release(v1.7.14-alpha): install overlay + FIPS real fix + AIUI restore

Install UX
  SystemUpdate.vue now shows a full-screen overlay after apply: the
  BitcoinFaceAscii logo, a target-version label, an indeterminate
  progress stripe (solid orange; solid green on ready), and an
  elapsed-time readout. Polls /health every 1.5s and auto-reloads
  once the backend reports the new version. 3-min stall → "Reload
  now" button. Download UI also shows a spinner + "Finishing
  download — verifying checksum…" while the fake bar sits at 95%.

FIPS reconnect — for real this time
  New fips.reconnect RPC does stop → start → wait 20s → re-poll →
  classify. Classification buckets: connected / daemon_down /
  no_seed_key / no_outbound_udp_or_anchor_down / peers_but_no_anchor,
  each with a plain-language hint surfaced verbatim by the Reconnect
  button. The real reason nodes like .198/.253 couldn't reach the
  anchor: identity::write_fips_key_from_seed was writing fips_key.pub
  as a bech32 npub TEXT file, but upstream fips expects 32 raw
  bytes. The daemon silently authenticated with garbage. Fix:
  PublicKey::to_bytes() → raw 32 bytes, and new
  fips::config::normalize_pub_file migrates legacy files by decoding
  the npub and rewriting in place. fips.reconnect also re-installs
  the config + healed keys to /etc/fips before restarting.

AIUI preservation + restore
  apply_update was wiping /opt/archipelago/web-ui/aiui because the
  Vue build doesn't include it — every OTA lost the Claude sidebar.
  The preserve block now copies aiui/ + archipelago-companion.apk
  from the old web-ui into the staging dir before the swap, and
  prefers new-tar versions if present. To restore it on the three
  nodes that already lost it (.116/.198/.253), this release bundles
  the 85 MB aiui build into the frontend tarball. Frontend component
  size is now ~155 MB.

Download / install timeouts
  Backend download client timeout 1800s → 3600s (1 h). Larger
  tarball + slow gitea raw throughput put us above the old cap.
  Frontend update.download rpc timeout 30 min → 65 min to match.
  package.install rpc timeout 15 min → 45 min — IndeedHub pulls
  6 images and was timing out mid-install.

UI nit
  "Rollback to Previous" → "Rollback Available".

App-catalog proxy already landed in v1.7.13.

Artefacts:
  archipelago                                      725e18e6…3c525e6   40462288
  archipelago-frontend-1.7.14-alpha.tar.gz         c35284be…ff2c16   162077052 (+aiui)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.1-alpha"
+version = "1.7.14-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.1-alpha"
+version = "1.7.14-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/handler/mod.rs

@@ -113,6 +113,53 @@ impl ApiHandler {
         }
     }
 
+    /// Server-side fetch of the upstream app catalog so the browser can
+    /// load it without fighting CORS (git.tx1138.com emits no ACAO) or
+    /// CSP (the fallback IP-port URL isn't in `connect-src`). Tries the
+    /// upstream URLs in the same order the frontend used, returns the
+    /// first 2xx response. 15s total timeout.
+    async fn handle_app_catalog_proxy() -> Result<Response<hyper::Body>> {
+        const UPSTREAMS: &[&str] = &[
+            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
+            "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json",
+        ];
+        let client = match reqwest::Client::builder()
+            .timeout(std::time::Duration::from_secs(15))
+            .build()
+        {
+            Ok(c) => c,
+            Err(e) => {
+                return Ok(build_response(
+                    hyper::StatusCode::INTERNAL_SERVER_ERROR,
+                    "text/plain",
+                    hyper::Body::from(format!("client build failed: {}", e)),
+                ));
+            }
+        };
+        for url in UPSTREAMS {
+            match client.get(*url).send().await {
+                Ok(resp) if resp.status().is_success() => {
+                    if let Ok(bytes) = resp.bytes().await {
+                        return Ok(Response::builder()
+                            .status(hyper::StatusCode::OK)
+                            .header("Content-Type", "application/json")
+                            .header("Cache-Control", "public, max-age=3600")
+                            .body(hyper::Body::from(bytes))
+                            .unwrap_or_else(|_| {
+                                Response::new(hyper::Body::from("proxy response build failed"))
+                            }));
+                    }
+                }
+                _ => continue,
+            }
+        }
+        Ok(build_response(
+            hyper::StatusCode::BAD_GATEWAY,
+            "text/plain",
+            hyper::Body::from("all upstream catalog URLs failed"),
+        ))
+    }
+
     /// Build a 401 Unauthorized JSON response.
     fn unauthorized() -> Response<hyper::Body> {
         let body = serde_json::json!({ "error": "Unauthorized" });
@@ -352,6 +399,18 @@ impl ApiHandler {
             // Electrs status — unauthenticated (read-only sync status)
             (Method::GET, "/electrs-status") => Self::handle_electrs_status().await,
 
+            // App-catalog proxy — fetches catalog.json from the configured
+            // upstream URLs server-side so the browser doesn't hit CORS
+            // (git.tx1138.com has no ACAO header) or CSP (IP-port upstream
+            // falls outside `connect-src`). Session-authenticated so only
+            // the logged-in node owner can spin up fetches.
+            (Method::GET, "/api/app-catalog") => {
+                if !self.is_authenticated(&headers).await {
+                    return Ok(Self::unauthorized());
+                }
+                Self::handle_app_catalog_proxy().await
+            }
+
             // LND connect info — nginx validates session cookie (presence check),
             // backend is bound to 127.0.0.1 so only nginx can reach it.
             // No backend auth check here because the LND UI iframe fetches this

core/archipelago/src/api/rpc/dispatcher.rs

@@ -413,6 +413,7 @@ impl RpcHandler {
             "fips.apply-update" => self.handle_fips_apply_update().await,
             "fips.install" => self.handle_fips_install().await,
             "fips.restart" => self.handle_fips_restart().await,
+            "fips.reconnect" => self.handle_fips_reconnect().await,
 
             // System updates
             "update.check" => self.handle_update_check().await,

