fix(server): web UI listens on IPv6 — the mesh could never load it

The mesh is IPv6-only; the main web listener bound 0.0.0.0 only, so a
phone reaching a node over its fips0 ULA got RST on :80
(ERR_CONNECTION_ABORTED) — UI over mesh was structurally impossible.
Confirmed 2026-07-26 on framework-pt: v4:80 = 200, v6:80 = refused.
Mirror an IPv4-any main listener with a V6ONLY [::] socket on the same
port; V6ONLY so it coexists with the v4 listener regardless of
net.ipv6.bindv6only.

Also: fips.yaml generator carries the fast-reconnect profile (validated
live on framework-pt since 2026-07-24; snapshot tests updated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Android/COMPANION_RELEASE.md

@@ -23,6 +23,10 @@ used by the `.githooks/pre-push` hook), which:
    **aborts** if any is missing.
 5. Stages the signed APK at `neode-ui/public/packages/archipelago-companion.apk`,
    commits, and pushes with `SHIP_COMPANION=1` (the sanctioned pre-push bypass).
+6. The first-launch companion modal and Android "Share this app" QR point at
+   `http://146.59.87.168:2100/packages/archipelago-companion.apk`. After the
+   repo artifact is built, mirror that exact APK to the VPS2-served path before
+   calling the release done.
 
 **Never** hand-roll `gradlew assembleDebug` + `cp` to the served path. That path
 skips the clean build and the signature enforcement and is exactly how a broken
@@ -82,13 +86,16 @@ home-screen app layouts wiped by an over-broad action.
 
 ## Verify the published download after shipping
 
-The download served to nodes is Gitea raw-on-main. Confirm the live bytes match
-what you built and signed:
+The checked-in artifact is Gitea raw-on-main. The QR/App Store download served
+to users is the VPS2 `:2100` URL. Confirm both live byte streams match what you
+built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
-curl -sS -o /tmp/live.apk "$URL"
-shasum -a 256 "$SERVED" /tmp/live.apk          # must match
-apksigner verify -v --min-sdk-version 21 /tmp/live.apk | grep -i "scheme"  # v1/v2/v3 = true
+GITEA_URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
+QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
+curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
+curl -sS -o /tmp/live-qr.apk "$QR_URL"
+shasum -a 256 "$SERVED" /tmp/live-gitea.apk /tmp/live-qr.apk  # all must match
+apksigner verify -v --min-sdk-version 21 /tmp/live-qr.apk | grep -i "scheme"  # v1/v2/v3 = true
 ```

Android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 29
-        versionName = "0.5.9"
+        versionCode = 38
+        versionName = "0.5.18"
 
         vectorDrawables {
             useSupportLibrary = true

Android/app/src/main/java/com/archipelago/app/data/ServerQrParser.kt

@@ -88,8 +88,18 @@ object ServerQrParser {
 
     private fun parseFips(uri: Uri): FipsPairInfo? {
         val npub = uri.getQueryParameter("fnpub")?.trim()
-        val host = uri.getQueryParameter("fhost")?.trim()
+        var host = uri.getQueryParameter("fhost")?.trim()
         if (npub.isNullOrBlank() || host.isNullOrBlank()) return null
+        // A .fips fhost is a dead dial hint: Android's system DNS can't
+        // resolve .fips, so every handshake send fails and first connect
+        // falls back to slow anchor discovery. If the QR's `url` host is a
+        // real address, dial that instead (QRs minted while the node UI was
+        // browsed over the mesh carry npub….fips here).
+        if (host.endsWith(".fips")) {
+            val urlHost = uri.getQueryParameter("url")
+                ?.let { runCatching { Uri.parse(it).host }.getOrNull() }
+            if (!urlHost.isNullOrBlank() && !urlHost.endsWith(".fips")) host = urlHost
+        }
         return FipsPairInfo(
             npub = npub,
             ula = uri.getQueryParameter("fip")?.trim().orEmpty(),

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -25,6 +25,26 @@ internal const val ARCHY_ANCHOR_NPUB =
 internal const val ARCHY_ANCHOR_ADDR = "146.59.87.168:8444"
 internal const val ARCHY_ANCHOR_TRANSPORT = "tcp"
 
+/**
+ * Public FIPS network anchors (join.fips.network — the dual-transport TCP
+ * pair; keep in lockstep with core/archipelago/src/fips/anchors.rs
+ * fips_network_anchors()). Baked into every pairing at trailing priority so
+ * a degraded/unreachable vps2 anchor can never strand the phone: the mesh
+ * still joins the public tree and routes to the node through it.
+ */
+internal val PUBLIC_FIPS_ANCHORS = listOf(
+    Triple(
+        "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u",
+        "23.182.128.74:443",
+        "tcp",
+    ),
+    Triple(
+        "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98",
+        "217.77.8.91:443",
+        "tcp",
+    ),
+)
+
 /**
  * Mesh identity + known node peers. Follows the same plaintext-DataStore
  * storage model as ServerPreferences (the server password lives there the
@@ -126,7 +146,7 @@ class FipsPreferences(private val context: Context) {
             if (peer.ip.isBlank() || peer.port <= 0) continue
             merged.put(JSONObject().apply {
                 put("npub", peer.npub)
-                put("alias", peer.name.ifBlank { "Party phone" })
+                put("alias", hostSafeAlias(peer.name.ifBlank { "party-phone" }))
                 put("addresses", JSONArray().put(JSONObject().apply {
                     put("transport", "udp")
                     put("addr", "${peer.ip}:${peer.port}")
@@ -145,7 +165,7 @@ class FipsPreferences(private val context: Context) {
         ) {
             merged.put(JSONObject().apply {
                 put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "Archipelago anchor")
+                put("alias", "archipelago-anchor")
                 put("addresses", JSONArray().put(JSONObject().apply {
                     put("transport", ARCHY_ANCHOR_TRANSPORT)
                     put("addr", ARCHY_ANCHOR_ADDR)
@@ -153,9 +173,40 @@ class FipsPreferences(private val context: Context) {
                 }))
             })
         }
+        // Backfill anchor peers for entries paired before newer QR/app
+        // releases added them. `upsertNodePeer` persists these on re-scan, but
+        // startup must also self-heal old DataStore state so updating the APK is
+        // enough to get off-LAN redundancy.
+        if (merged.length() > 0) {
+            addAnchorIfMissing(merged, ARCHY_ANCHOR_NPUB, "archipelago-anchor", ARCHY_ANCHOR_ADDR, ARCHY_ANCHOR_TRANSPORT, 40)
+            for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+                val (npub, addr, transport) = anchor
+                addAnchorIfMissing(merged, npub, "fips-network-anchor-${i + 1}", addr, transport, 50 + i * 10)
+            }
+        }
         return merged.toString()
     }
 
+    private fun addAnchorIfMissing(
+        peers: JSONArray,
+        npub: String,
+        alias: String,
+        addr: String,
+        transport: String,
+        priority: Int,
+    ) {
+        if ((0 until peers.length()).any { peers.optJSONObject(it)?.optString("npub") == npub }) return
+        peers.put(JSONObject().apply {
+            put("npub", npub)
+            put("alias", alias)
+            put("addresses", JSONArray().put(JSONObject().apply {
+                put("transport", transport)
+                put("addr", addr)
+                put("priority", priority)
+            }))
+        })
+    }
+
     private fun parsePartyPeers(json: String): List<PartyPeer> = try {
         val arr = JSONArray(json)
         (0 until arr.length()).mapNotNull { i ->
@@ -200,16 +251,19 @@ class FipsPreferences(private val context: Context) {
         val incoming = mutableListOf<JSONObject>()
         incoming += JSONObject().apply {
             put("npub", info.npub)
-            put("alias", alias.ifBlank { "Archipelago" })
+            put("alias", hostSafeAlias(alias.ifBlank { "Archipelago" }))
             val addresses = JSONArray()
-            if (info.udpPort > 0) {
+            // .fips hosts are unresolvable on Android (no system .fips DNS):
+            // storing one gives the mesh a dial target that fails every
+            // handshake and stalls first connect on anchor discovery.
+            if (info.udpPort > 0 && !info.host.endsWith(".fips")) {
                 addresses.put(JSONObject().apply {
                     put("transport", "udp")
                     put("addr", "${info.host}:${info.udpPort}")
                     put("priority", 10)
                 })
             }
-            if (info.tcpPort > 0) {
+            if (info.tcpPort > 0 && !info.host.endsWith(".fips")) {
                 addresses.put(JSONObject().apply {
                     put("transport", "tcp")
                     put("addr", "${info.host}:${info.tcpPort}")
@@ -220,9 +274,10 @@ class FipsPreferences(private val context: Context) {
         }
         for (anchor in info.anchors) {
             if (anchor.npub == info.npub) continue
+            if (anchor.addr.substringBeforeLast(":").endsWith(".fips")) continue
             incoming += JSONObject().apply {
                 put("npub", anchor.npub)
-                put("alias", "Mesh anchor")
+                put("alias", "mesh-anchor")
                 put("addresses", JSONArray().put(JSONObject().apply {
                     put("transport", anchor.transport)
                     put("addr", anchor.addr)
@@ -237,7 +292,7 @@ class FipsPreferences(private val context: Context) {
         ) {
             incoming += JSONObject().apply {
                 put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "Archipelago anchor")
+                put("alias", "archipelago-anchor")
                 put("addresses", JSONArray().put(JSONObject().apply {
                     put("transport", ARCHY_ANCHOR_TRANSPORT)
                     put("addr", ARCHY_ANCHOR_ADDR)
@@ -245,6 +300,21 @@ class FipsPreferences(private val context: Context) {
                 }))
             }
         }
+        // And the public FIPS network anchors at trailing priority, so one
+        // degraded rendezvous (vps2, 2026-07-24) can never strand the phone.
