diff --git a/apps/bitcoin-core/manifest.yml b/apps/bitcoin-core/manifest.yml
index 55cbb492..326a7315 100644
--- a/apps/bitcoin-core/manifest.yml
+++ b/apps/bitcoin-core/manifest.yml
@@ -35,6 +35,9 @@ app:
         fi;
         RPC_USER="$(printenv BITCOIN_RPC_USER)";
         RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        printf "rpcuser=%s\nrpcpassword=%s\n" "$RPC_USER" "$RPC_PASS" > "$RPC_CONF";
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +46,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
diff --git a/apps/bitcoin-knots/manifest.yml b/apps/bitcoin-knots/manifest.yml
index 4c3f9257..21372b74 100644
--- a/apps/bitcoin-knots/manifest.yml
+++ b/apps/bitcoin-knots/manifest.yml
@@ -35,6 +35,9 @@ app:
         fi;
         RPC_USER="$(printenv BITCOIN_RPC_USER)";
         RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        printf "rpcuser=%s\nrpcpassword=%s\n" "$RPC_USER" "$RPC_PASS" > "$RPC_CONF";
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +46,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
diff --git a/apps/pine/manifest.yml b/apps/pine/manifest.yml
index 3785ce2f..4f690234 100644
--- a/apps/pine/manifest.yml
+++ b/apps/pine/manifest.yml
@@ -1,7 +1,7 @@
 app:
   id: pine
   name: Pine
-  version: "1.1.1"
+  version: "1.2.0"
   description: A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.
   category: home
 
@@ -174,10 +174,15 @@ app:
               <div id="log">Ready. Click the button, then pick “PineVoice” in the Bluetooth popup.</div>
             </div>
 
-            <p class="ha">After WiFi joins, add the speaker to Home Assistant:
-              <b>Settings → Devices &amp; services → Add Wyoming Protocol</b>, host =
-              the speaker’s IP, port <b>10700</b>, then pick an Assist pipeline using
-              Whisper + Piper. Wake word: <b>“Hey Jarvis.”</b></p>
+            <p class="ha">After WiFi joins, one manual step remains — pair the
+              speaker in Home Assistant: <b>Settings → Devices &amp; services →
+              Add Wyoming Protocol</b>, host = the speaker’s IP, port
+              <b>10700</b>. Whisper, Piper and the Assist pipeline are wired up
+              automatically when Pine installs. Wake word: <b>“Hey Jarvis.”</b>
+              You can also ask node things like <i>“what’s the block height?”</i></p>
+            <p class="ha">Troubleshooting: if it hears you (LED reacts) but answers
+              are silent, unplug and replug the speaker — an interrupted answer can
+              wedge its audio output until it reboots.</p>
           </div>
 
           <script>
diff --git a/neode-ui/src/components/WalletScanModal.vue b/neode-ui/src/components/WalletScanModal.vue
index 8cb78a07..8c38f345 100644
--- a/neode-ui/src/components/WalletScanModal.vue
+++ b/neode-ui/src/components/WalletScanModal.vue
@@ -44,12 +44,22 @@
             <!-- ============ SCAN PANE ============ -->
             <div v-if="pane === 'scan'" key="scan">
               <div class="relative w-full aspect-square rounded-xl overflow-hidden bg-black/40 border border-white/10 mb-4">
-                <video ref="videoElement" class="w-full h-full object-cover" autoplay muted playsinline></video>
+                <!-- opacity (not v-if/v-show): the scanner needs the element, and a
+                     source-less <video> flashes a native play glyph in Android WebViews -->
+                <video ref="videoElement" class="w-full h-full object-cover transition-opacity duration-200" :class="isScanning ? 'opacity-100' : 'opacity-0'" autoplay muted playsinline></video>
                 <!-- Viewfinder -->
                 <div class="absolute inset-0 flex items-center justify-center pointer-events-none">
                   <div class="scan-viewfinder"></div>
                 </div>
-                <div v-if="!isScanning" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
+                <!-- While auto-start is settling, show only a quiet spinner — the
+                     Start/Take-photo buttons are the FALLBACK, not a splash screen -->
+                <div v-if="!isScanning && autoStarting" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
+                  <svg class="w-8 h-8 text-white/40 animate-spin" fill="none" viewBox="0 0 24 24">
+                    <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" />
+                    <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8v3a5 5 0 00-5 5H4z" />
+                  </svg>
+                </div>
+                <div v-else-if="!isScanning" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
                   <svg class="w-10 h-10 text-white/40" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                     <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M3 9a2 2 0 012-2h.93a2 2 0 001.664-.89l.812-1.22A2 2 0 0110.07 4h3.86a2 2 0 011.664.89l.812 1.22A2 2 0 0018.07 7H19a2 2 0 012 2v9a2 2 0 01-2 2H5a2 2 0 01-2-2V9z" />
                     <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15 13a3 3 0 11-6 0 3 3 0 016 0z" />
@@ -272,7 +282,7 @@ function goBack() {
   if (pane.value === 'amount') {
     error.value = ''
     goTo('scan', 'back')
-    nextTick(() => startScanning())
+    nextTick(() => { if (!liveCameraUnavailable.value) startScanning() })
   } else if (pane.value === 'success') {
     close()
   }
@@ -281,6 +291,10 @@ function goBack() {
 // --- Scanner ---
 const videoElement = ref<HTMLVideoElement | null>(null)
 const isScanning = ref(false)
+// True while a camera-start attempt is in flight (incl. the automatic one on
+// open) — the fallback buttons stay hidden until it resolves, so they don't
+// flash for a second on every open.
