fix(aiui): keep embedded chat background transparent

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -0,0 +1,23 @@
+# Blocking incident: Framework LND startup and false zero balance
+
+Before starting or resuming work in this repository, read
+`docs/incident-framework-lnd-startup.md` and check its status.
+
+The user explicitly required this incident to take priority over later work.
+While its status is OPEN:
+
+- Surface this blocker at session start, including when the user asks for unrelated work.
+- Prioritize investigation and repair on the actual Framework node. If access is
+  unavailable, ask for it and continue useful offline investigation; defer unrelated
+  work unless the user explicitly overrides this priority.
+- A manual LND restart, a source patch, passing local tests, or publishing an OTA
+  does not resolve the incident. Do not mark it fixed until the Framework's startup,
+  Receive flow, and balance behavior are verified on the node, including a controlled
+  reboot with access and recovery arrangements in place.
+- Preserve wallet identity, wallet/channel databases, credentials, and backups.
+  Never run wallet wipe/recreation as an automatic investigation or recovery step.
+- Record evidence, changes, validation, and remaining work in the incident document.
+
+This priority comes from the user's explicit instruction on 2026-09-15. It remains
+in effect across sessions until the documented acceptance criteria are met or the
+user explicitly changes it.

Android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 47
-        versionName = "0.5.27"
+        versionCode = 52
+        versionName = "0.5.32"
 
         vectorDrawables {
             useSupportLibrary = true
@@ -41,6 +41,17 @@ android {
             enableV1Signing = true
             enableV2Signing = true
         }
+        // Local-only UAT builds install beside both the production companion
+        // and its shared-key debug package. The ignored uat.keystore is made
+        // on the validation box; it must never be used for a public artifact.
+        create("uat") {
+            storeFile = file("uat.keystore")
+            storePassword = "android"
+            keyAlias = "androiduatkey"
+            keyPassword = "android"
+            enableV1Signing = true
+            enableV2Signing = true
+        }
     }
 
     buildTypes {
@@ -51,6 +62,13 @@ android {
             versionNameSuffix = "-debug"
             signingConfig = signingConfigs.getByName("debug")
         }
+        create("uat") {
+            initWith(getByName("debug"))
+            applicationIdSuffix = ".uat"
+            versionNameSuffix = "-uat"
+            signingConfig = signingConfigs.getByName("uat")
+            matchingFallbacks += listOf("debug")
+        }
         release {
             isMinifyEnabled = true
             isShrinkResources = true
@@ -118,8 +136,8 @@ tasks.register<Exec>("buildRustArm64") {
 
 tasks.matching {
     it.name in listOf(
-        "mergeDebugNativeLibs", "mergeReleaseNativeLibs",
-        "mergeDebugJniLibFolders", "mergeReleaseJniLibFolders",
+        "mergeDebugNativeLibs", "mergeUatNativeLibs", "mergeReleaseNativeLibs",
+        "mergeDebugJniLibFolders", "mergeUatJniLibFolders", "mergeReleaseJniLibFolders",
     )
 }.configureEach { dependsOn("buildRustArm64") }
 

Android/app/src/main/AndroidManifest.xml

@@ -54,6 +54,15 @@
                 <category android:name="android.intent.category.BROWSABLE" />
                 <data android:scheme="archipelago" android:host="pair" />
             </intent-filter>
+            <!-- Remote-signer pairing deep link (NIP-46, companion 0.5.28):
+                 nostrconnect://<client-pubkey>?relay=...&secret=... — the
+                 node's login QR, hand-off from any QR scanner app. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="nostrconnect" />
+            </intent-filter>
         </activity>
 
         <!-- Embedded FIPS mesh node: split-tunnel VpnService (fd00::/8 only),

Android/app/src/main/java/com/archipelago/app/NativeCore.kt

@@ -0,0 +1,69 @@
+package com.archipelago.app
+
+import org.json.JSONObject
+
+/**
+ * JNI binding to the companion's non-mesh native surface (same
+ * libarchy_fips_core.so as FipsNative — backup + nostr signer crypto, built
+ * from Android/rust/archy-fips-core).
+ *
+ * Same contract as FipsNative: JSON over strings, failures come back as
+ * {"error": "…"} rather than exceptions, and [available] is false on ABIs
+ * the .so isn't built for so every caller can degrade gracefully.
+ */
+object NativeCore {
+    val available: Boolean = try {
+        System.loadLibrary("archy_fips_core")
+        true
+    } catch (_: Throwable) {
+        false
+    }
+
+    // ── Backup (#128): the node's ADR-005 envelope ──────────────────────────
+
+    /** Encrypt a JSON payload into an ADR-005 envelope (ChaCha20-Poly1305). */
+    external fun backupEncrypt(payload: String, passphrase: String): String
+
+    /** Decrypt an ADR-005 envelope back to its payload JSON. */
+    external fun backupDecrypt(envelope: String, passphrase: String): String
+
+    // ── NIP-46 remote signer (#139) ─────────────────────────────────────────
+
+    /** Generate a fresh nostr key: {"secret","pubkey","npub","nsec"}. */
+    external fun nostrGenerateSecret(): String
+
+    /** Import a key from hex or nsec…: {"secret","pubkey","npub","nsec"}. */
+    external fun nostrSecretFromAny(secret: String): String
+
+    /** Parse nostrconnect://…: {"clientPubkey","relays":[…],"secret","perms","name","url","image"}. */
+    external fun nostrParseConnectUri(uri: String): String
+
+    /**
+     * Sign `{kind, content, tags, created_at}` with the signer key: returns
+     * the full signed event JSON. Approval happens BEFORE this call — the
+     * native side never signs unasked.
+     */
+    external fun nostrSignEvent(secretHex: String, eventJson: String): String
+
+    /** NIP-44 v2 encrypt/decrypt; result JSON: {"result": payload} or {"error": …}. */
+    external fun nostrNip44Encrypt(secretHex: String, peerPub: String, plaintext: String): String
+    external fun nostrNip44Decrypt(secretHex: String, peerPub: String, payload: String): String
+
+    /** NIP-04 fallback (deprecated but still spoken by real clients). */
+    external fun nostrNip04Encrypt(secretHex: String, peerPub: String, plaintext: String): String
+    external fun nostrNip04Decrypt(secretHex: String, peerPub: String, payload: String): String
+
+    /** True when a native reply is an error envelope. */
+    fun isErr(json: String): Boolean = try {
+        JSONObject(json).has("error")
+    } catch (_: Exception) {
+        true
+    }
+
+    /** Error text from a native reply, or a generic message if malformed. */
+    fun errMsg(json: String): String = try {
+        JSONObject(json).optString("error", "native call failed")
+    } catch (_: Exception) {
+        "native call failed"
+    }
+}

Android/app/src/main/java/com/archipelago/app/data/BackupManager.kt

@@ -0,0 +1,229 @@
+package com.archipelago.app.data
+
+import android.content.Context
+import com.archipelago.app.NativeCore
+import com.archipelago.app.fips.FipsPreferences
+import com.archipelago.app.nostr.NostrSignerPreferences
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.withContext
+import org.json.JSONArray
+import org.json.JSONObject
+
+/**
+ * Companion backup & restore (#128) — the phone side of "losing your phone,
+ * or wiping it to cross a border".
+ *
+ * The payload (servers + FIPS identity/peers + signer key + flags) is
+ * serialized to JSON and sealed into the node's ADR-005 envelope (Argon2id +
+ * ChaCha20-Poly1305) by the native core — the SAME envelope the node uses,
+ * not a second format. The passphrase never leaves the encrypt call.
+ *
+ * Transport is deliberately boring: a plain .json file the user saves via
+ * the system file picker (SAF) — on GrapheneOS there is no cloud backup and
+ * there should be none here either; the file goes wherever the user puts it
+ * (USB drive, computer, a folder synced their way).
+ */
+class BackupManager(private val context: Context) {
+
+    private val servers = ServerPreferences(context)
+    private val fips = FipsPreferences(context)
+    private val signer = NostrSignerPreferences(context)
+
+    /** Everything the backup captures, for the restore preview UI. */
+    data class PayloadSummary(
+        val serverCount: Int,
+        val hasFipsIdentity: Boolean,
+        val hasSignerKey: Boolean,
+        val appVersion: String,
+    )
+
+    /** What a restore actually did, for the result UI. */
+    data class RestoreResult(
+        val serversRestored: Int,
+        val activeSet: Boolean,
+        val fipsIdentityRestored: Boolean,
+        val signerKeyRestored: Boolean,
+    )
+
+    private fun appVersion(): String = try {
+        context.packageManager.getPackageInfo(context.packageName, 0).versionName ?: ""
+    } catch (_: Exception) {
+        ""
+    }
+
+    /**
+     * Assemble the encrypted backup envelope. Runs on IO: DataStore reads
+     * plus the Argon2id KDF (tens of ms) + AEAD.
+     */
+    suspend fun createBackup(passphrase: String): String = withContext(Dispatchers.IO) {
+        require(passphrase.isNotEmpty()) { "passphrase required" }
+
+        val active = servers.activeServer.first()
+        val saved = servers.savedServers.first()
+        val fipsId = fips.identity()
+        val peers = fips.peersJson()
+        val partyPeers = fips.partyPeers()
+        val partyName = fips.partyName()
+        val partyListen = fips.partyListen()
+        val signerSecret = signer.secret()
+
+        val payload = JSONObject().apply {
+            put("app", "archipelago-companion")
+            put("payloadVersion", 1)
+            put("appVersion", appVersion())
+            put("createdAt", System.currentTimeMillis() / 1000)
+            put("servers", JSONArray(saved.map { it.serialize() }))
+            put("active", active?.serialize() ?: JSONObject.NULL)
+            if (fipsId != null) {
+                put("fips", JSONObject().apply {
+                    put("secret", fipsId.secret)
+                    put("npub", fipsId.npub)
+                    put("address", fipsId.address)
+                    put("peers", JSONArray(peers))
+                    put("partyPeers", JSONArray().apply { partyPeers.forEach { put(JSONObject().apply {
+                        put("npub", it.npub); put("ula", it.ula); put("name", it.name)
+                        put("ip", it.ip); put("port", it.port)
+                    }) } })
+                    put("partyName", partyName)
+                    put("partyListen", partyListen)
+                })
+            }
+            if (signerSecret != null) {
+                put("signer", JSONObject().apply { put("secret", signerSecret) })
+            }
+            put("flags", JSONObject().apply {
+                put("introSeen", servers.introSeen.first())
+            })
+        }
+
+        val envelope = NativeCore.backupEncrypt(payload.toString(), passphrase)
+        if (NativeCore.isErr(envelope)) throw BackupException(NativeCore.errMsg(envelope))
+        envelope
+    }
+
+    /**
+     * Peek at a decrypted backup (passphrase already checked) to preview what
+     * a restore would do. Does NOT touch any stored state.
+     */
+    suspend fun readBackup(envelope: String, passphrase: String): Pair<PayloadSummary, JSONObject> =
+        withContext(Dispatchers.IO) {
+            val payload = NativeCore.backupDecrypt(envelope, passphrase)
+            if (NativeCore.isErr(payload)) throw BackupException(NativeCore.errMsg(payload))
+            val obj = JSONObject(payload)
+            if (obj.optString("app") != "archipelago-companion") {
+                throw BackupException("Not a companion backup (this may be a node backup — restore it on the node)")
+            }
+            val summary = PayloadSummary(
+                serverCount = obj.optJSONArray("servers")?.length() ?: 0,
+                hasFipsIdentity = obj.has("fips"),
+                hasSignerKey = obj.has("signer"),
+                appVersion = obj.optString("appVersion", ""),
+            )
+            summary to obj
+        }
+
+    /**
+     * Apply a decrypted backup to this install. Merge semantics — a restore
+     * never silently destroys what's already here:
+     *
+     * - Servers upsert (npub-first, [ServerPreferences.upsertServer]) — same
+     *   identity merges, never duplicates.
+     * - The backup's active server is set active only when none is.
+     * - FIPS identity/peers restore only when this phone has none (a phone
+     *   that already paired has a live identity the node peers with; swapping
+     *   it from a backup would strand the current pairing). Peers merge by
+     *   npub otherwise.
+     * - Signer key restores only when none exists locally.
+     */
+    suspend fun restoreBackup(payload: JSONObject): RestoreResult = withContext(Dispatchers.IO) {
+        val serverArray = payload.optJSONArray("servers") ?: JSONArray()
+        var restored = 0
+        for (i in 0 until serverArray.length()) {
+            val raw = serverArray.optString(i)
+            val entry = ServerEntry.deserialize(raw) ?: continue
+            servers.upsertServer(entry)
+            restored++
+        }
+
+        var activeSet = false
+        val activeStr = if (payload.isNull("active")) null else payload.optString("active", "")
+        val activeEntry = activeStr?.takeIf { it.isNotBlank() }?.let { ServerEntry.deserialize(it) }
+        if (activeEntry != null && servers.activeServer.first() == null) {
+            servers.setActiveServer(activeEntry)
+            activeSet = true
+        }
+
+        // FIPS identity: only adopt when this phone has none.
+        var fipsRestored = false
+        val fipsObj = payload.optJSONObject("fips")
+        if (fipsObj != null && fips.identity() == null) {
+            val secret = fipsObj.optString("secret")
+            if (secret.isNotBlank()) {
+                fips.saveIdentity(
+                    com.archipelago.app.fips.FipsNative.Identity(
+                        secret = secret,
+                        npub = fipsObj.optString("npub"),
+                        address = fipsObj.optString("address"),
+                    )
+                )
+                fipsRestored = true
+            }
+            // Peers: union by npub with whatever is already here (an empty
+            // store takes the backup's list wholesale).
+            val backupPeers = fipsObj.optJSONArray("peers")?.let { arr ->
+                (0 until arr.length()).joinToString(",", "[", "]") { arr.optString(it) }
+            } ?: "[]"
+            fips.mergePeersJson(backupPeers)
+
+            val partyArr = fipsObj.optJSONArray("partyPeers")
+            if (partyArr != null) {
+                for (i in 0 until partyArr.length()) {
+                    val p = partyArr.optJSONObject(i) ?: continue
+                    val npub = p.optString("npub")
+                    val ula = p.optString("ula")
+                    if (npub.isNotBlank() && ula.isNotBlank()) {
+                        fips.upsertPartyPeer(
+                            com.archipelago.app.fips.PartyPeer(
+                                npub = npub, ula = ula,
+                                name = p.optString("name").ifBlank { "Phone" },
+                                ip = p.optString("ip"), port = p.optInt("port"),
+                            )
+                        )
+                    }
+                }
+            }
+            if (fipsObj.optString("partyName").isNotBlank()) {
+                fips.setPartyName(fipsObj.optString("partyName"))
+            }
+            fips.setPartyListen(fipsObj.optBoolean("partyListen", false))
+        }
+
+        // Signer key: only adopt when none exists locally.
+        var signerRestored = false
+        val signerObj = payload.optJSONObject("signer")
+        if (signerObj != null && signer.secret() == null) {
+            val secret = signerObj.optString("secret")
+            if (secret.isNotBlank()) {
+                signer.saveSecret(secret)
+                signerRestored = true
+            }
+        }
+
+        // Flags: a user who completed the intro on the old phone shouldn't
+        // see it again on the new one.
+        val flags = payload.optJSONObject("flags")
+        if (flags?.optBoolean("introSeen", false) == true) {
+            servers.markIntroSeen()
+        }
+
+        RestoreResult(
+            serversRestored = restored,
+            activeSet = activeSet,
+            fipsIdentityRestored = fipsRestored,
+            signerKeyRestored = signerRestored,
+        )
+    }
+
+    class BackupException(message: String) : Exception(message)
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -89,6 +89,38 @@ class FipsPreferences(private val context: Context) {
 
     suspend fun hasPeers(): Boolean = JSONArray(peersJson()).length() > 0
 
+    /**
+     * Union the stored node peers with a backup's peer list, matched by
+     * npub — the backup's copy wins for the same npub (its addresses are what
+     * the restored identity pairs against). Used by companion restore (#128)
+     * after [saveIdentity] adopted the backup's mesh identity.
+     */
+    suspend fun mergePeersJson(incomingJson: String) {
+        context.fipsDataStore.edit { prefs ->
+            val current = JSONArray(prefs[peersKey] ?: "[]")
+            val incoming = try {
+                JSONArray(incomingJson)
+            } catch (_: Exception) {
+                JSONArray()
+            }
+            val incomingNpubs = mutableSetOf<String>()
+            val merged = JSONArray()
+            for (i in 0 until incoming.length()) {
+                val peer = incoming.optJSONObject(i) ?: continue
+                val npub = peer.optString("npub")
+                if (npub.isNotBlank()) {
+                    incomingNpubs.add(npub)
+                    merged.put(peer)
+                }
+            }
+            for (i in 0 until current.length()) {
+                val peer = current.optJSONObject(i) ?: continue
+                if (peer.optString("npub") !in incomingNpubs) merged.put(peer)
+            }
+            prefs[peersKey] = merged.toString()
+        }
+    }
+
     // ── Mesh Party (phone↔phone) ────────────────────────────────────────────
 
     suspend fun partyListen(): Boolean =

Android/app/src/main/java/com/archipelago/app/nostr/BunkerManager.kt

@@ -0,0 +1,445 @@
+package com.archipelago.app.nostr
+
+import android.content.Context
+import com.archipelago.app.NativeCore
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.withContext
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import okhttp3.WebSocket
+import okhttp3.WebSocketListener
+import org.json.JSONArray
+import org.json.JSONObject
+import java.security.SecureRandom
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+
+/**
+ * NIP-46 remote-signer session (#139) — the phone side, wire-faithful to
+ * rust-nostr's reference bunker (`signer/nostr-connect/src/signer.rs`),
+ * which the node's login flow will interoperate with:
+ *
+ * 1. Client (the node's login page) shows a `nostrconnect://` QR.
+ * 2. We scan it, connect to its relay, subscribe to kind-24133 events
+ *    p-tagged to our signer key, and send a `connect` request carrying the
+ *    secret (the client validates it and answers "ack").
+ * 3. Requests arrive as NIP-44-encrypted kind-24133 events; we respond over
+ *    the same channel. `sign_event` is the one method that never runs
+ *    without a human tapping Approve on this phone.
+ *
+ * The session lives while the app is around (the login handshake takes
+ * seconds); there is no background service in v1 and no remembered-session
+ * auto-reconnect (research doc flow C — deferred deliberately).
+ */
+object BunkerManager {
+
+    sealed class SignerState {
+        /** Native core unavailable (e.g. x86 emulator) — signing impossible. */
+        object Unavailable : SignerState()
+        /** Key exists, no session. */
+        object Idle : SignerState()
+        /** No signer key generated/imported yet. */
+        object NoKey : SignerState()
+        data class Connecting(val relay: String) : SignerState()
+        /** Connect request sent; waiting for the client to ack. */
+        data class AwaitingClient(val relay: String, val clientName: String) : SignerState()
+        /** Handshake complete — this is the state where requests are answered. */
+        data class Ready(val relay: String, val clientName: String) : SignerState()
+        data class Failed(val reason: String) : SignerState()
+    }
+
+    /** One signature request awaiting a human decision. */
+    data class PendingRequest(
+        val id: String,
+        val method: String,
+        val clientPubkey: String,
+        val clientName: String,
+        val kind: Long?,
+        val content: String?,
+        /** Formatted tag lines for the approval card. */
+        val tags: List<String>,
+        val createdAt: Long?,
+        /** The full unsigned event JSON handed to the native signer on approve. */
+        val unsignedEventJson: String,
+    )
+
+    private val _state = MutableStateFlow<SignerState>(SignerState.Idle)
+    val state: StateFlow<SignerState> = _state.asStateFlow()
+
+    private val _pending = MutableStateFlow<PendingRequest?>(null)
+    val pending: StateFlow<PendingRequest?> = _pending.asStateFlow()
+
+    private val client = OkHttpClient.Builder()
+        .connectTimeout(10, TimeUnit.SECONDS)
+        .pingInterval(25, TimeUnit.SECONDS) // relay keepalive
+        .build()
+
+    private data class Session(
+        val socket: WebSocket,
+        val relay: String,
+        /** The client's pubkey (hex) from the nostrconnect URI. */
+        val clientPubkey: String,
+        val clientName: String,
+        /** The pairing secret — echoed back during handshake, then kept for
+         *  validating an incoming `connect` from the same client. */
+        val secret: String,
+        /** Our connect request id, to match the client's ack response. */
+        val connectRequestId: String,
+        /** Our signer secret (hex). */
+        val signerSecretHex: String,
+        /** Our signer pubkey (hex). */
+        val signerPubkeyHex: String,
+        /** Event ids already handled (relays may redeliver). */
+        val seen: MutableSet<String> = java.util.concurrent.ConcurrentHashMap.newKeySet(),
+    )
+
+    private val session = AtomicReference<Session?>(null)
+
+    /** Refresh Idle/NoKey state (suspend; call from a coroutine — DataStore reads hit disk). */
+    suspend fun refreshState(context: Context) {
+        if (!NativeCore.available) {
+            _state.value = SignerState.Unavailable
+            return
+        }
+        if (session.get() != null) return
+        val prefs = NostrSignerPreferences(context.applicationContext)
+        _state.value =
+            if (prefs.secret() == null) SignerState.NoKey else SignerState.Idle
+    }
+
+    /**
+     * Pair from a scanned or deep-linked `nostrconnect://…` URI. Returns a
+     * user-presentable error on failure, or null on success (state moves to
+     * Connecting → AwaitingClient).
+     */
+    suspend fun pair(context: Context, uri: String): String? {
+        if (!NativeCore.available) return "Signing is unavailable on this device"
+        val appContext = context.applicationContext
+        return withContext(Dispatchers.IO) {
+            val parsed = JSONObject(NativeCore.nostrParseConnectUri(uri.trim()))
+            if (parsed.has("error")) return@withContext parsed.getString("error")
+
+            val prefs = NostrSignerPreferences(appContext)
+            val secret = prefs.secret()
+                ?: return@withContext "No signer key yet — generate or import one first"
+            val info = JSONObject(NativeCore.nostrSecretFromAny(secret))
+            if (info.has("error")) return@withContext info.getString("error")
+
+            val clientPubkey = parsed.getString("clientPubkey")
+            val relays = mutableListOf<String>()
+            parsed.optJSONArray("relays")?.let { arr -> for (i in 0 until arr.length()) relays.add(arr.optString(i)) }
+            val clientName = parsed.optString("name").ifBlank { "client" }
+            val pairSecret = parsed.getString("secret")
+
+            if (relays.isEmpty()) return@withContext "The pairing code carries no relay to reach the client on"
+
+            teardown()
+
+            var lastError = "no relay could be reached"
+            for (relay in relays) {
+                _state.value = SignerState.Connecting(relay)
+                val opened = openSession(
+                    relay, clientPubkey, clientName, pairSecret, secret, info,
+                )
+                if (opened != null) {
+                    session.set(opened)
+                    prefs.savePairing(
+                        NostrSignerPreferences.Pairing(clientPubkey, relay, clientName)
+                    )
+                    _state.value = SignerState.AwaitingClient(relay, clientName)
+                    return@withContext null
+                }
+                lastError = "relay $relay did not answer"
+            }
+            _state.value = SignerState.Failed(lastError)
+            lastError
+        }
+    }
+
+    /** Re-establish the last saved pairing without a fresh QR. */
+    suspend fun resume(context: Context): String? {
+        if (!NativeCore.available) return "Signing is unavailable on this device"
+        val appContext = context.applicationContext
+        return withContext(Dispatchers.IO) {
+            val prefs = NostrSignerPreferences(appContext)
+            val pairing = prefs.lastPairing()
+                ?: return@withContext "Nothing to resume — no saved pairing"
+            val secret = prefs.secret()
+                ?: return@withContext "No signer key"
+            val info = JSONObject(NativeCore.nostrSecretFromAny(secret))
+            if (info.has("error")) return@withContext info.getString("error")
+            teardown()
+            _state.value = SignerState.Connecting(pairing.relay)
+            val opened = openSession(
+                pairing.relay, pairing.clientPubkey, pairing.name,
+                secret = "", signerSecretHex = secret, info = info,
+            )
+            if (opened == null) {
+                _state.value = SignerState.Failed("relay ${pairing.relay} did not answer")
+                return@withContext "Could not reach ${pairing.relay}"
+            }
+            session.set(opened)
+            _state.value = SignerState.AwaitingClient(pairing.relay, pairing.name)
+            null
+        }
+    }
+
+    fun unpair() {
+        teardown()
+        _state.value = SignerState.Idle
+    }
+
+    private fun teardown() {
+        session.getAndSet(null)?.socket?.close(1000, "unpaired")
+        _pending.value = null
+    }
+
+    private fun randomId(): String {
+        val bytes = ByteArray(8)
+        SecureRandom().nextBytes(bytes)
+        return bytes.joinToString("") { "%02x".format(it) }
+    }
+
+    private fun openSession(
+        relay: String,
+        clientPubkey: String,
+        clientName: String,
+        secret: String,
+        signerSecretHex: String,
+        info: JSONObject,
+    ): Session? {
+        val signerPubkeyHex = info.getString("pubkey")
+        val connectRequestId = randomId()
+        // The listener needs the Session, the Session needs the WebSocket:
+        // bind through a holder set right after newWebSocket returns (OkHttp
+        // invokes onOpen on its own dispatcher after the network round-trip,
+        // i.e. always after the bind below).
+        val holder = AtomicReference<Session?>()
+
+        val request = Request.Builder().url(relay).build()
+        val socket = client.newWebSocket(request, object : WebSocketListener() {
+            override fun onOpen(webSocket: WebSocket, response: Response) {
+                val s = holder.get() ?: return
+                // Subscribe to requests addressed to us (p-tag filter), from
+                // now — no history replay of stale login attempts.
+                webSocket.send(
+                    """["REQ","${s.connectRequestId}sub",{"kinds":[24133],"#p":["${s.signerPubkeyHex}"],"since":${epochSecs() - 120}}]"""
+                )
+                // Handshake: the signer sends `connect` carrying the secret
+                // (rust-nostr's NostrConnectRemoteSigner.send_connect_ack —
+                // the exact frame the node's client waits for).
+                val content = JSONObject().apply {
+                    put("id", s.connectRequestId)
+                    put("method", "connect")
+                    put("params", JSONArray().put(s.signerPubkeyHex).put(s.secret))
+                }.toString()
+                if (!sendEncrypted(s, content)) {
+                    _state.value = SignerState.Failed("Could not encrypt the connect message")
+                }
+            }
+
+            override fun onMessage(webSocket: WebSocket, text: String) {
+                val s = session.get() ?: return
+                handleRelayMessage(s, text)
+            }
+
+            override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) {
+                if (session.get()?.socket === webSocket) {
+                    _state.value = SignerState.Failed(t.message ?: "relay connection failed")
+                    session.getAndSet(null)
+                }
+            }
+
+            override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
+                if (session.get()?.socket === webSocket) {
+                    _state.value = SignerState.Idle
+                    session.getAndSet(null)
+                }
+            }
+        })
+
+        val s = Session(
+            socket = socket,
+            relay = relay,
+            clientPubkey = clientPubkey,
+            clientName = clientName,
+            secret = secret,
+            connectRequestId = connectRequestId,
+            signerSecretHex = signerSecretHex,
+            signerPubkeyHex = signerPubkeyHex,
+        )
+        holder.set(s)
+        return s
+    }
+
+    private fun epochSecs(): Long = System.currentTimeMillis() / 1000
+
+    /** Encrypt a JSON-RPC frame to the peer and publish it as kind 24133. */
+    private fun sendEncrypted(s: Session, json: String): Boolean {
+        val enc = NativeCore.nostrNip44Encrypt(s.signerSecretHex, s.clientPubkey, json)
+        if (NativeCore.isErr(enc)) return false
+        val payload = JSONObject(enc).getString("result")
+        val event = JSONObject().apply {
+            put("kind", 24133)
+            put("content", payload)
+            put("tags", JSONArray().put(JSONArray().put("p").put(s.clientPubkey)))
+            put("created_at", epochSecs())
+        }.toString()
+        val signed = NativeCore.nostrSignEvent(s.signerSecretHex, event)
+        if (NativeCore.isErr(signed)) return false
+        return s.socket.send("""["EVENT",$signed]""")
+    }
+
+    private fun handleRelayMessage(s: Session, text: String) {
+        val arr = try {
+            JSONArray(text)
+        } catch (_: Exception) {
+            return
+        }
+        if (arr.length() == 0) return
+        when (arr.optString(0)) {
+            "EVENT" -> {
+                val event = arr.optJSONObject(2) ?: return
+                if (event.optLong("kind") != 24133L) return
+                val id = event.optString("id")
+                if (id.isNotEmpty() && !s.seen.add(id)) return
+                val author = event.optString("pubkey")
+                if (author != s.clientPubkey) return // not our client
+                handleClientEvent(s, author, event.optString("content"))
+            }
+            // OK / CLOSED / NOTICE: nothing actionable for the bunker in v1.
+        }
+    }
+
+    private fun handleClientEvent(s: Session, author: String, content: String) {
+        // NIP-44 is the mandated transport; NIP-04 stays as receive fallback
+        // for clients that still speak the deprecated scheme.
+        val plain = run {
+            val nip44 = NativeCore.nostrNip44Decrypt(s.signerSecretHex, author, content)
+            if (!NativeCore.isErr(nip44)) JSONObject(nip44).getString("result") else {
+                val nip04 = NativeCore.nostrNip04Decrypt(s.signerSecretHex, author, content)
+                if (!NativeCore.isErr(nip04)) JSONObject(nip04).getString("result") else return
+            }
+        }
+
+        val msg = try {
+            JSONObject(plain)
+        } catch (_: Exception) {
+            return
+        }
+
+        val id = msg.optString("id")
+        val method = msg.optString("method", "")
+        if (method.isNotEmpty()) {
+            when (method) {
+                "connect" -> {
+                    val params = msg.optJSONArray("params") ?: return
+                    // Param 0 must be OUR pubkey (client is connecting to us,
+                    // not some other bunker through this session).
+                    val target = params.optString(0)
+                    val givenSecret = params.optString(1)
+                    val authorized = target == s.signerPubkeyHex &&
+                        (s.secret.isBlank() || givenSecret == s.secret || givenSecret.isBlank())
+                    if (authorized) {
+                        respond(s, id, result = "ack")
+                        _state.value = SignerState.Ready(s.relay, s.clientName)
+                    } else {
+                        respond(s, id, error = "unauthorized")
+                    }
+                }
+                "get_public_key" -> respond(s, id, result = s.signerPubkeyHex)
+                "describe" -> respond(s, id, result = "connect get_public_key sign_event ping")
+                "ping" -> respond(s, id, result = "pong")
+                "sign_event" -> {
+                    val params = msg.optJSONArray("params") ?: return
+                    val eventJson = params.optString(0)
+                    val ev = try {
+                        JSONObject(eventJson)
+                    } catch (_: Exception) {
+                        respond(s, id, error = "malformed event")
+                        return
+                    }
+                    // Never overwrite a pending request silently — a second
+                    // tap on the node would otherwise cancel the visible one.
+                    if (_pending.value == null) {
+                        _pending.value = PendingRequest(
+                            id = id,
+                            method = method,
+                            clientPubkey = author,
+                            clientName = s.clientName,
+                            kind = if (ev.has("kind") && !ev.isNull("kind")) ev.optLong("kind") else null,
+                            content = if (ev.has("content") && !ev.isNull("content")) ev.optString("content") else null,
+                            tags = formatTags(ev.optJSONArray("tags")),
+                            createdAt = if (ev.has("created_at") && !ev.isNull("created_at")) ev.optLong("created_at") else null,
+                            unsignedEventJson = eventJson,
+                        )
+                    } else {
+                        respond(s, id, error = "busy")
+                    }
+                }
+                else -> respond(s, id, error = "not authorized")
+            }
+        } else if (msg.has("result") || msg.has("error")) {
+            // A response to OUR connect request (the client's ack).
+            if (id == s.connectRequestId) {
+                if (msg.has("error")) {
+                    _state.value = SignerState.Failed("Client rejected the connection: ${msg.optString("error")}")
+                } else if (msg.optString("result") == "ack") {
+                    _state.value = SignerState.Ready(s.relay, s.clientName)
+                }
+            }
+        }
+    }
+
+    /** Approve the pending request: sign and send the result. */
+    suspend fun approve(): Boolean {
+        val s = session.get() ?: return false
+        val req = _pending.value ?: return false
+        val ok = withContext(Dispatchers.IO) {
+            val signed = NativeCore.nostrSignEvent(s.signerSecretHex, req.unsignedEventJson)
+            if (NativeCore.isErr(signed)) {
+                respond(s, req.id, error = "signing failed")
+                false
+            } else {
+                // Result is the signed event, JSON-stringified per the spec.
+                respond(s, req.id, result = signed)
+            }
+        }
+        _pending.value = null
+        return ok
+    }
+
+    /** Deny the pending request with an explicit error. */
+    fun deny() {
+        val s = session.get() ?: return
+        val req = _pending.value ?: return
+        respond(s, req.id, error = "denied")
+        _pending.value = null
+    }
+
+    /** Send a JSON-RPC response frame to the client. True when the WS send worked. */
+    private fun respond(s: Session, id: String, result: String? = null, error: String? = null): Boolean {
+        val frame = JSONObject().apply {
+            put("id", id)
+            if (error != null) put("error", error)
+            if (result != null) put("result", result)
+        }.toString()
+        return sendEncrypted(s, frame)
+    }
+
+    private fun formatTags(tags: JSONArray?): List<String> {
+        tags ?: return emptyList()
+        val out = mutableListOf<String>()
+        for (i in 0 until tags.length()) {
+            val tag = tags.optJSONArray(i) ?: continue
+            val parts = mutableListOf<String>()
+            for (j in 0 until tag.length()) parts.add(tag.optString(j))
+            out.add(parts.joinToString(" "))
+        }
+        return out
+    }
+}

Android/app/src/main/java/com/archipelago/app/nostr/NostrSignerPreferences.kt

@@ -0,0 +1,95 @@
+package com.archipelago.app.nostr
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.archipelago.app.NativeCore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+
+private val Context.signerDataStore: DataStore<Preferences> by preferencesDataStore(name = "nostr_signer")
+
+/**
+ * Storage for the phone-side NIP-46 remote signer (#139): the signer secret
+ * key (hex) and the last pairing, so a re-opened app can resume a session
+ * without re-scanning the node's QR.
+ *
+ * Same plaintext-DataStore model as the FIPS secret (app-private storage,
+ * no extra OS keystore ceremony — the node login password lives the same way
+ * in ServerPreferences); the nsec grants the ability to sign as this identity,
+ * never node login.
+ */
+class NostrSignerPreferences(private val context: Context) {
+
+    private val secretKey = stringPreferencesKey("signer_secret")
+    private val clientPubkeyKey = stringPreferencesKey("pair_client_pubkey")
+    private val clientRelayKey = stringPreferencesKey("pair_client_relay")
+    private val clientNameKey = stringPreferencesKey("pair_client_name")
+
+    /** The signer secret (hex) or null when no key exists yet. */
+    suspend fun secret(): String? = context.signerDataStore.data.first()[secretKey]
+
+    val secretFlow: Flow<String?> = context.signerDataStore.data
+        .map { it[secretKey] }
+        .distinctUntilChanged()
+
+    suspend fun saveSecret(hex: String) {
+        context.signerDataStore.edit { it[secretKey] = hex.trim() }
+    }
+
+    /** Generate a fresh signer key (fails if the native core is missing). */
+    suspend fun generateSecret(): JSONObject = withContext(Dispatchers.IO) {
+        val json = NativeCore.nostrGenerateSecret()
+        val obj = JSONObject(json)
+        if (obj.has("error")) throw IllegalStateException(obj.getString("error"))
+        saveSecret(obj.getString("secret"))
+        obj
+    }
+
+    /** Import a secret from hex or nsec…; returns the parsed key info. */
+    suspend fun importSecret(raw: String): JSONObject = withContext(Dispatchers.IO) {
+        val json = NativeCore.nostrSecretFromAny(raw.trim())
+        val obj = JSONObject(json)
+        if (obj.has("error")) throw IllegalArgumentException(obj.getString("error"))
+        saveSecret(obj.getString("secret"))
+        obj
+    }
+
+    data class Pairing(val clientPubkey: String, val relay: String, val name: String)
+
+    suspend fun lastPairing(): Pairing? {
+        val prefs = context.signerDataStore.data.first()
+        val pubkey = prefs[clientPubkeyKey] ?: return null
+        val relay = prefs[clientRelayKey] ?: return null
+        if (pubkey.isBlank() || relay.isBlank()) return null
+        return Pairing(pubkey, relay, prefs[clientNameKey] ?: "")
+    }
+
+    suspend fun savePairing(pairing: Pairing) {
+        context.signerDataStore.edit {
+            it[clientPubkeyKey] = pairing.clientPubkey
+            it[clientRelayKey] = pairing.relay
+            it[clientNameKey] = pairing.name
+        }
+    }
+
+    suspend fun clearPairing() {
+        context.signerDataStore.edit {
+            it.remove(clientPubkeyKey)
+            it.remove(clientRelayKey)
+            it.remove(clientNameKey)
+        }
+    }
+
+    suspend fun wipeKey() {
+        context.signerDataStore.edit { it.remove(secretKey) }
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/BackupSection.kt

@@ -0,0 +1,294 @@
+package com.archipelago.app.ui.components
+
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Restore
+import androidx.compose.material.icons.filled.Save
+import androidx.compose.material3.Icon
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.data.BackupManager
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SuccessGreen
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+
+/**
+ * Backup & Restore (#128) — the hub's BACKUP sub-page (same container as
+ * Nodes/FIPS), the phone side of losing your phone or wiping it to cross a
+ * border. See docs/companion-backup-restore.md for the envelope and merge
+ * semantics; this composable is the flow only.
+ */
+@Composable
+internal fun BackupSection() {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    val manager = remember { BackupManager(context) }
+
+    var passphrase by remember { mutableStateOf("") }
+    var confirm by remember { mutableStateOf("") }
+    var status by remember { mutableStateOf<String?>(null) }
+    var statusError by remember { mutableStateOf(false) }
+    var busy by remember { mutableStateOf(false) }
+
+    // Decrypted backup awaiting the user's go-ahead (restore flow).
+    var restorePreview by remember { mutableStateOf<Pair<BackupManager.PayloadSummary, org.json.JSONObject>?>(null) }
+
+    fun say(msg: String, error: Boolean) {
+        status = msg
+        statusError = error
+    }
+
+    val exportLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.CreateDocument("application/json")
+    ) { uri ->
+        if (uri == null) return@rememberLauncherForActivityResult
+        scope.launch {
+            busy = true
+            try {
+                val envelope = manager.createBackup(passphrase)
+                withContext(Dispatchers.IO) {
+                    context.contentResolver.openOutputStream(uri)?.use { out ->
+                        out.write(envelope.toByteArray())
+                    } ?: throw BackupManager.BackupException("could not open the destination file")
+                }
+                say("Saved — keep the file and the passphrase somewhere safe.", false)
+            } catch (e: Exception) {
+                say(e.message ?: "backup failed", true)
+            } finally {
+                busy = false
+            }
+        }
+    }
+
+    val importLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.OpenDocument()
+    ) { uri ->
+        if (uri == null) return@rememberLauncherForActivityResult
+        scope.launch {
+            busy = true
+            try {
+                val envelope = withContext(Dispatchers.IO) {
+                    context.contentResolver.openInputStream(uri)?.use { it.readBytes().decodeToString() }
+                        ?: throw BackupManager.BackupException("could not read the selected file")
+                }
+                val (summary, payload) = manager.readBackup(envelope, passphrase)
+                restorePreview = summary to payload
+            } catch (e: Exception) {
+                say(e.message ?: "restore failed", true)
+            } finally {
+                busy = false
+            }
+        }
+    }
+
+    Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
+        SectionCopy(
+            "An encrypted copy of everything this phone holds — nodes and their passwords, " +
+                "your mesh identity, the remote-signer key. Same envelope your node uses (ADR-005), " +
+                "one passphrase, no cloud."
+        )
+
+        // ── Create a backup ──────────────────────────────────────────────
+        SectionHeader(Icons.Default.Save, "Create a backup")
+        GlassField(
+            value = passphrase,
+            onValueChange = { passphrase = it },
+            placeholder = "Passphrase",
+            visualTransformation = androidx.compose.ui.text.input.PasswordVisualTransformation(),
+        )
+        GlassField(
+            value = confirm,
+            onValueChange = { confirm = it },
+            placeholder = "Repeat passphrase",
+            visualTransformation = androidx.compose.ui.text.input.PasswordVisualTransformation(),
+        )
+        SectionHint("The passphrase cannot be recovered — a backup nobody can open is a paperweight.")
+        WideAction(
+            text = if (busy) "Working…" else "Save backup file",
+            onClick = {
+                if (busy) return@WideAction
+                if (passphrase.length < 8) {
+                    say("Use at least 8 characters — this passphrase guards every secret in the app.", true)
+                    return@WideAction
+                }
+                if (passphrase != confirm) {
+                    say("The two passphrases don't match.", true)
+                    return@WideAction
+                }
+                val stamp = SimpleDateFormat("yyyyMMdd-HHmm", Locale.US).format(Date())
+                exportLauncher.launch("archy-companion-backup-$stamp.json")
+            },
+        )
+
+        Spacer(Modifier.height(2.dp))
+
+        // ── Restore a backup ─────────────────────────────────────────────
+        SectionHeader(Icons.Default.Restore, "Restore a backup")
+        SectionHint(
+            "Nothing is overwritten: nodes merge by identity, and the mesh identity and " +
+                "signer key only restore when this phone has none."
+        )
+        WideAction(
+            text = if (busy) "Working…" else "Choose backup file",
+            onClick = {
+                if (busy) return@WideAction
+                if (passphrase.isEmpty()) {
+                    say("Enter the backup's passphrase first.", true)
+                    return@WideAction
+                }
+                importLauncher.launch(arrayOf("application/json"))
+            },
+        )
+
+        restorePreview?.let { (summary, payload) ->
+            Spacer(Modifier.height(2.dp))
+            Column(
+                Modifier
+                    .fillMaxWidth()
+                    .clip(RoundedCornerShape(14.dp))
+                    .background(Color.White.copy(alpha = 0.04f))
+                    .border(1.dp, Color.White.copy(alpha = 0.08f), RoundedCornerShape(14.dp))
+                    .padding(12.dp),
+                verticalArrangement = Arrangement.spacedBy(6.dp),
+            ) {
+                Text(
+                    "Backup verified${if (summary.appVersion.isNotBlank()) " (made by v${summary.appVersion})" else ""}",
+                    color = SuccessGreen, fontSize = 13.sp, fontWeight = FontWeight.SemiBold,
+                )
+                SummaryRow("Nodes", summary.serverCount.toString())
+                if (summary.hasFipsIdentity) SummaryRow("Mesh identity", "included")
+                if (summary.hasSignerKey) SummaryRow("Remote-signer key", "included")
+                WideAction(
+                    text = if (busy) "Restoring…" else "Restore onto this phone",
+                    onClick = {
+                        if (busy) return@WideAction
+                        scope.launch {
+                            busy = true
+                            try {
+                                val result = manager.restoreBackup(payload)
+                                restorePreview = null
+                                passphrase = ""
+                                confirm = ""
+                                say(
+                                    "Restored ${result.serversRestored} node(s)" +
+                                        (if (result.activeSet) ", set active" else "") +
+                                        (if (result.fipsIdentityRestored) ", mesh identity" else "") +
+                                        (if (result.signerKeyRestored) ", signer key" else "") +
+                                        ". Restart the app to reconnect.",
+                                    false,
+                                )
+                            } catch (e: Exception) {
+                                say(e.message ?: "restore failed", true)
+                            } finally {
+                                busy = false
+                            }
+                        }
+                    },
+                )
+            }
+        }
+
+        status?.takeIf { it.isNotBlank() }?.let { msg ->
+            Text(
+                msg,
+                color = if (statusError) Color(0xFFFF6B6B) else SuccessGreen,
+                fontSize = 12.sp,
+                textAlign = TextAlign.Center,
+                modifier = Modifier.fillMaxWidth(),
+            )
+        }
+    }
+}
+
+@Composable
+internal fun SectionHeader(icon: androidx.compose.ui.graphics.vector.ImageVector, title: String) {
+    Row(
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(10.dp),
+    ) {
+        Icon(icon, contentDescription = null, tint = BitcoinOrange, modifier = Modifier.size(18.dp))
+        Text(title, color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.SemiBold)
+    }
+}
+
+@Composable
+internal fun SectionCopy(text: String) {
+    Text(text, color = TextMuted, fontSize = 12.sp, lineHeight = 16.sp)
+}
+
+@Composable
+internal fun SectionHint(text: String) {
+    Text(text, color = TextMuted.copy(alpha = 0.8f), fontSize = 10.sp, lineHeight = 13.sp)
+}
+
+/** Wide orange-outline action button in the menu's visual language. */
+@Composable
+internal fun WideAction(
+    text: String,
+    onClick: () -> Unit,
+    icon: androidx.compose.ui.graphics.vector.ImageVector? = null,
+) {
+    Row(
+        Modifier
+            .fillMaxWidth()
+            .height(44.dp)
+            .clip(RoundedCornerShape(12.dp))
+            .background(BitcoinOrange.copy(alpha = 0.15f))
+            .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+            .clickable { onClick() },
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.Center,
+    ) {
+        if (icon != null) {
+            Icon(icon, contentDescription = null, tint = BitcoinOrange, modifier = Modifier.size(16.dp))
+            Spacer(Modifier.size(8.dp))
+        }
+        Text(text, color = BitcoinOrange, fontSize = 13.sp, fontWeight = FontWeight.Bold)
+    }
+}
+
+@Composable
+internal fun SummaryRow(label: String, value: String) {
+    Row(
+        Modifier.fillMaxWidth(),
+        horizontalArrangement = Arrangement.SpaceBetween,
+    ) {
+        Text(label, color = TextMuted, fontSize = 12.sp)
+        Text(value, color = TextPrimary, fontSize = 12.sp, fontWeight = FontWeight.Medium)
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/NESMenu.kt

@@ -31,6 +31,8 @@ import androidx.compose.material.icons.filled.Dns
 import androidx.compose.material.icons.filled.Groups
 import androidx.compose.material.icons.filled.Keyboard
 import androidx.compose.material.icons.filled.RestartAlt
+import androidx.compose.material.icons.filled.SettingsBackupRestore
+import androidx.compose.material.icons.filled.Key
 import androidx.compose.material.icons.filled.SportsEsports
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.shape.RoundedCornerShape
@@ -106,22 +108,62 @@ fun NESMenu(
     onKeyboard: () -> Unit,
     onBackToWebView: (() -> Unit)? = null,
     onMeshParty: (() -> Unit)? = null,
+    // Remote-signer pairing request (nostrconnect://… deep link, or a scan):
+    // non-null opens the hub on the signer sub-page and pairs. Consumed once
+    // the signer section hands it back via [onSignerPairHandled].
+    signerPairRequest: String? = null,
+    onSignerPairHandled: () -> Unit = {},
 ) {
+    // Pairing state is latched here (not passed straight through) so the
+    // source can clear itself while the request stays alive until consumed.
+    var pendingSignerPair by remember { mutableStateOf<String?>(null) }
+    var signerScan by remember { mutableStateOf(false) }
+    LaunchedEffect(signerPairRequest) {
+        if (signerPairRequest != null) pendingSignerPair = signerPairRequest
+    }
+
     AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
         // Contained hub overlay: a centred glass panel (not full-screen) that
-        // holds the card page and its sub-pages (Nodes, FIPS) and scrolls
-        // inside its own bounds when content is tall. Tapping the dimmed
-        // backdrop dismisses.
+        // holds the card page and its sub-pages (Nodes, FIPS, Backup, Signer)
+        // and scrolls inside its own bounds when content is tall. Tapping the
+        // dimmed backdrop dismisses.
         Box(
             Modifier.fillMaxSize().background(Color.Black.copy(alpha = 0.7f))
                 .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) { onDismiss() },
             contentAlignment = Alignment.Center,
         ) {
             AnimatedVisibility(visible = visible, enter = fadeIn() + scaleIn(initialScale = 0.95f), exit = fadeOut() + scaleOut(targetScale = 0.95f)) {
-                MenuPanel(servers, activeServer, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onRemote, onKeyboard, onBackToWebView, onMeshParty)
+                MenuPanel(
+                    servers, activeServer, onDismiss, onSelectServer, onAddServer, onScanQr,
+                    onEditServer, onRemoveServer, onRemote, onKeyboard, onBackToWebView, onMeshParty,
+                    signerPairUri = pendingSignerPair,
+                    onSignerScan = { signerScan = true },
+                    onSignerPairHandled = {
+                        pendingSignerPair = null
+                        onSignerPairHandled()
+                    },
+                )
             }
         }
     }
+
+    // Pairing-QR scanner for the signer sub-page — a full-screen glass
+    // modal hosted OUTSIDE the hub panel so it isn't clipped to the panel's
+    // bounds (same layering the pairing scanner gets from WebViewScreen).
+    QrGlassModal(
+        visible = signerScan && visible,
+        title = "Scan pairing QR",
+        status = null,
+        idleHint = "Point at the nostrconnect QR the node or client shows",
+        permissionRationale = "Camera access is needed to scan the pairing code",
+        onDismiss = { signerScan = false },
+        onDecoded = { text ->
+            if (text.startsWith("nostrconnect://")) {
+                signerScan = false
+                pendingSignerPair = text
+            }
+        },
+    )
 }
 
 @Composable
@@ -138,6 +180,9 @@ private fun MenuPanel(
     onKeyboard: () -> Unit,
     onBackToWebView: (() -> Unit)?,
     onMeshParty: (() -> Unit)?,
+    signerPairUri: String?,
+    onSignerScan: () -> Unit,
+    onSignerPairHandled: () -> Unit,
 ) {
     var showAdd by remember { mutableStateOf(false) }
     // The saved server being edited, or null when adding a new one.
@@ -176,9 +221,10 @@ private fun MenuPanel(
             .widthIn(max = 420.dp)
             .fillMaxWidth()
             .padding(horizontal = 20.dp)
-            // Cap height just short of the full screen; the panel wraps short
-            // content and only scrolls in the rare case it outgrows this.
-            .heightIn(max = (LocalConfiguration.current.screenHeightDp * 0.92f).dp)
+            // Cap height at 70% of the screen — a ~15% breathing margin top
+            // and bottom — the panel wraps short content and scrolls inside
+            // its own bounds when a sub-page outgrows this.
+            .heightIn(max = (LocalConfiguration.current.screenHeightDp * 0.70f).dp)
             .clip(RoundedCornerShape(PANEL_R))
             .background(PanelBg.copy(alpha = 0.86f))
             .border(1.dp, PanelBorder, RoundedCornerShape(PANEL_R))
@@ -201,7 +247,13 @@ private fun MenuPanel(
                     IconRound(Icons.AutoMirrored.Filled.ArrowBack, "Back") { resetForm(); page = HubPage.HUB }
                     Spacer(Modifier.width(12.dp))
                     Text(
-                        if (page == HubPage.NODES) "Nodes" else "FIPS Mesh",
+                        when (page) {
+                            HubPage.NODES -> "Nodes"
+                            HubPage.FIPS -> "FIPS Mesh"
+                            HubPage.BACKUP -> "Backup & Restore"
+                            HubPage.SIGNER -> "Remote Signer"
+                            HubPage.HUB -> "Menu"
+                        },
                         color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 1.sp,
                     )
                 }
@@ -233,6 +285,12 @@ private fun MenuPanel(
                 if (onMeshParty != null) {
                     HubCard(Icons.Default.Groups, "Mesh Party", "Phone-to-phone chat & beam") { onMeshParty() }
                 }
+                // Backup & Restore (#128): the phone side of losing your phone
+                // or wiping it to cross a border — encrypted export file, no cloud.
+                HubCard(Icons.Default.SettingsBackupRestore, "Backup & Restore", "Encrypted export for a wiped phone") { page = HubPage.BACKUP }
+                // Remote Signer (#139): hold a nostr key on the phone and
+                // approve/deny remote signature requests (NIP-46).
+                HubCard(Icons.Default.Key, "Remote Signer", "Approve signatures for your node") { page = HubPage.SIGNER }
                 // Dark/Classic style lives on the remote/keyboard screen next to
                 // the settings button — not here.
 
