Merge branch 'openwrt-enhancements' of http://146.59.87.168:3000/lfg2025/archy into openwrt-enhancements

"Switch router" only reset local Vue state, leaving router_config.json
on disk — a reload silently reconnected with the old saved SSH
password. Add openwrt.forget RPC + forget_router_config() to delete
the saved config, and a "Forget router" button in OpenWrtGateway.vue.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

core/Cargo.lock

@@ -84,15 +84,6 @@ version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arc-swap"
 version = "1.9.1"
@@ -170,7 +161,6 @@ dependencies = [
  "uuid",
  "zbase32",
  "zeroize",
- "zip",
 ]
 
 [[package]]
@@ -1185,17 +1175,6 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "derive_builder"
 version = "0.20.2"
@@ -6916,37 +6895,8 @@ dependencies = [
  "syn 2.0.114",
 ]
 
-[[package]]
-name = "zip"
-version = "2.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "crossbeam-utils",
- "displaydoc",
- "flate2",
- "indexmap",
- "memchr",
- "thiserror 2.0.18",
- "zopfli",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfcd145825aace48cff44a8844de64bf75feec3080e0aa5cdbde72961ae51a65"
-
-[[package]]
-name = "zopfli"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]

core/archipelago/Cargo.toml

@@ -108,10 +108,6 @@ bytes = "1"
 # Mesh networking (Meshcore serial protocol over USB LoRa radios)
 serial2-tokio = "0.1"
 
-# LoRa radio firmware flashing: Meshtastic ships per-board images inside a
-# per-platform release zip (see mesh/flash.rs).
-zip = { version = "2", default-features = false, features = ["deflate"] }
-
 # Double Ratchet key derivation (Phase 3: encrypted mesh messaging)
 hkdf = "0.12.4"
 

core/archipelago/src/api/rpc/bitcoin_relay.rs

@@ -465,7 +465,6 @@ impl RpcHandler {
             signing_key.as_ref().map(|i| i.signing_key()),
             Some(&peer.pubkey),
             data.server_info.name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await
     }

core/archipelago/src/api/rpc/dispatcher.rs

@@ -244,6 +244,8 @@ impl RpcHandler {
             // OpenWrt / TollGate
             "openwrt.scan" => self.handle_openwrt_scan(params).await,
             "openwrt.get-status" => self.handle_openwrt_get_status(params).await,
+            "openwrt.forget" => self.handle_openwrt_forget().await,
+            "openwrt.set-password" => self.handle_openwrt_set_password(params).await,
             "openwrt.provision-tollgate" => self.handle_openwrt_provision_tollgate(params).await,
             "openwrt.scan-wifi" => self.handle_openwrt_scan_wifi(params).await,
             "openwrt.configure-wan" => self.handle_openwrt_configure_wan(params).await,
@@ -391,12 +393,7 @@ impl RpcHandler {
             // Mesh networking (Meshcore LoRa)
             "mesh.status" => self.handle_mesh_status().await,
             "mesh.probe-device" => self.handle_mesh_probe_device(params).await,
-            "mesh.flash-list-firmware" => self.handle_mesh_flash_list_firmware(params).await,
-            "mesh.flash-device" => self.handle_mesh_flash_device(params).await,
-            "mesh.flash-status" => self.handle_mesh_flash_status().await,
-            "mesh.flash-cancel" => self.handle_mesh_flash_cancel().await,
             "mesh.peers" => self.handle_mesh_peers().await,
-            "mesh.refresh" => self.handle_mesh_refresh().await,
             "mesh.messages" => self.handle_mesh_messages(params).await,
             "mesh.debug-dump" => self.handle_mesh_debug_dump().await,
             "mesh.send" => self.handle_mesh_send(params).await,

core/archipelago/src/api/rpc/federation/handlers.rs

@@ -866,8 +866,7 @@ impl RpcHandler {
             )
             .service(crate::settings::transport::PeerService::Peers)
             .timeout(std::time::Duration::from_secs(30))
-            .fips_timeout(std::time::Duration::from_secs(6))
-            .record_transport(&self.config.data_dir);
+            .fips_timeout(std::time::Duration::from_secs(6));
 
             match req.send_json(&body).await {
                 Ok((resp, transport)) if resp.status().is_success() => {

core/archipelago/src/api/rpc/fips.rs

@@ -13,14 +13,7 @@ use anyhow::Result;
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
         let status = fips::FipsStatus::query(&self.config.data_dir).await;
-        let mut v = serde_json::to_value(status)?;
-        // Dial outcome counters (process-lifetime): how often peer dials
-        // used FIPS vs fell back to Tor, broken down by reason. This is
-        // the observability that makes "FIPS uptime" measurable.
-        if let Some(obj) = v.as_object_mut() {
-            obj.insert("dial_stats".to_string(), fips::telemetry::snapshot());
-        }
-        Ok(v)
+        Ok(serde_json::to_value(status)?)
     }
 
     /// Everything the companion app needs to join this node's mesh, embedded

core/archipelago/src/api/rpc/mesh/flash.rs

@@ -1,132 +0,0 @@
-use super::super::RpcHandler;
-use crate::mesh;
-use crate::mesh::flash::{self, FlashBoard, FlashJobStatus};
-use crate::mesh::types::DeviceType;
-use anyhow::Result;
-
-fn parse_family(s: &str) -> Result<DeviceType> {
-    match s.trim().to_lowercase().as_str() {
-        "meshcore" => Ok(DeviceType::Meshcore),
-        "meshtastic" => Ok(DeviceType::Meshtastic),
-        "reticulum" | "rnode" => Ok(DeviceType::Reticulum),
-        other => anyhow::bail!("Unknown firmware family: {other} (expected meshcore|meshtastic|reticulum)"),
-    }
-}
-
-fn parse_board(s: &str) -> Result<FlashBoard> {
-    match s.trim().to_lowercase().as_str() {
-        "heltec-v3" | "heltec_v3" | "heltecv3" => Ok(FlashBoard::HeltecV3),
-        "heltec-v4" | "heltec_v4" | "heltecv4" => Ok(FlashBoard::HeltecV4),
-        other => anyhow::bail!("Unknown board: {other} (expected heltec-v3|heltec-v4)"),
-    }
-}
-
-impl RpcHandler {
-    /// mesh.flash-list-firmware — resolve the available firmware version(s)
-    /// for a given family. v1 only ever surfaces "latest".
-    pub(in crate::api::rpc) async fn handle_mesh_flash_list_firmware(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let family = params
-            .as_ref()
-            .and_then(|p| p.get("family"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing family"))?;
-        let family = parse_family(family)?;
-        let versions = flash::list_firmware(family).await?;
-        Ok(serde_json::json!({ "versions": versions }))
-    }
-
-    /// mesh.flash-device — erase and reflash a detected LoRa radio with the
-    /// latest firmware for the given family, defaulting to a full chip
-    /// erase before write. `board` is optional: if the port's USB vid:pid
-    /// unambiguously resolves to a known board, that's used; otherwise the
-    /// caller must supply it explicitly (see `flash::resolve_flash_board`'s
-    /// doc comment on why we refuse to guess).
-    pub(in crate::api::rpc) async fn handle_mesh_flash_device(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let path = params
-            .as_ref()
-            .and_then(|p| p.get("path"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing path"))?
-            .to_string();
-        let family = params
-            .as_ref()
-            .and_then(|p| p.get("family"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing family"))?;
-        let family = parse_family(family)?;
-
-        let detected = mesh::detect_devices().await;
-        anyhow::ensure!(
-            detected.iter().any(|d| d == &path),
-            "{path} is not a detected mesh-radio candidate port"
-        );
-
-        let board = match params
-            .as_ref()
-            .and_then(|p| p.get("board"))
-            .and_then(|v| v.as_str())
-        {
-            Some(explicit) => parse_board(explicit)?,
-            None => {
-                let info = mesh::detect_devices_info()
-                    .await
-                    .into_iter()
-                    .find(|d| d.path == path);
-                info.as_ref()
-                    .and_then(flash::resolve_flash_board)
-                    .ok_or_else(|| {
-                        anyhow::anyhow!(
-                            "Could not auto-detect the board on {path} — specify board explicitly"
-                        )
-                    })?
-            }
-        };
-
-        flash::start_flash_job(
-            &self.flash_job,
-            &self.mesh_service_arc(),
-            self.config.data_dir.clone(),
-            path,
-            board,
-            family,
-        )
-        .await?;
-
-        Ok(serde_json::json!({ "started": true }))
-    }
-
-    /// mesh.flash-status — poll the current (or most recent) flash job.
-    pub(in crate::api::rpc) async fn handle_mesh_flash_status(&self) -> Result<serde_json::Value> {
-        let job = self.flash_job.read().await;
-        match job.as_ref() {
-            Some(j) => {
-                let status: FlashJobStatus = j.snapshot().await;
-                let mut value = serde_json::to_value(&status)?;
-                if let Some(obj) = value.as_object_mut() {
-                    obj.insert("active".into(), (!status.done).into());
-                }
-                Ok(value)
-            }
-            None => Ok(serde_json::json!({ "active": false })),
-        }
-    }
-
-    /// mesh.flash-cancel — best-effort; only honored before erase/write has
-    /// started (see `FlashJob::cancel`'s doc comment).
-    pub(in crate::api::rpc) async fn handle_mesh_flash_cancel(&self) -> Result<serde_json::Value> {
-        let job = self.flash_job.read().await;
-        match job.as_ref() {
-            Some(j) => {
-                j.cancel().await?;
-                Ok(serde_json::json!({ "cancelled": true }))
-            }
-            None => anyhow::bail!("No flash job in progress"),
-        }
-    }
-}

core/archipelago/src/api/rpc/mesh/messaging.rs

@@ -1,7 +1,6 @@
 use super::super::RpcHandler;
 use crate::mesh;
 use anyhow::Result;
-use std::sync::Arc;
 use tracing::info;
 
 impl RpcHandler {
@@ -132,14 +131,7 @@ impl RpcHandler {
             config.broadcast_identity = broadcast;
         }
         if let Some(name) = params.get("advert_name").and_then(|v| v.as_str()) {
-            // Empty clears the custom mesh name (falls back to the server
-            // name) — without this, a name could be set but never unset.
-            let trimmed = name.trim();
-            config.advert_name = if trimmed.is_empty() {
-                None
-            } else {
-                Some(trimmed.to_string())
-            };
+            config.advert_name = Some(name.to_string());
         }
         if let Some(announce) = params
             .get("announce_block_headers")
@@ -210,24 +202,10 @@ impl RpcHandler {
 
         mesh::save_config(&self.config.data_dir, &config).await?;
 
-        // Apply to the running service in the background: configure() may
-        // stop+start the listener (config changes now restart the session so
-        // they actually take effect), and that can take seconds when the old
-        // session is mid-probe. Holding the service write-lock for that long
-        // inside this handler stalled every concurrent mesh.status/mesh.peers
-        // poll behind it — the UI froze and nginx surfaced 502s. The config is
-        // already persisted above; the UI observes progress via mesh.status.
-        {
-            let service_arc = Arc::clone(&self.mesh_service);
-            let config_for_apply = config.clone();
-            tokio::spawn(async move {
-                let mut service = service_arc.write().await;
-                if let Some(svc) = service.as_mut() {
-                    if let Err(e) = svc.configure(config_for_apply).await {
-                        tracing::error!("Applying mesh config to running service failed: {e:#}");
-                    }
-                }
-            });
+        // If we have a running service, update its config
+        let mut service = self.mesh_service.write().await;
+        if let Some(svc) = service.as_mut() {
+            svc.configure(config.clone()).await?;
         }
 
         info!("Mesh config updated");

core/archipelago/src/api/rpc/mesh/mod.rs

@@ -1,6 +1,5 @@
 mod assistant;
 mod bitcoin_ops;
-mod flash;
 mod messaging;
 mod safety;
 mod status;

core/archipelago/src/api/rpc/mesh/status.rs

@@ -101,59 +101,13 @@ impl RpcHandler {
             detected.iter().any(|d| d == &path),
             "{path} is not a detected mesh-radio candidate port"
         );
-        // Refuse to probe while a firmware flash is in flight. Confirmed
-        // live 2026-07-23: esptool ("multiple access on port?") and
-        // rnodeconf (OSError Errno 71 Protocol error on an RTS ioctl) both
-        // failed with symptoms consistent with a second process holding the
-        // same serial fd — the flash subprocess runs for minutes outside
-        // our own async runtime, so nothing previously stopped a concurrent
-        // `mesh.probe-device` call (e.g. the hot-swap modal's own re-probe)
-        // from opening the identical port at the same time and corrupting
-        // both operations' handshakes.
-        if let Some(job) = self.flash_job.read().await.as_ref() {
-            anyhow::ensure!(
-                job.snapshot().await.done,
-                "A firmware flash is in progress — refusing to probe the serial port until it finishes"
-            );
-        }
-        // Only hold the mesh_service lock long enough for the quick
-        // active-path guard check — NEVER across the actual probe, which
-        // can take 15-60s across its internal collision retries. Confirmed
-        // live 2026-07-23: holding this read lock for the full probe starved
-        // a concurrent firmware-flash job's MeshService::stop() (which needs
-        // the write lock) well past its own bounded timeout, surfacing as
-        // "Mesh listener did not release the serial port" even though
-        // stop() itself was fast.
-        {
-            let service = self.mesh_service.read().await;
-            if let Some(svc) = service.as_ref() {
-                svc.ensure_probe_allowed(&path).await?;
-            }
-        }
-        let probe = mesh::listener::probe_device(&path).await?;
-        Ok(serde_json::to_value(probe)?)
-    }
-
-    /// mesh.refresh — Actively refresh discovery state: re-query the radio's
-    /// contact table and re-announce ourselves so quiet-but-alive neighbours
-    /// answer. This is what the UI's Refresh button calls — before it existed
-    /// the button only re-read server caches and never touched the radio.
-    pub(in crate::api::rpc) async fn handle_mesh_refresh(&self) -> Result<serde_json::Value> {
         let service = self.mesh_service.read().await;
-        let Some(svc) = service.as_ref() else {
-            return Ok(serde_json::json!({ "refreshed": false, "device_connected": false }));
+        let probe = match service.as_ref() {
+            Some(svc) => svc.probe_device(&path).await?,
+            // No mesh service yet (radio never enabled) — probe directly.
+            None => mesh::listener::probe_device(&path).await?,
         };
-        let status = svc.status().await;
-        if status.device_connected {
-            let state = svc.shared_state();
-            let _ = state
-                .send_cmd(crate::mesh::listener::MeshCommand::RefreshContacts)
-                .await;
-        }
-        Ok(serde_json::json!({
-            "refreshed": status.device_connected,
-            "device_connected": status.device_connected,
-        }))
+        Ok(serde_json::to_value(probe)?)
     }
 
     /// mesh.peers — List discovered mesh peers.

core/archipelago/src/api/rpc/mesh/typed_messages.rs

@@ -821,7 +821,6 @@ impl RpcHandler {
                 .service(crate::settings::transport::PeerService::MeshFileSharing)
                 .timeout(std::time::Duration::from_secs(120))
                 .fips_timeout(std::time::Duration::from_secs(8))
-                .record_transport(&self.config.data_dir)
                 .send_get()
                 .await
                 .map_err(|e| anyhow::anyhow!("Fetch failed: {}", e))?;

core/archipelago/src/api/rpc/mod.rs

@@ -89,9 +89,6 @@ pub struct RpcHandler {
     endpoint_rate_limiter: EndpointRateLimiter,
     response_cache: ResponseCache,
     mesh_service: Arc<tokio::sync::RwLock<Option<crate::mesh::MeshService>>>,
-    /// LoRa radio firmware-flash job state, sibling to `mesh_service` — one
-    /// job at a time, since flashing needs exclusive access to the port.
-    flash_job: crate::mesh::flash::FlashJobHandle,
     transport_router: Arc<tokio::sync::RwLock<Option<Arc<crate::transport::TransportRouter>>>>,
     /// Shared content-addressed blob store. Set by ApiHandler after construction
     /// so mesh.send-content / mesh.fetch-content RPCs can reach it without a
@@ -163,7 +160,6 @@ impl RpcHandler {
             endpoint_rate_limiter,
             response_cache: ResponseCache::new(5),
             mesh_service: Arc::new(tokio::sync::RwLock::new(None)),
-            flash_job: crate::mesh::flash::new_job_handle(),
             transport_router: Arc::new(tokio::sync::RwLock::new(None)),
             blob_store: Arc::new(tokio::sync::RwLock::new(None)),
             self_pubkey_hex: Arc::new(tokio::sync::RwLock::new(None)),

core/archipelago/src/api/rpc/network.rs

@@ -137,7 +137,6 @@ impl RpcHandler {
             None,
             None,
             None,
-            Some(&self.config.data_dir),
         )
         .await?;
 
@@ -226,7 +225,6 @@ impl RpcHandler {
             signing_key.as_ref().map(|i| i.signing_key()),
             Some(&req.from_pubkey),
             data.server_info.name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await
         {

core/archipelago/src/api/rpc/openwrt.rs

@@ -165,6 +165,66 @@ impl RpcHandler {
         }))
     }
 
+    /// Forget the saved router config — deletes `router_config.json` so the
+    /// app requires a fresh login next time. Takes no params.
+    pub(super) async fn handle_openwrt_forget(&self) -> Result<serde_json::Value> {
+        net_router::forget_router_config(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "ok": true }))
+    }
+
+    /// Set the router's SSH login password from the app — no manual SSH/
+    /// console session on the router required. Works for a fresh flash
+    /// (root has no password yet — connect with `current_password: ""`)
+    /// or to rotate an existing one. On success the new credentials are
+    /// persisted the same way a normal login does, so the app is fully
+    /// connected afterward with no separate "Connect" step needed.
+    ///
+    /// Params: `{ "host": "192.168.1.1", "ssh_user": "root",
+    ///             "current_password": "", "new_password": "..." }`
+    pub(super) async fn handle_openwrt_set_password(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let p = params.unwrap_or_default();
+        let host = p
+            .get("host")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("host is required"))?
+            .to_string();
+        let ssh_user = p
+            .get("ssh_user")
+            .and_then(|v| v.as_str())
+            .unwrap_or("root")
+            .to_string();
+        let current_password = p
+            .get("current_password")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+        let new_password = p
+            .get("new_password")
+            .and_then(|v| v.as_str())
+            .filter(|s| !s.is_empty())
+            .ok_or_else(|| anyhow::anyhow!("new_password is required"))?
+            .to_string();
+
+        let router = Router::connect_password(&host, 22, &ssh_user, &current_password)?;
+        router.verify_openwrt()?;
+        router.set_password(&ssh_user, &new_password)?;
+
+        net_router::configure_router(
+            &self.config.data_dir,
+            net_router::RouterType::OpenWrt,
+            &host,
+            None,
+            Some(&ssh_user),
+            Some(&new_password),
+        )
+        .await?;
+
+        Ok(serde_json::json!({ "ok": true, "host": host }))
+    }
+
     /// Provision TollGate on an OpenWrt router and create the "archipelago" SSID.
     ///
     /// Params: `{ "host": "192.168.1.1", "ssh_user": "root", "ssh_password": "",

core/archipelago/src/api/rpc/peers.rs

@@ -133,7 +133,6 @@ impl RpcHandler {
             Some(node_id.signing_key()),
             recipient_pubkey.as_deref(),
             node_name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await?;
         Ok(serde_json::json!({ "ok": true, "sent_to": onion }))

core/archipelago/src/api/rpc/system/handlers.rs

@@ -61,28 +61,6 @@ impl RpcHandler {
 
         info!("Server name updated to: {}", name);
 
-        // Propagate to the mesh: the listener advertises the server name (when
-        // no explicit mesh advert_name overrides it), but it was only read at
-        // process startup — a rename never reached the radio/RNS until the
-        // next full restart. Push it into the service and bounce the listener
-        // in the background (the restart re-probes the radio, which can take
-        // seconds — don't block the rename response on it).
-        {
-            let mesh_arc = self.mesh_service_arc();
-            let name_for_mesh = name.clone();
-            tokio::spawn(async move {
-                let mut guard = mesh_arc.write().await;
-                if let Some(svc) = guard.as_mut() {
-                    svc.set_server_name(Some(name_for_mesh));
-                    if svc.config().advert_name.is_none() {
-                        if let Err(e) = svc.restart_listener_if_running().await {
-                            warn!("Mesh listener restart after rename failed: {}", e);
-                        }
-                    }
-                }
-            });
-        }
-
         // Push the new name to federation peers in background
         let data_dir = self.config.data_dir.clone();
         let state_manager = self.state_manager.clone();

core/archipelago/src/api/rpc/tor/mod.rs

@@ -499,8 +499,7 @@ pub(super) async fn notify_federation_peers_address_change(
                         )
                         .service(crate::settings::transport::PeerService::Peers)
                         .timeout(std::time::Duration::from_secs(30))
-                        .fips_timeout(std::time::Duration::from_secs(6))
-                        .record_transport(data_dir);
+                        .fips_timeout(std::time::Duration::from_secs(6));
                         match req.send_json(&payload).await {
                             Ok((_, transport)) => {
                                 info!(peer_did = %peer.did, transport = %transport, "Notified peer of address change")

core/archipelago/src/container/companion.rs

@@ -22,10 +22,8 @@
 //! single declarative call.
 
 use anyhow::{Context, Result};
-use std::collections::HashMap;
 use std::path::PathBuf;
-use std::sync::{LazyLock, Mutex};
-use std::time::{Duration, Instant};
+use std::time::Duration;
 use tokio::fs;
 use tokio::process::Command;
 use tracing::{info, warn};
@@ -37,15 +35,6 @@ const COMPANION_REGISTRY: &str = "146.59.87.168:3000/lfg2025";
 const COMPANION_IMAGE_CHECK_TIMEOUT: Duration = Duration::from_secs(15);
 const COMPANION_BUILD_TIMEOUT: Duration = Duration::from_secs(900);
 const COMPANION_PULL_TIMEOUT: Duration = Duration::from_secs(300);
-/// After a failed repair (image build/pull included), leave the companion
-/// alone for this long. Without it, a node under IO pressure retried a 900s
-/// image build every 30s reconcile tick — each build pegging the disk that
-/// made the probes fail in the first place (live-diagnosed on zaza-optiplex
-/// 2026-07-28: load 50, podman scans starved, apps page stuck).
-const REPAIR_COOLDOWN: Duration = Duration::from_secs(600);
-
-static REPAIR_FAILED_AT: LazyLock<Mutex<HashMap<&'static str, Instant>>> =
-    LazyLock::new(|| Mutex::new(HashMap::new()));
 
 /// Static description of one companion. The full list per backend
 /// app_id lives in `companions_for`.
@@ -475,28 +464,12 @@ pub async fn reconcile(installed_apps: &[String]) -> Vec<(String, anyhow::Error)
             match needs_repair(spec).await {
                 Ok(false) => {}
                 Ok(true) => {
-                    if let Some(failed_at) =
-                        REPAIR_FAILED_AT.lock().unwrap().get(spec.name).copied()
-                    {
-                        if failed_at.elapsed() < REPAIR_COOLDOWN {
-                            continue;
-                        }
-                    }
                     info!(
                         companion = spec.name,
                         "reconcile: companion not active, repairing"
                     );
-                    match install_one(spec).await {
-                        Ok(()) => {
-                            REPAIR_FAILED_AT.lock().unwrap().remove(spec.name);
-                        }
-                        Err(e) => {
-                            REPAIR_FAILED_AT
-                                .lock()
-                                .unwrap()
-                                .insert(spec.name, Instant::now());
-                            failures.push((spec.name.to_string(), e));
-                        }
+                    if let Err(e) = install_one(spec).await {
+                        failures.push((spec.name.to_string(), e));
                     }
                 }
                 Err(e) => {
@@ -511,58 +484,19 @@ pub async fn reconcile(installed_apps: &[String]) -> Vec<(String, anyhow::Error)
 
 /// Does this companion need install_one to be re-run? Returns true if
 /// the unit file is missing, stale, or the service is not active.
-///
-/// This probe runs every reconcile tick for every companion, so it must be
-/// PASSIVE: no image builds, no pulls. It used to call ensure_image_present
-/// to render the expected unit — under IO pressure the image-existence check
-/// inside timed out, read as "image missing", and a 900s `podman build` ran
-/// inside the probe even though the companion was up (the .198 load spiral).
 async fn needs_repair(spec: &CompanionSpec) -> Result<bool> {
     let dir = quadlet::unit_dir().await?;
     let unit_path = dir.join(format!("{}.container", spec.name));
     if !fs::try_exists(&unit_path).await.unwrap_or(false) {
         return Ok(true);
     }
-    let svc = format!("{}.service", spec.name);
-    // A hung `systemctl is-active` under IO pressure must not read as
-    // "companion dead" — that's a repair (and possibly an image build) fired
-    // off exactly when the node can least afford one.
-    match tokio::time::timeout(Duration::from_secs(10), quadlet::is_active(&svc)).await {
-        Ok(active) => {
-            if !active {
-                return Ok(true);
-            }
-        }
-        Err(_) => {
-            warn!(
-                companion = spec.name,
-                "is-active probe timed out; assuming active"
-            );
-        }
-    }
-    // Service is running. Flag it stale only on definitive, cheap signals:
-    // the on-disk unit matching none of the image refs install_one could
-    // have written, or a local build context newer than the built image.
-    let on_disk = fs::read_to_string(&unit_path).await.unwrap_or_default();
-    let local_image = format!("localhost/{}:latest", spec.image_base);
-    let local_image_compat = format!("localhost/{}:local", spec.image_base);
-    let registry_image = format!("{}/{}:latest", COMPANION_REGISTRY, spec.image_base);
-    let matches_known_shape = [&local_image, &local_image_compat, &registry_image]
-        .iter()
-        .any(|img| build_unit(spec, img).render() == on_disk);
-    if !matches_known_shape {
+    let expected_image = ensure_image_present(spec).await?;
+    let expected_unit = build_unit(spec, &expected_image);
+    if expected_unit.render() != fs::read_to_string(&unit_path).await.unwrap_or_default() {
         return Ok(true);
     }
-    if on_disk.contains(&local_image) && !on_disk.contains(&local_image_compat) {
-        for dir in spec.build_dir_candidates {
-            let dockerfile = PathBuf::from(dir).join("Dockerfile");
-            if fs::try_exists(&dockerfile).await.unwrap_or(false) {
-                // Conservative on any timeout/error inside: reuse the cache.
-                return Ok(context_is_newer_than_image(dir, &local_image).await);
-            }
-        }
-    }
-    Ok(false)
+    let svc = format!("{}.service", spec.name);
+    Ok(!quadlet::is_active(&svc).await)
 }
 
 #[cfg(test)]

core/archipelago/src/fips/anchors.rs

@@ -232,32 +232,26 @@ pub async fn remove(data_dir: &Path, npub: &str) -> Result<Vec<SeedAnchor>> {
 /// leaving `anchor_connected=false` and every peer dial falling back to
 /// a slow Tor timeout.
 pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
-    // Concurrent, each connect hard-capped: the old serial loop waited
-    // unbounded on every `sudo fipsctl connect`, so one hung subprocess
-    // stalled the whole apply — and the periodic anchor tick behind it,
-    // which is exactly when a wedged daemon most needs the re-apply.
-    let futs = anchors.iter().cloned().map(|anchor| async move {
-        let out = tokio::time::timeout(
-            std::time::Duration::from_secs(15),
-            Command::new("sudo")
-                .args([
-                    "-n",
-                    "fipsctl",
-                    "connect",
-                    &anchor.npub,
-                    &anchor.address,
-                    &anchor.transport,
-                ])
-                .output(),
-        )
-        .await;
+    let mut results = Vec::with_capacity(anchors.len());
+    for anchor in anchors {
+        let out = Command::new("sudo")
+            .args([
+                "-n",
+                "fipsctl",
+                "connect",
+                &anchor.npub,
+                &anchor.address,
+                &anchor.transport,
+            ])
+            .output()
+            .await;
         let result = match out {
-            Ok(Ok(o)) if o.status.success() => ApplyResult {
+            Ok(o) if o.status.success() => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: true,
                 message: String::from_utf8_lossy(&o.stdout).trim().to_string(),
             },
-            Ok(Ok(o)) => ApplyResult {
+            Ok(o) => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: false,
                 message: format!(
@@ -266,16 +260,11 @@ pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
                     String::from_utf8_lossy(&o.stderr).trim()
                 ),
             },
-            Ok(Err(e)) => ApplyResult {
+            Err(e) => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: false,
                 message: format!("sudo fipsctl launch failed: {}", e),
             },
-            Err(_) => ApplyResult {
-                npub: anchor.npub.clone(),
-                ok: false,
-                message: "sudo fipsctl connect timed out after 15s".to_string(),
-            },
         };
         if result.ok {
             tracing::debug!(npub = %result.npub, "Seed anchor applied");
@@ -286,9 +275,9 @@ pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
                 "Seed anchor apply failed (non-fatal)"
             );
         }
-        result
-    });
-    futures_util::future::join_all(futs).await
+        results.push(result);
+    }
+    results
 }
 
 /// Outcome of a single `fipsctl connect` call.

core/archipelago/src/fips/dial.rs

@@ -24,7 +24,6 @@
 //! ```
 #![allow(dead_code)]
 
-use super::telemetry::{self, FallbackReason};
 use anyhow::{Context, Result};
 use std::net::{IpAddr, Ipv6Addr};
 use std::time::Duration;
@@ -151,12 +150,6 @@ pub async fn warm_path(npub: &str) {
     if !is_service_active().await {
         return;
     }
-    warm_path_unchecked(npub).await
-}
-
-/// [`warm_path`] without the service-active check — for callers (the warm
-/// tick) that already verified the daemon once for the whole batch.
-pub async fn warm_path_unchecked(npub: &str) {
     let Ok(base) = peer_base_url(npub).await else {
         return;
     };
@@ -283,39 +276,21 @@ pub fn as_ip_addr(v6: Ipv6Addr) -> IpAddr {
 
 // ── High-level peer request helpers ────────────────────────────────────
 
-/// TTL for the [`is_service_active`] cache. Every FIPS dial attempt and
-/// every warm-tick peer used to spawn up to two `systemctl` subprocesses;
-/// service state changes on human timescales, so 10s staleness is free.
-const SERVICE_ACTIVE_TTL_MS: u64 = 10_000;
-static SERVICE_ACTIVE: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
-static SERVICE_PROBED_AT_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-
 /// Quick poll: is the FIPS daemon (archipelago-supervised OR upstream)
-/// currently `systemctl is-active`? Cached for [`SERVICE_ACTIVE_TTL_MS`];
-/// concurrent refreshes are harmless (idempotent probe, last write wins).
+/// currently `systemctl is-active`? Async wrapper intended for the
+/// migration call sites; unlike `FipsTransport::is_available` this does
+/// not maintain a cache, so callers that poll frequently should cache
+/// themselves.
 pub async fn is_service_active() -> bool {
-    use std::sync::atomic::Ordering;
-    let now_ms = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_millis() as u64)
-        .unwrap_or(0);
-    let probed_at = SERVICE_PROBED_AT_MS.load(Ordering::Relaxed);
-    if probed_at != 0 && now_ms.saturating_sub(probed_at) < SERVICE_ACTIVE_TTL_MS {
-        return SERVICE_ACTIVE.load(Ordering::Relaxed);
-    }
-    let mut active = false;
     for unit in [
         crate::fips::SERVICE_UNIT,
         crate::fips::UPSTREAM_SERVICE_UNIT,
     ] {
         if crate::fips::service::unit_state(unit).await == "active" {
-            active = true;
-            break;
+            return true;
         }
     }
-    SERVICE_ACTIVE.store(active, Ordering::Relaxed);
-    SERVICE_PROBED_AT_MS.store(now_ms, Ordering::Relaxed);
-    active
+    false
 }
 
 /// Builder for a peer request that may be sent over FIPS (preferred) or
@@ -342,11 +317,6 @@ pub struct PeerRequest<'a> {
     /// large content download needs so its long FIPS transfer isn't truncated.
     pub fips_timeout: Option<std::time::Duration>,
     pub service: Option<crate::settings::transport::PeerService>,
-    /// When set, the transport that actually served this request is written
-    /// to federation storage (`record_peer_transport`, matched by onion) so
-    /// the per-peer FIPS/Tor badge reflects reality. Opt-in because not
-    /// every caller has a data dir in scope.
-    pub record_data_dir: Option<std::path::PathBuf>,
 }
 
 impl<'a> PeerRequest<'a> {
@@ -359,31 +329,6 @@ impl<'a> PeerRequest<'a> {
             timeout: std::time::Duration::from_secs(30),
             fips_timeout: None,
             service: None,
-            record_data_dir: None,
-        }
-    }
-
-    /// Record the transport that serves this request into federation storage
-    /// (matched by this request's onion host). Best-effort, off the hot path.
-    pub fn record_transport(mut self, data_dir: impl Into<std::path::PathBuf>) -> Self {
-        self.record_data_dir = Some(data_dir.into());
-        self
-    }
-
-    fn spawn_record(&self, kind: crate::transport::TransportKind) {
-        if let Some(dir) = &self.record_data_dir {
-            let dir = dir.clone();
-            let onion = self.onion_host.to_string();
-            let transport = kind.to_string();
-            tokio::spawn(async move {
-                let _ = crate::federation::record_peer_transport(
-                    &dir,
-                    None,
-                    Some(&onion),
-                    &transport,
-                )
-                .await;
-            });
         }
     }
 
@@ -444,22 +389,8 @@ impl<'a> PeerRequest<'a> {
                     // fix (404 path-not-served / 5xx) and we're allowed to
                     // fall back. FIPS-only never falls back.
                     if pref == TransportPref::Fips || !fips_should_fall_back(resp.status()) {
-                        telemetry::record_fips_ok();
-                        self.spawn_record(crate::transport::TransportKind::Fips);
                         return Ok((resp, crate::transport::TransportKind::Fips));
                     }
-                    let reason = if resp.status() == reqwest::StatusCode::NOT_FOUND {
-                        FallbackReason::Http404
-                    } else {
-                        FallbackReason::Http5xx
-                    };
-                    telemetry::record_fallback(reason);
-                    tracing::info!(
-                        reason = reason.key(),
-                        status = %resp.status(),
-                        "FIPS POST {} answered but status triggers Tor fallback",
-                        self.path
-                    );
                 }
                 None => {
                     if pref == TransportPref::Fips {
@@ -471,7 +402,6 @@ impl<'a> PeerRequest<'a> {
             }
         }
         let resp = self.send_tor_post_json(body).await?;
-        self.spawn_record(crate::transport::TransportKind::Tor);
         Ok((resp, crate::transport::TransportKind::Tor))
     }
 
@@ -483,22 +413,8 @@ impl<'a> PeerRequest<'a> {
             match self.try_fips_get().await? {
                 Some(resp) => {
                     if pref == TransportPref::Fips || !fips_should_fall_back(resp.status()) {
-                        telemetry::record_fips_ok();
-                        self.spawn_record(crate::transport::TransportKind::Fips);
                         return Ok((resp, crate::transport::TransportKind::Fips));
                     }
-                    let reason = if resp.status() == reqwest::StatusCode::NOT_FOUND {
-                        FallbackReason::Http404
-                    } else {
-                        FallbackReason::Http5xx
-                    };
-                    telemetry::record_fallback(reason);
-                    tracing::info!(
-                        reason = reason.key(),
-                        status = %resp.status(),
-                        "FIPS GET {} answered but status triggers Tor fallback",
-                        self.path
-                    );
                 }
                 None => {
                     if pref == TransportPref::Fips {
@@ -510,7 +426,6 @@ impl<'a> PeerRequest<'a> {
             }
         }
         let resp = self.send_tor_get().await?;
-        self.spawn_record(crate::transport::TransportKind::Tor);
         Ok((resp, crate::transport::TransportKind::Tor))
     }
 
@@ -519,23 +434,15 @@ impl<'a> PeerRequest<'a> {
         body: &B,
     ) -> Result<Option<reqwest::Response>> {
         let Some(npub) = self.fips_npub else {
-            telemetry::record_fallback(FallbackReason::NoNpub);
             return Ok(None);
         };
         if !is_service_active().await {
-            telemetry::record_fallback(FallbackReason::ServiceInactive);
             return Ok(None);
         }
         let base = match peer_base_url(npub).await {
             Ok(b) => b,
             Err(e) => {
-                telemetry::record_fallback(FallbackReason::DnsFail);
-                tracing::info!(
-                    reason = FallbackReason::DnsFail.key(),
-                    "FIPS resolve for {} failed: {}, falling back to Tor",
-                    npub,
-                    e
-                );
+                tracing::debug!("FIPS resolve for {} failed: {}", npub, e);
                 return Ok(None);
             }
         };
@@ -560,9 +467,7 @@ impl<'a> PeerRequest<'a> {
         match tokio::time::timeout(budget, send_with_retry(rb)).await {
             Ok(Ok(r)) => Ok(Some(r)),
             Ok(Err(e)) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+                tracing::debug!(
                     "FIPS POST {} failed after retry: {}, falling back to Tor",
                     url,
                     e
@@ -570,9 +475,7 @@ impl<'a> PeerRequest<'a> {
                 Ok(None)
             }
             Err(_) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+                tracing::debug!(
                     "FIPS POST {} exceeded attempt budget {:?}, falling back to Tor",
                     url,
                     budget
@@ -584,23 +487,15 @@ impl<'a> PeerRequest<'a> {
 
     async fn try_fips_get(&self) -> Result<Option<reqwest::Response>> {
         let Some(npub) = self.fips_npub else {
-            telemetry::record_fallback(FallbackReason::NoNpub);
             return Ok(None);
         };
         if !is_service_active().await {
-            telemetry::record_fallback(FallbackReason::ServiceInactive);
             return Ok(None);
         }
         let base = match peer_base_url(npub).await {
             Ok(b) => b,
             Err(e) => {
-                telemetry::record_fallback(FallbackReason::DnsFail);
-                tracing::info!(
-                    reason = FallbackReason::DnsFail.key(),
-                    "FIPS resolve for {} failed: {}, falling back to Tor",
-                    npub,
-                    e
-                );
+                tracing::debug!("FIPS resolve for {} failed: {}", npub, e);
                 return Ok(None);
             }
         };
@@ -621,9 +516,7 @@ impl<'a> PeerRequest<'a> {
         match tokio::time::timeout(budget, send_with_retry(rb)).await {
             Ok(Ok(r)) => Ok(Some(r)),
             Ok(Err(e)) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+                tracing::debug!(
                     "FIPS GET {} failed after retry: {}, falling back to Tor",
                     url,
                     e
@@ -631,9 +524,7 @@ impl<'a> PeerRequest<'a> {
                 Ok(None)
             }
             Err(_) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+                tracing::debug!(
                     "FIPS GET {} exceeded attempt budget {:?}, falling back to Tor",
                     url,
                     budget

core/archipelago/src/fips/mod.rs

@@ -31,7 +31,6 @@ pub mod config;
 pub mod dial;
 pub mod iface;
 pub mod service;
-pub mod telemetry;
 pub mod update;
 
 use serde::{Deserialize, Serialize};
@@ -80,73 +79,25 @@ pub async fn ensure_activated(data_dir: &std::path::Path) {
 pub fn spawn_fips_supervisor(data_dir: std::path::PathBuf) {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(std::time::Duration::from_secs(25));
-        // Connectivity watcher state: re-apply seed anchors the moment the
-        // anchor link drops (edge) or the data path degrades (dials keep
-        // failing with zero successes), instead of waiting for the 300s
-        // anchor tick. Bounded: at most one re-apply per RE_APPLY_BACKOFF.
-        const RE_APPLY_BACKOFF: std::time::Duration = std::time::Duration::from_secs(60);
-        let mut prev_connected: Option<bool> = None;
-        let mut prev_totals = telemetry::totals();
-        let mut last_apply: Option<std::time::Instant> = None;
         loop {
             tick.tick().await;
             // Bring FIPS up on its own once onboarding has materialised the key.
             ensure_activated(&data_dir).await;
             if !dial::is_service_active().await {
-                prev_connected = None; // daemon restart = fresh edge detection
                 continue;
             }
-
-            // ── Warm the union of federation peers + configured seed
-            // anchors. Warming only federation npubs left the direct
-            // anchors (vps2, LAN peers) to go cold between 300s ticks.
             let nodes = crate::federation::load_nodes(&data_dir)
                 .await
                 .unwrap_or_default();
-            let seed = anchors::load(&data_dir).await.unwrap_or_default();
-            let mut warm_npubs: std::collections::BTreeSet<String> = nodes
-                .iter()
-                .filter_map(|n| n.fips_npub.clone())
-                .collect();
-            warm_npubs.extend(seed.iter().map(|a| a.npub.clone()));
             let mut handles = Vec::new();
-            for npub in warm_npubs {
-                // Service-active was checked once above for the whole batch.
-                handles.push(tokio::spawn(
-                    async move { dial::warm_path_unchecked(&npub).await },
-                ));
+            for node in nodes {
+                if let Some(npub) = node.fips_npub.clone() {
+                    handles.push(tokio::spawn(async move { dial::warm_path(&npub).await }));
+                }
             }
             for h in handles {
                 let _ = h.await;
             }
-
-            // ── Connectivity watcher: detect anchor-link loss AND silent
-            // data-path death (daemon reports "connected" but every dial
-            // connect-fails — observed live on .198, 2026-07-27, where the
-            // 300s tick never healed it).
-            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
-            anchor_npubs.extend(seed.iter().map(|a| a.npub.clone()));
-            let (_, connected) = service::peer_connectivity_summary(&anchor_npubs).await;
-            let totals = telemetry::totals();
-            let link_dropped = prev_connected == Some(true) && !connected;
-            let never_connected = prev_connected.is_none() && !connected;
-            let data_path_dead =
-                totals.1.saturating_sub(prev_totals.1) >= 5 && totals.0 == prev_totals.0;
-            prev_connected = Some(connected);
-            prev_totals = totals;
-
-            let backoff_ok = last_apply.is_none_or(|t| t.elapsed() >= RE_APPLY_BACKOFF);
-            if (link_dropped || never_connected || data_path_dead) && backoff_ok && !seed.is_empty()
-            {
-                tracing::info!(
-                    link_dropped,
-                    never_connected,
-                    data_path_dead,
-                    "FIPS connectivity degraded — re-applying seed anchors now"
-                );
-                last_apply = Some(std::time::Instant::now());
-                let _ = anchors::apply(&seed).await;
-            }
         }
     });
 }

