chore: release v1.7.110-alpha

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 18
-        versionName = "0.4.14"
+        versionCode = 19
+        versionName = "0.4.15"
 
         vectorDrawables {
             useSupportLibrary = true

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -1,10 +1,13 @@
 package com.archipelago.app.ui.screens
 
+import android.Manifest
 import android.annotation.SuppressLint
+import android.content.pm.PackageManager
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.view.ViewGroup
 import android.webkit.CookieManager
+import android.webkit.PermissionRequest
 import android.webkit.WebChromeClient
 import android.webkit.WebResourceError
 import android.webkit.WebResourceRequest
@@ -12,6 +15,9 @@ import android.webkit.WebSettings
 import android.webkit.WebView
 import android.webkit.WebViewClient
 import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.content.ContextCompat
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
@@ -146,6 +152,20 @@ fun WebViewScreen(
     var hasError by remember { mutableStateOf(false) }
     var webView by remember { mutableStateOf<WebView?>(null) }
 
+    // Web-page camera access (wallet QR scanner). The WebView's default
+    // WebChromeClient silently denies getUserMedia, so grant video capture —
+    // asking for the app-level CAMERA permission first when needed.
+    val webViewContext = LocalContext.current
+    var pendingWebPermission by remember { mutableStateOf<PermissionRequest?>(null) }
+    val webCameraPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        pendingWebPermission?.let { req ->
+            if (granted) req.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE)) else req.deny()
+        }
+        pendingWebPermission = null
+    }
+
     // A node app that refused iframing, opened in a local WebView overlay.
     // null = no overlay. The kiosk WebView underneath stays alive (and warm)
     // while this is shown, so closing it returns instantly with no reload.
@@ -371,6 +391,25 @@ fun WebViewScreen(
                                 loadProgress = newProgress
                             }
 
+                            // Wallet QR scanner: grant the page camera access.
+                            // Only video capture is granted — anything else the
+                            // page asks for is denied as before.
+                            override fun onPermissionRequest(request: PermissionRequest) {
+                                if (PermissionRequest.RESOURCE_VIDEO_CAPTURE !in request.resources) {
+                                    request.deny()
+                                    return
+                                }
+                                val hasCamera = ContextCompat.checkSelfPermission(
+                                    webViewContext, Manifest.permission.CAMERA,
+                                ) == PackageManager.PERMISSION_GRANTED
+                                if (hasCamera) {
+                                    request.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE))
+                                } else {
+                                    pendingWebPermission = request
+                                    webCameraPermissionLauncher.launch(Manifest.permission.CAMERA)
+                                }
+                            }
+
                             // window.open() — e.g. the kiosk's "Open in new tab"
                             // for an app that can't be iframed. Capture the target
                             // URL via a throwaway WebView and route it ourselves.
@@ -516,6 +555,18 @@ private fun InAppBrowser(
     var canGoBack by remember { mutableStateOf(false) }
     var canGoForward by remember { mutableStateOf(false) }
 
+    // Same camera bridge as the main WebView — node apps opened in the overlay
+    // (e.g. anything with a QR scanner) get getUserMedia too.
+    var pendingWebPermission by remember { mutableStateOf<PermissionRequest?>(null) }
+    val webCameraPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        pendingWebPermission?.let { req ->
+            if (granted) req.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE)) else req.deny()
+        }
+        pendingWebPermission = null
+    }
+
     // Seed the loading-screen icon immediately from a best-effort favicon
     // pre-fetch (main's app-icon work), then onReceivedIcon upgrades it — so the
     // loader shows an icon right away instead of staying blank until the page
@@ -565,6 +616,22 @@ private fun InAppBrowser(
                             override fun onReceivedIcon(view: WebView?, icon: Bitmap?) {
                                 if (icon != null) favicon = icon
                             }
+
+                            override fun onPermissionRequest(request: PermissionRequest) {
+                                if (PermissionRequest.RESOURCE_VIDEO_CAPTURE !in request.resources) {
+                                    request.deny()
+                                    return
+                                }
+                                val hasCamera = ContextCompat.checkSelfPermission(
+                                    context, Manifest.permission.CAMERA,
+                                ) == PackageManager.PERMISSION_GRANTED
+                                if (hasCamera) {
+                                    request.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE))
+                                } else {
+                                    pendingWebPermission = request
+                                    webCameraPermissionLauncher.launch(Manifest.permission.CAMERA)
+                                }
+                            }
                         }
 
                         webViewClient = object : WebViewClient() {

CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## v1.7.110-alpha (2026-07-21)
+
+- Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.
+- The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.
+- You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.
+- The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.
+- The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).
+- Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.
+- The Lightning setup guidance now reads the same everywhere: "Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."
+- Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen.
+
+## v1.7.109-alpha (2026-07-21)
+
+- Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice — speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.
+- Your node can now program its MeshCore radio's RF settings — frequency, bandwidth, spreading factor, and coding rate — from Mesh → Device settings. Radios that were flashed with mismatched settings could hear that other radios exist but never decode their messages, and until now the only fix was a separate phone app. Set the values once and the node programs the radio automatically (it restarts once to apply); every radio on your mesh must use the same values to talk to each other.
+- The Device settings panel is tidier: values you can edit (name, region, channel) are no longer also shown as separate read-only rows.
+
+## v1.7.108-alpha (2026-07-20)
+
+- Your node connects to the private mesh far more reliably. Nodes rely on a public rendezvous point to find each other, and the only one available was unreachable from many home and office networks — leaving some nodes unable to join the mesh at all. There is now a second, always-reachable rendezvous point, and your node tries every one it knows, so it joins the mesh in seconds instead of being stranded.
+- Wi-Fi setup now heals itself on older nodes. Some nodes set up before a mid-year fix couldn't connect to a Wi-Fi network from the screen — it failed with a permissions error — because the piece that lets the node manage networking on your behalf was missing. Nodes now put that piece in place automatically on startup, so "scan, pick a network, type the password, connect" works without reinstalling.
+- Your node rejoins the mesh within seconds after an update. Applying an update briefly restarts the mesh service, and previously a node could sit disconnected from other nodes for up to five minutes before it retried.
+- The TV screen now fits your television. On a large or 4K TV the interface rendered tiny with no way to zoom on a keyboard-less screen; it now sizes itself to a comfortable, readable scale automatically (and small laptop panels are left unchanged).
+- More TV-screen polish: the built-in assistant shows its dark theme instead of bright white panels, the on-screen hint for switching between the kiosk and a terminal now points at the right keys, the welcome logo no longer occasionally renders as garbled characters, and an accidental tap of the power button no longer shuts the node down — hold it to power off on purpose.
+- Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle.
+
+## v1.7.106-alpha (2026-07-20)
+
+- Nodes on the same network now find each other directly. Your node announces itself on your local network and connects straight to other Archipelago nodes nearby, instead of every connection having to be introduced by a public rendezvous server out on the internet. Peers in the same home or office stay connected to each other even when that server is unreachable, and they reach each other faster.
+- On a phone, the peer files screen tells you how you're connected again. The badge showing whether a peer's files are arriving over the fast mesh or over Tor was only visible on desktop — on narrow screens it disappeared entirely. It now appears next to the peer name on mobile too.
+- Your node's mesh settings can no longer be written in a way that breaks the mesh. The configuration file used to be assembled as free-form text, where one wrong setting would stop the mesh service from starting and quietly drop your node off the network. It's now generated from a checked description of the file, with tests that verify the exact output.
+- When your node has trouble reaching another node, the logs now record the real reason instead of a generic summary. A failure to open a peer's files previously logged only "Failed to connect to peer" and threw away the actual cause, which made these problems very hard to diagnose. Nothing changes on screen, and no internal detail is exposed.
+- Behind the scenes: the installer image now builds its mesh component at a fixed, known version instead of whatever upstream had published that day, so two images built from the same source are identical.
+
+## v1.7.105-alpha (2026-07-20)
+
+- Fixed a failure loop where a node that lost power or was moved could get stuck on a blank "can't reach your node" screen forever: startup recovery no longer spends minutes retrying containers that no longer exist, and a genuinely large recovery is no longer cut off half-way and forced to start over. The node now reaches its login screen even after the messiest shutdown.
+- Phone tunnel setup (WireGuard) is now dependable: the QR screen automatically retries while a fresh install is still settling instead of dead-ending at "failed to fetch", and if your node has moved to a different network the QR and downloadable config now carry the node's current address instead of the old one.
+- Fixed the white screen some laptop displays showed right after the intro on v1.7.104.
+- The companion phone app no longer suggests installing the companion app from inside itself.
+- The Tor page now lists onion addresses only for apps you actually have installed — fresh installs no longer come with six pre-made addresses for apps that were never set up.
+- Running `archipelago --version` or `--help` on the command line now prints and exits instead of silently starting a second copy of the node, which could briefly disrupt running apps.
+- Behind the scenes: installer image builds now stop loudly if VPN components are missing instead of producing a broken image, and a background file-permission sweep runs far less often, reducing disk churn on busy nodes.
+
 ## v1.7.104-alpha (2026-07-19)
 
 - Software updates are now much safer to receive: the node will never install an update that isn't completely downloaded and verified byte-for-byte, closing a rare bug where an interrupted or cancelled download could leave a node unable to start.

app-catalog/catalog.json

@@ -370,6 +370,17 @@
         ]
       }
     },
+    {
+      "id": "pine",
+      "title": "Pine",
+      "version": "1.1.1",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
+      "icon": "/assets/img/app-icons/pine.svg",
+      "author": "Archipelago",
+      "category": "home",
+      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "repoUrl": "https://github.com/rhasspy/wyoming"
+    },
     {
       "id": "grafana",
       "title": "Grafana",

apps/pine-piper/manifest.yml

@@ -0,0 +1,70 @@
+app:
+  id: pine-piper
+  name: Pine Piper (TTS)
+  version: "2.2.2"
+  description: Wyoming-protocol Piper text-to-speech engine. Internal Pine voice-assistant stack member — gives Home Assistant Assist a natural voice for spoken responses on the PineVoice satellite.
+  category: home
+
+  # Hyphen name matches the runtime references (stack member table / startup
+  # order) + the live container, so on an existing node the orchestrator ADOPTS
+  # the running engine rather than recreating it (downloaded voices under /data
+  # preserved).
+  container_name: pine-piper
+
+  container:
+    image: docker.io/rhasspy/wyoming-piper:2.2.2
+    pull_policy: if-not-present
+    network: archy-net
+    network_aliases: [pine-piper]
+    # The image entrypoint already binds tcp://0.0.0.0:10200; this arg only
+    # picks the voice (mirrors the pine ha-stack.yml compose command).
+    custom_args: ["--voice", "en_GB-alba-medium"]
+
+  dependencies:
+    - storage: 1Gi
+
+  resources:
+    memory_limit: 512Mi
+
+  security:
+    # cap-drop=ALL is applied by the orchestrator. A plain Python Wyoming server
+    # on an unprivileged port needs no added capabilities.
+    capabilities: []
+    readonly_root: false   # downloads the voice into /data on first run
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    # Published so Home Assistant (on the pasta net) can reach the engine via
+    # host.containers.internal:10200 (the Wyoming integration endpoint).
+    - host: 10200
+      container: 10200
+      protocol: tcp
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine-piper
+      target: /data
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:10200
+    interval: 30s
+    timeout: 5s
+    retries: 5
+    start_period: 60s   # first start downloads the voice
+
+  metadata:
+    author: Rhasspy / Home Assistant
+    icon: /assets/img/app-icons/pine.svg
+    website: https://github.com/rhasspy/wyoming-piper
+    repo: https://github.com/rhasspy/wyoming-piper
+    license: MIT
+    tags:
+      - home
+      - voice
+      - text-to-speech
+      - wyoming

apps/pine-whisper/manifest.yml

@@ -0,0 +1,70 @@
+app:
+  id: pine-whisper
+  name: Pine Whisper (STT)
+  version: "3.4.1"
+  description: Wyoming-protocol faster-whisper speech-to-text engine. Internal Pine voice-assistant stack member — turns speech captured by a PineVoice satellite into text for Home Assistant Assist.
+  category: home
+
+  # Hyphen name matches the runtime references (stack member table / startup
+  # order) + the live container, so on an existing node the orchestrator ADOPTS
+  # the running engine rather than recreating it (downloaded models under /data
+  # preserved).
+  container_name: pine-whisper
+
+  container:
+    image: docker.io/rhasspy/wyoming-whisper:3.4.1
+    pull_policy: if-not-present
+    network: archy-net
+    network_aliases: [pine-whisper]
+    # The image entrypoint already binds tcp://0.0.0.0:10300; these args only
+    # pick the model + language (mirrors the pine ha-stack.yml compose command).
+    custom_args: ["--model", "base-int8", "--language", "en"]
+
+  dependencies:
+    - storage: 2Gi
+
+  resources:
+    memory_limit: 2Gi
+
+  security:
+    # cap-drop=ALL is applied by the orchestrator. A plain Python Wyoming server
+    # on an unprivileged port needs no added capabilities.
+    capabilities: []
+    readonly_root: false   # downloads the whisper model into /data on first run
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    # Published so Home Assistant (on the pasta net) can reach the engine via
+    # host.containers.internal:10300 (the Wyoming integration endpoint).
+    - host: 10300
+      container: 10300
+      protocol: tcp
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine-whisper
+      target: /data
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:10300
+    interval: 30s
+    timeout: 5s
+    retries: 5
+    start_period: 60s   # first start downloads the model
+
+  metadata:
+    author: Rhasspy / Home Assistant
+    icon: /assets/img/app-icons/pine.svg
+    website: https://github.com/rhasspy/wyoming-faster-whisper
+    repo: https://github.com/rhasspy/wyoming-faster-whisper
+    license: MIT
+    tags:
+      - home
+      - voice
+      - speech-to-text
+      - wyoming

apps/pine/manifest.yml

@@ -0,0 +1,336 @@
+app:
+  id: pine
+  name: Pine
+  version: "1.1.1"
+  description: A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.
+  category: home
+
+  # The user-facing launcher (app_id + container both "pine", matching the
+  # runtime references + the live container so the orchestrator adopts it). A
+  # tiny nginx that serves the "Connect Pine to WiFi" provisioner page for the
+  # voice stack. The two Wyoming engines (pine-whisper, pine-piper) are internal
+  # stack members.
+  container_name: pine
+
+  container:
+    image: docker.io/library/nginx:1.27-alpine
+    pull_policy: if-not-present
+    network: archy-net
+    network_aliases: [pine]
+    # The provisioner uses Web Bluetooth (Improv-over-BLE) to push WiFi creds to
+    # the PineVoice speaker. navigator.bluetooth only exists in a SECURE CONTEXT
+    # (https or localhost), so the launcher terminates TLS with a self-signed
+    # cert — otherwise the "Connect Pine to WiFi" button is inert on the LAN.
+    # Idempotent: kept as-is when crt+key already exist. Mirrors the netbird
+    # secure-context fix (#15).
+    generated_certs:
+      - crt: /var/lib/archipelago/pine/tls.crt
+        key: /var/lib/archipelago/pine/tls.key
+
+  dependencies:
+    - app_id: pine-whisper
+    - app_id: pine-piper
+    - storage: 128Mi
+
+  resources:
+    memory_limit: 64Mi
+
+  security:
+    # cap-drop=ALL is applied by the orchestrator. nginx (master as root, drops
+    # workers) binds :443 inside the container — needs the worker-drop caps +
+    # NET_BIND_SERVICE for the privileged port.
+    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE]
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    # 10380 (http) is the Open target — the UI launches apps as
+    # http://host:10380 (resolveAppUrl). nginx there 301-redirects to the https
+    # listener on 10381, so the new tab lands on a secure context where
+    # navigator.bluetooth (the "Connect Pine to WiFi" provisioner) works.
+    - host: 10380
+      container: 80
+      protocol: tcp
+    - host: 10381
+      container: 443
+      protocol: tcp
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine/nginx.conf
+      target: /etc/nginx/conf.d/default.conf
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.crt
+      target: /etc/nginx/tls.crt
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.key
+      target: /etc/nginx/tls.key
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/index.html
+      target: /usr/share/nginx/html/index.html
+      options: [ro]
+
+  environment: []
+
+  files:
+    - path: /var/lib/archipelago/pine/nginx.conf
+      overwrite: true
+      content: |
+        server {
+            listen 80;
+            server_name _;
+            return 301 https://$host:10381$request_uri;
+        }
+        server {
+            listen 443 ssl;
+            server_name _;
+            ssl_certificate /etc/nginx/tls.crt;
+            ssl_certificate_key /etc/nginx/tls.key;
+            root /usr/share/nginx/html;
+            index index.html;
+            location / { try_files $uri $uri/ /index.html; }
+        }
+    - path: /var/lib/archipelago/pine/index.html
+      overwrite: true
+      content: |
+        <!doctype html>
+        <html lang="en">
+        <head>
+          <meta charset="utf-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1">
+          <title>Pine — connect your speaker</title>
+          <style>
+            :root { color-scheme: dark; }
+            * { box-sizing: border-box; }
+            body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;
+                   background: #0f1512; color: #e7efe9; }
+            .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }
+            header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }
+            header svg { width: 52px; height: 52px; flex: 0 0 auto; }
+            h1 { font-size: 26px; margin: 0; }
+            .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }
+            .card { background: #16201b; border: 1px solid #24332b;
+                    border-radius: 14px; padding: 20px; margin: 20px 0; }
+            .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }
+            .status .row b { min-width: 84px; color: #9fd3b6; }
+            .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;
+                           font-size: 13px; color: #cfe9d9; }
+            label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }
+            input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;
+                    background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;
+                    outline: none; }
+            input:focus { border-color: #4fae82; }
+            button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;
+                     font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;
+                     border-radius: 10px; cursor: pointer; transition: filter .15s; }
+            button:hover:not(:disabled) { filter: brightness(1.08); }
+            button:disabled { opacity: .45; cursor: default; }
+            #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;
+                   font-family: ui-monospace, monospace; white-space: pre-wrap;
+                   background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;
+                   color: #a9c6b6; max-height: 220px; overflow-y: auto; }
+            .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }
+            .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }
+            .ha b { color: #9fbfad; }
+            .insecure { display: none; background: #2a1f12; border-color: #4a3418;
+                        color: #e8c878; font-size: 13px; }
+          </style>
+        </head>
+        <body>
+          <div class="wrap">
+            <header>
+              <svg viewBox="0 0 512 512" aria-hidden="true"><g fill="#7fd6a6">
+                <rect x="236" y="396" width="40" height="72" rx="6"/>
+                <path d="M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z"/>
+                <path d="M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z"/>
+                <path d="M256 262 L392 430 L120 430 L256 262 Z"/>
+              </g></svg>
+              <div><h1>Pine</h1>
+                <p class="tag">Connect your speaker — everything stays on your node.</p></div>
+            </header>
+
+            <div class="card status">
+              <div class="row"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>
+              <div class="row"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>
+              <div class="row"><b>Speaker</b><span>put it in pairing mode — ring LED blinking yellow</span></div>
+            </div>
+
+            <div class="card insecure" id="insecure">
+              This page isn’t running over HTTPS, so the browser blocks Bluetooth.
+              Open it via its <b>https://…:10380</b> address (accept the self-signed
+              certificate) and the button below will work.
+            </div>
+
+            <div class="card">
+              <label for="ssid">WiFi network (SSID)</label>
+              <input id="ssid" autocomplete="off" spellcheck="false" placeholder="Your 2.4 GHz network">
+              <label for="pass">WiFi password — typed here, sent only over Bluetooth to the speaker</label>
+              <input id="pass" type="password" autocomplete="off">
+              <button id="go">Connect Pine to WiFi</button>
+              <div id="log">Ready. Click the button, then pick “PineVoice” in the Bluetooth popup.</div>
+            </div>
+
+            <p class="ha">After WiFi joins, add the speaker to Home Assistant:
+              <b>Settings → Devices &amp; services → Add Wyoming Protocol</b>, host =
+              the speaker’s IP, port <b>10700</b>, then pick an Assist pipeline using
+              Whisper + Piper. Wake word: <b>“Hey Jarvis.”</b></p>
+          </div>
+
+          <script>
+          "use strict";
+          // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).
+          const SVC   = "00467768-6228-2272-4663-277478268000";
+          const CHAR_STATE  = "00467768-6228-2272-4663-277478268001";
+          const CHAR_ERROR  = "00467768-6228-2272-4663-277478268002";
+          const CHAR_RPC    = "00467768-6228-2272-4663-277478268003";
+          const CHAR_RESULT = "00467768-6228-2272-4663-277478268004";
+          const STATES = {1:"authorization required",2:"authorized",3:"provisioning…",4:"PROVISIONED"};
+          const ERRORS = {1:"invalid RPC packet",2:"unknown RPC command",
+            3:"unable to connect — wrong password, or the SSID isn't reachable on 2.4 GHz",
+            4:"not authorized — press the button on the device",5:"bad hostname",
+            255:"unknown device error"};
+
+          const logEl = document.getElementById("log");
+          const log = (msg, cls) => { const l = document.createElement("div");
+            if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);
+            logEl.scrollTop = logEl.scrollHeight; };
+          const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]
+            .map(b => b.toString(16).padStart(2, "0")).join(" ");
+
+          const btn = document.getElementById("go");
+          if (!navigator.bluetooth) {
+            document.getElementById("insecure").style.display = "block";
+            logEl.textContent = "Web Bluetooth unavailable — open this page over https (see note above).";
+          }
+
+          btn.addEventListener("click", async () => {
+            const ssid = document.getElementById("ssid").value.trim();
+            const pass = document.getElementById("pass").value;
+            if (!ssid) { log("Enter your WiFi network name first.", "err"); return; }
+            if (!navigator.bluetooth) { log("No Web Bluetooth — open this page over https.", "err"); return; }
+            btn.disabled = true; logEl.textContent = "";
+            let device;
+            try {
+              log("Opening Bluetooth device chooser…");
+              device = await navigator.bluetooth.requestDevice({
+                filters: [{ services: [SVC] }, { namePrefix: "PineVoice" }],
+                optionalServices: [SVC],
+              });
+              log(`Selected: ${device.name || "(unnamed)"}`);
+              device.addEventListener("gattserverdisconnected", () => log("BLE disconnected."));
+              log("Connecting…");
+              const gatt = await device.gatt.connect();
+              const svc = await gatt.getPrimaryService(SVC);
+              const stateChar  = await svc.getCharacteristic(CHAR_STATE);
+              const errorChar  = await svc.getCharacteristic(CHAR_ERROR);
+              const rpcChar    = await svc.getCharacteristic(CHAR_RPC);
+              const resultChar = await svc.getCharacteristic(CHAR_RESULT);
+
+              let done, fail;
+              const outcome = new Promise((res, rej) => { done = res; fail = rej; });
+              let authorize; const authorized = new Promise(res => { authorize = res; });
+              let state = -1;
+              const onState = (s, via = "") => {
+                if (s === state) return; state = s;
+                log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? "ok" : undefined);
+                if (s >= 2) authorize();
+                if (s === 4) done(null);
+              };
+              stateChar.addEventListener("characteristicvaluechanged",
+                e => onState(e.target.value.getUint8(0)));
+              errorChar.addEventListener("characteristicvaluechanged", e => {
+                const c = e.target.value.getUint8(0);
+                if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });
+              resultChar.addEventListener("characteristicvaluechanged", e => {
+                const v = e.target.value; log(`RPC result: ${hex(v)}`);
+                if (v.byteLength > 2 && v.getUint8(1) > 0) {
+                  const n = v.getUint8(2); const b = new Uint8Array(n);
+                  for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);
+                  done(new TextDecoder().decode(b)); } });
+              await stateChar.startNotifications();
+              await errorChar.startNotifications();
+              await resultChar.startNotifications();
+              onState((await stateChar.readValue()).getUint8(0));
+
+              const poller = setInterval(async () => {
+                try { onState((await stateChar.readValue()).getUint8(0), " (polled)");
+                  const ec = (await errorChar.readValue()).getUint8(0);
+                  if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);
+
+              let nextUrl;
+              try {
+                if (state === 1) {
+                  log("Authorization required — press the centre button on the speaker now.", "warn");
+                  await Promise.race([authorized, outcome,
+                    new Promise((_, rej) => setTimeout(
+                      () => rej(new Error("timed out waiting for the button press")), 60000))]);
+                  log("Authorized.", "ok");
+                }
+                const enc = new TextEncoder();
+                const sb = enc.encode(ssid), pb = enc.encode(pass);
+                const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);
+                const pkt = new Uint8Array([1, data.length, ...data, 0]);
+                pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);
+                log(`Sending WiFi credentials for “${ssid}”…`);
+                if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);
+                else await rpcChar.writeValue(pkt);
+                log("Credentials delivered — speaker acknowledged.", "ok");
+                log("Joining WiFi… (the speaker plays a sound within ~20s either way)");
+                const timeout = new Promise((_, rej) => setTimeout(
+                  () => rej(new Error("timed out after 60s waiting for the device")), 60000));
+                nextUrl = await Promise.race([outcome, timeout]);
+              } finally { clearInterval(poller); }
+
+              log("✓ PROVISIONED — the ring LED should breathe dim magenta.", "ok");
+              if (nextUrl) log(`Device reports next step: ${nextUrl}`, "ok");
+              try { gatt.disconnect(); } catch {}
+            } catch (err) {
+              log(`✗ ${err.name || "Error"}: ${err.message}`, "err");
+              if (err.name === "NotFoundError")
+                log("No speaker matched, or you closed the chooser. LED blinking yellow? "
+                  + "Hold the dot button 15s to reset.", "warn");
+              if (err.name === "NetworkError")
+                log("BLE link dropped — move closer, and make sure the Mac isn't already "
+                  + "paired to the speaker (it can hold the link exclusively).", "warn");
+              try { device?.gatt?.disconnect(); } catch {}
+            } finally { btn.disabled = false; }
+          });
+          </script>
+        </body>
+        </html>
+
+  health_check:
+    type: tcp
+    endpoint: localhost:443
+    interval: 30s
+    timeout: 5s
+    retries: 5
+    start_period: 10s
+
+  interfaces:
+    main:
+      name: Pine
+      description: Connect your speaker to WiFi and check the voice assistant
+      type: ui
+      port: 10380
+      protocol: http
+      path: /
+
+  metadata:
+    author: Archipelago
+    icon: /assets/img/app-icons/pine.svg
+    website: https://github.com/rhasspy/wyoming
+    repo: https://github.com/rhasspy/wyoming
+    license: MIT
+    category: home
+    launch:
+      open_in_new_tab: true
+    tags:
+      - home
+      - voice
+      - assistant
+      - privacy

core/Cargo.lock

@@ -95,7 +95,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.104-alpha"
+version = "1.7.109-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.104-alpha"
+version = "1.7.110-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/rpc/dispatcher.rs

@@ -456,6 +456,8 @@ impl RpcHandler {
             "system.factory-reset" => self.handle_system_factory_reset(params).await,
             "system.settings.get" => self.handle_system_settings_get(params).await,
             "system.settings.set" => self.handle_system_settings_set(params).await,
+            "system.kiosk-display.get" => self.handle_system_kiosk_display_get().await,
+            "system.kiosk-display.set" => self.handle_system_kiosk_display_set(params).await,
 
             // Opt-in anonymous analytics
             "analytics.get-status" => self.handle_analytics_get_status().await,

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -28,13 +28,20 @@ impl RpcHandler {
             ));
         }
 
+        // Zero-amount invoices need the amount supplied by the payer; LND's
+        // REST API takes it as an `amt` string alongside the payment request.
+        let amount_sats = params.get("amount_sats").and_then(|v| v.as_u64());
+
         info!("Paying Lightning invoice");
 
         let (client, macaroon_hex) = self.lnd_client().await?;
 