@@ -272,6 +330,11 @@ private fun MenuPanel(
                     val active = server.serialize() == activeServer?.serialize()
                     MenuItem(
                         label = server.displayName(),
+                        // FIPS nodes carry their mesh ULA — the address Termux
+                        // (or any other app) can reach over the split-tunnel,
+                        // from anywhere. Tap to copy; the node's npub stays
+                        // visible in the FIPS Mesh page.
+                        subtitle = server.meshIp.takeIf { it.isNotBlank() },
                         selected = active,
                         onClick = { onSelectServer(server) },
                         onEdit = { startEdit(server) },
@@ -391,11 +454,23 @@ private fun MenuPanel(
             HubPage.FIPS -> {
                 FipsSection(embedded = true)
             }
+
+            HubPage.BACKUP -> {
+                BackupSection()
+            }
+
+            HubPage.SIGNER -> {
+                SignerSection(
+                    pairUri = signerPairUri,
+                    onScan = onSignerScan,
+                    onPairHandled = onSignerPairHandled,
+                )
+            }
         }
     }
 }
 
-private enum class HubPage { HUB, NODES, FIPS }
+private enum class HubPage { HUB, NODES, FIPS, BACKUP, SIGNER }
 
 /** Big tappable destination card for the hub page: icon + title + subtitle. */
 @Composable
@@ -582,26 +657,52 @@ private fun MenuItem(
     onClick: () -> Unit,
     onEdit: (() -> Unit)? = null,
     onRemove: (() -> Unit)? = null,
+    /** Optional second line (the node's mesh ULA); tapping it copies. */
+    subtitle: String? = null,
 ) {
+    val clipboard = LocalClipboardManager.current
     Row(
         Modifier
             .fillMaxWidth()
-            .height(ROW_H)
+            // Rows with a second line grow to fit it.
+            .then(if (subtitle == null) Modifier.height(ROW_H) else Modifier.heightIn(min = ROW_H))
             .clip(RoundedCornerShape(ROW_R))
             .background(if (selected) BitcoinOrange.copy(alpha = 0.12f) else RowBg)
             .border(1.dp, if (selected) BitcoinOrange.copy(alpha = 0.4f) else RowBorder, RoundedCornerShape(ROW_R))
             .clickable { onClick() }
-            .padding(horizontal = 16.dp),
+            .padding(horizontal = 16.dp)
+            .then(if (subtitle == null) Modifier else Modifier.padding(vertical = 8.dp)),
         verticalAlignment = Alignment.CenterVertically,
         horizontalArrangement = Arrangement.SpaceBetween,
     ) {
-        Text(
-            label,
-            color = if (selected) BitcoinOrange else labelColor,
-            fontSize = 16.sp,
-            fontWeight = FontWeight.Medium,
-            modifier = Modifier.weight(1f),
-        )
+        Column(Modifier.weight(1f)) {
+            Text(
+                label,
+                color = if (selected) BitcoinOrange else labelColor,
+                fontSize = 16.sp,
+                fontWeight = FontWeight.Medium,
+            )
+            if (subtitle != null) {
+                Row(
+                    Modifier
+                        .padding(top = 2.dp)
+                        .clip(RoundedCornerShape(6.dp))
+                        .clickable { clipboard.setText(AnnotatedString(subtitle)) }
+                        .padding(horizontal = 4.dp, vertical = 2.dp),
+                    verticalAlignment = Alignment.CenterVertically,
+                ) {
+                    Text(
+                        subtitle,
+                        color = TextMuted,
+                        fontSize = 10.sp,
+                        fontFamily = androidx.compose.ui.text.font.FontFamily.Monospace,
+                        maxLines = 1,
+                        overflow = androidx.compose.ui.text.style.TextOverflow.Ellipsis,
+                    )
+                    Text("⧉", color = TextMuted.copy(alpha = 0.7f), fontSize = 11.sp, modifier = Modifier.padding(start = 6.dp))
+                }
+            }
+        }
         if (onEdit != null) {
             Text(
                 "✎",
@@ -623,7 +724,7 @@ private fun MenuItem(
 
 /** Glass text field with centered input text. */
 @Composable
-private fun GlassField(
+internal fun GlassField(
     value: String,
     onValueChange: (String) -> Unit,
     placeholder: String,

Android/app/src/main/java/com/archipelago/app/ui/components/SignerLaunch.kt

@@ -0,0 +1,14 @@
+package com.archipelago.app.ui.components
+
+import kotlinx.coroutines.flow.MutableStateFlow
+
+/**
+ * Cross-layer handoff for remote-signer pairing (#139): NavGraph's
+ * `nostrconnect://` deep link drops the URI here and routes to the session;
+ * WebViewScreen collects it, opens the hub menu, and NESMenu opens the
+ * signer sub-page with the request. Cleared once the signer section has
+ * consumed it (via NESMenu's onSignerPairHandled).
+ */
+object SignerLaunch {
+    val pendingUri = MutableStateFlow<String?>(null)
+}

Android/app/src/main/java/com/archipelago/app/ui/components/SignerSection.kt

@@ -0,0 +1,381 @@
+package com.archipelago.app.ui.components
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Key
+import androidx.compose.material.icons.filled.QrCodeScanner
+import androidx.compose.material3.Icon
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalClipboardManager
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.NativeCore
+import com.archipelago.app.nostr.BunkerManager
+import com.archipelago.app.nostr.NostrSignerPreferences
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SuccessGreen
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import kotlinx.coroutines.launch
+import org.json.JSONObject
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+
+/**
+ * Remote Signer (#139) — the hub's SIGNER sub-page (same container as
+ * Nodes/FIPS). The phone holds a nostr key; a NIP-46 client (the node's
+ * login QR, any nostrconnect:// app) pairs via [pairUri] or the scanner
+ * (hosted by NESMenu outside this panel), and every `sign_event` request
+ * lands as a legible approve/deny card. See
+ * docs/companion-nip46-remote-signer.md.
+ */
+@Composable
+internal fun SignerSection(
+    pairUri: String?,
+    onScan: () -> Unit,
+    onPairHandled: () -> Unit,
+) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    val clipboard = LocalClipboardManager.current
+    val prefs = remember { NostrSignerPreferences(context) }
+
+    var keyInfo by remember { mutableStateOf<JSONObject?>(null) }
+    var keyError by remember { mutableStateOf<String?>(null) }
+    var importText by remember { mutableStateOf("") }
+    var showNsec by remember { mutableStateOf(false) }
+    var notice by remember { mutableStateOf<String?>(null) }
+    var noticeError by remember { mutableStateOf(false) }
+
+    val bunkerState by BunkerManager.state.collectAsState()
+    val pending by BunkerManager.pending.collectAsState()
+
+    fun say(msg: String, error: Boolean) {
+        notice = msg
+        noticeError = error
+    }
+
+    suspend fun loadKey() {
+        val secret = prefs.secret()
+        keyInfo = secret?.let {
+            val json = NativeCore.nostrSecretFromAny(it)
+            if (NativeCore.isErr(json)) null else JSONObject(json)
+        }
+    }
+
+    LaunchedEffect(Unit) {
+        BunkerManager.refreshState(context)
+        loadKey()
+    }
+
+    // Consume a pairing request (deep link or scanner) exactly once.
+    LaunchedEffect(pairUri) {
+        val uri = pairUri?.takeIf { it.isNotBlank() } ?: return@LaunchedEffect
+        if (keyInfo == null) loadKey()
+        val err = BunkerManager.pair(context, uri)
+        if (err != null) say(err, true) else say("Pairing started…", false)
+        onPairHandled()
+    }
+
+    Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
+        SectionCopy(
+            "Hold a nostr key on this phone and sign for it remotely — pair with your " +
+                "node's login QR (or any NIP-46 client), then approve each signature " +
+                "request as it arrives. Nothing signs without you."
+        )
+
+        if (bunkerState is BunkerManager.SignerState.Unavailable) {
+            Text(
+                "Signing is unavailable on this device (native core missing).",
+                color = Color(0xFFFF6B6B), fontSize = 12.sp,
+            )
+        }
+
+        val info = keyInfo
+        if (info == null) {
+            // ── No key yet: generate or import ──────────────────────────
+            keyError?.let { Text(it, color = Color(0xFFFF6B6B), fontSize = 11.sp) }
+            WideAction(text = "Generate signer key", onClick = {
+                scope.launch {
+                    try {
+                        keyInfo = prefs.generateSecret()
+                        keyError = null
+                        BunkerManager.refreshState(context)
+                    } catch (e: Exception) {
+                        keyError = e.message ?: "could not generate a key"
+                    }
+                }
+            })
+            GlassField(
+                value = importText,
+                onValueChange = { importText = it },
+                placeholder = "or import nsec…",
+                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                keyboardActions = KeyboardActions(onGo = {
+                    if (importText.isNotBlank()) {
+                        scope.launch {
+                            try {
+                                keyInfo = prefs.importSecret(importText)
+                                importText = ""
+                                keyError = null
+                                BunkerManager.refreshState(context)
+                            } catch (e: Exception) {
+                                keyError = e.message ?: "not a valid nsec"
+                            }
+                        }
+                    }
+                }),
+            )
+            WideAction(text = "Import", onClick = {
+                if (importText.isBlank()) return@WideAction
+                scope.launch {
+                    try {
+                        keyInfo = prefs.importSecret(importText)
+                        importText = ""
+                        keyError = null
+                        BunkerManager.refreshState(context)
+                    } catch (e: Exception) {
+                        keyError = e.message ?: "not a valid nsec"
+                    }
+                }
+            })
+        } else {
+            // ── Identity ─────────────────────────────────────────────────
+            SectionHeader(Icons.Default.Key, "Signer identity")
+            MonoValue("npub", info.optString("npub")) {
+                clipboard.setText(AnnotatedString(info.optString("npub")))
+            }
+            if (showNsec) {
+                MonoValue("nsec", info.optString("nsec"), secret = true) {
+                    clipboard.setText(AnnotatedString(info.optString("nsec")))
+                }
+                SectionHint("Anyone with the nsec can sign as you — clear the clipboard after copying.")
+            } else {
+                Text(
+                    "Show nsec",
+                    color = TextMuted, fontSize = 11.sp,
+                    modifier = Modifier
+                        .clip(RoundedCornerShape(8.dp))
+                        .clickable { showNsec = true }
+                        .padding(vertical = 2.dp, horizontal = 6.dp),
+                )
+            }
+
+            // ── Session ──────────────────────────────────────────────────
+            Spacer(Modifier.height(2.dp))
+            val label = when (val s = bunkerState) {
+                BunkerManager.SignerState.Unavailable -> "Unavailable on this device"
+                BunkerManager.SignerState.NoKey -> "No signer key yet"
+                BunkerManager.SignerState.Idle -> "Idle — pair to start"
+                is BunkerManager.SignerState.Connecting -> "Connecting to ${s.relay}…"
+                is BunkerManager.SignerState.AwaitingClient -> "Paired with \"${s.clientName}\" — waiting for the handshake to finish"
+                is BunkerManager.SignerState.Ready -> "Ready for \"${s.clientName}\""
+                is BunkerManager.SignerState.Failed -> s.reason
+            }
+            Text("Session", color = TextMuted, fontSize = 11.sp)
+            Text(
+                label,
+                color = if (bunkerState is BunkerManager.SignerState.Failed) Color(0xFFFF6B6B)
+                else if (bunkerState is BunkerManager.SignerState.Ready) SuccessGreen
+                else TextPrimary,
+                fontSize = 13.sp,
+                lineHeight = 17.sp,
+            )
+            WideAction(
+                text = "Scan pairing QR",
+                onClick = {
+                    if (bunkerState is BunkerManager.SignerState.NoKey) {
+                        say("Generate or import a signer key first.", true)
+                        return@WideAction
+                    }
+                    onScan()
+                },
+                icon = Icons.Default.QrCodeScanner,
+            )
+            if (bunkerState is BunkerManager.SignerState.Ready ||
+                bunkerState is BunkerManager.SignerState.AwaitingClient ||
+                bunkerState is BunkerManager.SignerState.Connecting
+            ) {
+                Text(
+                    "End session",
+                    color = TextMuted, fontSize = 11.sp,
+                    modifier = Modifier
+                        .clip(RoundedCornerShape(8.dp))
+                        .clickable { BunkerManager.unpair() }
+                        .padding(vertical = 2.dp, horizontal = 6.dp),
+                )
+            }
+
+            // ── Pending signature request — the whole point ──────────────
+            pending?.let { req ->
+                Spacer(Modifier.height(2.dp))
+                Column(
+                    Modifier
+                        .fillMaxWidth()
+                        .clip(RoundedCornerShape(14.dp))
+                        .background(Color.White.copy(alpha = 0.04f))
+                        .border(1.dp, BitcoinOrange.copy(alpha = 0.35f), RoundedCornerShape(14.dp))
+                        .padding(12.dp),
+                    verticalArrangement = Arrangement.spacedBy(6.dp),
+                ) {
+                    Text("Signature request", color = BitcoinOrange, fontSize = 13.sp, fontWeight = FontWeight.Bold)
+                    SummaryRow("Client", req.clientName.ifBlank { req.clientPubkey.take(12) + "…" })
+                    SummaryRow("Kind", kindLabel(req.kind))
+                    req.createdAt?.let {
+                        SummaryRow("Time", SimpleDateFormat("HH:mm:ss", Locale.US).format(Date(it * 1000)))
+                    }
+                    req.content?.takeIf { it.isNotBlank() }?.let { content ->
+                        Text(
+                            content,
+                            color = TextPrimary, fontSize = 10.sp, lineHeight = 14.sp,
+                            fontFamily = FontFamily.Monospace,
+                            modifier = Modifier
+                                .fillMaxWidth()
+                                .clip(RoundedCornerShape(10.dp))
+                                .background(Color.Black.copy(alpha = 0.45f))
+                                .padding(8.dp)
+                                .heightIn(max = 160.dp),
+                        )
+                    }
+                    if (req.tags.isNotEmpty()) {
+                        Column(
+                            Modifier
+                                .fillMaxWidth()
+                                .clip(RoundedCornerShape(10.dp))
+                                .background(Color.Black.copy(alpha = 0.45f))
+                                .padding(8.dp),
+                            verticalArrangement = Arrangement.spacedBy(2.dp),
+                        ) {
+                            req.tags.take(6).forEach {
+                                Text(
+                                    it,
+                                    color = TextMuted, fontSize = 9.sp,
+                                    fontFamily = FontFamily.Monospace,
+                                    maxLines = 1,
+                                    overflow = TextOverflow.Ellipsis,
+                                )
+                            }
+                            if (req.tags.size > 6) {
+                                Text("+${req.tags.size - 6} more", color = TextMuted, fontSize = 9.sp)
+                            }
+                        }
+                    }
+                    Row(horizontalArrangement = Arrangement.spacedBy(10.dp)) {
+                        Box(
+                            Modifier
+                                .weight(1f)
+                                .height(40.dp)
+                                .clip(RoundedCornerShape(12.dp))
+                                .background(Color(0xFFE5484D).copy(alpha = 0.16f))
+                                .border(1.dp, Color(0xFFE5484D).copy(alpha = 0.5f), RoundedCornerShape(12.dp))
+                                .clickable { BunkerManager.deny() },
+                            contentAlignment = Alignment.Center,
+                        ) { Text("Deny", color = Color(0xFFFF8A8D), fontSize = 13.sp, fontWeight = FontWeight.Bold) }
+                        Box(
+                            Modifier
+                                .weight(1f)
+                                .height(40.dp)
+                                .clip(RoundedCornerShape(12.dp))
+                                .background(BitcoinOrange.copy(alpha = 0.2f))
+                                .border(1.dp, BitcoinOrange.copy(alpha = 0.6f), RoundedCornerShape(12.dp))
+                                .clickable {
+                                    scope.launch {
+                                        val ok = BunkerManager.approve()
+                                        say(if (ok) "Signed and sent." else "Could not send the signature.", !ok)
+                                    }
+                                },
+                            contentAlignment = Alignment.Center,
+                        ) { Text("Approve", color = BitcoinOrange, fontSize = 13.sp, fontWeight = FontWeight.Bold) }
+                    }
+                }
+            }
+        }
+
+        notice?.takeIf { it.isNotBlank() }?.let { msg ->
+            Text(
+                msg,
+                color = if (noticeError) Color(0xFFFF6B6B) else SuccessGreen,
+                fontSize = 12.sp,
+                textAlign = TextAlign.Center,
+                modifier = Modifier.fillMaxWidth(),
+            )
+        }
+    }
+}
+
+/** Kind number → legible label, so the approve/deny card reads like a sentence. */
+private fun kindLabel(kind: Long?): String = when (kind) {
+    0L -> "Metadata (kind 0)"
+    1L -> "Text note (kind 1)"
+    3L -> "Contact list (kind 3)"
+    4L -> "Direct message (kind 4)"
+    7L -> "Reaction (kind 7)"
+    14L -> "Chat message (kind 14)"
+    22242L -> "Client authentication (kind 22242)"
+    30078L -> "App-stored data (kind 30078)"
+    null -> "Unknown kind"
+    else -> "Kind $kind"
+}
+
+/** Monospace value chip with a copy affordance (tap the row). */
+@Composable
+private fun MonoValue(label: String, value: String, secret: Boolean = false, onCopy: () -> Unit) {
+    Column(Modifier.fillMaxWidth()) {
+        Text(label, color = TextMuted, fontSize = 10.sp)
+        Row(
+            Modifier
+                .fillMaxWidth()
+                .clip(RoundedCornerShape(10.dp))
+                .background(Color.Black.copy(alpha = 0.45f))
+                .clickable { onCopy() }
+                .padding(horizontal = 10.dp, vertical = 8.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Text(
+                value,
+                color = if (secret) Color(0xFFFFB86B) else TextPrimary,
+                fontSize = 10.sp,
+                fontFamily = FontFamily.Monospace,
+                modifier = Modifier.weight(1f),
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+            )
+            Text("⧉", color = TextMuted, fontSize = 13.sp, modifier = Modifier.padding(start = 8.dp))
+        }
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/navigation/NavGraph.kt

@@ -22,6 +22,7 @@ import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.data.ServerQrParser
 import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.components.SignerLaunch
 import com.archipelago.app.ui.screens.FlareScreen
 import com.archipelago.app.ui.screens.IntroScreen
 import com.archipelago.app.ui.screens.NodePickerScreen
@@ -133,27 +134,41 @@ fun AppNavHost(
     LaunchedEffect(pairUri) {
         val raw = pairUri ?: return@LaunchedEffect
         onPairUriConsumed()
-        when (val result = ServerQrParser.parse(raw)) {
-            is PairResult.Success -> {
-                // Pairing implies the app is installed and in use — skip the intro.
+        when {
+            // Remote-signer pairing deep link (NIP-46): nostrconnect://…
+            // from the node's login QR — any QR scanner app can hand it over.
+            // The signer UI lives inside the hub menu: drop the URI where
+            // WebViewScreen picks it up and route to the session, which opens
+            // the hub on its signer sub-page.
+            raw.startsWith("nostrconnect://") -> {
                 prefs.markIntroSeen()
-                val merged = prefs.upsertServer(result.server)
-                FipsManager.registerNode(context, result.fips, merged.displayName())
-                if (merged.password.isNotBlank()) {
-                    // Demo flow: password came with the link — connect in one step.
-                    prefs.setActiveServer(merged)
-                    navController.navigate(Routes.WEB_VIEW) {
-                        popUpTo(0) { inclusive = true }
-                    }
-                } else {
-                    pairPrefill = merged
-                    navController.navigate(Routes.SERVER_CONNECT) {
-                        popUpTo(0) { inclusive = true }
-                    }
+                SignerLaunch.pendingUri.value = raw
+                navController.navigate(Routes.WEB_VIEW) {
+                    popUpTo(0) { inclusive = true }
                 }
             }
-            else -> {
-                // Invalid or too-new pairing link — ignore; normal startup continues.
+            else -> when (val result = ServerQrParser.parse(raw)) {
+                is PairResult.Success -> {
+                    // Pairing implies the app is installed and in use — skip the intro.
+                    prefs.markIntroSeen()
+                    val merged = prefs.upsertServer(result.server)
+                    FipsManager.registerNode(context, result.fips, merged.displayName())
+                    if (merged.password.isNotBlank()) {
+                        // Demo flow: password came with the link — connect in one step.
+                        prefs.setActiveServer(merged)
+                        navController.navigate(Routes.WEB_VIEW) {
+                            popUpTo(0) { inclusive = true }
+                        }
+                    } else {
+                        pairPrefill = merged
+                        navController.navigate(Routes.SERVER_CONNECT) {
+                            popUpTo(0) { inclusive = true }
+                        }
+                    }
+                }
+                else -> {
+                    // Invalid or too-new pairing link — ignore; normal startup continues.
+                }
             }
         }
     }

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -101,6 +101,7 @@ import com.archipelago.app.fips.FipsManager
 import com.archipelago.app.ui.components.GestureHintOverlay
 import com.archipelago.app.ui.components.MeshLoadingScreen
 import com.archipelago.app.ui.components.NESMenu
+import com.archipelago.app.ui.components.SignerLaunch
 import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.components.SlidingLoader
 import com.archipelago.app.ui.components.WalletQrScannerModal
@@ -325,8 +326,9 @@ private object KioskWebView {
 private fun injectSafeAreaVars(view: WebView) {
     val insets = view.rootWindowInsets ?: return // listener re-fires when real
     val density = view.resources.displayMetrics.density
-    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
-    val sab = (insets.getInsets(android.view.WindowInsets.Type.navigationBars()).bottom / density).toInt()
+    val compatibleInsets = androidx.core.view.WindowInsetsCompat.toWindowInsetsCompat(insets, view)
+    val sat = (compatibleInsets.getInsets(androidx.core.view.WindowInsetsCompat.Type.statusBars()).top / density).toInt()
+    val sab = (compatibleInsets.getInsets(androidx.core.view.WindowInsetsCompat.Type.navigationBars()).bottom / density).toInt()
     // The insets listener fires on every pass (every IME show/hide); skip the
     // JS round-trip — and the Vue event it dispatches — when nothing changed.
     val stamp = "sa:$sat,$sab"
@@ -376,7 +378,8 @@ private fun injectSafeAreaVars(view: WebView) {
 private fun injectTopInset(view: WebView) {
     val insets = view.rootWindowInsets ?: return
     val density = view.resources.displayMetrics.density
-    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
+    val compatibleInsets = androidx.core.view.WindowInsetsCompat.toWindowInsetsCompat(insets, view)
+    val sat = (compatibleInsets.getInsets(androidx.core.view.WindowInsetsCompat.Type.statusBars()).top / density).toInt()
     if (sat <= 0) return
     view.evaluateJavascript(
         """
@@ -990,6 +993,51 @@ fun WebViewScreen(
                                         )
                                     }
                                 }
+
+                                /** HTML downloads are not handled by WebView.
+                                 *  Fetch only this connected node's public CA
+                                 *  over its always-available HTTP listener,
+                                 *  verify it is an actual CA certificate, then
+                                 *  hand it to Android's trusted system prompt.
+                                 *  No caller-controlled certificate bytes are
+                                 *  accepted by this bridge. */
+                                @android.webkit.JavascriptInterface
+                                fun installNodeCertificate() {
+                                    scope.launch {
+                                        try {
+                                            val der = withContext(Dispatchers.IO) {
+                                                val host = android.net.Uri.parse(serverUrl).host
+                                                    ?: error("node URL has no host")
+                                                val caUrl = java.net.URI(
+                                                    "http", null, host, 80, "/ca.crt", null, null,
+                                                ).toASCIIString()
+                                                val request = okhttp3.Request.Builder().url(caUrl).build()
+                                                okhttp3.OkHttpClient().newCall(request).execute().use { response ->
+                                                    if (!response.isSuccessful) error("CA download failed")
+                                                    val bytes = response.body?.bytes() ?: error("empty CA")
+                                                    if (bytes.size > 64 * 1024) error("CA is too large")
+                                                    val cert = java.security.cert.CertificateFactory
+                                                        .getInstance("X.509")
+                                                        .generateCertificate(java.io.ByteArrayInputStream(bytes))
+                                                        as java.security.cert.X509Certificate
+                                                    if (cert.basicConstraints < 0) error("certificate is not a CA")
+                                                    cert.encoded
+                                                }
+                                            }
+                                            val intent = android.security.KeyChain.createInstallIntent().apply {
+                                                putExtra(android.security.KeyChain.EXTRA_CERTIFICATE, der)
+                                                putExtra(
+                                                    android.security.KeyChain.EXTRA_NAME,
+                                                    "Archipelago node CA",
+                                                )
+                                                addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK)
+                                            }
+                                            context.startActivity(intent)
+                                        } catch (_: Exception) {
+                                            // Network failure, invalid CA, or no credential installer.
+                                        }
+                                    }
+                                }
                             },
                             "ArchipelagoNative",
                         )
@@ -1373,6 +1421,16 @@ fun WebViewScreen(
         // Hub menu overlay — opened by the three-finger hold, drawn above
         // everything (also reachable from the error screen, where switching
         // servers is exactly what's needed).
+        // Remote-signer deep link: route to the session and pop the hub open
+        // on its signer sub-page (the request itself is consumed by NESMenu).
+        var signerPairRequest by remember { mutableStateOf<String?>(null) }
+        val signerLaunch by SignerLaunch.pendingUri.collectAsState()
+        LaunchedEffect(signerLaunch) {
+            val uri = signerLaunch ?: return@LaunchedEffect
+            signerPairRequest = uri
+            SignerLaunch.pendingUri.value = null
+            showHubMenu = true
+        }
         NESMenu(
             visible = showHubMenu,
             servers = savedServers,
@@ -1427,6 +1485,8 @@ fun WebViewScreen(
             onKeyboard = { showHubMenu = false; onRemoteKeyboard() },
             onBackToWebView = { showHubMenu = false },
             onMeshParty = onMeshParty?.let { open -> { showHubMenu = false; open() } },
+            signerPairRequest = signerPairRequest,
+            onSignerPairHandled = { signerPairRequest = null },
         )
 
         // Pairing-QR scan launched from the menu's Nodes page; the menu stays
@@ -1510,6 +1570,11 @@ private fun InAppBrowser(
     var loaderIcon by remember { mutableStateOf<Bitmap?>(null) }
     var progress by remember { mutableIntStateOf(0) }
     var loading by remember { mutableStateOf(true) }
+    // Once this WebView has painted an app, keep that surface visible during
+    // same-app reloads/navigation. Covering every navigation with an opaque
+    // Compose loader caused GitWorkshop to flash, and an IndeeHub auth reload
+    // could remain covered when WebView omitted the final callback.
+    var hasCommittedPage by remember { mutableStateOf(false) }
     var canGoBack by remember { mutableStateOf(false) }
     var canGoForward by remember { mutableStateOf(false) }
     // Main-frame load failure — the branded offline screen renders instead of
@@ -1581,6 +1646,20 @@ private fun InAppBrowser(
                         // Node apps (BTCPay invoices, LND, Portainer tokens) are
                         // served over plain HTTP too — same dead-clipboard trap.
                         addClipboardBridge()
+                        val appBrowserView = this
+                        addJavascriptInterface(
+                            object {
+                                @android.webkit.JavascriptInterface
+                                fun expectPageTransition() {
+                                    appBrowserView.post {
+                                        hasCommittedPage = false
+                                        loading = true
+                                        appBrowserView.invalidate()
+                                    }
+                                }
+                            },
+                            "ArchipelagoSurface",
+                        )
 
                         webChromeClient = object : WebChromeClient() {
                             override fun onProgressChanged(view: WebView?, newProgress: Int) {
@@ -1610,7 +1689,7 @@ private fun InAppBrowser(
 
                         webViewClient = object : WebViewClient() {
                             override fun onPageStarted(view: WebView?, u: String?, favicon: Bitmap?) {
-                                loading = true
+                                loading = !hasCommittedPage
                                 loadError = false
                                 view?.let {
                                     injectTopInset(it)
@@ -1619,6 +1698,7 @@ private fun InAppBrowser(
                             }
 
                             override fun onPageFinished(view: WebView?, u: String?) {
+                                hasCommittedPage = true
                                 loading = false
                                 canGoBack = view?.canGoBack() == true
                                 canGoForward = view?.canGoForward() == true
@@ -1628,6 +1708,14 @@ private fun InAppBrowser(
                                 }
                             }
 
+                            override fun onPageCommitVisible(view: WebView?, url: String?) {
+                                // Fires when the new main-frame pixels are ready,
+                                // earlier and more reliably than onPageFinished
+                                // for service-worker-controlled SPAs.
+                                hasCommittedPage = true
+                                loading = false
+                            }
+
                             override fun onReceivedError(
                                 view: WebView?,
                                 request: WebResourceRequest?,
@@ -1719,6 +1807,7 @@ private fun InAppBrowser(
                         text = stringResource(R.string.retry),
                         onClick = {
                             loadError = false
+                            hasCommittedPage = false
                             loading = true
                             browser?.reload()
                         },

Android/rust/archy-fips-core/Cargo.lock

@@ -12,6 +12,17 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -81,17 +92,41 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 name = "archy-fips-core"
 version = "0.1.0"
 dependencies = [
+ "aes",
  "anyhow",
+ "argon2",
+ "base64",
+ "bech32",
+ "cbc",
+ "chacha20 0.9.1",
+ "chacha20poly1305",
  "fips",
  "getrandom 0.2.17",
  "hex",
+ "hkdf",
+ "hmac",
  "jni",
  "libc",
  "paranoid-android",
+ "secp256k1 0.29.1",
  "serde_json",
+ "sha2",
  "tokio",
  "tracing",
  "tracing-subscriber",
+ "url",
+]
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
 ]
 
 [[package]]
@@ -124,6 +159,18 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bech32"
 version = "0.11.1"
@@ -172,6 +219,15 @@ version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -181,6 +237,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "blocking"
 version = "1.6.2"
@@ -200,6 +265,15 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "cc"
 version = "1.3.0"
@@ -406,6 +480,17 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "either"
 version = "1.16.0"
@@ -476,7 +561,7 @@ dependencies = [
  "libc",
  "rand 0.10.2",
  "rtnetlink",
- "secp256k1",
+ "secp256k1 0.30.0",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -491,6 +576,15 @@ dependencies = [
  "tun",
 ]
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.33"
@@ -676,6 +770,110 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -692,6 +890,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
+ "block-padding",
  "generic-array",
 ]
 
@@ -788,6 +987,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
 [[package]]
 name = "log"
 version = "0.4.33"
@@ -954,12 +1159,29 @@ version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "paste"
 version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -988,6 +1210,15 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -1129,6 +1360,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "secp256k1"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9465315bc9d4566e1724f0fffcbcc446268cb522e60f9a27bcded6b19c108113"
+dependencies = [
+ "secp256k1-sys",
+]
+
 [[package]]
 name = "secp256k1"
 version = "0.30.0"
@@ -1272,6 +1512,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -1306,6 +1552,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -1355,6 +1612,16 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tokio"
 version = "1.53.1"
@@ -1519,6 +1786,24 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -1657,6 +1942,35 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.8.55"
@@ -1677,12 +1991,66 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "zmij"
 version = "1.0.23"

Android/rust/archy-fips-core/Cargo.toml

@@ -37,6 +37,35 @@ tracing = "0.1"
 # fcntl: force the VpnService TUN fd into blocking mode (see mesh::start).
 libc = "0.2"
 
+# ── Companion backup (#128) ───────────────────────────────────────────────
+# ADR-005 envelope: the SAME crates and blob layout as the node's backup code
+# (core/archipelago/src/backup/identity.rs) — Argon2id KDF + ChaCha20-Poly1305
+# AEAD — applied to the companion's own JSON payload. Do not diverge from
+# those parameters: a companion backup and a node backup must decrypt with
+# the same code path on either side.
+argon2 = "0.5"
+chacha20poly1305 = "0.10"
+base64 = "0.22"
+
+# ── NIP-46 remote signer (#139) ───────────────────────────────────────────
+# BIP340 schnorr signing + secp256k1 ECDH (NIP-44/NIP-04 conversation keys).
+# Audited libsecp256k1 via cc; cargo-ndk provides the NDK clang on Android.
+secp256k1 = "0.29"
+# NIP-44 v2: HKDF-SHA256 (conversation/message keys) + HMAC-SHA256 (MAC).
+sha2 = "0.10"
+hmac = "0.12"
+hkdf = "0.12"
+# NIP-44 v2 stream cipher (raw ChaCha20, RFC 8439 — NOT the AEAD).
+chacha20 = "0.9"
+# NIP-04 fallback (deprecated in the spec but still sent by real clients):
+# AES-256-CBC, key = raw ECDH x-coordinate.
+aes = "0.8"
+cbc = { version = "0.1", features = ["alloc"] }
+# npub/nsec (bech32, BIP173 variant — NOT Bech32m).
+bech32 = "0.11"
+# nostrconnect:// URI parsing (repeated relay params + percent-decoding).
+url = "2.5"
+
 # The JNI surface only exists on Android; host builds skip it and drive the
 # mesh module directly (tests).
 [target.'cfg(target_os = "android")'.dependencies]

Android/rust/archy-fips-core/src/backup.rs

@@ -0,0 +1,246 @@
+//! Companion app backup — the ADR-005 encrypted-backup envelope.
+//!
+//! Reuses the node's backup format exactly (ADR-005:
+//! `core/archipelago/src/backup/identity.rs`): Argon2id key derivation with
+//! default params, ChaCha20-Poly1305 AEAD, and the same blob layout
+//! `base64(salt[16] || nonce[12] || ciphertext)`. A companion backup and a
+//! node backup share one crypto story — the payload differs (the companion
+//! serializes its servers, FIPS identity and signer key instead of a node
+//! key), the envelope does not.
+//!
+//! The envelope is JSON with `version`, `kind`, `encrypted`, `blob` and
+//! `timestamp`; [`decrypt`] ignores any extra fields, so node envelopes
+//! (which carry `did`/`pubkey`/`kid`) decrypt here too.
+
+use anyhow::{bail, Context, Result};
+use argon2::Argon2;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
+use chacha20poly1305::aead::{Aead, KeyInit};
+use chacha20poly1305::{ChaCha20Poly1305, Key, Nonce};
+use serde_json::json;
+
+/// Envelope version. Bump only when the blob layout itself changes — and
+/// then only with a reader for the old layout (same policy as the node).
+const BACKUP_VERSION: u32 = 1;
+const SALT_LEN: usize = 16;
+const NONCE_LEN: usize = 12;
+const KEY_LEN: usize = 32;
+
+/// Encrypt a JSON payload into an ADR-005 envelope.
+///
+/// The passphrase never leaves this call; the envelope carries only the
+/// salt (Argon2id parameter), the AEAD nonce, and the ciphertext.
+pub fn encrypt(payload: &str, passphrase: &str) -> Result<String> {
+    if payload.is_empty() {
+        bail!("backup payload is empty");
+    }
+    if passphrase.is_empty() {
+        bail!("backup passphrase must not be empty");
+    }
+
+    let mut salt = [0u8; SALT_LEN];
+    let mut nonce = [0u8; NONCE_LEN];
+    // Same CSPRNG discipline as identity generation (getrandom, see mesh.rs):
+    // OS RNG, never thread-local or derived-from-content randomness for key
+    // material or nonces.
+    getrandom::getrandom(&mut salt).context("OS RNG")?;
+    getrandom::getrandom(&mut nonce).context("OS RNG")?;
+
+    let key = derive_key(passphrase, &salt)?;
+    let cipher = ChaCha20Poly1305::new(Key::from_slice(&key));
+    let ciphertext = cipher
+        .encrypt(Nonce::from_slice(&nonce), payload.as_bytes())
+        .map_err(|_| anyhow::anyhow!("encryption failed"))?;
+
+    let mut blob = Vec::with_capacity(SALT_LEN + NONCE_LEN + ciphertext.len());
+    blob.extend_from_slice(&salt);
+    blob.extend_from_slice(&nonce);
+    blob.extend_from_slice(&ciphertext);
+
+    Ok(json!({
+        "version": BACKUP_VERSION,
+        "kind": "companion",
+        "encrypted": true,
+        "blob": BASE64.encode(&blob),
+        "timestamp": chrono_like_now(),
+    })
+    .to_string())
+}
+
+/// Decrypt an ADR-005 envelope back into its JSON payload.
+///
+/// Accepts `version: 1` envelopes regardless of `kind` or extra fields —
+/// the node's identity backups use the same blob, and being able to decrypt
+/// one here is free interop (the caller decides what to do with it).
+pub fn decrypt(envelope: &str, passphrase: &str) -> Result<String> {
+    let obj: serde_json::Value =
+        serde_json::from_str(envelope).context("not a JSON backup envelope")?;
+
+    if obj.get("version").and_then(|v| v.as_u64()) != Some(BACKUP_VERSION as u64) {
+        bail!("unsupported backup version (expected {BACKUP_VERSION})");
+    }
+
+    let blob_b64 = obj
+        .get("blob")
+        .and_then(|v| v.as_str())
+        .context("missing 'blob' in backup envelope")?;
+    let blob = BASE64
+        .decode(blob_b64)
+        .context("invalid base64 in backup blob")?;
+    if blob.len() < SALT_LEN + NONCE_LEN {
+        bail!("backup blob too short");
+    }
+
+    let salt = &blob[..SALT_LEN];
+    let nonce = &blob[SALT_LEN..SALT_LEN + NONCE_LEN];
+    let ciphertext = &blob[SALT_LEN + NONCE_LEN..];
+
+    let key = derive_key(passphrase, salt)?;
+    let cipher = ChaCha20Poly1305::new(Key::from_slice(&key));
+    let plaintext = cipher
+        .decrypt(Nonce::from_slice(nonce), ciphertext)
+        .map_err(|_| anyhow::anyhow!("decryption failed — wrong passphrase or corrupted backup"))?;
+
+    String::from_utf8(plaintext).context("decrypted payload is not valid UTF-8")
+}
+
+fn derive_key(passphrase: &str, salt: &[u8]) -> Result<[u8; KEY_LEN]> {
+    let mut key = [0u8; KEY_LEN];
+    Argon2::default()
+        .hash_password_into(passphrase.as_bytes(), salt, &mut key)
+        .map_err(|e| anyhow::anyhow!("Argon2 key derivation failed: {e}"))?;
+    Ok(key)
+}
+
+/// RFC 3339 UTC timestamp without pulling chrono into the .so — the node's
+/// envelope field is informational (display), not part of the authenticated
+/// or derived material.
+fn chrono_like_now() -> String {
+    let secs = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let days = secs / 86_400;
+    let rem = secs % 86_400;
+    let (h, m, s) = (rem / 3600, (rem % 3600) / 60, rem % 60);
+    // Civil-from-days (Howard Hinnant's algorithm), valid for 1970-2100+.
+    let z = days as i64 + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z.rem_euclid(146_097);
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let y = yoe + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let mo = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = if mo <= 2 { y + 1 } else { y };
+    format!("{y:04}-{mo:02}-{d:02}T{h:02}:{m:02}:{s:02}Z")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PAYLOAD: &str = r#"{"app":"archipelago-companion","servers":["192.168.1.10|false|1301||Lab Node|fd00::1|npub1abc"]}"#;
+
+    #[test]
+    fn round_trip() {
+        let envelope = encrypt(PAYLOAD, "correct horse battery staple").unwrap();
+        let decrypted = decrypt(&envelope, "correct horse battery staple").unwrap();
+        assert_eq!(decrypted, PAYLOAD);
+    }
+
+    #[test]
+    fn wrong_passphrase_fails() {
+        let envelope = encrypt(PAYLOAD, "right").unwrap();
+        let err = decrypt(&envelope, "wrong").unwrap_err();
+        assert!(
+            err.to_string().contains("wrong passphrase"),
+            "error should name the likely cause: {err}"
+        );
+    }
+
+    #[test]
+    fn envelope_shape_matches_node_format() {
+        let envelope = encrypt(PAYLOAD, "pw").unwrap();
+        let obj: serde_json::Value = serde_json::from_str(&envelope).unwrap();
+
+        assert_eq!(obj["version"], 1);
+        assert_eq!(obj["encrypted"], true);
+        assert!(obj["kind"].as_str().is_some());
+        assert!(obj["timestamp"].as_str().is_some());
+
+        // Blob layout is exactly the node's: base64(salt||nonce||ct) with the
+        // AEAD tag inside the ciphertext — at least 16+12+16+1 bytes.
+        let blob = BASE64
+            .decode(obj["blob"].as_str().unwrap())
+            .expect("blob is base64");
+        assert!(blob.len() >= SALT_LEN + NONCE_LEN + 16 + PAYLOAD.len());
+    }
+
+    #[test]
+    fn fresh_salt_and_nonce_every_time() {
+        let a = encrypt(PAYLOAD, "pw").unwrap();
+        let b = encrypt(PAYLOAD, "pw").unwrap();
+        let (oa, ob): (serde_json::Value, serde_json::Value) = (
+            serde_json::from_str(&a).unwrap(),
+            serde_json::from_str(&b).unwrap(),
+        );
+        assert_ne!(oa["blob"], ob["blob"], "salt/nonce must never repeat");
+    }
+
+    #[test]
+    fn tampered_blob_fails_to_decrypt() {
+        let envelope = encrypt(PAYLOAD, "pw").unwrap();
+        let mut obj: serde_json::Value = serde_json::from_str(&envelope).unwrap();
+        let blob = BASE64.decode(obj["blob"].as_str().unwrap()).unwrap();
+        let mut tampered = blob.clone();
+        // Flip a bit inside the ciphertext (past salt+nonce).
+        tampered[SALT_LEN + NONCE_LEN] ^= 0x01;
+        obj["blob"] = serde_json::Value::String(BASE64.encode(&tampered));
+        assert!(decrypt(&obj.to_string(), "pw").is_err());
+    }
+
+    /// Node identity backups use the same blob layout but carry their own
+    /// envelope fields (did/pubkey/kid). Decrypt must ignore those extras —
+    /// one envelope reader, two producers.
+    #[test]
+    fn node_style_envelope_with_extra_fields_decrypts() {
+        let envelope = encrypt(PAYLOAD, "pw").unwrap();
+        let mut obj: serde_json::Value = serde_json::from_str(&envelope).unwrap();
+        obj["kind"] = serde_json::Value::String("node-identity".into());
+        obj["did"] = serde_json::Value::String("did:key:z6Mktest".into());
+        obj["pubkey"] = serde_json::Value::String("aabbcc".into());
+        obj["kid"] = serde_json::Value::String("did:key:z6Mktest#key-1".into());
+        let decrypted = decrypt(&obj.to_string(), "pw").unwrap();
+        assert_eq!(decrypted, PAYLOAD);
+    }
+
+    #[test]
+    fn rejects_unknown_version_and_garbage() {
+        let err = decrypt("{\"version\":99,\"blob\":\"AAAA\"}", "pw").unwrap_err();
+        assert!(err.to_string().contains("version"));
+        assert!(decrypt("not json", "pw").is_err());
+        assert!(decrypt("{\"version\":1}", "pw").is_err());
+    }
+
+    #[test]
+    fn rejects_empty_passphrase_and_payload() {
+        assert!(encrypt(PAYLOAD, "").is_err());
+        assert!(encrypt("", "pw").is_err());
+    }
+
+    #[test]
+    fn timestamp_is_rfc3339_utc() {
+        let envelope = encrypt(PAYLOAD, "pw").unwrap();
+        let obj: serde_json::Value = serde_json::from_str(&envelope).unwrap();
+        let ts = obj["timestamp"].as_str().unwrap();
+        // 2026-08-31T12:34:56Z — 20 chars, RFC 3339 UTC.
+        assert_eq!(ts.len(), 20);
+        assert!(ts.ends_with('Z'));
+        assert_eq!(&ts[4..5], "-");
+        assert_eq!(&ts[10..11], "T");
+        assert!(ts.starts_with("20"));
+    }
+}

Android/rust/archy-fips-core/src/jni_glue.rs

@@ -1,5 +1,6 @@
-//! JNI surface for `com.archipelago.app.fips.FipsNative` — JSON over strings,
-//! no codegen (the myco / nostr-vpn embedding pattern). Errors come back as
+//! JNI surface for `com.archipelago.app.fips.FipsNative` and
+//! `com.archipelago.app.NativeCore` — JSON over strings, no codegen (the
+//! myco / nostr-vpn embedding pattern). Errors come back as
 //! `{"error": "…"}` so Kotlin never sees a raw exception from native code.
 
 use std::sync::Once;
@@ -127,3 +128,177 @@ pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_statusJson(
 ) -> jstring {
     out(&env, mesh::status_json())
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// com.archipelago.app.NativeCore — companion backup (#128) and NIP-46 remote
+// signer crypto (#139). Same library, JSON-over-strings contract.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Kotlin: `external fun backupEncrypt(payload: String, passphrase: String): String`
+/// Returns the ADR-005 envelope JSON or `{"error": …}`.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_backupEncrypt(
+    mut env: JNIEnv,
+    _class: JClass,
+    payload: JString,
+    passphrase: JString,
+) -> jstring {
+    init_logging();
+    let payload = jstr(&mut env, &payload);
+    let passphrase = jstr(&mut env, &passphrase);
+    let json = match crate::backup::encrypt(&payload, &passphrase) {
+        Ok(envelope) => envelope,
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun backupDecrypt(envelope: String, passphrase: String): String`
+/// Returns the decrypted payload JSON or `{"error": …}`.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_backupDecrypt(
+    mut env: JNIEnv,
+    _class: JClass,
+    envelope: JString,
+    passphrase: JString,
+) -> jstring {
+    init_logging();
+    let envelope = jstr(&mut env, &envelope);
+    let passphrase = jstr(&mut env, &passphrase);
+    let json = match crate::backup::decrypt(&envelope, &passphrase) {
+        Ok(payload) => payload,
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun nostrGenerateSecret(): String`
+/// Returns `{"secret": hex, "pubkey": hex, "npub": …, "nsec": …}` or `{"error": …}`.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_nostrGenerateSecret(
+    env: JNIEnv,
+    _class: JClass,
+) -> jstring {
+    init_logging();
+    let json = match crate::nostr::generate_secret() {
+        Ok(secret) => nostr_key_info_json(&secret),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun nostrSecretFromAny(secret: String): String`
+/// Accepts hex or `nsec…`; returns key-info JSON or `{"error": …}`.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_nostrSecretFromAny(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret: JString,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret);
+    let json = match crate::nostr::secret_from_any(&secret) {
+        Ok(hex) => nostr_key_info_json(&hex),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+fn nostr_key_info_json(secret_hex: &str) -> String {
+    match (
+        crate::nostr::pubkey_hex(secret_hex),
+        crate::nostr::npub_from_pubkey(&crate::nostr::pubkey_hex(secret_hex).unwrap_or_default()),
+        crate::nostr::nsec_from_secret(secret_hex),
+    ) {
+        (Ok(pubkey), Ok(npub), Ok(nsec)) => serde_json::json!({
+            "secret": secret_hex,
+            "pubkey": pubkey,
+            "npub": npub,
+            "nsec": nsec,
+        })
+        .to_string(),
+        (e, _, _) => err_json(e.unwrap_err()),
+    }
+}
+
+/// Kotlin: `external fun nostrParseConnectUri(uri: String): String`
+/// Returns the parsed URI fields or `{"error": …}`.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_nostrParseConnectUri(
+    mut env: JNIEnv,
+    _class: JClass,
+    uri: JString,
+) -> jstring {
+    init_logging();
+    let uri = jstr(&mut env, &uri);
+    let json = match crate::nostr::parse_connect_uri(&uri) {
+        Ok(info) => info.to_json().to_string(),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun nostrSignEvent(secretHex: String, eventJson: String): String`
+/// Returns the signed event JSON or `{"error": …}`. The approve/deny decision
+/// is made in Kotlin BEFORE this is called — native code never signs unasked.
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_NativeCore_nostrSignEvent(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret_hex: JString,
+    event_json: JString,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret_hex);
+    let event = jstr(&mut env, &event_json);
+    let json = match crate::nostr::sign_event(&secret, &event) {
+        Ok(signed) => signed,
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+macro_rules! nostr_cipher {
+    ($name:ident, $doc:literal, $fn:path) => {
+        #[doc = $doc]
+        #[no_mangle]
+        pub extern "system" fn $name(
+            mut env: JNIEnv,
+            _class: JClass,
+            secret_hex: JString,
+            peer_pub: JString,
+            text: JString,
+        ) -> jstring {
+            init_logging();
+            let secret = jstr(&mut env, &secret_hex);
+            let peer = jstr(&mut env, &peer_pub);
+            let text = jstr(&mut env, &text);
+            let json = match $fn(&secret, &peer, &text) {
+                Ok(out) => serde_json::json!({ "result": out }).to_string(),
+                Err(e) => err_json(e),
+            };
+            out(&env, json)
+        }
+    };
+}
+
+nostr_cipher!(
+    Java_com_archipelago_app_NativeCore_nostrNip44Encrypt,
+    "Kotlin: `external fun nostrNip44Encrypt(secretHex: String, peerPub: String, plaintext: String): String` — returns `{\"result\": payload}` or `{\"error\": …}`.",
+    crate::nostr::nip44_encrypt
+);
+nostr_cipher!(
+    Java_com_archipelago_app_NativeCore_nostrNip44Decrypt,
+    "Kotlin: `external fun nostrNip44Decrypt(secretHex: String, peerPub: String, payload: String): String`",
+    crate::nostr::nip44_decrypt
+);
+nostr_cipher!(
+    Java_com_archipelago_app_NativeCore_nostrNip04Encrypt,
+    "Kotlin: `external fun nostrNip04Encrypt(secretHex: String, peerPub: String, plaintext: String): String`",
+    crate::nostr::nip04_encrypt
+);
+nostr_cipher!(
+    Java_com_archipelago_app_NativeCore_nostrNip04Decrypt,
+    "Kotlin: `external fun nostrNip04Decrypt(secretHex: String, peerPub: String, payload: String): String`",
+    crate::nostr::nip04_decrypt
+);

Android/rust/archy-fips-core/src/lib.rs

@@ -11,7 +11,9 @@
 //! JSON-over-strings, mirroring the myco / nostr-vpn embedding pattern:
 //! `generateIdentity`, `deriveIdentity`, `start`, `stop`, `isRunning`.
 
+pub mod backup;
 pub mod mesh;
+pub mod nostr;
 
 #[cfg(target_os = "android")]
 mod jni_glue;