core/archipelago/src/fips/telemetry.rs

@@ -1,155 +0,0 @@
-//! In-process counters for FIPS dial outcomes.
-//!
-//! Every peer dial that could have used FIPS either succeeds over FIPS or
-//! falls back to Tor for one of six reasons (F1–F6). Before these counters
-//! existed, fallbacks were `debug!`-only and invisible in production, which
-//! made "FIPS uptime" unfalsifiable — several paths were 100% Tor for months
-//! (dead ports, firewalled listeners, allowlist 404s) and nothing surfaced
-//! it. The counters are process-lifetime (reset on restart) and exposed via
-//! `fips.status` as `dial_stats`, so a fleet-wide fallback regression shows
-//! up on the dashboard instead of as vague slowness.
-
-use std::sync::atomic::{AtomicU64, Ordering};
-
-/// Why a FIPS-capable dial fell back to Tor.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FallbackReason {
-    /// F1 — no FIPS npub known for the peer (never meshed, or pre-npub
-    /// federation record). Expected for non-FIPS peers; high counts here
-    /// mean npub propagation is broken, not the transport.
-    NoNpub,
-    /// F2 — the local FIPS daemon service isn't active.
-    ServiceInactive,
-    /// F3 — the local FIPS DNS resolver couldn't resolve the peer's npub
-    /// (daemon up but peer not in the identity cache / mesh unreachable).
-    DnsFail,
-    /// F4 — TCP/HTTP dial to the peer's ULA failed or exceeded the FIPS
-    /// attempt budget (firewalled :5679, cold hole-punch, peer down).
-    ConnectFail,
-    /// F5 — peer answered over FIPS with 404: its listener doesn't serve
-    /// this path (older build / stricter allowlist).
-    Http404,
-    /// F6 — peer answered over FIPS with a 5xx server error.
-    Http5xx,
-}
-
-impl FallbackReason {
-    pub fn key(self) -> &'static str {
-        match self {
-            Self::NoNpub => "no_npub",
-            Self::ServiceInactive => "service_inactive",
-            Self::DnsFail => "dns_fail",
-            Self::ConnectFail => "connect_fail",
-            Self::Http404 => "http_404",
-            Self::Http5xx => "http_5xx",
-        }
-    }
-}
-
-static FIPS_OK: AtomicU64 = AtomicU64::new(0);
-static NO_NPUB: AtomicU64 = AtomicU64::new(0);
-static SERVICE_INACTIVE: AtomicU64 = AtomicU64::new(0);
-static DNS_FAIL: AtomicU64 = AtomicU64::new(0);
-static CONNECT_FAIL: AtomicU64 = AtomicU64::new(0);
-static HTTP_404: AtomicU64 = AtomicU64::new(0);
-static HTTP_5XX: AtomicU64 = AtomicU64::new(0);
-
-fn counter(reason: FallbackReason) -> &'static AtomicU64 {
-    match reason {
-        FallbackReason::NoNpub => &NO_NPUB,
-        FallbackReason::ServiceInactive => &SERVICE_INACTIVE,
-        FallbackReason::DnsFail => &DNS_FAIL,
-        FallbackReason::ConnectFail => &CONNECT_FAIL,
-        FallbackReason::Http404 => &HTTP_404,
-        FallbackReason::Http5xx => &HTTP_5XX,
-    }
-}
-
-/// A dial completed over FIPS (any HTTP status that wasn't a fallback
-/// trigger — the peer was reached on the mesh).
-pub fn record_fips_ok() {
-    FIPS_OK.fetch_add(1, Ordering::Relaxed);
-}
-
-/// A FIPS-capable dial fell back to Tor.
-pub fn record_fallback(reason: FallbackReason) {
-    counter(reason).fetch_add(1, Ordering::Relaxed);
-}
-
-/// `(fips_ok, connect_fail)` totals for the connectivity watcher: a window
-/// where connect_fail grows while fips_ok doesn't is a degraded data path —
-/// including the "daemon says connected but packets blackhole" failure the
-/// link-state check alone can't see (observed live 2026-07-27 on .198).
-pub fn totals() -> (u64, u64) {
-    (
-        FIPS_OK.load(Ordering::Relaxed),
-        CONNECT_FAIL.load(Ordering::Relaxed),
-    )
-}
-
-/// Snapshot for `fips.status` (`dial_stats`). Process-lifetime counts.
-pub fn snapshot() -> serde_json::Value {
-    let f1 = NO_NPUB.load(Ordering::Relaxed);
-    let f2 = SERVICE_INACTIVE.load(Ordering::Relaxed);
-    let f3 = DNS_FAIL.load(Ordering::Relaxed);
-    let f4 = CONNECT_FAIL.load(Ordering::Relaxed);
-    let f5 = HTTP_404.load(Ordering::Relaxed);
-    let f6 = HTTP_5XX.load(Ordering::Relaxed);
-    serde_json::json!({
-        "fips_ok": FIPS_OK.load(Ordering::Relaxed),
-        "fallbacks": {
-            "no_npub": f1,
-            "service_inactive": f2,
-            "dns_fail": f3,
-            "connect_fail": f4,
-            "http_404": f5,
-            "http_5xx": f6,
-            "total": f1 + f2 + f3 + f4 + f5 + f6,
-        },
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn snapshot_counts_recorded_events() {
-        // Counters are global; assert deltas rather than absolutes so this
-        // test stays correct alongside any other test that dials.
-        let before = snapshot();
-        record_fips_ok();
-        record_fallback(FallbackReason::ConnectFail);
-        record_fallback(FallbackReason::Http404);
-        let after = snapshot();
-        let d = |v: &serde_json::Value, path: &[&str]| -> u64 {
-            let mut cur = v;
-            for p in path {
-                cur = &cur[p];
-            }
-            cur.as_u64().unwrap()
-        };
-        assert_eq!(d(&after, &["fips_ok"]) - d(&before, &["fips_ok"]), 1);
-        assert_eq!(
-            d(&after, &["fallbacks", "connect_fail"]) - d(&before, &["fallbacks", "connect_fail"]),
-            1
-        );
-        assert_eq!(
-            d(&after, &["fallbacks", "http_404"]) - d(&before, &["fallbacks", "http_404"]),
-            1
-        );
-        assert!(d(&after, &["fallbacks", "total"]) >= 2);
-    }
-
-    #[test]
-    fn reason_keys_are_stable() {
-        // These strings are the fips.status API surface — renaming one is a
-        // breaking change for the UI.
-        assert_eq!(FallbackReason::NoNpub.key(), "no_npub");
-        assert_eq!(FallbackReason::ServiceInactive.key(), "service_inactive");
-        assert_eq!(FallbackReason::DnsFail.key(), "dns_fail");
-        assert_eq!(FallbackReason::ConnectFail.key(), "connect_fail");
-        assert_eq!(FallbackReason::Http404.key(), "http_404");
-        assert_eq!(FallbackReason::Http5xx.key(), "http_5xx");
-    }
-}

core/archipelago/src/mesh/flash.rs

@@ -1,975 +0,0 @@
-// WIP mesh/transport protocol — suppress dead code warnings
-#![allow(dead_code)]
-//! Firmware flashing for LoRa mesh radios — Heltec V3/V4 in v1, across all
-//! three firmware families the mesh module already knows how to detect (see
-//! `mesh::types::DeviceType`). Firmware is always fetched from upstream at
-//! flash time (never bundled/pinned in the repo), and every flash defaults
-//! to a full chip erase before write.
-//!
-//! MeshCore and Meshtastic are flashed the same way: download a released
-//! image, `esptool erase_flash`, then `esptool write_flash 0x0 <image>`.
-//! Reticulum/RNode is different: `archy-rnodeconf --autoinstall` owns the
-//! whole fetch+erase+flash+EEPROM-bootstrap sequence itself (confirmed live
-//! via `archy-rnodeconf --help` — there is no raw esptool path exposed for
-//! this family, so we deliberately don't resolve a firmware URL ourselves
-//! for Reticulum; rnodeconf already knows how).
-
-use super::serial::DetectedDeviceInfo;
-use super::types::DeviceType;
-use super::MeshService;
-use anyhow::{Context, Result};
-use regex::Regex;
-use serde::Serialize;
-use std::path::{Path, PathBuf};
-use std::process::Stdio;
-use std::sync::{Arc, OnceLock};
-use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
-use tokio::process::Command;
-use tokio::sync::RwLock;
-use tracing::{info, warn};
-
-/// Boards supported for v1. Both are ESP32-S3 (a single `--chip esp32s3`
-/// esptool target covers both), but ship different USB identities and
-/// different per-board firmware assets upstream.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum FlashBoard {
-    HeltecV3,
-    HeltecV4,
-}
-
-impl FlashBoard {
-    /// Meshtastic's board id (matches the release manifest's `board` field
-    /// and its per-board asset naming, e.g. `firmware-heltec-v3-<ver>.factory.bin`).
-    fn meshtastic_id(self) -> &'static str {
-        match self {
-            Self::HeltecV3 => "heltec-v3",
-            Self::HeltecV4 => "heltec-v4",
-        }
-    }
-}
-
-/// Map a detected USB vid:pid to a known flashable board, using the same
-/// table as `image-recipe/configs/99-mesh-radio.rules`. CP2102 (10c4:ea60)
-/// is confirmed there as Heltec V3's USB-UART bridge chip, and is safe to
-/// auto-match since that vid:pid is bridge-chip-specific.
-///
-/// Heltec V4 is NOT auto-matchable and deliberately has no entry here: it
-/// was confirmed live (real hardware, 2026-07-23) to use the ESP32-S3's
-/// built-in native-USB JTAG/serial peripheral, reporting vid:pid 303a:1001
-/// with product string "USB JTAG/serial debug unit" — that descriptor is
-/// baked into the chip's ROM and is IDENTICAL across every ESP32-S3 board
-/// with native USB enabled, not just Heltec V4. Adding `303a:1001 =>
-/// HeltecV4` here would silently misidentify any other native-USB ESP32-S3
-/// board (a T3-S3, a bare devkit, etc.) as a V4 and risk writing the wrong
-/// board's image. Callers (the RPC layer / frontend) must let the user pick
-/// the board manually whenever this returns `None`.
-pub fn resolve_flash_board(info: &DetectedDeviceInfo) -> Option<FlashBoard> {
-    match (info.vid.as_deref(), info.pid.as_deref()) {
-        (Some("10c4"), Some("ea60")) => Some(FlashBoard::HeltecV3),
-        _ => None,
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum FlashStage {
-    Downloading,
-    Erasing,
-    Writing,
-    Autoinstalling,
-    Done,
-    Failed,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct FlashJobStatus {
-    pub board: FlashBoard,
-    pub family: DeviceType,
-    pub path: String,
-    pub stage: FlashStage,
-    pub percent: Option<u8>,
-    pub log_tail: Vec<String>,
-    pub done: bool,
-    pub error: Option<String>,
-}
-
-const LOG_TAIL_MAX: usize = 200;
-
-/// How long to wait after a successful flash before resuming the mesh
-/// listener, so the board finishes its own post-flash boot/reset before we
-/// start opening the port (which itself toggles DTR/RTS) again.
-const POST_FLASH_SETTLE_DELAY: std::time::Duration = std::time::Duration::from_secs(5);
-
-/// Absolute ceiling on a whole flash job (download + erase + write, or
-/// autoinstall), regardless of what it's doing internally. Last-resort
-/// safety net so a hang anywhere can't wedge the single-flash-job guard
-/// forever — generous enough to never trigger on a legitimately slow
-/// multi-hundred-MB transfer.
-const MAX_JOB_DURATION: std::time::Duration = std::time::Duration::from_secs(15 * 60);
-
-/// How long to wait for MeshService::stop() to release the serial port
-/// before giving up. Confirmed live 2026-07-23: the listener's own
-/// reconnect/multi-candidate-probe loop doesn't check its shutdown signal
-/// between candidates, so stop() can take a while (or, if the loop is
-/// wedged, never return) — 20s comfortably covers a normal handshake-probe
-/// cycle without leaving a flash request hanging indefinitely if the
-/// listener genuinely won't let go.
-const STOP_LISTENER_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-
-/// How long to keep retrying the port-free check before giving up.
-const PORT_FREE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
-
-/// Confirm nothing else has `path` open by actually opening (and immediately
-/// closing) it ourselves. Retries across the timeout since a just-stopped
-/// listener's fd can take a moment to actually release even after `stop()`
-/// returns (task abort is a request, not an instant guarantee the OS-level
-/// resource is gone yet).
-async fn wait_for_port_free(path: &str) -> Result<()> {
-    let deadline = tokio::time::Instant::now() + PORT_FREE_TIMEOUT;
-    let mut last_err = None;
-    loop {
-        match serial2_tokio::SerialPort::open(path, 115200) {
-            Ok(_) => return Ok(()),
-            Err(e) => last_err = Some(e),
-        }
-        if tokio::time::Instant::now() >= deadline {
-            break;
-        }
-        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-    }
-    Err(anyhow::anyhow!(
-        "{path} is still held open by something else after {}s (last error: {}) — refusing to start the flasher against a contended port",
-        PORT_FREE_TIMEOUT.as_secs(),
-        last_err.map(|e| e.to_string()).unwrap_or_default()
-    ))
-}
-
-/// Live state for the one flash job that can run at a time. A single global
-/// slot is sufficient because flashing needs exclusive serial access to the
-/// one port being flashed — there is no meaningful concept of two concurrent
-/// flash jobs on this node.
-pub struct FlashJob {
-    status: RwLock<FlashJobStatus>,
-    /// Set once the background task is spawned. Only used while `stage` is
-    /// still `Downloading` — an interrupted erase/write can leave the chip
-    /// in a worse state than either finished or unstarted, so cancellation
-    /// is refused once erase begins (see `cancel()`).
-    abort_handle: RwLock<Option<tokio::task::AbortHandle>>,
-}
-
-impl FlashJob {
-    fn new(board: FlashBoard, family: DeviceType, path: String) -> Arc<Self> {
-        Arc::new(Self {
-            abort_handle: RwLock::new(None),
-            status: RwLock::new(FlashJobStatus {
-                board,
-                family,
-                path,
-                stage: FlashStage::Downloading,
-                percent: None,
-                log_tail: Vec::new(),
-                done: false,
-                error: None,
-            }),
-        })
-    }
-
-    pub async fn snapshot(&self) -> FlashJobStatus {
-        self.status.read().await.clone()
-    }
-
-    async fn set_stage(&self, stage: FlashStage) {
-        let mut s = self.status.write().await;
-        s.stage = stage;
-        s.percent = None;
-    }
-
-    async fn set_percent(&self, percent: u8) {
-        self.status.write().await.percent = Some(percent.min(100));
-    }
-
-    async fn push_log(&self, line: impl Into<String>) {
-        let mut s = self.status.write().await;
-        s.log_tail.push(line.into());
-        let overflow = s.log_tail.len().saturating_sub(LOG_TAIL_MAX);
-        if overflow > 0 {
-            s.log_tail.drain(0..overflow);
-        }
-    }
-
-    async fn fail(&self, err: &anyhow::Error) {
-        let mut s = self.status.write().await;
-        s.stage = FlashStage::Failed;
-        s.error = Some(format!("{err:#}"));
-        s.done = true;
-    }
-
-    async fn finish(&self) {
-        let mut s = self.status.write().await;
-        s.stage = FlashStage::Done;
-        s.done = true;
-    }
-
-    /// Best-effort cancel: only honored before erase/write/autoinstall has
-    /// started (i.e. still in `Downloading`). Once a stage that touches the
-    /// chip begins, this refuses — interrupting an erase or write can leave
-    /// the flash in a state worse than either finished or unstarted.
-    pub async fn cancel(&self) -> Result<()> {
-        let mut s = self.status.write().await;
-        if s.done {
-            anyhow::bail!("Flash job already finished");
-        }
-        if s.stage != FlashStage::Downloading {
-            anyhow::bail!(
-                "Cannot cancel once {:?} has started — let it finish or fail on its own",
-                s.stage
-            );
-        }
-        if let Some(handle) = self.abort_handle.write().await.take() {
-            handle.abort();
-        }
-        s.stage = FlashStage::Failed;
-        s.error = Some("Cancelled by user".to_string());
-        s.done = true;
-        Ok(())
-    }
-}
-
-/// Shared handle held by `RpcHandler`, sibling to `mesh_service`.
-pub type FlashJobHandle = Arc<RwLock<Option<Arc<FlashJob>>>>;
-
-pub fn new_job_handle() -> FlashJobHandle {
-    Arc::new(RwLock::new(None))
-}
-
-fn firmware_cache_dir(data_dir: &Path) -> PathBuf {
-    data_dir.join("mesh").join("firmware-cache")
-}
-
-/// No blanket `.timeout()` here on purpose: reqwest's request timeout covers
-/// the *entire* request including streaming the response body, which would
-/// kill a legitimate large download partway through (Meshtastic's esp32s3
-/// zip is ~170MB) — not just a hung connection. `download_to_file` instead
-/// applies a per-chunk stall timeout, and metadata calls (small JSON
-/// responses) get their own short timeout at the call site.
-fn github_client() -> Result<reqwest::Client> {
-    reqwest::Client::builder()
-        .user_agent("archipelago-mesh-flash")
-        .connect_timeout(std::time::Duration::from_secs(10))
-        .build()
-        .context("Failed to build HTTP client")
-}
-
-/// Applied per-chunk while streaming a firmware download — if the transfer
-/// stalls (no bytes for this long) it's treated as a failure, but a slow
-/// download that's still making progress is never killed just for taking a
-/// while.
-const DOWNLOAD_STALL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
-
-/// Applied to metadata calls (GitHub release JSON) — these are small
-/// responses with no reason to ever take this long.
-const METADATA_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-
-/// Resolve what firmware is available for a board+family. v1 only ever
-/// offers "latest" — MeshCore/Meshtastic latest GitHub release, or, for
-/// Reticulum, "latest" meaning "whatever archy-rnodeconf --autoinstall
-/// resolves on its own" (it does its own version checking upstream).
-pub async fn list_firmware(family: DeviceType) -> Result<Vec<String>> {
-    match family {
-        DeviceType::Reticulum => Ok(vec!["latest".to_string()]),
-        DeviceType::Meshtastic => {
-            let client = github_client()?;
-            let release: GithubRelease = client
-                .get("https://api.github.com/repos/meshtastic/firmware/releases/latest")
-                .send()
-                .await
-                .context("Fetching Meshtastic release list")?
-                .error_for_status()
-                .context("Meshtastic releases API error")?
-                .json()
-                .await
-                .context("Parsing Meshtastic release JSON")?;
-            Ok(vec![release.tag_name])
-        }
-        DeviceType::Meshcore => {
-            let client = github_client()?;
-            let release: GithubRelease = client
-                .get("https://api.github.com/repos/meshcore-dev/MeshCore/releases/latest")
-                .send()
-                .await
-                .context("Fetching MeshCore release list")?
-                .error_for_status()
-                .context("MeshCore releases API error")?
-                .json()
-                .await
-                .context("Parsing MeshCore release JSON")?;
-            Ok(vec![release.tag_name])
-        }
-        DeviceType::Unknown => anyhow::bail!("Pick a firmware family before listing versions"),
-    }
-}
-
-#[derive(serde::Deserialize)]
-struct GithubAsset {
-    name: String,
-    browser_download_url: String,
-}
-
-#[derive(serde::Deserialize)]
-struct GithubRelease {
-    tag_name: String,
-    assets: Vec<GithubAsset>,
-}
-
-/// Start a flash job in the background. Returns as soon as the job has been
-/// registered and the listener released — callers poll `FlashJobHandle` via
-/// `mesh.flash-status` for progress. Only one job may be in flight at a time.
-pub async fn start_flash_job(
-    handle: &FlashJobHandle,
-    mesh_service: &Arc<RwLock<Option<MeshService>>>,
-    data_dir: PathBuf,
-    path: String,
-    board: FlashBoard,
-    family: DeviceType,
-) -> Result<()> {
-    {
-        let existing = handle.read().await;
-        if let Some(job) = existing.as_ref() {
-            if !job.snapshot().await.done {
-                anyhow::bail!("A firmware flash is already in progress on this node");
-            }
-        }
-    }
-
-    let job = FlashJob::new(board, family, path.clone());
-    *handle.write().await = Some(Arc::clone(&job));
-
-    let bg_job = Arc::clone(&job);
-    let bg_service = Arc::clone(mesh_service);
-    let task = tokio::spawn(async move {
-        // esptool/archy-rnodeconf need exclusive serial access — release
-        // the listener's hold on the port before touching it. This USED
-        // TO run synchronously in start_flash_job before the job was even
-        // spawned, blocking the RPC call itself on s.stop().await — a real
-        // 2026-07-23 incident: the mesh listener was mid a multi-candidate
-        // reconnect/probe sequence that doesn't check its shutdown signal
-        // between candidates, so stop() never returned. The HTTP request
-        // timed out client-side ("Operation failed"), while the job
-        // (already inserted into `handle`) was permanently wedged — nothing
-        // had been spawned yet to ever mark it done, so every later flash
-        // attempt failed with "already in progress" until a full restart.
-        // Now this runs inside the spawned task with its own bounded
-        // timeout, so the RPC call always returns immediately regardless,
-        // and a slow-to-stop listener fails the job cleanly instead of
-        // hanging everything downstream of it forever.
-        let stop_result = tokio::time::timeout(STOP_LISTENER_TIMEOUT, async {
-            let mut svc = bg_service.write().await;
-            if let Some(s) = svc.as_mut() {
-                s.stop().await;
-            }
-        })
-        .await;
-        if stop_result.is_err() {
-            let err = anyhow::anyhow!(
-                "Mesh listener did not release the serial port within {}s — it may still be mid a reconnect attempt. Try again once mesh.status shows the device idle, or restart the archipelago service if this persists.",
-                STOP_LISTENER_TIMEOUT.as_secs()
-            );
-            bg_job.push_log(format!("ERROR: {err:#}")).await;
-            bg_job.fail(&err).await;
-            return;
-        }
-
-        // Belt-and-suspenders port-free check. `stop()` above should have
-        // fully released the port, but esptool/rnodeconf run as external
-        // subprocesses for minutes outside our own async runtime — if
-        // ANYTHING else still has it open (a racing probe, a not-yet-dropped
-        // fd from an aborted task, anything we haven't anticipated), handing
-        // the port to the flasher anyway risks exactly the corruption
-        // confirmed live 2026-07-23: esptool's "device disconnected or
-        // multiple access on port?" and rnodeconf's raw `OSError: [Errno 71]
-        // Protocol error` on an RTS ioctl are both textbook two-openers-on-
-        // one-fd symptoms. Verify by actually opening it ourselves — cheap,
-        // and definitive — before ever starting the flasher.
-        if let Err(e) = wait_for_port_free(&path).await {
-            bg_job.push_log(format!("ERROR: {e:#}")).await;
-            bg_job.fail(&e).await;
-            return;
-        }
-
-        // Outer ceiling on top of run_flash's own internal timeouts —
-        // belt-and-suspenders so that no future hang (network, subprocess,
-        // anything) can ever wedge the single-flash-job guard permanently
-        // again the way a stuck download did on 2026-07-23 (every
-        // subsequent mesh.flash-device call failed with "already in
-        // progress" until the service was restarted). Generous enough that
-        // a legitimately slow multi-hundred-MB transfer still completes.
-        let result = match tokio::time::timeout(
-            MAX_JOB_DURATION,
-            run_flash(board, family, &data_dir, &path, &bg_job),
-        )
-        .await
-        {
-            Ok(inner) => inner,
-            Err(_) => Err(anyhow::anyhow!(
-                "Flash job exceeded the {}-minute ceiling — aborted",
-                MAX_JOB_DURATION.as_secs() / 60
-            )),
-        };
-        let succeeded = result.is_ok();
-
-        match &result {
-            Ok(()) => {
-                bg_job.push_log("Flash completed successfully".to_string()).await;
-                bg_job.finish().await;
-                info!(path = %path, board = ?board, family = %family, "LoRa firmware flash succeeded");
-            }
-            Err(e) => {
-                // {:#} (alternate Display) walks the full anyhow context
-                // chain — plain {} / %e only prints the outermost .context()
-                // message, which made a real 2026-07-23 esptool failure
-                // undiagnosable from journalctl alone (just "esptool
-                // erase_flash failed", no actual esptool stderr).
-                warn!(path = %path, error = %format!("{e:#}"), "LoRa firmware flash failed");
-                bg_job.push_log(format!("ERROR: {e:#}")).await;
-                bg_job.fail(e).await;
-            }
-        }
-
-        // The board's firmware may now differ from whatever was pinned
-        // before — clear the pin either way so a later reconnect's strict
-        // auto-detect order picks up reality instead of getting wedged
-        // trying the old protocol first.
-        if let Ok(mut config) = super::load_config(&data_dir).await {
-            config.device_kind = None;
-            if let Err(e) = super::save_config(&data_dir, &config).await {
-                warn!(error = %e, "Failed to clear device_kind pin after flash");
-            }
-        }
-
-        if !succeeded {
-            // Deliberately do NOT auto-restart the listener here. A failed
-            // flash means we can't vouch for the board's state — reopening
-            // the port immediately (esptool/rnodeconf's own reset sequence
-            // plus our open() toggling DTR/RTS again right after) risks
-            // hammering a marginal device with reconnect attempts. Confirmed
-            // live 2026-07-23: exactly this sequence left a real Heltec V3
-            // boot-looping for 5+ minutes after a failed flash. Leave mesh
-            // stopped; the user reconnects explicitly via the hot-swap
-            // modal/Mesh page once they've confirmed the board is alive.
-            warn!(
-                path = %path,
-                "Leaving mesh listener stopped after failed flash — reconnect manually once the board is confirmed responsive"
-            );
-            return;
-        }
-
-        // On success, give the board a moment to finish booting after the
-        // flash tool's own reset sequence before we start hammering it with
-        // connection attempts — same reasoning as above, just the
-        // lower-risk (successful-flash) side of it.
-        tokio::time::sleep(POST_FLASH_SETTLE_DELAY).await;
-
-        let mut svc = bg_service.write().await;
-        if let Some(s) = svc.as_mut() {
-            match super::load_config(&data_dir).await {
-                Ok(config) => {
-                    // Only resume if mesh is actually still enabled per the
-                    // CURRENT persisted config — confirmed live 2026-07-23:
-                    // unconditionally forcing a restart here, regardless of
-                    // `enabled`, overrode a user's own concurrent "disable
-                    // mesh" toggle and left the listener running while
-                    // config said disabled. That inconsistent state is what
-                    // made a later legitimate "Keep As Is" click (which
-                    // correctly tries to start on a false→true transition)
-                    // fail with "already running" — the listener had already
-                    // been force-started behind the config's back.
-                    let should_run = config.enabled;
-                    if let Err(e) = s.configure(config).await {
-                        warn!(error = %e, "Failed to resume mesh listener after flash");
-                    }
-                    if should_run {
-                        if let Err(e) = s.start() {
-                            warn!(error = %e, "Failed to restart mesh listener after flash");
-                        }
-                    }
-                }
-                Err(e) => warn!(error = %e, "Failed to load mesh config after flash"),
-            }
-        }
-    });
-    *job.abort_handle.write().await = Some(task.abort_handle());
-
-    Ok(())
-}
-
-async fn run_flash(
-    board: FlashBoard,
-    family: DeviceType,
-    data_dir: &Path,
-    path: &str,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    match family {
-        DeviceType::Meshtastic | DeviceType::Meshcore => {
-            let image = fetch_esptool_image(board, family, data_dir, job).await?;
-            esptool_erase_and_write(path, &image, job).await
-        }
-        DeviceType::Reticulum => {
-            let lora_region = super::load_config(data_dir)
-                .await
-                .ok()
-                .and_then(|c| c.lora_region);
-            rnodeconf_autoinstall(path, board, lora_region.as_deref(), job).await
-        }
-        DeviceType::Unknown => anyhow::bail!("Pick a firmware family before flashing"),
-    }
-}
-
-// ─── MeshCore / Meshtastic: esptool ─────────────────────────────────────
-
-async fn fetch_esptool_image(
-    board: FlashBoard,
-    family: DeviceType,
-    data_dir: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let cache = firmware_cache_dir(data_dir);
-    tokio::fs::create_dir_all(&cache)
-        .await
-        .context("Creating firmware cache dir")?;
-    let client = github_client()?;
-
-    match family {
-        DeviceType::Meshtastic => fetch_meshtastic_image(&client, board, &cache, job).await,
-        DeviceType::Meshcore => fetch_meshcore_image(&client, board, &cache, job).await,
-        _ => anyhow::bail!("{family} is not flashed via esptool"),
-    }
-}
-
-async fn fetch_meshtastic_image(
-    client: &reqwest::Client,
-    board: FlashBoard,
-    cache: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let release: GithubRelease = client
-        .get("https://api.github.com/repos/meshtastic/firmware/releases/latest")
-        .timeout(METADATA_TIMEOUT)
-        .send()
-        .await
-        .context("Fetching Meshtastic release list")?
-        .error_for_status()
-        .context("Meshtastic releases API error")?
-        .json()
-        .await
-        .context("Parsing Meshtastic release JSON")?;
-
-    // Meshtastic bundles all esp32s3 boards' images inside one per-platform
-    // zip rather than shipping per-board top-level assets — both Heltec V3
-    // and V4 are esp32s3, so this is the right zip for both (confirmed live
-    // against v2.7.26.54e0d8d).
-    let zip_asset = release
-        .assets
-        .iter()
-        .find(|a| a.name.starts_with("firmware-esp32s3-") && a.name.ends_with(".zip"))
-        .ok_or_else(|| anyhow::anyhow!("No esp32s3 firmware zip in latest Meshtastic release"))?;
-
-    let version = zip_asset
-        .name
-        .strip_prefix("firmware-esp32s3-")
-        .and_then(|s| s.strip_suffix(".zip"))
-        .ok_or_else(|| anyhow::anyhow!("Unexpected Meshtastic asset name: {}", zip_asset.name))?
-        .to_string();
-
-    let zip_path = cache.join(&zip_asset.name);
-    if tokio::fs::metadata(&zip_path).await.is_err() {
-        download_to_file(client, &zip_asset.browser_download_url, &zip_path, job).await?;
-    } else {
-        job.push_log(format!("Using cached {}", zip_asset.name)).await;
-    }
-
-    // "*.factory.bin" is Meshtastic's full merged image (bootloader +
-    // partition table + app) meant to be written at offset 0x0 on a freshly
-    // erased chip — confirmed by inspecting the real zip's contents, as
-    // opposed to the plain "*.bin" OTA-update image which assumes an
-    // existing bootloader/partition table already on the chip.
-    let entry_name = format!(
-        "firmware-{}-{}.factory.bin",
-        board.meshtastic_id(),
-        version
-    );
-    let out_path = cache.join(&entry_name);
-    if tokio::fs::metadata(&out_path).await.is_ok() {
-        return Ok(out_path);
-    }
-
-    job.push_log(format!(
-        "Extracting {entry_name} from {}",
-        zip_asset.name
-    ))
-    .await;
-    let zip_path_owned = zip_path.clone();
-    let entry_name_owned = entry_name.clone();
-    let out_path_owned = out_path.clone();
-    tokio::task::spawn_blocking(move || -> Result<()> {
-        let file = std::fs::File::open(&zip_path_owned).context("Opening downloaded firmware zip")?;
-        let mut archive = zip::ZipArchive::new(file).context("Reading firmware zip")?;
-        let mut entry = archive
-            .by_name(&entry_name_owned)
-            .with_context(|| format!("{entry_name_owned} not found in firmware zip"))?;
-        let mut out =
-            std::fs::File::create(&out_path_owned).context("Creating extracted firmware file")?;
-        std::io::copy(&mut entry, &mut out).context("Extracting firmware image")?;
-        Ok(())
-    })
-    .await
-    .context("Firmware extraction task panicked")??;
-
-    Ok(out_path)
-}
-
-async fn fetch_meshcore_image(
-    client: &reqwest::Client,
-    board: FlashBoard,
-    cache: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let release: GithubRelease = client
-        .get("https://api.github.com/repos/meshcore-dev/MeshCore/releases/latest")
-        .timeout(METADATA_TIMEOUT)
-        .send()
-        .await
-        .context("Fetching MeshCore release list")?
-        .error_for_status()
-        .context("MeshCore releases API error")?
-        .json()
-        .await
-        .context("Parsing MeshCore release JSON")?;
-
-    // Upstream's casing differs between boards (Heltec_v3_... vs
-    // heltec_v4_...) — match case-insensitively on the exact per-board
-    // substring so V4 isn't accidentally matched by "heltec_v4_tft_..."
-    // variants (there's a "_tft_" in between, so a straight substring match
-    // on "heltec_v4_companion_radio_usb" is already safe).
-    let needle = match board {
-        FlashBoard::HeltecV3 => "heltec_v3_companion_radio_usb",
-        FlashBoard::HeltecV4 => "heltec_v4_companion_radio_usb",
-    };
-    let asset = release
-        .assets
-        .iter()
-        .find(|a| {
-            let lower = a.name.to_lowercase();
-            lower.contains(needle) && lower.ends_with("-merged.bin")
-        })
-        .ok_or_else(|| {
-            anyhow::anyhow!("No matching MeshCore image in release {}", release.tag_name)
-        })?;
-
-    let out_path = cache.join(&asset.name);
-    if tokio::fs::metadata(&out_path).await.is_ok() {
-        job.push_log(format!("Using cached {}", asset.name)).await;
-        return Ok(out_path);
-    }
-    download_to_file(client, &asset.browser_download_url, &out_path, job).await?;
-    Ok(out_path)
-}
-
-async fn download_to_file(
-    client: &reqwest::Client,
-    url: &str,
-    dest: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    job.set_stage(FlashStage::Downloading).await;
-    // Bound only the wait for the response to *start* (headers) — NOT a
-    // request-level `.timeout()`, which would cap the whole body transfer
-    // again (the bug this replaced: a blanket 30s client timeout killed
-    // large downloads mid-stream). If the server never responds at all,
-    // this is what stops the job from hanging forever; the per-chunk stall
-    // timeout below is what guards the body once streaming starts. Without
-    // this, a server that accepts the TCP connection but never sends
-    // headers back hangs this call indefinitely — confirmed live
-    // 2026-07-23: a stuck `.send()` here wedged the single-flash-job guard
-    // for good, permanently blocking every subsequent flash attempt with
-    // "already in progress" until the service was restarted.
-    let resp = tokio::time::timeout(METADATA_TIMEOUT, client.get(url).send())
-        .await
-        .context("Firmware download server did not respond")?
-        .context("Starting firmware download")?
-        .error_for_status()
-        .context("Firmware download returned an error status")?;
-    let total = resp.content_length();
-    let tmp = dest.with_extension("part");
-    let mut file = tokio::fs::File::create(&tmp)
-        .await
-        .context("Creating firmware download file")?;
-    let mut stream = resp.bytes_stream();
-    let mut downloaded: u64 = 0;
-    use futures_util::StreamExt;
-    loop {
-        let next = tokio::time::timeout(DOWNLOAD_STALL_TIMEOUT, stream.next())
-            .await
-            .context("Firmware download stalled")?;
-        let Some(chunk) = next else { break };
-        let chunk = chunk.context("Reading firmware download stream")?;
-        file.write_all(&chunk)
-            .await
-            .context("Writing firmware download")?;
-        downloaded += chunk.len() as u64;
-        if let Some(total) = total {
-            if total > 0 {
-                job.set_percent(((downloaded.saturating_mul(100)) / total) as u8)
-                    .await;
-            }
-        }
-    }
-    file.flush().await.ok();
-    tokio::fs::rename(&tmp, dest)
-        .await
-        .context("Finalizing firmware download")?;
-    job.push_log(format!(
-        "Downloaded {} ({downloaded} bytes)",
-        dest.display()
-    ))
-    .await;
-    Ok(())
-}
-
-/// Both Heltec V3 and V4 are ESP32-S3 boards.
-const ESPTOOL_CHIP: &str = "esp32s3";
-
-/// esptool's auto-reset-into-bootloader handshake (toggling DTR/RTS in a
-/// specific timed pattern) is well-known to be flaky on some CP2102/CH340
-/// board+adapter combinations — esptool's own docs recommend retrying at a
-/// lower baud rate when this happens. Rather than fail the whole job on the
-/// first hiccup, retry once at a conservative baud before giving up.
-const ESPTOOL_FALLBACK_BAUD: &str = "115200";
-
-/// `write_flash --erase-all` erases the whole chip before writing, in one
-/// esptool invocation. This needs the esp32s3 stub flasher loaded (see
-/// esptool_global_args' doc comment) — without it, --erase-all hits the
-/// exact same ROM limitation a standalone `erase_flash` does ("ESP32-S3 ROM
-/// does not support function erase_flash", confirmed live 2026-07-23), since
-/// esptool's --erase-all is implemented as the same full-chip-erase command,
-/// not a per-sector loop.
-async fn esptool_erase_and_write(path: &str, image: &Path, job: &Arc<FlashJob>) -> Result<()> {
-    job.set_stage(FlashStage::Writing).await;
-    let image_str = image.to_string_lossy().to_string();
-    esptool_with_retry(
-        path,
-        &["write_flash", "--erase-all", "0x0", &image_str],
-        job,
-    )
-    .await
-    .context("esptool write_flash failed")?;
-
-    Ok(())
-}
-
-/// esptool's global flags (--chip/--port/--baud) MUST precede the subcommand
-/// token (erase_flash/write_flash/...) — confirmed live 2026-07-23:
-/// appending `--baud 115200` after the subcommand on the retry path
-/// produced "esptool: error: unrecognized arguments: --baud 115200" every
-/// time, so the fallback-baud retry never actually got a chance to run.
-/// Building global args separately from subcommand args keeps this correct
-/// by construction instead of relying on call-site ordering.
-///
-/// Normal stub-loader mode (no --no-stub) needs the esp32s3 stub flasher
-/// blob at /usr/lib/python3/dist-packages/esptool/targets/stub_flasher/
-/// stub_flasher_32s3.json — Debian's `esptool` package (4.7.0+dfsg-0.1)
-/// ships without it (stripped for DFSG compliance: the prebuilt blob has no
-/// buildable-from-source path Debian could verify), so scripts/self-update.sh
-/// fetches the exact same file from the matching upstream esptool release
-/// tag and installs it alongside the apt package (see the esptool install
-/// step there). --no-stub (talk directly to the ROM bootloader, skip the
-/// stub) was tried first and works for connecting, but the ROM bootloader
-/// doesn't implement a full-chip-erase opcode at all — only the stub does —
-/// so --no-stub broke our "always erase before write" default outright
-/// rather than just being slower. Restoring the real stub file is the
-/// correct fix, not routing around its absence.
-fn esptool_global_args<'a>(path: &'a str, baud: Option<&'a str>) -> Vec<&'a str> {
-    let mut args = vec!["--chip", ESPTOOL_CHIP, "--port", path];
-    if let Some(b) = baud {
-        args.push("--baud");
-        args.push(b);
-    }
-    args
-}
-
-async fn esptool_with_retry(path: &str, subcommand: &[&str], job: &Arc<FlashJob>) -> Result<()> {
-    let mut cmd = Command::new("esptool");
-    cmd.args(esptool_global_args(path, None));
-    cmd.args(subcommand);
-    match run_streamed(cmd, None, job).await {
-        Ok(()) => Ok(()),
-        Err(first_err) => {
-            job.push_log(format!(
-                "First attempt failed ({first_err:#}); retrying once at {ESPTOOL_FALLBACK_BAUD} baud"
-            ))
-            .await;
-            let mut retry = Command::new("esptool");
-            retry.args(esptool_global_args(path, Some(ESPTOOL_FALLBACK_BAUD)));
-            retry.args(subcommand);
-            run_streamed(retry, None, job)
-                .await
-                .context(format!("retry also failed (first attempt: {first_err:#})"))
-        }
-    }
-}
-
-// ─── Reticulum/RNode: archy-rnodeconf ───────────────────────────────────
-
-fn rnodeconf_bin() -> String {
-    std::env::var("ARCHY_RNODECONF_BIN")
-        .unwrap_or_else(|_| "/usr/local/bin/archy-rnodeconf".to_string())
-}
-
-/// `--autoinstall`'s "which board is this" step is interactive by design —
-/// confirmed live against a real Heltec V4 (2026-07-23): even with a board
-/// given on the command line, rnodeconf can't always tell V3 from V4 apart
-/// (their bootstrap-time USB identity is often generic, same root cause as
-/// `resolve_flash_board`'s doc comment), so it always asks. The full prompt
-/// sequence observed for a Heltec board that already has *some* RNode
-/// firmware installed (the common case — a truly blank chip likely skips
-/// straight to the same "Device Selection" menu):
-///   1. numbered device-type menu  → answer with the menu number
-///   2. "Hit enter to continue"    → answer with a blank line
-///   3. numbered band menu         → answer with the menu number
-///   4. "Is the above correct? [y/N]" → answer "y"
-/// Feeding all four answers up front (rather than watching stdout for each
-/// prompt text) works because the menu is always asked in this fixed order
-/// for every board that needs (re)provisioning — verified by driving it
-/// through an unprovisioned real V4 end-to-end (erase → flash → EEPROM
-/// bootstrap → "Device signature validated" on the next probe).
-fn rnodeconf_device_menu_number(board: FlashBoard) -> &'static str {
-    match board {
-        FlashBoard::HeltecV3 => "8",
-        FlashBoard::HeltecV4 => "9",
-    }
-}
-
-/// rnodeconf's band choice is a coarse RF-frontend bootstrap parameter
-/// (868/915/923 MHz), not the final operating frequency — that's still
-/// configured later via the daemon's interface config, same as today. This
-/// is a best-effort mapping from the node's persisted Meshtastic-style
-/// region code (see `mesh::meshtastic::region_name_to_code`) down to
-/// rnodeconf's 3-way menu; regions with no exact 868/923 match fall back to
-/// 915 MHz as the broadest-compatibility default.
-fn rnodeconf_band_menu_number(lora_region: Option<&str>) -> &'static str {
-    match lora_region.map(|s| s.trim().to_uppercase()) {
-        Some(r) if r.contains("868") => "1",
-        Some(r) if r.contains("923") => "3",
-        _ => "2",
-    }
-}
-
-/// `--autoinstall` fetches, erases, flashes, and bootstraps the EEPROM for
-/// a detected board as one atomic step (confirmed via `archy-rnodeconf
-/// --help` AND a real end-to-end flash on real hardware) — this is the
-/// RNode-side equivalent of our "always erase before write" default, since
-/// autoinstall doesn't try to preserve any existing on-device state.
-async fn rnodeconf_autoinstall(
-    path: &str,
-    board: FlashBoard,
-    lora_region: Option<&str>,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    job.set_stage(FlashStage::Autoinstalling).await;
-    let bin = rnodeconf_bin();
-    let mut cmd = if Path::new(&bin).exists() {
-        Command::new(bin)
-    } else {
-        // Dev fallback if only a plain venv/system rnodeconf is on PATH.
-        Command::new("rnodeconf")
-    };
-    cmd.args(["--autoinstall", path]);
-    let stdin = format!(
-        "{}\n\n{}\ny\n",
-        rnodeconf_device_menu_number(board),
-        rnodeconf_band_menu_number(lora_region)
-    );
-    run_streamed(cmd, Some(stdin.into_bytes()), job)
-        .await
-        .context("archy-rnodeconf --autoinstall failed")
-}
-
-// ─── Subprocess streaming ────────────────────────────────────────────────
-
-fn percent_regex() -> &'static Regex {
-    static RE: OnceLock<Regex> = OnceLock::new();
-    RE.get_or_init(|| Regex::new(r"\((\d{1,3})\s*%\)").expect("valid regex"))
-}
-
-async fn run_streamed(mut cmd: Command, stdin: Option<Vec<u8>>, job: &Arc<FlashJob>) -> Result<()> {
-    cmd.stdout(Stdio::piped());
-    cmd.stderr(Stdio::piped());
-    if stdin.is_some() {
-        cmd.stdin(Stdio::piped());
-    }
-    // Deliberately NOT kill_on_drop: an interrupted erase/write can leave
-    // the chip in a worse state than either finished or unstarted (see the
-    // cancellation-safety note in mesh flashing docs). The job is expected
-    // to run to completion or fail on its own.
-    let mut child = cmd.spawn().context("Failed to start subprocess")?;
-
-    if let Some(bytes) = stdin {
-        if let Some(mut child_stdin) = child.stdin.take() {
-            child_stdin
-                .write_all(&bytes)
-                .await
-                .context("Writing to subprocess stdin")?;
-        }
-    }
-
-    let mut tasks = Vec::new();
-    if let Some(stdout) = child.stdout.take() {
-        let job = Arc::clone(job);
-        tasks.push(tokio::spawn(async move {
-            let mut lines = BufReader::new(stdout).lines();
-            while let Ok(Some(line)) = lines.next_line().await {
-                if let Some(cap) = percent_regex().captures(&line) {
-                    if let Ok(pct) = cap[1].parse::<u8>() {
-                        job.set_percent(pct).await;
-                    }
-                }
-                job.push_log(line).await;
-            }
-        }));
-    }
-    if let Some(stderr) = child.stderr.take() {
-        let job = Arc::clone(job);
-        tasks.push(tokio::spawn(async move {
-            let mut lines = BufReader::new(stderr).lines();
-            while let Ok(Some(line)) = lines.next_line().await {
-                job.push_log(line).await;
-            }
-        }));
-    }
-
-    let status = child.wait().await.context("Waiting for subprocess")?;
-    for t in tasks {
-        let _ = t.await;
-    }
-    if !status.success() {
-        // Exit status alone isn't diagnosable — the actual esptool/rnodeconf
-        // stderr (already captured into job.log_tail by the reader tasks
-        // above) is what actually explains a failure. Confirmed live
-        // 2026-07-23: a bare "Command exited with exit status: 1" told us
-        // nothing when esptool's real error was sitting in the log tail the
-        // whole time, only visible via the UI's live poll, not journald.
-        let tail: Vec<String> = job
-            .snapshot()
-            .await
-            .log_tail
-            .iter()
-            .rev()
-            .take(10)
-            .rev()
-            .cloned()
-            .collect();
-        anyhow::bail!("Command exited with {status}\n{}", tail.join("\n"));
-    }
-    Ok(())
-}

core/archipelago/src/mesh/listener/decode.rs

@@ -578,7 +578,7 @@ pub(super) async fn handle_identity_received(
         .insert(contact_id, shared_secret);
 