+const autoStarting = ref(false)
 const scanStatus = ref('')
 const scanStatusIsError = ref(false)
 const cameraError = ref(false)
@@ -291,6 +305,7 @@ const animatedDecoder = useAnimatedQRDecoder()
 async function startScanning() {
   cameraError.value = false
   scanStatusIsError.value = false
+  autoStarting.value = true
   try {
     if (!videoElement.value) return
     if (!navigator.mediaDevices?.getUserMedia) {
@@ -307,7 +322,9 @@ async function startScanning() {
         returnDetailedScanResult: true,
         highlightScanRegion: false,
         preferredCamera: 'environment',
-        maxScansPerSecond: 10,
+        // 4/s decodes plenty fast for a hand-held QR while keeping the
+        // preview smooth on phone WebViews (10/s visibly lagged the video).
+        maxScansPerSecond: 4,
       }
     )
     await qrScanner.value.start()
@@ -317,6 +334,8 @@ async function startScanning() {
     cameraError.value = true
     scanStatusIsError.value = true
     scanStatus.value = err instanceof Error ? err.message : 'Unable to access camera'
+  } finally {
+    autoStarting.value = false
   }
 }
 
@@ -465,7 +484,8 @@ function acceptDetected(raw: string) {
     action.value = 'pay-invoice'
     dest.value = text
     const invoiceAmount = parseBolt11AmountSats(text)
-    amount.value = invoiceAmount ?? 0
+    // Zero-amount invoice inside a unified BIP21 URI: prefill from amount=
+    amount.value = invoiceAmount ?? bip21AmountSats ?? 0
     amountLocked.value = invoiceAmount !== null
   } else if (isCashuToken(text)) {
     rail.value = 'cashu'
@@ -491,6 +511,16 @@ function acceptDetected(raw: string) {
     dest.value = text
     amount.value = bip21AmountSats ?? 0
     amountLocked.value = false
+  } else if (text.toLowerCase().startsWith('lno1')) {
+    // BOLT12 offer — LND (this node's Lightning backend) can't pay offers yet
+    scanStatusIsError.value = true
+    scanStatus.value = 'BOLT12 offers aren\'t supported yet — ask the recipient for a BOLT11 invoice'
+    return
+  } else if (text.toLowerCase().startsWith('lnurl1') || /^[\w.+-]+@[\w-]+(\.[\w-]+)+$/.test(text)) {
+    // LNURL-pay / lightning address — needs an HTTP callback flow we don't do yet
+    scanStatusIsError.value = true
+    scanStatus.value = 'LNURL and lightning addresses aren\'t supported yet — ask for a BOLT11 invoice'
+    return
   } else {
     scanStatusIsError.value = true
     scanStatus.value = 'Not a recognised invoice, address or token'
@@ -656,7 +686,7 @@ function close() {
 watch(() => props.show, (open) => {
   if (open) {
     resetAll()
-    nextTick(() => startScanning())
+    nextTick(() => { if (!liveCameraUnavailable.value) startScanning() })
   } else {
     stopScanning()
   }
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index c38ebc0b..9f7ea046 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -423,7 +423,7 @@
               "-lc"
             ],
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser=\"$RPC_USER\" -rpcpassword=\"$RPC_PASS\";\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser=\"$RPC_USER\" -rpcpassword=\"$RPC_PASS\";\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; printf \"rpcuser=%s\\nrpcpassword=%s\\n\" \"$RPC_USER\" \"$RPC_PASS\" > \"$RPC_CONF\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "derived_env": [
               {
@@ -566,7 +566,7 @@
               "-lc"
             ],
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser=\"$RPC_USER\" -rpcpassword=\"$RPC_PASS\";\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser=\"$RPC_USER\" -rpcpassword=\"$RPC_PASS\";\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; printf \"rpcuser=%s\\nrpcpassword=%s\\n\" \"$RPC_USER\" \"$RPC_PASS\" > \"$RPC_CONF\"; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "derived_env": [
               {
@@ -3843,12 +3843,12 @@
       }
     },
     "pine": {
-      "version": "1.1.1",
+      "version": "1.2.0",
       "manifest": {
         "app": {
           "id": "pine",
           "name": "Pine",
-          "version": "1.1.1",
+          "version": "1.2.0",
           "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
           "category": "home",
           "container_name": "pine",
@@ -3948,7 +3948,7 @@
             {
               "path": "/var/lib/archipelago/pine/index.html",
               "overwrite": true,
