running"))?;
 
+        // The real outcome, not fire-and-forget: the UI shows this string
+        // (or the error) instead of pretending success.
+        let outcome = tokio::time::timeout(std::time::Duration::from_secs(15), rx)
+            .await
+            .map_err(|_| anyhow::anyhow!("The radio did not acknowledge the reboot in time"))?
+            .map_err(|_| anyhow::anyhow!("Mesh session ended before the reboot completed"))?;
+        let message = outcome.map_err(|e| anyhow::anyhow!(e))?;
         info!(seconds, "Mesh radio reboot triggered");
-        Ok(())
+        Ok(message)
+    }
+
+    /// Live RNode radio state (Reticulum-only): the sidecar's view of the
+    /// interface including the radio-confirmed r_* parameters. The LoRa
+    /// settings panel's source for "what is the device actually running".
+    pub async fn radio_state(&self) -> Result<serde_json::Value> {
+        let status = self.state.status.read().await;
+        if !status.device_connected {
+            anyhow::bail!("No mesh device connected. Check USB connection.");
+        }
+        drop(status);
+
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        self.state
+            .send_cmd(listener::MeshCommand::QueryRadioState { reply: tx })
+            .await
+            .map_err(|_| anyhow::anyhow!("Mesh listener not running"))?;
+        let state = tokio::time::timeout(std::time::Duration::from_secs(10), rx)
+            .await
+            .map_err(|_| anyhow::anyhow!("The radio daemon did not answer the state query"))?
+            .map_err(|_| anyhow::anyhow!("Mesh session ended before the state query completed"))?;
+        state.map_err(|e| anyhow::anyhow!(e))
     }
 
     /// Current mesh-AI assistant settings (issue #50).
diff --git a/core/archipelago/src/mesh/reticulum.rs b/core/archipelago/src/mesh/reticulum.rs
index 6099d904..9b7f3dfc 100644
--- a/core/archipelago/src/mesh/reticulum.rs
+++ b/core/archipelago/src/mesh/reticulum.rs
@@ -940,6 +940,20 @@ impl ReticulumLink {
         }
     }
 
+    /// Restart the sidecar daemon: ask it to shut down cleanly and mark the
+    /// link dead so the session loop tears down and the outer reconnect loop
+    /// respawns it — re-detecting the RNode and reapplying the RF config
+    /// from the (possibly just-edited) persisted settings. This IS the
+    /// "reboot device" semantic for Reticulum radios, and the apply step of
+    /// the .126 LoRa settings panel.
+    pub async fn restart_daemon(&mut self) -> Result<()> {
+        // Best-effort clean shutdown (lets PyInstaller clear its _MEI dir);
+        // the SIGTERM path in Drop/terminate covers an already-dead socket.
+        let _ = self.send_rpc(serde_json::json!({"cmd": "shutdown"})).await;
+        self.daemon_gone = true;
+        Ok(())
+    }
+
     /// Ask the sidecar for the live RNode state and wait briefly for the
     /// reply event. Returns the freshest `radio_state` payload, or `None`
     /// when the daemon didn't answer in time (dead daemon, no radio build).

From 45fa8b6c6fae0aa82b392e3c4a5a645f2c58aac3 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 08:56:34 -0400
Subject: [PATCH 55/60] feat(neode-ui): seed & entropy explainer page at
 /entropy/ + link from Backup settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Standalone static guide (same pattern as /architecture/) covering how the
master seed entropy is drawn (explicit OsRng, sealed KeyGenRng allowlist,
degenerate-draw refusal, CSPRNG readiness ledger), how it is stored
(Argon2 + ChaCha20-Poly1305 envelope), the full derivation tree (HKDF
labels, NIP-06, LND aezeed one-way gate, second-order keys), what is NOT
seed-derived, every failure/fallback path, and the restore flow — in
paired layman/technical language. Linked from the Recovery-phrase card
in Settings → Backup. CSP-safe: no inline scripts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 neode-ui/public/entropy/index.html            | 1019 +++++++++++++++++
 neode-ui/src/views/settings/BackupSection.vue |    9 +
 2 files changed, 1028 insertions(+)
 create mode 100644 neode-ui/public/entropy/index.html