     // Update peer record
-    let mut peer = MeshPeer {
+    let peer = MeshPeer {
         contact_id,
         // .get(): a malformed DID shorter than the "did:key:" prefix must
         // not panic the listener on a radio-supplied string.
@@ -607,24 +607,6 @@ pub(super) async fn handle_identity_received(
     let is_new = {
         let mut peers = state.peers.write().await;
         let is_new = !peers.contains_key(&contact_id);
-        if let Some(existing) = peers.get(&contact_id) {
-            // This id is shared with the federation-seeded row for the same
-            // node (that's the point — identity adverts MERGE, not duplicate).
-            // The wholesale insert below must not stomp the federation row's
-            // real node name with our synthetic "Archy-…" placeholder — with
-            // Reticulum re-emitting identity adverts every announce tick,
-            // that renamed every federated contact once a minute. Same for a
-            // known position: keep it rather than nulling it out.
-            if !existing.advert_name.trim().is_empty()
-                && !existing.advert_name.starts_with("Archy-")
-            {
-                peer.advert_name = existing.advert_name.clone();
-            }
-            if peer.lat.is_none() {
-                peer.lat = existing.lat;
-                peer.lon = existing.lon;
-            }
-        }
         peers.insert(contact_id, peer.clone());
         is_new
     };

core/archipelago/src/mesh/listener/mod.rs

@@ -557,10 +557,6 @@ pub fn spawn_mesh_listener(
         let mut shutdown = shutdown;
         let mut cmd_rx = cmd_rx;
         let mut reconnect_delay = RECONNECT_DELAY_INIT;
-        // Mutable so a successful auto-detect can pin the firmware kind for
-        // the rest of this listener's lifetime — see the pin-on-first-success
-        // block below for why.
-        let mut device_kind = device_kind;
         // Backlog #12 hot-swap re-binding: each run_mesh_session call already
         // builds a fresh device struct (contacts/current_region/etc. all
         // start empty), so per-device session state is naturally isolated
@@ -632,45 +628,6 @@ pub fn spawn_mesh_listener(
                 }
             }
 
-            // Pin the firmware kind after the first successful auto-detect.
-            // Confirmed live 2026-07-23: with device_kind left unpinned (e.g.
-            // after clearing a stale pin), EVERY reconnect re-runs the full
-            // Reticulum→Meshcore→Meshtastic auto-detect cascade — each
-            // candidate past the first does its own open() with the DTR/RTS
-            // reset both boards need, so a device correctly identified as
-            // Meshtastic still gets reset once for the failed Meshcore
-            // attempt before Meshtastic's own open() resets it again. That
-            // doubled the reset count on every single reconnect indefinitely,
-            // not just during initial detection. Once auto-detect has
-            // identified the device this listener is actually talking to,
-            // there's no reason to keep guessing on subsequent reconnects —
-            // pin it, both in this task's own loop (takes effect
-            // immediately) and on disk (survives a service restart). A
-            // genuine hot-swap to different firmware is still handled: the
-            // setup modal's `mesh.probe-device` always re-probes unpinned,
-            // and the flash flow already clears this pin on its own.
-            if device_kind.is_none() {
-                let detected = state.status.read().await.device_type;
-                if detected != super::types::DeviceType::Unknown {
-                    device_kind = Some(detected);
-                    match super::load_config(&data_dir).await {
-                        Ok(mut cfg) if cfg.device_kind.is_none() => {
-                            cfg.device_kind = Some(detected);
-                            if let Err(e) = super::save_config(&data_dir, &cfg).await {
-                                warn!("Failed to persist auto-detected device_kind: {}", e);
-                            } else {
-                                info!(
-                                    kind = %detected,
-                                    "Pinned auto-detected firmware kind to avoid repeated multi-protocol resets on reconnect"
-                                );
-                            }
-                        }
-                        Ok(_) => {}
-                        Err(e) => warn!("Failed to load mesh config to persist device_kind: {}", e),
-                    }
-                }
-            }
-
             // Update status to disconnected. device_type/firmware_version are
             // reset too — they were previously left holding the LAST radio's
             // identity, so after a hot-swap the UI showed the old firmware

core/archipelago/src/mesh/listener/session.rs

@@ -270,7 +270,6 @@ async fn auto_detect_and_open(
     our_x25519_pubkey_hex: &str,
     device_kind: Option<DeviceType>,
     skip_path: Option<&str>,
-    advert_name: Option<&str>,
 ) -> Result<(String, MeshRadioDevice, DeviceInfo)> {
     let mut paths = super::super::serial::detect_serial_devices().await;
     // When falling back from a just-failed preferred path, don't probe that
@@ -288,7 +287,6 @@ async fn auto_detect_and_open(
             None => "No serial devices found in /dev".to_string(),
         });
     }
-    info!(candidates = ?paths, "Auto-detect candidate ports for this attempt");
     for path in &paths {
         debug!(path = %path, "Probing for mesh radio device");
         // Tried FIRST: `ReticulumLink::open()` gates its expensive daemon
@@ -306,7 +304,6 @@ async fn auto_detect_and_open(
                 data_dir,
                 Some(our_ed_pubkey_hex),
                 Some(our_x25519_pubkey_hex),
-                advert_name,
             )
             .await
             {
@@ -468,7 +465,6 @@ async fn open_preferred_path(
     our_ed_pubkey_hex: &str,
     our_x25519_pubkey_hex: &str,
     device_kind: Option<DeviceType>,
-    advert_name: Option<&str>,
 ) -> Result<(MeshRadioDevice, DeviceInfo)> {
     // Pinned: try only the configured firmware and surface its own error —
     // never fall through to (and inject probe bytes into) another firmware's
@@ -501,7 +497,6 @@ async fn open_preferred_path(
                     data_dir,
                     Some(our_ed_pubkey_hex),
                     Some(our_x25519_pubkey_hex),
-                    advert_name,
                 )
                 .await
                 .context("Could not open preferred path as Reticulum")?;
@@ -515,21 +510,40 @@ async fn open_preferred_path(
         };
     }
 
-    // Unpinned: don't probe this path ourselves at all. Confirmed live
-    // 2026-07-23 — this function used to run its own Reticulum→Meshcore→
-    // Meshtastic sequence here, and the caller (run_mesh_session) falls
-    // back to `auto_detect_and_open` on any error, which scans every
-    // candidate path (this one included) with the exact same three-protocol
-    // sequence. With a single physical radio — the overwhelmingly common
-    // case — `path` here IS the one candidate `auto_detect_and_open` is
-    // about to try, so every unpinned reconnect was resetting the board via
-    // Reticulum/Meshcore/Meshtastic's DTR/RTS toggle TWICE: once here, once
-    // again moments later in auto-detect. Bailing immediately (no port
-    // access at all) means auto-detect's single pass is the only one that
-    // ever touches the port when nothing is pinned yet. (auto_detect_and_open
-    // carries the advert_name threading from main, so nothing is lost.)
-    let _ = advert_name;
-    anyhow::bail!("No device_kind pin — deferring to auto-detect for {path}")
+    // Reticulum first — see the matching comment on auto_detect_and_open:
+    // its cheap probe_rnode gate fails in ~1s for non-RNode firmware, while
+    // trying Meshcore/Meshtastic first was observed leaving a real RNode
+    // board unresponsive by the time Reticulum's turn came.
+    match ReticulumLink::open(
+        path,
+        data_dir,
+        Some(our_ed_pubkey_hex),
+        Some(our_x25519_pubkey_hex),
+    )
+    .await
+    {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => return Ok((MeshRadioDevice::Reticulum(dev), info)),
+            Err(e) => {
+                debug!(path = %path, error = %e, "Preferred path is not a working Reticulum RNode")
+            }
+        },
+        Err(e) => debug!(path = %path, error = %e, "Could not open preferred path as Reticulum"),
+    }
+    match MeshcoreDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => return Ok((MeshRadioDevice::Meshcore(dev), info)),
+            Err(e) => debug!(path = %path, error = %e, "Preferred path is not Meshcore"),
+        },
+        Err(e) => debug!(path = %path, error = %e, "Could not open preferred path as Meshcore"),
+    }
+    match MeshtasticDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => Ok((MeshRadioDevice::Meshtastic(dev), info)),
+            Err(e) => Err(e).context("Preferred path is not a working Meshtastic device"),
+        },
+        Err(e) => Err(e).context("Could not open preferred path as Meshtastic"),
+    }
 }
 
 /// Bring up a Reticulum daemon over plain TCP — no physical RNode, no
@@ -542,7 +556,6 @@ async fn open_reticulum_tcp(
     data_dir: &Path,
     our_ed_pubkey_hex: &str,
     our_x25519_pubkey_hex: &str,
-    advert_name: Option<&str>,
 ) -> Result<(String, MeshRadioDevice, DeviceInfo)> {
     let mut dev = match cfg {
         ReticulumTcpConfig::Server { bind } => ReticulumLink::open_tcp_server(
@@ -550,7 +563,6 @@ async fn open_reticulum_tcp(
             data_dir,
             Some(our_ed_pubkey_hex),
             Some(our_x25519_pubkey_hex),
-            advert_name,
         )
         .await
         .context("Could not open Reticulum TCP server interface")?,
@@ -559,7 +571,6 @@ async fn open_reticulum_tcp(
             data_dir,
             Some(our_ed_pubkey_hex),
             Some(our_x25519_pubkey_hex),
-            advert_name,
         )
         .await
         .context("Could not open Reticulum TCP client interface")?,
@@ -976,93 +987,49 @@ pub(super) async fn run_mesh_session(
     // auto-detect. TCP mode is additive/dev-only; it never changes behavior
     // for existing serial/RNode deployments where `reticulum_tcp` is None.
     //
-    // The name we present on the mesh: the operator's configured mesh name /
-    // server name, falling back to a DID fragment. Computed BEFORE the open
-    // sequence because Reticulum needs it at daemon-spawn time — the RNS
-    // announce carries it from the very first announce. (Meshcore/Meshtastic
-    // still receive it via set_advert_name after connect, below.)
-    let desired_advert_name: String = match server_name {
-        // Meshcore firmware limits advert names — truncate to 20 chars.
-        Some(name) => name.chars().take(20).collect(),
-        None => format!(
-            "Archy-{}",
-            our_did.chars().skip(8).take(8).collect::<String>()
-        ),
-    };
-
     // The whole open sequence runs under PORT_OPEN_LOCK so an RPC probe
     // can't interleave its own handshakes on the same tty (see the lock's
     // doc comment). Held only until the device is opened, then released.
-    //
-    // The sequence is raced against the shutdown signal: probes/handshakes
-    // can take 10s+, and without this a stop() issued mid-probe (config
-    // change, disable, rename) always burned the full listener-shutdown
-    // timeout and ended in a hard abort — observed live on archi-dev-box
-    // 2026-07-28. Dropping the open future mid-probe is safe: it holds no
-    // session state yet and the port guard/serial handle close with it.
-    let open_fut = async {
-        let port_guard = PORT_OPEN_LOCK.lock().await;
-        let result = if let Some(tcp_cfg) = &reticulum_tcp {
-            open_reticulum_tcp(
-                tcp_cfg,
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                Some(&desired_advert_name),
-            )
-            .await
-        } else if let Some(path) = preferred_path {
-            match open_preferred_path(
-                path,
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                device_kind,
-                Some(&desired_advert_name),
-            )
-            .await
-            {
-                Ok((dev, info)) => Ok((path.to_string(), dev, info)),
-                Err(e) => {
-                    warn!(
-                        "Preferred path {} probe failed: {} — trying auto-detect",
-                        path, e
-                    );
-                    auto_detect_and_open(
-                        data_dir,
-                        our_ed_pubkey_hex,
-                        our_x25519_pubkey_hex,
-                        device_kind,
-                        Some(path),
-                        Some(&desired_advert_name),
-                    )
-                    .await
-                }
+    let port_guard = PORT_OPEN_LOCK.lock().await;
+    let (device_path, mut device, device_info) = if let Some(tcp_cfg) = &reticulum_tcp {
+        open_reticulum_tcp(tcp_cfg, data_dir, our_ed_pubkey_hex, our_x25519_pubkey_hex).await?
+    } else if let Some(path) = preferred_path {
+        match open_preferred_path(
+            path,
+            data_dir,
+            our_ed_pubkey_hex,
+            our_x25519_pubkey_hex,
+            device_kind,
+        )
+        .await
+        {
+            Ok((dev, info)) => (path.to_string(), dev, info),
+            Err(e) => {
+                warn!(
+                    "Preferred path {} probe failed: {} — trying auto-detect",
+                    path, e
+                );
+                auto_detect_and_open(
+                    data_dir,
+                    our_ed_pubkey_hex,
+                    our_x25519_pubkey_hex,
+                    device_kind,
+                    Some(path),
+                )
+                .await?
             }
-        } else {
-            auto_detect_and_open(
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                device_kind,
-                None,
-                Some(&desired_advert_name),
-            )
-            .await
-        };
-        drop(port_guard);
-        result
-    };
-    let (device_path, mut device, device_info) = tokio::select! {
-        res = open_fut => res?,
-        _ = shutdown.changed() => {
-            if *shutdown.borrow() {
-                info!("Shutdown requested during device open — ending session");
-                return Ok(());
-            }
-            anyhow::bail!("shutdown signal changed during device open");
         }
+    } else {
+        auto_detect_and_open(
+            data_dir,
+            our_ed_pubkey_hex,
+            our_x25519_pubkey_hex,
+            device_kind,
+            None,
+        )
+        .await?
     };
+    drop(port_guard);
 
     // Update status
     {
@@ -1209,14 +1176,19 @@ pub(super) async fn run_mesh_session(
         }
     }
 
-    // Set advert name to the configured mesh/server name (computed above).
-    // Skipped in keep-as-is mode for radio-held names — the radio keeps the
-    // name it came with (already reflected in status from the connect
-    // handshake). Reticulum is exempt from keep-as-is: its display name
-    // lives in OUR daemon (the RNode holds no name), so "keep as is" has
-    // nothing to preserve and an unnamed node would be anonymous on RNS.
-    if manage_radio || matches!(device, MeshRadioDevice::Reticulum(_)) {
-        if let Err(e) = device.set_advert_name(&desired_advert_name).await {
+    // Set advert name to the server's human-readable name (e.g. "ThinkPad"),
+    // falling back to the DID fragment if no name is configured. Skipped in
+    // keep-as-is mode — the radio keeps the name it came with (already
+    // reflected in status from the connect handshake).
+    if manage_radio {
+        let advert_name = if let Some(name) = server_name {
+            // Meshcore firmware limits advert names — truncate to 20 chars
+            name.chars().take(20).collect::<String>()
+        } else {
+            let short_did = our_did.chars().skip(8).take(8).collect::<String>();
+            format!("Archy-{}", short_did)
+        };
+        if let Err(e) = device.set_advert_name(&advert_name).await {
             warn!("Failed to set advert name: {}", e);
         } else {
             // Reflect the post-set name in MeshStatus too so the UI can filter
@@ -1224,7 +1196,7 @@ pub(super) async fn run_mesh_session(
             // still carries whatever pre-set name the firmware reported and the
             // self-filter never matches.
             let mut status = state.status.write().await;
-            status.self_advert_name = Some(desired_advert_name.clone());
+            status.self_advert_name = Some(advert_name.clone());
         }
     }
 
@@ -1517,15 +1489,6 @@ async fn handle_send_command(
             } else {
                 *consecutive_write_failures = 0;
             }
-            // The self-advert alone is a no-op for discovery on Meshtastic
-            // (heartbeat + time carry no identity) — the NodeInfo broadcast
-            // is what makes peers learn/refresh us. want_response=true so
-            // neighbours answer with their own NodeInfo: the user pressed
-            // Broadcast to be seen AND to see who's out there. No-op on
-            // Meshcore/Reticulum, whose self-advert already carries identity.
-            if let Err(e) = device.send_nodeinfo_advert(true).await {
-                warn!("Failed to send NodeInfo advert: {}", e);
-            }
         }
         MeshCommand::RebootRadio { seconds } => {
             if let Err(e) = device.reboot(seconds).await {

core/archipelago/src/mesh/mod.rs

@@ -8,7 +8,6 @@
 pub mod alerts;
 pub mod bitcoin_relay;
 pub mod crypto;
-pub mod flash;
 pub mod listener;
 pub mod meshtastic;
 pub mod message_types;
@@ -478,31 +477,6 @@ impl Default for MeshConfig {
     }
 }
 
-/// Whether a mesh config file has ever been written for this node — lets the
-/// boot path distinguish "operator explicitly disabled mesh" (file exists,
-/// enabled=false) from "never configured" (no file), which is the only case
-/// radio auto-enable should touch.
-pub fn config_file_exists(data_dir: &Path) -> bool {
-    data_dir.join(MESH_CONFIG_FILE).exists()
-}
-
-/// True when `new` differs from `old` in any field a running mesh session
-/// captured by value at spawn (device path/kind, advert name, region, PHY
-/// params, channel, manage_radio, TCP interface) — i.e. when applying `new`
-/// to a live service requires a listener restart. Fields the session reads
-/// live from shared state (broadcast flags, assistant settings, steganography
-/// mode, …) deliberately don't trigger a restart.
-fn session_config_changed(old: &MeshConfig, new: &MeshConfig) -> bool {
-    old.device_path != new.device_path
-        || old.device_kind != new.device_kind
-        || old.advert_name != new.advert_name
-        || old.lora_region != new.lora_region
-        || old.lora_radio_params != new.lora_radio_params
-        || old.channel_name != new.channel_name
-        || old.manage_radio != new.manage_radio
-        || old.reticulum_tcp != new.reticulum_tcp
-}
-
 pub async fn load_config(data_dir: &Path) -> Result<MeshConfig> {
     let path = data_dir.join(MESH_CONFIG_FILE);
     if !path.exists() {
@@ -768,18 +742,10 @@ impl MeshService {
         self.server_name = name;
     }
 
-    /// Start the background mesh listener. Idempotent: if the listener is
-    /// already running, this is a harmless no-op rather than an error —
-    /// confirmed live 2026-07-23, a real race between the flash job's own
-    /// post-flash restart and a concurrent user "Keep As Is" click (both
-    /// legitimately trying to ensure the listener is running) surfaced this
-    /// as a user-facing "Mesh listener already running" RPC error. Ensuring
-    /// the listener is running is the intent every caller actually has;
-    /// whichever caller's start() happens to win the race, the other
-    /// finding it already satisfied is success, not failure.
+    /// Start the background mesh listener.
     pub fn start(&mut self) -> Result<()> {
         if self.listener_handle.is_some() {
-            return Ok(());
+            anyhow::bail!("Mesh listener already running");
         }
 
         let (shutdown_tx, shutdown_rx) = watch::channel(false);
@@ -798,11 +764,7 @@ impl MeshService {
             self.our_ed_pubkey_hex.clone(),
             self.our_x25519_secret,
             self.our_x25519_pubkey_hex.clone(),
-            // The mesh-page "Name on the mesh" (config.advert_name) wins over
-            // the server name — it existed as write-only config with no reader
-            // until this line, which is why renaming on the Mesh page never
-            // changed anything on the air.
-            self.config.advert_name.clone().or_else(|| self.server_name.clone()),
+            self.server_name.clone(),
             self.config.lora_region.clone(),
             self.config.lora_radio_params,
             self.config.channel_name.clone(),
@@ -1093,12 +1055,13 @@ impl MeshService {
         self.state.peers.read().await.values().cloned().collect()
     }
 
-    /// Refuse to probe the port the live session currently occupies (the
-    /// probe would steal the serial port from under the session); a
+    /// Probe a serial port for a mesh radio without provisioning or keeping
+    /// it — powers the hot-swap "device detected" modal's current-details
+    /// view. Refuses to probe the port the live session currently occupies
+    /// (the probe would steal the serial port from under the session); a
     /// detected-but-not-connected port is fair game, accepting a benign race
-    /// with the reconnect loop (whichever loses just retries). Split out from
-    /// the actual probe on purpose — see `probe_device`'s doc comment.
-    pub async fn ensure_probe_allowed(&self, path: &str) -> Result<()> {
+    /// with the reconnect loop (whichever loses just retries).
+    pub async fn probe_device(&self, path: &str) -> Result<listener::DeviceProbe> {
         let status = self.state.status.read().await;
         if status.device_connected {
             if let Some(active) = status.device_path.as_deref() {
@@ -1113,7 +1076,8 @@ impl MeshService {
                 }
             }
         }
-        Ok(())
+        drop(status);
+        listener::probe_device(path).await
     }
 
     /// Get message history.
@@ -1160,32 +1124,7 @@ impl MeshService {
         let peer = peers
             .get(&contact_id)
             .ok_or_else(|| anyhow::anyhow!("Peer not found"))?;
-        // Cross-transport twin resolution: callers frequently hold the
-        // FEDERATION twin's contact_id (the UI's merged conversation row),
-        // whose pubkey_hex is the Archipelago ed25519 key — NOT a radio
-        // routing key. Sending a Reticulum resource with that prefix fails
-        // with "Unknown Reticulum prefix" (observed live 2026-07-28,
-        // image-over-LoRa to a merged contact). Route via the radio twin —
-        // same arch identity, radio-range id — whose pubkey_hex is the
-        // actual over-the-air routing key (RNS dest hash / firmware key).
-        let radio_peer = if peer.contact_id >= FEDERATION_CONTACT_ID_BASE {
-            peer.arch_pubkey_hex
-                .as_deref()
-                .and_then(|arch| {
-                    peers.values().find(|p| {
-                        p.contact_id < FEDERATION_CONTACT_ID_BASE
-                            && p.arch_pubkey_hex.as_deref() == Some(arch)
-                    })
-                })
-                .ok_or_else(|| {
-                    anyhow::anyhow!(
-                        "Peer is federation-only (no radio twin) — not reachable over the radio"
-                    )
-                })?
-        } else {
-            peer
-        };
-        let pubkey_hex = radio_peer
+        let pubkey_hex = peer
             .pubkey_hex
             .as_ref()
             .ok_or_else(|| anyhow::anyhow!("Peer has no public key"))?;
@@ -1323,44 +1262,12 @@ impl MeshService {
                 .map(|p| !p.reachable && p.arch_pubkey_hex.is_some())
                 .unwrap_or(false)
         };
-        // Transport policy: LoRa first when it can actually carry the message,
-        // then FIPS, then Tor. A federation-synthetic id (what the UI's merged
-        // conversation holds) used to ALWAYS take the federation path, even
-        // when the very same node was sitting one LoRa hop away — so chats
-        // between two radio-equipped nodes silently rode FIPS/Tor. If the
-        // federation contact has a REACHABLE radio twin (same archipelago
-        // identity, radio-range id) and the payload fits the radio, skip the
-        // federation branch: the fall-through LoRa path twin-resolves the
-        // routing key via peer_dest_prefix.
-        let device_connected = self.state.status.read().await.device_connected;
-        let radio_twin_reachable = is_federation_synthetic && !exceeds_lora && device_connected && {
-            let peers = self.state.peers.read().await;
-            peers
-                .get(&contact_id)
-                .and_then(|p| p.arch_pubkey_hex.clone())
-                .map(|arch| {
-                    peers.values().any(|p| {
-                        p.contact_id < FEDERATION_CONTACT_ID_BASE
-                            && p.reachable
-                            && p.arch_pubkey_hex.as_deref() == Some(arch.as_str())
-                    })
-                })
-                .unwrap_or(false)
-        };
         let mesh_only_mode = load_config(&self.data_dir)
             .await
             .ok()
             .and_then(|cfg| cfg.mesh_only_mode)
             .unwrap_or(false);
-        if radio_twin_reachable && !mesh_only_mode {
-            tracing::info!(
-                contact_id,
-                bytes = wire.len(),
-                "Radio-first routing: federation contact has a reachable radio twin — sending over LoRa"
-            );
-        }
         if !mesh_only_mode
-            && !radio_twin_reachable
             && (is_federation_synthetic || exceeds_lora || radio_federated_unreachable)
         {
             // Resolve the peer's pubkey/did. Prefer the live mesh peer table,
@@ -2184,7 +2091,6 @@ impl MeshService {
         save_config(&self.data_dir, &config).await?;
 
         let was_enabled = self.config.enabled;
-        let needs_session_restart = session_config_changed(&self.config, &config);
         self.config = config.clone();
 
         // Update the status to reflect new config
@@ -2209,31 +2115,11 @@ impl MeshService {
             status.firmware_version = None;
             status.self_node_id = None;
             status.peer_count = 0;
-        } else if config.enabled && was_enabled && needs_session_restart {
-            info!("Mesh session config changed — restarting listener to apply");
-            self.stop().await;
-            self.start()?;
         }
 
         Ok(())
     }
 
-    /// The service's current (last-applied) config.
-    pub fn config(&self) -> &MeshConfig {
-        &self.config
-    }
-
-    /// Restart the listener (if running) so it picks up out-of-band state a
-    /// spawn captured by value — currently the server name pushed by
-    /// `server.set-name`.
-    pub async fn restart_listener_if_running(&mut self) -> Result<()> {
-        if self.listener_handle.is_some() {
-            self.stop().await;
-            self.start()?;
-        }
-        Ok(())
-    }
-
     /// Get a reference to shared state (for RPC handlers).
     pub fn shared_state(&self) -> Arc<MeshState> {
         Arc::clone(&self.state)
@@ -2355,46 +2241,6 @@ async fn bitcoin_rpc_getblockheader_by_height(
 mod tests {
     use super::*;
 
-    #[test]
-    fn session_config_change_detection() {
-        let base = MeshConfig::default();
-
-        // Same config → no restart.
-        assert!(!session_config_changed(&base, &base.clone()));
-
-        // Every session-captured field individually triggers a restart.
-        let mut c = base.clone();
-        c.device_kind = Some(types::DeviceType::Reticulum);
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.device_path = Some("/dev/ttyUSB0".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.advert_name = Some("RNode Shaza".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.manage_radio = !base.manage_radio;
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.lora_region = Some("EU_868".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.channel_name = Some("private-net".into());
-        assert!(session_config_changed(&base, &c));
-
-        // Live-read fields must NOT force a session restart.
-        let mut c = base.clone();
-        c.broadcast_identity = !base.broadcast_identity;
-        c.announce_block_headers = !base.announce_block_headers;
-        c.assistant_enabled = !base.assistant_enabled;
-        assert!(!session_config_changed(&base, &c));
-    }
-
     fn mk_peer(contact_id: u32, name: &str, arch: Option<&str>, reachable: bool) -> MeshPeer {
         MeshPeer {
             contact_id,

core/archipelago/src/mesh/reticulum.rs

@@ -121,7 +121,6 @@ fn daemon_command(
     identity_key: &Path,
     archy_ed_pubkey_hex: Option<&str>,
     archy_x25519_pubkey_hex: Option<&str>,
-    display_name: Option<&str>,
 ) -> Command {
     let bin = std::env::var("ARCHY_RETICULUM_DAEMON_BIN")
         .unwrap_or_else(|_| "/usr/local/bin/archy-reticulum-daemon".to_string());
@@ -160,15 +159,6 @@ fn daemon_command(
             .arg("--archy-x25519-pubkey-hex")
             .arg(x);
     }
-    // The RNS-visible display name (what Sideband/NomadNet/other archy nodes
-    // show for us). Without this the daemon falls back to its argparse
-    // default and every archy node announces the same anonymous name.
-    if let Some(name) = display_name {
-        let name = name.trim();
-        if !name.is_empty() {
-            cmd.arg("--display-name").arg(name);
-        }
-    }
     // Run the daemon as its own process-group leader. The packaged binary is
     // a PyInstaller one-file bootloader that forks the real Python process;
     // making it a group leader lets shutdown signal the WHOLE group so the
@@ -217,10 +207,6 @@ struct ReticulumPeer {
     /// `bind_federation_twins`, which those two transports rely on instead).
     arch_pubkey_hex: Option<String>,
     reachable: bool,
-    /// Unix time of the last announce heard from this peer over the air.
-    /// In-memory only (a persisted value would be stale by definition) —
-    /// `0` after a restart until the peer re-announces.
-    last_advert_at: u64,
 }
 
 /// On-disk shape of `ReticulumPeer` — `[u8; 16]` can't be a JSON object key,
@@ -259,11 +245,6 @@ pub struct ReticulumLink {
     /// matching `resource_progress`/`resource_sent`/`resource_failed` events
     /// back to a log line; sends are fire-and-forget (see `send_resource`).
     resource_id_counter: u64,
-    /// Set when the daemon's RPC socket closes or its process exits. Once
-    /// true, `try_recv_frame` returns an error so the session loop tears
-    /// down and the outer reconnect loop respawns the daemon — without this
-    /// a dead daemon was invisible until the 30-minute RX-stall watchdog.
-    daemon_gone: bool,
 }
 
 impl ReticulumLink {
@@ -288,7 +269,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         probe_rnode(path)
             .await
@@ -298,7 +278,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -311,7 +290,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         let host = bind.rsplit_once(':').map(|(h, _)| h).unwrap_or(bind);
         anyhow::ensure!(
@@ -324,7 +302,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -336,7 +313,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         anyhow::ensure!(
             !targets.is_empty(),
@@ -347,7 +323,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -357,7 +332,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         // Keep the RPC socket under the archipelago-owned data dir (not the
         // shared system temp dir) so its access is bounded by the same
@@ -405,7 +379,6 @@ impl ReticulumLink {
             &identity_key,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         );
         cmd.env("TMPDIR", &tmp_dir);
         let child = cmd
@@ -477,7 +450,6 @@ impl ReticulumLink {
             peers_file: runtime_dir.join("peers.json"),
             inbound: std::collections::VecDeque::new(),
             resource_id_counter: 0,
-            daemon_gone: false,
         };
         link.load_persisted_peers();
         Ok(link)
@@ -500,25 +472,15 @@ impl ReticulumLink {
             };
             let prefix: [u8; 6] = hash[..6].try_into().unwrap();
             self.prefix_to_hash.insert(prefix, hash);
-            // Heal names persisted by pre-2026-07-28 builds, which could
-            // store a raw `ARCHY:…` identity blob as the display name (seen
-            // live on archi-dev-box). Blob-only announces assert no name, so
-            // nothing would ever overwrite it — swap in the placeholder.
-            let display_name = if p.display_name.starts_with("ARCHY:") {
-                format!("Reticulum {}", hex::encode(&hash[..4]))
-            } else {
-                p.display_name
-            };
             self.peers.insert(
                 hash,
                 ReticulumPeer {
                     dest_hash: hash,
-                    display_name,
+                    display_name: p.display_name,
                     arch_pubkey_hex: p.arch_pubkey_hex,
                     // Reachability is a live property, not a persisted fact —
                     // start conservative and let the first real event refresh it.
                     reachable: false,
-                    last_advert_at: 0,
                 },
             );
         }
@@ -571,12 +533,10 @@ impl ReticulumLink {
     }
 
     pub async fn set_advert_name(&mut self, name: &str) -> Result<()> {
-        // Live rename: the daemon's `set_name` verb updates the LXMF delivery
-        // destination's display_name and re-announces, so peers pick the new
-        // name up on their next announce receipt. Also tracked locally so
-        // `advert_name()` reflects it immediately.
-        self.send_rpc(serde_json::json!({"cmd": "set_name", "name": name}))
-            .await?;
+        // The daemon's display_name is fixed at spawn time (CLI arg); changing
+        // it live would require an RPC verb we haven't added. Track locally so
+        // `advert_name()` reflects the caller's intent even though the
+        // RNS-visible name doesn't change until the daemon restarts.
         self.display_name = Some(name.to_string());
         Ok(())
     }
@@ -725,7 +685,7 @@ impl ReticulumLink {
             .map(|p| ParsedContact {
                 public_key_hex: hex::encode(p.dest_hash),
                 advert_name: p.display_name.clone(),
-                last_advert: p.last_advert_at as u32,
+                last_advert: 0,
                 // Deliberately not 1 ("friend"/meshcore type), so the
                 // meshcore-only auto-heal `reset_contact_path` loop in
                 // `refresh_contacts` (session.rs) skips these — RNS does its
@@ -758,12 +718,6 @@ impl ReticulumLink {
 
     pub async fn try_recv_frame(&mut self) -> Result<Option<InboundFrame>> {
         self.drain_events().await;
-        if self.daemon_gone {
-            // Surface the dead daemon as a hard error so run_mesh_session
-            // bails and the outer reconnect loop respawns it, instead of
-            // idling on an empty queue until the RX-stall watchdog fires.
-            anyhow::bail!("reticulum-daemon is gone (process exited or RPC socket closed)");
-        }
         Ok(self.inbound.pop_front())
     }
 
@@ -789,15 +743,6 @@ impl ReticulumLink {
     /// Drain any buffered daemon events (non-blocking) and translate them into
     /// peer-table updates / synthetic InboundFrames.
     async fn drain_events(&mut self) {
-        // A daemon that died without closing the socket cleanly (SIGKILL,
-        // OOM) leaves the socket readable-with-EOF or just silent — poll the
-        // child's exit status too so death is never mistaken for quiet.
-        if !self.daemon_gone {
-            if let Ok(Some(status)) = self.child.try_wait() {
-                warn!(%status, "reticulum-daemon process exited");
-                self.daemon_gone = true;
-            }
-        }
         loop {
             let mut line = String::new();
             let read =
@@ -805,16 +750,10 @@ impl ReticulumLink {
                     .await;
             let n = match read {
                 Ok(Ok(n)) => n,
-                Ok(Err(e)) => {
-                    warn!("Reticulum daemon RPC read failed: {}", e);
-                    self.daemon_gone = true;
-                    break;
-                }
-                Err(_) => break, // timeout — no data buffered
+                _ => break, // timeout (no data) or read error — stop draining
             };
             if n == 0 {
                 warn!("Reticulum daemon RPC connection closed");
-                self.daemon_gone = true;
                 break;
             }
             let Ok(ev) = serde_json::from_str::<Value>(line.trim()) else {
@@ -836,23 +775,6 @@ impl ReticulumLink {
                 };
                 let prefix: [u8; 6] = hash[..6].try_into().unwrap();
                 self.prefix_to_hash.insert(prefix, hash);
-                // Current daemons decode the LXMF announce app_data themselves
-                // and hand us clean fields: `display_name` (LXMF-standard
-                // msgpack name, Sideband-interoperable) and `archy_blob` (the
-                // `ARCHY:n:` identity string, carried as an extra msgpack list
-                // element stock clients ignore). The raw `app_data` text path
-                // below remains for announces from pre-upgrade archy nodes,
-                // whose app_data was EITHER the blob OR a bare-utf8 name.
-                let explicit_name = ev
-                    .get("display_name")
-                    .and_then(Value::as_str)
-                    .map(|s| s.trim().to_string())
-                    .filter(|s| !s.is_empty());
-                let explicit_blob = ev
-                    .get("archy_blob")
-                    .and_then(Value::as_str)
-                    .map(str::to_string)
-                    .filter(|s| !s.is_empty());
                 let app_data_text = ev
                     .get("app_data")
                     .and_then(Value::as_str)
@@ -872,17 +794,12 @@ impl ReticulumLink {
                 // now carry the same `arch_pubkey_hex`, instead of relying on
                 // `bind_federation_twins`'s advert_name matching, which never
                 // matches here — see `display_name` below.
-                let legacy_identity = app_data_text
+                let parsed_identity = app_data_text
                     .as_deref()
                     .and_then(protocol::parse_identity_broadcast);
-                let is_legacy_blob = legacy_identity.is_some();
-                let identity_blob_text = explicit_blob.or_else(|| {
-                    app_data_text.clone().filter(|_| is_legacy_blob)
-                });
-                let parsed_identity = identity_blob_text
-                    .as_deref()
-                    .and_then(protocol::parse_identity_broadcast);
-                if let Some(text) = identity_blob_text.as_deref().filter(|_| parsed_identity.is_some()) {
+                let is_identity_blob = parsed_identity.is_some();
+                if is_identity_blob {
+                    let text = app_data_text.clone().unwrap();
                     let mut data = Vec::with_capacity(7 + text.len());
                     data.push(0); // channel index — unused by the identity path
                     data.extend_from_slice(&prefix);
@@ -895,31 +812,23 @@ impl ReticulumLink {
                 }
                 let arch_pubkey_hex = parsed_identity.map(|(_did, ed_pubkey, _x25519)| ed_pubkey);
 
-                let announced_name =
-                    pick_announced_name(explicit_name, app_data_text, is_legacy_blob);
-                let now = std::time::SystemTime::now()
-                    .duration_since(std::time::UNIX_EPOCH)
-                    .unwrap_or_default()
-                    .as_secs();
+                let display_name = app_data_text
+                    .filter(|_| !is_identity_blob)
+                    .unwrap_or_else(|| format!("Reticulum {}", hex::encode(&hash[..4])));
                 self.peers
                     .entry(hash)
                     .and_modify(|p| {
-                        if let Some(name) = announced_name.clone() {
-                            p.display_name = name;
-                        }
+                        p.display_name = display_name.clone();
                         p.reachable = true;
-                        p.last_advert_at = now;
                         if arch_pubkey_hex.is_some() {
                             p.arch_pubkey_hex = arch_pubkey_hex.clone();
                         }
                     })
-                    .or_insert_with(|| ReticulumPeer {
+                    .or_insert(ReticulumPeer {
                         dest_hash: hash,
-                        display_name: announced_name
-                            .unwrap_or_else(|| format!("Reticulum {}", hex::encode(&hash[..4]))),
+                        display_name,
                         arch_pubkey_hex,
                         reachable: true,
-                        last_advert_at: now,
                     });
                 self.persist_peers();
             }
@@ -935,24 +844,16 @@ impl ReticulumLink {
                 // A peer that messages us without ever announcing still needs
                 // to survive a restart — give it a placeholder name (the real
                 // one, if any, arrives via a later "announce" and overwrites
-                // this) so its routing entry alone doesn't get lost. An
-                // existing entry is proof of life too: mark it reachable so a
-                // restart-restored (reachable=false) peer that DMs us doesn't
-                // stay red-dotted until its next announce.
-                match self.peers.entry(source_hash) {
-                    std::collections::hash_map::Entry::Vacant(e) => {
-                        e.insert(ReticulumPeer {
-                            dest_hash: source_hash,
-                            display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
-                            arch_pubkey_hex: None,
-                            reachable: true,
-                            last_advert_at: 0,
-                        });
-                        self.persist_peers();
-                    }
-                    std::collections::hash_map::Entry::Occupied(mut e) => {
-                        e.get_mut().reachable = true;
-                    }
+                // this) so its routing entry alone doesn't get lost.
+                if let std::collections::hash_map::Entry::Vacant(e) = self.peers.entry(source_hash)
+                {
+                    e.insert(ReticulumPeer {
+                        dest_hash: source_hash,
+                        display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
+                        arch_pubkey_hex: None,
+                        reachable: true,
+                    });
+                    self.persist_peers();
                 }
 