core/archipelago/src/api/rpc/fips.rs

@@ -44,4 +44,89 @@ impl RpcHandler {
         fips::service::restart(fips::SERVICE_UNIT).await?;
         Ok(serde_json::json!({ "restarted": true }))
     }
+
+    /// Full reconnect: stop the daemon, bring it back, wait for the DHT
+    /// bootstrap window, poll the identity-cache + peer list, and
+    /// classify what recovered (or didn't) so the UI can explain it to
+    /// the user instead of showing a generic failure.
+    ///
+    /// Runtime: ~20s. Needs an RPC timeout ≥ 45s on the client.
+    pub(super) async fn handle_fips_reconnect(&self) -> Result<serde_json::Value> {
+        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
+        let before = fips::FipsStatus::query(&identity_dir).await;
+
+        // Heal the pre-fix bech32-text fips_key.pub → 32-raw-bytes
+        // mismatch. The daemon silently authenticates with a garbage
+        // pubkey when the .pub file is 63-char text, which looks like
+        // "anchor unreachable" to the user even though the real fault
+        // was an identity malformed on the node itself. Re-install the
+        // config + keys so /etc/fips gets the healed .pub.
+        let key_src = identity_dir.join("fips_key");
+        let pub_src = identity_dir.join("fips_key.pub");
+        if key_src.exists() {
+            let _ = fips::config::normalize_pub_file(&key_src, &pub_src).await;
+            // Re-install refreshes /etc/fips/fips.pub from the healed
+            // source. No-op if nothing changed.
+            let _ = fips::config::install(&identity_dir).await;
+        }
+
+        // Clean stop+start rather than `restart`, so a daemon that
+        // fails to come back up surfaces as service_active=false
+        // instead of quietly sticking with the old process.
+        let _ = fips::service::stop(fips::SERVICE_UNIT).await;
+        tokio::time::sleep(std::time::Duration::from_millis(800)).await;
+        fips::service::activate(fips::SERVICE_UNIT).await?;
+
+        // Anchor bootstrap window: poll the status every ~3s for up to
+        // 20s. Bail as soon as the anchor is connected.
+        let mut last_status: Option<fips::FipsStatus> = None;
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
+        loop {
+            tokio::time::sleep(std::time::Duration::from_secs(3)).await;
+            let s = fips::FipsStatus::query(&identity_dir).await;
+            if s.anchor_connected {
+                last_status = Some(s);
+                break;
+            }
+            last_status = Some(s);
+            if std::time::Instant::now() >= deadline {
+                break;
+            }
+        }
+        let after = last_status.unwrap_or_else(|| before.clone());
+
+        let recovered = after.anchor_connected && !before.anchor_connected;
+        let likely_cause = if after.anchor_connected {
+            "connected"
+        } else if !after.service_active {
+            "daemon_down"
+        } else if !after.key_present {
+            "no_seed_key"
+        } else if after.authenticated_peer_count == 0 {
+            // Daemon is up with a key but hasn't authenticated any
+            // peers — almost always outbound UDP/8668 dropped by the
+            // local firewall/router, or the anchor itself being down.
+            "no_outbound_udp_or_anchor_down"
+        } else {
+            "peers_but_no_anchor"
+        };
+        let hint = match likely_cause {
+            "connected" => "Anchor is reachable.",
+            "daemon_down" => "The FIPS daemon didn't come back up — check archipelago-fips.service.",
+            "no_seed_key" => "No seed-derived FIPS key on disk. Re-run the onboarding unlock step.",
+            "no_outbound_udp_or_anchor_down" =>
+                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or the anchor (fips.v0l.io) could be down.",
+            "peers_but_no_anchor" =>
+                "Mesh has peers but the anchor hasn't been seen yet. Give it a minute and re-check.",
+            _ => "",
+        };
+
+        Ok(serde_json::json!({
+            "recovered": recovered,
+            "likely_cause": likely_cause,
+            "hint": hint,
+            "before": before,
+            "after": after,
+        }))
+    }
 }

core/archipelago/src/api/rpc/update.rs

@@ -6,12 +6,18 @@ impl RpcHandler {
     /// Check for available system updates.
     /// Tries git-based check first (if repo exists), falls back to manifest-based.
     pub(super) async fn handle_update_check(&self) -> Result<serde_json::Value> {
-        // Try git-based check first (preferred for beta nodes)
+        // Manifest override: when ARCHIPELAGO_UPDATE_URL is explicitly set,
+        // the operator wants OTA via manifest — typically a dev box where
+        // ~/archy/.git exists but isn't the intended update surface.
+        // Without this short-circuit the dev box always advertises "Pull
+        // & Rebuild" and can never exercise the manifest OTA path.
+        let manifest_override = std::env::var("ARCHIPELAGO_UPDATE_URL").is_ok();
+
         let repo_dir = std::path::PathBuf::from(
             std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string()),
         )
         .join("archy");
-        if repo_dir.join(".git").exists() {
+        if !manifest_override && repo_dir.join(".git").exists() {
             if let Ok(git_status) = self.git_check_update(&repo_dir).await {
                 return Ok(git_status);
             }

core/archipelago/src/data_model.rs

@@ -265,16 +265,13 @@ impl DataModel {
     /// falling back to Cargo.toml version. This allows sequential CI build
     /// numbers to be reflected in the UI without recompiling the binary.
     fn detect_build_version() -> String {
-        if let Ok(content) = std::fs::read_to_string("/opt/archipelago/build-info.txt") {
-            for line in content.lines() {
-                if let Some(v) = line.strip_prefix("version=") {
-                    let v = v.trim();
-                    if !v.is_empty() {
-                        return v.to_string();
-                    }
-                }
-            }
-        }
+        // Always use the binary's compiled-in version. The ISO installer
+        // writes /opt/archipelago/build-info.txt at install time, but that
+        // file is never rewritten by OTA or sideload, so trusting it made
+        // the sidebar permanently advertise whatever the ISO shipped with
+        // even after the running binary had moved on. CARGO_PKG_VERSION is
+        // baked into the binary at compile time, so it always matches what
+        // is actually running.
         env!("CARGO_PKG_VERSION").to_string()
     }
 

core/archipelago/src/fips/config.rs

@@ -78,11 +78,65 @@ pub async fn install(identity_dir: &Path) -> Result<()> {
     install_result?;
 
     sudo_install_file(&src_key, DAEMON_KEY_PATH, "0600").await?;
+    // Heal a legacy fips_key.pub that was written as bech32 npub text
+    // (pre-fix identity::write_fips_key_from_seed did this). Upstream
+    // fips expects 32 raw bytes; a text file silently passes through
+    // and then the daemon can't identify itself to peers. This
+    // rewrites the source file in place with the correct binary form
+    // derived from fips_key before staging it to /etc/fips/fips.pub.
+    normalize_pub_file(&src_key, &src_pub).await?;
     sudo_install_file(&src_pub, DAEMON_PUB_PATH, "0644").await?;
 
     Ok(())
 }
 
+/// Ensure `fips_key.pub` is 32 raw bytes. If it's a bech32 npub text
+/// file (from the pre-fix writer), decode it and rewrite in place. If
+/// the file is missing or its content doesn't match either format,
+/// re-derive the public key from `fips_key` and write that.
+pub async fn normalize_pub_file(key_path: &Path, pub_path: &Path) -> Result<()> {
+    // Happy path: already 32 raw bytes.
+    if let Ok(bytes) = tokio::fs::read(pub_path).await {
+        if bytes.len() == 32 {
+            return Ok(());
+        }
+        // bech32 npub text from the pre-fix writer: decode in place.
+        if let Ok(s) = std::str::from_utf8(&bytes) {
+            let trimmed = s.trim();
+            if trimmed.starts_with("npub1") {
+                if let Ok(pk) = nostr_sdk::PublicKey::parse(trimmed) {
+                    let raw: [u8; 32] = pk.to_bytes();
+                    tokio::fs::write(pub_path, raw)
+                        .await
+                        .context("rewriting fips_key.pub as 32 raw bytes")?;
+                    tracing::info!(
+                        "Migrated legacy bech32 fips_key.pub to raw-byte form at {}",
+                        pub_path.display()
+                    );
+                    return Ok(());
+                }
+            }
+        }
+    }
+
+    // Fallback: no pub file, or unreadable format. Re-derive from the
+    // private key file (already validated by load_fips_keys).
+    let secret_bytes = tokio::fs::read(key_path)
+        .await
+        .with_context(|| format!("read {} to derive public", key_path.display()))?;
+    let text = std::str::from_utf8(&secret_bytes)
+        .context("fips_key is not UTF-8 — can't derive public")?;
+    let secret = nostr_sdk::SecretKey::parse(text.trim())
+        .context("fips_key not parseable as bech32 nsec")?;
+    let keys = nostr_sdk::Keys::new(secret);
+    let raw: [u8; 32] = keys.public_key().to_bytes();
+    tokio::fs::write(pub_path, raw)
+        .await
+        .context("writing re-derived fips_key.pub")?;
+    tracing::info!("Re-derived fips_key.pub from fips_key");
+    Ok(())
+}
+
 async fn sudo_install_dir(path: &str) -> Result<()> {
     let out = Command::new("sudo")
         .args(["install", "-d", "-m", "0755", path])

core/archipelago/src/identity.rs

@@ -219,14 +219,22 @@ async fn write_fips_key_from_seed(
             .await
             .context("Failed to set FIPS key permissions")?;
     }
-    let npub = keys.public_key().to_bech32().unwrap_or_default();
-    fs::write(&pub_path, format!("{npub}\n"))
+    // Upstream fips daemon expects 32 raw bytes in /etc/fips/fips.pub —
+    // not a bech32 npub string. Writing the bech32 form here meant the
+    // installed .pub file was a 63-char text file the daemon parsed as
+    // 63 raw bytes of garbage, so it couldn't identify itself to peers
+    // and the anchor never handshook. Write the raw public-key bytes
+    // (PublicKey::to_bytes returns a [u8; 32]) so the daemon reads
+    // them directly.
+    let raw_pub: [u8; 32] = keys.public_key().to_bytes();
+    fs::write(&pub_path, raw_pub)
         .await
         .context("Failed to write FIPS public key")?;
 