-              "content": "<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>Pine \u2014 connect your speaker</title>\n  <style>\n    :root { color-scheme: dark; }\n    * { box-sizing: border-box; }\n    body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;\n           background: #0f1512; color: #e7efe9; }\n    .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }\n    header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }\n    header svg { width: 52px; height: 52px; flex: 0 0 auto; }\n    h1 { font-size: 26px; margin: 0; }\n    .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }\n    .card { background: #16201b; border: 1px solid #24332b;\n            border-radius: 14px; padding: 20px; margin: 20px 0; }\n    .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }\n    .status .row b { min-width: 84px; color: #9fd3b6; }\n    .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;\n                   font-size: 13px; color: #cfe9d9; }\n    label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }\n    input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;\n            background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;\n            outline: none; }\n    input:focus { border-color: #4fae82; }\n    button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;\n             font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;\n             border-radius: 10px; cursor: pointer; transition: filter .15s; }\n    button:hover:not(:disabled) { filter: brightness(1.08); }\n    button:disabled { opacity: .45; cursor: default; }\n    #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;\n           font-family: ui-monospace, monospace; white-space: pre-wrap;\n           background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;\n           color: #a9c6b6; max-height: 220px; overflow-y: auto; }\n    .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }\n    .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }\n    .ha b { color: #9fbfad; }\n    .insecure { display: none; background: #2a1f12; border-color: #4a3418;\n                color: #e8c878; font-size: 13px; }\n  </style>\n</head>\n<body>\n  <div class=\"wrap\">\n    <header>\n      <svg viewBox=\"0 0 512 512\" aria-hidden=\"true\"><g fill=\"#7fd6a6\">\n        <rect x=\"236\" y=\"396\" width=\"40\" height=\"72\" rx=\"6\"/>\n        <path d=\"M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z\"/>\n        <path d=\"M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z\"/>\n        <path d=\"M256 262 L392 430 L120 430 L256 262 Z\"/>\n      </g></svg>\n      <div><h1>Pine</h1>\n        <p class=\"tag\">Connect your speaker \u2014 everything stays on your node.</p></div>\n    </header>\n\n    <div class=\"card status\">\n      <div class=\"row\"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>\n      <div class=\"row\"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>\n      <div class=\"row\"><b>Speaker</b><span>put it in pairing mode \u2014 ring LED blinking yellow</span></div>\n    </div>\n\n    <div class=\"card insecure\" id=\"insecure\">\n      This page isn\u2019t running over HTTPS, so the browser blocks Bluetooth.\n      Open it via its <b>https://\u2026:10380</b> address (accept the self-signed\n      certificate) and the button below will work.\n    </div>\n\n    <div class=\"card\">\n      <label for=\"ssid\">WiFi network (SSID)</label>\n      <input id=\"ssid\" autocomplete=\"off\" spellcheck=\"false\" placeholder=\"Your 2.4 GHz network\">\n      <label for=\"pass\">WiFi password \u2014 typed here, sent only over Bluetooth to the speaker</label>\n      <input id=\"pass\" type=\"password\" autocomplete=\"off\">\n      <button id=\"go\">Connect Pine to WiFi</button>\n      <div id=\"log\">Ready. Click the button, then pick \u201cPineVoice\u201d in the Bluetooth popup.</div>\n    </div>\n\n    <p class=\"ha\">After WiFi joins, add the speaker to Home Assistant:\n      <b>Settings \u2192 Devices &amp; services \u2192 Add Wyoming Protocol</b>, host =\n      the speaker\u2019s IP, port <b>10700</b>, then pick an Assist pipeline using\n      Whisper + Piper. Wake word: <b>\u201cHey Jarvis.\u201d</b></p>\n  </div>\n\n  <script>\n  \"use strict\";\n  // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).