                 // A stock LXMF client (Sideband/NomadNet — not an archy peer)
@@ -1031,20 +932,15 @@ impl ReticulumLink {
                 };
                 let prefix: [u8; 6] = source_hash[..6].try_into().unwrap();
                 self.prefix_to_hash.insert(prefix, source_hash);
-                match self.peers.entry(source_hash) {
-                    std::collections::hash_map::Entry::Vacant(e) => {
-                        e.insert(ReticulumPeer {
-                            dest_hash: source_hash,
-                            display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
-                            arch_pubkey_hex: None,
-                            reachable: true,
-                            last_advert_at: 0,
-                        });
-                        self.persist_peers();
-                    }
-                    std::collections::hash_map::Entry::Occupied(mut e) => {
-                        e.get_mut().reachable = true;
-                    }
+                if let std::collections::hash_map::Entry::Vacant(e) = self.peers.entry(source_hash)
+                {
+                    e.insert(ReticulumPeer {
+                        dest_hash: source_hash,
+                        display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
+                        arch_pubkey_hex: None,
+                        reachable: true,
+                    });
+                    self.persist_peers();
                 }
                 use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
                 let Some(data) = ev
@@ -1193,10 +1089,8 @@ pub(crate) async fn probe_rnode(path: &str) -> Result<()> {
     // ESP32-S3 native-USB boards (Heltec V3/V4 etc. — no separate USB-UART
     // bridge chip) treat a DTR/RTS transition on open as a reset signal, the
     // same mechanism esptool uses to force bootloader entry. Deassert both
-    // before writing the probe. Boards behind a USB-UART bridge (CP2102 on
-    // the Heltec V3) get the reset pulse from the open() itself, before we
-    // can deassert anything — that case is handled by the boot-settle retry
-    // below.
+    // and let the board settle before writing the probe, or the reboot eats
+    // the DETECT_RESP window below.
     let _ = port.set_dtr(false);
     let _ = port.set_rts(false);
     tokio::time::sleep(Duration::from_millis(300)).await;
@@ -1215,81 +1109,26 @@ pub(crate) async fn probe_rnode(path: &str) -> Result<()> {
         0x00,
         KISS_FEND,
     ];
-    // Attempt 1: probe immediately. A board that did NOT reset on open (it
-    // was already up — e.g. a re-probe of a running RNode) answers in well
-    // under a second, so the fast path stays fast.
     tokio::time::timeout(Duration::from_millis(500), port.write_all(&probe))
         .await
         .context("RNode probe write timed out")?
         .context("RNode probe write failed")?;
+
     let mut buf = [0u8; 256];
     let mut seen = Vec::new();
-    if await_detect_resp(&port, &mut buf, &mut seen, PROBE_READ_TIMEOUT).await {
-        return Ok(());
-    }
-
-    // No DETECT_RESP. If the open() power-cycled the board (verified live on
-    // a Heltec V3 RNode behind a CP2102: the ESP32 spends ~2.5-3s in boot
-    // ROM + app init and silently eats anything written meanwhile, so the
-    // first probe lands in the void), wait for its boot chatter to go quiet
-    // and probe once more with a fresh response window.
-    const BOOT_QUIET_WINDOW: Duration = Duration::from_millis(800);
-    const BOOT_SETTLE_MAX: Duration = Duration::from_secs(6);
-    let settle_deadline = tokio::time::Instant::now() + BOOT_SETTLE_MAX;
-    let mut last_data = tokio::time::Instant::now();
-    while tokio::time::Instant::now() < settle_deadline {
+    let deadline = tokio::time::Instant::now() + PROBE_READ_TIMEOUT;
+    while tokio::time::Instant::now() < deadline {
         match tokio::time::timeout(Duration::from_millis(150), port.read(&mut buf)).await {
             Ok(Ok(n)) if n > 0 => {
                 seen.extend_from_slice(&buf[..n]);
-                // A late DETECT_RESP to the first write still counts.
                 if contains_detect_resp(&seen) {
                     return Ok(());
                 }
-                last_data = tokio::time::Instant::now();
-            }
-            _ => {
-                if last_data.elapsed() >= BOOT_QUIET_WINDOW {
-                    break;
-                }
-            }
-        }
-    }
-
-    tokio::time::timeout(Duration::from_millis(500), port.write_all(&probe))
-        .await
-        .context("RNode probe rewrite timed out")?
-        .context("RNode probe rewrite failed")?;
-    seen.clear();
-    if await_detect_resp(&port, &mut buf, &mut seen, PROBE_READ_TIMEOUT).await {
-        return Ok(());
-    }
-    anyhow::bail!(
-        "No RNode DETECT_RESP within {:?} (incl. post-boot-settle retry)",
-        PROBE_READ_TIMEOUT
-    )
-}
-
-/// Read from `port` for up to `window`, accumulating into `seen`; true once
-/// the KISS DETECT_RESP sequence shows up anywhere in the stream.
-async fn await_detect_resp(
-    port: &serial2_tokio::SerialPort,
-    buf: &mut [u8],
-    seen: &mut Vec<u8>,
-    window: Duration,
-) -> bool {
-    let deadline = tokio::time::Instant::now() + window;
-    while tokio::time::Instant::now() < deadline {
-        match tokio::time::timeout(Duration::from_millis(150), port.read(buf)).await {
-            Ok(Ok(n)) if n > 0 => {
-                seen.extend_from_slice(&buf[..n]);
-                if contains_detect_resp(seen) {
-                    return true;
-                }
             }
             _ => continue,
         }
     }
-    false
+    anyhow::bail!("No RNode DETECT_RESP within {:?}", PROBE_READ_TIMEOUT)
 }
 
 /// Look for the `[FEND, CMD_DETECT, DETECT_RESP]` sequence anywhere in the
@@ -1299,33 +1138,6 @@ fn contains_detect_resp(buf: &[u8]) -> bool {
         .any(|w| w == [KISS_FEND, KISS_CMD_DETECT, KISS_DETECT_RESP])
 }
 
-/// The display name an announce actually asserted, if any.
-///
-/// Precedence: the daemon-decoded LXMF display name (`display_name` event
-/// field), then — legacy peers only — bare-utf8 app_data that wasn't an
-/// identity blob. The bare-utf8 fallback must actually look like text:
-/// lossy-decoded msgpack (a new-format announce whose name the daemon failed
-/// to decode) is full of U+FFFD/control chars and would otherwise become a
-/// mojibake display name. `None` (e.g. a blob-only legacy announce) means
-/// "no name asserted" and must NOT stomp a previously-learned name.
-fn pick_announced_name(
-    explicit_name: Option<String>,
-    app_data_text: Option<String>,
-    is_legacy_blob: bool,
-) -> Option<String> {
-    explicit_name
-        // A legacy blob-only announce utf8-decodes cleanly, so LXMF's
-        // display_name_from_app_data hands the daemon the ENTIRE `ARCHY:…`
-        // string as a "name" — seen live from a pre-upgrade Framework PT.
-        // An identity blob is never a display name.
-        .filter(|s| !s.starts_with("ARCHY:"))
-        .or_else(|| {
-            app_data_text
-                .filter(|_| !is_legacy_blob)
-                .filter(|s| !s.chars().any(|c| c.is_control() || c == '\u{FFFD}'))
-        })
-}
-
 impl Drop for ReticulumLink {
     fn drop(&mut self) {
         // Group-wide SIGTERM with a delayed SIGKILL backstop (`terminate_group`).
@@ -1342,37 +1154,6 @@ impl Drop for ReticulumLink {
 mod tests {
     use super::*;
 
-    #[test]
-    fn announced_name_precedence() {
-        // Daemon-decoded LXMF name always wins.
-        assert_eq!(
-            pick_announced_name(
-                Some("RNode Shaza".into()),
-                Some("ARCHY:2:aa:bb".into()),
-                true
-            ),
-            Some("RNode Shaza".to_string())
-        );
-        // Legacy bare-utf8 name (old daemon, no explicit field).
-        assert_eq!(
-            pick_announced_name(None, Some("zaza".into()), false),
-            Some("zaza".to_string())
-        );
-        // Legacy blob-only announce asserts NO name (must not stomp).
-        assert_eq!(
-            pick_announced_name(None, Some("ARCHY:2:aa:bb".into()), true),
-            None
-        );
-        // Lossy-decoded msgpack must not become a mojibake name.
-        assert_eq!(
-            pick_announced_name(None, Some("\u{FFFD}\u{FFFD}Shaza\u{FFFD}".into()), false),
-            None
-        );
-        assert_eq!(pick_announced_name(None, Some("has\u{1}ctl".into()), false), None);
-        // Nothing at all.
-        assert_eq!(pick_announced_name(None, None, false), None);
-    }
-
     #[test]
     fn detect_resp_found_in_kiss_stream() {
         let stream = [

core/archipelago/src/mesh/serial.rs

@@ -557,39 +557,29 @@ fn likely_non_mesh_serial_device(path: &str) -> bool {
 /// Scan for serial devices that could be Meshcore radios.
 /// Returns paths to existing serial device files.
 ///
-/// Dedupes by canonical (symlink-resolved) target: `/dev/mesh-radio` is a
-/// stable udev symlink to whatever `/dev/ttyUSB*`/`/dev/ttyACM*` node the
-/// primary radio currently enumerates as, so both names always pointed at
-/// the same candidate list entry and both passed this scan — confirmed live
-/// 2026-07-23, this made an already-connected, working radio (connected via
-/// its `/dev/mesh-radio` alias) simultaneously appear as a second, separate
-/// "detected but unclaimed" device under its raw `/dev/ttyUSBn` name. The
-/// hot-swap UI's active-session guard compares path strings, so it didn't
-/// recognize the two aliases as the same port, showed the "device detected"
-/// modal for a radio that was already set up, and probing it there opened
-/// (and DTR/RTS-reset) the exact port the live session was mid-conversation
-/// with — a continuous, UI-driven reset loop that only ran while that view
-/// was open (matches the reported "stops when I leave, resumes when I come
-/// back"). SERIAL_CANDIDATES lists `/dev/mesh-radio` first, so it wins the
-/// dedup and is what's reported when both alias and target are present.
-/// (Independently re-discovered and fixed on main 2026-07-26 — both sides
-/// of the 2026-07-28 merge carried an equivalent implementation.)
+/// Candidates are deduplicated by canonical path: /dev/mesh-radio is a udev
+/// symlink to a ttyUSB*/ttyACM* node that is ALSO in the candidate list, so
+/// without this one physical board shows up (and gets probed, and gets its
+/// DTR/RTS reset toggled) twice per cycle. The first candidate wins, which
+/// keeps the stable /dev/mesh-radio name when the symlink exists.
 pub async fn detect_serial_devices() -> Vec<String> {
     let mut devices = Vec::new();
-    let mut seen_real_paths = std::collections::HashSet::new();
+    let mut seen_canonical: Vec<std::path::PathBuf> = Vec::new();
     for path in SERIAL_CANDIDATES {
         if tokio::fs::metadata(path).await.is_ok() {
             if likely_non_mesh_serial_device(path) {
                 debug!(path = %path, "Skipping known non-mesh serial device");
                 continue;
             }
-            let real_path = tokio::fs::canonicalize(path)
+            let canonical = tokio::fs::canonicalize(path)
                 .await
                 .unwrap_or_else(|_| std::path::PathBuf::from(path));
-            if !seen_real_paths.insert(real_path.clone()) {
-                debug!(path = %path, real_path = %real_path.display(), "Skipping duplicate alias for an already-listed device");
+            if seen_canonical.contains(&canonical) {
+                debug!(path = %path, canonical = %canonical.display(),
+                    "Skipping alias of an already-detected serial device");
                 continue;
             }
+            seen_canonical.push(canonical);
             devices.push(path.to_string());
         }
     }
@@ -620,23 +610,12 @@ pub async fn detect_serial_devices_info() -> Vec<DetectedDeviceInfo> {
     let mut out = Vec::new();
     for path in detect_serial_devices().await {
         let usb = usb_info_for_tty(&path).await;
-        // Birth time (btime), falling back to inode-change time (ctime) —
-        // NOT mtime: a tty node's mtime bumps on every open()/write, so with
-        // mtime here each probe/session open minted a "new" plugged_at, the
-        // UI's (path, plugged_at) dismissal key never matched again, and the
-        // setup modal re-fired forever on a device that never left the port
-        // (observed live on archi-dev-box 2026-07-28). btime/ctime only
-        // change when udev (re)creates/chowns the node — i.e. on real plugs.
-        let plugged_at = tokio::fs::metadata(&path).await.ok().and_then(|m| {
-            m.created()
-                .ok()
-                .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
-                .map(|d| d.as_secs())
-                .or_else(|| {
-                    use std::os::unix::fs::MetadataExt;
-                    u64::try_from(m.ctime()).ok()
-                })
-        });
+        let plugged_at = tokio::fs::metadata(&path)
+            .await
+            .ok()
+            .and_then(|m| m.modified().ok())
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+            .map(|d| d.as_secs());
         out.push(DetectedDeviceInfo {
             path,
             vid: usb.0,

core/archipelago/src/network/dwn_sync.rs

@@ -134,7 +134,6 @@ pub async fn sync_with_peers(data_dir: &Path, peer_onions: &[String]) -> Result<
         for onion in &unique_onions {
             let fips_npub = crate::federation::fips_npub_for_onion(data_dir, onion).await;
             match sync_single_peer(
-                data_dir,
                 fips_npub.as_deref(),
                 &store,
                 onion,
@@ -174,7 +173,6 @@ pub async fn sync_with_peers(data_dir: &Path, peer_onions: &[String]) -> Result<
 /// Sync with a single peer: pull their messages and push ours.
 /// Each HTTP call picks FIPS when a npub is known, otherwise Tor.
 async fn sync_single_peer(
-    data_dir: &Path,
     fips_npub: Option<&str>,
     store: &crate::network::dwn_store::DwnStore,
     onion: &str,
@@ -189,7 +187,6 @@ async fn sync_single_peer(
         .service(crate::settings::transport::PeerService::Federation)
         .timeout(std::time::Duration::from_secs(30))
         .fips_timeout(std::time::Duration::from_secs(6))
-        .record_transport(data_dir)
         .send_get()
         .await
         .context("Peer DWN unreachable")?;
@@ -216,7 +213,6 @@ async fn sync_single_peer(
         .service(crate::settings::transport::PeerService::Federation)
         .timeout(std::time::Duration::from_secs(30))
         .fips_timeout(std::time::Duration::from_secs(6))
-        .record_transport(data_dir)
         .send_json(&pull_body)
         .await
         .context("Failed to query peer DWN")?;
@@ -276,7 +272,6 @@ async fn sync_single_peer(
             .service(crate::settings::transport::PeerService::Federation)
             .timeout(std::time::Duration::from_secs(30))
             .fips_timeout(std::time::Duration::from_secs(6))
-            .record_transport(data_dir)
             .send_json(&push_body)
             .await
         {

core/archipelago/src/network/router.rs

@@ -366,6 +366,17 @@ pub async fn save_router_config(data_dir: &Path, config: &RouterConfig) -> Resul
         .context("Writing router config")
 }
 
+/// Remove the saved router config (credentials + address) so the app forgets
+/// this router entirely and the next call requires a fresh login.
+pub async fn forget_router_config(data_dir: &Path) -> Result<()> {
+    let path = data_dir.join(ROUTER_CONFIG_FILE);
+    match fs::remove_file(&path).await {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e).context("Removing router config"),
+    }
+}
+
 /// Validate that an IP string is a private/LAN address (not public, not localhost).
 fn is_valid_private_ip(ip_str: &str) -> bool {
     let ip: std::net::IpAddr = match ip_str.parse() {

core/archipelago/src/node_message.rs

@@ -342,9 +342,6 @@ pub async fn send_to_peer(
     signing_key: Option<&ed25519_dalek::SigningKey>,
     recipient_pubkey: Option<&str>,
     from_name: Option<&str>,
-    // Federation data dir for last-transport recording; None skips recording
-    // (callers without a data dir in scope).
-    record_data_dir: Option<&std::path::Path>,
 ) -> Result<()> {
     validate_onion(onion)?;
 
@@ -373,15 +370,11 @@ pub async fn send_to_peer(
         body["from_name"] = serde_json::Value::String(name.to_string());
     }
 
-    let mut req =
+    let (resp, transport) =
         crate::fips::dial::PeerRequest::new(fips_npub, onion, "/archipelago/node-message")
             .service(crate::settings::transport::PeerService::Messaging)
             .timeout(std::time::Duration::from_secs(60))
-            .fips_timeout(std::time::Duration::from_secs(8));
-    if let Some(dir) = record_data_dir {
-        req = req.record_transport(dir);
-    }
-    let (resp, transport) = req
+            .fips_timeout(std::time::Duration::from_secs(8))
             .send_json(&body)
             .await
             .map_err(|e| {

core/archipelago/src/server.rs

@@ -294,13 +294,8 @@ impl Server {
                         .await
                         .unwrap_or_default();
 
-                    // Auto-enable mesh if a radio is detected and no config exists
-                    // yet. Only on a genuinely missing config: an existing file
-                    // with enabled=false is an explicit operator decision (e.g.
-                    // via mesh.configure) and force-re-enabling it on every boot
-                    // made "disable mesh" impossible on any node with a radio
-                    // plugged in.
-                    if !mesh_config.enabled && !crate::mesh::config_file_exists(&data_dir) {
+                    // Auto-enable mesh if a radio is detected and no config exists yet
+                    if !mesh_config.enabled {
                         let devices = crate::mesh::detect_devices().await;
                         if !devices.is_empty() {
                             info!("📡 Auto-detected mesh radio: {:?} — enabling mesh", devices);
@@ -1222,36 +1217,18 @@ async fn peer_late_bind_loop(
                     }
                 };
                 info!("FIPS peer listener bound {}", addr);
-                // Serve until shutdown, a persistent accept failure, or a
-                // fips0 ULA change. The listener must be REBINDABLE: a
-                // daemon re-key tears fips0 down and brings it back with a
-                // (possibly different) ULA, and the old one-shot bind left
-                // the node inbound-dead over FIPS until process restart.
-                tokio::select! {
-                    _ = accept_loop(
-                        handler.clone(),
-                        listener,
-                        active_connections.clone(),
-                        true, // peer listener: apply path filter
-                        shutdown_rx.clone(),
-                        addr,
-                    ) => {
-                        if *shutdown_rx.borrow() { return; }
-                        warn!("FIPS peer accept loop ended — rebinding");
-                    }
-                    _ = async {
-                        loop {
-                            tokio::time::sleep(std::time::Duration::from_secs(30)).await;
-                            if crate::fips::iface::fips0_ula() != Some(ip) {
-                                break;
-                            }
-                        }
-                    } => {
-                        info!("fips0 ULA changed — rebinding FIPS peer listener");
-                        // Dropping the select arm cancels accept_loop and
-                        // frees the socket; the outer loop rebinds fresh.
-                    }
-                }
+                // Once bound, serve until shutdown fires. accept_loop
+                // returns on shutdown, which also ends this outer loop.
+                accept_loop(
+                    handler,
+                    listener,
+                    active_connections,
+                    true, // peer listener: apply path filter
+                    shutdown_rx,
+                    addr,
+                )
+                .await;
+                return;
             }
             _ = shutdown_rx.changed() => {
                 if *shutdown_rx.borrow() { return; }
@@ -1303,70 +1280,22 @@ async fn accept_loop(
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
     local_addr: SocketAddr,
 ) {
-    // Consecutive accept-error tracking: a fips0 teardown/re-key leaves the
-    // peer listener's socket permanently broken — `continue`-ing forever
-    // made the node inbound-dead over FIPS until process restart. After a
-    // burst of consecutive errors the peer accept loop returns so its
-    // caller (peer_late_bind_loop) can rebind on the current ULA.
-    let mut consecutive_errors: u32 = 0;
     loop {
         tokio::select! {
             result = listener.accept() => {
                 let (stream, peer_addr) = match result {
-                    Ok(c) => { consecutive_errors = 0; c }
+                    Ok(c) => c,
                     Err(e) => {
                         error!("{} accept error: {}", local_addr, e);
-                        consecutive_errors += 1;
-                        if peer_only && consecutive_errors >= 10 {
-                            warn!("{} accept failing persistently — returning for rebind", local_addr);
-                            return;
-                        }
-                        // Don't hot-loop on a dead socket.
-                        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
                         continue;
                     }
                 };
                 let handler = handler.clone();
-                // NEVER park the accept loop on the connection budget.
-                // `acquire_owned().await` here froze accept() entirely when
-                // permits drained — and permits drained because half-open
-                // clients and hung upstreams held them forever (the .228
-                // session-flapping / CLOSE-WAIT `inode: 0` signature). Shed
-                // load instead: accept, answer 503, close.
-                let permit = match active_connections.clone().try_acquire_owned() {
-                    Ok(p) => p,
-                    Err(_) => {
-                        warn!(
-                            "{} connection budget exhausted — shedding {}",
-                            local_addr, peer_addr
-                        );
-                        tokio::spawn(async move {
-                            use tokio::io::AsyncWriteExt;
-                            let mut stream = stream;
-                            let _ = tokio::time::timeout(
-                                std::time::Duration::from_secs(5),
-                                stream.write_all(
-                                    b"HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\nContent-Length: 0\r\n\r\n",
-                                ),
-                            )
-                            .await;
-                            let _ = stream.shutdown().await;
-                        });
-                        continue;
-                    }
-                };
+                let permit = active_connections.clone().acquire_owned().await;
                 tokio::spawn(async move {
                     let _permit = permit;
-                    // Set when a request carries an Upgrade header (websocket):
-                    // upgraded connections are legitimately long-lived and are
-                    // exempt from the non-upgraded connection deadline below.
-                    let upgraded = Arc::new(std::sync::atomic::AtomicBool::new(false));
-                    let upgraded_flag = upgraded.clone();
                     let service = service_fn(move |mut req: hyper::Request<hyper::Body>| {
                         let handler = handler.clone();
-                        if req.headers().contains_key(hyper::header::UPGRADE) {
-                            upgraded_flag.store(true, std::sync::atomic::Ordering::Relaxed);
-                        }
                         async move {
                             // Record the TCP peer so rate limiting only trusts
                             // forwarded headers on loopback (nginx) connections.
@@ -1385,48 +1314,13 @@ async fn accept_loop(
                                 .map_err(|e| std::io::Error::other(format!("{}", e)))
                         }
                     });
-                    // header_read_timeout: a client that connects and never
-                    // sends a request (slowloris / half-open) is dropped
-                    // instead of holding a permit until the heat death of the
-                    // node. Long RPCs are safe — the clock only covers header
-                    // read.
-                    let conn = Http::new()
+                    if let Err(e) = Http::new()
                         .http1_keep_alive(false)
-                        .http1_header_read_timeout(std::time::Duration::from_secs(30))
                         .serve_connection(stream, service)
-                        .with_upgrades();
-                    tokio::pin!(conn);
-                    // Deadline watchdog for NON-upgraded connections. With
-                    // keep-alive off a plain connection serves one exchange;
-                    // 15 min bounds even the slowest legitimate RPC/stream
-                    // while guaranteeing a hung upstream can't hold a permit
-                    // forever. Upgraded (websocket) connections are exempt.
-                    const NON_UPGRADED_DEADLINE: std::time::Duration =
-                        std::time::Duration::from_secs(900);
-                    let started = std::time::Instant::now();
-                    let watchdog = async {
-                        loop {
-                            tokio::time::sleep(std::time::Duration::from_secs(30)).await;
-                            if !upgraded.load(std::sync::atomic::Ordering::Relaxed)
-                                && started.elapsed() >= NON_UPGRADED_DEADLINE
-                            {
-                                return;
-                            }
-                        }
-                    };
-                    tokio::select! {
-                        r = &mut conn => {
-                            if let Err(e) = r {
-                                error!("Error serving connection from {}: {}", peer_addr, e);
-                            }
-                        }
-                        _ = watchdog => {
-                            warn!(
-                                "connection from {} exceeded {}s without completing or upgrading — dropping",
-                                peer_addr,
-                                NON_UPGRADED_DEADLINE.as_secs()
-                            );
-                        }
+                        .with_upgrades()
+                        .await
+                    {
+                        error!("Error serving connection from {}: {}", peer_addr, e);
                     }
                 });
             }

core/openwrt/src/router.rs

@@ -82,6 +82,22 @@ impl Router {
         Ok(out)
     }
 
+    /// Set `user`'s login password via BusyBox `passwd`, non-interactively.
+    ///
+    /// BusyBox's passwd applet reads the new password twice from stdin even
+    /// without a tty (unlike shadow-utils' passwd, which requires one), so
+    /// piping two lines in works. Root can always set its own (or another
+    /// user's) password without supplying the old one first. This is what
+    /// lets a fresh-flash router (root has no password yet) be fully set up
+    /// from the app — no manual SSH/console session required.
+    pub fn set_password(&self, user: &str, new_password: &str) -> Result<()> {
+        let q = crate::uci::shell_quote(new_password);
+        let uq = crate::uci::shell_quote(user);
+        let cmd = format!("printf '%s\\n%s\\n' {q} {q} | passwd {uq} 2>&1");
+        self.run_ok(&cmd)?;
+        Ok(())
+    }
+
     /// Verify the remote device is actually running OpenWrt.
     pub fn verify_openwrt(&self) -> Result<String> {
         let release = self

core/openwrt/src/uci.rs

@@ -60,6 +60,6 @@ impl Router {
 }
 
 /// Wrap a value in single quotes, escaping any embedded single quotes.
-fn shell_quote(s: &str) -> String {
+pub(crate) fn shell_quote(s: &str) -> String {
     format!("'{}'", s.replace('\'', r"'\''"))
 }

docs/RETICULUM-TRANSPORT-PROGRESS.md

@@ -12,33 +12,6 @@ Full plan: `.claude/plans/enchanted-strolling-rocket.md`. Memory pointer:
 avoiding `mesh/listener/session.rs` transport plumbing + `mesh/mod.rs` routing, which this work
 owns. Stay out of `meshtastic.rs`/`protocol.rs` to avoid collisions.
 
-## Checkpoint 2026-07-28 — RNode connect + names FIXED, live-verified E2E (read this first)
-
-The fleet reflash back to RNode firmware exposed a stack of bugs that made Reticulum
-unusable on CP2102-bridged boards (Heltec V3 etc.) and left every archy node nameless on
-RNS. All fixed in `a8c4694c` (backend) + `3f76b496` (UI), live-verified on archi-dev-box
-and archy-x250-dev with a real RNode-to-RNode LXMF message (`transport: "reticulum"` in
-mesh-messages) plus a cross-transport reply:
-
-1. **probe_rnode boot race** — serial open pulses DTR/RTS via the USB-UART bridge → ESP32
-   power-cycles → KISS DETECT written 300ms later is eaten during ~2.5-3s of boot. Fix:
-   immediate probe (fast path) + drain-until-quiet boot settle + second DETECT window.
-2. **configure() was a no-op on a running listener** (only enable/disable restarted it) —
-   the setup modal's apply/keep-as-is and every rename did nothing until process restart.
-3. **Name propagation** — `config.advert_name` had no reader; `server.set-name` never
-   reached mesh; daemon display name fixed at spawn to the "Archy" default; the ARCHY:2
-   announce blob REPLACED the LXMF name. Now: announces carry msgpack
-   `[name, stamp_cost, sf, ARCHY-blob]` (Sideband-compatible, blob invisible to stock
-   clients), daemon has a `set_name` verb, renames bounce the session live.
-4. **Daemon-death detection** (was invisible up to the 30-min RX-stall watchdog),
-   **modal re-trigger loop** (plugged_at used tty mtime → bumps on every open; now
-   btime/ctime), **ARCHY:2 federation-name clobber**, **mesh.refresh RPC** (Refresh button
-   now actually re-queries the radio), **Meshtastic mesh.broadcast now sends NodeInfo**.
-
-Still open here: legacy-format peers (old fleet builds) show as `Reticulum <hex4>` until
-they OTA; RNode RF params still daemon-hardcoded (EU-868 869.525/125k/SF8/CR5); Phase 4
-multi-radio; duty-cycle guard.
-
 ## Status at a glance
 
 | Phase | What | Status |

docs/combined-test-plan-2026-07-22.md

@@ -110,61 +110,6 @@ lands].
 2. ❑ Mobile Home: wallet card directly under My Apps (G5 from the voice epic).
 3. ❑ Mesh RF settings panel (Mesh → Device) still loads and saves.
 
-## H. LoRa radio firmware flashing (Heltec V3/V4, new — extends Section E)
-
-Full v1 scope is 3 firmware families × 2 boards (6 cells); mark each cell
-tested on real hardware vs. code-reviewed only as this is run.
-
-1. ❑ From the hot-swap modal's step 1 (device already probed), press
-   **Flash Firmware…** → new step shows firmware-family + board pickers and
-   the erase-confirmation checkbox; "Erase & Flash Now" stays disabled until
-   family, board, AND the checkbox are all set.
-2. ❑ Confirm what's currently on the test stick via the existing probe
-   BEFORE flashing it — don't flash the only known-good device without a
-   fallback board on hand.
-3. ❑ Prefer a spare Heltec V3/V4 for the first destructive erase+flash run;
-   only exercise a primary/in-use stick once the flow is proven safe.
-4. ❑ MeshCore → Heltec V3: erase + write completes, progress bar and log
-   tail update live, ends at "Flash complete".
-5. ❑ Meshtastic → Heltec V3: same, using the extracted `*.factory.bin` from
-   the esp32s3 release zip.
-6. ❑ Reticulum/RNode → Heltec V3: `archy-rnodeconf --autoinstall` path
-   completes (no raw esptool erase/write step for this family — see
-   `mesh/flash.rs` doc comment).
-7. ❑ Repeat 4-6 against a Heltec V4. Confirmed 2026-07-23 on real hardware:
-   V4 uses the ESP32-S3's native-USB JTAG/serial peripheral (vid:pid
-   303a:1001, generic to every native-USB ESP32-S3 board, not V4-specific)
-   — so unlike V3's CP2102 bridge chip, V4 is permanently NOT auto-matchable
-   by vid:pid. Board auto-detect should fail closed for it every time
-   (manual board selection required, "couldn't confirm automatically"
-   warning shown) — this is expected steady-state behavior, not a gap to
-   close later.
-8. ❑ After a successful flash, the modal automatically re-probes and shows
-   the NEW firmware's badge/details — same as unplugging and replugging
-   (Section E item 3), but without physically touching the cable.
-9. ❑ Deliberately test a failure path once (disconnect the board mid-write,
-   or point at a bad cached asset) — confirm the error surfaces in the
-   progress log AND that `docs/troubleshooting.md`'s "LoRa radio firmware
-   flash failed" recovery steps (BOOT+RST bootloader entry, manual esptool/
-   rnodeconf command) actually get the board back to a flashable state.
-10. ❑ Cancel button only appears (and only works) while still in the
-    "Downloading firmware…" stage — once erasing/writing starts, no cancel
-    affordance is offered.
-11. ❑ **Boot-loop regression (2026-07-23 incident)**: after a *failed* flash
-    (e.g. kill network access mid-download to force a failure), confirm the
-    mesh listener does NOT auto-resume — `journalctl -u archipelago` should
-    show a single `Leaving mesh listener stopped after failed flash` line
-    and then go quiet for that device, not a repeating `mesh::serial:
-    Opened serial port... Starting Meshcore handshake` cycle every few
-    seconds. Reconnect manually via the hot-swap modal afterward and confirm
-    it connects normally (the board itself should be untouched — the
-    download fails before esptool/rnodeconf ever runs).
-12. ❑ Separately, force a device to flap connected/disconnected a few times
-    in under 20s each (e.g. a marginal USB connection) and confirm
-    `reconnect_delay` in the logs actually escalates (5s → 10s → 20s → ...)
-    rather than resetting to 5s on every attempt — see
-    `STABLE_SESSION_THRESHOLD` in `mesh/listener/mod.rs`.
-
 ---
 
 After this passes: fold the batch + other agent's work into the next release

docs/troubleshooting.md

@@ -443,86 +443,6 @@ free -h
 - Check Nginx WebSocket proxy config: `/etc/nginx/sites-available/archipelago` must include `proxy_set_header Upgrade $http_upgrade`
 - If on WiFi, try wired Ethernet for more stable connectivity
 
-### 21. LoRa radio firmware flash failed / board unresponsive
-
-**Symptoms**: The "Erase & Flash Now" flow in the mesh hot-swap modal reports
-an error, or the radio no longer enumerates as a serial device after a flash
-attempt.
-
-**Diagnosis**:
-```bash
-# Poll the flash job's last-known stage/error directly
-curl -s http://localhost:5678/rpc/v1 \
-  -H 'Content-Type: application/json' \
-  -d '{"method":"mesh.flash-status","params":{}}'
-
-# Confirm the board is still enumerating at all
-ls -la /dev/ttyUSB* /dev/ttyACM* /dev/mesh-radio 2>&1
-
-# esptool/rnodeconf binaries present?
-which esptool; ls -la /usr/local/bin/archy-rnodeconf
-```
-
-**Solutions**:
-- A failure during `erasing`/`writing` (MeshCore/Meshtastic) or
-  `autoinstalling` (Reticulum) can leave the chip erased or half-written —
-  this is expected risk of the "always erase first" default, not a bug.
-- Heltec V3/V4 boards can be forced back into bootloader mode manually: hold
-  **BOOT**, tap **RST**, then release **BOOT** — this puts the chip in a
-  state esptool can always talk to, regardless of what firmware (if any) is
-  currently on it.
-- With the board in bootloader mode, a manual recovery flash can be run
-  directly over SSH without the UI:
-  ```bash
-  esptool --chip esp32s3 --port /dev/ttyACM0 erase_flash
-  esptool --chip esp32s3 --port /dev/ttyACM0 write_flash 0x0 <known-good-image.bin>
-  ```
-- For Reticulum/RNode boards, the equivalent manual recovery is
-  `archy-rnodeconf /dev/ttyACM0 --autoinstall` (or `/usr/local/bin/archy-rnodeconf`
-  if it's not on `PATH`) — it re-runs the same fetch+erase+flash+bootstrap
-  sequence the UI triggers.
-- If `esptool`/`archy-rnodeconf` are missing entirely, they should have been
-  installed by the last `self-update.sh` run — check
-  `sudo journalctl -u archipelago-update` for install failures, or install
-  `esptool` via `sudo apt-get install esptool` directly.
-- Once a fresh image is confirmed written, unplug/replug the radio (or wait
-  for the next detection poll) — the hot-swap modal re-probes automatically
-  and shows whatever firmware is actually on the board now.
-
-**Known incident (2026-07-23) — reconnect storm / device boot-loop after a
-failed flash**: a real Heltec V3 got stuck cycling "connect → partial
-handshake → drop" every 5-15s for 5+ minutes after a `mesh.flash-device`
-attempt failed with `Reading firmware download stream`. Root cause was two
-compounding issues, both now fixed:
-1. `spawn_mesh_listener`'s reconnect backoff (`core/archipelago/src/mesh/listener/mod.rs`)
-   reset to its 5s minimum any time the prior session had been `device_connected`
-   at all, even for under a second — so a device that connects-then-drops
-   repeatedly never actually backed off. Every retry's `open()` toggles
-   DTR/RTS, which resets many ESP32 boards' MCU (native-USB *and*
-   CP2102/CH340 auto-reset-circuit boards), so the aggressive retries were
-   themselves *causing* the boot loop, not just observing one. Fixed by only
-   resetting backoff when a session ran for at least `STABLE_SESSION_THRESHOLD`
-   (20s) — see that constant's doc comment.
-2. `mesh::flash::start_flash_job`'s post-completion handler auto-resumed the
-   listener unconditionally, even after a *failed* flash, immediately
-   re-entering the reconnect loop above with no cooldown. Fixed: on failure
-   the listener is now deliberately left stopped (reconnect manually via the
-   UI once the board is confirmed alive); on success there's a 5s settle
-   delay before resuming, so the board finishes booting from the flash
-   tool's own reset before Archipelago starts probing it again.
-3. Separately, the download itself was failing because `mesh::flash`'s HTTP
-   client had a blanket 30s request timeout that covered the *entire*
-   download (including streaming a 170MB Meshtastic zip), not just
-   connection setup — fixed with a per-chunk stall timeout instead of a
-   fixed total-transfer cap.
-
-If this symptom recurs (rapid repeating `mesh::serial: Opened serial
-port... Starting Meshcore handshake` lines in `journalctl -u archipelago`
-without a `LoRa firmware flash` job in progress), it's a NEW instance of the
-same class of bug, not the one above — check whether backoff is actually
-escalating (`Mesh session error: ... (retry in Xs)` — X should grow past 5s
-within a few cycles) before assuming it's flashing-related.
-
 ---
 
 ## General Maintenance

image-recipe/_archived/build-auto-installer-iso.sh

@@ -365,11 +365,6 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     ca-certificates \
     openssl \
     chrony \
-    iputils-ping \
-    esptool \
-    python3-venv \
-    binutils \
-    libpython3.13 \
     locales \
     console-setup \
     keyboard-configuration \

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.115-alpha",
+  "version": "1.7.116-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.115-alpha",
+      "version": "1.7.116-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",
@@ -150,7 +150,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1812,7 +1811,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -1836,7 +1834,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -3923,7 +3920,6 @@
       "integrity": "sha512-TbAd9DaPGSnzp6QvtYngntMZgcRk+igFELwR2N99XZn7RXUdKgsXMR+28bUO0rPsWp8MIu/f47luLIQuSLYv/w==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/geojson": "*"
       }
@@ -3973,7 +3969,6 @@
       "integrity": "sha512-MCbrb508JZHqe7bUibmZj/lyojdhLRnfkmyXnkrCM2zVrjTgL89U8UEfInpKTvPeTnxsw2hmyZxnhsdNR6yhwg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "cac": "^6.7.14",
         "colorette": "^2.0.20",
@@ -4474,7 +4469,6 @@
       "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
         "fast-uri": "^3.0.1",
@@ -4960,7 +4954,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -5979,7 +5972,6 @@
       "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
       "integrity": "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==",
       "license": "ISC",
-      "peer": true,
       "engines": {
         "node": ">=12"
       }
@@ -8172,7 +8164,6 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -8222,7 +8213,6 @@
       "integrity": "sha512-8i7LzZj7BF8uplX+ZyOlIz86V6TAsSs+np6m1kpW9u0JWi4z/1t+FzcK1aek+ybTnAC4KhBL4uXCNT0wcUIeCw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "cssstyle": "^4.1.0",
         "data-urls": "^5.0.0",
@@ -8325,8 +8315,7 @@
       "version": "1.9.4",
       "resolved": "https://registry.npmjs.org/leaflet/-/leaflet-1.9.4.tgz",
       "integrity": "sha512-nxS1ynzJOmOlHp+iL3FyWqK89GtNL8U8rvlMOsQdTTssxZwCXh8N2NB3GDQOL+YR3XnWyZAxwQixURb+FA74PA==",
-      "license": "BSD-2-Clause",
-      "peer": true
+      "license": "BSD-2-Clause"
     },
     "node_modules/leven": {
       "version": "3.1.0",
@@ -9082,7 +9071,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -9744,7 +9732,6 @@
       "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/estree": "1.0.8"
       },
@@ -11000,7 +10987,6 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -11256,7 +11242,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -11498,7 +11483,6 @@
       "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
@@ -11661,7 +11645,6 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -11675,7 +11658,6 @@
       "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/chai": "^5.2.2",
         "@vitest/expect": "3.2.4",
@@ -11768,7 +11750,6 @@
       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.30.tgz",
       "integrity": "sha512-hTHLc6VNZyzzEH/l7PFGjpcTvUgiaPK5mdLkbjrTeWSRcEfxFrv56g/XckIYlE9ckuobsdwqd5mk2g1sBkMewg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@vue/compiler-dom": "3.5.30",
         "@vue/compiler-sfc": "3.5.30",

neode-ui/src/api/rpc-client.ts

@@ -4,16 +4,6 @@ export interface RPCOptions {
   method: string
   params?: Record<string, unknown>
   timeout?: number
-  /** Abort the call (and any pending retries) from the outside — pass a
-   * component-scoped controller's signal so fan-outs stop on unmount. */
-  signal?: AbortSignal
-  /** Per-call retry budget (default 3). Use 1 for calls whose caller has its
-   * own timeout/fallback UX — retry×3 on a slow peer is how one unreachable
-   * node turns a 30s timeout into a 90s spinner. */
-  maxRetries?: number
-  /** Collapse concurrent identical calls (same method + params) into one
-   * request. Opt-in: only safe for reads. */
-  dedup?: boolean
 }
 
 export interface RPCResponse<T> {
@@ -84,35 +74,18 @@ function getCsrfToken(): string | null {
 class RPCClient {
   private static _sessionExpiredRedirecting = false
   private baseUrl: string
-  /** In-flight dedup map for `dedup: true` calls, keyed method+params. */
-  private inflight = new Map<string, Promise<unknown>>()
 
   constructor(baseUrl: string = '/rpc/v1') {
     this.baseUrl = baseUrl
   }
 
   async call<T>(options: RPCOptions): Promise<T> {
-    if (options.dedup) {
-      const key = `${options.method}:${JSON.stringify(options.params ?? {})}`
-      const existing = this.inflight.get(key)
-      if (existing) return existing as Promise<T>
-      const p = this.callInner<T>(options).finally(() => this.inflight.delete(key))
-      this.inflight.set(key, p)
-      return p
-    }
-    return this.callInner<T>(options)
-  }
-
-  private async callInner<T>(options: RPCOptions): Promise<T> {
-    const { method, params = {}, timeout = 15000, signal: external } = options
-    const maxRetries = Math.max(1, options.maxRetries ?? 3)
+    const { method, params = {}, timeout = 15000 } = options
+    const maxRetries = 3
 
     for (let attempt = 0; attempt < maxRetries; attempt++) {
-      if (external?.aborted) throw new Error('Aborted')
       const controller = new AbortController()
       const timeoutId = setTimeout(() => controller.abort(), timeout)
-      const onExternalAbort = () => controller.abort()
-      external?.addEventListener('abort', onExternalAbort, { once: true })
 
       try {
         const headers: Record<string, string> = {
@@ -132,7 +105,6 @@ class RPCClient {
         })
 
         clearTimeout(timeoutId)
-        external?.removeEventListener('abort', onExternalAbort)
 
         if (!response.ok) {
           // Session expired — debounced redirect to login
@@ -195,11 +167,8 @@ class RPCClient {
         return data.result as T
       } catch (error) {
         clearTimeout(timeoutId)
-        external?.removeEventListener('abort', onExternalAbort)
         if (error instanceof Error) {
           if (error.name === 'AbortError') {
-            // Caller-initiated abort is final — never retried.
-            if (external?.aborted) throw new Error('Aborted')
             const timeoutErr = new Error('Request timeout')
             if (attempt < maxRetries - 1) {
               const delay = 600 * (attempt + 1)

neode-ui/src/components/LightningChannelsPanel.vue

@@ -377,9 +377,8 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed } from 'vue'
+import { ref, computed, onMounted } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import { useTxExplorer } from '@/composables/useTxExplorer'
 
 defineProps<{ compact?: boolean }>()
@@ -463,41 +462,11 @@ const feePresets: { key: FeePreset; label: string; hint?: string; confTarget?: n
   { key: 'custom', label: 'Custom' },
 ]
 
