feat(wallet): LND wedge watchdog + Fedi send rail + token QRs + Auto hidden

- LND watchdog: framework-pt's LND sat wedged 14h (RPC up, server never
  ready, channels inactive) with nothing noticing. 15 consecutive bad
  minutes now bounce the container automatically (30min cooldown) —
  silent multi-hour Lightning outages become self-healed blips.
- Send modal: Auto tab hidden; Ecash splits into Cashu and Fedi (new
  wallet.fedimint-send RPC wrapping the existing spend_from_any); both
  rails render the generated token as a scannable QR alongside the
  copyable text.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/api/rpc/dispatcher.rs

@@ -260,6 +260,7 @@ impl RpcHandler {
             "wallet.fedimint-join" => self.handle_wallet_fedimint_join(params).await,
             "wallet.fedimint-leave" => self.handle_wallet_fedimint_leave(params).await,
             "wallet.fedimint-balance" => self.handle_wallet_fedimint_balance().await,
+            "wallet.fedimint-send" => self.handle_wallet_fedimint_send(params).await,
 
             // Ark protocol (via barkd sidecar)
             "wallet.ark-status" => self.handle_wallet_ark_status().await,

core/archipelago/src/api/rpc/fedimint.rs

@@ -118,6 +118,31 @@ impl RpcHandler {
         Ok(serde_json::json!({ "removed": removed }))
     }
 
+    /// `wallet.fedimint-send` — spend ecash notes from any joined federation
+    /// with sufficient balance. Returns the notes token for the recipient
+    /// (rendered as text + QR by the send modal — the wallet's Fedi rail,
+    /// split from Cashu 2026-07-22). The heavy lifting already existed in
+    /// `fedimint_client::spend_from_any`; it was simply never exposed.
+    pub(super) async fn handle_wallet_fedimint_send(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let amount_sats = params
+            .as_ref()
+            .and_then(|p| p.get("amount_sats"))
+            .and_then(|v| v.as_u64())
+            .ok_or_else(|| anyhow::anyhow!("Missing amount_sats"))?;
+        anyhow::ensure!(amount_sats > 0, "must be at least 1 sat");
+        let (token, federation_id) =
+            crate::wallet::fedimint_client::spend_from_any(&self.config.data_dir, amount_sats)
+                .await?;
+        Ok(serde_json::json!({
+            "token": token,
+            "federation_id": federation_id,
+            "amount_sats": amount_sats,
+        }))
+    }
+
     /// `wallet.fedimint-balance` — total sats across all joined federations.
     pub(super) async fn handle_wallet_fedimint_balance(&self) -> Result<serde_json::Value> {
         // Soft-fail to zero when clientd isn't installed/running, so the unified

core/archipelago/src/api/rpc/lnd/mod.rs

@@ -120,6 +120,108 @@ async fn stream_lnd_transactions(sm: &crate::state::StateManager) -> Result<()>
     Ok(())
 }
 