diff --git a/neode-ui/public/entropy/index.html b/neode-ui/public/entropy/index.html
new file mode 100644
index 00000000..d003abf0
--- /dev/null
+++ b/neode-ui/public/entropy/index.html
@@ -0,0 +1,1019 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Archipelago — Seed &amp; Entropy Guide</title>
+<style>
+  :root {
+    --bg: #000000;
+    --glass-card: rgba(0, 0, 0, 0.65);
+    --glass-dark: rgba(0, 0, 0, 0.35);
+    --glass-darker: rgba(0, 0, 0, 0.6);
+    --glass-border: rgba(255, 255, 255, 0.18);
+    --glass-highlight: rgba(255, 255, 255, 0.22);
+    --glass-blur: 18px;
+    --glass-blur-strong: 24px;
+    --shadow-glass: 0 8px 24px rgba(0, 0, 0, 0.45);
+    --shadow-glass-inset: inset 0 1px 0 rgba(255, 255, 255, 0.22);
+    --text: rgba(255, 255, 255, 0.9);
+    --text-muted: rgba(255, 255, 255, 0.6);
+    --accent: #fb923c;
+    --accent-dim: rgba(251, 146, 60, 0.15);
+    --green: #4ade80;
+    --green-dim: rgba(74, 222, 128, 0.15);
+    --red: #ef4444;
+    --red-dim: rgba(239, 68, 68, 0.12);
+    --blue: #3b82f6;
+    --blue-dim: rgba(59, 130, 246, 0.12);
+    --yellow: #facc15;
+    --yellow-dim: rgba(250, 204, 21, 0.12);
+    --purple: #a78bfa;
+    --purple-dim: rgba(167, 139, 250, 0.12);
+    --radius: 16px;
+    --radius-sm: 12px;
+    --transition: 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+  }
+
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+
+  html { scroll-behavior: smooth; }
+
+  body {
+    font-family: 'Avenir Next', system-ui, -apple-system, sans-serif;
+    background: var(--bg);
+    color: var(--text);
+    line-height: 1.7;
+    font-size: 16px;
+  }
+
+  nav {
+    position: fixed;
+    top: 0; left: 0;
+    width: 280px;
+    height: 100vh;
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur-strong));
+    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
+    border-right: 1px solid var(--glass-border);
+    box-shadow: var(--shadow-glass);
+    overflow-y: auto;
+    padding: 24px 0;
+    z-index: 100;
+    scrollbar-width: thin;
+    scrollbar-color: rgba(255,255,255,0.15) transparent;
+  }
+  nav .logo { padding: 0 24px 20px; margin-bottom: 16px; }
+  nav .logo h1 {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 18px; font-weight: 700;
+    color: var(--accent); letter-spacing: -0.02em;
+  }
+  nav .logo p { font-size: 12px; color: var(--text-muted); margin-top: 4px; }
+  nav .nav-section {
+    padding: 12px 16px 4px;
+    font-size: 10px; font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.1em;
+    color: var(--text-muted);
+  }
+  nav a {
+    display: block;
+    padding: 6px 24px;
+    color: var(--text-muted);
+    text-decoration: none;
+    font-size: 13px;
+    transition: all var(--transition);
+    border-left: 2px solid transparent;
+  }
+  nav a:hover, nav a.active {
+    color: var(--text);
+    background: rgba(255, 255, 255, 0.06);
+    border-left-color: var(--accent);
+  }
+
+  main {
+    margin-left: 280px;
+    max-width: 960px;
+    padding: 48px 48px 120px;
+  }
+
+  h2 {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 28px; font-weight: 700;
+    margin: 64px 0 8px;
+    padding-top: 24px;
+    color: var(--text);
+    letter-spacing: -0.02em;
+  }
+  h2:first-of-type { margin-top: 0; }
+  h3 {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 20px; font-weight: 600;
+    margin: 40px 0 12px;
+    color: var(--text);
+  }
+  h4 {
+    font-size: 16px; font-weight: 600;
+    margin: 24px 0 8px;
+    color: var(--accent);
+  }
+  p { margin: 8px 0 16px; color: var(--text); }
+  ul, ol { margin: 8px 0 16px 24px; color: var(--text); }
+  li { margin: 4px 0; }
+
+  .subtitle {
+    font-size: 15px;
+    color: var(--text-muted);
+    margin-bottom: 32px;
+  }
+
+  .hero { text-align: center; padding: 48px 0 56px; margin-bottom: 24px; }
+  .hero h1 {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 42px; font-weight: 800;
+    background: linear-gradient(135deg, var(--accent), #f59e0b);
+    -webkit-background-clip: text;
+    -webkit-text-fill-color: transparent;
+    letter-spacing: -0.03em;
+  }
+  .hero .tagline {
+    font-size: 18px;
+    color: var(--text-muted);
+    margin: 12px auto 0;
+    max-width: 640px;
+  }
+  .hero .meta {
+    margin-top: 20px;
+    display: flex; gap: 16px;
+    justify-content: center; flex-wrap: wrap;
+  }
+  .hero .meta span {
+    font-size: 12px;
+    padding: 4px 12px;
+    border-radius: 999px;
+    background: var(--glass-dark);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    color: var(--text-muted);
+  }
+
+  .card {
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
+    border-radius: var(--radius);
+    padding: 24px;
+    margin: 16px 0;
+  }
+  .card-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+    gap: 16px;
+    margin: 16px 0;
+  }
+  .card-sm {
+    background: var(--glass-darker);
+    backdrop-filter: blur(var(--glass-blur-strong));
+    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
+    border: 1px solid var(--glass-border);
+    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
+    border-radius: var(--radius);
+    padding: 16px 20px;
+    transition: transform var(--transition), box-shadow var(--transition);
+  }
+  .card-sm:hover {
+    transform: translateY(-2px);
+    box-shadow: 0 12px 32px rgba(0, 0, 0, 0.6), inset 0 1px 0 rgba(255, 255, 255, 0.25);
+  }
+  .card-sm h4 { margin: 0 0 6px; font-size: 14px; }
+  .card-sm p { font-size: 13px; color: var(--text-muted); margin: 0; }
+
+  .badge {
+    display: inline-block;
+    font-size: 11px; font-weight: 600;
+    padding: 2px 10px;
+    border-radius: 999px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+  }
+  .badge-green { background: var(--green-dim); color: var(--green); }
+  .badge-red { background: var(--red-dim); color: var(--red); }
+  .badge-yellow { background: var(--yellow-dim); color: var(--yellow); }
+  .badge-blue { background: var(--blue-dim); color: var(--blue); }
+  .badge-purple { background: var(--purple-dim); color: var(--purple); }
+  .badge-accent { background: var(--accent-dim); color: var(--accent); }
+
+  table {
+    width: 100%;
+    border-collapse: separate;
+    border-spacing: 0;
+    margin: 16px 0;
+    font-size: 13px;
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-sm);
+    overflow: hidden;
+    box-shadow: var(--shadow-glass);
+  }
+  th {
+    text-align: left;
+    padding: 10px 14px;
+    background: rgba(0, 0, 0, 0.4);
+    color: var(--text-muted);
+    font-weight: 600;
+    font-size: 11px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    border-bottom: 1px solid var(--glass-border);
+  }
+  td {
+    padding: 10px 14px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+    vertical-align: top;
+  }
+  tr:last-child td { border-bottom: none; }
+  tr:hover td { background: rgba(255, 255, 255, 0.04); }
+
+  code {
+    font-family: 'Menlo', 'Monaco', 'Courier New', monospace;
+    font-size: 13px;
+    background: rgba(0, 0, 0, 0.4);
+    padding: 2px 6px;
+    border-radius: 4px;
+    color: var(--accent);
+  }
+  pre {
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-sm);
+    padding: 20px;
+    overflow-x: auto;
+    margin: 16px 0;
+    font-size: 13px;
+    line-height: 1.6;
+    box-shadow: var(--shadow-glass);
+  }
+  pre code { background: none; padding: 0; color: var(--text); }
+
+  .diagram {
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur-strong));
+    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
+    border: 1px solid var(--glass-border);
+    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
+    border-radius: var(--radius);
+    padding: 24px;
+    margin: 20px 0;
+    overflow-x: auto;
+    font-family: 'Menlo', 'Monaco', monospace;
+    font-size: 13px;
+    line-height: 1.5;
+    color: var(--text-muted);
+    white-space: pre;
+  }
+  .diagram .highlight { color: var(--accent); font-weight: 600; }
+  .diagram .green { color: var(--green); }
+  .diagram .blue { color: var(--blue); }
+  .diagram .red { color: var(--red); }
+  .diagram .purple { color: var(--purple); }
+  .diagram .yellow { color: var(--yellow); }
+
+  .callout {
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-sm);
+    padding: 16px 20px;
+    margin: 16px 0;
+    font-size: 14px;
+    border-left: 3px solid;
+    box-shadow: var(--shadow-glass);
+  }
+  .callout-info { border-color: var(--blue); }
+  .callout-warn { border-color: var(--yellow); }
+  .callout-danger { border-color: var(--red); }
+  .callout-success { border-color: var(--green); }
+  .callout-learn {
+    border-color: var(--purple);
+    background: rgba(167, 139, 250, 0.06);
+    position: relative;
+    padding-top: 32px;
+  }
+  .callout-learn::before {
+    content: 'In Plain Words';
+    position: absolute;
+    top: 10px; left: 20px;
+    font-size: 10px;
+    font-weight: 700;
+    letter-spacing: 0.1em;
+    text-transform: uppercase;
+    color: var(--purple);
+  }
+  .callout strong { display: block; margin-bottom: 4px; }
+
+  .score-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+    gap: 12px;
+    margin: 20px 0;
+  }
+  .score-card {
+    background: var(--glass-darker);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
+    border-radius: var(--radius);
+    padding: 16px;
+    text-align: center;
+    transition: transform var(--transition);
+  }
+  .score-card:hover { transform: translateY(-2px); }
+  .score-card .score {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 28px; font-weight: 800;
+    margin: 4px 0;
+    color: var(--accent);
+  }
+  .score-card .label {
+    font-size: 11px;
+    color: var(--text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+  }
+
+  .steps { counter-reset: step; margin: 20px 0; }
+  .step {
+    position: relative;
+    padding: 16px 20px 16px 64px;
+    margin: 12px 0;
+    background: var(--glass-card);
+    backdrop-filter: blur(var(--glass-blur));
+    -webkit-backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-sm);
+    box-shadow: var(--shadow-glass);
+    counter-increment: step;
+  }
+  .step::before {
+    content: counter(step);
+    position: absolute;
+    left: 18px; top: 50%;
+    transform: translateY(-50%);
+    width: 30px; height: 30px;
+    border-radius: 50%;
+    background: var(--accent-dim);
+    color: var(--accent);
+    font-weight: 700;
+    font-size: 14px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    line-height: 30px;
+    text-align: center;
+  }
+  .step h4 { margin: 0 0 4px; }
+  .step p { margin: 0; font-size: 13px; color: var(--text-muted); }
+
+  hr {
+    border: none;
+    border-top: 1px solid var(--glass-border);
+    margin: 48px 0;
+  }
+
+  @media (max-width: 900px) {
+    nav { display: none; }
+    main { margin-left: 0; padding: 20px; }
+    .hero h1 { font-size: 32px; }
+  }
+</style>
+</head>
+<body>
+
+<nav>
+  <div class="logo">
+    <h1>Archipelago</h1>
+    <p>Seed &amp; Entropy Guide</p>
+  </div>
+
+  <div class="nav-section">Overview</div>
+  <a href="#intro">Introduction</a>
+  <a href="#big-picture">The Big Picture</a>
+
+  <div class="nav-section">Creation</div>
+  <a href="#randomness">Where Randomness Comes From</a>
+  <a href="#when">When the Seed Is Born</a>
+  <a href="#guardrails">The Five Guardrails</a>
+  <a href="#hardening">Recent Hardening</a>
+
+  <div class="nav-section">Storage</div>
+  <a href="#storage">What's Kept on Disk</a>
+  <a href="#envelope">The Encrypted Envelope</a>
+
+  <div class="nav-section">Derivation</div>
+  <a href="#tree">The Derivation Tree</a>
+  <a href="#lightning">The Lightning Special Case</a>
+  <a href="#second-order">Second-Order Keys</a>
+  <a href="#independent">What Is NOT Derived</a>
+
+  <div class="nav-section">Failure &amp; Recovery</div>
+  <a href="#failures">Failure Modes &amp; Fallbacks</a>
+  <a href="#restore">The Restore Flow</a>
+  <a href="#comes-back">What Comes Back (and What Doesn't)</a>
+  <a href="#seedqr">SeedQR</a>
+
+  <div class="nav-section">Assurance</div>
+  <a href="#limitations">Honest Edges</a>
+  <a href="#verify">Verify It Yourself</a>
+</nav>
+
+<main>
+
+<div class="hero">
+  <h1>Your Node's Seed &amp; Entropy</h1>
+  <p class="tagline">How 32 random bytes become every key your node owns — where that randomness comes from, what protects it, and exactly what your 24 words can (and cannot) bring back.</p>
+  <div class="meta">
+    <span>256-bit entropy</span>
+    <span>BIP-39 · 24 words</span>
+    <span>HKDF-SHA256 derivation</span>
+    <span>Kernel CSPRNG only</span>
+    <span>KEY-05 hardened</span>
+  </div>
+</div>
+
+<h2 id="intro">Introduction</h2>
+<p class="subtitle">One master secret, many keys — by design.</p>
+
+<p>
+Almost everything cryptographic on this node — its identity, its Nostr keys, its mesh
+transport keys, its Lightning wallet — grows from a <strong>single master seed</strong>:
+32 bytes (256 bits) of randomness drawn once, shown to you once as a 24-word recovery
+phrase, and never stored in raw form anywhere.
+</p>
+
+<div class="callout callout-learn">
+  <strong>The tree and the acorn</strong>
+  Think of the seed as an acorn. Every branch of the tree — your identity, your wallet,
+  your mesh radio's name — grows from it in a fixed, repeatable pattern. Plant the same
+  acorn on new hardware (by typing your 24 words) and the <em>same tree</em> grows back,
+  branch for branch. That's why those words are the single most valuable thing your node
+  ever shows you — and why anyone who copies them owns your tree.
+</div>
+
+<p>
+This page explains, in both plain and technical language: where those 32 bytes come from,
+the guardrails that make sure they're genuinely random, how they're protected on disk,
+everything that is derived from them, everything that deliberately <em>isn't</em>, and
+what happens in every failure and recovery scenario.
+</p>
+
+<h2 id="big-picture">The Big Picture</h2>
+<p class="subtitle">From kernel randomness to every key on the node.</p>
+
+<div class="diagram">
+<span class="blue">Linux kernel CSPRNG</span>  (hardware noise: interrupts, timing jitter, CPU RNG)
+        │
+        │  getrandom(2) — via an explicitly named <span class="highlight">OsRng</span>, nothing else allowed
+        ▼
+<span class="highlight">32 bytes of raw entropy</span>  ──▶  degenerate-draw check ──▶ <span class="red">refuse &amp; wipe if suspicious</span>
+        │
+        │  BIP-39 encoding
+        ▼
+<span class="green">24-word recovery phrase</span>   ←── the only form you ever see or back up
+        │
+        │  PBKDF2-HMAC-SHA512 × 2048 (empty passphrase)
+        ▼
+<span class="highlight">64-byte master seed</span>       ←── lives only in RAM, never written to disk
+        │
+        ├── HKDF "archipelago/node/ed25519/v1"      ──▶ <span class="green">Node identity key + DID</span>
+        ├── HKDF "archipelago/nostr-node/…/v1"      ──▶ <span class="purple">Node Nostr key (npub)</span>
+        ├── HKDF "archipelago/fips/secp256k1/v1"    ──▶ <span class="blue">FIPS mesh transport key</span>
+        ├── HKDF "archipelago/identity/{i}/…/v1"    ──▶ <span class="green">Personal identities (Ed25519)</span>
+        ├── BIP-32 m/44'/1237'/0'/0/{i}  (NIP-06)   ──▶ <span class="purple">Personal Nostr keys</span>
+        ├── HKDF "archipelago/lnd/entropy/v1"       ──▶ <span class="yellow">Lightning wallet entropy → aezeed</span>
+        └── BIP-32 m/84'/0'/0'                      ──▶ <span class="yellow">Bitcoin xprv (dormant, reserved)</span>
+                    │
+                    │  and from the node identity key, second-order:
+                    ▼
+        ├── <span class="blue">Reticulum / RNS mesh identity</span>  (HKDF, salt "archipelago-reticulum-identity-v1")
+        ├── <span class="green">Message-store encryption key</span>   (SHA-256 domain-separated)
+        ├── <span class="green">Mesh-contacts encryption key</span>   (SHA-256 domain-separated)
+        └── <span class="green">Credential-store key</span>           (SHA-256 domain-separated)
+</div>
+
+<div class="callout callout-info">
+  <strong>One rule to remember</strong>
+  If it's on the diagram above, your 24 words can rebuild it from scratch, on any hardware,
+  forever. If it's not on the diagram (session tokens, app passwords, WireGuard keys,
+  the Lightning channel state…), it's independent randomness — protected by other backups,
+  not by the words.
+</div>
+
+<h2 id="randomness">Where Randomness Comes From</h2>
+<p class="subtitle">One named source. No mixing. No silent defaults.</p>
+
+<div class="callout callout-learn">
+  <strong>Dice you can audit</strong>
+  Computers can't invent randomness — they collect it. The Linux kernel constantly harvests
+  unpredictable physical noise (the exact nanosecond your network card interrupts, timing
+  jitter between CPU cores, the CPU's built-in hardware random generator) and distils it
+  into a cryptographic random pool. Archipelago rolls its dice by asking that pool
+  directly — and <em>only</em> that pool. There is deliberately no "mixing" of other
+  sources, because a single, named, well-studied source is auditable; a blend of
+  sources is a place for bugs to hide.
+</div>
+
+<h3>Technically</h3>
+<p>
+The master seed is generated by <code>MasterSeed::generate()</code> in
+<code>core/archipelago/src/seed.rs</code>. It fills a 32-byte buffer using
+<code>rand::rngs::OsRng</code> — a thin wrapper around the
+<code>getrandom(2)</code> system call, which reads the kernel's CSPRNG
+(the same source as <code>/dev/urandom</code>, but immune to file-descriptor
+exhaustion and chroot tricks).
+</p>
+
+<ul>
+  <li><strong>Exactly 32 bytes / 256 bits</strong> — the maximum BIP-39 strength, encoding to 24 words.</li>
+  <li><strong>The RNG is named at the call site.</strong> No function anywhere in the codebase generates key material with a "default" or implicit RNG anymore (see <a href="#hardening">Recent Hardening</a> for why this is stated so emphatically).</li>
+  <li><strong>The RNG type is compiler-enforced.</strong> Key-generation functions only accept RNGs on a <em>sealed allowlist</em> (<code>KeyGenRng</code> in <code>core/archipelago/src/entropy.rs</code>). The list has exactly one production member: <code>OsRng</code>. No other module — not even a future refactor — can add a weaker RNG without editing the allowlist file itself.</li>
+  <li><strong>The buffer is zeroized</strong> (securely wiped from memory) on every path, success or failure.</li>
+</ul>
+
+<pre><code>// core/archipelago/src/seed.rs — the actual draw
+let mut entropy = [0u8; 32];
+crate::entropy::draw_key_bytes(&amp;mut rand::rngs::OsRng, &amp;mut entropy)?;  // guarded draw
+let mnemonic = bip39::Mnemonic::from_entropy(&amp;entropy)?;               // → 24 words
+entropy.zeroize();                                                      // wipe the raw bytes</code></pre>
+
+<p>
+The 24 words are then stretched into the 64-byte master seed using standard BIP-39:
+<code>PBKDF2-HMAC-SHA512</code>, 2048 rounds, empty passphrase. (There is no "25th word"
+passphrase — your login password protects the stored backup instead, see
+<a href="#envelope">The Encrypted Envelope</a>.) That 64-byte seed exists
+<strong>only in memory</strong>, is re-computed from the words whenever needed, and is
+never written to disk in any form.
+</p>
+
+<h2 id="when">When the Seed Is Born</h2>
+<p class="subtitle">At onboarding — not at first boot.</p>
+
+<div class="steps">
+  <div class="step">
+    <h4>First boot: a placeholder key</h4>
+    <p>A freshly-flashed node boots with a random <em>temporary</em> identity key so services can start. This key is NOT seed-derived and is about to be thrown away.</p>
+  </div>
+  <div class="step">
+    <h4>Onboarding: the real draw</h4>
+    <p>When you reach the "Recovery phrase" step of setup, the <code>seed.generate</code> RPC performs the guarded 32-byte draw described above and shows you the 24 words — the only time they're ever displayed unprompted.</p>
+  </div>
+  <div class="step">
+    <h4>Derivation: keys are materialised</h4>
+    <p>The node identity key, DID, Nostr key, FIPS mesh key, and your first personal identity are all derived from the seed and written to <code>/var/lib/archipelago/identity/</code> (each file mode 0600). The placeholder key from step 1 is overwritten.</p>
+  </div>
+  <div class="step">
+    <h4>Password setup: the backup is sealed</h4>
+    <p>When you set your login password, the 24 words are encrypted under it (Argon2 + ChaCha20-Poly1305) and stored as <code>master_seed.enc</code> — so you can re-reveal them later from Settings → Backup.</p>
+  </div>
+</div>
+
+<div class="callout callout-info">
+  <strong>Refresh-proof by design</strong>
+  If the onboarding page is retried within 10 minutes (browser refresh, flaky connection),
+  the node returns the <em>same</em> words instead of minting a second seed. Generation is
+  serialised behind a lock — there is no window where two competing seeds can exist.
+</div>
+
+<h2 id="guardrails">The Five Guardrails</h2>
+<p class="subtitle">Defence in depth around a single random draw.</p>
+
+<div class="card-grid">
+  <div class="card-sm">
+    <h4><span class="badge badge-accent">1</span> &nbsp;Sealed RNG allowlist</h4>
+    <p>Key draws only compile against RNG types on a closed, private allowlist. Production allowlist: <code>OsRng</code>. Full stop. A refactor that swaps in a weak or deterministic RNG becomes a <em>compile error</em>, not a silent disaster.</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-accent">2</span> &nbsp;Degenerate-draw refusal</h4>
+    <p>Every draw is inspected for three tell-tale broken-RNG shapes: all zeros, all bytes identical, or a counting pattern. A match is <strong>refused and wiped — never retried</strong>, because retrying would mask a broken RNG instead of exposing it.</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-accent">3</span> &nbsp;CSPRNG readiness ledger</h4>
+    <p>Before generating the seed, the node probes whether the kernel's random pool is fully initialised, and appends the verdict to a tamper-evident, append-only log at <code>security/csprng-readiness.jsonl</code> (0600). You can audit, forever, the entropy conditions your seed was born under.</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-accent">4</span> &nbsp;Build-time lint bans</h4>
+    <p>The CI lint config bans <code>rand::random()</code> and <code>rand::thread_rng()</code> outright across the workspace — the two "convenient" RNG entry points that caused real-world wallet disasters elsewhere. Using either fails the build.</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-accent">5</span> &nbsp;Zeroization everywhere</h4>
+    <p>Raw entropy, mnemonics, and derived secrets are wiped from memory on every code path — including error paths — so key material doesn't linger in freed RAM or end up in crash dumps.</p>
+  </div>
+</div>
+
+<div class="callout callout-learn">
+  <strong>Why so paranoid about one function?</strong>
+  In 2026 a well-known hardware wallet shipped a bug where a code refactor quietly switched
+  seed generation to a <em>predictable</em> random source — with no error, no warning, and
+  seeds that looked perfectly normal. Predictable randomness is invisible: the words look
+  random, the wallet works, and months later someone who can predict the generator drains
+  it. Archipelago's answer is to make that entire class of bug <em>impossible to compile</em>,
+  and to log the health of the random pool at the exact moment your seed was created.
+</div>
+
+<h3>What the degenerate check does — and doesn't — do</h3>
+<p>
+The check (<code>is_degenerate</code> in <code>entropy.rs</code>) is deliberately
+<em>closed-form</em>: it recognises exactly three catastrophic failure shapes
+(all-zero, all-identical, ±1 counter). It is <strong>not</strong> a statistical entropy
+estimator — those can't actually distinguish good randomness from a cleverly broken RNG,
+and they introduce false positives. The real security load is carried by guardrails 1,
+3 and 4; the degenerate check is a tripwire for total RNG failure (e.g. a zeroed buffer
+that was never filled).
+</p>
+
+<h2 id="hardening">Recent Hardening (the KEY-05 work)</h2>
+<p class="subtitle">This system was audited and rebuilt in early August 2026.</p>
+
+<p>
+Triggered by the COLDCARD-class of entropy defects, a full entropy &amp; seed-generation
+audit (<code>docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md</code>) reviewed every random
+draw in the codebase. The headline finding: the library used for mnemonic generation was
+silently choosing its own RNG via a transitive default. It happened to be a secure one —
+but nothing <em>guaranteed</em> that, and a dependency update could have changed it
+without any diff in Archipelago's own code.
+</p>
+
+<table>
+  <tr><th>Date</th><th>Change</th></tr>
+  <tr><td>Jul 30</td><td>Kernel CSPRNG readiness probe added; RNG non-determinism regression test (64 consecutive mnemonics must all be unique).</td></tr>
+  <tr><td>Jul 31</td><td>Full entropy audit published (findings F-01…F-13).</td></tr>
+  <tr><td>Aug 1</td><td><strong>The pivotal fix:</strong> master-seed RNG made explicit — <code>OsRng</code> named at the call site, injected through a testable seam, pinned by a known-answer test.</td></tr>
+  <tr><td>Aug 2</td><td>Audit widened: 43 defaulted-RNG call sites across 15 files found and migrated to explicit <code>OsRng</code> — including AEAD nonces and ecash key material.</td></tr>
+  <tr><td>Aug 2</td><td>Onboarding RPCs gated: <code>seed.restore</code> and friends now refuse on an already-provisioned node (previously an unauthenticated restore call could hijack a live node — fixed before any release shipped it).</td></tr>
+  <tr><td>Aug 2</td><td>KEY-05 enforcement layer landed: sealed <code>KeyGenRng</code> allowlist, guarded draws, durable readiness ledger, clippy bans, supply-chain version pinning on the <code>rand</code> crate.</td></tr>
+  <tr><td>Aug 2</td><td>Legacy Bitcoin Core wallet-import path deleted — the master xprv is no longer handed to any external wallet process.</td></tr>
+</table>
+
+<h2 id="storage">What's Kept on Disk</h2>
+<p class="subtitle">The words, encrypted — and the keys, materialised. Never the raw seed.</p>
+
+<table>
+  <tr><th>File</th><th>Contents</th><th>Protection</th></tr>
+  <tr><td><code>identity/master_seed.enc</code></td><td>Your 24 words (as text), encrypted</td><td>Argon2(login password) + ChaCha20-Poly1305, mode 0600</td></tr>
+  <tr><td><code>identity/node_key</code> / <code>.pub</code></td><td>Node Ed25519 identity key</td><td>0600, seed-derived (recoverable from words)</td></tr>
+  <tr><td><code>identity/nostr_secret</code> / <code>nostr_pubkey</code></td><td>Node Nostr keypair</td><td>0600, seed-derived</td></tr>
+  <tr><td><code>identity/fips_key</code> / <code>.pub</code></td><td>FIPS mesh transport key (bech32 nsec)</td><td>0600, seed-derived</td></tr>
+  <tr><td><code>identity/identity_index</code></td><td>Next unused identity derivation index</td><td>Plain integer (not secret)</td></tr>
+  <tr><td><code>identities/&lt;uuid&gt;.json</code></td><td>Personal identity records (keys + metadata)</td><td>0600; keys seed-derived, <em>metadata is not</em></td></tr>
+  <tr><td><code>identity/lnd_aezeed.enc</code></td><td>Lightning wallet's own seed (see <a href="#lightning">below</a>)</td><td>Encrypted under the LND wallet password</td></tr>
+  <tr><td><code>security/csprng-readiness.jsonl</code></td><td>Append-only entropy audit trail</td><td>0600; deliberately outside <code>identity/</code> so restores never touch it</td></tr>
+</table>
+
+<div class="callout callout-success">
+  <strong>The raw seed never touches disk</strong>
+  What's stored is the <em>encrypted words</em> and the <em>derived keys</em>. The 64-byte
+  master seed itself is recomputed in RAM from the words when needed (e.g. during restore
+  or identity creation) and wiped afterwards.
+</div>
+
+<h2 id="envelope">The Encrypted Envelope</h2>
+<p class="subtitle">How <code>master_seed.enc</code> is built.</p>
+
+<div class="diagram">
+your login password ──▶ <span class="highlight">Argon2id</span> (memory-hard KDF) ──▶ 256-bit file key
+                            ▲
+                    16-byte random salt
+
+24 words ──▶ <span class="highlight">ChaCha20-Poly1305</span> (authenticated encryption, 12-byte random nonce)
+                            │
+                            ▼
+        ┌───────────┬────────────┬──────────────────────────────┐
+        │ salt (16) │ nonce (12) │ ciphertext + auth tag        │   = master_seed.enc
+        └───────────┴────────────┴──────────────────────────────┘
+</div>
+
+<div class="callout callout-learn">
+  <strong>A safe inside a safe</strong>
+  Your words are locked in a digital safe whose combination is your login password —
+  but run through a deliberately slow, memory-hungry grinder (Argon2) so that guessing
+  billions of passwords per second is physically impractical, even for someone who steals
+  the file. The "auth tag" means the safe also notices if anyone has tampered with its
+  contents: a corrupted or modified file fails loudly rather than yielding wrong words.
+</div>
+
+<p>
+Revealing the words later (Settings → Backup → <em>Reveal</em>) requires an authenticated
+session <em>plus</em> re-entering your password <em>plus</em> your 2FA code if enabled,
+is rate-limited, and the words are returned only to your browser — never written to logs.
+</p>
+
+<h2 id="tree">The Derivation Tree</h2>
+<p class="subtitle">Every key, its exact derivation, and where it lands.</p>
+
+<div class="callout callout-learn">
+  <strong>One password, many doors — without reuse</strong>
+  The node never uses the master seed directly as a key. Instead it uses HKDF — think of it
+  as a locksmith who, given one master blank and a <em>label</em> ("node key", "mesh key",
+  "Lightning entropy"…), cuts a completely different, unrelated key for each label. Knowing
+  one cut key tells you nothing about the others or about the blank. The labels are fixed
+  strings baked into the code, which is what makes regrowing the identical tree on new
+  hardware possible.
+</div>
+
+<table>
+  <tr><th>Key</th><th>Derivation</th><th>Label / path</th><th>Materialised at</th></tr>
+  <tr><td><strong>Node identity (Ed25519)</strong> — signs everything, forms your DID</td><td>HKDF-SHA256</td><td><code>archipelago/node/ed25519/v1</code></td><td><code>identity/node_key</code></td></tr>
+  <tr><td><strong>Node Nostr key (secp256k1)</strong> — the node's npub</td><td>HKDF-SHA256</td><td><code>archipelago/nostr-node/secp256k1/v1</code></td><td><code>identity/nostr_secret</code></td></tr>
+  <tr><td><strong>FIPS mesh transport key</strong> — federation/mesh overlay identity</td><td>HKDF-SHA256</td><td><code>archipelago/fips/secp256k1/v1</code></td><td><code>identity/fips_key</code></td></tr>
+  <tr><td><strong>Personal identity #i (Ed25519)</strong></td><td>HKDF-SHA256</td><td><code>archipelago/identity/{i}/ed25519/v1</code></td><td><code>identities/&lt;uuid&gt;.json</code></td></tr>
+  <tr><td><strong>Personal Nostr key #i</strong> — standard NIP-06, importable into other Nostr apps</td><td>BIP-32</td><td><code>m/44'/1237'/0'/0/{i}</code></td><td><code>identities/&lt;uuid&gt;.json</code></td></tr>
+  <tr><td><strong>Lightning (LND) wallet entropy</strong> — 16 bytes</td><td>HKDF-SHA256</td><td><code>archipelago/lnd/entropy/v1</code></td><td>fed into LND at wallet init (see below)</td></tr>
+  <tr><td><strong>Bitcoin BIP-84 account xprv</strong> — native-segwit</td><td>BIP-32</td><td><code>m/84'/0'/0'</code></td><td><em>nowhere</em> — dormant, reserved for a future on-node cold vault</td></tr>
+  <tr><td><strong>Release-root signing key</strong> — fleet update signing</td><td>HKDF-SHA256</td><td><code>archipelago/release/root/ed25519/v1</code></td><td><em>never on a node</em> — derived offline by the publisher from a separate release mnemonic; nodes only pin the public key</td></tr>
+</table>
+
+<p>
+All HKDF derivations are HKDF-SHA256 with a distinct, versioned info-label (the
+<code>/v1</code> suffix means a future algorithm migration can introduce
+<code>/v2</code> labels without ambiguity). Personal Nostr keys intentionally use the
+NIP-06 standard path instead of HKDF so that <em>the same 24 words typed into any
+NIP-06-compliant Nostr client reproduce the same npub</em> — your social identity is
+portable beyond Archipelago.
+</p>
+
+<h2 id="lightning">The Lightning Special Case</h2>
+<p class="subtitle">The one branch of the tree with a one-way gate in it.</p>
+
+<div class="diagram">
+master seed ──HKDF──▶ 16 bytes of entropy ──▶ <span class="yellow">LND generates its own "aezeed"</span> ──▶ Lightning wallet
+                                                        │
+                                                        │  ⚠ one-way: the aezeed cannot be
+                                                        │    recomputed from your 24 words later
+                                                        ▼
+                                       captured ONCE at wallet init and stored as
+                                       <span class="highlight">identity/lnd_aezeed.enc</span> (encrypted)
+</div>
+
+<p>
+LND (the Lightning node) uses its own seed format called <em>aezeed</em>, which is not
+BIP-39. Archipelago derives deterministic entropy from your master seed and hands it to
+LND at wallet-creation time — but LND then wraps it with its own internal random salt,
+so the resulting aezeed <strong>cannot be re-derived from your 24 words afterwards</strong>.
+The node therefore captures the aezeed exactly once, at init, and stores it encrypted
+alongside your other identity files. The Lightning seed backup screen shows it to you
+with the same tap-to-reveal flow as the main phrase.
+</p>
+
+<div class="callout callout-warn">
+  <strong>Back up the Lightning seed separately</strong>
+  Your 24 words alone restore your node identity and on-chain derivations — but
+  <em>not</em> an already-initialised Lightning wallet, and never the off-chain channel
+  balances (those additionally need channel backups, which Lightning requires by design).
+  Treat the LND aezeed shown in the Lightning app's backup screen as a second phrase
+  worth writing down. Note it restores into LND-based wallets (Zeus, Blixt, another
+  Archipelago node) — hardware wallets can't import it.
+</div>
+
+<h2 id="second-order">Second-Order Keys</h2>
+<p class="subtitle">Derived from the node key — so still fully recoverable from the words.</p>
+
+<p>
+Several subsystems derive their keys from the <em>node identity key</em> rather than the
+master seed directly. Since the node key is itself seed-derived, these all regrow from
+your 24 words too — the chain is <code>words → master seed → node key → subsystem key</code>.
+</p>
+
+<table>
+  <tr><th>Subsystem</th><th>Derivation from <code>node_key</code></th></tr>
+  <tr><td><strong>Reticulum / RNS mesh identity</strong> (LoRa long-range mesh)</td><td>HKDF-SHA256, salt <code>archipelago-reticulum-identity-v1</code>, two labels for the X25519 + Ed25519 halves — yields a stable LXMF address that survives reinstalls</td></tr>
+  <tr><td><strong>Message-store encryption</strong> (chats at rest)</td><td><code>SHA-256("archipelago-message-store-v1" ‖ node_key)</code></td></tr>
+  <tr><td><strong>Mesh contacts encryption</strong></td><td><code>SHA-256("archipelago-mesh-contacts-v1" ‖ node_key)</code></td></tr>
+  <tr><td><strong>Credential store</strong> (saved app credentials)</td><td>Same domain-separated SHA-256 pattern</td></tr>
+</table>
+
+<div class="callout callout-learn">
+  <strong>Domain separation, in one sentence</strong>
+  Each purpose prefixes a unique fixed string before hashing, so even though they start
+  from the same node key, every subsystem ends up with an unrelated key — compromising
+  one never exposes another.
+</div>
+
+<h2 id="independent">What Is NOT Derived From the Seed</h2>
+<p class="subtitle">Independent randomness — deliberately outside the tree.</p>
+
+<p>
+Plenty of secrets are <em>freshly random</em> rather than seed-derived. That's intentional:
+things that should die with a session, rotate freely, or belong to a third-party app must
+not be recoverable from your words (and mostly you wouldn't want them to be).
+</p>
+
+<div class="card-grid">
+  <div class="card-sm">
+    <h4>Ephemeral by design</h4>
+    <p>Session tokens, device/companion pairing tokens, federation invites, TOTP/2FA secrets and backup codes, all encryption nonces, X3DH ephemeral mesh keys, anonymous marketplace/discovery Nostr keys.</p>
+  </div>
+  <div class="card-sm">
+    <h4>App-owned secrets</h4>
+    <p>Every manifest-declared <code>generated_secret</code> (app database passwords, API keys), Bitcoin RPC credentials, the LND wallet <em>password</em> (distinct from its seed), Home Assistant tokens.</p>
+  </div>
+  <div class="card-sm">
+    <h4>Host-level material</h4>
+    <p>WireGuard VPN keypairs (generated by <code>wg genkey</code>), SSH host keys and the TLS certificate (created by the installer image at first boot), the machine-id.</p>
+  </div>
+  <div class="card-sm">
+    <h4>Opt-outs from derivability</h4>
+    <p>Extra identities created with "new random key" instead of seed derivation, and a node key after an explicit <code>rotate-key</code> — rotation <em>deliberately</em> breaks the link to the words, and says so.</p>
+  </div>
+</div>
+
+<div class="callout callout-info">
+  <strong>Consequence for backups</strong>
+  A seed-only restore brings back everything in the derivation tree but none of the above.
+  App data, chat history and app secrets travel via the separate node backup/restore
+  feature; Lightning channels need channel backups; VPN peers re-pair. Your words are your
+  <em>identity's</em> lifeboat, not a full-system image.
+</div>
+
+<h2 id="failures">Failure Modes &amp; Fallbacks</h2>
+<p class="subtitle">What happens when something goes wrong — at every stage.</p>
+
+<table>
+  <tr><th>Scenario</th><th>Behaviour</th><th>Outcome</th></tr>
+  <tr>
+    <td>RNG returns a degenerate pattern (all-zero / repeated / counter)</td>
+    <td>Draw is <strong>refused and wiped, never retried</strong>; error logged; onboarding fails loudly</td>
+    <td><span class="badge badge-red">No seed created</span></td>
+  </tr>
+  <tr>
+    <td>Kernel random pool not yet initialised (exotic first-boot case)</td>
+    <td><code>getrandom(2)</code> <strong>blocks</strong> until the pool is seeded — an unseeded pool physically cannot produce a seed. The advisory probe logs a warning and records the verdict in the readiness ledger</td>
+    <td><span class="badge badge-yellow">Waits, then proceeds</span></td>
+  </tr>
+  <tr>
+    <td>Onboarding page refreshed / retried mid-generation</td>
+    <td>Same words returned for 10 minutes (mutex-serialised); no second seed can be minted</td>
+    <td><span class="badge badge-green">Idempotent</span></td>
+  </tr>
+  <tr>
+    <td><code>master_seed.enc</code> missing (e.g. backup write failed during setup)</td>
+    <td>Node runs normally — every derived key is already materialised on disk. Only the <em>Reveal</em> feature and future re-derivation are unavailable; the UI says so explicitly</td>
+    <td><span class="badge badge-yellow">Degraded, functional</span></td>
+  </tr>
+  <tr>
+    <td><code>master_seed.enc</code> corrupt, or wrong password at reveal</td>
+    <td>Authenticated decryption fails closed with an explicit error — no fallback, no partial output, no auto-regeneration</td>
+    <td><span class="badge badge-red">Fails loudly</span></td>
+  </tr>
+  <tr>
+    <td>Restore attempted on an already-provisioned node</td>
+    <td>The onboarding gate refuses identity-mutating RPCs once the node is set up — a live node cannot be hijacked or accidentally re-seeded</td>
+    <td><span class="badge badge-green">Refused</span></td>
+  </tr>
+  <tr>
+    <td>Legacy / corrupt on-disk FIPS key format</td>
+    <td>Self-heals: legacy raw-byte format is detected and migrated in place to the current bech32 format</td>
+    <td><span class="badge badge-green">Auto-migrated</span></td>
+  </tr>
+  <tr>
+    <td>Readiness-ledger write fails (disk full, permissions)</td>
+    <td>Warns and continues — the audit trail is best-effort and can <em>never</em> block key generation</td>
+    <td><span class="badge badge-yellow">Non-blocking</span></td>
+  </tr>
+</table>
+
+<div class="callout callout-danger">
+  <strong>The one true single point of failure is you</strong>
+  Every software failure above fails <em>safe</em>. The only unrecoverable scenario is
+  losing the 24 words <em>and</em> the node's disk together. Write the words down, store
+  them offline, and never type them into anything except a node you're restoring.
+  Anyone holding them can rebuild your entire identity tree — that's precisely
+  what makes them a perfect backup, and a perfect target.
+</div>
+
+<h2 id="restore">The Restore Flow</h2>
+<p class="subtitle">Typing 24 words into a fresh node, step by step.</p>
+
+<div class="steps">
+  <div class="step">
+    <h4>Gate check</h4>
+    <p>Restore only proceeds on an un-onboarded node. A provisioned node refuses — this gate is load-bearing and runs before anything else.</p>
+  </div>
+  <div class="step">
+    <h4>Validation</h4>
+    <p>Exactly 24 words, checked against the BIP-39 wordlist and its built-in checksum — a typo is caught here, before anything is written.</p>
+  </div>
+  <div class="step">
+    <h4>Identity regrowth</h4>
+    <p>Node Ed25519 key + DID, node Nostr key, and FIPS mesh key are re-derived and written — byte-identical to the originals, because the HKDF labels are fixed.</p>
+  </div>
+  <div class="step">
+    <h4>Personal identity #0</h4>
+    <p>The identity index resets to 0 and your default "Personal" identity (Ed25519 + NIP-06 Nostr key) is recreated. If you had created more seed-derived identities, their keys re-derive on demand as the index walks forward — but their names, avatars and profiles were metadata, not key material, and come from a node backup instead.</p>
+  </div>
+  <div class="step">
+    <h4>Mesh reactivation</h4>
+    <p>FIPS federation auto-activation kicks off in the background; the Reticulum identity re-derives from the restored node key, so your LXMF mesh address comes back too.</p>
+  </div>
+  <div class="step">
+    <h4>Password &amp; re-seal</h4>
+    <p>When you set the (new) login password, the words are re-encrypted into a fresh <code>master_seed.enc</code> — the reveal feature works on the restored node just like the original.</p>
+  </div>
+</div>
+
+<h2 id="comes-back">What Comes Back — and What Doesn't</h2>
+
+<div class="card-grid">
+  <div class="card-sm">
+    <h4><span class="badge badge-green">Restored by the words</span></h4>
+    <p>Node identity &amp; DID · node npub · FIPS mesh key · Reticulum/LXMF address · personal identity keys &amp; npubs · message-store / contacts / credential encryption keys · the (dormant) Bitcoin xprv · the ability to reveal the phrase again.</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-yellow">Needs its own backup</span></h4>
+    <p>Lightning wallet (aezeed — one-way gate, see above) and channel state · chat history &amp; app data (node backup) · identity names/avatars (metadata) · app secrets (regenerate on reinstall).</p>
+  </div>
+  <div class="card-sm">
+    <h4><span class="badge badge-red">Gone by design</span></h4>
+    <p>Sessions &amp; device pairings (re-login, re-pair) · 2FA secret (re-enrol) · WireGuard peers (re-pair) · rotated-away node keys · anonymous throwaway Nostr keys.</p>
+  </div>
+</div>
+
+<h2 id="seedqr">SeedQR</h2>
+<p class="subtitle">Your words as a scannable code — using the open SeedSigner standard.</p>
+
+<p>
+Wherever the phrase is displayed, a <strong>QR code</strong> tab is offered alongside the
+words. For the main (BIP-39) phrase the default format is <strong>SeedQR</strong>: each
+word becomes its 4-digit position in the official wordlist (24 words → 96 digits),
+encoded as a compact numeric QR. Hardware wallets like Passport, SeedSigner and Keystone
+import this format directly — so you can move your on-chain identity into cold storage
+without ever typing the words. A plain-text QR fallback exists for wallets that read the
+phrase as text.
+</p>
+
+<ul>
+  <li>The QR contains <em>exactly the same secret</em> as the words — treat a printout or screenshot of it with identical care.</li>
+  <li>The Lightning aezeed is deliberately <em>never</em> SeedQR-encoded — it isn't BIP-39, hardware wallets can't import it, and pretending otherwise would be dishonest. It gets a plain-text QR with an explanation instead.</li>
+  <li>Restore is by typed/pasted words; there's no camera-based SeedQR scanner on the restore path today.</li>
+</ul>
+
+<h2 id="limitations">Honest Edges</h2>
+<p class="subtitle">Known trade-offs and open hardening items, stated plainly.</p>
+
+<p>
+The audit that produced this system also tracked what it <em>didn't</em> fix. None of
+these are secrets — honest security means naming the edges:
+</p>
+
+<ul>
+  <li><strong>The words cross the RPC boundary.</strong> During onboarding the phrase travels (over HTTPS/localhost) to your browser to be displayed, sits in the browser's session storage for the wizard's duration, and is held in server memory for the 10-minute idempotence window. This is the deliberate price of a refresh-proof, display-once flow.</li>
+  <li><strong>Argon2 parameters are the library defaults</strong> (≈19 MiB, 2 passes) rather than the heavier profile the design doc calls for. Still memory-hard and slow for attackers; scheduled for tightening.</li>
+  <li><strong>2FA backup codes carry a slight statistical bias</strong> from a modulo operation — cosmetically imperfect, cryptographically irrelevant at their length, and queued for cleanup.</li>
+  <li><strong>The lint ban covers the main workspace</strong>, but one small helper crate outside the workspace isn't reached by it yet.</li>
+  <li><strong>Best-effort backup sealing:</strong> if writing <code>master_seed.enc</code> fails during setup, the node continues (keys exist; only reveal is lost) — a loud failure might arguably be better, and this trade-off is under review.</li>
+</ul>
+
+<h2 id="verify">Verify It Yourself</h2>
+<p class="subtitle">Don't trust — recompute.</p>
+
+<p>
+Because every derivation is deterministic and label-fixed, you can independently confirm
+that your node's keys really do come from your words:
+</p>
+
+<ul>
+  <li><strong>Independent re-derivation script:</strong> <code>scripts/verify-seed-derivation.py</code> in the Archipelago source — pure-standard-library Python, no Archipelago code. Paste your mnemonic (on a trusted, offline machine) and it recomputes <code>node_key</code>, <code>nostr_secret</code> and <code>fips_key</code>, byte-comparing them against <code>/var/lib/archipelago/identity/</code>.</li>
+  <li><strong>Known-answer tests:</strong> the test suite pins the exact expected keys for a fixed test mnemonic; any change to the derivation math, however subtle, turns the build red.</li>
+  <li><strong>Non-determinism regression test:</strong> 64 consecutive generated mnemonics are asserted unique — a canary against the "predictable RNG" failure class.</li>
+  <li><strong>Your entropy audit trail:</strong> <code>/var/lib/archipelago/security/csprng-readiness.jsonl</code> records, append-only, the kernel randomness verdict at every key-generation event on <em>this</em> node — including the moment your seed was born.</li>
+</ul>
+
+<div class="callout callout-success">
+  <strong>The whole story in one paragraph</strong>
+  Your node asked the Linux kernel for 32 bytes of hardware-grade randomness through a
+  single, named, compiler-enforced channel; refused to proceed unless the bytes looked
+  alive; wrote down the health of the random pool as evidence; turned the bytes into 24
+  words it showed you exactly once; locked an encrypted copy behind your password; and
+  then grew every identity and key it owns from those words along fixed, versioned,
+  independently-verifiable paths — so that the words in your drawer are, and will remain,
+  a complete blueprint of who your node is.
+</div>
+
+<hr>
+
+<p style="color: var(--text-muted); font-size: 13px; text-align: center;">
+  Archipelago — Seed &amp; Entropy Guide · reflects the KEY-05 hardened implementation (August 2026) ·
+  see also the <a href="/architecture/" style="color: var(--accent);">LoRa &amp; Mesh Guide</a>
+</p>
+
+</main>
+</body>
+</html>
diff --git a/neode-ui/src/views/settings/BackupSection.vue b/neode-ui/src/views/settings/BackupSection.vue
index 151ad739..5fdebcce 100644
--- a/neode-ui/src/views/settings/BackupSection.vue
+++ b/neode-ui/src/views/settings/BackupSection.vue
@@ -289,6 +289,15 @@ defineExpose({ loadBackups })
           (and 2FA code, if enabled). Only reveal it somewhere private — anyone with these
           words controls this node.
         </p>
+        <a
+          href="/entropy/"
+          target="_blank"
+          rel="noopener"
+          class="inline-flex items-center gap-1 mt-2 text-sm text-orange-300/90 hover:text-orange-200 transition-colors"
+        >
+          How your seed &amp; keys work — the full guide
+          <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>
+        </a>
       </div>
       <button
         type="button"