-// Cached: revisits paint the channel lists instantly and revalidate behind
-// them. Open and closed history are separate entries so a closed-history
-// failure keeps its last list without touching the main channel view.
-interface ChannelsData { channels: Channel[]; total_inbound: number; total_outbound: number }
-const channelsRes = useCachedResource<ChannelsData>({
-  key: 'lnd.channels',
-  fetcher: async (signal) => {
-    const result = await rpcClient.call<ChannelsData>({
-      method: 'lnd.listchannels', timeout: 15000, signal, dedup: true, maxRetries: 1,
-    })
-    return {
-      channels: result?.channels || [],
-      total_inbound: result?.total_inbound || 0,
-      total_outbound: result?.total_outbound || 0,
-    }
-  },
-})
-const closedRes = useCachedResource<ClosedChannel[]>({
-  key: 'lnd.closed-channels',
-  fetcher: async (signal) => {
-    const closed = await rpcClient.call<{ channels: ClosedChannel[] }>({
-      method: 'lnd.closedchannels', timeout: 15000, signal, dedup: true, maxRetries: 1,
-    })
-    return closed?.channels || []
-  },
-})
-const loading = computed(() =>
-  channelsRes.loadState.value === 'loading' || channelsRes.loadState.value === 'refreshing')
-const error = computed(() => channelsRes.error.value)
-const channels = computed(() => channelsRes.data.value?.channels ?? [])
-const closedChannels = computed(() => closedRes.data.value ?? [])
-const summary = computed(() => ({
-  total_inbound: channelsRes.data.value?.total_inbound ?? 0,
-  total_outbound: channelsRes.data.value?.total_outbound ?? 0,
-}))
+const loading = ref(true)
+const error = ref<string | null>(null)
+const channels = ref<Channel[]>([])
+const closedChannels = ref<ClosedChannel[]>([])
+const summary = ref({ total_inbound: 0, total_outbound: 0 })
 
 // Olympus by ZEUS — the LSP node behind the Zeus mobile wallet.
 // Channel limits: min 150,000 / max 1,500,000 sats.
@@ -569,10 +538,37 @@ function capacityPercent(amount: number, capacity: number): number {
   return Math.round((amount / capacity) * 100)
 }
 
-function loadChannels(): Promise<void> {
-  const main = channelsRes.refresh()
-  void closedRes.refresh()
-  return main
+async function loadChannels() {
+  const hadChannels = channels.value.length > 0
+  loading.value = true
+  error.value = null
+  try {
+    const result = await rpcClient.call<{ channels: Channel[]; total_inbound: number; total_outbound: number }>({
+      method: 'lnd.listchannels',
+      timeout: 15000,
+    })
+    channels.value = result.channels || []
+    summary.value = {
+      total_inbound: result.total_inbound || 0,
+      total_outbound: result.total_outbound || 0,
+    }
+    // Closed history is a separate RPC — a failure here keeps the previous
+    // list rather than blanking the main channel view.
+    try {
+      const closed = await rpcClient.call<{ channels: ClosedChannel[] }>({
+        method: 'lnd.closedchannels',
+        timeout: 15000,
+      })
+      closedChannels.value = closed.channels || []
+    } catch {
+      /* keep previous closed list */
+    }
+  } catch (err: unknown) {
+    error.value = err instanceof Error ? err.message : 'Failed to load channels'
+    if (!hadChannels) channels.value = []
+  } finally {
+    loading.value = false
+  }
 }
 
 function feeParams(): { target_conf?: number; sat_per_vbyte?: number } | null {
@@ -651,5 +647,7 @@ async function closeChannel() {
   }
 }
 
+onMounted(loadChannels)
+
 defineExpose({ channels, loadChannels })
 </script>

neode-ui/src/components/mesh/MeshDeviceSetupModal.vue

@@ -1,7 +1,7 @@
 <template>
   <BaseModal
     :show="show"
-    :title="step === 1 ? 'Mesh Radio Detected' : step === 2 ? 'Set Recommended' : 'Flash Firmware'"
+    :title="step === 1 ? 'Mesh Radio Detected' : 'Apply Archipelago Settings'"
     max-width="max-w-lg"
     content-class="max-h-[90vh] overflow-y-auto"
     @close="dismiss"
@@ -35,17 +35,9 @@
 
       <!-- What's currently flashed / configured on it -->
       <div class="mt-4 text-left rounded-xl bg-white/[0.05] border border-white/10 p-3">
-        <div v-if="probing" class="py-1">
-          <div class="flex items-center justify-between text-white/60 text-sm mb-1.5">
-            <span>{{ probeStage }}</span>
-            <span class="text-white/40 text-xs tabular-nums">{{ Math.round(probeProgress) }}%</span>
-          </div>
-          <div class="h-1.5 rounded-full bg-white/10 overflow-hidden">
-            <div
-              class="h-full rounded-full bg-orange-400/80 transition-[width] duration-500 ease-linear"
-              :style="{ width: probeProgress + '%' }"
-            ></div>
-          </div>
+        <div v-if="probing" class="flex items-center gap-2 text-white/60 text-sm py-1">
+          <span class="inline-block w-3.5 h-3.5 rounded-full border-2 border-orange-300/70 border-t-transparent animate-spin"></span>
+          Reading what's on the radio…
         </div>
         <template v-else-if="probe">
           <div class="flex items-center gap-2">
@@ -102,123 +94,21 @@
           :disabled="!!connecting"
           @click="step = 2"
         >
-          Set Recommended
+          Set Up with Archipelago Settings
         </button>
       </div>
       <p class="text-white/40 text-[11px] mt-3">
         "Keep As Is" uses the radio exactly as it is — nothing on it is changed,
         and you can hot-swap radios any time.
       </p>
-      <button
-        class="w-full text-center text-white/40 hover:text-white/70 text-[11px] mt-3 underline underline-offset-2"
-        :disabled="!!connecting"
-        @click="openFlashStep"
-      >
-        Flash Firmware…
-      </button>
       <p v-if="error" class="text-xs text-red-400 mt-2">{{ error }}</p>
     </div>
 
-    <!-- Step 3: erase + reflash — destructive, opt-in only -->
-    <div v-else-if="step === 'flash'">
-      <!-- Once a job exists (started via startFlash), ALWAYS show the
-           progress/result view below — including on failure. The old
-           condition (`!active && stage !== 'done'`) was also true for a
-           FAILED job (active:false, stage:'failed'), which silently sent
-           the user back to this picker instead of showing the error. -->
-      <template v-if="!flashJob">
-        <p class="text-white/60 text-xs mb-3">
-          Downloads the latest firmware from upstream and writes it to
-          <span class="font-mono text-orange-300">{{ devicePath }}</span>.
-        </p>
-
-        <div class="space-y-4">
-          <div>
-            <label class="block text-sm text-white/80 mb-1">Firmware family</label>
-            <select v-model="flashFamily" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
-              <option value="">Choose…</option>
-              <option value="meshcore">MeshCore</option>
-              <option value="meshtastic">Meshtastic</option>
-              <option value="reticulum">Reticulum RNode</option>
-            </select>
-          </div>
-          <div>
-            <label class="block text-sm text-white/80 mb-1">Board</label>
-            <select v-model="flashBoard" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
-              <option value="">Choose…</option>
-              <option value="heltec-v3">Heltec LoRa 32 V3</option>
-              <option value="heltec-v4">Heltec LoRa 32 V4</option>
-            </select>
-            <p v-if="!boardAutoDetected" class="text-[11px] text-amber-400/80 mt-1">
-              Couldn't confirm the board automatically — double check before flashing.
-              Flashing the wrong board's image can brick it.
-            </p>
-          </div>
-        </div>
-
-        <div class="rounded-xl bg-red-500/10 border border-red-500/30 p-3 mt-4">
-          <label class="flex items-start gap-2 text-xs text-red-300">
-            <input type="checkbox" v-model="flashConfirmed" class="mt-0.5" />
-            <span>
-              This <strong>erases the entire chip</strong>, including any existing
-              keys, identity, and contacts. This cannot be undone.
-            </span>
-          </label>
-        </div>
-
-        <p v-if="error" class="text-xs text-red-400 mt-3">{{ error }}</p>
-
-        <div class="flex gap-2 mt-6">
-          <button class="glass-button px-4 py-2 rounded-lg text-sm" @click="step = 1">Back</button>
-          <button
-            class="flex-1 glass-button px-4 py-2 rounded-lg text-sm font-medium bg-red-500/80 hover:bg-red-500 text-white disabled:opacity-50"
-            :disabled="!flashFamily || !flashBoard || !flashConfirmed || starting"
-            @click="startFlash"
-          >
-            {{ starting ? 'Starting…' : 'Erase & Flash Now' }}
-          </button>
-        </div>
-      </template>
-
-      <!-- Progress -->
-      <template v-else>
-        <div class="text-center py-2">
-          <p class="text-white text-sm font-medium">{{ flashStageLabel }}</p>
-          <div class="mt-3 h-2 rounded-full bg-white/10 overflow-hidden">
-            <div
-              class="h-full bg-orange-400 transition-all"
-              :style="{ width: (flashJob?.percent ?? (flashJob?.stage === 'done' ? 100 : 8)) + '%' }"
-            ></div>
-          </div>
-          <p v-if="flashJob?.error" class="text-xs text-red-400 mt-3">{{ flashJob.error }}</p>
-        </div>
-        <div class="mt-3 rounded-xl bg-black/30 border border-white/10 p-2 h-32 overflow-y-auto font-mono text-[10px] text-white/50 leading-relaxed">
-          <div v-for="(line, i) in (flashJob?.log_tail ?? []).slice(-40)" :key="i">{{ line }}</div>
-        </div>
-        <div class="flex gap-2 mt-4">
-          <button
-            v-if="flashJob?.stage === 'downloading' && flashJob?.active"
-            class="glass-button px-4 py-2 rounded-lg text-sm"
-            @click="cancelFlash"
-          >
-            Cancel
-          </button>
-          <button
-            v-if="!flashJob?.active"
-            class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium"
-            @click="closeFlashStep"
-          >
-            Done
-          </button>
-        </div>
-      </template>
-    </div>
-
     <!-- Step 2: our latest parameters, shown before anything is written -->
     <div v-else>
       <p class="text-white/60 text-xs mb-3">
-        These are the recommended Archipelago settings — nothing is written to
-        the radio until you confirm.
+        These are the latest Archipelago settings — nothing is written to the
+        radio until you confirm.
       </p>
 
       <!-- Summary of what will be applied -->
@@ -300,7 +190,7 @@
 import { ref, computed, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import BaseModal from '@/components/BaseModal.vue'
-import { useMeshStore, type MeshDeviceProbe, type MeshConfigureParams, type FlashFirmwareFamily, type FlashBoard, type FlashJobStatus } from '@/stores/mesh'
+import { useMeshStore, type MeshDeviceProbe, type MeshConfigureParams } from '@/stores/mesh'
 import { useAppStore } from '@/stores/app'
 import { LORA_REGIONS, regionByCode, suggestRegionFromLatLon, meshcorePlanFor } from '@/utils/loraRegions'
 import { resolveMeshDeviceImage } from '@/utils/meshDeviceImages'
@@ -309,37 +199,13 @@ const mesh = useMeshStore()
 const appStore = useAppStore()
 const router = useRouter()
 
-const step = ref<1 | 2 | 'flash'>(1)
+const step = ref<1 | 2>(1)
 const connecting = ref<false | 'keep' | 'setup'>(false)
 const error = ref('')
 const probing = ref(false)
 const probe = ref<MeshDeviceProbe | null>(null)
 const probeError = ref('')
 
-// Time-driven probe progress: the probe RPC is a single opaque call that can
-// take ~5-30s (boot settle + up to three firmware handshakes), so the bar
-// advances on a clock toward 92% and snaps to 100% when the result lands.
-const probeProgress = ref(0)
-const probeStage = ref('Waiting for the radio to boot…')
-let probeTicker: ReturnType<typeof setInterval> | null = null
-function startProbeProgress() {
-  stopProbeProgress()
-  probeProgress.value = 0
-  probeStage.value = 'Waiting for the radio to boot…'
-  const startedAt = Date.now()
-  probeTicker = setInterval(() => {
-    const elapsed = (Date.now() - startedAt) / 1000
-    // ~92% at 30s, decelerating — never looks stuck, never lies "done".
-    probeProgress.value = Math.min(92, 100 * (1 - Math.exp(-elapsed / 11)))
-    if (elapsed >= 4) probeStage.value = 'Detecting firmware…'
-    if (elapsed >= 18) probeStage.value = 'Still checking (radios can be slow to answer)…'
-  }, 400)
-}
-function stopProbeProgress(done = false) {
-  if (probeTicker) { clearInterval(probeTicker); probeTicker = null }
-  if (done) probeProgress.value = 100
-}
-
 const devicePath = computed(() => mesh.undismissedDetectedDevices[0] ?? '')
 const show = computed(() => !!devicePath.value)
 const imageFailed = ref(false)
@@ -398,10 +264,7 @@ const rfPreset = computed(() => {
 
 // (Re)probe + (re)apply presets each time a new device surfaces the modal
 watch([show, devicePath], async ([visible]) => {
-  if (!visible) {
-    stopFlashPoll()
-    return
-  }
+  if (!visible) return
   step.value = 1
   error.value = ''
   imageFailed.value = false
@@ -412,7 +275,6 @@ watch([show, devicePath], async ([visible]) => {
   probe.value = null
   probeError.value = ''
   probing.value = true
-  startProbeProgress()
   const path = devicePath.value
   try {
     const res = await mesh.probeDevice(path)
@@ -422,7 +284,6 @@ watch([show, devicePath], async ([visible]) => {
       probeError.value = e instanceof Error ? e.message : String(e)
     }
   } finally {
-    stopProbeProgress(true)
     if (devicePath.value === path) probing.value = false
   }
 }, { immediate: false })
@@ -488,118 +349,6 @@ async function applySetup() {
     connecting.value = false
   }
 }
-
-// ─── Step 3: erase + reflash ─────────────────────────────────────────────
-const flashFamily = ref<FlashFirmwareFamily | ''>('')
-const flashBoard = ref<FlashBoard | ''>('')
-const flashConfirmed = ref(false)
-const starting = ref(false)
-const flashJob = ref<FlashJobStatus | null>(null)
-let flashPollTimer: ReturnType<typeof setInterval> | null = null
-
-const detectedInfo = computed(() =>
-  mesh.status?.detected_device_info?.find(d => d.path === devicePath.value)
-)
-
-// Mirrors mesh::flash::resolve_flash_board (core/archipelago/src/mesh/flash.rs)
-// exactly — matching on the display label was wrong: a Heltec V3's CP2102
-// bridge chip reports "CP2102 USB to UART Bridge Controller" in its USB
-// strings, not "Heltec", so meshDeviceImages.ts falls back to a generic
-// "LoRa radio (CP2102 serial)" label that never matched /v3/i, showing the
-// "couldn't confirm automatically" warning even though the backend CAN
-// safely auto-detect V3 via vid:pid. Heltec V4 deliberately has no entry
-// here, same reasoning as the backend: its vid:pid (303a:1001) is the
-// ESP32-S3's generic native-USB descriptor, not V4-specific, so it can't be
-// safely auto-matched and always requires manual selection.
-const resolvedFlashBoard = computed<FlashBoard | ''>(() => {
-  const info = detectedInfo.value
-  if (info?.vid?.toLowerCase() === '10c4' && info?.pid?.toLowerCase() === 'ea60') return 'heltec-v3'
-  return ''
-})
-
-const boardAutoDetected = computed(() => !!resolvedFlashBoard.value)
-
-const flashStageLabel = computed(() => {
-  switch (flashJob.value?.stage) {
-    case 'downloading': return 'Downloading firmware…'
-    case 'erasing': return 'Erasing chip…'
-    case 'writing': return 'Writing firmware…'
-    case 'autoinstalling': return 'Installing (rnodeconf)…'
-    case 'done': return 'Flash complete'
-    case 'failed': return 'Flash failed'
-    default: return ''
-  }
-})
-
-function openFlashStep() {
-  flashFamily.value = (probe.value?.kind as FlashFirmwareFamily) ?? ''
-  flashBoard.value = resolvedFlashBoard.value
-  flashConfirmed.value = false
-  flashJob.value = null
-  error.value = ''
-  step.value = 'flash'
-}
-
-function stopFlashPoll() {
-  if (flashPollTimer) {
-    clearInterval(flashPollTimer)
-    flashPollTimer = null
-  }
-}
-
-async function pollFlashStatus() {
-  try {
-    const status = await mesh.flashStatus()
-    flashJob.value = status
-    if (!status.active) {
-      stopFlashPoll()
-      if (status.done && !status.error) {
-        // Mirrors the unplug/replug hot-swap flow: re-probe so the details
-        // card reflects whatever firmware is actually on the board now.
-        const path = devicePath.value
-        probing.value = true
-        try {
-          probe.value = await mesh.probeDevice(path)
-        } catch {
-          probe.value = null
-        } finally {
-          probing.value = false
-        }
-      }
-    }
-  } catch {
-    stopFlashPoll()
-  }
-}
-
-async function startFlash() {
-  if (!flashFamily.value || !flashBoard.value || !flashConfirmed.value) return
-  starting.value = true
-  error.value = ''
-  try {
-    await mesh.flashDevice(devicePath.value, flashFamily.value, flashBoard.value)
-    flashJob.value = { active: true, stage: 'downloading', log_tail: [] }
-    stopFlashPoll()
-    flashPollTimer = setInterval(pollFlashStatus, 1500)
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : 'Failed to start flashing'
-  } finally {
-    starting.value = false
-  }
-}
-
-async function cancelFlash() {
-  try {
-    await mesh.flashCancel()
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : 'Failed to cancel'
-  }
-}
-
-function closeFlashStep() {
-  stopFlashPoll()
-  step.value = 1
-}
 </script>
 
 <style scoped>

neode-ui/src/composables/useCachedResource.ts

@@ -1,107 +0,0 @@
-// Stale-while-revalidate resource hook over the shared resources store.
-//
-// Usage:
-//   const files = useCachedResource<CloudFile[]>({
-//     key: 'cloud.my-files',
-//     fetcher: (signal) => rpcClient.call({ method: 'content.list', signal, dedup: true }),
-//     ttlMs: 30_000,
-//   })
-//   // template: files.data renders instantly on revisit (cache), while
-//   // files.loadState === 'refreshing' drives a subtle refresh indicator.
-//
-// Behavior:
-// - Synchronous hydrate: memory (survives navigation) → sessionStorage
-//   snapshot (survives reload) → fetch.
-// - Sticky-ready: never regresses ready → loading; refreshes are
-//   'refreshing' so content stays on screen.
-// - Stale-while-revalidate: on mount, cached data is shown immediately and a
-//   background refresh runs only if the TTL has lapsed (or never fetched).
-// - Keep-last-value on error, with `isStale`/`ageMs` for badges.
-// - revalidateOnFocus: refreshes when the tab regains focus and the data is
-//   stale (debounced by TTL, so focus-flapping is free).
-// - Abort-on-unmount: the fetcher receives an AbortSignal that fires when
-//   the last subscribed component unmounts.
-
-import { computed, getCurrentScope, onScopeDispose, type ComputedRef } from 'vue'
-import { useResourcesStore, type ResourceEntry, type ResourceLoadState } from '@/stores/resources'
-
-export interface CachedResourceOptions<T> {
-  /** Cache key. Include identifying params, e.g. `peer-files:${onion}`. */
-  key: string
-  /** Fetch fresh data. Receives an abort signal tied to component lifetime. */
-  fetcher: (signal: AbortSignal) => Promise<T>
-  /** Data older than this triggers a background revalidate (default 30s). */
-  ttlMs?: number
-  /** Snapshot to sessionStorage so reloads paint instantly (default true).
-   * Disable for large payloads. */
-  persist?: boolean
-  /** Revalidate (if stale) when the window regains focus (default true). */
-  revalidateOnFocus?: boolean
-  /** Fetch on first use (default true). Set false for lazy resources. */
-  immediate?: boolean
-}
-
-export interface CachedResource<T> {
-  entry: ResourceEntry<T>
-  /** Convenience computed views over the entry. */
-  data: ComputedRef<T | null>
-  loadState: ComputedRef<ResourceLoadState>
-  error: ComputedRef<string | null>
-  /** True when data exists but is older than the TTL (drive an age badge). */
-  isStale: ComputedRef<boolean>
-  ageMs: ComputedRef<number | null>
-  /** Force a refresh now (deduped with any in-flight one). */
-  refresh: () => Promise<void>
-  /** Mark stale + debounce-refresh all mounted users of this key. */
-  invalidate: () => void
-  /** Optimistically update cached data; returns rollback for RPC failure. */
-  optimistic: (update: (current: T | null) => T) => () => void
-}
-
-export function useCachedResource<T>(opts: CachedResourceOptions<T>): CachedResource<T> {
-  const store = useResourcesStore()
-  const ttlMs = opts.ttlMs ?? 30_000
-  const persist = opts.persist ?? true
-  const entry = store.entry<T>(opts.key, persist)
-
-  const aborter = new AbortController()
-  const fetcher = () => opts.fetcher(aborter.signal)
-  const refresh = () => store.refresh(opts.key, fetcher, { persist })
-
-  const stale = () => entry.fetchedAt === null || Date.now() - entry.fetchedAt > ttlMs
-  const refreshIfStale = () => {
-    if (stale()) void refresh()
-  }
-
-  // Register as a live revalidator so invalidate(key) reaches us.
-  const unsubscribe = store.subscribe(opts.key, () => void refresh())
-
-  const onFocus = () => refreshIfStale()
-  if (opts.revalidateOnFocus ?? true) {
-    window.addEventListener('focus', onFocus)
-  }
-
-  // Tied to the owning effect scope (component setup or manual scope);
-  // outside any scope (tests, module init) there's nothing to dispose.
-  if (getCurrentScope()) {
-    onScopeDispose(() => {
-      unsubscribe()
-      window.removeEventListener('focus', onFocus)
-      aborter.abort()
-    })
-  }
-
-  if (opts.immediate ?? true) refreshIfStale()
-
-  return {
-    entry,
-    data: computed(() => entry.data),
-    loadState: computed(() => entry.loadState),
-    error: computed(() => entry.error),
-    isStale: computed(() => entry.data !== null && stale()),
-    ageMs: computed(() => (entry.fetchedAt === null ? null : Date.now() - entry.fetchedAt)),
-    refresh,
-    invalidate: () => store.invalidate(opts.key),
-    optimistic: (update) => store.optimistic<T>(opts.key, update),
-  }
-}

neode-ui/src/stores/__tests__/resources.test.ts

@@ -1,131 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { setActivePinia, createPinia } from 'pinia'
-
-import { useResourcesStore } from '../resources'
-import { useCachedResource } from '@/composables/useCachedResource'
-
-describe('resources store — stale-while-revalidate semantics', () => {
-  beforeEach(() => {
-    setActivePinia(createPinia())
-    sessionStorage.clear()
-    vi.useFakeTimers()
-  })
-  afterEach(() => {
-    vi.useRealTimers()
-  })
-
-  it('first fetch goes idle → loading → ready with data', async () => {
-    const store = useResourcesStore()
-    const e = store.entry<string>('k1')
-    expect(e.loadState).toBe('idle')
-    const p = store.refresh('k1', async () => 'hello')
-    expect(e.loadState).toBe('loading')
-    await p
-    expect(e.loadState).toBe('ready')
-    expect(e.data).toBe('hello')
-    expect(e.fetchedAt).not.toBeNull()
-  })
-
-  it('sticky-ready: refresh never regresses ready → loading', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k2', async () => 1)
-    const e = store.entry<number>('k2')
-    const p = store.refresh('k2', async () => 2)
-    expect(e.loadState).toBe('refreshing')
-    await p
-    expect(e.loadState).toBe('ready')
-    expect(e.data).toBe(2)
-  })
-
-  it('keeps last-known data on refresh error (ready + error set)', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k3', async () => 'good')
-    const e = store.entry<string>('k3')
-    await store.refresh('k3', async () => {
-      throw new Error('boom')
-    })
-    expect(e.data).toBe('good')
-    expect(e.loadState).toBe('ready')
-    expect(e.error).toBe('boom')
-  })
-
-  it('errors with no prior data land in error state', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k4', async () => {
-      throw new Error('down')
-    })
-    const e = store.entry('k4')
-    expect(e.loadState).toBe('error')
-    expect(e.data).toBeNull()
-  })
-
-  it('dedups concurrent refreshes for the same key', async () => {
-    const store = useResourcesStore()
-    const fetcher = vi.fn(async () => 'once')
-    const p1 = store.refresh('k5', fetcher)
-    const p2 = store.refresh('k5', fetcher)
-    await Promise.all([p1, p2])
-    expect(fetcher).toHaveBeenCalledTimes(1)
-  })
-
-  it('hydrates a new entry from the sessionStorage snapshot', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k6', async () => ({ n: 42 }))
-    // Fresh pinia = fresh memory cache, same sessionStorage.
-    setActivePinia(createPinia())
-    const store2 = useResourcesStore()
-    const e = store2.entry<{ n: number }>('k6')
-    expect(e.loadState).toBe('ready')
-    expect(e.data).toEqual({ n: 42 })
-  })
-
-  it('optimistic update applies immediately and rollback restores', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k7', async () => ['a'])
-    const e = store.entry<string[]>('k7')
-    const rollback = store.optimistic<string[]>('k7', (cur) => [...(cur ?? []), 'b'])
-    expect(e.data).toEqual(['a', 'b'])
-    rollback()
-    expect(e.data).toEqual(['a'])
-  })
-
-  it('invalidate marks stale and debounce-runs subscribers', async () => {
-    const store = useResourcesStore()
-    await store.refresh('k8', async () => 1)
-    const revalidate = vi.fn()
-    store.subscribe('k8', revalidate)
-    store.invalidate('k8')
-    expect(store.entry('k8').fetchedAt).toBeNull()
-    expect(revalidate).not.toHaveBeenCalled()
-    vi.advanceTimersByTime(900)
-    expect(revalidate).toHaveBeenCalledTimes(1)
-  })
-})
-
-describe('useCachedResource composable', () => {
-  beforeEach(() => {
-    setActivePinia(createPinia())
-    sessionStorage.clear()
-  })
-
-  it('fetches immediately when stale and exposes reactive views', async () => {
-    const fetcher = vi.fn(async () => 'data')
-    const r = useCachedResource<string>({ key: 'c1', fetcher, revalidateOnFocus: false })
-    await r.refresh()
-    expect(fetcher).toHaveBeenCalled()
-    expect(r.data.value).toBe('data')
-    expect(r.loadState.value).toBe('ready')
-    expect(r.isStale.value).toBe(false)
-  })
-
-  it('does not refetch within TTL (instant render from cache)', async () => {
-    const fetcher = vi.fn(async () => 'v1')
-    const r1 = useCachedResource<string>({ key: 'c2', fetcher, ttlMs: 60_000, revalidateOnFocus: false })
-    await r1.refresh()
-    // Second component using the same key inside the TTL: no new fetch.
-    const fetcher2 = vi.fn(async () => 'v2')
-    const r2 = useCachedResource<string>({ key: 'c2', fetcher: fetcher2, ttlMs: 60_000, revalidateOnFocus: false })
-    expect(r2.data.value).toBe('v1')
-    expect(fetcher2).not.toHaveBeenCalled()
-  })
-})

neode-ui/src/stores/cloud.ts

@@ -8,11 +8,6 @@ export const useCloudStore = defineStore('cloud', () => {
   const loading = ref(false)
   const error = ref<string | null>(null)
   const authenticated = ref(false)
-  // Per-path listing cache: re-entering a folder paints the last listing
-  // immediately (no spinner) while the fresh listing loads behind it.
-  const pathCache = new Map<string, FileBrowserItem[]>()
-  // Last-wins guard for overlapping navigations (fast folder hopping).
-  let navSeq = 0
 
   const breadcrumbs = computed(() => {
     const parts = currentPath.value.split('/').filter(Boolean)
@@ -41,22 +36,7 @@ export const useCloudStore = defineStore('cloud', () => {
   }
 
   async function navigate(path: string): Promise<void> {
-    const seq = ++navSeq
-    const apply = (p: string, result: FileBrowserItem[]) => {
-      pathCache.set(p, result)
-      if (seq !== navSeq) return // a newer navigation superseded this one
-      items.value = result
-      currentPath.value = p
-    }
-    // Stale-while-revalidate: show the cached listing for this path
-    // immediately (no spinner), then refresh it underneath.
-    const cached = pathCache.get(path)
-    if (cached) {
-      items.value = cached
-      currentPath.value = path
-    } else {
-      loading.value = true
-    }
+    loading.value = true
     error.value = null
     try {
       if (!authenticated.value) {
@@ -67,7 +47,9 @@ export const useCloudStore = defineStore('cloud', () => {
         }
       }
       try {
-        apply(path, await fileBrowserClient.listDirectory(path))
+        const result = await fileBrowserClient.listDirectory(path)
+        items.value = result
+        currentPath.value = path
       } catch {
         // Directory may not exist — try to create it, then retry
         if (path !== '/') {
@@ -75,20 +57,23 @@ export const useCloudStore = defineStore('cloud', () => {
             const parentPath = path.substring(0, path.lastIndexOf('/')) || '/'
             const dirName = path.substring(path.lastIndexOf('/') + 1)
             await fileBrowserClient.createFolder(parentPath, dirName)
-            apply(path, await fileBrowserClient.listDirectory(path))
+            const result = await fileBrowserClient.listDirectory(path)
+            items.value = result
+            currentPath.value = path
           } catch {
             // Fall back to root
-            apply('/', await fileBrowserClient.listDirectory('/'))
+            const result = await fileBrowserClient.listDirectory('/')
+            items.value = result
+            currentPath.value = '/'
           }
         } else {
           throw new Error('Failed to list root directory')
         }
       }
     } catch (e) {
-      // Keep showing the cached listing on a failed revalidate.
-      if (!cached) error.value = e instanceof Error ? e.message : 'Failed to load files'
+      error.value = e instanceof Error ? e.message : 'Failed to load files'
     } finally {
-      if (seq === navSeq) loading.value = false
+      loading.value = false
     }
   }
 
@@ -127,7 +112,6 @@ export const useCloudStore = defineStore('cloud', () => {
     items.value = []
     loading.value = false
     error.value = null
-    pathCache.clear()
   }
 
   return {

neode-ui/src/stores/mesh.ts

@@ -57,23 +57,6 @@ export interface MeshDeviceProbe {
   max_contacts: number | null
 }
 
-export type FlashFirmwareFamily = 'meshcore' | 'meshtastic' | 'reticulum'
-export type FlashBoard = 'heltec-v3' | 'heltec-v4'
-export type FlashStage = 'downloading' | 'erasing' | 'writing' | 'autoinstalling' | 'done' | 'failed'
-
-/** Live progress for the one flash job that can run at a time. */
-export interface FlashJobStatus {
-  active: boolean
-  board?: FlashBoard
-  family?: FlashFirmwareFamily
-  path?: string
-  stage?: FlashStage
-  percent?: number | null
-  log_tail?: string[]
-  done?: boolean
-  error?: string | null
-}
-
 /** Params accepted by mesh.configure (superset of the status fields). */
 export interface MeshConfigureParams {
   enabled?: boolean
@@ -291,16 +274,12 @@ export const useMeshStore = defineStore('mesh', () => {
   async function fetchStatus() {
     try {
       loading.value = true
+      error.value = null
       const res = await rpcClient.call<MeshStatus>({ method: 'mesh.status' })
       status.value = res
       trackDetectedDevices(res)
     } catch (err: unknown) {
-      // Don't clobber a user-action error (broadcast/configure/send) — this
-      // runs on a 5s poll, and the old `error.value = null` on entry meant
-      // any real error banner survived at most one poll tick.
-      if (!error.value) {
-        error.value = err instanceof Error ? err.message : 'Failed to fetch mesh status'
-      }
+      error.value = err instanceof Error ? err.message : 'Failed to fetch mesh status'
     } finally {
       loading.value = false
     }
@@ -379,32 +358,6 @@ export const useMeshStore = defineStore('mesh', () => {
       timeout: 45000, // serial probes are slow (multi-firmware handshakes)
     })
   }
-  /** Available firmware version(s) for a family — v1 only ever returns
-   *  ["latest"], since firmware is always fetched from upstream at flash
-   *  time rather than pinned/bundled. */
-  async function flashListFirmware(family: FlashFirmwareFamily): Promise<string[]> {
-    const res = await rpcClient.call<{ versions: string[] }>({
-      method: 'mesh.flash-list-firmware',
-      params: { family },
-    })
-    return res.versions
-  }
-  /** Erase + reflash a detected radio. `board` is optional — omit it to let
-   *  the backend auto-resolve from the port's USB vid:pid; if that fails
-   *  (e.g. Heltec V4 not yet in the vid:pid table), it errors and the UI
-   *  must ask the user to pick the board explicitly. Always erases first. */
-  async function flashDevice(path: string, family: FlashFirmwareFamily, board?: FlashBoard): Promise<void> {
-    await rpcClient.call({
-      method: 'mesh.flash-device',
-      params: board ? { path, family, board } : { path, family },
-    })
-  }
-  async function flashStatus(): Promise<FlashJobStatus> {
-    return rpcClient.call<FlashJobStatus>({ method: 'mesh.flash-status' })
-  }
-  async function flashCancel(): Promise<void> {
-    await rpcClient.call({ method: 'mesh.flash-cancel' })
-  }
   let globalDetectTimer: ReturnType<typeof setInterval> | null = null
   /** App-wide light poll so the detected-device modal works on every page
    *  (the Mesh view's own 5s poll takes over while it is mounted). */
@@ -1022,18 +975,6 @@ export const useMeshStore = defineStore('mesh', () => {
     await Promise.all([fetchStatus(), fetchPeers(), fetchMessages(), fetchDeadmanStatus(), fetchBlockHeaders()])
   }
 
-  /** Ask the backend to actively re-query the radio's contact table (and by
-   *  extension re-drain daemon events for Reticulum) — the server-side half
-   *  of the Refresh button; refreshAll() alone only re-reads caches. */
-  async function refreshRadio(): Promise<boolean> {
-    try {
-      const res = await rpcClient.call<{ refreshed: boolean }>({ method: 'mesh.refresh' })
-      return !!res.refreshed
-    } catch {
-      return false
-    }
-  }
-
   return {
     status,
     peers,
@@ -1053,10 +994,6 @@ export const useMeshStore = defineStore('mesh', () => {
     undismissedDetectedDevices,
     dismissDetectedDevice,
     probeDevice,
-    flashListFirmware,
-    flashDevice,
-    flashStatus,
-    flashCancel,
     startGlobalDetection,
     fetchPeers,
     fetchMessages,
@@ -1065,7 +1002,6 @@ export const useMeshStore = defineStore('mesh', () => {
     broadcastIdentity,
     configure,
     refreshAll,
-    refreshRadio,
     markChatRead,
     clearViewingChat,
     sendInvoice,

neode-ui/src/stores/resources.ts

@@ -1,166 +0,0 @@
-// Shared cache for RPC-backed page data (the "stale-while-revalidate" layer).
-//
-// Pages used to fetch-on-mount with a spinner on every navigation — Dashboard
-// keys its router-view by route.path, so each visit unmounted and refetched
-// everything. This store is the single place resource state lives instead:
-// keyed entries survive navigation (Pinia) and reloads (sessionStorage
-// snapshot), and `useCachedResource` renders them instantly while
-// revalidating in the background.
-//
-// Semantics (generalized from homeStatus.ts / useFleetData.ts, the proven
-// hand-rolled versions):
-// - sticky-ready: once a key is 'ready' it never regresses to 'loading';
-//   refreshes show as 'refreshing' so the UI keeps the data visible.
-// - keep-last-known-value on error: a failed revalidate leaves data in place
-//   (with `error` set and `fetchedAt` untouched → age badge shows staleness).
-// - in-flight dedup per key: concurrent refreshes collapse into one fetch.
-
-import { defineStore } from 'pinia'
-import { reactive } from 'vue'
-
-export type ResourceLoadState = 'idle' | 'loading' | 'ready' | 'refreshing' | 'error'
-
-export interface ResourceEntry<T = unknown> {
-  data: T | null
-  loadState: ResourceLoadState
-  /** Epoch ms of the last SUCCESSFUL fetch (drives TTL + stale badges). */
-  fetchedAt: number | null
-  error: string | null
-}
-
-const SNAPSHOT_PREFIX = 'resource:'
-
-function readSnapshot<T>(key: string): { data: T; fetchedAt: number } | null {
-  try {
-    const raw = sessionStorage.getItem(SNAPSHOT_PREFIX + key)
-    if (!raw) return null
-    const parsed = JSON.parse(raw)
-    if (parsed && typeof parsed.fetchedAt === 'number' && 'data' in parsed) return parsed
-  } catch {
-    /* corrupt/absent snapshot — fall through to a fresh fetch */
-  }
-  return null
-}
-
-function writeSnapshot(key: string, data: unknown, fetchedAt: number): void {
-  try {
-    sessionStorage.setItem(SNAPSHOT_PREFIX + key, JSON.stringify({ data, fetchedAt }))
-  } catch {
-    /* quota exceeded or unserializable — memory cache still works */
-  }
-}
-
-export const useResourcesStore = defineStore('resources', () => {
-  const entries = reactive(new Map<string, ResourceEntry>())
-  // Non-reactive bookkeeping: in-flight fetches + active revalidators.
-  const inflight = new Map<string, Promise<void>>()
-  const revalidators = new Map<string, Set<() => void>>()
-  const invalidateTimers = new Map<string, ReturnType<typeof setTimeout>>()
-
-  /** Get (or create) the reactive entry for a key, hydrating from the
-   * sessionStorage snapshot on first sight so revisits after a reload paint
-   * before any RPC completes. Pass `persist: false` to skip snapshots. */
-  function entry<T>(key: string, persist = true): ResourceEntry<T> {
-    let e = entries.get(key)
-    if (!e) {
-      const snap = persist ? readSnapshot<T>(key) : null
-      e = reactive<ResourceEntry>({
-        data: snap ? snap.data : null,
-        loadState: snap ? 'ready' : 'idle',
-        fetchedAt: snap ? snap.fetchedAt : null,
-        error: null,
-      })
-      entries.set(key, e)
-    }
-    return e as ResourceEntry<T>
-  }
-
-  /** Run `fetcher` for `key` with sticky-ready + keep-last-value semantics.
-   * Concurrent calls for the same key share one in-flight fetch. */
-  function refresh<T>(
-    key: string,
-    fetcher: () => Promise<T>,
-    opts: { persist?: boolean } = {},
-  ): Promise<void> {
-    const existing = inflight.get(key)
-    if (existing) return existing
-    const e = entry<T>(key, opts.persist ?? true)
-    e.loadState = e.loadState === 'ready' || e.loadState === 'refreshing' ? 'refreshing' : 'loading'
-    const p = (async () => {
-      try {
-        const data = await fetcher()
-        e.data = data
-        e.error = null
-        e.fetchedAt = Date.now()
-        e.loadState = 'ready'
-        if (opts.persist ?? true) writeSnapshot(key, data, e.fetchedAt)
-      } catch (err) {
-        e.error = err instanceof Error ? err.message : String(err)
-        // Keep last-known data visible; only 'error' when we have nothing.
-        e.loadState = e.data !== null ? 'ready' : 'error'
-      } finally {
-        inflight.delete(key)
-      }
-    })()
-    inflight.set(key, p)
-    return p
-  }
-
-  /** Mark a key stale and (debounced) re-run every mounted subscriber's
-   * fetcher. Call after a mutation or on a relevant WS push. */
-  function invalidate(key: string, opts: { debounceMs?: number } = {}): void {
-    const e = entries.get(key)
-    if (e) e.fetchedAt = null
-    const subs = revalidators.get(key)
-    if (!subs || subs.size === 0) return
-    const t = invalidateTimers.get(key)
-    if (t) clearTimeout(t)
-    invalidateTimers.set(
-      key,
-      setTimeout(() => {
-        invalidateTimers.delete(key)
-        for (const fn of subs) fn()
-      }, opts.debounceMs ?? 800),
-    )
-  }
-
-  /** Register a live revalidator for a key (used by useCachedResource);
-   * returns an unsubscribe fn. */
-  function subscribe(key: string, revalidate: () => void): () => void {
-    let subs = revalidators.get(key)
-    if (!subs) {
-      subs = new Set()
-      revalidators.set(key, subs)
-    }
-    subs.add(revalidate)
-    return () => {
-      subs.delete(revalidate)
-    }
-  }
-
-  /** Optimistically apply `update` to the cached value; returns a rollback.
-   * Pattern: rollback on RPC failure (generalized TransportPrefsCard). */
-  function optimistic<T>(key: string, update: (current: T | null) => T): () => void {
-    const e = entry<T>(key)
-    const before = e.data
-    const beforeState = e.loadState
-    e.data = update(before)
-    if (e.loadState === 'idle' || e.loadState === 'error') e.loadState = 'ready'
-    return () => {
-      e.data = before
-      e.loadState = beforeState
-    }
-  }
-
-  /** Drop a key entirely (memory + snapshot). */
-  function evict(key: string): void {
-    entries.delete(key)
-    try {
-      sessionStorage.removeItem(SNAPSHOT_PREFIX + key)
-    } catch {
-      /* noop */
-    }
-  }
-
-  return { entries, entry, refresh, invalidate, subscribe, optimistic, evict }
-})

neode-ui/src/stores/sync.ts

@@ -2,38 +2,9 @@
 
 import { defineStore } from 'pinia'
 import { ref, computed } from 'vue'
-import type { DataModel, PatchOperation } from '../types/api'
+import type { DataModel } from '../types/api'
 import { wsClient, applyDataPatch } from '../api/websocket'
 import { rpcClient } from '../api/rpc-client'
-import { useResourcesStore } from './resources'
-
-/** Unescape one JSON-pointer segment (RFC 6901: ~1 → '/', ~0 → '~'). */
-function pointerSegment(path: string, prefix: string): string {
-  const seg = path.slice(prefix.length).split('/')[0] ?? ''
-  return seg.replace(/~1/g, '/').replace(/~0/g, '~')
-}
-
-/** B5: bridge /ws/db pushes into the cached-resource layer. Each patch op
- * maps to the resource keys whose backing data it changes; invalidate()
- * debounces (800ms) and only refetches keys with mounted subscribers, so a
- * patch storm costs one revalidation per key. The 30s staleness
- * reconciliation stays as the backstop for anything unmapped. */
-function invalidateResourcesForPatch(patch: PatchOperation[]): void {
-  const resources = useResourcesStore()
-  for (const op of patch) {
-    const path = op.path ?? ''
-    if (path.startsWith('/peer-health/')) {
-      // A peer flipping reachability changes both its browse result and the
-      // federation node list's online state.
-      const onion = pointerSegment(path, '/peer-health/')
-      if (onion) resources.invalidate(`cloud.peer-browse:${onion}`)
-      resources.invalidate('federation.nodes')
-    } else if (path.startsWith('/package-data/')) {
-      // App installs/uninstalls add or remove their tor services.
-      resources.invalidate('server.tor-services')
-    }
-  }
-}
 
 export const useSyncStore = defineStore('sync', () => {
   // State
@@ -137,7 +108,6 @@ export const useSyncStore = defineStore('sync', () => {
           try {
             if (import.meta.env.DEV) console.log('[Store] Applying patch at revision', update.rev || 'unknown')
           data.value = applyDataPatch(data.value, update.patch)
-            invalidateResourcesForPatch(update.patch)
             // Mark as connected once we receive any valid patch
             if (!isConnected.value) {
               isConnected.value = true

neode-ui/src/views/Cloud.vue

@@ -194,7 +194,7 @@
             Open Federation
           </RouterLink>
         </div>
-        <div v-else-if="filteredPeerFiles.length === 0 && peerFilesPending === 0" class="glass-card p-8 text-center text-white/40 text-sm">
+        <div v-else-if="filteredPeerFiles.length === 0" class="glass-card p-8 text-center text-white/40 text-sm">
           {{ selectedCategory === 'all' ? 'Your peers are not sharing any files yet.' : 'No peer files in this category.' }}
         </div>
         <div v-else class="space-y-2">
@@ -216,13 +216,6 @@
             <span class="text-[10px] px-2 py-0.5 rounded-full bg-purple-500/15 text-purple-400 shrink-0">{{ f.peerName }}</span>
           </button>
         </div>
-        <p v-if="peerFilesPending > 0" class="text-[11px] text-white/35 text-center mt-3 flex items-center justify-center gap-2">
-          <svg class="animate-spin h-3 w-3" fill="none" viewBox="0 0 24 24">
-            <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-            <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
-          </svg>
-          Still fetching from {{ peerFilesPending }} peer{{ peerFilesPending === 1 ? '' : 's' }}…
-        </p>
         <p v-if="peerFilesErrors > 0" class="text-[11px] text-white/35 text-center mt-3">
           {{ peerFilesErrors }} peer{{ peerFilesErrors === 1 ? '' : 's' }} unreachable — showing what answered.
         </p>
@@ -308,23 +301,12 @@
             <span class="w-1.5 h-1.5 rounded-full" :class="peer.trust_level === 'trusted' ? 'bg-green-400' : 'bg-purple-400'"></span>
             {{ peer.trust_level }}
           </span>
-          <!-- Live transport badge — which route actually served the last
-               browse (FIPS = direct mesh, fast; Tor = fallback, slow). -->
-          <span
-            v-if="peerTransport(peer.onion)"
-            class="inline-flex items-center gap-1.5 px-2 py-1 rounded-full"
-            :class="peerTransport(peer.onion)!.transport === 'fips' ? 'bg-emerald-500/15 text-emerald-300' : 'bg-amber-500/15 text-amber-300'"
-            :title="`Last browse served via ${peerTransport(peer.onion)!.transport.toUpperCase()}`"
-          >
-            <span class="w-1.5 h-1.5 rounded-full" :class="peerTransport(peer.onion)!.transport === 'fips' ? 'bg-emerald-400' : 'bg-amber-400'"></span>
-            {{ peerTransport(peer.onion)!.transport.toUpperCase() }} · {{ (peerTransport(peer.onion)!.latencyMs / 1000).toFixed(1) }}s
-          </span>
-          <span v-else class="text-white/30">Peer Node</span>
+          <span class="text-white/30">Peer Node</span>
         </div>
       </div>
 