+/// LND wedge watchdog (2026-07-22, "100% uptime"): framework-pt's LND sat
+/// for 14 HOURS with its RPC answering but the server never finishing
+/// startup — synced_to_chain=false, zero peers, every channel inactive —
+/// and nothing noticed until a human tried to open a channel. The wedge
+/// signature is precise: RPC healthy while (!synced_to_chain, or zero peers
+/// with channels that need a peer) persists. A restart reliably clears it
+/// (the backend-churn wedge is a known lnd+rpcpolling failure mode), so
+/// after 15 consecutive bad minutes we bounce the container ourselves, with
+/// a 30-minute cooldown so a genuinely broken LND can't restart-loop.
+/// RPC-unreachable and locked-wallet states are deliberately NOT handled
+/// here — container-down is crash-recovery's job, and unlocking needs the
+/// operator.
+pub(crate) fn spawn_lnd_health_watchdog() {
+    tokio::spawn(async move {
+        let mut bad_minutes: u32 = 0;
+        let mut last_restart: Option<tokio::time::Instant> = None;
+        loop {
+            tokio::time::sleep(std::time::Duration::from_secs(60)).await;
+            let Ok(bytes) = read_lnd_admin_macaroon().await else {
+                bad_minutes = 0; // no LND on this node (or not set up yet)
+                continue;
+            };
+            let macaroon_hex = hex::encode(bytes);
+            let Ok(client) = reqwest::Client::builder()
+                .no_proxy()
+                .timeout(std::time::Duration::from_secs(10))
+                .danger_accept_invalid_certs(true)
+                .build()
+            else {
+                continue;
+            };
+            let Ok(resp) = client
+                .get(format!("{LND_REST_BASE_URL}/v1/getinfo"))
+                .header("Grpc-Metadata-macaroon", &macaroon_hex)
+                .send()
+                .await
+            else {
+                bad_minutes = 0; // down/locked — not the wedge signature
+                continue;
+            };
+            let Ok(info) = resp.json::<serde_json::Value>().await else {
+                bad_minutes = 0;
+                continue;
+            };
+            let synced = info
+                .get("synced_to_chain")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(true);
+            let peers = info.get("num_peers").and_then(|v| v.as_u64()).unwrap_or(0);
+            let channels = info
+                .get("num_active_channels")
+                .and_then(|v| v.as_u64())
+                .unwrap_or(0)
+                + info
+                    .get("num_inactive_channels")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(0)
+                + info
+                    .get("num_pending_channels")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(0);
+            let wedged = !synced || (channels > 0 && peers == 0);
+            if !wedged {
+                bad_minutes = 0;
+                continue;
+            }
+            bad_minutes += 1;
+            if bad_minutes < 15 {
+                continue;
+            }
+            if last_restart
+                .map(|t| t.elapsed() < std::time::Duration::from_secs(1800))
+                .unwrap_or(false)
+            {
+                continue;
+            }
+            tracing::warn!(
+                synced_to_chain = synced,
+                num_peers = peers,
+                channels,
+                "LND wedged for {bad_minutes} minutes (RPC up, server never ready) — restarting the lnd container"
+            );
+            let out = tokio::process::Command::new("podman")
+                .args(["restart", "lnd"])
+                .output()
+                .await;
+            match out {
+                Ok(o) if o.status.success() => {
+                    tracing::info!("LND watchdog restart complete");
+                }
+                Ok(o) => tracing::warn!(
+                    "LND watchdog restart failed: {}",
+                    String::from_utf8_lossy(&o.stderr).trim()
+                ),
+                Err(e) => tracing::warn!("LND watchdog restart failed: {e}"),
+            }
+            last_restart = Some(tokio::time::Instant::now());
+            bad_minutes = 0;
+        }
+    });
+}
+
 impl RpcHandler {
     /// Helper: create an authenticated LND REST client.
     /// Returns an HTTP client configured for LND's self-signed TLS and the

core/archipelago/src/server.rs

@@ -106,6 +106,9 @@ impl Server {
         // seconds of hitting the mempool (works whenever LND is up; retries
         // forever otherwise). User req 2026-07-22.
         crate::api::rpc::lnd::spawn_lnd_tx_watcher(state_manager.clone());
+        // LND wedge watchdog — self-heal the silent "RPC up, server never
+        // ready" state instead of waiting for a human (100%-uptime req).
+        crate::api::rpc::lnd::spawn_lnd_health_watchdog();
 
         // Retry Tor address in background — Tor may not be ready at startup
         if data.server_info.tor_address.is_none() {

neode-ui/src/components/SendBitcoinModal.vue

@@ -3,12 +3,12 @@
         <!-- Method tabs -->
         <div class="flex gap-1 mb-4 p-1 bg-white/5 rounded-lg">
           <button
-            v-for="m in (['auto', 'lightning', 'onchain', 'ecash', 'ark'] as const)"
+            v-for="m in (['lightning', 'onchain', 'ecash', 'fedimint', 'ark'] as const)"
             :key="m"
             @click="sendMethod = m"
             class="flex-1 px-2 py-1.5 rounded text-xs font-medium capitalize transition-colors"
             :class="sendMethod === m ? 'bg-white/15 text-white' : 'text-white/50 hover:text-white/80'"
-          >{{ m === 'onchain' ? t('sendBitcoin.onChain') : m === 'lightning' ? t('sendBitcoin.lightning') : m === 'ecash' ? t('sendBitcoin.ecash') : m === 'ark' ? 'Ark' : t('sendBitcoin.auto') }}</button>
+          >{{ m === 'onchain' ? t('sendBitcoin.onChain') : m === 'lightning' ? t('sendBitcoin.lightning') : m === 'ecash' ? 'Cashu' : m === 'fedimint' ? 'Fedi' : 'Ark' }}</button>
         </div>
 
