chore: release v1.7.111-alpha

docs: v1.7.111-alpha changelog + What's New sync
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-22 05:40:40 -04:00 · 2026-07-22 05:04:11 -04:00 · 2026-07-22 05:00:10 -04:00 · 2026-07-22 04:54:20 -04:00 · 2026-07-22 04:54:20 -04:00 · 2026-07-22 04:54:20 -04:00
72 changed files with 3770 additions and 353 deletions
@@ -11,8 +11,8 @@ android {
        applicationId = "com.archipelago.app"
        minSdk = 26
        targetSdk = 35
-        versionCode = 18
-        versionName = "0.4.14"
+        versionCode = 19
+        versionName = "0.4.15"

        vectorDrawables {
            useSupportLibrary = true
@@ -1,10 +1,13 @@
 package com.archipelago.app.ui.screens

+import android.Manifest
 import android.annotation.SuppressLint
+import android.content.pm.PackageManager
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.view.ViewGroup
 import android.webkit.CookieManager
+import android.webkit.PermissionRequest
 import android.webkit.WebChromeClient
 import android.webkit.WebResourceError
 import android.webkit.WebResourceRequest
@@ -12,6 +15,9 @@ import android.webkit.WebSettings
 import android.webkit.WebView
 import android.webkit.WebViewClient
 import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.content.ContextCompat
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
@@ -146,6 +152,20 @@ fun WebViewScreen(
    var hasError by remember { mutableStateOf(false) }
    var webView by remember { mutableStateOf<WebView?>(null) }

+    // Web-page camera access (wallet QR scanner). The WebView's default
+    // WebChromeClient silently denies getUserMedia, so grant video capture —
+    // asking for the app-level CAMERA permission first when needed.
+    val webViewContext = LocalContext.current
+    var pendingWebPermission by remember { mutableStateOf<PermissionRequest?>(null) }
+    val webCameraPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        pendingWebPermission?.let { req ->
+            if (granted) req.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE)) else req.deny()
+        }
+        pendingWebPermission = null
+    }
+
    // A node app that refused iframing, opened in a local WebView overlay.
    // null = no overlay. The kiosk WebView underneath stays alive (and warm)
    // while this is shown, so closing it returns instantly with no reload.
@@ -371,6 +391,25 @@ fun WebViewScreen(
                                loadProgress = newProgress
                            }

+                            // Wallet QR scanner: grant the page camera access.
+                            // Only video capture is granted — anything else the
+                            // page asks for is denied as before.
+                            override fun onPermissionRequest(request: PermissionRequest) {
+                                if (PermissionRequest.RESOURCE_VIDEO_CAPTURE !in request.resources) {
+                                    request.deny()
+                                    return
+                                }
+                                val hasCamera = ContextCompat.checkSelfPermission(
+                                    webViewContext, Manifest.permission.CAMERA,
+                                ) == PackageManager.PERMISSION_GRANTED
+                                if (hasCamera) {
+                                    request.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE))
+                                } else {
+                                    pendingWebPermission = request
+                                    webCameraPermissionLauncher.launch(Manifest.permission.CAMERA)
+                                }
+                            }
+
                            // window.open() — e.g. the kiosk's "Open in new tab"
                            // for an app that can't be iframed. Capture the target
                            // URL via a throwaway WebView and route it ourselves.
@@ -516,6 +555,18 @@ private fun InAppBrowser(
    var canGoBack by remember { mutableStateOf(false) }
    var canGoForward by remember { mutableStateOf(false) }

+    // Same camera bridge as the main WebView — node apps opened in the overlay
+    // (e.g. anything with a QR scanner) get getUserMedia too.
+    var pendingWebPermission by remember { mutableStateOf<PermissionRequest?>(null) }
+    val webCameraPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        pendingWebPermission?.let { req ->
+            if (granted) req.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE)) else req.deny()
+        }
+        pendingWebPermission = null
+    }
+
    // Seed the loading-screen icon immediately from a best-effort favicon
    // pre-fetch (main's app-icon work), then onReceivedIcon upgrades it — so the
    // loader shows an icon right away instead of staying blank until the page
@@ -565,6 +616,22 @@ private fun InAppBrowser(
                            override fun onReceivedIcon(view: WebView?, icon: Bitmap?) {
                                if (icon != null) favicon = icon
                            }
+
+                            override fun onPermissionRequest(request: PermissionRequest) {
+                                if (PermissionRequest.RESOURCE_VIDEO_CAPTURE !in request.resources) {
+                                    request.deny()
+                                    return
+                                }
+                                val hasCamera = ContextCompat.checkSelfPermission(
+                                    context, Manifest.permission.CAMERA,
+                                ) == PackageManager.PERMISSION_GRANTED
+                                if (hasCamera) {
+                                    request.grant(arrayOf(PermissionRequest.RESOURCE_VIDEO_CAPTURE))
+                                } else {
+                                    pendingWebPermission = request
+                                    webCameraPermissionLauncher.launch(Manifest.permission.CAMERA)
+                                }
+                            }
                        }