+        for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+            val (npub, addr, transport) = anchor
+            if (info.npub == npub || incoming.any { it.optString("npub") == npub }) continue
+            incoming += JSONObject().apply {
+                put("npub", npub)
+                put("alias", "fips-network-anchor-${i + 1}")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", transport)
+                    put("addr", addr)
+                    put("priority", 50 + i * 10)
+                }))
+            }
+        }
         val incomingNpubs = incoming.map { it.optString("npub") }.toSet()
         context.fipsDataStore.edit { prefs ->
             val current = JSONArray(prefs[peersKey] ?: "[]")
@@ -258,3 +328,14 @@ class FipsPreferences(private val context: Context) {
         }
     }
 }
+
+/**
+ * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
+ * that isn't a valid DNS label ("Framework PT" — the space) gets rejected and
+ * silently drops the peer from name resolution. Slug it instead of losing it.
+ */
+internal fun hostSafeAlias(alias: String): String =
+    alias.lowercase()
+        .replace(Regex("[^a-z0-9.-]+"), "-")
+        .trim('-', '.')
+        .ifBlank { "archipelago" }

Android/app/src/main/java/com/archipelago/app/ui/components/MeshLoadingScreen.kt

@@ -1,6 +1,7 @@
 package com.archipelago.app.ui.components
 
 import androidx.compose.foundation.background
+import androidx.compose.foundation.border
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Spacer
@@ -12,6 +13,7 @@ import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
@@ -37,7 +39,22 @@ fun MeshLoadingScreen(message: String = "Dialing your node by its key — no IPs
         contentAlignment = Alignment.Center,
     ) {
         Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            PixelArtLogo(Modifier.size(96.dp))
+            // The brand's circle-container logo (as on the connect screen /
+            // web login): pixel-art "a" centered in a black disc.
+            Box(
+                Modifier
+                    .size(120.dp)
+                    .clip(androidx.compose.foundation.shape.CircleShape)
+                    .background(Color.Black)
+                    .border(
+                        1.dp,
+                        Color.White.copy(alpha = 0.14f),
+                        androidx.compose.foundation.shape.CircleShape,
+                    ),
+                contentAlignment = Alignment.Center,
+            ) {
+                PixelArtLogo(Modifier.size(64.dp))
+            }
             Spacer(Modifier.height(20.dp))
             Text(
                 text = "F*CK IPs MESH",

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -23,20 +23,26 @@ import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.WindowInsetsSides
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.navigationBars
+import androidx.compose.foundation.layout.only
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.safeDrawing
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.statusBars
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.windowInsetsBottomHeight
 import androidx.compose.foundation.layout.windowInsetsPadding
 import androidx.compose.foundation.layout.windowInsetsTopHeight
 import androidx.compose.foundation.shape.RoundedCornerShape
@@ -66,6 +72,7 @@ import androidx.compose.runtime.snapshotFlow
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
@@ -150,6 +157,34 @@ private object KioskWebView {
     }
 }
 
+/** Inject the safe-area CSS vars from the CURRENT window insets. Android
+ *  WebView doesn't populate env(safe-area-inset-*); worse, on a cold start
+ *  onPageFinished can run before the view is attached — rootWindowInsets is
+ *  null then, and injecting 0px collapsed the UI's top/bottom margins (and
+ *  put the tab bar inside the gesture zone, killing its taps). Called from
+ *  onPageFinished, from the window-insets listener (fires when real insets
+ *  arrive), and on reattach. */
+private fun injectSafeAreaVars(view: WebView) {
+    val insets = view.rootWindowInsets ?: return // listener re-fires when real
+    val density = view.resources.displayMetrics.density
+    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
+    val sab = (insets.getInsets(android.view.WindowInsets.Type.navigationBars()).bottom / density).toInt()
+    view.evaluateJavascript(
+        """
+        (function() {
+            var style = document.getElementById('archipelago-android-insets');
+            if (!style) {
+                style = document.createElement('style');
+                style.id = 'archipelago-android-insets';
+                document.head.appendChild(style);
+            }
+            style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
+        })();
+        """.trimIndent(),
+        null,
+    )
+}
+
 /** True when a TCP listener answers at [base]'s host:port within [timeoutMs]. */
 private fun tcpAnswers(base: String, timeoutMs: Int): Boolean = try {
     val u = android.net.Uri.parse(base)
@@ -429,6 +464,14 @@ fun WebViewScreen(
 
                         val webViewRef = this
 
+                        // Re-inject the safe-area vars whenever REAL insets
+                        // arrive — on cold start onPageFinished often beats
+                        // window attachment and would otherwise bake in 0px.
+                        setOnApplyWindowInsetsListener { v, insets ->
+                            (v as? WebView)?.let { injectSafeAreaVars(it) }
+                            v.onApplyWindowInsets(insets)
+                        }
+
                         // Decide where an outbound URL goes:
                         //  - same host as the node  → in-app WebView overlay
                         //    (this is the "open in browser" target for apps the
@@ -515,34 +558,7 @@ fun WebViewScreen(
                                 isLoading = false
                                 if (view == null) return
 
-                                // Convert physical pixels → CSS pixels
-                                val density = view.resources.displayMetrics.density
-                                val satPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.statusBars())
-                                    ?.top ?: 0
-                                val sabPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.navigationBars())
-                                    ?.bottom ?: 0
-                                val sat = (satPx / density).toInt()
-                                val sab = (sabPx / density).toInt()
-
-                                // Android WebView doesn't populate env(safe-area-inset-*).
-                                // Set CSS custom properties the web UI can use as fallback:
-                                //   var(--safe-area-top, env(safe-area-inset-top, 0px))
-                                view.evaluateJavascript(
-                                    """
-                                    (function() {
-                                        var style = document.getElementById('archipelago-android-insets');
-                                        if (!style) {
-                                            style = document.createElement('style');
-                                            style.id = 'archipelago-android-insets';
-                                            document.head.appendChild(style);
-                                        }
-                                        style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
-                                    })();
-                                    """.trimIndent(),
-                                    null,
-                                )
+                                injectSafeAreaVars(view)
 
                                 // Auto-login with the stored password (QR pairing /
                                 // saved server) — only on our own server's pages
@@ -733,10 +749,12 @@ fun WebViewScreen(
                         } else {
                             // Reattached views keep stale measurements until an
                             // input event — that was the top/bottom UI being
-                            // wrong until a tap. Force a fresh pass.
+                            // wrong until a tap. Force a fresh pass, and re-sync
+                            // the page's safe-area vars while we're at it.
                             post {
                                 requestLayout()
                                 invalidate()
+                                injectSafeAreaVars(this)
                             }
                         }
                     }
@@ -917,7 +935,13 @@ private fun InAppBrowser(
         modifier = Modifier
             .fillMaxSize()
             .background(SurfaceBlack)
-            .windowInsetsPadding(WindowInsets.safeDrawing),
+            // Bottom inset handled by the touch-shield strip below the bar —
+            // NOT by padding: a padded area only paints, it doesn't consume,
+            // so taps in the gesture strip fell straight THROUGH this overlay
+            // into the kiosk's tab bar behind it (accidental AIUI-tab hits).
+            .windowInsetsPadding(
+                WindowInsets.safeDrawing.only(WindowInsetsSides.Horizontal + WindowInsetsSides.Top)
+            ),
     ) {
         // WebView + loading overlay fill the area above the bottom control bar.
         Box(modifier = Modifier.weight(1f).fillMaxWidth()) {
@@ -1106,6 +1130,21 @@ private fun InAppBrowser(
                 )
             }
         }
+
+        // Touch-shield over the gesture-nav strip: solid black AND consumes
+        // taps — stray touches below the control bar landed on the kiosk's
+        // tab bar behind this overlay (opening the AIUI chat by accident).
+        Box(
+            Modifier
+                .fillMaxWidth()
+                .windowInsetsBottomHeight(WindowInsets.navigationBars)
+                .background(Color.Black)
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = {},
+                ),
+        )
     }
 }
 

Android/rust/archy-fips-core/Cargo.lock

@@ -464,7 +464,7 @@ checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "fips"
 version = "0.3.0-dev"
-source = "git+https://github.com/9qeklajc/fips-native?rev=46494a74fc85b878305d275d42ab719082b06ba6#46494a74fc85b878305d275d42ab719082b06ba6"
+source = "git+https://github.com/Zazawowow/fips-native?rev=07d21d4482be56b14295d2525e41f8386d1bfe6f#07d21d4482be56b14295d2525e41f8386d1bfe6f"
 dependencies = [
  "bech32",
  "chacha20poly1305",

Android/rust/archy-fips-core/Cargo.toml

@@ -23,7 +23,10 @@ crate-type = ["lib", "cdylib"]
 
 [dependencies]
 # default-features drops the ratatui TUI; tun-support enables Node::start_with_tun_fd.
-fips = { git = "https://github.com/9qeklajc/fips-native", rev = "46494a74fc85b878305d275d42ab719082b06ba6", default-features = false, features = ["tun-support"] }
+# Zazawowow/fips-native `fast-join-pinned` = upstream pinned rev 46494a74 +
+# discovery re-fire on topology change (fresh 5G join: first route no longer
+# waits out doomed pre-join lookups). Upstream 9qeklajc denies pushes.
+fips = { git = "https://github.com/Zazawowow/fips-native", rev = "07d21d4482be56b14295d2525e41f8386d1bfe6f", default-features = false, features = ["tun-support"] }
 anyhow = "1.0"
 serde_json = "1.0"
 hex = "0.4"

Android/rust/archy-fips-core/src/mesh.rs

@@ -85,6 +85,27 @@ pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> C
     });
     // TCP with no bind_addr = outbound-only (fallback when UDP is blocked).
     cfg.transports.tcp = TransportInstances::Single(Default::default());
+    // Fast-connect profile — a phone opens the app and expects the node NOW.
+    // Stock pacing is tuned for always-on routers: a failed discovery backs
+    // off 30s, session resends gap out to 8-16s, dead links redial at
+    // 5s→300s. Over 5G that stacked into a ~40s first connect (observed
+    // 2026-07-24: anchor +10s, session +40s). Retries only fire while a
+    // link/session is down, so steady-state traffic is unchanged.