Android/rust/archy-fips-core/src/nostr.rs

@@ -0,0 +1,824 @@
+//! NIP-46 phone-side remote signer ("bunker") crypto core.
+//!
+//! Everything that must be constant-time correct for the companion to act as
+//! a nostr remote signer: key handling (nsec/npub bech32), BIP340 schnorr
+//! event signing, NIP-44 v2 payload encryption (the mandated NIP-46
+//! transport), NIP-04 fallback decryption (deprecated, but real clients
+//! still speak it), and `nostrconnect://` URI parsing. The protocol session
+//! — relay WebSocket, JSON-RPC dispatch, approve/deny UX — lives in Kotlin;
+//! this module is the crypto and nothing but.
+//!
+//! Verified against the official NIP-44 vectors and BIP-340 reference
+//! vectors (see tests below).
+
+use anyhow::{bail, Context, Result};
+use base64::engine::general_purpose::{STANDARD as BASE64, URL_SAFE as BASE64_URL};
+use base64::Engine;
+use bech32::{Bech32, Hrp};
+use chacha20::cipher::{KeyIvInit, StreamCipher};
+use chacha20::ChaCha20;
+use hmac::{Hmac, Mac};
+use hkdf::Hkdf;
+use secp256k1::ecdh;
+use secp256k1::schnorr::Signature;
+use secp256k1::{
+    Keypair, Message, PublicKey, Secp256k1, SecretKey, XOnlyPublicKey,
+};
+use sha2::{Digest, Sha256};
+
+type HmacSha256 = Hmac<Sha256>;
+
+const NIP44_VERSION: u8 = 2;
+const NIP44_SALT: &[u8] = b"nip44-v2";
+const NIP44_MIN_PAYLOAD_LEN: usize = 99; // 1 ver + 32 nonce + 32 ct + 32 mac
+const NIP44_MIN_B64_LEN: usize = 132;
+
+// ── keys ──────────────────────────────────────────────────────────────────
+
+/// Generate a fresh nostr secret key (hex) from the OS CSPRNG.
+pub fn generate_secret() -> Result<String> {
+    loop {
+        let mut bytes = [0u8; 32];
+        getrandom::getrandom(&mut bytes).context("OS RNG")?;
+        // Reject zero and >= curve order — the valid scalar range (mirrors
+        // the mesh identity loop; rejection is astronomically unlikely).
+        if bytes.iter().all(|&b| b == 0) {
+            continue;
+        }
+        if SecretKey::from_slice(&bytes).is_ok() {
+            return Ok(hex::encode(bytes));
+        }
+    }
+}
+
+/// Parse a secret key from hex or bech32 `nsec…` form into hex.
+pub fn secret_from_any(s: &str) -> Result<String> {
+    let s = s.trim();
+    if s.starts_with("nsec") {
+        return secret_from_nsec(s);
+    }
+    let bytes = hex::decode(s.trim()).context("secret key must be hex or nsec")?;
+    let sk = SecretKey::from_slice(&bytes).context("invalid nostr secret key")?;
+    Ok(hex::encode(sk.secret_bytes()))
+}
+
+pub fn secret_from_nsec(nsec: &str) -> Result<String> {
+    let (hrp, data) = bech32::decode(nsec).context("bad nsec encoding")?;
+    if hrp.as_str() != "nsec" {
+        bail!("not an nsec");
+    }
+    let sk = SecretKey::from_slice(&data).context("invalid nostr secret key")?;
+    Ok(hex::encode(sk.secret_bytes()))
+}
+
+pub fn nsec_from_secret(secret_hex: &str) -> Result<String> {
+    let bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
+    let hrp = Hrp::parse("nsec").context("nsec hrp")?;
+    bech32::encode::<Bech32>(hrp, &bytes).context("nsec encoding")
+}
+
+/// x-only public key (hex) for a secret key.
+/// NOTE: `Keypair::public_key()` in secp256k1 0.29 is the full compressed
+/// (33-byte) key — nostr uses x-only pubkeys, so serialize `.x_only_public_key().0`.
+pub fn pubkey_hex(secret_hex: &str) -> Result<String> {
+    let kp = keypair(secret_hex)?;
+    Ok(hex::encode(kp.public_key().x_only_public_key().0.serialize()))
+}
+
+pub fn npub_from_pubkey(pub_hex: &str) -> Result<String> {
+    let bytes = hex::decode(pub_hex.trim()).context("bad pubkey hex")?;
+    let hrp = Hrp::parse("npub").context("npub hrp")?;
+    bech32::encode::<Bech32>(hrp, &bytes).context("npub encoding")
+}
+
+/// Parse an x-only pubkey from hex or bech32 `npub…` form into hex.
+pub fn pubkey_from_any(s: &str) -> Result<String> {
+    let s = s.trim();
+    let bytes = if s.starts_with("npub") {
+        let (hrp, data) = bech32::decode(s).context("bad npub encoding")?;
+        if hrp.as_str() != "npub" {
+            bail!("not an npub");
+        }
+        data
+    } else {
+        hex::decode(s).context("pubkey must be hex or npub")?
+    };
+    XOnlyPublicKey::from_slice(&bytes).context("invalid x-only pubkey")?;
+    Ok(hex::encode(bytes))
+}
+
+fn keypair(secret_hex: &str) -> Result<Keypair> {
+    let bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
+    let sk = SecretKey::from_slice(&bytes).context("invalid nostr secret key")?;
+    Ok(Keypair::from_secret_key(&Secp256k1::new(), &sk))
+}
+
+// ── nostrconnect:// URI ───────────────────────────────────────────────────
+
+#[derive(Debug, Clone)]
+pub struct ConnectUri {
+    /// The client's pubkey, hex.
+    pub client_pubkey: String,
+    /// Relays the client is listening on (≥1 by spec; kept in URI order).
+    pub relays: Vec<String>,
+    /// One-time pairing secret the client expects to see echoed back.
+    pub secret: String,
+    /// Comma-separated permission grants the client requests (display hint
+    /// only — approval always stays with the human).
+    pub perms: Vec<String>,
+    pub name: String,
+    pub url: String,
+    pub image: String,
+}
+
+impl ConnectUri {
+    /// JSON shape for the JNI boundary (flat strings/arrays — easy to parse
+    /// with org.json on the Kotlin side).
+    pub fn to_json(&self) -> serde_json::Value {
+        serde_json::json!({
+            "clientPubkey": self.client_pubkey,
+            "relays": self.relays,
+            "secret": self.secret,
+            "perms": self.perms,
+            "name": self.name,
+            "url": self.url,
+            "image": self.image,
+        })
+    }
+}
+
+/// Parse `nostrconnect://<client-pubkey>?relay=…&secret=…&perms=…&name=…`.
+///
+/// Query values are percent-decoded; `relay` may repeat. The pubkey in the
+/// host position may be hex or (non-spec but harmless) `npub…`.
+pub fn parse_connect_uri(uri: &str) -> Result<ConnectUri> {
+    let uri = uri.trim();
+    let rest = uri
+        .strip_prefix("nostrconnect://")
+        .ok_or_else(|| anyhow::anyhow!("not a nostrconnect:// URI"))?;
+
+    let (host, query) = match rest.split_once('?') {
+        Some((h, q)) => (h, q),
+        None => bail!("nostrconnect URI has no query parameters"),
+    };
+    let client_pubkey = pubkey_from_any(host).context("nostrconnect URI: bad client pubkey")?;
+
+    let mut relays = Vec::new();
+    let mut secret = String::new();
+    let mut perms: Vec<String> = Vec::new();
+    let mut name = String::new();
+    let mut url = String::new();
+    let mut image = String::new();
+
+    for (k, v) in url::form_urlencoded::parse(query.as_bytes()) {
+        let v = v.into_owned();
+        match k.as_ref() {
+            "relay" => {
+                if v.starts_with("ws://") || v.starts_with("wss://") {
+                    relays.push(v);
+                }
+            }
+            "secret" => secret = v,
+            "perms" => perms = v.split(',').filter(|s| !s.is_empty()).map(String::from).collect(),
+            "name" => name = v,
+            "url" => url = v,
+            "image" => image = v,
+            _ => {} // forward-compat: ignore unknown params
+        }
+    }
+
+    if relays.is_empty() {
+        bail!("nostrconnect URI carries no relay");
+    }
+    if secret.is_empty() {
+        bail!("nostrconnect URI carries no secret");
+    }
+
+    Ok(ConnectUri {
+        client_pubkey,
+        relays,
+        secret,
+        perms,
+        name,
+        url,
+        image,
+    })
+}
+
+// ── events (NIP-01 id + BIP340 signature) ─────────────────────────────────
+
+/// Compute the NIP-01 event id: sha256 over the compact serialization
+/// `[0, pubkey, created_at, kind, tags, content]`.
+fn event_id(pubkey: &str, created_at: u64, kind: u64, tags: &serde_json::Value, content: &str) -> [u8; 32] {
+    let serialized = serde_json::json!([
+        0,
+        pubkey,
+        created_at,
+        kind,
+        tags,
+        content,
+    ]);
+    let mut hasher = Sha256::new();
+    hasher.update(serialized.to_string().as_bytes());
+    hasher.finalize().into()
+}
+
+/// Sign an unsigned event `{kind, content, tags, created_at}` (pubkey filled
+/// from the secret key; `pubkey` in the input ignored) and return the signed
+/// event JSON. This is the `sign_event` NIP-46 method's core — the approve
+/// happens before this call, never inside it.
+pub fn sign_event(secret_hex: &str, event_json: &str) -> Result<String> {
+    let ev: serde_json::Value = serde_json::from_str(event_json).context("event is not JSON")?;
+    let kind = ev
+        .get("kind")
+        .and_then(|v| v.as_u64())
+        .context("event has no kind")?;
+    let created_at = ev
+        .get("created_at")
+        .and_then(|v| v.as_u64())
+        .context("event has no created_at")?;
+    let tags = ev
+        .get("tags")
+        .cloned()
+        .unwrap_or_else(|| serde_json::json!([]));
+    let content = ev
+        .get("content")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+
+    let kp = keypair(secret_hex)?;
+    let pubkey = hex::encode(kp.public_key().x_only_public_key().0.serialize());
+    let id = event_id(&pubkey, created_at, kind, &tags, &content);
+
+    let mut aux = [0u8; 32];
+    getrandom::getrandom(&mut aux).context("OS RNG")?;
+    let sig = Secp256k1::new().sign_schnorr_with_aux_rand(
+        &Message::from_digest(id),
+        &kp,
+        &aux,
+    );
+
+    Ok(serde_json::json!({
+        "id": hex::encode(id),
+        "pubkey": pubkey,
+        "created_at": created_at,
+        "kind": kind,
+        "tags": tags,
+        "content": content,
+        "sig": hex::encode(sig.serialize()),
+    })
+    .to_string())
+}
+
+/// Verify a signed event's id and schnorr signature (tests + defensive use).
+pub fn verify_event(event_json: &str) -> Result<()> {
+    let ev: serde_json::Value = serde_json::from_str(event_json).context("event is not JSON")?;
+    let pubkey = ev.get("pubkey").and_then(|v| v.as_str()).context("no pubkey")?;
+    let id_hex = ev.get("id").and_then(|v| v.as_str()).context("no id")?;
+    let sig_hex = ev.get("sig").and_then(|v| v.as_str()).context("no sig")?;
+    let kind = ev.get("kind").and_then(|v| v.as_u64()).context("no kind")?;
+    let created_at = ev.get("created_at").and_then(|v| v.as_u64()).context("no created_at")?;
+    let tags = ev.get("tags").cloned().unwrap_or_else(|| serde_json::json!([]));
+    let content = ev.get("content").and_then(|v| v.as_str()).unwrap_or("");
+
+    let expected = event_id(pubkey, created_at, kind, &tags, content);
+    if hex::encode(expected) != id_hex {
+        bail!("event id mismatch");
+    }
+
+    let pk = XOnlyPublicKey::from_slice(&hex::decode(pubkey)?)
+        .context("bad pubkey")?;
+    let sig = Signature::from_slice(&hex::decode(sig_hex)?)
+        .context("bad signature")?;
+    Secp256k1::new()
+        .verify_schnorr(&sig, &Message::from_digest(expected), &pk)
+        .context("signature verification failed")?;
+    Ok(())
+}
+
+// ── NIP-44 v2 ──────────────────────────────────────────────────────────────
+
+/// ECDH shared x-coordinate (unhashed, 32 bytes) between our secret key and
+/// the peer's x-only public key. Lifting the x-only key with even-y parity
+/// is safe here: negating a point flips only y, so the shared x — the only
+/// thing NIP-44/NIP-04 consume — is unchanged.
+fn shared_x(secret_hex: &str, peer_pubkey_hex: &str) -> Result<[u8; 32]> {
+    let sk_bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
+    let sk = SecretKey::from_slice(&sk_bytes).context("invalid secret key")?;
+    let peer_hex = pubkey_from_any(peer_pubkey_hex)?;
+    let peer = XOnlyPublicKey::from_slice(&hex::decode(&peer_hex)?)
+        .context("invalid peer pubkey")?;
+    // Lift x-only key to a full public key (even-y representative).
+    let full = PublicKey::from_x_only_public_key(peer, secp256k1::Parity::Even);
+    let point = ecdh::shared_secret_point(&full, &sk); // 64 bytes: x || y
+    let mut x = [0u8; 32];
+    x.copy_from_slice(&point[..32]);
+    Ok(x)
+}
+
+/// NIP-44 v2 conversation key: HKDF-extract(IKM = ECDH x, salt = 'nip44-v2').
+fn conversation_key(secret_hex: &str, peer_pubkey_hex: &str) -> Result<[u8; 32]> {
+    let x = shared_x(secret_hex, peer_pubkey_hex)?;
+    let mut hk = HkdfExtractSha256::new(Some(NIP44_SALT));
+    hk.input_ikm(&x);
+    let (prk, _) = hk.finalize();
+    let mut ck = [0u8; 32];
+    ck.copy_from_slice(prk.as_slice());
+    Ok(ck)
+}
+
+/// HKDF-SHA256 extract step, exposing the raw PRK (Hkdf::expand hashes with
+/// an info suffix even when info is empty, which is NOT the extract output;
+/// finalize returns (PRK, ready-to-expand Hkdf)).
+type HkdfExtractSha256 = hkdf::HkdfExtract<Sha256>;
+
+/// Per-message keys: HKDF-expand(PRK = conversation key, info = nonce, L = 76)
+/// sliced into chacha_key[32] chacha_nonce[12] hmac_key[32].
+fn message_keys(ck: &[u8; 32], nonce: &[u8; 32]) -> ([u8; 32], [u8; 12], [u8; 32]) {
+    let hk = Hkdf::<Sha256>::from_prk(ck).expect("conversation key is 32 bytes");
+    let mut okm = [0u8; 76];
+    hk.expand(nonce, &mut okm).expect("76 <= 255 * hash len");
+    let mut chacha_key = [0u8; 32];
+    let mut chacha_nonce = [0u8; 12];
+    let mut hmac_key = [0u8; 32];
+    chacha_key.copy_from_slice(&okm[..32]);
+    chacha_nonce.copy_from_slice(&okm[32..44]);
+    hmac_key.copy_from_slice(&okm[44..76]);
+    (chacha_key, chacha_nonce, hmac_key)
+}
+
+/// NIP-44 padding: 2-byte big-endian plaintext length (6 bytes, `0x0000` +
+/// u32, when ≥ 65536), zero-padded to the next power-of-two-ish chunk.
+fn calc_padded_len(unpadded: usize) -> usize {
+    let unpadded: u64 = unpadded as u64;
+    if unpadded <= 32 {
+        return 32;
+    }
+    let next_power = 1u64 << ((63 - (unpadded - 1).leading_zeros()) + 1);
+    let chunk = if next_power <= 256 { 32 } else { next_power / 8 };
+    (chunk * ((unpadded - 1) / chunk + 1)) as usize
+}
+
+fn pad(plaintext: &[u8]) -> Result<Vec<u8>> {
+    if plaintext.is_empty() || plaintext.len() > u32::MAX as usize {
+        bail!("invalid plaintext length");
+    }
+    let prefix: Vec<u8> = if plaintext.len() >= 65536 {
+        let mut p = vec![0u8, 0u8];
+        p.extend_from_slice(&(plaintext.len() as u32).to_be_bytes());
+        p
+    } else {
+        (plaintext.len() as u16).to_be_bytes().to_vec()
+    };
+    let padded_len = calc_padded_len(plaintext.len());
+    let mut out = Vec::with_capacity(prefix.len() + padded_len);
+    out.extend_from_slice(&prefix);
+    out.extend_from_slice(plaintext);
+    out.resize(prefix.len() + padded_len, 0);
+    Ok(out)
+}
+
+fn unpad(padded: &[u8]) -> Result<Vec<u8>> {
+    if padded.len() < 2 {
+        bail!("invalid padding");
+    }
+    let first_two = u16::from_be_bytes([padded[0], padded[1]]);
+    let (unpadded_len, prefix_len) = if first_two == 0 {
+        if padded.len() < 6 {
+            bail!("invalid padding");
+        }
+        (u32::from_be_bytes([padded[2], padded[3], padded[4], padded[5]]) as usize, 6)
+    } else {
+        (first_two as usize, 2)
+    };
+    if unpadded_len == 0
+        || padded.len() < prefix_len + unpadded_len
+        || padded.len() != prefix_len + calc_padded_len(unpadded_len)
+    {
+        bail!("invalid padding");
+    }
+    Ok(padded[prefix_len..prefix_len + unpadded_len].to_vec())
+}
+
+/// Constant-time equality (length differs → false; content comparison never
+/// short-circuits on a byte).
+fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+/// NIP-44 v2 encrypt: returns `base64(0x02 || nonce || ciphertext || mac)`.
+pub fn nip44_encrypt(secret_hex: &str, peer_pubkey_hex: &str, plaintext: &str) -> Result<String> {
+    let ck = conversation_key(secret_hex, peer_pubkey_hex)?;
+    let mut nonce = [0u8; 32];
+    getrandom::getrandom(&mut nonce).context("OS RNG")?;
+    let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
+
+    let mut padded = pad(plaintext.as_bytes())?;
+    ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut padded);
+
+    let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).expect("hmac accepts any key len");
+    mac.update(&nonce);
+    mac.update(&padded);
+    let tag = mac.finalize().into_bytes();
+
+    let mut out = Vec::with_capacity(1 + 32 + padded.len() + 32);
+    out.push(NIP44_VERSION);
+    out.extend_from_slice(&nonce);
+    out.extend_from_slice(&padded);
+    out.extend_from_slice(&tag);
+    Ok(BASE64.encode(&out))
+}
+
+/// NIP-44 v2 decrypt of a `base64(0x02 || …)` payload.
+pub fn nip44_decrypt(secret_hex: &str, peer_pubkey_hex: &str, payload: &str) -> Result<String> {
+    if payload.starts_with('#') {
+        bail!("unknown NIP-44 version (non-base64 payload)");
+    }
+    let data = BASE64
+        .decode(payload.trim())
+        .context("payload is not base64")?;
+    if payload.len() < NIP44_MIN_B64_LEN || data.len() < NIP44_MIN_PAYLOAD_LEN {
+        bail!("invalid NIP-44 payload size");
+    }
+    if data[0] != NIP44_VERSION {
+        bail!("unknown NIP-44 version {}", data[0]);
+    }
+    let nonce: [u8; 32] = data[1..33].try_into().expect("slice is 32");
+    let ciphertext = &data[33..data.len() - 32];
+    let mac_bytes = &data[data.len() - 32..];
+
+    let ck = conversation_key(secret_hex, peer_pubkey_hex)?;
+    let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
+
+    let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).expect("hmac accepts any key len");
+    mac.update(&nonce);
+    mac.update(ciphertext);
+    let expected = mac.finalize().into_bytes();
+    if !ct_eq(&expected, mac_bytes) {
+        bail!("invalid NIP-44 MAC");
+    }
+
+    let mut buf = ciphertext.to_vec();
+    ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut buf);
+    let plaintext = unpad(&buf)?;
+    String::from_utf8(plaintext).context("decrypted payload is not UTF-8")
+}
+
+// ── NIP-04 (deprecated transport, still spoken by real clients) ────────────
+
+/// NIP-04 encrypt: AES-256-CBC, key = raw ECDH x-coordinate (unhashed — the
+/// spec's quirk), output `<base64 ct>?iv=<base64 iv>`.
+pub fn nip04_encrypt(secret_hex: &str, peer_pubkey_hex: &str, plaintext: &str) -> Result<String> {
+    use aes::cipher::{BlockEncryptMut, KeyIvInit};
+    type Enc = cbc::Encryptor<aes::Aes256>;
+
+    let key = shared_x(secret_hex, peer_pubkey_hex)?;
+    let mut iv = [0u8; 16];
+    getrandom::getrandom(&mut iv).context("OS RNG")?;
+    let ct = Enc::new(&key.into(), &iv.into()).encrypt_padded_vec_mut::<aes::cipher::block_padding::Pkcs7>(plaintext.as_bytes());
+    Ok(format!("{}?iv={}", BASE64.encode(&ct), BASE64.encode(iv)))
+}
+
+/// NIP-04 decrypt of `<base64 ct>?iv=<base64 iv>`.
+pub fn nip04_decrypt(secret_hex: &str, peer_pubkey_hex: &str, payload: &str) -> Result<String> {
+    use aes::cipher::{BlockDecryptMut, KeyIvInit};
+    type Dec = cbc::Decryptor<aes::Aes256>;
+
+    let (ct_b64, iv_b64) = payload
+        .trim()
+        .split_once("?iv=")
+        .ok_or_else(|| anyhow::anyhow!("not a NIP-04 payload (no iv)"))?;
+    let ct = BASE64.decode(ct_b64).context("bad NIP-04 ciphertext base64")?;
+    let iv: [u8; 16] = BASE64
+        .decode(iv_b64)
+        .context("bad NIP-04 iv base64")?
+        .try_into()
+        .map_err(|_| anyhow::anyhow!("NIP-04 iv must be 16 bytes"))?;
+    let key = shared_x(secret_hex, peer_pubkey_hex)?;
+    let pt = Dec::new(&key.into(), &iv.into())
+        .decrypt_padded_vec_mut::<aes::cipher::block_padding::Pkcs7>(&ct)
+        .map_err(|_| anyhow::anyhow!("NIP-04 decryption failed"))?;
+    String::from_utf8(pt).context("decrypted payload is not UTF-8")
+}
+
+/// URL-safe base64 for keys that cross the JNI boundary — unused by the
+/// protocol but handy for the Kotlin side; keep the engine in one place.
+pub fn b64_url(data: &[u8]) -> String {
+    BASE64_URL.encode(data)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // ── official NIP-44 vectors (paulmillr/nip44 nip44.vectors.json) ──────
+
+    #[test]
+    fn nip44_official_conversation_keys() {
+        let vectors: &[(&str, &str, &str)] = &[
+            ("315e59ff51cb9209768cf7da80791ddcaae56ac9775eb25b6dee1234bc5d2268", "c2f9d9948dc8c7c38321e4b85c8558872eafa0641cd269db76848a6073e69133", "3dfef0ce2a4d80a25e7a328accf73448ef67096f65f79588e358d9a0eb9013f1"),
+            ("98a5902fd67518a0c900f0fb62158f278f94a21d6f9d33d30cd3091195500311", "aae65c15f98e5e677b5050de82e3aba47a6fe49b3dab7863cf35d9478ba9f7d1", "9c00b769d5f54d02bf175b7284a1cbd28b6911b06cda6666b2243561ac96bad7"),
+            ("86ae5ac8034eb2542ce23ec2f84375655dab7f836836bbd3c54cefe9fdc9c19f", "59f90272378089d73f1339710c02e2be6db584e9cdbe86eed3578f0c67c23585", "19f934aafd3324e8415299b64df42049afaa051c71c98d0aa10e1081f2e3e2ba"),
+            // sec1 == pub2 (ECDH with self)
+            ("0000000000000000000000000000000000000000000000000000000000000001", "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798", "3b4610cb7189beb9cc29eb3716ecc6102f1247e8f3101a03a1787d8908aeb54e"),
+        ];
+        for (sec1, pub2, expected) in vectors {
+            let ck = conversation_key(sec1, pub2).unwrap();
+            assert_eq!(hex::encode(ck), *expected);
+        }
+    }
+
+    #[test]
+    fn nip44_official_message_keys() {
+        let ck_bytes: [u8; 32] = hex::decode("a1a3d60f3470a8612633924e91febf96dc5366ce130f658b1f0fc652c20b3b54")
+            .unwrap()
+            .try_into()
+            .unwrap();
+        let vectors: &[(&str, &str, &str, &str)] = &[
+            ("e1e6f880560d6d149ed83dcc7e5861ee62a5ee051f7fde9975fe5d25d2a02d72", "f145f3bed47cb70dbeaac07f3a3fe683e822b3715edb7c4fe310829014ce7d76", "c4ad129bb01180c0933a160c", "027c1db445f05e2eee864a0975b0ddef5b7110583c8c192de3732571ca5838c4"),
+            ("ea6eb84cac23c5c1607c334e8bdf66f7977a7e374052327ec28c6906cbe25967", "ff68db24b34fa62c78ac5ffeeaf19533afaedf651fb6a08384e46787f6ce94be", "50bb859aa2dde938cc49ec7a", "06ff32e1f7b29753a727d7927b25c2dd175aca47751462d37a2039023ec6b5a6"),
+        ];
+        for (nonce_h, ck_exp, cn_exp, hk_exp) in vectors {
+            let nonce: [u8; 32] = hex::decode(nonce_h).unwrap().try_into().unwrap();
+            let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck_bytes, &nonce);
+            assert_eq!(hex::encode(chacha_key), *ck_exp);
+            assert_eq!(hex::encode(chacha_nonce), *cn_exp);
+            assert_eq!(hex::encode(hmac_key), *hk_exp);
+        }
+    }
+
+    #[test]
+    fn nip44_offical_padded_len() {
+        let vectors: &[(usize, usize)] = &[
+            (16, 32), (32, 32), (33, 64), (37, 64), (45, 64), (49, 64), (64, 64),
+            (65, 96), (100, 128), (111, 128), (200, 224), (250, 256), (320, 320),
+            (383, 384), (384, 384), (400, 448), (500, 512), (512, 512), (515, 640),
+            (700, 768), (800, 896), (900, 1024), (1020, 1024), (65536, 65536),
+        ];
+        for (unpadded, padded) in vectors {
+            assert_eq!(calc_padded_len(*unpadded), *padded, "unpadded {unpadded}");
+        }
+    }
+
+    #[test]
+    fn nip44_official_encrypt_vectors() {
+        // (sec1, sec2, nonce, plaintext, payload) — decrypt with the peer's
+        // view (sec2, pub(sec1)) so this also proves key symmetry.
+        let vectors: &[(&str, &str, &str, &str, &str)] = &[
+            ("0000000000000000000000000000000000000000000000000000000000000001",
+             "0000000000000000000000000000000000000000000000000000000000000002",
+             "0000000000000000000000000000000000000000000000000000000000000001",
+             "a",
+             "AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABee0G5VSK0/9YypIObAtDKfYEAjD35uVkHyB0F4DwrcNaCXlCWZKaArsGrY6M9wnuTMxWfp1RTN9Xga8no+kF5Vsb"),
+            ("0000000000000000000000000000000000000000000000000000000000000002",
+             "0000000000000000000000000000000000000000000000000000000000000001",
+             "f00000000000000000000000000000f00000000000000000000000000000000f",
+             "🍕🫃",
+             "AvAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAPSKSK6is9ngkX2+cSq85Th16oRTISAOfhStnixqZziKMDvB0QQzgFZdjLTPicCJaV8nDITO+QfaQ61+KbWQIOO2Yj"),
+            ("5c0c523f52a5b6fad39ed2403092df8cebc36318b39383bca6c00808626fab3a",
+             "4b22aa260e4acb7021e32f38a6cdf4b673c6a277755bfce287e370c924dc936d",
+             "b635236c42db20f021bb8d1cdff5ca75dd1a0cc72ea742ad750f33010b24f73b",
+             "表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀",
+             "ArY1I2xC2yDwIbuNHN/1ynXdGgzHLqdCrXUPMwELJPc7s7JqlCMJBAIIjfkpHReBPXeoMCyuClwgbT419jUWU1PwaNl4FEQYKCDKVJz+97Mp3K+Q2YGa77B6gpxB/lr1QgoqpDf7wDVrDmOqGoiPjWDqy8KzLueKDcm9BVP8xeTJIxs="),
+            ("eba1687cab6a3101bfc68fd70f214aa4cc059e9ec1b79fdb9ad0a0a4e259829f",
+             "dff20d262bef9dfd94666548f556393085e6ea421c8af86e9d333fa8747e94b3",
+             "2180b52ae645fcf9f5080d81b1f0b5d6f2cd77ff3c986882bb549158462f3407",
+             "( ͡° ͜ʖ ͡°)",
+             "AiGAtSrmRfz59QgNgbHwtdbyzXf/PJhogrtUkVhGLzQHv4qhKQwnFQ54OjVMgqCea/Vj0YqBSdhqNR777TJ4zIUk7R0fnizp6l1zwgzWv7+ee6u+0/89KIjY5q1wu6inyuiv"),
+            ("d5633530f5bcfebceb5584cfbbf718a30df0751b729dd9a789b9f30c0587d74e",
+             "b74e6a341fb134127272b795a08b59250e5fa45a82a2eb4095e4ce9ed5f5e214",
+             "a3e219242d85465e70adcd640b564b3feff57d2ef8745d5e7a0663b2dccceb54",
+             "🙈 🙉 🙊 0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗",
+             "AqPiGSQthUZecK3NZAtWSz/v9X0u+HRdXnoGY7LczOtUf05aMF89q1FLwJvaFJYICZoMYgRJHFLwPiOHce7fuAc40kX0wXJvipyBJ9HzCOj7CgtnC1/cmPCHR3s5AIORmroBWglm1LiFMohv1FSPEbaBD51VXxJa4JyWpYhreSOEjn1wd0lMKC9b+osV2N2tpbs+rbpQem2tRen3sWflmCqjkG5VOVwRErCuXuPb5+hYwd8BoZbfCrsiAVLd7YT44dRtKNBx6rkabWfddKSLtreHLDysOhQUVOp/XkE7OzSkWl6sky0Hva6qJJ/V726hMlomvcLHjE41iKmW2CpcZfOedg=="),
+        ];
+        for (sec1, sec2, nonce_hex, plaintext, payload) in vectors {
+            // Encrypt from A to B with the fixed nonce must reproduce the
+            // official payload byte-for-byte.
+            let pub1 = pubkey_hex(sec1).unwrap();
+            let made = {
+                let ck = conversation_key(sec1, &pubkey_hex(sec2).unwrap()).unwrap();
+                let nonce: [u8; 32] = hex::decode(nonce_hex).unwrap().try_into().unwrap();
+                let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
+                let mut padded = pad(plaintext.as_bytes()).unwrap();
+                ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut padded);
+                let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).unwrap();
+                mac.update(&nonce);
+                mac.update(&padded);
+                let tag = mac.finalize().into_bytes();
+                let mut out = vec![NIP44_VERSION];
+                out.extend_from_slice(&nonce);
+                out.extend_from_slice(&padded);
+                out.extend_from_slice(&tag);
+                BASE64.encode(&out)
+            };
+            assert_eq!(&made, payload, "encrypt vector for {plaintext:?}");
+
+            // Decrypt from B's view of A (key-role symmetry).
+            let got = nip44_decrypt(sec2, &pub1, payload).unwrap();
+            assert_eq!(got, *plaintext);
+        }
+    }
+
+    #[test]
+    fn nip44_round_trip_and_failures() {
+        let sk_a = generate_secret().unwrap();
+        let sk_b = generate_secret().unwrap();
+        let pub_b = pubkey_hex(&sk_b).unwrap();
+        let pub_a = pubkey_hex(&sk_a).unwrap();
+
+        let msg = "hello, remote signer";
+        let payload = nip44_encrypt(&sk_a, &pub_b, msg).unwrap();
+        assert_eq!(nip44_decrypt(&sk_b, &pub_a, &payload).unwrap(), msg);
+
+        // Round-trip long content across the 65536 prefix boundary.
+        let long = "x".repeat(70_000);
+        let payload = nip44_encrypt(&sk_a, &pub_b, &long).unwrap();
+        assert_eq!(nip44_decrypt(&sk_b, &pub_a, &payload).unwrap(), long);
+
+        // Wrong peer key must fail the MAC, not return garbage.
+        let stranger = generate_secret().unwrap();
+        assert!(nip44_decrypt(&sk_b, &pub_b, &payload).is_err());
+        let _ = stranger;
+
+        // Tampered payload fails.
+        let payload = nip44_encrypt(&sk_a, &pub_b, msg).unwrap();
+        let mut tampered = BASE64.decode(&payload).unwrap();
+        let n = tampered.len();
+        tampered[n - 1] ^= 0x01;
+        assert!(nip44_decrypt(&sk_b, &pub_a, &BASE64.encode(&tampered)).is_err());
+
+        // Truncated payload fails.
+        assert!(nip44_decrypt(&sk_b, &pub_a, "AAAA").is_err());
+    }
+
+    // ── BIP-340 official vectors (github.com/bitcoin/bips test vectors) ────
+
+    #[test]
+    fn bip340_reference_sign_vectors() {
+        // (seckey, pubkey, aux, msg, expected sig) — indices 0/1/2 of the
+        // official BIP-340 `bip-0340/test-vectors.csv` "should sign" set,
+        // transcribed from the file itself (x(3G) additionally verified
+        // by independent scalar-math in the review notes for this commit).
+        let vectors: &[(&str, &str, &str, &str, &str)] = &[
+            ("0000000000000000000000000000000000000000000000000000000000000003",
+             "F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9",
+             "0000000000000000000000000000000000000000000000000000000000000000",
+             "0000000000000000000000000000000000000000000000000000000000000000",
+             "E907831F80848D1069A5371B402410364BDF1C5F8307B0084C55F1CE2DCA821525F66A4A85EA8B71E482A74F382D2CE5EBEEE8FDB2172F477DF4900D310536C0"),
+            ("B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF",
+             "DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659",
+             "0000000000000000000000000000000000000000000000000000000000000001",
+             "243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89",
+             "6896BD60EEAE296DB48A229FF71DFE071BDE413E6D43F917DC8DCF8C78DE33418906D11AC976ABCCB20B091292BFF4EA897EFCB639EA871CFA95F6DE339E4B0A"),
+            ("C90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C9",
+             "DD308AFEC5777E13121FA72B9CC1B7CC0139715309B086C960E18FD969774EB8",
+             "C87AA53824B4D7AE2EB035A2B5BBBCCC080E76CDC6D1692C4B0B62D798E6D906",
+             "7E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C",
+             "5831AAEED7B44BB74E5EAB94BA9D4294C49BCF2A60728D8B4C200F50DD313C1BAB745879A5AD954A72C45A91C3A51D3C7ADEA98D82F8481E0E1E03674A6F3FB7"),
+        ];
+        for (sk_hex, pk_hex, aux_hex, msg_hex, sig_hex) in vectors {
+            let sk_bytes = hex::decode(sk_hex).unwrap();
+            let sk = SecretKey::from_slice(&sk_bytes).unwrap();
+            let kp = Keypair::from_secret_key(&Secp256k1::new(), &sk);
+            assert_eq!(hex::encode(kp.public_key().x_only_public_key().0.serialize()).to_uppercase(), *pk_hex);
+
+            let msg: [u8; 32] = hex::decode(msg_hex).unwrap().try_into().unwrap();
+            let aux: [u8; 32] = hex::decode(aux_hex).unwrap().try_into().unwrap();
+            let sig = Secp256k1::new().sign_schnorr_with_aux_rand(
+                &Message::from_digest(msg),
+                &kp,
+                &aux,
+            );
+            assert_eq!(hex::encode(sig.serialize()).to_uppercase(), *sig_hex);
+        }
+    }
+
+    #[test]
+    fn event_signing_round_trip() {
+        let sk = generate_secret().unwrap();
+        let unsigned = r#"{"kind":22242,"content":"{\"challenge\":\"abc123\"}","tags":[["relay","ws://127.0.0.1:7777"]],"created_at":1725100000}"#;
+        let signed = sign_event(&sk, unsigned).unwrap();
+        verify_event(&signed).unwrap();
+
+        let ev: serde_json::Value = serde_json::from_str(&signed).unwrap();
+        assert_eq!(ev["kind"], 22242);
+        assert_eq!(ev["pubkey"], pubkey_hex(&sk).unwrap());
+        // Tampering with content breaks the id, which breaks verification.
+        let mut tampered = ev.clone();
+        tampered["content"] = serde_json::Value::String("nope".into());
+        assert!(verify_event(&tampered.to_string()).is_err());
+    }
+
+    #[test]
+    fn connect_uri_parsing() {
+        let uri = "nostrconnect://83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5?relay=wss%3A%2F%2Frelay1.example.com&perms=nip44_encrypt%2Csign_event%3A22242&name=My+Client&secret=0s8j2djs&relay=ws%3A%2F%2F192.168.1.20%3A7777";
+        let info = parse_connect_uri(uri).unwrap();
+        assert_eq!(info.client_pubkey, "83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5");
+        assert_eq!(
+            info.relays,
+            vec!["wss://relay1.example.com", "ws://192.168.1.20:7777"]
+        );
+        assert_eq!(info.secret, "0s8j2djs");
+        assert_eq!(info.perms, vec!["nip44_encrypt", "sign_event:22242"]);
+        assert_eq!(info.name, "My Client");
+
+        // npub client keys and unknown params tolerated — the npub is
+        // generated through our own encoder so the test carries no
+        // hand-transcribed bech32 string.
+        let sk1 = "0000000000000000000000000000000000000000000000000000000000000001";
+        let npub = npub_from_pubkey(&pubkey_hex(sk1).unwrap()).unwrap();
+        let pubkey = pubkey_from_any(&npub).unwrap();
+        let uri = format!("nostrconnect://{npub}?relay=wss://r&secret=s&future=1");
+        let info = parse_connect_uri(&uri).unwrap();
+        assert_eq!(info.client_pubkey, pubkey);
+        assert_eq!(info.relays, vec!["wss://r"]);
+
+        assert!(parse_connect_uri("bunker://abc?relay=wss://r&secret=s").is_err());
+        assert!(parse_connect_uri("nostrconnect://zz?relay=wss://r&secret=s").is_err());
+        assert!(parse_connect_uri("nostrconnect://83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5?name=x").is_err());
+    }
+
+    #[test]
+    fn nip04_round_trip_and_cross_check() {
+        let sk_a = generate_secret().unwrap();
+        let sk_b = generate_secret().unwrap();
+        let pub_b = pubkey_hex(&sk_b).unwrap();
+        let pub_a = pubkey_hex(&sk_a).unwrap();
+
+        let payload = nip04_encrypt(&sk_a, &pub_b, "old client hello").unwrap();
+        assert!(payload.contains("?iv="));
+        assert_eq!(nip04_decrypt(&sk_b, &pub_a, &payload).unwrap(), "old client hello");
+
+        // Wrong key must fail (PKCS#7 padding check) rather than return garbage.
+        assert!(nip04_decrypt(&sk_a, &pub_a, &payload).is_err());
+        assert!(nip04_decrypt(&sk_b, &pub_b, &payload).is_err());
+        assert!(nip04_decrypt(&sk_b, &pub_a, "not-a-payload").is_err());
+    }
+
+    #[test]
+    fn key_encoding_round_trip() {
+        let sk = generate_secret().unwrap();
+        let nsec = nsec_from_secret(&sk).unwrap();
+        assert!(nsec.starts_with("nsec1"));
+        assert_eq!(secret_from_nsec(&nsec).unwrap(), sk);
+        assert_eq!(secret_from_any(&nsec).unwrap(), sk);
+        assert_eq!(secret_from_any(&sk).unwrap(), sk);
+
+        let pk = pubkey_hex(&sk).unwrap();
+        let npub = npub_from_pubkey(&pk).unwrap();
+        assert!(npub.starts_with("npub1"));
+        assert_eq!(pubkey_from_any(&npub).unwrap(), pk);
+        assert_eq!(pubkey_from_any(&pk).unwrap(), pk);
+
+        // The famous even-y lift edge case: pubkey of sk=1 is x(G) (y is odd);
+        // shared_x with oneself is exactly x(G) — pins the unhashed-x ECDH and
+        // the even-parity lift in one assertion (x is invariant under y-negation,
+        // so the lift is safe for NIP-44/NIP-04 keys).
+        let g_x = "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798";
+        assert_eq!(
+            pubkey_hex("0000000000000000000000000000000000000000000000000000000000000001").unwrap(),
+            g_x
+        );
+        assert_eq!(
+            hex::encode(
+                shared_x("0000000000000000000000000000000000000000000000000000000000000001", g_x).unwrap()
+            ),
+            g_x
+        );
+        assert!(secret_from_nsec("npub1").is_err());
+    }
+
+    /// The mesh ULA is a PURE function of the node's public key:
+    /// `fd ‖ sha256(x-only pubkey)[0..15]` (fips identity/node_addr.rs →
+    /// identity/address.rs). That is what makes "address by npub" work —
+    /// Termux's fipssh helper, and any future DNS-style resolver, just
+    /// computes what the fips daemon's DNS answers.
+    #[test]
+    fn npub_derives_the_same_mesh_ula_as_the_fips_identity() {
+        for seed in [0x42u8, 0x07, 0x31] {
+            // 0xff… would exceed the curve order — secret keys must be valid scalars.
+            let secret = [seed; 32];
+            let id = fips::Identity::from_secret_bytes(&secret).unwrap();
+            let npub = id.npub();
+            let expected = id.address().to_ipv6().to_string();
+
+            let pubkey_hex = pubkey_from_any(&npub).unwrap();
+            let pk = hex::decode(&pubkey_hex).unwrap();
+            let mut hasher = Sha256::new();
+            hasher.update(&pk);
+            let hash = hasher.finalize();
+            let mut ula = [0u8; 16];
+            ula[0] = 0xfd;
+            ula[1..].copy_from_slice(&hash[..15]);
+            assert_eq!(std::net::Ipv6Addr::from(ula).to_string(), expected, "npub {npub}");
+        }
+    }
+}

Android/tools/fipssh

@@ -0,0 +1,145 @@
+#!/data/data/com.termux/files/usr/bin/sh
+# fipssh — SSH to an Archipelago FIPS mesh node BY NPUB.
+#
+# The mesh ULA is a pure function of the node's public key (verified against
+# the fips crate itself — archy-fips-core's npub_derives_the_same_mesh_ula
+# test, and the Android tools commit that shipped this script):
+#
+#     ula = fd || sha256(x-only pubkey)[0..15]
+#
+# so the npub IS the address: no DNS server, no mesh query, works offline.
+# The node's fips daemon answers the same question through its DNS resolver
+# (core/archipelago/src/fips/dial.rs) — this is the phone-side equivalent.
+#
+# Setup (Termux):     pkg install python openssh
+# Usage:
+#   fipssh <user>@npub1… [ssh args…]   connect
+#   fipssh npub1…                      connect as $FIPSSH_USER
+#   fipssh --resolve npub1…            print the ULA and exit
+#
+# The companion's split tunnel carries the connection (fd00::/8 routes the
+# whole device while the mesh is up) — at home on LAN, away via the anchors.
+# The node still has to allow port 22 through its fips0 firewall: see
+# docs/HANDOFF-2026-08-31-ssh-over-mesh.md (the interim 90-ssh.nft drop-in,
+# restricted to your phone's ULA, until the node-side toggle ships).
+set -eu
+
+usage() {
+    sed -n '2,20p' "$0" | sed 's/^# \{0,1\}//'
+    exit 1
+}
+
+RESOLVE_ONLY=0
+if [ "${1:-}" = "--resolve" ]; then
+    RESOLVE_ONLY=1
+    shift
+fi
+[ $# -ge 1 ] || usage
+
+TARGET="$1"
+shift 2>/dev/null || true
+
+case "$TARGET" in
+    *npub1*)
+        case "$TARGET" in
+            *@npub1*) USER_PART="${TARGET%%@*}"; N_PUB="${TARGET#*@}" ;;
+            npub1*)
+                USER_PART="${FIPSSH_USER:-}"
+                N_PUB="$TARGET"
+                if [ -z "$USER_PART" ] && [ "$RESOLVE_ONLY" = 0 ]; then
+                    echo "fipssh: no user given (use user@npub… or set FIPSSH_USER)" >&2
+                    exit 1
+                fi
+                ;;
+            *) echo "fipssh: expected [user@]npub1…, got '$TARGET'" >&2; exit 1 ;;
+        esac
+        ;;
+    *) echo "fipssh: '$TARGET' is not an npub (expected [user@]npub1…)" >&2; exit 1 ;;
+esac
+
+command -v python3 >/dev/null 2>&1 || {
+    echo "fipssh: python3 not found — run: pkg install python" >&2
+    exit 1
+}
+
+ULA=$(python3 - "$N_PUB" <<'PYEOF'
+import hashlib, ipaddress, sys
+
+CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+
+
+def bech32_polymod(values):
+    gen = [0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3]
+    chk = 1
+    for value in values:
+        top = chk >> 25
+        chk = (chk & 0x1FFFFFF) << 5 ^ value
+        for i in range(5):
+            chk ^= gen[i] if ((top >> i) & 1) else 0
+    return chk
+
+
+def bech32_hrp_expand(hrp):
+    return [ord(c) >> 5 for c in hrp] + [0] + [ord(c) & 31 for c in hrp]
+
+
+def bech32_verify_checksum(hrp, data):
+    return bech32_polymod(bech32_hrp_expand(hrp) + data) == 1
+
+
+def bech32_decode(s):
+    if any(ord(c) < 33 or ord(c) > 126 for c in s):
+        raise ValueError("bad character")
+    if s.lower() != s and s.upper() != s:
+        raise ValueError("mixed case")
+    s = s.lower()
+    pos = s.rfind("1")
+    if pos < 1 or pos + 7 > len(s) or len(s) > 90:
+        raise ValueError("bad separator")
+    hrp = s[:pos]
+    data = [CHARSET.find(c) for c in s[pos + 1:]]
+    if -1 in data:
+        raise ValueError("bad data character")
+    if not bech32_verify_checksum(hrp, data):
+        raise ValueError("bad checksum — typo in the npub?")
+    return hrp, data[:-6]
+
+
+def convertbits(data, frombits, tobits):
+    acc = 0
+    bits = 0
+    ret = bytearray()
+    maxv = (1 << tobits) - 1
+    for value in data:
+        if value < 0 or (value >> frombits):
+            raise ValueError("bad value")
+        acc = (acc << frombits) | value
+        bits += frombits
+        while bits >= tobits:
+            bits -= tobits
+            ret.append((acc >> bits) & maxv)
+    if bits >= frombits or ((acc << (tobits - bits)) & maxv):
+        raise ValueError("bad padding")
+    return bytes(ret)
+
+
+npub = sys.argv[1]
+hrp, data = bech32_decode(npub)
+if hrp != "npub":
+    raise ValueError(f"expected hrp 'npub', got '{hrp}'")
+pubkey = convertbits(data, 5, 8)
+if len(pubkey) != 32:
+    raise ValueError(f"npub data must be 32 bytes, got {len(pubkey)}")
+# ula = fd || sha256(pubkey)[0..15] — mirrors fips identity/node_addr.rs +
+# identity/address.rs (FIPS_ADDRESS_PREFIX = 0xfd).
+ula = bytes([0xFD]) + hashlib.sha256(pubkey).digest()[:15]
+print(ipaddress.IPv6Address(ula).compressed)
+PYEOF
+) || exit 1
+
+if [ "$RESOLVE_ONLY" = 1 ]; then
+    echo "$ULA"
+    exit 0
+fi
+
+exec ssh "${USER_PART}@${ULA}" "$@"

Android/tools/nip46-test-client.py

@@ -0,0 +1,384 @@
+#!/usr/bin/env python3
+"""
+NIP-46 test client for the Archipelago companion's Remote Signer (#139).
+
+Plays the role the node's login flow will play (rust-nostr nostr-connect
+client): generates a nostrconnect:// pairing QR, connects to a relay, waits
+for the phone's bunker `connect` (secret echo), acks it, then exercises
+get_public_key + sign_event and VERIFIES the returned schnorr signature with
+independent pure-Python BIP-340 code (no shared code with the phone's Rust).
+
+Run it on your computer next to the phone:
+
+    python3 -m venv /tmp/nip46env
+    /tmp/nip46env/bin/pip install websockets qrcode
+    /tmp/nip46env/bin/python Android/tools/nip46-test-client.py [--relay wss://relay.damus.io]
+
+…then on the phone: hub menu (three-finger hold) → Remote Signer →
+Generate key (once) → Scan pairing QR → point at the terminal QR → Approve.
+
+Pure Python (no deps for the crypto; websockets + qrcode for transport/QR).
+"""
+import argparse
+import asyncio
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import struct
+import sys
+import time
+import urllib.parse
+
+import websockets  # pip install websockets
+
+# ── secp256k1 / BIP-340 (independent of the phone's Rust code) ──────────────
+
+P = 2**256 - 2**32 - 977
+N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
+GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
+G = (GX, GY)
+
+
+def _add(pt1, pt2):
+    if pt1 is None:
+        return pt2
+    if pt2 is None:
+        return pt1
+    x1, y1 = pt1
+    x2, y2 = pt2
+    if x1 == x2 and (y1 + y2) % P == 0:
+        return None
+    if pt1 == pt2:
+        lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
+    else:
+        lam = (y2 - y1) * pow(x2 - x1, -1, P) % P
+    x3 = (lam * lam - x1 - x2) % P
+    return (x3, (lam * (x1 - x3) - y1) % P)
+
+
+def _mul(k, pt):
+    r = None
+    while k:
+        if k & 1:
+            r = _add(r, pt)
+        pt = _add(pt, pt)
+        k >>= 1
+    return r
+
+
+def lift_x(x):
+    if x >= P:
+        return None
+    y_sq = (pow(x, 3, P) + 7) % P
+    y = pow(y_sq, (P + 1) // 4, P)
+    if y * y % P != y_sq:
+        return None
+    return (x, y if y % 2 == 0 else P - y)
+
+
+def tagged(tag: bytes, data: bytes) -> bytes:
+    """BIP-340 tagged hash: sha256(hash(tag) || hash(tag) || data)."""
+    th = hashlib.sha256(tag).digest()
+    return hashlib.sha256(th + th + data).digest()
+
+
+def bip340_sign(msg: bytes, seckey: int, aux: bytes) -> bytes:
+    d = seckey if seckey <= N - 1 else seckey - N
+    pub = _mul(d, G)
+    if pub[1] % 2 != 0:
+        d = N - d
+    t = bytes(a ^ b for a, b in zip(d.to_bytes(32, "big"), tagged(b"BIP0340/aux", aux)))
+    rand = tagged(b"BIP0340/nonce", t + pub[0].to_bytes(32, "big") + msg)
+    k = int.from_bytes(rand, "big") % N
+    assert k > 0
+    R = _mul(k, G)
+    if R[1] % 2 != 0:
+        k = N - k
+    e = int.from_bytes(tagged(b"BIP0340/challenge", R[0].to_bytes(32, "big") + pub[0].to_bytes(32, "big") + msg), "big") % N
+    return R[0].to_bytes(32, "big") + ((k + e * d) % N).to_bytes(32, "big")
+
+
+def bip340_verify(msg: bytes, pubkey_x: bytes, sig: bytes) -> bool:
+    """Check s·G − e·P == R with even-y R and x(R) == r (BIP-340)."""
+    if len(sig) != 64 or len(pubkey_x) != 32:
+        return False
+    pub = lift_x(int.from_bytes(pubkey_x, "big"))
+    if pub is None:
+        return False
+    r = int.from_bytes(sig[:32], "big")
+    s = int.from_bytes(sig[32:], "big")
+    if r >= P or s >= N:
+        return False
+    e = int.from_bytes(tagged(b"BIP0340/challenge", sig[:32] + pubkey_x + msg), "big") % N
+    sg = _mul(s, G)
+    ep = _mul(e, pub)
+    neg_ep = (ep[0], (P - ep[1]) % P)
+    rp = _add(sg, neg_ep)
+    return rp is not None and rp[0] == r and rp[1] % 2 == 0
+
+
+def ecdh_x(secret_hex: str, peer_x_hex: str) -> bytes:
+    """Raw ECDH x-coordinate against an x-only peer key (even-y lift)."""
+    peer = lift_x(int(peer_x_hex, 16))
+    assert peer is not None, "peer pubkey not on curve"
+    pt = _mul(int(secret_hex, 16) % N, peer)
+    return pt[0].to_bytes(32, "big")
+
+
+# ── NIP-44 v2 (pure python, spec-literal) ────────────────────────────────────
+
+def hkdf_extract(salt: bytes, ikm: bytes) -> bytes:
+    return hmac.new(salt, ikm, hashlib.sha256).digest()
+
+
+def hkdf_expand(prk: bytes, info: bytes, length: int) -> bytes:
+    t = b""
+    out = b""
+    i = 1
+    while len(out) < length:
+        t = hmac.new(prk, t + info + bytes([i]), hashlib.sha256).digest()
+        out += t
+        i += 1
+    return out[:length]
+
+
+def _rotl(x: int, n: int) -> int:
+    return ((x << n) | (x >> (32 - n))) & 0xFFFFFFFF
+
+
+def _qr(s, a, b, c, d):
+    s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = _rotl(s[d], 16)
+    s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = _rotl(s[b], 12)
+    s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = _rotl(s[d], 8)
+    s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = _rotl(s[b], 7)
+
+
+def chacha20_block(key: bytes, counter: int, nonce: bytes) -> bytes:
+    consts = [0x61707865, 0x3320646E, 0x79622D32, 0x6B206574]
+    state = consts + list(struct.unpack("<8I", key)) + [counter] + list(struct.unpack("<3I", nonce))
+    working = list(state)
+    for _ in range(10):
+        _qr(working, 0, 4, 8, 12); _qr(working, 1, 5, 9, 13)
+        _qr(working, 2, 6, 10, 14); _qr(working, 3, 7, 11, 15)
+        _qr(working, 0, 5, 10, 15); _qr(working, 1, 6, 11, 12)
+        _qr(working, 2, 7, 8, 13); _qr(working, 3, 4, 9, 14)
+    return struct.pack("<16I", *[(x + y) & 0xFFFFFFFF for x, y in zip(working, state)])
+
+
+def chacha20(key: bytes, nonce: bytes, data: bytes) -> bytes:
+    counter = 0  # NIP-44: "ChaCha20 (RFC 8439) with starting counter set to 0"
+    out = bytearray()
+    for i in range(0, len(data), 64):
+        ks = chacha20_block(key, counter, nonce)
+        chunk = data[i:i + 64]
+        out += bytes(a ^ b for a, b in zip(chunk, ks))
+        counter += 1
+    return bytes(out)
+
+
+def calc_padded_len(n: int) -> int:
+    if n <= 32:
+        return 32
+    power = 1 << ((n - 1).bit_length())
+    chunk = 32 if power <= 256 else power // 8
+    return chunk * ((n - 1) // chunk + 1)
+
+
+def nip44_encrypt(secret_hex: str, peer_hex: str, plaintext: str) -> str:
+    ck = hkdf_extract(b"nip44-v2", ecdh_x(secret_hex, peer_hex))
+    nonce = secrets.token_bytes(32)
+    okm = hkdf_expand(ck, nonce, 76)
+    key, iv, mac_key = okm[:32], okm[32:44], okm[44:76]
+    pt = plaintext.encode()
+    padded = (len(pt).to_bytes(2, "big") if len(pt) < 65536 else b"\x00\x00" + len(pt).to_bytes(4, "big")) + pt
+    padded += b"\x00" * (calc_padded_len(len(pt)) - len(pt))
+    ct = chacha20(key, iv, padded)
+    mac = hmac.new(mac_key, nonce + ct, hashlib.sha256).digest()
+    return base64.b64encode(bytes([2]) + nonce + ct + mac).decode()
+
+
+def nip44_decrypt(secret_hex: str, peer_hex: str, payload: str) -> str:
+    data = base64.b64decode(payload)
+    assert data[0] == 2, "only NIP-44 v2 supported"
+    nonce, ct, mac = data[1:33], data[33:-32], data[-32:]
+    ck = hkdf_extract(b"nip44-v2", ecdh_x(secret_hex, peer_hex))
+    okm = hkdf_expand(ck, nonce, 76)
+    key, iv, mac_key = okm[:32], okm[32:44], okm[44:76]
+    assert hmac.compare_digest(hmac.new(mac_key, nonce + ct, hashlib.sha256).digest(), mac), "bad MAC"
+    padded = chacha20(key, iv, ct)
+    ln = int.from_bytes(padded[:2], "big")
+    body = padded[2:2 + ln] if ln else padded[6:6 + int.from_bytes(padded[2:6], "big")]
+    return body.decode()
+
+
+# ── nostr events ─────────────────────────────────────────────────────────────
+
+def event_id(pubkey_hex: str, created_at: int, kind: int, tags, content: str) -> str:
+    serialized = json.dumps([0, pubkey_hex, created_at, kind, tags, content], separators=(",", ":"))
+    return hashlib.sha256(serialized.encode()).hexdigest()
+
+
+def sign_event(secret_hex: str, event: dict) -> dict:
+    eid = event_id(event["pubkey"], event["created_at"], event["kind"], event["tags"], event["content"])
+    ev = dict(event)
+    ev["id"] = eid
+    ev["sig"] = bip340_sign(bytes.fromhex(eid), int(secret_hex, 16), os.urandom(32)).hex()
+    return ev
+
+
+# ── the client session ────────────────────────────────────────────────────────
+
+def compact(d) -> str:
+    return json.dumps(d, separators=(",", ":"))
+
+
+async def run(relay: str):
+    client_secret = os.urandom(32).hex()
+    client_secret_int = int(client_secret, 16) % N
+    client_pub_hex = _mul(client_secret_int, G)[0].to_bytes(32, "big").hex()
+    pair_secret = secrets.token_hex(16)
+    nonce = secrets.token_hex(8)
+
+    uri = (
+        f"nostrconnect://{client_pub_hex}"
+        f"?relay={urllib.parse.quote(relay, safe='')}"
+        f"&secret={pair_secret}"
+        f"&name=Archipelago+Test+Client"
+    )
+
+    print(f"· client key  : {client_pub_hex}")
+    print(f"· relay       : {relay}")
+    print()
+    print("Scan this QR with: Companion → hub (3-finger) → Remote Signer → Scan pairing QR")
+    print()
+
+    try:
+        import qrcode
+        qr = qrcode.QRCode(border=1)
+        qr.add_data(uri)
+        qr.make(fit=True)
+        qr.print_ascii(invert=True)
+    except ImportError:
+        print(uri)
+
+    print()
+    print("Waiting for the phone to pair (connect, ack, get_public_key, sign_event)…")
+
+    async with websockets.connect(relay, max_size=2**22) as ws:
+        await ws.send(compact(["REQ", "test", {"kinds": [24133], "#p": [client_pub_hex], "since": int(time.time()) - 60}]))
+
+        signer_pub = None
+        acked = False
+        requests = []
+
+        def send_frame(content: dict):
+            assert signer_pub is not None
+            ev = {
+                "pubkey": client_pub_hex,
+                "created_at": int(time.time()),
+                "kind": 24133,
+                "tags": [["p", signer_pub]],
+                "content": nip44_encrypt(client_secret, signer_pub, compact(content)),
+            }
+            return asyncio.ensure_future(ws.send(compact(["EVENT", sign_event(client_secret, ev)])))
+
+        async def request(method, params, rid):
+            send_frame({"id": rid, "method": method, "params": params})
+
+        timeout = time.time() + 120
+        got_pubkey = None
+        signed_event = None
+
+        while time.time() < timeout:
+            try:
+                raw = await asyncio.wait_for(ws.recv(), timeout=timeout - time.time())
+            except (asyncio.TimeoutError, TimeoutError):
+                break
+            arr = json.loads(raw)
+            if not isinstance(arr, list) or len(arr) < 3 or arr[0] != "EVENT":
+                continue
+            ev = arr[2]
+            if ev.get("kind") != 24133 or ev.get("pubkey") == client_pub_hex:
+                continue
+            author = ev["pubkey"]
+            try:
+                msg = json.loads(nip44_decrypt(client_secret, author, ev["content"]))
+            except Exception:
+                continue
+
+            if "method" in msg and msg["method"] == "connect":
+                params = msg.get("params", [])
+                if params and params[0] == author and (len(params) < 2 or params[1] == pair_secret):
+                    signer_pub = author
+                    print(f"✓ phone paired  — signer pubkey {author[:16]}…")
+                    send_frame({"id": msg["id"], "result": "ack"})
+                    acked = True
+                    await asyncio.sleep(0.5)
+                    await request("get_public_key", [], nonce + "-gpk")
+                else:
+                    print("✗ phone sent connect but the secret didn't match")
+                    return 1
+                continue
+
+            if "result" in msg or "error" in msg:
+                rid = msg.get("id", "")
+                if "error" in msg:
+                    print(f"✗ error for {rid}: {msg['error']}")
+                    if rid.endswith("-sign"):
+                        return 1
+                    continue
+                result = msg.get("result", "")
+                if rid.endswith("-gpk"):
+                    got_pubkey = result
+                    print(f"✓ get_public_key → {result}")
+                    await request(
+                        "sign_event",
+                        [compact({
+                            "kind": 1,
+                            "content": "Hello from the Archipelago NIP-46 test client — approved by hand.",
+                            "tags": [],
+                            "created_at": int(time.time()),
+                        })],
+                        nonce + "-sign",
+                    )
+                elif rid.endswith("-sign"):
+                    signed_event = json.loads(result)
+                    print(f"✓ sign_event → signed event {signed_event.get('id', '')[:16]}…")
+                    break
+
+        if not acked:
+            print("✗ the phone never connected (2-minute timeout)")
+            return 1
+        if got_pubkey is None or got_pubkey != signer_pub:
+            print("✗ get_public_key missing or mismatched")
+            return 1
+        if signed_event is None:
+            return 1
+
+        ev = signed_event
+        expected_id = event_id(ev["pubkey"], ev["created_at"], ev["kind"], ev["tags"], ev["content"])
+        ok_id = expected_id == ev["id"]
+        ok_sig = bip340_verify(bytes.fromhex(expected_id), bytes.fromhex(ev["pubkey"]), bytes.fromhex(ev["sig"]))
+        print(f"· event id correct : {ok_id}")
+        print(f"· schnorr signature: {'VERIFIED ✓' if ok_sig else 'INVALID ✗'}")
+        if ok_id and ok_sig:
+            print()
+            print("END-TO-END PASS — the companion signed as the identity the phone holds,")
+            print("and the signature verifies under an independent BIP-340 implementation.")
+            return 0
+        return 1
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--relay", default="wss://relay.damus.io", help="any nostr relay both devices can reach")
+    args = ap.parse_args()
+    sys.exit(asyncio.run(run(args.relay)))
+
+
+if __name__ == "__main__":
+    main()