       <div
-        v-if="(peersLoading || peersRefreshing) && peerNodes.length > 0"
+        v-if="peersLoading && peerNodes.length > 0"
         class="glass-card p-3 text-center text-white/45 text-xs md:col-span-2 lg:col-span-3 flex items-center justify-center gap-2"
       >
         <svg class="animate-spin h-3.5 w-3.5" fill="none" viewBox="0 0 24 24">
@@ -406,8 +388,6 @@ import { computed, ref, watch, onMounted } from 'vue'
 import { useRouter, RouterLink } from 'vue-router'
 import { useAppStore } from '../stores/app'
 import { useCloudStore } from '../stores/cloud'
-import { useResourcesStore } from '../stores/resources'
-import { useCachedResource } from '../composables/useCachedResource'
 import { fileBrowserClient, type FileBrowserItem } from '@/api/filebrowser-client'
 import { rpcClient } from '@/api/rpc-client'
 import { getFileCategory } from '../composables/useFileType'
@@ -419,19 +399,9 @@ import MediaLightbox from '../components/cloud/MediaLightbox.vue'
 const router = useRouter()
 const store = useAppStore()
 const cloudStore = useCloudStore()
-const resources = useResourcesStore()
 const audioPlayer = useAudioPlayer()
-
-// Section counts — cached: revisits render the last-known counts instantly
-// and refresh in the background (sticky-ready never regresses to "Loading").
-const countsResource = useCachedResource<Record<string, number>>({
-  key: 'cloud.section-counts',
-  fetcher: fetchCounts,
-  ttlMs: 30_000,
-  immediate: false, // gated on fileBrowserRunning; kicked from onMounted/watch
-})
-const sectionCounts = computed(() => countsResource.entry.data ?? {})
-const countsLoading = computed(() => countsResource.entry.loadState === 'loading')
+const sectionCounts = ref<Record<string, number>>({})
+const countsLoading = ref(false)
 
 // ── Tabs / categories / search state ────────────────────────────────────────
 type TabId = 'folders' | 'mine' | 'peers' | 'paid'
@@ -454,18 +424,14 @@ const activeTab = ref<TabId>('folders')
 
 // ── Paid Files tab ──────────────────────────────────────────────────────────
 interface PaidItem { onion: string; content_id: string; filename: string; mime_type: string; size_bytes: number; paid_sats: number; purchased_at: string }
-const paidResource = useCachedResource<PaidItem[]>({
-  key: 'cloud.paid-items',
-  fetcher: async (signal) => {
-    const res = await rpcClient.call<{ items: PaidItem[] }>({ method: 'content.owned-list', signal, dedup: true })
-    return (res.items || []).slice().reverse()
-  },
-  immediate: false, // loaded when the Paid tab is opened
-})
-const paidItems = computed(() => paidResource.entry.data ?? [])
-const paidLoading = computed(() => paidResource.entry.loadState === 'loading')
-function loadPaidItems() {
-  return paidResource.refresh()
+const paidItems = ref<PaidItem[]>([])
+const paidLoading = ref(false)
+async function loadPaidItems() {
+  paidLoading.value = true
+  try {
+    const res = await rpcClient.call<{ items: PaidItem[] }>({ method: 'content.owned-list' })
+    paidItems.value = (res.items || []).slice().reverse()
+  } catch { paidItems.value = [] } finally { paidLoading.value = false }
 }
 async function viewPaidItem(it: PaidItem) {
   try {
@@ -507,21 +473,8 @@ interface PeerNode {
   trust_level: string
 }
 
-// Federation peers — cached so the Folders tab's peer cards paint instantly
-// on revisit while the list revalidates behind them.
-const peersResource = useCachedResource<PeerNode[]>({
-  key: 'cloud.peer-nodes',
-  fetcher: async (signal) => {
-    const result = await rpcClient.federationListNodes()
-    void signal
-    return result?.nodes ?? []
-  },
-  ttlMs: 30_000,
-  immediate: false, // kicked from onMounted (keeps the legacy load order)
-})
-const peerNodes = computed(() => peersResource.entry.data ?? [])
-const peersLoading = computed(() => peersResource.entry.loadState === 'loading')
-const peersRefreshing = computed(() => peersResource.entry.loadState === 'refreshing')
+const peerNodes = ref<PeerNode[]>([])
+const peersLoading = ref(true)
 const loadError = ref('')
 
 const APP_ALIASES: Record<string, string[]> = {
@@ -626,51 +579,42 @@ function formatSize(bytes: number): string {
 }
 
 // ── My Files (flat list of every own file across the sections) ──────────────
-// Cached: revisiting the tab renders the last walk instantly and re-walks in
-// the background only when stale.
-const myFilesResource = useCachedResource<FileBrowserItem[]>({
-  key: 'cloud.my-files',
-  fetcher: fetchMyFiles,
-  ttlMs: 60_000,
-  immediate: false, // loaded when the My Files tab (or search) needs it
-})
-const myFiles = computed(() => myFilesResource.entry.data ?? [])
-const myFilesLoading = computed(() => myFilesResource.entry.loadState === 'loading')
+const myFiles = ref<FileBrowserItem[]>([])
+const myFilesLoading = ref(false)
+const myFilesLoaded = ref(false)
 
 /** Depth-limited walk of the section folders; flat file list, capped. */
-async function fetchMyFiles(): Promise<FileBrowserItem[]> {
-  if (!fileBrowserRunning.value) return []
-  const ok = await cloudStore.init()
-  if (!ok) return []
-  const out: FileBrowserItem[] = []
-  for (const [sectionId, root] of Object.entries(SECTION_PATHS)) {
-    if (sectionId === 'files') continue // '/' would double-visit the sections
-    const queue: Array<{ path: string; depth: number }> = [{ path: root, depth: 0 }]
-    while (queue.length > 0 && out.length < 500) {
-      const { path, depth } = queue.shift()!
-      let items: FileBrowserItem[]
-      try { items = await fileBrowserClient.listDirectory(path) } catch { continue }
-      for (const item of items) {
-        const itemPath = item.path || `${path.replace(/\/$/, '')}/${item.name}`
-        if (item.isDir) {
-          if (depth < 3) queue.push({ path: itemPath, depth: depth + 1 })
-        } else {
-          out.push({ ...item, path: itemPath })
+async function loadMyFiles(force = false) {
+  if (myFilesLoading.value || (myFilesLoaded.value && !force)) return
+  if (!fileBrowserRunning.value) { myFilesLoaded.value = true; return }
+  myFilesLoading.value = true
+  try {
+    const ok = await cloudStore.init()
+    if (!ok) return
+    const out: FileBrowserItem[] = []
+    for (const [sectionId, root] of Object.entries(SECTION_PATHS)) {
+      if (sectionId === 'files') continue // '/' would double-visit the sections
+      const queue: Array<{ path: string; depth: number }> = [{ path: root, depth: 0 }]
+      while (queue.length > 0 && out.length < 500) {
+        const { path, depth } = queue.shift()!
+        let items: FileBrowserItem[]
+        try { items = await fileBrowserClient.listDirectory(path) } catch { continue }
+        for (const item of items) {
+          const itemPath = item.path || `${path.replace(/\/$/, '')}/${item.name}`
+          if (item.isDir) {
+            if (depth < 3) queue.push({ path: itemPath, depth: depth + 1 })
+          } else {
+            out.push({ ...item, path: itemPath })
+          }
         }
       }
     }
+    out.sort((a, b) => a.name.localeCompare(b.name))
+    myFiles.value = out
+    myFilesLoaded.value = true
+  } finally {
+    myFilesLoading.value = false
   }
-  out.sort((a, b) => a.name.localeCompare(b.name))
-  return out
-}
-
-/** Load if never fetched or stale; `force` always re-walks. */
-function loadMyFiles(force = false): Promise<void> {
-  if (force) return myFilesResource.refresh()
-  if (myFilesResource.entry.data === null || myFilesResource.isStale.value) {
-    return myFilesResource.refresh()
-  }
-  return Promise.resolve()
 }
 
 const filteredMyFiles = computed(() =>
@@ -724,8 +668,7 @@ function handlePreview(path: string, context: FileBrowserItem[]) {
 async function handleDelete(path: string) {
   try {
     await cloudStore.deleteItem(path)
-    // Delete confirmed — update the cache in place (no rollback needed).
-    myFilesResource.optimistic((cur) => (cur ?? []).filter(f => f.path !== path))
+    myFiles.value = myFiles.value.filter(f => f.path !== path)
     searchResults.value = searchResults.value.filter(r => r.item?.path !== path)
   } catch (e) {
     loadError.value = e instanceof Error ? e.message : 'Delete failed'
@@ -743,6 +686,11 @@ interface PeerFileEntry {
   peerOnion: string
 }
 
+const peerFiles = ref<PeerFileEntry[]>([])
+const peerFilesLoading = ref(false)
+const peerFilesLoaded = ref(false)
+const peerFilesErrors = ref(0)
+
 interface CatalogItem {
   id: string
   filename: string
@@ -756,96 +704,46 @@ function priceOf(access: CatalogItem['access']): number {
   return typeof access === 'object' && access?.paid ? access.paid.price_sats : 0
 }
 
-// Per-peer browse results live as individual cached entries so (a) each
-// peer's card/rows render the moment THAT peer answers — no more blocking on
-// the slowest peer via Promise.allSettled — and (b) revisits paint from
-// cache. The response's `transport` (fips/tor) + measured latency ride
-// along, giving every peer a live transport badge.
-interface PeerBrowse {
-  items: CatalogItem[]
-  transport: string | null
-  latencyMs: number
-}
-
-const peerBrowseKey = (onion: string) => `cloud.peer-browse:${onion}`
-
-function browsePeer(peer: PeerNode): Promise<void> {
-  return resources.refresh<PeerBrowse>(peerBrowseKey(peer.onion), async () => {
-    const t0 = Date.now()
-    const res = await rpcClient.call<{ items?: CatalogItem[]; transport?: string }>({
-      method: 'content.browse-peer',
-      params: { onion: peer.onion },
-      timeout: 30000,
-      // One slow/unreachable peer must cost its timeout ONCE, not ×3 —
-      // the retry loop is why one dead peer meant a 90s spinner.
-      maxRetries: 1,
-      dedup: true,
-    })
-    return { items: res?.items ?? [], transport: res?.transport ?? null, latencyMs: Date.now() - t0 }
-  })
-}
-
-function peerBrowseEntry(onion: string) {
-  return resources.entry<PeerBrowse>(peerBrowseKey(onion))
-}
-
-/** Transport badge data for a peer (null until its first browse resolves). */
-function peerTransport(onion: string): { transport: string; latencyMs: number } | null {
-  const e = peerBrowseEntry(onion)
-  if (!e.data?.transport) return null
-  return { transport: e.data.transport, latencyMs: e.data.latencyMs }
-}
-
-/** Aggregated peer files, incrementally updated as each peer resolves. */
-const peerFiles = computed<PeerFileEntry[]>(() => {
-  const merged: PeerFileEntry[] = []
-  for (const peer of peerNodes.value) {
-    const e = peerBrowseEntry(peer.onion)
-    if (!e.data) continue
-    const peerName = peer.name || peerDisplayName(peer.did)
-    for (const item of e.data.items) {
-      merged.push({
-        key: `${peer.onion}:${item.id}`,
-        filename: item.filename,
-        sizeBytes: item.size_bytes,
-        priceSats: priceOf(item.access),
-        category: categoryOf(item.mime_type || item.filename),
-        peerName,
-        peerOnion: peer.onion,
-      })
-    }
-  }
-  merged.sort((a, b) => a.filename.localeCompare(b.filename))
-  return merged
-})
-
-/** Peers still on their first in-flight browse (nothing cached yet). */
-const peerFilesPending = computed(() =>
-  peerNodes.value.filter(p => {
-    const s = peerBrowseEntry(p.onion).loadState
-    return s === 'loading' || s === 'idle'
-  }).length,
-)
-/** Peers whose browse failed with no cached data to show. */
-const peerFilesErrors = computed(() =>
-  peerNodes.value.filter(p => peerBrowseEntry(p.onion).loadState === 'error').length,
-)
-/** All-or-nothing spinner ONLY when nothing has ever been cached. */
-const peerFilesLoading = computed(() =>
-  peerNodes.value.length > 0 && peerFiles.value.length === 0 && peerFilesPending.value > 0 && peerFilesErrors.value < peerNodes.value.length,
-)
-
-/** Fan out content.browse-peer; each peer renders as it resolves. */
+/** Fan out content.browse-peer over every federation node; tolerate stragglers. */
 async function loadPeerFiles(force = false) {
-  if (peerNodes.value.length === 0) await loadPeers()
-  const targets = peerNodes.value.filter(p => {
-    if (force) return true
-    const e = peerBrowseEntry(p.onion)
-    const stale = e.fetchedAt === null || Date.now() - e.fetchedAt > 30_000
-    return e.loadState === 'idle' || e.loadState === 'error' ? true : stale
-  })
-  // Fire-and-collect: the computed aggregation updates per resolution.
-  await Promise.allSettled(targets.map(p => browsePeer(p)))
+  if (peerFilesLoading.value || (peerFilesLoaded.value && !force)) return
+  peerFilesLoading.value = true
+  peerFilesErrors.value = 0
+  try {
+    if (peerNodes.value.length === 0) await loadPeers()
+    const results = await Promise.allSettled(
+      peerNodes.value.map(async (peer) => {
+        const res = await rpcClient.call<{ items?: CatalogItem[] }>({
+          method: 'content.browse-peer',
+          params: { onion: peer.onion },
+          timeout: 30000,
+        })
+        return { peer, items: res?.items ?? [] }
+      }),
+    )
+    const merged: PeerFileEntry[] = []
+    for (const r of results) {
+      if (r.status !== 'fulfilled') { peerFilesErrors.value++; continue }
+      const { peer, items } = r.value
+      const peerName = peer.name || peerDisplayName(peer.did)
+      for (const item of items) {
+        merged.push({
+          key: `${peer.onion}:${item.id}`,
+          filename: item.filename,
+          sizeBytes: item.size_bytes,
+          priceSats: priceOf(item.access),
+          category: categoryOf(item.mime_type || item.filename),
+          peerName,
+          peerOnion: peer.onion,
+        })
+      }
+    }
+    merged.sort((a, b) => a.filename.localeCompare(b.filename))
+    peerFiles.value = merged
+    peerFilesLoaded.value = true
+  } finally {
+    peerFilesLoading.value = false
+  }
 }
 
 const filteredPeerFiles = computed(() =>
@@ -923,50 +821,47 @@ const searchMineItems = computed(() =>
 )
 
 // ── Existing counts / peers loading ──────────────────────────────────────────
-async function fetchCounts(): Promise<Record<string, number>> {
-  if (!fileBrowserRunning.value) return {}
-  const ok = await fileBrowserClient.login()
-  if (!ok) throw new Error('File Browser login failed')
-  const counts: Record<string, number> = {}
-  for (const section of contentSections) {
-    const path = SECTION_PATHS[section.id]
-    if (!path) continue
-    try {
-      counts[section.id] = (await fileBrowserClient.listDirectory(path)).length
-    } catch {
-      counts[section.id] = 0
+async function loadCounts() {
+  if (!fileBrowserRunning.value) return
+  countsLoading.value = true
+  try {
+    const ok = await fileBrowserClient.login()
+    if (!ok) return
+    for (const section of contentSections) {
+      const path = SECTION_PATHS[section.id]
+      if (!path) continue
+      try {
+        const items = await fileBrowserClient.listDirectory(path)
+        sectionCounts.value[section.id] = items.length
+      } catch {
+        sectionCounts.value[section.id] = 0
+      }
     }
-  }
-  return counts
-}
-
-function loadCounts() {
-  if (countsResource.entry.data === null || countsResource.isStale.value) {
-    void countsResource.refresh()
+  } catch (e) {
+    loadError.value = e instanceof Error ? e.message : 'Failed to load file counts'
+    if (import.meta.env.DEV) console.warn('FileBrowser count loading failed', e)
+  } finally {
+    countsLoading.value = false
   }
 }
 
-onMounted(async () => {
+onMounted(() => {
   loadCounts()
-  await loadPeers()
-  // Warm the per-peer browse cache in the background: peer cards get their
-  // FIPS/Tor badge and the Peer Files tab is instant. Staleness-gated, so
-  // quick revisits don't refetch.
-  void loadPeerFiles()
-})
-
-// File Browser can finish its startup scan after we mount — pick counts up
-// the moment it becomes available instead of showing a permanent blank.
-watch(fileBrowserRunning, (running) => {
-  if (running) loadCounts()
+  loadPeers()
 })
 
 async function loadPeers() {
-  await peersResource.refresh()
-  // Surface refresh failures in the banner — the cached peer list stays
-  // visible either way (keep-last-known-value).
-  const e = peersResource.entry
-  if (e.error) loadError.value = e.error
+  const hadPeers = peerNodes.value.length > 0
+  peersLoading.value = true
+  try {
+    const result = await rpcClient.federationListNodes()
+    peerNodes.value = result?.nodes ?? []
+  } catch (e) {
+    if (!hadPeers) peerNodes.value = []
+    loadError.value = e instanceof Error ? e.message : 'Failed to load peer nodes'
+  } finally {
+    peersLoading.value = false
+  }
 }
 
 function peerDisplayName(did: string): string {

neode-ui/src/views/CloudFolder.vue

@@ -306,12 +306,12 @@ const backLabel = computed(() => {
   return atSectionRoot.value ? 'Back to Cloud' : 'Back to Parent Folder'
 })
 
-// Initialize native file browser when entering a native-UI section.
-// No reset() here: navigate() serves the per-path cache instantly and
-// revalidates underneath — resetting wiped the listing and forced a
-// spinner on every folder entry.
+// Initialize native file browser when entering a native-UI section
 watch([useNativeUI, section, routeFolderPath], async ([native, sec, path]) => {
   if (native && sec) {
+    if (cloudStore.currentPath !== path) {
+      cloudStore.reset()
+    }
     const ok = await cloudStore.init()
     if (ok) {
       await cloudStore.navigate(path)

neode-ui/src/views/Credentials.vue

@@ -199,9 +199,8 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed } from 'vue'
+import { ref, onMounted } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import BackButton from '@/components/BackButton.vue'
 
 interface Identity {
@@ -229,30 +228,9 @@ interface Credential {
   status: string
 }
 
-// Cached: revisits paint identities/credentials instantly and revalidate
-// behind them (errors keep the last-known lists).
-const identitiesRes = useCachedResource<Identity[]>({
-  key: 'credentials.identities',
-  fetcher: async (signal) => {
-    const result = await rpcClient.call<{ identities: Identity[] }>({
-      method: 'identity.list', params: {}, signal, dedup: true, maxRetries: 1,
-    })
-    return result?.identities || []
-  },
-})
-const credentialsRes = useCachedResource<Credential[]>({
-  key: 'credentials.list',
-  fetcher: async (signal) => {
-    const result = await rpcClient.call<{ credentials: Credential[] }>({
-      method: 'identity.list-credentials', params: {}, signal, dedup: true, maxRetries: 1,
-    })
-    return result?.credentials || []
-  },
-})
-const identities = computed(() => identitiesRes.data.value ?? [])
-const credentials = computed(() => credentialsRes.data.value ?? [])
-const loadingCreds = computed(() =>
-  credentialsRes.loadState.value === 'loading' || credentialsRes.loadState.value === 'refreshing')
+const identities = ref<Identity[]>([])
+const credentials = ref<Credential[]>([])
+const loadingCreds = ref(false)
 const selectedCredential = ref<Credential | null>(null)
 const credCopied = ref(false)
 const revoking = ref(false)
@@ -302,10 +280,31 @@ function formatClaims(subject: Record<string, unknown>): string {
   return JSON.stringify(claims, null, 2)
 }
 
+async function loadIdentities() {
+  try {
+    const result = await rpcClient.call<{ identities: Identity[] }>({
+      method: 'identity.list',
+      params: {},
+    })
+    identities.value = result.identities || []
+  } catch (e) {
+    identities.value = []
+    if (import.meta.env.DEV) console.warn('Failed to load identities:', e)
+  }
+}
+
 async function loadCredentials() {
-  await credentialsRes.refresh()
-  if (credentialsRes.error.value) {
-    showToast(`Failed to load credentials: ${credentialsRes.error.value}`, 'error')
+  loadingCreds.value = true
+  try {
+    const result = await rpcClient.call<{ credentials: Credential[] }>({
+      method: 'identity.list-credentials',
+      params: {},
+    })
+    credentials.value = result.credentials || []
+  } catch (e) {
+    showToast(`Failed to load credentials: ${e instanceof Error ? e.message : 'Unknown error'}`, 'error')
+  } finally {
+    loadingCreds.value = false
   }
 }
 
@@ -405,8 +404,9 @@ async function copyCredentialJson() {
   setTimeout(() => { credCopied.value = false }, 2000)
 }
 
-// Both resources fetch themselves on first use (skipping the fetch entirely
-// when the cached value is fresh).
+onMounted(async () => {
+  await Promise.all([loadIdentities(), loadCredentials()])
+})
 
 defineExpose({ credentials, loadCredentials })
 </script>

neode-ui/src/views/Federation.vue

@@ -229,7 +229,6 @@
 <script setup lang="ts">
 import { ref, computed, onMounted, onUnmounted } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import { useTransportStore } from '@/stores/transport'
 import { useAppStore } from '@/stores/app'
 import { useSyncStore } from '@/stores/sync'
@@ -251,15 +250,8 @@ const transportStore = useTransportStore()
 const appStore = useAppStore()
 const syncStore = useSyncStore()
 
-// Cached: revisits paint the node list instantly; the 5s poll and mutation
-// refreshes revalidate behind it. `loading` is initial-load only (background
-// refreshes keep content on screen — the old showLoader:false semantics).
-const nodesRes = useCachedResource<FederatedNode[]>({
-  key: 'federation.nodes',
-  fetcher: async () => (await rpcClient.federationListNodes()).nodes,
-})
-const nodes = computed(() => nodesRes.data.value ?? [])
-const loading = computed(() => nodesRes.loadState.value === 'loading')
+const nodes = ref<FederatedNode[]>([])
+const loading = ref(true)
 const error = ref('')
 const selectedNode = ref<FederatedNode | null>(null)
 const inviteType = ref<'trusted' | 'observer'>('trusted')
@@ -328,12 +320,7 @@ const mapLinks = computed(() => {
   }))
 })
 
-const dwnStatusRes = useCachedResource<DwnStatus>({
-  key: 'federation.dwn-status',
-  fetcher: (signal) => rpcClient.call<DwnStatus>({ method: 'dwn.status', signal, dedup: true, maxRetries: 1 }),
-  immediate: false,
-})
-const dwnStatus = computed(() => dwnStatusRes.data.value)
+const dwnStatus = ref<DwnStatus | null>(null)
 const dwnSyncing = ref(false)
 
 const dwnSyncDotClass = computed(() => {
@@ -513,13 +500,25 @@ function isOnlineCheck(node: FederatedNode): boolean {
   return lastSeen > tenMinutesAgo
 }
 
-/** Explicit reload (mutations, retry): surfaces a load failure in the error
- *  banner. The background poll calls nodesRes.refresh() directly and stays
- *  silent, like the old surfaceErrors:false path. */
 async function loadNodes() {
-  await nodesRes.refresh()
-  if (nodesRes.error.value) error.value = nodesRes.error.value
-  else error.value = ''
+  return loadNodesWithOptions()
+}
+
+async function loadNodesWithOptions(options: { showLoader?: boolean; surfaceErrors?: boolean } = {}) {
+  const showLoader = options.showLoader ?? nodes.value.length === 0
+  const surfaceErrors = options.surfaceErrors ?? true
+  try {
+    if (showLoader) loading.value = true
+    const result = await rpcClient.federationListNodes()
+    nodes.value = result.nodes
+    error.value = ''
+  } catch (e) {
+    if (surfaceErrors) {
+      error.value = e instanceof Error ? e.message : 'Failed to load nodes'
+    }
+  } finally {
+    if (showLoader) loading.value = false
+  }
 }
 
 function handleGenerateInvite(type: 'trusted' | 'observer') {
@@ -611,8 +610,13 @@ async function deployApp(did: string, appId: string) {
   }
 }
 
-function loadDwnStatus() {
-  return dwnStatusRes.refresh()
+async function loadDwnStatus() {
+  try {
+    const result = await rpcClient.call<DwnStatus>({ method: 'dwn.status' })
+    dwnStatus.value = result
+  } catch {
+    dwnStatus.value = null
+  }
 }
 
 async function triggerDwnSync() {
@@ -677,6 +681,7 @@ async function rotateDid(password: string) {
 let autoRefreshTimer: ReturnType<typeof setInterval> | null = null
 
 onMounted(async () => {
+  loadNodesWithOptions({ showLoader: true })
   loadDwnStatus()
   loadDiscoveryState()
   loadPendingRequests()
@@ -689,7 +694,7 @@ onMounted(async () => {
     // Self DID not available
   }
   autoRefreshTimer = setInterval(() => {
-    void nodesRes.refresh()
+    loadNodesWithOptions({ showLoader: false, surfaceErrors: false })
     loadPendingRequests()
   }, 5000)
 })

neode-ui/src/views/Mesh.vue

@@ -38,8 +38,6 @@ const activeChatChannel = ref<{ index: number; name: string } | null>(null)
 const messageText = ref('')
 const sendError = ref('')
 const broadcasting = ref(false)
-const broadcastResult = ref<string | null>(null) // 'ok' | error message
-const refreshing = ref(false)
 const configuring = ref(false)
 const connectingDevice = ref<string | null>(null)
 // Device-detected onboarding now lives in the global MeshDeviceSetupModal (App.vue).
@@ -385,22 +383,12 @@ onMounted(async () => {
     archPollInterval = setInterval(loadArchMessages, 15000)
   }
   if (!pollInterval) {
-    let tick = 0
     pollInterval = setInterval(() => {
       mesh.fetchStatus()
       mesh.fetchPeers()
       mesh.fetchMessages()
       mesh.fetchDeadmanStatus()
       mesh.fetchBlockHeaders()
-      // Contacts/aliases, federation nodes and the outbox badge previously
-      // loaded ONCE at mount and went permanently stale — new federation
-      // peers or renames never appeared without a full page reload. Every
-      // 6th tick (~30s) keeps them fresh without adding per-5s load.
-      if (++tick % 6 === 0) {
-        void refreshContacts()
-        void refreshFederationNodes()
-        void refreshOutboxCount()
-      }
     }, 5000)
   }
 
@@ -1033,37 +1021,7 @@ function onChatWheel(e: WheelEvent) {
 
 async function handleBroadcast() {
   broadcasting.value = true
-  broadcastResult.value = null
-  try {
-    await mesh.broadcastIdentity()
-    broadcastResult.value = 'ok'
-  } catch (e) {
-    broadcastResult.value = e instanceof Error ? e.message : 'Broadcast failed'
-  } finally {
-    broadcasting.value = false
-    setTimeout(() => { broadcastResult.value = null }, 4000)
-  }
-}
-
-async function handleRefresh() {
-  if (refreshing.value) return
-  refreshing.value = true
-  try {
-    // Backend first: re-query the radio's contact table (mesh.refresh), then
-    // re-read EVERYTHING the list is built from — peers, contacts/aliases,
-    // federation nodes, outbox — not just the mesh caches.
-    await Promise.allSettled([
-      mesh.refreshRadio(),
-      mesh.refreshAll(),
-      refreshContacts(),
-      refreshFederationNodes(),
-      refreshOutboxCount(),
-    ])
-    // Radio contact refresh is async on the backend — pick up its result.
-    await mesh.fetchPeers()
-  } finally {
-    refreshing.value = false
-  }
+  try { await mesh.broadcastIdentity() } finally { broadcasting.value = false }
 }
 
 async function handleToggleEnabled() {
@@ -1872,14 +1830,8 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
           <button class="glass-button mesh-action-btn" :disabled="configuring" @click="handleToggleEnabled">
             {{ mesh.status?.enabled ? 'Disable' : 'Enable' }}
           </button>
-          <button
-            class="glass-button mesh-action-btn"
-            :class="broadcastResult === 'ok' ? 'mesh-action-ok' : ''"
-            :disabled="!mesh.status?.device_connected || broadcasting"
-            :title="broadcastResult && broadcastResult !== 'ok' ? broadcastResult : 'Announce this node so nearby radios learn about it'"
-            @click="handleBroadcast"
-          >
-            {{ broadcasting ? 'Sending…' : broadcastResult === 'ok' ? 'Sent ✓' : broadcastResult ? 'Failed ✕' : 'Broadcast' }}
+          <button class="glass-button mesh-action-btn" :disabled="!mesh.status?.device_connected || broadcasting" @click="handleBroadcast">
+            {{ broadcasting ? 'Sending...' : 'Broadcast' }}
           </button>
           <button
             class="glass-button mesh-action-btn"
@@ -1889,10 +1841,7 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
           >
             {{ transport.meshOnly ? 'Go Online' : 'Off-Grid' }}
           </button>
-          <button class="glass-button mesh-action-btn" :disabled="refreshing" @click="handleRefresh">
-            <span v-if="refreshing" class="mesh-refresh-spinner" aria-hidden="true"></span>
-            {{ refreshing ? 'Refreshing…' : 'Refresh' }}
-          </button>
+          <button class="glass-button mesh-action-btn" @click="mesh.refreshAll()">Refresh</button>
         </div>
 
         <!-- Peers list -->
@@ -1922,10 +1871,7 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
             >&times;</button>
           </div>
 
-          <!-- Only claim "no peers" when the MERGED list (radio + federation)
-               is truly empty — with no radio attached the federation rows and
-               the two channel rows must still render. -->
-          <div v-if="displayedPeers.length === 0 && !mesh.status?.device_connected" class="mesh-empty">
+          <div v-if="mesh.peers.length === 0 && !mesh.status?.device_connected" class="mesh-empty">
             No peers discovered yet.
           </div>
 
@@ -2194,14 +2140,8 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
                         <button
                           class="mesh-typed-content-download-btn"
                           title="Download"
-                          aria-label="Download image"
                           @click="downloadAttachment(msg.typed_payload as any)"
-                        >
-                          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-                            <path d="M12 4v11m0 0l-4.5-4.5M12 15l4.5-4.5" />
-                            <path d="M5 19h14" />
-                          </svg>
-                        </button>
+                        >&#x2B07;</button>
                       </div>
                       <audio
                         v-else-if="(msg.typed_payload.mime || '').startsWith('audio/')"
@@ -2225,19 +2165,10 @@ async function downloadAttachment(payload: MeshAttachmentPayload) {
                         @click="openMeshLightbox(msg.typed_payload as any)"
                       />
                       <button
-                        class="mesh-typed-content-fetch-btn"
+                        class="btn"
                         :disabled="fetchingCids.has(msg.typed_payload.cid)"
                         @click="handleFetchContent(msg.typed_payload as any)"
                       >
-                        <span
-                          v-if="fetchingCids.has(msg.typed_payload.cid)"
-                          class="mesh-refresh-spinner"
-                          aria-hidden="true"
-                        ></span>
-                        <svg v-else viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-                          <path d="M12 4v11m0 0l-4.5-4.5M12 15l4.5-4.5" />
-                          <path d="M5 19h14" />
-                        </svg>
                         {{ fetchingCids.has(msg.typed_payload.cid) ? 'Fetching…' : 'Download' }}
                       </button>
                     </template>

neode-ui/src/views/Monitoring.vue

@@ -218,7 +218,6 @@ import { ref, computed, onMounted, onUnmounted } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import { useHomeStatusStore } from '@/stores/homeStatus'
 import BackButton from '@/components/BackButton.vue'
 import LineChart from '@/components/LineChart.vue'
@@ -292,51 +291,11 @@ const backTarget = computed(() => (cameFromHome.value ? '/dashboard' : '/dashboa
 const backLabel = computed(() => (cameFromHome.value ? t('common.back') : 'Web5'))
 const homeStatus = useHomeStatusStore()
 
-// Cached: revisits paint the last snapshot/chart/alerts instantly and the 5s
-// poll revalidates behind them; errors keep the last-known values.
-const currentRes = useCachedResource<MetricSnapshot>({
-  key: 'monitoring.current',
-  fetcher: async (signal) => {
-    const data = await rpcClient.call<MetricSnapshot | { status: string }>({
-      method: 'monitoring.current', signal, dedup: true, maxRetries: 1,
-    })
-    if (!data || !('system' in data)) throw new Error('metrics not ready')
-    return data
-  },
-})
-const historyRes = useCachedResource<MetricSnapshot[]>({
-  key: 'monitoring.history.minute60',
-  fetcher: async (signal) => {
-    const data = await rpcClient.call<HistoryResponse>({
-      method: 'monitoring.history', params: { resolution: 'minute', count: 60 },
-      signal, dedup: true, maxRetries: 1,
-    })
-    return data?.data ?? []
-  },
-})
-const alertsRes = useCachedResource<FiredAlert[]>({
-  key: 'monitoring.alerts',
-  fetcher: async (signal) => {
-    const data = await rpcClient.call<{ alerts: FiredAlert[] }>({
-      method: 'monitoring.alerts', params: { count: 50 }, signal, dedup: true, maxRetries: 1,
-    })
-    return (data?.alerts ?? []).reverse()
-  },
-})
-const alertRulesRes = useCachedResource<AlertRule[]>({
-  key: 'monitoring.alert-rules',
-  fetcher: async (signal) => {
-    const data = await rpcClient.call<{ rules: AlertRule[] }>({
-      method: 'monitoring.alert-rules', signal, dedup: true, maxRetries: 1,
-    })
-    return data?.rules ?? []
-  },
-})
-const current = computed(() => currentRes.data.value)
-const history = computed(() => historyRes.data.value ?? [])
-const containers = computed<ContainerMetrics[]>(() => currentRes.data.value?.containers ?? [])
-const alerts = computed(() => alertsRes.data.value ?? [])
-const alertRules = computed(() => alertRulesRes.data.value ?? [])
+const current = ref<MetricSnapshot | null>(null)
+const history = ref<MetricSnapshot[]>([])
+const containers = ref<ContainerMetrics[]>([])
+const alerts = ref<FiredAlert[]>([])
+const alertRules = ref<AlertRule[]>([])
 const showAlertConfig = ref(false)
 const chartWidth = ref(380)
 let pollTimer: ReturnType<typeof setInterval> | null = null
@@ -505,10 +464,66 @@ async function exportMetrics(format: 'csv' | 'json') {
   }
 }
 
+async function fetchCurrent() {
+  try {
+    await homeStatus.refreshSystemStats()
+    const data = await rpcClient.call<MetricSnapshot | { status: string }>({
+      method: 'monitoring.current',
+    })
+    if (data && 'system' in data) {
+      current.value = data
+      containers.value = data.containers ?? []
+    }
+  } catch {
+    // Silently retry on next poll
+  }
+}
+
+async function fetchHistory() {
+  try {
+    const data = await rpcClient.call<HistoryResponse>({
+      method: 'monitoring.history',
+      params: { resolution: 'minute', count: 60 },
+    })
+    if (data?.data) {
+      history.value = data.data
+    }
+  } catch {
+    // Silently retry on next poll
+  }
+}
+
+async function fetchAlerts() {
+  try {
+    const data = await rpcClient.call<{ alerts: FiredAlert[] }>({
+      method: 'monitoring.alerts',
+      params: { count: 50 },
+    })
+    if (data?.alerts) {
+      alerts.value = data.alerts.reverse()
+    }
+  } catch {
+    // Silently retry on next poll
+  }
+}
+
+async function fetchAlertRules() {
+  try {
+    const data = await rpcClient.call<{ rules: AlertRule[] }>({
+      method: 'monitoring.alert-rules',
+    })
+    if (data?.rules) {
+      alertRules.value = data.rules
+    }
+  } catch {
+    // Non-critical
+  }
+}
+
 async function toggleAlertRule(kind: string, enabled: boolean) {
   try {
     await rpcClient.call({ method: 'monitoring.configure-alert', params: { kind, enabled } })
-    await alertRulesRes.refresh()
+    await fetchAlertRules()
   } catch {
     // Non-critical
   }
@@ -519,7 +534,7 @@ async function updateThreshold(kind: string, value: string) {
   if (isNaN(threshold) || threshold <= 0) return
   try {
     await rpcClient.call({ method: 'monitoring.configure-alert', params: { kind, threshold } })
-    await alertRulesRes.refresh()
+    await fetchAlertRules()
   } catch {
     // Non-critical
   }
@@ -528,7 +543,7 @@ async function updateThreshold(kind: string, value: string) {
 async function acknowledgeAlert(id: string) {
   try {
     await rpcClient.call({ method: 'monitoring.acknowledge-alert', params: { id } })
-    await alertsRes.refresh()
+    await fetchAlerts()
   } catch {
     // Non-critical
   }
@@ -541,18 +556,18 @@ function updateChartWidth() {
   }
 }
 
-onMounted(() => {
+onMounted(async () => {
   updateChartWidth()
   window.addEventListener('resize', updateChartWidth)
 
-  // The cached resources fetch themselves on first use; the poll keeps the
-  // live view fresh (refreshes dedup in the store).
-  void homeStatus.refreshSystemStats()
-  pollTimer = setInterval(() => {
-    void homeStatus.refreshSystemStats()
-    void currentRes.refresh()
-    void historyRes.refresh()
-    void alertsRes.refresh()
+  await Promise.all([fetchCurrent(), fetchHistory(), fetchAlerts(), fetchAlertRules()])
+
+  pollTimer = setInterval(async () => {
+    try {
+      await Promise.all([fetchCurrent(), fetchHistory(), fetchAlerts()])
+    } catch {
+      // Background poll — ignore transient errors
+    }
   }, 5000)
 })
 

neode-ui/src/views/PeerFiles.vue

@@ -594,11 +594,10 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, reactive, watch, onMounted, onUnmounted } from 'vue'
+import { ref, computed, reactive, watch, onMounted } from 'vue'
 import { useRouter } from 'vue-router'
 import QRCode from 'qrcode'
 import { rpcClient } from '@/api/rpc-client'
-import { useResourcesStore } from '@/stores/resources'
 import { useAudioPlayer } from '@/composables/useAudioPlayer'
 import { pipSupported, togglePip } from '@/utils/pip'
 import BackButton from '@/components/BackButton.vue'
@@ -626,33 +625,16 @@ interface CatalogItem {
   access: string | { paid: { price_sats: number } }
 }
 