From 3cef1d09f49d74db8e6ec95258978adbcbb25f65 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 09:08:19 -0400
Subject: [PATCH 56/60] feat(mesh-ui): RNode settings editor with live device
 read-back + region presets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The LoRa device panel's Reticulum section (operator .126 top priority):

- Shows the device's CURRENT settings first — the radio-confirmed r_*
  values from mesh.rnode-config (online badge, port, frequency, bw,
  SF, CR, txpower, airtime limits), with a Refresh action.
- Every RNodeInterface parameter is editable: enabled, serial port
  (auto-detect when blank), frequency, bandwidth (RNode's discrete
  set), SF 5-12, CR 4/5-4/8, txpower, airtime short/long %.
- "Set recommended for <region>" fills the fields from per-region
  plans (EU868 = the operator-validated Portugal plan incl. 25%/10%
  duty-cycle locks); driven by the existing region selector above.
- Apply & Confirm on Device: persists, restarts the radio daemon, and
  reports the radio's own confirmation (green ✓ only when the device
  read-back matches; amber/red messages say what actually happened).
- Action buttons stack in a column (operator layout request).
- Reboot Radio surfaces the backend's real acknowledgement message.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 neode-ui/src/stores/mesh.ts                 |  27 ++-
 neode-ui/src/views/mesh/MeshDevicePanel.vue | 227 +++++++++++++++++++-
 2 files changed, 251 insertions(+), 3 deletions(-)

diff --git a/neode-ui/src/stores/mesh.ts b/neode-ui/src/stores/mesh.ts
index a7ddc846..b8a80a56 100644
--- a/neode-ui/src/stores/mesh.ts
+++ b/neode-ui/src/stores/mesh.ts
@@ -863,12 +863,35 @@ export const useMeshStore = defineStore('mesh', () => {
   }
 
   async function rebootRadio(seconds = 2) {
-    return rpcClient.call<{ reboot: boolean; seconds: number }>({
+    // Long timeout: Reticulum reboots restart the sidecar daemon and the
+    // backend waits for the acknowledgement instead of fire-and-forgetting.
+    return rpcClient.call<{ reboot: boolean; seconds: number; message?: string }>({
       method: 'mesh.reboot-radio',
       params: { seconds },
+      timeout: 30000,
     })
   }
 
+  /** Persisted RNode RF settings + live radio-confirmed state (Reticulum). */
+  async function getRnodeConfig() {
+    return rpcClient.call<{
+      settings: Record<string, unknown>
+      live: Record<string, unknown> | null
+      live_error: string | null
+    }>({ method: 'mesh.rnode-config', timeout: 20000 })
+  }
+
+  /** Apply RNode RF settings: persists, restarts the radio daemon, waits for
+   *  the radio's own read-back confirmation (up to ~50s). */
+  async function applyRnodeConfig(settings: Record<string, unknown>) {
+    return rpcClient.call<{
+      applied: boolean
+      confirmed?: boolean
+      live?: Record<string, unknown> | null
+      message: string
+    }>({ method: 'mesh.rnode-config-apply', params: { settings }, timeout: 70000 })
+  }
+
   async function getOutbox() {
     try {
       return await rpcClient.call<{ count: number; messages?: unknown[] }>({ method: 'mesh.outbox' })
@@ -1155,6 +1178,8 @@ export const useMeshStore = defineStore('mesh', () => {
     sendReply,
     sendReaction,
     rebootRadio,
+    getRnodeConfig,
+    applyRnodeConfig,
     getOutbox,
     sendReadReceipt,
     forwardMessage,
diff --git a/neode-ui/src/views/mesh/MeshDevicePanel.vue b/neode-ui/src/views/mesh/MeshDevicePanel.vue
index 46b0b768..1345b321 100644
--- a/neode-ui/src/views/mesh/MeshDevicePanel.vue
+++ b/neode-ui/src/views/mesh/MeshDevicePanel.vue
@@ -7,12 +7,17 @@ const mesh = useMeshStore()
 
 const rebooting = ref(false)
 const rebootError = ref<string | null>(null)
+const rebootMessage = ref<string | null>(null)
 
 async function handleReboot() {
   rebooting.value = true
   rebootError.value = null
+  rebootMessage.value = null
   try {
-    await mesh.rebootRadio()
+    const res = await mesh.rebootRadio()
+    // The backend now waits for the device's acknowledgement and says what
+    // actually happened — show it instead of silently going idle again.
+    rebootMessage.value = res.message || 'Reboot command acknowledged by the radio.'
   } catch (e) {
     rebootError.value = e instanceof Error ? e.message : 'Failed to reboot radio'
   } finally {
@@ -20,6 +25,121 @@ async function handleReboot() {
   }
 }
 
+// ── RNode (Reticulum) RF settings — full round-trip with device read-back ──
+// Recommended plans per region for Reticulum RNode radios. EU868 is the
+// operator-validated Portugal plan (869.4625 MHz keeps clear of the default
+// community channel while staying in the 10%-duty 869.4–869.65 sub-band;
+// airtime locks match EU duty-cycle law). Others use the RNS community
+// conventions for the band with the region's legal power cap.
+const RNODE_REGION_PLANS: Record<string, { frequency: number; bandwidth: number; spreading_factor: number; coding_rate: number; txpower: number; airtime_limit_short: number | null; airtime_limit_long: number | null }> = {
+  EU868: { frequency: 869462500, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 14, airtime_limit_short: 25, airtime_limit_long: 10 },
+  US915: { frequency: 914875000, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 17, airtime_limit_short: null, airtime_limit_long: null },
+  AU915: { frequency: 916800000, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 17, airtime_limit_short: null, airtime_limit_long: null },
+  ANZ:   { frequency: 916800000, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 17, airtime_limit_short: null, airtime_limit_long: null },
+  AS923: { frequency: 923200000, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 13, airtime_limit_short: null, airtime_limit_long: null },
+  IN865: { frequency: 866000000, bandwidth: 125000, spreading_factor: 8, coding_rate: 5, txpower: 17, airtime_limit_short: null, airtime_limit_long: null },
+}
+
+const rnodeForm = ref({
+  enabled: true,
+  port: '',
+  frequency: '',
+  bandwidth: '125000',
+  spreading_factor: '8',
+  coding_rate: '5',
+  txpower: '17',
+  airtime_limit_short: '',
+  airtime_limit_long: '',
+})
+const rnodeLive = ref<Record<string, unknown> | null>(null)
+const rnodeLiveError = ref<string | null>(null)
+const rnodeLoading = ref(false)
+const rnodeApplying = ref(false)
+const rnodeResult = ref<{ ok: boolean; confirmed: boolean; message: string } | null>(null)
+let rnodeSeeded = false
+
+const rnodeRegionPlan = computed(() => (form.value.region ? RNODE_REGION_PLANS[form.value.region] : undefined))
+
+function setRnodeRecommendedForRegion() {
+  const plan = rnodeRegionPlan.value
+  if (!plan) return
+  rnodeForm.value.frequency = String(plan.frequency)
+  rnodeForm.value.bandwidth = String(plan.bandwidth)
+  rnodeForm.value.spreading_factor = String(plan.spreading_factor)
+  rnodeForm.value.coding_rate = String(plan.coding_rate)
+  rnodeForm.value.txpower = String(plan.txpower)
+  rnodeForm.value.airtime_limit_short = plan.airtime_limit_short != null ? String(plan.airtime_limit_short) : ''
+  rnodeForm.value.airtime_limit_long = plan.airtime_limit_long != null ? String(plan.airtime_limit_long) : ''
+}
+
+async function loadRnodeConfig() {
+  rnodeLoading.value = true
+  try {
+    const res = await mesh.getRnodeConfig()
+    rnodeLive.value = res.live
+    rnodeLiveError.value = res.live_error
+    const s = res.settings as Record<string, unknown>
+    if (!rnodeSeeded && s) {
+      rnodeSeeded = true
+      rnodeForm.value.enabled = s.enabled !== false
+      rnodeForm.value.port = (s.port as string) ?? ''
+      rnodeForm.value.frequency = String(s.frequency ?? '')
+      rnodeForm.value.bandwidth = String(s.bandwidth ?? '125000')
+      rnodeForm.value.spreading_factor = String(s.spreading_factor ?? '8')
+      rnodeForm.value.coding_rate = String(s.coding_rate ?? '5')
+      rnodeForm.value.txpower = String(s.txpower ?? '17')
+      rnodeForm.value.airtime_limit_short = s.airtime_limit_short != null ? String(s.airtime_limit_short) : ''
+      rnodeForm.value.airtime_limit_long = s.airtime_limit_long != null ? String(s.airtime_limit_long) : ''
+    }
+  } catch (e) {
+    rnodeLiveError.value = e instanceof Error ? e.message : 'Could not load RNode settings'
+  } finally {
+    rnodeLoading.value = false
+  }
+}
+
+async function applyRnodeSettings() {
+  rnodeApplying.value = true
+  rnodeResult.value = null
+  try {
+    const res = await mesh.applyRnodeConfig({
+      enabled: rnodeForm.value.enabled,
+      port: rnodeForm.value.port.trim() || null,
+      frequency: Number(rnodeForm.value.frequency),
+      bandwidth: Number(rnodeForm.value.bandwidth),
+      spreading_factor: Number(rnodeForm.value.spreading_factor),
+      coding_rate: Number(rnodeForm.value.coding_rate),
+      txpower: Number(rnodeForm.value.txpower),
+      airtime_limit_short: rnodeForm.value.airtime_limit_short === '' ? null : Number(rnodeForm.value.airtime_limit_short),
+      airtime_limit_long: rnodeForm.value.airtime_limit_long === '' ? null : Number(rnodeForm.value.airtime_limit_long),
+    })
+    rnodeResult.value = { ok: res.applied, confirmed: !!res.confirmed, message: res.message }
+    if (res.live) rnodeLive.value = res.live
+  } catch (e) {
+    rnodeResult.value = { ok: false, confirmed: false, message: e instanceof Error ? e.message : 'Apply failed' }
+  } finally {
+    rnodeApplying.value = false
+  }
+}
+
+async function refreshRnodeLive() {
+  rnodeLoading.value = true
+  try {
+    const res = await mesh.getRnodeConfig()
+    rnodeLive.value = res.live
+    rnodeLiveError.value = res.live_error
+  } catch (e) {
+    rnodeLiveError.value = e instanceof Error ? e.message : 'Could not read the radio state'
+  } finally {
+    rnodeLoading.value = false
+  }
+}
+
+function fmtMhz(v: unknown): string {
+  const n = Number(v)
+  return Number.isFinite(n) && n > 0 ? `${(n / 1e6).toFixed(4)} MHz` : '—'
+}
+
 // ── Editable settings (persisted via mesh.configure) ──
 const form = ref({
   region: '',
@@ -157,6 +277,18 @@ async function saveSettings() {
     saving.value = false
   }
 }
+
+// Load the RNode settings + live state as soon as the panel knows a
+// Reticulum radio is (or is pinned as) the device. Declared LAST: with
+// `immediate: true` the source getter runs at setup, and `effectiveKind`
+// must already exist (the SendBitcoinModal TDZ-crash lesson).
+watch(
+  () => effectiveKind.value,
+  (kind) => {
+    if (kind === 'reticulum') void loadRnodeConfig()
+  },
+  { immediate: true },
+)
 </script>
 