\n  const SVC   = \"00467768-6228-2272-4663-277478268000\";\n  const CHAR_STATE  = \"00467768-6228-2272-4663-277478268001\";\n  const CHAR_ERROR  = \"00467768-6228-2272-4663-277478268002\";\n  const CHAR_RPC    = \"00467768-6228-2272-4663-277478268003\";\n  const CHAR_RESULT = \"00467768-6228-2272-4663-277478268004\";\n  const STATES = {1:\"authorization required\",2:\"authorized\",3:\"provisioning\u2026\",4:\"PROVISIONED\"};\n  const ERRORS = {1:\"invalid RPC packet\",2:\"unknown RPC command\",\n    3:\"unable to connect \u2014 wrong password, or the SSID isn't reachable on 2.4 GHz\",\n    4:\"not authorized \u2014 press the button on the device\",5:\"bad hostname\",\n    255:\"unknown device error\"};\n\n  const logEl = document.getElementById(\"log\");\n  const log = (msg, cls) => { const l = document.createElement(\"div\");\n    if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);\n    logEl.scrollTop = logEl.scrollHeight; };\n  const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]\n    .map(b => b.toString(16).padStart(2, \"0\")).join(\" \");\n\n  const btn = document.getElementById(\"go\");\n  if (!navigator.bluetooth) {\n    document.getElementById(\"insecure\").style.display = \"block\";\n    logEl.textContent = \"Web Bluetooth unavailable \u2014 open this page over https (see note above).\";\n  }\n\n  btn.addEventListener(\"click\", async () => {\n    const ssid = document.getElementById(\"ssid\").value.trim();\n    const pass = document.getElementById(\"pass\").value;\n    if (!ssid) { log(\"Enter your WiFi network name first.\", \"err\"); return; }\n    if (!navigator.bluetooth) { log(\"No Web Bluetooth \u2014 open this page over https.\", \"err\"); return; }\n    btn.disabled = true; logEl.textContent = \"\";\n    let device;\n    try {\n      log(\"Opening Bluetooth device chooser\u2026\");\n      device = await navigator.bluetooth.requestDevice({\n        filters: [{ services: [SVC] }, { namePrefix: \"PineVoice\" }],\n        optionalServices: [SVC],\n      });\n      log(`Selected: ${device.name || \"(unnamed)\"}`);\n      device.addEventListener(\"gattserverdisconnected\", () => log(\"BLE disconnected.\"));\n      log(\"Connecting\u2026\");\n      const gatt = await device.gatt.connect();\n      const svc = await gatt.getPrimaryService(SVC);\n      const stateChar  = await svc.getCharacteristic(CHAR_STATE);\n      const errorChar  = await svc.getCharacteristic(CHAR_ERROR);\n      const rpcChar    = await svc.getCharacteristic(CHAR_RPC);\n      const resultChar = await svc.getCharacteristic(CHAR_RESULT);\n\n      let done, fail;\n      const outcome = new Promise((res, rej) => { done = res; fail = rej; });\n      let authorize; const authorized = new Promise(res => { authorize = res; });\n      let state = -1;\n      const onState = (s, via = \"\") => {\n        if (s === state) return; state = s;\n        log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? \"ok\" : undefined);\n        if (s >= 2) authorize();\n        if (s === 4) done(null);\n      };\n      stateChar.addEventListener(\"characteristicvaluechanged\",\n        e => onState(e.target.value.getUint8(0)));\n      errorChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const c = e.target.value.getUint8(0);\n        if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });\n      resultChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const v = e.target.value; log(`RPC result: ${hex(v)}`);\n        if (v.byteLength > 2 && v.getUint8(1) > 0) {\n          const n = v.getUint8(2); const b = new Uint8Array(n);\n          for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);\n          done(new TextDecoder().decode(b)); } });\n      await stateChar.startNotifications();\n      await errorChar.startNotifications();\n      await resultChar.startNotifications();\n      onState((await stateChar.readValue()).getUint8(0));\n\n      const poller = setInterval(async () => {\n        try { onState((await stateChar.readValue()).getUint8(0), \" (polled)\");\n          const ec = (await errorChar.readValue()).getUint8(0);\n          if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);\n\n      let nextUrl;\n      try {\n        if (state === 1) {\n          log(\"Authorization required \u2014 press the centre button on the speaker now.