CHANGELOG.md

@@ -1,5 +1,180 @@
 # Changelog
 
+## Unreleased
+
+## v1.8.18-alpha (2026-09-18)
+
+- Framework startup prioritizes Bitcoin and LND before unrelated containers, and unavailable LND balances remain unavailable instead of appearing as false zeroes.
+- Cashu Receive guides unseeded wallets through recovery-phrase setup, with shorter backup guidance and a single-column layout.
+- Added live Framework verification for automatic LND unlock, native balance preservation, Cashu address registration, and proof preservation.
+
+## v1.8.17-alpha (2026-09-15)
+
+- Minibits claims that every mint reports as already spent leave the retry queue, clearing repeated failure notices. Network errors and mixed mint failures remain queued for another attempt.
+- Minibits polls its primary relay first and connects to public fallback relays only when the primary is unreachable, reducing unnecessary connections.
+- Large payment backlogs are fetched from newest to oldest with a saved cursor, so polling can resume after interruptions or page limits. Payments sharing the same timestamp remain reachable.
+- Added regression coverage for spent-claim classification, wrapped and mixed mint errors, same-second payments, and interrupted or multi-poll backlogs.
+
+## v1.8.16-alpha (2026-09-15)
+
+- App updates refresh and verify the signed catalog before changing containers. A failed refresh or manifest reload cancels the update, and automatic updates wait for a successful refresh.
+- Fixed repeated Mempool update offers: downstream `-archyN` patches now sort above their upstream release, and moving a published image between registry namespaces does not hide a genuine upgrade.
+- Updates inspect installed component versions, refuse known downgrades, skip containers already at the target versions, and verify the resulting versions before reporting success.
+- Added regression coverage for stale catalogs, matching versions, publisher namespace changes, stack component updates, and keeping running containers untouched when no upgrade is needed.
+
+## v1.8.15-alpha (2026-09-13)
+
+- Cuprate is presented as one user-facing app in My Apps, including its UI launch button; the generated dashboard companion is hidden as an implementation detail instead of appearing under Services.
+- Added regression coverage for Cuprate install and installed-state grouping.
+- Release validation was rerun on the corrected tree before OTA and ISO publication.
+
+## v1.8.14-alpha (2026-09-13)
+
+- **Cuprate gains a first-party companion dashboard.** The Monero node now has a Bitcoin-style status UI, safe app grouping, a 450 GB disk-safety gate, and a restricted RPC that is never exposed as a launch page.
+- **Bitcoin Core Tor enrollment uses the correct protocol identity.** `bitcoin-core` is forwarded on port 8333 and resolves to its own hidden-service directory without disturbing legacy Bitcoin aliases.
+- **GitWorkshop opens Archipelago’s canonical ngit repository by default.** The launcher and registry promotion use the full maintainer/relay/`archy` coordinate, with regression coverage for Companion and browser-tab launches.
+- **Release validation is stricter.** The registry gate now checks the complete canonical source deep link, and the merged candidate passed the full frontend and focused backend test suites.
+
+## v1.8.13-alpha (2026-09-12)
+
+- **GitWorkshop installs reliably on fresh nodes.** The app is classified as a user-facing app while its install placeholder is being created, so it remains visible under My Apps instead of Services.
+- **Fresh GitWorkshop installs build the correct image.** The production orchestrator handles its bundled build context instead of sending the local image reference through the legacy registry-pull path.
+- **Curated app classification is regression-tested.** Every user-facing app remains in My Apps during installation, while headless services stay in Services.
+
+## v1.8.12-alpha (2026-09-11)
+
+- **Fresh IndeedHub installs no longer share a fleet-wide encryption root.** The API now generates a persistent per-node AES master secret and shares it with the media worker through the platform's protected secret environment. Existing nodes migrate the exact legacy value they are already using before any container can be recreated, preserving access to encrypted data; an unreadable or empty existing root fails safely instead of being silently replaced. The manifest path, retired fallback installer, and container repair script follow the same rule.
+
+- **The Companion download advertises and re-announces the APK it actually serves.** The Discover banner and its install prompt now share the no-cache APK metadata, visibly report Companion 0.5.32 build 52, and remember dismissal per Android build rather than forever, so an existing browser gets one useful update prompt when the APK changes. The ISO gate reads the expected version from the Android build itself instead of accepting the stale 0.5.28 payload.
+
+- **GitWorkshop's dependency audit is clean.** The pinned upstream client keeps its separately reviewable Archipelago integration patch and now applies a deterministic dependency patch: safe lock refreshes plus targeted `fflate`, React Router, and Vitest upgrades remove all ten production advisories and all eight development advisories. A clean install reports zero vulnerabilities; type-check, all 152 upstream unit tests, and the exact Archipelago subpath build pass.
+
+- **Every completed payment now gets the full Lightning-style receipt screen.** Cashu and Fedimint sends no longer leave the payment form open behind a token; wallet, QR-scan, Web5, and app-requested sends all replace their forms with the animated success state. Payment hashes, transaction IDs, ecash tokens/notes, mint details, and other useful references remain copyable in the receipt, and receive completions open the same distinct payment-success modal. Minibits claims retain a short-lived durable receipt so the visible modal still reports success when another dashboard or Companion context wins the claim-poll race, while concurrent watchers now share one bounded relay fetch instead of queueing several long polls.
+
+- **TollGate provisioning closes the free-access path without taking over an admin network.** Confirmed upstream `TollGate-*` access points are moved from LAN onto the paid network, mint URLs are normalized consistently, and operators can set a validated Lightning payout address without replacing merchant keys or other revenue-share identities. Malformed existing identity data now stops provisioning safely instead of being overwritten.
+
+- **Cashu receive gains a human-readable Minibits Lightning address.** The node derives the profile from the existing ecash recovery phrase, collects payments from the Minibits Nostr delivery relays, and redeems them into the Cashu wallet. Claim polling is single-flight, state and already-consumed tokens are written atomically with private permissions, same-second events are deduplicated without being skipped, restored seeds cannot reuse another wallet's profile, and pending claims retain the service key that encrypted them across key rotations. The UI identifies Minibits as a third-party beta service and recommends small balances.
+
+- **Nostr sign-in returns directly to the app instead of a black or grey frame.** The top-level signer broker now stays loaded as a 1px non-interactive surface parked physically off-screen; removing or display-hiding its full-screen cross-origin iframe could leave stale compositor pixels above IndeeHub or GitWorkshop in Android WebView and mobile Chromium until refresh. One retained broker also keeps identity selection and its immediately following signing request in a continuous UI, while Companion no longer adds a separate 180ms cover that made GitWorkshop visibly flicker.
+
+- **Gitea is sized for source and release hosting, not an empty demo.** Its manifest storage allowance is now 50GiB, release attachments accept individual files up to 10GiB, container-package owner storage remains unlimited, and HTTP/HTTPS proxy uploads share a streamed 10GiB ceiling. Existing repository, package, LFS and release data is unchanged.
+
+- **Companion browser-tab signing now accepts the app gate's complete session.** A fresh external browser no longer needs a prior dashboard login/localStorage marker before the dashboard-origin signer can load. The app gate now issues both the shared HttpOnly node session and its matching readable CSRF token, so identity discovery and signing RPCs work after that one login instead of rendering a misleading “No identities found” state. Normal dashboard logout/session checks keep their existing behavior.
+
+- **Fast Nostr identity choices now survive app startup and Companion tabs.** The tab/WebView broker waits for the application load event before opening its first-run picker, queues every NIP-07 call until the signer is initialized, and hands the just-selected public key directly to the immediate login request. GitWorkshop now turns that first-run choice into its normal extension account automatically, eliminating the startup race that surfaced as IndeedHub's “Could not get public key from extension.”
+
+- **GitWorkshop makes network projects and Archipelago login explicit.** Its signed-in dashboard now includes recent repositories from the Nostr git index, the NIP-07 action reads “Extension / Archipelago,” and explicit Archipelago logins reopen the node identity chooser instead of silently reusing the first identity. Direct, user-triggered NIP-07 logins receive the same account-switch behavior for upstream apps such as IndeedHub.
+
+- **IndeedHub tab signing now tracks the dashboard signer.** The injected provider supports the contained signer broker in direct tabs, is cache-busted, and is reconciled after dashboard-only updates as well as app installs and starts.
+
+- **App launches now honor credentials everywhere.** Home, Spotlight, Discover, My Apps, and app-detail launches all pass through one platform-owned credential handoff, so Portainer's first-run token and the File Browser/PhotoPrism login details can no longer be skipped by launching from the Home grid.
+
+- **Manage Updates returns to Download immediately after cancellation.** Canceling a stalled OTA now clears both the local staged state and progress state instead of leaving an incorrect Install button visible until the page is refreshed.
+
+- **GitWorkshop no longer probes a desktop-only localhost relay or unauthenticated manifest.** The packaged upstream client disables its default `localhost:4869` nostrdb probe, uses credentialed manifest loading, drops dead lookup relays, and permits the dashboard's contained signer broker in its frame policy.
+
+- **Rootless app ports self-heal when `pasta` drops a listener.** The five-minute container doctor compares every running container's declared Podman port bindings with actual host listeners and restarts only a container whose listener vanished. TCP and UDP are checked separately, avoiding false restarts of services such as NetBird's UDP port 3478. This covers the intermittent Nginx Proxy Manager port 8081 rebind failure without requiring a node reboot.
+
+- **Nostr identity actions now use one contained, companion-safe signing experience.** The old full-screen signer has been replaced by the same in-app consent surface used by embedded apps, with the animated identity circle as a brief signing indicator and an explicit completion state. Editing an identity now ends on a dedicated success screen that reports relay coverage and the event ID instead of disappearing back into the form. The app developer guide defines this platform-owned NIP-07 flow and its browser/Companion test matrix so apps do not add a second signer UI.
+
+- **Discovery merchandising is now owned by the signed app registry.** The catalog declares the Popular Apps set and contribution promotion; Discover renders two desktop rows of popular apps, then the “Your node. Your source.” banner, then the remaining apps. GitWorkshop uses a cache-busted copy of its current upstream mark, and its catalog entry identifies the canonical Archipelago maintainer npub.
+
+- **Companion opens Source in its native WebView and installs the node certificate.** GitWorkshop is a top-level page in the Companion in-app browser—not a dashboard iframe—and its injected provider uses the contained, consent-gated signer broker. The generic native launcher turns relative app paths into complete URLs before handing them to Android. The Node certificate button uses Android's system credential installer in the companion instead of an unsupported WebView download.
+
+- **Node certificate guidance now covers installation and the failures people actually see.** Settings includes the complete macOS, iOS/iPadOS, Windows, Android, Linux, Firefox, and Arch/Manjaro steps; reminds users to restart browsers that cache trust decisions; separates certificate trust from DNS; and maps common browser symptoms to their likely cause.
+
+- **Tab and Companion Nostr sign-in no longer loses the broker or an early identity choice.** The signer route validates the shared app-gate session with the implemented, authenticated `system.get-hostname` RPC instead of the nonexistent `system.get-version`. The provider also exposes a sticky identity subscription so a GitWorkshop React listener that mounts just after selection still completes the normal NIP-07 login. The dashboard service worker no longer precaches the signer route or provider, preventing an old bridge from surviving an update. This repairs GitWorkshop automatic login and IndeeHub's external mobile-browser flow.
+
+- **The App Store now makes Archipelago's source an invitation to contribute.** GitWorkshop has its real upstream icon and source-focused description, plus a dedicated “Your node. Your source.” banner explaining that users can browse the code, clone with ngit, and send issues, patches, and reviews over Nostr.
+
+- **Source now packages GitWorkshop instead of maintaining a separate Nostr Git interface.** The pinned upstream client runs read-only behind the authenticated app gate, launches at the dashboard's same origin under `/app/archipelago-source/`, and uses the node's consent-gated NIP-07 bridge. The upstream revision declares no license; Archipelago's owner accepted that redistribution risk without representing the client as licensed. Production publication still requires a tested canonical Archipelago NIP-34/GRASP announcement.
+
+- **Changing the node password now reports a wrong current password directly.** The backend was already rejecting the request before changing either the web or SSH password, but its error sanitizer replaced that safe, actionable explanation with “check server logs.” The real validation error now reaches the password dialog.
+
+- **The periodic container doctor runs from the same canonical path used by OTA updates.** Its systemd unit and embedded bootstrap still pointed at the retired source-checkout path while release updates installed the script under `/opt/archipelago/scripts`, leaving the doctor failed on nodes without that checkout. ISO, OTA bootstrap, and the deployment smoke test now agree on the `/opt` path.
+
+## v1.8.11-alpha (2026-09-07)
+
+- **Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.
+
+- **OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.
+
+- **Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links.
+
+## v1.8.10-alpha (2026-09-02)
+
+- **Lightning sends work again — v1.8.9's payment switch lost the fee budget.** Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as **zero allowed fees**: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered "No route to the recipient" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (`fee_limit=0 mSAT` on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.
+
+- **A channel that drops its peer link now heals itself — on every node.** Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails "no route to the recipient". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.
+
+- **The Lightning wallet states the node's real funding state instead of "you have no channel."** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the *receiving* copy. The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance.
+
+## v1.8.9-alpha (2026-09-01)
+
+- **Lightning sends work again after the LND 0.21.2 update.** LND 0.21 removed the old synchronous payment route the node's backend paid through (`/v1/channels/transactions`) — every Lightning send answered the literal "Not Found" and the wallet showed "Payment failed: Not Found". The backend now pays through the supported Router.SendPaymentV2 route, keeps the same settle-then-report behaviour (a slow multi-hop payment is still tracked to completion, never falsely declared failed), and translates LND's failure reasons into plain advice. A new gate test speaks the payment route directly against the running LND, so an image/backend skew like this can never ship silently again.
+
+- **The node no longer pins HSTS — HTTP access is a supported mode, and it stays working.** The HTTPS listener used to send `Strict-Transport-Security: max-age=31536000; includeSubDomains`; browsers that visited HTTPS once cached that and then silently upgraded the still-open HTTP dashboard's calls to HTTPS, which is a scheme change — cross-origin — so every request died as "CORS blocked / Failed to fetch" while the node was perfectly healthy. The HTTPS listener now actively clears the cached policy (`max-age=0`) and port 80 sends no HSTS at all, which is deliberate: the node's certificate is optional and self-signed, and devices that haven't installed the CA must keep plain-HTTP access (that's what Settings → Node certificate is for). If your browser already cached the old policy, visiting the dashboard over HTTPS once after this update clears it; a gate test now refuses any config that reintroduces the pin.
+
+- **App frames open over HTTPS again — including the ones that "did not connect."** The launcher asked the signed catalog for each app's port policy under the name you click ("Mempool Web", "Bitcoin Knots"), but the catalog declares those ports under the manifest that owns them (the Mempool web container, Bitcoin UI). The lookup missed, the launcher handed the iframe an `http://` address, and the browser blocked it as mixed content — the app tile went blank or spun forever. Port resolution now follows launch aliases (mempool-web, bitcoin-knots/bitcoin-core, lnd, electrs and friends), falls back to a port-wide catalog scan when the id is unknown, and the catalog is warmed as soon as the dashboard loads rather than only in the App Store, so the very first app you open already knows which ports serve TLS.
+
+- **Signing in to IndeeHub with Nostr works over HTTPS.** The NIP-07 bridge compared the app frame's origin for exact equality with the recorded `http://` app URL — a frame the browser upgraded to HTTPS (or any scheme change) was silently ignored, and replies addressed to the stale origin were refused outright, so Nostr sign-in quietly did nothing. The bridge now matches host and port (scheme intentionally ignored) and always replies to the frame's real origin.
+
+- **Nginx Proxy Manager starts again.** Converting it to a platform manifest dropped two things its image needs: the `/etc/letsencrypt` mount its boot script hard-requires, and the `NET_BIND_SERVICE` capability its internal nginx needs to bind ports 80/443/81 under the orchestrator's `--cap-drop=ALL`. The result was an endless start/die loop (a node watched it restart 3,176 times). Both are declared in its manifest now, its certs live on unchanged under the same persistent app directory, and the signed catalog carries the fix so installed nodes heal on the next update.
+
+- **Portainer's first-run token is in the app page, not buried in "server logs."** New Portainer versions mint a one-time setup token on a fresh install and print it only to the container logs — on an appliance that meant telling the user to go read a server log to get into their own app. The token now appears in the same launch interstitial as app login credentials (with a copy button), only while first-run setup is actually pending; once the admin account exists the card disappears on its own.
+
+- **The Lightning wallet states the node's real funding state instead of "you have no channel."** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had no channel at all (the outbound sum is legitimately zero in both states). The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of pointing at channel setup, and only a genuinely channel-less node is sent to open one.
+
+## v1.8.8-alpha (2026-09-01)
+
+- **SSH over the mesh is now a first-class setting.** Settings gains an "SSH over mesh" card: off by default, and when you allow it the node's mesh firewall opens port 22 — either to every mesh peer (behind an explicit "I understand" confirmation, because that's a real exposure) or only to the mesh addresses you list. The rule is owned by the node (the `90-ssh.nft` drop-in), so it survives upgrades and daemon reinstalls, and the card tells you up front whether sshd is running, whether it listens on IPv6 (the mesh is IPv6-only — this is what a broken attempt looks like before it happens), and whether password login is on (keys-only is the recommended pairing). From Termux on your phone, `fipssh <user>@<node-npub>` connects once the toggle is on — the npub is the durable address, and the command is shown with a copy button on the card.
+
+- **The App Store now lists apps — not parts of apps.** The signed catalog carries every manifest because the node's update layer needs their pins, and the store briefly listed them all: Mempool API, LND UI, Bitcoin UI, the Pine voice engines, the IndeeHub and Immich backends, the mesh router and friends. Components are hidden from the store listing (they still appear where they belong — the Services tab of My Apps, once installed), and four entries that never earned a tile are gone outright: MorphOS server (old), the Web5 DID wallet, Lightning Stack (an untracked upstream bundle — LND covers the need), and CryptPad (never tested).
+
+- **App icons now persist everywhere, in the proper container style.** Two fixes: installed apps render the icon from their own manifest — Cuprate no longer falls back to the generic A-mark on its Services tile — and the store grids (the Discover page) apply the same icon container treatment (backdrop, border, shadow) as My Apps, the detail pages, and Home. Manifest-declared UI apps also classify correctly again: Alby Hub installs into My Apps with a working tile, not into Services, because a probe miss no longer buries an app the manifest itself says has a frontend.
+
+- **Installing from the store keeps you on the store page.** The install progress lives on the tile itself and the app appears in My Apps when it lands — no more being yanked to My Apps mid-browse.
+
+## v1.8.7-alpha (2026-08-31)
+
+- **What's New really does stop at v1.8.0 now.** The first correction removed old generated release blocks but missed six much older hand-written v1.2 sections at the bottom of the modal. Those sections are gone, and the release check now recognizes and rejects that legacy format too, so the history floor cannot falsely pass again.
+
+- **The installer carries the same corrected release and Companion 0.5.28.** Its artifact gate now checks the companion APK version and the v1.8.0 What's New floor inside the finished ISO, so a stale frontend or phone app cannot be published under the current release label.
+
+- **Crash dumps work on fresh installs as well as upgraded nodes.** The installer gate checks every kdump package inside the finished ISO, and `makedumpfile` is installed explicitly rather than accidentally relying on a recommended dependency that the minimal image deliberately omits.
+
+- **Apps open over HTTPS when your node does.** Connect to your node over HTTPS and the apps you open — Vaultwarden in its own tab, BTCPay, Grafana, and the rest, on a remote browser or in the phone's in-app browser — now open on the same secure connection instead of silently dropping to plain HTTP. The node's app gate already served TLS on every app port; the dashboard was handing out `http://` addresses regardless of how you reached it. Ports the gate does not front (plain-HTTP publishes, and the API ports like Cuprate's RPC) deliberately stay on `http` — `https` there would simply fail to connect. Plain-HTTP access (the kiosk, LAN browsing) is unchanged.
+
+- **Every app in the store is now a first-class platform app.** The remaining platform apps carry full manifests: the node's app gate fronts their web ports (TLS on the same port, the node login where appropriate, embedding fixes, Tor), installs go through the orchestrator like every other app, and their pins live in the signed catalog. Ollama stays loopback-only — it is the assistant's local model backend, not a web app. Retired apps are dropped from the catalog, and Cuprate's manifest — which carried a duplicated metadata block that strict parsers reject — is fixed.
+
+- **Newly signed apps appear in the App Store immediately.** The App Store now serves the release-signed catalog the node has already fetched and verified — so publishing a signed app (like Cuprate) makes it appear for every updated node without waiting for a dashboard release. The unsigned community catalog remains only as a fallback for nodes that can't reach the registry. The same signed catalog now also decides which ports serve TLS, so nothing is upgraded to `https` that can't answer it.
+
+## v1.8.6-alpha (2026-08-31)
+
+- **Companion 0.5.28 is included in the node download this time, with the work that missed v1.8.5.** The companion hub can back up and restore its node list, act as a NIP-46 remote signer, and shows each paired node's FIPS mesh address with tap-to-copy. For Termux users, the included `fipssh` helper turns a durable node npub into its mesh address, so `fipssh user@npub1…` can reach SSH once that node has explicitly allowed port 22. The node-side “SSH over mesh” firewall toggle is not claimed here—it still needs implementation and remains off by default.
+
+- **What's New now starts cleanly at v1.8.0 and is guaranteed to be newest-first.** Older alpha history no longer overwhelms the useful recent changes, the three stray v1.7 entries that appeared above current releases are gone, and the release check now fails if either the ordering or the v1.8.0 history floor drifts again.
+
+- **A release can no longer advertise itself before its files exist.** New releases are prepared behind a pending manifest; the publisher uploads the backend and frontend, downloads both back and verifies their size and hash, and only then promotes the signed manifest to the path nodes read. The manifest generator also includes every curated What's New item instead of silently stopping after the first ten physical changelog lines.
+
+## v1.8.5-alpha (2026-08-30)
+
+- **Cuprate — an independent Monero node — is now an app.** Monero consensus validated by a second, unrelated codebase (Rust), the same layer of security-in-depth Bitcoin gets from Knots. Review caught two problems before anything shipped: the unrestricted RPC that can move funds stayed bound to the container's loopback (never published to the node, let alone the LAN — anything on the node could previously have reached it), and its restricted RPC moved off port 18089 to avoid colliding with Penpot. Honest caveat: upstream has cut no stable release yet, so the pin tracks an exact preview build (0.1.0-preview-18-g618ff14) and moves to their first tagged release when there is one.
+
+- **A frozen node now explains itself — and comes back on its own.** The host now captures a memory dump into /var/crash when the kernel panics *or* wedges (a hung kiosk used to sit dead until someone power-cycled it; now it dumps, reboots itself, and leaves the evidence behind), and records failing-memory signals (ECC errors) into a database as they happen. This is the first change delivered by a new host-update channel: the node's own updater now carries OS-level packages and settings to already-deployed machines — the crash-kernel's memory reservation is the one part that waits for a reboot, and the node says so rather than pretending.
+
+- **Uninstalling an app can no longer report success when it failed.** The declarative path used to swallow every teardown error and report the app uninstalled, leaving the tile behind and the truth in the logs. A failed uninstall now stops and shows the real per-app errors, so "still there" is never presented as "gone".
+
+- **Pictures to internet-only mesh contacts work now.** Sending an attachment inline always took the radio path and failed with "Peer is federation-only (no radio twin)" for contacts reachable only over the internet — and the size-adviser kept recommending a radio transfer those peers can't receive. Both fixed: inline sends route over the federation when that's the only way to reach the peer, and the advice no longer offers radio-only transfers to radio-unreachable contacts.
+
+- **Disk cleanup finally has honest numbers.** Space "free" on a drive was counted including the slice the filesystem keeps reserved for root — roughly 5% of the disk, 92 GB on one dev box — so the automatic cleanup that's supposed to kick in at 90% never triggered and stale container images piled up unnoticed. Reserved space now counts as used, which is what the threshold was always meant to measure.
+
+- **Three small screens that were lying to you, fixed.** The "Bitcoin is synced — fund your wallet" toast no longer appears on a node where the wallet it means (LND) isn't installed — it points at installing LND instead. The seed-reveal screen hides its third prompt unless the password actually fails to decrypt (the backup passphrase only exists if you set one). And multi-version store cards stop quoting a version number you'll be asked to choose on the next screen anyway.
+
+- **Mesh notifications survive a refresh, and a stale router no longer hides the fix.** Radio message unread counts are now remembered per contact instead of guessed from session state (the "one new message showed 11 unread" bug), cover Meshtastic, MeshCore and Reticulum alike, and deep-link to the right conversation; a single new message announces itself once. Separately, when the cached router address goes stale, the error card gains a "Reconfigure router" action instead of a Retry loop that can never succeed.
+
+- **The app updater now knows what upstream shipped.** Every app's manifest records where it comes from — including the odd corners (GitLab-only projects, ghcr-only images) — and a checker sweeps all of them against upstream releases, so a pin that quietly rots for months is now visible instead of invisible. The first full sweep found 27 pins behind; the safe patch-level ones shipped with this release (strfry, BTCPay Server 2.4.3, the two nginx frontends), and the major jumps that may carry data migrations are deliberately held for their own careful passes.
+
 ## v1.8.4-alpha (2026-08-20)
 
 - **Apps with their own login can now skip the node's login screen — Gitea and BTCPay Server do so out of the box.** Some apps bring a complete account system of their own, and putting the node's password page in front of them broke real workflows: git clients can't answer a browser login, and a BTCPay checkout link handed to a customer must open for that customer. These apps are now served directly on their own login, while the node still fronts the connection for everything else it does (embedding fixes, the "app is restarting" page, Tor). Every app gets a new **Settings → app → Access control** switch, so you can put the node login back in front of any app — or take it away from one — with one click, effective immediately. App developers declare the default in their manifest (`auth: open`), documented in the developer guide.
@@ -291,6 +466,12 @@
 - More TV-screen polish: the built-in assistant shows its dark theme instead of bright white panels, the on-screen hint for switching between the kiosk and a terminal now points at the right keys, the welcome logo no longer occasionally renders as garbled characters, and an accidental tap of the power button no longer shuts the node down — hold it to power off on purpose.
 - Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle.
 
+## v1.7.107-alpha (2026-07-20)
+
+- Wi-Fi setup now heals itself on older nodes. Some nodes set up before a mid-year fix couldn't connect to a Wi-Fi network from the screen — it failed with a permissions error — because the piece that lets the node manage networking on your behalf was missing. Nodes now put that piece in place automatically on startup, so "scan, pick a network, type the password, connect" works without reinstalling.
+- Your node rejoins the mesh faster after an update. Applying this update briefly restarts the mesh service, and previously a node could sit disconnected from other nodes for up to five minutes before it retried. It now notices the restart and reconnects within seconds.
+- Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle — two separate faults that had been failing the build.
+
 ## v1.7.106-alpha (2026-07-20)
 
 - Nodes on the same network now find each other directly. Your node announces itself on your local network and connects straight to other Archipelago nodes nearby, instead of every connection having to be introduced by a public rendezvous server out on the internet. Peers in the same home or office stay connected to each other even when that server is unreachable, and they reach each other faster.
@@ -670,11 +851,13 @@
 
 - Orchestrator-backed app starts now run the same pre-start repairs as the legacy Podman path, so Nginx Proxy Manager stale `81:81` container metadata is removed and recreated before the orchestrator tries to start it.
 - Live diagnostics on a fleet node confirmed host nginx is healthy while Nginx Proxy Manager has no listeners on `8081`, `8084`, or `8444`, causing host nginx `502` responses for NPM proxy paths.
+- The gap this closes: apps launched through the orchestrator previously skipped the legacy start-time repair path entirely, so the same stale metadata the old flow cleaned up silently broke the new one. Both paths now converge on the same repairs.
 
 ## v1.7.64-alpha (2026-05-18)
 
 - Update apply rate limiting is relaxed for authenticated admins from 2 attempts per 10 minutes to 10 attempts per minute, preventing the System Update page from getting stuck behind `429 Too Many Requests` during legitimate OTA retry/troubleshooting flows.
 - The corrected backend artifact rebuild protection from `v1.7.63-alpha` remains in place, so this release is built from a fresh Rust backend binary before publishing.
+- For operators mid-incident this changes the recovery loop: a failed apply can now be retried immediately from the System Update page instead of waiting out a throttle window while a node sits half-updated.
 
 ## v1.7.63-alpha (2026-05-18)
 
@@ -784,6 +967,18 @@
 - Debian 13/Trixie ISO and disk-install paths now force security updates from `trixie-security` during image/install creation so rebuilt release media includes patched base packages.
 - Broad `.198` lifecycle audit passes with the current qualified app set; known absent blockers remain `electrumx`, `photoprism`, `dwn`, and `ollama`.
 
+## v1.7.51-alpha (2026-04-30)
+
+- Stack installs now adopt containers that already exist instead of failing on them — a repair or reinstall over leftover containers completes, and the adopted container's readiness is waited on like any fresh start.
+- Failed installs come with evidence: the install path waits for its containers, and when one doesn't become healthy it captures that container's logs, so the error on screen names the real culprit instead of a bare timeout.
+- Bitcoin RPC bindings are ensured as part of install, and the startup self-heal path gained additional ground for already-deployed nodes.
+
+## v1.7.50-alpha (2026-04-30)
+
+- The OTA bridge older nodes needed: deployed binaries only knew how to apply two artifacts (the backend binary and the frontend archive), so the scripts, app specs and docker assets newer releases carry never reached them. This release packs those payloads inside the frontend tarball — the one channel old binaries do apply — and the new backend promotes them into /opt once it starts.
+- Runtime payloads are staged into timestamped directories and promoted atomically; a failed extraction cleans up its staging area instead of leaving half-written state for the next update to trip over.
+- This is the release that un-sticks the fleet's update pipeline: from here on, an OTA can carry more than the two artifacts, and app installs on updated nodes use the specs that match their backend.
+
 ## v1.7.49-alpha (2026-04-30)
 
 - Bitcoin Knots/Core UI now reports connection, reconnecting, syncing, and error states from a backend status bridge instead of showing a stale "Unable to connect" message while the node is warming up.
@@ -795,12 +990,15 @@
 
 ## v1.7.48-alpha (2026-04-29)
 
-- archipelago.service no longer fails to start with "Failed to set up mount namespacing: /run/containers: No such file or directory" on nodes where /run/containers wasn't pre-created. ExecStartPre now creates it. Existing nodes need a one-time `systemctl edit archipelago` to add the mkdir; ISO installs from this version forward have the fix baked in.
+- archipelago.service no longer fails to start with "Failed to set up mount namespacing: /run/containers: No such file or directory" on nodes where that runtime directory wasn't pre-created — the failure surfaced in systemd's mount-namespace setup before the service itself ever ran.
+- ExecStartPre now creates /run/containers before the service starts, so the node's service manager finds the directory it needs on every boot; ISO installs from this version forward have the fix baked in.
+- Existing nodes pick the fix up with a one-time `systemctl edit archipelago` adding the mkdir — after which the boot failure does not recur.
 
 ## v1.7.47-alpha (2026-04-29)
 
 - Bitcoin Knots/Core sync is now significantly faster. The container now uses every available core for script verification (was capped at 2) and has 8GB of memory instead of 4GB so its 4GB UTXO cache has headroom for the mempool and peer connections. Existing nodes pick up the new limits on next install/update; freshly-installed nodes start at full speed.
 - ElectrumX initial indexing is faster too. Its CPU cap is removed, container memory is 4GB, and its internal cache is now 3GB (default was 1.2GB).
+- The result: a fresh node's first hours are measurably shorter — initial block download and ElectrumX indexing were the two longest post-install waits, and both now run at the hardware's limit.
 
 ## v1.7.46-alpha (2026-04-29)
 
@@ -823,10 +1021,9 @@
 
 ## v1.7.44-alpha (2026-04-28)
 
-43de3b73 feat(orchestrator): complete container migration and release hardening
-ce39430b feat(self-update): sync and rebuild UI containers on OTA
-72dec5aa fix(lnd-ui): align container port across all specs
-83aacdf2 chore(release): archive ISO build recipes, tarball-only releases
+- Container orchestration migration completed, with release hardening across the app lifecycle — installs, updates and removals now run through one orchestrator path instead of the split legacy/Podman flows.
+- OTA updates now rebuild and sync the app UI containers they carry, so an updated app serves the UI image that matches its backend instead of whatever happened to be on disk.
+- LND UI port handling is aligned across all runtime specs, and release packaging moved to tarball-only payloads with the ISO build recipes archived — update payloads now carry only the files existing nodes need.
 
 
 All notable changes to Archipelago will be documented in this file.

NOTICE

@@ -57,6 +57,13 @@ ElevenLabs TTS under a commercial-use plan.
 
 ## Redistributed software (ISO and container registry)
 
+- **GitWorkshop** — https://github.com/DanConwayDev/gitworkshop — pinned at
+  `dc36db64f6a2cca29d109829eabaf0a49d4bf4da`. The upstream revision declares
+  no software license. Archipelago applies a documented integration patch and
+  redistributes the resulting static application under an explicit owner risk
+  acceptance dated 2026-09-11; this notice does not claim or grant upstream
+  copyright permission. See `docker/archipelago-source/UPSTREAM.md`.
+
 The Archipelago OS image is based on Debian and redistributes Debian packages
 (including the Linux kernel, GRUB, and non-free firmware/microcode blobs
 required for hardware support); per-package license texts are preserved at
@@ -65,7 +72,7 @@ is available via Debian (https://snapshot.debian.org) as referenced in each
 release's notes. Container images offered through the app catalog and mirror
 registry remain under their upstream licenses (including GPL/AGPL software
 such as mempool, Nextcloud, Vaultwarden, SearXNG, PhotoPrism, Immich,
-Jellyfin, MariaDB, AdGuard Home, and strfry); source links are provided in
+Jellyfin, MariaDB, and strfry); source links are provided in
 the app catalog. The modified mempool-frontend image is built from
 `docker/mempool-frontend/` in this repository (AGPL-3.0 corresponding source).
 

README.md

@@ -11,7 +11,21 @@ Podman containers managed by the Rust backend.
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Rust](https://img.shields.io/badge/rust-stable-orange)](https://www.rust-lang.org/)
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
-[![Version](https://img.shields.io/badge/version-1.8.0--alpha-blue)]()
+[![Version](https://img.shields.io/badge/version-1.8.13--alpha-blue)](https://source.archipelago-foundation.org/lfg2025/archy/releases)
+
+## Current release
+
+The current pre-release is **v1.8.13-alpha**. Release notes and signed OTA
+artifacts are published on [Gitea](https://source.archipelago-foundation.org/lfg2025/archy/releases).
+The same source is mirrored through ngit for Nostr-native cloning and
+contribution:
+
+```
+nostr://npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg/relay.ngit.dev/archy
+```
+
+Clone with ngit, or use the Gitea mirror when you need a conventional Git
+remote. Contributions should follow [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## What is here
 

aiui/packages/app/src/pages/ChatPage.vue

@@ -2,13 +2,13 @@
   <div
     class="h-full flex flex-col relative overflow-hidden transition-colors duration-300"
     :class="[]"
-    :style="isDark
-      ? { background: '#000 url(' + bgImageUrl + ') center center / cover no-repeat fixed' }
-      : isEmbedded
-        ? { background: 'transparent' }
+    :style="isEmbedded
+      ? { background: 'transparent' }
+      : isDark
+        ? { background: '#000 url(' + bgImageUrl + ') center center / cover no-repeat fixed' }
         : { backgroundColor: '#f5f4f1' }"
   >
-    <div v-if="isDark" class="absolute inset-0 pointer-events-none bg-black/20" />
+    <div v-if="isDark && !isEmbedded" class="absolute inset-0 pointer-events-none bg-black/20" />
 
     <!-- Desktop layout -->
     <div

app-catalog/README.md

@@ -34,6 +34,40 @@ Add an entry to `catalog.json`:
 For apps with hardcoded backend configs (Bitcoin, LND, etc.), `containerConfig` is optional.
 For new apps, include `containerConfig` so the backend knows how to create the container.
 
+## Storefront layout
+
+Discovery merchandising is app-registry data, not node-OS layout. The optional
+top-level `storefront` block defines the ordered Popular Apps rows and the
+promotional banners placed before the remaining `All Apps` grid:
+
+```json
+{
+  "storefront": {
+    "popular": ["bitcoin-knots", "lnd", "btcpay-server"],
+    "promotions": [{
+      "id": "my-app",
+      "banner": "/assets/img/featured/my-app.webp",
+      "eyebrow": "open source",
+      "headline": "Build together.",
+      "description": "Catalog-controlled promotional copy.",
+      "tag": "NOSTR // SOURCE",
+      "path": "/npub1maintainer/project",
+      "launchLabel": "Open",
+      "installLabel": "Install",
+      "detailsLabel": "Learn more →"
+    }]
+  }
+}
+```
+
+Only IDs present in `apps` render. An optional promotion `path` deep-links into
+the installed app; Archipelago uses this to open the canonical signed Nostr
+repository rather than GitWorkshop's generic dashboard. New dashboards prefer `storefront` from the
+daemon-verified signed catalog and use the bundled community copy as a local
+fallback. `scripts/generate-app-catalog.sh` carries this block into the signed
+release artifact; changing it does not require a node OS release once that
+artifact is published.
+
 ## Categories
 
 money, commerce, data, home, nostr, networking, community, development, l484

app-catalog/catalog.json

@@ -9,18 +9,61 @@
     "description": "Bitcoin documentaries with Nostr identity.",
     "tag": "NOSTR IDENTITY // YOUR NODE"
   },
+  "storefront": {
+    "popular": [
+      "bitcoin-knots",
+      "lnd",
+      "btcpay-server",
+      "mempool",
+      "filebrowser",
+      "homeassistant"
+    ],
+    "promotions": [
+      {
+        "id": "archipelago-source",
+        "banner": "/assets/img/featured/archipelago-source-banner.webp",
+        "eyebrow": "open source",
+        "headline": "Your node. Your source.",
+        "description": "Install GitWorkshop to browse Archipelago's code from your own node, clone it with ngit, and contribute issues, patches, and reviews over Nostr.",
+        "tag": "NGIT // NOSTR // NO SILO",
+        "path": "/npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg/relay.ngit.dev/archy",
+        "launchLabel": "Open GitWorkshop",
+        "installLabel": "Install GitWorkshop",
+        "detailsLabel": "How contribution works →"
+      }
+    ]
+  },
   "apps": [
     {
-      "id": "bitcoin-knots",
-      "title": "Bitcoin Knots",
-      "version": "28.1.0",
-      "description": "Full Bitcoin Knots node with dynamic prune/full-mode startup based on host disk.",
-      "icon": "/assets/img/app-icons/bitcoin-knots.webp",
-      "author": "Bitcoin Knots",
+      "id": "alby-hub",
+      "title": "Alby Hub",
+      "version": "1.23.0",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
+      "icon": "/assets/img/app-icons/alby-hub.svg",
+      "author": "Alby",
       "category": "money",
-      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:29.3.knots20260210",
-      "repoUrl": "https://github.com/bitcoinknots/bitcoin"
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
+      "repoUrl": "https://github.com/getAlby/hub"
+    },
+    {
+      "id": "barkd",
+      "title": "Ark Wallet",
+      "version": "0.3.0",
+      "description": "Ark protocol wallet daemon (barkd). Lets the node hold self-custodial off-chain bitcoin via an Ark server; the wallet talks to it over a local REST API. Signet by default while Ark matures.",
+      "icon": "/assets/img/app-icons/bark.png",
+      "author": "Second",
+      "category": "money",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
+      "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
+      "containerConfig": {
+        "ports": [
+          "3535:3535"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/barkd:/data"
+        ]
+      }
     },
     {
       "id": "bitcoin-core",
@@ -35,76 +78,16 @@
       "repoUrl": "https://github.com/bitcoin/bitcoin"
     },
     {
-      "id": "lnd",
-      "title": "LND",
-      "version": "0.18.4",
-      "description": "Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.",
-      "icon": "/assets/img/app-icons/lnd.png",
-      "author": "Lightning Labs",
+      "id": "bitcoin-knots",
+      "title": "Bitcoin Knots",
+      "version": "28.1.0",
+      "description": "Full Bitcoin Knots node with dynamic prune/full-mode startup based on host disk.",
+      "icon": "/assets/img/app-icons/bitcoin-knots.webp",
+      "author": "Bitcoin Knots",
       "category": "money",
       "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
-      "repoUrl": "https://github.com/lightningnetwork/lnd",
-      "requires": [
-        "bitcoin-knots"
-      ]
-    },
-    {
-      "id": "btcpay-server",
-      "title": "BTCPay Server",
-      "version": "2.4.3",
-      "description": "Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.",
-      "icon": "/assets/img/app-icons/btcpay-server.png",
-      "author": "BTCPay Server Foundation",
-      "category": "commerce",
-      "tier": "core",
-      "dockerImage": "docker.io/btcpayserver/btcpayserver:2.4.3",
-      "repoUrl": "https://github.com/btcpayserver/btcpayserver",
-      "requires": [
-        "bitcoin-knots"
-      ]
-    },
-    {
-      "id": "mempool",
-      "title": "Mempool Explorer",
-      "version": "3.0.0",
-      "description": "Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.",
-      "icon": "/assets/img/app-icons/mempool.webp",
-      "author": "Mempool",
-      "category": "money",
-      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
-      "repoUrl": "https://github.com/mempool/mempool",
-      "requires": [
-        "bitcoin-knots",
-        "electrumx"
-      ]
-    },
-    {
-      "id": "electrumx",
-      "title": "ElectrumX",
-      "version": "1.18.0",
-      "description": "Electrum server indexing Bitcoin chain data for lightweight wallet queries.",
-      "icon": "/assets/img/app-icons/electrumx.png",
-      "author": "Luke Childs",
-      "category": "money",
-      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
-      "repoUrl": "https://github.com/spesmilo/electrumx",
-      "requires": [
-        "bitcoin-knots"
-      ]
-    },
-    {
-      "id": "indeedhub",
-      "title": "IndeeHub",
-      "version": "1.0.0",
-      "description": "Bitcoin documentary streaming platform featuring God Bless Bitcoin and other educational content about Bitcoin, sovereignty, and decentralized technology. Sign in with your Nostr identity.",
-      "icon": "/assets/img/app-icons/indeedhub.png",
-      "author": "IndeeHub",
-      "category": "community",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
-      "repoUrl": "https://github.com/indeedhub/indeedhub"
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:29.3.knots20260210",
+      "repoUrl": "https://github.com/bitcoinknots/bitcoin"
     },
     {
       "id": "botfights",
@@ -132,127 +115,46 @@
       }
     },
     {
-      "id": "gitea",
-      "title": "Gitea",
-      "version": "1.23",
-      "description": "Self-hosted Git service with built-in container registry, CI/CD, and package hosting.",
-      "icon": "/assets/img/app-icons/gitea.svg",
-      "author": "Gitea",
-      "category": "development",
-      "dockerImage": "docker.io/gitea/gitea:1.23",
-      "repoUrl": "https://gitea.com",
-      "containerConfig": {
-        "ports": [
-          "3001:3000",
-          "2222:22"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/gitea/data:/data",
-          "/var/lib/archipelago/gitea/config:/etc/gitea"
-        ],
-        "env": [
-          "GITEA__database__DB_TYPE=sqlite3",
-          "GITEA__server__SSH_PORT=2222",
-          "GITEA__server__SSH_LISTEN_PORT=22",
-          "GITEA__server__LFS_START_SERVER=true",
-          "GITEA__packages__ENABLED=true",
-          "GITEA__repository__ENABLE_PUSH_CREATE_USER=true",
-          "GITEA__repository__ENABLE_PUSH_CREATE_ORG=true",
-          "GITEA__security__X_FRAME_OPTIONS="
-        ]
-      },
-      "tier": "optional"
-    },
-    {
-      "id": "filebrowser",
-      "title": "File Browser",
-      "version": "2.27.0",
-      "description": "Baseline Archipelago file manager service.",
-      "icon": "/assets/img/app-icons/file-browser.webp",
-      "author": "File Browser",
-      "category": "data",
+      "id": "btcpay-server",
+      "title": "BTCPay Server",
+      "version": "2.4.3",
+      "description": "Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.",
+      "icon": "/assets/img/app-icons/btcpay-server.png",
+      "author": "BTCPay Server Foundation",
+      "category": "commerce",
       "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
-      "repoUrl": "https://github.com/filebrowser/filebrowser",
-      "containerConfig": {
-        "ports": [
-          "8083:80"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/filebrowser:/srv",
-          "/var/lib/archipelago/filebrowser-data:/data"
-        ],
-        "args": [
-          "--database=/data/database.db",
-          "--root=/srv",
-          "--address=0.0.0.0",
-          "--port=80"
-        ]
-      }
+      "dockerImage": "docker.io/btcpayserver/btcpayserver:2.4.3",
+      "repoUrl": "https://github.com/btcpayserver/btcpayserver",
+      "requires": [
+        "bitcoin-knots"
+      ]
     },
     {
-      "id": "nostr-rs-relay",
-      "title": "Nostr Relay (Rust)",
-      "version": "0.10.0",
-      "description": "High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.",
-      "icon": "/assets/img/app-icons/nostrudel.svg",
-      "author": "Nostr RS Relay",
-      "category": "community",
-      "tier": "recommended",
-      "dockerImage": "scsibug/nostr-rs-relay:0.10.0",
-      "repoUrl": "https://github.com/scsibug/nostr-rs-relay",
-      "containerConfig": {
-        "ports": [
-          "8081:8080"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/nostr-relay:/usr/src/app/db"
-        ],
-        "env": [
-          "RELAY_NAME=Archipelago Nostr Relay",
-          "RELAY_DESCRIPTION=Self-hosted Nostr relay on Archipelago"
-        ]
-      }
+      "id": "cuprate",
+      "title": "Cuprate",
+      "version": "0.1.0-preview",
+      "description": "Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.",
+      "icon": "/assets/img/app-icons/cuprate.svg",
+      "author": "Cuprate contributors",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/cuprate:0.1.0-preview-18-g618ff14",
+      "repoUrl": "https://github.com/Cuprate/cuprate"
     },
     {
-      "id": "vaultwarden",
-      "title": "Vaultwarden",
-      "version": "1.30.0",
-      "description": "Self-hosted password vault with zero-knowledge encryption.",
-      "icon": "/assets/img/app-icons/vaultwarden.webp",
-      "author": "Vaultwarden",
-      "category": "data",
-      "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
-      "repoUrl": "https://github.com/dani-garcia/vaultwarden",
-      "containerConfig": {
-        "ports": [
-          "8082:80"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/vaultwarden:/data"
-        ]
-      }
-    },
-    {
-      "id": "searxng",
-      "title": "SearXNG",
-      "version": "1.0.0",
-      "description": "Privacy-respecting metasearch engine. Search the web without tracking.",
-      "icon": "/assets/img/app-icons/searxng.png",
-      "author": "SearXNG",
-      "category": "data",
-      "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
-      "repoUrl": "https://github.com/searxng/searxng",
-      "containerConfig": {
-        "ports": [
-          "8888:8080"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/searxng:/etc/searxng"
-        ]
-      }
+      "id": "electrumx",
+      "title": "ElectrumX",
+      "version": "1.18.0",
+      "description": "Electrum server indexing Bitcoin chain data for lightweight wallet queries.",
+      "icon": "/assets/img/app-icons/electrumx.png",
+      "author": "Luke Childs",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
+      "repoUrl": "https://github.com/spesmilo/electrumx",
+      "requires": [
+        "bitcoin-knots"
+      ]
     },
     {
       "id": "fedimint",
@@ -299,87 +201,76 @@
       }
     },
     {
-      "id": "barkd",
-      "title": "Ark Wallet",
-      "version": "0.3.0",
-      "description": "Ark protocol wallet daemon (barkd). Lets the node hold self-custodial off-chain bitcoin via an Ark server; the wallet talks to it over a local REST API. Signet by default while Ark matures.",
-      "icon": "/assets/img/app-icons/bark.png",
-      "author": "Second",
-      "category": "money",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
-      "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
+      "id": "filebrowser",
+      "title": "File Browser",
+      "version": "2.63.23",
+      "description": "Baseline Archipelago file manager service.",
+      "icon": "/assets/img/app-icons/file-browser.webp",
+      "author": "File Browser",
+      "category": "data",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23",
+      "repoUrl": "https://github.com/filebrowser/filebrowser",
       "containerConfig": {
         "ports": [
-          "3535:3535"
+          "8083:80"
         ],
         "volumes": [
-          "/var/lib/archipelago/barkd:/data"
+          "/var/lib/archipelago/filebrowser:/srv",
+          "/var/lib/archipelago/filebrowser-data:/data"
+        ],
+        "args": [
+          "--database=/data/database.db",
+          "--root=/srv",
+          "--address=0.0.0.0",
+          "--port=80"
         ]
       }
     },
     {
-      "id": "jellyfin",
-      "title": "Jellyfin",
-      "version": "10.8.13",
-      "description": "Free media server. Stream movies, music, and photos.",
-      "icon": "/assets/img/app-icons/jellyfin.webp",
-      "author": "Jellyfin",
-      "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
-      "repoUrl": "https://github.com/jellyfin/jellyfin",
+      "id": "gitea",
+      "title": "Gitea",
+      "version": "1.27.3",
+      "description": "Self-hosted Git service with built-in container registry, CI/CD, and package hosting.",
+      "icon": "/assets/img/app-icons/gitea.svg",
+      "author": "Gitea",
+      "category": "development",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gitea:1.27.3",
+      "repoUrl": "https://gitea.com",
       "containerConfig": {
         "ports": [
-          "8096:8096"
+          "3001:3000",
+          "2222:22"
         ],
         "volumes": [
-          "/var/lib/archipelago/jellyfin/config:/config",
-          "/var/lib/archipelago/jellyfin/cache:/cache"
-        ]
-      }
-    },
-    {
-      "id": "immich",
-      "title": "Immich",
-      "version": "2.7.4",
-      "description": "Self-hosted photo and video backup with mobile apps and search.",
-      "icon": "/assets/img/app-icons/immich.png",
-      "author": "Immich",
-      "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
-      "repoUrl": "https://github.com/immich-app/immich"
-    },
-    {
-      "id": "homeassistant",
-      "title": "Home Assistant",
-      "version": "2026.7.3",
-      "description": "Open source home automation platform. Control and monitor your smart home devices.",
-      "icon": "/assets/img/app-icons/homeassistant.png",
-      "author": "Home Assistant",
-      "category": "home",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
-      "repoUrl": "https://github.com/home-assistant/core",
-      "containerConfig": {
-        "ports": [
-          "8123:8123"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/home-assistant:/config"
+          "/var/lib/archipelago/gitea/data:/data",
+          "/var/lib/archipelago/gitea/config:/etc/gitea"
         ],
         "env": [
-          "TZ=UTC"
+          "GITEA__database__DB_TYPE=sqlite3",
+          "GITEA__server__SSH_PORT=2222",
+          "GITEA__server__SSH_LISTEN_PORT=22",
+          "GITEA__server__LFS_START_SERVER=true",
+          "GITEA__packages__ENABLED=true",
+          "GITEA__repository__ENABLE_PUSH_CREATE_USER=true",
+          "GITEA__repository__ENABLE_PUSH_CREATE_ORG=true",
+          "GITEA__security__X_FRAME_OPTIONS="
         ]
-      }
+      },
+      "tier": "optional"
     },
     {
-      "id": "pine",
-      "title": "Pine",
-      "version": "1.3.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
-      "icon": "/assets/img/app-icons/pine.svg",
-      "author": "Archipelago",
-      "category": "home",
-      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
-      "repoUrl": "https://github.com/rhasspy/wyoming"
+      "id": "archipelago-source",
+      "title": "GitWorkshop",
+      "version": "0.4.0",
+      "description": "Get Archipelago's source, clone it with ngit, and contribute issues, patches, and reviews over Nostr using the upstream GitWorkshop client.",
+      "icon": "/assets/img/app-icons/gitworkshop-dc36db6.svg",
+      "author": "GitWorkshop contributors",
+      "maintainerNpub": "npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg",
+      "category": "development",
+      "tier": "optional",
+      "repoUrl": "https://github.com/DanConwayDev/gitworkshop",
+      "dockerImage": "localhost/archipelago-source:local"
     },
     {
       "id": "grafana",
@@ -405,6 +296,279 @@
         ]
       }
     },
+    {
+      "id": "homeassistant",
+      "title": "Home Assistant",
+      "version": "2026.8.3",
+      "description": "Open source home automation platform. Control and monitor your smart home devices.",
+      "icon": "/assets/img/app-icons/homeassistant.png",
+      "author": "Home Assistant",
+      "category": "home",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3",
+      "repoUrl": "https://github.com/home-assistant/core",
+      "containerConfig": {
+        "ports": [
+          "8123:8123"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/home-assistant:/config"
+        ],
+        "env": [
+          "TZ=UTC"
+        ]
+      }
+    },
+    {
+      "id": "immich",
+      "title": "Immich",
+      "version": "2.7.4",
+      "description": "Self-hosted photo and video backup with mobile apps and search.",
+      "icon": "/assets/img/app-icons/immich.png",
+      "author": "Immich",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
+      "repoUrl": "https://github.com/immich-app/immich"
+    },
+    {
+      "id": "indeedhub",
+      "title": "IndeeHub",
+      "version": "1.0.0",
+      "description": "Bitcoin documentary streaming platform featuring God Bless Bitcoin and other educational content about Bitcoin, sovereignty, and decentralized technology. Sign in with your Nostr identity.",
+      "icon": "/assets/img/app-icons/indeedhub.png",
+      "author": "IndeeHub",
+      "category": "community",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
+      "repoUrl": "https://github.com/indeedhub/indeedhub"
+    },
+    {
+      "id": "jellyfin",
+      "title": "Jellyfin",
+      "version": "10.8.13",
+      "description": "Free media server. Stream movies, music, and photos.",
+      "icon": "/assets/img/app-icons/jellyfin.webp",
+      "author": "Jellyfin",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
+      "repoUrl": "https://github.com/jellyfin/jellyfin",
+      "containerConfig": {
+        "ports": [
+          "8096:8096"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/jellyfin/config:/config",
+          "/var/lib/archipelago/jellyfin/cache:/cache"
+        ]
+      }
+    },
+    {
+      "id": "lnd",
+      "title": "LND",
+      "version": "0.21.2",
+      "description": "Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.",
+      "icon": "/assets/img/app-icons/lnd.png",
+      "author": "Lightning Labs",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta",
+      "repoUrl": "https://github.com/lightningnetwork/lnd",
+      "requires": [
+        "bitcoin-knots"
+      ]
+    },
+    {
+      "id": "mempool",
+      "title": "Mempool Explorer",
+      "version": "3.3.1-archy1",
+      "description": "Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.",
+      "icon": "/assets/img/app-icons/mempool.webp",
+      "author": "Mempool",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/chaum/mempool-frontend:v3.3.1-archy1",
+      "repoUrl": "https://github.com/mempool/mempool",
+      "requires": [
+        "bitcoin-knots",
+        "electrumx"
+      ]
+    },
+    {
+      "id": "netbird",
+      "title": "NetBird",
+      "version": "2.38.0",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
+      "icon": "/assets/img/app-icons/netbird.svg",
+      "author": "NetBird",
+      "category": "networking",
+      "tier": "recommended",
+      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
+      "repoUrl": "https://github.com/netbirdio/netbird",
+      "containerConfig": {
+        "ports": [
+          "8087:80",
+          "8086:80",
+          "3478:3478/udp"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/netbird:/var/lib/netbird"
+        ],
+        "notes": "Installed as a two-container stack: netbird dashboard on 8087 and netbird-server control plane on 8086 plus UDP 3478. For production clients, publish a DNS name over HTTPS with gRPC/WebSocket routing."
+      }
+    },
+    {
+      "id": "nextcloud",
+      "title": "Nextcloud",
+      "version": "29",
+      "description": "Your own private cloud. File sync, calendars, contacts.",
+      "icon": "/assets/img/app-icons/nextcloud.webp",
+      "author": "Nextcloud",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
+      "repoUrl": "https://github.com/nextcloud/server",
+      "containerConfig": {
+        "ports": [
+          "8085:80"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/nextcloud:/var/www/html"
+        ]
+      }
+    },
+    {
+      "id": "nginx-proxy-manager",
+      "title": "Nginx Proxy Manager",
+      "version": "2.12.1",
+      "description": "Reverse proxy with SSL. Beautiful web interface for managing proxies. On a node, this manages its admin UI and upstream configuration — the proxy's own :80/:443 listeners are not published (the node's web server owns those ports).",
+      "icon": "/assets/img/app-icons/nginx.svg",
+      "author": "Nginx Proxy Manager",
+      "category": "networking",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest",
+      "repoUrl": "https://github.com/NginxProxyManager/nginx-proxy-manager"
+    },
+    {
+      "id": "nostr-rs-relay",
+      "title": "Nostr Relay (Rust)",
+      "version": "0.10.0",
+      "description": "High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.",
+      "icon": "/assets/img/app-icons/nostrudel.svg",
+      "author": "Nostr RS Relay",
+      "category": "community",
+      "tier": "recommended",
+      "dockerImage": "scsibug/nostr-rs-relay:0.10.0",
+      "repoUrl": "https://github.com/scsibug/nostr-rs-relay",
+      "containerConfig": {
+        "ports": [
+          "8081:8080"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/nostr-relay:/usr/src/app/db"
+        ],
+        "env": [
+          "RELAY_NAME=Archipelago Nostr Relay",
+          "RELAY_DESCRIPTION=Self-hosted Nostr relay on Archipelago"
+        ]
+      }
+    },
+    {
+      "id": "ollama",
+      "title": "Ollama",
+      "version": "0.5.4",
+      "description": "Run large language models locally. Download and run AI models like Llama, Mistral on your own hardware — served on the node's loopback for the AI assistant (Settings → Claude Auth → model backend), never exposed to the network.",
+      "icon": "/assets/img/app-icons/ollama.png",
+      "author": "Ollama",
+      "category": "community",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/ollama:latest",
+      "repoUrl": "https://github.com/ollama/ollama"
+    },
+    {
+      "id": "phoenixd",
+      "title": "phoenixd",
+      "version": "0.9.0",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "icon": "/assets/img/app-icons/phoenixd.svg",
+      "author": "ACINQ",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/phoenixd:0.9.0",
+      "repoUrl": "https://github.com/ACINQ/phoenixd"
+    },
+    {
+      "id": "photoprism",
+      "title": "PhotoPrism",
+      "version": "240915",
+      "description": "AI-powered photo management with facial recognition.",
+      "icon": "/assets/img/app-icons/photoprism.svg",
+      "author": "PhotoPrism",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
+      "repoUrl": "https://github.com/photoprism/photoprism",
+      "containerConfig": {
+        "ports": [
+          "2342:2342"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/photoprism:/photoprism/storage"
+        ],
+        "env": [
+          "PHOTOPRISM_ADMIN_PASSWORD=archipelago",
+          "PHOTOPRISM_DEFAULT_LOCALE=en"
+        ]
+      }
+    },
+    {
+      "id": "pine",
+      "title": "Pine",
+      "version": "1.3.0",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
+      "icon": "/assets/img/app-icons/pine.svg",
+      "author": "Archipelago",
+      "category": "home",
+      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
+      "repoUrl": "https://github.com/rhasspy/wyoming"
+    },
+    {
+      "id": "portainer",
+      "title": "Portainer",
+      "version": "2.45.0",
+      "description": "Container management web UI for the local Podman socket.",
+      "icon": "/assets/img/app-icons/portainer.webp",
+      "author": "Portainer",
+      "category": "development",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.45.0",
+      "repoUrl": "https://github.com/portainer/portainer",
+      "containerConfig": {
+        "ports": [
+          "9000:9000"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/portainer:/data",
+          "/run/user/1000/podman/podman.sock:/var/run/docker.sock"
+        ],
+        "notes": "Uses the manifest-owned Podman socket bind mount preparation path."
+      }
+    },
+    {
+      "id": "searxng",
+      "title": "SearXNG",
+      "version": "1.0.0",
+      "description": "Privacy-respecting metasearch engine. Search the web without tracking.",
+      "icon": "/assets/img/app-icons/searxng.png",
+      "author": "SearXNG",
+      "category": "data",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
+      "repoUrl": "https://github.com/searxng/searxng",
+      "containerConfig": {
+        "ports": [
+          "8888:8080"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/searxng:/etc/searxng"
+        ]
+      }
+    },
     {
       "id": "tailscale",
       "title": "Tailscale",
@@ -433,51 +597,6 @@
         ]
       }
     },
-    {
-      "id": "portainer",
-      "title": "Portainer",
-      "version": "2.19.4",
-      "description": "Container management web UI for the local Podman socket.",
-      "icon": "/assets/img/app-icons/portainer.webp",
-      "author": "Portainer",
-      "category": "development",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
-      "repoUrl": "https://github.com/portainer/portainer",
-      "containerConfig": {
-        "ports": [
-          "9000:9000"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/portainer:/data",
-          "/run/user/1000/podman/podman.sock:/var/run/docker.sock"
-        ],
-        "notes": "Uses the manifest-owned Podman socket bind mount preparation path."
-      }
-    },
-    {
-      "id": "netbird",
-      "title": "NetBird",
-      "version": "2.38.0",
-      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
-      "icon": "/assets/img/app-icons/netbird.svg",
-      "author": "NetBird",
-      "category": "networking",
-      "tier": "recommended",
-      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
-      "repoUrl": "https://github.com/netbirdio/netbird",
-      "containerConfig": {
-        "ports": [
-          "8087:80",
-          "8086:80",
-          "3478:3478/udp"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/netbird:/var/lib/netbird"
-        ],
-        "notes": "Installed as a two-container stack: netbird dashboard on 8087 and netbird-server control plane on 8086 plus UDP 3478. For production clients, publish a DNS name over HTTPS with gRPC/WebSocket routing."
-      }
-    },
     {
       "id": "uptime-kuma",
       "title": "Uptime Kuma",
@@ -507,82 +626,24 @@
       }
     },
     {
-      "id": "photoprism",
-      "title": "PhotoPrism",
-      "version": "240915",
-      "description": "AI-powered photo management with facial recognition.",
-      "icon": "/assets/img/app-icons/photoprism.svg",
-      "author": "PhotoPrism",
+      "id": "vaultwarden",
+      "title": "Vaultwarden",
+      "version": "1.37.2",
+      "description": "Self-hosted password vault with zero-knowledge encryption.",
+      "icon": "/assets/img/app-icons/vaultwarden.webp",
+      "author": "Vaultwarden",
       "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
-      "repoUrl": "https://github.com/photoprism/photoprism",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine",
+      "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
-          "2342:2342"
+          "8082:80"
         ],
         "volumes": [
-          "/var/lib/archipelago/photoprism:/photoprism/storage"
-        ],
-        "env": [
-          "PHOTOPRISM_ADMIN_PASSWORD=archipelago",
-          "PHOTOPRISM_DEFAULT_LOCALE=en"
+          "/var/lib/archipelago/vaultwarden:/data"
         ]
       }
-    },
-    {
-      "id": "nextcloud",
-      "title": "Nextcloud",
-      "version": "29",
-      "description": "Your own private cloud. File sync, calendars, contacts.",
-      "icon": "/assets/img/app-icons/nextcloud.webp",
-      "author": "Nextcloud",
-      "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
-      "repoUrl": "https://github.com/nextcloud/server",
-      "containerConfig": {
-        "ports": [
-          "8085:80"
-        ],
-        "volumes": [
-          "/var/lib/archipelago/nextcloud:/var/www/html"
-        ]
-      }
-    },
-    {
-      "id": "alby-hub",
-      "title": "Alby Hub",
-      "version": "1.23.0",
-      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
-      "icon": "/assets/img/app-icons/alby-hub.svg",
-      "author": "Alby",
-      "category": "money",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
-      "repoUrl": "https://github.com/getAlby/hub"
-    },
-    {
-      "id": "phoenixd",
-      "title": "phoenixd",
-      "version": "0.9.0",
-      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
-      "icon": "/assets/img/app-icons/phoenixd.svg",
-      "author": "ACINQ",
-      "category": "money",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/phoenixd:0.9.0",
-      "repoUrl": "https://github.com/ACINQ/phoenixd"
-    },
-    {
-      "id": "cuprate",
-      "title": "Cuprate",
-      "version": "0.1.0-preview",
-      "description": "Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.",
-      "icon": "/assets/img/app-icons/cuprate.svg",
-      "author": "Cuprate contributors",
-      "category": "money",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/cuprate:0.1.0-preview-18-g618ff14",
-      "repoUrl": "https://github.com/Cuprate/cuprate"
     }
   ]
 }

apps/PORTS.md

@@ -25,6 +25,7 @@ This document lists all port assignments for Archipelago apps.
 | did-wallet | 8083 | TCP | Web UI | 18083 |
 | router | 8084, 5353, 1900 | TCP/UDP | Web UI, mDNS, SSDP | 18084, 15353, 11900 |
 | meshtastic | 4403, 1883 | TCP | HTTP API, MQTT | 14403, 11883 |
+| archipelago-source | 8337 | TCP | Authenticated source UI | 18337 |
 