 <template>
@@ -202,7 +334,7 @@ async function saveSettings() {
             Program the radio's RF settings with the fields below — every radio on your mesh must match{{ selectedRegion ? ` (${selectedRegion.band} MHz band)` : '' }}.
           </p>
           <p v-else-if="effectiveKind === 'reticulum'" class="text-[11px] text-sky-300/80 mt-1">
-            RNode RF parameters are managed by the Reticulum daemon's interface config on this node.
+            Pick your region, then use "Set recommended for region" in the RNode section below.
           </p>
         </div>
         <div>
@@ -271,6 +403,96 @@ async function saveSettings() {
           Saved settings program the radio on its next connect (it reboots once to apply). Leave all four empty to keep the radio's own settings.
         </p>
       </div>
+      <!-- RNode (Reticulum) RF settings: the device's CURRENT values shown
+           first (radio-confirmed read-back), then every parameter editable,
+           with apply → device confirmation. Actions stack in a column. -->
+      <div v-if="effectiveKind === 'reticulum'" class="mt-4">
+        <div class="flex items-center justify-between mb-2">
+          <h5 class="text-xs font-semibold text-white/80">RNode radio — current device settings</h5>
+          <button class="text-[11px] text-sky-300/80 hover:text-sky-200 disabled:opacity-50" :disabled="rnodeLoading" @click="refreshRnodeLive">
+            {{ rnodeLoading ? 'Reading…' : 'Refresh' }}
+          </button>
+        </div>
+        <div v-if="rnodeLive" class="rounded-lg bg-white/[0.04] border border-white/10 p-3 mb-3 grid grid-cols-2 sm:grid-cols-4 gap-2 text-xs">
+          <div><span class="text-white/40 block">Status</span><span :class="rnodeLive.online ? 'text-green-400' : 'text-amber-400'">{{ rnodeLive.online ? 'Online' : 'Detected, not online' }}</span></div>
+          <div><span class="text-white/40 block">Port</span><span class="text-white/80">{{ rnodeLive.port || '—' }}</span></div>
+          <div><span class="text-white/40 block">Frequency</span><span class="text-white/80">{{ fmtMhz(rnodeLive.r_frequency ?? rnodeLive.frequency) }}</span></div>
+          <div><span class="text-white/40 block">Bandwidth</span><span class="text-white/80">{{ rnodeLive.r_bandwidth ?? rnodeLive.bandwidth ?? '—' }} Hz</span></div>
+          <div><span class="text-white/40 block">Spreading</span><span class="text-white/80">SF {{ rnodeLive.r_spreadingfactor ?? rnodeLive.spreadingfactor ?? '—' }}</span></div>
+          <div><span class="text-white/40 block">Coding rate</span><span class="text-white/80">4/{{ rnodeLive.r_codingrate ?? rnodeLive.codingrate ?? '—' }}</span></div>
+          <div><span class="text-white/40 block">TX power</span><span class="text-white/80">{{ rnodeLive.r_txpower ?? rnodeLive.txpower ?? '—' }} dBm</span></div>
+          <div><span class="text-white/40 block">Airtime limits</span><span class="text-white/80">{{ rnodeLive.r_airtime_limit_short ?? rnodeLive.airtime_limit_short ?? '—' }}% / {{ rnodeLive.r_airtime_limit_long ?? rnodeLive.airtime_limit_long ?? '—' }}%</span></div>
+        </div>
+        <p v-else-if="rnodeLiveError" class="text-[11px] text-amber-400/80 mb-3">{{ rnodeLiveError }}</p>
+
+        <h5 class="text-xs font-semibold text-white/80 mb-2">RNode RF parameters</h5>
+        <div class="grid gap-3 grid-cols-2 sm:grid-cols-4">
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Frequency (Hz)</label>
+            <input v-model="rnodeForm.frequency" inputmode="numeric" placeholder="869462500" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Bandwidth (Hz)</label>
+            <select v-model="rnodeForm.bandwidth" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option v-for="bw in ['7800','10400','15600','20800','31250','41700','62500','125000','250000','500000']" :key="bw" :value="bw">{{ bw }}</option>
+            </select>
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Spreading factor</label>
+            <select v-model="rnodeForm.spreading_factor" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option v-for="sf in [5,6,7,8,9,10,11,12]" :key="sf" :value="String(sf)">SF {{ sf }}</option>
+            </select>
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Coding rate</label>
+            <select v-model="rnodeForm.coding_rate" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option v-for="cr in [5,6,7,8]" :key="cr" :value="String(cr)">4/{{ cr }}</option>
+            </select>
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">TX power (dBm)</label>
+            <input v-model="rnodeForm.txpower" inputmode="numeric" placeholder="14" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Airtime short (%)</label>
+            <input v-model="rnodeForm.airtime_limit_short" inputmode="decimal" placeholder="25" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Airtime long (%)</label>
+            <input v-model="rnodeForm.airtime_limit_long" inputmode="decimal" placeholder="10" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Serial port</label>
+            <input v-model="rnodeForm.port" placeholder="auto-detect" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+        </div>
+        <label class="flex items-center gap-2 mt-3 text-sm text-white/80 cursor-pointer">
+          <input v-model="rnodeForm.enabled" type="checkbox" class="h-4 w-4 accent-orange-500" />
+          RNode interface enabled
+        </label>
+
+        <!-- Actions: stacked in a column on purpose (operator layout request) -->
+        <div class="flex flex-col gap-2 mt-4 max-w-sm">
+          <button
+            class="glass-button px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50"
+            :disabled="!rnodeRegionPlan || rnodeApplying"
+            @click="setRnodeRecommendedForRegion"
+          >
+            {{ rnodeRegionPlan ? `Set recommended for ${form.region}` : 'Pick a region above first' }}
+          </button>
+          <button
+            class="glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50"
+            :disabled="rnodeApplying"
+            @click="applyRnodeSettings"
+          >
+            {{ rnodeApplying ? 'Applying — waiting for the radio to confirm…' : 'Apply & Confirm on Device' }}
+          </button>
+        </div>
+        <p v-if="rnodeResult" class="text-xs mt-2" :class="rnodeResult.ok && rnodeResult.confirmed ? 'text-green-400' : rnodeResult.ok ? 'text-amber-400' : 'text-red-400'">
+          <template v-if="rnodeResult.ok && rnodeResult.confirmed">✓ </template>{{ rnodeResult.message }}
+        </p>
+      </div>
+
       <label class="flex items-center gap-2 mt-3 text-sm text-white/80 cursor-pointer">
         <input v-model="form.broadcastIdentity" type="checkbox" class="h-4 w-4 accent-orange-500" />
         Periodically broadcast this node's identity on the mesh
@@ -304,6 +526,7 @@ async function saveSettings() {
         <template v-else>Reboot Radio</template>
       </button>
       <p class="mesh-device-reboot-hint">Use this if the device stops responding to sent messages or seems stuck.</p>
+      <p v-if="rebootMessage" class="text-xs text-green-400 mt-1">{{ rebootMessage }}</p>
       <p v-if="rebootError" class="mesh-device-reboot-error">{{ rebootError }}</p>
     </div>
   </div>

From 83d72348242b12656f4ac5616356e3c8d2bfb9f4 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 09:11:15 -0400
Subject: [PATCH 57/60] =?UTF-8?q?style(entropy-guide):=20use=20the=20app's?=
 =?UTF-8?q?=20real=20look=20=E2=80=94=20Settings=20wallpaper=20+=20Montser?=
 =?UTF-8?q?rat?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Layer the page over /assets/img/bg-settings.webp (fixed, cover, with a
dim gradient so prose between glass panels stays readable) and load the
actual Montserrat Bold/ExtraBold faces from the node's own web root,
instead of the flat-black background the /architecture/ guide uses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 neode-ui/public/entropy/index.html | 33 +++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/neode-ui/public/entropy/index.html b/neode-ui/public/entropy/index.html
index d003abf0..be063af9 100644
--- a/neode-ui/public/entropy/index.html
+++ b/neode-ui/public/entropy/index.html
@@ -37,7 +37,21 @@
 
   * { margin: 0; padding: 0; box-sizing: border-box; }
 
-  html { scroll-behavior: smooth; }
+  html { scroll-behavior: smooth; color-scheme: dark; }
+
+  /* The app's actual header font, served from the node's own web root */
+  @font-face {
+    font-family: 'Montserrat';
+    src: url('/assets/fonts/Montserrat/Montserrat-Bold.ttf') format('truetype');
+    font-weight: 700;
+    font-style: normal;
+  }
+  @font-face {
+    font-family: 'Montserrat';
+    src: url('/assets/fonts/Montserrat/Montserrat-ExtraBold.ttf') format('truetype');
+    font-weight: 800;
+    font-style: normal;
+  }
 
   body {
     font-family: 'Avenir Next', system-ui, -apple-system, sans-serif;
@@ -47,6 +61,23 @@
     font-size: 16px;
   }
 
+  /* The app's Settings wallpaper, with a dim gradient so prose between the
+     glass panels stays readable — same layering as the dashboard views. */
+  body::before {
+    content: '';
+    position: fixed;
+    inset: 0;
+    z-index: -2;
+    background: #000 url('/assets/img/bg-settings.webp') center center / cover no-repeat;
+  }
+  body::after {
+    content: '';
+    position: fixed;
+    inset: 0;
+    z-index: -1;
+    background: linear-gradient(to bottom, rgba(0, 0, 0, 0.45), rgba(0, 0, 0, 0.62));
+  }
+
   nav {
     position: fixed;
     top: 0; left: 0;

From 6c0fc366b31616cde6cf0b519f12dd3cef5dd63c Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 09:17:10 -0400
Subject: [PATCH 58/60] fix(appgate): classify ports from the catalog even for
 on-node-built apps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The port map deferred to DISK manifests for any app with a build source
— which is exactly the four companion UIs (lnd-ui, bitcoin-ui,
electrs-ui, fips-ui). Their disk manifests reach nodes only via the
frontend runtime payload or a per-node repo checkout, and in the
v1.7.125 rollout both proved stale or entirely absent: one node had no
checkout at all, others restored an older payload over apps/ at every
boot. Result: session_passthrough never reached the gate, so the node's
own screens 401'd on every data call, and on nodes whose UI rebuilt
from a stale context the app held its port UNGATED.

Classification now uses a ports-only overlay that accepts build-source
manifests (install/orchestration still defers to disk — unchanged). The
signed catalog is the freshest, operator-signed source, and the gate's
address binds fail safely against a container publishing differently
(logged CANNOT PROTECT), so this can only tighten policy, never expose.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/appgate/identity.rs      | 13 ++++++---
 core/archipelago/src/container/app_catalog.rs | 27 +++++++++++++++++++
 2 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/core/archipelago/src/appgate/identity.rs b/core/archipelago/src/appgate/identity.rs
index 8bfc0142..240e160d 100644
--- a/core/archipelago/src/appgate/identity.rs
+++ b/core/archipelago/src/appgate/identity.rs
@@ -147,11 +147,18 @@ pub fn build_port_map() -> PortMap {
     let mut seen_apps: std::collections::HashSet<String> = std::collections::HashSet::new();
 
     for (app_id, value) in crate::container::app_catalog::catalog_manifest_values() {
+        // Ports-only overlay: unlike the install path, classification also
+        // accepts BUILD-SOURCE manifests. The on-node-built companion UIs
+        // are exactly the apps whose gate policy (session_passthrough,
+        // auth: gated) must arrive reliably, and their disk manifests
+        // proved stale or absent fleet-wide in the v1.7.125 rollout. The
+        // gate's binds fail safely on conflict with a differently-published
+        // container, so a fresher catalog can only tighten, never expose.
         let Some(manifest) =
-            crate::container::app_catalog::catalog_manifest_overlay(&app_id, value)
+            crate::container::app_catalog::catalog_manifest_ports_overlay(&app_id, value)
         else {
-            // Unparseable/invalid/build-source → the orchestrator falls back
-            // to disk for this app, so classification must too.
+            // Unparseable/invalid → the orchestrator falls back to disk for
+            // this app, so classification must too.
             continue;
         };
         if seen_apps.insert(app_id) {
diff --git a/core/archipelago/src/container/app_catalog.rs b/core/archipelago/src/container/app_catalog.rs
index 63b46b30..94c02e93 100644
--- a/core/archipelago/src/container/app_catalog.rs
+++ b/core/archipelago/src/container/app_catalog.rs
@@ -256,6 +256,33 @@ pub fn catalog_manifest_overlay(
     Some(m)
 }
 
+/// Like [`catalog_manifest_overlay`] but WITHOUT the build-source refusal —
+/// for PORT CLASSIFICATION only, never for install/orchestration.
+///
+/// The on-node-built companion UIs (lnd-ui, bitcoin-ui, electrs-ui, fips-ui)
+/// are exactly the apps whose port policy (auth/bind/session_passthrough)
+/// must reach the gate reliably, yet their build sources made the overlay
+/// defer to DISK manifests — whose only delivery paths (frontend runtime
+/// payload, per-node repo copies) proved stale or absent across the fleet in
+/// the v1.7.125 rollout: nodes served ungated UIs or 401-dead panels until
+/// hand-fixed. The signed catalog is fresher and operator-signed; and the
+/// gate's address binds fail safely on conflict with a container that
+/// publishes differently (logged as CANNOT PROTECT), so classifying from the
+/// catalog cannot open anything the running container hasn't already opened.
+pub fn catalog_manifest_ports_overlay(
+    app_id: &str,
+    value: serde_json::Value,
+) -> Option<archipelago_container::manifest::AppManifest> {
+    let m: archipelago_container::manifest::AppManifest = serde_json::from_value(value).ok()?;
+    if m.app.id != app_id {
+        return None;
+    }
+    if m.validate().is_err() {
+        return None;
+    }
+    Some(m)
+}
+
 /// The catalog's default/latest version string for an app (the top-level
 /// `version` field), if covered. Used to decide whether an install-time
 /// selection should pin (older) or track-latest (default).

From 3e124dd4b38450ebcaaf92558a87f601d7739bb8 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 09:28:44 -0400
Subject: [PATCH 59/60] fix(rpc): surface unknown-method + RNode settings
 errors instead of masking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deploying the .126 LoRa panel ahead of its daemon made every button
report "Operation failed. Check server logs for details." — the panel
was calling RPCs the older binary doesn't have, and the sanitizer
masked "Unknown method: mesh.rnode-config" into that generic string.
Read as "the feature is broken" rather than "this node needs its
update" (operator, 2026-08-06).

Allowlisted: "Unknown method" (a frontend newer than its daemon should
say so), every RNode RF validation message (each names the field and
its legal range — the entire point of validating before touching the
radio), and the actionable mesh preconditions (no device connected,
mesh service not running, MeshCore has no remote reboot, radio daemon
did not answer, RNode interface disabled).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 core/archipelago/src/api/rpc/middleware.rs | 27 ++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/core/archipelago/src/api/rpc/middleware.rs b/core/archipelago/src/api/rpc/middleware.rs
index bba77598..0b6c093e 100644
--- a/core/archipelago/src/api/rpc/middleware.rs
+++ b/core/archipelago/src/api/rpc/middleware.rs
@@ -84,6 +84,33 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         // Masking sent the operator to journalctl again (framework-pt
         // sweep, 2026-08-06) — same lesson as the two above.
         "Failed to send",
+        // A frontend newer than the daemon calls methods it doesn't have.
+        // Masked, this reads as "the feature is broken" instead of "this
+        // node needs its update" — hit live the moment the .126 LoRa panel
+        // was deployed ahead of its binary (2026-08-06).
+        "Unknown method",
+        // RNode RF settings validation (mesh::rnode_settings::validate) —
+        // every one names the offending field and its legal range, which is
+        // the entire point of validating before touching the radio.
+        "frequency ",
+        "bandwidth ",
+        "spreading factor ",
+        "coding rate ",
+        "tx power ",
+        "airtime_limit_short",
+        "airtime_limit_long",
+        "port must be an absolute",
+        "Invalid settings",
+        "Missing 'settings'",
+        // Mesh preconditions the operator can act on directly.
+        "Mesh service not running",
+        "No mesh device connected",
+        "Mesh listener not running",
+        "MeshCore radios have no remote reboot",
+        "Radio state read-back",
+        "The radio daemon did not answer",
+        "The radio did not acknowledge",
+        "RNode interface is disabled",
         // Lightning payment failures carry LND's reason ("invoice expired.
         // Valid until …", "no route", …) — the user can act on every one of
         // them, and masking sent the operator to journalctl (invoice-expired

From 53753687a564490a5b140cd653a0132153737295 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 6 Aug 2026 09:30:41 -0400
Subject: [PATCH 60/60] style(entropy-guide): rebuild on the dashboard's own
 sidebar + glass-card
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the bespoke doc-page chrome with the app's real components:
DashboardSidebar shell (256px, rgba(0,0,0,.25) + 18px blur, staggered
nav-item entrance), the AnimatedLogo neode mark with its 20 staggered
squares, sidebar-nav-item + nav-tab-active for section state, and the
Settings wallpaper behind it all.

Every bespoke container (.card/.card-sm/.step/.score-card/.callout-*/
.diagram) is gone — .glass-card from style.css is now the only box on
the page, with layout-only grids inside it.

Scroll-spy lives in nav.js rather than inline, since the node's CSP is
script-src 'self'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 neode-ui/public/entropy/index.html | 1779 +++++++++++++---------------
 neode-ui/public/entropy/nav.js     |   29 +
 2 files changed, 857 insertions(+), 951 deletions(-)
 create mode 100644 neode-ui/public/entropy/nav.js

diff --git a/neode-ui/public/entropy/index.html b/neode-ui/public/entropy/index.html
index be063af9..0941670e 100644
--- a/neode-ui/public/entropy/index.html
+++ b/neode-ui/public/entropy/index.html
@@ -3,1048 +3,925 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>Archipelago — Seed &amp; Entropy Guide</title>
+<title>Archipelago — Seed &amp; Entropy</title>
+<link rel="icon" href="/favicon-v2.ico">
 <style>
-  :root {
-    --bg: #000000;
-    --glass-card: rgba(0, 0, 0, 0.65);
-    --glass-dark: rgba(0, 0, 0, 0.35);
-    --glass-darker: rgba(0, 0, 0, 0.6);
-    --glass-border: rgba(255, 255, 255, 0.18);
-    --glass-highlight: rgba(255, 255, 255, 0.22);
-    --glass-blur: 18px;
-    --glass-blur-strong: 24px;
-    --shadow-glass: 0 8px 24px rgba(0, 0, 0, 0.45);
-    --shadow-glass-inset: inset 0 1px 0 rgba(255, 255, 255, 0.22);
-    --text: rgba(255, 255, 255, 0.9);
-    --text-muted: rgba(255, 255, 255, 0.6);
-    --accent: #fb923c;
-    --accent-dim: rgba(251, 146, 60, 0.15);
-    --green: #4ade80;
-    --green-dim: rgba(74, 222, 128, 0.15);
-    --red: #ef4444;
-    --red-dim: rgba(239, 68, 68, 0.12);
-    --blue: #3b82f6;
-    --blue-dim: rgba(59, 130, 246, 0.12);
-    --yellow: #facc15;
-    --yellow-dim: rgba(250, 204, 21, 0.12);
-    --purple: #a78bfa;
-    --purple-dim: rgba(167, 139, 250, 0.12);
-    --radius: 16px;
-    --radius-sm: 12px;
-    --transition: 0.3s cubic-bezier(0.4, 0, 0.2, 1);
-  }
+  /* Everything below is lifted from the app's own stylesheets
+     (src/style.css + views/dashboard/dashboard-styles.css) so this page is
+     the dashboard, not a lookalike. No new container styles: .glass-card is
+     the only box. */
 
-  * { margin: 0; padding: 0; box-sizing: border-box; }
+  :root { color-scheme: dark; }
 
-  html { scroll-behavior: smooth; color-scheme: dark; }
-
-  /* The app's actual header font, served from the node's own web root */
   @font-face {
     font-family: 'Montserrat';
     src: url('/assets/fonts/Montserrat/Montserrat-Bold.ttf') format('truetype');
-    font-weight: 700;
-    font-style: normal;
+    font-weight: 700; font-style: normal;
   }
   @font-face {
     font-family: 'Montserrat';
     src: url('/assets/fonts/Montserrat/Montserrat-ExtraBold.ttf') format('truetype');
-    font-weight: 800;
-    font-style: normal;
+    font-weight: 800; font-style: normal;
   }
 
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  html { scroll-behavior: smooth; }
+
   body {
     font-family: 'Avenir Next', system-ui, -apple-system, sans-serif;
-    background: var(--bg);
-    color: var(--text);
+    color: rgba(255, 255, 255, 0.9);
     line-height: 1.7;
     font-size: 16px;
+    min-height: 100vh;
   }
 
-  /* The app's Settings wallpaper, with a dim gradient so prose between the
-     glass panels stays readable — same layering as the dashboard views. */
+  /* Dashboard background layer — the Settings wallpaper, as the app uses it */
   body::before {
     content: '';
-    position: fixed;
-    inset: 0;
-    z-index: -2;
+    position: fixed; inset: 0; z-index: -2;
     background: #000 url('/assets/img/bg-settings.webp') center center / cover no-repeat;
   }
   body::after {
     content: '';
-    position: fixed;
-    inset: 0;
-    z-index: -1;
-    background: linear-gradient(to bottom, rgba(0, 0, 0, 0.45), rgba(0, 0, 0, 0.62));
+    position: fixed; inset: 0; z-index: -1;
+    background: linear-gradient(to bottom, rgba(0,0,0,0.45), rgba(0,0,0,0.62));
   }
 
-  nav {
-    position: fixed;
-    top: 0; left: 0;
-    width: 280px;
+  .dashboard-view { display: flex; min-height: 100vh; }
+
+  /* ---- Sidebar (dashboard-styles.css) ---- */
+  aside {
+    width: 256px;
+    flex-shrink: 0;
+    position: sticky;
+    top: 0;
     height: 100vh;
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur-strong));
-    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
-    border-right: 1px solid var(--glass-border);
-    box-shadow: var(--shadow-glass);
-    overflow-y: auto;
-    padding: 24px 0;
-    z-index: 100;
+    z-index: 10;
+  }
+  .sidebar-shell {
+    width: 100%; height: 100%; min-height: 0;
+    background: rgba(0, 0, 0, 0.25);
+    backdrop-filter: blur(18px);
+    -webkit-backdrop-filter: blur(18px);
+    border-right: 1px solid rgba(255, 255, 255, 0.18);
+    box-shadow: 4px 0 24px rgba(0, 0, 0, 0.3);
+    overflow: hidden;
+  }
+  .sidebar-inner { display: flex; flex-direction: column; height: 100%; min-height: 0; overflow: hidden; }
+
+  .sidebar-logo {
+    display: flex; align-items: center; gap: 0.75rem;
+    margin-bottom: 2rem; padding: 1.5rem 1.5rem 0; flex-shrink: 0;
+  }
+  .sidebar-logo h2 {
+    font-size: 1.125rem; font-weight: 600; color: #fff;
+    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  }
+  .sidebar-logo p { font-size: 0.75rem; color: rgba(255, 255, 255, 0.6); }
+
+  /* AnimatedLogo.vue — gradient ring + staggered square reveal */
+  .logo-gradient-border {
+    position: relative;
+    flex-shrink: 0;
+    display: inline-block;
+    overflow: hidden;
+    width: 3.5rem; height: 3.5rem;
+    border-radius: 9999px;
+    padding: 3px;
+    background: linear-gradient(135deg, rgba(255,255,255,0.6) 0%, rgba(0,0,0,0.8) 100%);
+    box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
+  }
+  .logo-gradient-border::after {
+    content: '';
+    position: absolute; inset: 3px;
+    border-radius: 9999px;
+    background: #000;
+    z-index: 0;
+  }
+  .logo-gradient-border svg {
+    border-radius: 9999px;
+    display: block; position: relative; z-index: 1;
+    width: 100%; height: 100%;
+  }
+  .logo-square {
+    opacity: 0;
+    animation: logo-square-in 3s ease-out infinite;
+    animation-delay: var(--delay, 0ms);
+    animation-fill-mode: both;
+  }
+  @keyframes logo-square-in {
+    0% { opacity: 0; }
+    15% { opacity: 1; }
+    100% { opacity: 1; }
+  }
+
+  .sidebar-nav {
+    flex: 1; min-height: 0;
+    overflow-y: auto; overscroll-behavior: contain;
+    padding: 1rem 1.5rem;
     scrollbar-width: thin;
-    scrollbar-color: rgba(255,255,255,0.15) transparent;
+    scrollbar-color: rgba(255, 255, 255, 0.24) transparent;
   }
-  nav .logo { padding: 0 24px 20px; margin-bottom: 16px; }
-  nav .logo h1 {
-    font-family: 'Montserrat', 'Avenir Next', sans-serif;
-    font-size: 18px; font-weight: 700;
-    color: var(--accent); letter-spacing: -0.02em;
-  }
-  nav .logo p { font-size: 12px; color: var(--text-muted); margin-top: 4px; }
-  nav .nav-section {
-    padding: 12px 16px 4px;
-    font-size: 10px; font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.1em;
-    color: var(--text-muted);
-  }
-  nav a {
-    display: block;
-    padding: 6px 24px;
-    color: var(--text-muted);
+  .sidebar-nav::-webkit-scrollbar { width: 6px; }
+  .sidebar-nav::-webkit-scrollbar-thumb { background: rgba(255,255,255,0.22); border-radius: 999px; }
+  .sidebar-nav > * + * { margin-top: 0.5rem; }
+
+  .sidebar-nav-item {
+    display: flex; align-items: center; gap: 0.75rem;
+    padding: 0.75rem 1rem;
+    border-radius: 0.5rem;
+    color: rgba(255, 255, 255, 0.8);
     text-decoration: none;
-    font-size: 13px;
-    transition: all var(--transition);
-    border-left: 2px solid transparent;
+    font-size: 0.9375rem;
+    transition: background-color 0.2s ease, color 0.2s ease;
   }
-  nav a:hover, nav a.active {
-    color: var(--text);
-    background: rgba(255, 255, 255, 0.06);
-    border-left-color: var(--accent);
+  .sidebar-nav-item:hover { background: rgba(255, 255, 255, 0.1); color: #fff; }
+  .sidebar-nav-item svg { width: 1.25rem; height: 1.25rem; flex-shrink: 0; }
+
+  /* nav-tab-active (style.css) — the app's current-section treatment */
+  .nav-tab-active {
+    position: relative;
+    background: rgba(0, 0, 0, 0.35);
+    box-shadow: 0 6px 16px rgba(0,0,0,0.6), inset 0 1px 0 rgba(255,255,255,0.25);
+    color: #fff;
+    font-weight: 600;
+  }
+  .nav-tab-active::before {
+    content: '';
+    position: absolute; inset: 0;
+    border-radius: inherit;
+    padding: 2px;
+    background: linear-gradient(135deg, rgba(255,255,255,0.3), transparent);
+    -webkit-mask: linear-gradient(#fff 0 0) content-box, linear-gradient(#fff 0 0);
+    -webkit-mask-composite: xor;
+    mask-composite: exclude;
+    pointer-events: none;
   }
 