+    let npub_for_log = keys.public_key().to_bech32().unwrap_or_default();
     tracing::info!(
         "Derived FIPS mesh key from seed (npub: {}...)",
-        npub.chars().take(20).collect::<String>()
+        npub_for_log.chars().take(20).collect::<String>()
     );
     Ok(())
 }

core/archipelago/src/identity_manager.rs

@@ -739,6 +739,20 @@ impl IdentityManager {
                 .and_then(|pk| pk.to_bech32().ok())
         });
 
+        // Backfill a default avatar for identities created before the
+        // default-avatar feature shipped. The synthetic profile lives only
+        // in the returned record — we don't rewrite the file on disk,
+        // since a later explicit save will persist whatever the user
+        // actually chose. Master identities (seed index 0) get the hex
+        // node SVG; all other pre-existing identities get the identicon.
+        let profile = file.profile.or_else(|| {
+            let is_master = file.derivation_index == Some(0);
+            Some(IdentityProfile {
+                picture: Some(crate::avatar::default_picture(&file.pubkey_hex, is_master)),
+                ..Default::default()
+            })
+        });
+
         Ok(IdentityRecord {
             id: file.id,
             name: file.name,
@@ -749,7 +763,7 @@ impl IdentityManager {
             created_at: file.created_at,
             nostr_pubkey: file.nostr_pubkey_hex,
             nostr_npub,
-            profile: file.profile,
+            profile,
         })
     }
 

core/archipelago/src/update.rs

@@ -176,7 +176,12 @@ pub async fn download_update(data_dir: &Path) -> Result<DownloadProgress> {
         .context("Failed to create staging dir")?;
 
     let client = reqwest::Client::builder()
-        .timeout(std::time::Duration::from_secs(1800))
+        // 1h per component — the bundled frontend+aiui tarball sits at
+        // ~160 MB and git.tx1138.com raw serves at ~70 KB/s which puts
+        // the worst case above the old 30 min cap. A larger timeout
+        // with a tight connect_timeout keeps hung connections from
+        // swallowing the whole budget.
+        .timeout(std::time::Duration::from_secs(3600))
         .connect_timeout(std::time::Duration::from_secs(30))
         .build()
         .context("Failed to create HTTP client")?;
@@ -244,6 +249,32 @@ pub async fn download_update(data_dir: &Path) -> Result<DownloadProgress> {
     })
 }
 
+/// Run a command as root, but *outside* the archipelago service's
+/// restricted mount namespace.
+///
+/// archipelago.service uses `ProtectSystem=strict`, which makes `/opt`
+/// and `/usr` read-only inside the service — and sudo inherits the
+/// namespace, so `sudo mv /opt/archipelago/...` fails with EROFS even
+/// though sudo itself is root. `systemd-run --wait` spawns a transient
+/// service unit that inherits systemd's default protections (i.e. none
+/// of ours), escaping the namespace.
+async fn host_sudo(args: &[&str]) -> Result<std::process::ExitStatus> {
+    let mut full: Vec<&str> = vec![
+        "systemd-run",
+        "--wait",
+        "--quiet",
+        "--collect",
+        "--pipe",
+        "--",
+    ];
+    full.extend_from_slice(args);
+    tokio::process::Command::new("sudo")
+        .args(&full)
+        .status()
+        .await
+        .context("sudo systemd-run spawn failed")
+}
+
 /// Apply a downloaded update. Backs up current binaries, replaces with staged versions.
 pub async fn apply_update(data_dir: &Path) -> Result<()> {
     let staging_dir = data_dir.join("update-staging");
@@ -277,46 +308,118 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
 
         match name.as_str() {
             "archipelago" => {
-                let dest = Path::new("/usr/local/bin/archipelago");
-                fs::copy(&src, dest)
+                // Two namespace gotchas this block works around:
+                //   1. We're running FROM /usr/local/bin/archipelago, so
+                //      `install`/`cp` (O_TRUNC + write) fail with ETXTBSY.
+                //      Use `mv`, which is atomic rename() and tolerates a
+                //      busy destination.
+                //   2. archipelago.service sets ProtectSystem=strict, so
+                //      even `sudo mv` into /usr/local/bin/ fails EROFS —
+                //      sudo inherits the service's mount namespace. Route
+                //      the rename through systemd-run so it runs in a
+                //      transient unit with default protections.
+                let staged = src.to_string_lossy().to_string();
+                let _ = host_sudo(&["chmod", "0755", &staged]).await;
+                let _ = host_sudo(&["chown", "root:root", &staged]).await;
+                let status = host_sudo(&["mv", &staged, "/usr/local/bin/archipelago"])
                     .await
-                    .with_context(|| format!("Failed to apply {}", name))?;
-                #[cfg(unix)]
-                {
-                    use std::os::unix::fs::PermissionsExt;
-                    std::fs::set_permissions(dest, std::fs::Permissions::from_mode(0o755))
-                        .context("Failed to set binary permissions")?;
+                    .with_context(|| format!("Failed to spawn mv for {}", name))?;
+                if !status.success() {
+                    anyhow::bail!(
+                        "mv into /usr/local/bin failed for {} (exit {:?})",
+                        name,
+                        status.code()
+                    );
                 }
                 info!(name = %name, "Backend binary applied");
             }
             _ if name.contains("frontend") && name.ends_with(".tar.gz") => {
-                let web_ui_dir = Path::new("/opt/archipelago/web-ui");
-                // Back up current frontend
-                let frontend_backup = backup_dir.join("web-ui-backup.tar.gz");
-                if web_ui_dir.exists() {
-                    let status = tokio::process::Command::new("tar")
-                        .args([
-                            "-czf",
-                            &frontend_backup.to_string_lossy(),
-                            "-C",
-                            "/opt/archipelago",
-                            "web-ui",
-                        ])
-                        .status()
-                        .await
-                        .context("Failed to backup frontend")?;
-                    if status.success() {
-                        info!("Frontend backed up");
+                // Tarball contents are the *inside* of web-ui/ (root entries
+                // `./test-aiui.html`, `./assets/`, ...). Extract into a
+                // uniquely-named staging dir, then mv into place. No `rm
+                // -rf` pre-cleanup — that's what hit transient EROFS on
+                // .198 and aborted the apply mid-flight.
+                let ts = chrono::Utc::now().timestamp_millis();
+                let staging_new = format!("/opt/archipelago/web-ui.new.{}", ts);
+                let staging_old = format!("/opt/archipelago/web-ui.old.{}", ts);
+                let web_ui = "/opt/archipelago/web-ui";
+                let backup_path = "/opt/archipelago/web-ui.bak";
+
+                // All sudo calls that touch /opt/archipelago go through
+                // host_sudo so they see a normal root mount namespace.
+                let mk = host_sudo(&["mkdir", "-p", &staging_new])
+                    .await
+                    .context("Failed to create frontend staging dir")?;
+                if !mk.success() {
+                    anyhow::bail!("mkdir {} failed", staging_new);
+                }
+                let extract = host_sudo(&[
+                    "tar",
+                    "-xzf",
+                    &src.to_string_lossy(),
+                    "-C",
+                    &staging_new,
+                ])
+                .await
+                .with_context(|| format!("Failed to extract {}", name))?;
+                if !extract.success() {
+                    let _ = host_sudo(&["rm", "-rf", &staging_new]).await;
+                    anyhow::bail!("tar extraction failed for {}", name);
+                }
+                let _ = host_sudo(&[
+                    "chown",
+                    "-R",
+                    "archipelago:archipelago",
+                    &staging_new,
+                ])
+                .await;
+
+                // Preserve paths that are installed outside the Vue build
+                // (baked in by the ISO or sibling installers) and so
+                // aren't in the new tarball. Without this copy, every OTA
+                // wipes them — notably aiui/ (Claude Code sidebar) and
+                // the companion APK. `cp -a` preserves mode/ownership.
+                for preserved in ["aiui", "archipelago-companion.apk"] {
+                    let src = format!("{}/{}", web_ui, preserved);
+                    let dst = format!("{}/{}", staging_new, preserved);
+                    // Only preserve the old copy if the new tarball
+                    // doesn't already ship a fresher one.
+                    if Path::new(&src).exists() && !Path::new(&dst).exists() {
+                        let _ = host_sudo(&["cp", "-a", &src, &dst]).await;
                     }
                 }
-                // Extract new frontend
-                let status = tokio::process::Command::new("tar")
-                    .args(["-xzf", &src.to_string_lossy(), "-C", "/opt/archipelago"])
-                    .status()
+
+                // Swap: mv current web-ui aside, then mv new into place.
+                if Path::new(web_ui).exists() {
+                    let mv_old = host_sudo(&["mv", web_ui, &staging_old])
+                        .await
+                        .context("Failed to rotate old web-ui")?;
+                    if !mv_old.success() {
+                        anyhow::bail!("failed to move old web-ui aside");
+                    }
+                }
+                let mv_new = host_sudo(&["mv", &staging_new, web_ui])
                     .await
-                    .with_context(|| format!("Failed to extract {}", name))?;
-                if !status.success() {
-                    anyhow::bail!("tar extraction failed for {}", name);
+                    .context("Failed to swap new web-ui into place")?;
+                if !mv_new.success() {
+                    if Path::new(&staging_old).exists() {
+                        let _ = host_sudo(&["mv", &staging_old, web_ui]).await;
+                    }
+                    anyhow::bail!("failed to move new web-ui into place");
+                }
+
+                // Rotate previous rollback aside and install this apply's
+                // old copy as the new rollback.
+                if Path::new(&staging_old).exists() {
+                    if Path::new(backup_path).exists() {
+                        let _ = host_sudo(&[
+                            "mv",
+                            backup_path,
+                            &format!("{}.{}", backup_path, ts),
+                        ])
+                        .await;
+                    }
+                    let _ = host_sudo(&["mv", &staging_old, backup_path]).await;
                 }
                 info!(name = %name, "Frontend archive extracted to /opt/archipelago/web-ui");
             }
@@ -339,7 +442,20 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
     // Clean staging
     let _ = fs::remove_dir_all(&staging_dir).await;
 