-        let pay_body = serde_json::json!({
+        let mut pay_body = serde_json::json!({
             "payment_request": payment_request,
         });
+        if let Some(amt) = amount_sats {
+            pay_body["amt"] = serde_json::json!(amt.to_string());
+        }
 
         let resp = client
             .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))

core/archipelago/src/api/rpc/mesh/messaging.rs

@@ -158,6 +158,29 @@ impl RpcHandler {
                 anyhow::bail!("Unknown LoRa region: {trimmed}");
             }
         }
+        // Meshcore LoRa PHY params (freq/bw/sf/cr, firmware field units — see
+        // mesh::LoraRadioParams). Validated against the firmware's accepted
+        // ranges here so a bad value errors at the API instead of being sent
+        // to the radio and rejected on-device. `null` clears the setting.
+        if let Some(rp) = params.get("lora_radio_params") {
+            if rp.is_null() {
+                config.lora_radio_params = None;
+            } else {
+                let parsed: mesh::LoraRadioParams = serde_json::from_value(rp.clone())
+                    .map_err(|e| anyhow::anyhow!("Invalid lora_radio_params: {e}"))?;
+                anyhow::ensure!(
+                    (150_000..=2_500_000).contains(&parsed.freq_khz),
+                    "freq_khz out of range (150000..=2500000)"
+                );
+                anyhow::ensure!(
+                    (7_000..=500_000).contains(&parsed.bw_hz),
+                    "bw_hz out of range (7000..=500000)"
+                );
+                anyhow::ensure!((5..=12).contains(&parsed.sf), "sf out of range (5..=12)");
+                anyhow::ensure!((5..=8).contains(&parsed.cr), "cr out of range (5..=8)");
+                config.lora_radio_params = Some(parsed);
+            }
+        }
         // Firmware pin: probe only the named firmware on the port ("auto"/""
         // clears the pin and restores strict-probe auto-detect).
         if let Some(kind) = params.get("device_kind").and_then(|v| v.as_str()) {

core/archipelago/src/api/rpc/mesh/status.rs

@@ -41,6 +41,10 @@ impl RpcHandler {
             // live radio-reported `region`): the configured LoRa region and
             // the firmware pin ("meshcore"|"meshtastic"|"reticulum"|null=auto).
             obj.insert("lora_region".into(), config.lora_region.clone().into());
+            obj.insert(
+                "lora_radio_params".into(),
+                serde_json::to_value(config.lora_radio_params).unwrap_or_default(),
+            );
             obj.insert(
                 "device_kind".into(),
                 config

core/archipelago/src/api/rpc/mod.rs

@@ -438,7 +438,13 @@ impl RpcHandler {
                 }
             }
             Err(e) => {
-                error!("RPC error on {}: {}", rpc_req.method, e);
+                // `{:#}` renders the whole anyhow context chain. Logging only the
+                // outermost context threw away the actual cause: a peer-files
+                // failure logged just "Failed to connect to peer", with the real
+                // error (Tor SOCKS failure, FIPS resolve, timeout) discarded — so
+                // the logs couldn't distinguish a dead peer from a slow circuit.
+                // The client-facing message below stays `{}` so internals aren't leaked.
+                error!("RPC error on {}: {:#}", rpc_req.method, e);
                 let user_message = sanitize_error_message(&e.to_string());
                 RpcResponse {
                     result: None,

core/archipelago/src/api/rpc/package/config.rs

@@ -496,6 +496,8 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
             "netbird-dashboard".into(),
             "netbird-server".into(),
         ],
+        // Pine voice-assistant stack: launcher + the two Wyoming engines.
+        "pine" => vec!["pine".into(), "pine-whisper".into(), "pine-piper".into()],
         "nostr-vpn" => vec![
             "nostr-vpn".into(),
             "archy-nostr-vpn".into(),

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -595,6 +595,9 @@ pub(super) fn needs_archy_net(package_id: &str) -> bool {
             | "nbxplorer"
             | "fedimint"
             | "fedimint-gateway"
+            | "pine"
+            | "pine-whisper"
+            | "pine-piper"
     )
 }
 
@@ -626,6 +629,7 @@ pub(super) fn startup_order(package_id: &str) -> &'static [&'static str] {
             &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
         }
         "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
+        "pine" => &["pine-whisper", "pine-piper", "pine"],
         "penpot" | "penpot-frontend" => &[
             "penpot-postgres",
             "penpot-valkey",

core/archipelago/src/api/rpc/package/install.rs

@@ -294,6 +294,9 @@ impl RpcHandler {
         if package_id == "netbird" {
             return self.install_netbird_stack().await;
         }
+        if package_id == "pine" {
+            return self.install_pine_stack().await;
+        }
         // Dependency checks. Prefer the scanner's cached package state so a
         // congested Podman API does not turn an already-running dependency into
         // a false install failure. Fall back to a bounded direct Podman probe

core/archipelago/src/api/rpc/package/stacks.rs

@@ -744,6 +744,15 @@ fn netbird_stack_app_ids() -> &'static [&'static str] {
     &["netbird-server", "netbird-dashboard", "netbird"]
 }
 
+fn pine_stack_app_ids() -> &'static [&'static str] {
+    // Dependency/startup order: the two Wyoming engines (STT + TTS) first — they
+    // own their downloaded model/voice under /data and publish 10300/10200 —
+    // then the user-facing launcher ("pine", the nginx that serves the setup /
+    // status page + is the Open target). Mirrors the pine startup_order in
+    // dependencies.rs + the stack member table in app_ops.rs.
+    &["pine-whisper", "pine-piper", "pine"]
+}
+
 fn indeedhub_stack_app_ids() -> &'static [&'static str] {
     // Dependency order: backends + their generated secrets first, then the api
     // (owns indeedhub-jwt; reads the db/minio secrets the backends materialised),
@@ -1907,6 +1916,37 @@ impl RpcHandler {
             "netbird manifests not available on this node — the signed catalog must provide apps/netbird-*/manifest.yml (legacy hardcoded installer removed in #20 ph4)"
         )
     }
+
+    /// Install the Pine voice-assistant stack (Whisper STT + Piper TTS + the
+    /// setup/status launcher). Manifest-driven only, like netbird: render the
+    /// 3-member stack from apps/pine-*/manifest.yml via the orchestrator
+    /// (archy-net + network_aliases, published Wyoming ports 10300/10200 so
+    /// Home Assistant reaches the engines via host.containers.internal, the
+    /// launcher's setup page written via `files:`). The manifests use the exact
+    /// live container names, so on an existing node this ADOPTS the running
+    /// stack rather than recreating it (downloaded models/voices preserved).
+    ///
+    /// There is no in-Rust hardcoded fallback: the signed catalog always ships
+    /// apps/pine-*/manifest.yml. If the orchestrator doesn't know these app_ids
+    /// and no running stack exists to adopt, install errors rather than
+    /// silently diverging from the manifest contract.
+    pub(super) async fn install_pine_stack(&self) -> Result<serde_json::Value> {
+        if let Some(orchestrated) =
+            install_stack_via_orchestrator(self, "pine", pine_stack_app_ids()).await?
+        {
+            return Ok(orchestrated);
+        }
+
+        if let Some(adopted) =
+            adopt_stack_if_exists("pine", "pine", &["pine-whisper", "pine-piper", "pine"]).await?
+        {
+            return Ok(adopted);
+        }
+
+        anyhow::bail!(
+            "pine manifests not available on this node — the signed catalog must provide apps/pine-*/manifest.yml"
+        )
+    }
 }
 
 #[cfg(test)]

core/archipelago/src/api/rpc/system/handlers.rs

@@ -719,4 +719,94 @@ impl RpcHandler {
             _ => anyhow::bail!("Unknown setting: {}", key),
         }
     }
+
+    /// system.kiosk-display.get — Current kiosk display preset + whether this
+    /// node has a kiosk at all (no kiosk unit -> the Settings section hides).
+    pub(in crate::api::rpc) async fn handle_system_kiosk_display_get(
+        &self,
+    ) -> Result<serde_json::Value> {
+        let has_kiosk = tokio::fs::metadata("/etc/systemd/system/archipelago-kiosk.service")
+            .await
+            .is_ok();
+        let conf = tokio::fs::read_to_string(KIOSK_DISPLAY_CONF)
+            .await
+            .unwrap_or_default();
+        let preset = if conf.contains("ARCHIPELAGO_KIOSK_SCALE=1") {
+            "native"
+        } else if conf.contains("ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920") {
+            "balanced"
+        } else if conf.contains("ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280") {
+            "large"
+        } else {
+            "auto"
+        };
+        Ok(serde_json::json!({ "has_kiosk": has_kiosk, "preset": preset }))
+    }
+
+    /// system.kiosk-display.set — Write the kiosk display preset and restart
+    /// the kiosk (only if it is running) so it takes effect immediately. The
+    /// launcher sources /etc/archipelago/kiosk-display.conf at startup.
+    pub(in crate::api::rpc) async fn handle_system_kiosk_display_set(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let preset = params
+            .get("preset")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing preset"))?;
+
+        let conf = match preset {
+            // Resolution-derived default: 4K -> 2.0 (1920-wide layout),
+            // 1080p TV -> 1.5, laptop panels -> 1.0.
+            "auto" => String::new(),
+            // Biggest UI: every panel targets a 1280-wide layout.
+            "large" => "ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280\n".to_string(),
+            // Full-HD layout on any panel that can carry it.
+            "balanced" => "ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920\n".to_string(),
+            // No scaling: native CSS viewport, most content, smallest UI.
+            "native" => "ARCHIPELAGO_KIOSK_SCALE=1\n".to_string(),
+            other => anyhow::bail!("Unknown display preset: {other}"),
+        };
+
+        host_sudo(&["/usr/bin/mkdir", "-p", "/etc/archipelago"]).await?;
+        if conf.is_empty() {
+            let _ = host_sudo(&["/usr/bin/rm", "-f", KIOSK_DISPLAY_CONF]).await;
+        } else {
+            // tee via sudo — the backend runs unprivileged and /etc is root's.
+            let mut child = tokio::process::Command::new("/usr/bin/sudo")
+                .args(["-n", "/usr/bin/tee", KIOSK_DISPLAY_CONF])
+                .stdin(std::process::Stdio::piped())
+                .stdout(std::process::Stdio::null())
+                .stderr(std::process::Stdio::piped())
+                .spawn()
+                .context("spawn sudo tee for kiosk display conf")?;
+            use tokio::io::AsyncWriteExt;
+            if let Some(mut stdin) = child.stdin.take() {
+                stdin.write_all(conf.as_bytes()).await?;
+            }
+            let out = child.wait_with_output().await?;
+            if !out.status.success() {
+                anyhow::bail!(
+                    "writing {} failed: {}",
+                    KIOSK_DISPLAY_CONF,
+                    String::from_utf8_lossy(&out.stderr).trim()
+                );
+            }
+        }
+
+        // try-restart: only bounces a kiosk that is actually running, so this
+        // never starts a kiosk an operator disabled.
+        let _ = host_sudo(&[
+            "/usr/bin/systemctl",
+            "try-restart",
+            "archipelago-kiosk.service",
+        ])
+        .await;
+
+        info!(preset, "Kiosk display preset applied");
+        Ok(serde_json::json!({ "preset": preset, "applied": true }))
+    }
 }
+
+const KIOSK_DISPLAY_CONF: &str = "/etc/archipelago/kiosk-display.conf";

core/archipelago/src/api/rpc/tor/handlers.rs

@@ -4,9 +4,21 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 impl RpcHandler {
     /// List all configured hidden services with their .onion addresses.
+    /// Services for known-but-uninstalled apps are hidden (issue #79).
     pub(in crate::api::rpc) async fn handle_tor_list_services(&self) -> Result<serde_json::Value> {
         let config_dir = self.config.data_dir.join("tor-config");
-        let services = list_services(&config_dir).await?;
+        let (data, _) = self.state_manager.get_snapshot().await;
+        let mut apps = AppInstallState {
+            known: Default::default(),
+            installed: Default::default(),
+        };
+        for (id, pkg) in &data.package_data {
+            apps.known.insert(id.clone());
+            if pkg.installed.is_some() {
+                apps.installed.insert(id.clone());
+            }
+        }
+        let services = list_services(&config_dir, Some(&apps)).await?;
         let tor_running = check_tor_running().await;
         Ok(serde_json::json!({ "services": services, "tor_running": tor_running }))
     }

core/archipelago/src/api/rpc/tor/mod.rs

@@ -228,15 +228,67 @@ pub(super) async fn sync_all_hostname_copies(config: &ServicesConfig) {
 
 // ─── Service Listing ─────────────────────────────────────────────
 
-pub(super) async fn list_services(config_dir: &std::path::Path) -> Result<Vec<TorService>> {
+/// Which packages the node knows about and which are installed — used to
+/// hide hidden services for apps that aren't installed. ISO first-boot used
+/// to pre-bake onions for a fixed app list (bitcoin/electrumx/lnd/btcpay/
+/// mempool/fedimint), so fresh nodes showed Tor sites for apps that were
+/// never installed (issue #79).
+pub(super) struct AppInstallState {
+    pub known: std::collections::HashSet<String>,
+    pub installed: std::collections::HashSet<String>,
+}
+
+/// Package ids a Tor service name may correspond to. Service names predate
+/// the catalog app ids (the ISO baked "bitcoin"/"btcpay"), so one service
+/// can map to several package ids.
+fn service_alias_candidates(name: &str) -> Vec<&str> {
+    match name {
+        "bitcoin" | "bitcoin-knots" | "bitcoin-core" => {
+            vec!["bitcoin", "bitcoin-knots", "bitcoin-core"]
+        }
+        "electrumx" | "electrs" | "mempool-electrs" => {
+            vec!["electrumx", "electrs", "mempool-electrs"]
+        }
+        "btcpay" | "btcpay-server" | "btcpayserver" => {
+            vec!["btcpay", "btcpay-server", "btcpayserver"]
+        }
+        "mempool" | "mempool-web" => vec!["mempool", "mempool-web"],
+        other => vec![other],
+    }
+}
+
+impl AppInstallState {
+    /// A service is listed unless it names a known-but-uninstalled app.
+    /// The node's own service, the content relay, and custom user-created
+    /// services (names matching no catalog package) always show.
+    fn service_visible(&self, name: &str) -> bool {
+        if name == "archipelago" || name == "relay" {
+            return true;
+        }
+        let candidates = service_alias_candidates(name);
+        if !candidates.iter().any(|c| self.known.contains(*c)) {
+            return true; // not an app — custom hidden service
+        }
+        candidates.iter().any(|c| self.installed.contains(*c))
+    }
+}
+
+pub(super) async fn list_services(
+    config_dir: &std::path::Path,
+    apps: Option<&AppInstallState>,
+) -> Result<Vec<TorService>> {
     let base = detect_hidden_service_base();
     let config = load_services_config(config_dir).await;
     let mut services = Vec::new();
     let mut seen = std::collections::HashSet::new();
+    let visible = |name: &str| apps.map(|a| a.service_visible(name)).unwrap_or(true);
 
     for entry in &config.services {
-        let onion = read_onion_address(&entry.name).await;
         seen.insert(entry.name.clone());
+        if !visible(&entry.name) {
+            continue;
+        }
+        let onion = read_onion_address(&entry.name).await;
         services.push(TorService {
             name: entry.name.clone(),
             local_port: entry.local_port,
@@ -260,9 +312,12 @@ pub(super) async fn list_services(config_dir: &std::path::Path) -> Result<Vec<To
                     if seen.contains(&service_name) {
                         continue;
                     }
+                    seen.insert(service_name.clone());
+                    if !visible(&service_name) {
+                        continue;
+                    }
                     let onion = read_onion_address(&service_name).await;
                     let port = known_service_port(&service_name);
-                    seen.insert(service_name.clone());
                     let is_proto = is_protocol_service(&service_name);
                     services.push(TorService {
                         name: service_name,

core/archipelago/src/api/rpc/vpn.rs

@@ -437,6 +437,23 @@ impl RpcHandler {
         Ok(serde_json::json!({ "added": true, "npub": npub }))
     }
 
+    /// The host address a WireGuard peer should dial — prefer the configured
+    /// host IP, then public-IP lookup, then first local address.
+    async fn current_wg_endpoint_host(&self) -> String {
+        if self.config.host_ip != "127.0.0.1" {
+            return self.config.host_ip.clone();
+        }
+        tokio::process::Command::new("sh")
+            .arg("-c")
+            .arg("curl -s --connect-timeout 5 https://api.ipify.org 2>/dev/null || hostname -I | awk '{print $1}'")
+            .output()
+            .await
+            .ok()
+            .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(|| self.config.host_ip.clone())
+    }
+
     /// vpn.create-peer — Generate a WireGuard peer config + QR code for mobile devices.
     pub(super) async fn handle_vpn_create_peer(
         &self,
@@ -501,22 +518,7 @@ impl RpcHandler {
                 .ok_or_else(|| anyhow::anyhow!("Cannot read server public key"))?
         };
 
-        // Detect host IP — prefer config, then nvpn, then system detection
-        let host_ip = if self.config.host_ip != "127.0.0.1" {
-            self.config.host_ip.clone()
-        } else {
-            // Fallback: get public IP via external service
-            tokio::process::Command::new("sh")
-                .arg("-c")
-                .arg("curl -s --connect-timeout 5 https://api.ipify.org 2>/dev/null || hostname -I | awk '{print $1}'")
-                .output()
-                .await
-                .ok()
-                .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
-                .filter(|s| !s.is_empty())
-                .unwrap_or_else(|| self.config.host_ip.clone())
-        };
-        let endpoint = format!("{}:51820", host_ip);
+        let endpoint = format!("{}:51820", self.current_wg_endpoint_host().await);
 
         // Allocate a peer IP (simple: hash the peer name)
         let peer_num = (name.bytes().map(|b| b as u32).sum::<u32>() % 253) + 2;
@@ -667,15 +669,41 @@ impl RpcHandler {
         let content = tokio::fs::read_to_string(&peer_file)
             .await
             .map_err(|_| anyhow::anyhow!("Peer '{}' not found", name))?;
-        let peer: serde_json::Value = serde_json::from_str(&content)?;
+        let mut peer: serde_json::Value = serde_json::from_str(&content)?;
 
-        let config = peer.get("config").and_then(|v| v.as_str()).ok_or_else(|| {
+        let stored = peer.get("config").and_then(|v| v.as_str()).ok_or_else(|| {
             anyhow::anyhow!(
                 "No config stored for peer '{}' — recreate the device to get a new QR code",
                 name
             )
         })?;
 
+        // The stored Endpoint is the node's address at creation time; after
+        // the node moves networks it points at a dead IP and the QR produces
+        // a tunnel that can never connect. Refresh it to the current address.
+        let endpoint = format!("{}:51820", self.current_wg_endpoint_host().await);
+        let config: String = stored
+            .lines()
+            .map(|l| {
+                if l.trim_start().starts_with("Endpoint") {
+                    format!("Endpoint = {}", endpoint)
+                } else {
+                    l.to_string()
+                }
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+        if config != stored {
+            if let Some(obj) = peer.as_object_mut() {
+                obj.insert("config".to_string(), config.clone().into());
+            }
+            if let Ok(json) = serde_json::to_string_pretty(&peer) {
+                if tokio::fs::write(&peer_file, json).await.is_ok() {
+                    info!("VPN peer '{}' endpoint refreshed to {}", name, endpoint);
+                }
+            }
+        }
+
         let qr = qrcode::QrCode::new(config.as_bytes())
             .map_err(|e| anyhow::anyhow!("QR generation failed: {}", e))?;
         let svg = qr

core/archipelago/src/app_ops.rs

@@ -50,6 +50,7 @@ pub fn stack_member_app_ids(package_id: &str) -> &'static [&'static str] {
             &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
         }
         "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
+        "pine" => &["pine-whisper", "pine-piper", "pine"],
         // The legacy umbrella id maps to the split stack (the orchestrator's
         // umbrella alias handles this too; listing it here keeps the RPC
         // layer's fan-out explicit).
@@ -75,7 +76,14 @@ pub fn address_caching_dependents(package_id: &str) -> &'static [&'static str] {
 /// `app_id` is a member (RPC ops on "mempool" hold the "mempool" lock while
 /// they drive archy-mempool-web), otherwise the app itself.
 fn owning_package(app_id: &str) -> &str {
-    const STACKS: &[&str] = &["immich", "indeedhub", "btcpay-server", "netbird", "mempool"];
+    const STACKS: &[&str] = &[
+        "immich",
+        "indeedhub",
+        "btcpay-server",
+        "netbird",
+        "mempool",
+        "pine",
+    ];
     for stack in STACKS {
         if stack_member_app_ids(stack).contains(&app_id) {
             return stack;

core/archipelago/src/bootstrap.rs

@@ -137,6 +137,13 @@ pub async fn ensure_doctor_installed() {
         Ok(false) => debug!("/opt/archipelago/apps already populated (or no installer copy)"),
         Err(e) => warn!("Apps dir repair failed (non-fatal): {:#}", e),
     }
+    match run_polkit_networkmanager_repair().await {
+        Ok(true) => info!(
+            "Installed NetworkManager polkit rule for the archipelago user — Wi-Fi setup enabled"
+        ),
+        Ok(false) => debug!("NetworkManager polkit rule already present"),
+        Err(e) => warn!("polkit NetworkManager repair failed (non-fatal): {:#}", e),
+    }
     match run_journald_dropin().await {
         Ok(true) => info!("Installed journald log-volume policy drop-in"),
         Ok(false) => debug!("journald log-volume policy already in place"),
@@ -442,6 +449,68 @@ exit 2
     }
 }
 
+/// Self-heal Wi-Fi setup on nodes that predate the polkit fix (issue #99).
+///
+/// Archipelago drives NetworkManager from a system-level systemd service
+/// (`User=archipelago`, no logind seat), so the stock NM polkit rule — which
+/// only authorizes `subject.local && subject.active` sessions — denies it, and
+/// "connect to Wi-Fi" fails with "Insufficient privileges". Fresh ISO installs
+/// since 2026-05 ship the rule below, but nodes that reached this build over
+/// OTA never got it (OTA replaces the binary + web UI, not host system config).
+///
+/// Install the scoped rule if it is missing, and best-effort ensure `polkitd`
+/// itself is present (without the daemon the rule is inert). Both are wrapped
+/// so an offline/locked apt or a missing package can never fail startup — the
+/// rule is still written so it takes effect once polkitd arrives (e.g. after an
+/// ISO reflash). Idempotent: keyed on the rule's unique `subject.user` marker.
+async fn run_polkit_networkmanager_repair() -> Result<bool> {
+    let script = r#"
+set -u
+RULE=/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
+MARKER='subject.user == "archipelago"'
+# Rule already installed — nothing to do.
+if grep -qF "$MARKER" "$RULE" 2>/dev/null; then
+    exit 0
+fi
+# The rule is inert without the polkit daemon. Older nodes (the ones that hit
+# issue #99) shipped without it. Try to install it, but never let apt failure
+# (offline node, locked dpkg, package unavailable) abort the heal — the rule is
+# written regardless so it activates whenever polkitd lands.
+if [ ! -d /usr/share/polkit-1 ] && ! command -v pkaction >/dev/null 2>&1; then
+    timeout 240 apt-get install -y --no-install-recommends polkitd >/dev/null 2>&1 \
+        || timeout 240 sh -c 'apt-get update >/dev/null 2>&1 && apt-get install -y --no-install-recommends polkitd >/dev/null 2>&1' \
+        || true
+fi
+mkdir -p /etc/polkit-1/rules.d
+cat > "$RULE" <<'RULEEOF'
+polkit.addRule(function(action, subject) {
+    if (subject.user == "archipelago" && action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {
+        return polkit.Result.YES;
+    }
+});
+RULEEOF
+chmod 644 "$RULE"
+# Pick up the new rule. polkitd re-reads rules.d on reload; restart as a
+# fallback. Non-fatal if the unit name differs or the daemon is absent.
+systemctl reload polkit 2>/dev/null \
+    || systemctl restart polkit 2>/dev/null \
+    || systemctl restart polkit.service 2>/dev/null \
+    || true
+exit 2
+"#;
+    let status = host_sudo(&["sh", "-lc", script])
+        .await
+        .context("install NetworkManager polkit rule")?;
+    match status.code() {
+        Some(0) => Ok(false),
+        Some(2) => Ok(true),
+        _ => {
+            warn!("polkit NetworkManager repair helper exited with {}", status);
+            Ok(false)
+        }
+    }
+}
+
 async fn run_bitcoin_rpc_repair() -> Result<bool> {
     // Older installs can have a container-owned bitcoin.conf with only rpcauth
     // and printtoconsole. Repair it at startup so OTA fixes existing nodes

core/archipelago/src/container/docker_packages.rs

@@ -57,6 +57,8 @@ impl DockerPackageScanner {
             "indeedhub-build_ffmpeg-worker_1",
             "netbird-server",
             "netbird-dashboard",
+            "pine-whisper",
+            "pine-piper",
             "buildx_buildkit_default",
         ];
 

core/archipelago/src/container/prod_orchestrator.rs

@@ -301,6 +301,33 @@ fn unrepairable_ownership() -> &'static std::sync::Mutex<std::collections::HashS
     SET.get_or_init(|| std::sync::Mutex::new(std::collections::HashSet::new()))
 }
 
+/// Per-container timestamp of the last volume-ownership sweep. The sweep's
+/// write-probes are `podman exec`s into EVERY running container; running them
+/// on every 30s reconcile tick meant six-plus cross-context exec attempts per
+/// tick forever — a permanent conmon "Failed to create container" storm on
+/// hosts where exec from the backend's cgroup context fails (Debian 13 first
+/// boot, 2026-07-19). Ownership drift is an install/OTA-time event, not a
+/// steady-state one: sweep each container on the first pass after it appears,
+/// then at most once per hour.
+fn ownership_sweep_due(name: &str) -> bool {
+    const SWEEP_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60 * 60);
+    static LAST: std::sync::OnceLock<
+        std::sync::Mutex<std::collections::HashMap<String, std::time::Instant>>,
+    > = std::sync::OnceLock::new();
+    let map = LAST.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
+    let Ok(mut map) = map.lock() else {
+        return true;
+    };
+    let now = std::time::Instant::now();
+    match map.get(name) {
+        Some(last) if now.duration_since(*last) < SWEEP_INTERVAL => false,
+        _ => {
+            map.insert(name.to_string(), now);
+            true
+        }
+    }
+}
+
 /// App-agnostic, userns-mapping-proof volume-ownership repair for a RUNNING
 /// container.
 ///
@@ -1739,6 +1766,11 @@ impl ProdContainerOrchestrator {
                 if crate::app_ops::lifecycle_op_in_flight(&c.name) {
                     continue;
                 }
+                // Throttled: first pass after the container appears, then
+                // hourly — not on every 30s tick (see ownership_sweep_due).
+                if !ownership_sweep_due(&c.name) {
+                    continue;
+                }
                 if ensure_running_container_ownership(&c.name).await {
                     tracing::info!(container = %c.name, "volume ownership repaired during reconcile — restarting to recover");
                     let _ = tokio::process::Command::new("podman")

core/archipelago/src/crash_recovery.rs

@@ -372,6 +372,28 @@ pub async fn save_container_snapshot(data_dir: &Path) -> Result<()> {
 /// Recover containers that were running before a crash.
 /// Attempts to start each container, logging success/failure.
 pub async fn recover_containers(containers: &[RunningContainerRecord]) -> RecoveryReport {
+    // Snapshot entries can outlive their containers (removed while we were
+    // down, or podman storage partially reset by an unclean poweroff).
+    // `podman start` on those fails permanently, and recovery runs BEFORE the
+    // server binds its port and notifies systemd ready — burning retries on
+    // them pushed recovery past TimeoutStartSec and brick-looped the node
+    // (killed mid-recovery → next boot sees a crash again, forever).
+    let containers: Vec<&RunningContainerRecord> = match existing_container_names().await {
+        Some(existing) => {
+            let (present, missing): (Vec<_>, Vec<_>) =
+                containers.iter().partition(|r| existing.contains(&r.name));
+            if !missing.is_empty() {
+                warn!(
+                    "Skipping {} snapshot container(s) that no longer exist: {:?}",
+                    missing.len(),
+                    missing.iter().map(|r| r.name.as_str()).collect::<Vec<_>>()
+                );
+            }
+            present
+        }
+        None => containers.iter().collect(),
+    };
+
     let mut report = RecoveryReport {
         total: containers.len(),
         recovered: 0,
@@ -386,6 +408,15 @@ pub async fn recover_containers(containers: &[RunningContainerRecord]) -> Recove
             record.name, record.image
         );
 
+        // Recovery counts against systemd's start timeout; a heavy node
+        // legitimately needs several minutes for dozens of containers. Push
+        // the deadline out ahead of each container so systemd only kills us
+        // if we stop making progress (360s covers one full attempt chain).
+        let _ = sd_notify::notify(
+            false,
+            &[sd_notify::NotifyState::ExtendTimeoutUsec(360_000_000)],
+        );
+
         // Rate-limit container starts to avoid overwhelming podman on low-resource systems
         if i > 0 {
             tokio::time::sleep(std::time::Duration::from_secs(3)).await;
@@ -427,6 +458,11 @@ pub async fn recover_containers(containers: &[RunningContainerRecord]) -> Recove
                         attempt + 1,
                         stderr.trim()
                     );
+                    // The container is gone (raced past the pre-filter, or the
+                    // filter query failed) — retrying can never succeed.
+                    if stderr.contains("no such container") {
+                        break;
+                    }
                 }
                 Err(e) => {
                     warn!(
@@ -448,6 +484,26 @@ pub async fn recover_containers(containers: &[RunningContainerRecord]) -> Recove
     report
 }
 