+    cfg.node.retry.base_interval_secs = 1; // dead-link redial 1s,2s,4s…
+    cfg.node.retry.max_backoff_secs = 30; // …capped at 30s, not 5 min
+    cfg.node.retry.max_retries = 30;
+    cfg.node.rate_limit.handshake_resend_interval_ms = 400;
+    cfg.node.rate_limit.handshake_resend_backoff = 1.5;
+    cfg.node.rate_limit.handshake_max_resends = 10;
+    cfg.node.discovery.backoff_base_secs = 1; // failed lookup retries fast
+    cfg.node.discovery.backoff_max_secs = 30;
+    cfg.node.discovery.retry_interval_secs = 2;
+    cfg.node.discovery.max_attempts = 3;
+    // Lookups launched before the tree position settles are doomed; a 10s
+    // completion timeout made each one cost 10s before the 1s retry could
+    // fire (observed: 19s to a route on a fresh join). Fail fast instead —
+    // the resend-within-window above still gives each attempt two shots.
+    cfg.node.discovery.timeout_secs = 5;
     cfg.peers = peers;
     cfg
 }

CHANGELOG.md

@@ -1,7 +1,22 @@
 # Changelog
 
-## v1.7.112-alpha (2026-07-22)
+## v1.7.112-alpha (2026-07-23)
 
+- Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.
+- Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.
+- The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.
+- Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.
+- Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.
+- The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.
+- Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.
+- Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.
+- Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.
+- Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.
+- Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.
+- A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.
+- Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.
+- If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.
+- Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.
 - Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.
 - Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.
 - Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.

core/Cargo.lock

@@ -95,7 +95,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.111-alpha"
+version = "1.7.112-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.111-alpha"
+version = "1.7.112-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/handler/content.rs

@@ -202,7 +202,9 @@ impl ApiHandler {
             return Ok(build_response(
                 StatusCode::BAD_REQUEST,
                 "application/json",
-                hyper::Body::from(r#"{"error":"The seller does not accept Lightning for this item"}"#),
+                hyper::Body::from(
+                    r#"{"error":"The seller does not accept Lightning for this item"}"#,
+                ),
             ));
         }
 

core/archipelago/src/api/rpc/content.rs

@@ -443,8 +443,7 @@ impl RpcHandler {
                     && (o.content_id == content_id
                         || filename.is_some_and(|f| {
                             !f.is_empty()
-                                && o.filename.trim_start_matches('/')
-                                    == f.trim_start_matches('/')
+                                && o.filename.trim_start_matches('/') == f.trim_start_matches('/')
                         }))
             });
             if let Some(o) = already {
@@ -454,12 +453,9 @@ impl RpcHandler {
                     owned_as = %o.content_id,
                     "paid download: already owned — serving cached copy, NOT paying again"
                 );
-                if let Some((mime, bytes)) = crate::content_owned::read_owned(
-                    &self.config.data_dir,
-                    &o.onion,
-                    &o.content_id,
-                )
-                .await
+                if let Some((mime, bytes)) =
+                    crate::content_owned::read_owned(&self.config.data_dir, &o.onion, &o.content_id)
+                        .await
                 {
                     use base64::Engine;
                     return Ok(serde_json::json!({
@@ -692,10 +688,7 @@ impl RpcHandler {
                     n += 1;
                 }
                 match tokio::fs::write(&target, &bytes).await {
-                    Ok(()) => tracing::info!(
-                        "paid download: filed into {}",
-                        target.display()
-                    ),
+                    Ok(()) => tracing::info!("paid download: filed into {}", target.display()),
                     Err(e) => tracing::warn!(
                         "paid download: filing into {} failed (non-fatal): {e}",
                         target.display()

core/archipelago/src/api/rpc/fips.rs

@@ -23,9 +23,11 @@ impl RpcHandler {
     /// host/IP itself — it knows which origin the browser reached the node on.
     pub(super) async fn handle_fips_pair_info(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let npub = crate::identity::fips_npub(&identity_dir).await?.ok_or_else(|| {
-            anyhow::anyhow!("FIPS identity not provisioned yet — complete onboarding first")
-        })?;
+        let npub = crate::identity::fips_npub(&identity_dir)
+            .await?
+            .ok_or_else(|| {
+                anyhow::anyhow!("FIPS identity not provisioned yet — complete onboarding first")
+            })?;
         let ula = fips::iface::fips0_ula().map(|ip| ip.to_string());
         // The node's seed anchors ride along so the phone can rendezvous
         // through the same public mesh points when the node's LAN endpoint

core/archipelago/src/api/rpc/mod.rs

@@ -556,8 +556,8 @@ impl RpcHandler {
                         .is_some(),
                     None => false,
                 };
-            let totp_enabled = !is_token_login
-                && self.auth_manager.is_totp_enabled().await.unwrap_or(false);
+            let totp_enabled =
+                !is_token_login && self.auth_manager.is_totp_enabled().await.unwrap_or(false);
             if totp_enabled {
                 let password = login_params
                     .as_ref()

core/archipelago/src/api/rpc/package/pine_ha.rs

@@ -766,7 +766,11 @@ async fn find_satellite(port: u16) -> Option<String> {
             if self_ips.contains(&ip) {
                 continue;
             }
-            set.spawn(async move { tcp_alive(&ip.to_string(), port, 500).await.then(|| ip.to_string()) });
+            set.spawn(async move {
+                tcp_alive(&ip.to_string(), port, 500)
+                    .await
+                    .then(|| ip.to_string())
+            });
         }
         while let Some(res) = set.join_next().await {
             if let Ok(Some(ip)) = res {

core/archipelago/src/bootstrap.rs

@@ -848,11 +848,17 @@ pub async fn ensure_audio_stack() {
         {
             Ok(s) if s.success() => info!("audio: PipeWire stack installed"),
             Ok(s) => {
-                warn!("audio: package install exited with {} — will retry next start", s);
+                warn!(
+                    "audio: package install exited with {} — will retry next start",
+                    s
+                );
                 return;
             }
             Err(e) => {
-                warn!("audio: package install failed: {:#} — will retry next start", e);
+                warn!(
+                    "audio: package install failed: {:#} — will retry next start",
+                    e
+                );
                 return;
             }
         }
@@ -878,12 +884,23 @@ pub async fn ensure_audio_stack() {
     }
     if unit_was_missing {
         // First install on this node — bring it up now and on every boot.
-        let _ = host_sudo(&["systemctl", "enable", "--now", "archipelago-audio-router.service"]).await;
+        let _ = host_sudo(&[
+            "systemctl",
+            "enable",
+            "--now",
+            "archipelago-audio-router.service",
+        ])
+        .await;
         info!("audio: router installed and enabled (HDMI routing + ELD heal)");
     } else if script_changed || unit_changed {
         // Content update: restart only if it's running — never re-enable a
         // unit an operator deliberately disabled.
-        let _ = host_sudo(&["systemctl", "try-restart", "archipelago-audio-router.service"]).await;
+        let _ = host_sudo(&[
+            "systemctl",
+            "try-restart",
+            "archipelago-audio-router.service",
+        ])
+        .await;
         info!("audio: router updated");
     }
 }
@@ -911,10 +928,21 @@ pub async fn ensure_gamepad_keys() {
         }
     }
     if unit_was_missing {
-        let _ = host_sudo(&["systemctl", "enable", "--now", "archipelago-gamepad-keys.service"]).await;
+        let _ = host_sudo(&[
+            "systemctl",
+            "enable",
+            "--now",
+            "archipelago-gamepad-keys.service",
+        ])
+        .await;
         info!("gamepad: bridge installed and enabled (TV controller input)");
     } else if script_changed || unit_changed {
-        let _ = host_sudo(&["systemctl", "try-restart", "archipelago-gamepad-keys.service"]).await;
+        let _ = host_sudo(&[
+            "systemctl",
+            "try-restart",
+            "archipelago-gamepad-keys.service",
+        ])
+        .await;
         info!("gamepad: bridge updated");
     }
 }
@@ -994,10 +1022,10 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     // Companion mesh access: phones reach this node over FIPS at its fips0
     // ULA (http://[fdxx:…]). Configs shipped before 2026-07-23 listened on
     // IPv4 only, so the ULA could never connect — nothing answered [::]:80.
-    let missing_v6_http = content.contains("listen 80 default_server;")
-        && !content.contains("listen [::]:80");
-    let missing_v6_https = content.contains("listen 443 ssl default_server;")
-        && !content.contains("listen [::]:443");
+    let missing_v6_http =
+        content.contains("listen 80 default_server;") && !content.contains("listen [::]:80");
+    let missing_v6_https =
+        content.contains("listen 443 ssl default_server;") && !content.contains("listen [::]:443");
     if !missing_app_catalog
         && !missing_bitcoin_status
         && !missing_lnd_proxy

core/archipelago/src/container/boot_reconciler.rs

@@ -111,8 +111,7 @@ impl BootReconciler {
                 let mut failure_rounds: u32 = 0;
                 loop {
                     let installed = orchestrator.manifest_ids().await;
-                    let failures =
-                        crate::container::companion::reconcile(&installed).await;
+                    let failures = crate::container::companion::reconcile(&installed).await;
                     for (companion, err) in &failures {
                         tracing::warn!(
                             companion = %companion,

core/archipelago/src/fips/anchors.rs

@@ -90,15 +90,13 @@ pub fn archy_anchor() -> SeedAnchor {
 pub fn fips_network_anchors() -> Vec<SeedAnchor> {
     vec![
         SeedAnchor {
-            npub: "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u"
-                .to_string(),
+            npub: "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u".to_string(),
             address: "23.182.128.74:443".to_string(),
             transport: "tcp".to_string(),
             label: "FIPS network anchor (join.fips.network)".to_string(),
         },
         SeedAnchor {
-            npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
-                .to_string(),
+            npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98".to_string(),
             address: "217.77.8.91:443".to_string(),
             transport: "tcp".to_string(),
             label: "FIPS network anchor (join.fips.network)".to_string(),
@@ -158,7 +156,24 @@ pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
         .with_context(|| format!("read {}", path.display()))?;
     let anchors: Vec<SeedAnchor> =
         serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
-    Ok(anchors)
+    Ok(repair_legacy_anchor_set(anchors))
+}
+
+/// Add the newer redundant public TCP anchors to legacy files that only carry
+/// the Archipelago-operated vps2 anchor. A deliberately custom/private anchor
+/// list remains authoritative; this only repairs the exact stale shape shipped
+/// before the join.fips.network anchors became defaults.