 ## Development Ports (Offset: +10000)
 
@@ -53,6 +54,7 @@ In development mode, all ports are offset by 10000 to avoid conflicts with produ
 | DID Wallet | http://localhost:18083 |
 | Router | http://localhost:18084 |
 | Meshtastic | http://localhost:14403 |
+| GitWorkshop | http://localhost:18337 |
 
 ## Port Conflict Resolution
 

apps/archipelago-source/manifest.yml

@@ -0,0 +1,80 @@
+app:
+  id: archipelago-source
+  name: GitWorkshop
+  version: 0.4.0
+  upstream:
+    kind: github
+    repo: DanConwayDev/gitworkshop
+  description: >-
+    Get Archipelago's source, clone it with ngit, and contribute issues,
+    patches, and reviews over Nostr using the upstream GitWorkshop client.
+  category: development
+
+  container:
+    build:
+      context: /opt/archipelago/docker/archipelago-source
+      dockerfile: Dockerfile
+      tag: localhost/archipelago-source:local
+
+  resources:
+    cpu_limit: 1
+    memory_limit: 64Mi
+    disk_limit: 64Mi
+
+  security:
+    capabilities: []
+    readonly_root: true
+    no_new_privileges: true
+    network_policy: host
+
+  ports:
+    - host: 8337
+      container: 8337
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      session_passthrough: true
+
+  volumes:
+    - type: tmpfs
+      target: /tmp
+      tmpfs_options: rw,noexec,nosuid,size=16m,mode=1777
+
+  environment: []
+
+  health_check:
+    type: http
+    endpoint: http://127.0.0.1:8337
+    path: /healthz
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: GitWorkshop
+      description: NIP-34 repository browser, issues, pull requests, and review
+      type: ui
+      port: 8337
+      protocol: http
+      path: /
+
+  metadata:
+    # Versioned filename deliberately invalidates dashboard/browser icon caches
+    # when the Source prototype is replaced by the upstream GitWorkshop mark.
+    icon: /assets/img/app-icons/gitworkshop-dc36db6.svg
+    author: GitWorkshop contributors
+    repo: https://github.com/DanConwayDev/gitworkshop
+    maintainer_npub: npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg
+    tier: optional
+    launch:
+      # GitWorkshop is top-level in Companion's native in-app WebView. Its
+      # injected NIP-07 provider creates the authenticated dashboard-origin
+      # signer broker itself, so no dashboard parent frame is required.
+      requires_host_frame: false
+    features:
+      - NIP-34 repository discovery and browsing
+      - Bandwidth-efficient Git explorer over GRASP
+      - Nostr issues, pull requests, and code review
+      - NIP-07 extension and NIP-46 remote-signer support
+      - Archipelago node identity through explicit signing consent

apps/archy-mempool-web/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: archy-mempool-web
   name: Mempool Web
-  version: 3.0.1
+  version: 3.3.1-archy1
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -12,7 +12,7 @@ app:
   container_name: mempool
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1
+    image: source.archipelago-foundation.org/chaum/mempool-frontend:v3.3.1-archy1
     pull_policy: if-not-present
     network: archy-net
 
@@ -45,7 +45,9 @@ app:
     # first, but nginx binds 0.0.0.0:8080 (IPv4) only -> localhost probe gets
     # "connection refused" -> perpetual unhealthy -> health_monitor restart loop.
     endpoint: http://127.0.0.1:8080
-    path: /
+    # Probe the backend through nginx: a static page can be healthy while
+    # every API/WebSocket request is stuck on a dead backend address.
+    path: /api/v1/backend-info
     interval: 30s
     timeout: 5s
     retries: 3

apps/cuprate-ui/manifest.yml

@@ -0,0 +1,67 @@
+app:
+  id: cuprate-ui
+  name: Cuprate UI
+  version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
+  description: |
+    Archipelago-native HTTP frontend for the Cuprate Monero node. Runs nginx
+    inside a container, serves a static status dashboard, and proxies
+    /cuprate-rpc/ to the cuprate restricted RPC on 127.0.0.1:18090 (the
+    published host port for the container's 18089). No credentials are
+    injected — the restricted RPC is Monero's own safe-for-public subset — so
+    the nginx.conf is baked into the image and there is no rendered-config
+    bind-mount like bitcoin-ui's.
+
+  container:
+    build:
+      context: /opt/archipelago/docker/cuprate-ui
+      dockerfile: Dockerfile
+      tag: localhost/cuprate-ui:local
+
+  dependencies:
+    - app_id: cuprate
+
+  resources:
+    memory_limit: 64Mi
+
+  security:
+    readonly_root: false
+    network_policy: host
+
+  # Host networking: nginx listens on 18091 directly on the host IP.
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate would have no
+  # idea the port existed: neither protected nor listed as unprotected.
+  ports:
+    - host: 18091
+      container: 18091
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
+
+  volumes: []
+
+  environment: []
+
+  health_check:
+    type: http
+    endpoint: http://127.0.0.1:18091
+    path: /
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  metadata:
+    icon: /assets/img/app-icons/cuprate.svg
+    category: money
+    tier: optional
+    author: Archipelago
+    repo: https://github.com/Cuprate/cuprate

apps/cuprate/manifest.yml

@@ -15,11 +15,6 @@ app:
   description: Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.
   category: money
 
-  metadata:
-    icon: /assets/img/app-icons/cuprate.svg
-    repo: https://github.com/Cuprate/cuprate
-    tier: optional
-
   container:
     # Built from the upstream Dockerfile at the tip of main, 18 commits past
     # the cuprated-0.1.0-preview tag (commit 618ff14, 2026-08-19) — there is
@@ -41,17 +36,38 @@ app:
     data_uid: "1000:1000"
 
   dependencies:
-    # Monero mainnet is ~250GiB unpruned as of 2026 and growing a few GB a
-    # month; cuprated's pruning support is not confirmed stable yet (the
-    # `pruning` crate exists in the workspace but nothing in this config
-    # surface toggles it), so this sizes for a full unpruned chain plus
-    # headroom rather than assuming pruning is available.
-    - storage: 300Gi
+    # Monero mainnet is ~250GiB unpruned as of 2026 and growing ~60GiB/year.
+    # Verified against upstream main (binaries/cuprated/src/config.rs, 2026-09):
+    # cuprated has NO on-disk pruning setting of any kind — the `pruning`
+    # crate in its workspace is Monero's p2p *protocol* pruning, not a
+    # smaller chain — so unlike bitcoin-knots this app CANNOT self-prune
+    # when disk is scarce (see the DISK_GB branch in
+    # apps/bitcoin-knots/manifest.yml). Left running on a too-small disk it
+    # syncs until the filesystem fills and takes Archipelago down. The
+    # disk-scarce equivalent is enforced in Rust instead: install, start,
+    # restart and update refuse, and boot reconcile skips, on any node under
+    # CUPRATE_MIN_DISK_GB (450GB — chain + headroom; refuses the 250GB VPS
+    # class, allows 500GB-class disks). If upstream ever ships a prune flag,
+    # replace that gate with the bitcoin-style entrypoint branch.
+    #
+    # 450Gi, not the chain size (~250GiB): every manifest-driven surface
+    # (store size display, install pre-checks, docs) must show the number the
+    # Rust gate actually enforces, or a user provisioned to the displayed
+    # value gets refused at a different, unexplained one. Single source of
+    # truth is crate::constants::CUPRATE_MIN_DISK_GB — keep in lockstep.
+    - storage: 450Gi
 
   resources:
     cpu_limit: 0
-    memory_limit: 4Gi
-    disk_limit: 300Gi
+    # Raised from 4Gi alongside target_max_memory below (see files[] comment)
+    # — 2026-09-03 incident: a 4Gi/3GB-cache config starved
+    # cuprated's DB cache into constant eviction/flush, driving 45% sustained
+    # CPU and ~595GB/24h of block I/O on a fully-synced node. 10Gi leaves
+    # headroom above the 8GiB cache for the process itself.
+    memory_limit: 10Gi
+    # Matches the storage dependency above (= the enforced disk floor),
+    # not the raw chain size — see the CUPRATE_MIN_DISK_GB note.
+    disk_limit: 450Gi
 
   security:
     # FROM scratch, no package manager/shell, ownership fixed at build time
@@ -87,17 +103,21 @@ app:
     # bind without an explicit i_know_what_im_doing override.
     # Restricted RPC: Monero's own purpose-built safe-for-public subset —
     # what wallets use when connecting to a "remote node". Disabled by
-    # cuprated's own default; enabled via files[] below. A dashboard login
-    # would break wallet clients connecting programmatically, same
-    # reasoning as electrumx's port. The daemon still uses its canonical
-    # container port 18089, but Penpot already owns host port 18089, so this
-    # maps the public host port to the free 18090 instead.
+    # cuprated's own default; enabled via files[] below. `open`, not `gated`:
+    # the gate still takes the port over (loopback pin, external binds,
+    # fronts the Tor onion) but skips the dashboard login challenge, same
+    # reasoning as electrumx's port — wallet clients (Feather,
+    # monero-wallet-rpc, GUI) speak plain HTTP JSON-RPC programmatically and
+    # cannot complete a browser login or hold a session cookie. The daemon
+    # still uses its canonical container port 18089, but Penpot already owns
+    # host port 18089, so this maps the public host port to the free 18090
+    # instead.
     - host: 18090
       container: 18089
       protocol: tcp
-      auth: none
+      auth: open
       auth_rationale: >-
-        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.
+        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.
 
   volumes:
     - type: bind
@@ -108,11 +128,23 @@ app:
   # Settings that need to differ from cuprated's own documented defaults
   # (verified against `cuprated --generate-config` and `--dry-run` locally,
   # 2026-08-21):
+  #   - fast_sync: cuprated's own default is false, which performs full
+  #     cryptographic verification (ring signatures + RandomX PoW) on every
+  #     incoming block instead of trusting checkpointed history. Root-caused
+  #     2026-09-03 as the dominant cause of a sustained 45% CPU node,
+  #     vs. 2.8% on a reference node with fast_sync = true — same chain height, same
+  #     block rate. Set explicitly rather than relying on the binary
+  #     default so fresh deploys don't silently regress into full-verify.
   #   - target_max_memory: cuprated's own default auto-detects total *host*
   #     RAM via sysinfo, which inside a memory-limited container would let
   #     it size caches far past what resources.memory_limit above actually
   #     grants — same class of problem bitcoin-knots' -dbcache sizing
-  #     comment addresses. Set explicitly, comfortably under the 4Gi limit.
+  #     comment addresses. Set explicitly, comfortably under the 10Gi limit.
+  #     Previously 3000000000 (~2.8GiB); that starved the DB cache and
+  #     forced constant eviction/flush (595GB/24h block I/O on a node just
+  #     appending ~2MB blocks every 2 minutes) — raised to 8GiB, matching
+  #     the healthy reference node, and
+  #     resources.memory_limit above raised in step to keep headroom above it.
   #   - rpc.restricted.enable: cuprated ships this off by default; flip on
   #     so the auth:none host port above actually serves something instead
   #     of refusing every connection. port stays at its documented default
@@ -130,14 +162,34 @@ app:
   #     uses for its own RPC port (-rpcbind=0.0.0.0:8332 internally, gate
   #     restricts it externally) — not a new risk, the same one already
   #     reviewed and accepted for Bitcoin's RPC.
+  #   - tracing.stdout.level / tracing.file.{level,max_log_files}: an
+  #     operator reading Cuprated.toml on disk should be able to see and
+  #     tune the log level directly instead of the file silently omitting
+  #     the whole [tracing] table (verified live on the affected node
+  #     2026-09-01: the deployed file had no [tracing] section at all, and
+  #     the level was only discoverable by running `cuprated
+  #     --generate-config` and diffing). file.level is set to "info", NOT
+  #     cuprated's own raw default of "debug" — matches the reference dev
+  #     config this app was built and tested against (verified 2026-09-01),
+  #     which deliberately runs file logging quieter
+  #     than the binary default. max_log_files similarly follows that
+  #     reference (14, not the binary default of 7).
   files:
     - path: /var/lib/archipelago/cuprate/Cuprated.toml
       content: |
         network = "Mainnet"
-        target_max_memory = 3000000000
+        fast_sync = true
+        target_max_memory = 8589934592
 
         [rpc.restricted]
         enable = true
+
+        [tracing.stdout]
+        level = "info"
+
+        [tracing.file]
+        level = "info"
+        max_log_files = 14
       overwrite: false
 
   health_check:

apps/did-wallet/.dockerignore

@@ -1,6 +0,0 @@
-node_modules
-dist
-*.log
-.git
-.gitignore
-README.md

apps/did-wallet/Dockerfile

@@ -1,39 +0,0 @@
-FROM node:20-alpine AS builder
-
-WORKDIR /app
-
-# Copy package files
-COPY package*.json ./
-RUN npm ci
-
-# Copy source code
-COPY . .
-
-# Build the application
-RUN npm run build
-
-# Production stage
-FROM node:20-alpine
-
-WORKDIR /app
-
-# Copy built application
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/package.json ./
-COPY --from=builder /app/public ./public
-
-# Create non-root user
-RUN addgroup -g 1000 appuser && \
-    adduser -D -u 1000 -G appuser appuser && \
-    mkdir -p /app/wallet && \
-    chown -R appuser:appuser /app
-
-USER appuser
-
-EXPOSE 8080
-
-ENV WALLET_STORAGE=/app/wallet
-ENV DWN_ENDPOINT=http://web5-dwn:3000
-
-CMD ["node", "dist/index.js"]

apps/did-wallet/README.md

@@ -1,35 +0,0 @@
-# DID Wallet
-
-Web5 wallet with Decentralized Identifier (DID) support.
-
-## Building
-
-```bash
-# From the apps directory
-./build.sh did-wallet
-
-# Or manually
-cd did-wallet
-docker build -t archipelago/did-wallet:latest .
-```
-
-## Development
-
-```bash
-cd did-wallet
-npm install
-npm run dev
-```
-
-## Ports
-
-- **8083**: Web UI (dev: 18083)
-
-## Running Locally
-
-```bash
-docker run -p 8083:8080 \
-  -v /tmp/archipelago-dev/did-wallet:/app/wallet \
-  -e DWN_ENDPOINT=http://localhost:13000 \
-  archipelago/did-wallet:latest
-```

apps/did-wallet/manifest.yml

@@ -1,59 +0,0 @@
-app:
-  id: did-wallet
-  name: Web5 DID Wallet
-  version: 1.0.0
-  # Built by this project — there is no upstream release feed to watch.
-  upstream:
-    kind: internal
-  description: Web5 wallet with Decentralized Identifier (DID) support. Manage your digital identity and Web5 assets.
-  
-  container:
-    image: archipelago/did-wallet:1.0.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - storage: 2Gi
-    
-  resources:
-    cpu_limit: 1
-    memory_limit: 512Mi
-    disk_limit: 2Gi
-    
-  security:
-    capabilities: []
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: did-wallet
-    
-  ports:
-    - host: 8088
-      container: 8080
-      protocol: tcp  # Web UI
-      bind: 127.0.0.1
-      auth: gated
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/did-wallet
-      target: /app/wallet
-      options: [rw]
-      
-  environment:
-    - WALLET_STORAGE=/app/wallet
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /health
-    interval: 30s
-    timeout: 5s
-    retries: 3
-    
-  web5_integration:
-    did_support: true
-    wallet_functionality: true
-    bitcoin_integration: true

apps/did-wallet/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "did-wallet",
-  "version": "1.0.0",
-  "description": "Web5 DID Wallet for Archipelago",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts"
-  },
-  "dependencies": {
-    "express": "^4.18.2",
-    "@web5/api": "^0.9.0"
-  },
-  "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.10.0",
-    "typescript": "^5.3.3",
-    "ts-node": "^10.9.2"
-  }
-}

apps/did-wallet/public/index.html

@@ -1,23 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>DID Wallet</title>
-    <style>
-        body {
-            font-family: system-ui, -apple-system, sans-serif;
-            max-width: 800px;
-            margin: 0 auto;
-            padding: 20px;
-        }
-    </style>
-</head>
-<body>
-    <h1>Web5 DID Wallet</h1>
-    <p>Decentralized Identity Wallet for Archipelago</p>
-    <div id="app">
-        <p>Wallet interface coming soon...</p>
-    </div>
-</body>
-</html>

apps/did-wallet/src/index.ts

@@ -1,37 +0,0 @@
-import express from 'express';
-
-const app = express();
-const port = 8080;
-
-// Middleware
-app.use(express.json());
-app.use(express.static('public'));
-
-// Health check endpoint
-app.get('/health', (req, res) => {
-  res.json({ status: 'ok', service: 'did-wallet' });
-});
-
-// Wallet API endpoints
-app.get('/api/wallet/info', (req, res) => {
-  res.json({
-    status: 'ok',
-    wallet: {
-      dids: [],
-      balance: 0
-    }
-  });
-});
-
-app.post('/api/wallet/did/create', async (req, res) => {
-  // Placeholder for DID creation
-  res.json({
-    status: 'ok',
-    did: 'did:key:placeholder'
-  });
-});
-
-// Start server
-app.listen(port, '0.0.0.0', () => {
-  console.log(`DID Wallet listening on port ${port}`);
-});

apps/did-wallet/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "lib": ["ES2020"],
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

apps/filebrowser/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: filebrowser
   name: File Browser
-  version: 2.27.0
+  version: 2.63.23
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Baseline Archipelago file manager service.
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23
     pull_policy: if-not-present
     network: archy-net
     custom_args: ["--config", "/data/.filebrowser.json"]

apps/gitea/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: gitea
   name: Gitea
-  version: "1.23"
+  version: "1.27.3"
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -12,15 +12,17 @@ app:
   category: development
 
   container:
-    image: docker.io/gitea/gitea:1.23
+    image: source.archipelago-foundation.org/lfg2025/gitea:1.27.3
     pull_policy: if-not-present
 
   dependencies:
-    - storage: 500Mi
+    # Source history, LFS objects, release artifacts and OCI layers all share
+    # this persistent store. 500Mi was only suitable for an empty demo node.
+    - storage: 50Gi
 
   resources:
     memory_limit: 256Mi
-    disk_limit: 500Mi
+    disk_limit: 50Gi
 
   security:
     capabilities: [CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE]
@@ -66,6 +68,12 @@ app:
     - GITEA__server__SSH_LISTEN_PORT=22
     - GITEA__server__LFS_START_SERVER=true
     - GITEA__packages__ENABLED=true
+    # Package/LFS storage remains bounded by the node's disk, not an arbitrary
+    # per-owner quota. Release artifacts allow installer/OTA images up to 10GiB.
+    - GITEA__packages__LIMIT_TOTAL_OWNER_SIZE=-1
+    - GITEA__packages__LIMIT_SIZE_CONTAINER=-1
+    - GITEA__repository_0x2Erelease__FILE_MAX_SIZE=10240
+    - GITEA__repository_0x2Erelease__MAX_FILES=20
     - GITEA__repository__ENABLE_PUSH_CREATE_USER=true
     - GITEA__repository__ENABLE_PUSH_CREATE_ORG=true
 

apps/home-assistant/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: homeassistant
   name: Home Assistant
-  version: 2026.7.3
+  version: 2026.8.3
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Open source home automation platform. Control and monitor your smart home devices.
   
   container:
-    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3
     pull_policy: if-not-present
     network: pasta
     

apps/indeedhub-api/manifest.yml

@@ -19,14 +19,15 @@ app:
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [api]
-    # The JWT signing secret is owned here (no backend container owns it); the
-    # db + minio passwords are owned by indeedhub-postgres / indeedhub-minio and
-    # only consumed here. ensure_generated_secrets no-ops when a file already
-    # exists, so live values on .228 are preserved (postgres pw is fixed at
-    # PGDATA init — regenerating would lock the API out).
+    # The JWT signing secret and stable envelope-encryption root are owned here;
+    # the db + minio passwords are owned by indeedhub-postgres / indeedhub-minio
+    # and only consumed here. Existing nodes migrate the legacy AES value into
+    # the secret file once, while fresh nodes receive a unique per-node value.
     generated_secrets:
       - name: indeedhub-jwt
         kind: hex32
+      - name: indeedhub-aes-master
+        kind: hex16
     secret_env:
       - key: DATABASE_PASSWORD
         secret_file: indeedhub-db-password
@@ -34,6 +35,8 @@ app:
         secret_file: indeedhub-minio-password
       - key: NOSTR_JWT_SECRET
         secret_file: indeedhub-jwt
+      - key: AES_MASTER_SECRET
+        secret_file: indeedhub-aes-master
 
   dependencies:
     - app_id: indeedhub-postgres
@@ -67,9 +70,6 @@ app:
     - S3_PRIVATE_BUCKET_NAME=indeedhub-private
     - S3_PUBLIC_BUCKET_URL=/storage
     - NOSTR_JWT_EXPIRES_IN=7d
-    # Fixed across the fleet (envelope-encryption master key baked by the legacy
-    # installer); not node-specific, so a plain env literal, not a secret.
-    - AES_MASTER_SECRET=0123456789abcdef0123456789abcdef
     - ENVIRONMENT=production
 
   health_check:

apps/indeedhub-ffmpeg/manifest.yml

@@ -22,6 +22,8 @@ app:
         secret_file: indeedhub-db-password
       - key: AWS_SECRET_KEY
         secret_file: indeedhub-minio-password
+      - key: AES_MASTER_SECRET
+        secret_file: indeedhub-aes-master
 
   dependencies:
     - app_id: indeedhub-api
@@ -51,4 +53,3 @@ app:
     - S3_PUBLIC_BUCKET_NAME=indeedhub-public
     - S3_PRIVATE_BUCKET_NAME=indeedhub-private
     - ENVIRONMENT=production
-    - AES_MASTER_SECRET=0123456789abcdef0123456789abcdef

apps/indeedhub/manifest.yml

@@ -69,7 +69,10 @@ app:
       - copy_from_host:
           src: "web-ui/nostr-provider.js"
           dest: "/usr/share/nginx/html/nostr-provider.js"
+      - exec: ["sh", "-c", "grep -qF 'location = /nostr-provider.js {' /etc/nginx/conf.d/default.conf || sed -i '/location = \/sw.js {/i\\    location = /nostr-provider.js {\\n        add_header Cache-Control \"no-cache, no-store, must-revalidate\";\\n        expires off;\\n    }\\n' /etc/nginx/conf.d/default.conf"]
       - exec: ["sh", "-c", "grep -q nostr-provider /etc/nginx/conf.d/default.conf || sed -i 's#</head>#<script src=\"/nostr-provider.js\"></script></head>#' /etc/nginx/conf.d/default.conf"]
+      - exec: ["sed", "-i", "s#tab-signer-v2#tab-signer-v4#g; s#tab-signer-v3#tab-signer-v4#g", "/etc/nginx/conf.d/default.conf"]
+      - exec: ["sed", "-i", "s#src=\"/nostr-provider.js\"#src=\"/nostr-provider.js?v=tab-signer-v4\"#g", "/etc/nginx/conf.d/default.conf"]
       - exec: ["nginx", "-s", "reload"]
 
   # TCP liveness on the nginx port, NOT an http GET of /. nginx binds 7777 at

apps/lightning-stack/Dockerfile

@@ -1,5 +0,0 @@
-# Lightning Stack - uses official image
-FROM lightninglabs/lightning-stack:v0.12.0
-
-# Default configuration is in the image
-# No additional setup needed

apps/lightning-stack/manifest.yml

@@ -1,85 +0,0 @@
-app:
-  id: lightning-stack
-  name: Lightning Stack
-  version: 0.12.0
-  # No public listing exists for lightninglabs/lightning-stack (checked
-  # docker.io, ghcr.io and github.com) — nothing can be queried automatically,
-  # so this one is tracked by hand.
-  upstream:
-    kind: manual
-    url: no public listing for lightninglabs/lightning-stack — verify by hand
-  description: Complete Lightning Network implementation. Includes LND, CLN, and management tools.
-  
-  container:
-    image: lightninglabs/lightning-stack:v0.12.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - app_id: bitcoin-core
-      version: ">=24.0"
-    - storage: 50Gi
-    
-  resources:
-    cpu_limit: 4
-    memory_limit: 4Gi
-    disk_limit: 50Gi
-    
-  security:
-    capabilities: [NET_BIND_SERVICE]
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: lightning-stack
-    
-  ports:
-    - host: 9738
-      container: 9735
-      protocol: tcp  # P2P
-      auth: none
-      auth_rationale: >-
-        Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.
-    - host: 10010
-      container: 10009
-      protocol: tcp  # gRPC
-      auth: none
-      auth_rationale: >-
-        LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.
-    # Mirrors lnd's 18080 exemption — same LND REST API, same macaroon auth.
-    - host: 8091
-      container: 8080
-      protocol: tcp  # REST/Web UI
-      auth: none
-      auth_rationale: >-
-        LND REST, authenticated by macaroon over TLS. A browser login page would break
-        Zeus and every non-browser wallet client, exactly as for lnd's 18080.
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/lightning-stack
-      target: /root/.lightning
-      options: [rw]
-      
-  environment:
-    - BITCOIND_HOST=bitcoin-core
-    - BITCOIND_RPCUSER=${BITCOIN_RPC_USER}
-    - BITCOIND_RPCPASS=${BITCOIN_RPC_PASSWORD}
-    - NETWORK=mainnet
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /v1/getinfo
-    interval: 30s
-    timeout: 5s
-    retries: 3
-    
-  bitcoin_integration:
-    rpc_access: admin
-    sync_required: true
-    
-  lightning_integration:
-    channel_management: true
-    payment_routing: true

apps/lnd/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: lnd
   name: LND
-  version: 0.18.4
+  version: 0.21.2
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta
     pull_policy: if-not-present
     network: archy-net
     # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or

apps/mempool/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: mempool
   name: Mempool Explorer
-  version: 3.0.0
+  version: 3.3.1-archy1
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.
   
   container:
-    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1
+    image: source.archipelago-foundation.org/chaum/mempool-frontend:v3.3.1-archy1
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/morphos-server/.dockerignore

@@ -1,6 +0,0 @@
-node_modules
-dist
-*.log
-.git
-.gitignore
-README.md

apps/morphos-server/Dockerfile

@@ -1,37 +0,0 @@
-FROM node:20-alpine AS builder
-
-WORKDIR /app
-
-# Copy package files
-COPY package*.json ./
-RUN npm ci --only=production
-
-# Copy source code
-COPY . .
-
-# Build the application
-RUN npm run build
-
-# Production stage
-FROM node:20-alpine
-
-WORKDIR /app
-
-# Copy built application
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/package.json ./
-
-# Create non-root user
-RUN addgroup -g 1000 appuser && \
-    adduser -D -u 1000 -G appuser appuser && \
-    mkdir -p /app/data && \
-    chown -R appuser:appuser /app
-
-USER appuser
-
-EXPOSE 8080
-
-ENV MORPHOS_DATA_DIR=/app/data
-
-CMD ["node", "dist/index.js"]

apps/morphos-server/manifest.yml

@@ -1,55 +0,0 @@
-app:
-  id: morphos-server
-  name: MorphOS Server
-  version: 1.0.0
-  # Built by this project — there is no upstream release feed to watch.
-  upstream:
-    kind: internal
-  description: MorphOS server platform. Decentralized application server.
-  
-  container:
-    image: archipelago/morphos-server:1.0.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - storage: 5Gi
-    
-  resources:
-    cpu_limit: 2
-    memory_limit: 2Gi
-    disk_limit: 5Gi
-    
-  security:
-    capabilities: []
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: morphos-server
-    
-  ports:
-    - host: 8089
-      container: 8080
-      protocol: tcp  # Web UI
-      bind: 127.0.0.1
-      auth: gated
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/morphos-server
-      target: /app/data
-      options: [rw]
-      
-  environment:
-    - MORPHOS_ENV=production
-    - MORPHOS_DATA_DIR=/app/data
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /health
-    interval: 30s
-    timeout: 5s
-    retries: 3

apps/morphos-server/package.json

@@ -1,20 +0,0 @@
-{
-  "name": "morphos-server",
-  "version": "1.0.0",
-  "description": "MorphOS server platform",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts"
-  },
-  "dependencies": {
-    "express": "^4.18.2"
-  },
-  "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.10.0",
-    "typescript": "^5.3.3",
-    "ts-node": "^10.9.2"
-  }
-}

apps/morphos-server/src/index.ts

@@ -1,27 +0,0 @@
-import express from 'express';
-
-const app = express();
-const port = 8080;
-
-// Middleware
-app.use(express.json());
-
-// Health check endpoint
-app.get('/health', (req, res) => {
-  res.json({ status: 'ok', service: 'morphos-server', version: '1.0.0' });
-});
-
-// API endpoints
-app.get('/api/info', (req, res) => {
-  res.json({
-    name: 'MorphOS Server',
-    version: '1.0.0',
-    status: 'running'
-  });
-});
-
-// Start server
-app.listen(port, '0.0.0.0', () => {
-  console.log(`MorphOS Server listening on port ${port}`);
-  console.log(`Data directory: ${process.env.MORPHOS_DATA_DIR || '/app/data'}`);
-});

apps/morphos-server/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "lib": ["ES2020"],
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

apps/nginx-proxy-manager/manifest.yml

@@ -0,0 +1,88 @@
+app:
+  id: nginx-proxy-manager
+  name: Nginx Proxy Manager
+  version: 2.12.1
+  upstream:
+    kind: github
+    repo: NginxProxyManager/nginx-proxy-manager
+  description: >-
+    Reverse proxy with SSL. Beautiful web interface for managing proxies.
+    On a node, this manages its admin UI and upstream configuration — the
+    proxy's own :80/:443 listeners are not published (the node's web server
+    owns those ports).
+
+  container:
+    image: source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest
+    pull_policy: if-not-present
+    network: pasta
+
+  dependencies:
+    - storage: 1Gi
+
+  resources:
+    memory_limit: 512Mi
+    disk_limit: 1Gi
+
+  security:
+    # NET_BIND_SERVICE is load-bearing, not decoration: NPM's internal nginx
+    # listens on 80, 443 AND 81, and the orchestrator runs --cap-drop=ALL —
+    # without this cap every start dies with "bind() to 0.0.0.0:80 failed
+    # (13: Permission denied)" and s6 restart-loops forever (shorty-s,
+    # 2026-09-01, restart counter 3176 within hours of the manifest
+    # conversion). The legacy podman-run path defaulted to the full cap set,
+    # which is why it never showed there.
+    capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE]
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    - host: 8081
+      container: 81
+      protocol: tcp
+      bind: 127.0.0.1
+      # open, not gated: NPM carries a complete admin login of its own. The
+      # gate still fronts the port (TLS on the same port, header fixes, retry
+      # page, Tor) without putting a cookie challenge in front of it.
+      auth: open
+      auth_rationale: >-
+        Nginx Proxy Manager enforces its own admin account on every page;
+        the initial setup wizard also has to answer before any account exists.
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/nginx-proxy-manager
+      target: /data
+      options: [rw]
+    # Current NPM images refuse to start unless /etc/letsencrypt is a mount in
+    # its own right. Keeping the files below the same persistent app directory
+    # preserves existing certificates while satisfying that startup contract.
+    - type: bind
+      source: /var/lib/archipelago/nginx-proxy-manager/letsencrypt
+      target: /etc/letsencrypt
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:81
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: Admin UI
+      description: Nginx Proxy Manager admin interface
+      type: ui
+      port: 8081
+      protocol: http
+      path: /
+
+  metadata:
+    author: Nginx Proxy Manager
+    category: networking
+    icon: /assets/img/app-icons/nginx.svg
+    repo: https://github.com/NginxProxyManager/nginx-proxy-manager
+    tier: optional

apps/ollama/manifest.yml

@@ -0,0 +1,63 @@
+app:
+  id: ollama
+  name: Ollama
+  version: 0.5.4
+  upstream:
+    kind: github
+    repo: ollama/ollama
+  description: >-
+    Run large language models locally. Download and run AI models like
+    Llama, Mistral on your own hardware — served on the node's loopback for
+    the AI assistant (Settings → Claude Auth → model backend), never exposed
+    to the network.
+
+  container:
+    image: source.archipelago-foundation.org/lfg2025/ollama:latest
+    pull_policy: if-not-present
+    network: pasta
+
+  dependencies:
+    - storage: 50Gi
+
+  resources:
+    # No memory limit: models are sized by the disk allowance below, and a
+    # RAM ceiling would just OOM-kill long inferences.
+    disk_limit: 50Gi
+
+  security:
+    capabilities: []
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    - host: 11434
+      container: 11434
+      protocol: tcp
+      # local: Ollama's REST API is consumed by the node's own assistant over
+      # loopback — never externally reachable, so no gate, no TLS, and no
+      # login surface exist at all.
+      bind: 127.0.0.1
+      auth: local
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/ollama
+      target: /root/.ollama
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:11434
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  metadata:
+    author: Ollama
+    category: community
+    icon: /assets/img/app-icons/ollama.png
+    repo: https://github.com/ollama/ollama
+    tier: optional

apps/pine-whisper/manifest.yml

@@ -5,7 +5,7 @@ app:
   # (--beam-size 1). Bumped past the image version so catalog-driven nodes
   # pick up the args change; the pre-release form "3.4.1-1" would compare
   # LOWER than 3.4.1 under semver and never roll out.
-  version: "3.4.2"
+  version: "3.6.0"
   # Tracks the rhasspy/wyoming-whisper image we pin (Docker Hub — the
   # project's GitHub tags are not the image tags). NOTE: this manifest
   # deliberately ships an args-tuned revision AHEAD of the image tag (see
@@ -24,7 +24,7 @@ app:
   container_name: pine-whisper
 
   container:
-    image: docker.io/rhasspy/wyoming-whisper:3.4.1
+    image: docker.io/rhasspy/wyoming-whisper:3.6.0
     pull_policy: if-not-present
     network: archy-net
     network_aliases: [pine-whisper]

apps/portainer/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: portainer
   name: Portainer
-  version: 2.19.4
+  version: 2.45.0
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -12,7 +12,7 @@ app:
   category: development
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/portainer:2.39.6
+    image: source.archipelago-foundation.org/lfg2025/portainer:2.45.0
     pull_policy: if-not-present
     data_uid: "1000:1000"
 

apps/tailscale/manifest.yml

@@ -0,0 +1,78 @@
+app:
+  id: tailscale
+  name: Tailscale
+  version: 1.78.0
+  upstream:
+    kind: github
+    repo: tailscale/tailscale
+  description: Zero-config VPN with WireGuard mesh networking.
+
+  container:
+    image: source.archipelago-foundation.org/lfg2025/tailscale:stable
+    pull_policy: if-not-present
+    network: pasta
+    # Mirrors the legacy curated install exactly: tailscaled in userspace
+    # networking (no host TUN device needed — the rootless container cannot
+    # have one anyway), then `tailscale web` serving the console on :8240 as
+    # plain HTTP the app gate can front (TLS on the same port via the node
+    # certificate, framing-header fixes, retry page, Tor).
+    entrypoint: ["sh", "-c", "tailscaled --tun=userspace-networking & for i in $(seq 1 30); do [ -S /var/run/tailscale/tailscaled.sock ] && break; sleep 1; done; tailscale web --listen 0.0.0.0:8240 & wait"]
+
+  dependencies:
+    - storage: 1Gi
+
+  resources:
+    memory_limit: 512Mi
+    disk_limit: 1Gi
+
+  security:
+    capabilities: []
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    - host: 8240
+      container: 8240
+      protocol: tcp
+      bind: 127.0.0.1
+      # open, not gated: the web console requires the tailnet's own login for
+      # every administrative action — the gate fronts the port without adding
+      # a second login in front of it.
+      auth: open
+      auth_rationale: >-
+        Tailscale's web console authenticates against the tailnet account for
+        all administrative actions; the node's cookie challenge would be a
+        second, redundant login.
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/tailscale
+      target: /var/lib/tailscale
+      options: [rw]
+
+  environment:
+    - TS_STATE_DIR=/var/lib/tailscale
+
+  health_check:
+    type: tcp
+    endpoint: localhost:8240
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: Web console
+      description: Tailscale web console
+      type: ui
+      port: 8240
+      protocol: http
+      path: /
+
+  metadata:
+    author: Tailscale
+    category: networking
+    icon: /assets/img/app-icons/tailscale.webp
+    repo: https://github.com/tailscale/tailscale
+    tier: recommended

apps/vaultwarden/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: vaultwarden
   name: Vaultwarden
-  version: 1.30.0
+  version: 1.37.2
   # Where this app comes from, so scripts/check-upstream-releases.py can
   # tell us when the pin below has fallen behind. Without it nothing can:
   # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
   description: Self-hosted password vault with zero-knowledge encryption.
 
   container:
-    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine
+    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine
     pull_policy: if-not-present
     network: pasta
 

catalog.json

@@ -0,0 +1,588 @@
+{
+  "version": 2,
+  "updated": "2026-04-22T00:00:00Z",
+  "registry": "source.archipelago-foundation.org/lfg2025",
+  "featured": {
+    "id": "indeedhub",
+    "banner": "/assets/img/featured/indeedhub-banner.jpg",
+    "headline": "Stream Sovereignty",
+    "description": "Bitcoin documentaries with Nostr identity.",
+    "tag": "NOSTR IDENTITY // YOUR NODE"
+  },
+  "apps": [
+    {
+      "id": "bitcoin-knots",
+      "title": "Bitcoin Knots",
+      "version": "28.1.0",
+      "description": "Full Bitcoin Knots node with dynamic prune/full-mode startup based on host disk.",
+      "icon": "/assets/img/app-icons/bitcoin-knots.webp",
+      "author": "Bitcoin Knots",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:29.3.knots20260210",
+      "repoUrl": "https://github.com/bitcoinknots/bitcoin"
+    },
+    {
+      "id": "bitcoin-core",
+      "title": "Bitcoin Core",
+      "version": "28.4.0",
+      "description": "Reference Bitcoin Core node with dynamic prune/full-mode startup based on host disk.",
+      "icon": "/assets/img/app-icons/bitcoin-core.svg",
+      "author": "Bitcoin Core contributors",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin:28.4",
+      "repoUrl": "https://github.com/bitcoin/bitcoin"
+    },
+    {
+      "id": "lnd",
+      "title": "LND",
+      "version": "0.18.4",
+      "description": "Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.",
+      "icon": "/assets/img/app-icons/lnd.png",
+      "author": "Lightning Labs",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
+      "repoUrl": "https://github.com/lightningnetwork/lnd",
+      "requires": [
+        "bitcoin-knots"
+      ]
+    },
+    {
+      "id": "btcpay-server",
+      "title": "BTCPay Server",
+      "version": "2.4.3",
+      "description": "Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.",
+      "icon": "/assets/img/app-icons/btcpay-server.png",
+      "author": "BTCPay Server Foundation",
+      "category": "commerce",
+      "tier": "core",
+      "dockerImage": "docker.io/btcpayserver/btcpayserver:2.4.3",
+      "repoUrl": "https://github.com/btcpayserver/btcpayserver",
+      "requires": [
+        "bitcoin-knots"
+      ]
+    },
+    {
+      "id": "mempool",
+      "title": "Mempool Explorer",
+      "version": "3.3.1-archy1",
+      "description": "Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.",
+      "icon": "/assets/img/app-icons/mempool.webp",
+      "author": "Mempool",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/chaum/mempool-frontend:v3.3.1-archy1",
+      "repoUrl": "https://github.com/mempool/mempool",
+      "requires": [
+        "bitcoin-knots",
+        "electrumx"
+      ]
+    },
+    {
+      "id": "electrumx",
+      "title": "ElectrumX",
+      "version": "1.18.0",
+      "description": "Electrum server indexing Bitcoin chain data for lightweight wallet queries.",
+      "icon": "/assets/img/app-icons/electrumx.png",
+      "author": "Luke Childs",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
+      "repoUrl": "https://github.com/spesmilo/electrumx",
+      "requires": [
+        "bitcoin-knots"
+      ]
+    },
+    {
+      "id": "indeedhub",
+      "title": "IndeeHub",
+      "version": "1.0.0",
+      "description": "Bitcoin documentary streaming platform featuring God Bless Bitcoin and other educational content about Bitcoin, sovereignty, and decentralized technology. Sign in with your Nostr identity.",
+      "icon": "/assets/img/app-icons/indeedhub.png",
+      "author": "IndeeHub",
+      "category": "community",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
+      "repoUrl": "https://github.com/indeedhub/indeedhub"
+    },
+    {
+      "id": "botfights",
+      "title": "BotFights",
+      "version": "1.2.11",
+      "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
+      "icon": "/assets/img/app-icons/botfights.svg",
+      "author": "BotFights",
+      "category": "community",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/botfights:1.2.11",
+      "repoUrl": "https://botfights.net",
+      "containerConfig": {
+        "ports": [
+          "9100:9100"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/botfights:/app/server/data"
+        ],
+        "env": [
+          "NODE_ENV=production",
+          "PORT=9100",
+          "FIGHT_LOOP_ENABLED=true",
+          "ARCHY_EMBEDDED=1"
+        ]
+      }
+    },
+    {
+      "id": "gitea",
+      "title": "Gitea",
+      "version": "1.23",
+      "description": "Self-hosted Git service with built-in container registry, CI/CD, and package hosting.",
+      "icon": "/assets/img/app-icons/gitea.svg",
+      "author": "Gitea",
+      "category": "development",
+      "dockerImage": "docker.io/gitea/gitea:1.23",
+      "repoUrl": "https://gitea.com",
+      "containerConfig": {
+        "ports": [
+          "3001:3000",
+          "2222:22"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/gitea/data:/data",
+          "/var/lib/archipelago/gitea/config:/etc/gitea"
+        ],
+        "env": [
+          "GITEA__database__DB_TYPE=sqlite3",
+          "GITEA__server__SSH_PORT=2222",
+          "GITEA__server__SSH_LISTEN_PORT=22",
+          "GITEA__server__LFS_START_SERVER=true",
+          "GITEA__packages__ENABLED=true",
+          "GITEA__repository__ENABLE_PUSH_CREATE_USER=true",
+          "GITEA__repository__ENABLE_PUSH_CREATE_ORG=true",
+          "GITEA__security__X_FRAME_OPTIONS="
+        ]
+      },
+      "tier": "optional"
+    },
+    {
+      "id": "filebrowser",
+      "title": "File Browser",
+      "version": "2.27.0",
+      "description": "Baseline Archipelago file manager service.",
+      "icon": "/assets/img/app-icons/file-browser.webp",
+      "author": "File Browser",
+      "category": "data",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
+      "repoUrl": "https://github.com/filebrowser/filebrowser",
+      "containerConfig": {
+        "ports": [
+          "8083:80"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/filebrowser:/srv",
+          "/var/lib/archipelago/filebrowser-data:/data"
+        ],
+        "args": [
+          "--database=/data/database.db",
+          "--root=/srv",
+          "--address=0.0.0.0",
+          "--port=80"
+        ]
+      }
+    },
+    {
+      "id": "nostr-rs-relay",
+      "title": "Nostr Relay (Rust)",
+      "version": "0.10.0",
+      "description": "High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.",
+      "icon": "/assets/img/app-icons/nostrudel.svg",
+      "author": "Nostr RS Relay",
+      "category": "community",
+      "tier": "recommended",
+      "dockerImage": "scsibug/nostr-rs-relay:0.10.0",
+      "repoUrl": "https://github.com/scsibug/nostr-rs-relay",
+      "containerConfig": {
+        "ports": [
+          "8081:8080"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/nostr-relay:/usr/src/app/db"
+        ],
+        "env": [
+          "RELAY_NAME=Archipelago Nostr Relay",
+          "RELAY_DESCRIPTION=Self-hosted Nostr relay on Archipelago"
+        ]
+      }
+    },
+    {
+      "id": "vaultwarden",
+      "title": "Vaultwarden",
+      "version": "1.30.0",
+      "description": "Self-hosted password vault with zero-knowledge encryption.",
+      "icon": "/assets/img/app-icons/vaultwarden.webp",
+      "author": "Vaultwarden",
+      "category": "data",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
+      "repoUrl": "https://github.com/dani-garcia/vaultwarden",
+      "containerConfig": {
+        "ports": [
+          "8082:80"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/vaultwarden:/data"
+        ]
+      }
+    },
+    {
+      "id": "searxng",
+      "title": "SearXNG",
+      "version": "1.0.0",
+      "description": "Privacy-respecting metasearch engine. Search the web without tracking.",
+      "icon": "/assets/img/app-icons/searxng.png",
+      "author": "SearXNG",
+      "category": "data",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
+      "repoUrl": "https://github.com/searxng/searxng",
+      "containerConfig": {
+        "ports": [
+          "8888:8080"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/searxng:/etc/searxng"
+        ]
+      }
+    },
+    {
+      "id": "fedimint",
+      "title": "Fedimint Guardian",
+      "version": "0.10.0",
+      "description": "Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.",
+      "icon": "/assets/img/app-icons/fedimint.png",
+      "author": "Fedimint",
+      "category": "money",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.1",
+      "repoUrl": "https://github.com/fedimint/fedimint"
+    },
+    {
+      "id": "fedimint-clientd",
+      "title": "Fedimint Client",
+      "version": "0.8.0",
+      "description": "Fedimint ecash client daemon (fmcd). Lets the node hold Fedimint ecash and join federations; the wallet talks to it over a local REST API.",
+      "icon": "/assets/img/app-icons/fedimint.png",
+      "author": "Fedimint",
+      "category": "money",
+      "tier": "core",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fmcd:0.8.1",
+      "repoUrl": "https://github.com/minmoto/fmcd"
+    },
+    {
+      "id": "fedimint-gateway",
+      "title": "Fedimint Gateway",
+      "version": "0.10.0",
+      "description": "Fedimint gateway service with automatic LND-or-LDK backend selection.",
+      "icon": "/assets/img/app-icons/fedimint.png",
+      "author": "Fedimint",
+      "category": "money",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.1",
+      "repoUrl": "https://github.com/fedimint/fedimint",
+      "containerConfig": {
+        "ports": [
+          "8176:8176",
+          "9737:9737"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/fedimint-gateway:/data",
+          "/var/lib/archipelago/lnd:/lnd:ro"
+        ]
+      }
+    },
+    {
+      "id": "barkd",
+      "title": "Ark Wallet",
+      "version": "0.3.0",
+      "description": "Ark protocol wallet daemon (barkd). Lets the node hold self-custodial off-chain bitcoin via an Ark server; the wallet talks to it over a local REST API. Signet by default while Ark matures.",
+      "icon": "/assets/img/app-icons/bark.png",
+      "author": "Second",
+      "category": "money",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
+      "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
+      "containerConfig": {
+        "ports": [
+          "3535:3535"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/barkd:/data"
+        ]
+      }
+    },
+    {
+      "id": "jellyfin",
+      "title": "Jellyfin",
+      "version": "10.8.13",
+      "description": "Free media server. Stream movies, music, and photos.",
+      "icon": "/assets/img/app-icons/jellyfin.webp",
+      "author": "Jellyfin",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
+      "repoUrl": "https://github.com/jellyfin/jellyfin",
+      "containerConfig": {
+        "ports": [
+          "8096:8096"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/jellyfin/config:/config",
+          "/var/lib/archipelago/jellyfin/cache:/cache"
+        ]
+      }
+    },
+    {
+      "id": "immich",
+      "title": "Immich",
+      "version": "2.7.4",
+      "description": "Self-hosted photo and video backup with mobile apps and search.",
+      "icon": "/assets/img/app-icons/immich.png",
+      "author": "Immich",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
+      "repoUrl": "https://github.com/immich-app/immich"
+    },
+    {
+      "id": "homeassistant",
+      "title": "Home Assistant",
+      "version": "2026.7.3",
+      "description": "Open source home automation platform. Control and monitor your smart home devices.",
+      "icon": "/assets/img/app-icons/homeassistant.png",
+      "author": "Home Assistant",
+      "category": "home",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
+      "repoUrl": "https://github.com/home-assistant/core",
+      "containerConfig": {
+        "ports": [
+          "8123:8123"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/home-assistant:/config"
+        ],
+        "env": [
+          "TZ=UTC"
+        ]
+      }
+    },
+    {
+      "id": "pine",
+      "title": "Pine",
+      "version": "1.3.0",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
+      "icon": "/assets/img/app-icons/pine.svg",
+      "author": "Archipelago",
+      "category": "home",
+      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
+      "repoUrl": "https://github.com/rhasspy/wyoming"
+    },
+    {
+      "id": "grafana",
+      "title": "Grafana",
+      "version": "10.2.0",
+      "description": "Analytics and monitoring platform. Visualize metrics and create dashboards.",
+      "icon": "/assets/img/app-icons/grafana.png",
+      "author": "Grafana Labs",
+      "category": "data",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/grafana:10.2.0",
+      "repoUrl": "https://github.com/grafana/grafana",
+      "containerConfig": {
+        "ports": [
+          "3000:3000"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/grafana:/var/lib/grafana"
+        ],
+        "env": [
+          "GF_PATHS_DATA=/var/lib/grafana",
+          "GF_USERS_ALLOW_SIGN_UP=false"
+        ]
+      }
+    },
+    {
+      "id": "tailscale",
+      "title": "Tailscale",
+      "version": "1.78.0",
+      "description": "Zero-config VPN with WireGuard mesh networking.",
+      "icon": "/assets/img/app-icons/tailscale.webp",
+      "author": "Tailscale",
+      "category": "networking",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/tailscale:stable",
+      "repoUrl": "https://github.com/tailscale/tailscale",
+      "containerConfig": {
+        "ports": [
+          "8240:8240"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/tailscale:/var/lib/tailscale"
+        ],
+        "env": [
+          "TS_STATE_DIR=/var/lib/tailscale"
+        ],
+        "args": [
+          "sh",
+          "-c",
+          "tailscaled --tun=userspace-networking & for i in $(seq 1 30); do [ -S /var/run/tailscale/tailscaled.sock ] && break; sleep 1; done; tailscale web --listen 0.0.0.0:8240 & wait"
+        ]
+      }
+    },
+    {
+      "id": "portainer",
+      "title": "Portainer",
+      "version": "2.19.4",
+      "description": "Container management web UI for the local Podman socket.",
+      "icon": "/assets/img/app-icons/portainer.webp",
+      "author": "Portainer",
+      "category": "development",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
+      "repoUrl": "https://github.com/portainer/portainer",
+      "containerConfig": {
+        "ports": [
+          "9000:9000"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/portainer:/data",
+          "/run/user/1000/podman/podman.sock:/var/run/docker.sock"
+        ],
+        "notes": "Uses the manifest-owned Podman socket bind mount preparation path."
+      }
+    },
+    {
+      "id": "netbird",
+      "title": "NetBird",
+      "version": "2.38.0",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
+      "icon": "/assets/img/app-icons/netbird.svg",
+      "author": "NetBird",
+      "category": "networking",
+      "tier": "recommended",
+      "dockerImage": "docker.io/library/nginx:1.31.4-alpine",
+      "repoUrl": "https://github.com/netbirdio/netbird",
+      "containerConfig": {
+        "ports": [
+          "8087:80",
+          "8086:80",
+          "3478:3478/udp"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/netbird:/var/lib/netbird"
+        ],
+        "notes": "Installed as a two-container stack: netbird dashboard on 8087 and netbird-server control plane on 8086 plus UDP 3478. For production clients, publish a DNS name over HTTPS with gRPC/WebSocket routing."
+      }
+    },
+    {
+      "id": "uptime-kuma",
+      "title": "Uptime Kuma",
+      "version": "1.23.0",
+      "description": "Self-hosted uptime monitoring.",
+      "icon": "/assets/img/app-icons/uptime-kuma.webp",
+      "author": "Uptime Kuma",
+      "category": "data",
+      "tier": "recommended",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/uptime-kuma:1",
+      "repoUrl": "https://github.com/louislam/uptime-kuma",
+      "containerConfig": {
+        "ports": [
+          "3002:3001"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/uptime-kuma:/app/data"
+        ],
+        "env": [
+          "TZ=UTC"
+        ],
+        "args": [
+          "--",
+          "node",
+          "server/server.js"
+        ]
+      }
+    },
+    {
+      "id": "photoprism",
+      "title": "PhotoPrism",
+      "version": "240915",
+      "description": "AI-powered photo management with facial recognition.",
+      "icon": "/assets/img/app-icons/photoprism.svg",
+      "author": "PhotoPrism",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
+      "repoUrl": "https://github.com/photoprism/photoprism",
+      "containerConfig": {
+        "ports": [
+          "2342:2342"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/photoprism:/photoprism/storage"
+        ],
+        "env": [
+          "PHOTOPRISM_ADMIN_PASSWORD=archipelago",
+          "PHOTOPRISM_DEFAULT_LOCALE=en"
+        ]
+      }
+    },
+    {
+      "id": "nextcloud",
+      "title": "Nextcloud",
+      "version": "29",
+      "description": "Your own private cloud. File sync, calendars, contacts.",
+      "icon": "/assets/img/app-icons/nextcloud.webp",
+      "author": "Nextcloud",
+      "category": "data",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
+      "repoUrl": "https://github.com/nextcloud/server",
+      "containerConfig": {
+        "ports": [
+          "8085:80"
+        ],
+        "volumes": [
+          "/var/lib/archipelago/nextcloud:/var/www/html"
+        ]
+      }
+    },
+    {
+      "id": "alby-hub",
+      "title": "Alby Hub",
+      "version": "1.23.0",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
+      "icon": "/assets/img/app-icons/alby-hub.svg",
+      "author": "Alby",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
+      "repoUrl": "https://github.com/getAlby/hub"
+    },
+    {
+      "id": "phoenixd",
+      "title": "phoenixd",
+      "version": "0.9.0",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "icon": "/assets/img/app-icons/phoenixd.svg",
+      "author": "ACINQ",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/phoenixd:0.9.0",
+      "repoUrl": "https://github.com/ACINQ/phoenixd"
+    },
+    {
+      "id": "cuprate",
+      "title": "Cuprate",
+      "version": "0.1.0-preview",
+      "description": "Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.",
+      "icon": "/assets/img/app-icons/cuprate.svg",
+      "author": "Cuprate contributors",
+      "category": "money",
+      "tier": "optional",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/cuprate:0.1.0-preview-18-g618ff14",
+      "repoUrl": "https://github.com/Cuprate/cuprate"
+    }
+  ]
+}

core/Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.8.4-alpha"
+version = "1.8.18-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.8.4-alpha"
+version = "1.8.18-alpha"
 edition = "2021"
 license.workspace = true
 description = "Archipelago Bitcoin Node OS - Native backend"
@@ -90,8 +90,9 @@ rustls-pemfile = "1.0"
 webpki = { package = "rustls-webpki", version = "0.101" }
 reqwest = { version = "0.11", default-features = false, features = ["json", "socks", "rustls-tls", "stream"] }
 