\", \"warn\");\n          await Promise.race([authorized, outcome,\n            new Promise((_, rej) => setTimeout(\n              () => rej(new Error(\"timed out waiting for the button press\")), 60000))]);\n          log(\"Authorized.\", \"ok\");\n        }\n        const enc = new TextEncoder();\n        const sb = enc.encode(ssid), pb = enc.encode(pass);\n        const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);\n        const pkt = new Uint8Array([1, data.length, ...data, 0]);\n        pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);\n        log(`Sending WiFi credentials for \u201c${ssid}\u201d\u2026`);\n        if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);\n        else await rpcChar.writeValue(pkt);\n        log(\"Credentials delivered \u2014 speaker acknowledged.\", \"ok\");\n        log(\"Joining WiFi\u2026 (the speaker plays a sound within ~20s either way)\");\n        const timeout = new Promise((_, rej) => setTimeout(\n          () => rej(new Error(\"timed out after 60s waiting for the device\")), 60000));\n        nextUrl = await Promise.race([outcome, timeout]);\n      } finally { clearInterval(poller); }\n\n      log(\"\u2713 PROVISIONED \u2014 the ring LED should breathe dim magenta.\", \"ok\");\n      if (nextUrl) log(`Device reports next step: ${nextUrl}`, \"ok\");\n      try { gatt.disconnect(); } catch {}\n    } catch (err) {\n      log(`\u2717 ${err.name || \"Error\"}: ${err.message}`, \"err\");\n      if (err.name === \"NotFoundError\")\n        log(\"No speaker matched, or you closed the chooser. LED blinking yellow? \"\n          + \"Hold the dot button 15s to reset.\", \"warn\");\n      if (err.name === \"NetworkError\")\n        log(\"BLE link dropped \u2014 move closer, and make sure the Mac isn't already \"\n          + \"paired to the speaker (it can hold the link exclusively).\", \"warn\");\n      try { device?.gatt?.disconnect(); } catch {}\n    } finally { btn.disabled = false; }\n  });\n  </script>\n</body>\n</html>\n"
+              "content": "<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>Pine \u2014 connect your speaker</title>\n  <style>\n    :root { color-scheme: dark; }\n    * { box-sizing: border-box; }\n    body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;\n           background: #0f1512; color: #e7efe9; }\n    .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }\n    header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }\n    header svg { width: 52px; height: 52px; flex: 0 0 auto; }\n    h1 { font-size: 26px; margin: 0; }\n    .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }\n    .card { background: #16201b; border: 1px solid #24332b;\n            border-radius: 14px; padding: 20px; margin: 20px 0; }\n    .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }\n    .status .row b { min-width: 84px; color: #9fd3b6; }\n    .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;\n                   font-size: 13px; color: #cfe9d9; }\n    label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }\n    input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;\n            background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;\n            outline: none; }\n    input:focus { border-color: #4fae82; }\n    button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;\n             font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;\n             border-radius: 10px; cursor: pointer; transition: filter .15s; }\n    button:hover:not(:disabled) { filter: brightness(1.08); }\n    button:disabled { opacity: .45; cursor: default; }\n    #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;\n           font-family: ui-monospace, monospace; white-space: pre-wrap;\n           background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;\n           color: #a9c6b6; max-height: 220px; overflow-y: auto; }\n    .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }\n    .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }\n    .ha b { color: #9fbfad; }\n    .insecure { display: none; background: #2a1f12; border-color: #4a3418;\n                color: #e8c878; font-size: 13px; }\n  </style>\n</head>\n<body>\n  <div class=\"wrap\">\n    <header>\n      <svg viewBox=\"0 0 512 512\" aria-hidden=\"true\"><g fill=\"#7fd6a6\">\n        <rect x=\"236\" y=\"396\" width=\"40\" height=\"72\" rx=\"6\"/>\n        <path d=\"M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z\"/>\n        <path d=\"M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z\"/>\n        <path d=\"M256 262 L392 430 L120 430 L256 262 Z\"/>\n      </g></svg>\n      <div><h1>Pine</h1>\n        <p class=\"tag\">Connect your speaker \u2014 everything stays on your node.