+/// All container names podman knows about (running or not). `None` if the
+/// query fails — callers fail open and attempt every snapshot entry.
+async fn existing_container_names() -> Option<std::collections::HashSet<String>> {
+    let output = podman_output(
+        &["ps", "-a", "--format", "{{.Names}}"],
+        Duration::from_secs(30),
+    )
+    .await
+    .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    Some(
+        String::from_utf8_lossy(&output.stdout)
+            .split_whitespace()
+            .map(|s| s.to_string())
+            .collect(),
+    )
+}
+
 #[derive(Debug)]
 pub struct RecoveryReport {
     pub total: usize,
@@ -710,6 +766,9 @@ fn should_auto_start_stopped_container(name: &str, include_stack_members: bool)
                 | "netbird-server"
                 | "netbird-dashboard"
                 | "netbird"
+                | "pine-whisper"
+                | "pine-piper"
+                | "pine"
         )
 }
 
@@ -771,6 +830,20 @@ fn stack_recovery_specs() -> &'static [StackRecoverySpec] {
             containers: &["netbird-server", "netbird-dashboard", "netbird"],
             anchor: "netbird-server",
         },
+        StackRecoverySpec {
+            name: "pine",
+            network: "archy-net",
+            aliases: &[
+                ("pine-whisper", "pine-whisper"),
+                ("pine-piper", "pine-piper"),
+                ("pine", "pine"),
+            ],
+            containers: &["pine-whisper", "pine-piper", "pine"],
+            // The launcher only depends on the two engines; whisper is the
+            // heaviest/first member, so treat it as the stack anchor (its
+            // presence means the stack was really installed, not orphan debris).
+            anchor: "pine-whisper",
+        },
     ]
 }
 

core/archipelago/src/fips/anchors.rs

@@ -49,9 +49,7 @@ pub const DEFAULT_PUBLIC_ANCHOR_NPUB: &str =
 pub const DEFAULT_PUBLIC_ANCHOR_ADDR: &str = "185.18.221.160:8443";
 pub const DEFAULT_PUBLIC_ANCHOR_TRANSPORT: &str = "tcp";
 
-/// The default public anchor as a ready-to-apply `SeedAnchor`. Carried
-/// implicitly by `load()` on nodes that have never edited their anchor
-/// list, so every node dials it without operator action.
+/// The upstream public anchor as a ready-to-apply `SeedAnchor`.
 pub fn default_public_anchor() -> SeedAnchor {
     SeedAnchor {
         npub: DEFAULT_PUBLIC_ANCHOR_NPUB.to_string(),
@@ -61,6 +59,38 @@ pub fn default_public_anchor() -> SeedAnchor {
     }
 }
 
+// Archipelago-operated anchor on vps2 (the OTA/registry host, 146.59.87.168).
+// Every node already reaches this host for updates, so it is reachable from
+// networks that the upstream anchor is not — which is most of them (the
+// upstream anchor answers on one IPv4 that many home/office networks can't
+// reach, and its DNS resolves IPv6-first while the daemon is IPv4-only).
+// TCP because that traverses NAT/firewalls best; 8444 because 8443 on that
+// host is already taken by a container.
+pub const ARCHY_ANCHOR_NPUB: &str =
+    "npub1dptaktwxv0mm245g2lqjykwm5ll0jpc6m3r4242ydfa9z7qe6urs3jvrak";
+pub const ARCHY_ANCHOR_ADDR: &str = "146.59.87.168:8444";
+pub const ARCHY_ANCHOR_TRANSPORT: &str = "tcp";
+
+/// The Archipelago-operated anchor as a ready-to-apply `SeedAnchor`.
+pub fn archy_anchor() -> SeedAnchor {
+    SeedAnchor {
+        npub: ARCHY_ANCHOR_NPUB.to_string(),
+        address: ARCHY_ANCHOR_ADDR.to_string(),
+        transport: ARCHY_ANCHOR_TRANSPORT.to_string(),
+        label: "Archipelago anchor (vps2)".to_string(),
+    }
+}
+
+/// The default anchor set carried implicitly by `load()` on nodes that have
+/// never edited their anchor list, so every node dials them without operator
+/// action. Multiple anchors so one unreachable rendezvous host can't strand a
+/// node: `fipsctl connect` is attempted for each, and whichever the node's
+/// network can reach wins. The Archipelago-operated anchor is listed first
+/// because it is reachable from the widest set of networks.
+pub fn default_public_anchors() -> Vec<SeedAnchor> {
+    vec![archy_anchor(), default_public_anchor()]
+}
+
 /// One seed-anchor entry. `address` must be directly dialable (IP or
 /// resolvable hostname + UDP port); `transport` is one of "udp", "tcp",
 /// "tor", "ethernet" (the values upstream `fipsctl connect` accepts).
@@ -94,7 +124,7 @@ fn anchors_path(data_dir: &Path) -> PathBuf {
 pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
     let path = anchors_path(data_dir);
     if !path.exists() {
-        return Ok(vec![default_public_anchor()]);
+        return Ok(default_public_anchors());
     }
     let bytes = tokio::fs::read(&path)
         .await
@@ -268,28 +298,46 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn load_missing_seeds_default_public_anchor() {
-        // A node that has never edited its anchor list should still get
-        // the public anchor so it can bootstrap the mesh out of the box.
+    async fn load_missing_seeds_default_public_anchors() {
+        // A node that has never edited its anchor list should still get the
+        // full default anchor set so it can bootstrap the mesh out of the box.
         let dir = tempfile::tempdir().unwrap();
         let got = load(dir.path()).await.unwrap();
-        assert_eq!(got, vec![default_public_anchor()]);
-        // ...and the default must be the TCP/8443 form, not the dead udp:8668.
-        assert_eq!(got[0].transport, "tcp");
-        assert!(got[0].address.ends_with(":8443"));
+        assert_eq!(got, default_public_anchors());
+        // The Archipelago-operated anchor must come first (widest reachability)
+        // and the upstream anchor must remain present as a fallback.
+        assert_eq!(got[0], archy_anchor());
+        assert!(got.contains(&default_public_anchor()));
+        // Every default must be a TCP form (traverses NAT/firewalls), never the
+        // dead udp:8668 the upstream anchor never answers on.
+        assert!(got.iter().all(|a| a.transport == "tcp"));
     }
 
     #[tokio::test]
-    async fn removing_default_persists_as_empty() {
-        // Once the operator removes the default, a file exists and is
-        // authoritative — we must not silently re-seed it on next load.
+    async fn removing_one_default_persists_and_keeps_the_other() {
+        // Editing the anchor list (here removing one default) makes the file
+        // authoritative: the removed anchor must not be silently re-seeded on
+        // next load, and the remaining default must stay.
         let dir = tempfile::tempdir().unwrap();
+        let list = remove(dir.path(), ARCHY_ANCHOR_NPUB).await.unwrap();
+        assert!(!list.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB));
+        assert!(list.contains(&default_public_anchor()));
+        let got = load(dir.path()).await.unwrap();
+        assert_eq!(got, list, "edited list is authoritative; no re-seed");
+    }
+
+    #[tokio::test]
+    async fn removing_all_defaults_persists_as_empty() {
+        // Removing every default leaves an empty authoritative list that must
+        // not be re-seeded on next load.
+        let dir = tempfile::tempdir().unwrap();
+        remove(dir.path(), ARCHY_ANCHOR_NPUB).await.unwrap();
         let list = remove(dir.path(), DEFAULT_PUBLIC_ANCHOR_NPUB)
             .await
             .unwrap();
         assert!(list.is_empty());
         let got = load(dir.path()).await.unwrap();
-        assert!(got.is_empty(), "default must stay removed once edited");
+        assert!(got.is_empty(), "defaults must stay removed once edited");
     }
 
     #[tokio::test]

core/archipelago/src/fips/config.rs

@@ -10,6 +10,7 @@
 //! whitelists `install` into `/etc/fips/`.
 
 use anyhow::{Context, Result};
+use serde::Serialize;
 use std::path::Path;
 use tokio::process::Command;
 
@@ -17,47 +18,145 @@ use super::{
     DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_TCP_PORT, DEFAULT_UDP_PORT,
 };
 
-/// Write the FIPS daemon config based on the local npub and default
-/// transports. Overwrites any existing file — callers are expected to
+/// Header prepended to the generated YAML. serde doesn't emit comments, so
+/// this is concatenated onto the serialised body.
+const CONFIG_HEADER: &str = "# Generated by archipelago — do not edit by hand.\n\
+                             # Regenerated on every key change and daemon upgrade.\n";
+
+/// Typed mirror of the subset of upstream `fips.yaml` that archipelago owns.
+///
+/// This was previously built by `format!`-ing a string literal. Upstream's
+/// config structs are `#[serde(deny_unknown_fields)]`, so a key we get wrong
+/// doesn't degrade gracefully — the daemon refuses to start and the node drops
+/// off the mesh. Serialising from typed structs lets the compiler and the
+/// tests below catch drift, instead of a node discovering it at boot after an
+/// upgrade.
+///
+/// Schema verified field-by-field against jmcorgan/fips **v0.4.1** (2026-07-20).
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct FipsConfig {
+    pub node: NodeSection,
+    pub tun: TunSection,
+    pub dns: DnsSection,
+    pub transports: TransportsSection,
+    /// Static peers. Always empty: archipelago feeds peers dynamically via the
+    /// seed-anchors apply loop and federation-invite hooks.
+    pub peers: Vec<PeerEntry>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct NodeSection {
+    pub identity: IdentitySection,
+    pub discovery: DiscoverySection,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct IdentitySection {
+    /// With `persistent: true` the daemon reuses the key file at
+    /// config-dir/fips.key (= `DAEMON_KEY_PATH`) instead of generating an
+    /// ephemeral identity on every start.
+    pub persistent: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct DiscoverySection {
+    pub lan: LanDiscoverySection,
+}
+
+/// mDNS / DNS-SD discovery on the local link (`node.discovery.lan.*`), added
+/// upstream in v0.4.0 and opt-in there (upstream default is `false`).
+///
+/// We enable it so co-located nodes peer directly instead of depending on the
+/// public anchor being reachable — an anchor blackhole on one network segment
+/// otherwise islands a node completely.
+///
+/// Emitted unconditionally rather than version-gated: v0.3.0's `DiscoveryConfig`
+/// has no `lan` field *and* no `deny_unknown_fields`, so a v0.3.0 daemon ignores
+/// this key harmlessly (verified against the v0.3.0 source). It therefore starts
+/// working on its own when a node upgrades, with no second config migration.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct LanDiscoverySection {
+    pub enabled: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct TunSection {
+    pub enabled: bool,
+    pub name: String,
+    pub mtu: u16,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct DnsSection {
+    pub enabled: bool,
+    pub bind_addr: String,
+}
+
+/// Both UDP and TCP are enabled: the public anchor answers on TCP/8443 only,
+/// and networks that block outbound UDP can still bootstrap over TCP.
+/// Upstream dropped the `tor:` transport variant — archipelago's own Tor
+/// fallback handles that layer.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct TransportsSection {
+    pub udp: TransportBind,
+    pub tcp: TransportBind,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct TransportBind {
+    /// Upstream takes `bind_addr` ("host:port"), not `enabled` + `port`.
+    pub bind_addr: String,
+}
+
+/// A static peer entry. Never constructed today (see `FipsConfig::peers`), but
+/// typed so the shape is checked if static peering is ever needed.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct PeerEntry {
+    pub npub: String,
+    pub address: String,
+    pub transport: String,
+}
+
+impl Default for FipsConfig {
+    fn default() -> Self {
+        Self {
+            node: NodeSection {
+                identity: IdentitySection { persistent: true },
+                discovery: DiscoverySection {
+                    lan: LanDiscoverySection { enabled: true },
+                },
+            },
+            tun: TunSection {
+                enabled: true,
+                name: "fips0".to_string(),
+                mtu: 1280,
+            },
+            dns: DnsSection {
+                enabled: true,
+                bind_addr: "127.0.0.1".to_string(),
+            },
+            transports: TransportsSection {
+                udp: TransportBind {
+                    bind_addr: format!("0.0.0.0:{DEFAULT_UDP_PORT}"),
+                },
+                tcp: TransportBind {
+                    bind_addr: format!("0.0.0.0:{DEFAULT_TCP_PORT}"),
+                },
+            },
+            peers: Vec::new(),
+        }
+    }
+}
+
+/// Render the FIPS daemon config. Overwrites any existing file — callers
 /// re-run this whenever the key or daemon version changes.
 ///
-/// Schema is intentionally minimal: node identity comes from the key
-/// file on disk (the daemon handles it), transports enable UDP + TCP
-/// (matching upstream factory default), IPv6 TUN + DNS on defaults.
-/// Static peer list is empty — archipelago feeds peers dynamically via
-/// the seed-anchors apply loop and federation-invite hooks.
+/// Node identity comes from the key file on disk; the static peer list stays
+/// empty because peers are fed dynamically at runtime.
 pub fn render_config_yaml() -> String {
-    // Schema matches upstream jmcorgan/fips as of 2026-04. With
-    // `node.identity.persistent: true` the daemon reuses the key file at
-    // config-dir/fips.key (= DAEMON_KEY_PATH). Transports take `bind_addr`
-    // rather than `enabled: true / port: N`. Both UDP and TCP are
-    // enabled by default because the public anchor (fips.v0l.io)
-    // currently answers on TCP/8443 only, and networks that block UDP
-    // outbound can still bootstrap via TCP. Upstream fips no longer
-    // has a `tor:` transport variant — archipelago's own Tor fallback
-    // handles that layer.
-    format!(
-        "# Generated by archipelago — do not edit by hand.\n\
-         # Regenerated on every key change and daemon upgrade.\n\
-         node:\n  \
-         identity:\n    \
-         persistent: true\n\
-         tun:\n  \
-         enabled: true\n  \
-         name: fips0\n  \
-         mtu: 1280\n\
-         dns:\n  \
-         enabled: true\n  \
-         bind_addr: \"127.0.0.1\"\n\
-         transports:\n  \
-         udp:\n    \
-         bind_addr: \"0.0.0.0:{udp}\"\n  \
-         tcp:\n    \
-         bind_addr: \"0.0.0.0:{tcp}\"\n\
-         peers: []\n",
-        udp = DEFAULT_UDP_PORT,
-        tcp = DEFAULT_TCP_PORT,
-    )
+    let body = serde_yaml::to_string(&FipsConfig::default())
+        .expect("FipsConfig is a plain struct tree and cannot fail to serialise");
+    format!("{CONFIG_HEADER}{body}")
 }
 
 /// Install the local FIPS key + rendered config into `/etc/fips/`.
@@ -205,6 +304,60 @@ mod tests {
         assert!(!yaml.contains("tor:"));
     }
 
+    /// Exact-output snapshot. Upstream's config structs are
+    /// `deny_unknown_fields`, so an accidental key rename/addition means the
+    /// daemon won't start. Pinning the full rendering makes any such change
+    /// fail here — where it's cheap — instead of on a node after an upgrade.
+    /// If this fails, re-verify against the upstream schema before updating it.
+    #[test]
+    fn test_rendered_yaml_exact_snapshot() {
+        let expected = "\
+# Generated by archipelago — do not edit by hand.
+# Regenerated on every key change and daemon upgrade.
+node:
+  identity:
+    persistent: true
+  discovery:
+    lan:
+      enabled: true
+tun:
+  enabled: true
+  name: fips0
+  mtu: 1280
+dns:
+  enabled: true
+  bind_addr: 127.0.0.1
+transports:
+  udp:
+    bind_addr: 0.0.0.0:8668
+  tcp:
+    bind_addr: 0.0.0.0:8443
+peers: []
+";
+        assert_eq!(render_config_yaml(), expected);
+    }
+
+    /// The rendered config must parse as YAML and carry the mDNS opt-in at the
+    /// exact path upstream reads (`node.discovery.lan.enabled`) — a typo there
+    /// would silently leave LAN discovery off rather than erroring.
+    #[test]
+    fn test_lan_discovery_enabled_at_upstream_path() {
+        let yaml = render_config_yaml();
+        let parsed: serde_yaml::Value = serde_yaml::from_str(&yaml).expect("renders valid YAML");
+        assert_eq!(
+            parsed["node"]["discovery"]["lan"]["enabled"],
+            serde_yaml::Value::Bool(true),
+        );
+    }
+
+    /// Rendering is deterministic: the startup drift check in server.rs compares
+    /// the freshly rendered config against what's on disk, so any instability
+    /// here would cause an endless reinstall+restart loop of the daemon.
+    #[test]
+    fn test_render_is_deterministic() {
+        assert_eq!(render_config_yaml(), render_config_yaml());
+    }
+
     #[tokio::test]
     async fn test_install_refuses_when_key_missing() {
         let dir = tempfile::tempdir().unwrap();

core/archipelago/src/main.rs

@@ -98,6 +98,40 @@ async fn main() -> Result<()> {
         return ceremony::run();
     }
 
+    // Plain CLI flags must never boot the daemon (a stray `--version` used to
+    // start a second instance next to the systemd one). Handled before any
+    // tracing/state init so stdout stays clean.
+    match std::env::args().nth(1).as_deref() {
+        Some("--version") | Some("-V") => {
+            println!(
+                "archipelago {}-{}",
+                env!("CARGO_PKG_VERSION"),
+                option_env!("GIT_HASH").unwrap_or("dev")
+            );
+            return Ok(());
+        }
+        Some("--help") | Some("-h") => {
+            println!("Archipelago Bitcoin Node OS");
+            println!();
+            println!("Usage: archipelago [COMMAND]");
+            println!();
+            println!("Running with no arguments starts the node daemon.");
+            println!();
+            println!("Commands:");
+            println!("  ceremony <gen|pubkey|sign|verify>  Release-root signing ceremony");
+            println!();
+            println!("Options:");
+            println!("  -V, --version  Print version and exit");
+            println!("  -h, --help     Print this help and exit");
+            return Ok(());
+        }
+        Some(other) if other.starts_with('-') => {
+            eprintln!("archipelago: unknown option '{other}' (see --help)");
+            std::process::exit(2);
+        }
+        _ => {}
+    }
+
     let startup_start = std::time::Instant::now();
     crash_recovery::init_start_time();
 

core/archipelago/src/mesh/listener/mod.rs

@@ -421,6 +421,7 @@ pub fn spawn_mesh_listener(
     our_x25519_pubkey_hex: String,
     server_name: Option<String>,
     lora_region: Option<String>,
+    lora_radio_params: Option<super::LoraRadioParams>,
     channel_name: Option<String>,
     device_kind: Option<super::types::DeviceType>,
     reticulum_tcp: Option<super::types::ReticulumTcpConfig>,
@@ -456,6 +457,7 @@ pub fn spawn_mesh_listener(
                 &our_x25519_pubkey_hex,
                 server_name.as_deref(),
                 lora_region.as_deref(),
+                lora_radio_params,
                 channel_name.as_deref(),
                 device_kind,
                 reticulum_tcp.clone(),

core/archipelago/src/mesh/listener/session.rs

@@ -836,6 +836,10 @@ const MAX_REGION_PROVISION_ATTEMPTS: u32 = 3;
 static REGION_PROVISION_ATTEMPTS: std::sync::atomic::AtomicU32 =
     std::sync::atomic::AtomicU32::new(0);
 
+/// Same retry-cap idea as the region, for the Meshcore radio-params write.
+static RADIO_PARAMS_PROVISION_ATTEMPTS: std::sync::atomic::AtomicU32 =
+    std::sync::atomic::AtomicU32::new(0);
+
 /// Same retry-cap idea as the region, for the shared-channel write.
 static CHANNEL_PROVISION_ATTEMPTS: std::sync::atomic::AtomicU32 =
     std::sync::atomic::AtomicU32::new(0);
@@ -851,6 +855,7 @@ pub(super) async fn run_mesh_session(
     our_x25519_pubkey_hex: &str,
     server_name: Option<&str>,
     lora_region: Option<&str>,
+    lora_radio_params: Option<crate::mesh::LoraRadioParams>,
     channel_name: Option<&str>,
     device_kind: Option<DeviceType>,
     reticulum_tcp: Option<ReticulumTcpConfig>,
@@ -978,6 +983,62 @@ pub(super) async fn run_mesh_session(
         );
     }
 
+    // Provision Meshcore LoRa PHY params (freq/bw/sf/cr) when the operator has
+    // configured them. Meshcore-only: Meshtastic radios get region+preset via
+    // ensure_lora_region above, and Reticulum carries its own RNode profile.
+    // Gated on a persisted marker of the last-applied params rather than the
+    // device's SELF_INFO readback (its field offsets shift across firmware
+    // versions), so we send the set-command once per configured value and never
+    // reboot-loop a radio that refuses it. The firmware reboots on RESP_OK, so
+    // a successful write restarts the session like the region path.
+    if let (Some(params), MeshRadioDevice::Meshcore(dev)) = (lora_radio_params, &mut device) {
+        let marker_path = data_dir.join("meshcore-radio-params.json");
+        let applied: Option<crate::mesh::LoraRadioParams> = tokio::fs::read(&marker_path)
+            .await
+            .ok()
+            .and_then(|b| serde_json::from_slice(&b).ok());
+        if applied != Some(params) {
+            let attempts = RADIO_PARAMS_PROVISION_ATTEMPTS.load(Ordering::Relaxed);
+            if attempts < MAX_REGION_PROVISION_ATTEMPTS {
+                match dev
+                    .set_radio_params(params.freq_khz, params.bw_hz, params.sf, params.cr)
+                    .await
+                {
+                    Ok(()) => {
+                        RADIO_PARAMS_PROVISION_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
+                        if let Ok(json) = serde_json::to_vec(&params) {
+                            if let Err(e) = tokio::fs::write(&marker_path, json).await {
+                                warn!("Failed to persist radio-params marker: {}", e);
+                            }
+                        }
+                        info!(
+                            freq_khz = params.freq_khz,
+                            bw_hz = params.bw_hz,
+                            sf = params.sf,
+                            cr = params.cr,
+                            "Provisioned Meshcore radio params — radio rebooting, \
+                             restarting mesh session"
+                        );
+                        tokio::time::sleep(Duration::from_secs(10)).await;
+                        return Ok(());
+                    }
+                    Err(e) => {
+                        RADIO_PARAMS_PROVISION_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
+                        warn!("Failed to provision Meshcore radio params: {}", e);
+                    }
+                }
+            } else {
+                warn!(
+                    attempts = MAX_REGION_PROVISION_ATTEMPTS,
+                    "Meshcore radio rejected the configured radio params after \
+                     repeated attempts — continuing with the device's own settings."
+                );
+            }
+        } else {
+            RADIO_PARAMS_PROVISION_ATTEMPTS.store(0, Ordering::Relaxed);
+        }
+    }
+
     // Set advert name to the server's human-readable name (e.g. "ThinkPad"),
     // falling back to the DID fragment if no name is configured.
     let advert_name = if let Some(name) = server_name {

core/archipelago/src/mesh/mod.rs

@@ -322,6 +322,22 @@ pub(crate) async fn seed_federation_peers_into_mesh(
     }
 }
 
+/// Operator-configured LoRa PHY parameters for a Meshcore radio, in the
+/// firmware's own field units: `freq_khz` = MHz×1000 (869618 → 869.618 MHz),
+/// `bw_hz` = kHz×1000 (62500 → 62.5 kHz), `sf` 5..=12, `cr` 5..=8. These are
+/// region/deployment-specific (e.g. the Portugal preset 869618/62500/8/8) and
+/// MUST match every radio on the local mesh — a mismatched radio hears RF
+/// energy but demodulates nothing. None (the default) leaves the device's own
+/// settings untouched, so nodes outside the configured deployment are never
+/// affected.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+pub struct LoraRadioParams {
+    pub freq_khz: u32,
+    pub bw_hz: u32,
+    pub sf: u8,
+    pub cr: u8,
+}
+
 /// Mesh configuration (persisted to disk).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct MeshConfig {
@@ -340,6 +356,11 @@ pub struct MeshConfig {
     /// unset/None.
     #[serde(default)]
     pub lora_region: Option<String>,
+    /// Meshcore LoRa PHY parameters (freq/bw/sf/cr). Provisioned onto the
+    /// radio on connect when set; None leaves the device untouched. Ignored
+    /// for Meshtastic (region/preset covers it) and Reticulum.
+    #[serde(default)]
+    pub lora_radio_params: Option<LoraRadioParams>,
     /// Whether to periodically broadcast our identity.
     #[serde(default)]
     pub broadcast_identity: bool,
@@ -422,6 +443,7 @@ impl Default for MeshConfig {
             device_path: None,
             channel_name: Some("archipelago".to_string()),
             lora_region: None,
+            lora_radio_params: None,
             broadcast_identity: true,
             advert_name: None,
             mesh_only_mode: None,
@@ -722,6 +744,7 @@ impl MeshService {
             self.our_x25519_pubkey_hex.clone(),
             self.server_name.clone(),
             self.config.lora_region.clone(),
+            self.config.lora_radio_params,
             self.config.channel_name.clone(),
             self.config.device_kind,
             self.config.reticulum_tcp.clone(),

core/archipelago/src/mesh/protocol.rs

@@ -210,6 +210,24 @@ pub fn build_set_device_time(unix_secs: u64) -> Vec<u8> {
     encode_frame(&data)
 }
 
+/// CMD_SET_RADIO_PARAMS (0x0B): set the LoRa PHY config. The device reboots to
+/// apply. `freq_field` and `bw_field` are the raw firmware fields (freq =
+/// MHz×1000 e.g. 869618 for 869.618 MHz; bw = kHz×1000 e.g. 62500 for 62.5 kHz);
+/// `sf` is 5..=12 and `cr` is 5..=8. Wire format verified against the MeshCore
+/// companion firmware handler (`examples/companion_radio/MyMesh.cpp`,
+/// `CMD_SET_RADIO_PARAMS`): `[11][freq:u32 LE][bw:u32 LE][sf:u8][cr:u8]`. The
+/// same fields (same units) come back in the SELF_INFO reply, so a caller can
+/// read them to detect drift. Values outside the firmware's accepted ranges are
+/// rejected by the device (it replies with an error frame), not clamped here.
+pub fn build_set_radio_params(freq_field: u32, bw_field: u32, sf: u8, cr: u8) -> Vec<u8> {
+    let mut data = vec![CMD_SET_RADIO_PARAMS];
+    data.extend_from_slice(&freq_field.to_le_bytes());
+    data.extend_from_slice(&bw_field.to_le_bytes());
+    data.push(sf);
+    data.push(cr);
+    encode_frame(&data)
+}
+
 /// CMD_SET_ADVERT_NAME (0x08): Set the node's advertised name on the mesh.
 pub fn build_set_advert_name(name: &str) -> Vec<u8> {
     let mut data = vec![CMD_SET_ADVERT_NAME];
@@ -730,6 +748,29 @@ mod tests {
         assert_eq!(frame[4], PROTOCOL_VERSION);
     }
 