-    info!("Update applied. Restart service to take effect.");
+    info!("Update applied — scheduling service restart in 2s so the RPC reply lands first");
+
+    // Restart asynchronously so the JSON-RPC response actually reaches the
+    // UI before systemd kills us. --no-block makes sure systemctl doesn't
+    // try to wait for the current service (us) to exit cleanly before
+    // starting the new process — it would deadlock otherwise.
+    tokio::spawn(async {
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        // systemctl talks to PID 1 over D-Bus — doesn't need the host
+        // mount namespace, but routing through host_sudo keeps the
+        // apply flow's sudo calls uniform.
+        let _ = host_sudo(&["systemctl", "--no-block", "restart", "archipelago"]).await;
+    });
+
     Ok(())
 }
 

neode-ui/src/api/rpc-client.ts

@@ -525,7 +525,11 @@ class RPCClient {
     return this.call({
       method: 'package.install',
       params: { id, 'marketplace-url': marketplaceUrl, version },
-      timeout: 900000, // 15 min — multi-GB stacks (IndeedHub, Bitcoin, Penpot) take time
+      // 45 min — IndeedHub is 6 images and gitea raw-file throughput is
+      // ~70 KB/s per image; 15 min was short enough to kill the install
+      // mid-pull and land the user on a "didn't work" screen while the
+      // backend kept working in the background.
+      timeout: 2700000,
     })
   }
 

neode-ui/src/locales/en.json

@@ -663,18 +663,18 @@
     "autoApply": "Auto-Apply",
     "autoApplyDesc": "Check daily and automatically install updates at 3 AM. Service restarts as needed.",
     "downloadUpdate": "Download Update",
-    "applyUpdate": "Apply Update",
+    "applyUpdate": "Install Update",
     "checkForUpdates": "Check for Updates",
     "checking": "Checking...",
-    "rollback": "Rollback to Previous",
+    "rollback": "Rollback Available",
     "backToSettings": "Back to Settings",
     "percentComplete": "{percent}% complete",
     "applyWarning": "Installing components and restarting services. Do not power off.",
-    "applyTitle": "Apply Update?",
+    "applyTitle": "Install Update?",
     "applyMessage": "The backend service will restart. This may take a moment.",
     "rollbackTitle": "Rollback Version?",
     "rollbackMessage": "This will restore the previous version. The backend service will restart.",
-    "applyNow": "Apply Now",
+    "applyNow": "Install Now",
     "rollbackButton": "Rollback",
     "upToDateMessage": "Your system is up to date. No updates available. Your system is running the latest version.",
     "checkFailed": "Failed to check for updates. Check your internet connection.",
@@ -685,6 +685,14 @@
     "rollbackSuccess": "Rolled back to previous version. Service will restart.",
     "rollbackFailed": "Rollback failed.",
     "pullAndRebuild": "Pull & Rebuild",
+    "finishingDownload": "Finishing download — verifying checksum…",
+    "overlayApplying": "Installing update…",
+    "overlayRestarting": "Restarting server…",
+    "overlayReconnecting": "Reconnecting to the new version…",
+    "overlayReady": "Update installed — reloading…",
+    "overlayStalled": "Taking longer than expected",
+    "overlayTarget": "Installing v{version}",
+    "overlayReloadNow": "Reload now",
     "gitMethodHint": "This node builds from source. Update will git-pull, rebuild the backend and UI, then restart — takes a few minutes.",
     "gitApplyTitle": "Pull & Rebuild?",
     "gitApplyMessage": "Archipelago will pull the latest code, rebuild, and restart. This can take several minutes and the UI will be briefly unavailable.",