-# Nostr (node discovery + NIP-44 encrypted peer handshake)
-nostr-sdk = { version = "0.44", features = ["nip04", "nip44"] }
+# Nostr (node discovery + NIP-44 encrypted peer handshake).
+# nip06: NIP-06 key derivation for the Minibits @minibits.cash profile flow.
+nostr-sdk = { version = "0.44", features = ["nip04", "nip06", "nip44"] }
 
 # Backup encryption (DID identity export) + TOTP 2FA encryption
 argon2 = "0.5.3"

core/archipelago/src/api/handler/mod.rs

@@ -145,6 +145,21 @@ impl ApiHandler {
     /// URL so the App Store still renders on nodes that haven't persisted
     /// a registry config yet. 15s total timeout.
     async fn handle_app_catalog_proxy(&self) -> Result<Response<hyper::Body>> {
+        // The daemon already refreshes and verifies releases/app-catalog.json.
+        // Serve that release-root-anchored cache first so a newly published app
+        // appears immediately, without a frontend release. The old external UI
+        // catalog below is emergency compatibility only; it must never override
+        // a healthy signed catalog (Cuprate was invisible for exactly that reason).
+        if let Ok(body) =
+            crate::container::app_catalog::verified_catalog_body(&self.config.data_dir).await
+        {
+            return Ok(Response::builder()
+                .status(hyper::StatusCode::OK)
+                .header("Content-Type", "application/json")
+                .header("Cache-Control", "no-cache")
+                .body(hyper::Body::from(body))?);
+        }
+
         let mut upstreams: Vec<String> = Vec::new();
         if let Ok(config) = crate::container::registry::load_registries(&self.config.data_dir).await
         {

core/archipelago/src/api/rpc/dispatcher.rs

@@ -269,6 +269,8 @@ impl RpcHandler {
             "wallet.ecash-network" => self.handle_wallet_ecash_network().await,
             "wallet.ecash-set-network" => self.handle_wallet_ecash_set_network(params).await,
             "wallet.ecash-seed-status" => self.handle_wallet_ecash_seed_status().await,
+            "wallet.ecash-lnaddress" => self.handle_wallet_ecash_lnaddress().await,
+            "wallet.ecash-lnaddress-claim" => self.handle_wallet_ecash_lnaddress_claim().await,
             "wallet.ecash-seed-reveal" => self.handle_wallet_ecash_seed_reveal(params).await,
             "wallet.ecash-restore" => self.handle_wallet_ecash_restore(params).await,
             "wallet.ecash-seed-import" => self.handle_wallet_ecash_seed_import(params).await,
@@ -558,6 +560,11 @@ impl RpcHandler {
                 self.handle_fips_remove_seed_anchor(&p).await
             }
             "fips.apply-seed-anchors" => self.handle_fips_apply_seed_anchors().await,
+            "fips.ssh-over-mesh.get" => self.handle_fips_ssh_over_mesh_get().await,
+            "fips.ssh-over-mesh.set" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_ssh_over_mesh_set(&p).await
+            }
 
             // System updates
             "update.check" => self.handle_update_check().await,

core/archipelago/src/api/rpc/fips.rs

@@ -261,4 +261,51 @@ impl RpcHandler {
             }).collect::<Vec<_>>(),
         }))
     }
+
+    /// The SSH-over-mesh toggle state plus sshd preflights (the card explains
+    /// the rule instead of gating on it — see ssh_mesh.rs).
+    pub(super) async fn handle_fips_ssh_over_mesh_get(&self) -> Result<serde_json::Value> {
+        let state = fips::ssh_mesh::load(&self.config.data_dir).await;
+        let preflights = fips::ssh_mesh::preflights().await;
+        Ok(serde_json::json!({
+            "enabled": state.enabled,
+            "sources": state.sources,
+            "scope": if state.sources.is_empty() { "any" } else { "list" },
+            "preflights": preflights,
+        }))
+    }
+
+    /// Set the toggle. Params: `{ enabled: bool, sources?: string[] }` —
+    /// an empty/absent source list opens port 22 to every mesh peer (the UI
+    /// confirms that explicitly before calling with it).
+    pub(super) async fn handle_fips_ssh_over_mesh_set(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let enabled = params
+            .get("enabled")
+            .and_then(|v| v.as_bool())
+            .ok_or_else(|| anyhow::anyhow!("missing boolean 'enabled'"))?;
+        let sources: Vec<String> = params
+            .get("sources")
+            .and_then(|v| v.as_array())
+            .map(|a| {
+                a.iter()
+                    .filter_map(|s| s.as_str().map(str::to_string))
+                    .collect()
+            })
+            .unwrap_or_default();
+        let (state, outcome) =
+            fips::ssh_mesh::set(&self.config.data_dir, enabled, &sources).await?;
+        let preflights = fips::ssh_mesh::preflights().await;
+        Ok(serde_json::json!({
+            "enabled": state.enabled,
+            "sources": state.sources,
+            "scope": if state.sources.is_empty() { "any" } else { "list" },
+            "applied": outcome.applied,
+            "removed": outcome.removed,
+            "reloaded": outcome.reloaded,
+            "preflights": preflights,
+        }))
+    }
 }

core/archipelago/src/api/rpc/identity/handlers.rs

@@ -55,6 +55,10 @@ impl RpcHandler {
                     "did": id.did,
                     "created_at": id.created_at,
                     "is_default": is_default,
+                    // The node's operational Nostr key is intentionally
+                    // distinguishable from user profile identities. Clients
+                    // must never offer it in app sign-in pickers.
+                    "is_node": is_node,
                     "nostr_pubkey": nostr_pubkey,
                     "nostr_npub": nostr_npub,
                     "profile": id.profile,

core/archipelago/src/api/rpc/lnd/info.rs

@@ -73,6 +73,42 @@ struct LndChannelBalanceResponse {
     pending_open_local_balance: Option<LndAmount>,
 }
 
+/// Reject unavailable LND data before it can be decoded as an empty, zero wallet.
+async fn get_lnd_json<T: serde::de::DeserializeOwned>(
+    client: &reqwest::Client,
+    url: &str,
+    macaroon_hex: &str,
+) -> Result<T> {
+    client
+        .get(url)
+        .header("Grpc-Metadata-macaroon", macaroon_hex)
+        .send()
+        .await
+        .context("LND is unavailable; balance could not be checked")?
+        .error_for_status()
+        .context("LND is not ready; balance could not be checked")?
+        .json()
+        .await
+        .context("LND returned invalid wallet data")
+}
+
+fn checked_balances(
+    wallet: LndBalanceResponse,
+    channels: LndChannelBalanceResponse,
+) -> Result<(i64, i64, i64)> {
+    fn sats(value: Option<String>) -> Result<i64> {
+        let value = value.context("LND omitted a balance; balance is unavailable")?;
+        let amount: i64 = value.parse().context("LND returned an invalid balance")?;
+        anyhow::ensure!(amount >= 0, "LND returned a negative balance");
+        Ok(amount)
+    }
+    Ok((
+        sats(wallet.total_balance)?,
+        sats(channels.local_balance.and_then(|a| a.sat))?,
+        sats(channels.pending_open_local_balance.and_then(|a| a.sat))?,
+    ))
+}
+
 impl RpcHandler {
     pub(in crate::api::rpc) async fn handle_lnd_getinfo(&self) -> Result<serde_json::Value> {
         let macaroon_bytes = read_lnd_admin_macaroon().await?;
@@ -85,45 +121,26 @@ impl RpcHandler {
             .build()
             .context("Failed to create HTTP client")?;
 
-        let get_info: LndGetInfoResponse = client
-            .get(format!("{LND_REST_BASE_URL}/v1/getinfo"))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-            .context("LND REST connection failed")?
-            .json()
-            .await
-            .context("Failed to parse LND getinfo response")?;
-
-        let channel_balance: LndChannelBalanceResponse = match client
-            .get(format!("{LND_REST_BASE_URL}/v1/balance/channels"))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-        {
-            Ok(resp) => resp.json().await.unwrap_or(LndChannelBalanceResponse {
-                local_balance: None,
-                pending_open_local_balance: None,
-            }),
-            Err(_) => LndChannelBalanceResponse {
-                local_balance: None,
-                pending_open_local_balance: None,
-            },
-        };
-
-        let wallet_balance: LndBalanceResponse = match client
-            .get(format!("{LND_REST_BASE_URL}/v1/balance/blockchain"))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-        {
-            Ok(resp) => resp.json().await.unwrap_or(LndBalanceResponse {
-                total_balance: None,
-            }),
-            Err(_) => LndBalanceResponse {
-                total_balance: None,
-            },
-        };
+        let get_info: LndGetInfoResponse = get_lnd_json(
+            &client,
+            &format!("{LND_REST_BASE_URL}/v1/getinfo"),
+            &macaroon_hex,
+        )
+        .await?;
+        let channel_balance: LndChannelBalanceResponse = get_lnd_json(
+            &client,
+            &format!("{LND_REST_BASE_URL}/v1/balance/channels"),
+            &macaroon_hex,
+        )
+        .await?;
+        let wallet_balance: LndBalanceResponse = get_lnd_json(
+            &client,
+            &format!("{LND_REST_BASE_URL}/v1/balance/blockchain"),
+            &macaroon_hex,
+        )
+        .await?;
+        let (balance_sats, channel_balance_sats, pending_open_balance) =
+            checked_balances(wallet_balance, channel_balance)?;
 
         let (identity_pubkey, uris) = map_identity(&get_info);
 
@@ -135,18 +152,9 @@ impl RpcHandler {
             num_peers: get_info.num_peers.unwrap_or(0),
             synced_to_chain: get_info.synced_to_chain.unwrap_or(false),
             block_height: get_info.block_height.unwrap_or(0),
-            balance_sats: wallet_balance
-                .total_balance
-                .and_then(|s| s.parse().ok())
-                .unwrap_or(0),
-            channel_balance_sats: channel_balance
-                .local_balance
-                .and_then(|a| a.sat.and_then(|s| s.parse().ok()))
-                .unwrap_or(0),
-            pending_open_balance: channel_balance
-                .pending_open_local_balance
-                .and_then(|a| a.sat.and_then(|s| s.parse().ok()))
-                .unwrap_or(0),
+            balance_sats,
+            channel_balance_sats,
+            pending_open_balance,
         };
 
         Ok(serde_json::to_value(info)?)
@@ -268,6 +276,76 @@ impl RpcHandler {
 mod tests {
     use super::*;
 
+    #[test]
+    fn unavailable_balances_are_not_zero() {
+        for body in [r#"{}"#, r#"{"code":14,"message":"wallet locked"}"#] {
+            assert!(checked_balances(
+                serde_json::from_str(body).unwrap(),
+                serde_json::from_str(body).unwrap(),
+            )
+            .is_err());
+        }
+        for value in ["bad", "-1", "9223372036854775808"] {
+            let wallet = LndBalanceResponse {
+                total_balance: Some(value.into()),
+            };
+            let channels = serde_json::from_str(
+                r#"{"local_balance":{"sat":"5"},"pending_open_local_balance":{"sat":"0"}}"#,
+            )
+            .unwrap();
+            assert!(checked_balances(wallet, channels).is_err());
+        }
+    }
+
+    #[test]
+    fn verified_zero_and_nonzero_balances_survive() {
+        for expected in [0, 42] {
+            let wallet = LndBalanceResponse {
+                total_balance: Some(expected.to_string()),
+            };
+            let channels = serde_json::from_value(serde_json::json!({
+                "local_balance":{"sat":expected.to_string()},
+                "pending_open_local_balance":{"sat":"0"}
+            }))
+            .unwrap();
+            assert_eq!(
+                checked_balances(wallet, channels).unwrap(),
+                (expected, expected, 0)
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn locked_wallet_http_response_is_not_successful_getinfo() {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            let mut buf = [0; 2048];
+            stream.read(&mut buf).await.unwrap();
+            let body =
+                r#"{"code":9,"message":"wallet locked, unlock it to enable full RPC access"}"#;
+            stream.write_all(format!(
+                "HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+                body.len(), body
+            ).as_bytes()).await.unwrap();
+        });
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .timeout(std::time::Duration::from_secs(2))
+            .build()
+            .unwrap();
+        assert!(get_lnd_json::<LndGetInfoResponse>(
+            &client,
+            &format!("http://{addr}/v1/getinfo"),
+            "test"
+        )
+        .await
+        .is_err());
+        server.await.unwrap();
+    }
+
     /// A real compressed secp256k1 pubkey shape: 66 hex characters.
     const GOOD_PUBKEY: &str = "03a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90";
 

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -4,6 +4,59 @@ use tracing::info;
 
 use super::LND_REST_BASE_URL;
 
+fn router_error_message(body: &serde_json::Value) -> Option<&str> {
+    body.get("error")
+        .and_then(|e| e.get("message"))
+        .and_then(|v| v.as_str())
+        .or_else(|| body.get("message").and_then(|v| v.as_str()))
+}
+
+fn payment_error(message: &str) -> anyhow::Error {
+    if message.to_ascii_lowercase().contains("invoice expired") {
+        anyhow::anyhow!(
+            "Payment failed: this invoice has expired ({}). Ask the recipient for a fresh invoice and try again.",
+            message.trim_start_matches("invoice expired. ")
+        )
+    } else {
+        anyhow::anyhow!("Payment failed: {message}")
+    }
+}
+
+fn payment_failure_reason(reason: &str) -> &'static str {
+    match reason {
+        "FAILURE_REASON_NO_ROUTE" => "No route to the recipient",
+        "FAILURE_REASON_INSUFFICIENT_BALANCE" => "Insufficient channel balance",
+        "FAILURE_REASON_TIMEOUT" => "Payment timed out in the network",
+        "FAILURE_REASON_INCORRECT_PAYMENT_DETAILS" => {
+            "Recipient rejected the payment (wrong details or expired invoice)"
+        }
+        _ => "Payment failed",
+    }
+}
+
+fn json_i64(value: &serde_json::Value, key: &str) -> Option<i64> {
+    value.get(key).and_then(|v| {
+        v.as_str()
+            .and_then(|s| s.parse().ok())
+            .or_else(|| v.as_i64())
+    })
+}
+
+/// Fee budget for a send, matching lncli's own default: the payment amount
+/// (100%). Zero-amount invoices take the payer-supplied amount; fixed invoices
+/// take the invoice's own amount. Falls back to a nominal 1,000 sats only when
+/// both are somehow absent — the limit must never be left at LND's zero
+/// default, which rejects every fee-carrying route as "no route".
+fn fee_limit_sats(amount_sats: Option<u64>, decoded_amt: i64) -> i64 {
+    if let Some(amt) = amount_sats {
+        return amt as i64;
+    }
+    if decoded_amt > 0 {
+        return decoded_amt;
+    }
+    1_000
+}
+
 impl RpcHandler {
     /// Pay a Lightning invoice.
     pub(in crate::api::rpc) async fn handle_lnd_payinvoice(
@@ -65,23 +118,30 @@ impl RpcHandler {
 
         let mut pay_body = serde_json::json!({
             "payment_request": payment_request,
+            // Suppress intermediate stream records: one terminal Payment is
+            // enough, and it makes grpc-gateway's response a single JSON value.
+            "no_inflight_updates": true,
+            "timeout_seconds": 120,
+            // Router.SendPaymentV2 treats an ABSENT fee limit as ZERO — every
+            // real route carries a routing fee, so the pathfinder rejects
+            // them all and the wallet gets "No route to the recipient" on
+            // every send (fleet-wide, 2026-09-01: the v1.8.9 switch to the v2
+            // route shipped without this, and a manual lncli test that set
+            // --fee_limit masked it). lncli's own default is the payment
+            // amount (100%), which is what we send here.
+            "fee_limit_sat": fee_limit_sats(amount_sats, decoded_amt),
         });
         if let Some(amt) = amount_sats {
             pay_body["amt"] = serde_json::json!(amt.to_string());
         }
 
-        // `/v1/channels/transactions` is SYNCHRONOUS: it blocks until the
-        // payment settles or definitively fails, and multi-hop routing with
-        // retries routinely takes longer than the shared client's 15s budget.
-        // That 15s abort used to surface as "Payment failed" while LND kept
-        // paying in the background — only LND may declare a payment failed,
-        // so a post-connect timeout is IN FLIGHT (status: pending), never
-        // failure. The window is deliberately SHORT: most payments settle in
-        // a couple of seconds and still get their answer in one round trip,
-        // while a slow multi-hop route flips the UI into its "settling…"
-        // polling state (lnd.paymentstatus every 3s) after ~8s instead of
-        // freezing the modal for two minutes with no feedback (a test node
-        // user report, 2026-07-29).
+        // LND 0.21 removed the deprecated Lightning.SendPaymentSync REST route
+        // (`/v1/channels/transactions`). Router.SendPaymentV2 is its supported
+        // replacement. The old route now returns literal 404 "Not Found" on
+        // every payment — the fleet failure seen immediately after the 0.21.2
+        // update. Keep the short browser-facing wait: after LND accepts a slow
+        // payment we return pending and the UI follows it through
+        // lnd.paymentstatus instead of declaring a transport timeout a failure.
         let pay_client = reqwest::Client::builder()
             .no_proxy()
             .connect_timeout(std::time::Duration::from_secs(10))
@@ -91,7 +151,7 @@ impl RpcHandler {
             .context("Failed to create HTTP client")?;
 
         let resp = match pay_client
-            .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))
+            .post(format!("{LND_REST_BASE_URL}/v2/router/send"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&pay_body)
             .send()
@@ -119,49 +179,42 @@ impl RpcHandler {
         let body: serde_json::Value = resp
             .json()
             .await
-            .context("Failed to parse payment response")?;
+            .context("Failed to parse Router.SendPaymentV2 response")?;
 
+        // grpc-gateway wraps server-streaming records as {"result": ...} and
+        // transport/RPC failures as {"error": {"message": ...}}. Do not look
+        // only for the old endpoint's top-level `message`: that turns useful
+        // LND errors into "Unknown error".
         if !status.is_success() {
-            let msg = body
-                .get("message")
-                .and_then(|v| v.as_str())
-                .unwrap_or("Unknown error");
-            // Invoices are short-lived; retrying the same one can never
-            // succeed, so tell the user the way out instead of just the fact.
-            if msg.contains("invoice expired") {
-                return Err(anyhow::anyhow!(
-                    "Payment failed: this invoice has expired ({}). Ask the recipient for a fresh invoice and try again.",
-                    msg.trim_start_matches("invoice expired. ")
-                ));
+            let msg = router_error_message(&body).unwrap_or("Unknown error");
+            return Err(payment_error(msg));
+        }
+        let payment = body.get("result").unwrap_or(&body);
+        match payment.get("status").and_then(|v| v.as_str()).unwrap_or("") {
+            "SUCCEEDED" => {}
+            "FAILED" => {
+                let reason = payment
+                    .get("failure_reason")
+                    .and_then(|v| v.as_str())
+                    .map(payment_failure_reason)
+                    .unwrap_or("Payment failed");
+                return Err(anyhow::anyhow!("Payment failed: {reason}"));
+            }
+            _ => {
+                return Ok(serde_json::json!({
+                    "status": "pending",
+                    "payment_hash": decoded_hash,
+                    "amount_sats": decoded_amt,
+                }));
             }
-            return Err(anyhow::anyhow!("Payment failed: {}", msg));
         }
 
-        let payment_error = body
-            .get("payment_error")
-            .and_then(|v| v.as_str())
-            .unwrap_or("");
-        if !payment_error.is_empty() {
-            return Err(anyhow::anyhow!("Payment failed: {}", payment_error));
-        }
-
-        let amount_sat = body
-            .get("payment_route")
-            .and_then(|r| r.get("total_amt"))
-            .and_then(|v| v.as_str())
-            .and_then(|s| s.parse::<i64>().ok())
-            .unwrap_or(decoded_amt);
-
-        let payment_hash = body
-            .get("payment_hash")
-            .and_then(|v| v.as_str())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string())
-            .unwrap_or(decoded_hash);
-
+        let amount_sat = json_i64(payment, "value_sat").unwrap_or(decoded_amt);
         Ok(serde_json::json!({
             "status": "succeeded",
-            "payment_hash": payment_hash,
+            // The decode endpoint returns the canonical hex hash used by our
+            // polling/list APIs. Router's bytes field is base64 in REST JSON.
+            "payment_hash": decoded_hash,
             "amount_sats": amount_sat,
         }))
     }
@@ -482,3 +535,53 @@ impl RpcHandler {
         Ok(serde_json::json!({ "transactions": transactions }))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unwraps_grpc_gateway_router_success() {
+        let body = serde_json::json!({
+            "result": { "status": "SUCCEEDED", "value_sat": "1000" }
+        });
+        let payment = body.get("result").unwrap_or(&body);
+        assert_eq!(
+            payment.get("status").and_then(|v| v.as_str()),
+            Some("SUCCEEDED")
+        );
+        assert_eq!(json_i64(payment, "value_sat"), Some(1000));
+    }
+
+    #[test]
+    fn reads_nested_router_error() {
+        let body = serde_json::json!({
+            "error": { "code": 2, "message": "invoice expired. valid until yesterday" }
+        });
+        let msg = router_error_message(&body).unwrap();
+        assert!(payment_error(msg).to_string().contains("fresh invoice"));
+    }
+
+    #[test]
+    fn router_failure_reasons_are_actionable() {
+        assert_eq!(
+            payment_failure_reason("FAILURE_REASON_NO_ROUTE"),
+            "No route to the recipient"
+        );
+        assert_eq!(
+            payment_failure_reason("FAILURE_REASON_INSUFFICIENT_BALANCE"),
+            "Insufficient channel balance"
+        );
+    }
+
+    #[test]
+    fn fee_limit_never_falls_back_to_zero() {
+        // SendPaymentV2 defaults an ABSENT fee limit to zero — which rejects
+        // every fee-carrying route as "no route". The budget must always be
+        // positive: the payer-supplied amount for zero-amount invoices, the
+        // invoice's own amount otherwise.
+        assert_eq!(fee_limit_sats(Some(20_000), 0), 20_000);
+        assert_eq!(fee_limit_sats(None, 20_000), 20_000);
+        assert_eq!(fee_limit_sats(None, 0), 1_000);
+    }
+}

core/archipelago/src/api/rpc/middleware.rs

@@ -64,6 +64,11 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "must be",
         "cannot",
         "Password",
+        // auth.changePassword verifies the existing node password before it
+        // writes either the web hash or the optional Linux/SSH password. This
+        // is safe, actionable validation text; masking it as an internal
+        // failure sent operators to the server logs for a simple typo.
+        "Current password is incorrect",
         // OTA apply/download errors are all operator-actionable ("download it
         // again", "download first") — sanitizing them to "Operation failed"
         // left users stuck with no idea what to do, and hid the "already
@@ -242,6 +247,12 @@ mod sanitize_tests {
         assert_eq!(sanitize_error_message(msg), msg);
     }
 
+    #[test]
+    fn change_password_rejection_reaches_the_operator() {
+        let msg = "Current password is incorrect";
+        assert_eq!(sanitize_error_message(msg), msg);
+    }
+
     #[test]
     fn tor_unavailable_precondition_passes_through() {
         let msg = "Tor address not available. Tor may not be running.";
@@ -306,7 +317,7 @@ mod sanitize_tests {
 /// Deterministic: same session token always produces the same CSRF token.
 /// Survives backend restarts because it depends only on the session token
 /// and the on-disk remember secret (not ephemeral state).
-pub(super) async fn derive_csrf_token(session_token: &str) -> String {
+pub(crate) async fn derive_csrf_token(session_token: &str) -> String {
     use hmac::{Hmac, Mac};
     use sha2::Sha256;
     type HmacSha256 = Hmac<Sha256>;

core/archipelago/src/api/rpc/mod.rs

@@ -34,6 +34,7 @@ mod nostr;
 mod onboarding_gate;
 mod openwrt;
 mod package;
+pub(crate) use package::patch_indeedhub_nostr_provider;
 pub(crate) use package::wyoming_satellite_keeper;
 mod peers;
 mod pine_status;
@@ -71,12 +72,53 @@ pub use middleware::PeerAddr;
 // never added to it — the Phase-10 hard constraint this crate must hold.
 // The list's *contents* are unchanged; only its read-visibility widens from
 // "this module" to "this crate".
-pub(crate) use middleware::UNAUTHENTICATED_METHODS;
-use middleware::{
-    derive_csrf_token, extract_client_ip, extract_cookie, sanitize_error_message, CACHEABLE_METHODS,
-};
+pub(crate) use middleware::{derive_csrf_token, UNAUTHENTICATED_METHODS};
+use middleware::{extract_client_ip, extract_cookie, sanitize_error_message, CACHEABLE_METHODS};
 use response::{cookie_header, json_response, ResponseCache, RpcError, RpcRequest, RpcResponse};
 
+/// Browser apps run on dedicated high ports and can share the authenticated
+/// node cookie. Nostr signing must therefore be callable by the dashboard
+/// bridge (ports 80/443), not directly by an iframe that could bypass its
+/// consent dialog. Requests without Origin remain available to authenticated
+/// local CLI/integration clients. Development permits loopback origins.
+fn nostr_signing_origin_allowed(headers: &hyper::HeaderMap, dev_mode: bool) -> bool {
+    let Some(origin) = headers.get("origin").and_then(|value| value.to_str().ok()) else {
+        return true;
+    };
+    let Ok(url) = reqwest::Url::parse(origin) else {
+        return false;
+    };
+    if !matches!(url.scheme(), "http" | "https") || url.host_str().is_none() {
+        return false;
+    }
+    if dev_mode && matches!(url.host_str(), Some("localhost" | "127.0.0.1" | "::1")) {
+        return true;
+    }
+    matches!(url.port_or_known_default(), Some(80 | 443))
+}
+
+/// Read-only authenticated methods may skip CSRF, but they must still exist in
+/// the dispatcher. The tab signer uses `system.get-hostname` as its lightweight
+/// session probe, so keeping the policy in one testable function protects that
+/// cross-origin app-gate bootstrap contract.
+fn csrf_exempt_method(method: &str) -> bool {
+    matches!(
+        method,
+        "node-messages-received"
+            | "server.echo"
+            | "server.get-state"
+            | "system.stats"
+            | "tor.status"
+            | "tor.onion-addresses"
+            | "bitcoin.relay-status"
+            | "federation.list-nodes"
+            | "system.get-settings"
+            | "system.get-node-key"
+            | "system.get-metrics"
+            | "system.get-hostname"
+    )
+}
+
 /// Default dev password when no user is set up (matches mock-backend).
 /// Dev builds only — the pre-setup login bypass that reads this is
 /// cfg-gated out of release binaries.
@@ -291,6 +333,18 @@ impl RpcHandler {
 
         debug!("RPC method: {}", rpc_req.method);
 
+        if matches!(
+            rpc_req.method.as_str(),
+            "node.nostr-sign" | "identity.nostr-sign"
+        ) && !nostr_signing_origin_allowed(&parts.headers, self.config.dev_mode)
+        {
+            return Ok(self.error_response(
+                403,
+                "Nostr signing from app origins requires the dashboard consent bridge",
+                StatusCode::FORBIDDEN,
+            ));
+        }
+
         // Enforce authentication for non-allowlisted methods
         let is_unauthenticated = UNAUTHENTICATED_METHODS.contains(&rpc_req.method.as_str());
         let mut new_session_cookies: Option<(String, String)> = None;
@@ -340,21 +394,7 @@ impl RpcHandler {
         // CSRF protection: validate X-CSRF-Token header via HMAC derivation from session token.
         // Skip CSRF for read-only methods (polling, status) — CSRF prevents state-changing forgery.
         // Skip when session was just auto-restored from remember-me (browser has stale CSRF cookie).
-        let csrf_exempt = matches!(
-            rpc_req.method.as_str(),
-            "node-messages-received"
-                | "server.echo"
-                | "server.get-state"
-                | "system.stats"
-                | "tor.status"
-                | "tor.onion-addresses"
-                | "bitcoin.relay-status"
-                | "federation.list-nodes"
-                | "system.get-settings"
-                | "system.get-node-key"
-                | "system.get-metrics"
-                | "system.get-version"
-        );
+        let csrf_exempt = csrf_exempt_method(&rpc_req.method);
         if !is_unauthenticated && new_session_cookies.is_none() && !csrf_exempt {
             let csrf_header = parts
                 .headers
@@ -735,3 +775,62 @@ impl RpcHandler {
         );
     }
 }
+
+#[cfg(test)]
+mod nostr_signing_origin_tests {
+    use super::*;
+    use hyper::header::{HeaderMap, HeaderValue, ORIGIN};
+
+    fn headers(origin: Option<&str>) -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        if let Some(origin) = origin {
+            headers.insert(ORIGIN, HeaderValue::from_str(origin).unwrap());
+        }
+        headers
+    }
+
+    #[test]
+    fn signing_accepts_dashboard_and_authenticated_non_browser_clients() {
+        assert!(nostr_signing_origin_allowed(&headers(None), false));
+        assert!(nostr_signing_origin_allowed(
+            &headers(Some("https://node.local")),
+            false
+        ));
+        assert!(nostr_signing_origin_allowed(
+            &headers(Some("http://192.0.2.10")),
+            false
+        ));
+    }
+
+    #[test]
+    fn signing_rejects_app_ports_but_allows_loopback_dev_server() {
+        assert!(!nostr_signing_origin_allowed(
+            &headers(Some("https://node.local:8337")),
+            false
+        ));
+        assert!(!nostr_signing_origin_allowed(
+            &headers(Some("https://node.local:7778")),
+            false
+        ));
+        assert!(nostr_signing_origin_allowed(
+            &headers(Some("http://localhost:5173")),
+            true
+        ));
+    }
+}
+
+#[cfg(test)]
+mod session_probe_contract_tests {
+    use super::*;
+
+    #[test]
+    fn signer_session_probe_is_implemented_authenticated_and_read_only() {
+        const PROBE: &str = "system.get-hostname";
+        const DISPATCHER: &str = include_str!("dispatcher.rs");
+
+        assert!(csrf_exempt_method(PROBE));
+        assert!(!UNAUTHENTICATED_METHODS.contains(&PROBE));
+        assert!(DISPATCHER.contains("\"system.get-hostname\" =>"));
+        assert!(!DISPATCHER.contains("\"system.get-version\" =>"));
+    }
+}

core/archipelago/src/api/rpc/openwrt.rs

@@ -135,7 +135,7 @@ impl RpcHandler {
                 // not /usr/bin/tollgate-module-basic-go — that's only the opkg/apk
                 // *package* name, never an on-disk filename.
                 let tollgate_installed = router
-                    .run("/usr/bin/opkg list-installed 2>/dev/null | grep -q '^tollgate-module-basic-go ' || \
+                    .run("opkg list-installed 2>/dev/null | grep -q '^tollgate-module-basic-go ' || \
                           test -f /usr/bin/tollgate-wrt 2>/dev/null")
                     .map(|(_, code)| code == 0)
                     .unwrap_or(false);
@@ -150,6 +150,7 @@ impl RpcHandler {
                         "min_steps":     router.uci_get("tollgate.main.min_steps").ok().and_then(|v| v.parse::<u32>().ok()).unwrap_or(1),
                         "currency":      router.uci_get("tollgate.main.currency").unwrap_or_default(),
                         "mint_url":      router.uci_get("tollgate.main.mint_url").unwrap_or_default(),
+                        "payout_address":router.uci_get("tollgate.main.payout_address").unwrap_or_default(),
                     })
                 } else {
                     serde_json::json!({ "installed": false })
@@ -199,10 +200,15 @@ impl RpcHandler {
     ///
     /// Params: `{ "host": "192.168.1.1", "ssh_user": "root", "ssh_password": "",
     ///             "price_sats": 10, "step_size_ms": 60000, "min_steps": 1,
-    ///             "mint_url": "<optional override>" }`
+    ///             "mint_url": "<optional override>",
+    ///             "payout_address": "<optional Lightning address>" }`
     ///
     /// `mint_url` defaults to `http://<this node's IP>:3338` — the local Cashu
     /// mint that must be running as an Archy app before calling this endpoint.
+    ///
+    /// `payout_address` sets the "owner" identity's Lightning address for
+    /// TollGate's own built-in payout (see `config::apply_payout_identity`).
+    /// Omitted or blank leaves whatever's already on the router untouched.
     pub(super) async fn handle_openwrt_provision_tollgate(
         &self,
         params: Option<serde_json::Value>,
@@ -240,12 +246,35 @@ impl RpcHandler {
             .unwrap_or_default();
 
         let default_mint_url = format!("http://{}:{}", self.config.host_ip, LOCAL_MINT_PORT);
+        // Trim trailing slash(es): tollgate-wrt matches a token's embedded
+        // mint URL against this value with an exact string compare, and
+        // Cashu wallets (Minibits included) encode mint URLs without a
+        // trailing slash. A stray slash here means every otherwise-valid
+        // token gets rejected as "untrusted mint" — confirmed live against
+        // archy-x250-pa3 2026-09-07 with a manually-entered
+        // "https://mint.minibits.cash/Bitcoin/".
         let mint_url = p
             .get("mint_url")
             .and_then(|v| v.as_str())
             .unwrap_or(&default_mint_url)
+            .trim_end_matches('/')
             .to_string();
 
+        // `None` (not sent, or sent blank) leaves whatever's already on the
+        // router untouched — see apply_payout_identity's doc comment for why
+        // that matters (an upstream-default placeholder otherwise survives
+        // forever, since nothing else ever writes this field).
+        let payout_address = p
+            .get("payout_address")
+            .and_then(|v| v.as_str())
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(str::to_string);
+        if let Some(address) = payout_address.as_deref() {
+            tollgate::config::validate_payout_address(address)
+                .context("invalid TollGate payout address")?;
+        }
+
         let config = TollGateConfig {
             ssid: "archipelago".to_string(),
             mint_url,
@@ -256,6 +285,7 @@ impl RpcHandler {
                 .unwrap_or(60_000),
             min_steps: p.get("min_steps").and_then(|v| v.as_u64()).unwrap_or(1) as u32,
             enabled: p.get("enabled").and_then(|v| v.as_bool()).unwrap_or(true),
+            payout_address,
         };
 
         // Blocking SSH session, and provision runs `opkg install` over it —

core/archipelago/src/api/rpc/package/async_lifecycle.rs

@@ -55,6 +55,7 @@ impl RpcHandler {
             .to_string();
         super::validation::validate_app_id(&package_id)?;
         super::dependencies::check_bitcoin_pruning_compatibility(&package_id).await?;
+        super::dependencies::check_cuprate_disk_compatibility(&package_id).await?;
 
         // Reject if already in a transitional lifecycle (prevents double-click
         // queuing two installs on the same package).
@@ -294,6 +295,12 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?
             .to_string();
         super::validation::validate_app_id(&package_id)?;
+        // Update is stop → pull → remove → recreate, i.e. a fresh start by
+        // another name: on a disk that shrank since install it would resume
+        // cuprate's unprunable sync unchecked. Same gate as install and
+        // start, run BEFORE the Updating flip so a refusal leaves the app
+        // cleanly in its previous state.
+        super::dependencies::check_cuprate_disk_compatibility(&package_id).await?;
 
         // Reject if already in a transitional lifecycle.
         {
@@ -323,7 +330,7 @@ impl RpcHandler {
         let package_id_spawn = package_id.clone();
         tokio::spawn(async move {
             match handler.handle_package_update(params).await {
-                Ok(_) => {
+                Ok(result) => {
                     info!("package.update {}: complete", package_id_spawn);
                     // Same reasoning as install: the merge_preserving_transitional
                     // helper treats Updating as RPC-owned, so we MUST write the
@@ -338,7 +345,11 @@ impl RpcHandler {
                     set_package_state(
                         &handler.state_manager,
                         &package_id_spawn,
-                        PackageState::Running,
+                        if result.get("status").and_then(|v| v.as_str()) == Some("up-to-date") {
+                            pre_state.clone().unwrap_or(PackageState::Running)
+                        } else {
+                            PackageState::Running
+                        },
                     )
                     .await;
                 }

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -670,6 +670,50 @@ async fn detect_disk_gb() -> u64 {
         .unwrap_or(u64::MAX)
 }
 
+/// Smallest disk (GB, total) a cuprate node can live on. The value and its
+/// rationale live in ONE place — `crate::constants::CUPRATE_MIN_DISK_GB` —
+/// shared with the boot reconciler so install/start and boot can never
+/// disagree about where cuprate may run.
+use crate::constants::CUPRATE_MIN_DISK_GB;
+
+/// The bitcoin apps pick `-prune` automatically when disk is scarce, because
+/// bitcoind supports pruning. Cuprate CANNOT: upstream has no pruning config
+/// at all (the `pruning` crate in its workspace is Monero's p2p *protocol*
+/// pruning, not on-disk pruning), so the disk-scarce equivalent is to refuse
+/// to run cuprate at all rather than let it sync until the filesystem fills —
+/// which took Archipelago itself down on nodes with too little disk.
+fn cuprate_insufficient_disk_message(disk_gb: u64) -> String {
+    format!(
+        "Cuprate needs a disk of at least {} GB and this node has {} GB. \
+         A Monero node cannot run pruned — upstream cuprate has no pruning \
+         support — so the chain (~250 GB and growing) would fill the disk and \
+         take Archipelago down with it. Attach a larger disk (or move \
+         /var/lib/archipelago to one) and try again. Bitcoin apps CAN run \
+         pruned on smaller disks; Monero currently cannot.",
+        CUPRATE_MIN_DISK_GB, disk_gb
+    )
+}
+
+/// Pure decision half of the cuprate disk gate — testable without df.
+pub(super) fn cuprate_disk_gate(disk_gb: u64) -> Option<String> {
+    (disk_gb < CUPRATE_MIN_DISK_GB).then(|| cuprate_insufficient_disk_message(disk_gb))
+}
+
+/// Install/start-time pre-check: refuse cuprate on disks too small to hold
+/// the Monero chain. Mirrors `check_bitcoin_pruning_compatibility`'s
+/// fail-open-on-unknown-disk behaviour (`detect_disk_gb` returns u64::MAX
+/// when df fails, so an unreadable disk never blocks an install).
+pub(super) async fn check_cuprate_disk_compatibility(package_id: &str) -> Result<()> {
+    if package_id != "cuprate" {
+        return Ok(());
+    }
+    let disk_gb = detect_disk_gb().await;
+    if let Some(message) = cuprate_disk_gate(disk_gb) {
+        anyhow::bail!(message);
+    }
+    Ok(())
+}
+
 /// Log informational messages about optional dependencies.
 pub(super) fn log_optional_dep_info(package_id: &str, deps: &RunningDeps) {
     if matches!(package_id, "btcpay-server" | "btcpayserver") && !deps.has_lnd {
@@ -873,9 +917,9 @@ pub(super) fn configure_fedimint_lnd(
 #[cfg(test)]
 mod tests {
     use super::{
-        bitcoin_is_warming_up, dependency_list_declares_archival_bitcoin,
+        bitcoin_is_warming_up, cuprate_disk_gate, dependency_list_declares_archival_bitcoin,
         manifest_declares_archival_bitcoin, order_present_containers, requires_unpruned_bitcoin,
-        startup_order, BITCOIN_WARMUP_BUDGET,
+        startup_order, BITCOIN_WARMUP_BUDGET, CUPRATE_MIN_DISK_GB,
     };
     use archipelago_container::Dependency;
 
@@ -1017,6 +1061,37 @@ mod tests {
         assert!(!manifest_declares_archival_bitcoin("does-not-exist"));
     }
 
+    #[test]
+    fn cuprate_disk_gate_refuses_disks_too_small_for_the_monero_chain() {
+        // 250 GB VPS class: the ~250 GiB chain does not fit, full stop.
+        assert!(cuprate_disk_gate(0).is_some());
+        assert!(cuprate_disk_gate(250).is_some());
+        assert!(cuprate_disk_gate(CUPRATE_MIN_DISK_GB - 1).is_some());
+        assert!(cuprate_disk_gate(CUPRATE_MIN_DISK_GB).is_none());
+        assert!(cuprate_disk_gate(1000).is_none());
+        // df failure reads as u64::MAX — an unreadable disk must not block.
+        assert!(cuprate_disk_gate(u64::MAX).is_none());
+    }
+
+    #[test]
+    fn cuprate_disk_gate_message_names_the_fix_not_just_the_problem() {
+        let msg = cuprate_disk_gate(250).expect("250 GB must be refused");
+        assert!(msg.contains("cannot run pruned"), "{msg}");
+        assert!(msg.contains("larger disk"), "{msg}");
+        assert!(msg.contains("250 GB"), "{msg}");
+    }
+
+    #[tokio::test]
+    async fn cuprate_disk_gate_only_applies_to_cuprate() {
+        // Every other package passes regardless of disk — including the
+        // bitcoin apps, which self-prune via their manifest entrypoint.
+        for package_id in ["bitcoin-knots", "bitcoin-core", "electrumx", "mempool"] {
+            super::check_cuprate_disk_compatibility(package_id)
+                .await
+                .expect("non-cuprate installs must not be gated here");
+        }
+    }
+
     mod dep_wait {
         use super::super::{wait_for_install_deps, DepProbe, DependencyGateError, RunningDeps};
         use std::sync::atomic::{AtomicU32, Ordering};

core/archipelago/src/api/rpc/package/install.rs

@@ -3,10 +3,10 @@ use super::config::{
     is_readonly_compatible, is_valid_docker_image,
 };
 use super::dependencies::{
-    check_bitcoin_pruning_compatibility, configure_fedimint_lnd, detect_existing_containers,
-    detect_running_deps, detect_running_deps_from_package_data, log_optional_dep_info,
-    needs_archy_net, wait_for_install_deps, DepProbe, RunningDeps, DEP_WAIT_INTERVAL,
-    DEP_WAIT_MAX_ATTEMPTS,
+    check_bitcoin_pruning_compatibility, check_cuprate_disk_compatibility, configure_fedimint_lnd,
+    detect_existing_containers, detect_running_deps, detect_running_deps_from_package_data,
+    log_optional_dep_info, needs_archy_net, wait_for_install_deps, DepProbe, RunningDeps,
+    DEP_WAIT_INTERVAL, DEP_WAIT_MAX_ATTEMPTS,
 };
 use super::progress::parse_pull_progress;
 use super::validation::validate_app_id;
@@ -74,110 +74,178 @@ async fn local_podman_image_exists(image: &str) -> Result<bool> {
     }
 }
 
-pub(super) async fn patch_indeedhub_nostr_provider() {
+fn patched_indeedhub_nginx_config(original: &str) -> String {
+    let mut conf = original
+        .lines()
+        .filter(|line| !line.contains("X-Frame-Options"))
+        .collect::<Vec<_>>()
+        .join("\n");
+    conf.push('\n');
+    if !conf.contains("location = /nostr-provider.js {") {
+        conf = conf.replace(
+            "location = /sw.js {",
+            "location = /nostr-provider.js {\n\
+                    add_header Cache-Control \"no-cache, no-store, must-revalidate\";\n\
+                    expires off;\n\
+                }\n\n\
+                location = /sw.js {",
+        );
+    }
+    if conf.contains("try_files") && !conf.contains("sub_filter") {
+        conf = conf.replacen(
+            "try_files $uri $uri/ /index.html;",
+            "try_files $uri $uri/ /index.html;\n\
+                        sub_filter_once on;\n\
+                        sub_filter '</head>' '<script src=\"/nostr-provider.js?v=tab-signer-v4\"></script></head>';",
+            1,
+        );
+    }
+    conf = conf.replace(
+        "src=\"/nostr-provider.js\"",
+        "src=\"/nostr-provider.js?v=tab-signer-v4\"",
+    );
+    conf = conf.replace("tab-signer-v2", "tab-signer-v4");
+    conf = conf.replace("tab-signer-v3", "tab-signer-v4");
+    conf.replace(
+        "proxy_set_header X-Forwarded-Prefix /api;",
+        "proxy_set_header X-Forwarded-Prefix $http_x_forwarded_prefix/api;",
+    )
+}
+
+pub(crate) async fn patch_indeedhub_nostr_provider() {
     tokio::time::sleep(std::time::Duration::from_secs(5)).await;
 
-    let _ = tokio::process::Command::new("podman")
-        .args([
-            "exec",
-            "indeedhub",
-            "sed",
-            "-i",
-            "/X-Frame-Options/d",
-            "/etc/nginx/conf.d/default.conf",
-        ])
+    // Frontend assets can change during a dashboard-only OTA while the
+    // IndeedHub container keeps running. Reconcile the injected provider on
+    // daemon startup as well as app install/start, but stay quiet when the app
+    // is not installed or is intentionally stopped.
+    let running = tokio::process::Command::new("podman")
+        .args(["inspect", "-f", "{{.State.Running}}", "indeedhub"])
         .output()
-        .await;
-
-    let provider_src = "/opt/archipelago/web-ui/nostr-provider.js";
-    if tokio::fs::metadata(provider_src).await.is_ok() {
-        let _ = tokio::process::Command::new("podman")
-            .args([
-                "cp",
-                provider_src,
-                "indeedhub:/usr/share/nginx/html/nostr-provider.js",
-            ])
-            .output()
-            .await;
+        .await
+        .map(|out| out.status.success() && String::from_utf8_lossy(&out.stdout).trim() == "true")
+        .unwrap_or(false);
+    if !running {
+        return;
     }
 
-    let check = tokio::process::Command::new("podman")
-        .args([
-            "exec",
-            "indeedhub",
-            "grep",
-            "-q",
-            "nostr-provider",
-            "/etc/nginx/conf.d/default.conf",
-        ])
+    // `podman exec` cannot always join a rootless container's delegated cgroup
+    // from the system service, while Podman 5's copier refuses to overwrite an
+    // existing regular file. Mount the rootless storage namespace instead;
+    // this replaces both files without entering the container's cgroup.
+    let unique = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_nanos())
+        .unwrap_or(0);
+    let tmp_dir = format!("/tmp/indeedhub-nginx-patch-{}-{unique}", std::process::id());
+    let tmp_path = format!("{tmp_dir}/default.conf");
+    if tokio::fs::create_dir(&tmp_dir).await.is_err() {
+        tracing::warn!("IndeeHub signer reconciliation could not create its temporary directory");
+        return;
+    }
+
+    let mount_out = tokio::process::Command::new("podman")
+        .args(["unshare", "podman", "mount", "indeedhub"])
         .output()
         .await;
-    let already_patched = check.map(|o| o.status.success()).unwrap_or(false);
+    let container_root = mount_out
+        .ok()
+        .filter(|out| out.status.success())
+        .map(|out| String::from_utf8_lossy(&out.stdout).trim().to_string())
+        .filter(|path| {
+            std::path::Path::new(path).is_absolute()
+                && path.contains("/containers/storage/overlay/")
+                && path.ends_with("/merged")
+        });
+    let Some(container_root) = container_root else {
+        let _ = tokio::fs::remove_dir(&tmp_dir).await;
+        tracing::warn!("IndeeHub signer reconciliation could not mount rootless storage");
+        return;
+    };
 
-    if !already_patched {
-        let cat_out = tokio::process::Command::new("podman")
-            .args(["exec", "indeedhub", "cat", "/etc/nginx/conf.d/default.conf"])
+    let provider_src = "/opt/archipelago/web-ui/nostr-provider.js";
+    let provider_dest = format!("{container_root}/usr/share/nginx/html/nostr-provider.js");
+    let provider_copied = tokio::fs::metadata(provider_src).await.is_ok()
+        && tokio::process::Command::new("podman")
+            .args([
+                "unshare",
+                "install",
+                "-m",
+                "644",
+                provider_src,
+                &provider_dest,
+            ])
             .output()
-            .await;
+            .await
+            .map(|out| out.status.success())
+            .unwrap_or(false);
 
-        if let Ok(out) = cat_out {
-            if out.status.success() {
-                let conf = String::from_utf8_lossy(&out.stdout).to_string();
-                let conf = conf.replace(
-                    "location = /sw.js {",
-                    "location = /nostr-provider.js {\n\
-                            add_header Cache-Control \"no-cache, no-store, must-revalidate\";\n\
-                            expires off;\n\
-                        }\n\n\
-                        location = /sw.js {",
-                );
-                let conf = if conf.contains("try_files") && !conf.contains("sub_filter") {
-                    conf.replacen(
-                        "try_files $uri $uri/ /index.html;",
-                        "try_files $uri $uri/ /index.html;\n\
-                                sub_filter_once on;\n\
-                                sub_filter '</head>' '<script src=\"/nostr-provider.js\"></script></head>';",
-                        1,
-                    )
-                } else {
-                    conf
-                };
+    let copy_out = tokio::process::Command::new("podman")
+        .args(["cp", "indeedhub:/etc/nginx/conf.d/default.conf", &tmp_path])
+        .output()
+        .await;
 