+    #[test]
+    fn test_build_set_radio_params_wire_layout() {
+        // Portugal preset: 869.618 MHz, 62.5 kHz BW, SF 8, CR 8.
+        // freq field = MHz*1000 = 869618; bw field = kHz*1000 = 62500.
+        let frame = build_set_radio_params(869_618, 62_500, 8, 8);
+        assert_eq!(frame[0], OUTBOUND_MARKER);
+        // payload length = 1 (cmd) + 4 (freq) + 4 (bw) + 1 (sf) + 1 (cr) = 11
+        assert_eq!(u16::from_le_bytes([frame[1], frame[2]]), 11);
+        let data = &frame[3..];
+        assert_eq!(data[0], CMD_SET_RADIO_PARAMS);
+        assert_eq!(
+            u32::from_le_bytes([data[1], data[2], data[3], data[4]]),
+            869_618
+        );
+        assert_eq!(
+            u32::from_le_bytes([data[5], data[6], data[7], data[8]]),
+            62_500
+        );
+        assert_eq!(data[9], 8); // sf
+        assert_eq!(data[10], 8); // cr
+        assert_eq!(data.len(), 11);
+    }
+
     #[test]
     fn test_decode_frame_complete() -> Result<()> {
         // Simulate an inbound frame: < + len(2) + [RESP_OK]

core/archipelago/src/mesh/serial.rs

@@ -164,6 +164,29 @@ impl MeshcoreDevice {
         Ok(())
     }
 
+    /// Set the radio's LoRa PHY parameters (freq/bw/sf/cr, firmware field
+    /// units — see `protocol::build_set_radio_params`). On RESP_OK the
+    /// firmware persists the params and reboots to apply them, so the caller
+    /// must treat the session as gone and reconnect.
+    pub async fn set_radio_params(
+        &mut self,
+        freq_khz: u32,
+        bw_hz: u32,
+        sf: u8,
+        cr: u8,
+    ) -> Result<()> {
+        self.send_raw(&protocol::build_set_radio_params(freq_khz, bw_hz, sf, cr))
+            .await?;
+        let frame = self.recv_frame_timeout(READ_TIMEOUT).await?;
+        if frame.code == protocol::RESP_ERR {
+            anyhow::bail!(
+                "Set radio params failed: {}",
+                protocol::parse_error(&frame.data)
+            );
+        }
+        Ok(())
+    }
+
     /// Broadcast our advertisement to the mesh.
     pub async fn send_self_advert(&mut self) -> Result<()> {
         self.send_raw(&protocol::build_send_self_advert()).await?;

core/archipelago/src/server.rs

@@ -688,12 +688,27 @@ impl Server {
             let fips_peer_registry = fips_peer_registry.clone();
             tokio::spawn(async move {
                 tokio::time::sleep(Duration::from_secs(30)).await;
-                let mut interval = tokio::time::interval(Duration::from_secs(300));
+                // Steady cadence, but retry fast right after a daemon restart:
+                // regenerating fips.yaml (this build does, once, on first boot
+                // after the OTA) restarts the fips daemon, and for a few seconds
+                // `/run/fips/control.sock` is gone so every `fipsctl connect`
+                // fails and the node islands until the next tick. Detect that
+                // exact failure and retry in 15s instead of 5 min — bounded, so a
+                // node with no fips daemon falls back to the steady cadence
+                // rather than busy-looping.
+                const STEADY: Duration = Duration::from_secs(300);
+                const FAST: Duration = Duration::from_secs(15);
+                const MAX_FAST_RETRIES: u32 = 8; // ≤2 min of fast retries/episode
+                let mut fast_retries: u32 = 0;
                 loop {
-                    interval.tick().await;
+                    let mut daemon_restarting = false;
                     match crate::fips::anchors::load(&data_dir).await {
                         Ok(list) if !list.is_empty() => {
-                            let _ = crate::fips::anchors::apply(&list).await;
+                            let results = crate::fips::anchors::apply(&list).await;
+                            daemon_restarting = !results.is_empty()
+                                && results
+                                    .iter()
+                                    .all(|r| !r.ok && r.message.contains("control.sock"));
                         }
                         Ok(_) => { /* no seed anchors configured yet */ }
                         Err(e) => {
@@ -717,6 +732,15 @@ impl Server {
                             let _ = crate::fips::anchors::apply(&direct).await;
                         }
                     }
+
+                    let next = if daemon_restarting && fast_retries < MAX_FAST_RETRIES {
+                        fast_retries += 1;
+                        FAST
+                    } else {
+                        fast_retries = 0;
+                        STEADY
+                    };
+                    tokio::time::sleep(next).await;
                 }
             });
         }

docs/HANDOFF-2026-07-20-fips-peer-files.md

@@ -0,0 +1,238 @@
+# Handoff — 2026-07-20 — peer-files diagnosis, FIPS 0.4.1, mobile transport pill
+
+Written for a fresh session that will **cut the OTA release and build the ISO**.
+Everything below is already committed and pushed to `gitea-ai/main`. Last release
+was `v1.7.105-alpha` (`e2f83c01`); the next one should be **`v1.7.106-alpha`**.
+
+---
+
+## 1. What this release carries (3 commits on top of v1.7.105-alpha)
+
+| Commit | What | User-visible? |
+|---|---|---|
+| `9e3ac9ba` | Show the FIPS/Tor transport pill on **mobile** peer files | Yes |
+| `3ab7fb52` | Log the full anyhow error chain on RPC failures | No (diagnostics) |
+| `5fd0d6c3` | Generate `fips.yaml` from typed structs + enable **mDNS LAN discovery** | Indirectly |
+
+### `9e3ac9ba` — mobile transport pill
+`PeerFiles.vue:15` wraps the peer title in `hidden md:block` (the global header
+carries the name on mobile), and the transport pill was nested inside it — so it
+vanished below 768px. Added a separate `md:hidden` pill next to the peer icon.
+Frontend was rebuilt and the class verified present in the emitted bundle.
+
+Caveats worth knowing (pre-existing, not introduced here):
+- On this code path the backend only ever emits `fips` or `tor`, so the `mesh`
+  and `lan` branches in `transportPill` (`PeerFiles.vue:609-627`) are dead.
+- For **received** mesh messages, `mesh/mod.rs:1519-1533` falls back to a
+  hardcoded `"tor"` when the transport is unknown — that pill can genuinely lie.
+  The peer-files pill does not.
+
+### `3ab7fb52` — full error chain in logs
+`api/rpc/mod.rs:441` logged only the outermost anyhow context, so every
+peer-files failure read exactly `RPC error on content.browse-peer: Failed to
+connect to peer` with the real cause discarded. Now `{:#}`. The client-facing
+message still goes through `sanitize_error_message(&e.to_string())` (`{}`), so
+no internal detail leaks. **This fix applies to every RPC method, not just
+browse-peer.**
+
+### `5fd0d6c3` — typed FIPS config + mDNS
+`fips/config.rs` built `/etc/fips/fips.yaml` by `format!`-ing a string literal.
+Upstream's config structs are `#[serde(deny_unknown_fields)]`, so a wrong key
+does not degrade — **the daemon refuses to start and the node leaves the mesh**.
+Now a typed serde struct tree, verified field-by-field against jmcorgan/fips
+**v0.4.1**, with 4 tests: exact-output snapshot, determinism, mDNS key path, and
+the pre-existing schema test. All pass.
+
+Also enables `node.discovery.lan.enabled` (mDNS/DNS-SD, new upstream in v0.4.0)
+so co-located nodes peer directly instead of depending on the public anchor.
+
+> ⚠️ **Expected one-time behaviour on first boot after this lands:** the startup
+> drift check at `server.rs:864` compares the freshly rendered config against
+> what's on disk. The render differs now, so it reinstalls the config and
+> restarts the FIPS daemon **once**. This is the intended self-healing path and
+> settles immediately. Do not mistake it for a regression.
+
+Emitted unconditionally rather than version-gated: v0.3.0's `DiscoveryConfig`
+has no `lan` field **and** no `deny_unknown_fields`, so v0.3.0 daemons ignore it
+harmlessly (verified against the v0.3.0 source). It self-activates on upgrade.
+
+---
+
+## 2. FIPS 0.4.1 — validated, but the fleet is NOT rolled
+
+Fleet was on FIPS **0.3.0 / 0.3.0-dev** (2026-05-11). Upstream is **v0.4.1**
+(2026-07-19). Verified before touching anything:
+
+- **Wire-compatible** 0.3.0 → 0.4.0 → 0.4.1. Rolling upgrade, any order, no flag day.
+- **Config forward-compatible** — every key we emit exists in 0.4.1.
+- **Asset names match** what `fips/update.rs` expects (`fips_<ver>_<arch>.deb` +
+  `checksums-linux.txt`), so the in-product updater should work.
+
+### Upgraded so far (2 of N)
+| Node | Before | After | Result |
+|---|---|---|---|
+| OptiPlex `.198` / `100.114.134.21` | `0.3.0-dev-1` | **0.4.1** | ✅ anchor connected, `is_parent: true`, tree `depth: 4` |
+| thinkpad (this machine) | `0.3.0` | **0.4.1** | ✅ service active, but still islanded (see §4) |
+
+The OptiPlex was still running the **old string-rendered config** and 0.4.1
+accepted it — empirical confirmation of the compat analysis, not just desk work.
+
+### Upgrade recipe (nodes cannot reach GitHub — sideload)
+```bash
+# 1. On a host with GitHub access:
+curl -sL -o fips_0.4.1_amd64.deb \
+  https://github.com/jmcorgan/fips/releases/download/v0.4.1/fips_0.4.1_amd64.deb
+curl -sL -o checksums-linux.txt \
+  https://github.com/jmcorgan/fips/releases/download/v0.4.1/checksums-linux.txt
+sha256sum fips_0.4.1_amd64.deb   # must match checksums-linux.txt
+# expected: 9befcc0990c7e08742b5a88f75d753a1088134b20525156688d559a317334ded
+
+# 2. Sideload:
+scp fips_0.4.1_amd64.deb archipelago@<node>:/tmp/
+
+# 3. On the node — the same command update.rs uses:
+sudo -n systemd-run --collect --wait --quiet --pipe -- \
+  env DEBIAN_FRONTEND=noninteractive dpkg --force-confold --force-downgrade -i \
+  /tmp/fips_0.4.1_amd64.deb
+
+# 4. Restart the ACTIVE unit — it is archipelago-fips.service,
+#    NOT fips.service (which is inactive on these nodes):
+sudo -n systemctl restart archipelago-fips.service
+
+# 5. Verify:
+fipsctl --version
+sudo -n fipsctl show links   # expect anchor 185.18.221.160:8443 connected
+sudo -n fipsctl show tree    # expect is_root: false, depth > 0
+```
+
+### ISO implication (important)
+`image-recipe/build/auto-installer/Dockerfile.rootfs:23` builds FIPS from
+**unpinned upstream main** (`git clone --depth 1`, no rev/tag/checksum, amd64
+only). So a freshly built ISO will pick up whatever main is that day — probably
+≥0.4.1, but it is not deterministic. Pinning is an open item in
+`docs/1.8.0-RELEASE-HARDENING-PLAN.md:319-322`. **Consider pinning to v0.4.1
+before building the release ISO** so the shipped version is knowable.
+
+---
+
+## 3. The original bug — peer cloud files not loading
+
+**Status: root-caused for the thinkpad; NOT fully explained.** Being explicit
+because it would be easy to read this as closed.
+
+What is established:
+- FIPS was fully down on the thinkpad: `fipsctl show peers` → `[]`, `show links`
+  → `[]`, `show tree` → `is_root: true, depth 0`. An island.
+- Cause is **network egress**, not FIPS config: the thinkpad cannot reach the
+  public anchor `185.18.221.160` (`fips.v0l.io`) **at all** — 100% packet loss on
+  ICMP, 443/8443/8668 all time out. `show transports` showed
+  `packets_sent: 760, packets_recv: 0` on both UDP and TCP.
+- Local firewall is **not** the cause (nft/iptables policy `accept`; only stock
+  Tailscale anti-spoof DROPs).
+- The OptiPlex, on the same `/24`, reaches the anchor fine → it's the thinkpad's
+  WiFi segment (`wlp3s0`), which also blocks L2 to `.198` (`ip neigh` → `FAILED`).
+- With no FIPS tree, everything falls back to Tor. Every peer in
+  `federation/nodes.json` reads `last_transport: "tor"`, never `"fips"`.
+- **Tor itself is healthy**: fetched the OptiPlex's `/content` over Tor 3×,
+  HTTP 200 in 4.1–8.5s — well inside the 30s budget at `content.rs:349`.
+
+What is **not** established: why three specific `content.browse-peer` calls
+failed today (05:25, 16:37, 16:43 UTC). Tor tested healthy and was never
+reproduced. Two hypotheses were tested and **disproved**: the Tor fallback logic
+is correct (FIPS-unreachable returns `None` and falls through in Auto mode), and
+the legs get independent timeouts (Tor gets a fresh 30s). Best remaining guess is
+cold-circuit timeouts on first fetch after idle — **a guess, not a finding.**
+`3ab7fb52` means the next occurrence will log the actual cause.
+
+### Corrections to earlier claims in this session
+- "Point FIPS at the Tailscale IP" was **wrong**. FIPS routes by npub; the
+  `ip:port` in `fipsctl connect` is only an underlay endpoint hint.
+- "The public anchor may be dead fleet-wide" was **wrong**. Its peer is healthy
+  (`delivery_ratio` 1.0 both directions, bloom filter syncing). The
+  `bytes_recv: 0` link counters are simply uninstrumented in 0.3.0.
+
+---
+
+## 4. Open items — decisions NOT taken
+
+1. **Second FIPS anchor (user asked for this; not built).** Needs a host running
+   FIPS that is reachable from the restricted WiFi. Candidate found: OVH
+   **`146.59.87.168`** — pings fine from the thinkpad and general egress works
+   (github 200), while the upstream anchor fails even ICMP there. But it does not
+   run FIPS yet, so this means **installing FIPS on the box that hosts Gitea** —
+   a production change, deliberately not made unprompted. Code side is easy after:
+   `fips/anchors.rs:47-50` is a single hardcoded anchor that should become a list
+   (`default_public_anchor()` → `default_public_anchors() -> Vec<SeedAnchor>`).
+2. **Fleet rollout of FIPS 0.4.1** — only 2 nodes done. `.228`
+   (`100.64.204.114`) has been **offline ~20h** and could not be included.
+3. **Deploying the archipelago binary** carrying `5fd0d6c3` — no node has it yet,
+   so mDNS is not actually live anywhere. That is what this OTA is for.
+4. **mDNS caveat:** on the thinkpad's WiFi, multicast may also be blocked, so
+   mDNS may not rescue that particular node even after the OTA. It will help
+   co-located nodes on sane networks.
+5. **Pin FIPS in the ISO build** (see §2) — recommended before the release ISO.
+
+---
+
+## 5. Release ritual (from prior sessions — follow exactly)
+
+Working tree at handoff had pre-existing unrelated dirt: `core/Cargo.lock`,
+`release-manifest.json`, `releases/manifest.json` modified, and an untracked
+`neode-ui/vite.preview.config.mts`. **Stage explicitly by path** — another
+agent may share this tree; never `git add -A`.
+
+```bash
+V=1.7.106-alpha
+
+# Frontend build — MUST verify dist actually changed (build can silently no-op)
+cd neode-ui && npm run build          # → web/dist/neode-ui/
+grep -r "md:hidden" ../web/dist/neode-ui/assets/PeerFiles-*.js   # sanity
+
+# Backend
+cd core && cargo build --release -p archipelago
+# If you hit `rust-lld: undefined hidden symbol`, it's incremental-cache
+# corruption — rebuild with CARGO_INCREMENTAL=0
+
+# Tarball MUST be flat (files at root, no neode-ui/ wrapper) or every fleet UI 403s
+tar -czf releases/v$V/archipelago-frontend-$V.tar.gz -C web/dist/neode-ui .
+tar -tzf releases/v$V/archipelago-frontend-$V.tar.gz | head -3   # ./ then ./index.html
+# Exclude the ~17MB companion APK from tarballs.
+
+# Ship
+scripts/create-release.sh $V
+scripts/publish-release-assets.sh $V gitea-vps2
+git push origin main && git push origin --tags     # tag or the Releases page stays empty
+git push gitea-ai main                              # main is protected; use the `ai` account
+
+# Verify the live manifest
+curl -fsS http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json
+```
+
+Notes: vps2 (`146.59.87.168`) is the **primary** OTA manifest host. Signing is
+done at the **user's TTY** — do not attempt it unattended. Clean `/tmp` first
+(past releases hit ENOSPC). Changelogs must be **layman-readable**, leading with
+user benefit.
+
+### ISO
+```bash
+UNBUNDLED=1 bash image-recipe/build-debian-iso.sh
+```
+ISO builds are **always unbundled** — the default env silently builds the wrong
+full-bundle variant. Only filebrowser + fmcd are baked in. Verify the output
+filename contains `unbundled` and is ≈2.4G. The ISO's frontend source is
+`/opt/archipelago/web-ui` — rsync dist there first and verify **inside** the ISO.
+
+---
+
+## 6. Node access quick reference
+
+- **thinkpad (`.116`) is the local machine** — do not SSH to it; read
+  `journalctl -u archipelago` and `/var/lib/archipelago/**` directly.
+- **OptiPlex `.198`** = Tailscale `archipelago-5` / `100.114.134.21`, user
+  `archipelago`. Its LAN IP is unreachable from the thinkpad — use Tailscale.
+- `.228` = `archipelago-2` / `100.64.204.114` — **offline as of 2026-07-20**, and
+  it is in real use; don't touch uninvited.
+- `archipelago-1` (`100.82.34.38`) is a Ryzen AI Max desktop, **not** the OptiPlex.
+- Nodes have no `sqlite3` — use `sudo -n python3` to read the JSON stores.
+- `fipsctl` needs `sudo -n` (socket is `root:fips` 0660).
+- **Never run `archipelago --version` on fleet nodes** (deployed binaries predate #74).

image-recipe/_archived/build-auto-installer-iso.sh

@@ -254,17 +254,29 @@ container_pull() {
 echo "📦 Step 1: Building root filesystem..."
 
 ROOTFS_TAR="$WORK_DIR/archipelago-rootfs.tar"
+ROOTFS_STAMP="$WORK_DIR/archipelago-rootfs.recipe.sha256"
 
-if [ ! -f "$ROOTFS_TAR" ] || [ "$1" == "--rebuild" ]; then
+# The cached rootfs must be invalidated when its recipe changes: a stale
+# archipelago-rootfs.tar on the build machine shipped ISOs with NO
+# wpasupplicant/iw/rfkill (WiFi dead on laptops) long after those packages
+# were added to the Dockerfile below — the cache condition never looked at
+# the recipe. Hash the rootfs-defining region of this script; any edit to it
+# forces a rebuild. `--rebuild` still forces one unconditionally.
+RECIPE_HASH=$(sed -n '/^# STEP 1: Build complete root filesystem/,/^# STEP 2: Build minimal installer/p' "$0" | sha256sum | cut -d' ' -f1)
+
+if [ ! -f "$ROOTFS_TAR" ] || [ "${1:-}" == "--rebuild" ] || [ "$(cat "$ROOTFS_STAMP" 2>/dev/null)" != "$RECIPE_HASH" ]; then
     echo "   Using Docker to create Debian root filesystem..."
     
     # Create a Dockerfile for building the rootfs
     cat > "$WORK_DIR/Dockerfile.rootfs" <<DOCKERFILE
-# ─── Stage 1: Build the FIPS mesh daemon .deb from upstream main ─────────
+# ─── Stage 1: Build the FIPS mesh daemon .deb at a pinned tag ────────────
 #
 # FIPS (github.com/jmcorgan/fips) is a fast Nostr-keyed mesh routing
-# protocol archipelago uses as its preferred non-Tor transport. We track
-# upstream main per project decision (2026-04) — v0.2.0 isn't stable yet.
+# protocol archipelago uses as its preferred non-Tor transport.
+# Pinned so the shipped version is knowable: an unpinned --depth 1 clone of
+# main made every ISO carry whatever upstream happened to be that day.
+# v0.4.1 is the version fips/config.rs renders its typed config against and
+# the one validated in the field. Bump the two together.
 # The .deb is rebuilt every ISO build; Docker layer caching keeps the
 # incremental cost low. Failure here fails the ISO build on purpose:
 # we don't want to ship an ISO that silently skips FIPS.
@@ -282,7 +294,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \\
     clang libclang-dev libnftnl-dev libmnl-dev \\
     && rm -rf /var/lib/apt/lists/*
 RUN cargo install --locked cargo-deb
-RUN git clone --depth 1 https://github.com/jmcorgan/fips.git /src/fips
+ARG FIPS_VERSION=v0.4.1
+RUN git clone --depth 1 --branch "\$FIPS_VERSION" \\
+    https://github.com/jmcorgan/fips.git /src/fips
 WORKDIR /src/fips
 # fips-gateway is gated behind the `gateway` Cargo feature (depends on
 # `rustables`). Without the feature, cargo doesn't build it, and
@@ -370,6 +384,7 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     chromium \
     unclutter \
     fonts-liberation \
+    fonts-noto-color-emoji \
     xfonts-base \
     plymouth \
     plymouth-themes \
@@ -694,6 +709,7 @@ SYSTEMDSERVICE
     $CONTAINER_CMD export archipelago-rootfs-tmp > "$ROOTFS_TAR"
     $CONTAINER_CMD rm archipelago-rootfs-tmp
     
+    echo "$RECIPE_HASH" > "$ROOTFS_STAMP"
     echo "✅ Root filesystem created: $(du -h "$ROOTFS_TAR" | cut -f1)"
 else
     echo "✅ Using cached root filesystem: $(du -h "$ROOTFS_TAR" | cut -f1)"
@@ -1168,39 +1184,13 @@ BACKENDFILE
     fi
 fi
 
-# Extract NostrVPN binary from container image (native system service, not a container app)
-# NOTE: The container image must be built against Debian 13's GLIBC (2.40).
-# If built against a newer GLIBC, the binary will fail at runtime.
-# Rebuild with: FROM debian:13 AS builder
-echo "   Extracting NostrVPN binary..."
-_NVPN_IMG="${NOSTR_VPN_IMAGE:-146.59.87.168:3000/lfg2025/nostr-vpn:v0.3.7}"
-NVPN_IMAGE_ID="$($CONTAINER_CMD images -q "$_NVPN_IMG" 2>/dev/null)"
-if [ -z "$NVPN_IMAGE_ID" ]; then
-    $CONTAINER_CMD pull "$_NVPN_IMG" 2>/dev/null || true
-fi
-NVPN_CONTAINER=$($CONTAINER_CMD create "$_NVPN_IMG" 2>/dev/null) || true
-if [ -n "$NVPN_CONTAINER" ]; then
-    $CONTAINER_CMD cp "$NVPN_CONTAINER:/usr/local/bin/nvpn" "$ARCH_DIR/bin/nvpn" 2>/dev/null && \
-        chmod +x "$ARCH_DIR/bin/nvpn" && \
-        echo "   ✅ NostrVPN binary extracted ($(du -h "$ARCH_DIR/bin/nvpn" | cut -f1))"
-    $CONTAINER_CMD rm "$NVPN_CONTAINER" 2>/dev/null || true
-    # Check GLIBC compatibility — Debian 13 (Trixie) has GLIBC 2.40
-    if [ -f "$ARCH_DIR/bin/nvpn" ]; then
-        NVPN_GLIBC=$(objdump -T "$ARCH_DIR/bin/nvpn" 2>/dev/null | grep -oP 'GLIBC_\K[0-9.]+' | sort -V | tail -1)
-        if [ -n "$NVPN_GLIBC" ]; then
-            # Compare: if required GLIBC > 2.40, warn
-            if printf '%s\n' "2.40" "$NVPN_GLIBC" | sort -V | tail -1 | grep -qv "^2\.40$"; then
-                echo "   ⚠  WARNING: nvpn binary requires GLIBC $NVPN_GLIBC but Debian 13 has 2.40"
-                echo "   ⚠  The nvpn daemon will fail at runtime. Rebuild the container against Debian 13."
-                echo "   ⚠  VPN invite/status will still work via Rust backend config.toml fallback."
-            else
-                echo "   ✅ nvpn GLIBC compatibility OK (requires $NVPN_GLIBC, target has 2.40)"
-            fi
-        fi
-    fi
-else
-    echo "   ⚠  NostrVPN image not available — nvpn binary will be missing"
-fi
+# NostrVPN (the native `nvpn` mesh-VPN daemon) has been removed from the
+# product — the active VPN path is WireGuard/Tailscale (see core vpn.rs). Its
+# service is already masked below (ln -sf /dev/null nostr-vpn.service) and the
+# binary is never spawned at runtime, so we no longer extract it. The
+# nostr-vpn image was deleted from the registry, which is why hard-requiring
+# it here bricked the build. Intentionally left out; do not re-add without
+# restoring the daemon.
 
 # Extract nostr-rs-relay binary from container image (native system service for VPN signaling)
 echo "   Extracting nostr-rs-relay binary..."
@@ -1210,7 +1200,11 @@ if [ -z "$RELAY_IMAGE" ]; then
 fi
 RELAY_CONTAINER=$($CONTAINER_CMD create 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0 2>/dev/null) || true
 if [ -n "$RELAY_CONTAINER" ]; then
-    $CONTAINER_CMD cp "$RELAY_CONTAINER:/usr/local/bin/nostr-rs-relay" "$ARCH_DIR/bin/nostr-rs-relay" 2>/dev/null && \
+    # The relay image builds to its WORKDIR /usr/src/app and execs
+    # ./nostr-rs-relay from there (not /usr/local/bin — that path was from an
+    # older image build and silently broke extraction once the image was
+    # rebuilt to the standard layout).
+    $CONTAINER_CMD cp "$RELAY_CONTAINER:/usr/src/app/nostr-rs-relay" "$ARCH_DIR/bin/nostr-rs-relay" 2>/dev/null && \
         chmod +x "$ARCH_DIR/bin/nostr-rs-relay" && \
         echo "   ✅ nostr-rs-relay binary extracted ($(du -h "$ARCH_DIR/bin/nostr-rs-relay" | cut -f1))"
     $CONTAINER_CMD rm "$RELAY_CONTAINER" 2>/dev/null || true
@@ -1218,6 +1212,23 @@ else
     echo "   ⚠  nostr-rs-relay image not available — relay binary will be missing"
 fi
 
+# A missing nostr-rs-relay used to be a warning, and the resulting ISO shipped
+# an enabled nostr-relay unit that crash-looped on every install. Refuse to
+# produce that ISO unless explicitly overridden. (nvpn is intentionally no
+# longer required — NostrVPN was removed; see the note above.)
+MISSING_VPN_BINARIES=""
+[ -f "$ARCH_DIR/bin/nostr-rs-relay" ] || MISSING_VPN_BINARIES="$MISSING_VPN_BINARIES nostr-rs-relay"
+if [ -n "$MISSING_VPN_BINARIES" ]; then
+    if [ "${ALLOW_MISSING_VPN_BINARIES:-0}" = "1" ]; then
+        echo "   ⚠  Building WITHOUT:$MISSING_VPN_BINARIES (ALLOW_MISSING_VPN_BINARIES=1)"
+    else
+        echo "   ❌ Required binaries not extracted:$MISSING_VPN_BINARIES"
+        echo "      The registry (146.59.87.168:3000) must be reachable and hold the images,"
+        echo "      or set ALLOW_MISSING_VPN_BINARIES=1 to ship without VPN signaling."
+        exit 1
+    fi
+fi
+
 # Copy WireGuard helper script
 if [ -f "$WORK_DIR/archipelago-wg" ]; then
     cp "$WORK_DIR/archipelago-wg" "$ARCH_DIR/bin/archipelago-wg"
@@ -1658,17 +1669,17 @@ LOG="/var/log/archipelago-tor.log"
 
 mkdir -p "$ARCHY_TOR_DIR" "$TOR_CONFIG_DIR"
 
-# Write services.json for the backend to read
+# First boot only: seed services.json + torrc. The unit runs on EVERY boot
+# (oneshot, multi-user.target), and rewriting these unconditionally clobbered
+# hidden services the backend added after app installs. Only the node's own
+# service is pre-baked — apps get their hidden service created on install
+# (auto_add_tor_service / tor.create-service), never pre-created for apps
+# that may never be installed (issue #79).
+if [ ! -f "$TOR_CONFIG_DIR/services.json" ]; then
 cat > "$ARCHY_TOR_DIR/services.json" <<TORJSON
 {
   "services": [
-    {"name": "archipelago", "local_port": 80, "enabled": true},
-    {"name": "bitcoin", "local_port": 8333, "enabled": true},
-    {"name": "electrumx", "local_port": 50001, "enabled": true},
-    {"name": "lnd", "local_port": 9735, "enabled": true},
-    {"name": "btcpay", "local_port": 23000, "enabled": true},
-    {"name": "mempool", "local_port": 4080, "enabled": true},
-    {"name": "fedimint", "local_port": 8175, "enabled": true}
+    {"name": "archipelago", "local_port": 80, "enabled": true}
   ]
 }
 TORJSON
@@ -1688,33 +1699,16 @@ SocksPolicy reject *
 HiddenServiceDir $TOR_DIR/hidden_service_archipelago
 HiddenServicePort 80 127.0.0.1:80
 
-HiddenServiceDir $TOR_DIR/hidden_service_bitcoin
-HiddenServicePort 8333 127.0.0.1:8333
-HiddenServicePort 8332 127.0.0.1:8332
-
-HiddenServiceDir $TOR_DIR/hidden_service_electrumx
-HiddenServicePort 50001 127.0.0.1:50001
-
-HiddenServiceDir $TOR_DIR/hidden_service_lnd
-HiddenServicePort 9735 127.0.0.1:9735
-HiddenServicePort 8080 127.0.0.1:8080
-
-HiddenServiceDir $TOR_DIR/hidden_service_btcpay
-HiddenServicePort 23000 127.0.0.1:23000
-
-HiddenServiceDir $TOR_DIR/hidden_service_mempool
-HiddenServicePort 4080 127.0.0.1:4080
-
-HiddenServiceDir $TOR_DIR/hidden_service_fedimint
-HiddenServicePort 8175 127.0.0.1:8175
-
 HiddenServiceDir $TOR_DIR/hidden_service_relay
 HiddenServicePort 7777 127.0.0.1:7777
 TORRC
+else
+    echo "$(date): tor already initialized — leaving services.json/torrc alone" >> "$LOG"
+fi
 