-const resources = useResourcesStore()
+const loading = ref(true)
 const currentPeer = ref<PeerNode | null>(null)
+const catalogError = ref('')
+const catalogItems = ref<CatalogItem[]>([])
 const downloading = ref<string | null>(null)
 const playing = ref<string | null>(null)
 const purchaseError = ref<string | null>(null)
-
-// The catalog is the SAME cached entry Cloud.vue's per-peer fan-in fills
-// (`cloud.peer-browse:<onion>`): arriving here from the Cloud page paints
-// the file list instantly from cache and revalidates behind it.
-interface PeerBrowse {
-  items: CatalogItem[]
-  transport: string | null
-  latencyMs: number
-}
-const peerOnion = computed(() => props.peerId || currentPeer.value?.onion || '')
-function browseEntry() {
-  return resources.entry<PeerBrowse>(`cloud.peer-browse:${peerOnion.value}`)
-}
-const catalogItems = computed(() => browseEntry().data?.items ?? [])
-const catalogError = computed(() => browseEntry().error ?? '')
-const loading = computed(() => {
-  const s = browseEntry().loadState
-  return s === 'loading' || s === 'refreshing' || (s === 'idle' && !!peerOnion.value)
-})
 // Transport actually used to reach this peer (returned by content.browse-peer)
 // so we can show a FIPS/Tor pill instead of always assuming Tor (B21).
-const transport = computed(() => browseEntry().data?.transport ?? null)
+const transport = ref<string | null>(null)
 const transportPill = computed(() => {
   switch (transport.value) {
     case 'fips':
@@ -825,62 +807,44 @@ onMounted(async () => {
       loadCatalog(),
       loadOwned(),
     ])
+  } else {
+    loading.value = false
   }
-  // No peerId → peerOnion is empty and `loading` stays false on its own.
 })
 
-function loadCatalog(): Promise<void> {
-  const onion = peerOnion.value
-  if (!onion) return Promise.resolve()
-  return resources.refresh<PeerBrowse>(`cloud.peer-browse:${onion}`, async () => {
-    const t0 = Date.now()
+async function loadCatalog() {
+  const onion = props.peerId || currentPeer.value?.onion
+  if (!onion) return
+  const hadItems = catalogItems.value.length > 0
+  loading.value = true
+  catalogError.value = ''
+  try {
     const result = await rpcClient.call<{ items?: CatalogItem[]; transport?: string }>({
       method: 'content.browse-peer',
       params: { onion },
       timeout: 30000,
-      // The caller has its own timeout UX; retry×3 turned one slow peer
-      // into a 90s spinner.
-      maxRetries: 1,
-      dedup: true,
-    })
-    return { items: result?.items ?? [], transport: result?.transport ?? null, latencyMs: Date.now() - t0 }
-  })
-}
-
-// Load visual previews for image and video items when catalog loads.
-// Audio files don't need visual thumbnails — they show a waveform icon.
-// The fan-out is capped (3 concurrent) and aborts on unmount — it used to
-// fire one 30s RPC per media item all at once, unbounded.
-const previewAborter = new AbortController()
-onUnmounted(() => previewAborter.abort())
-const previewQueued = new Set<string>()
-let previewQueue: CatalogItem[] = []
-let previewWorkers = 0
-const PREVIEW_CONCURRENCY = 3
-
-function pumpPreviews(onion: string) {
-  while (previewWorkers < PREVIEW_CONCURRENCY && previewQueue.length > 0) {
-    const item = previewQueue.shift()!
-    previewWorkers++
-    void loadPreview(onion, item).finally(() => {
-      previewWorkers--
-      pumpPreviews(onion)
     })
+    catalogItems.value = result?.items ?? []
+    transport.value = result?.transport ?? null
+  } catch (e: unknown) {
+    catalogError.value = e instanceof Error ? e.message : 'Failed to connect to peer'
+    if (!hadItems) catalogItems.value = []
+  } finally {
+    loading.value = false
   }
 }
 
-watch(catalogItems, (items) => {
-  const onion = peerOnion.value
+// Load visual previews for image and video items when catalog loads
+// Audio files don't need visual thumbnails — they show a waveform icon
+watch(catalogItems, async (items) => {
+  const onion = props.peerId || currentPeer.value?.onion
   if (!onion) return
   for (const item of items) {
-    const isVisual = item.mime_type.startsWith('image/') || item.mime_type.startsWith('video/')
-    if (isVisual && !previewUrls[item.id] && !previewQueued.has(item.id)) {
-      previewQueued.add(item.id)
-      previewQueue.push(item)
+    if ((item.mime_type.startsWith('image/') || item.mime_type.startsWith('video/')) && !previewUrls[item.id]) {
+      loadPreview(onion, item)
     }
   }
-  pumpPreviews(onion)
-}, { immediate: true })
+})
 
 async function loadPreview(onion: string, item: CatalogItem) {
   try {
@@ -888,8 +852,6 @@ async function loadPreview(onion: string, item: CatalogItem) {
       method: 'content.preview-peer',
       params: { onion, content_id: item.id },
       timeout: 30000,
-      maxRetries: 1,
-      signal: previewAborter.signal,
     })
     if (result?.data) {
       const mime = result.content_type || item.mime_type

neode-ui/src/views/Server.vue

@@ -407,7 +407,6 @@
 import { ref, computed, onMounted, onUnmounted, watch } from 'vue'
 import DOMPurify from 'dompurify'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource, type CachedResource } from '@/composables/useCachedResource'
 import { useAppStore } from '@/stores/app'
 import QuickActionsCard from './server/QuickActionsCard.vue'
 import TorServicesCard from './server/TorServicesCard.vue'
@@ -435,51 +434,18 @@ const torStatusColor = computed(() => {
 const autoSyncEnabled = ref(true)
 const logCount = ref(0)
 
-// Network data — a cached aggregate over four RPCs (allSettled: a failing
-// one keeps that slice's previous values). Revisits paint instantly.
-interface NetworkData {
-  wifiCount: string; wifiSsid: string | null; torConnected: boolean; forwardCount: string
-  vpnConnected: boolean; vpnProvider: string; vpnIp: string; wgIp: string; wgPubkey: string
-  vpnHostname: string; vpnPeers: number
-  dnsProvider: string; dnsServers: string[]; dnsDoH: boolean
-}
-const defaultNetworkData = (): NetworkData => ({
-  wifiCount: 'N/A', wifiSsid: null, torConnected: false, forwardCount: 'N/A',
+// Network data
+const networkLoading = ref(true)
+const networkRefreshing = ref(false)
+const networkHasLoaded = ref(false)
+const networkData = ref({
+  wifiCount: 'N/A', wifiSsid: null as string | null, torConnected: false, forwardCount: 'N/A',
   vpnConnected: false, vpnProvider: '', vpnIp: '', wgIp: '', wgPubkey: '', vpnHostname: '', vpnPeers: 0,
-  dnsProvider: 'system', dnsServers: [], dnsDoH: false,
+  dnsProvider: 'system', dnsServers: [] as string[], dnsDoH: false,
 })
-// immediate:false — the fetcher merges onto the previous value via
-// networkRes, so it must not run during this initializer (onMounted loads
-// it). The explicit annotation breaks the self-referential inference cycle.
-const networkRes: CachedResource<NetworkData> = useCachedResource<NetworkData>({
-  key: 'server.network-summary',
-  immediate: false,
-  fetcher: async () => {
-    const next = { ...(networkRes.data.value ?? defaultNetworkData()) }
-    const [diagRes, fwdRes, vpnRes, dnsRes] = await Promise.allSettled([
-      rpcClient.call<{ wan_ip: string | null; nat_type: string; upnp_available: boolean; tor_connected: boolean; wifi_count?: number }>({ method: 'network.diagnostics' }),
-      rpcClient.call<{ forwards: unknown[] }>({ method: 'router.list-forwards' }),
-      rpcClient.vpnStatus(),
-      rpcClient.dnsStatus(),
-    ])
-    if (diagRes.status === 'fulfilled') { next.torConnected = diagRes.value.tor_connected; next.wifiCount = diagRes.value.wifi_count !== undefined ? `${diagRes.value.wifi_count} configured` : 'N/A'; next.wifiSsid = (diagRes.value as { wifi_ssid?: string | null }).wifi_ssid ?? null }
-    if (fwdRes.status === 'fulfilled') { const c = fwdRes.value.forwards?.length ?? 0; next.forwardCount = `${c} rule${c !== 1 ? 's' : ''}` }
-    if (vpnRes.status === 'fulfilled') { next.vpnConnected = vpnRes.value.connected; next.vpnProvider = vpnRes.value.provider ?? ''; next.vpnIp = (vpnRes.value.ip_address ?? '').replace(/\/\d+$/, ''); next.wgIp = vpnRes.value.wg_ip ?? ''; next.wgPubkey = (vpnRes.value as Record<string, unknown>).wg_pubkey as string ?? '' }
-    if (dnsRes.status === 'fulfilled') { next.dnsProvider = dnsRes.value.provider; next.dnsServers = dnsRes.value.resolv_conf_servers ?? []; next.dnsDoH = dnsRes.value.doh_enabled }
-    return next
-  },
-})
-const networkData = computed(() => networkRes.data.value ?? defaultNetworkData())
-const networkLoading = computed(() => networkRes.loadState.value === 'loading')
-const networkRefreshing = computed(() => networkRes.loadState.value === 'refreshing')
 
 // FIPS status row for the Local Network card. Full FIPS card lives below.
-const fipsSummaryRes = useCachedResource<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number }>({
-  key: 'server.fips-summary',
-  immediate: false,
-  fetcher: (signal) => rpcClient.call({ method: 'fips.status', signal, dedup: true, maxRetries: 1 }),
-})
-const fipsSummary = computed(() => fipsSummaryRes.data.value)
+const fipsSummary = ref<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number } | null>(null)
 const fipsRowLabel = computed(() => {
   const s = fipsSummary.value
   if (!s) return '…'
@@ -501,12 +467,32 @@ const fipsRowTextClass = computed(() => {
   if (s.anchor_connected === false) return 'text-orange-400'
   return 'text-green-400'
 })
-function loadFipsSummary() {
-  return fipsSummaryRes.refresh()
+async function loadFipsSummary() {
+  try {
+    fipsSummary.value = await rpcClient.call<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number }>({ method: 'fips.status' })
+  } catch { /* backend too old */ }
 }
 
-function loadNetworkData() {
-  return networkRes.refresh()
+async function loadNetworkData() {
+  const initialLoad = !networkHasLoaded.value
+  networkLoading.value = initialLoad
+  networkRefreshing.value = !initialLoad
+  try {
+    const [diagRes, fwdRes, vpnRes, dnsRes] = await Promise.allSettled([
+      rpcClient.call<{ wan_ip: string | null; nat_type: string; upnp_available: boolean; tor_connected: boolean; wifi_count?: number }>({ method: 'network.diagnostics' }),
+      rpcClient.call<{ forwards: unknown[] }>({ method: 'router.list-forwards' }),
+      rpcClient.vpnStatus(),
+      rpcClient.dnsStatus(),
+    ])
+    if (diagRes.status === 'fulfilled') { networkData.value.torConnected = diagRes.value.tor_connected; networkData.value.wifiCount = diagRes.value.wifi_count !== undefined ? `${diagRes.value.wifi_count} configured` : 'N/A'; networkData.value.wifiSsid = (diagRes.value as { wifi_ssid?: string | null }).wifi_ssid ?? null }
+    if (fwdRes.status === 'fulfilled') { const c = fwdRes.value.forwards?.length ?? 0; networkData.value.forwardCount = `${c} rule${c !== 1 ? 's' : ''}` }
+    if (vpnRes.status === 'fulfilled') { networkData.value.vpnConnected = vpnRes.value.connected; networkData.value.vpnProvider = vpnRes.value.provider ?? ''; networkData.value.vpnIp = (vpnRes.value.ip_address ?? '').replace(/\/\d+$/, ''); networkData.value.wgIp = vpnRes.value.wg_ip ?? ''; networkData.value.wgPubkey = (vpnRes.value as Record<string, unknown>).wg_pubkey as string ?? '' }
+    if (dnsRes.status === 'fulfilled') { networkData.value.dnsProvider = dnsRes.value.provider; networkData.value.dnsServers = dnsRes.value.resolv_conf_servers ?? []; networkData.value.dnsDoH = dnsRes.value.doh_enabled }
+  } catch { /* keep existing/default values */ } finally {
+    networkHasLoaded.value = true
+    networkLoading.value = false
+    networkRefreshing.value = false
+  }
 }
 
 // VPN peer management
@@ -521,18 +507,13 @@ const sanitizedPeerQrSvg = computed(() =>
 )
 const peerError = ref('')
 const copiedConfig = ref(false)
-const vpnPeersRes = useCachedResource<{ name: string; ip: string; type?: string; npub?: string }[]>({
-  key: 'server.vpn-peers',
-  immediate: false,
-  fetcher: async (signal) => {
-    const res = await rpcClient.call<{ peers: { name: string; ip: string }[] }>({ method: 'vpn.list-peers', signal, dedup: true, maxRetries: 1 })
-    return res.peers || []
-  },
-})
-const vpnPeers = computed(() => vpnPeersRes.data.value ?? [])
+const vpnPeers = ref<{ name: string; ip: string; type?: string; npub?: string }[]>([])
 
-function loadVpnPeers() {
-  return vpnPeersRes.refresh()
+async function loadVpnPeers() {
+  try {
+    const res = await rpcClient.call<{ peers: { name: string; ip: string }[] }>({ method: 'vpn.list-peers' })
+    vpnPeers.value = res.peers || []
+  } catch { /* no peers */ }
 }
 
 async function createPeer() {
@@ -576,7 +557,7 @@ async function removePeer(name: string) {
   removingPeer.value = name
   try {
     await rpcClient.call({ method: 'vpn.remove-peer', params: { name } })
-    vpnPeersRes.optimistic(cur => (cur ?? []).filter(p => p.name !== name))
+    vpnPeers.value = vpnPeers.value.filter(p => p.name !== name)
   } catch { /* ignore */ }
   finally { removingPeer.value = '' }
 }
@@ -602,17 +583,10 @@ async function copyPeerConfig() {
 interface NetworkInterface { name: string; type: string; state: string; mac: string; ipv4: string[] }
 interface WifiNetwork { ssid: string; signal: number; security: string }
 
-const interfacesRes = useCachedResource<NetworkInterface[]>({
-  key: 'server.interfaces',
-  immediate: false,
-  fetcher: async (signal) => {
-    const res = await rpcClient.call<{ interfaces: NetworkInterface[] }>({ method: 'network.list-interfaces', signal, dedup: true, maxRetries: 1 })
-    return res.interfaces
-  },
-})
-const interfacesLoading = computed(() => interfacesRes.loadState.value === 'loading')
-const interfacesRefreshing = computed(() => interfacesRes.loadState.value === 'refreshing')
-const allInterfaces = computed(() => interfacesRes.data.value ?? [])
+const interfacesLoading = ref(true)
+const interfacesRefreshing = ref(false)
+const interfacesHaveLoaded = ref(false)
+const allInterfaces = ref<NetworkInterface[]>([])
 const physicalInterfaces = computed(() => allInterfaces.value.filter(i => i.type === 'ethernet' || i.type === 'wifi'))
 const wifiAvailable = computed(() => allInterfaces.value.some(i => i.type === 'wifi'))
 
@@ -663,19 +637,19 @@ async function applyDnsConfig(customServers: string) {
     const res = await rpcClient.configureDns(params)
     // Never trust the response shape: an undefined `servers` used to reach the
     // dnsDisplayLabel computed and crash the whole page render on `.length`.
-    // Write-through to the cached aggregate (the RPC already succeeded).
-    networkRes.optimistic(cur => ({
-      ...(cur ?? defaultNetworkData()),
-      dnsProvider: res?.provider ?? provider,
-      dnsServers: Array.isArray(res?.servers) ? res.servers : (params.servers ?? []),
-      dnsDoH: !!res?.doh_enabled,
-    }))
+    networkData.value.dnsProvider = res?.provider ?? provider
+    networkData.value.dnsServers = Array.isArray(res?.servers) ? res.servers : (params.servers ?? [])
+    networkData.value.dnsDoH = !!res?.doh_enabled
     showDnsModal.value = false
   } catch (e) { dnsError.value = e instanceof Error ? e.message : 'DNS configuration failed.' } finally { dnsApplying.value = false }
 }
 
-function loadInterfaces() {
-  return interfacesRes.refresh()
+async function loadInterfaces() {
+  const initialLoad = !interfacesHaveLoaded.value
+  const hadInterfaces = allInterfaces.value.length > 0
+  interfacesLoading.value = initialLoad
+  interfacesRefreshing.value = !initialLoad
+  try { const res = await rpcClient.call<{ interfaces: NetworkInterface[] }>({ method: 'network.list-interfaces' }); allInterfaces.value = res.interfaces } catch { if (!hadInterfaces) allInterfaces.value = [] } finally { interfacesHaveLoaded.value = true; interfacesLoading.value = false; interfacesRefreshing.value = false }
 }
 
 async function toggleWifiRadio(iface: NetworkInterface) {
@@ -757,18 +731,9 @@ function formatBytes(bytes: number): string {
 }
 
 // Tor Services
-const torServicesRes = useCachedResource<{ services: TorServiceInfo[]; tor_running: boolean }>({
-  key: 'server.tor-services',
-  immediate: false,
-  fetcher: async (signal) => {
-    const res = await rpcClient.call<{ services: TorServiceInfo[]; tor_running: boolean }>({ method: 'tor.list-services', signal, dedup: true, maxRetries: 1 })
-    return { services: res.services || [], tor_running: res.tor_running ?? false }
-  },
-})
-const torServices = computed(() => torServicesRes.data.value?.services ?? [])
-const torServicesLoading = computed(() =>
-  torServicesRes.loadState.value === 'loading' || torServicesRes.loadState.value === 'refreshing')
-const torDaemonRunning = computed(() => torServicesRes.data.value?.tor_running ?? false)
+const torServices = ref<TorServiceInfo[]>([])
+const torServicesLoading = ref(false)
+const torDaemonRunning = ref(false)
 const torRestarting = ref(false)
 const torRotating = ref<string | false>(false)
 const torDeleting = ref<string | false>(false)
@@ -785,8 +750,11 @@ const availableAppsForTor = computed(() => {
     .sort((a, b) => a.title.localeCompare(b.title))
 })
 
-function loadTorServices() {
-  return torServicesRes.refresh()
+async function loadTorServices() {
+  const hadServices = torServices.value.length > 0
+  torServicesLoading.value = true
+  try { const res = await rpcClient.call<{ services: TorServiceInfo[]; tor_running: boolean }>({ method: 'tor.list-services' }); torServices.value = res.services || []; torDaemonRunning.value = res.tor_running ?? false }
+  catch { if (!hadServices) { torServices.value = []; torDaemonRunning.value = false } } finally { torServicesLoading.value = false }
 }
 
 async function copyTorAddress(address: string) {
@@ -830,18 +798,14 @@ async function createService(name: string, port: number | null) {
 
 onMounted(() => { checkTorStatus(); loadNetworkData(); loadInterfaces(); loadDiskStatus(); loadTorServices(); loadVpnPeers(); loadFipsSummary() })
 
-// Poll VPN status every 15s so IP updates after pairing (write-through to
-// the cached aggregate without refetching the other three RPCs)
+// Poll VPN status every 15s so IP updates after pairing
 const vpnPollInterval = setInterval(async () => {
   try {
     const vpnRes = await rpcClient.vpnStatus()
-    networkRes.optimistic(cur => ({
-      ...(cur ?? defaultNetworkData()),
-      vpnConnected: vpnRes.connected,
-      vpnProvider: vpnRes.provider ?? '',
-      vpnIp: (vpnRes.ip_address ?? '').replace(/\/\d+$/, ''),
-      wgIp: vpnRes.wg_ip ?? '',
-    }))
+    networkData.value.vpnConnected = vpnRes.connected
+    networkData.value.vpnProvider = vpnRes.provider ?? ''
+    networkData.value.vpnIp = (vpnRes.ip_address ?? '').replace(/\/\d+$/, '')
+    networkData.value.wgIp = vpnRes.wg_ip ?? ''
   } catch { /* ignore */ }
 }, 15000)
 onUnmounted(() => clearInterval(vpnPollInterval))
@@ -865,11 +829,8 @@ async function restartServices() {
 
 async function checkTorStatus() {
   checkingTor.value = true; torStatusLabel.value = 'checking'
-  try {
-    await torServicesRes.refresh()
-    if (torServicesRes.error.value) torStatusLabel.value = 'stopped'
-    else torStatusLabel.value = torServices.value.some(s => s.onion_address) ? 'running' : 'stopped'
-  } finally { checkingTor.value = false }
+  try { const res = await rpcClient.call<{ services: TorServiceInfo[] }>({ method: 'tor.list-services' }); torServices.value = res.services || []; torStatusLabel.value = torServices.value.some(s => s.onion_address) ? 'running' : 'stopped' }
+  catch { torStatusLabel.value = 'stopped' } finally { checkingTor.value = false }
 }
 
 const logsToast = ref('')

neode-ui/src/views/__tests__/CredentialsRefresh.test.ts

@@ -1,6 +1,5 @@
 import { flushPromises, mount } from '@vue/test-utils'
 import { describe, expect, it, vi } from 'vitest'
-import { createPinia } from 'pinia'
 import Credentials from '../Credentials.vue'
 import { rpcClient } from '@/api/rpc-client'
 
@@ -43,8 +42,6 @@ describe('Credentials', () => {
 
     const wrapper = mount(Credentials, {
       global: {
-        // The cached-resource layer pulls the Pinia resources store in setup.
-        plugins: [createPinia()],
         mocks: {
           $router: { push: vi.fn() },
         },

neode-ui/src/views/__tests__/PeerFilesRefresh.test.ts

@@ -1,6 +1,5 @@
 import { flushPromises, mount } from '@vue/test-utils'
 import { describe, expect, it, vi } from 'vitest'
-import { createPinia } from 'pinia'
 import PeerFiles from '../PeerFiles.vue'
 import { rpcClient } from '@/api/rpc-client'
 
@@ -56,8 +55,6 @@ describe('PeerFiles', () => {
     const wrapper = mount(PeerFiles, {
       props: { peerId: 'peer.onion' },
       global: {
-        // The shared peer-browse cache lives in the Pinia resources store.
-        plugins: [createPinia()],
         stubs: {
           Teleport: true,
         },

neode-ui/src/views/__tests__/ServerNetworkRefresh.test.ts

@@ -1,6 +1,5 @@
 import { flushPromises, mount } from '@vue/test-utils'
 import { describe, expect, it, vi } from 'vitest'
-import { createPinia } from 'pinia'
 import Server from '../Server.vue'
 import { rpcClient } from '@/api/rpc-client'
 
@@ -30,8 +29,6 @@ function deferred<T>() {
 function mountServer(options: { renderTorServices?: boolean } = {}) {
   return mount(Server, {
     global: {
-      // The cached-resource layer pulls the Pinia resources store in setup.
-      plugins: [createPinia()],
       stubs: {
         QuickActionsCard: true,
         TorServicesCard: options.renderTorServices ? false : true,

neode-ui/src/views/mesh/MeshDevicePanel.vue

@@ -142,15 +142,12 @@ async function saveSettings() {
       lora_region: form.value.region,
       device_kind: form.value.deviceKind,
       channel_name: form.value.channel.trim() || 'archipelago',
-      // Always sent: an empty string CLEARS the custom mesh name (backend
-      // maps "" -> None -> fall back to the server name). The old omit-when-
-      // empty made clearing impossible once a name was ever set.
-      advert_name: form.value.name.trim(),
+      ...(form.value.name.trim() ? { advert_name: form.value.name.trim() } : {}),
       broadcast_identity: form.value.broadcastIdentity,
       ...(rfParams ? { lora_radio_params: rfParams } : {}),
     })
     saveDone.value = true
-    setTimeout(() => { saveDone.value = false }, 5000)
+    setTimeout(() => { saveDone.value = false }, 3000)
   } catch (e) {
     saveError.value = e instanceof Error ? e.message : 'Failed to save mesh settings'
   } finally {
@@ -289,7 +286,7 @@ async function saveSettings() {
         >
           {{ saving ? 'Saving…' : 'Save Settings' }}
         </button>
-        <span v-if="saveDone" class="text-xs text-green-400">Saved — applying to the radio now…</span>
+        <span v-if="saveDone" class="text-xs text-green-400">Saved — applies on next radio session</span>
         <span v-if="saveError" class="text-xs text-red-400">{{ saveError }}</span>
       </div>
     </div>

neode-ui/src/views/mesh/mesh-styles.css

@@ -83,19 +83,6 @@
 .mesh-offgrid-active { border-color: rgba(251, 146, 60, 0.4) !important; color: #fb923c !important; }
 .mesh-actions { display: flex; gap: 8px; flex-shrink: 0; }
 .mesh-action-btn { flex: 1; padding: 8px 0; font-size: 0.8rem; }
-.mesh-action-ok { color: #34d399; border-color: rgba(52, 211, 153, 0.4); }
-.mesh-refresh-spinner {
-  display: inline-block;
-  width: 10px;
-  height: 10px;
-  margin-right: 4px;
-  border-radius: 9999px;
-  border: 2px solid rgba(251, 146, 60, 0.7);
-  border-top-color: transparent;
-  animation: mesh-refresh-spin 0.8s linear infinite;
-  vertical-align: -1px;
-}
-@keyframes mesh-refresh-spin { to { transform: rotate(360deg); } }
 .mesh-peers-card { padding: 14px; flex: 1; min-height: 0; display: flex; flex-direction: column; }
 .mesh-peers-card .mesh-section-title { margin-bottom: 10px; flex-shrink: 0; }
 .mesh-peer-list { display: flex; flex-direction: column; gap: 4px; overflow-y: auto; flex: 1; min-height: 0; }
@@ -374,35 +361,13 @@
 .mesh-typed-content-audio { width: 220px; max-width: 100%; display: block; }
 .mesh-typed-content-image-wrap { position: relative; display: inline-block; }
 .mesh-typed-content-download-btn {
-  position: absolute; bottom: 8px; right: 8px;
-  width: 2.25rem; height: 2.25rem; min-width: 2.25rem; flex-shrink: 0;
-  border-radius: 50%; border: 1px solid rgba(255,255,255,0.18);
-  background: rgba(10,10,14,0.55); color: rgba(255,255,255,0.9);
+  position: absolute; bottom: 6px; right: 6px; width: 1.75rem; height: 1.75rem;
+  border-radius: 50%; border: 1px solid rgba(255,255,255,0.15);
+  background: rgba(0,0,0,0.55); color: rgba(255,255,255,0.85); font-size: 0.85rem;
   display: flex; align-items: center; justify-content: center; cursor: pointer;
-  backdrop-filter: blur(10px); -webkit-backdrop-filter: blur(10px);
-  box-shadow: 0 2px 8px rgba(0,0,0,0.35);
-  transition: background 0.15s ease, transform 0.15s ease;
+  backdrop-filter: blur(6px);
 }
-.mesh-typed-content-download-btn svg { width: 1.05rem; height: 1.05rem; }
-.mesh-typed-content-download-btn:hover { background: rgba(251,146,60,0.35); color: #fff; transform: scale(1.06); }
-.mesh-typed-content-download-btn:active { transform: scale(0.96); }
-/* Pre-fetch "Download" pill under an incoming attachment. The generic .btn it
-   replaced collapsed to its text width inside the narrow mobile bubble and
-   looked squashed — this is a full-width glass pill in the house style. */
-.mesh-typed-content-fetch-btn {
-  display: flex; align-items: center; justify-content: center; gap: 7px;
-  width: 100%; min-height: 2.4rem; padding: 8px 14px; margin-top: 2px;
-  border-radius: 12px; border: 1px solid rgba(255,255,255,0.14);
-  background: rgba(255,255,255,0.07); color: rgba(255,255,255,0.9);
-  font-size: 0.82rem; font-weight: 500; cursor: pointer; white-space: nowrap;
-  backdrop-filter: blur(10px); -webkit-backdrop-filter: blur(10px);
-  transition: background 0.15s ease, border-color 0.15s ease;
-}
-.mesh-typed-content-fetch-btn svg { width: 1rem; height: 1rem; flex-shrink: 0; }
-.mesh-typed-content-fetch-btn:hover:not(:disabled) {
-  background: rgba(251,146,60,0.18); border-color: rgba(251,146,60,0.4); color: #fff;
-}
-.mesh-typed-content-fetch-btn:disabled { opacity: 0.6; cursor: default; }
+.mesh-typed-content-download-btn:hover { background: rgba(0,0,0,0.75); color: #fff; }
 .mesh-tab-bar { display: flex; gap: 2px; background: rgba(0,0,0,0.3); border-radius: 10px; padding: 3px; flex-shrink: 0; }
 .mesh-tab { flex: 1; padding: 8px 12px; border: none; background: transparent; color: rgba(255,255,255,0.5); font-size: 0.82rem; font-weight: 500; border-radius: 8px; cursor: pointer; transition: all 0.2s ease; display: flex; align-items: center; justify-content: center; gap: 6px; }
 .mesh-tab:hover { color: rgba(255,255,255,0.8); background: rgba(255,255,255,0.05); }

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -121,7 +121,6 @@
 <script setup lang="ts">
 import { computed, onMounted, onUnmounted, ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import { safeClipboardWrite } from '@/views/web5/utils'
 import FipsSeedAnchorsCard from './FipsSeedAnchorsCard.vue'
 
@@ -137,14 +136,7 @@ interface FipsStatus {
   anchor_connected?: boolean
 }
 
-// Shares `server.fips-summary` with the Local Network card's FIPS row, so
-// both paint from the same cache instantly on revisit and never disagree.
-const statusRes = useCachedResource<FipsStatus>({
-  key: 'server.fips-summary',
-  ttlMs: 15_000,
-  fetcher: (signal) => rpcClient.call<FipsStatus>({ method: 'fips.status', signal, dedup: true, maxRetries: 1 }),
-})
-const status = computed<FipsStatus>(() => statusRes.data.value ?? {
+const status = ref<FipsStatus>({
   installed: false,
   version: null,
   service_state: 'unknown',
@@ -207,11 +199,18 @@ function flash(msg: string, isError = false) {
   setTimeout(() => { statusMessage.value = '' }, 6000)
 }
 
+async function loadStatus() {
+  try {
+    status.value = await rpcClient.call<FipsStatus>({ method: 'fips.status' })
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('fips.status failed', e)
+  }
+}
+
 async function installAndActivate() {
   installing.value = true
   try {
-    const next = await rpcClient.call<FipsStatus>({ method: 'fips.install' })
-    statusRes.optimistic(() => next) // confirmed server state, not a guess
+    status.value = await rpcClient.call<FipsStatus>({ method: 'fips.install' })
     flash('FIPS started')
   } catch (e: unknown) {
     const msg = e instanceof Error ? e.message : String(e)
@@ -236,7 +235,7 @@ async function reconnectAnchor() {
     }>({ method: 'fips.reconnect', timeout: 60_000 })
     // Update the card with the post-reconnect status returned by the
     // backend — avoids an extra status fetch race.
-    statusRes.optimistic((cur) => ({ ...(cur ?? status.value), ...res.after }))
+    status.value = { ...status.value, ...res.after }
     if (res.recovered) {
       flash('Anchor reconnected.')
     } else if (res.likely_cause === 'connected') {
@@ -259,10 +258,8 @@ async function reconnectAnchor() {
 // stuck showing whatever anchor state existed at mount time forever.
 let statusInterval: ReturnType<typeof setInterval> | null = null
 onMounted(() => {
-  statusInterval = setInterval(() => {
-    if (document.hidden) return
-    void statusRes.refresh()
-  }, 15000)
+  loadStatus()
+  statusInterval = setInterval(loadStatus, 15000)
 })
 onUnmounted(() => {
   if (statusInterval) clearInterval(statusInterval)

neode-ui/src/views/server/FipsSeedAnchorsCard.vue

@@ -88,9 +88,8 @@
 </template>
 
 <script setup lang="ts">
-import { computed, reactive, ref } from 'vue'
+import { onMounted, reactive, ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 
 defineProps<{ closable?: boolean }>()
 defineEmits<{ (e: 'close'): void }>()
@@ -108,16 +107,7 @@ interface ApplyResult {
   message: string
 }
 
-const anchorsRes = useCachedResource<SeedAnchor[]>({
-  key: 'server.fips-seed-anchors',
-  fetcher: async (signal) => {
-    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({
-      method: 'fips.list-seed-anchors', signal, dedup: true, maxRetries: 1,
-    })
-    return res.seed_anchors
-  },
-})
-const anchors = computed(() => anchorsRes.data.value ?? [])
+const anchors = ref<SeedAnchor[]>([])
 const adding = ref(false)
 const applying = ref(false)
 const statusMessage = ref('')
@@ -136,6 +126,15 @@ function flash(msg: string, isError = false) {
   setTimeout(() => { statusMessage.value = '' }, 6000)
 }
 
+async function load() {
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({ method: 'fips.list-seed-anchors' })
+    anchors.value = res.seed_anchors
+  } catch (e: unknown) {
+    if (import.meta.env.DEV) console.warn('fips.list-seed-anchors failed', e)
+  }
+}
+
 async function addAnchor() {
   if (!draft.npub.trim() || !draft.address.trim()) return
   adding.value = true
@@ -149,7 +148,7 @@ async function addAnchor() {
         label: draft.label.trim(),
       },
     })
-    anchorsRes.optimistic(() => res.seed_anchors) // authoritative post-add list
+    anchors.value = res.seed_anchors
     draft.npub = ''
     draft.address = ''
     draft.label = ''
@@ -169,7 +168,7 @@ async function removeAnchor(npub: string) {
       method: 'fips.remove-seed-anchor',
       params: { npub },
     })
-    anchorsRes.optimistic(() => res.seed_anchors)
+    anchors.value = res.seed_anchors
     flash('Anchor removed.')
   } catch (e: unknown) {
     const msg = e instanceof Error ? e.message : String(e)
@@ -190,4 +189,6 @@ async function applyAll() {
     applying.value = false
   }
 }
+
+onMounted(load)
 </script>

neode-ui/src/views/server/OpenWrtGateway.vue

@@ -2,7 +2,6 @@
 import { ref, computed, onMounted } from 'vue'
 import { useRouter } from 'vue-router'
 import { rpcClient } from '@/api/rpc-client'
-import { useResourcesStore } from '@/stores/resources'
 import BackButton from '@/components/BackButton.vue'
 
 const router = useRouter()
@@ -74,15 +73,8 @@ interface ScannedNetwork {
   encryption: string
 }
 
-const status = computed(() => statusEntry().data)
-// Router status is cached in the shared resources store so revisits paint
-// the last-known state instantly while a fresh read runs behind it.
-const resources = useResourcesStore()
-const statusEntry = () => resources.entry<RouterStatus>('server.openwrt-status')
-const loading = computed(() => {
-  const s = statusEntry().loadState
-  return s === 'loading' || s === 'refreshing' || (s === 'idle' && statusEntry().data === null)
-})
+const status = ref<RouterStatus | null>(null)
+const loading = ref(true)
 const error = ref('')
 const host = ref('')
 const sshUser = ref('root')
@@ -95,6 +87,15 @@ const detecting = ref(false)
 const detectError = ref('')
 const detectedCandidates = ref<string[]>([])
 
+// Set/change router password — lets a fresh-flash router (root has no
+// password yet) get fully connected without the user ever opening a
+// terminal or LuCI themselves.
+const showSetPassword = ref(false)
+const newPassword = ref('')
+const confirmPassword = ref('')
+const settingPassword = ref(false)
+const setPasswordError = ref('')
+
 const provisioning = ref(false)
 const provisionError = ref('')
 const provisionSuccess = ref(false)
@@ -123,25 +124,25 @@ const dhcpLimit = ref(150)
 const masqEnabled = ref(true)
 
 async function load(params?: Record<string, string>) {
+  loading.value = true
   error.value = ''
-  await resources.refresh<RouterStatus>('server.openwrt-status', () =>
-    rpcClient.call<RouterStatus>({
+  try {
+    status.value = await rpcClient.call<RouterStatus>({
       method: 'openwrt.get-status',
       params: params ?? {},
       timeout: 30000,
-      dedup: true,
-      maxRetries: 1,
-    }))
-  const err = statusEntry().error
-  if (err) {
-    if (err.includes('No router configured')) {
-      showConnectForm.value = true
-    } else {
-      error.value = err
-    }
-  } else {
+    })
     showConnectForm.value = false
     if (params) connectedParams.value = params
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    if (msg.includes('No router configured')) {
+      showConnectForm.value = true
+    } else {
+      error.value = msg
+    }
+  } finally {
+    loading.value = false
   }
 }
 
@@ -156,6 +157,39 @@ async function connect() {
   }
 }
 
+async function setPasswordAndConnect() {
+  if (!host.value.trim() || !newPassword.value) return
+  setPasswordError.value = ''
+  if (newPassword.value !== confirmPassword.value) {
+    setPasswordError.value = 'Passwords do not match.'
+    return
+  }
+  settingPassword.value = true
+  try {
+    await rpcClient.call({
+      method: 'openwrt.set-password',
+      params: {
+        host: host.value.trim(),
+        ssh_user: sshUser.value,
+        current_password: sshPassword.value,
+        new_password: newPassword.value,
+      },
+      timeout: 20000,
+    })
+    // Router accepted the new password — log in with it right away so the
+    // user never has to separately "Connect" after this.
+    sshPassword.value = newPassword.value
+    showSetPassword.value = false
+    newPassword.value = ''
+    confirmPassword.value = ''
+    await connect()
+  } catch (e) {
+    setPasswordError.value = e instanceof Error ? e.message : String(e)
+  } finally {
+    settingPassword.value = false
+  }
+}
+
 interface WiredInterface { name: string; type: string; state: string; ipv4: string[] }
 
 async function detectRouter() {
@@ -211,6 +245,33 @@ function disconnectRouter() {
   showConnectForm.value = true
 }
 
+const forgetting = ref(false)
+const forgetError = ref('')
+
+// Unlike disconnectRouter() (which only resets local state, leaving the saved
+// router_config.json in place so onMounted reconnects on next visit), this
+// deletes the saved credentials server-side so the router is truly forgotten.
+async function forgetRouter() {
+  if (!confirm('Forget this router? You will need to log in again next time.')) return
+  forgetting.value = true
+  forgetError.value = ''
+  try {
+    await rpcClient.call({ method: 'openwrt.forget', timeout: 10000 })
+    status.value = null
+    connectedParams.value = null
+    host.value = ''
+    sshUser.value = 'root'
+    sshPassword.value = ''
+    detectError.value = ''
+    detectedCandidates.value = []
+    showConnectForm.value = true
+  } catch (e) {
+    forgetError.value = e instanceof Error ? e.message : String(e)
+  } finally {
+    forgetting.value = false
+  }
+}
+
 async function provisionTollgate() {
   provisioning.value = true
   provisionError.value = ''
@@ -445,6 +506,45 @@ onMounted(() => load())
         >
           {{ connecting ? 'Connecting…' : 'Connect' }}
         </button>
+        <button
+          class="w-full text-xs text-white/40 hover:text-white/70 transition-colors text-center"
+          @click="showSetPassword = !showSetPassword"
+        >
+          First login, or don't know the password? Set one →
+        </button>
+        <div v-if="showSetPassword" class="space-y-3 pt-2 border-t border-white/10">
+          <p class="text-xs text-white/40">
+            Sets the router's SSH password directly — no need to SSH in yourself first.
+            Leave "Password" above blank if this is a fresh flash (no password set yet).
+          </p>
+          <div class="grid grid-cols-2 gap-3">
+            <div>
+              <label class="block text-xs text-white/40 mb-1">New password</label>
+              <input
+                v-model="newPassword"
+                type="password"
+                class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white focus:outline-none focus:border-white/40 focus:ring-1 focus:ring-white/20 transition-colors"
+              />
+            </div>
+            <div>
+              <label class="block text-xs text-white/40 mb-1">Confirm password</label>
+              <input
+                v-model="confirmPassword"
+                type="password"
+                class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white focus:outline-none focus:border-white/40 focus:ring-1 focus:ring-white/20 transition-colors"
+              />
+            </div>
+          </div>
+          <button
+            :disabled="settingPassword || !host.trim() || !newPassword"
+            class="glass-button w-full text-sm font-medium"
+            :class="settingPassword || !host.trim() || !newPassword ? 'opacity-40 cursor-not-allowed' : ''"
+            @click="setPasswordAndConnect"
+          >
+            {{ settingPassword ? 'Setting password…' : 'Set Password & Connect' }}
+          </button>
+          <p v-if="setPasswordError" class="text-xs text-red-400">{{ setPasswordError }}</p>
+        </div>
       </div>
       <p v-if="error" class="mt-3 text-xs text-red-400">{{ error }}</p>
     </div>
@@ -507,7 +607,15 @@ onMounted(() => load())
           <button class="text-xs text-white/40 hover:text-white/70 transition-colors" @click="disconnectRouter">
             Switch router →
           </button>
+          <button
+            class="text-xs text-red-400/70 hover:text-red-400 transition-colors"
+            :disabled="forgetting"
+            @click="forgetRouter"
+          >
+            {{ forgetting ? 'Forgetting…' : 'Forget router' }}
+          </button>
         </div>
+        <p v-if="forgetError" class="mt-2 text-xs text-red-400">{{ forgetError }}</p>
       </div>
 
       <!-- WAN / Uplink -->

neode-ui/src/views/web5/Web5.vue

@@ -93,9 +93,8 @@ let web5AnimationDone = false
 import { ref, computed, onMounted, onUnmounted } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
-import { useCachedResource } from '@/composables/useCachedResource'
 import { safeClipboardWrite } from './utils'
-import type { ProfitsData, HwWalletDevice } from './types'
+import type { ProfitsData, WalletTransaction, HwWalletDevice } from './types'
 
 import Web5QuickActions from './Web5QuickActions.vue'
 // import Web5Wallet from './Web5Wallet.vue'  // hidden for now
@@ -137,13 +136,7 @@ function showToast(text: string) {
 }
 