+fn repair_legacy_anchor_set(mut anchors: Vec<SeedAnchor>) -> Vec<SeedAnchor> {
+    let has_archy = anchors.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB);
+    let has_fips_network = fips_network_anchors()
+        .iter()
+        .any(|default| anchors.iter().any(|a| a.npub == default.npub));
+    if has_archy && !has_fips_network {
+        for anchor in fips_network_anchors() {
+            anchors.push(anchor);
+        }
+    }
+    anchors
 }
 
 /// Persist the list. Overwrites atomically via write-then-rename so a
@@ -340,6 +355,30 @@ mod tests {
         assert!(got.iter().all(|a| a.transport == "tcp"));
     }
 
+    #[tokio::test]
+    async fn load_repairs_legacy_archy_only_anchor_file() {
+        let dir = tempfile::tempdir().unwrap();
+        save(dir.path(), &[archy_anchor()]).await.unwrap();
+
+        let got = load(dir.path()).await.unwrap();
+        assert!(got.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB));
+        for anchor in fips_network_anchors() {
+            assert!(got.iter().any(|a| a.npub == anchor.npub));
+        }
+    }
+
+    #[tokio::test]
+    async fn load_keeps_private_anchor_file_authoritative() {
+        let dir = tempfile::tempdir().unwrap();
+        let private = mk("npub1private");
+        save(dir.path(), std::slice::from_ref(&private))
+            .await
+            .unwrap();
+
+        let got = load(dir.path()).await.unwrap();
+        assert_eq!(got, vec![private]);
+    }
+
     #[tokio::test]
     async fn removing_one_default_persists_and_keeps_the_other() {
         // Editing the anchor list (here removing one default) makes the file

core/archipelago/src/fips/config.rs

@@ -48,6 +48,30 @@ pub struct FipsConfig {
 pub struct NodeSection {
     pub identity: IdentitySection,
     pub discovery: DiscoverySection,
+    pub retry: RetrySection,
+    pub rate_limit: RateLimitSection,
+}
+
+/// Fast-reconnect profile (`node.retry.*`). Upstream defaults (5s base
+/// doubling to 300s) are tuned for stable always-on links; a node redialing
+/// a recycled anchor sat off-mesh for ~90s. Field names verified live on
+/// 2026-07-24: a daemon restarted with these keys in fips.yaml and peered.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct RetrySection {
+    pub base_interval_secs: u64,
+    pub max_backoff_secs: u64,
+    pub max_retries: u32,
+}
+
+/// Session-handshake resend pacing (`node.rate_limit.*`). Stock 1s x2.0
+/// gaps out to 8-16s between resends exactly when a route has just
+/// appeared; 400ms x1.5 keeps continuous coverage through the connect
+/// window (phone measured session-after-route: 225ms).
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct RateLimitSection {
+    pub handshake_resend_interval_ms: u64,
+    pub handshake_resend_backoff: f64,
+    pub handshake_max_resends: u32,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -60,6 +84,14 @@ pub struct IdentitySection {
 
 #[derive(Debug, Clone, PartialEq, Serialize)]
 pub struct DiscoverySection {
+    /// Lookup completion timeout. Lookups fired while the tree position is
+    /// still settling are doomed; failing them fast (5s, not 10s) lets the
+    /// 1s-backoff retry find the route the moment it exists.
+    pub timeout_secs: u64,
+    pub backoff_base_secs: u64,
+    pub backoff_max_secs: u64,
+    pub retry_interval_secs: u64,
+    pub max_attempts: u8,
     pub lan: LanDiscoverySection,
 }
 
@@ -123,8 +155,23 @@ impl Default for FipsConfig {
             node: NodeSection {
                 identity: IdentitySection { persistent: true },
                 discovery: DiscoverySection {
+                    timeout_secs: 5,
+                    backoff_base_secs: 1,
+                    backoff_max_secs: 30,
+                    retry_interval_secs: 2,
+                    max_attempts: 3,
                     lan: LanDiscoverySection { enabled: true },
                 },
+                retry: RetrySection {
+                    base_interval_secs: 1,
+                    max_backoff_secs: 30,
+                    max_retries: 30,
+                },
+                rate_limit: RateLimitSection {
+                    handshake_resend_interval_ms: 400,
+                    handshake_resend_backoff: 1.5,
+                    handshake_max_resends: 10,
+                },
             },
             tun: TunSection {
                 enabled: true,
@@ -318,8 +365,21 @@ node:
   identity:
     persistent: true
   discovery:
+    timeout_secs: 5
+    backoff_base_secs: 1
+    backoff_max_secs: 30
+    retry_interval_secs: 2
+    max_attempts: 3
     lan:
       enabled: true
+  retry:
+    base_interval_secs: 1
+    max_backoff_secs: 30
+    max_retries: 30
+  rate_limit:
+    handshake_resend_interval_ms: 400
+    handshake_resend_backoff: 1.5
+    handshake_max_resends: 10
 tun:
   enabled: true
   name: fips0

core/archipelago/src/fips/service.rs

@@ -81,6 +81,7 @@ async fn sudo_systemctl(verb: &str, unit: &str) -> Result<()> {
 /// Unmask + start + enable the FIPS service. Idempotent — safe to call
 /// on every backend startup once the key is on disk.
 pub async fn activate(unit: &str) -> Result<()> {
+    kill_stale_daemons().await?;
     // Order matters: unmask before enable/start, otherwise enable fails
     // on a masked unit.
     sudo_systemctl("unmask", unit).await?;
@@ -94,9 +95,42 @@ pub async fn stop(unit: &str) -> Result<()> {
 }
 
 pub async fn restart(unit: &str) -> Result<()> {
+    kill_stale_daemons().await?;
     sudo_systemctl("restart", unit).await
 }
 
+/// Kill orphaned `fips` processes not owned by either known systemd unit.
+///
+/// Field failure, 2026-07-24: a stale daemon survived outside systemd and kept
+/// `0.0.0.0:8443` bound. The supervised daemon then started UDP-only, so every
+/// TCP seed-anchor connect failed with "no operational transport" and phones
+/// on 5G could not discover the node. We keep the cleanup narrow: preserve the
+/// MainPID of both units and terminate only extra `pgrep -x fips` matches.
+pub async fn kill_stale_daemons() -> Result<()> {
+    let script = format!(
+        r#"keep="$(systemctl show -p MainPID --value {managed} 2>/dev/null; systemctl show -p MainPID --value {upstream} 2>/dev/null)"
+for pid in $(pgrep -x fips 2>/dev/null || true); do
+  case " $keep " in
+    *" $pid "*) ;;
+    *) kill "$pid" 2>/dev/null || true ;;
+  esac
+done
+"#,
+        managed = super::SERVICE_UNIT,
+        upstream = super::UPSTREAM_SERVICE_UNIT,
+    );
+    let out = Command::new("sudo")
+        .args(["sh", "-c", &script])
+        .output()
+        .await
+        .context("sudo stale fips cleanup failed to launch")?;
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr).trim().to_string();
+        anyhow::bail!("stale fips cleanup failed: {}", stderr);
+    }
+    Ok(())
+}
+
 /// Resolve which systemd unit is actually supervising the fips daemon
 /// on this host. Nodes installed from the archipelago ISO run
 /// `archipelago-fips.service`; nodes that were apt-installed (or had

core/archipelago/src/main.rs

@@ -34,7 +34,6 @@ mod bitcoin_rpc;
 mod bitcoin_status;
 mod blobs;
 mod bootstrap;
-mod mesh_ports;
 mod ceremony;
 mod config;
 mod constants;
@@ -57,6 +56,7 @@ mod identity;
 mod identity_manager;
 mod marketplace;
 mod mesh;
+mod mesh_ports;
 mod monitoring;
 mod names;
 mod network;

core/archipelago/src/mesh/listener/mod.rs

@@ -438,7 +438,10 @@ impl MeshState {
         let persisted: PersistedMessages = match serde_json::from_slice(&bytes) {
             Ok(p) => p,
             Err(e) => {
-                warn!("mesh: parsing {} failed (skipping restore): {e}", path.display());
+                warn!(
+                    "mesh: parsing {} failed (skipping restore): {e}",
+                    path.display()
+                );
                 return;
             }
         };
@@ -454,7 +457,10 @@ impl MeshState {
                 *id = max_id + 1;
             }
         }
-        info!("mesh: restored {count} persisted messages (next id {})", max_id + 1);
+        info!(
+            "mesh: restored {count} persisted messages (next id {})",
+            max_id + 1
+        );
     }
 }
 
@@ -498,7 +504,11 @@ pub fn spawn_message_persister(state: Arc<MeshState>) {
                 warn!("mesh: chmod {} failed: {e}", tmp.display());
             }
             if let Err(e) = tokio::fs::rename(&tmp, &path).await {
-                warn!("mesh: renaming {} -> {} failed: {e}", tmp.display(), path.display());
+                warn!(
+                    "mesh: renaming {} -> {} failed: {e}",
+                    tmp.display(),
+                    path.display()
+                );
                 continue;
             }
             last_written = Some(json);

core/archipelago/src/mesh/meshtastic.rs

@@ -191,10 +191,13 @@ impl MeshtasticDevice {
                 .current_modem_preset
                 .and_then(modem_preset_name)
                 .map(str::to_string),
-            primary_channel: self
-                .current_primary_channel
-                .as_ref()
-                .map(|(name, _)| if name.is_empty() { "(default public)".to_string() } else { name.clone() }),
+            primary_channel: self.current_primary_channel.as_ref().map(|(name, _)| {
+                if name.is_empty() {
+                    "(default public)".to_string()
+                } else {
+                    name.clone()
+                }
+            }),
             secondary_channel: self
                 .current_secondary_channel
                 .as_ref()

core/archipelago/src/mesh_ports.rs

@@ -110,8 +110,8 @@ async fn listening_ports(path: &str, addr_hex_len: usize) -> Result<HashSet<u16>
 /// A v6-only listener on [::]:port forwarding each connection to 127.0.0.1:port.