+  .sidebar-bottom {
+    padding: 1rem 1.5rem 1.5rem;
+    flex-shrink: 0;
+    background: linear-gradient(to top, rgba(0, 0, 0, 0.18), transparent 100%);
+  }
+
+  /* Entrance animation, mirroring the dashboard's staggered sidebar reveal */
+  .sidebar-logo { opacity: 0; animation: sidebar-logo-in 0.5s cubic-bezier(0.25,0.46,0.45,0.94) 0.05s forwards; }
+  @keyframes sidebar-logo-in {
+    0% { opacity: 0; transform: translateY(-8px); }
+    100% { opacity: 1; transform: translateY(0); }
+  }
+  .sidebar-nav-item {
+    opacity: 0;
+    animation: sidebar-nav-item-in 0.4s cubic-bezier(0.25,0.46,0.45,0.94) forwards;
+    animation-delay: calc(0.22s + var(--nav-stagger, 0) * 0.06s);
+  }
+  @keyframes sidebar-nav-item-in {
+    0% { opacity: 0; transform: translateX(-12px); }
+    100% { opacity: 1; transform: translateX(0); }
+  }
+
+  /* ---- Main content ---- */
   main {
-    margin-left: 280px;
-    max-width: 960px;
-    padding: 48px 48px 120px;
+    flex: 1; min-width: 0;
+    padding: 2.5rem 2rem 6rem;
   }
+  .content { max-width: 900px; margin: 0 auto; }
 
+  h1 {
+    font-family: 'Montserrat', 'Avenir Next', sans-serif;
+    font-size: 2rem; font-weight: 800;
+    color: #fff;
+    letter-spacing: -0.02em;
+    line-height: 1.25;
+  }
   h2 {
     font-family: 'Montserrat', 'Avenir Next', sans-serif;
-    font-size: 28px; font-weight: 700;
-    margin: 64px 0 8px;
-    padding-top: 24px;
-    color: var(--text);
+    font-size: 1.5rem; font-weight: 700;
+    color: #fff;
     letter-spacing: -0.02em;
+    margin: 3rem 0 0.25rem;
+    scroll-margin-top: 1.5rem;
   }
-  h2:first-of-type { margin-top: 0; }
-  h3 {
-    font-family: 'Montserrat', 'Avenir Next', sans-serif;
-    font-size: 20px; font-weight: 600;
-    margin: 40px 0 12px;
-    color: var(--text);
-  }
-  h4 {
-    font-size: 16px; font-weight: 600;
-    margin: 24px 0 8px;
-    color: var(--accent);
-  }
-  p { margin: 8px 0 16px; color: var(--text); }
-  ul, ol { margin: 8px 0 16px 24px; color: var(--text); }
-  li { margin: 4px 0; }
+  h3 { font-size: 1.125rem; font-weight: 600; color: #fff; margin: 1.75rem 0 0.5rem; }
+  h4 { font-size: 0.9375rem; font-weight: 600; color: #fff; margin: 0 0 0.35rem; }
+  p { margin: 0.5rem 0 1rem; }
+  .glass-card > p:last-child, .glass-card > ul:last-child { margin-bottom: 0; }
+  ul, ol { margin: 0.5rem 0 1rem 1.25rem; }
+  li { margin: 0.25rem 0; }
+  .lede { color: rgba(255,255,255,0.6); font-size: 0.9375rem; margin-bottom: 1rem; }
+  a { color: #fb923c; }
 
-  .subtitle {
-    font-size: 15px;
-    color: var(--text-muted);
-    margin-bottom: 32px;
+  /* The section label the app uses above grouped content */
+  .section-label {
+    display: block;
+    font-size: 0.6875rem; font-weight: 700;
+    letter-spacing: 0.1em; text-transform: uppercase;
+    color: rgba(255, 255, 255, 0.5);
+    margin-bottom: 0.5rem;
+  }
+  .section-label.accent { color: #fb923c; }
+
+  /* glass-card (style.css) — the ONLY container on this page */
+  .glass-card {
+    background-color: rgba(0, 0, 0, 0.65);
+    backdrop-filter: blur(18px);
+    -webkit-backdrop-filter: blur(18px);
+    border: 1px solid rgba(255, 255, 255, 0.18);
+    box-shadow: 0 8px 24px rgba(0, 0, 0, 0.45);
+    border-radius: 1rem;
+    padding: 1.25rem 1.5rem;
+    margin: 1rem 0;
+    overflow-x: auto;
   }
 
-  .hero { text-align: center; padding: 48px 0 56px; margin-bottom: 24px; }
-  .hero h1 {
-    font-family: 'Montserrat', 'Avenir Next', sans-serif;
-    font-size: 42px; font-weight: 800;
-    background: linear-gradient(135deg, var(--accent), #f59e0b);
-    -webkit-background-clip: text;
-    -webkit-text-fill-color: transparent;
-    letter-spacing: -0.03em;
-  }
-  .hero .tagline {
-    font-size: 18px;
-    color: var(--text-muted);
-    margin: 12px auto 0;
-    max-width: 640px;
-  }
-  .hero .meta {
-    margin-top: 20px;
-    display: flex; gap: 16px;
-    justify-content: center; flex-wrap: wrap;
-  }
-  .hero .meta span {
-    font-size: 12px;
-    padding: 4px 12px;
-    border-radius: 999px;
-    background: var(--glass-dark);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    color: var(--text-muted);
-  }
-
-  .card {
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
-    border-radius: var(--radius);
-    padding: 24px;
-    margin: 16px 0;
-  }
-  .card-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
-    gap: 16px;
-    margin: 16px 0;
-  }
-  .card-sm {
-    background: var(--glass-darker);
-    backdrop-filter: blur(var(--glass-blur-strong));
-    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
-    border: 1px solid var(--glass-border);
-    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
-    border-radius: var(--radius);
-    padding: 16px 20px;
-    transition: transform var(--transition), box-shadow var(--transition);
-  }
-  .card-sm:hover {
-    transform: translateY(-2px);
-    box-shadow: 0 12px 32px rgba(0, 0, 0, 0.6), inset 0 1px 0 rgba(255, 255, 255, 0.25);
-  }
-  .card-sm h4 { margin: 0 0 6px; font-size: 14px; }
-  .card-sm p { font-size: 13px; color: var(--text-muted); margin: 0; }
+  /* Layout only — no new box chrome */
+  .grid { display: grid; gap: 1rem; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); margin: 1rem 0; }
+  .grid .glass-card { margin: 0; }
 
+  /* Orange count badge, as used on sidebar nav items */
   .badge {
-    display: inline-block;
-    font-size: 11px; font-weight: 600;
-    padding: 2px 10px;
-    border-radius: 999px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
+    display: inline-flex; align-items: center; justify-content: center;
+    min-width: 1.25rem; height: 1.25rem; padding: 0 0.4rem;
+    border-radius: 9999px;
+    background: #f97316; color: #fff;
+    font-size: 10px; font-weight: 700;
+    vertical-align: middle;
   }
-  .badge-green { background: var(--green-dim); color: var(--green); }
-  .badge-red { background: var(--red-dim); color: var(--red); }
-  .badge-yellow { background: var(--yellow-dim); color: var(--yellow); }
-  .badge-blue { background: var(--blue-dim); color: var(--blue); }
-  .badge-purple { background: var(--purple-dim); color: var(--purple); }
-  .badge-accent { background: var(--accent-dim); color: var(--accent); }
+  .badge.muted { background: rgba(255,255,255,0.14); color: rgba(255,255,255,0.85); }
 
-  table {
-    width: 100%;
-    border-collapse: separate;
-    border-spacing: 0;
-    margin: 16px 0;
-    font-size: 13px;
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    border-radius: var(--radius-sm);
-    overflow: hidden;
-    box-shadow: var(--shadow-glass);
+  .pill {
+    display: inline-block;
+    font-size: 0.75rem;
+    padding: 0.25rem 0.75rem;
+    border-radius: 9999px;
+    background: rgba(0, 0, 0, 0.35);
+    backdrop-filter: blur(18px);
+    -webkit-backdrop-filter: blur(18px);
+    border: 1px solid rgba(255, 255, 255, 0.18);
+    color: rgba(255, 255, 255, 0.6);
   }
+  .pills { display: flex; flex-wrap: wrap; gap: 0.5rem; margin-top: 1rem; }
+
+  table { width: 100%; border-collapse: collapse; font-size: 0.8125rem; }
   th {
-    text-align: left;
-    padding: 10px 14px;
-    background: rgba(0, 0, 0, 0.4);
-    color: var(--text-muted);
-    font-weight: 600;
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    border-bottom: 1px solid var(--glass-border);
-  }
-  td {
-    padding: 10px 14px;
-    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
-    vertical-align: top;
+    text-align: left; padding: 0.5rem 0.75rem;
+    color: rgba(255, 255, 255, 0.5);
+    font-size: 0.6875rem; font-weight: 600;
+    text-transform: uppercase; letter-spacing: 0.05em;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.18);
+    white-space: nowrap;
   }
+  td { padding: 0.625rem 0.75rem; border-bottom: 1px solid rgba(255, 255, 255, 0.06); vertical-align: top; }
   tr:last-child td { border-bottom: none; }
-  tr:hover td { background: rgba(255, 255, 255, 0.04); }
 
   code {
     font-family: 'Menlo', 'Monaco', 'Courier New', monospace;
-    font-size: 13px;
-    background: rgba(0, 0, 0, 0.4);
-    padding: 2px 6px;
-    border-radius: 4px;
-    color: var(--accent);
+    font-size: 0.8125rem;
+    background: rgba(255, 255, 255, 0.08);
+    padding: 0.1rem 0.35rem;
+    border-radius: 0.25rem;
+    color: #fb923c;
   }
   pre {
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    border-radius: var(--radius-sm);
-    padding: 20px;
-    overflow-x: auto;
-    margin: 16px 0;
-    font-size: 13px;
-    line-height: 1.6;
-    box-shadow: var(--shadow-glass);
-  }
-  pre code { background: none; padding: 0; color: var(--text); }
-
-  .diagram {
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur-strong));
-    -webkit-backdrop-filter: blur(var(--glass-blur-strong));
-    border: 1px solid var(--glass-border);
-    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
-    border-radius: var(--radius);
-    padding: 24px;
-    margin: 20px 0;
-    overflow-x: auto;
     font-family: 'Menlo', 'Monaco', monospace;
-    font-size: 13px;
-    line-height: 1.5;
-    color: var(--text-muted);
-    white-space: pre;
+    font-size: 0.8125rem;
+    line-height: 1.55;
+    color: rgba(255, 255, 255, 0.6);
+    overflow-x: auto;
   }
-  .diagram .highlight { color: var(--accent); font-weight: 600; }
-  .diagram .green { color: var(--green); }
-  .diagram .blue { color: var(--blue); }
-  .diagram .red { color: var(--red); }
-  .diagram .purple { color: var(--purple); }
-  .diagram .yellow { color: var(--yellow); }
+  pre code { background: none; padding: 0; color: rgba(255,255,255,0.85); }
+  pre .a { color: #fb923c; font-weight: 600; }
+  pre .g { color: #4ade80; }
+  pre .b { color: #60a5fa; }
+  pre .r { color: #f87171; }
+  pre .p { color: #a78bfa; }
+  pre .y { color: #facc15; }
 
-  .callout {
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    border-radius: var(--radius-sm);
-    padding: 16px 20px;
-    margin: 16px 0;
-    font-size: 14px;
-    border-left: 3px solid;
-    box-shadow: var(--shadow-glass);
-  }
-  .callout-info { border-color: var(--blue); }
-  .callout-warn { border-color: var(--yellow); }
-  .callout-danger { border-color: var(--red); }
-  .callout-success { border-color: var(--green); }
-  .callout-learn {
-    border-color: var(--purple);
-    background: rgba(167, 139, 250, 0.06);
+  .ok { color: #4ade80; }
+  .warn { color: #facc15; }
+  .bad { color: #f87171; }
+
+  ol.steps { list-style: none; margin-left: 0; counter-reset: s; }
+  ol.steps li {
+    counter-increment: s;
     position: relative;
-    padding-top: 32px;
+    padding-left: 2.25rem;
+    margin: 0.85rem 0;
   }
-  .callout-learn::before {
-    content: 'In Plain Words';
-    position: absolute;
-    top: 10px; left: 20px;
-    font-size: 10px;
-    font-weight: 700;
-    letter-spacing: 0.1em;
-    text-transform: uppercase;
-    color: var(--purple);
-  }
-  .callout strong { display: block; margin-bottom: 4px; }
-
-  .score-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
-    gap: 12px;
-    margin: 20px 0;
-  }
-  .score-card {
-    background: var(--glass-darker);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    box-shadow: var(--shadow-glass), var(--shadow-glass-inset);
-    border-radius: var(--radius);
-    padding: 16px;
-    text-align: center;
-    transition: transform var(--transition);
-  }
-  .score-card:hover { transform: translateY(-2px); }
-  .score-card .score {
-    font-family: 'Montserrat', 'Avenir Next', sans-serif;
-    font-size: 28px; font-weight: 800;
-    margin: 4px 0;
-    color: var(--accent);
-  }
-  .score-card .label {
-    font-size: 11px;
-    color: var(--text-muted);
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
+  ol.steps li::before {
+    content: counter(s);
+    position: absolute; left: 0; top: 0.15rem;
+    width: 1.5rem; height: 1.5rem;
+    border-radius: 9999px;
+    background: rgba(249, 115, 22, 0.18);
+    color: #fb923c;
+    font-size: 0.75rem; font-weight: 700;
+    display: flex; align-items: center; justify-content: center;
   }
 
-  .steps { counter-reset: step; margin: 20px 0; }
-  .step {
-    position: relative;
-    padding: 16px 20px 16px 64px;
-    margin: 12px 0;
-    background: var(--glass-card);
-    backdrop-filter: blur(var(--glass-blur));
-    -webkit-backdrop-filter: blur(var(--glass-blur));
-    border: 1px solid var(--glass-border);
-    border-radius: var(--radius-sm);
-    box-shadow: var(--shadow-glass);
-    counter-increment: step;
-  }
-  .step::before {
-    content: counter(step);
-    position: absolute;
-    left: 18px; top: 50%;
-    transform: translateY(-50%);
-    width: 30px; height: 30px;
-    border-radius: 50%;
-    background: var(--accent-dim);
-    color: var(--accent);
-    font-weight: 700;
-    font-size: 14px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    line-height: 30px;
-    text-align: center;
-  }
-  .step h4 { margin: 0 0 4px; }
-  .step p { margin: 0; font-size: 13px; color: var(--text-muted); }
-
-  hr {
-    border: none;
-    border-top: 1px solid var(--glass-border);
-    margin: 48px 0;
-  }
-
-  @media (max-width: 900px) {
-    nav { display: none; }
-    main { margin-left: 0; padding: 20px; }
-    .hero h1 { font-size: 32px; }
+  @media (max-width: 920px) {
+    aside { display: none; }
+    main { padding: 1.5rem 1rem 4rem; }
+    h1 { font-size: 1.5rem; }
   }
 </style>
 </head>
 <body>
 
-<nav>
-  <div class="logo">
-    <h1>Archipelago</h1>
-    <p>Seed &amp; Entropy Guide</p>
+<div class="dashboard-view">
+
+<aside>
+  <div class="sidebar-shell">
+    <div class="sidebar-inner">
+
+      <div class="sidebar-logo">
+        <div class="logo-gradient-border">
+          <svg viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg" aria-label="Neode">
+            <rect width="1024" height="1024" fill="#030202"/>
+            <rect class="logo-square" style="--delay:0ms"    x="357.614" y="318"     width="71.007" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:100ms"  x="436.152" y="318"     width="72.082" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:200ms"  x="515.766" y="318"     width="72.082" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:300ms"  x="595.379" y="318"     width="71.007" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:400ms"  x="595.379" y="396.46"  width="71.007" height="72.011" fill="white"/>
+            <rect class="logo-square" style="--delay:500ms"  x="673.917" y="396.46"  width="72.083" height="72.011" fill="white"/>
+            <rect class="logo-square" style="--delay:600ms"  x="278"     y="475.994" width="72.083" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:700ms"  x="357.614" y="475.994" width="71.007" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:800ms"  x="436.152" y="475.994" width="72.082" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:900ms"  x="515.766" y="475.994" width="72.082" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:1000ms" x="595.379" y="475.994" width="71.007" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:1100ms" x="673.917" y="475.994" width="72.083" height="72.012" fill="white"/>
+            <rect class="logo-square" style="--delay:1200ms" x="278"     y="555.529" width="72.083" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:1300ms" x="357.614" y="555.529" width="71.007" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:1400ms" x="595.379" y="555.529" width="71.007" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:1500ms" x="673.917" y="555.529" width="72.083" height="70.936" fill="white"/>
+            <rect class="logo-square" style="--delay:1600ms" x="357.614" y="633.989" width="71.007" height="72.011" fill="white"/>
+            <rect class="logo-square" style="--delay:1700ms" x="436.152" y="633.989" width="72.082" height="72.011" fill="white"/>
+            <rect class="logo-square" style="--delay:1800ms" x="515.766" y="633.989" width="72.082" height="72.011" fill="white"/>
+            <rect class="logo-square" style="--delay:1900ms" x="595.379" y="633.989" width="71.007" height="72.011" fill="white"/>
+          </svg>
+        </div>
+        <div style="min-width:0;flex:1">
+          <h2>Seed &amp; Entropy</h2>
+          <p>Node security guide</p>
+        </div>
+      </div>
+
+      <nav class="sidebar-nav" aria-label="Guide sections">
+        <a class="sidebar-nav-item nav-tab-active" href="#overview" style="--nav-stagger:0">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"/></svg>
+          <span>Overview</span>
+        </a>
+        <a class="sidebar-nav-item" href="#creation" style="--nav-stagger:1">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/></svg>
+          <span>How it's created</span>
+        </a>
+        <a class="sidebar-nav-item" href="#guardrails" style="--nav-stagger:2">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>
+          <span>Guardrails</span>
+          <span class="badge">5</span>
+        </a>
+        <a class="sidebar-nav-item" href="#storage" style="--nav-stagger:3">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/></svg>
+          <span>Stored on disk</span>
+        </a>
+        <a class="sidebar-nav-item" href="#derivation" style="--nav-stagger:4">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.684 13.342C8.886 12.938 9 12.482 9 12c0-.482-.114-.938-.316-1.342m0 2.684a3 3 0 110-2.684m0 2.684l6.632 3.316m-6.632-6l6.632-3.316m0 0a3 3 0 105.367-2.684 3 3 0 00-5.367 2.684zm0 9.316a3 3 0 105.368 2.684 3 3 0 00-5.368-2.684z"/></svg>
+          <span>Derivation tree</span>
+        </a>
+        <a class="sidebar-nav-item" href="#failures" style="--nav-stagger:5">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"/></svg>
+          <span>Failures</span>
+        </a>
+        <a class="sidebar-nav-item" href="#restore" style="--nav-stagger:6">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg>
+          <span>Restore</span>
+        </a>
+        <a class="sidebar-nav-item" href="#verify" style="--nav-stagger:7">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>
+          <span>Verify it yourself</span>
+        </a>
+      </nav>
+
+      <div class="sidebar-bottom">
+        <a class="sidebar-nav-item" href="/dashboard/settings" style="--nav-stagger:8">
+          <svg fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 19l-7-7m0 0l7-7m-7 7h18"/></svg>
+          <span>Back to Settings</span>
+        </a>
+      </div>
+
+    </div>
   </div>
-
-  <div class="nav-section">Overview</div>
-  <a href="#intro">Introduction</a>
-  <a href="#big-picture">The Big Picture</a>
-
-  <div class="nav-section">Creation</div>
-  <a href="#randomness">Where Randomness Comes From</a>
-  <a href="#when">When the Seed Is Born</a>
-  <a href="#guardrails">The Five Guardrails</a>
-  <a href="#hardening">Recent Hardening</a>
-
-  <div class="nav-section">Storage</div>
-  <a href="#storage">What's Kept on Disk</a>
-  <a href="#envelope">The Encrypted Envelope</a>
-
-  <div class="nav-section">Derivation</div>
-  <a href="#tree">The Derivation Tree</a>
-  <a href="#lightning">The Lightning Special Case</a>
-  <a href="#second-order">Second-Order Keys</a>
-  <a href="#independent">What Is NOT Derived</a>
-
-  <div class="nav-section">Failure &amp; Recovery</div>
-  <a href="#failures">Failure Modes &amp; Fallbacks</a>
-  <a href="#restore">The Restore Flow</a>
-  <a href="#comes-back">What Comes Back (and What Doesn't)</a>
-  <a href="#seedqr">SeedQR</a>
-
-  <div class="nav-section">Assurance</div>
-  <a href="#limitations">Honest Edges</a>
-  <a href="#verify">Verify It Yourself</a>
-</nav>
+</aside>
 