 // --- Networking Profits ---
-const profitsRes = useCachedResource<ProfitsData>({
-  key: 'web5.networking-profits',
-  fetcher: (signal) => rpcClient.call<ProfitsData>({ method: 'wallet.networking-profits', signal, dedup: true, maxRetries: 1 }),
-})
-const profitsBreakdown = computed<ProfitsData | null>(() =>
-  profitsRes.data.value
-    ?? (profitsRes.error.value ? { total_sats: 0, content_sales_sats: 0, routing_fees_sats: 0 } : null))
+const profitsBreakdown = ref<ProfitsData | null>(null)
 const networkingProfitsDisplay = computed(() => {
   if (!profitsBreakdown.value) return '...'
   const sats = profitsBreakdown.value.total_sats
@@ -153,6 +146,15 @@ const networkingProfitsDisplay = computed(() => {
   return `\u20BF${btc.toFixed(8).replace(/0+$/, '').replace(/\.$/, '')}`
 })
 
+async function loadNetworkingProfits() {
+  try {
+    const res = await rpcClient.call<ProfitsData>({ method: 'wallet.networking-profits' })
+    profitsBreakdown.value = res
+  } catch {
+    profitsBreakdown.value = { total_sats: 0, content_sales_sats: 0, routing_fees_sats: 0 }
+  }
+}
+
 // --- DID State ---
 const storedDid = ref<string | null>(null)
 try {
@@ -288,35 +290,64 @@ async function copyDidDocument() {
 }
 
 // --- Wallet / LND Balances ---
-// Cached: balances/transactions paint instantly on revisit and revalidate
-// behind the cached value; errors keep the last-known data.
-const lndInfoRes = useCachedResource<{
-  balance_sats: number
-  channel_balance_sats: number
-  synced_to_chain: boolean
-}>({
-  key: 'web5.lnd-info',
-  fetcher: (signal) => rpcClient.call({ method: 'lnd.getinfo', signal, dedup: true, maxRetries: 1 }),
-})
-// connectWallet() can still "disconnect" the (hidden) wallet card UI-side.
-const walletManuallyDisconnected = ref(false)
-const walletConnected = computed(() =>
-  !walletManuallyDisconnected.value && lndInfoRes.data.value !== null && !lndInfoRes.error.value)
+const walletConnected = ref(false)
 const connectingWallet = ref(false)
-// Ecash/transaction/balance display lives in the hidden wallet card — when it
-// returns, add cached resources for wallet.ecash-balance / lnd.gettransactions
-// here rather than reviving the old eager loaders.
+const lndOnchainBalance = ref(0)
+const lndChannelBalance = ref(0)
+const walletError = ref('')
+const ecashBalance = ref(0)
+
+// Transactions — wallet card hidden, but loadTransactions still called for QuickActions walletConnected state
+const walletTransactions = ref<WalletTransaction[]>([])
 
 // Hardware wallets
 const detectedHwWallets = ref<HwWalletDevice[]>([])
 
+async function loadLndBalances() {
+  try {
+    const res = await rpcClient.call<{
+      balance_sats: number
+      channel_balance_sats: number
+      synced_to_chain: boolean
+    }>({ method: 'lnd.getinfo' })
+    lndOnchainBalance.value = res.balance_sats || 0
+    lndChannelBalance.value = res.channel_balance_sats || 0
+    walletConnected.value = true
+    walletError.value = ''
+  } catch (e) {
+    walletConnected.value = false
+    lndOnchainBalance.value = 0
+    lndChannelBalance.value = 0
+    walletError.value = e instanceof Error ? e.message : 'Failed to load wallet balances'
+  }
+}
+
+async function loadEcashBalance() {
+  try {
+    const res = await rpcClient.call<{ balance_sats: number; token_count: number }>({ method: 'wallet.ecash-balance' })
+    ecashBalance.value = res.balance_sats ?? 0
+  } catch {
+    // Keep last-known balance on a transient failure rather than flashing 0.
+  }
+}
+
+async function loadTransactions() {
+  try {
+    const res = await rpcClient.call<{ transactions: WalletTransaction[]; incoming_pending_count: number }>({ method: 'lnd.gettransactions' })
+    walletTransactions.value = res.transactions || []
+    walletError.value = ''
+  } catch (e) {
+    walletTransactions.value = []
+    walletError.value = e instanceof Error ? e.message : 'Failed to load transactions'
+  }
+}
+
 async function connectWallet() {
   if (walletConnected.value) {
-    walletManuallyDisconnected.value = true
+    walletConnected.value = false
   } else {
     connectingWallet.value = true
-    walletManuallyDisconnected.value = false
-    await lndInfoRes.refresh()
+    await loadLndBalances()
     connectingWallet.value = false
   }
 }
@@ -330,8 +361,13 @@ async function detectHardwareWallets() {
   }
 }
 
-// Auto-refresh wallet data every 30s while mounted (B5 will move this to
-// WS-push invalidation; the store dedups overlapping refreshes).
+// function reloadBalances() {  // wallet hidden
+//   loadLndBalances()
+//   loadEcashBalance()
+//   loadTransactions()
+// }
+
+// Auto-refresh wallet data every 30s
 let walletRefreshInterval: ReturnType<typeof setInterval> | null = null
 
 onMounted(() => {
@@ -356,15 +392,20 @@ onMounted(() => {
   // credentialsRef.value?.loadCredentials()  // hidden for now
   // sharedContentRef.value?.loadContentItems()  // hidden for now
 
-  // Wallet/profits resources fetch themselves on first use (and skip the
-  // fetch entirely when the cached value is still fresh).
+  // Load local state data
+  loadEcashBalance()
+  loadNetworkingProfits()
+  loadLndBalances()
+  loadTransactions()
   detectHardwareWallets()
 
   // Shared content loaded by the component itself via expose
   // The SharedContent component manages its own loadContentItems
 
   walletRefreshInterval = setInterval(() => {
-    void lndInfoRes.refresh()
+    loadLndBalances()
+    loadTransactions()
+    loadEcashBalance()
   }, 30000)
 })
 

reticulum-daemon/build.sh

@@ -47,16 +47,11 @@ if [ -n "$RNODECONF_SRC" ] && [ -f "$RNODECONF_SRC" ]; then
     # exit()/quit() builtins, which only exist in interactive Python (site.py
     # injects them) — a frozen app hits NameError right as it tries to quit
     # cleanly, after all the real work already succeeded. See
-    # pyi_rthook_exit_builtins.py. A second hook fixes rnodeconf's board-flash
-    # step, which shells out to a bundled esptool.py via `sys.executable` —
-    # under a frozen binary that's the binary itself, not a real interpreter,
-    # so the flash subprocess call breaks. See
-    # pyi_rthook_fix_flasher_executable.py.
+    # pyi_rthook_exit_builtins.py.
     .venv/bin/pyinstaller --onefile --name archy-rnodeconf --clean --noconfirm \
         --collect-submodules RNS \
         --collect-data RNS \
         --runtime-hook pyi_rthook_exit_builtins.py \
-        --runtime-hook pyi_rthook_fix_flasher_executable.py \
         -d noarchive \
         "$RNODECONF_SRC"
     echo "Built dist/archy-rnodeconf ($(du -h dist/archy-rnodeconf | cut -f1))"

reticulum-daemon/pyi_rthook_fix_flasher_executable.py

@@ -1,34 +0,0 @@
-# PyInstaller runtime hook — see build.sh.
-#
-# rnodeconf's own board-flashing code shells out to a bundled esptool.py as
-# `[sys.executable, flasher_path, "--chip", ..., "write_flash", ...]` (RNS's
-# rnodeconf.py, ~line 2794 as of RNS 1.3.5). That's correct for a normal
-# `python rnodeconf.py` invocation, but under a frozen PyInstaller binary
-# `sys.executable` is the frozen binary itself, not a real interpreter — so
-# the "subprocess" just re-invokes archy-rnodeconf's OWN argparse CLI with
-# esptool-shaped flags, which it doesn't recognize, and the flash step fails
-# immediately with "unrecognized arguments: --chip ...". Confirmed live
-# against a real Heltec V4 (2026-07-23): device selection, band selection,
-# and firmware download all worked; only the final `write_flash` subprocess
-# call broke this way.
-#
-# Fix: point sys.executable at a real Python interpreter that has rnodeconf's
-# own runtime deps available (esptool.py only needs pyserial, which RNS
-# already depends on) before any of rnodeconf's code runs. Prefer the build
-# venv this exact binary was frozen from — see build.sh — falling back to a
-# bare `python3` on PATH if that venv isn't present on this node.
-import os
-import sys
-
-if getattr(sys, "frozen", False):
-    _candidates = [
-        os.environ.get("ARCHY_RNODECONF_PYTHON", ""),
-        os.path.join(os.path.dirname(os.path.abspath(sys.argv[0])), "..", "reticulum-daemon", ".venv", "bin", "python3"),
-        os.path.expanduser("~/archy/reticulum-daemon/.venv/bin/python3"),
-    ]
-    for _candidate in _candidates:
-        if _candidate and os.path.isfile(_candidate):
-            sys.executable = _candidate
-            break
-    else:
-        sys.executable = "python3"

reticulum-daemon/reticulum_daemon.py

@@ -14,13 +14,12 @@ Security posture (see the plan's "most secure way" section):
 RPC (one JSON object per line, both directions):
   in : {"cmd":"send","dest_hash":"<hex16>","content":"…","title":"…","method":"direct|opportunistic"}
        {"cmd":"announce"}
-       {"cmd":"set_name","name":"…"}
        {"cmd":"status"}
        {"cmd":"send_resource","id":"<correlation>","dest_hash":"<hex16>","data_b64":"…"}
        {"cmd":"shutdown"}
   out: {"event":"ready","dest_hash":"<hex16>","display_name":"…"}
        {"event":"recv","source_hash":"<hex16>","content":"…","title":"…","fields":{…},"app_data":"<hex>","rssi":n,"snr":n,"stamp":t}
-       {"event":"announce","dest_hash":"<hex16>","app_data":"<hex>","display_name":"…"|null,"archy_blob":"ARCHY:2:…"|null}
+       {"event":"announce","dest_hash":"<hex16>","app_data":"<hex>"}
        {"event":"delivered","dest_hash":"<hex16>","state":"delivered|failed","id":"<hex>"}
        {"event":"status","connected":bool,"dest_hash":"<hex16>","interfaces":[…]}
        {"event":"resource_progress","id":"<correlation>","transferred":n,"total":n}
@@ -228,47 +227,31 @@ class ReticulumDaemon:
         if self.delivery_destination is not None:
             self.delivery_destination.announce(app_data=self._announce_app_data())
 
-    def _archy_identity_blob(self):
-        """The ``ARCHY:2:{ed25519_hex}:{x25519_hex}`` identity string the Rust
-        side parses (``protocol::parse_identity_broadcast``) and binds via
-        ``handle_identity_received`` — so a Reticulum-carried identity merges
-        into the SAME conversation as the meshcore/Meshtastic/federation twins
-        of the same Archy node. The keys are the node's real Archipelago
-        pubkeys (passed in by the Rust side) — NOT this daemon's
-        internally-HKDF-derived RNS keys, which exist only to make the RNS
-        destination hash deterministic. ``None`` when the pubkeys weren't
-        supplied (dev/selftest run)."""
+    def _announce_app_data(self) -> bytes:
+        """Carry the Archy identity so peers bind this RNS destination onto the
+        existing contact, the same way a meshcore/Meshtastic identity advert does.
+
+        Reuses the exact ``ARCHY:2:{ed25519_hex}:{x25519_hex}`` wire format the
+        Rust side already parses (``protocol::parse_identity_broadcast``) and
+        binds via ``handle_identity_received``/``bind_federation_twins`` — so a
+        Reticulum-carried identity merges into the SAME conversation as the
+        meshcore/Meshtastic/federation twins of the same Archy node, satisfying
+        cross-protocol DM convergence. The keys are the node's real Archipelago
+        ed25519/x25519 pubkeys (passed in by the Rust side, which already has
+        them) — NOT this daemon's internally-HKDF-derived RNS keys, which exist
+        only to make the RNS destination hash deterministic and are never
+        themselves treated as an Archy identity.
+
+        Falls back to a plain display-name string (undetected as an identity
+        blob — no `ARCHY:2:` prefix) if the Archy pubkeys weren't supplied, e.g.
+        a dev/selftest run with no `--archy-ed-pubkey-hex`.
+        """
         if self.args.archy_ed_pubkey_hex and self.args.archy_x25519_pubkey_hex:
             return (
                 f"ARCHY:2:{self.args.archy_ed_pubkey_hex}:"
                 f"{self.args.archy_x25519_pubkey_hex}"
             ).encode("ascii")
-        return None
-
-    def _announce_app_data(self) -> bytes:
-        """LXMF-standard announce app_data — msgpack ``[display_name,
-        stamp_cost, supported_functionality]`` via the router, so Sideband/
-        NomadNet/MeshChat (and upgraded archy nodes) all see our real display
-        name — with the Archy identity blob appended as an EXTRA list element.
-        Stock clients only read the elements they know ([0]/[1]), so the blob
-        rides along invisibly instead of replacing the name the way the old
-        blob-only app_data did (which left every archy node nameless on RNS).
-        """
-        import RNS.vendor.umsgpack as msgpack
-        app_data = self.router.get_announce_app_data(self.delivery_destination.hash)
-        blob = self._archy_identity_blob()
-        if blob is None:
-            return app_data
-        try:
-            peer_data = msgpack.unpackb(app_data)
-            if not isinstance(peer_data, list):
-                raise ValueError("unexpected announce app_data shape")
-            peer_data.append(blob)
-            return msgpack.packb(peer_data)
-        except Exception:
-            # Never let announce formatting kill announcing entirely — fall
-            # back to the legacy blob-only format (identity binding > name).
-            return blob
+        return (self.args.display_name or "").encode("utf-8")
 
     # ---- RNS-thread callbacks → asyncio ----
     def _on_lxmf_delivery(self, message):
@@ -345,15 +328,6 @@ class ReticulumDaemon:
             self._send(req)
         elif cmd == "announce":
             self.announce()
-        elif cmd == "set_name":
-            # Live rename: update the LXMF delivery destination's display name
-            # (what get_announce_app_data reads) and re-announce immediately so
-            # peers learn the new name without waiting for the next advert tick.
-            name = (req.get("name") or "").strip()
-            if name and self.delivery_destination is not None:
-                self.args.display_name = name
-                self.delivery_destination.display_name = name
-                self.announce()
         elif cmd == "status":
             self._broadcast(self._status())
         elif cmd == "send_resource":
@@ -547,41 +521,10 @@ class _AnnounceHandler:
         self.receive_path_responses = True
 
     def received_announce(self, destination_hash, announced_identity, app_data):
-        # Decode what we can here (both the LXMF-standard display name and our
-        # appended ARCHY identity blob — see _announce_app_data) so the Rust
-        # side gets clean typed fields instead of re-implementing msgpack.
-        display_name = None
-        archy_blob = None
-        raw = app_data or b""
-        try:
-            import LXMF
-            display_name = LXMF.display_name_from_app_data(raw)
-            # A legacy blob-only announce is plain ascii, so LXMF's decoder
-            # returns the whole ARCHY identity blob as a "name" — drop it.
-            if display_name and display_name.startswith("ARCHY:"):
-                display_name = None
-        except Exception:
-            display_name = None
-        try:
-            if raw[:1] and ((0x90 <= raw[0] <= 0x9F) or raw[0] == 0xDC):
-                import RNS.vendor.umsgpack as msgpack
-                peer_data = msgpack.unpackb(raw)
-                if isinstance(peer_data, list):
-                    for el in peer_data[3:]:
-                        if isinstance(el, bytes) and el.startswith(b"ARCHY:"):
-                            archy_blob = el.decode("ascii", "ignore")
-                            break
-            elif raw.startswith(b"ARCHY:"):
-                # Legacy (pre-upgrade archy node): app_data IS the blob.
-                archy_blob = raw.decode("ascii", "ignore")
-        except Exception:
-            archy_blob = None
         self.daemon._emit_threadsafe({
             "event": "announce",
             "dest_hash": destination_hash.hex(),
-            "app_data": raw.hex(),
-            "display_name": display_name,
-            "archy_blob": archy_blob,
+            "app_data": (app_data or b"").hex(),
         })
 
 
@@ -661,30 +604,8 @@ def main(argv=None) -> int:
     if args.selftest:
         args.no_radio = True
         daemon.bring_up()
-        # Announce app_data round-trip: the LXMF-standard msgpack name must be
-        # decodable by stock clients AND (with archy keys set) the appended
-        # identity blob must survive as an extra list element — this is the
-        # exact wire contract the Rust announce handler and Sideband both
-        # depend on, so verify it here where there's a real router to build it.
-        import LXMF as _LXMF
-        import RNS.vendor.umsgpack as _msgpack
-        args.archy_ed_pubkey_hex = args.archy_ed_pubkey_hex or "ab" * 32
-        args.archy_x25519_pubkey_hex = args.archy_x25519_pubkey_hex or "cd" * 32
-        app_data = daemon._announce_app_data()
-        decoded_name = _LXMF.display_name_from_app_data(app_data)
-        assert decoded_name == args.display_name, (
-            f"announce name round-trip failed: {decoded_name!r} != {args.display_name!r}"
-        )
-        blob_elems = [e for e in _msgpack.unpackb(app_data)[3:]
-                      if isinstance(e, bytes) and e.startswith(b"ARCHY:")]
-        assert blob_elems, "identity blob missing from announce app_data"
-        # Live rename: set_name must change what the next announce carries.
-        daemon.delivery_destination.display_name = "selftest-renamed"
-        renamed = _LXMF.display_name_from_app_data(daemon._announce_app_data())
-        assert renamed == "selftest-renamed", f"rename round-trip failed: {renamed!r}"
         print(f"selftest ok — dest_hash={daemon.dest_hash_hex} "
-              f"display_name={args.display_name!r} lxmf_router=up "
-              f"announce_app_data=verified set_name=verified")
+              f"display_name={args.display_name!r} lxmf_router=up")
         return 0
 
     for sig in (signal.SIGINT, signal.SIGTERM):

scripts/flash-mt3000-openwrt.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+# Flash stock OpenWrt on a GL.iNet GL-MT3000 (Beryl AX)
+#
+# Usage:
+#   ./flash-mt3000-openwrt.sh <router-password> [router-ip] [--image /path/to/image.bin]
+#
+# Defaults to 192.168.8.1.
+# Requires: curl, sshpass, ssh, sha256sum
+# Optional: scp (falls back to pipe if unavailable on router)
+#
+# What it does:
+#   1. Verifies tools and connectivity
+#   2. Downloads the stock OpenWrt sysupgrade image (or uses a pre-downloaded one)
+#   3. Verifies SHA256 checksum
+#   4. Uploads image to the router (SCP or pipe)
+#   5. Flashes via sysupgrade (no settings preserved)
+#   6. Waits for reboot and verifies new firmware
+#
+# After flash, stock OpenWrt is at 192.168.1.1 (root, no password).
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log()  { echo -e "${GREEN}[+]${NC} $*"; }
+warn() { echo -e "${YELLOW}[!]${NC} $*"; }
+err()  { echo -e "${RED}[-]${NC} $*" >&2; }
+
+# --- Parse args ---
+PASSWORD=""
+ROUTER="192.168.8.1"
+LOCAL_IMAGE=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --image)
+            LOCAL_IMAGE="$2"
+            shift 2
+            ;;
+        --router)
+            ROUTER="$2"
+            shift 2
+            ;;
+        *)
+            if [ -z "$PASSWORD" ]; then
+                PASSWORD="$1"
+            else
+                ROUTER="$1"
+            fi
+            shift
+            ;;
+    esac
+done
+
+if [ -z "$PASSWORD" ]; then
+    echo "Usage: $0 <router-password> [router-ip] [--image /path/to/sysupgrade.bin]"
+    echo ""
+    echo "Options:"
+    echo "  --image PATH   Use a pre-downloaded sysupgrade image instead of downloading"
+    echo "  --router IP    Router IP (default: 192.168.8.1)"
+    exit 1
+fi
+
+SSH_USER="root"
+OPENWRT_VERSION="24.10.2"
+IMAGE_NAME="openwrt-${OPENWRT_VERSION}-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin"
+IMAGE_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/${IMAGE_NAME}"
+CHECKSUM_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums"
+DOWNLOAD_DIR="/tmp/openwrt-flash"
+DEFAULT_IMAGE="${DOWNLOAD_DIR}/${IMAGE_NAME}"
+NEW_IP="192.168.1.1"
+
+SSH_CMD="sshpass -p ${PASSWORD} ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${SSH_USER}@${ROUTER}"
+
+# --- Step 1: Check tools ---
+log "Checking required tools..."
+MISSING=()
+for cmd in curl sshpass ssh sha256sum; do
+    command -v "$cmd" >/dev/null 2>&1 || MISSING+=("$cmd")
+done
+if [ ${#MISSING[@]} -gt 0 ]; then
+    err "Missing tools: ${MISSING[*]}"
+    exit 1
+fi
+log "All tools found."
+
+# --- Step 2: Check router connectivity ---
+log "Checking router connectivity at ${ROUTER}..."
+if ! $SSH_CMD "echo ok" >/dev/null 2>&1; then
+    err "Cannot SSH into ${ROUTER}. Is the router reachable and is the password correct?"
+    exit 1
+fi
+log "Router reachable."
+
+# Verify it's a GL-MT3000
+BOARD=$($SSH_CMD "cat /tmp/sysinfo/board_name 2>/dev/null" || true)
+if [[ "$BOARD" != *"mt3000"* ]]; then
+    err "Router board is '${BOARD}', expected GL-MT3000. Aborting."
+    exit 1
+fi
+log "Confirmed GL-MT3000 (board: ${BOARD})."
+
+# --- Step 3: Get image ---
+if [ -n "$LOCAL_IMAGE" ]; then
+    # User provided a local image
+    if [ ! -f "$LOCAL_IMAGE" ]; then
+        err "Image file not found: ${LOCAL_IMAGE}"
+        exit 1
+    fi
+    log "Using provided image: ${LOCAL_IMAGE}"
+else
+    # Download the image
+    log "Downloading OpenWrt ${OPENWRT_VERSION} sysupgrade image..."
+    mkdir -p "$DOWNLOAD_DIR"
+
+    if [ -f "$DEFAULT_IMAGE" ]; then
+        warn "Image already exists locally, skipping download."
+    else
+        # Test if HTTPS is being intercepted (common with GL.iNet routers)
+        CERT_ISSUE=false
+        CERT_INFO=$(curl -v --connect-timeout 5 "https://downloads.openwrt.org" 2>&1 || true)
+        if echo "$CERT_INFO" | grep -qi "GLiNet\|gl-inet\|self-signed"; then
+            CERT_ISSUE=true
+            warn "HTTPS interception detected — the router is MITM-ing TLS connections."
+            warn "This is the same issue that breaks Tailscale."
+        fi
+
+        if [ "$CERT_ISSUE" = true ]; then
+            warn "Attempting download via HTTP..."
+            HTTP_URL="${IMAGE_URL/https:/http:}"
+            if ! curl -fSL --progress-bar --connect-timeout 10 -o "$DEFAULT_IMAGE" "$HTTP_URL" 2>/dev/null; then
+                err ""
+                err "Download failed. The router is intercepting HTTPS and HTTP is also blocked."
+                err ""
+                err "Workaround: download the image on a machine NOT behind this router,"
+                err "then run this script with --image /path/to/${IMAGE_NAME}"
+                err ""
+                err "Direct download URL:"
+                err "  ${IMAGE_URL}"
+                err ""
+                exit 1
+            fi
+        else
+            if ! curl -fSL --progress-bar -o "$DEFAULT_IMAGE" "$IMAGE_URL"; then
+                err "Download failed from ${IMAGE_URL}"
+                exit 1
+            fi
+        fi
+    fi
+    LOCAL_IMAGE="$DEFAULT_IMAGE"
+fi
+
+log "Image ready: $(ls -lh "$LOCAL_IMAGE" | awk '{print $5}')"
+
+# --- Step 4: Verify checksum ---
+log "Verifying SHA256 checksum..."
+EXPECTED_HASH=""
+CHECKSUM_ATTEMPTS=(
+    "https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums"
+    "http://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums"
+)
+
+for url in "${CHECKSUM_ATTEMPTS[@]}"; do
+    EXPECTED_HASH=$(curl -fsSL --connect-timeout 5 "$url" 2>/dev/null | grep "${IMAGE_NAME}" | awk '{print $1}' || true)
+    if [ -n "$EXPECTED_HASH" ]; then
+        break
+    fi
+done
+
+if [ -n "$EXPECTED_HASH" ]; then
+    ACTUAL_HASH=$(sha256sum "$LOCAL_IMAGE" | awk '{print $1}')
+    if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+        err "Checksum mismatch!"
+        err "  Expected: ${EXPECTED_HASH}"
+        err "  Actual:   ${ACTUAL_HASH}"
+        exit 1
+    fi
+    log "Checksum OK: ${ACTUAL_HASH:0:16}..."
+else
+    warn "Could not fetch expected checksum (network issue?), skipping verification."
+fi
+
+# --- Step 5: Pre-flash checks ---
+log "Running pre-flash checks on router..."
+
+# Check free space on /tmp
+FREE_KB=$($SSH_CMD "df /tmp | tail -1 | awk '{print \$4}'")
+IMAGE_SIZE_KB=$(( $(stat -c%s "$LOCAL_IMAGE") / 1024 ))
+if [ "$FREE_KB" -lt "$((IMAGE_SIZE_KB + 10240))" ]; then
+    err "Not enough space on /tmp. Need ~$((IMAGE_SIZE_KB/1024))MB, have $((FREE_KB/1024))MB."
+    exit 1
+fi
+log "Free space on /tmp: $((FREE_KB/1024))MB, image: $((IMAGE_SIZE_KB/1024))MB — OK."
+
+# Verify current firmware
+CURRENT_FW=$($SSH_CMD "cat /etc/openwrt_release 2>/dev/null | grep DISTRIB_DESCRIPTION" || true)
+log "Current firmware: ${CURRENT_FW}"
+
+# --- Step 6: Upload image ---
+log "Uploading image to router..."
+
+# Try SCP first, fall back to pipe (GL.iNet firmware lacks sftp-server)
+if command -v scp >/dev/null 2>&1 && \
+   sshpass -p "$PASSWORD" scp -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o BatchMode=yes "$LOCAL_IMAGE" "${SSH_USER}@${ROUTER}:/tmp/openwrt-sysupgrade.bin" 2>/dev/null; then
+    log "Upload complete (via SCP)."
+else
+    log "SCP unavailable on router, using pipe transfer..."
+    cat "$LOCAL_IMAGE" | $SSH_CMD "cat > /tmp/openwrt-sysupgrade.bin"
+    log "Upload complete (via pipe)."
+fi
+
+# Verify uploaded file
+REMOTE_HASH=$($SSH_CMD "sha256sum /tmp/openwrt-sysupgrade.bin | awk '{print \$1}'")
+LOCAL_HASH=$(sha256sum "$LOCAL_IMAGE" | awk '{print $1}')
+if [ "$REMOTE_HASH" != "$LOCAL_HASH" ]; then
+    err "Remote file hash mismatch after upload!"
+    $SSH_CMD "rm -f /tmp/openwrt-sysupgrade.bin"
+    exit 1
+fi
+log "Remote file verified."
+
+# --- Step 7: Flash ---
+echo ""
+log "============================================"
+log "FLASHING STOCK OPENWRT ${OPENWRT_VERSION}"
+log "The router will reboot. This takes ~3-5 min."
+log "After flash, OpenWrt will be at ${NEW_IP}"
+log "============================================"
+echo ""
+
+$SSH_CMD "sysupgrade -n /tmp/openwrt-sysupgrade.bin" &
+SCP_PID=$!
+
+# sysupgrade disconnects SSH, wait for it
+wait $SCP_PID 2>/dev/null || true
+
+log "Flash initiated. Waiting for router to reboot..."
+sleep 15
+
+# --- Step 8: Wait for new router ---
+log "Waiting for stock OpenWrt at ${NEW_IP}..."
+for i in $(seq 1 90); do
+    if ping -c1 -W2 "$NEW_IP" >/dev/null 2>&1; then
+        log "Router is up at ${NEW_IP}!"
+        break
+    fi
+    if [ $i -eq 90 ]; then
+        warn "Router not responding at ${NEW_IP} after 3 minutes."
+        warn "It may still be booting. Try: ssh root@${NEW_IP}"
+        warn "If unreachable, hold reset for U-Boot recovery at 192.168.1.1"
+        exit 1
+    fi
+    printf "\r  Waiting... (%d/90)" $i
+    sleep 2
+done
+echo ""
+
+# --- Step 9: Verify new firmware ---
+log "Verifying new firmware..."
+for attempt in 1 2 3; do
+    if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new root@${NEW_IP} "cat /etc/openwrt_release" 2>/dev/null; then
+        echo ""
+        log "============================================"
+        log "FLASH COMPLETE"
+        log "Stock OpenWrt is running at ${NEW_IP}"
+        log "Login: root (no password)"
+        log "Run 'passwd' to set a root password."
+        log "============================================"
+        exit 0
+    fi
+    sleep 5
+done
+
+warn "Could not verify firmware. Router is reachable but SSH may still be starting."
+warn "Try: ssh root@${NEW_IP}"

scripts/gl-inet-enable-ssh.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# ./gl-inet-enable-ssh.sh <password> [router-ip]
+#
+# Defaults to 192.168.8.1. It does:
+#
+# 1. Completes OOBE/init (sets password + enables SSH)
+# 2. Challenge-response login
+# 3. Explicitly enables SSH via API
+# 4. Verifies SSH is working
+#
+# Needs curl, python3, openssl, sshpass, and md5sum on the machine running it.
+
+set -euo pipefail
+
+ROUTER="${GL_ROUTER:-192.168.8.1}"
+PASSWORD="${1:?Usage: $0 <password> [router-ip]}"
+HOST="${2:-$ROUTER}"
+
+challenge() {
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"challenge\",\"params\":{\"username\":\"root\"},\"id\":1}"
+}
+
+login() {
+  local hash="$1"
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"username\":\"root\",\"hash\":\"$hash\"},\"id\":2}"
+}
+
+rpc_call() {
+  local sid="$1" module="$2" method="$3" params="$4"
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"call\",\"params\":[\"$sid\",\"$module\",\"$method\",$params],\"id\":3}"
+}
+
+# Step 1: Complete OOBE / init (enables SSH)
+echo "Initializing router..."
+INIT=$(curl -sk "http://$HOST/rpc" \
+  -H "Content-Type: application/json" \
+  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"call\",\"params\":[\"\",\"ui\",\"init\",{\"lang\":\"en\",\"username\":\"root\",\"password\":\"$PASSWORD\",\"security_rule\":0}]}")
+echo "$INIT"
+
+if echo "$INIT" | grep -q '"error"'; then
+  echo "Init returned error (may already be initialized), continuing..."
+fi
+
+sleep 1
+
+# Step 2: Challenge-response login
+echo "Logging in..."
+CHALLENGE=$(challenge)
+SALT=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['salt'])")
+NONCE=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['nonce'])")
+ALG=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['alg'])")
+
+CIPHER=$(openssl passwd "-$ALG" -salt "$SALT" "$PASSWORD" 2>/dev/null)
+HASH=$(printf "root:%s:%s" "$CIPHER" "$NONCE" | md5sum | cut -d' ' -f1)
+
+LOGIN=$(login "$HASH")
+SID=$(echo "$LOGIN" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['sid'])" 2>/dev/null)
+
+if [ -z "$SID" ]; then
+  echo "Login failed: $LOGIN"
+  echo "SSH should still be enabled from the init call. Try: ssh root@$HOST"
+  exit 1
+fi
+
+echo "Logged in. SID: $SID"
+
+# Step 3: Enable SSH explicitly
+echo "Enabling SSH..."
+SSH_RESULT=$(rpc_call "$SID" "system" "set_settings" '{"key":"ssh","value":{"enable":true}}')
+echo "$SSH_RESULT"
+
+# Step 4: Verify SSH
+echo "Verifying SSH on $HOST:22..."
+if sshpass -p "$PASSWORD" ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@$HOST "echo SSH OK" 2>/dev/null; then
+  echo "Done. SSH is enabled on root@$HOST"
+else
+  echo "SSH port not responding yet. May need a moment or SSH may already be enabled."
+  echo "Try: ssh root@$HOST"
+fi

scripts/self-update.sh

@@ -84,64 +84,6 @@ if ! command -v nano >/dev/null 2>&1; then
     fi
 fi
 
-if ! command -v ping >/dev/null 2>&1; then
-    log "Installing iputils-ping..."
-    if sudo apt-get update -qq 2>>"$LOG_FILE" && sudo apt-get install -y -qq iputils-ping 2>>"$LOG_FILE"; then
-        ok "ping installed"
-    else
-        warn "Unable to install ping automatically; continuing update"
-    fi
-fi
-
-if ! command -v esptool >/dev/null 2>&1; then
-    log "Installing esptool for LoRa radio firmware flashing..."
-    if sudo apt-get update -qq 2>>"$LOG_FILE" && sudo apt-get install -y -qq esptool 2>>"$LOG_FILE"; then
-        ok "esptool installed"
-    else
-        warn "Unable to install esptool automatically; radio firmware flashing will be unavailable"
-    fi
-fi
-
-# Debian's esptool package (4.7.0+dfsg-0.1) ships without the precompiled
-# esp32s3 "stub flasher" blob (stripped for DFSG compliance — no
-# buildable-from-source path Debian could verify). Without it, esptool's
-# normal stub-loader mode fails outright (FileNotFoundError), and the ROM
-# bootloader fallback (--no-stub) doesn't implement a full-chip erase at
-# all — confirmed live 2026-07-23 flashing a real Heltec V4, both ways.
-# Fetching the exact same file from the matching upstream esptool release
-# tag restores full (and correct) flashing behavior — it's the same
-# open-source codebase, just the one blob Debian's packaging couldn't
-# include.
-if command -v esptool >/dev/null 2>&1; then
-    STUB_DIR="/usr/lib/python3/dist-packages/esptool/targets/stub_flasher"
-    STUB_FILE="$STUB_DIR/stub_flasher_32s3.json"
-    if [ ! -f "$STUB_FILE" ]; then
-        log "Fetching esptool's esp32s3 stub flasher (missing from the Debian package)..."
-        ESPTOOL_VERSION=$(esptool version 2>/dev/null | tail -1 | tr -d ' \t')
-        if [ -n "$ESPTOOL_VERSION" ] && sudo curl -fsSL -o "$STUB_FILE" \
-            "https://raw.githubusercontent.com/espressif/esptool/v${ESPTOOL_VERSION}/esptool/targets/stub_flasher/stub_flasher_32s3.json" \
-            2>>"$LOG_FILE"; then
-            sudo chmod 644 "$STUB_FILE"
-            ok "esp32s3 stub flasher installed"
-        else
-            sudo rm -f "$STUB_FILE" 2>/dev/null
-            warn "Unable to fetch esp32s3 stub flasher; LoRa firmware flashing will be unavailable"
-        fi
-    fi
-fi
-
-# Build-time prerequisites for reticulum-daemon/build.sh's PyInstaller step
-# below (discovered the hard way: ensurepip needs python3-venv, and
-# PyInstaller itself needs objdump + libpython3.13.so at build time — none
-# of these are pulled in by a bare `python3` package on Debian trixie).
-for pkg in python3-venv binutils libpython3.13; do
-    if ! dpkg -s "$pkg" >/dev/null 2>&1; then
-        log "Installing $pkg (reticulum-daemon build prerequisite)..."
-        sudo apt-get update -qq 2>>"$LOG_FILE" && sudo apt-get install -y -qq "$pkg" 2>>"$LOG_FILE" \
-            || warn "Unable to install $pkg automatically; reticulum-daemon tools build may fail"
-    fi
-done
-
 # Fetch latest
 log "Fetching from origin..."
 git fetch origin main --quiet 2>>"$LOG_FILE"
@@ -213,30 +155,6 @@ sudo cp "$BUILT_BIN" "$INSTALL_BIN"
 sudo chmod +x "$INSTALL_BIN"
 ok "Backend installed"
 
-# Build + install reticulum-daemon tools (archy-reticulum-daemon, archy-rnodeconf).
-# Non-fatal: archipelago falls back to its dev venv path if the packaged
-# binaries aren't present, so a missing/failed build here degrades mesh
-# Reticulum support rather than breaking the update. This mirrors
-# deploy-to-target.sh's existing manual-deploy step, which until now was the
-# only path that ever installed these — a node that only ever received OTA
-# self-updates had neither binary.
-if [ -f "$REPO_DIR/reticulum-daemon/build.sh" ]; then
-    log "Building reticulum-daemon tools (archy-reticulum-daemon, archy-rnodeconf)..."
-    if (cd "$REPO_DIR/reticulum-daemon" && ./build.sh) 2>>"$LOG_FILE"; then
-        for tool in archy-reticulum-daemon archy-rnodeconf; do
-            if [ -f "$REPO_DIR/reticulum-daemon/dist/$tool" ]; then
-                sudo cp "$REPO_DIR/reticulum-daemon/dist/$tool" /usr/local/bin/
-                sudo chmod +x "/usr/local/bin/$tool"
-                ok "$tool installed"
-            else
-                warn "$tool not built — leaving existing /usr/local/bin/$tool (if any) in place"
-            fi
-        done
-    else
-        warn "reticulum-daemon tools build failed — continuing without updating them"
-    fi
-fi
-
 # Build frontend
 log "Building Vue frontend (production)..."
 cd "$FRONTEND_DIR"

tests/mesh/run-mesh-tests.sh

@@ -1,85 +0,0 @@
-#!/bin/bash
-# Mesh / Reticulum test suite — the "is the mesh stack healthy" gate.
-#
-# Three layers, cheapest first:
-#   1. Rust unit tests        (no hardware, ~2s once built)
-#   2. Daemon selftest        (full RNS+LXMF bring-up, no radio; also verifies
-#                              the announce app_data wire contract + set_name)
-#   3. Live-node assertions   (optional; needs a running archipelago with a
-#                              radio — set MESH_TEST_LIVE=1 MESH_TEST_PW=...)
-#
-# Usage:
-#   tests/mesh/run-mesh-tests.sh                # layers 1+2
-#   MESH_TEST_LIVE=1 MESH_TEST_PW='...' tests/mesh/run-mesh-tests.sh
-#   MESH_TEST_HOST=100.113.100.55 ...           # live-test a remote node
-set -u
-cd "$(dirname "$0")/../.."
-FAIL=0
-ok()   { echo "ok  - $1"; }
-bad()  { echo "not ok - $1"; FAIL=1; }
-
-# ── 1. Rust unit tests ────────────────────────────────────────────────
-RUST_RESULTS=$(cd core && cargo test -p archipelago --bin archipelago mesh 2>&1 | grep "^test result:")
-if [ -n "$RUST_RESULTS" ] && ! echo "$RUST_RESULTS" | grep -vq " 0 failed"; then
-    ok "rust mesh unit tests ($(echo "$RUST_RESULTS" | grep -o '[0-9]* passed' | head -1))"
-else
-    bad "rust mesh unit tests"
-fi
-
-# ── 2. Reticulum daemon selftest (no radio) ───────────────────────────
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-head -c 32 /dev/urandom > "$TMP/key"
-DAEMON=reticulum-daemon/.venv/bin/python
-if [ -x "$DAEMON" ]; then
-    if "$DAEMON" reticulum-daemon/reticulum_daemon.py \
-        --identity-key "$TMP/key" --rns-config "$TMP/rns" \
-        --socket "$TMP/sock" --display-name "SelftestNode" --selftest 2>/dev/null \
-        | grep -q "announce_app_data=verified set_name=verified"; then
-        ok "daemon selftest (announce wire contract + set_name)"
-    else
-        bad "daemon selftest"
-    fi
-else
-    echo "skip - daemon selftest (no venv at $DAEMON)"
-fi
-
-# ── 3. Live node assertions (opt-in) ──────────────────────────────────
-if [ "${MESH_TEST_LIVE:-0}" = "1" ]; then
-    HOST="${MESH_TEST_HOST:-127.0.0.1}"
-    PW="${MESH_TEST_PW:?set MESH_TEST_PW}"
-    # Nodes differ: dev boxes serve plain http on :80, ISO installs https.
-    RPC=""
-    for base in "http://$HOST" "https://$HOST" "http://$HOST:5678"; do
-        code=$(curl -ksS -o /dev/null -w '%{http_code}' -m 5 -X POST "$base/rpc/v1" 2>/dev/null || true)
-        case "$code" in 000|"") continue ;; *) RPC="$base/rpc/v1"; break ;; esac
-    done
-    [ -n "$RPC" ] || { bad "live: no RPC endpoint reachable on $HOST"; echo FAIL; exit 1; }
-    JAR="$TMP/jar"
-    curl -ksS -c "$JAR" -H "Content-Type: application/json" \
-        -d "{\"jsonrpc\":\"2.0\",\"method\":\"auth.login\",\"params\":{\"password\":\"$PW\"},\"id\":1}" \
-        "$RPC" > "$TMP/login"
-    if grep -q '"error":null' "$TMP/login"; then ok "live: rpc login"; else bad "live: rpc login"; fi
-    call() {
-        local csrf; csrf=$(awk '/^[^#]/ && /csrf_token/ {print $7; exit}' "$JAR")
-        curl -ksS -b "$JAR" -c "$JAR" -H "Content-Type: application/json" \
-            -H "X-CSRF-Token: $csrf" \
-            -d "{\"jsonrpc\":\"2.0\",\"method\":\"$1\",\"params\":${2:-{\}},\"id\":2}" \
-            --max-time 60 "$RPC"
-    }
-    ST=$(call mesh.status)
-    echo "$ST" | grep -q '"device_connected":true' \
-        && ok "live: radio connected ($(echo "$ST" | grep -o '"device_type":"[a-z]*"'))" \
-        || bad "live: radio connected"
-    echo "$ST" | grep -q '"self_advert_name":"[^"]' \
-        && ok "live: node has a mesh name" || bad "live: node has a mesh name"
-    call mesh.refresh | grep -q '"refreshed":true' \
-        && ok "live: mesh.refresh" || bad "live: mesh.refresh"
-    call mesh.broadcast | grep -q '"broadcast":true' \
-        && ok "live: mesh.broadcast" || bad "live: mesh.broadcast"
-    # No peer may ever display a raw identity blob as its name.
-    call mesh.peers | grep -q '"advert_name":"ARCHY:' \
-        && bad "live: no ARCHY-blob peer names" || ok "live: no ARCHY-blob peer names"
-fi
-
-[ "$FAIL" = 0 ] && echo "PASS" || { echo "FAIL"; exit 1; }