</p></div>\n    </header>\n\n    <div class=\"card status\">\n      <div class=\"row\"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>\n      <div class=\"row\"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>\n      <div class=\"row\"><b>Speaker</b><span>put it in pairing mode \u2014 ring LED blinking yellow</span></div>\n    </div>\n\n    <div class=\"card insecure\" id=\"insecure\">\n      This page isn\u2019t running over HTTPS, so the browser blocks Bluetooth.\n      Open it via its <b>https://\u2026:10380</b> address (accept the self-signed\n      certificate) and the button below will work.\n    </div>\n\n    <div class=\"card\">\n      <label for=\"ssid\">WiFi network (SSID)</label>\n      <input id=\"ssid\" autocomplete=\"off\" spellcheck=\"false\" placeholder=\"Your 2.4 GHz network\">\n      <label for=\"pass\">WiFi password \u2014 typed here, sent only over Bluetooth to the speaker</label>\n      <input id=\"pass\" type=\"password\" autocomplete=\"off\">\n      <button id=\"go\">Connect Pine to WiFi</button>\n      <div id=\"log\">Ready. Click the button, then pick \u201cPineVoice\u201d in the Bluetooth popup.</div>\n    </div>\n\n    <p class=\"ha\">After WiFi joins, one manual step remains \u2014 pair the\n      speaker in Home Assistant: <b>Settings \u2192 Devices &amp; services \u2192\n      Add Wyoming Protocol</b>, host = the speaker\u2019s IP, port\n      <b>10700</b>. Whisper, Piper and the Assist pipeline are wired up\n      automatically when Pine installs. Wake word: <b>\u201cHey Jarvis.\u201d</b>\n      You can also ask node things like <i>\u201cwhat\u2019s the block height?\u201d</i></p>\n    <p class=\"ha\">Troubleshooting: if it hears you (LED reacts) but answers\n      are silent, unplug and replug the speaker \u2014 an interrupted answer can\n      wedge its audio output until it reboots.</p>\n  </div>\n\n  <script>\n  \"use strict\";\n  // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).\n  const SVC   = \"00467768-6228-2272-4663-277478268000\";\n  const CHAR_STATE  = \"00467768-6228-2272-4663-277478268001\";\n  const CHAR_ERROR  = \"00467768-6228-2272-4663-277478268002\";\n  const CHAR_RPC    = \"00467768-6228-2272-4663-277478268003\";\n  const CHAR_RESULT = \"00467768-6228-2272-4663-277478268004\";\n  const STATES = {1:\"authorization required\",2:\"authorized\",3:\"provisioning\u2026\",4:\"PROVISIONED\"};\n  const ERRORS = {1:\"invalid RPC packet\",2:\"unknown RPC command\",\n    3:\"unable to connect \u2014 wrong password, or the SSID isn't reachable on 2.4 GHz\",\n    4:\"not authorized \u2014 press the button on the device\",5:\"bad hostname\",\n    255:\"unknown device error\"};\n\n  const logEl = document.getElementById(\"log\");\n  const log = (msg, cls) => { const l = document.createElement(\"div\");\n    if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);\n    logEl.scrollTop = logEl.scrollHeight; };\n  const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]\n    .map(b => b.toString(16).padStart(2, \"0\")).join(\" \");\n\n  const btn = document.getElementById(\"go\");\n  if (!navigator.bluetooth) {\n    document.getElementById(\"insecure\").style.display = \"block\";\n    logEl.textContent = \"Web Bluetooth unavailable \u2014 open this page over https (see note above).\";\n  }\n\n  btn.addEventListener(\"click\", async () => {\n    const ssid = document.getElementById(\"ssid\").value.trim();\n    const pass = document.getElementById(\"pass\").value;\n    if (!ssid) { log(\"Enter your WiFi network name first.\", \"err\"); return; }\n    if (!navigator.bluetooth) { log(\"No Web Bluetooth \u2014 open this page over https.\", \"err\"); return; }\n    btn.disabled = true; logEl.textContent = \"\";\n    let device;\n    try {\n      log(\"Opening Bluetooth device chooser\u2026\");\n      device = await navigator.bluetooth.requestDevice({\n        filters: [{ services: [SVC] }, { namePrefix: \"PineVoice\" }],\n        optionalServices: [SVC],\n      });\n      log(`Selected: ${device.name || \"(unnamed)\"}`);\n      device.addEventListener(\"gattserverdisconnected\", () => log(\"BLE disconnected.