-                let tmp_path = "/tmp/indeedhub-nginx-patch.conf";
-                if tokio::fs::write(tmp_path, &conf).await.is_ok() {
-                    let _ = tokio::process::Command::new("podman")
-                        .args(["cp", tmp_path, "indeedhub:/etc/nginx/conf.d/default.conf"])
+    let mut config_copied = false;
+    if let Ok(out) = copy_out {
+        if out.status.success() {
+            if let Ok(original) = tokio::fs::read_to_string(&tmp_path).await {
+                let conf = patched_indeedhub_nginx_config(&original);
+                if conf != original && tokio::fs::write(&tmp_path, &conf).await.is_ok() {
+                    config_copied = tokio::process::Command::new("podman")
+                        .args([
+                            "unshare",
+                            "install",
+                            "-m",
+                            "644",
+                            &tmp_path,
+                            &format!("{container_root}/etc/nginx/conf.d/default.conf"),
+                        ])
                         .output()
-                        .await;
-                    let _ = tokio::fs::remove_file(tmp_path).await;
+                        .await
+                        .map(|out| out.status.success())
+                        .unwrap_or(false);
+                    if config_copied {
+                        let _ = tokio::fs::remove_file(&tmp_path).await;
+                        config_copied = tokio::process::Command::new("podman")
+                            .args(["cp", "indeedhub:/etc/nginx/conf.d/default.conf", &tmp_path])
+                            .output()
+                            .await
+                            .map(|out| out.status.success())
+                            .unwrap_or(false)
+                            && tokio::fs::read_to_string(&tmp_path)
+                                .await
+                                .map(|actual| actual == conf)
+                                .unwrap_or(false);
+                    }
+                } else if conf == original
+                    && conf.contains("location = /nostr-provider.js {")
+                    && conf.contains("src=\"/nostr-provider.js?v=tab-signer-v4\"")
+                {
+                    config_copied = true;
                 }
             }
         }
     }
-
+    let _ = tokio::fs::remove_file(&tmp_path).await;
+    let _ = tokio::fs::remove_dir(&tmp_dir).await;
     let _ = tokio::process::Command::new("podman")
-        .args([
-            "exec",
-            "indeedhub",
-            "sed",
-            "-i",
-            "s|proxy_set_header X-Forwarded-Prefix /api;|proxy_set_header X-Forwarded-Prefix $http_x_forwarded_prefix/api;|",
-            "/etc/nginx/conf.d/default.conf",
-        ])
+        .args(["unshare", "podman", "unmount", "indeedhub"])
         .output()
         .await;
 
     let reload = tokio::process::Command::new("podman")
-        .args(["exec", "indeedhub", "nginx", "-s", "reload"])
+        .args(["kill", "--signal", "HUP", "indeedhub"])
         .output()
         .await;
     match reload {
-        Ok(o) if o.status.success() => {
+        Ok(o) if o.status.success() && provider_copied && config_copied => {
             info!("IndeeHub: NIP-07 provider injected, nginx patched and reloaded");
         }
         Ok(o) => {
             tracing::warn!(
-                "IndeeHub nginx reload failed: {}",
+                "IndeeHub signer reconciliation incomplete (provider_copied={}, config_copied={}): {}",
+                provider_copied,
+                config_copied,
                 String::from_utf8_lossy(&o.stderr)
             );
         }
@@ -306,6 +374,7 @@ impl RpcHandler {
         // failing instantly.
         let deps = self.gate_install_deps(package_id).await?;
         check_bitcoin_pruning_compatibility(package_id).await?;
+        check_cuprate_disk_compatibility(package_id).await?;
         log_optional_dep_info(package_id, &deps);
         if matches!(package_id, "bitcoin" | "bitcoin-core" | "bitcoin-knots") {
             // Materialise the RPC password file before any install path
@@ -1620,124 +1689,10 @@ autopilot.active=false\n",
             }
         }
 
-        // IndeeHub: inject nostr-provider.js and patch container nginx for NIP-07 signing
+        // IndeeHub: inject the current consent-gated provider and make it work
+        // in both the dashboard frame and a direct browser tab.
         if package_id == "indeedhub" {
-            tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-
-            // 1. Remove X-Frame-Options so iframe embedding works
-            let _ = tokio::process::Command::new("podman")
-                .args([
-                    "exec",
-                    "indeedhub",
-                    "sed",
-                    "-i",
-                    "/X-Frame-Options/d",
-                    "/etc/nginx/conf.d/default.conf",
-                ])
-                .output()
-                .await;
-
-            // 2. Copy nostr-provider.js into container
-            let provider_src = "/opt/archipelago/web-ui/nostr-provider.js";
-            if tokio::fs::metadata(provider_src).await.is_ok() {
-                let _ = tokio::process::Command::new("podman")
-                    .args([
-                        "cp",
-                        provider_src,
-                        "indeedhub:/usr/share/nginx/html/nostr-provider.js",
-                    ])
-                    .output()
-                    .await;
-            }
-
-            // 3. Add nostr-provider.js location block + sub_filter injection
-            let check = tokio::process::Command::new("podman")
-                .args([
-                    "exec",
-                    "indeedhub",
-                    "grep",
-                    "-q",
-                    "nostr-provider",
-                    "/etc/nginx/conf.d/default.conf",
-                ])
-                .output()
-                .await;
-            let already_patched = check.map(|o| o.status.success()).unwrap_or(false);
-
-            if !already_patched {
-                // Read current nginx config from container
-                let cat_out = tokio::process::Command::new("podman")
-                    .args(["exec", "indeedhub", "cat", "/etc/nginx/conf.d/default.conf"])
-                    .output()
-                    .await;
-
-                if let Ok(out) = cat_out {
-                    if out.status.success() {
-                        let conf = String::from_utf8_lossy(&out.stdout).to_string();
-
-                        // Insert provider location block before the sw.js location
-                        let conf = conf.replace(
-                            "location = /sw.js {",
-                            "location = /nostr-provider.js {\n\
-                             \x20       add_header Cache-Control \"no-cache, no-store, must-revalidate\";\n\
-                             \x20       expires off;\n\
-                             \x20   }\n\n\
-                             \x20   location = /sw.js {"
-                        );
-
-                        // Inject script tag into HTML via sub_filter
-                        let conf = if conf.contains("try_files") && !conf.contains("sub_filter") {
-                            conf.replacen(
-                                "try_files $uri $uri/ /index.html;",
-                                "try_files $uri $uri/ /index.html;\n\
-                                 \x20       sub_filter_once on;\n\
-                                 \x20       sub_filter '</head>' '<script src=\"/nostr-provider.js\"></script></head>';",
-                                1,
-                            )
-                        } else {
-                            conf
-                        };
-
-                        // Write patched config back into container
-                        let tmp_path = "/tmp/indeedhub-nginx-patch.conf";
-                        if tokio::fs::write(tmp_path, &conf).await.is_ok() {
-                            let _ = tokio::process::Command::new("podman")
-                                .args(["cp", tmp_path, "indeedhub:/etc/nginx/conf.d/default.conf"])
-                                .output()
-                                .await;
-                            let _ = tokio::fs::remove_file(tmp_path).await;
-                        }
-                    }
-                }
-            }
-
-            // 4. Fix X-Forwarded-Prefix for NIP-98 URL reconstruction in iframe context
-            let _ = tokio::process::Command::new("podman")
-                .args(["exec", "indeedhub", "sed", "-i",
-                       "s|proxy_set_header X-Forwarded-Prefix /api;|proxy_set_header X-Forwarded-Prefix $http_x_forwarded_prefix/api;|",
-                       "/etc/nginx/conf.d/default.conf"])
-                .output()
-                .await;
-
-            // 5. Reload nginx to apply changes
-            let reload = tokio::process::Command::new("podman")
-                .args(["exec", "indeedhub", "nginx", "-s", "reload"])
-                .output()
-                .await;
-            match reload {
-                Ok(o) if o.status.success() => {
-                    info!("IndeeHub: NIP-07 provider injected, nginx patched and reloaded");
-                }
-                Ok(o) => {
-                    tracing::warn!(
-                        "IndeeHub nginx reload failed: {}",
-                        String::from_utf8_lossy(&o.stderr)
-                    );
-                }
-                Err(e) => {
-                    tracing::warn!("IndeeHub nginx reload error: {}", e);
-                }
-            }
+            patch_indeedhub_nostr_provider().await;
         }
 
         // Gitea: keep it on its native host port (3001). The UI opens Gitea
@@ -2040,10 +1995,59 @@ autopilot.active=false\n",
             }));
         }
 
+        // Portainer ≥2.21 no longer lets whoever loads the page first claim the
+        // admin account: on a fresh install it mints a one-time setup token and
+        // prints it to the SERVER LOGS, expecting the operator to go digging.
+        // On an appliance that is hostile UX — "check the Portainer server
+        // logs" is exactly the dead end users cannot follow. The token is the
+        // only thing standing between the user and their own app, so surface
+        // it in the same launch interstitial as the login credentials: extract
+        // it from the container logs and hand it over with a copy button.
+        // Once setup completes Portainer invalidates the token, and a container
+        // recreate (any update) drops the log line entirely — so absence of the
+        // line naturally makes the card disappear and no stale token lingers.
+        if app_id == "portainer" {
+            if let Some(token) = portainer_setup_token(self).await {
+                return Ok(serde_json::json!({
+                    "title": "Portainer first-run token",
+                    "description": "New Portainer versions protect the first launch with a one-time setup token instead of letting anyone on the network claim the admin account. Paste this token into Portainer's setup screen to create your administrator login. It is only valid until setup finishes — if you already created your admin account, ignore this.",
+                    "credentials": [
+                        { "label": "Setup token", "value": token, "sensitive": true }
+                    ]
+                }));
+            }
+        }
+
         Ok(serde_json::json!({ "credentials": [] }))
     }
 }
 
+/// Extract Portainer's first-run `setup_token=…` from the live container's
+/// recent logs. `None` when the line is absent (setup already done, or an
+/// older Portainer without the token flow).
+async fn portainer_setup_token(rpc: &RpcHandler) -> Option<String> {
+    let logs = rpc.get_container_logs_value("portainer", 300).await.ok()?;
+    let lines = logs.as_array()?;
+    let lines: Vec<&str> = lines.iter().filter_map(|l| l.as_str()).collect();
+    parse_setup_token(&lines)
+}
+
+/// Pure log-line scan: the token is 64 hex chars after `setup_token=`.
+/// Sear newest-first so the most recent mint wins.
+fn parse_setup_token(lines: &[&str]) -> Option<String> {
+    for line in lines.iter().rev() {
+        let Some(idx) = line.find("setup_token=") else {
+            continue;
+        };
+        let tail = &line[idx + "setup_token=".len()..];
+        let token: String = tail.chars().take_while(|c| c.is_ascii_hexdigit()).collect();
+        if token.len() == 64 {
+            return Some(token);
+        }
+    }
+    None
+}
+
 async fn cleanup_stale_package_ports(package_id: &str) {
     match package_id {
         "grafana" => cleanup_stale_pasta_port("3000").await,
@@ -2740,6 +2744,11 @@ fn uses_orchestrator_install_flow(package_id: &str) -> bool {
             | "gitea"
             | "portainer"
             | "meshtastic"
+            // Build-backed user-facing app. Route it through the production
+            // orchestrator so a fresh node builds its bundled image instead
+            // of treating localhost/archipelago-source:local as a registry
+            // image in the legacy installer.
+            | "archipelago-source"
     )
 }
 
@@ -2751,11 +2760,43 @@ fn is_unknown_app_id_error(err: &anyhow::Error) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        orchestrator_install_app_id, should_try_orchestrator_install,
-        uses_orchestrator_install_flow,
+        orchestrator_install_app_id, parse_setup_token, patched_indeedhub_nginx_config,
+        should_try_orchestrator_install, uses_orchestrator_install_flow,
     };
     use crate::api::rpc::package::runtime::orchestrator_uninstall_app_ids;
 
+    #[test]
+    fn indeedhub_nginx_patch_is_complete_and_idempotent() {
+        let original = r#"server {
+    add_header X-Frame-Options SAMEORIGIN;
+    location = /sw.js {
+        expires off;
+    }
+    location /api/ {
+        proxy_set_header X-Forwarded-Prefix /api;
+    }
+    location / {
+        try_files $uri $uri/ /index.html;
+        sub_filter_once on;
+        sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
+    }
+}
+"#;
+        let patched = patched_indeedhub_nginx_config(original);
+        assert!(!patched.contains("X-Frame-Options"));
+        assert!(patched.contains("location = /nostr-provider.js {"));
+        assert!(patched.contains("Cache-Control \"no-cache, no-store, must-revalidate\""));
+        assert!(patched.contains("src=\"/nostr-provider.js?v=tab-signer-v4\""));
+        assert!(patched.contains("X-Forwarded-Prefix $http_x_forwarded_prefix/api"));
+        assert_eq!(patched_indeedhub_nginx_config(&patched), patched);
+
+        let previous_broker = patched.replace("tab-signer-v4", "tab-signer-v3");
+        let migrated = patched_indeedhub_nginx_config(&previous_broker);
+        assert!(migrated.contains("tab-signer-v4"));
+        assert!(!migrated.contains("tab-signer-v3"));
+        assert_eq!(patched_indeedhub_nginx_config(&migrated), migrated);
+    }
+
     #[test]
     fn orchestrator_install_allowlist_includes_ported_backends() {
         for app in [
@@ -2787,6 +2828,7 @@ mod tests {
             "gitea",
             "portainer",
             "meshtastic",
+            "archipelago-source",
         ] {
             assert!(uses_orchestrator_install_flow(app));
             assert!(should_try_orchestrator_install(app, true));
@@ -2861,4 +2903,41 @@ mod tests {
             "Error: no container with name or ID \"bitcoin-knots\" found"
         ));
     }
+
+    #[test]
+    fn portainer_setup_token_is_extracted_from_log_lines() {
+        // Shape captured live from portainer:2.45.0 on 2026-09-01 — the
+        // token line is plain text inside the bordered s6 log block.
+        let logs = [
+            "2026/09/01 12:38PM INF github.com/portainer/portainer/api/database/boltdb/db.go:163 > loading PortainerDB | filename=portainer.db",
+            "==========================",
+            "setup_token=27637c02b6323972dff76bcad4caa456f957b521d3cfe3bc7fb95d2488dfd23a",
+            "Paste it into the setup screen, or send it in the X-Setup-Token header.",
+            "==========================",
+        ];
+        assert_eq!(
+            parse_setup_token(&logs).as_deref(),
+            Some("27637c02b6323972dff76bcad4caa456f957b521d3cfe3bc7fb95d2488dfd23a")
+        );
+    }
+
+    #[test]
+    fn portainer_setup_token_absent_when_setup_already_done() {
+        // An instance with an existing admin account never prints the line —
+        // the credentials card must not render a stale or empty token.
+        let logs = [
+            "2026/09/01 11:37AM INF api/datastore/migrator/migrate_ce.go:76 > db migrated to 2.45.0 |",
+            "2026/09/01 11:37:38 server: Listening on http://0.0.0.0:8000",
+        ];
+        assert_eq!(parse_setup_token(&logs), None);
+    }
+
+    #[test]
+    fn portainer_setup_token_rejects_short_or_non_hex_values() {
+        assert_eq!(parse_setup_token(&["setup_token=abc123"]), None);
+        assert_eq!(
+            parse_setup_token(&["setup_token=".to_string().as_str()]),
+            None
+        );
+    }
 }

core/archipelago/src/api/rpc/package/mod.rs

@@ -4,6 +4,7 @@ mod dependencies;
 mod install;
 mod lifecycle;
 mod pine_ha;
+pub(crate) use install::patch_indeedhub_nostr_provider;
 pub(crate) use pine_ha::wyoming_satellite_keeper;
 mod progress;
 mod runtime;

core/archipelago/src/api/rpc/package/runtime.rs

@@ -60,6 +60,12 @@ impl RpcHandler {
             .and_then(|v| v.as_str())
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
+        // A cuprate node that starts on a too-small disk fills it and takes
+        // Archipelago down with it (no upstream pruning — see
+        // dependencies::check_cuprate_disk_compatibility). Fail the start
+        // before clearing user-stopped or flipping state, so the app stays
+        // cleanly stopped and the error carries the actionable message.
+        super::dependencies::check_cuprate_disk_compatibility(package_id).await?;
 
         let to_start = if self.orchestrator.is_some() && uses_single_orchestrator_app(package_id) {
             vec![orchestrator_app_id(package_id).to_string()]
@@ -251,6 +257,11 @@ impl RpcHandler {
             .and_then(|v| v.as_str())
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
+        // Restart is stop + recreate, so on a disk that shrank below the cuprate
+        // minimum after install it resumes the doomed unprunable sync just like
+        // start would — same gate, same "fail before clearing user-stopped /
+        // flipping state" contract (see handle_package_start).
+        super::dependencies::check_cuprate_disk_compatibility(package_id).await?;
 
         let single_orchestrator_app =
             self.orchestrator.is_some() && uses_single_orchestrator_app(package_id);

core/archipelago/src/api/rpc/package/stacks.rs

@@ -1559,6 +1559,31 @@ impl RpcHandler {
         self.set_install_progress("indeedhub", n_images, n_images)
             .await;
 
+        // The retired installer injected one fleet-wide AES root directly in
+        // the API/worker environment. Detect those consumers before removing
+        // anything, then persist the legacy value exactly once so an upgrade
+        // cannot orphan encrypted data. A genuinely fresh fallback install
+        // receives a random per-node root instead.
+        let mut had_existing_crypto_consumer = false;
+        for name in [
+            "indeedhub-api",
+            "indeedhub-ffmpeg",
+            "indeedhub-build_api_1",
+            "indeedhub-build_ffmpeg-worker_1",
+        ] {
+            let status =
+                podman_stack_status(&["container", "exists", name], PODMAN_STACK_PROBE_TIMEOUT)
+                    .await?;
+            had_existing_crypto_consumer |= status.success();
+        }
+        let secrets_dir = self.config.data_dir.join("secrets");
+        crate::container::secrets::ensure_indeedhub_aes_master_secret(
+            &secrets_dir,
+            had_existing_crypto_consumer,
+        )
+        .context("preparing IndeedHub encryption root")?;
+        let aes_master = crate::container::secrets::indeedhub_aes_master_secret(&secrets_dir)?;
+
         // Remove any leftover containers from a previous partial install (or
         // from the first-boot frontend stub that used to race the installer).
         // Without this, `podman run --name indeedhub` fails on name conflict
@@ -1759,7 +1784,7 @@ impl RpcHandler {
                 "-e".to_string(),
                 "NOSTR_JWT_EXPIRES_IN=7d".to_string(),
                 "-e".to_string(),
-                "AES_MASTER_SECRET=0123456789abcdef0123456789abcdef".to_string(),
+                format!("AES_MASTER_SECRET={aes_master}"),
                 "-e".to_string(),
                 "ENVIRONMENT=production".to_string(),
                 format!("{registry}/indeedhub-api:1.0.0"),
@@ -1810,7 +1835,7 @@ impl RpcHandler {
                 "-e".to_string(),
                 "ENVIRONMENT=production".to_string(),
                 "-e".to_string(),
-                "AES_MASTER_SECRET=0123456789abcdef0123456789abcdef".to_string(),
+                format!("AES_MASTER_SECRET={aes_master}"),
                 format!("{registry}/indeedhub-ffmpeg:1.0.0"),
             ],
             &tmp_env,

core/archipelago/src/api/rpc/package/update.rs

@@ -19,7 +19,7 @@ use tracing::{error, info, warn};
 const PODMAN_UPDATE_PULL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(600);
 
 impl RpcHandler {
-    /// Update a package to the version pinned in image-versions.sh.
+    /// Update a package to the freshly verified catalog target.
     /// This is a manual operation — the user clicks "Update" in the UI.
     pub(in crate::api::rpc) async fn handle_package_update(
         &self,
@@ -32,6 +32,21 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
 
+        // An Update click must not act on an hourly cache that predates the
+        // button. Fetch and verify first; failure leaves running containers alone.
+        crate::container::app_catalog::refresh_catalog(&self.config.data_dir)
+            .await
+            .context(
+                "Cannot check the signed app catalog; update cancelled before changing containers",
+            )?;
+        if let Some(orch) = &self.orchestrator {
+            // Reload even when bytes did not change: a previous reload may have
+            // failed after the cache was written, or another refresher wrote it.
+            orch.reload_manifests()
+                .await
+                .context("Cannot load current app manifests; update cancelled")?;
+        }
+
         // Resolve the target image. Prefer the remote app catalog (decoupled
         // from the binary OTA), falling back to the image-versions.sh pin. This
         // is OPTIONAL for orchestrator-managed apps: the orchestrator resolves
@@ -42,6 +57,22 @@ impl RpcHandler {
         let pinned = crate::container::app_catalog::catalog_primary_image(package_id)
             .or_else(|| image_versions::pinned_image_for_app(package_id));
 
+        let targets = pinned
+            .as_ref()
+            .map(|target| self.resolve_images_to_pull(package_id, target));
+        if let Some(targets) = &targets {
+            let installed = inspect_update_images(package_id).await?;
+            if !update_targets_need_change(targets, &installed)? {
+                install_log(&format!(
+                    "UPDATE SKIP: {} — target versions already installed",
+                    package_id
+                ))
+                .await;
+                self.clear_install_progress(package_id).await;
+                return Ok(serde_json::json!({"status": "up-to-date", "package_id": package_id}));
+            }
+        }
+
         // Note: the `already updating` guard lives in `spawn_package_update`
         // (the async wrapper that dispatch actually routes to). By the time
         // this inner function runs, the wrapper has already flipped state to
@@ -80,6 +111,12 @@ impl RpcHandler {
             if let Some(orchestrator) = self.orchestrator.as_ref() {
                 match orchestrator.upgrade(orchestrator_app_id).await {
                     Ok(()) => {
+                        if let Some(targets) = &targets {
+                            verify_update_targets(
+                                targets,
+                                &inspect_update_images(package_id).await?,
+                            )?;
+                        }
                         self.set_install_phase(package_id, InstallPhase::WaitingHealthy)
                             .await;
                         if let Ok(health) = orchestrator.health(orchestrator_app_id).await {
@@ -133,7 +170,8 @@ impl RpcHandler {
         };
 
         // Resolve images to pull — either a stack or single container
-        let images_to_pull = self.resolve_images_to_pull(package_id, &pinned);
+        let images_to_pull =
+            targets.unwrap_or_else(|| self.resolve_images_to_pull(package_id, &pinned));
 
         // Get all containers for this app
         let containers = get_containers_for_app(package_id).await?;
@@ -324,15 +362,22 @@ impl RpcHandler {
                 .await;
             if let Ok(o) = status {
                 let state = String::from_utf8_lossy(&o.stdout).trim().to_string();
-                if state == "exited" {
-                    warn!(
-                        "Update {}: container {} exited after recreate",
-                        package_id, name
-                    );
-                }
+                anyhow::ensure!(
+                    o.status.success() && state == "running",
+                    "Update {}: container {} is not running after recreate",
+                    package_id,
+                    name
+                );
+            } else {
+                anyhow::bail!(
+                    "Update {}: cannot inspect recreated container {}",
+                    package_id,
+                    name
+                );
             }
         }
 
+        verify_update_targets(images_to_pull, &inspect_update_images(package_id).await?)?;
         Ok(())
     }
 
@@ -514,6 +559,98 @@ impl RpcHandler {
     }
 }
 
+async fn inspect_update_images(package_id: &str) -> Result<Vec<(String, String)>> {
+    let containers = get_containers_for_app(package_id).await?;
+    anyhow::ensure!(
+        !containers.is_empty(),
+        "No containers found for {}",
+        package_id
+    );
+    let mut command = tokio::process::Command::new("podman");
+    command.arg("inspect").args(&containers).kill_on_drop(true);
+    let output = tokio::time::timeout(std::time::Duration::from_secs(30), command.output())
+        .await
+        .context("Timed out checking installed images")??;
+    anyhow::ensure!(
+        output.status.success(),
+        "Cannot inspect installed images; update cancelled"
+    );
+    let inspected: Vec<serde_json::Value> = serde_json::from_slice(&output.stdout)?;
+    inspected
+        .iter()
+        .map(|entry| {
+            let name = entry
+                .get("Name")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| anyhow::anyhow!("Container inspection omitted Name"))?;
+            let image = entry
+                .get("ImageName")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| anyhow::anyhow!("Container inspection omitted ImageName"))?;
+            Ok((name.trim_start_matches('/').to_string(), image.to_string()))
+        })
+        .collect()
+}
+
+fn installed_image_for_target<'a>(
+    app_id: &str,
+    installed: &'a [(String, String)],
+) -> Option<&'a str> {
+    installed
+        .iter()
+        .find(|(name, _)| {
+            candidate_app_ids_for_container(name)
+                .iter()
+                .any(|id| id == app_id)
+        })
+        .map(|(_, image)| image.as_str())
+}
+
+/// A successful recreate is not proof that it used the downloaded image.
+fn verify_update_targets(
+    targets: &[(String, String)],
+    installed: &[(String, String)],
+) -> Result<()> {
+    for (app_id, target) in targets {
+        let running = installed_image_for_target(app_id, installed).ok_or_else(|| {
+            anyhow::anyhow!("Update {}: target container missing after recreate", app_id)
+        })?;
+        anyhow::ensure!(
+            image_versions::extract_version_from_image(target)
+                == image_versions::extract_version_from_image(running)
+                || image_versions::compare_image_versions(target, running)
+                    == Some(std::cmp::Ordering::Equal),
+            "Update {}: recreated container did not reach target version {}",
+            app_id,
+            image_versions::extract_version_from_image(target)
+        );
+    }
+    Ok(())
+}
+
+/// Check every stack component, not just the version shown on its tile. A
+/// newer backend must still update when its frontend version is unchanged.
+/// A stale target for any component cancels before pulling or stopping anything.
+fn update_targets_need_change(
+    targets: &[(String, String)],
+    installed: &[(String, String)],
+) -> Result<bool> {
+    use std::cmp::Ordering;
+    let mut changed = false;
+    for (app_id, target) in targets {
+        let running = installed_image_for_target(app_id, installed);
+        match running.and_then(|image| image_versions::compare_image_versions(target, image)) {
+            Some(Ordering::Less) => anyhow::bail!(
+                "Catalog target for {} is older than the installed image; refusing downgrade",
+                app_id
+            ),
+            Some(Ordering::Equal) => {}
+            Some(Ordering::Greater) | None => changed = true,
+        }
+    }
+    Ok(changed)
+}
+
 fn should_try_orchestrator_update(package_id: &str, orchestrator_available: bool) -> bool {
     orchestrator_available && !uses_legacy_update_flow(package_id)
 }
@@ -526,11 +663,14 @@ fn orchestrator_update_app_id(package_id: &str) -> &str {
 }
 
 fn uses_legacy_update_flow(package_id: &str) -> bool {
-    matches!(
-        package_id,
-        // Multi-container stacks still updated via the stack-aware path.
-        "immich" | "penpot" | "penpot-frontend" | "indeedhub"
-    )
+    // A primary container already at its target does not mean its backend or
+    // database is current. Route every mapped stack through the component flow.
+    !image_versions::containers_for_stack(package_id).is_empty()
+        || matches!(
+            package_id,
+            // Multi-container stacks still updated via the stack-aware path.
+            "immich" | "penpot" | "penpot-frontend" | "indeedhub"
+        )
 }
 
 fn is_unknown_app_id_error(err: &anyhow::Error) -> bool {
@@ -554,7 +694,12 @@ fn candidate_app_ids_for_container(container_name: &str) -> Vec<String> {
         "archy-bitcoin-ui" => push("bitcoin-ui"),
         "archy-lnd-ui" => push("lnd-ui"),
         "archy-electrs-ui" => push("electrs-ui"),
-        "mempool" => {
+        "mysql-mempool" => push("archy-mempool-db"),
+        "btcpay" | "btcpayserver" | "archy-btcpay" => push("btcpay-server"),
+        "homeassistant" | "archy-homeassistant" => push("home-assistant"),
+        "fedimintd" => push("fedimint"),
+        "electrs" | "mempool-electrs" => push("electrumx"),
+        "mempool" | "mempool-web" => {
             push("archy-mempool-web");
             push("mempool");
         }
@@ -572,27 +717,89 @@ fn candidate_app_ids_for_container(container_name: &str) -> Vec<String> {
 mod tests {
     use super::{
         candidate_app_ids_for_container, orchestrator_update_app_id,
-        should_try_orchestrator_update, uses_legacy_update_flow,
+        should_try_orchestrator_update, update_targets_need_change, uses_legacy_update_flow,
+        verify_update_targets,
     };
 
+    #[test]
+    fn mempool_update_preflight_rejects_stale_catalog_without_reinstalling() {
+        let installed = vec![(
+            "mempool".into(),
+            "r.test/lfg2025/mempool-frontend:v3.3.1-archy1".into(),
+        )];
+        let stale = vec![(
+            "archy-mempool-web".into(),
+            "r.test/lfg2025/mempool-frontend:v3.3.1".into(),
+        )];
+        assert!(update_targets_need_change(&stale, &installed).is_err());
+        let current = vec![(
+            "archy-mempool-web".into(),
+            "r.test/chaum/mempool-frontend:v3.3.1-archy1".into(),
+        )];
+        assert!(!update_targets_need_change(&current, &installed).unwrap());
+        let legacy = vec![(
+            "mempool-web".into(),
+            "r.test/old/mempool-frontend:v3.3.1-archy1".into(),
+        )];
+        assert!(!update_targets_need_change(&current, &legacy).unwrap());
+        let newer = vec![(
+            "archy-mempool-web".into(),
+            "r.test/chaum/mempool-frontend:v3.3.1-archy2".into(),
+        )];
+        assert!(update_targets_need_change(&newer, &installed).unwrap());
+    }
+
+    #[test]
+    fn stack_update_checks_backend_even_when_frontend_matches() {
+        let installed = vec![
+            ("mempool".into(), "r.test/team/web:3.3.1-archy1".into()),
+            ("mempool-api".into(), "r.test/team/api:3.3.1".into()),
+        ];
+        let mut targets = vec![
+            (
+                "archy-mempool-web".into(),
+                "r.test/team/web:3.3.1-archy1".into(),
+            ),
+            ("mempool-api".into(), "r.test/team/api:3.3.2".into()),
+        ];
+        assert!(update_targets_need_change(&targets, &installed).unwrap());
+        targets[0].1 = "r.test/team/web:3.3.1".into();
+        assert!(update_targets_need_change(&targets, &installed).is_err());
+    }
+
+    #[test]
+    fn update_completion_requires_the_target_version_to_be_installed() {
+        let targets = vec![(
+            "archy-mempool-web".into(),
+            "r.test/chaum/mempool-frontend:v3.3.1-archy1".into(),
+        )];
+        let mut installed = vec![(
+            "mempool".into(),
+            "r.test/lfg2025/mempool-frontend:v3.3.1".into(),
+        )];
+        assert!(verify_update_targets(&targets, &installed).is_err());
+        assert!(verify_update_targets(&targets, &[]).is_err());
+        installed[0].1 = "r.test/lfg2025/mempool-frontend:v3.3.1-archy1".into();
+        assert!(verify_update_targets(&targets, &installed).is_ok());
+    }
+
     #[test]
     fn legacy_flow_for_stack_apps() {
-        for app in ["immich", "penpot", "indeedhub"] {
+        for app in [
+            "immich",
+            "penpot",
+            "indeedhub",
+            "mempool",
+            "btcpay-server",
+            "netbird",
+        ] {
             assert!(uses_legacy_update_flow(app), "{app} should stay legacy");
         }
     }
 
     #[test]
     fn orchestrator_flow_for_single_apps() {
-        for app in [
-            "lnd",
-            "bitcoin-core",
-            "searxng",
-            "grafana",
-            "btcpay-server",
-            "mempool",
-            "fedimint",
-        ] {
+        for app in ["lnd", "bitcoin-core", "searxng", "grafana", "fedimint"] {
             assert!(
                 !uses_legacy_update_flow(app),
                 "{app} should be orchestrator-first"

core/archipelago/src/api/rpc/tor/mod.rs

@@ -377,6 +377,23 @@ async fn write_staged_torrc(content: &str, staging: &str) -> Result<()> {
     Ok(())
 }
 
+#[cfg(test)]
+mod known_service_tests {
+    use super::{is_protocol_service, known_service_port};
+
+    #[test]
+    fn bitcoin_core_is_a_protocol_service_on_the_p2p_port() {
+        // Regression: apps/bitcoin-core/manifest.yml uses id "bitcoin-core",
+        // distinct from the legacy "bitcoin"/"bitcoin-knots" ids. Missing
+        // here means auto-enrollment silently skips it (known_service_port
+        // returns 0) and, separately, regenerate_torrc falls back to the
+        // web-app HiddenServicePort-80 default instead of forwarding 8333
+        // straight through.
+        assert_eq!(known_service_port("bitcoin-core"), 8333);
+        assert!(is_protocol_service("bitcoin-core"));
+    }
+}
+
 #[cfg(test)]
 mod torrc_tests {
     use super::app_hidden_service_port_line;
@@ -594,7 +611,7 @@ fn is_valid_v3_onion(s: &str) -> bool {
 pub(in crate::api::rpc) fn known_service_port(name: &str) -> u16 {
     match name {
         "archipelago" => 80,
-        "bitcoin" | "bitcoin-knots" => 8333,
+        "bitcoin" | "bitcoin-core" | "bitcoin-knots" => 8333,
         "electrs" | "electrumx" => 50001,
         "lnd" => 8080,
         "btcpay" | "btcpay-server" | "btcpayserver" => 23000,
@@ -619,7 +636,7 @@ pub(in crate::api::rpc) fn known_service_port(name: &str) -> u16 {
 pub(in crate::api::rpc) fn is_protocol_service(name: &str) -> bool {
     matches!(
         name,
-        "bitcoin" | "bitcoin-knots" | "electrs" | "electrumx" | "lnd"
+        "bitcoin" | "bitcoin-core" | "bitcoin-knots" | "electrs" | "electrumx" | "lnd"
     )
 }
 

core/archipelago/src/api/rpc/wallet.rs

@@ -421,6 +421,33 @@ impl RpcHandler {
         }))
     }
 
+    /// `wallet.ecash-lnaddress` — the node's Minibits Lightning address
+    /// (`<name>@minibits.cash`, LUD-16), derived from and authenticated by the
+    /// ecash wallet's own seed. Registers the profile on first use; safe to call
+    /// on every open of the Cashu receive screen (it is idempotent).
+    pub(super) async fn handle_wallet_ecash_lnaddress(&self) -> Result<serde_json::Value> {
+        crate::wallet::minibits::lnaddress(&self.config.data_dir).await
+    }
+
+    /// `wallet.ecash-lnaddress-claim` — redeem any Lightning payments that
+    /// arrived on the node's Minibits address as ecash. Returns the sats swept in
+    /// (0 when nothing was waiting), so the UI can refresh its balance.
+    /// `failed_count` is non-zero when a payment was fetched (and so already
+    /// consumed server-side) but couldn't be redeemed yet — it stays queued
+    /// and is retried automatically, but the UI should tell the operator
+    /// rather than let it be a silent, unbounded wait.
+    pub(super) async fn handle_wallet_ecash_lnaddress_claim(&self) -> Result<serde_json::Value> {
+        let outcome = crate::wallet::minibits::claim_and_redeem(&self.config.data_dir).await?;
+        Ok(serde_json::json!({
+            "claimed_count": outcome.claimed_count,
+            "received_sats": outcome.received_sats,
+            "failed_count": outcome.failed_count,
+            "receipt_id": outcome.receipt_id,
+            "receipt_sats": outcome.receipt_sats,
+            "receipt_at": outcome.receipt_at,
+        }))
+    }
+
     pub(super) async fn handle_wallet_networking_profits(&self) -> Result<serde_json::Value> {
         let summary = profits::get_networking_profits(&self.config.data_dir).await?;
         Ok(serde_json::json!({

core/archipelago/src/appgate/mod.rs

@@ -148,9 +148,16 @@ impl AppGate {
         let app = live.as_ref().unwrap_or(app);
 
         let path = req.uri().path().to_string();
+        // A dashboard same-origin proxy strips `/app/<id>/` before this gate
+        // sees the URI. Carry that trusted proxy mount into the challenge's
+        // form/assets and its post-login redirect so the browser stays inside
+        // the mounted app instead of posting to the dashboard root.
+        let mount_prefix = forwarded_mount_prefix(req.headers());
 
         if let Some(action) = path.strip_prefix(GATE_PREFIX) {
-            return self.handle_gate_action(req, app, action, client_ip).await;
+            return self
+                .handle_gate_action(req, app, action, client_ip, &mount_prefix)
+                .await;
         }
 
         // A browser fetches a few subresources WITHOUT credentials by
@@ -188,10 +195,25 @@ impl AppGate {
             return proxy_to_app(req, app, false).await;
         }
 
+        // Capture the platform session before the request is moved into the
+        // upstream proxy. Older app-gate sessions (issued before the paired
+        // CSRF-cookie fix) can then repair themselves on the very next app
+        // response, before the app's provider creates its signer iframe.
+        let session_for_csrf = crate::session::extract_session_cookie(req.headers());
+        let needs_csrf_cookie = cookie_value(req.headers(), "csrf_token").is_none();
+
         match self.authorize(req.headers(), &app.app_id).await {
             // The credential was a cookie (or none was needed): the
             // Authorization header, if any, belongs to the app. Forward it.
-            Authorization::Allow => proxy_to_app(req, app, false).await,
+            Authorization::Allow => {
+                let mut response = proxy_to_app(req, app, false).await;
+                if needs_csrf_cookie {
+                    if let Some(token) = session_for_csrf {
+                        set_csrf_cookie(&mut response, &token).await;
+                    }
+                }
+                response
+            }
             // The credential WAS the Authorization header, and it was ours.
             Authorization::AllowGateToken => proxy_to_app(req, app, true).await,
             // 401 rather than a redirect: a redirect to a login page is
@@ -199,7 +221,9 @@ impl AppGate {
             // clients would follow it and parse HTML as if it were their API
             // response. The status says "you are not authenticated" in a way
             // every client understands, and browsers still render the body.
-            Authorization::Challenge => login_page(app, None, StatusCode::UNAUTHORIZED),
+            Authorization::Challenge => {
+                login_page(app, None, StatusCode::UNAUTHORIZED, &mount_prefix)
+            }
         }
     }
 
@@ -229,6 +253,7 @@ impl AppGate {
         app: &GatedPort,
         action: &str,
         client_ip: IpAddr,
+        mount_prefix: &str,
     ) -> Response<Body> {
         // Assets are GET and pre-auth by nature: the login page cannot
         // render its own background or logo without them.
@@ -236,7 +261,7 @@ impl AppGate {
             return self.serve_asset(name);
         }
         if req.method() != Method::POST {
-            return login_page(app, None, StatusCode::OK);
+            return login_page(app, None, StatusCode::OK, mount_prefix);
         }
 
         // Captured before the body is consumed. The pending-2FA session
@@ -253,17 +278,28 @@ impl AppGate {
                 app,
                 Some("Too many attempts. Wait a minute and try again."),
                 StatusCode::TOO_MANY_REQUESTS,
+                mount_prefix,
             );
         }
 
         let form = match read_form(req).await {
             Some(form) => form,
-            None => return login_page(app, Some("Malformed request."), StatusCode::BAD_REQUEST),
+            None => {
+                return login_page(
+                    app,
+                    Some("Malformed request."),
+                    StatusCode::BAD_REQUEST,
+                    mount_prefix,
+                )
+            }
         };
 
         match action {
-            "login" => self.do_login(app, &form, client_ip).await,
-            "totp" => self.do_totp(app, &form, pending, client_ip).await,
+            "login" => self.do_login(app, &form, client_ip, mount_prefix).await,
+            "totp" => {
+                self.do_totp(app, &form, pending, client_ip, mount_prefix)
+                    .await
+            }
             _ => not_found(),
         }
     }
@@ -288,14 +324,25 @@ impl AppGate {
             .expect("asset response builds")
     }
 
-    async fn do_login(&self, app: &GatedPort, form: &Form, client_ip: IpAddr) -> Response<Body> {
+    async fn do_login(
+        &self,
+        app: &GatedPort,
+        form: &Form,
+        client_ip: IpAddr,
+        mount_prefix: &str,
+    ) -> Response<Body> {
         let password = field(form, "password").unwrap_or_default();
 
         match self.auth.verify_password(&password).await {
             Ok(true) => {}
             _ => {
                 self.limiter.record_failure(client_ip).await;
-                return login_page(app, Some("Incorrect password."), StatusCode::UNAUTHORIZED);
+                return login_page(
+                    app,
+                    Some("Incorrect password."),
+                    StatusCode::UNAUTHORIZED,
+                    mount_prefix,
+                );
             }
         }
 
@@ -307,8 +354,8 @@ impl AppGate {
             if let Ok(Some(totp_data)) = self.auth.get_totp_data().await {
                 if let Ok(secret) = crate::totp::decrypt_secret(&totp_data, &password) {
                     let pending = self.sessions.create_pending(secret).await;
-                    let mut resp = totp_page(app, None, StatusCode::OK);
-                    set_session_cookie(&mut resp, &pending);
+                    let mut resp = totp_page(app, None, StatusCode::OK, mount_prefix);
+                    set_session_cookie(&mut resp, &pending).await;
                     return resp;
                 }
             }
@@ -319,12 +366,13 @@ impl AppGate {
                 app,
                 Some("Two-factor data could not be read. Sign in from the dashboard."),
                 StatusCode::INTERNAL_SERVER_ERROR,
+                mount_prefix,
             );
         }
 
         let token = self.sessions.create().await;
-        let mut resp = redirect_to_app();
-        set_session_cookie(&mut resp, &token);
+        let mut resp = redirect_to_app(mount_prefix);
+        set_session_cookie(&mut resp, &token).await;
         resp
     }
 
@@ -334,10 +382,16 @@ impl AppGate {
         form: &Form,
         pending: Option<String>,
         client_ip: IpAddr,
+        mount_prefix: &str,
     ) -> Response<Body> {
         let code = field(form, "code").unwrap_or_default();
         let Some(pending) = pending.filter(|s| !s.is_empty()) else {
-            return login_page(app, Some("Session expired."), StatusCode::UNAUTHORIZED);
+            return login_page(
+                app,
+                Some("Session expired."),
+                StatusCode::UNAUTHORIZED,
+                mount_prefix,
+            );
         };
 
         let Some(secret) = self.sessions.get_pending_secret(&pending).await else {
@@ -345,6 +399,7 @@ impl AppGate {
                 app,
                 Some("Session expired. Start again."),
                 StatusCode::UNAUTHORIZED,
+                mount_prefix,
             );
         };
 
@@ -371,17 +426,27 @@ impl AppGate {
                 }
                 match self.sessions.upgrade_to_full(&pending).await {
                     Some(full) => {
-                        let mut resp = redirect_to_app();
-                        set_session_cookie(&mut resp, &full);
+                        let mut resp = redirect_to_app(mount_prefix);
+                        set_session_cookie(&mut resp, &full).await;
                         resp
                     }
-                    None => login_page(app, Some("Session expired."), StatusCode::UNAUTHORIZED),
+                    None => login_page(
+                        app,
+                        Some("Session expired."),
+                        StatusCode::UNAUTHORIZED,
+                        mount_prefix,
+                    ),
                 }
             }
             _ => {
                 self.limiter.record_failure(client_ip).await;
-                let mut resp = totp_page(app, Some("Incorrect code."), StatusCode::UNAUTHORIZED);
-                set_session_cookie(&mut resp, &pending);
+                let mut resp = totp_page(
+                    app,
+                    Some("Incorrect code."),
+                    StatusCode::UNAUTHORIZED,
+                    mount_prefix,
+                );
+                set_session_cookie(&mut resp, &pending).await;
                 resp
             }
         }
@@ -634,7 +699,7 @@ fn strip_gate_cookies(headers: &mut hyper::HeaderMap) {
     }
 }
 
-fn set_session_cookie(resp: &mut Response<Body>, token: &str) {
+async fn set_session_cookie(resp: &mut Response<Body>, token: &str) {
     // No Domain attribute, so the cookie is host-only. Cookies ignore port,
     // which is what makes one sign-in cover the dashboard and every app port
     // on the same host — and equally why an app on a *different* host (its
@@ -644,12 +709,82 @@ fn set_session_cookie(resp: &mut Response<Body>, token: &str) {
     {
         resp.headers_mut().append(header::SET_COOKIE, value);
     }
+
+    // The dashboard RPC layer requires a readable CSRF cookie as well as the
+    // HttpOnly session cookie. An app-gate login is a complete node login, so
+    // it must establish the same pair as auth.login; otherwise a fresh browser
+    // can open the signer broker but every identity/signing RPC is rejected
+    // with `has_session=true, has_header=false`.
+    set_csrf_cookie(resp, token).await;
 }
 
-fn redirect_to_app() -> Response<Body> {
+async fn set_csrf_cookie(resp: &mut Response<Body>, token: &str) {
+    let csrf = crate::api::rpc::derive_csrf_token(token).await;
+    if let Ok(value) =
+        header::HeaderValue::from_str(&format!("csrf_token={csrf}; SameSite=Lax; Path=/"))
+    {
+        resp.headers_mut().append(header::SET_COOKIE, value);
+    }
+}
+
+fn cookie_value(headers: &HeaderMap, name: &str) -> Option<String> {
+    let prefix = format!("{name}=");
+    headers
+        .get_all(header::COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .flat_map(|value| value.split(';'))
+        .map(str::trim)
+        .find_map(|pair| pair.strip_prefix(&prefix))
+        .filter(|value| !value.is_empty())
+        .map(str::to_owned)
+}
+
+/// Validate the mount supplied by the node's own nginx proxy.
+///
+/// Treat this as untrusted input even though our canonical proxy sets it: a
+/// client can reach an app-gate port directly and forge request headers. Only
+/// a short absolute path made from ordinary URL-path characters is accepted;
+/// protocol-relative URLs, dot segments, escaping and query/fragment syntax
+/// all fall back to the direct-port root.
+fn forwarded_mount_prefix(headers: &HeaderMap) -> String {
+    let Some(raw) = headers
+        .get("x-forwarded-prefix")
+        .and_then(|value| value.to_str().ok())
+    else {
+        return String::new();
+    };
+    let value = raw.trim_end_matches('/');
+    if value.is_empty()
+        || value.len() > 256
+        || !value.starts_with('/')
+        || value.starts_with("//")
+        || value
+            .bytes()
+            .any(|b| !(b.is_ascii_alphanumeric() || matches!(b, b'/' | b'-' | b'_' | b'.')))
+        || value
+            .split('/')
+            .skip(1)
+            .any(|segment| segment.is_empty() || segment == "." || segment == "..")
+    {
+        return String::new();
+    }
+    value.to_owned()
+}
+
+fn gate_url(mount_prefix: &str, action: &str) -> String {
+    format!("{mount_prefix}{GATE_PREFIX}{action}")
+}
+
+fn redirect_to_app(mount_prefix: &str) -> Response<Body> {
+    let location = if mount_prefix.is_empty() {
+        "/".to_owned()
+    } else {
+        format!("{mount_prefix}/")
+    };
     Response::builder()
         .status(StatusCode::SEE_OTHER)
-        .header(header::LOCATION, "/")
+        .header(header::LOCATION, location)
         .body(Body::empty())
         .expect("static response builds")
 }
@@ -674,7 +809,13 @@ dashboard and check {name} under My Apps.</p>"#,
         icon = icon_markup(app),
         name = esc(&app.app_name),
     );
-    let mut resp = page("App not responding", app, &body, StatusCode::BAD_GATEWAY);
+    let mut resp = page(
+        "App not responding",
+        app,
+        &body,
+        StatusCode::BAD_GATEWAY,
+        "",
+    );
     // Header-based refresh, not <meta> or script: page()'s CSP allows no
     // script, and the header keeps the retry out of the document entirely.
     resp.headers_mut()
@@ -707,7 +848,7 @@ fn esc(s: &str) -> String {
 /// the app's own port, so any asset URL would either hit the unauthenticated
 /// app behind it or a different origin the browser may not reach.
 /// One stacked layer per background, each delayed so they cross-fade in turn.
-fn background_layers() -> String {
+fn background_layers(mount_prefix: &str) -> String {
     let step = LOGIN_BACKGROUNDS.len() as u32 * 9 / LOGIN_BACKGROUNDS.len() as u32;
     LOGIN_BACKGROUNDS
         .iter()
@@ -715,7 +856,7 @@ fn background_layers() -> String {
         .map(|(i, name)| {
             format!(
                 r#"<div class="bg" style="background-image:url('{prefix}asset/{name}');animation-delay:{delay}s"></div>"#,
-                prefix = GATE_PREFIX,
+                prefix = gate_url(mount_prefix, ""),
                 delay = i as u32 * step,
             )
         })
@@ -938,7 +1079,13 @@ fn base64_encode(bytes: &[u8]) -> String {
     base64::engine::general_purpose::STANDARD.encode(bytes)
 }
 
-fn page(title: &str, app: &GatedPort, body: &str, status: StatusCode) -> Response<Body> {
+fn page(
+    title: &str,
+    app: &GatedPort,
+    body: &str,
+    status: StatusCode,
+    mount_prefix: &str,
+) -> Response<Body> {
     let html = format!(
         r#"<!doctype html>
 <html lang="en"><head>
@@ -1055,7 +1202,7 @@ button.loading .busy {{ display:inline-flex; align-items:center; gap:.5rem; }}
         app_name = esc(&app.app_name),
         body = body,
         submit_feedback = SUBMIT_FEEDBACK_JS,
-        backgrounds = background_layers(),
+        backgrounds = background_layers(mount_prefix),
         cycle = LOGIN_BACKGROUNDS.len() as u32 * 9,
         hold = 100 / LOGIN_BACKGROUNDS.len() as u32,
         fade = 100 / LOGIN_BACKGROUNDS.len() as u32 + 4,
@@ -1092,7 +1239,12 @@ button.loading .busy {{ display:inline-flex; align-items:center; gap:.5rem; }}
 /// The challenge. Names and pictures the app being opened, so the visitor can
 /// confirm what they are authenticating to rather than being asked for a
 /// password by an unexplained page.
-fn login_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Response<Body> {
+fn login_page(
+    app: &GatedPort,
+    error: Option<&str>,
+    status: StatusCode,
+    mount_prefix: &str,
+) -> Response<Body> {
     let body = format!(
         r#"{logo}
 {icon}
@@ -1110,14 +1262,19 @@ fn login_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Respo
         err = error
             .map(|e| format!(r#"<div class="err">{}</div>"#, esc(e)))
             .unwrap_or_default(),
-        prefix = GATE_PREFIX,
+        prefix = gate_url(mount_prefix, ""),
     );
-    page("Sign in", app, &body, status)
+    page("Sign in", app, &body, status, mount_prefix)
 }
 
 /// Second factor. Reached only after the password verified, and the session
 /// backing it cannot authorise anything until this completes.
-fn totp_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Response<Body> {
+fn totp_page(
+    app: &GatedPort,
+    error: Option<&str>,
+    status: StatusCode,
+    mount_prefix: &str,
+) -> Response<Body> {
     let body = format!(
         r#"{icon}
 <h1>Two-factor code</h1>
@@ -1133,9 +1290,9 @@ fn totp_page(app: &GatedPort, error: Option<&str>, status: StatusCode) -> Respon
         err = error
             .map(|e| format!(r#"<div class="err">{}</div>"#, esc(e)))
             .unwrap_or_default(),
-        prefix = GATE_PREFIX,
+        prefix = gate_url(mount_prefix, ""),
     );
-    page("Two-factor", app, &body, status)
+    page("Two-factor", app, &body, status, mount_prefix)
 }
 
 #[cfg(test)]
@@ -1207,9 +1364,35 @@ mod tests {
         assert_eq!(bearer_token(&headers), None);
     }
 
+    #[test]
+    fn forwarded_mount_prefix_accepts_only_a_safe_absolute_path() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            "x-forwarded-prefix",
+            "/app/archipelago-source/".parse().unwrap(),
+        );
+        assert_eq!(forwarded_mount_prefix(&headers), "/app/archipelago-source");
+
+        for unsafe_value in [
+            "//other.example/app",
+            "/app/../admin",
+            "/app//source",
+            "/app/source?next=//other.example",
+            "https://other.example/app",
+            "/app/%2e%2e/admin",
+        ] {
+            headers.insert("x-forwarded-prefix", unsafe_value.parse().unwrap());
+            assert_eq!(
+                forwarded_mount_prefix(&headers),
+                "",
+                "accepted {unsafe_value}"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn login_page_names_the_app() {
-        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED, "");
         assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
         let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
         let html = String::from_utf8_lossy(&body);
@@ -1222,7 +1405,7 @@ mod tests {
     async fn page_escapes_app_names() {
         let mut app = app();
         app.app_name = r#"<script>alert(1)</script>"#.to_string();
-        let resp = login_page(&app, None, StatusCode::UNAUTHORIZED);
+        let resp = login_page(&app, None, StatusCode::UNAUTHORIZED, "");
         let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
         let html = String::from_utf8_lossy(&body);
         assert!(!html.contains("<script>alert"));
@@ -1235,6 +1418,7 @@ mod tests {
             &app(),
             Some("<img src=x onerror=1>"),
             StatusCode::UNAUTHORIZED,
+            "",
         );
         let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
         let html = String::from_utf8_lossy(&body);
@@ -1293,7 +1477,7 @@ mod tests {
 
     #[test]
     fn challenge_pages_are_uncacheable_and_framable_only_by_this_node() {
-        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED, "");
         assert_eq!(resp.headers()[header::CACHE_CONTROL], "no-store");
         assert!(
             !resp.headers().contains_key("X-Frame-Options"),
@@ -1329,7 +1513,7 @@ mod tests {
     /// never 404 at all.
     #[tokio::test]
     async fn login_page_sources_its_art_from_the_gate() {
-        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED, "");
         let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
         let html = String::from_utf8_lossy(&body).to_string();
         assert_eq!(
@@ -1345,13 +1529,32 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn mounted_login_keeps_forms_assets_and_redirect_inside_the_app() {
+        let mount = "/app/archipelago-source";
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED, mount);
+        let body = hyper::body::to_bytes(resp.into_body()).await.unwrap();
+        let html = String::from_utf8_lossy(&body);
+        assert!(html.contains(r#"action="/app/archipelago-source/__archipelago-gate/login""#));
+        for name in LOGIN_BACKGROUNDS {
+            assert!(html.contains(&format!("/app/archipelago-source{GATE_PREFIX}asset/{name}")));
+        }
+
+        let redirect = redirect_to_app(mount);
+        assert_eq!(redirect.status(), StatusCode::SEE_OTHER);
+        assert_eq!(
+            redirect.headers()[header::LOCATION],
+            "/app/archipelago-source/"
+        );
+    }
+
     /// The only script the challenge pages may run is the submit-feedback
     /// snippet, admitted by hash. The page must carry exactly that script,
     /// and the CSP must name its hash — anything injected has a different
     /// hash and stays inert.
     #[tokio::test]
     async fn submit_feedback_script_is_present_and_hash_pinned() {
-        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED);
+        let resp = login_page(&app(), None, StatusCode::UNAUTHORIZED, "");
         let csp = resp.headers()["Content-Security-Policy"]
             .to_str()
             .unwrap()
@@ -1455,6 +1658,54 @@ mod tests {
         assert!(headers.get(header::COOKIE).is_none());
     }
 