 fn spawn_forwarder(port: u16) -> Result<JoinHandle<()>> {
     use socket2::{Domain, Protocol, Socket, Type};
-    let socket = Socket::new(Domain::IPV6, Type::STREAM, Some(Protocol::TCP))
-        .context("create v6 socket")?;
+    let socket =
+        Socket::new(Domain::IPV6, Type::STREAM, Some(Protocol::TCP)).context("create v6 socket")?;
     // v6only so we coexist with the app's own 0.0.0.0:<port> bind.
     socket.set_only_v6(true).context("set v6only")?;
     socket.set_reuse_address(true).ok();
@@ -119,8 +119,8 @@ fn spawn_forwarder(port: u16) -> Result<JoinHandle<()>> {
     let addr = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, port, 0, 0);
     socket.bind(&addr.into()).context("bind [::]")?;
     socket.listen(128).context("listen")?;
-    let listener = tokio::net::TcpListener::from_std(socket.into())
-        .context("register with tokio")?;
+    let listener =
+        tokio::net::TcpListener::from_std(socket.into()).context("register with tokio")?;
 
     Ok(tokio::spawn(async move {
         loop {

core/archipelago/src/server.rs

@@ -988,6 +988,43 @@ impl Server {
             main_addr,
         ));
 
+        // The mesh is IPv6-only: a phone reaching the node over its fips0
+        // ULA lands on port 80 over v6, where a 0.0.0.0 listener never
+        // answers — the UI was structurally unreachable over the mesh
+        // (RST -> ERR_CONNECTION_ABORTED, confirmed 2026-07-26: v4:80 = 200,
+        // v6:80 = refused). Mirror an IPv4-any main listener with a
+        // V6ONLY [::] socket on the same port — v6-only so it coexists
+        // with the v4 listener regardless of net.ipv6.bindv6only.
+        let v4_any_port = match main_addr {
+            SocketAddr::V4(v4) if v4.ip().is_unspecified() => Some(v4.port()),
+            _ => None,
+        };
+        let v6_task = if let Some(port) = v4_any_port {
+            let v6_addr = SocketAddr::new(
+                std::net::IpAddr::V6(std::net::Ipv6Addr::UNSPECIFIED),
+                port,
+            );
+            match bind_v6_only(v6_addr) {
+                Ok(listener) => {
+                    info!("IPv6 web listener bound {} (mesh ULA reachable)", v6_addr);
+                    Some(tokio::spawn(accept_loop(
+                        self.api_handler.clone(),
+                        listener,
+                        active_connections.clone(),
+                        false, // same semantics as the main listener
+                        tx.subscribe(),
+                        v6_addr,
+                    )))
+                }
+                Err(e) => {
+                    warn!("IPv6 web listener bind {} failed: {} — UI stays v4-only", v6_addr, e);
+                    None
+                }
+            }
+        } else {
+            None
+        };
+
         // Peer listener: late-binding so we don't need an archipelago
         // restart when fips0 comes up after onboarding.
         let peer_task = tokio::spawn(peer_late_bind_loop(
@@ -1012,6 +1049,9 @@ impl Server {
         }
 
         let _ = main_task.await;
+        if let Some(t) = v6_task {
+            let _ = t.await;
+        }
         let _ = peer_task.await;
 
         info!("Shutdown complete");
@@ -1019,6 +1059,24 @@ impl Server {
     }
 }
 
+/// Bind a V6ONLY `[::]` TCP listener. V6ONLY is set explicitly so the
+/// socket never claims the IPv4 side (which the main listener owns) —
+/// without it, Linux hosts with `net.ipv6.bindv6only=0` would fail with
+/// EADDRINUSE.
+fn bind_v6_only(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
+    let socket = socket2::Socket::new(
+        socket2::Domain::IPV6,
+        socket2::Type::STREAM,
+        Some(socket2::Protocol::TCP),
+    )?;
+    socket.set_only_v6(true)?;
+    socket.set_reuse_address(true)?;
+    socket.set_nonblocking(true)?;
+    socket.bind(&addr.into())?;
+    socket.listen(1024)?;
+    tokio::net::TcpListener::from_std(socket.into())
+}
+
 /// Poll every 30s for `fips0`'s ULA; when it appears, bind the peer
 /// listener and run the normal accept loop. If the bind fails (port
 /// already taken, permissions), log and keep retrying. Returns on

core/archipelago/src/wallet/ecash.rs

@@ -632,11 +632,30 @@ pub async fn send_token_at(data_dir: &Path, mint_url: &str, amount_sats: u64) ->
         // Mark original proofs as spent
         wallet.mark_spent(&indices);
 
-        // Separate send proofs from change proofs
-        let (send, change): (Vec<_>, Vec<_>) = swap_result
-            .new_proofs
-            .into_iter()
-            .partition(|p| send_denoms.contains(&p.amount));
+        // Separate send proofs from change proofs BY COUNT, not membership:
+        // partition(contains) put EVERY proof whose denomination appeared in
+        // send_denoms into the token — when change shared a denomination with
+        // the send (worst case: spending from a proof worth exactly 2× the
+        // amount, send [n] + change [n]), the change proofs rode along and the
+        // receiver was credited double. Consume exactly one proof per needed
+        // send denomination; everything else is change.
+        let mut send_needed = send_denoms.clone();
+        let mut send: Vec<Proof> = Vec::new();
+        let mut change: Vec<Proof> = Vec::new();
+        for p in swap_result.new_proofs {
+            if let Some(pos) = send_needed.iter().position(|&d| d == p.amount) {
+                send_needed.swap_remove(pos);
+                send.push(p);
+            } else {
+                change.push(p);
+            }
+        }
+        if !send_needed.is_empty() {
+            anyhow::bail!(
+                "Mint swap returned incomplete send denominations (missing {:?})",
+                send_needed
+            );
+        }
 
         // Add change proofs back to wallet
         if !change.is_empty() {

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.111-alpha",
+  "version": "1.7.112-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.111-alpha",
+      "version": "1.7.112-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.111-alpha",
+  "version": "1.7.112-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/src/components/CompanionIntroOverlay.vue

@@ -150,7 +150,7 @@ const STORAGE_KEY = 'neode_companion_intro_seen'
 // exposes the release-server address.
 const DEFAULT_DOWNLOAD_URL = IS_DEMO
   ? `${window.location.origin}/packages/archipelago-companion.apk`
-  : 'http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/neode-ui/public/packages/archipelago-companion.apk'
+  : 'http://146.59.87.168:2100/packages/archipelago-companion.apk'
 
 // Deep-link scheme the companion app registers; carries the server entry the
 // app should create (see docs/companion-pairing-qr.md for the contract).
@@ -267,12 +267,20 @@ function isTailnetIp(host: string): boolean {
  *   - a tailnet 100.x address (operator browsing over Tailscale — a scanned
  *     QR carried one of these on 2026-07-22 and the companion sat there
  *     dialing an IP the phone had no route to)
+ *   - a .fips name or mesh ULA (operator browsing over the mesh — a scanned
+ *     QR carried npub….fips as fhost on 2026-07-24; Android's system DNS
+ *     can't resolve .fips, so the phone's direct dial died and first
+ *     connect crawled through anchor discovery instead of the LAN)
  */
 async function resolveServerUrl(): Promise<string> {
   if (IS_DEMO) return DEMO_SERVER_URL
   const { hostname, origin } = window.location
   const phoneUnreachable =
-    hostname === 'localhost' || hostname === '127.0.0.1' || isTailnetIp(hostname)
+    hostname === 'localhost' ||
+    hostname === '127.0.0.1' ||
+    isTailnetIp(hostname) ||
+    hostname.endsWith('.fips') ||
+    hostname.includes(':') // IPv6 literal — the node's mesh ULA
   if (!phoneUnreachable) return origin
   try {
     const res = await rpcClient.call<{ mdns_hostname?: string; lan_ip?: string | null }>({

neode-ui/src/components/SendBitcoinModal.vue

@@ -1,7 +1,58 @@
 <template>
   <BaseModal :show="show" :title="t('web5.sendBitcoinTitle')" max-width="max-w-2xl" content-class="max-h-[90vh] overflow-y-auto" @close="close">
+        <!-- ============ SUCCESS PANE — the payment's moment, not a footnote ============ -->
+        <template v-if="successInfo">
+          <div class="text-center py-4">
+            <div class="send-success-burst mx-auto mb-6">
+              <span class="burst-ring"></span>
+              <span class="burst-ring burst-ring-2"></span>
+              <span class="burst-ring burst-ring-3"></span>
+              <div class="burst-core">
+                <svg class="w-14 h-14 text-green-400 burst-check" fill="none" stroke="currentColor" stroke-width="3" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+                </svg>
+              </div>
+            </div>
+
+            <div v-if="successInfo.amount > 0" class="text-5xl font-black text-green-400 mb-1">
+              {{ successInfo.amount.toLocaleString() }}<span class="text-2xl font-bold text-green-400/70"> sats</span>
+            </div>
+            <div class="text-2xl font-bold tracking-widest text-white mb-1">SENT</div>
+            <p class="text-sm text-white/50 mb-6">{{ successInfo.methodLabel }}</p>
+
+            <div v-if="successInfo.hash || successInfo.txid || successInfo.note" class="p-4 bg-white/5 rounded-xl text-left space-y-4 mb-6">
+              <div v-if="successInfo.hash">
+                <p class="text-xs text-white/50 mb-1">Payment hash</p>
+                <div class="flex items-center gap-2">
+                  <p class="flex-1 text-xs font-mono text-white/80 break-all">{{ successInfo.hash }}</p>
+                  <button
+                    class="shrink-0 px-2.5 py-1.5 rounded-lg text-xs glass-button"
+                    @click="copyDetail(successInfo.hash)"
+                  >{{ copiedDetail === successInfo.hash ? 'Copied!' : 'Copy' }}</button>
+                </div>
+              </div>
+              <div v-if="successInfo.txid">
+                <p class="text-xs text-white/50 mb-1">Transaction ID</p>
+                <div class="flex items-center gap-2">
+                  <p class="flex-1 text-xs font-mono text-white/80 break-all">{{ successInfo.txid }}</p>
+                  <button
+                    class="shrink-0 px-2.5 py-1.5 rounded-lg text-xs glass-button"
+                    @click="copyDetail(successInfo.txid)"
+                  >{{ copiedDetail === successInfo.txid ? 'Copied!' : 'Copy' }}</button>
+                </div>
+              </div>
+              <p v-if="successInfo.note" class="text-xs text-white/60">{{ successInfo.note }}</p>
+            </div>
+
+            <div class="flex gap-3">
+              <button @click="sendAnother" class="flex-1 glass-button px-4 py-3 rounded-xl text-sm font-medium">Send another</button>
+              <button @click="close" class="flex-1 glass-button glass-button-warning px-4 py-3 rounded-xl text-sm font-semibold">Done</button>
+            </div>
+          </div>
+        </template>
+
         <!-- ============ CONFIRM PANE (second step, mirrors the scan flow) ============ -->
-        <template v-if="confirming">
+        <template v-else-if="confirming">
           <div class="mb-3 p-3 bg-white/5 rounded-lg">
             <div class="flex items-center justify-between mb-2">
               <span class="text-xs text-white/50">Method</span>
@@ -125,16 +176,6 @@
           <button @click="copyText(ecashToken)" class="mt-2 text-xs text-orange-400 hover:text-orange-300">{{ t('common.copy') }}</button>
         </div>
 
-        <div v-if="resultTxid" class="mb-3 alert-success">
-          <p class="text-xs">{{ t('sendBitcoin.sentTx', { txid: resultTxid }) }}</p>
-        </div>
-        <div v-if="resultHash" class="mb-3 alert-success">
-          <p class="text-xs">{{ t('sendBitcoin.paidHash', { hash: resultHash }) }}</p>
-        </div>
-        <div v-if="resultArk" class="mb-3 alert-success">
-          <p class="text-xs">{{ resultArk }}</p>
-        </div>
-
         <div v-if="error" class="mb-3 alert-error">{{ error }}</div>
 
         <div class="flex gap-3">
@@ -171,9 +212,23 @@ const amount = ref<number>(0)
 const dest = ref('')
 const processing = ref(false)
 const error = ref('')
-const resultTxid = ref('')
-const resultHash = ref('')
-const resultArk = ref('')
+// Set on a completed send — flips the modal to the success pane.