 # Create hidden service dirs with correct ownership and permissions (700, not 750)
 # Tor refuses to start if permissions are too permissive
-for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint relay; do
+for svc in archipelago relay; do
     mkdir -p "$TOR_DIR/hidden_service_$svc"
     chown debian-tor:debian-tor "$TOR_DIR/hidden_service_$svc"
     chmod 700 "$TOR_DIR/hidden_service_$svc"
@@ -1759,7 +1753,7 @@ done
 # Sync hostnames to backend-readable directory
 HOSTNAMES_DIR="/var/lib/archipelago/tor-hostnames"
 mkdir -p "$HOSTNAMES_DIR"
-for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint relay; do
+for svc in archipelago relay; do
     if [ -f "$TOR_DIR/hidden_service_${svc}/hostname" ]; then
         cp "$TOR_DIR/hidden_service_${svc}/hostname" "$HOSTNAMES_DIR/$svc"
         echo "$(date): Synced hostname: $svc" >> "$LOG"
@@ -2497,6 +2491,17 @@ HandleLidSwitchExternalPower=ignore
 HandleLidSwitchDocked=ignore
 LIDCONF
 
+# Kiosk appliance: a short press or accidental brush of the power button used
+# to shut the node down instantly (confirmed on a Framework node — "Power key
+# pressed short -> Powering off"). Ignore the short press; keep a deliberate
+# long press (hold ~2s) as the intentional power-off, so the node isn't taken
+# down by accident but can still be shut down on purpose without a keyboard.
+cat > /mnt/target/etc/systemd/logind.conf.d/power-key.conf <<'PWRCONF'
+[Login]
+HandlePowerKey=ignore
+HandlePowerKeyLongPress=poweroff
+PWRCONF
+
 # Copy Archipelago binaries and files
 if [ -d "$BOOT_MEDIA/archipelago/bin" ]; then
     cp -r "$BOOT_MEDIA/archipelago/bin/"* /mnt/target/usr/local/bin/ 2>/dev/null || true
@@ -2656,6 +2661,11 @@ if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
     W='\033[1;37m'
     N='\033[0m'
 
+    # The logo uses UTF-8 block-drawing glyphs. Switching back from the kiosk
+    # (Xorg on vt1) can leave the console VT out of UTF-8 mode, which renders
+    # them as garbage bytes ("sometimes corrupt"). ESC % G forces the VT into
+    # UTF-8 mode so the logo always draws correctly.
+    printf '\033%%G' 2>/dev/null || true
     clear
     echo -e "  ${O}▄▀█ █▀▄ █▀▀ █ █ █ █▀█ █▀▀ █   ▄▀█ █▀▀ █▀█${N}"
     echo -e "  ${O}█▀█ █▀▄ █   █▀█ █ █▀▀ ██▀ █   █▀█ █ █ █ █${N}"
@@ -2671,10 +2681,14 @@ if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
     if [ -b /dev/mapper/archipelago-data ] || [ -b /dev/mapper/archipelago_crypt ]; then
         echo -e "  ${OD}storage   LUKS2 encrypted${N}"
     fi
+    # The kiosk's Xorg runs on vt1 (see archipelago-kiosk-launcher: "Xorg :0
+    # vt1"), so Ctrl+Alt+F1 IS the kiosk and a terminal is on another VT (F2,
+    # where systemd auto-spawns a getty). The old hints had these backwards —
+    # they sent you to an empty black VT7 and there was no way back to the kiosk.
     if systemctl is-active archipelago-kiosk.service >/dev/null 2>&1; then
-        echo -e "  ${OD}display   Kiosk active (Ctrl+Alt+F1 for terminal)${N}"
+        echo -e "  ${OD}display   Kiosk active (Ctrl+Alt+F2 for terminal)${N}"
     else
-        echo -e "  ${OD}display   Console (Ctrl+Alt+F7 for kiosk)${N}"
+        echo -e "  ${OD}display   Console (Ctrl+Alt+F1 for kiosk)${N}"
     fi
     echo ""
 fi
@@ -3345,6 +3359,11 @@ echo ""
 echo "=== Done ==="
 DIAGSCRIPT
 chmod +x /mnt/target/opt/archipelago/scripts/first-boot-diag.sh
+# v1.7.104 shipped installs where this script was missing while its unit was
+# enabled (203/EXEC forever). Verify the write actually landed, loudly.
+if [ ! -x /mnt/target/opt/archipelago/scripts/first-boot-diag.sh ]; then
+    echo "ERROR: first-boot-diag.sh was not written to the target" >&2
+fi
 
 # Systemd oneshot service for first-boot diagnostics
 cat > /mnt/target/etc/systemd/system/archipelago-diag.service <<'DIAGSVC'
@@ -3352,6 +3371,8 @@ cat > /mnt/target/etc/systemd/system/archipelago-diag.service <<'DIAGSVC'
 Description=Archipelago First Boot Diagnostics
 After=multi-user.target archipelago.service nginx.service
 ConditionPathExists=!/var/log/archipelago-first-boot-diag.log
+# Skip cleanly (instead of failing 203/EXEC) if the script is missing.
+ConditionPathExists=/opt/archipelago/scripts/first-boot-diag.sh
 
 [Service]
 Type=oneshot

image-recipe/configs/archipelago-kiosk-launcher.sh

@@ -22,6 +22,11 @@ if [ "$X_READY" != "true" ]; then
     exit 1
 fi
 
+# Settings-managed display overrides (system.kiosk-display.set writes this
+# file, then restarts the kiosk): may set ARCHIPELAGO_KIOSK_SCALE,
+# ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH or ARCHIPELAGO_KIOSK_MAX_WIDTH.
+[ -f /etc/archipelago/kiosk-display.conf ] && . /etc/archipelago/kiosk-display.conf
+
 KIOSK_SAFE_AREA_X_PX=${ARCHIPELAGO_KIOSK_SAFE_AREA_X_PX:-}
 KIOSK_SAFE_AREA_Y_PX=${ARCHIPELAGO_KIOSK_SAFE_AREA_Y_PX:-}
 
@@ -54,6 +59,25 @@ configure_display() {
     ' /tmp/archipelago-kiosk-xrandr.txt)
     [ -n "$mode" ] || mode=1920x1080
 
+    # Optional resolution cap for weak hardware: ARCHIPELAGO_KIOSK_MAX_WIDTH=1920
+    # drops a 4K panel to its best <=1920-wide mode (the TV upscales) so the
+    # software rasterizer paints 1/4 the pixels. Off by default — native mode
+    # is sharp and fits the tile budget now that --window-size is in DIPs.
+    local max_w=${ARCHIPELAGO_KIOSK_MAX_WIDTH:-0}
+    if [ "$max_w" -gt 0 ] 2>/dev/null && [ "${mode%x*}" -gt "$max_w" ] 2>/dev/null; then
+        local capped
+        capped=$(awk -v out="$output" -v maxw="$max_w" '
+            $1 == out { active = 1; next }
+            active && /^[[:space:]]+[0-9]+x[0-9]+/ {
+                split($1, wh, "x")
+                if (wh[1] + 0 <= maxw && wh[1] + 0 > best_w) { best_w = wh[1] + 0; best = $1 }
+            }
+            active && /^[^[:space:]]/ { active = 0 }
+            END { if (best) print best }
+        ' /tmp/archipelago-kiosk-xrandr.txt)
+        [ -n "$capped" ] && mode=$capped
+    fi
+
     # Kiosk should use one native output. A spanning desktop makes Chromium land
     # on the laptop panel or stretch across both outputs.
     for internal in $(awk '/ connected/ && $1 ~ /^eDP|^LVDS/{print $1}' /tmp/archipelago-kiosk-xrandr.txt); do
@@ -82,6 +106,40 @@ configure_display() {
 
 configure_display
 
+# --- Kiosk UI scaling for large / high-res displays -----------------------
+# REVERT: set env ARCHIPELAGO_KIOSK_SCALE=1 (per-node, no rebuild), or restore
+# the hardcoded --force-device-scale-factor=1 below to disable entirely.
+#
+# A big TV reports its full native resolution as the CSS viewport, so a 4K
+# panel becomes a 3840px-wide viewport and the UI renders tiny — and a
+# keyboard-less kiosk can't zoom. Derive Chromium's device-scale-factor from
+# the detected panel width so the *effective* CSS viewport lands near a
+# comfortable target. Panels >=2560 wide get a 1920-wide layout (4K -> scale
+# 2.0 — user-validated on a 72" TV: spacious desktop layout, 2x sharp);
+# smaller panels get a 1280-wide layout (1920 -> 1.50, laptops -> 1.0).
+if [ -z "${ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH:-}" ]; then
+    if [ "$KIOSK_MODE_W" -ge 2560 ] 2>/dev/null; then
+        ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920
+    else
+        ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280
+    fi
+fi
+KIOSK_TARGET_CSS_WIDTH=$ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH
+if [ -n "${ARCHIPELAGO_KIOSK_SCALE:-}" ]; then
+    KIOSK_SCALE=$ARCHIPELAGO_KIOSK_SCALE
+else
+    KIOSK_SCALE=$(awk -v w="$KIOSK_MODE_W" -v t="$KIOSK_TARGET_CSS_WIDTH" \
+        'BEGIN{if(t<=0)t=1280; s=w/t; s=int(s*4+0.5)/4; if(s<1)s=1; if(s>3)s=3; printf "%.2f", s}')
+fi
+
+# Chromium's --window-size is in DIPs (CSS px), not physical pixels: at scale S
+# the window paints S x larger. This X session has no window manager, so
+# --kiosk/--start-fullscreen cannot snap an oversized window back to the panel
+# — it just hangs off the right/bottom edges (content cropped, background art
+# offscreen). Size the window in DIPs so DIPs x scale = the panel exactly.
+KIOSK_WIN_W=$(awk -v w="$KIOSK_MODE_W" -v s="$KIOSK_SCALE" 'BEGIN{printf "%d", w/s}')
+KIOSK_WIN_H=$(awk -v h="$KIOSK_MODE_H" -v s="$KIOSK_SCALE" 'BEGIN{printf "%d", h/s}')
+
 xhost +SI:localuser:archipelago 2>/dev/null || true
 xsetroot -solid black 2>/dev/null || true
 xset s off 2>/dev/null || true
@@ -116,8 +174,17 @@ while true; do
     # backend can't find PipeWire-Pulse's socket at /run/user/<uid>/pulse/native,
     # falls back to raw ALSA "default", fails to connect, and produces no audio
     # at all with no visible error (--noerrdialogs suppresses it).
-    sudo -u archipelago env DISPLAY=:0 HOME=/home/archipelago XDG_RUNTIME_DIR=/run/user/$ARCHIPELAGO_UID chromium --kiosk \
+    # Force a DARK color-scheme preference. The main UI hardcodes its dark
+    # theme, but the bundled AIUI app themes via `@media (prefers-color-scheme)`
+    # and defaults to its LIGHT variant (white panels) when the browser reports
+    # no preference — which a minimal kiosk X session does. Two independent dark
+    # signals so this survives a Chromium enum change: GTK_THEME is version-
+    # independent and can never force light (worst case: no effect), and the
+    # blink-settings flag (0 = kDark in modern Chromium) reinforces it. Neither
+    # can regress the always-dark main UI.
+    sudo -u archipelago env DISPLAY=:0 HOME=/home/archipelago GTK_THEME=Adwaita:dark XDG_RUNTIME_DIR=/run/user/$ARCHIPELAGO_UID chromium --kiosk \
       --app=http://localhost/kiosk?safe_area_x=${KIOSK_SAFE_AREA_X_PX:-0}\&safe_area_y=${KIOSK_SAFE_AREA_Y_PX:-0} \
+      --blink-settings=preferredColorScheme=0 \
       --noerrdialogs \
       --disable-infobars \
       --disable-translate \
@@ -130,10 +197,10 @@ while true; do
       --disable-component-update \
       $GPU_FLAGS \
       --renderer-process-limit=2 \
-      --window-size=${KIOSK_MODE_W},${KIOSK_MODE_H} \
+      --window-size=${KIOSK_WIN_W},${KIOSK_WIN_H} \
       --window-position=0,0 \
       --start-fullscreen \
-      --force-device-scale-factor=1 \
+      --force-device-scale-factor=${KIOSK_SCALE} \
       --disable-background-networking \
       --disable-background-timer-throttling \
       --disable-backgrounding-occluded-windows \

image-recipe/configs/nostr-relay.service

@@ -3,6 +3,9 @@ Description=Archipelago Private Nostr Relay
 After=network-online.target
 Wants=network-online.target
 Before=nostr-vpn.service
+# An ISO built without the relay binary (registry unreachable at build time)
+# must not crash-loop every 3s forever — skip cleanly instead.
+ConditionPathExists=/usr/local/bin/nostr-rs-relay
 
 [Service]
 Type=simple

image-recipe/configs/nostr-vpn.service

@@ -4,6 +4,9 @@ After=network-online.target tor.service archipelago.service
 Wants=network-online.target
 StartLimitIntervalSec=300
 StartLimitBurst=10
+# An ISO built without the nvpn binary (registry unreachable at build time)
+# must not restart-loop — skip cleanly instead.
+ConditionPathExists=/usr/local/bin/nvpn
 
 [Service]
 Type=simple

neode-ui/package-lock.json

@@ -1,22 +1,25 @@
 {
   "name": "neode-ui",
-  "version": "1.7.104-alpha",
+  "version": "1.7.110-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.104-alpha",
+      "version": "1.7.110-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",
+        "buffer": "^6.0.3",
         "d3": "^7.9.0",
         "dompurify": "^3.3.3",
         "fast-json-patch": "^3.1.1",
         "fuse.js": "^7.1.0",
         "leaflet": "^1.9.4",
         "pinia": "^3.0.4",
+        "qr-scanner": "^1.4.2",
         "qrcode": "^1.5.4",
+        "qrloop": "^1.4.1",
         "vue": "^3.5.24",
         "vue-i18n": "^11.3.0",
         "vue-router": "^4.6.3"
@@ -3896,6 +3899,12 @@
         "undici-types": "~7.16.0"
       }
     },
+    "node_modules/@types/offscreencanvas": {
+      "version": "2019.7.3",
+      "resolved": "https://registry.npmjs.org/@types/offscreencanvas/-/offscreencanvas-2019.7.3.tgz",
+      "integrity": "sha512-ieXiYmgSRXUDeOntE1InxjWyvEelZGP63M+cGuquuRLuIKKT1osnkXjxev9B7d1nXSug5vpunx+gNlbVxMlC9A==",
+      "license": "MIT"
+    },
     "node_modules/@types/qrcode": {
       "version": "1.5.6",
       "resolved": "https://registry.npmjs.org/@types/qrcode/-/qrcode-1.5.6.tgz",
@@ -4727,7 +4736,6 @@
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
       "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -4801,6 +4809,31 @@
         "readable-stream": "^3.4.0"
       }
     },
+    "node_modules/bl/node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
     "node_modules/body-parser": {
       "version": "1.20.4",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
@@ -4901,10 +4934,9 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -4922,7 +4954,7 @@
       "license": "MIT",
       "dependencies": {
         "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "ieee754": "^1.2.1"
       }
     },
     "node_modules/buffer-from": {
@@ -5099,6 +5131,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/charenc": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz",
+      "integrity": "sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/check-error": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.3.tgz",
@@ -5499,6 +5540,15 @@
         "node": ">= 8"
       }
     },
+    "node_modules/crypt": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz",
+      "integrity": "sha512-mCxBlsHFYh9C+HVpiEacem8FEBnMXgU9gy4zmNC+SXAZNB/1idgp/aulFJ4FgCi7GPEVbfyng092GqL2k2rmow==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/crypto-random-string": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
@@ -7408,7 +7458,6 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
       "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -7564,6 +7613,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-buffer": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
+      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
+      "license": "MIT"
+    },
     "node_modules/is-callable": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
@@ -8358,6 +8413,17 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/md5": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz",
+      "integrity": "sha512-T1GITYmFaKuO91vxyoQMFETst+O71VUPEU3ze5GNzDm0OWdP8v1ziTaAEPUr/3kLsY3Sftgz242A1SetQiDL7g==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "charenc": "0.0.2",
+        "crypt": "0.0.2",
+        "is-buffer": "~1.1.6"
+      }
+    },
     "node_modules/media-typer": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -9193,6 +9259,15 @@
         "node": ">=6"
       }
     },
+    "node_modules/qr-scanner": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/qr-scanner/-/qr-scanner-1.4.2.tgz",
+      "integrity": "sha512-kV1yQUe2FENvn59tMZW6mOVfpq9mGxGf8l6+EGaXUOd4RBOLg7tRC83OrirM5AtDvZRpdjdlXURsHreAOSPOUw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/offscreencanvas": "^2019.6.4"
+      }
+    },
     "node_modules/qrcode": {
       "version": "1.5.4",
       "resolved": "https://registry.npmjs.org/qrcode/-/qrcode-1.5.4.tgz",
@@ -9317,6 +9392,16 @@
         "node": ">=6"
       }
     },
+    "node_modules/qrloop": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/qrloop/-/qrloop-1.4.1.tgz",
+      "integrity": "sha512-LXkwCl1Qd8imTHb+KqjMn+cHmuncyFT81AXoooWJvbG3+g9q61l9udSRPgY4cgl+5goQHuAK4teEdUF6UErYXw==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^6.0.3",
+        "md5": "^2.3.0"
+      }
+    },
     "node_modules/qs": {
       "version": "6.14.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.104-alpha",
+  "version": "1.7.110-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",
@@ -26,13 +26,16 @@
   "dependencies": {
     "@types/dompurify": "^3.0.5",
     "@vue-leaflet/vue-leaflet": "^0.10.1",
+    "buffer": "^6.0.3",
     "d3": "^7.9.0",
     "dompurify": "^3.3.3",
     "fast-json-patch": "^3.1.1",
     "fuse.js": "^7.1.0",
     "leaflet": "^1.9.4",
     "pinia": "^3.0.4",
+    "qr-scanner": "^1.4.2",
     "qrcode": "^1.5.4",
+    "qrloop": "^1.4.1",
     "vue": "^3.5.24",
     "vue-i18n": "^11.3.0",
     "vue-router": "^4.6.3"

neode-ui/public/assets/img/app-icons/pine.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="Pine">
+  <rect width="512" height="512" fill="#ffffff"/>
+  <g fill="#000000">
+    <!-- trunk -->
+    <rect x="236" y="396" width="40" height="72" rx="6"/>
+    <!-- three tiers of the evergreen, top to bottom -->
+    <path d="M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z"/>
+    <path d="M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z"/>
+    <path d="M256 262 L392 430 L120 430 L256 262 Z"/>
+  </g>
+</svg>

neode-ui/public/catalog.json

@@ -370,6 +370,17 @@
         ]
       }
     },
+    {
+      "id": "pine",
+      "title": "Pine",
+      "version": "1.1.1",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
+      "icon": "/assets/img/app-icons/pine.svg",
+      "author": "Archipelago",
+      "category": "home",
+      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "repoUrl": "https://github.com/rhasspy/wyoming"
+    },
     {
       "id": "grafana",
       "title": "Grafana",

neode-ui/src/App.vue

@@ -131,6 +131,13 @@ function syncKioskSafeArea() {
   // (--in-process-gpu / --disable-gpu), where heavy compositing effects
   // (3D bg layers, animated mix-blend overlays) fail and paint black.
   document.documentElement.classList.toggle('kiosk-mode', isKiosk)
+  if (isKiosk) {
+    // AIUI (same-origin iframe) themes from localStorage['aiui-theme'], and a
+    // stored value beats its prefers-color-scheme fallback. Kiosk profiles
+    // that ran before the launcher forced a dark color-scheme have "light"
+    // baked in — white panels on an otherwise dark TV UI — so pin it dark.
+    try { localStorage.setItem('aiui-theme', 'dark') } catch { /* storage full/denied */ }
+  }
   const rawSafeArea = localStorage.getItem('archipelago_kiosk_safe_area_px') || '0'
   const safeArea = /^\d{1,3}$/.test(rawSafeArea) ? Number(rawSafeArea) : 0
   const rawSafeAreaX = localStorage.getItem('archipelago_kiosk_safe_area_x_px') || rawSafeArea
@@ -152,13 +159,12 @@ watch(() => appStore.isAuthenticated, (authenticated) => {
   if (authenticated) {
     messageToast.startPolling()
     screensaverStore.resetInactivityTimer()
-    // Don't start relay on kiosk — kiosk gets input via xdotool (system-level),
-    // relay would duplicate every keystroke/click as DOM events
-    const isKiosk = localStorage.getItem('kiosk') === 'true'
-      || new URLSearchParams(window.location.search).has('kiosk')
-    if (!isKiosk) {
-      startRemoteRelay()
-    }
+    // Kiosk included: the backend's remote-input path is relay-only (it
+    // validates and broadcasts; it never runs xdotool), so the browser-side
+    // relay is the ONLY consumer of companion input. Skipping it on kiosk —
+    // an assumption from a long-gone system-level xdotool injector — left
+    // TVs deaf to the companion remote.
+    startRemoteRelay()
   } else {
     messageToast.stopPolling()
     toastMessage.value = { show: false, text: '', fromPubkey: '' }
@@ -424,10 +430,14 @@ onMounted(async () => {
   const { IS_DEMO } = await import('@/composables/useDemoIntro')
   if (IS_DEMO && bootPath === '/') replayRequested = true
   let onboardingComplete: boolean | null = localStorage.getItem('neode_onboarding_complete') === '1' ? true : null
-  const splashCandidate = !seenIntro
-    && (fromBoot || (bootPath === '/' && import.meta.env.VITE_DEV_MODE !== 'boot'))
+  // Root boots always ask the backend — even when this browser thinks it has
+  // seen the intro. Both `neode_intro_seen` and `neode_onboarding_complete`
+  // are per-origin browser state: after a reinstall (or another node coming
+  // up on a DHCP-recycled IP) they describe the PREVIOUS node and would mute
+  // a fresh install's intro / misroute it to login.
+  const splashCandidate = fromBoot || (bootPath === '/' && import.meta.env.VITE_DEV_MODE !== 'boot')
 
-  if (splashCandidate && onboardingComplete !== true) {
+  if (splashCandidate) {
     try {
       const { checkOnboardingStatus } = await import('@/composables/useOnboarding')
       // Bound the pre-splash status check: its retry ladder can spend ~30s
@@ -437,10 +447,17 @@ onMounted(async () => {
       // the splash play (a fresh install IS the slow-backend case; onboarded
       // nodes answer in milliseconds, so their suppression path is intact).
       // handleSplashComplete re-checks with full retries after the intro.
-      onboardingComplete = await Promise.race([
+      const live = await Promise.race([
         checkOnboardingStatus(),
         new Promise<null>((resolve) => setTimeout(() => resolve(null), 2500)),
       ])
+      if (live !== null) onboardingComplete = live
+      if (live === false && seenIntro) {
+        // Backend-confirmed fresh node behind a browser with a stale flag —
+        // drop it so this boot (and every later one) plays the intro.
+        try { localStorage.removeItem('neode_intro_seen') } catch { /* noop */ }
+        seenIntro = false
+      }
     } catch {
       onboardingComplete = localStorage.getItem('neode_onboarding_complete') === '1' ? true : null
     }

neode-ui/src/components/CompanionIntroOverlay.vue

@@ -161,6 +161,14 @@
                 </div>
               </div>
               <p v-if="wgError" class="text-xs text-red-400 text-center mb-3">{{ wgError }}</p>
+              <button
+                v-if="wgError && !wgLoading"
+                type="button"
+                class="inline-flex w-full items-center justify-center rounded-lg bg-white/5 border border-white/15 px-4 py-2.5 text-sm font-medium text-white/80 hover:bg-white/10 hover:text-white transition-colors mb-3"
+                @click="retryWgPeer"
+              >
+                Try again
+              </button>
 
               <!-- Same-device path: a phone can't scan its own screen, so offer
                    the config as a file WireGuard can import. -->
@@ -318,7 +326,15 @@ const POST_INTRO_GRACE_MS = 2000
 
 let calmTicker: ReturnType<typeof setInterval> | null = null
 
+// Running inside the companion app's own WebView (it injects this JS bridge).
+// The "get the companion app" pitch is nonsense there — the user is already in
+// it — and the WG steps mid-pairing race the phone's changing network (the
+// "Failed to fetch" dead-end QR). Server/tunnel management for connected
+// companions lives in the NESMenu instead.
+const IN_COMPANION_APP = typeof (window as { ArchipelagoNative?: unknown }).ArchipelagoNative !== 'undefined'
+
 onMounted(() => {
+  if (IN_COMPANION_APP) return
   try {
     if (localStorage.getItem(STORAGE_KEY) !== '1') {
       setTimeout(maybeShow, BASE_DELAY_MS)
@@ -471,6 +487,19 @@ function backFromPair() {
   }
 }
 
+// Network-class failures: the node itself was unreachable (as opposed to the
+// backend answering with an RPC error). Includes the client's own timeout.
+const WG_NETWORK_ERR = /failed to fetch|networkerror|load failed|abort|request timeout/i
+
+// Auto-retry ladder for network-class failures. On a first install this step
+// is often reached while the backend is still settling (services starting,
+// backend restarting during container orchestration) — a single failed fetch
+// left a permanently blank QR unless the user spotted the retry button.
+const WG_RETRY_DELAYS_MS = [2000, 4000, 8000]
+
+const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms))
+const stillOnWgStep = () => visible.value && step.value === 'wgqr'
+
 // Create (or fetch) the phone's VPN peer and render its config as a QR.
 // Reuses the same RPCs as the Server page's Add Device modal; the peer is
 // looked up first so reopening the modal never duplicates it.
@@ -478,30 +507,71 @@ async function loadWgPeer() {
   if (wgQrDataUrl.value || wgLoading.value) return
   wgLoading.value = true
   wgError.value = ''
-  try {
-    const listed = await rpcClient
-      .call<{ peers: { name: string }[] }>({ method: 'vpn.list-peers' })
-      .catch(() => ({ peers: [] as { name: string }[] }))
-    const exists = (listed.peers || []).some((p) => p.name === WG_PEER_NAME)
-    const res = await rpcClient.call<{ config: string; peer_ip: string }>({
-      method: exists ? 'vpn.peer-config' : 'vpn.create-peer',
-      params: { name: WG_PEER_NAME },
-    })
-    wgConfig.value = res.config
-    wgQrDataUrl.value = await QRCode.toDataURL(res.config, {
-      width: 512,
-      margin: 3,
-      errorCorrectionLevel: 'M',
-      color: {
-        dark: '#111111',
-        light: '#ffffff',
-      },
-    })
-  } catch (e) {
-    wgError.value = e instanceof Error ? e.message : 'Failed to generate the tunnel config'
-  } finally {
-    wgLoading.value = false
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await provisionWgPeer()
+      break
+    } catch (e) {
+      const raw = e instanceof Error ? e.message : ''
+      const isNetworkErr = WG_NETWORK_ERR.test(raw)
+      const retryDelay = WG_RETRY_DELAYS_MS[attempt]
+      if (isNetworkErr && retryDelay !== undefined && stillOnWgStep()) {
+        await sleep(retryDelay)
+        if (stillOnWgStep()) continue
+      }
+      // fetch()'s raw "Failed to fetch" means the node itself was unreachable —
+      // after the retry ladder that's usually the phone's network mid-change
+      // (WiFi drop, or a half-configured tunnel already routing 10.44.0.0/16).
+      // Say so, and leave a Retry path instead of a dead end.
+      wgError.value = isNetworkErr
+        ? "Can't reach your node. Check the phone is on the same network as the node (and any half-set-up tunnel is switched off), then tap Try again."
+        : raw || 'Failed to generate the tunnel config'
+      break
+    }
   }
+  wgLoading.value = false
+}
+
+async function provisionWgPeer() {
+  const listed = await rpcClient
+    .call<{ peers: { name: string }[] }>({ method: 'vpn.list-peers' })
+    .catch(() => null)
+  // list-peers unreachable → don't guess "doesn't exist": create-peer on an
+  // existing name would fail. Try create first, fall back to peer-config.
+  const exists = listed === null
+    ? null
+    : (listed.peers || []).some((p) => p.name === WG_PEER_NAME)
+  let res: { config: string; peer_ip: string }
+  if (exists === true) {
+    res = await rpcClient.call({ method: 'vpn.peer-config', params: { name: WG_PEER_NAME } })
+  } else {
+    try {
+      res = await rpcClient.call({ method: 'vpn.create-peer', params: { name: WG_PEER_NAME } })
+    } catch (e) {
+      // Peer already provisioned on a previous visit (list failed or raced).
+      const msg = e instanceof Error ? e.message : ''
+      if (/exist|duplicate/i.test(msg)) {
+        res = await rpcClient.call({ method: 'vpn.peer-config', params: { name: WG_PEER_NAME } })
+      } else {
+        throw e
+      }
+    }
+  }
+  wgConfig.value = res.config
+  wgQrDataUrl.value = await QRCode.toDataURL(res.config, {
+    width: 512,
+    margin: 3,
+    errorCorrectionLevel: 'M',
+    color: {
+      dark: '#111111',
+      light: '#ffffff',
+    },
+  })
+}
+
+function retryWgPeer() {
+  wgError.value = ''
+  void loadWgPeer()
 }
 