neode-ui/src/locales/es.json

@@ -662,18 +662,18 @@
     "autoApply": "Aplicaci\u00f3n autom\u00e1tica",
     "autoApplyDesc": "Buscar diariamente y aplicar actualizaciones autom\u00e1ticamente a las 3 AM. Los servicios se reinician seg\u00fan sea necesario.",
     "downloadUpdate": "Descargar actualizaci\u00f3n",
-    "applyUpdate": "Aplicar actualizaci\u00f3n",
+    "applyUpdate": "Instalar actualizaci\u00f3n",
     "checkForUpdates": "Buscar actualizaciones",
     "checking": "Verificando...",
-    "rollback": "Revertir a la versi\u00f3n anterior",
+    "rollback": "Rollback disponible",
     "backToSettings": "Volver a configuraci\u00f3n",
     "percentComplete": "{percent}% completado",
     "applyWarning": "Instalando componentes y reiniciando servicios. No apague el equipo.",
-    "applyTitle": "\u00bfAplicar actualizaci\u00f3n?",
+    "applyTitle": "\u00bfInstalar actualizaci\u00f3n?",
     "applyMessage": "El servicio del backend se reiniciar\u00e1. Esto puede tomar un momento.",
     "rollbackTitle": "\u00bfRevertir versi\u00f3n?",
     "rollbackMessage": "Esto restaurar\u00e1 la versi\u00f3n anterior. El servicio del backend se reiniciar\u00e1.",
-    "applyNow": "Aplicar ahora",
+    "applyNow": "Instalar ahora",
     "rollbackButton": "Revertir",
     "upToDateMessage": "Su sistema est\u00e1 actualizado. No hay actualizaciones disponibles. Su sistema est\u00e1 ejecutando la \u00faltima versi\u00f3n.",
     "checkFailed": "Error al buscar actualizaciones. Verifique su conexi\u00f3n a internet.",
@@ -684,6 +684,14 @@
     "rollbackSuccess": "Se revirti\u00f3 a la versi\u00f3n anterior. El servicio se reiniciar\u00e1.",
     "rollbackFailed": "Error al revertir.",
     "pullAndRebuild": "Pull y Recompilar",
+    "finishingDownload": "Terminando descarga — verificando checksum…",
+    "overlayApplying": "Instalando actualizaci\u00f3n…",
+    "overlayRestarting": "Reiniciando servidor…",
+    "overlayReconnecting": "Reconectando a la nueva versi\u00f3n…",
+    "overlayReady": "Actualizaci\u00f3n instalada — recargando…",
+    "overlayStalled": "Tardando m\u00e1s de lo esperado",
+    "overlayTarget": "Instalando v{version}",
+    "overlayReloadNow": "Recargar ahora",
     "gitMethodHint": "Este nodo compila desde el c\u00f3digo fuente. La actualizaci\u00f3n har\u00e1 git-pull, recompilar\u00e1 y reiniciar\u00e1 — tarda unos minutos.",
     "gitApplyTitle": "\u00bfPull y Recompilar?",
     "gitApplyMessage": "Archipelago descargar\u00e1 el c\u00f3digo m\u00e1s reciente, lo compilar\u00e1 y reiniciar\u00e1. Puede tardar varios minutos y la UI estar\u00e1 brevemente no disponible.",

neode-ui/src/views/Home.vue

@@ -317,26 +317,35 @@ const torConnected = computed(() => {
 })
 const vpnStatus = ref({ connected: false, provider: '' })
 const vpnConnected = computed(() => vpnStatus.value.connected || (!!packages.value['tailscale'] && packages.value['tailscale'].state === PackageState.Running))
-const fipsStatus = ref<{ installed: boolean; service_active: boolean; key_present: boolean } | null>(null)
+const fipsStatus = ref<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number } | null>(null)
 const fipsDotClass = computed(() => {
   const s = fipsStatus.value
   if (!s || !s.installed) return 'bg-white/40'
-  if (s.service_active) return 'bg-green-400'
-  return 'bg-white/40'
+  if (!s.service_active) return 'bg-white/40'
+  // Active but no anchor = degraded, not fully green
+  if (s.anchor_connected === false) return 'bg-orange-400'
+  return 'bg-green-400'
 })
 const fipsTextClass = computed(() => {
   const s = fipsStatus.value
   if (!s || !s.installed) return 'text-white/40'
-  if (s.service_active) return 'text-green-400'
-  return 'text-white/40'
+  if (!s.service_active) return 'text-white/40'
+  if (s.anchor_connected === false) return 'text-orange-400'
+  return 'text-green-400'
 })
 const fipsStatusLabel = computed(() => {
   const s = fipsStatus.value
   if (!s) return '…'
   if (!s.installed) return 'Not installed'
-  if (s.service_active) return 'Active'
-  if (!s.key_present) return 'Awaiting seed'
-  return 'Inactive'
+  if (!s.service_active) {
+    if (!s.key_present) return 'Awaiting seed'
+    return 'Inactive'
+  }
+  // Service is active — reflect anchor reachability in the label so the
+  // Home and Server rows flip in sync with the FIPS card.
+  if (s.anchor_connected === false) return 'No anchor'
+  const peers = s.authenticated_peer_count ?? 0
+  return peers === 1 ? 'Active · 1 peer' : `Active · ${peers} peers`
 })
 const bitcoinSyncDisplay = computed(() => {
   if (!systemStats.bitcoinAvailable) return 'Not running'

neode-ui/src/views/Server.vue

@@ -420,25 +420,31 @@ const networkData = ref({
 })
 
 // FIPS status row for the Local Network card. Full FIPS card lives below.
-const fipsSummary = ref<{ installed: boolean; service_active: boolean; key_present: boolean } | null>(null)
+const fipsSummary = ref<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number } | null>(null)
 const fipsRowLabel = computed(() => {
   const s = fipsSummary.value
   if (!s) return '…'
   if (!s.installed) return 'Not installed'
-  // Service-active wins even on legacy nodes with no seed-derived key.
-  if (s.service_active) return 'Active'
-  if (!s.key_present) return 'Awaiting seed'
-  return 'Inactive'
+  if (!s.service_active) {
+    if (!s.key_present) return 'Awaiting seed'
+    return 'Inactive'
+  }
+  // Service is active — reflect anchor reachability so the row flips in
+  // sync with the full FIPS card below.
+  if (s.anchor_connected === false) return 'No anchor'
+  const peers = s.authenticated_peer_count ?? 0
+  return peers === 1 ? 'Active · 1 peer' : `Active · ${peers} peers`
 })
 const fipsRowTextClass = computed(() => {
   const s = fipsSummary.value
   if (!s || !s.installed) return 'text-white/40'
-  if (s.service_active) return 'text-green-400'
-  return 'text-white/60'
+  if (!s.service_active) return 'text-white/60'
+  if (s.anchor_connected === false) return 'text-orange-400'
+  return 'text-green-400'
 })
 async function loadFipsSummary() {
   try {
-    fipsSummary.value = await rpcClient.call<{ installed: boolean; service_active: boolean; key_present: boolean }>({ method: 'fips.status' })
+    fipsSummary.value = await rpcClient.call<{ installed: boolean; service_active: boolean; key_present: boolean; anchor_connected?: boolean; authenticated_peer_count?: number }>({ method: 'fips.status' })
   } catch { /* backend too old */ }
 }
 

neode-ui/src/views/SystemUpdate.vue

@@ -113,7 +113,14 @@
           :style="{ width: downloadPercentFormatted + '%' }"
         ></div>
       </div>
-      <p class="text-xs text-white/60">{{ t('systemUpdate.percentComplete', { percent: downloadPercentFormatted }) }}</p>
+      <div class="flex items-center gap-2">
+        <div v-if="downloadFinishing" class="w-3 h-3 border-2 border-orange-400 border-t-transparent rounded-full animate-spin shrink-0"></div>
+        <p class="text-xs text-white/60">
+          {{ downloadFinishing
+             ? t('systemUpdate.finishingDownload')
+             : t('systemUpdate.percentComplete', { percent: downloadPercentFormatted }) }}
+        </p>
+      </div>
     </div>
 