+    #[test]
+    fn cookie_value_finds_only_a_nonempty_named_cookie() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            "app_session=keep; csrf_token=csrf123; empty="
+                .parse()
+                .unwrap(),
+        );
+        assert_eq!(
+            cookie_value(&headers, "csrf_token"),
+            Some("csrf123".to_string())
+        );
+        assert_eq!(cookie_value(&headers, "session"), None);
+        assert_eq!(cookie_value(&headers, "empty"), None);
+    }
+
+    /// An app-gate login must be equivalent to a dashboard login. The session
+    /// cookie alone can load the broker route, but every identity/signing RPC
+    /// also needs the matching readable CSRF cookie.
+    #[tokio::test]
+    async fn app_gate_login_establishes_the_dashboard_csrf_cookie() {
+        let token = "app-gate-session-token";
+        let mut resp = redirect_to_app("");
+
+        set_session_cookie(&mut resp, token).await;
+
+        let cookies: Vec<_> = resp
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .collect();
+        let expected_csrf = crate::api::rpc::derive_csrf_token(token).await;
+        assert!(cookies
+            .iter()
+            .any(|cookie| cookie.starts_with(&format!("session={token};"))));
+        assert!(cookies
+            .iter()
+            .any(|cookie| cookie.starts_with(&format!("csrf_token={expected_csrf};"))));
+        assert!(cookies
+            .iter()
+            .any(|cookie| cookie.starts_with("session=") && cookie.contains("HttpOnly")));
+        assert!(cookies
+            .iter()
+            .any(|cookie| cookie.starts_with("csrf_token=") && !cookie.contains("HttpOnly")));
+    }
+
     /// The regression that killed every Nostr login on 2026-08-06.
     ///
     /// IndeeHub's NIP-98 credential rides in `Authorization: Nostr <event>`

core/archipelago/src/bootstrap.rs

@@ -26,7 +26,7 @@ const DOCTOR_SERVICE: &str =
     include_str!("../../../image-recipe/configs/archipelago-doctor.service");
 const DOCTOR_TIMER: &str = include_str!("../../../image-recipe/configs/archipelago-doctor.timer");
 
-const DOCTOR_SH_PATH: &str = "/home/archipelago/archy/scripts/container-doctor.sh";
+const DOCTOR_SH_PATH: &str = "/opt/archipelago/scripts/container-doctor.sh";
 const DOCTOR_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-doctor.service";
 const DOCTOR_TIMER_PATH: &str = "/etc/systemd/system/archipelago-doctor.timer";
 
@@ -85,6 +85,15 @@ const RUNTIME_ASSETS_DIR: &str = "/opt/archipelago/web-ui/archipelago-runtime";
 /// image-recipe/configs/nginx-archipelago.conf.
 const NGINX_APP_CATALOG_BLOCK: &str = "\n    # App Store catalog proxy — backend fetches from configured registries\n    # so the browser doesn't hit CORS/CSP. Without this block nginx falls\n    # through to the SPA index.html and the frontend gets HTML back instead\n    # of JSON.\n    location /api/app-catalog {\n        proxy_pass http://127.0.0.1:5678;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header Cookie $http_cookie;\n        proxy_connect_timeout 15s;\n        proxy_read_timeout 30s;\n        proxy_send_timeout 15s;\n        error_page 502 503 = @backend_unavailable;\n        error_page 504 = @backend_timeout;\n    }\n\n";
 
+const NGINX_SOURCE_PROXY_BLOCK: &str = "    # GitWorkshop follows the dashboard origin so LAN, Tailscale, FIPS, Tor,\n    # hostnames and reverse proxies all use the connection that already works.\n    location /app/archipelago-source/ {\n        proxy_pass http://127.0.0.2:8337/;\n        proxy_http_version 1.1;\n        proxy_set_header Host $http_host;\n        proxy_set_header Cookie $http_cookie;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header X-Forwarded-Prefix /app/archipelago-source;\n        proxy_hide_header X-Frame-Options;\n        add_header X-Frame-Options \"SAMEORIGIN\" always;\n        add_header X-Content-Type-Options \"nosniff\" always;\n        proxy_read_timeout 300s;\n    }\n";
+
+const NGINX_SOURCE_PROXY_BLOCK_SNIPPET: &str = "# GitWorkshop follows the dashboard origin; the app gate keeps the route\n# session-authenticated before it reaches the loopback-only container.\nlocation /app/archipelago-source/ {\n    proxy_pass http://127.0.0.2:8337/;\n    proxy_http_version 1.1;\n    proxy_set_header Host $http_host;\n    proxy_set_header Cookie $http_cookie;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Prefix /app/archipelago-source;\n    proxy_hide_header X-Frame-Options;\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    proxy_read_timeout 300s;\n}\n";
+
+/// The normal dashboard sends X-Frame-Options SAMEORIGIN. This one document
+/// must be frameable by an app on another port of the same node so tabs and
+/// companion WebViews can use the same authenticated signer UI.
+const NGINX_NOSTR_SIGNER_BLOCK: &str = "    # Dashboard-origin Nostr signer for tab/WebView apps.\n    location = /nostr-signer {\n        try_files /index.html =404;\n        add_header Cache-Control \"no-store\" always;\n        add_header X-Content-Type-Options \"nosniff\" always;\n        add_header Referrer-Policy \"no-referrer\" always;\n        add_header Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self' http://$host:* https://$host:*; base-uri 'none'; form-action 'none';\" always;\n    }\n\n";
+
 const NGINX_BITCOIN_STATUS_BLOCK: &str = "\n    location /bitcoin-status {\n        proxy_pass http://127.0.0.1:5678/bitcoin-status;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_connect_timeout 10s;\n        proxy_read_timeout 10s;\n        proxy_send_timeout 5s;\n        error_page 502 503 = @backend_unavailable;\n        error_page 504 = @backend_timeout;\n    }\n";
 
 /// Inserted into every server block that lacks the `/proxy/lnd/` proxy. Nodes
@@ -1231,7 +1240,7 @@ async fn run() -> Result<bool> {
 
     let mut changed = false;
 
-    // 1. Script — lives in archipelago's home dir, user-writable.
+    // 1. Script — lives in the canonical OTA runtime scripts directory.
     if needs_write(DOCTOR_SH_PATH, DOCTOR_SH).await {
         fs::write(DOCTOR_SH_PATH, DOCTOR_SH)
             .await
@@ -1580,6 +1589,62 @@ fn heal_stale_web_search_block(content: &str) -> Option<String> {
     ))
 }
 
+fn heal_missing_source_proxy(content: &str) -> Option<String> {
+    if content.contains("location /app/archipelago-source/") {
+        return None;
+    }
+    let indented_anchor = "    location /app/gitea/ {";
+    if content.contains(indented_anchor) {
+        return Some(content.replace(
+            indented_anchor,
+            &format!("{}{}", NGINX_SOURCE_PROXY_BLOCK, indented_anchor),
+        ));
+    }
+    let snippet_anchor = "location /app/gitea/ {";
+    content.contains(snippet_anchor).then(|| {
+        content.replace(
+            snippet_anchor,
+            &format!("{}{}", NGINX_SOURCE_PROXY_BLOCK_SNIPPET, snippet_anchor),
+        )
+    })
+}
+
+/// Older same-origin GitWorkshop blocks stripped the app mount but did not
+/// tell the app gate what was stripped. Its challenge therefore posted to
+/// `/__archipelago-gate/login` on the dashboard and nginx returned 405. Add
+/// the mount header to every canonical source block (HTTP and HTTPS snippet).
+fn heal_source_forwarded_prefix(content: &str) -> Option<String> {
+    if !content.contains("proxy_pass http://127.0.0.2:8337/;") {
+        return None;
+    }
+    let mut healed = content.to_owned();
+    for indent in ["        ", "    "] {
+        let old = format!(
+            "proxy_pass http://127.0.0.2:8337/;\n{indent}proxy_http_version 1.1;\n{indent}proxy_set_header Host $http_host;\n{indent}proxy_set_header Cookie $http_cookie;\n{indent}proxy_set_header X-Real-IP $remote_addr;\n{indent}proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n{indent}proxy_set_header X-Forwarded-Proto $scheme;\n{indent}proxy_hide_header X-Frame-Options;"
+        );
+        let new = old.replace(
+            &format!("\n{indent}proxy_hide_header X-Frame-Options;"),
+            &format!(
+                "\n{indent}proxy_set_header X-Forwarded-Prefix /app/archipelago-source;\n{indent}proxy_hide_header X-Frame-Options;"
+            ),
+        );
+        healed = healed.replace(&old, &new);
+    }
+    (healed != content).then_some(healed)
+}
+
+fn heal_missing_nostr_signer(content: &str) -> Option<String> {
+    if content.contains("location = /nostr-signer") {
+        return None;
+    }
+    // The anchor occurs once in each complete HTTP/HTTPS dashboard server and
+    // does not occur in the separate app-proxy snippet.
+    let anchor = "    location /aiui/ {";
+    content
+        .contains(anchor)
+        .then(|| content.replace(anchor, &format!("{}{}", NGINX_NOSTR_SIGNER_BLOCK, anchor)))
+}
+
 async fn patch_nginx_conf(path: &str) -> Result<bool> {
     let content = fs::read_to_string(path)
         .await
@@ -1610,6 +1675,9 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     let missing_v6_https =
         content.contains("listen 443 ssl default_server;") && !content.contains("listen [::]:443");
     let stale_web_search = heal_stale_web_search_block(&content).is_some();
+    let missing_source_proxy = heal_missing_source_proxy(&content).is_some();
+    let missing_source_prefix = heal_source_forwarded_prefix(&content).is_some();
+    let missing_nostr_signer = heal_missing_nostr_signer(&content).is_some();
     if !missing_app_catalog
         && !missing_bitcoin_status
         && !missing_lnd_proxy
@@ -1620,6 +1688,9 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
         && !missing_v6_http
         && !missing_v6_https
         && !stale_web_search
+        && !missing_source_proxy
+        && !missing_source_prefix
+        && !missing_nostr_signer
     {
         return Ok(false);
     }
@@ -1629,6 +1700,15 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     if let Some(p) = heal_stale_web_search_block(&patched) {
         patched = p;
     }
+    if let Some(p) = heal_missing_source_proxy(&patched) {
+        patched = p;
+    }
+    if let Some(p) = heal_source_forwarded_prefix(&patched) {
+        patched = p;
+    }
+    if let Some(p) = heal_missing_nostr_signer(&patched) {
+        patched = p;
+    }
 
     if missing_v6_http {
         patched = patched.replace(
@@ -1796,6 +1876,17 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn doctor_service_uses_the_canonical_ota_script_path() {
+        let expected = format!("ExecStart={} --local", DOCTOR_SH_PATH);
+        assert!(DOCTOR_SERVICE.lines().any(|line| line == expected));
+        assert_eq!(
+            DOCTOR_SH_PATH,
+            "/opt/archipelago/scripts/container-doctor.sh"
+        );
+        assert!(!DOCTOR_SERVICE.contains("/home/archipelago/archy/"));
+    }
+
     #[test]
     fn podman_heal_outcome_no_longer_has_cleanup_variant() {
         let outcome = PodmanHealOutcome::Unhealthy;
@@ -1817,6 +1908,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn source_proxy_uses_same_origin_through_authenticated_app_gate() {
+        let main = "server {\n    location /app/gitea/ {\n    }\n}\nserver {\n    location /app/gitea/ {\n    }\n}";
+        let healed = heal_missing_source_proxy(main).expect("source proxy must be added");
+        assert_eq!(
+            healed.matches("location /app/archipelago-source/").count(),
+            2
+        );
+        assert!(healed.contains("proxy_pass http://127.0.0.2:8337/;"));
+        assert!(healed.contains("proxy_set_header Cookie $http_cookie;"));
+        assert!(healed.contains("proxy_set_header X-Forwarded-Prefix /app/archipelago-source;"));
+        assert!(heal_missing_source_proxy(&healed).is_none());
+
+        let snippet = "location /app/gitea/ {\n}";
+        let healed = heal_missing_source_proxy(snippet).expect("snippet must be patched");
+        assert!(healed.starts_with("# GitWorkshop follows the dashboard origin"));
+    }
+
+    #[test]
+    fn existing_source_proxy_gets_the_forwarded_mount_once() {
+        let stale = "location /app/archipelago-source/ {\n    proxy_pass http://127.0.0.2:8337/;\n    proxy_http_version 1.1;\n    proxy_set_header Host $http_host;\n    proxy_set_header Cookie $http_cookie;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_hide_header X-Frame-Options;\n}";
+        let healed = heal_source_forwarded_prefix(stale).expect("mount header must be added");
+        assert_eq!(
+            healed
+                .matches("X-Forwarded-Prefix /app/archipelago-source")
+                .count(),
+            1
+        );
+        assert!(heal_source_forwarded_prefix(&healed).is_none());
+    }
+
+    #[test]
+    fn nostr_signer_is_added_to_each_dashboard_server_only_once() {
+        let main =
+            "server {\n    location /aiui/ {\n    }\n}\nserver {\n    location /aiui/ {\n    }\n}";
+        let healed = heal_missing_nostr_signer(main).expect("signer route must be added");
+        assert_eq!(healed.matches("location = /nostr-signer").count(), 2);
+        assert!(healed.contains("frame-ancestors 'self' http://$host:* https://$host:*"));
+        assert!(heal_missing_nostr_signer(&healed).is_none());
+        assert!(heal_missing_nostr_signer("location /app/gitea/ {}\n").is_none());
+    }
+
     /// The exact ExecStart framework-pt shipped with must parse, and the
     /// rewrite must preserve its listen port and forward target.
     #[test]

core/archipelago/src/constants.rs

@@ -9,3 +9,19 @@ pub const DWN_HEALTH_URL: &str = "http://127.0.0.1:3100/health";
 
 /// Tor SOCKS5 proxy for outbound onion connections.
 pub const TOR_SOCKS_PROXY: &str = "socks5h://127.0.0.1:9050";
+
+/// Smallest disk (GB, total) a cuprate node may be installed, started,
+/// restarted, updated, or boot-reconciled onto. Cuprate has no on-disk
+/// pruning (verified against upstream `cuprated/src/config.rs` — the
+/// `pruning` crate is Monero's p2p protocol pruning), so unlike the bitcoin
+/// apps it cannot self-shrink on a scarce disk; below this line the ~250 GiB
+/// Monero chain simply does not fit and running it would fill the filesystem
+/// and take Archipelago down. 450 = chain + growth/headroom: allows
+/// 500 GB-class disks, refuses the 250 GB VPS class.
+///
+/// SINGLE SOURCE OF TRUTH — the RPC gates
+/// (`api::rpc::package::dependencies`) and the boot reconciler
+/// (`container::prod_orchestrator`) both read this; a drift between them
+/// would silently reopen the disk-fill failure the gate exists to close.
+/// Keep `apps/cuprate/manifest.yml` (storage dependency + comments) aligned.
+pub const CUPRATE_MIN_DISK_GB: u64 = 450;

core/archipelago/src/container/app_catalog.rs

@@ -24,6 +24,7 @@
 //! Unknown fields are ignored (no `deny_unknown_fields`), so adding fields on the
 //! publisher side never breaks older nodes.
 
+use anyhow::Context;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -194,6 +195,27 @@ fn entry_for(app_id: &str) -> Option<AppCatalogEntry> {
     load_catalog().apps.get(app_id).cloned()
 }
 
+/// Return the cached catalog bytes only when they carry a signature anchored
+/// to the release root. This is the browser App Store's source: newly signed
+/// apps must appear without waiting for a frontend OTA, while unsigned or
+/// self-signed registry data must never become an install button.
+pub async fn verified_catalog_body(data_dir: &Path) -> anyhow::Result<String> {
+    let path = data_dir.join(APP_CATALOG_FILE);
+    let body = tokio::fs::read_to_string(&path)
+        .await
+        .with_context(|| format!("read signed app catalog {}", path.display()))?;
+    let raw: serde_json::Value = serde_json::from_str(&body)?;
+    match crate::trust::verify_detached(&raw)? {
+        crate::trust::SignatureStatus::Verified { anchored: true, .. } => Ok(body),
+        crate::trust::SignatureStatus::Verified {
+            anchored: false, ..
+        } => {
+            anyhow::bail!("app catalog signer is not anchored to the release root")
+        }
+        crate::trust::SignatureStatus::Unsigned => anyhow::bail!("app catalog is unsigned"),
+    }
+}
+
 /// Primary image for an app per the remote catalog, if covered.
 pub fn catalog_primary_image(app_id: &str) -> Option<String> {
     entry_for(app_id).and_then(|e| e.image)
@@ -378,7 +400,7 @@ pub fn available_update_for_app(app_id: &str, running_image: &str) -> Option<Str
     }
     if let Some(catalog_image) = catalog_primary_image(app_id) {
         // Catalog covers this app with a concrete image -> authoritative.
-        return crate::container::image_versions::available_update_for_images(
+        return crate::container::image_versions::available_catalog_update_for_images(
             &catalog_image,
             running_image,
         );
@@ -641,4 +663,27 @@ mod tests {
             ]
         );
     }
+
+    // The signed-catalog body served to the browser must be the anchored,
+    // release-root-verified bytes — and nothing else. Unsigned caches (the
+    // migration-window form) and self-consistent-but-unanchored signatures
+    // must both be refused so a tampered mirror can never become an install
+    // button (same posture as the OTA manifest supply-chain gate).
+    #[tokio::test]
+    async fn verified_catalog_body_rejects_unsigned_cache() {
+        let dir = tempfile::tempdir().unwrap();
+        write_cache(
+            dir.path(),
+            r#"{"schema":1,"apps":{"demo":{"version":"1"}}}"#,
+        )
+        .unwrap();
+        let err = verified_catalog_body(dir.path()).await.unwrap_err();
+        assert!(err.to_string().contains("unsigned"));
+    }
+
+    #[tokio::test]
+    async fn verified_catalog_body_rejects_missing_cache() {
+        let dir = tempfile::tempdir().unwrap();
+        assert!(verified_catalog_body(dir.path()).await.is_err());
+    }
 }

core/archipelago/src/container/companion.rs

@@ -10,6 +10,7 @@
 //! | lnd              | archy-lnd-ui       | wallet/channel UI        |
 //! | electrumx        | archy-electrs-ui   | indexer status UI        |
 //! | fedimint         | archy-fedimint-ui  | wait/proxy Guardian UI   |
+//! | cuprate          | archy-cuprate-ui   | Monero node status UI    |
 //!
 //! Lifecycle: `install` writes a Quadlet `.container` unit to
 //! `~/.config/containers/systemd/`, daemon-reloads, then starts the
@@ -97,6 +98,7 @@ pub fn companions_for(package_id: &str) -> &'static [CompanionSpec] {
         "lnd" => LND_UI,
         "electrumx" | "electrs" | "mempool-electrs" => ELECTRS_UI,
         "fedimint" | "fedimintd" => FEDIMINT_UI,
+        "cuprate" => CUPRATE_UI,
         _ => &[],
     }
 }
@@ -104,7 +106,8 @@ pub fn companions_for(package_id: &str) -> &'static [CompanionSpec] {
 /// Every companion this build knows how to provision. Kept beside
 /// `companions_for` — a new companion must be added to both, or the reaper
 /// will not recognise it as one of ours and will leave it running forever.
-const ALL_COMPANIONS: &[&[CompanionSpec]] = &[BITCOIN_UI, LND_UI, ELECTRS_UI, FEDIMINT_UI];
+const ALL_COMPANIONS: &[&[CompanionSpec]] =
+    &[BITCOIN_UI, LND_UI, ELECTRS_UI, FEDIMINT_UI, CUPRATE_UI];
 
 const BITCOIN_UI: &[CompanionSpec] = &[CompanionSpec {
     name: "archy-bitcoin-ui",
@@ -172,6 +175,24 @@ const FEDIMINT_UI: &[CompanionSpec] = &[CompanionSpec {
     host_network: true,
 }];
 
+const CUPRATE_UI: &[CompanionSpec] = &[CompanionSpec {
+    name: "archy-cuprate-ui",
+    image_base: "cuprate-ui",
+    build_dir_candidates: &[
+        "/opt/archipelago/docker/cuprate-ui",
+        "/home/archipelago/archy/docker/cuprate-ui",
+        "/home/archipelago/Projects/archy/docker/cuprate-ui",
+    ],
+    // No pre-start hook and no bind mounts: unlike bitcoin-ui there is no
+    // secret to inject. Cuprate's restricted RPC (the only thing this UI
+    // proxies) is unauthenticated by design — Monero's safe-for-public
+    // subset — so the nginx.conf is baked into the image.
+    pre_start: None,
+    bind_mounts: &[],
+    ports: &[],
+    host_network: true,
+}];
+
 fn render_bitcoin_ui() -> futures_util::future::BoxFuture<'static, Result<()>> {
     Box::pin(async {
         let paths = crate::container::bitcoin_ui::RenderPaths::default();
@@ -869,6 +890,7 @@ mod tests {
             "mempool-electrs",
             "fedimint",
             "fedimintd",
+            "cuprate",
         ];
         let known: std::collections::HashSet<&str> = ALL_COMPANIONS
             .iter()
@@ -893,6 +915,7 @@ mod tests {
             names(&orphan_companions(&[])),
             vec![
                 "archy-bitcoin-ui",
+                "archy-cuprate-ui",
                 "archy-electrs-ui",
                 "archy-fedimint-ui",
                 "archy-lnd-ui"
@@ -906,7 +929,10 @@ mod tests {
         // electrumx installed, fedimint and lnd not — yet all four companions
         // were running because the reconciler was fed the manifest list.
         let orphans = orphan_companions(&ids(&["bitcoin-knots", "electrumx"]));
-        assert_eq!(names(&orphans), vec!["archy-fedimint-ui", "archy-lnd-ui"]);
+        assert_eq!(
+            names(&orphans),
+            vec!["archy-cuprate-ui", "archy-fedimint-ui", "archy-lnd-ui"]
+        );
     }
 
     #[test]
@@ -926,12 +952,18 @@ mod tests {
     #[test]
     fn apps_without_companions_orphan_everything_and_panic_nothing() {
         let orphans = orphan_companions(&ids(&["nextcloud", "not-a-real-app"]));
-        assert_eq!(orphans.len(), 4);
+        assert_eq!(orphans.len(), 5);
     }
 
     #[test]
     fn every_backend_installed_leaves_no_orphans() {
-        let orphans = orphan_companions(&ids(&["bitcoin-knots", "lnd", "electrumx", "fedimint"]));
+        let orphans = orphan_companions(&ids(&[
+            "bitcoin-knots",
+            "lnd",
+            "electrumx",
+            "fedimint",
+            "cuprate",
+        ]));
         assert!(
             names(&orphans).is_empty(),
             "unexpected orphans: {:?}",
@@ -970,7 +1002,12 @@ mod tests {
         let due = due_after_grace(orphans, &names_seen, &mut since, start + ORPHAN_GRACE);
         assert_eq!(
             names(&due),
-            vec!["archy-electrs-ui", "archy-fedimint-ui", "archy-lnd-ui"]
+            vec![
+                "archy-cuprate-ui",
+                "archy-electrs-ui",
+                "archy-fedimint-ui",
+                "archy-lnd-ui"
+            ]
         );
     }
 
@@ -1024,6 +1061,7 @@ mod tests {
         assert_eq!(companions_for("mempool-electrs").len(), 1);
         assert_eq!(companions_for("fedimint").len(), 1);
         assert_eq!(companions_for("fedimintd").len(), 1);
+        assert_eq!(companions_for("cuprate").len(), 1);
         assert_eq!(companions_for("nextcloud").len(), 0);
         assert_eq!(companions_for("not-a-real-app").len(), 0);
     }

core/archipelago/src/container/docker_packages.rs

@@ -141,6 +141,12 @@ impl DockerPackageScanner {
 
             // Get metadata for this app
             let metadata = get_app_metadata(&app_id);
+            // Manifest-owned metadata (icon) wins over the static table: the
+            // manifest is what the catalog signed and what the App Store shows,
+            // so it is also what an installed tile must render.
+            let manifest_icon = real_manifest_metadata(&app_id)
+                .and_then(|m| m.get("icon").and_then(|v| v.as_str()).map(str::to_string))
+                .filter(|s| !s.trim().is_empty());
 
             // Resolve UI address: separate UI containers > static map > dynamic ports
             let lan_address = if app_id == "netbird" {
@@ -191,7 +197,7 @@ impl DockerPackageScanner {
                 static_files: StaticFiles {
                     license: "MIT".to_string(),
                     instructions: metadata.description.clone(),
-                    icon: metadata.icon.clone(),
+                    icon: manifest_icon.unwrap_or_else(|| metadata.icon.clone()),
                 },
                 manifest: Manifest {
                     id: app_id.clone(),
@@ -211,28 +217,34 @@ impl DockerPackageScanner {
                     author: Some("Archipelago".to_string()),
                     website: lan_address.clone(),
                     tier: Some(metadata.tier.to_string()),
-                    interfaces: if lan_address.is_some() || tor_address.is_some() {
+                    interfaces: {
                         // `ui` is no longer implied by a published port: a
                         // headless backend with an exposed port is a service,
                         // not a launchable app. ui_detection consults the
                         // manifest declaration first, then HTTP-probes the
-                        // port. Addresses stay present either way so the
-                        // Services tab can still show where a backend lives.
+                        // port. A DECLARED UI classifies the app as launchable
+                        // even when no reachable address was confirmed this
+                        // scan — the launch button falls back to the static
+                        // port map, and burying a manifest-declared UI app
+                        // (Alby Hub) in Services because a probe missed was
+                        // exactly the classification bug this fixes.
                         let has_ui = super::ui_detection::has_web_ui(
                             &app_id,
                             lan_address.as_deref(),
                             package_state == PackageState::Running,
                         )
                         .await;
-                        Some(Interfaces {
-                            main: Some(MainInterface {
-                                ui: has_ui.then(|| "true".to_string()),
-                                tor_config: tor_address.clone(),
-                                lan_config: None,
-                            }),
-                        })
-                    } else {
-                        None
+                        if lan_address.is_some() || tor_address.is_some() || has_ui {
+                            Some(Interfaces {
+                                main: Some(MainInterface {
+                                    ui: has_ui.then(|| "true".to_string()),
+                                    tor_config: tor_address.clone(),
+                                    lan_config: None,
+                                }),
+                            })
+                        } else {
+                            None
+                        }
                     },
                 },
                 available_update,
@@ -322,6 +334,47 @@ fn is_transient_podman_helper(app_id: &str, ports: &[String]) -> bool {
         && right.chars().all(|c| c.is_ascii_lowercase())
 }
 
+/// Raw `metadata` block of an installed app's real manifest — catalog overlay
+/// first (origin-wins), disk manifest as fallback. Kept as raw JSON because
+/// the typed `AppManifest` deliberately does not model `metadata`, yet its
+/// `icon` is what makes an installed app's tile render the right icon on
+/// every surface (My Apps, Services, launcher, companion) instead of the
+/// generic A-mark — the exact regression Cuprate exposed on install.
+fn real_manifest_metadata(app_id: &str) -> Option<serde_json::Value> {
+    for (id, value) in crate::container::app_catalog::catalog_manifest_values() {
+        if id == app_id {
+            return value.get("app").and_then(|a| a.get("metadata")).cloned();
+        }
+    }
+    let mut candidates = Vec::new();
+    if let Ok(dir) = std::env::var("ARCHIPELAGO_DATA_DIR") {
+        candidates.push(
+            std::path::PathBuf::from(dir)
+                .join("../apps")
+                .join(app_id)
+                .join("manifest.yml"),
+        );
+    }
+    candidates.push(
+        std::path::PathBuf::from("/opt/archipelago/apps")
+            .join(app_id)
+            .join("manifest.yml"),
+    );
+    for path in candidates {
+        let Ok(content) = std::fs::read_to_string(&path) else {
+            continue;
+        };
+        let Ok(value) = serde_yaml::from_str::<serde_json::Value>(&content) else {
+            continue;
+        };
+        let meta = value.get("app").and_then(|a| a.get("metadata")).cloned();
+        if meta.is_some() {
+            return meta;
+        }
+    }
+    None
+}
+
 fn get_app_metadata(app_id: &str) -> AppMetadata {
     let mut meta = match app_id {
         "bitcoin-core" => AppMetadata {
@@ -604,9 +657,19 @@ fn apply_dynamic_metadata(app_id: &str, meta: &mut AppMetadata) {
 /// Map app_id to Tor hidden service directory name.
 /// "archipelago" is the main web UI (nginx port 80).
 /// Supports container names from deploy (archy-*, btcpay-server, etc.).
+///
+/// This must match what enrollment actually names the hidden service dir
+/// with — both the install-time auto-enroll (`install.rs`) and the manual
+/// `tor.create-service` RPC write `HiddenServiceDir` using the raw
+/// `package_id`/`name` verbatim, with no canonicalization. So `bitcoin-core`
+/// gets its own identity arm rather than folding into the "bitcoin" alias:
+/// aliasing it here without also canonicalizing the write side would point
+/// this lookup at `hidden_service_bitcoin`, which never gets created — the
+/// on-disk dir is always `hidden_service_bitcoin-core` for this app id.
 fn tor_service_name(app_id: &str) -> Option<&'static str> {
     match app_id {
         "archipelago" => Some("archipelago"),
+        "bitcoin-core" => Some("bitcoin-core"),
         "bitcoin" | "bitcoin-knots" | "bitcoind" => Some("bitcoin"),
         "electrumx" | "electrs" | "electrum" => Some("electrumx"),
         "lnd" | "lnd-ui" => Some("lnd"),
@@ -853,6 +916,28 @@ mod launch_url_port_tests {
     }
 }
 
+#[cfg(test)]
+mod tor_service_name_tests {
+    use super::tor_service_name;
+
+    #[test]
+    fn bitcoin_core_resolves_to_its_own_hidden_service_dir() {
+        // Regression: enrollment (install.rs, tor.create-service) writes
+        // HiddenServiceDir/tor-hostnames entries using the raw package_id
+        // verbatim, never canonicalized. Aliasing "bitcoin-core" to the
+        // shared "bitcoin" name here would point reads at a directory
+        // enrollment never creates.
+        assert_eq!(tor_service_name("bitcoin-core"), Some("bitcoin-core"));
+    }
+
+    #[test]
+    fn legacy_bitcoin_ids_share_the_bitcoin_alias() {
+        assert_eq!(tor_service_name("bitcoin"), Some("bitcoin"));
+        assert_eq!(tor_service_name("bitcoin-knots"), Some("bitcoin"));
+        assert_eq!(tor_service_name("bitcoind"), Some("bitcoin"));
+    }
+}
+
 #[cfg(test)]
 mod extract_lan_address_tests {
     use super::extract_lan_address;

core/archipelago/src/container/image_versions.rs

@@ -100,6 +100,12 @@ fn parse_image_versions(content: &str) -> HashMap<String, String> {
 
         // Match VAR="value" or VAR=value
         if let Some((key, val)) = parse_assignment(line) {
+            // Read a self-default assignment without evaluating shell code.
+            let default_prefix = format!("${{{key}:-");
+            let val = val
+                .strip_prefix(&default_prefix)
+                .and_then(|v| v.strip_suffix('}'))
+                .unwrap_or(val);
             let expanded = val.replace("$ARCHY_REGISTRY", &registry);
             if key == "ARCHY_REGISTRY" {
                 registry = expanded.clone();
@@ -146,6 +152,7 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
         "bitcoin-ui" | "archy-bitcoin-ui" => Some("BITCOIN_UI_IMAGE"),
         "lnd-ui" | "archy-lnd-ui" => Some("LND_UI_IMAGE"),
         "electrs-ui" | "archy-electrs-ui" => Some("ELECTRS_UI_IMAGE"),
+        "cuprate-ui" | "archy-cuprate-ui" => Some("CUPRATE_UI_IMAGE"),
 
         // Mempool stack (primary = web)
         "mempool" | "mempool-web" | "archy-mempool-web" => Some("MEMPOOL_WEB_IMAGE"),
@@ -163,7 +170,6 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
         "vaultwarden" => Some("VAULTWARDEN_IMAGE"),
         "nextcloud" => Some("NEXTCLOUD_IMAGE"),
         "searxng" => Some("SEARXNG_IMAGE"),
-        "cryptpad" => Some("CRYPTPAD_IMAGE"),
         "filebrowser" => Some("FILEBROWSER_IMAGE"),
         "nginx-proxy-manager" => Some("NPM_IMAGE"),
         "portainer" => Some("PORTAINER_IMAGE"),
@@ -178,20 +184,11 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
 
         // Nostr / VPN
         "nostr-rs-relay" => Some("NOSTR_RS_RELAY_IMAGE"),
-        "nostr-vpn" => Some("NOSTR_VPN_IMAGE"),
-        "fips" => Some("FIPS_IMAGE"),
 
         // Immich (primary = server)
         "immich" | "immich_server" => Some("IMMICH_SERVER_IMAGE"),
 
-        // Penpot (primary = frontend)
-        "penpot" | "penpot-frontend" => Some("PENPOT_FRONTEND_IMAGE"),
-
-        // AI
-        "routstr" => Some("ROUTSTR_IMAGE"),
-
         // Networking
-        "adguardhome" => Some("ADGUARDHOME_IMAGE"),
         "tor" | "archy-tor" => Some("ALPINE_TOR_IMAGE"),
 
         _ => None,
@@ -214,48 +211,71 @@ pub fn available_update_for_app(app_id: &str, running_image: &str) -> Option<Str
 }
 
 pub fn available_update_for_images(pinned: &str, running_image: &str) -> Option<String> {
-    let pinned_version = extract_version_from_image(&pinned);
+    if image_without_registry_or_tag(pinned) != image_without_registry_or_tag(running_image) {
+        return None;
+    }
+    available_catalog_update_for_images(pinned, running_image)
+}
+
+/// A signed catalog binds the image to an app id, so a publisher namespace
+/// migration must not hide a real upgrade. Baseline pins still require the
+/// same repository via `available_update_for_images` above.
+pub fn available_catalog_update_for_images(pinned: &str, running_image: &str) -> Option<String> {
+    let pinned_version = extract_version_from_image(pinned);
     if is_floating_tag(&pinned_version) {
         return None;
     }
-
-    let running_version = extract_version_from_image(running_image);
-    if pinned_version == running_version {
-        return None;
-    }
-
-    let pinned_repo = image_without_registry_or_tag(&pinned);
-    let running_repo = image_without_registry_or_tag(running_image);
-    if pinned_repo != running_repo {
-        return None;
-    }
-
-    // Never advertise a LOWER version as an update.
-    //
-    // Everything upstream of here is a version claim that can go stale: the
-    // signed catalog, a legacy catalog entry with no manifest, the
-    // image-versions.sh baseline pin. When one lags behind what a node is
-    // actually running, a bare `pinned != running` check turns that staleness
-    // into an "Update" button that rolls the node BACKWARDS — and a rollback
-    // to a version withdrawn for a vulnerability is precisely the case where
-    // that must not happen. Observed with BTCPay: 2.4.2 installed, a stale
-    // 2.3.9 pin, and the UI offering "update" to the exploited release.
-    //
-    // Only suppress when both tags parse as comparable version numbers, so
-    // apps with opaque tags (RELEASE.2024-11-07T00-52-20Z, 14-vectorchord0.4.3)
-    // keep the previous behaviour rather than silently losing updates.
-    if let (Some(p), Some(r)) = (
-        parse_version_parts(&pinned_version),
-        parse_version_parts(&running_version),
+    if matches!(
+        compare_image_versions(pinned, running_image),
+        Some(std::cmp::Ordering::Less | std::cmp::Ordering::Equal)
     ) {
-        if p < r {
-            return None;
-        }
+        return None;
     }
-
     Some(pinned_version)
 }
 
+/// Compare explicit image tags, ignoring registry and namespace. `None` means
+/// unknown ordering (including floating tags), never permission to downgrade.
+/// Archipelago's `-archyN` is a downstream patch revision ABOVE the upstream
+/// release, not a SemVer prerelease below it.
+pub fn compare_image_versions(target: &str, running: &str) -> Option<std::cmp::Ordering> {
+    use std::cmp::Ordering;
+    let target = extract_version_from_image(target);
+    let running = extract_version_from_image(running);
+    if is_floating_tag(&target) || is_floating_tag(&running) {
+        return None;
+    }
+    let target = target.strip_prefix('v').unwrap_or(&target);
+    let running = running.strip_prefix('v').unwrap_or(&running);
+    if target == running {
+        return Some(Ordering::Equal);
+    }
+    let mut target_core = parse_version_parts(target)?;
+    let mut running_core = parse_version_parts(running)?;
+    while target_core.last() == Some(&0) {
+        target_core.pop();
+    }
+    while running_core.last() == Some(&0) {
+        running_core.pop();
+    }
+    match target_core.cmp(&running_core) {
+        Ordering::Equal => {
+            fn patch_revision(tag: &str) -> Option<u64> {
+                if let Some((base, revision)) = tag.rsplit_once("-archy") {
+                    if base.chars().all(|c| c.is_ascii_digit() || c == '.') {
+                        return revision.parse().ok();
+                    }
+                }
+                tag.chars()
+                    .all(|c| c.is_ascii_digit() || c == '.')
+                    .then_some(0)
+            }
+            Some(patch_revision(target)?.cmp(&patch_revision(running)?))
+        }
+        order => Some(order),
+    }
+}
+
 /// Numeric components of a version tag, for ordering comparisons only.
 ///
 /// Accepts a leading `v` and a trailing pre-release suffix (`v0.18.4-beta`),
@@ -341,13 +361,6 @@ pub fn containers_for_stack(app_id: &str) -> Vec<(&'static str, &'static str)> {
             ("immich_redis", "REDIS_IMAGE"),
             ("immich_server", "IMMICH_SERVER_IMAGE"),
         ],
-        "penpot" | "penpot-frontend" => vec![
-            ("penpot-postgres", "PENPOT_POSTGRES_IMAGE"),
-            ("penpot-valkey", "PENPOT_VALKEY_IMAGE"),
-            ("penpot-backend", "PENPOT_BACKEND_IMAGE"),
-            ("penpot-exporter", "PENPOT_EXPORTER_IMAGE"),
-            ("penpot-frontend", "PENPOT_FRONTEND_IMAGE"),
-        ],
         "netbird" => vec![
             ("netbird", "NETBIRD_PROXY_IMAGE"),
             ("netbird-dashboard", "NETBIRD_DASHBOARD_IMAGE"),
@@ -439,6 +452,57 @@ mod tests {
         );
     }
 
+    #[test]
+    fn downstream_patch_is_newer_than_upstream_and_orders_revisions() {
+        let upstream = "registry.test/team/mempool-frontend:v3.3.1";
+        let patch1 = "registry.test/team/mempool-frontend:v3.3.1-archy1";
+        let patch2 = "registry.test/team/mempool-frontend:v3.3.1-archy2";
+        assert_eq!(available_update_for_images(upstream, patch1), None);
+        assert_eq!(available_update_for_images(patch1, patch2), None);
+        assert_eq!(
+            available_update_for_images(patch1, upstream),
+            Some("v3.3.1-archy1".into())
+        );
+        assert_eq!(
+            available_update_for_images(patch2, patch1),
+            Some("v3.3.1-archy2".into())
+        );
+    }
+
+    #[test]
+    fn catalog_namespace_migration_does_not_hide_patch_or_offer_reinstall() {
+        let old = "registry.test/lfg2025/mempool-frontend:v3.3.1";
+        let patched = "registry.test/chaum/mempool-frontend:v3.3.1-archy1";
+        assert_eq!(
+            available_catalog_update_for_images(patched, old),
+            Some("v3.3.1-archy1".into())
+        );
+        assert_eq!(
+            available_catalog_update_for_images(
+                patched,
+                "registry.test/lfg2025/mempool-frontend:v3.3.1-archy1"
+            ),
+            None
+        );
+        assert_eq!(available_update_for_images(patched, old), None);
+    }
+
+    #[test]
+    fn equivalent_version_spelling_does_not_offer_update() {
+        assert_eq!(
+            available_update_for_images("r.test/team/app:v3.3.1", "r.test/team/app:3.3.1"),
+            None
+        );
+        assert_eq!(
+            available_update_for_images("r.test/team/app:3.3.0", "r.test/team/app:3.3"),
+            None
+        );
+        assert_eq!(
+            compare_image_versions("r.test/team/app:latest", "r.test/team/app:latest"),
+            None
+        );
+    }
+
     #[test]
     fn test_parse_image_versions() {
         let content = r#"
@@ -461,6 +525,22 @@ NOT_AN_IMAGE="something"
         assert!(!parsed.contains_key("ARCHY_REGISTRY"));
     }
 
+    #[test]
+    fn shipped_image_pins_expand_shell_defaults_to_concrete_refs() {
+        let images = parse_image_versions(include_str!("../../../../scripts/image-versions.sh"));
+        assert_eq!(
+            images["MEMPOOL_WEB_IMAGE"],
+            "source.archipelago-foundation.org/chaum/mempool-frontend:v3.3.1-archy1"
+        );
+        assert_eq!(
+            images["MEMPOOL_BACKEND_IMAGE"],
+            "source.archipelago-foundation.org/lfg2025/mempool-backend:v3.3.1"
+        );
+        assert!(images
+            .values()
+            .all(|v| !v.contains('$') && !v.contains('}')));
+    }
+
     #[test]
     fn test_image_var_mapping() {
         assert_eq!(image_var_for_app("lnd"), Some("LND_IMAGE"));

core/archipelago/src/container/lnd.rs

@@ -96,125 +96,21 @@ pub async fn ensure_wallet_initialized() -> Result<()> {
         if file_exists_as_root(admin_macaroon).await && lnd_getinfo_ready(admin_macaroon).await {
             return Ok(());
         }
-        match unlock_existing_wallet().await? {
-            true => {
-                wait_for_admin_macaroon(admin_macaroon).await?;
-                return Ok(());
-            }
-            false => {
-                // Every candidate password was actively rejected: this wallet was
-                // created with a password this node no longer has, so it can never
-                // auto-unlock unattended. Alpha nodes hold no real funds and a wallet
-                // locked with an unknown password is already inaccessible, so wipe +
-                // recreate it on the per-node secret to self-heal at boot.
-                recreate_wallet_destructively().await?;
-                wait_for_admin_macaroon(admin_macaroon).await?;
-                return Ok(());
-            }
-        }
+        unlock_existing_wallet_no_wipe().await?;
+        wait_for_admin_macaroon(admin_macaroon).await?;
+        return Ok(());
     }
 
     init_wallet_via_rest().await?;
     wait_for_admin_macaroon(admin_macaroon).await
 }
 
-/// LND data subdirectories holding wallet + channel + graph state. Removing them
-/// returns LND to a NON_EXISTING wallet state. Funds-bearing data lives here too,
-/// so deletion is destructive — only done once the wallet is already unrecoverable.
-const LND_STATE_DIRS: &[&str] = &[
-    "/var/lib/archipelago/lnd/data/chain",
-    "/var/lib/archipelago/lnd/data/graph",
-];
+/// Canonical on-host admin macaroon — same path the RPC layer reads.
+const LND_ADMIN_MACAROON: &str =
+    "/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/admin.macaroon";
 
-/// Podman container name for the core LND app (see `compute_container_name`:
-/// non-UI core apps keep their bare id). LND runs as a plain bridge-network
-/// container, not a Quadlet unit, so it is restarted via `podman`, not systemctl.
-const LND_CONTAINER: &str = "lnd";
-
-/// Archipelago data dir (default; not overridden in prod). Holds the
-/// `user-stopped.json` that gates health-monitor auto-restart.
 const ARCHY_DATA_DIR: &str = "/var/lib/archipelago";
 
-/// Destroy an unrecoverable LND wallet and recreate a fresh one keyed to the
-/// per-node secret. Suppresses health-monitor auto-restart for the wipe window,
-/// stops LND, deletes its wallet/chain/graph state as root, restarts it, waits
-/// for NON_EXISTING, then inits a fresh wallet. Destructive — only called when no
-/// candidate password can open the existing wallet.
-async fn recreate_wallet_destructively() -> Result<()> {
-    tracing::warn!(
-        "[lnd] wallet is locked with an unknown password and cannot auto-unlock; \
-         wiping and recreating it on the per-node secret (DESTRUCTIVE)"
-    );
-
-    // The health monitor restarts any container it sees stopped; mark LND
-    // user-stopped so it doesn't re-launch (and re-open the wallet) mid-wipe.
-    // Always cleared below so LND auto-recovers normally afterwards.
-    let data_dir = std::path::Path::new(ARCHY_DATA_DIR);
-    crate::crash_recovery::mark_user_stopped(data_dir, LND_CONTAINER).await;
-    let result = wipe_and_reinit_wallet().await;
-    crate::crash_recovery::clear_user_stopped(data_dir, LND_CONTAINER).await;
-    result
-}
-
-async fn wipe_and_reinit_wallet() -> Result<()> {
-    podman_user_scoped(&["stop", LND_CONTAINER])
-        .await
-        .context("stopping lnd before wallet wipe")?;
-
-    for dir in LND_STATE_DIRS {
-        let status = host_sudo(&["rm", "-rf", dir])
-            .await
-            .with_context(|| format!("removing {dir}"))?;
-        if !status.success() {
-            anyhow::bail!("removing {dir} exited with {status}");
-        }
-    }
-
-    podman_user_scoped(&["start", LND_CONTAINER])
-        .await
-        .context("restarting lnd after wallet wipe")?;
-
-    wait_for_wallet_state("NON_EXISTING").await?;
-    init_wallet_via_rest().await
-}
-
-/// Run `podman <args>` inside a transient `systemd-run --user --scope`, matching
-/// how the orchestrator/health-monitor manage rootless containers (keeps the
-/// container out of the archipelago service's cgroup).
-async fn podman_user_scoped(args: &[&str]) -> Result<()> {
-    let out = tokio::process::Command::new("systemd-run")
-        .args(["--user", "--scope", "--quiet", "--collect", "podman"])
-        .args(args)
-        .output()
-        .await
-        .with_context(|| format!("systemd-run --user --scope podman {}", args.join(" ")))?;
-    if !out.status.success() {
-        anyhow::bail!(
-            "podman {} failed: {}",
-            args.join(" "),
-            String::from_utf8_lossy(&out.stderr).trim()
-        );
-    }
-    Ok(())
-}
-
-/// Poll `/v1/state` until LND reports `target`, or time out after ~120s.
-async fn wait_for_wallet_state(target: &str) -> Result<()> {
-    let client = reqwest::Client::builder()
-        .no_proxy()
-        .timeout(std::time::Duration::from_secs(5))
-        .danger_accept_invalid_certs(true)
-        .build()
-        .context("building LND REST client")?;
-    for _ in 0..120 {
-        if wallet_state(&client).await.as_deref() == Some(target) {
-            return Ok(());
-        }
-        tokio::time::sleep(std::time::Duration::from_secs(1)).await;
-    }
-    anyhow::bail!("LND did not reach state {target} after wallet wipe")
-}
-
 async fn file_exists_as_root(path: &str) -> bool {
     if std::path::Path::new(path).exists() {
         return true;
@@ -386,14 +282,8 @@ async fn unlock_existing_wallet_via_rest() -> Result<bool> {
     )
 }
 
-/// Unlock an existing wallet WITHOUT the destructive fallback.
-///
-/// `ensure_wallet_initialized` wipes and recreates a wallet no candidate
-/// password can open — correct for a boot path that must self-heal, and exactly
-/// wrong for macaroon rotation, which restarts LND against a wallet the operator
-/// still wants. Rotation calls this instead, so there is no code path from
-/// "rotate my credentials" to "delete my wallet": a rejected password surfaces
-/// as an error the caller reports, never as a wipe.
+/// Unlock the existing wallet, preserving its identity and channel data when
+/// passwords are unavailable or rejected. Used by boot and credential rotation.
 pub(crate) async fn unlock_existing_wallet_no_wipe() -> Result<()> {
     match unlock_existing_wallet().await? {
         true => Ok(()),
@@ -534,7 +424,7 @@ async fn init_wallet_via_rest() -> Result<()> {
     {
         UnlockerResponse::Value(seed) => seed,
         UnlockerResponse::WalletAlreadyExists => {
-            unlock_existing_wallet().await?;
+            unlock_existing_wallet_no_wipe().await?;
             return Ok(());
         }
     };
@@ -565,7 +455,7 @@ async fn init_wallet_via_rest() -> Result<()> {
             .await;
         }
         UnlockerResponse::WalletAlreadyExists => {
-            unlock_existing_wallet().await?;
+            unlock_existing_wallet_no_wipe().await?;
         }
     }
 
@@ -872,6 +762,188 @@ fn cert_sha256_thumbprint(pem: &str) -> Result<String> {
     Ok(hex::encode_upper(Sha256::digest(&der)))
 }
 
+// ── Channel-peer watchdog ──────────────────────────────────────────────────
+
+/// Every open channel's remote peer that is NOT currently connected.
+/// Pure over LND's REST JSON so the selection can be unit-tested.
+///
+/// `/v1/peers` uses `pub_key`; `/v1/channels` uses `remote_pubkey` — the
+/// asymmetry is LND's, not ours.
+fn select_reconnect_targets(
+    channels: &serde_json::Value,
+    peers: &serde_json::Value,
+) -> Vec<String> {
+    let connected: std::collections::HashSet<&str> = peers
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|p| p.get("pub_key").and_then(|v| v.as_str()))
+                .collect()
+        })
+        .unwrap_or_default();
+    let mut targets: Vec<String> = channels
+        .get("channels")
+        .and_then(|c| c.as_array())
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|c| c.get("remote_pubkey").and_then(|v| v.as_str()))
+                .filter(|pk| !connected.contains(pk))
+                .map(str::to_string)
+                .collect()
+        })
+        .unwrap_or_default();
+    targets.sort();
+    targets.dedup();
+    targets
+}
+
+/// Reconnect peers of open channels that LND has not re-established on its
+/// own. Returns the number of peers reconnected this pass.
+///
+/// LND normally reconnects channel peers after a restart — but not reliably:
+/// when the restart outages are long or repeated (an app update, a node
+/// reboot, reconciler churn), the peer link can stay down for hours while
+/// BOTH endpoints keep flagging the channel `disabled` in the routing
+/// graph. The node itself looks perfectly healthy and every payment in
+/// either direction fails "no route to the recipient" — observed live on
+/// framework-pt (2026-09-01): its only channel sat disabled on both policy
+/// sides for ~17h after the LND 0.21.2 update, while the wallet showed
+/// plenty of outbound. The channel graph is desired state; this keeps it.
+///
+/// Quietly returns Ok(0) when LND is not installed or its wallet is locked —
+/// that is every node without LND, on every pass.
+///
+/// `last_attempt` throttles retries per peer (`min_retry`) so an unreachable
+/// peer is not hammered every pass; the caller owns the map so the pass
+/// itself stays stateless and testable.
+pub(crate) async fn reconnect_disconnected_channel_peers(
+    last_attempt: &mut std::collections::HashMap<String, std::time::Instant>,
+    min_retry: std::time::Duration,
+) -> Result<usize> {
+    let Ok(macaroon) = read_file_as_root(LND_ADMIN_MACAROON).await else {
+        return Ok(0); // LND not installed (or not initialized yet)
+    };
+    let macaroon_hex = hex::encode(macaroon);
+    let client = reqwest::Client::builder()
+        .no_proxy()
+        .timeout(std::time::Duration::from_secs(8))
+        .danger_accept_invalid_certs(true)
+        .build()
+        .context("building LND REST client for the channel-peer watchdog")?;
+
+    let channels: serde_json::Value = client
+        .get(format!("{LND_REST_BASE_URL}/v1/channels"))
+        .header("Grpc-Metadata-macaroon", &macaroon_hex)
+        .send()
+        .await
+        .context("LND REST: listing channels for the peer watchdog")?
+        .json()
+        .await
+        .context("parsing LND channel list")?;
+    // A locked wallet answers 503 with an error body — it parses as JSON
+    // with no "channels" key, which selects nothing. That is a quiet pass.
+    let peers: serde_json::Value = client
+        .get(format!("{LND_REST_BASE_URL}/v1/peers"))
+        .header("Grpc-Metadata-macaroon", &macaroon_hex)
+        .send()
+        .await
+        .context("LND REST: listing peers for the peer watchdog")?
+        .json()
+        .await
+        .context("parsing LND peer list")?;
+
+    let mut reconnected = 0usize;
+    for pubkey in select_reconnect_targets(&channels, &peers) {
+        if last_attempt
+            .get(&pubkey)
+            .is_some_and(|t| t.elapsed() < min_retry)
+        {
+            continue;
+        }
+        last_attempt.insert(pubkey.clone(), std::time::Instant::now());
+
+        // Where does the peer live? Its advertised addresses in the public
+        // graph. A peer with none (fully private) cannot be dialed from here
+        // — LND itself may still find it; we only log the gap once per pass.
+        // Unknown to the public graph (or the graph query failed) — nothing
+        // to dial on.
+        let Ok(node) = client
+            .get(format!("{LND_REST_BASE_URL}/v1/graph/node/{pubkey}"))
+            .header("Grpc-Metadata-macaroon", &macaroon_hex)
+            .send()
+            .await
+            .and_then(|r| r.error_for_status())
+        else {
+            continue;
+        };
+        let Ok(node) = node.json::<serde_json::Value>().await else {
+            continue;
+        };
+        let addresses: Vec<String> = node
+            .get("node")
+            .and_then(|n| n.get("addresses"))
+            .and_then(|a| a.as_array())
+            .map(|arr| {
+                arr.iter()
+                    .filter_map(|a| a.get("addr").and_then(|v| v.as_str()))
+                    .map(str::to_string)
+                    .collect()
+            })
+            .unwrap_or_default();
+        if addresses.is_empty() {
+            tracing::warn!(
+                peer = %pubkey,
+                "LND channel peer is disconnected and advertises no address — cannot dial it; payments through this channel stay unroutable"
+            );
+            continue;
+        }
+
+        for addr in addresses {
+            let Some((host, port)) = addr.rsplit_once(':') else {
+                continue;
+            };
+            let Ok(port) = port.parse::<u32>() else {
+                continue;
+            };
+            let body = serde_json::json!({
+                "perm": false,
+                "timeout": "15s",
+                "addr": { "pubkey": pubkey, "host": host, "port": port },
+            });
+            match client
+                .post(format!("{LND_REST_BASE_URL}/v1/peers"))
+                .header("Grpc-Metadata-macaroon", &macaroon_hex)
+                .json(&body)
+                .send()
+                .await
+            {
+                Ok(resp) if resp.status().is_success() => {
+                    reconnected += 1;
+                    tracing::info!(
+                        peer = %pubkey,
+                        addr = %addr,
+                        "reconnected a disconnected channel peer (channel was unroutable)"
+                    );
+                    break;
+                }
+                Ok(resp) => {
+                    let msg = resp.text().await.unwrap_or_default();
+                    // Already connected between our list call and now — success.
+                    if msg.contains("already connected") {
+                        break;
+                    }
+                    tracing::debug!(peer = %pubkey, addr = %addr, %msg, "channel-peer connect attempt failed");
+                }
+                Err(e) => {
+                    tracing::debug!(peer = %pubkey, addr = %addr, error = %e, "channel-peer connect attempt failed");
+                }
+            }
+        }
+    }
+    Ok(reconnected)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -985,4 +1057,35 @@ mod tests {
         let cands = unlock_password_candidates().await;
         assert!(cands.iter().any(|p| p == LEGACY_WALLET_PASSWORD));
     }
+
+    #[test]
+    fn reconnect_targets_pick_disconnected_channel_peers_only() {
+        // Shape captured from a live node: /v1/channels uses remote_pubkey,
+        // /v1/peers uses pub_key, and an offline channel's peer is simply
+        // absent from the peer list — that absence is the whole signal.
+        let channels = serde_json::json!({
+            "channels": [
+                { "remote_pubkey": "AAA", "active": true },
+                { "remote_pubkey": "BBB", "active": false },
+                { "remote_pubkey": "AAA" }
+            ]
+        });
+        let peers = serde_json::json!({ "peers": [ { "pub_key": "AAA" } ] });
+
+        let targets = select_reconnect_targets(&channels, &peers);
+        assert_eq!(targets, vec!["BBB".to_string()]);
+    }
+
+    #[test]
+    fn reconnect_targets_empty_without_channels_or_peers() {
+        // No LND wallet (503 error body), locked wallet, or an empty node:
+        // selects nothing, quietly.
+        let error_body = serde_json::json!({ "message": "locked" });
+        assert!(select_reconnect_targets(&error_body, &serde_json::json!({})).is_empty());
+        assert!(select_reconnect_targets(
+            &serde_json::json!({ "channels": [] }),
+            &serde_json::json!({ "peers": [] })
+        )
+        .is_empty());
+    }
 }