 <main>
+<div class="content">
 
-<div class="hero">
-  <h1>Your Node's Seed &amp; Entropy</h1>
-  <p class="tagline">How 32 random bytes become every key your node owns — where that randomness comes from, what protects it, and exactly what your 24 words can (and cannot) bring back.</p>
-  <div class="meta">
-    <span>256-bit entropy</span>
-    <span>BIP-39 · 24 words</span>
-    <span>HKDF-SHA256 derivation</span>
-    <span>Kernel CSPRNG only</span>
-    <span>KEY-05 hardened</span>
+  <h1>Your node's seed &amp; entropy</h1>
+  <p class="lede">How 32 random bytes become every key this node owns — where the randomness comes from, what protects it, and exactly what your 24 words can and cannot bring back.</p>
+  <div class="pills">
+    <span class="pill">256-bit entropy</span>
+    <span class="pill">BIP-39 · 24 words</span>
+    <span class="pill">HKDF-SHA256</span>
+    <span class="pill">Kernel CSPRNG only</span>
+    <span class="pill">KEY-05 hardened</span>
   </div>
-</div>
 
-<h2 id="intro">Introduction</h2>
-<p class="subtitle">One master secret, many keys — by design.</p>
+  <h2 id="overview">Overview</h2>
+  <p class="lede">One master secret, many keys — by design.</p>
 
-<p>
-Almost everything cryptographic on this node — its identity, its Nostr keys, its mesh
-transport keys, its Lightning wallet — grows from a <strong>single master seed</strong>:
-32 bytes (256 bits) of randomness drawn once, shown to you once as a 24-word recovery
-phrase, and never stored in raw form anywhere.
-</p>
+  <p>
+    Almost everything cryptographic on this node — its identity, its Nostr keys, its mesh
+    transport keys, its Lightning wallet — grows from a <strong>single master seed</strong>:
+    32 bytes of randomness drawn once, shown to you once as a 24-word recovery phrase, and
+    never stored in raw form anywhere.
+  </p>
 
-<div class="callout callout-learn">
-  <strong>The tree and the acorn</strong>
-  Think of the seed as an acorn. Every branch of the tree — your identity, your wallet,
-  your mesh radio's name — grows from it in a fixed, repeatable pattern. Plant the same
-  acorn on new hardware (by typing your 24 words) and the <em>same tree</em> grows back,
-  branch for branch. That's why those words are the single most valuable thing your node
-  ever shows you — and why anyone who copies them owns your tree.
-</div>
+  <div class="glass-card">
+    <span class="section-label accent">In plain words</span>
+    <p>
+      Think of the seed as an acorn. Every branch of the tree — your identity, your wallet,
+      your mesh radio's name — grows from it in a fixed, repeatable pattern. Plant the same
+      acorn on new hardware by typing your 24 words and the <em>same tree</em> grows back,
+      branch for branch. That is why those words are the most valuable thing your node ever
+      shows you, and why anyone who copies them owns your tree.
+    </p>
+  </div>
 
-<p>
-This page explains, in both plain and technical language: where those 32 bytes come from,
-the guardrails that make sure they're genuinely random, how they're protected on disk,
-everything that is derived from them, everything that deliberately <em>isn't</em>, and
-what happens in every failure and recovery scenario.
-</p>
+  <div class="glass-card">
+<pre><span class="b">Linux kernel CSPRNG</span>  (interrupt timing, jitter, CPU RNG)
+      │
+      │  getrandom(2) — via an explicitly named <span class="a">OsRng</span>, nothing else allowed
+      ▼
+<span class="a">32 bytes raw entropy</span> ──▶ degenerate-draw check ──▶ <span class="r">refuse &amp; wipe if suspicious</span>
+      │
+      │  BIP-39 encoding
+      ▼
+<span class="g">24-word recovery phrase</span>  ←── the only form you ever see or back up
+      │
+      │  PBKDF2-HMAC-SHA512 × 2048
+      ▼
+<span class="a">64-byte master seed</span>      ←── lives only in RAM, never written to disk
+      │
+      ├─ HKDF "archipelago/node/ed25519/v1"    ──▶ <span class="g">Node identity key + DID</span>
+      ├─ HKDF "archipelago/nostr-node/…/v1"    ──▶ <span class="p">Node Nostr key (npub)</span>
+      ├─ HKDF "archipelago/fips/secp256k1/v1"  ──▶ <span class="b">FIPS mesh transport key</span>
+      ├─ HKDF "archipelago/identity/{i}/…/v1"  ──▶ <span class="g">Personal identities</span>
+      ├─ BIP-32 m/44'/1237'/0'/0/{i} (NIP-06)  ──▶ <span class="p">Personal Nostr keys</span>
+      ├─ HKDF "archipelago/lnd/entropy/v1"     ──▶ <span class="y">Lightning entropy → aezeed</span>
+      └─ BIP-32 m/84'/0'/0'                    ──▶ <span class="y">Bitcoin xprv (dormant)</span>
+                  │
+                  │  and from the node key, second-order:
+                  ▼
+      ├─ <span class="b">Reticulum / LXMF mesh identity</span>
+      ├─ <span class="g">Message-store + contacts encryption</span>
+      └─ <span class="g">Credential-store key</span>
+</pre>
+  </div>
 
-<h2 id="big-picture">The Big Picture</h2>
-<p class="subtitle">From kernel randomness to every key on the node.</p>
+  <div class="glass-card">
+    <h4>One rule to remember</h4>
+    <p>
+      If it is on the diagram above, your 24 words rebuild it from scratch, on any hardware,
+      forever. If it is not on the diagram — session tokens, app passwords, WireGuard keys,
+      Lightning channel state — it is independent randomness, protected by other backups.
+    </p>
+  </div>
 
-<div class="diagram">
-<span class="blue">Linux kernel CSPRNG</span>  (hardware noise: interrupts, timing jitter, CPU RNG)
-        │
-        │  getrandom(2) — via an explicitly named <span class="highlight">OsRng</span>, nothing else allowed
-        ▼
-<span class="highlight">32 bytes of raw entropy</span>  ──▶  degenerate-draw check ──▶ <span class="red">refuse &amp; wipe if suspicious</span>
-        │
-        │  BIP-39 encoding
-        ▼
-<span class="green">24-word recovery phrase</span>   ←── the only form you ever see or back up
-        │
-        │  PBKDF2-HMAC-SHA512 × 2048 (empty passphrase)
-        ▼
-<span class="highlight">64-byte master seed</span>       ←── lives only in RAM, never written to disk
-        │
-        ├── HKDF "archipelago/node/ed25519/v1"      ──▶ <span class="green">Node identity key + DID</span>
-        ├── HKDF "archipelago/nostr-node/…/v1"      ──▶ <span class="purple">Node Nostr key (npub)</span>
-        ├── HKDF "archipelago/fips/secp256k1/v1"    ──▶ <span class="blue">FIPS mesh transport key</span>
-        ├── HKDF "archipelago/identity/{i}/…/v1"    ──▶ <span class="green">Personal identities (Ed25519)</span>
-        ├── BIP-32 m/44'/1237'/0'/0/{i}  (NIP-06)   ──▶ <span class="purple">Personal Nostr keys</span>
-        ├── HKDF "archipelago/lnd/entropy/v1"       ──▶ <span class="yellow">Lightning wallet entropy → aezeed</span>
-        └── BIP-32 m/84'/0'/0'                      ──▶ <span class="yellow">Bitcoin xprv (dormant, reserved)</span>
-                    │
-                    │  and from the node identity key, second-order:
-                    ▼
-        ├── <span class="blue">Reticulum / RNS mesh identity</span>  (HKDF, salt "archipelago-reticulum-identity-v1")
-        ├── <span class="green">Message-store encryption key</span>   (SHA-256 domain-separated)
-        ├── <span class="green">Mesh-contacts encryption key</span>   (SHA-256 domain-separated)
-        └── <span class="green">Credential-store key</span>           (SHA-256 domain-separated)
-</div>
+  <h2 id="creation">How it's created</h2>
+  <p class="lede">One named source. No mixing. No silent defaults.</p>
 
-<div class="callout callout-info">
-  <strong>One rule to remember</strong>
-  If it's on the diagram above, your 24 words can rebuild it from scratch, on any hardware,
-  forever. If it's not on the diagram (session tokens, app passwords, WireGuard keys,
-  the Lightning channel state…), it's independent randomness — protected by other backups,
-  not by the words.
-</div>
+  <div class="glass-card">
+    <span class="section-label accent">In plain words</span>
+    <p>
+      Computers cannot invent randomness — they collect it. The Linux kernel constantly
+      harvests unpredictable physical noise (the exact nanosecond a network card interrupts,
+      timing jitter between CPU cores, the CPU's hardware random generator) into a
+      cryptographic pool. Archipelago rolls its dice by asking that pool directly, and only
+      that pool. There is deliberately no blending of other sources: a single, named,
+      well-studied source is auditable, whereas a blend is a place for bugs to hide.
+    </p>
+  </div>
 
-<h2 id="randomness">Where Randomness Comes From</h2>
-<p class="subtitle">One named source. No mixing. No silent defaults.</p>
+  <h3>Technically</h3>
+  <p>
+    The master seed is generated by <code>MasterSeed::generate()</code> in
+    <code>core/archipelago/src/seed.rs</code>. It fills a 32-byte buffer using
+    <code>rand::rngs::OsRng</code> — a thin wrapper around the <code>getrandom(2)</code>
+    system call, which reads the kernel CSPRNG (same source as <code>/dev/urandom</code>,
+    but immune to file-descriptor exhaustion and chroot tricks).
+  </p>
 
-<div class="callout callout-learn">
-  <strong>Dice you can audit</strong>
-  Computers can't invent randomness — they collect it. The Linux kernel constantly harvests
-  unpredictable physical noise (the exact nanosecond your network card interrupts, timing
-  jitter between CPU cores, the CPU's built-in hardware random generator) and distils it
-  into a cryptographic random pool. Archipelago rolls its dice by asking that pool
-  directly — and <em>only</em> that pool. There is deliberately no "mixing" of other
-  sources, because a single, named, well-studied source is auditable; a blend of
-  sources is a place for bugs to hide.
-</div>
-
-<h3>Technically</h3>
-<p>
-The master seed is generated by <code>MasterSeed::generate()</code> in
-<code>core/archipelago/src/seed.rs</code>. It fills a 32-byte buffer using
-<code>rand::rngs::OsRng</code> — a thin wrapper around the
-<code>getrandom(2)</code> system call, which reads the kernel's CSPRNG
-(the same source as <code>/dev/urandom</code>, but immune to file-descriptor
-exhaustion and chroot tricks).
-</p>
-
-<ul>
-  <li><strong>Exactly 32 bytes / 256 bits</strong> — the maximum BIP-39 strength, encoding to 24 words.</li>
-  <li><strong>The RNG is named at the call site.</strong> No function anywhere in the codebase generates key material with a "default" or implicit RNG anymore (see <a href="#hardening">Recent Hardening</a> for why this is stated so emphatically).</li>
-  <li><strong>The RNG type is compiler-enforced.</strong> Key-generation functions only accept RNGs on a <em>sealed allowlist</em> (<code>KeyGenRng</code> in <code>core/archipelago/src/entropy.rs</code>). The list has exactly one production member: <code>OsRng</code>. No other module — not even a future refactor — can add a weaker RNG without editing the allowlist file itself.</li>
-  <li><strong>The buffer is zeroized</strong> (securely wiped from memory) on every path, success or failure.</li>
-</ul>
-
-<pre><code>// core/archipelago/src/seed.rs — the actual draw
-let mut entropy = [0u8; 32];
+  <div class="glass-card">
+<pre><code>let mut entropy = [0u8; 32];
 crate::entropy::draw_key_bytes(&amp;mut rand::rngs::OsRng, &amp;mut entropy)?;  // guarded draw
-let mnemonic = bip39::Mnemonic::from_entropy(&amp;entropy)?;               // → 24 words
-entropy.zeroize();                                                      // wipe the raw bytes</code></pre>
+let mnemonic = bip39::Mnemonic::from_entropy(&amp;entropy)?;                // → 24 words
+entropy.zeroize();                                                       // wipe raw bytes</code></pre>
+  </div>
 
-<p>
-The 24 words are then stretched into the 64-byte master seed using standard BIP-39:
-<code>PBKDF2-HMAC-SHA512</code>, 2048 rounds, empty passphrase. (There is no "25th word"
-passphrase — your login password protects the stored backup instead, see
-<a href="#envelope">The Encrypted Envelope</a>.) That 64-byte seed exists
-<strong>only in memory</strong>, is re-computed from the words whenever needed, and is
-never written to disk in any form.
-</p>
+  <ul>
+    <li><strong>Exactly 32 bytes / 256 bits</strong> — the maximum BIP-39 strength, encoding to 24 words.</li>
+    <li><strong>The RNG is named at the call site.</strong> No function anywhere generates key material with a default or implicit RNG.</li>
+    <li><strong>The RNG type is compiler-enforced.</strong> Key generation only accepts RNGs on a sealed allowlist (<code>KeyGenRng</code>) whose single production member is <code>OsRng</code>.</li>
+    <li><strong>The buffer is zeroized</strong> on every path, success or failure.</li>
+  </ul>
 
-<h2 id="when">When the Seed Is Born</h2>
-<p class="subtitle">At onboarding — not at first boot.</p>
+  <p>
+    The words are then stretched into the 64-byte master seed by standard BIP-39:
+    PBKDF2-HMAC-SHA512, 2048 rounds, empty passphrase. That 64-byte value is a 512-bit
+    expansion of the same 256 bits of entropy — not extra randomness. It exists only in
+    memory, is recomputed from the words when needed, and never touches disk.
+  </p>
 