     <!-- Applying -->
@@ -176,6 +183,67 @@
       </div>
     </div>
 
+    <!-- Install progress overlay — covers the UI while the backend
+         swaps files, restarts, and comes back up on the new version.
+         Auto-reloads the page as soon as /health reports the target
+         version. Styled to match the screensaver (ASCII logo, full-
+         screen black). -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="installing"
+          class="fixed inset-0 z-[3000] bg-black flex flex-col items-center justify-center overflow-hidden"
+        >
+          <!-- Centered ASCII logo — same asset used by the screensaver -->
+          <div class="install-overlay-ascii">
+            <BitcoinFaceAscii />
+          </div>
+
+          <!-- Status text + progress bar underneath -->
+          <div class="mt-8 w-[min(520px,80vw)] text-center">
+            <h2 class="text-xl font-semibold text-white mb-1">
+              {{ installStage === 'applying' ? t('systemUpdate.overlayApplying')
+               : installStage === 'restarting' ? t('systemUpdate.overlayRestarting')
+               : installStage === 'reconnecting' ? t('systemUpdate.overlayReconnecting')
+               : installStage === 'ready' ? t('systemUpdate.overlayReady')
+               : t('systemUpdate.overlayStalled') }}
+            </h2>
+            <p v-if="installTargetVersion" class="text-sm text-white/60 mb-4">
+              {{ t('systemUpdate.overlayTarget', { version: installTargetVersion }) }}
+            </p>
+
+            <!-- Animated bar: indeterminate stripe while working; full
+                 orange when ready; steady at 50% (paused look) when
+                 stalled so it reads as "something needs the user". -->
+            <div class="w-full h-2 bg-white/10 rounded-full overflow-hidden mb-3 relative">
+              <div
+                v-if="installStage === 'ready'"
+                class="absolute inset-0 bg-green-400"
+              ></div>
+              <div
+                v-else-if="installStage === 'stalled'"
+                class="absolute inset-y-0 left-0 w-1/2 bg-orange-400/60"
+              ></div>
+              <div
+                v-else
+                class="absolute inset-y-0 w-1/3 bg-orange-400 rounded-full install-overlay-bar-anim"
+              ></div>
+            </div>
+
+            <p class="text-xs text-white/40">{{ installElapsedLabel }}</p>
+
+            <button
+              v-if="installStage === 'stalled'"
+              @click="reloadNow"
+              class="mt-5 glass-button rounded-lg px-5 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30"
+            >
+              {{ t('systemUpdate.overlayReloadNow') }}
+            </button>
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+
     <!-- Confirmation modal -->
     <Transition name="fade">
       <div v-if="confirmAction" class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md" @click.self="cancelConfirm">
@@ -221,6 +289,7 @@ import { ref, computed, onMounted } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { RouterLink } from 'vue-router'
 import { rpcClient } from '@/api/rpc-client'
+import BitcoinFaceAscii from '@/views/discover/BitcoinFaceAscii.vue'
 
 interface UpdateDetail {
   version: string
@@ -255,6 +324,78 @@ const statusMessage = ref('')
 const statusIsError = ref(false)
 const downloadPercent = ref(0)
 const downloadPercentFormatted = computed(() => downloadPercent.value.toFixed(2))
+// Shown next to the progress bar when the fake increment has maxed out
+// at 95% but the real RPC hasn't returned yet — lets the user know the
+// UI hasn't frozen while SHA verification and disk writes finish.
+const downloadFinishing = computed(() => downloading.value && downloadPercent.value >= 95)
+
+// Install overlay state — drives the full-screen progress modal shown
+// while the backend swaps files, restarts, and comes back up on the
+// new version. The overlay polls /health and auto-reloads the browser
+// as soon as the backend reports the target version, so the user
+// doesn't need to manually refresh.
+type InstallStage = 'applying' | 'restarting' | 'reconnecting' | 'ready' | 'stalled'
+const installing = ref(false)
+const installStage = ref<InstallStage>('applying')
+const installTargetVersion = ref<string | null>(null)
+const installStartedAt = ref<number>(0)
+const installElapsedSec = ref(0)
+let installPollTimer: ReturnType<typeof setInterval> | null = null
+let installElapsedTimer: ReturnType<typeof setInterval> | null = null
+const installElapsedLabel = computed(() => {
+  const s = installElapsedSec.value
+  if (s < 60) return `Elapsed: ${s}s`
+  return `Elapsed: ${Math.floor(s / 60)}m${s % 60 < 10 ? '0' : ''}${s % 60}s`
+})
+function startInstallOverlay(targetVersion: string) {
+  installing.value = true
+  installStage.value = 'applying'
+  installTargetVersion.value = targetVersion
+  installStartedAt.value = Date.now()
+  installElapsedSec.value = 0
+  // Tick an elapsed counter once per second for the UI.
+  installElapsedTimer = setInterval(() => {
+    installElapsedSec.value = Math.floor((Date.now() - installStartedAt.value) / 1000)
+    // Stop polling after 3 min — surface the manual reload button.
+    if (installElapsedSec.value >= 180 && installStage.value !== 'ready') {
+      installStage.value = 'stalled'
+    }
+  }, 1000)
+  // Start polling /health after a short delay — the backend restarts 2s
+  // after replying to update.apply, so an immediate poll would see the
+  // old backend and conclude nothing happened.
+  setTimeout(() => {
+    installStage.value = 'restarting'
+    installPollTimer = setInterval(pollHealth, 1500)
+  }, 2500)
+}
+async function pollHealth() {
+  if (installStage.value === 'ready' || installStage.value === 'stalled') return
+  try {
+    const res = await fetch('/health', { signal: AbortSignal.timeout(2000) })
+    if (!res.ok) throw new Error(`health ${res.status}`)
+    const data = await res.json() as { version?: string }
+    if (data.version && data.version === installTargetVersion.value) {
+      installStage.value = 'ready'
+      if (installPollTimer) { clearInterval(installPollTimer); installPollTimer = null }
+      // Brief pause so the user sees the "Ready" state before the reload.
+      setTimeout(() => { window.location.reload() }, 1200)
+    } else {
+      // Backend is up but still reporting the old version — frontend
+      // and backend are mid-swap. Signal to the user.
+      installStage.value = 'reconnecting'
+    }
+  } catch {
+    // Fetch fails while the server is mid-restart. Stay in 'restarting'.
+  }
+}
+function reloadNow() { window.location.reload() }
+// Cleanup if the component is torn down mid-install (unlikely but safe).
+import { onBeforeUnmount } from 'vue'
+onBeforeUnmount(() => {
+  if (installPollTimer) clearInterval(installPollTimer)
+  if (installElapsedTimer) clearInterval(installElapsedTimer)
+})
 
 const lastCheckDisplay = computed(() => {
   if (!lastCheck.value) return t('common.never')
@@ -345,10 +486,12 @@ async function downloadUpdate() {
   downloadPercent.value = 0
   statusMessage.value = ''
 
-  // Simulate incremental progress while waiting for the RPC
+  // Simulate incremental progress while waiting for the RPC. Capped at
+  // 95% so the bar never shows >100% before the real completion jumps it
+  // to 100 — previously the random increment could overshoot.
   const progressInterval = setInterval(() => {
-    if (downloadPercent.value < 90) {
-      downloadPercent.value += Math.random() * 15
+    if (downloadPercent.value < 95) {
+      downloadPercent.value = Math.min(95, downloadPercent.value + Math.random() * 3)
     }
   }, 500)
 
@@ -357,7 +500,7 @@ async function downloadUpdate() {
       total_bytes: number
       downloaded_bytes: number
       components_downloaded: number
-    }>({ method: 'update.download', timeout: 1_800_000 })
+    }>({ method: 'update.download', timeout: 3_900_000 })
     downloadPercent.value = 100
     downloaded.value = true
     const sizeMB = (res.downloaded_bytes / 1_048_576).toFixed(1)
@@ -393,40 +536,50 @@ async function executeConfirm() {
   if (action === 'apply') {
     await applyUpdate()
   } else if (action === 'git-apply') {
-    await applyUpdateGit()
+    await applyUpdateGitWithOverlay()
   } else if (action === 'rollback') {
     await rollbackUpdate()
   }
 }
 