 // Same-device path: hand the config to the WireGuard app as an importable

neode-ui/src/components/LightningChannelsPanel.vue

@@ -27,9 +27,8 @@
         <div class="flex-1 min-w-0">
           <p class="text-white/90 text-sm font-semibold mb-0.5">Open a channel with Zeus</p>
           <p class="text-white/55 text-xs leading-relaxed">
-            Pair your node with the Zeus mobile wallet — open a channel to their Olympus node and
-            start sending and receiving Lightning payments from your phone.
-            Minimum 150,000 · maximum 1,500,000 sats.
+            Open a channel with Zeus Olympus node and start sending and receiving Lightning
+            payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.
           </p>
         </div>
         <div class="flex sm:flex-col items-center gap-2 shrink-0">

neode-ui/src/components/ReceiveBitcoinModal.vue

@@ -72,6 +72,12 @@
 
         <div class="flex gap-3">
           <button @click="close" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">{{ t('common.close') }}</button>
+          <button @click="$emit('scan')" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-2">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+            Scan
+          </button>
           <button @click="receive" :disabled="processing" class="flex-1 glass-button glass-button-success px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50">
             {{ processing ? t('receiveBitcoin.processing') : receiveMethod === 'onchain' ? t('receiveBitcoin.generateAddress') : receiveMethod === 'lightning' ? t('receiveBitcoin.createInvoice') : receiveMethod === 'ark' ? 'Get Ark address' : t('receiveBitcoin.receive') }}
           </button>
@@ -95,7 +101,7 @@ const props = defineProps<{
   /** Generate an on-chain address immediately when the modal opens */
   autoGenerate?: boolean
 }>()
-const emit = defineEmits<{ close: []; received: [] }>()
+const emit = defineEmits<{ close: []; received: []; scan: [] }>()
 
 watch(() => props.show, (open) => {
   if (open && props.autoGenerate && receiveMethod.value === 'onchain' && !onchainAddress.value) {

neode-ui/src/components/SendBitcoinModal.vue

@@ -69,6 +69,12 @@
 
         <div class="flex gap-3">
           <button @click="close" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">{{ t('common.close') }}</button>
+          <button @click="$emit('scan')" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-2">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+            Scan
+          </button>
           <button @click="send" :disabled="processing || (!amount && !isSweep)" class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50">
             {{ processing ? t('common.sending') : t('common.send') }}
           </button>
@@ -85,7 +91,7 @@ import BaseModal from '@/components/BaseModal.vue'
 const { t } = useI18n()
 
 const props = defineProps<{ show: boolean }>()
-const emit = defineEmits<{ close: []; sent: [] }>()
+const emit = defineEmits<{ close: []; sent: []; scan: [] }>()
 
 const sendMethod = ref<'auto' | 'lightning' | 'onchain' | 'ecash' | 'ark'>('auto')
 const amount = ref<number>(0)

neode-ui/src/components/WalletScanModal.vue

@@ -0,0 +1,722 @@
+<template>
+  <Teleport to="body">
+    <Transition name="modal">
+      <div
+        v-if="show"
+        class="fixed inset-0 z-[3000] flex items-center justify-center p-4"
+        @click.self="close"
+      >
+        <div class="absolute inset-0 bg-black/60 backdrop-blur-md"></div>
+        <div
+          ref="modalRef"
+          class="glass-card p-6 w-full max-w-md relative z-10 overflow-hidden"
+          role="dialog"
+          aria-modal="true"
+          @click.stop
+        >
+          <!-- Header -->
+          <div class="flex items-center justify-between gap-4 mb-4">
+            <div class="flex items-center gap-2 min-w-0">
+              <button
+                v-if="pane !== 'scan'"
+                @click="goBack"
+                class="p-2 -ml-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors shrink-0"
+                aria-label="Back"
+              >
+                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
+                </svg>
+              </button>
+              <h3 class="text-xl font-semibold text-white truncate">{{ paneTitle }}</h3>
+            </div>
+            <button
+              @click="close"
+              class="p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors shrink-0"
+              aria-label="Close"
+            >
+              <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+            </button>
+          </div>
+
+          <Transition :name="direction === 'forward' ? 'pane-forward' : 'pane-back'" mode="out-in">
+            <!-- ============ SCAN PANE ============ -->
+            <div v-if="pane === 'scan'" key="scan">
+              <div class="relative w-full aspect-square rounded-xl overflow-hidden bg-black/40 border border-white/10 mb-4">
+                <video ref="videoElement" class="w-full h-full object-cover" autoplay muted playsinline></video>
+                <!-- Viewfinder -->
+                <div class="absolute inset-0 flex items-center justify-center pointer-events-none">
+                  <div class="scan-viewfinder"></div>
+                </div>
+                <div v-if="!isScanning" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
+                  <svg class="w-10 h-10 text-white/40" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M3 9a2 2 0 012-2h.93a2 2 0 001.664-.89l.812-1.22A2 2 0 0110.07 4h3.86a2 2 0 011.664.89l.812 1.22A2 2 0 0018.07 7H19a2 2 0 012 2v9a2 2 0 01-2 2H5a2 2 0 01-2-2V9z" />
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15 13a3 3 0 11-6 0 3 3 0 016 0z" />
+                  </svg>
+                  <button v-if="!liveCameraUnavailable" @click="startScanning" class="glass-button px-4 py-2 rounded-lg text-sm font-medium">
+                    {{ cameraError ? 'Retry camera' : 'Start camera' }}
+                  </button>
+                  <!-- Insecure-context fallback: live getUserMedia preview needs
+                       HTTPS, but the native camera via a file input does not —
+                       snap a photo of the QR and decode it locally. -->
+                  <button @click="photoInput?.click()" class="glass-button px-4 py-2 rounded-lg text-sm font-medium">
+                    Take photo of QR
+                  </button>
+                  <input
+                    ref="photoInput"
+                    type="file"
+                    accept="image/*"
+                    capture="environment"
+                    class="hidden"
+                    @change="onPhotoPicked"
+                  />
+                </div>
+              </div>
+
+              <div class="mb-4 p-3 bg-white/5 rounded-lg min-h-[3rem] flex items-center justify-center">
+                <p class="text-sm text-center" :class="scanStatusIsError ? 'text-red-400' : 'text-white/60'">
+                  {{ scanStatus || 'Point the camera at a Lightning invoice, Bitcoin address, Cashu or Fedimint code' }}
+                </p>
+              </div>
+
+              <!-- Paste fallback (also the path on camera-less nodes) -->
+              <div class="flex gap-2">
+                <input
+                  v-model="pasteInput"
+                  type="text"
+                  placeholder="…or paste an invoice / address / token"
+                  class="flex-1 input-glass font-mono text-xs"
+                  @keydown.enter="submitPaste"
+                />
+                <button @click="submitPaste" :disabled="!pasteInput.trim()" class="glass-button px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-40">
+                  Use
+                </button>
+              </div>
+            </div>
+
+            <!-- ============ AMOUNT / CONFIRM PANE ============ -->
+            <div v-else-if="pane === 'amount'" key="amount">
+              <!-- Rail + destination summary -->
+              <div class="flex items-center gap-3 p-3 bg-white/5 rounded-lg mb-4">
+                <span class="w-9 h-9 rounded-lg bg-white/10 flex items-center justify-center shrink-0" :class="railColor">
+                  <span v-if="rail === 'onchain'" class="text-lg font-bold">&#x20bf;</span>
+                  <svg v-else-if="rail === 'lightning'" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                  </svg>
+                  <!-- SVG, not 🥜: kiosk images ship no color-emoji font -->
+                  <svg v-else-if="rail === 'cashu'" class="w-5 h-5" role="img" aria-label="Cashu" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 9V7a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2m2 4h10a2 2 0 002-2v-6a2 2 0 00-2-2H9a2 2 0 00-2 2v6a2 2 0 002 2zm7-5a2 2 0 11-4 0 2 2 0 014 0z" />
+                  </svg>
+                  <svg v-else class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a4 4 0 00-3-3.87M9 20H4v-2a4 4 0 013-3.87m6-.13a4 4 0 10-4-4 4 4 0 004 4zm6 0a4 4 0 10-3-6.65" />
+                  </svg>
+                </span>
+                <div class="min-w-0">
+                  <p class="text-sm font-medium text-white">{{ railLabel }}</p>
+                  <p class="text-[11px] text-white/40 font-mono truncate">{{ destDisplay }}</p>
+                </div>
+              </div>
+
+              <!-- Federation join is a confirm, not an amount entry -->
+              <template v-if="action === 'fedimint-join'">
+                <p class="text-sm text-white/70 mb-4">
+                  This is a Fedimint federation invite. Join it to hold and send ecash backed by this federation.
+                </p>
+              </template>
+
+              <template v-else>
+                <!-- Amount -->
+                <div class="mb-3">
+                  <div class="flex items-center justify-between mb-1">
+                    <label class="text-white/60 text-sm">Amount (sats)</label>
+                    <span v-if="amountLocked" class="text-[11px] px-2 py-0.5 rounded-full bg-white/10 text-white/50">set by invoice</span>
+                  </div>
+                  <input
+                    v-model.number="amount"
+                    type="number"
+                    min="1"
+                    inputmode="numeric"
+                    placeholder="0"
+                    :disabled="amountLocked || sendMax"
+                    class="w-full input-glass text-2xl font-semibold text-center disabled:opacity-70"
+                  />
+                </div>
+
+                <!-- Presets + Max -->
+                <div v-if="!amountLocked" class="grid grid-cols-5 gap-2 mb-4">
+                  <button
+                    v-for="preset in PRESETS"
+                    :key="preset"
+                    @click="applyPreset(preset)"
+                    :disabled="balance !== null && preset > balance"
+                    class="px-1 py-1.5 rounded-lg text-xs font-medium transition-colors disabled:opacity-30"
+                    :class="!sendMax && amount === preset ? 'bg-white/20 text-white' : 'bg-white/5 text-white/60 hover:bg-white/10 hover:text-white/90'"
+                  >{{ formatPreset(preset) }}</button>
+                  <button
+                    @click="toggleMax"
+                    class="px-1 py-1.5 rounded-lg text-xs font-semibold transition-colors"
+                    :class="sendMax ? 'bg-orange-500/25 text-orange-300 border border-orange-500/40' : 'bg-white/5 text-white/60 hover:bg-white/10 hover:text-white/90'"
+                  >Max</button>
+                </div>
+
+                <!-- Live balance impact -->
+                <div class="rounded-lg border border-white/10 divide-y divide-white/5 mb-4">
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">{{ railLabel }} balance</span>
+                    <span class="text-sm font-medium" :class="railColor">
+                      {{ balance === null ? '…' : balance.toLocaleString() + ' sats' }}
+                    </span>
+                  </div>
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">This send</span>
+                    <span class="text-sm font-medium text-white/80">−{{ effectiveAmount.toLocaleString() }} sats</span>
+                  </div>
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">Balance after</span>
+                    <span class="text-sm font-semibold" :class="insufficient ? 'text-red-400' : 'text-white'">
+                      {{ balance === null ? '…' : balanceAfter.toLocaleString() + ' sats' }}
+                    </span>
+                  </div>
+                </div>
+                <p v-if="insufficient" class="text-xs text-red-400 mb-3">Not enough {{ railLabel }} balance for this amount.</p>
+                <p v-else-if="sendMax && rail === 'onchain'" class="text-xs text-white/50 mb-3">Sweeps the entire on-chain balance minus network fees.</p>
+              </template>
+
+              <div v-if="error" class="mb-3 alert-error text-sm">{{ error }}</div>
+
+              <div class="flex gap-3">
+                <button @click="goBack" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">Back</button>
+                <button
+                  @click="confirmSend"
+                  :disabled="processing || (action !== 'fedimint-join' && (insufficient || (effectiveAmount <= 0 && !sendMax)))"
+                  class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50"
+                >
+                  {{ processing ? 'Sending…' : confirmLabel }}
+                </button>
+              </div>
+            </div>
+
+            <!-- ============ SUCCESS PANE ============ -->
+            <div v-else key="success" class="text-center py-2">
+              <div class="inline-flex items-center justify-center w-24 h-24 rounded-full mx-auto mb-5 success-ring">
+                <svg class="w-14 h-14 text-green-400" fill="none" stroke="currentColor" stroke-width="3" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+                </svg>
+              </div>
+
+              <div v-if="successAmount > 0" class="text-5xl font-black text-green-400 mb-1">
+                {{ successAmount.toLocaleString() }}<span class="text-2xl font-bold text-green-400/70"> sats</span>
+              </div>
+              <div class="text-2xl font-bold tracking-widest text-white mb-2">{{ successVerb }}</div>
+              <p class="text-sm text-white/50 mb-1">{{ successDetail }}</p>
+              <p v-if="successRef" class="text-[11px] text-white/30 font-mono break-all px-4 mb-4">{{ successRef }}</p>
+
+              <div v-if="balance !== null" class="inline-flex items-center gap-2 px-3 py-1.5 rounded-full bg-white/5 text-xs text-white/60 mb-5">
+                <span :class="railColor">{{ railLabel }}</span>
+                <span>balance now {{ balance.toLocaleString() }} sats</span>
+              </div>
+
+              <button
+                @click="close"
+                class="w-full py-3 rounded-xl font-semibold text-base bg-white/10 hover:bg-white/20 text-white transition-colors"
+              >
+                Done
+              </button>
+            </div>
+          </Transition>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, watch, onUnmounted, nextTick } from 'vue'
+import QrScanner from 'qr-scanner'
+import { rpcClient } from '@/api/rpc-client'
+import { useAnimatedQRDecoder } from '@/composables/useAnimatedQRDecoder'
+import { useModalKeyboard } from '@/composables/useModalKeyboard'
+import { useBodyScrollLock } from '@/composables/useBodyScrollLock'
+
+type Rail = 'onchain' | 'lightning' | 'cashu' | 'fedimint'
+type Action = 'pay-invoice' | 'send-onchain' | 'redeem-token' | 'fedimint-join'
+type Pane = 'scan' | 'amount' | 'success'
+
+const PRESETS = [21, 2100, 21000, 100000]
+
+const props = defineProps<{ show: boolean }>()
+const emit = defineEmits<{ close: []; sent: [] }>()
+
+const modalRef = ref<HTMLElement | null>(null)
+useModalKeyboard(modalRef, computed(() => props.show), close)
+useBodyScrollLock(computed(() => props.show))
+
+// --- Pane state ---
+const pane = ref<Pane>('scan')
+const direction = ref<'forward' | 'back'>('forward')
+const paneTitle = computed(() => {
+  if (pane.value === 'scan') return 'Scan to send'
+  if (pane.value === 'success') return 'Success'
+  if (action.value === 'fedimint-join') return 'Join federation'
+  if (action.value === 'redeem-token') return 'Redeem'
+  return 'Send'
+})
+
+function goTo(p: Pane, dir: 'forward' | 'back' = 'forward') {
+  direction.value = dir
+  pane.value = p
+}
+
+function goBack() {
+  if (pane.value === 'amount') {
+    error.value = ''
+    goTo('scan', 'back')
+    nextTick(() => startScanning())
+  } else if (pane.value === 'success') {
+    close()
+  }
+}
+
+// --- Scanner ---
+const videoElement = ref<HTMLVideoElement | null>(null)
+const isScanning = ref(false)
+const scanStatus = ref('')
+const scanStatusIsError = ref(false)
+const cameraError = ref(false)
+const pasteInput = ref('')
+const qrScanner = ref<QrScanner | null>(null)
+const animatedDecoder = useAnimatedQRDecoder()
+
+async function startScanning() {
+  cameraError.value = false
+  scanStatusIsError.value = false
+  try {
+    if (!videoElement.value) return
+    if (!navigator.mediaDevices?.getUserMedia) {
+      throw new Error(
+        location.protocol !== 'https:' && !['localhost', '127.0.0.1'].includes(location.hostname)
+          ? 'Camera needs HTTPS — paste the code below instead'
+          : 'No camera available — paste the code below instead'
+      )
+    }
+    qrScanner.value = new QrScanner(
+      videoElement.value,
+      (result) => handleScanned(result.data),
+      {
+        returnDetailedScanResult: true,
+        highlightScanRegion: false,
+        preferredCamera: 'environment',
+        maxScansPerSecond: 10,
+      }
+    )
+    await qrScanner.value.start()
+    isScanning.value = true
+    scanStatus.value = ''
+  } catch (err) {
+    cameraError.value = true
+    scanStatusIsError.value = true
+    scanStatus.value = err instanceof Error ? err.message : 'Unable to access camera'
+  }
+}
+
+function stopScanning() {
+  qrScanner.value?.stop()
+  qrScanner.value?.destroy()
+  qrScanner.value = null
+  isScanning.value = false
+}
+
+function submitPaste() {
+  const text = pasteInput.value.trim()
+  if (!text) return
+  handleScanned(text)
+}
+
+// --- Photo-capture fallback (works without a secure context) ---
+// getUserMedia is unreachable over plain http (navigator.mediaDevices is
+// undefined), but <input capture> opens the native camera in any browser,
+// PWA or WebView; the shot is decoded locally by qr-scanner's scanImage.
+const photoInput = ref<HTMLInputElement | null>(null)
+const liveCameraUnavailable = computed(() => !navigator.mediaDevices?.getUserMedia)
+
+async function onPhotoPicked(e: Event) {
+  const input = e.target as HTMLInputElement
+  const file = input.files?.[0]
+  if (!file) return
+  try {
+    const result = await QrScanner.scanImage(file, { returnDetailedScanResult: true })
+    handleScanned(result.data)
+  } catch {
+    scanStatusIsError.value = true
+    scanStatus.value = 'No QR code found in that photo — try again, closer and well-lit'
+  } finally {
+    input.value = ''
+  }
+}
+
+// --- Detection (ported from k484's scanner) ---
+const rail = ref<Rail>('lightning')
+const action = ref<Action>('pay-invoice')
+const dest = ref('')
+const amount = ref<number>(0)
+const amountLocked = ref(false)
+const sendMax = ref(false)
+
+const railLabel = computed(() => ({
+  onchain: 'On-chain',
+  lightning: 'Lightning',
+  cashu: 'Cashu',
+  fedimint: 'Fedimint',
+}[rail.value]))
+
+const railColor = computed(() => ({
+  onchain: 'text-orange-500',
+  lightning: 'text-yellow-400',
+  cashu: 'text-purple-400',
+  fedimint: 'text-blue-400',
+}[rail.value]))
+
+const destDisplay = computed(() =>
+  dest.value.length > 46 ? `${dest.value.slice(0, 26)}…${dest.value.slice(-14)}` : dest.value
+)
+
+const confirmLabel = computed(() => {
+  if (action.value === 'fedimint-join') return 'Join'
+  if (action.value === 'redeem-token') return 'Redeem'
+  return 'Send'
+})
+
+/** Amount encoded in a BOLT11 invoice's human-readable part, in sats (null = zero-amount). */
+function parseBolt11AmountSats(invoice: string): number | null {
+  const m = /^ln(?:bcrt|bc|tb)(\d+)?([munp])?1/.exec(invoice.toLowerCase())
+  if (!m || !m[1]) return null
+  const value = Number(m[1])
+  const mult = { m: 1e-3, u: 1e-6, n: 1e-9, p: 1e-12 }[m[2] as 'm' | 'u' | 'n' | 'p'] ?? 1
+  return Math.round(value * mult * 1e8)
+}
+
+function isLightningInvoice(text: string): boolean {
+  const t = text.toLowerCase()
+  return t.startsWith('lnbc') || t.startsWith('lntb') || t.startsWith('lnbcrt')
+}
+
+function isOnchainAddress(text: string): boolean {
+  return /^(bc1|tb1|bcrt1)[a-z0-9]{20,90}$/i.test(text) || /^[13][a-km-zA-HJ-NP-Z1-9]{25,40}$/.test(text)
+}
+
+function isCashuToken(text: string): boolean {
+  return text.startsWith('cashuA') || text.startsWith('cashuB')
+}
+
+function isFedimintInvite(text: string): boolean {
+  return text.startsWith('fed11')
+}
+
+function isFedimintToken(text: string): boolean {
+  return /^AwE/.test(text)
+}
+
+function isAnimatedFrame(text: string): boolean {
+  return text.startsWith('B$') || text.startsWith('AAAH') || text.startsWith('ZAAE') || text.startsWith('AAA')
+}
+
+function handleScanned(raw: string) {
+  let text = raw.trim()
+  scanStatusIsError.value = false
+
+  // Animated multi-frame QR (large Fedimint tokens): keep collecting frames
+  if (isAnimatedFrame(text)) {
+    animatedDecoder.addFrame(text)
+    if (animatedDecoder.isComplete.value && animatedDecoder.decodedData.value) {
+      const token = animatedDecoder.decodedData.value
+      animatedDecoder.reset()
+      acceptDetected(token)
+    } else {
+      scanStatus.value = `Animated code… ${animatedDecoder.progressText()}`
+    }
+    return
+  }
+
+  acceptDetected(text)
+}
+
+function acceptDetected(raw: string) {
+  let text = raw.trim()
+  let bip21AmountSats: number | null = null
+
+  // URI schemes
+  if (text.toLowerCase().startsWith('lightning:')) text = text.slice(10)
+  if (text.toLowerCase().startsWith('bitcoin:')) {
+    try {
+      const uri = new URL(text)
+      const lnParam = uri.searchParams.get('lightning')
+      const amt = uri.searchParams.get('amount')
+      if (amt && !Number.isNaN(Number(amt))) bip21AmountSats = Math.round(Number(amt) * 1e8)
+      // Prefer the unified lightning param when present, else the address
+      text = lnParam || text.slice(8).split('?')[0] || ''
+    } catch {
+      text = text.slice(8).split('?')[0] || ''
+    }
+  }
+
+  if (isLightningInvoice(text)) {
+    rail.value = 'lightning'
+    action.value = 'pay-invoice'
+    dest.value = text
+    const invoiceAmount = parseBolt11AmountSats(text)
+    amount.value = invoiceAmount ?? 0
+    amountLocked.value = invoiceAmount !== null
+  } else if (isCashuToken(text)) {
+    rail.value = 'cashu'
+    action.value = 'redeem-token'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isFedimintInvite(text)) {
+    rail.value = 'fedimint'
+    action.value = 'fedimint-join'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isFedimintToken(text)) {
+    rail.value = 'fedimint'
+    action.value = 'redeem-token'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isOnchainAddress(text)) {
+    rail.value = 'onchain'
+    action.value = 'send-onchain'
+    dest.value = text
+    amount.value = bip21AmountSats ?? 0
+    amountLocked.value = false
+  } else {
+    scanStatusIsError.value = true
+    scanStatus.value = 'Not a recognised invoice, address or token'
+    return
+  }
+
+  sendMax.value = false
+  error.value = ''
+  stopScanning()
+  loadBalance()
+
+  // Tokens carry their own value — redeem straight away, success screen follows
+  if (action.value === 'redeem-token') {
+    goTo('amount')
+    confirmSend()
+  } else {
+    goTo('amount')
+  }
+}
+
+// --- Balance for the active rail ---
+const balance = ref<number | null>(null)
+
+async function loadBalance() {
+  balance.value = null
+  try {
+    if (rail.value === 'cashu') {
+      const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.ecash-balance' })
+      balance.value = res.balance_sats ?? 0
+    } else if (rail.value === 'fedimint') {
+      const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.fedimint-balance' })
+      balance.value = res.balance_sats ?? 0
+    } else {
+      const res = await rpcClient.call<{ balance_sats: number; channel_balance_sats: number }>({ method: 'lnd.getinfo' })
+      balance.value = rail.value === 'onchain' ? (res.balance_sats ?? 0) : (res.channel_balance_sats ?? 0)
+    }
+  } catch {
+    balance.value = null
+  }
+}
+
+const effectiveAmount = computed(() => {
+  if (sendMax.value) return balance.value ?? 0
+  return amount.value > 0 ? Math.floor(amount.value) : 0
+})
+const balanceAfter = computed(() => (balance.value ?? 0) - effectiveAmount.value)
+const insufficient = computed(() =>
+  action.value !== 'fedimint-join' && action.value !== 'redeem-token' &&
+  balance.value !== null && effectiveAmount.value > balance.value
+)
+
+function applyPreset(preset: number) {
+  sendMax.value = false
+  amount.value = preset
+}
+
+function toggleMax() {
+  sendMax.value = !sendMax.value
+  if (sendMax.value && balance.value !== null && rail.value !== 'onchain') {
+    amount.value = balance.value
+  }
+}
+
+function formatPreset(preset: number): string {
+  return preset >= 1000 ? `${(preset / 1000).toLocaleString()}k` : String(preset)
+}
+
+// --- Send / redeem / join ---
+const processing = ref(false)
+const error = ref('')
+const successAmount = ref(0)
+const successVerb = ref('SENT')
+const successDetail = ref('')
+const successRef = ref('')
+
+async function confirmSend() {
+  if (processing.value) return
+  processing.value = true
+  error.value = ''
+  try {
+    if (action.value === 'pay-invoice') {
+      const params: Record<string, unknown> = { payment_request: dest.value }
+      if (!amountLocked.value && effectiveAmount.value > 0) params.amount_sats = effectiveAmount.value
+      const res = await rpcClient.call<{ payment_hash: string; amount_sats: number }>({
+        method: 'lnd.payinvoice',
+        params,
+        timeout: 60000,
+      })
+      successAmount.value = res.amount_sats || effectiveAmount.value
+      successVerb.value = 'PAID'
+      successDetail.value = 'Lightning invoice paid'
+      successRef.value = res.payment_hash
+    } else if (action.value === 'send-onchain') {
+      const res = await rpcClient.call<{ txid: string }>({
+        method: 'lnd.sendcoins',
+        params: sendMax.value
+          ? { addr: dest.value, send_all: true }
+          : { addr: dest.value, amount: effectiveAmount.value },
+        timeout: 60000,
+      })
+      successAmount.value = sendMax.value ? (balance.value ?? 0) : effectiveAmount.value
+      successVerb.value = 'SENT'
+      successDetail.value = 'On-chain transaction broadcast'
+      successRef.value = res.txid
+    } else if (action.value === 'redeem-token') {
+      const res = await rpcClient.call<{ received_sats: number; kind: string }>({
+        method: 'wallet.ecash-receive',
+        params: { token: dest.value },
+        timeout: 60000,
+      })
+      rail.value = res.kind === 'fedimint' ? 'fedimint' : 'cashu'
+      successAmount.value = res.received_sats || 0
+      successVerb.value = 'RECEIVED'
+      successDetail.value = `${res.kind === 'fedimint' ? 'Fedimint' : 'Cashu'} token redeemed`
+      successRef.value = ''
+    } else {
+      await rpcClient.call({
+        method: 'wallet.fedimint-join',
+        params: { invite_code: dest.value },
+        timeout: 60000,
+      })
+      successAmount.value = 0
+      successVerb.value = 'JOINED'
+      successDetail.value = 'Federation joined — you can now hold its ecash'
+      successRef.value = ''
+    }
+    await loadBalance()
+    goTo('success')
+    emit('sent')
+  } catch (err) {
+    error.value = err instanceof Error ? err.message : 'Send failed'
+    // Token redeems jump straight from scan; surface the failure on the amount pane
+    if (pane.value !== 'amount') goTo('amount')
+  } finally {
+    processing.value = false
+  }
+}
+
+// --- Lifecycle ---
+function resetAll() {
+  stopScanning()
+  animatedDecoder.reset()
+  pane.value = 'scan'
+  direction.value = 'forward'
+  scanStatus.value = ''
+  scanStatusIsError.value = false
+  cameraError.value = false
+  pasteInput.value = ''
+  dest.value = ''
+  amount.value = 0
+  amountLocked.value = false
+  sendMax.value = false
+  balance.value = null
+  processing.value = false
+  error.value = ''
+}
+
+function close() {
+  resetAll()
+  emit('close')
+}
+
+watch(() => props.show, (open) => {
+  if (open) {
+    resetAll()
+    nextTick(() => startScanning())
+  } else {
+    stopScanning()
+  }
+})
+
+onUnmounted(stopScanning)
+</script>
+
+<style scoped>
+.modal-enter-active,
+.modal-leave-active {
+  transition: opacity 0.2s ease;
+}
+.modal-enter-from,
+.modal-leave-to {
+  opacity: 0;
+}
+.modal-enter-active .glass-card,
+.modal-leave-active .glass-card {
+  transition: transform 0.2s ease;
+}
+.modal-enter-from .glass-card,
+.modal-leave-to .glass-card {
+  transform: scale(0.95);
+}
+
+/* Horizontal pane slide: forward = new pane arrives from the right */
+.pane-forward-enter-active,
+.pane-forward-leave-active,
+.pane-back-enter-active,
+.pane-back-leave-active {
+  transition: transform 0.22s ease, opacity 0.22s ease;
+}
+.pane-forward-enter-from {
+  transform: translateX(40px);
+  opacity: 0;
+}
+.pane-forward-leave-to {
+  transform: translateX(-40px);
+  opacity: 0;
+}
+.pane-back-enter-from {
+  transform: translateX(-40px);
+  opacity: 0;
+}
+.pane-back-leave-to {
+  transform: translateX(40px);
+  opacity: 0;
+}
+
+.scan-viewfinder {
+  width: 62%;
+  height: 62%;
+  border-radius: 1rem;
+  border: 2px solid rgba(249, 115, 22, 0.85);
+  box-shadow: 0 0 0 9999px rgba(0, 0, 0, 0.35);
+}
+
+.success-ring {
+  background: rgba(16, 185, 129, 0.12);
+  box-shadow: 0 0 40px rgba(16, 185, 129, 0.25);
+}
+</style>