+const successInfo = ref<{
+  amount: number
+  methodLabel: string
+  hash?: string
+  txid?: string
+  note?: string
+} | null>(null)
+const copiedDetail = ref('')
+
+function copyDetail(text: string) {
+  navigator.clipboard.writeText(text).catch(() => {})
+  copiedDetail.value = text
+  setTimeout(() => {
+    if (copiedDetail.value === text) copiedDetail.value = ''
+  }, 1500)
+}
 const ecashToken = ref('')
 
 // "Send all funds" — sweeps the whole on-chain balance (explicit on-chain tab only)
@@ -193,22 +248,6 @@ function toggleSendAll() {
 // Leaving the on-chain tab disarms the sweep so it can never apply elsewhere
 watch(sendMethod, (m) => { if (m !== 'onchain') sendAll.value = false })
 
-// Invoice-first lightning UX: a pasted invoice that fixes its amount locks
-// the amount field (auto-filled, "set by invoice"); zero-amount invoices
-// leave it editable. Clearing/leaving lightning unlocks again.
-const pastedInvoiceAmount = computed<number | null>(() => {
-  if (effectiveMethod.value !== 'lightning') return null
-  const d = dest.value.trim()
-  if (!d) return null
-  return parseBolt11AmountSats(d.toLowerCase().startsWith('lightning:') ? d.slice(10) : d)
-})
-watch(pastedInvoiceAmount, (fixed, prev) => {
-  if (fixed !== null) amount.value = fixed
-  // Swapping a fixed-amount invoice for a zero-amount one: don't silently
-  // keep the previous invoice's sats — make the user type the new amount.
-  else if (prev !== null) amount.value = 0
-})
-
 // Clipboard read needs a secure context (or the companion bridge); hide the
 // button where it can't work — the textarea still accepts a manual paste.
 const canReadClipboard = typeof navigator !== 'undefined' && !!navigator.clipboard?.readText
@@ -231,6 +270,25 @@ const effectiveMethod = computed(() => {
   return 'lightning'
 })
 
+// Invoice-first lightning UX: a pasted invoice that fixes its amount locks
+// the amount field (auto-filled, "set by invoice"); zero-amount invoices
+// leave it editable. Clearing/leaving lightning unlocks again.
+// MUST come after effectiveMethod: watch() evaluates its source getter at
+// setup, and reading a const still in its temporal dead zone crashed the
+// whole modal at mount ("Cannot access 'R' before initialization").
+const pastedInvoiceAmount = computed<number | null>(() => {
+  if (effectiveMethod.value !== 'lightning') return null
+  const d = dest.value.trim()
+  if (!d) return null
+  return parseBolt11AmountSats(d.toLowerCase().startsWith('lightning:') ? d.slice(10) : d)
+})
+watch(pastedInvoiceAmount, (fixed, prev) => {
+  if (fixed !== null) amount.value = fixed
+  // Swapping a fixed-amount invoice for a zero-amount one: don't silently
+  // keep the previous invoice's sats — make the user type the new amount.
+  else if (prev !== null) amount.value = 0
+})
+
 // --- Second-step confirmation (parity with the scan flow): review shows the
 // --- balance reduction before anything is sent or any token is minted.
 
@@ -315,14 +373,22 @@ function review() {
 
 function close() {
   error.value = ''
-  resultTxid.value = ''
-  resultHash.value = ''
-  resultArk.value = ''
   ecashToken.value = ''
   confirming.value = false
+  successInfo.value = null
   emit('close')
 }
 
+/** Reset the form for a fresh payment straight from the success screen. */
+function sendAnother() {
+  successInfo.value = null
+  confirming.value = false
+  dest.value = ''
+  amount.value = 0
+  sendAll.value = false
+  error.value = ''
+}
+
 function copyText(text: string) {
   navigator.clipboard.writeText(text).catch(() => {})
 }
@@ -345,11 +411,9 @@ async function send() {
   processing.value = true
   error.value = ''
   ecashToken.value = ''
-  resultTxid.value = ''
-  resultHash.value = ''
-  resultArk.value = ''
 
   const method = effectiveMethod.value
+  const paidAmount = confirmAmount.value
   try {
     if (method === 'ark') {
       if (!dest.value.trim()) { error.value = 'Enter an Ark address, invoice or lightning address'; return }
@@ -359,7 +423,7 @@ async function send() {
         // Ark sends can wait on round participation.
         timeout: 130000,
       })
-      resultArk.value = `Sent ${amount.value.toLocaleString()} sats via Ark`
+      successInfo.value = { amount: paidAmount, methodLabel: 'Sent via Ark', note: 'The transfer settles with the next Ark round.' }
     } else if (method === 'ecash') {
       const res = await rpcClient.call<{ token: string }>({
         method: 'wallet.ecash-send',
@@ -379,7 +443,7 @@ async function send() {
         method: 'lnd.payinvoice',
         params: { payment_request: dest.value.trim() },
       })
-      resultHash.value = res.payment_hash
+      successInfo.value = { amount: paidAmount, methodLabel: 'Paid over Lightning', hash: res.payment_hash }
     } else {
       if (!dest.value.trim()) { error.value = t('web5.enterBitcoinAddress'); return }
       const res = await rpcClient.call<{ txid: string }>({
@@ -388,10 +452,15 @@ async function send() {
           ? { addr: dest.value.trim(), send_all: true }
           : { addr: dest.value.trim(), amount: amount.value },
       })
-      resultTxid.value = res.txid
+      successInfo.value = {
+        amount: paidAmount,
+        methodLabel: isSweep.value ? 'Swept on-chain' : 'Sent on-chain',
+        txid: res.txid,
+        note: 'On-chain payments confirm over the next blocks.',
+      }
     }
     emit('sent')
-    // Back to the form pane so the success/token panes are visible.
+    // Success pane (or the token pane for ecash mints) takes over the modal.
     confirming.value = false
   } catch (err: unknown) {
     error.value = err instanceof Error ? err.message : t('web5.sendFailed')
@@ -400,3 +469,59 @@ async function send() {
   }
 }
 </script>
+
+<style scoped>
+/* Success burst — pop-in check inside radiating rings, wallet palette
+   (emerald for the settled payment, one Archipelago-orange ring). */
+.send-success-burst {
+  position: relative;
+  width: 7rem;
+  height: 7rem;
+}
+.burst-core {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 9999px;
+  background: rgba(16, 185, 129, 0.12);
+  box-shadow: 0 0 48px rgba(16, 185, 129, 0.3);
+  animation: burst-pop 0.5s cubic-bezier(0.175, 0.885, 0.32, 1.4) both;
+}
+.burst-check {
+  stroke-dasharray: 32;
+  stroke-dashoffset: 32;
+  animation: burst-draw 0.45s ease-out 0.25s forwards;
+}
+.burst-ring {
+  position: absolute;
+  inset: 0;
+  border-radius: 9999px;
+  border: 2px solid rgba(16, 185, 129, 0.45);
+  animation: burst-ripple 1.8s ease-out infinite;
+}
+.burst-ring-2 {
+  animation-delay: 0.45s;
+}
+.burst-ring-3 {
+  animation-delay: 0.9s;
+  border-color: rgba(249, 115, 22, 0.35);
+}
+@keyframes burst-pop {
+  from { transform: scale(0.3); opacity: 0; }
+  to { transform: scale(1); opacity: 1; }
+}
+@keyframes burst-draw {
+  to { stroke-dashoffset: 0; }
+}
+@keyframes burst-ripple {
+  0% { transform: scale(0.7); opacity: 0.9; }
+  100% { transform: scale(2); opacity: 0; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .burst-core, .burst-check, .burst-ring { animation: none; }
+  .burst-check { stroke-dashoffset: 0; }
+  .burst-ring { display: none; }
+}
+</style>

neode-ui/src/views/Apps.vue

@@ -646,37 +646,51 @@ function launchAppNow(id: string) {
   useAppLauncherStore().openSession(id)
 }
 
-async function maybeShowCredentialsBeforeLaunch(id: string): Promise<boolean> {
-  try {
-    const result = await rpcClient.call<AppCredentialsResponse>({
+// Per-app credentials memo: the pre-launch RPC could hold an Apps-tab launch
+// hostage for its full 5s timeout over the mesh (home-card launches skip this
+// gate entirely, which is why they always felt instant). First launch waits at
+// most LAUNCH_CRED_BUDGET_MS; the RPC keeps running in the background and its
+// answer is memoized, so every later launch of that app resolves instantly.