-<div class="steps">
-  <div class="step">
-    <h4>First boot: a placeholder key</h4>
-    <p>A freshly-flashed node boots with a random <em>temporary</em> identity key so services can start. This key is NOT seed-derived and is about to be thrown away.</p>
+  <h3>When the seed is born</h3>
+  <p>At onboarding — not at first boot.</p>
+  <div class="glass-card">
+    <ol class="steps">
+      <li><strong>First boot: a placeholder.</strong> A freshly flashed node boots with a random <em>temporary</em> identity key so services can start. It is not seed-derived and is about to be thrown away.</li>
+      <li><strong>Onboarding: the real draw.</strong> At the "Recovery phrase" step, the <code>seed.generate</code> RPC performs the guarded 32-byte draw and shows you the 24 words.</li>
+      <li><strong>Derivation.</strong> Node key, DID, Nostr key, FIPS mesh key and your first identity are derived and written to <code>/var/lib/archipelago/identity/</code> at mode 0600, overwriting the placeholder.</li>
+      <li><strong>Password setup: the backup is sealed.</strong> The words are encrypted under your login password and stored as <code>master_seed.enc</code>, so you can reveal them again later.</li>
+    </ol>
+    <p>
+      Generation is idempotent for 10 minutes and serialised behind a lock: a browser refresh
+      returns the <em>same</em> words rather than minting a second seed.
+    </p>
   </div>
-  <div class="step">
-    <h4>Onboarding: the real draw</h4>
-    <p>When you reach the "Recovery phrase" step of setup, the <code>seed.generate</code> RPC performs the guarded 32-byte draw described above and shows you the 24 words — the only time they're ever displayed unprompted.</p>
+
+  <h2 id="guardrails">Guardrails</h2>
+  <p class="lede">Defence in depth around a single random draw.</p>
+
+  <div class="grid">
+    <div class="glass-card">
+      <h4><span class="badge muted">1</span> Sealed RNG allowlist</h4>
+      <p>Key draws only compile against RNG types on a closed, private allowlist. A refactor that swaps in a weak or deterministic RNG becomes a <em>compile error</em>, not a silent disaster.</p>
+    </div>
+    <div class="glass-card">
+      <h4><span class="badge muted">2</span> Degenerate-draw refusal</h4>
+      <p>Every draw is checked for three broken-RNG shapes: all zeros, all bytes identical, or a counting pattern. A match is refused and wiped — <strong>never retried</strong>, because retrying would mask a broken RNG instead of exposing it.</p>
+    </div>
+    <div class="glass-card">
+      <h4><span class="badge muted">3</span> CSPRNG readiness ledger</h4>
+      <p>Before generating, the node probes whether the kernel pool is fully initialised and appends the verdict to an append-only log at <code>security/csprng-readiness.jsonl</code> (0600). You can audit the entropy conditions your seed was born under, forever.</p>
+    </div>
+    <div class="glass-card">
+      <h4><span class="badge muted">4</span> Build-time lint bans</h4>
+      <p>CI bans <code>rand::random()</code> and <code>rand::thread_rng()</code> across the workspace — the two convenient entry points behind real-world wallet disasters. Using either fails the build.</p>
+    </div>
+    <div class="glass-card">
+      <h4><span class="badge muted">5</span> Zeroization everywhere</h4>
+      <p>Raw entropy, mnemonics and derived secrets are wiped from memory on every code path, including error paths, so key material does not linger in freed RAM or crash dumps.</p>
+    </div>
   </div>
-  <div class="step">
-    <h4>Derivation: keys are materialised</h4>
-    <p>The node identity key, DID, Nostr key, FIPS mesh key, and your first personal identity are all derived from the seed and written to <code>/var/lib/archipelago/identity/</code> (each file mode 0600). The placeholder key from step 1 is overwritten.</p>
+
+  <div class="glass-card">
+    <span class="section-label accent">In plain words</span>
+    <h4>Why so paranoid about one function?</h4>
+    <p>
+      In 2026 a well-known hardware wallet shipped a bug where a refactor quietly switched
+      seed generation to a <em>predictable</em> random source — no error, no warning, and seeds
+      that looked perfectly normal. Predictable randomness is invisible: the words look random,
+      the wallet works, and months later someone who can predict the generator drains it.
+      Archipelago's answer is to make that entire class of bug impossible to compile, and to
+      log the health of the random pool at the moment your seed was created.
+    </p>
   </div>
-  <div class="step">
-    <h4>Password setup: the backup is sealed</h4>
-    <p>When you set your login password, the 24 words are encrypted under it (Argon2 + ChaCha20-Poly1305) and stored as <code>master_seed.enc</code> — so you can re-reveal them later from Settings → Backup.</p>
+
+  <h3>What the degenerate check does and doesn't do</h3>
+  <p>
+    It is deliberately closed-form: it recognises exactly three catastrophic shapes
+    (all-zero, all-identical, ±1 counter). It is <em>not</em> a statistical entropy estimator —
+    those cannot distinguish good randomness from a cleverly broken RNG and add false
+    positives. The security load is carried by guardrails 1, 3 and 4; this is a tripwire for
+    total RNG failure, such as a buffer that was never filled.
+  </p>
+
+  <h3>Recent hardening</h3>
+  <p>
+    This system was audited and rebuilt in early August 2026. The headline finding: the
+    mnemonic library was silently choosing its own RNG via a transitive default. It happened
+    to be a secure one, but nothing guaranteed that, and a dependency update could have
+    changed it with no diff in Archipelago's own code.
+  </p>
+  <div class="glass-card">
+    <table>
+      <tr><th>Date</th><th>Change</th></tr>
+      <tr><td>Jul 30</td><td>Kernel CSPRNG readiness probe; non-determinism regression test (64 consecutive mnemonics must be unique).</td></tr>
+      <tr><td>Jul 31</td><td>Full entropy audit published (findings F-01…F-13).</td></tr>
+      <tr><td>Aug 1</td><td><strong>The pivotal fix:</strong> master-seed RNG made explicit — <code>OsRng</code> named at the call site, injected through a testable seam, pinned by a known-answer test.</td></tr>
+      <tr><td>Aug 2</td><td>Audit widened: 43 defaulted-RNG call sites across 15 files migrated to explicit <code>OsRng</code>, including AEAD nonces and ecash key material.</td></tr>
+      <tr><td>Aug 2</td><td>Onboarding RPCs gated — <code>seed.restore</code> now refuses on a provisioned node (previously an unauthenticated restore could hijack a live node; fixed before any release shipped it).</td></tr>
+      <tr><td>Aug 2</td><td>KEY-05 layer landed: sealed allowlist, guarded draws, readiness ledger, clippy bans, supply-chain pinning of the <code>rand</code> crate.</td></tr>
+      <tr><td>Aug 2</td><td>Legacy Bitcoin Core wallet-import path deleted — the master xprv is no longer handed to any external wallet process.</td></tr>
+    </table>
   </div>
+
+  <h2 id="storage">Stored on disk</h2>
+  <p class="lede">The words, encrypted — and the derived keys. Never the raw seed.</p>
+
+  <div class="glass-card">
+    <table>
+      <tr><th>File</th><th>Contents</th><th>Protection</th></tr>
+      <tr><td><code>identity/master_seed.enc</code></td><td>Your 24 words, encrypted</td><td>Argon2(login password) + ChaCha20-Poly1305, 0600</td></tr>
+      <tr><td><code>identity/node_key</code></td><td>Node Ed25519 identity key</td><td>0600, seed-derived</td></tr>
+      <tr><td><code>identity/nostr_secret</code></td><td>Node Nostr keypair</td><td>0600, seed-derived</td></tr>
+      <tr><td><code>identity/fips_key</code></td><td>FIPS mesh transport key (bech32 nsec)</td><td>0600, seed-derived</td></tr>
+      <tr><td><code>identity/identity_index</code></td><td>Next unused derivation index</td><td>Plain integer, not secret</td></tr>
+      <tr><td><code>identities/&lt;uuid&gt;.json</code></td><td>Identity records: keys + metadata</td><td>0600; keys seed-derived, <em>metadata is not</em></td></tr>
+      <tr><td><code>identity/lnd_aezeed.enc</code></td><td>Lightning wallet's own seed</td><td>Encrypted under the LND wallet password</td></tr>
+      <tr><td><code>security/csprng-readiness.jsonl</code></td><td>Append-only entropy audit trail</td><td>0600; outside <code>identity/</code> so restores never touch it</td></tr>
+    </table>
+  </div>
+
+  <div class="glass-card">
+    <h4 class="ok">The raw seed never touches disk</h4>
+    <p>
+      What is stored is the <em>encrypted words</em> and the <em>derived keys</em>. The 64-byte
+      master seed is recomputed in RAM from the words when needed and wiped afterwards.
+    </p>
+  </div>
+
+  <h3>The encrypted envelope</h3>
+  <div class="glass-card">
+<pre>login password ──▶ <span class="a">Argon2id</span> (memory-hard) ──▶ 256-bit file key
+                       ▲
+               16-byte random salt
+
+24 words ──▶ <span class="a">ChaCha20-Poly1305</span> (authenticated, 12-byte random nonce)
+                       │
+                       ▼
+     ┌───────────┬────────────┬───────────────────────────┐
+     │ salt (16) │ nonce (12) │ ciphertext + auth tag     │  = master_seed.enc
+     └───────────┴────────────┴───────────────────────────┘
+</pre>
+  </div>
+
+  <div class="glass-card">
+    <span class="section-label accent">In plain words</span>
+    <p>
+      Your words are locked in a digital safe whose combination is your login password, run
+      through a deliberately slow, memory-hungry grinder (Argon2) so guessing billions of
+      passwords per second is impractical even for someone who steals the file. The
+      authentication tag means the safe also notices tampering: a modified file fails loudly
+      rather than yielding wrong words.
+    </p>
+  </div>
+
+  <p>
+    Revealing the words later (Settings → Backup → Reveal) requires an authenticated session,
+    re-entering your password, and your 2FA code if enabled. It is rate-limited, and the words
+    go only to your browser — never to logs.
+  </p>
+
+  <h2 id="derivation">Derivation tree</h2>
+  <p class="lede">Every key, its exact derivation, and where it lands.</p>
+
+  <div class="glass-card">
+    <span class="section-label accent">In plain words</span>
+    <p>
+      The node never uses the master seed directly as a key. It uses HKDF — think of a
+      locksmith who, given one master blank and a <em>label</em> ("node key", "mesh key",
+      "Lightning entropy"), cuts a completely different, unrelated key for each label. Knowing
+      one cut key tells you nothing about the others or about the blank. The labels are fixed
+      strings baked into the code, which is what lets the identical tree regrow on new hardware.
+    </p>
+  </div>
+
+  <div class="glass-card">
+    <table>
+      <tr><th>Key</th><th>Method</th><th>Label / path</th></tr>
+      <tr><td><strong>Node identity (Ed25519)</strong> — signs everything, forms your DID</td><td>HKDF-SHA256</td><td><code>archipelago/node/ed25519/v1</code></td></tr>
+      <tr><td><strong>Node Nostr key</strong> — the node's npub</td><td>HKDF-SHA256</td><td><code>archipelago/nostr-node/secp256k1/v1</code></td></tr>
+      <tr><td><strong>FIPS mesh transport key</strong></td><td>HKDF-SHA256</td><td><code>archipelago/fips/secp256k1/v1</code></td></tr>
+      <tr><td><strong>Personal identity #i (Ed25519)</strong></td><td>HKDF-SHA256</td><td><code>archipelago/identity/{i}/ed25519/v1</code></td></tr>
+      <tr><td><strong>Personal Nostr key #i</strong> — NIP-06 standard, portable to other Nostr apps</td><td>BIP-32</td><td><code>m/44'/1237'/0'/0/{i}</code></td></tr>
+      <tr><td><strong>Lightning wallet entropy</strong> — 16 bytes</td><td>HKDF-SHA256</td><td><code>archipelago/lnd/entropy/v1</code></td></tr>
+      <tr><td><strong>Bitcoin BIP-84 xprv</strong> — dormant, reserved for a future cold vault</td><td>BIP-32</td><td><code>m/84'/0'/0'</code></td></tr>
+      <tr><td><strong>Release-root signing key</strong> — never on a node; derived offline by the publisher</td><td>HKDF-SHA256</td><td><code>archipelago/release/root/ed25519/v1</code></td></tr>
+    </table>
+  </div>
+
+  <p>
+    All HKDF derivations are HKDF-SHA256 with a distinct, versioned label — the <code>/v1</code>
+    suffix means a future migration can introduce <code>/v2</code> without ambiguity. Personal
+    Nostr keys deliberately use the NIP-06 standard path instead of HKDF, so the same 24 words
+    typed into any NIP-06 Nostr client reproduce the same npub: your social identity is portable
+    beyond Archipelago.
+  </p>
+
+  <h3>The Lightning special case</h3>
+  <div class="glass-card">
+<pre>master seed ──HKDF──▶ 16 bytes ──▶ <span class="y">LND generates its own "aezeed"</span> ──▶ wallet
+                                              │
+                                              │  ⚠ one-way: the aezeed cannot be
+                                              │    recomputed from your 24 words
+                                              ▼
+                              captured ONCE at init, stored encrypted as
+                              <span class="a">identity/lnd_aezeed.enc</span>
+</pre>
+  </div>
+  <p>
+    LND uses its own seed format, <em>aezeed</em>, which is not BIP-39. Archipelago derives
+    deterministic entropy from your master seed and hands it to LND at wallet creation — but LND
+    wraps it with its own internal salt, so the resulting aezeed cannot be re-derived from your
+    24 words afterwards. The node captures it once and stores it encrypted alongside your other
+    identity files.
+  </p>
+  <div class="glass-card">
+    <h4 class="warn">Back up the Lightning seed separately</h4>
+    <p>
+      Your 24 words restore your node identity and on-chain derivations, but <em>not</em> an
+      already-initialised Lightning wallet, and never off-chain channel balances (those need
+      channel backups, as Lightning requires by design). Treat the aezeed in the Lightning
+      backup screen as a second phrase worth writing down. It restores into LND-based wallets
+      such as Zeus, Blixt or another Archipelago node — hardware wallets cannot import it.
+    </p>
+  </div>
+
+  <h3>Second-order keys</h3>
+  <p>
+    Some subsystems derive from the <em>node identity key</em> rather than the master seed
+    directly. Since the node key is itself seed-derived, these still regrow from your words:
+    <code>words → master seed → node key → subsystem key</code>. Each prefixes a unique fixed
+    string before hashing (domain separation), so compromising one never exposes another.
+  </p>
+  <div class="glass-card">
+    <table>
+      <tr><th>Subsystem</th><th>Derivation from <code>node_key</code></th></tr>
+      <tr><td><strong>Reticulum / LXMF mesh identity</strong> (LoRa long-range mesh)</td><td>HKDF-SHA256, salt <code>archipelago-reticulum-identity-v1</code>, separate X25519 + Ed25519 labels — a stable address that survives reinstalls</td></tr>
+      <tr><td><strong>Message store</strong> (chats at rest)</td><td><code>SHA-256("archipelago-message-store-v1" ‖ node_key)</code></td></tr>
+      <tr><td><strong>Mesh contacts</strong></td><td><code>SHA-256("archipelago-mesh-contacts-v1" ‖ node_key)</code></td></tr>
+      <tr><td><strong>Credential store</strong> (saved app credentials)</td><td>Same domain-separated SHA-256 pattern</td></tr>
+    </table>
+  </div>
+
+  <h3>What is <em>not</em> derived from the seed</h3>
+  <p>
+    Plenty of secrets are freshly random instead. That is intentional: things that should die
+    with a session, rotate freely, or belong to a third-party app must not be recoverable from
+    your words.
+  </p>
+  <div class="grid">
+    <div class="glass-card">
+      <h4>Ephemeral by design</h4>
+      <p>Session tokens, device pairing tokens, federation invites, TOTP secrets and backup codes, all encryption nonces, X3DH ephemeral mesh keys, anonymous marketplace and discovery Nostr keys.</p>
+    </div>
+    <div class="glass-card">
+      <h4>App-owned secrets</h4>
+      <p>Every manifest-declared <code>generated_secret</code> (app database passwords, API keys), Bitcoin RPC credentials, the LND wallet <em>password</em> (distinct from its seed), Home Assistant tokens.</p>
+    </div>
+    <div class="glass-card">
+      <h4>Host-level material</h4>
+      <p>WireGuard keypairs (via <code>wg genkey</code>), SSH host keys and the TLS certificate (created by the installer image at first boot), the machine-id.</p>
+    </div>
+    <div class="glass-card">
+      <h4>Opt-outs from derivability</h4>
+      <p>Identities created with "new random key" instead of seed derivation, and a node key after an explicit <code>rotate-key</code> — rotation deliberately breaks the link to your words, and says so.</p>
+    </div>
+  </div>
+
+  <h2 id="failures">Failures</h2>
+  <p class="lede">What happens when something goes wrong, at every stage.</p>
+
+  <div class="glass-card">
+    <table>
+      <tr><th>Scenario</th><th>Behaviour</th><th>Outcome</th></tr>
+      <tr>
+        <td>RNG returns a degenerate pattern</td>
+        <td>Draw refused and wiped, <strong>never retried</strong>; error logged; onboarding fails loudly</td>
+        <td class="bad">No seed created</td>
+      </tr>
+      <tr>
+        <td>Kernel pool not yet initialised</td>
+        <td><code>getrandom(2)</code> blocks until seeded — an unseeded pool cannot produce a seed. The probe logs a warning and records the verdict</td>
+        <td class="warn">Waits, then proceeds</td>
+      </tr>
+      <tr>
+        <td>Onboarding page refreshed mid-generation</td>
+        <td>Same words returned for 10 minutes, mutex-serialised; no second seed can be minted</td>
+        <td class="ok">Idempotent</td>
+      </tr>
+      <tr>
+        <td><code>master_seed.enc</code> missing</td>
+        <td>Node runs normally — derived keys are already on disk. Only Reveal and future re-derivation are unavailable, and the UI says so</td>
+        <td class="warn">Degraded, functional</td>
+      </tr>
+      <tr>
+        <td>Seed file corrupt, or wrong password</td>
+        <td>Authenticated decryption fails closed with an explicit error — no fallback, no partial output, no auto-regeneration</td>
+        <td class="bad">Fails loudly</td>
+      </tr>
+      <tr>
+        <td>Restore attempted on a provisioned node</td>
+        <td>The onboarding gate refuses identity-mutating RPCs once set up — a live node cannot be hijacked or accidentally re-seeded</td>
+        <td class="ok">Refused</td>
+      </tr>
+      <tr>
+        <td>Legacy or corrupt FIPS key format</td>
+        <td>Self-heals: the legacy raw-byte format is detected and migrated in place to bech32</td>
+        <td class="ok">Auto-migrated</td>
+      </tr>
+      <tr>
+        <td>Readiness-ledger write fails</td>
+        <td>Warns and continues — the audit trail is best-effort and can never block key generation</td>
+        <td class="warn">Non-blocking</td>
+      </tr>
+    </table>
+  </div>
+
+  <div class="glass-card">
+    <h4 class="bad">The one true single point of failure is you</h4>
+    <p>
+      Every software failure above fails <em>safe</em>. The only unrecoverable scenario is
+      losing the 24 words <em>and</em> the node's disk together. Write the words down, store
+      them offline, and never type them into anything except a node you are restoring. Anyone
+      holding them can rebuild your entire identity tree — which is exactly what makes them a
+      perfect backup and a perfect target.
+    </p>
+  </div>
+
+  <h2 id="restore">Restore</h2>
+  <p class="lede">Typing 24 words into a fresh node, step by step.</p>
+
+  <div class="glass-card">
+    <ol class="steps">
+      <li><strong>Gate check.</strong> Restore only proceeds on an un-onboarded node. This gate is load-bearing and runs before anything else.</li>
+      <li><strong>Validation.</strong> Exactly 24 words, checked against the BIP-39 wordlist and its checksum — a typo is caught here, before anything is written.</li>
+      <li><strong>Identity regrowth.</strong> Node key, DID, node Nostr key and FIPS mesh key are re-derived byte-identically, because the HKDF labels are fixed.</li>
+      <li><strong>Personal identity #0.</strong> The index resets to 0 and your default identity (Ed25519 + NIP-06 Nostr key) is recreated. Further seed-derived identities re-derive as the index walks forward, but their names and avatars were metadata, not key material.</li>
+      <li><strong>Mesh reactivation.</strong> FIPS auto-activation starts in the background; the Reticulum identity re-derives from the restored node key, so your LXMF address returns too.</li>
+      <li><strong>Password and re-seal.</strong> Setting the new login password re-encrypts the words into a fresh <code>master_seed.enc</code>, so Reveal works on the restored node.</li>
+    </ol>
+  </div>
+
+  <h3>What comes back — and what doesn't</h3>
+  <div class="grid">
+    <div class="glass-card">
+      <h4 class="ok">Restored by the words</h4>
+      <p>Node identity and DID · node npub · FIPS mesh key · Reticulum/LXMF address · personal identity keys and npubs · message-store, contacts and credential encryption keys · the dormant Bitcoin xprv · the ability to reveal the phrase again.</p>
+    </div>
+    <div class="glass-card">
+      <h4 class="warn">Needs its own backup</h4>
+      <p>Lightning wallet (aezeed — one-way gate) and channel state · chat history and app data (node backup) · identity names and avatars · app secrets, which regenerate on reinstall.</p>
+    </div>
+    <div class="glass-card">
+      <h4 class="bad">Gone by design</h4>
+      <p>Sessions and device pairings (log in, re-pair) · 2FA secret (re-enrol) · WireGuard peers (re-pair) · rotated-away node keys · anonymous throwaway Nostr keys.</p>
+    </div>
+  </div>
+
+  <h3>SeedQR</h3>
+  <p>
+    Wherever the phrase is shown, a QR tab sits beside the words. For the BIP-39 phrase the
+    default is <strong>SeedQR</strong>: each word becomes its 4-digit position in the official
+    wordlist (24 words → 96 digits) as a compact numeric QR. Passport, SeedSigner and Keystone
+    import this directly, so you can move your on-chain identity to cold storage without typing.
+    A plain-text QR fallback exists for wallets that read the phrase as text.
+  </p>
+  <ul>
+    <li>The QR holds <em>exactly the same secret</em> as the words — treat a printout or screenshot identically.</li>
+    <li>The Lightning aezeed is never SeedQR-encoded: it is not BIP-39, hardware wallets cannot import it, and pretending otherwise would be dishonest. It gets a plain-text QR with an explanation.</li>
+    <li>Restore is by typed or pasted words; there is no camera-based SeedQR scanner on the restore path today.</li>
+  </ul>
+
+  <h2 id="verify">Verify it yourself</h2>
+  <p class="lede">Don't trust — recompute.</p>
+
+  <p>Because every derivation is deterministic and label-fixed, you can independently confirm that this node's keys really do come from your words:</p>
+  <ul>
+    <li><strong>Independent re-derivation:</strong> <code>scripts/verify-seed-derivation.py</code> in the Archipelago source — pure standard-library Python, no Archipelago code. On a trusted offline machine it recomputes <code>node_key</code>, <code>nostr_secret</code> and <code>fips_key</code> from your mnemonic and byte-compares them against <code>/var/lib/archipelago/identity/</code>.</li>
+    <li><strong>Known-answer tests:</strong> the test suite pins the exact expected keys for a fixed test mnemonic, so any change to the derivation math turns the build red.</li>
+    <li><strong>Non-determinism test:</strong> 64 consecutive generated mnemonics are asserted unique — a canary against the predictable-RNG failure class.</li>
+    <li><strong>Your own audit trail:</strong> <code>/var/lib/archipelago/security/csprng-readiness.jsonl</code> records, append-only, the kernel randomness verdict at every key-generation event on this node — including the moment your seed was born.</li>
+  </ul>
+
+  <h3>Honest edges</h3>
+  <p>The audit that produced this system also tracked what it did not fix. Naming the edges is part of the point:</p>
+  <ul>
+    <li><strong>The words cross the RPC boundary.</strong> During onboarding the phrase travels to your browser to be displayed, sits in session storage for the wizard's duration, and is held in server memory for the 10-minute idempotence window — the price of a refresh-proof, display-once flow.</li>
+    <li><strong>Argon2 uses library defaults</strong> (≈19 MiB, 2 passes) rather than the heavier profile the design doc specifies. Still memory-hard; scheduled for tightening.</li>
+    <li><strong>2FA backup codes carry slight modulo bias</strong> — cosmetically imperfect, cryptographically irrelevant at their length, queued for cleanup.</li>
+    <li><strong>The lint ban covers the main workspace</strong>, but one small helper crate outside it is not reached yet.</li>
+    <li><strong>Best-effort sealing:</strong> if writing <code>master_seed.enc</code> fails during setup, the node continues (keys exist, only Reveal is lost). Whether that should fail loudly instead is under review.</li>
+  </ul>
+
+  <div class="glass-card">
+    <h4 class="ok">The whole story in one paragraph</h4>
+    <p>
+      Your node asked the Linux kernel for 32 bytes of hardware-grade randomness through a
+      single, named, compiler-enforced channel; refused to proceed unless the bytes looked
+      alive; wrote down the health of the random pool as evidence; turned the bytes into 24
+      words it showed you exactly once; locked an encrypted copy behind your password; and then
+      grew every identity and key it owns from those words along fixed, versioned,
+      independently verifiable paths — so the words in your drawer are, and will remain, a
+      complete blueprint of who your node is.
+    </p>
+  </div>
+
 </div>
-
-<div class="callout callout-info">
-  <strong>Refresh-proof by design</strong>
-  If the onboarding page is retried within 10 minutes (browser refresh, flaky connection),
-  the node returns the <em>same</em> words instead of minting a second seed. Generation is
-  serialised behind a lock — there is no window where two competing seeds can exist.
-</div>
-
-<h2 id="guardrails">The Five Guardrails</h2>
-<p class="subtitle">Defence in depth around a single random draw.</p>
-
-<div class="card-grid">
-  <div class="card-sm">
-    <h4><span class="badge badge-accent">1</span> &nbsp;Sealed RNG allowlist</h4>
-    <p>Key draws only compile against RNG types on a closed, private allowlist. Production allowlist: <code>OsRng</code>. Full stop. A refactor that swaps in a weak or deterministic RNG becomes a <em>compile error</em>, not a silent disaster.</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-accent">2</span> &nbsp;Degenerate-draw refusal</h4>
-    <p>Every draw is inspected for three tell-tale broken-RNG shapes: all zeros, all bytes identical, or a counting pattern. A match is <strong>refused and wiped — never retried</strong>, because retrying would mask a broken RNG instead of exposing it.</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-accent">3</span> &nbsp;CSPRNG readiness ledger</h4>
-    <p>Before generating the seed, the node probes whether the kernel's random pool is fully initialised, and appends the verdict to a tamper-evident, append-only log at <code>security/csprng-readiness.jsonl</code> (0600). You can audit, forever, the entropy conditions your seed was born under.</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-accent">4</span> &nbsp;Build-time lint bans</h4>