neode-ui/src/composables/useAnimatedQRDecoder.ts

@@ -0,0 +1,60 @@
+import { ref } from 'vue'
+import {
+  parseFramesReducer,
+  areFramesComplete,
+  framesToData,
+  totalNumberOfFrames,
+  currentNumberOfFrames,
+} from 'qrloop'
+
+/**
+ * Collects animated-QR frames (qrloop format, as used by k484 for large
+ * Fedimint tokens) and reassembles them into the original token string.
+ */
+export function useAnimatedQRDecoder() {
+  const framesState = ref<ReturnType<typeof parseFramesReducer> | null>(null)
+  const isComplete = ref(false)
+  const decodedData = ref<string | null>(null)
+  const uniqueFrames = ref<Set<string>>(new Set())
+
+  /** Feed one scanned frame; returns true once the full payload is decoded. */
+  function addFrame(frame: string): boolean {
+    if (isComplete.value) return true
+    if (uniqueFrames.value.has(frame)) return false
+    uniqueFrames.value.add(frame)
+
+    try {
+      framesState.value = parseFramesReducer(framesState.value, frame)
+      if (areFramesComplete(framesState.value)) {
+        const dataBuffer = framesToData(framesState.value)
+        // Tokens travel as URL-safe base64
+        decodedData.value = dataBuffer
+          .toString('base64')
+          .replace(/\+/g, '-')
+          .replace(/\//g, '_')
+        isComplete.value = true
+        return true
+      }
+      return false
+    } catch {
+      // A frame that qrloop rejects may just be a different QR format
+      return false
+    }
+  }
+
+  function progressText(): string {
+    if (!framesState.value) return ''
+    const total = totalNumberOfFrames(framesState.value)
+    const current = currentNumberOfFrames(framesState.value)
+    return `${current}/${total} frames`
+  }
+
+  function reset() {
+    framesState.value = null
+    uniqueFrames.value.clear()
+    isComplete.value = false
+    decodedData.value = null
+  }
+
+  return { isComplete, decodedData, addFrame, reset, progressText }
+}

neode-ui/src/data/goals.ts

@@ -15,7 +15,7 @@ const FUND_WALLET_STEP: GoalStep = {
   id: 'fund-wallet',
   title: 'Fund Your Bitcoin Wallet',
   description:
-    "Send bitcoin to your node's on-chain wallet so it can open a Lightning channel. Zeus channels need between 150,000 and 1,500,000 sats. Funding unlocks once your node finishes syncing the blockchain.",
+    "Send bitcoin to your node's on-chain wallet so it can open a Lightning channel. Zeus channels: minimum 150,000 · maximum 1,500,000 on-chain sats required. Funding unlocks once your node finishes syncing the blockchain.",
   action: 'fund',
   isAutomatic: false,
   icon: '/assets/img/app-icons/bitcoin-knots.webp',
@@ -51,7 +51,7 @@ export const GOALS: GoalDefinition[] = [
         id: 'open-zeus-channel',
         title: 'Open a Channel with Zeus',
         description:
-          'Open a Lightning channel to Zeus, the mobile wallet that pairs perfectly with your node. Fund it with 150,000–1,500,000 sats and your shop can accept instant Lightning payments.',
+          'Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.',
         action: 'configure',
         isAutomatic: false,
         icon: ZEUS_ICON,
@@ -106,7 +106,7 @@ export const GOALS: GoalDefinition[] = [
         id: 'open-channel',
         title: 'Open a Channel with Zeus',
         description:
-          'Open your first payment channel to Zeus, the mobile wallet built for nodes like yours (150,000–1,500,000 sats). You can then send and receive Lightning payments from your phone.',
+          'Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.',
         action: 'configure',
         isAutomatic: false,
         icon: ZEUS_ICON,
@@ -208,7 +208,7 @@ export const GOALS: GoalDefinition[] = [
         id: 'open-channels',
         title: 'Open Payment Channels',
         description:
-          'Open channels with well-connected nodes to start routing payments. A great first channel is Zeus (150,000–1,500,000 sats) — it also puts your node in your pocket. More channels means more routing opportunities.',
+          'Open channels with well-connected nodes to start routing payments. A great first channel is Zeus Olympus (minimum 150,000 · maximum 1,500,000 on-chain sats) — it also puts your node in your pocket. More channels means more routing opportunities.',
         action: 'configure',
         isAutomatic: false,
         icon: ZEUS_ICON,

neode-ui/src/router/index.ts

@@ -88,9 +88,9 @@ const router = createRouter({
       // normal app (onboarding → login → dashboard) like any other client.
       // This route only persists kiosk mode + safe-area insets, then redirects
       // to the root app. The launcher still points Chromium here (not directly
-      // at `/`) so the 'kiosk' flag gets set — App.vue uses it to skip the
-      // remote relay, which would otherwise double xdotool input on the kiosk
-      // display. Public so the auth guard doesn't bounce us before beforeEnter.
+      // at `/`) so the 'kiosk' flag gets set — App.vue keys kiosk-only styling
+      // (kiosk-mode/kiosk-safe-area classes, dark AIUI pin) off it. Public so
+      // the auth guard doesn't bounce us before beforeEnter.
       path: '/kiosk',
       name: 'kiosk',
       meta: { public: true },

neode-ui/src/stores/mesh.ts

@@ -48,6 +48,9 @@ export interface MeshConfigureParams {
   receive_block_headers?: boolean
   lora_region?: string
   device_kind?: string
+  /** MeshCore LoRa PHY params in firmware field units (freq_khz = MHz×1000,
+   *  bw_hz = kHz×1000). null clears; omitted leaves unchanged. */
+  lora_radio_params?: { freq_khz: number; bw_hz: number; sf: number; cr: number } | null
 }
 
 export interface MeshPeer {

neode-ui/src/style.css

@@ -1417,6 +1417,15 @@ html.kiosk-safe-area body {
   width: 100vw;
   height: 100vh;
   overflow: hidden;
+}
+/* Black fill on BODY only, never on the root element. With a background on
+   <html>, body's background no longer propagates to the canvas and instead
+   paints as a normal block background — which by CSS paint order lands ON TOP
+   of negative-z-index descendants, i.e. over .bg-perspective-container
+   (z-index -10): every dashboard/login background image rendered as solid
+   black on kiosk displays. Body-only matches the non-kiosk pages, where the
+   art has always shown. */
+html.kiosk-safe-area body {
   background: #000;
 }
 

neode-ui/src/types/qrloop.d.ts

@@ -0,0 +1,9 @@
+declare module 'qrloop' {
+  export type FramesState = unknown
+  export function parseFramesReducer(state: FramesState | null, frame: string): FramesState
+  export function areFramesComplete(state: FramesState): boolean
+  export function framesToData(state: FramesState): { toString(encoding: string): string }
+  export function totalNumberOfFrames(state: FramesState): number
+  export function currentNumberOfFrames(state: FramesState): number
+  export function progressOfFrames(state: FramesState): number
+}

neode-ui/src/utils/__tests__/introSplash.test.ts

@@ -38,4 +38,50 @@ describe('shouldShowIntroSplash', () => {
       replayRequested: true,
     })).toBe(true)
   })
+
+  it('a confirmed-fresh node plays the intro despite a stale per-origin seenIntro flag (reinstall / DHCP-recycled IP)', () => {
+    expect(shouldShowIntroSplash({
+      seenIntro: true,
+      routePath: '/',
+      fromBoot: false,
+      onboardingComplete: false,
+    })).toBe(true)
+  })
+
+  it('a confirmed-fresh node plays the intro on the boot-screen handoff too', () => {
+    expect(shouldShowIntroSplash({
+      seenIntro: true,
+      routePath: '/login',
+      fromBoot: true,
+      onboardingComplete: false,
+    })).toBe(true)
+  })
+
+  it('stale seenIntro still suppresses when the backend answer is unknown', () => {
+    expect(shouldShowIntroSplash({
+      seenIntro: true,
+      routePath: '/',
+      fromBoot: false,
+      onboardingComplete: null,
+    })).toBe(false)
+  })
+
+  it('fresh node on a deep route without boot handoff stays suppressed', () => {
+    expect(shouldShowIntroSplash({
+      seenIntro: false,
+      routePath: '/onboarding/seed',
+      fromBoot: false,
+      onboardingComplete: false,
+    })).toBe(false)
+  })
+
+  it('boot dev mode never root-boots into the intro', () => {
+    expect(shouldShowIntroSplash({
+      seenIntro: false,
+      routePath: '/',
+      fromBoot: false,
+      devMode: 'boot',
+      onboardingComplete: false,
+    })).toBe(false)
+  })
 })

neode-ui/src/utils/introSplash.ts

@@ -10,10 +10,19 @@ export interface IntroSplashDecisionInput {
 
 export function shouldShowIntroSplash(input: IntroSplashDecisionInput): boolean {
   if (input.replayRequested) return true
+
+  const isDirectRoute = input.routePath !== '/'
+  // A node the backend CONFIRMS has never completed onboarding always gets
+  // the full intro on a root boot. `seenIntro` is per-origin browser state —
+  // after a reinstall (or a DHCP-recycled IP), the browser still carries the
+  // previous node's flag at the same origin, which silently muted the intro
+  // on genuinely fresh installs.
+  if (input.onboardingComplete === false && (input.fromBoot || (!isDirectRoute && input.devMode !== 'boot'))) {
+    return true
+  }
   if (input.seenIntro) return false
   if (input.onboardingComplete === true) return false
 
-  const isDirectRoute = input.routePath !== '/'
   if (input.fromBoot) return true
   if (input.devMode === 'boot') return false
   return !isDirectRoute

neode-ui/src/utils/loraRegions.ts

@@ -100,3 +100,29 @@ export function meshcorePlanFor(code: string | null | undefined): MeshcorePlan |
   if (!code) return undefined
   return MESHCORE_PLANS[code.toUpperCase()]
 }
+
+/** A named MeshCore RF preset for the Device-panel dropdown. */
+export interface MeshcoreRfPreset {
+  id: string
+  label: string
+  freqMhz: number
+  bwKhz: number
+  sf: number
+  cr: number
+}
+
+/**
+ * Prepopulated MeshCore RF plans by country/region for the Device panel's
+ * preset dropdown ("Custom" in the UI unlocks free entry). Values are only
+ * added here when verifiable: the MeshCore community plans above, the
+ * MeshCore firmware's own build defaults (platformio.ini `arduino_base`:
+ * 869.618/62.5/SF8, CR default 5; companion example: 915.0/250/SF10/CR5),
+ * and operator-attested deployment plans.
+ */
+export const MESHCORE_RF_PRESETS: MeshcoreRfPreset[] = [
+  { id: 'eu_868', label: 'Europe / UK — 869.525 MHz, 250 kHz, SF11, CR4/5', freqMhz: 869.525, bwKhz: 250, sf: 11, cr: 5 },
+  { id: 'pt', label: 'Portugal — 869.618 MHz, 62.5 kHz, SF8, CR4/8', freqMhz: 869.618, bwKhz: 62.5, sf: 8, cr: 8 },
+  { id: 'fw_default', label: 'MeshCore firmware default — 869.618 MHz, 62.5 kHz, SF8, CR4/5', freqMhz: 869.618, bwKhz: 62.5, sf: 8, cr: 5 },
+  { id: 'us_anz_915', label: 'US / Canada / ANZ — 915.0 MHz, 250 kHz, SF10, CR4/5', freqMhz: 915.0, bwKhz: 250, sf: 10, cr: 5 },
+  { id: 'eu_433', label: 'Europe (433 MHz) — 433.65 MHz, 250 kHz, SF11, CR4/5', freqMhz: 433.65, bwKhz: 250, sf: 11, cr: 5 },
+]

neode-ui/src/views/GoalDetail.vue

@@ -125,7 +125,7 @@
                             {{ walletOnchainSats.toLocaleString() }} sats
                           </span>
                         </div>
-                        <p class="text-xs text-white/45 mt-1">Zeus channels need 150,000–1,500,000 sats.</p>
+                        <p class="text-xs text-white/45 mt-1">Minimum 150,000 · maximum 1,500,000 on-chain sats required.</p>
                       </div>
                       <div class="flex flex-wrap gap-2">
                         <button
@@ -205,7 +205,7 @@
     <!-- Fund-wallet receive modal (on-chain address + QR, Zeus limits noted) -->
     <ReceiveBitcoinModal
       :show="showFundModal"
-      note="Fund your Lightning channel: Zeus channels need a minimum of 150,000 and a maximum of 1,500,000 sats."
+      note="Fund your Lightning channel: minimum 150,000 · maximum 1,500,000 on-chain sats required."
       auto-generate
       @close="showFundModal = false"
     />

neode-ui/src/views/Home.vue

@@ -136,6 +136,7 @@
           :wallet-ark="walletArk"
           :wallet-transactions="walletTransactions"
           :is-dev="isDev"
+          @show-scan="showScanModal = true"
           @show-send="showSendModal = true"
           @show-receive="showReceiveModal = true"
           @show-transactions="showTransactionsModal = true"
@@ -278,8 +279,9 @@
     </div>
 
     <!-- Wallet Modals -->
-    <SendBitcoinModal :show="showSendModal" @close="showSendModal = false" @sent="loadWeb5Status()" />
-    <ReceiveBitcoinModal :show="showReceiveModal" @close="showReceiveModal = false" @received="loadWeb5Status()" />
+    <WalletScanModal :show="showScanModal" @close="showScanModal = false" @sent="loadWeb5Status()" />
+    <SendBitcoinModal :show="showSendModal" @close="showSendModal = false" @sent="loadWeb5Status()" @scan="showSendModal = false; showScanModal = true" />
+    <ReceiveBitcoinModal :show="showReceiveModal" @close="showReceiveModal = false" @received="loadWeb5Status()" @scan="showReceiveModal = false; showScanModal = true" />
     <TransactionsModal :show="showTransactionsModal" :transactions="walletTransactions" @close="showTransactionsModal = false" />
     <WalletSettingsModal :show="showWalletSettingsModal" @close="showWalletSettingsModal = false" @changed="loadWeb5Status()" />
   </div>
@@ -289,6 +291,7 @@
 import { computed, ref, watch, onBeforeUnmount, onMounted } from 'vue'
 import { RouterLink, useRoute, useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
+import WalletScanModal from '@/components/WalletScanModal.vue'
 import SendBitcoinModal from '@/components/SendBitcoinModal.vue'
 import ReceiveBitcoinModal from '@/components/ReceiveBitcoinModal.vue'
 import TransactionsModal from '@/components/TransactionsModal.vue'
@@ -517,7 +520,7 @@ onMounted(async () => {
 })
 
 // Wallet modals
-const showSendModal = ref(false); const showReceiveModal = ref(false); const showTransactionsModal = ref(false); const showWalletSettingsModal = ref(false)
+const showScanModal = ref(false); const showSendModal = ref(false); const showReceiveModal = ref(false); const showTransactionsModal = ref(false); const showWalletSettingsModal = ref(false)
 
 async function devFaucet() { try { await rpcClient.call({ method: 'dev.faucet', params: { amount_sats: 1_000_000 } }); await loadWeb5Status() } catch { /* ignore */ } }
 

neode-ui/src/views/OnboardingWrapper.vue

@@ -691,20 +691,28 @@ video.bg-layer {
    why the kiosk login/onboarding background still went black. Keep 2D
    opacity crossfades; drop 3D transforms, blur filters, and blend-mode
    glitch overlays. */
-:global(html.kiosk-mode) .bg-perspective-container,
-:global(html.kiosk-mode) .perspective-container {
+/* The full selector must live inside :global() — with `:global(html.kiosk-mode)
+   .bg-layer` the SFC compiler drops the descendant part, emitting bare
+   `html.kiosk-mode { display: none !important }` rules that blank the whole
+   document on kiosk (the v1.7.104 white-screen). */
+:global(html.kiosk-mode .bg-perspective-container),
+:global(html.kiosk-mode .perspective-container) {
   perspective: none !important;
 }
-:global(html.kiosk-mode) .bg-layer,
-:global(html.kiosk-mode) .view-wrapper {
+/* Scoped to the onboarding viewport: a bare `.view-wrapper` match also killed
+   the dashboard's route transitions on kiosk (transform:none !important beats
+   the transition classes), freezing every tab change. The dashboard has its
+   own kiosk-safe 2D transition overrides in dashboard-styles.css. */
+:global(html.kiosk-mode .bg-layer),
+:global(html.kiosk-mode .onb-viewport .view-wrapper) {
   transform: none !important;
   transform-style: flat !important;
   backface-visibility: visible !important;
   will-change: auto !important;
   filter: none !important;
 }
-:global(html.kiosk-mode) .login-glitch-layer,
-:global(html.kiosk-mode) .login-glitch-scan {
+:global(html.kiosk-mode .login-glitch-layer),
+:global(html.kiosk-mode .login-glitch-scan) {
   display: none !important;
 }
 </style>

neode-ui/src/views/PeerFiles.vue

@@ -25,6 +25,15 @@
           <p v-if="currentPeer?.did" class="text-sm text-white/50 font-mono truncate max-w-md" :title="currentPeer.did">{{ currentPeer.did }}</p>
           <p v-else class="text-sm text-white/50">Peer files</p>
         </div>
+        <!-- Mobile: the title block above is hidden (the global header carries the
+             peer name), so the transport pill would vanish with it. Render it on
+             its own here so mobile also sees whether this peer is FIPS or Tor. -->
+        <span
+          v-if="transportPill"
+          :class="transportPill.cls"
+          :title="transportPill.title"
+          class="md:hidden text-xs px-2 py-0.5 rounded-full font-medium"
+        >{{ transportPill.label }}</span>
       </div>
     </div>
 

neode-ui/src/views/Server.vue

@@ -146,7 +146,7 @@
             <div class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
               <div class="flex items-center gap-3">
                 <svg class="w-5 h-5 text-white/60" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" /></svg>
-                <span class="text-white/80 text-sm">Fuck IPs Mesh</span>
+                <span class="text-white/80 text-sm">F*ck IPs Mesh</span>
               </div>
               <span class="text-sm" :class="fipsRowTextClass">{{ fipsRowLabel }}</span>
             </div>

neode-ui/src/views/appSession/__tests__/appSessionConfig.test.ts

@@ -33,7 +33,10 @@ describe('appSessionConfig', () => {
       configurable: true,
     })
 
-    expect(resolveAppUrl('did-wallet')).toBe('http://192.168.1.228:8083')
+    // did-wallet's manifest publishes host port 8088 (apps/did-wallet/
+    // manifest.yml) — assert against the manifest-generated value, which is
+    // exactly what this test exists to protect.
+    expect(resolveAppUrl('did-wallet')).toBe('http://192.168.1.228:8088')
   })
 
   it('does not treat service-only tcp ports as web launch surfaces', () => {

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -6,26 +6,29 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "archy-nbxplorer": 32838,
   "botfights": 9100,
   "btcpay-server": 23000,
-  "did-wallet": 8083,
+  "did-wallet": 8088,
   "electrumx": 50002,
   "fedimint": 8175,
   "filebrowser": 8083,
   "gitea": 3001,
   "grafana": 3000,
   "homeassistant": 8123,
+  "immich": 2283,
   "indeedhub": 7778,
   "jellyfin": 8096,
   "lnd-ui": 18083,
   "mempool": 4080,
   "mempool-api": 8999,
-  "morphos-server": 8086,
+  "morphos-server": 8089,
+  "netbird": 8087,
   "nextcloud": 8085,
   "nostr-rs-relay": 18081,
   "photoprism": 2342,
+  "pine": 10380,
   "portainer": 9000,
   "router": 8084,
   "searxng": 8888,
-  "strfry": 8082,
+  "strfry": 8090,
   "uptime-kuma": 3002,
   "vaultwarden": 8082,
 }
@@ -36,6 +39,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "archy-mempool-db": "Mempool MariaDB",
   "archy-mempool-web": "Mempool Web",
   "archy-nbxplorer": "NBXplorer",
+  "barkd": "Ark Wallet",
   "bitcoin-core": "Bitcoin Core",
   "bitcoin-knots": "Bitcoin Knots",
   "bitcoin-ui": "Bitcoin UI",
@@ -45,24 +49,40 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "did-wallet": "Web5 DID Wallet",
   "electrs-ui": "Electrs UI",
   "electrumx": "ElectrumX",
-  "fedimint": "Fedimint",
+  "fedimint": "Fedimint Guardian",
+  "fedimint-clientd": "Fedimint Client",
   "fedimint-gateway": "Fedimint Gateway",
   "filebrowser": "File Browser",
+  "fips-ui": "FIPS Mesh",
   "gitea": "Gitea",
   "grafana": "Grafana",
   "homeassistant": "Home Assistant",
+  "immich": "Immich",
+  "immich-postgres": "Immich Postgres",
+  "immich-redis": "Immich Redis",
   "indeedhub": "IndeeHub",
+  "indeedhub-api": "IndeedHub API",
+  "indeedhub-ffmpeg": "IndeedHub FFmpeg Worker",
+  "indeedhub-minio": "IndeedHub MinIO",
+  "indeedhub-postgres": "IndeedHub Postgres",
+  "indeedhub-redis": "IndeedHub Redis",
+  "indeedhub-relay": "IndeedHub Nostr Relay",
   "jellyfin": "Jellyfin",
   "lightning-stack": "Lightning Stack",
   "lnd": "LND",
   "lnd-ui": "LND UI",
   "mempool": "Mempool Explorer",
   "mempool-api": "Mempool API",
-  "meshtastic": "Meshtastic",
   "morphos-server": "MorphOS Server",
+  "netbird": "NetBird",
+  "netbird-dashboard": "NetBird Dashboard",
+  "netbird-server": "NetBird Server",
   "nextcloud": "Nextcloud",
   "nostr-rs-relay": "Nostr Relay (Rust)",
   "photoprism": "PhotoPrism",
+  "pine": "Pine",
+  "pine-piper": "Pine Piper (TTS)",
+  "pine-whisper": "Pine Whisper (STT)",
   "portainer": "Portainer",
   "router": "Mesh Router",
   "searxng": "SearXNG",
@@ -76,8 +96,10 @@ export const GENERATED_NEW_TAB_APPS = new Set<string>([
   "gitea",
   "grafana",
   "homeassistant",
+  "immich",
   "nextcloud",
   "photoprism",
+  "pine",
   "portainer",
   "uptime-kuma",
   "vaultwarden",

neode-ui/src/views/apps/appsConfig.ts

@@ -26,6 +26,10 @@ export const SERVICE_NAMES = new Set([
   'indeedhub-relay', 'indeedhub-build_api_1', 'indeedhub-build_ffmpeg-worker_1',
   'indeedhub-build_postgres_1', 'indeedhub-build_redis_1', 'indeedhub-build_minio_1',
   'indeedhub-build_minio-init_1', 'indeedhub-build_relay_1',
+  // Pine voice-assistant stack: the two Wyoming engines are backends (STT/TTS)
+  // reached by Home Assistant over host.containers.internal — the user-facing
+  // card is "pine" (the setup/status launcher), so the engines go to Services.
+  'pine-whisper', 'pine-piper',
 ])
 
 const INTERNAL_TOOLING_NAMES = new Set([
@@ -61,7 +65,7 @@ export const APP_CATEGORY_MAP: Record<string, string> = {
   'fedimint': 'money', 'fedimint-gateway': 'money',
   'indeedhub': 'media', 'jellyfin': 'media', 'photoprism': 'media', 'immich': 'media',
   'nextcloud': 'data', 'vaultwarden': 'data', 'filebrowser': 'data', 'cryptpad': 'data',
-  'homeassistant': 'home', 'lorabell': 'home', 'endurain': 'home',
+  'homeassistant': 'home', 'lorabell': 'home', 'endurain': 'home', 'pine': 'home',
   'searxng': 'community', 'ollama': 'community', 'grafana': 'data', 'gitea': 'data',
   'nostrudel': 'nostr',
   'tailscale': 'networking', 'netbird': 'networking', 'nginx-proxy-manager': 'networking', 'portainer': 'networking',
@@ -212,6 +216,7 @@ const SERVICE_ICON_PREFIXES: Array<[string, string]> = [
   ['indeedhub-', '/assets/img/app-icons/indeedhub.png'],
   ['immich-', '/assets/img/app-icons/immich.png'],
   ['immich_', '/assets/img/app-icons/immich.png'],
+  ['pine-', '/assets/img/app-icons/pine.svg'],
 ]
 
 function serviceParentIcon(id: string): string | undefined {

neode-ui/src/views/dashboard/dashboard-styles.css

@@ -756,6 +756,38 @@ html.kiosk-mode .dashboard-view .bg-layer {
   transition: opacity 0.45s ease;
 }
 
+/* Kiosk: keep tab changes animated with cheap 2D moves. The 3D depth
+   transitions (translateZ + blur + preserve-3d) drop frames / paint black
+   under the software compositor, and the onboarding-era blanket
+   `transform: none` on .view-wrapper killed tab motion entirely. Plain 2D
+   scale + opacity composites fine there. */
+html.kiosk-mode .depth-forward-enter-active.view-wrapper,
+html.kiosk-mode .depth-forward-leave-active.view-wrapper,
+html.kiosk-mode .depth-back-enter-active.view-wrapper,
+html.kiosk-mode .depth-back-leave-active.view-wrapper {
+  transition: transform 0.45s ease, opacity 0.45s ease;
+  transform-style: flat;
+  backface-visibility: visible;
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-enter-from.view-wrapper,
+html.kiosk-mode .depth-back-leave-to.view-wrapper {
+  transform: scale(0.94);
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-leave-to.view-wrapper,
+html.kiosk-mode .depth-back-enter-from.view-wrapper {
+  transform: scale(1.05);
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-enter-to.view-wrapper,
+html.kiosk-mode .depth-forward-leave-from.view-wrapper,
+html.kiosk-mode .depth-back-enter-to.view-wrapper,
+html.kiosk-mode .depth-back-leave-from.view-wrapper {
+  transform: scale(1);
+  filter: none !important;
+}
+
 /* Background glitch effect layers - World Fair style */
 .bg-glitch-layer-1,
 .bg-glitch-layer-2,

neode-ui/src/views/home/HomeWalletCard.vue

@@ -122,7 +122,11 @@
           </div>
           <div class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
             <div class="flex items-center gap-3">
-              <span class="w-5 h-5 text-base leading-none flex items-center justify-center" role="img" aria-label="Cashu">🥜</span>
+              <!-- Inline SVG, not an emoji: kiosk images ship no color-emoji
+                   font, so 🥜 rendered as a tofu box on TVs -->
+              <svg class="w-5 h-5 text-purple-400" role="img" aria-label="Cashu" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 9V7a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2m2 4h10a2 2 0 002-2v-6a2 2 0 00-2-2H9a2 2 0 00-2 2v6a2 2 0 002 2zm7-5a2 2 0 11-4 0 2 2 0 014 0z" />
+              </svg>
               <span class="text-sm text-white/80">Cashu</span>
             </div>
             <span class="text-purple-400 text-sm font-medium">{{ walletEcash.toLocaleString() }} sats</span>
@@ -139,25 +143,37 @@
           <!-- Only rendered once barkd reports a balance — most nodes don't run the Ark sidecar -->
           <div v-if="(walletArk ?? 0) > 0" class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
             <div class="flex items-center gap-3">
-              <span class="w-5 h-5 text-base leading-none flex items-center justify-center" role="img" aria-label="Ark">⚓</span>
+              <svg class="w-5 h-5 text-teal-400" role="img" aria-label="Ark" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8a2.5 2.5 0 10-2.5-2.5A2.5 2.5 0 0012 8zm0 0v13m-7-7c0 3.87 3.13 7 7 7s7-3.13 7-7m-14 0H3m18 0h-2" />
+              </svg>
               <span class="text-sm text-white/80">Ark</span>
             </div>
             <span class="text-teal-400 text-sm font-medium">{{ (walletArk ?? 0).toLocaleString() }} sats</span>
           </div>
         </div>
-        <div class="home-card-buttons grid gap-2 mt-auto pt-4 shrink-0" :class="isDev ? 'grid-cols-4' : 'grid-cols-3'">
-          <button @click="$emit('showSend')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+        <div class="home-card-buttons flex gap-2 mt-auto pt-4 shrink-0">
+          <button @click="$emit('showSend')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
             {{ t('common.send') }}
           </button>
-          <button @click="$emit('showReceive')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+          <button @click="$emit('showReceive')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
             Receive
           </button>
-          <button @click="$emit('showTransactions')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+          <button @click="$emit('showTransactions')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
             Transactions
           </button>
           <button v-if="isDev" @click="$emit('faucet')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors text-green-400">
             Faucet
           </button>
+          <button
+            @click="$emit('showScan')"
+            aria-label="Scan QR to send"
+            title="Scan QR to send"
+            class="home-card-btn px-3 py-2 glass-button rounded-lg transition-colors shrink-0 flex items-center justify-center"
+          >
+            <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+          </button>
         </div>
       </div>
     </div>
@@ -197,6 +213,7 @@ const props = defineProps<{
 }>()
 
 defineEmits<{
+  showScan: []
   showSend: []
   showReceive: []
   showTransactions: []

neode-ui/src/views/mesh/MeshDevicePanel.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { ref, computed, watch } from 'vue'
 import { useMeshStore } from '@/stores/mesh'
-import { LORA_REGIONS, regionByCode, meshcorePlanFor } from '@/utils/loraRegions'
+import { LORA_REGIONS, regionByCode, meshcorePlanFor, MESHCORE_RF_PRESETS } from '@/utils/loraRegions'
 
 const mesh = useMeshStore()
 