+const LAUNCH_CRED_BUDGET_MS = 1200
+const credentialsCache = new Map<string, AppCredentialsResponse | null>()
+
+function fetchCredentials(id: string): Promise<AppCredentialsResponse | null> {
+  return rpcClient
+    .call<AppCredentialsResponse>({
       method: 'package.credentials',
       params: { app_id: id },
       timeout: 5000,
     })
-    const credentials = resolveAppCredentials(id, result)
-    if (!credentials) return false
-    credentialModal.value = {
-      show: true,
-      appId: id,
-      title: credentials.title || `${packages.value[id]?.manifest.title || id} credentials`,
-      description: credentials.description || 'Use these credentials when the app asks you to sign in.',
-      credentials: credentials.credentials,
-      copied: '',
-    }
-    return true
-  } catch {
-    const credentials = resolveAppCredentials(id, null)
-    if (!credentials) return false
-    credentialModal.value = {
-      show: true,
-      appId: id,
-      title: credentials.title || `${packages.value[id]?.manifest.title || id} credentials`,
-      description: credentials.description || 'Use these credentials when the app asks you to sign in.',
-      credentials: credentials.credentials,
-      copied: '',
-    }
-    return true
+    .then((r) => {
+      credentialsCache.set(id, r)
+      return r
+    })
+    .catch(() => {
+      credentialsCache.set(id, null)
+      return null
+    })
+}
+
+async function maybeShowCredentialsBeforeLaunch(id: string): Promise<boolean> {
+  const result = credentialsCache.has(id)
+    ? credentialsCache.get(id) ?? null
+    : await Promise.race([
+        fetchCredentials(id),
+        // Budget exceeded → launch with the static fallback config; the
+        // in-flight RPC still lands in the cache for next time.
+        new Promise<null>((resolve) => setTimeout(() => resolve(null), LAUNCH_CRED_BUDGET_MS)),
+      ])
+  const credentials = resolveAppCredentials(id, result)
+  if (!credentials) return false
+  credentialModal.value = {
+    show: true,
+    appId: id,
+    title: credentials.title || `${packages.value[id]?.manifest.title || id} credentials`,
+    description: credentials.description || 'Use these credentials when the app asks you to sign in.',
+    credentials: credentials.credentials,
+    copied: '',
   }
+  return true
 }
 
 function closeCredentialModal() {

neode-ui/src/views/Home.vue

@@ -522,8 +522,10 @@ const cloudStorageDisplay = computed(() => cloudStorageUsed.value !== null ? for
 const cloudFolderDisplay = computed(() => cloudFolderCount.value !== null ? String(cloudFolderCount.value) : '...')
 
 onMounted(async () => {
-  try { const usage = await fileBrowserClient.getUsage(); cloudStorageUsed.value = usage.totalSize; cloudFolderCount.value = usage.folderCount } catch { /* not running */ }
+  // Paint last-known wallet figures BEFORE any network round-trip.
+  hydrateWalletSnapshot()
   loadSystemStats(); systemStatsInterval = setInterval(loadSystemStats, 10000); checkUpdateStatus(); loadWeb5Status()
+  try { const usage = await fileBrowserClient.getUsage(); cloudStorageUsed.value = usage.totalSize; cloudFolderCount.value = usage.folderCount } catch { /* not running */ }
   // Poll wallet balances/transactions like Web5.vue does — without this a
   // pending on-chain receive (or a fresh instant payment) only shows up
   // after a manual wallet action or a remount.
@@ -583,25 +585,78 @@ function ecashToWalletTransaction(tx: EcashTransaction): WalletTransaction {
   }
 }
 
+// Last-known wallet snapshot, hydrated before ANY network round-trip so the
+// card paints real figures instantly (app-launch-speed doctrine: over the
+// mesh every serialized RPC costs a full RTT — never make the user watch it).
+const WALLET_SNAPSHOT_KEY = 'archy-wallet-snapshot-v1'
+
+function hydrateWalletSnapshot() {
+  try {
+    const raw = localStorage.getItem(WALLET_SNAPSHOT_KEY)
+    if (!raw) return
+    const s = JSON.parse(raw)
+    walletOnchain.value = s.onchain ?? 0
+    walletLightning.value = s.lightning ?? 0
+    walletEcash.value = s.ecash ?? 0
+    walletFedimint.value = s.fedimint ?? 0
+    walletArk.value = s.ark ?? 0
+    walletConnected.value = s.connected === true
+    if (Array.isArray(s.transactions)) walletTransactions.value = s.transactions
+  } catch { /* corrupt/absent snapshot — fresh load fills in */ }
+}
+
+function persistWalletSnapshot() {
+  try {
+    localStorage.setItem(WALLET_SNAPSHOT_KEY, JSON.stringify({
+      onchain: walletOnchain.value,
+      lightning: walletLightning.value,
+      ecash: walletEcash.value,
+      fedimint: walletFedimint.value,
+      ark: walletArk.value,
+      connected: walletConnected.value,
+      // Enough for the Transactions modal's first paint; refresh replaces it.
+      transactions: walletTransactions.value.slice(0, 50),
+    }))
+  } catch { /* storage full — snapshot is best-effort */ }
+}
+
 async function loadWeb5Status() {
   // A transient RPC timeout must NOT flash the balance to 0 ("wallet says 0 when
   // there is a balance"). On failure keep the last-known value — the refs start
-  // at 0, so only the very first load before any success shows 0.
-  try { const res = await rpcClient.call<{ balance_sats: number; channel_balance_sats: number }>({ method: 'lnd.getinfo', timeout: 5000 }); walletOnchain.value = res.balance_sats || 0; walletLightning.value = res.channel_balance_sats || 0; walletConnected.value = true } catch { walletConnected.value = false }
-  try { const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.ecash-balance', timeout: 5000 }); walletEcash.value = res.balance_sats ?? 0 } catch { /* keep last-known balance */ }
-  try { const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.fedimint-balance', timeout: 5000 }); walletFedimint.value = res.balance_sats ?? 0 } catch { /* keep last-known balance */ }
-  try { const res = await rpcClient.call<{ spendable_sats: number }>({ method: 'wallet.ark-balance', timeout: 5000 }); walletArk.value = res.spendable_sats ?? 0 } catch { /* keep last-known balance */ }
+  // from the persisted snapshot, so 0 only ever shows on a genuinely fresh node.
+  //
+  // All seven calls are independent — fire them TOGETHER. Serialized, this
+  // block cost 7 × (mesh RTT + backend time); parallel it costs one slowest
+  // call, which is what makes the card feel like an app launch.
+  const balances = Promise.allSettled([
+    rpcClient.call<{ balance_sats: number; channel_balance_sats: number }>({ method: 'lnd.getinfo', timeout: 5000 })
+      .then(res => { walletOnchain.value = res.balance_sats || 0; walletLightning.value = res.channel_balance_sats || 0; walletConnected.value = true })
+      .catch(() => { walletConnected.value = false }),
+    rpcClient.call<{ balance_sats: number }>({ method: 'wallet.ecash-balance', timeout: 5000 })
+      .then(res => { walletEcash.value = res.balance_sats ?? 0 }).catch(() => { /* keep last-known */ }),
+    rpcClient.call<{ balance_sats: number }>({ method: 'wallet.fedimint-balance', timeout: 5000 })
+      .then(res => { walletFedimint.value = res.balance_sats ?? 0 }).catch(() => { /* keep last-known */ }),
+    rpcClient.call<{ spendable_sats: number }>({ method: 'wallet.ark-balance', timeout: 5000 })
+      .then(res => { walletArk.value = res.spendable_sats ?? 0 }).catch(() => { /* keep last-known */ }),
+  ])
   // Merge LND transactions with ecash/Fedimint history (wallet.ecash-history
-  // already unifies both) — previously only LND transactions were fetched
-  // here, so any Cashu or Fedimint receive (e.g. a TollGate payment) never
-  // appeared in the Transactions modal even though the balance included it.
-  let lndTxs: WalletTransaction[] = []
-  try { const res = await rpcClient.call<{ transactions: WalletTransaction[]; incoming_pending_count: number }>({ method: 'lnd.gettransactions', timeout: 5000 }); lndTxs = (res.transactions || []).map(tx => ({ ...tx, kind: 'onchain' as const })) } catch { /* keep last-known transactions */ }
-  let lightningTxs: WalletTransaction[] = []
-  try { const res = await rpcClient.call<{ transactions: WalletTransaction[] }>({ method: 'lnd.lightning-history', timeout: 5000 }); lightningTxs = res.transactions || [] } catch { /* keep last-known transactions */ }
-  let ecashTxs: WalletTransaction[] = []
-  try { const res = await rpcClient.call<{ transactions: EcashTransaction[] }>({ method: 'wallet.ecash-history', timeout: 5000 }); ecashTxs = (res.transactions || []).map(ecashToWalletTransaction) } catch { /* keep last-known transactions */ }
-  walletTransactions.value = [...lndTxs, ...lightningTxs, ...ecashTxs].sort((a, b) => b.time_stamp - a.time_stamp)
+  // already unifies both) so Cashu/Fedimint receives appear in the modal.