-    <p>The CI lint config bans <code>rand::random()</code> and <code>rand::thread_rng()</code> outright across the workspace — the two "convenient" RNG entry points that caused real-world wallet disasters elsewhere. Using either fails the build.</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-accent">5</span> &nbsp;Zeroization everywhere</h4>
-    <p>Raw entropy, mnemonics, and derived secrets are wiped from memory on every code path — including error paths — so key material doesn't linger in freed RAM or end up in crash dumps.</p>
-  </div>
-</div>
-
-<div class="callout callout-learn">
-  <strong>Why so paranoid about one function?</strong>
-  In 2026 a well-known hardware wallet shipped a bug where a code refactor quietly switched
-  seed generation to a <em>predictable</em> random source — with no error, no warning, and
-  seeds that looked perfectly normal. Predictable randomness is invisible: the words look
-  random, the wallet works, and months later someone who can predict the generator drains
-  it. Archipelago's answer is to make that entire class of bug <em>impossible to compile</em>,
-  and to log the health of the random pool at the exact moment your seed was created.
-</div>
-
-<h3>What the degenerate check does — and doesn't — do</h3>
-<p>
-The check (<code>is_degenerate</code> in <code>entropy.rs</code>) is deliberately
-<em>closed-form</em>: it recognises exactly three catastrophic failure shapes
-(all-zero, all-identical, ±1 counter). It is <strong>not</strong> a statistical entropy
-estimator — those can't actually distinguish good randomness from a cleverly broken RNG,
-and they introduce false positives. The real security load is carried by guardrails 1,
-3 and 4; the degenerate check is a tripwire for total RNG failure (e.g. a zeroed buffer
-that was never filled).
-</p>
-
-<h2 id="hardening">Recent Hardening (the KEY-05 work)</h2>
-<p class="subtitle">This system was audited and rebuilt in early August 2026.</p>
-
-<p>
-Triggered by the COLDCARD-class of entropy defects, a full entropy &amp; seed-generation
-audit (<code>docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md</code>) reviewed every random
-draw in the codebase. The headline finding: the library used for mnemonic generation was
-silently choosing its own RNG via a transitive default. It happened to be a secure one —
-but nothing <em>guaranteed</em> that, and a dependency update could have changed it
-without any diff in Archipelago's own code.
-</p>
-
-<table>
-  <tr><th>Date</th><th>Change</th></tr>
-  <tr><td>Jul 30</td><td>Kernel CSPRNG readiness probe added; RNG non-determinism regression test (64 consecutive mnemonics must all be unique).</td></tr>
-  <tr><td>Jul 31</td><td>Full entropy audit published (findings F-01…F-13).</td></tr>
-  <tr><td>Aug 1</td><td><strong>The pivotal fix:</strong> master-seed RNG made explicit — <code>OsRng</code> named at the call site, injected through a testable seam, pinned by a known-answer test.</td></tr>
-  <tr><td>Aug 2</td><td>Audit widened: 43 defaulted-RNG call sites across 15 files found and migrated to explicit <code>OsRng</code> — including AEAD nonces and ecash key material.</td></tr>
-  <tr><td>Aug 2</td><td>Onboarding RPCs gated: <code>seed.restore</code> and friends now refuse on an already-provisioned node (previously an unauthenticated restore call could hijack a live node — fixed before any release shipped it).</td></tr>
-  <tr><td>Aug 2</td><td>KEY-05 enforcement layer landed: sealed <code>KeyGenRng</code> allowlist, guarded draws, durable readiness ledger, clippy bans, supply-chain version pinning on the <code>rand</code> crate.</td></tr>
-  <tr><td>Aug 2</td><td>Legacy Bitcoin Core wallet-import path deleted — the master xprv is no longer handed to any external wallet process.</td></tr>
-</table>
-
-<h2 id="storage">What's Kept on Disk</h2>
-<p class="subtitle">The words, encrypted — and the keys, materialised. Never the raw seed.</p>
-
-<table>
-  <tr><th>File</th><th>Contents</th><th>Protection</th></tr>
-  <tr><td><code>identity/master_seed.enc</code></td><td>Your 24 words (as text), encrypted</td><td>Argon2(login password) + ChaCha20-Poly1305, mode 0600</td></tr>
-  <tr><td><code>identity/node_key</code> / <code>.pub</code></td><td>Node Ed25519 identity key</td><td>0600, seed-derived (recoverable from words)</td></tr>
-  <tr><td><code>identity/nostr_secret</code> / <code>nostr_pubkey</code></td><td>Node Nostr keypair</td><td>0600, seed-derived</td></tr>
-  <tr><td><code>identity/fips_key</code> / <code>.pub</code></td><td>FIPS mesh transport key (bech32 nsec)</td><td>0600, seed-derived</td></tr>
-  <tr><td><code>identity/identity_index</code></td><td>Next unused identity derivation index</td><td>Plain integer (not secret)</td></tr>
-  <tr><td><code>identities/&lt;uuid&gt;.json</code></td><td>Personal identity records (keys + metadata)</td><td>0600; keys seed-derived, <em>metadata is not</em></td></tr>
-  <tr><td><code>identity/lnd_aezeed.enc</code></td><td>Lightning wallet's own seed (see <a href="#lightning">below</a>)</td><td>Encrypted under the LND wallet password</td></tr>
-  <tr><td><code>security/csprng-readiness.jsonl</code></td><td>Append-only entropy audit trail</td><td>0600; deliberately outside <code>identity/</code> so restores never touch it</td></tr>
-</table>
-
-<div class="callout callout-success">
-  <strong>The raw seed never touches disk</strong>
-  What's stored is the <em>encrypted words</em> and the <em>derived keys</em>. The 64-byte
-  master seed itself is recomputed in RAM from the words when needed (e.g. during restore
-  or identity creation) and wiped afterwards.
-</div>
-
-<h2 id="envelope">The Encrypted Envelope</h2>
-<p class="subtitle">How <code>master_seed.enc</code> is built.</p>
-
-<div class="diagram">
-your login password ──▶ <span class="highlight">Argon2id</span> (memory-hard KDF) ──▶ 256-bit file key
-                            ▲
-                    16-byte random salt
-
-24 words ──▶ <span class="highlight">ChaCha20-Poly1305</span> (authenticated encryption, 12-byte random nonce)
-                            │
-                            ▼
-        ┌───────────┬────────────┬──────────────────────────────┐
-        │ salt (16) │ nonce (12) │ ciphertext + auth tag        │   = master_seed.enc
-        └───────────┴────────────┴──────────────────────────────┘
-</div>
-
-<div class="callout callout-learn">
-  <strong>A safe inside a safe</strong>
-  Your words are locked in a digital safe whose combination is your login password —
-  but run through a deliberately slow, memory-hungry grinder (Argon2) so that guessing
-  billions of passwords per second is physically impractical, even for someone who steals
-  the file. The "auth tag" means the safe also notices if anyone has tampered with its
-  contents: a corrupted or modified file fails loudly rather than yielding wrong words.
-</div>
-
-<p>
-Revealing the words later (Settings → Backup → <em>Reveal</em>) requires an authenticated
-session <em>plus</em> re-entering your password <em>plus</em> your 2FA code if enabled,
-is rate-limited, and the words are returned only to your browser — never written to logs.
-</p>
-
-<h2 id="tree">The Derivation Tree</h2>
-<p class="subtitle">Every key, its exact derivation, and where it lands.</p>
-
-<div class="callout callout-learn">
-  <strong>One password, many doors — without reuse</strong>
-  The node never uses the master seed directly as a key. Instead it uses HKDF — think of it
-  as a locksmith who, given one master blank and a <em>label</em> ("node key", "mesh key",
-  "Lightning entropy"…), cuts a completely different, unrelated key for each label. Knowing
-  one cut key tells you nothing about the others or about the blank. The labels are fixed
-  strings baked into the code, which is what makes regrowing the identical tree on new
-  hardware possible.
-</div>
-
-<table>
-  <tr><th>Key</th><th>Derivation</th><th>Label / path</th><th>Materialised at</th></tr>
-  <tr><td><strong>Node identity (Ed25519)</strong> — signs everything, forms your DID</td><td>HKDF-SHA256</td><td><code>archipelago/node/ed25519/v1</code></td><td><code>identity/node_key</code></td></tr>
-  <tr><td><strong>Node Nostr key (secp256k1)</strong> — the node's npub</td><td>HKDF-SHA256</td><td><code>archipelago/nostr-node/secp256k1/v1</code></td><td><code>identity/nostr_secret</code></td></tr>
-  <tr><td><strong>FIPS mesh transport key</strong> — federation/mesh overlay identity</td><td>HKDF-SHA256</td><td><code>archipelago/fips/secp256k1/v1</code></td><td><code>identity/fips_key</code></td></tr>
-  <tr><td><strong>Personal identity #i (Ed25519)</strong></td><td>HKDF-SHA256</td><td><code>archipelago/identity/{i}/ed25519/v1</code></td><td><code>identities/&lt;uuid&gt;.json</code></td></tr>
-  <tr><td><strong>Personal Nostr key #i</strong> — standard NIP-06, importable into other Nostr apps</td><td>BIP-32</td><td><code>m/44'/1237'/0'/0/{i}</code></td><td><code>identities/&lt;uuid&gt;.json</code></td></tr>
-  <tr><td><strong>Lightning (LND) wallet entropy</strong> — 16 bytes</td><td>HKDF-SHA256</td><td><code>archipelago/lnd/entropy/v1</code></td><td>fed into LND at wallet init (see below)</td></tr>
-  <tr><td><strong>Bitcoin BIP-84 account xprv</strong> — native-segwit</td><td>BIP-32</td><td><code>m/84'/0'/0'</code></td><td><em>nowhere</em> — dormant, reserved for a future on-node cold vault</td></tr>
-  <tr><td><strong>Release-root signing key</strong> — fleet update signing</td><td>HKDF-SHA256</td><td><code>archipelago/release/root/ed25519/v1</code></td><td><em>never on a node</em> — derived offline by the publisher from a separate release mnemonic; nodes only pin the public key</td></tr>
-</table>
-
-<p>
-All HKDF derivations are HKDF-SHA256 with a distinct, versioned info-label (the
-<code>/v1</code> suffix means a future algorithm migration can introduce
-<code>/v2</code> labels without ambiguity). Personal Nostr keys intentionally use the
-NIP-06 standard path instead of HKDF so that <em>the same 24 words typed into any
-NIP-06-compliant Nostr client reproduce the same npub</em> — your social identity is
-portable beyond Archipelago.
-</p>
-
-<h2 id="lightning">The Lightning Special Case</h2>
-<p class="subtitle">The one branch of the tree with a one-way gate in it.</p>
-
-<div class="diagram">
-master seed ──HKDF──▶ 16 bytes of entropy ──▶ <span class="yellow">LND generates its own "aezeed"</span> ──▶ Lightning wallet
-                                                        │
-                                                        │  ⚠ one-way: the aezeed cannot be
-                                                        │    recomputed from your 24 words later
-                                                        ▼
-                                       captured ONCE at wallet init and stored as
-                                       <span class="highlight">identity/lnd_aezeed.enc</span> (encrypted)
-</div>
-
-<p>
-LND (the Lightning node) uses its own seed format called <em>aezeed</em>, which is not
-BIP-39. Archipelago derives deterministic entropy from your master seed and hands it to
-LND at wallet-creation time — but LND then wraps it with its own internal random salt,
-so the resulting aezeed <strong>cannot be re-derived from your 24 words afterwards</strong>.
-The node therefore captures the aezeed exactly once, at init, and stores it encrypted
-alongside your other identity files. The Lightning seed backup screen shows it to you
-with the same tap-to-reveal flow as the main phrase.
-</p>
-
-<div class="callout callout-warn">
-  <strong>Back up the Lightning seed separately</strong>
-  Your 24 words alone restore your node identity and on-chain derivations — but
-  <em>not</em> an already-initialised Lightning wallet, and never the off-chain channel
-  balances (those additionally need channel backups, which Lightning requires by design).
-  Treat the LND aezeed shown in the Lightning app's backup screen as a second phrase
-  worth writing down. Note it restores into LND-based wallets (Zeus, Blixt, another
-  Archipelago node) — hardware wallets can't import it.
-</div>
-
-<h2 id="second-order">Second-Order Keys</h2>
-<p class="subtitle">Derived from the node key — so still fully recoverable from the words.</p>
-
-<p>
-Several subsystems derive their keys from the <em>node identity key</em> rather than the
-master seed directly. Since the node key is itself seed-derived, these all regrow from
-your 24 words too — the chain is <code>words → master seed → node key → subsystem key</code>.
-</p>
-
-<table>
-  <tr><th>Subsystem</th><th>Derivation from <code>node_key</code></th></tr>
-  <tr><td><strong>Reticulum / RNS mesh identity</strong> (LoRa long-range mesh)</td><td>HKDF-SHA256, salt <code>archipelago-reticulum-identity-v1</code>, two labels for the X25519 + Ed25519 halves — yields a stable LXMF address that survives reinstalls</td></tr>
-  <tr><td><strong>Message-store encryption</strong> (chats at rest)</td><td><code>SHA-256("archipelago-message-store-v1" ‖ node_key)</code></td></tr>
-  <tr><td><strong>Mesh contacts encryption</strong></td><td><code>SHA-256("archipelago-mesh-contacts-v1" ‖ node_key)</code></td></tr>
-  <tr><td><strong>Credential store</strong> (saved app credentials)</td><td>Same domain-separated SHA-256 pattern</td></tr>
-</table>
-
-<div class="callout callout-learn">
-  <strong>Domain separation, in one sentence</strong>
-  Each purpose prefixes a unique fixed string before hashing, so even though they start
-  from the same node key, every subsystem ends up with an unrelated key — compromising
-  one never exposes another.
-</div>
-
-<h2 id="independent">What Is NOT Derived From the Seed</h2>
-<p class="subtitle">Independent randomness — deliberately outside the tree.</p>
-
-<p>
-Plenty of secrets are <em>freshly random</em> rather than seed-derived. That's intentional:
-things that should die with a session, rotate freely, or belong to a third-party app must
-not be recoverable from your words (and mostly you wouldn't want them to be).
-</p>
-
-<div class="card-grid">
-  <div class="card-sm">
-    <h4>Ephemeral by design</h4>
-    <p>Session tokens, device/companion pairing tokens, federation invites, TOTP/2FA secrets and backup codes, all encryption nonces, X3DH ephemeral mesh keys, anonymous marketplace/discovery Nostr keys.</p>
-  </div>
-  <div class="card-sm">
-    <h4>App-owned secrets</h4>
-    <p>Every manifest-declared <code>generated_secret</code> (app database passwords, API keys), Bitcoin RPC credentials, the LND wallet <em>password</em> (distinct from its seed), Home Assistant tokens.</p>
-  </div>
-  <div class="card-sm">
-    <h4>Host-level material</h4>
-    <p>WireGuard VPN keypairs (generated by <code>wg genkey</code>), SSH host keys and the TLS certificate (created by the installer image at first boot), the machine-id.</p>
-  </div>
-  <div class="card-sm">
-    <h4>Opt-outs from derivability</h4>
-    <p>Extra identities created with "new random key" instead of seed derivation, and a node key after an explicit <code>rotate-key</code> — rotation <em>deliberately</em> breaks the link to the words, and says so.</p>
-  </div>
-</div>
-
-<div class="callout callout-info">
-  <strong>Consequence for backups</strong>
-  A seed-only restore brings back everything in the derivation tree but none of the above.
-  App data, chat history and app secrets travel via the separate node backup/restore
-  feature; Lightning channels need channel backups; VPN peers re-pair. Your words are your
-  <em>identity's</em> lifeboat, not a full-system image.
-</div>
-
-<h2 id="failures">Failure Modes &amp; Fallbacks</h2>
-<p class="subtitle">What happens when something goes wrong — at every stage.</p>
-
-<table>
-  <tr><th>Scenario</th><th>Behaviour</th><th>Outcome</th></tr>
-  <tr>
-    <td>RNG returns a degenerate pattern (all-zero / repeated / counter)</td>
-    <td>Draw is <strong>refused and wiped, never retried</strong>; error logged; onboarding fails loudly</td>
-    <td><span class="badge badge-red">No seed created</span></td>
-  </tr>
-  <tr>
-    <td>Kernel random pool not yet initialised (exotic first-boot case)</td>
-    <td><code>getrandom(2)</code> <strong>blocks</strong> until the pool is seeded — an unseeded pool physically cannot produce a seed. The advisory probe logs a warning and records the verdict in the readiness ledger</td>
-    <td><span class="badge badge-yellow">Waits, then proceeds</span></td>
-  </tr>
-  <tr>
-    <td>Onboarding page refreshed / retried mid-generation</td>
-    <td>Same words returned for 10 minutes (mutex-serialised); no second seed can be minted</td>
-    <td><span class="badge badge-green">Idempotent</span></td>
-  </tr>
-  <tr>
-    <td><code>master_seed.enc</code> missing (e.g. backup write failed during setup)</td>
-    <td>Node runs normally — every derived key is already materialised on disk. Only the <em>Reveal</em> feature and future re-derivation are unavailable; the UI says so explicitly</td>
-    <td><span class="badge badge-yellow">Degraded, functional</span></td>
-  </tr>
-  <tr>
-    <td><code>master_seed.enc</code> corrupt, or wrong password at reveal</td>
-    <td>Authenticated decryption fails closed with an explicit error — no fallback, no partial output, no auto-regeneration</td>
-    <td><span class="badge badge-red">Fails loudly</span></td>
-  </tr>
-  <tr>
-    <td>Restore attempted on an already-provisioned node</td>
-    <td>The onboarding gate refuses identity-mutating RPCs once the node is set up — a live node cannot be hijacked or accidentally re-seeded</td>
-    <td><span class="badge badge-green">Refused</span></td>
-  </tr>
-  <tr>
-    <td>Legacy / corrupt on-disk FIPS key format</td>
-    <td>Self-heals: legacy raw-byte format is detected and migrated in place to the current bech32 format</td>
-    <td><span class="badge badge-green">Auto-migrated</span></td>
-  </tr>
-  <tr>
-    <td>Readiness-ledger write fails (disk full, permissions)</td>
-    <td>Warns and continues — the audit trail is best-effort and can <em>never</em> block key generation</td>
-    <td><span class="badge badge-yellow">Non-blocking</span></td>
-  </tr>
-</table>
-
-<div class="callout callout-danger">
-  <strong>The one true single point of failure is you</strong>
-  Every software failure above fails <em>safe</em>. The only unrecoverable scenario is
-  losing the 24 words <em>and</em> the node's disk together. Write the words down, store
-  them offline, and never type them into anything except a node you're restoring.
-  Anyone holding them can rebuild your entire identity tree — that's precisely
-  what makes them a perfect backup, and a perfect target.
-</div>
-
-<h2 id="restore">The Restore Flow</h2>
-<p class="subtitle">Typing 24 words into a fresh node, step by step.</p>
-
-<div class="steps">
-  <div class="step">
-    <h4>Gate check</h4>
-    <p>Restore only proceeds on an un-onboarded node. A provisioned node refuses — this gate is load-bearing and runs before anything else.</p>
-  </div>
-  <div class="step">
-    <h4>Validation</h4>
-    <p>Exactly 24 words, checked against the BIP-39 wordlist and its built-in checksum — a typo is caught here, before anything is written.</p>
-  </div>
-  <div class="step">
-    <h4>Identity regrowth</h4>
-    <p>Node Ed25519 key + DID, node Nostr key, and FIPS mesh key are re-derived and written — byte-identical to the originals, because the HKDF labels are fixed.</p>
-  </div>
-  <div class="step">
-    <h4>Personal identity #0</h4>
-    <p>The identity index resets to 0 and your default "Personal" identity (Ed25519 + NIP-06 Nostr key) is recreated. If you had created more seed-derived identities, their keys re-derive on demand as the index walks forward — but their names, avatars and profiles were metadata, not key material, and come from a node backup instead.</p>
-  </div>
-  <div class="step">
-    <h4>Mesh reactivation</h4>
-    <p>FIPS federation auto-activation kicks off in the background; the Reticulum identity re-derives from the restored node key, so your LXMF mesh address comes back too.</p>
-  </div>
-  <div class="step">
-    <h4>Password &amp; re-seal</h4>
-    <p>When you set the (new) login password, the words are re-encrypted into a fresh <code>master_seed.enc</code> — the reveal feature works on the restored node just like the original.</p>
-  </div>
-</div>
-
-<h2 id="comes-back">What Comes Back — and What Doesn't</h2>
-
-<div class="card-grid">
-  <div class="card-sm">
-    <h4><span class="badge badge-green">Restored by the words</span></h4>
-    <p>Node identity &amp; DID · node npub · FIPS mesh key · Reticulum/LXMF address · personal identity keys &amp; npubs · message-store / contacts / credential encryption keys · the (dormant) Bitcoin xprv · the ability to reveal the phrase again.</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-yellow">Needs its own backup</span></h4>
-    <p>Lightning wallet (aezeed — one-way gate, see above) and channel state · chat history &amp; app data (node backup) · identity names/avatars (metadata) · app secrets (regenerate on reinstall).</p>
-  </div>
-  <div class="card-sm">
-    <h4><span class="badge badge-red">Gone by design</span></h4>
-    <p>Sessions &amp; device pairings (re-login, re-pair) · 2FA secret (re-enrol) · WireGuard peers (re-pair) · rotated-away node keys · anonymous throwaway Nostr keys.</p>
-  </div>
-</div>
-
-<h2 id="seedqr">SeedQR</h2>
-<p class="subtitle">Your words as a scannable code — using the open SeedSigner standard.</p>
-
-<p>
-Wherever the phrase is displayed, a <strong>QR code</strong> tab is offered alongside the
-words. For the main (BIP-39) phrase the default format is <strong>SeedQR</strong>: each
-word becomes its 4-digit position in the official wordlist (24 words → 96 digits),
-encoded as a compact numeric QR. Hardware wallets like Passport, SeedSigner and Keystone
-import this format directly — so you can move your on-chain identity into cold storage
-without ever typing the words. A plain-text QR fallback exists for wallets that read the
-phrase as text.
-</p>
-
-<ul>
-  <li>The QR contains <em>exactly the same secret</em> as the words — treat a printout or screenshot of it with identical care.</li>
-  <li>The Lightning aezeed is deliberately <em>never</em> SeedQR-encoded — it isn't BIP-39, hardware wallets can't import it, and pretending otherwise would be dishonest. It gets a plain-text QR with an explanation instead.</li>
-  <li>Restore is by typed/pasted words; there's no camera-based SeedQR scanner on the restore path today.</li>
-</ul>
-
-<h2 id="limitations">Honest Edges</h2>
-<p class="subtitle">Known trade-offs and open hardening items, stated plainly.</p>
-
-<p>
-The audit that produced this system also tracked what it <em>didn't</em> fix. None of
-these are secrets — honest security means naming the edges:
-</p>
-
-<ul>
-  <li><strong>The words cross the RPC boundary.</strong> During onboarding the phrase travels (over HTTPS/localhost) to your browser to be displayed, sits in the browser's session storage for the wizard's duration, and is held in server memory for the 10-minute idempotence window. This is the deliberate price of a refresh-proof, display-once flow.</li>
-  <li><strong>Argon2 parameters are the library defaults</strong> (≈19 MiB, 2 passes) rather than the heavier profile the design doc calls for. Still memory-hard and slow for attackers; scheduled for tightening.</li>
-  <li><strong>2FA backup codes carry a slight statistical bias</strong> from a modulo operation — cosmetically imperfect, cryptographically irrelevant at their length, and queued for cleanup.</li>
-  <li><strong>The lint ban covers the main workspace</strong>, but one small helper crate outside the workspace isn't reached by it yet.</li>
-  <li><strong>Best-effort backup sealing:</strong> if writing <code>master_seed.enc</code> fails during setup, the node continues (keys exist; only reveal is lost) — a loud failure might arguably be better, and this trade-off is under review.</li>
-</ul>
-
-<h2 id="verify">Verify It Yourself</h2>
-<p class="subtitle">Don't trust — recompute.</p>
-
-<p>
-Because every derivation is deterministic and label-fixed, you can independently confirm
-that your node's keys really do come from your words:
-</p>
-
-<ul>
-  <li><strong>Independent re-derivation script:</strong> <code>scripts/verify-seed-derivation.py</code> in the Archipelago source — pure-standard-library Python, no Archipelago code. Paste your mnemonic (on a trusted, offline machine) and it recomputes <code>node_key</code>, <code>nostr_secret</code> and <code>fips_key</code>, byte-comparing them against <code>/var/lib/archipelago/identity/</code>.</li>
-  <li><strong>Known-answer tests:</strong> the test suite pins the exact expected keys for a fixed test mnemonic; any change to the derivation math, however subtle, turns the build red.</li>
-  <li><strong>Non-determinism regression test:</strong> 64 consecutive generated mnemonics are asserted unique — a canary against the "predictable RNG" failure class.</li>
-  <li><strong>Your entropy audit trail:</strong> <code>/var/lib/archipelago/security/csprng-readiness.jsonl</code> records, append-only, the kernel randomness verdict at every key-generation event on <em>this</em> node — including the moment your seed was born.</li>
-</ul>
-
-<div class="callout callout-success">
-  <strong>The whole story in one paragraph</strong>
-  Your node asked the Linux kernel for 32 bytes of hardware-grade randomness through a
-  single, named, compiler-enforced channel; refused to proceed unless the bytes looked
-  alive; wrote down the health of the random pool as evidence; turned the bytes into 24
-  words it showed you exactly once; locked an encrypted copy behind your password; and
-  then grew every identity and key it owns from those words along fixed, versioned,
-  independently-verifiable paths — so that the words in your drawer are, and will remain,
-  a complete blueprint of who your node is.
-</div>
-
-<hr>
-
-<p style="color: var(--text-muted); font-size: 13px; text-align: center;">
-  Archipelago — Seed &amp; Entropy Guide · reflects the KEY-05 hardened implementation (August 2026) ·
-  see also the <a href="/architecture/" style="color: var(--accent);">LoRa &amp; Mesh Guide</a>
-</p>
-
 </main>
+
+</div>
+
+<script src="./nav.js" defer></script>
 </body>
 </html>
diff --git a/neode-ui/public/entropy/nav.js b/neode-ui/public/entropy/nav.js
new file mode 100644
index 00000000..37987665
--- /dev/null
+++ b/neode-ui/public/entropy/nav.js
@@ -0,0 +1,29 @@
+// Scroll-spy for the sidebar, mirroring the dashboard's nav-tab-active state.
+// External file (not inline) because the node's CSP is script-src 'self'.
+(function () {
+  var links = Array.prototype.slice.call(
+    document.querySelectorAll('.sidebar-nav .sidebar-nav-item[href^="#"]')
+  )
+  if (!links.length || !('IntersectionObserver' in window)) return
+
+  var sections = links
+    .map(function (a) { return document.getElementById(a.getAttribute('href').slice(1)) })
+    .filter(Boolean)
+
+  function activate(id) {
+    links.forEach(function (a) {
+      a.classList.toggle('nav-tab-active', a.getAttribute('href') === '#' + id)
+    })
+  }
+
+  var visible = {}
+  var observer = new IntersectionObserver(function (entries) {
+    entries.forEach(function (e) { visible[e.target.id] = e.isIntersecting })
+    // Topmost section currently on screen wins, so the highlight tracks reading position.
+    for (var i = 0; i < sections.length; i++) {
+      if (visible[sections[i].id]) { activate(sections[i].id); return }
+    }
+  }, { rootMargin: '-10% 0px -70% 0px', threshold: 0 })
+
+  sections.forEach(function (s) { observer.observe(s) })
+})()