@@ -27,6 +27,12 @@ const form = ref({
   channel: 'archipelago',
   name: '',
   broadcastIdentity: true,
+  // MeshCore LoRa PHY params (human units; converted to firmware units on
+  // save). All four empty = leave the radio's flashed settings untouched.
+  rfFreqMhz: '',
+  rfBwKhz: '',
+  rfSf: '',
+  rfCr: '',
 })
 const saving = ref(false)
 const saveError = ref<string | null>(null)
@@ -43,10 +49,54 @@ watch(
     form.value.deviceKind = s.device_kind ?? 'auto'
     form.value.channel = s.channel_name || 'archipelago'
     form.value.name = s.self_advert_name ?? ''
+    const rp = (s as Record<string, unknown>).lora_radio_params as
+      | { freq_khz: number; bw_hz: number; sf: number; cr: number }
+      | null
+      | undefined
+    if (rp) {
+      applyingPreset = true
+      form.value.rfFreqMhz = String(rp.freq_khz / 1000)
+      form.value.rfBwKhz = String(rp.bw_hz / 1000)
+      form.value.rfSf = String(rp.sf)
+      form.value.rfCr = String(rp.cr)
+      // Show the matching named preset if the stored values are one; else Custom.
+      const match = MESHCORE_RF_PRESETS.find(
+        (p) =>
+          Math.round(p.freqMhz * 1000) === rp.freq_khz &&
+          Math.round(p.bwKhz * 1000) === rp.bw_hz &&
+          p.sf === rp.sf &&
+          p.cr === rp.cr,
+      )
+      rfPreset.value = match ? match.id : 'custom'
+      applyingPreset = false
+    }
   },
   { immediate: true },
 )
 
+// RF preset dropdown: picking a named plan fills the four fields; hand-editing
+// any field flips the dropdown to Custom so it never misrepresents the values.
+const rfPreset = ref('')
+let applyingPreset = false
+function selectRfPreset(id: string) {
+  rfPreset.value = id
+  if (id === 'custom' || id === '') return
+  const p = MESHCORE_RF_PRESETS.find((x) => x.id === id)
+  if (!p) return
+  applyingPreset = true
+  form.value.rfFreqMhz = String(p.freqMhz)
+  form.value.rfBwKhz = String(p.bwKhz)
+  form.value.rfSf = String(p.sf)
+  form.value.rfCr = String(p.cr)
+  applyingPreset = false
+}
+watch(
+  () => [form.value.rfFreqMhz, form.value.rfBwKhz, form.value.rfSf, form.value.rfCr],
+  () => {
+    if (!applyingPreset && rfPreset.value && rfPreset.value !== 'custom') rfPreset.value = 'custom'
+  },
+)
+
 const selectedRegion = computed(() => regionByCode(form.value.region))
 const deviceType = computed(() => mesh.status?.device_type ?? 'unknown')
 // Firmware whose options apply: explicit pin wins, else the connected type.
@@ -62,12 +112,39 @@ async function saveSettings() {
   saveError.value = null
   saveDone.value = false
   try {
+    // MeshCore RF params: a named preset sends its plan; Custom sends the
+    // four fields (all required — partial input is an error); "Keep the
+    // radio's current settings" omits the key so the config is untouched.
+    let rfParams: { freq_khz: number; bw_hz: number; sf: number; cr: number } | undefined
+    if (rfPreset.value && rfPreset.value !== 'custom') {
+      const p = MESHCORE_RF_PRESETS.find((x) => x.id === rfPreset.value)
+      if (p) {
+        rfParams = {
+          freq_khz: Math.round(p.freqMhz * 1000),
+          bw_hz: Math.round(p.bwKhz * 1000),
+          sf: p.sf,
+          cr: p.cr,
+        }
+      }
+    } else if (rfPreset.value === 'custom') {
+      const rf = [form.value.rfFreqMhz, form.value.rfBwKhz, form.value.rfSf, form.value.rfCr]
+      if (!rf.every((v) => String(v).trim() !== '')) {
+        throw new Error('Fill in all four RF fields (frequency, bandwidth, SF, CR)')
+      }
+      rfParams = {
+        freq_khz: Math.round(parseFloat(form.value.rfFreqMhz) * 1000),
+        bw_hz: Math.round(parseFloat(form.value.rfBwKhz) * 1000),
+        sf: parseInt(form.value.rfSf, 10),
+        cr: parseInt(form.value.rfCr, 10),
+      }
+    }
     await mesh.configure({
       lora_region: form.value.region,
       device_kind: form.value.deviceKind,
       channel_name: form.value.channel.trim() || 'archipelago',
       ...(form.value.name.trim() ? { advert_name: form.value.name.trim() } : {}),
       broadcast_identity: form.value.broadcastIdentity,
+      ...(rfParams ? { lora_radio_params: rfParams } : {}),
     })
     saveDone.value = true
     setTimeout(() => { saveDone.value = false }, 3000)
@@ -93,18 +170,6 @@ async function saveSettings() {
         <span class="mesh-stat-label">Node ID</span>
         <span class="mesh-stat-value">{{ mesh.status.self_node_id != null ? `!${mesh.status.self_node_id.toString(16).padStart(8, '0')}` : '—' }}</span>
       </div>
-      <div class="mesh-stat">
-        <span class="mesh-stat-label">Name</span>
-        <span class="mesh-stat-value">{{ mesh.status.self_advert_name ?? '—' }}</span>
-      </div>
-      <div class="mesh-stat">
-        <span class="mesh-stat-label">Region (radio)</span>
-        <span class="mesh-stat-value">{{ mesh.status.region ?? 'Not set' }}</span>
-      </div>
-      <div class="mesh-stat">
-        <span class="mesh-stat-label">Channel</span>
-        <span class="mesh-stat-value">{{ mesh.status.channel_name }}</span>
-      </div>
       <div class="mesh-stat">
         <span class="mesh-stat-label">Type</span>
         <span class="mesh-stat-value">{{ deviceType === 'unknown' ? '—' : deviceType }}</span>
@@ -128,10 +193,10 @@ async function saveSettings() {
             Applied to fresh (region-unset) Meshtastic radios; a radio that already has a region keeps it.
           </p>
           <p v-else-if="effectiveKind === 'meshcore' && meshcorePlan" class="text-[11px] text-sky-300/80 mt-1">
-            MeshCore community plan for {{ selectedRegion?.code }}: {{ meshcorePlan.freqMhz }} MHz, {{ meshcorePlan.bwKhz }} kHz, SF{{ meshcorePlan.sf }}, CR4/{{ meshcorePlan.cr }} — the radio's flashed RF settings apply; adjust via a MeshCore client if they differ.
+            MeshCore community plan for {{ selectedRegion?.code }}: {{ meshcorePlan.freqMhz }} MHz, {{ meshcorePlan.bwKhz }} kHz, SF{{ meshcorePlan.sf }}, CR4/{{ meshcorePlan.cr }} — set the RF fields below to program the radio.
           </p>
           <p v-else-if="effectiveKind === 'meshcore'" class="text-[11px] text-sky-300/80 mt-1">
-            MeshCore radios keep their flashed RF settings — verify the radio matches your region's band{{ selectedRegion ? ` (${selectedRegion.band} MHz)` : '' }}.
+            Program the radio's RF settings with the fields below — every radio on your mesh must match{{ selectedRegion ? ` (${selectedRegion.band} MHz band)` : '' }}.
           </p>
           <p v-else-if="effectiveKind === 'reticulum'" class="text-[11px] text-sky-300/80 mt-1">
             RNode RF parameters are managed by the Reticulum daemon's interface config on this node.
@@ -158,6 +223,51 @@ async function saveSettings() {
           <input v-model="form.name" maxlength="24" placeholder="node name" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
         </div>
       </div>
+
+      <!-- MeshCore LoRa PHY params — every radio on the local mesh must match
+           or it hears RF energy but decodes nothing. Empty = leave the radio's
+           flashed settings untouched. -->
+      <div v-if="effectiveKind === 'meshcore'" class="mt-4">
+        <h5 class="text-xs font-semibold text-white/80 mb-2">MeshCore RF parameters</h5>
+        <div class="mb-3">
+          <label class="block text-xs text-white/60 mb-1">Frequency plan</label>
+          <select :value="rfPreset" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" @change="selectRfPreset(($event.target as HTMLSelectElement).value)">
+            <option value="">Keep the radio's current settings</option>
+            <option v-for="p in MESHCORE_RF_PRESETS" :key="p.id" :value="p.id">{{ p.label }}</option>
+            <option value="custom">Custom…</option>
+          </select>
+        </div>
+        <div v-if="rfPreset === 'custom'" class="grid gap-3 grid-cols-2 sm:grid-cols-4">
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Frequency (MHz)</label>
+            <input v-model="form.rfFreqMhz" inputmode="decimal" placeholder="869.618" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Bandwidth (kHz)</label>
+            <select v-model="form.rfBwKhz" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option value="">—</option>
+              <option v-for="bw in ['62.5', '125', '250', '500']" :key="bw" :value="bw">{{ bw }}</option>
+            </select>
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Spreading factor</label>
+            <select v-model="form.rfSf" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option value="">—</option>
+              <option v-for="sf in [5, 6, 7, 8, 9, 10, 11, 12]" :key="sf" :value="String(sf)">SF {{ sf }}</option>
+            </select>
+          </div>
+          <div>
+            <label class="block text-xs text-white/60 mb-1">Coding rate</label>
+            <select v-model="form.rfCr" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60">
+              <option value="">—</option>
+              <option v-for="cr in [5, 6, 7, 8]" :key="cr" :value="String(cr)">4/{{ cr }}</option>
+            </select>
+          </div>
+        </div>
+        <p class="text-[11px] text-white/40 mt-1">
+          Saved settings program the radio on its next connect (it reboots once to apply). Leave all four empty to keep the radio's own settings.
+        </p>
+      </div>
       <label class="flex items-center gap-2 mt-3 text-sm text-white/80 cursor-pointer">
         <input v-model="form.broadcastIdentity" type="checkbox" class="h-4 w-4 accent-orange-500" />
         Periodically broadcast this node's identity on the mesh

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -8,7 +8,7 @@
       </div>
       <div class="flex-1">
         <div class="flex items-start justify-between gap-4 mb-2">
-          <h2 class="text-xl font-semibold text-white">Fuck IPs Mesh</h2>
+          <h2 class="text-xl font-semibold text-white">F*ck IPs Mesh</h2>
           <div class="flex items-center gap-3">
             <div class="flex items-center gap-2" :title="statusLabel">
               <span class="w-2 h-2 rounded-full" :class="statusDotColor"></span>

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -362,6 +362,80 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.110-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.110-alpha</span>
+                  <span class="text-xs text-white/40">July 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.</p>
+                  <p>The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.</p>
+                  <p>You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.</p>
+                  <p>The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.</p>
+                  <p>The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).</p>
+                  <p>Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.</p>
+                  <p>The Lightning setup guidance now reads the same everywhere: "Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."</p>
+                  <p>Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen.</p>
+                </div>
+              </div>
+              <!-- v1.7.109-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.109-alpha</span>
+                  <span class="text-xs text-white/40">July 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice — speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.</p>
+                  <p>Your node can now program its MeshCore radio's RF settings — frequency, bandwidth, spreading factor, and coding rate — from Mesh → Device settings. Radios that were flashed with mismatched settings could hear that other radios exist but never decode their messages, and until now the only fix was a separate phone app. Set the values once and the node programs the radio automatically (it restarts once to apply); every radio on your mesh must use the same values to talk to each other.</p>
+                  <p>The Device settings panel is tidier: values you can edit (name, region, channel) are no longer also shown as separate read-only rows.</p>
+                </div>
+              </div>
+              <!-- v1.7.108-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.108-alpha</span>
+                  <span class="text-xs text-white/40">July 20, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Your node connects to the private mesh far more reliably. Nodes rely on a public rendezvous point to find each other, and the only one available was unreachable from many home and office networks — leaving some nodes unable to join the mesh at all. There is now a second, always-reachable rendezvous point, and your node tries every one it knows, so it joins the mesh in seconds instead of being stranded.</p>
+                  <p>Wi-Fi setup now heals itself on older nodes. Some nodes set up before a mid-year fix couldn't connect to a Wi-Fi network from the screen — it failed with a permissions error — because the piece that lets the node manage networking on your behalf was missing. Nodes now put that piece in place automatically on startup, so "scan, pick a network, type the password, connect" works without reinstalling.</p>
+                  <p>Your node rejoins the mesh within seconds after an update. Applying an update briefly restarts the mesh service, and previously a node could sit disconnected from other nodes for up to five minutes before it retried.</p>
+                  <p>The TV screen now fits your television. On a large or 4K TV the interface rendered tiny with no way to zoom on a keyboard-less screen; it now sizes itself to a comfortable, readable scale automatically (and small laptop panels are left unchanged).</p>
+                  <p>More TV-screen polish: the built-in assistant shows its dark theme instead of bright white panels, the on-screen hint for switching between the kiosk and a terminal now points at the right keys, the welcome logo no longer occasionally renders as garbled characters, and an accidental tap of the power button no longer shuts the node down — hold it to power off on purpose.</p>
+                  <p>Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle.</p>
+                </div>
+              </div>
+              <!-- v1.7.106-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.106-alpha</span>
+                  <span class="text-xs text-white/40">July 20, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Nodes on the same network now find each other directly. Your node announces itself on your local network and connects straight to other Archipelago nodes nearby, instead of every connection having to be introduced by a public rendezvous server out on the internet. Peers in the same home or office stay connected to each other even when that server is unreachable, and they reach each other faster.</p>
+                  <p>On a phone, the peer files screen tells you how you're connected again. The badge showing whether a peer's files are arriving over the fast mesh or over Tor was only visible on desktop — on narrow screens it disappeared entirely. It now appears next to the peer name on mobile too.</p>
+                  <p>Your node's mesh settings can no longer be written in a way that breaks the mesh. The configuration file used to be assembled as free-form text, where one wrong setting would stop the mesh service from starting and quietly drop your node off the network. It's now generated from a checked description of the file, with tests that verify the exact output.</p>
+                  <p>When your node has trouble reaching another node, the logs now record the real reason instead of a generic summary. A failure to open a peer's files previously logged only "Failed to connect to peer" and threw away the actual cause, which made these problems very hard to diagnose. Nothing changes on screen, and no internal detail is exposed.</p>
+                  <p>Behind the scenes: the installer image now builds its mesh component at a fixed, known version instead of whatever upstream had published that day, so two images built from the same source are identical.</p>
+                </div>
+              </div>
+              <!-- v1.7.105-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.105-alpha</span>
+                  <span class="text-xs text-white/40">July 20, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Fixed a failure loop where a node that lost power or was moved could get stuck on a blank "can't reach your node" screen forever: startup recovery no longer spends minutes retrying containers that no longer exist, and a genuinely large recovery is no longer cut off half-way and forced to start over. The node now reaches its login screen even after the messiest shutdown.</p>
+                  <p>Phone tunnel setup (WireGuard) is now dependable: the QR screen automatically retries while a fresh install is still settling instead of dead-ending at "failed to fetch", and if your node has moved to a different network the QR and downloadable config now carry the node's current address instead of the old one.</p>
+                  <p>Fixed the white screen some laptop displays showed right after the intro on v1.7.104.</p>
+                  <p>The companion phone app no longer suggests installing the companion app from inside itself.</p>
+                  <p>The Tor page now lists onion addresses only for apps you actually have installed — fresh installs no longer come with six pre-made addresses for apps that were never set up.</p>
+                  <p>Running archipelago --version or --help on the command line now prints and exits instead of silently starting a second copy of the node, which could briefly disrupt running apps.</p>
+                  <p>Behind the scenes: installer image builds now stop loudly if VPN components are missing instead of producing a broken image, and a background file-permission sweep runs far less often, reducing disk churn on busy nodes.</p>
+                </div>
+              </div>
               <!-- v1.7.104-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

neode-ui/src/views/settings/KioskDisplaySection.vue

@@ -0,0 +1,82 @@
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+// Kiosk display resolution/scaling presets. Only shown on nodes that actually
+// have a kiosk display (has_kiosk from the backend).
+const hasKiosk = ref(false)
+const preset = ref('auto')
+const applying = ref(false)
+const error = ref('')
+
+const presets = [
+  {
+    id: 'auto',
+    label: 'Auto (recommended)',
+    description: 'Pick a comfortable size for the detected screen — 4K TVs get a Full-HD-sized layout at double sharpness.',
+  },
+  {
+    id: 'large',
+    label: 'Large UI',
+    description: 'Biggest text and buttons — easiest to read from across the room, fits less on screen.',
+  },
+  {
+    id: 'balanced',
+    label: 'Balanced',
+    description: 'Desktop-sized layout on any screen that can carry it — more on screen, still sharp.',
+  },
+  {
+    id: 'native',
+    label: 'Native (no scaling)',
+    description: 'Use the screen’s full native resolution 1:1 — the most content, the smallest UI.',
+  },
+]
+
+onMounted(async () => {
+  try {
+    const res = await rpcClient.call<{ has_kiosk: boolean; preset: string }>({ method: 'system.kiosk-display.get' })
+    hasKiosk.value = res.has_kiosk
+    preset.value = res.preset
+  } catch { /* backend without the RPC — leave the section hidden */ }
+})
+
+async function apply(id: string) {
+  if (applying.value || id === preset.value) return
+  applying.value = true
+  error.value = ''
+  const prev = preset.value
+  preset.value = id
+  try {
+    await rpcClient.call({ method: 'system.kiosk-display.set', params: { preset: id }, timeout: 20000 })
+  } catch (e: unknown) {
+    preset.value = prev
+    error.value = e instanceof Error ? e.message : 'Failed to apply display setting'
+  } finally {
+    applying.value = false
+  }
+}
+</script>
+
+<template>
+  <!-- Kiosk Display Section — only on nodes with an attached kiosk screen -->
+  <div v-if="hasKiosk" class="glass-card px-6 py-6 mb-6">
+    <h2 class="text-xl font-semibold text-white/96 mb-2">Display</h2>
+    <p class="text-sm text-white/60 mb-6">
+      How big the interface renders on the screen attached to this node. Changing this restarts the on-screen display.
+    </p>
+    <div data-controller-container tabindex="0" class="grid grid-cols-1 md:grid-cols-2 gap-4">
+      <button
+        v-for="p in presets"
+        :key="p.id"
+        :disabled="applying"
+        @click="apply(p.id)"
+        class="path-option-card text-left p-5 disabled:opacity-60"
+        :class="{ 'path-option-card--selected': preset === p.id }"
+      >
+        <div class="font-medium text-white/90 mb-1">{{ p.label }}</div>
+        <p class="text-sm text-white/60">{{ p.description }}</p>
+      </button>
+    </div>
+    <div v-if="error" class="mt-4 alert-error text-sm">{{ error }}</div>
+  </div>
+</template>

neode-ui/src/views/settings/SystemSection.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
+import KioskDisplaySection from '@/views/settings/KioskDisplaySection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
@@ -10,6 +11,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
 
 <template>
   <InterfaceModeSection />
+  <KioskDisplaySection />
   <ClaudeAuthSection />
   <AIDataAccessSection />
   <WebhookSection />

release-manifest.json

@@ -1,30 +1,34 @@
 {
   "changelog": [
-    "Software updates are now much safer to receive: the node will never install an update that isn't completely downloaded and verified byte-for-byte, closing a rare bug where an interrupted or cancelled download could leave a node unable to start.",
-    "If a freshly installed update does fail to start, the node now notices and automatically restores the previous working version by itself — no manual rescue needed.",
-    "The Electrum server now works with whichever Bitcoin you run: it finds Bitcoin Knots or Bitcoin Core automatically instead of assuming Knots.",
-    "While the Electrum server is first building its index, its waiting screen now shows the ElectrumX app icon and live progress."
+    "Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a \"Take photo of QR\" button snaps a picture with your phone's camera and reads the code from the photo instead.",
+    "The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.",
+    "You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.",
+    "The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.",
+    "The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).",
+    "Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.",
+    "The Lightning setup guidance now reads the same everywhere: \"Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.\"",
+    "Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen."
   ],
   "components": [
     {
-      "current_version": "1.7.104-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.104-alpha/archipelago",
+      "current_version": "1.7.110-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.110-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.104-alpha",
-      "sha256": "6f290654d3f6c784dd9518df673a14783b50f8832937306943bf50e62a33f1bb",
-      "size_bytes": 49976648
+      "new_version": "1.7.110-alpha",
+      "sha256": "60360d8138a5a5059278c9c5ea1c7255ebd55d3b0abfcb5ec1ae84e9cdd61a33",
+      "size_bytes": 50447256
     },
     {
-      "current_version": "1.7.104-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.104-alpha/archipelago-frontend-1.7.104-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.104-alpha.tar.gz",
-      "new_version": "1.7.104-alpha",
-      "sha256": "8413af30dadbcade9ca40984beeac17add1b0477de7b1f7e4274f1482658d554",
-      "size_bytes": 174592628
+      "current_version": "1.7.110-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.110-alpha/archipelago-frontend-1.7.110-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.110-alpha.tar.gz",
+      "new_version": "1.7.110-alpha",
+      "sha256": "f7794cc3343dff5e1c6fc301be23a15fa25ec01a84f5370d1cbad640843575fa",
+      "size_bytes": 174646904
     }
   ],
-  "release_date": "2026-07-19",
-  "signature": "c1e2f9312d44c6109a77ff4500ce511cfa66b0c879a35271c7295d5673172053942de911db5e64306c4bef78b4bfc259cac0bf0fe1fc8dadfe77b14d4a5c0d08",
+  "release_date": "2026-07-21",
+  "signature": "90d047fa24f4f64dff1145c02156801cdd98e3db52708009269b90809b882271b614f5bcddfbd8e2d6b4dc81f967d01ad5e8bbf1b4c19c91e8874c015a587b06",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.104-alpha"
+  "version": "1.7.110-alpha"
 }

releases/manifest.json

@@ -1,30 +1,34 @@
 {
   "changelog": [
-    "Software updates are now much safer to receive: the node will never install an update that isn't completely downloaded and verified byte-for-byte, closing a rare bug where an interrupted or cancelled download could leave a node unable to start.",
-    "If a freshly installed update does fail to start, the node now notices and automatically restores the previous working version by itself — no manual rescue needed.",
-    "The Electrum server now works with whichever Bitcoin you run: it finds Bitcoin Knots or Bitcoin Core automatically instead of assuming Knots.",
-    "While the Electrum server is first building its index, its waiting screen now shows the ElectrumX app icon and live progress."
+    "Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a \"Take photo of QR\" button snaps a picture with your phone's camera and reads the code from the photo instead.",
+    "The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.",
+    "You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.",
+    "The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.",
+    "The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).",
+    "Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.",
+    "The Lightning setup guidance now reads the same everywhere: \"Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.\"",
+    "Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen."
   ],
   "components": [
     {
-      "current_version": "1.7.104-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.104-alpha/archipelago",
+      "current_version": "1.7.110-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.110-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.7.104-alpha",
-      "sha256": "6f290654d3f6c784dd9518df673a14783b50f8832937306943bf50e62a33f1bb",
-      "size_bytes": 49976648
+      "new_version": "1.7.110-alpha",
+      "sha256": "60360d8138a5a5059278c9c5ea1c7255ebd55d3b0abfcb5ec1ae84e9cdd61a33",
+      "size_bytes": 50447256
     },
     {
-      "current_version": "1.7.104-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.104-alpha/archipelago-frontend-1.7.104-alpha.tar.gz",
-      "name": "archipelago-frontend-1.7.104-alpha.tar.gz",
-      "new_version": "1.7.104-alpha",
-      "sha256": "8413af30dadbcade9ca40984beeac17add1b0477de7b1f7e4274f1482658d554",
-      "size_bytes": 174592628
+      "current_version": "1.7.110-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.110-alpha/archipelago-frontend-1.7.110-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.110-alpha.tar.gz",
+      "new_version": "1.7.110-alpha",
+      "sha256": "f7794cc3343dff5e1c6fc301be23a15fa25ec01a84f5370d1cbad640843575fa",
+      "size_bytes": 174646904
     }
   ],
-  "release_date": "2026-07-19",
-  "signature": "c1e2f9312d44c6109a77ff4500ce511cfa66b0c879a35271c7295d5673172053942de911db5e64306c4bef78b4bfc259cac0bf0fe1fc8dadfe77b14d4a5c0d08",
+  "release_date": "2026-07-21",
+  "signature": "90d047fa24f4f64dff1145c02156801cdd98e3db52708009269b90809b882271b614f5bcddfbd8e2d6b4dc81f967d01ad5e8bbf1b4c19c91e8874c015a587b06",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "version": "1.7.104-alpha"
+  "version": "1.7.110-alpha"
 }

scripts/check-app-catalog-drift.py

@@ -39,6 +39,8 @@ INTERNAL_MANIFEST_IDS = {
     "indeedhub-relay",
     "netbird-dashboard",
     "netbird-server",
+    "pine-whisper",
+    "pine-piper",
 }
 
 LEGACY_STACK_CATALOG_IDS = {

scripts/run-post-install-tests.sh

@@ -103,6 +103,23 @@ for f in /usr/local/bin/archipelago \
   fi
 done
 
+# 1.1b — Every enabled archipelago/nostr unit must have an existing ExecStart
+# payload. v1.7.104 shipped nostr-relay.service without its binary (3s
+# crash-loop forever) and archipelago-diag.service without its script
+# (203/EXEC) — catch that class of ISO defect on first boot, by generic rule.
+for unit in /etc/systemd/system/archipelago*.service /etc/systemd/system/nostr*.service; do
+  [ -f "$unit" ] || continue
+  systemctl is-enabled "$(basename "$unit")" >/dev/null 2>&1 || continue
+  exec_bin=$(grep -m1 '^ExecStart=' "$unit" | sed 's/^ExecStart=[-+@!:]*//' | awk '{print $1}')
+  case "$exec_bin" in
+    /*) if [ -e "$exec_bin" ]; then
+          pass "Unit payload exists: $(basename "$unit") → $exec_bin"
+        else
+          fail "Unit payload missing" "$(basename "$unit") → $exec_bin"
+        fi ;;
+  esac
+done
+
 # 1.2 — Critical services active
 for svc in archipelago nginx; do
   if systemctl is-active "$svc" >/dev/null 2>&1; then