+  const histories = Promise.allSettled([
+    rpcClient.call<{ transactions: WalletTransaction[]; incoming_pending_count: number }>({ method: 'lnd.gettransactions', timeout: 5000 })
+      .then(res => (res.transactions || []).map(tx => ({ ...tx, kind: 'onchain' as const }))).catch(() => [] as WalletTransaction[]),
+    rpcClient.call<{ transactions: WalletTransaction[] }>({ method: 'lnd.lightning-history', timeout: 5000 })
+      .then(res => res.transactions || []).catch(() => [] as WalletTransaction[]),
+    rpcClient.call<{ transactions: EcashTransaction[] }>({ method: 'wallet.ecash-history', timeout: 5000 })
+      .then(res => (res.transactions || []).map(ecashToWalletTransaction)).catch(() => [] as WalletTransaction[]),
+  ]).then((results) => {
+    const merged = results.flatMap(r => (r.status === 'fulfilled' ? r.value : []))
+    // Keep last-known list when every history call failed this round.
+    if (merged.length > 0 || results.some(r => r.status === 'fulfilled')) {
+      walletTransactions.value = merged.sort((a, b) => b.time_stamp - a.time_stamp)
+    }
+  })
+  await Promise.allSettled([balances, histories])
+  persistWalletSnapshot()
 }
 
 // System stats

neode-ui/src/views/PeerFiles.vue

@@ -794,15 +794,19 @@ function goBack() {
 
 onMounted(async () => {
   if (props.peerId) {
-    // Find the peer by onion address
-    try {
-      const result = await rpcClient.federationListNodes()
-      const peers = result?.nodes ?? []
-      currentPeer.value = peers.find((p: PeerNode) => p.onion === props.peerId) || null
-    } catch {
-      // Continue with just the onion address
-    }
-    await Promise.all([loadCatalog(), loadOwned()])
+    // The peer-name lookup is cosmetic — the catalog only needs the onion we
+    // already have. Serialized, it added a full mesh round-trip before the
+    // files even started loading.
+    await Promise.all([
+      rpcClient.federationListNodes()
+        .then((result) => {
+          const peers = result?.nodes ?? []
+          currentPeer.value = peers.find((p: PeerNode) => p.onion === props.peerId) || null
+        })
+        .catch(() => { /* continue with just the onion address */ }),
+      loadCatalog(),
+      loadOwned(),
+    ])
   } else {
     loading.value = false
   }

neode-ui/src/views/apps/__tests__/LightningChannels.test.ts

@@ -1,5 +1,6 @@
 import { flushPromises, mount } from '@vue/test-utils'
 import { describe, expect, it, vi } from 'vitest'
+import { createPinia } from 'pinia'
 import LightningChannels from '@/components/LightningChannelsPanel.vue'
 import { rpcClient } from '@/api/rpc-client'
 
@@ -44,7 +45,11 @@ describe('LightningChannels', () => {
       total_outbound: 60_000,
     })
 
-    const wrapper = mount(LightningChannels)
+    // The panel's setup pulls a Pinia store via useTxExplorer — mount with a
+    // fresh Pinia or setup throws before the first render.
+    const wrapper = mount(LightningChannels, {
+      global: { plugins: [createPinia()] },
+    })
     await flushPromises()
 
     expect(wrapper.text()).toContain('peer-pubkey')

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -366,9 +366,24 @@ init()
               <div>
                 <div class="flex items-center gap-2 mb-3">
                   <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.112-alpha</span>
-                  <span class="text-xs text-white/40">July 22, 2026</span>
+                  <span class="text-xs text-white/40">July 23, 2026</span>
                 </div>
                 <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.</p>
+                  <p>Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.</p>
+                  <p>The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.</p>
+                  <p>Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.</p>
+                  <p>Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.</p>
+                  <p>The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.</p>
+                  <p>Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.</p>
+                  <p>Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.</p>
+                  <p>Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.</p>
+                  <p>Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.</p>
+                  <p>Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.</p>
+                  <p>A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.</p>
+                  <p>Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.</p>
+                  <p>If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.</p>
+                  <p>Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.</p>
                   <p>Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.</p>
                   <p>Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.</p>
                   <p>Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.</p>

neode-ui/src/views/web5/Web5ConnectedNodes.vue

@@ -350,13 +350,17 @@ async function loadPeers() {
   const hadPeers = peers.value.length > 0 || observers.value.length > 0
   loadingPeers.value = true
   try {
-    const res = await rpcClient.listPeers()
+    // Independent RPCs — fetched together (serialized they stacked two full
+    // mesh round-trips before anything rendered).
+    const [res, fedSettled] = await Promise.all([
+      rpcClient.listPeers(),
+      rpcClient.federationListNodes().catch(() => null),
+    ])
     const peerList = res.peers || []
     const observerList: Peer[] = []
 
     try {
-      const fedRes = await rpcClient.federationListNodes()
-      const fedNodes = fedRes.nodes || []
+      const fedNodes = fedSettled?.nodes || []
       for (const n of fedNodes) {
         if (!n.onion || n.trust_level === 'untrusted') {
           continue

release-manifest.json

@@ -1,36 +1,36 @@
 {
   "changelog": [
-    "Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — \"what's the block height?\", \"how many peers am I connected to?\", \"is bitcoin synced?\", \"what's my Lightning balance?\" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.",
-    "Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom \"Yo Archy\" wake word is in the works.)",
-    "Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.",
-    "Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.",
-    "The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.",
-    "Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.",
-    "Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text \"/bin/bash\"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.",
-    "Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.",
-    "Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.",
-    "On the phone home screen, the wallet card moved up to sit right under My Apps."
+    "Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.",
+    "Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.",
+    "The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.",
+    "Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a \"Share this app\" QR that anyone can scan with a normal camera to install the companion app.",
+    "Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.",
+    "The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.",
+    "Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.",
+    "Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.",
+    "Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.",
+    "Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases."
   ],
   "components": [
     {
-      "current_version": "1.7.111-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago",
+      "current_version": "1.7.112-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.112-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.111-alpha",
-      "sha256": "9e50577470cb4c5dd67b4316a3efaaa87e7afac15a8b5c2e3841edc6c3ed6550",
-      "size_bytes": 50615920
+      "new_version": "1.7.112-alpha",
+      "sha256": "7cd7ab9dd9b433db929841328cbf553a056937f18814d0b7368b0a5c44dc2b9b",
+      "size_bytes": 51469560
     },
     {
-      "current_version": "1.7.111-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago-frontend-1.7.111-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.111-alpha.tar.gz",
-      "new_version": "1.7.111-alpha",
-      "sha256": "3ea73cd8e98312b3b6877e00434363fe575362e7b2b134e03a9004d4e42930c9",
-      "size_bytes": 174650727
+      "current_version": "1.7.112-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.112-alpha/archipelago-frontend-1.7.112-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.112-alpha.tar.gz",
+      "new_version": "1.7.112-alpha",
+      "sha256": "02d916cadb54f76c19910376d6d42e820ee7b42fff7c1ea071bb5ec9b2bea3b8",
+      "size_bytes": 177952072
     }
   ],
-  "release_date": "2026-07-22",
-  "signature": "1cc569a121f2cc5560840198115732155db4ee037ea98c4be8cf9ef8a7b227e26dc686a88a779f1e40daaa94b5cb44083b78147f45398a29188bf2834488eb03",
+  "release_date": "2026-07-24",
+  "signature": "ffe1d1576e63c68f27dc6924f6db4381f745f48e1e279a9b20351c1104cf6e9a8756596cef99e8b3436925361bbbc9f305c14b0632e7c2f095b817783bbfa60d",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.111-alpha"
+  "version": "1.7.112-alpha"
 }

releases/manifest.json

@@ -1,36 +1,36 @@
 {
   "changelog": [
-    "Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — \"what's the block height?\", \"how many peers am I connected to?\", \"is bitcoin synced?\", \"what's my Lightning balance?\" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.",
-    "Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom \"Yo Archy\" wake word is in the works.)",
-    "Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.",
-    "Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.",
-    "The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.",
-    "Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.",
-    "Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text \"/bin/bash\"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.",
-    "Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.",
-    "Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.",
-    "On the phone home screen, the wallet card moved up to sit right under My Apps."
+    "Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.",
+    "Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.",
+    "The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.",
+    "Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a \"Share this app\" QR that anyone can scan with a normal camera to install the companion app.",
+    "Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.",
+    "The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.",
+    "Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.",
+    "Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.",
+    "Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.",
+    "Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases."
   ],
   "components": [
     {
-      "current_version": "1.7.111-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago",
+      "current_version": "1.7.112-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.112-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.111-alpha",
-      "sha256": "9e50577470cb4c5dd67b4316a3efaaa87e7afac15a8b5c2e3841edc6c3ed6550",
-      "size_bytes": 50615920
+      "new_version": "1.7.112-alpha",
+      "sha256": "7cd7ab9dd9b433db929841328cbf553a056937f18814d0b7368b0a5c44dc2b9b",
+      "size_bytes": 51469560
     },
     {
-      "current_version": "1.7.111-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago-frontend-1.7.111-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.111-alpha.tar.gz",
-      "new_version": "1.7.111-alpha",
-      "sha256": "3ea73cd8e98312b3b6877e00434363fe575362e7b2b134e03a9004d4e42930c9",
-      "size_bytes": 174650727
+      "current_version": "1.7.112-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.112-alpha/archipelago-frontend-1.7.112-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.112-alpha.tar.gz",
+      "new_version": "1.7.112-alpha",
+      "sha256": "02d916cadb54f76c19910376d6d42e820ee7b42fff7c1ea071bb5ec9b2bea3b8",
+      "size_bytes": 177952072
     }
   ],
-  "release_date": "2026-07-22",
-  "signature": "1cc569a121f2cc5560840198115732155db4ee037ea98c4be8cf9ef8a7b227e26dc686a88a779f1e40daaa94b5cb44083b78147f45398a29188bf2834488eb03",
+  "release_date": "2026-07-24",
+  "signature": "ffe1d1576e63c68f27dc6924f6db4381f745f48e1e279a9b20351c1104cf6e9a8756596cef99e8b3436925361bbbc9f305c14b0632e7c2f095b817783bbfa60d",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.111-alpha"
+  "version": "1.7.112-alpha"
 }