-async function applyUpdateGit() {
-  applying.value = true
-  statusMessage.value = ''
-  try {
-    await rpcClient.call({ method: 'update.git-apply', timeout: 900_000 })
-    showStatus(t('systemUpdate.gitApplyStarted'))
-    updateInfo.value = null
-  } catch (e) {
-    showStatus(t('systemUpdate.applyFailed'), true)
-    if (import.meta.env.DEV) console.warn('Git apply failed', e)
-  } finally {
-    applying.value = false
-  }
-}
-
 async function applyUpdate() {
   applying.value = true
   statusMessage.value = ''
+  const target = updateInfo.value?.version || null
   try {
     await rpcClient.call({ method: 'update.apply', timeout: 300_000 })
-    showStatus(t('systemUpdate.applySuccess'))
-    updateInfo.value = null
-    downloaded.value = false
-    await loadStatus()
+    // Apply succeeded. Backend scheduled a restart 2s after returning;
+    // show the full-screen overlay while we wait for the new backend
+    // to report the target version, then auto-reload.
+    applying.value = false
+    if (target) {
+      startInstallOverlay(target)
+    } else {
+      // No target version known (legacy path) — fall back to the old
+      // flash-and-reload behaviour.
+      showStatus(t('systemUpdate.applySuccess'))
+      setTimeout(() => window.location.reload(), 3000)
+    }
   } catch (e) {
     showStatus(t('systemUpdate.applyFailed'), true)
     if (import.meta.env.DEV) console.warn('Apply failed', e)
-  } finally {
+    applying.value = false
+  }
+}
+
+async function applyUpdateGitWithOverlay() {
+  // Git-apply (dev path) also restarts the service — reuse the overlay
+  // so the UX matches the manifest path. Target version isn't known up
+  // front for git-apply; we just wait for a version change on /health.
+  applying.value = true
+  statusMessage.value = ''
+  try {
+    await rpcClient.call({ method: 'update.git-apply', timeout: 900_000 })
+    applying.value = false
+    startInstallOverlay(updateInfo.value?.version || currentVersion.value)
+  } catch (e) {
+    showStatus(t('systemUpdate.applyFailed'), true)
+    if (import.meta.env.DEV) console.warn('Git apply failed', e)
     applying.value = false
   }
 }
@@ -467,3 +620,25 @@ onMounted(() => {
   Promise.all([loadStatus(), loadSchedule(), checkForUpdates()])
 })
 </script>
+
+<style scoped>
+/* Centered ASCII logo — clamped so the overlay doesn't blow out on
+   narrow viewports. :deep so the rule reaches BitcoinFaceAscii's
+   inner <pre>. */
+.install-overlay-ascii :deep(pre) {
+  font-size: clamp(6px, 1.2vw, 12px);
+  line-height: 1.1;
+  color: rgba(255, 255, 255, 0.85);
+  margin: 0;
+}
+
+/* Indeterminate progress stripe that slides left-to-right. */
+.install-overlay-bar-anim {
+  animation: installBarSlide 1.8s ease-in-out infinite;
+}
+@keyframes installBarSlide {
+  0%   { transform: translateX(-100%); }
+  50%  { transform: translateX(120%); }
+  100% { transform: translateX(300%); }
+}
+</style>

neode-ui/src/views/discover/curatedApps.ts

@@ -22,13 +22,13 @@ let cachedCatalog: AppCatalog | null = null
 let catalogFetchedAt = 0
 const CATALOG_TTL = 60 * 60 * 1000 // 1 hour cache
 
-/** Remote catalog URLs — tried in order. First success wins. */
+/** Catalog URLs tried in order. First success wins.
+ *  Primary is the backend proxy (`/api/app-catalog`) — server-side fetch
+ *  bypasses CORS on git.tx1138.com and CSP restrictions on the IP-port
+ *  fallback. If the backend is offline (mid-restart etc.) we fall back
+ *  to the static copy baked into the frontend build. */
 const CATALOG_URLS = [
-  // Primary: git.tx1138.com raw file (HTTPS, dynamic, updated without frontend rebuild)
-  'https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json',
-  // Fallback: direct IP (HTTP, only works if CSP allows http://$host:*)
-  'http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json',
-  // Last resort: local static file (baked into frontend build)
+  '/api/app-catalog',
   '/catalog.json',
 ]
 
@@ -40,7 +40,7 @@ export async function fetchAppCatalog(): Promise<AppCatalog | null> {
 
   for (const url of CATALOG_URLS) {
     try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(5000) })
+      const res = await fetch(url, { credentials: 'include', signal: AbortSignal.timeout(20000) })
       if (!res.ok) continue
       const data = await res.json() as AppCatalog
       if (!data.apps?.length) continue

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -18,27 +18,12 @@
       </div>
     </div>
 
-    <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3 flex-1 min-h-0">
+    <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3 shrink-0">
       <div class="p-3 bg-white/5 rounded-lg">
         <p class="text-xs text-white/60 mb-1">Daemon version</p>
         <p class="text-sm font-medium text-white break-all">{{ status.version || '—' }}</p>
         <p v-if="!status.installed" class="text-xs text-white/40 mt-1">Package not installed</p>
       </div>
-      <div v-if="status.service_active" class="p-3 bg-white/5 rounded-lg sm:col-span-2">
-        <div class="flex items-center justify-between gap-3 text-xs">
-          <div class="flex items-center gap-2">
-            <span class="w-2 h-2 rounded-full" :class="status.anchor_connected ? 'bg-cyan-400' : 'bg-orange-400'"></span>
-            <span class="text-white/70">Anchor (fips.v0l.io):</span>
-            <span :class="status.anchor_connected ? 'text-cyan-300' : 'text-orange-300'">
-              {{ status.anchor_connected ? 'connected' : 'not reached' }}
-            </span>
-          </div>
-          <div class="text-white/60">{{ status.authenticated_peer_count ?? 0 }} peer{{ (status.authenticated_peer_count ?? 0) === 1 ? '' : 's' }}</div>
-        </div>
-        <p v-if="!status.anchor_connected" class="mt-1 text-[11px] text-white/40">
-          Without the anchor, DHT routing to unknown npubs can't bootstrap; federation + messaging will fall back to Tor until it reconnects.
-        </p>
-      </div>
       <div class="p-3 bg-white/5 rounded-lg">
         <div class="flex items-center justify-between gap-2 mb-1">
           <p class="text-xs text-white/60">FIPS npub</p>
@@ -60,6 +45,33 @@
       </div>
     </div>
 
+    <!-- Anchor status: always full-width to keep desktop layout tidy -->
+    <div v-if="status.service_active" class="p-3 bg-white/5 rounded-lg mb-3 shrink-0">
+      <div class="flex items-center justify-between gap-3 flex-wrap">
+        <div class="flex items-center gap-2 text-xs">
+          <span class="w-2 h-2 rounded-full" :class="status.anchor_connected ? 'bg-cyan-400' : 'bg-orange-400'"></span>
+          <span class="text-white/70">Anchor (fips.v0l.io):</span>
+          <span :class="status.anchor_connected ? 'text-cyan-300' : 'text-orange-300'">
+            {{ status.anchor_connected ? 'connected' : 'not reached' }}
+          </span>
+          <span class="text-white/40">·</span>
+          <span class="text-white/60">{{ status.authenticated_peer_count ?? 0 }} peer{{ (status.authenticated_peer_count ?? 0) === 1 ? '' : 's' }}</span>
+        </div>
+        <button
+          v-if="!status.anchor_connected"
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-orange-400/15 hover:bg-orange-400/25 text-orange-200 disabled:opacity-60 transition-colors"
+          :disabled="reconnecting"
+          @click="reconnectAnchor"
+        >
+          {{ reconnecting ? 'Reconnecting…' : 'Reconnect' }}
+        </button>
+      </div>
+      <p v-if="!status.anchor_connected" class="mt-2 text-[11px] text-white/40 leading-snug">
+        Without the anchor, DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until it reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache.
+      </p>
+    </div>
+
     <div v-if="statusMessage" class="mb-3 p-3 rounded-lg text-xs" :class="statusIsError ? 'bg-red-400/10 text-red-300' : 'bg-green-400/10 text-green-300'">{{ statusMessage }}</div>
 
     <div v-if="status.key_present && !status.service_active" class="flex gap-2 mt-auto pt-3 shrink-0">
@@ -97,6 +109,7 @@ const status = ref<FipsStatus>({
   anchor_connected: false,
 })
 const installing = ref(false)
+const reconnecting = ref(false)
 const statusMessage = ref('')
 const statusIsError = ref(false)
 const copied = ref(false)
@@ -167,5 +180,39 @@ async function installAndActivate() {
   }
 }
 