         <div v-if="sendMethod === 'auto'" class="mb-3 p-2 bg-white/5 rounded-lg">
@@ -49,8 +49,13 @@
           <textarea v-model="dest" rows="2" :placeholder="effectiveMethod === 'lightning' ? 'lnbc...' : effectiveMethod === 'ark' ? 'tark1… / lnbc… / user@lnaddress' : 'bc1...'" class="w-full input-glass font-mono"></textarea>
         </div>
 
-        <div v-if="ecashToken && effectiveMethod === 'ecash'" class="mb-3 p-2 bg-white/5 rounded-lg">
+        <div v-if="ecashToken" class="mb-3 p-2 bg-white/5 rounded-lg">
           <p class="text-white/50 text-xs mb-1">{{ t('sendBitcoin.tokenShareLabel') }}</p>
+          <!-- QR so the recipient can scan the token straight off this screen
+               (animated multi-frame not needed: qrcode handles these sizes). -->
+          <div class="flex justify-center my-2">
+            <canvas ref="tokenQrCanvas" class="rounded-lg bg-white p-2"></canvas>
+          </div>
           <p class="text-xs font-mono text-white/80 break-all">{{ ecashToken }}</p>
           <button @click="copyText(ecashToken)" class="mt-2 text-xs text-orange-400 hover:text-orange-300">{{ t('common.copy') }}</button>
         </div>
@@ -83,7 +88,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, watch } from 'vue'
+import { ref, computed, watch, nextTick } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
 import BaseModal from '@/components/BaseModal.vue'
@@ -93,7 +98,9 @@ const { t } = useI18n()
 const props = defineProps<{ show: boolean }>()
 const emit = defineEmits<{ close: []; sent: []; scan: [] }>()
 
-const sendMethod = ref<'auto' | 'lightning' | 'onchain' | 'ecash' | 'ark'>('auto')
+// 'auto' remains in the type for the effectiveMethod logic but is no longer
+// offered as a tab (hidden per operator request 2026-07-22).
+const sendMethod = ref<'auto' | 'lightning' | 'onchain' | 'ecash' | 'fedimint' | 'ark'>('lightning')
 const amount = ref<number>(0)
 const dest = ref('')
 const processing = ref(false)
@@ -142,6 +149,17 @@ function copyText(text: string) {
   navigator.clipboard.writeText(text).catch(() => {})
 }
 
+const tokenQrCanvas = ref<HTMLCanvasElement | null>(null)
+watch(ecashToken, async (token) => {
+  if (!token) return
+  await nextTick()
+  if (!tokenQrCanvas.value) return
+  try {
+    const QRCode = await import('qrcode')
+    await QRCode.toCanvas(tokenQrCanvas.value, token, { width: 220, margin: 1 })
+  } catch { /* QR is a convenience — the copyable text is authoritative */ }
+})
+
 async function send() {
   if (processing.value) return
   if (!amount.value && !isSweep.value) return
@@ -169,6 +187,13 @@ async function send() {
         params: { amount_sats: amount.value },
       })
       ecashToken.value = res.token
+    } else if (method === 'fedimint') {
+      const res = await rpcClient.call<{ token: string }>({
+        method: 'wallet.fedimint-send',
+        params: { amount_sats: amount.value },
+        timeout: 60000,
+      })
+      ecashToken.value = res.token
     } else if (method === 'lightning') {
       if (!dest.value.trim()) { error.value = t('web5.pasteInvoice'); return }
       const res = await rpcClient.call<{ payment_hash: string }>({