\"));\n      log(\"Connecting\u2026\");\n      const gatt = await device.gatt.connect();\n      const svc = await gatt.getPrimaryService(SVC);\n      const stateChar  = await svc.getCharacteristic(CHAR_STATE);\n      const errorChar  = await svc.getCharacteristic(CHAR_ERROR);\n      const rpcChar    = await svc.getCharacteristic(CHAR_RPC);\n      const resultChar = await svc.getCharacteristic(CHAR_RESULT);\n\n      let done, fail;\n      const outcome = new Promise((res, rej) => { done = res; fail = rej; });\n      let authorize; const authorized = new Promise(res => { authorize = res; });\n      let state = -1;\n      const onState = (s, via = \"\") => {\n        if (s === state) return; state = s;\n        log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? \"ok\" : undefined);\n        if (s >= 2) authorize();\n        if (s === 4) done(null);\n      };\n      stateChar.addEventListener(\"characteristicvaluechanged\",\n        e => onState(e.target.value.getUint8(0)));\n      errorChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const c = e.target.value.getUint8(0);\n        if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });\n      resultChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const v = e.target.value; log(`RPC result: ${hex(v)}`);\n        if (v.byteLength > 2 && v.getUint8(1) > 0) {\n          const n = v.getUint8(2); const b = new Uint8Array(n);\n          for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);\n          done(new TextDecoder().decode(b)); } });\n      await stateChar.startNotifications();\n      await errorChar.startNotifications();\n      await resultChar.startNotifications();\n      onState((await stateChar.readValue()).getUint8(0));\n\n      const poller = setInterval(async () => {\n        try { onState((await stateChar.readValue()).getUint8(0), \" (polled)\");\n          const ec = (await errorChar.readValue()).getUint8(0);\n          if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);\n\n      let nextUrl;\n      try {\n        if (state === 1) {\n          log(\"Authorization required \u2014 press the centre button on the speaker now.\", \"warn\");\n          await Promise.race([authorized, outcome,\n            new Promise((_, rej) => setTimeout(\n              () => rej(new Error(\"timed out waiting for the button press\")), 60000))]);\n          log(\"Authorized.\", \"ok\");\n        }\n        const enc = new TextEncoder();\n        const sb = enc.encode(ssid), pb = enc.encode(pass);\n        const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);\n        const pkt = new Uint8Array([1, data.length, ...data, 0]);\n        pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);\n        log(`Sending WiFi credentials for \u201c${ssid}\u201d\u2026`);\n        if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);\n        else await rpcChar.writeValue(pkt);\n        log(\"Credentials delivered \u2014 speaker acknowledged.\", \"ok\");\n        log(\"Joining WiFi\u2026 (the speaker plays a sound within ~20s either way)\");\n        const timeout = new Promise((_, rej) => setTimeout(\n          () => rej(new Error(\"timed out after 60s waiting for the device\")), 60000));\n        nextUrl = await Promise.race([outcome, timeout]);\n      } finally { clearInterval(poller); }\n\n      log(\"\u2713 PROVISIONED \u2014 the ring LED should breathe dim magenta.\", \"ok\");\n      if (nextUrl) log(`Device reports next step: ${nextUrl}`, \"ok\");\n      try { gatt.disconnect(); } catch {}\n    } catch (err) {\n      log(`\u2717 ${err.name || \"Error\"}: ${err.message}`, \"err\");\n      if (err.name === \"NotFoundError\")\n        log(\"No speaker matched, or you closed the chooser. LED blinking yellow? \"\n          + \"Hold the dot button 15s to reset.\", \"warn\");\n      if (err.name === \"NetworkError\")\n        log(\"BLE link dropped \u2014 move closer, and make sure the Mac isn't already \"\n          + \"paired to the speaker (it can hold the link exclusively).\", \"warn\");\n      try { device?.gatt?.disconnect(); } catch {}\n    } finally { btn.disabled = false; }\n  });\n  </script>\n</body>\n</html>\n"
             }
           ],
           "health_check": {