+// Restart the FIPS daemon and wait for the anchor bootstrap window.
+// The backend runs a proper recovery sequence (stop → start → wait →
+// classify) and returns a structured diagnostic we can show the user
+// instead of a generic "still unreachable".
+async function reconnectAnchor() {
+  reconnecting.value = true
+  try {
+    const res = await rpcClient.call<{
+      recovered: boolean
+      likely_cause: string
+      hint: string
+      after: FipsStatus
+    }>({ method: 'fips.reconnect', timeout: 60_000 })
+    // Update the card with the post-reconnect status returned by the
+    // backend — avoids an extra status fetch race.
+    status.value = { ...status.value, ...res.after }
+    if (res.recovered) {
+      flash('Anchor reconnected.')
+    } else if (res.likely_cause === 'connected') {
+      // Already connected, not a "recovery" per se.
+      flash('Anchor is reachable.')
+    } else {
+      // Surface the backend's diagnostic hint verbatim — it's been
+      // written for the fleet reader.
+      flash(res.hint || 'Reconnect finished but anchor is still unreachable.', true)
+    }
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Reconnect failed: ${msg}`, true)
+  } finally {
+    reconnecting.value = false
+  }
+}
+
 onMounted(loadStatus)
 </script>

neode-ui/src/views/web5/Web5Identities.vue

@@ -68,8 +68,13 @@
       >
         <!-- Avatar -->
         <button @click="openProfileEditor(identity)" class="relative flex-shrink-0 w-10 h-10 rounded-full overflow-hidden group" title="Edit profile">
-          <img v-if="identity.profile?.picture" :src="identity.profile.picture" class="w-full h-full object-cover" @error="($event.target as HTMLImageElement).style.display = 'none'" />
-          <div v-if="!identity.profile?.picture" class="w-full h-full flex items-center justify-center" :class="{
+          <img
+            v-if="identity.profile?.picture && !listPictureFailed[identity.id]"
+            :src="displayableUrl(identity.profile.picture)"
+            class="w-full h-full object-cover"
+            @error="() => { listPictureFailed[identity.id] = true }"
+          />
+          <div v-if="!identity.profile?.picture || listPictureFailed[identity.id]" class="w-full h-full flex items-center justify-center" :class="{
             'bg-blue-500/20': identity.purpose === 'personal',
             'bg-orange-500/20': identity.purpose === 'business',
             'bg-purple-500/20': identity.purpose === 'anonymous',
@@ -88,7 +93,8 @@
         <!-- Info -->
         <div class="flex-1 min-w-0">
           <div class="flex items-center gap-2">
-            <span class="text-white font-medium text-sm">{{ identity.name }}</span>
+            <span class="text-white font-medium text-sm">{{ identity.profile?.display_name || identity.name }}</span>
+            <span v-if="identity.profile?.display_name && identity.profile.display_name !== identity.name" class="text-white/40 text-xs truncate max-w-[160px]" :title="`Internal name: ${identity.name}`">({{ identity.name }})</span>
             <span v-if="identity.is_default" class="text-yellow-400 text-xs" title="Default identity">&#9733;</span>
             <span class="text-xs px-2 py-0.5 rounded-full capitalize" :class="{
               'bg-blue-500/20 text-blue-300': identity.purpose === 'personal',
@@ -301,8 +307,14 @@
     <div class="glass-card p-6 w-full max-w-2xl mx-4 max-h-[90vh] overflow-y-auto" role="dialog" aria-modal="true" aria-labelledby="profile-editor-title">
       <div class="flex items-center gap-3 mb-5">
         <div class="relative w-16 h-16 rounded-full overflow-hidden bg-white/10 shrink-0">
-          <img v-if="profileForm.picture" :src="profileForm.picture" class="w-full h-full object-cover" @error="($event.target as HTMLImageElement).style.display = 'none'" />
-          <div v-else class="w-full h-full flex items-center justify-center">
+          <img
+            v-if="profileForm.picture && !editorPictureFailed"
+            :src="displayableUrl(profileForm.picture)"
+            class="w-full h-full object-cover"
+            @error="editorPictureFailed = true"
+            @load="editorPictureFailed = false"
+          />
+          <div v-if="!profileForm.picture || editorPictureFailed" class="w-full h-full flex items-center justify-center">
             <span class="text-2xl font-bold text-white/40">{{ profileEditorIdentity.name.charAt(0).toUpperCase() }}</span>
           </div>
         </div>
@@ -367,7 +379,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref } from 'vue'
+import { reactive, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
 import { safeClipboardWrite } from './utils'
@@ -408,10 +420,38 @@ const profilePublishing = ref(false)
 const avatarUploading = ref(false)
 const bannerUploading = ref(false)
 
-// Upload to the node's blob store and drop the returned public URL into
-// the profile field. The /api/blob endpoint marks these blobs public, so
-// the URL served back (`public_url`, onion-rooted when Tor is up) is
-// reachable by external Nostr clients fetching kind:0 metadata.
+// Track image load failures so the UI can fall back to the initial/
+// identicon placeholder instead of showing a blank square. Pasted URLs
+// that 404 (or point at an onion the local browser can't reach) were
+// previously silently hidden by a display:none handler that left the
+// fallback unrendered.
+const editorPictureFailed = ref(false)
+const listPictureFailed = reactive<Record<string, boolean>>({})
+
+// Reset the failure flag when the URL changes so a freshly pasted URL
+// gets re-tried (the watcher fires once the form reacts).
+watch(() => profileForm.value.picture, () => { editorPictureFailed.value = false })
+
+// The backend returns onion-based public URLs for uploaded profile
+// pictures (so they're fetchable by external Nostr clients), but the
+// local browser session isn't Tor-routed and can't resolve .onion hosts.
+// Rewrite onion-rooted `/blob/<cid>` URLs (with or without capability
+// query) to same-origin `/blob/<cid>` so they render in this UI. Data
+// URLs and plain external URLs pass through untouched.
+function displayableUrl(url: string | null | undefined): string {
+  if (!url) return ''
+  if (url.startsWith('data:') || url.startsWith('/')) return url
+  const onionMatch = url.match(/^https?:\/\/[a-z2-7]{16,56}\.onion(\/blob\/[0-9a-f]{64})(\?.*)?$/i)
+  if (onionMatch && onionMatch[1]) return onionMatch[1]
+  return url
+}
+
+// Upload to the node's blob store and drop a URL into the profile field.
+// For small images (≤64KB) we inline the bytes as a data URL so external
+// Nostr clients can render the picture without needing to reach a tor
+// onion. Larger uploads fall back to the onion-rooted public_url.
+const INLINE_MAX = 64 * 1024
+
 async function uploadAsset(ev: Event, field: 'picture' | 'banner') {
   const input = ev.target as HTMLInputElement
   const file = input?.files?.[0]
@@ -421,6 +461,14 @@ async function uploadAsset(ev: Event, field: 'picture' | 'banner') {
   profileError.value = ''
   try {
     const buf = await file.arrayBuffer()
+    // Inline small images as a data URL — universally fetchable by any
+    // Nostr client and bypasses the "only reachable over Tor" limitation.
+    if (buf.byteLength <= INLINE_MAX) {
+      const mime = file.type || 'image/png'
+      const b64 = btoa(Array.from(new Uint8Array(buf), (b) => String.fromCharCode(b)).join(''))
+      profileForm.value[field] = `data:${mime};base64,${b64}`
+      return
+    }
     const resp = await fetch('/api/blob', {
       method: 'POST',
       credentials: 'include',
@@ -436,6 +484,11 @@ async function uploadAsset(ev: Event, field: 'picture' | 'banner') {
     const url = public_url || self_test_url
     if (!url) throw new Error('blob API returned no URL')
     profileForm.value[field] = url
+    // Heads-up for large uploads: onion URLs only render on Tor-routed
+    // clients. Not an error, but worth telling the user.
+    if (url.includes('.onion/')) {
+      profileError.value = 'Large image stored on this node. Pasting a public https://… URL is recommended for Nostr visibility.'
+    }
   } catch (e: unknown) {
     profileError.value = e instanceof Error ? e.message : `${field} upload failed`
   } finally {