                        webViewClient = object : WebViewClient() {
@@ -1,5 +1,30 @@
 # Changelog

+## v1.7.111-alpha (2026-07-22)
+
+- Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — "what's the block height?", "how many peers am I connected to?", "is bitcoin synced?", "what's my Lightning balance?" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.
+- Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom "Yo Archy" wake word is in the works.)
+- Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.
+- Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.
+- The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.
+- Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.
+- Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text "/bin/bash"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.
+- Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.
+- Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.
+- On the phone home screen, the wallet card moved up to sit right under My Apps.
+- Home Assistant updated to 2026.7.3, which keeps voice satellites (like Pine's speaker) connected reliably.
+
+## v1.7.110-alpha (2026-07-21)
+
+- Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.
+- The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.
+- You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.
+- The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.
+- The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).
+- Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.
+- The Lightning setup guidance now reads the same everywhere: "Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."
+- Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen.
+
 ## v1.7.109-alpha (2026-07-21)

 - Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice — speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.
@@ -351,12 +351,12 @@
    {
      "id": "homeassistant",
      "title": "Home Assistant",
-      "version": "2024.1.0",
+      "version": "2026.7.3",
      "description": "Open source home automation platform. Control and monitor your smart home devices.",
      "icon": "/assets/img/app-icons/homeassistant.png",
      "author": "Home Assistant",
      "category": "home",
-      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2024.1",
+      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2026.7.3",
      "repoUrl": "https://github.com/home-assistant/core",
      "containerConfig": {
        "ports": [
@@ -373,8 +373,8 @@
    {
      "id": "pine",
      "title": "Pine",
-      "version": "1.0.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
+      "version": "1.3.0",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
      "icon": "/assets/img/app-icons/pine.svg",
      "author": "Archipelago",
      "category": "home",
@@ -35,6 +35,9 @@ app:
        fi;
        RPC_USER="$(printenv BITCOIN_RPC_USER)";
        RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
        RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
        DISK_GB_VALUE="$(printenv DISK_GB || true)";
        RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +46,9 @@ app:
          RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
        fi;
        if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
        else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
        fi
    derived_env:
      - key: DISK_GB
@@ -35,6 +35,9 @@ app:
        fi;
        RPC_USER="$(printenv BITCOIN_RPC_USER)";
        RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
        RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
        DISK_GB_VALUE="$(printenv DISK_GB || true)";
        RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +46,9 @@ app:
          RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
        fi;
        if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
        else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
        fi
    derived_env:
      - key: DISK_GB
@@ -1,5 +1,5 @@
 # Home Assistant - uses official image
-FROM homeassistant/home-assistant:2024.1
+FROM homeassistant/home-assistant:2026.7.3

 # Default configuration is in the image
 # No additional setup needed
@@ -1,11 +1,11 @@
 app:
  id: homeassistant
  name: Home Assistant
-  version: 2024.1.0
+  version: 2026.7.3
  description: Open source home automation platform. Control and monitor your smart home devices.
  
  container:
-    image: 146.59.87.168:3000/lfg2025/home-assistant:2024.1
+    image: 146.59.87.168:3000/lfg2025/home-assistant:2026.7.3
    pull_policy: if-not-present
    network: pasta
    
@@ -0,0 +1,70 @@
+app:
+  id: pine-openwakeword
+  name: Pine Wake Word (openWakeWord)
+  version: "2.1.0"
+  description: Wyoming-protocol openWakeWord wake-word engine. Internal Pine voice-assistant stack member — lets Assist pipelines run wake-word detection on the node (groundwork for the custom "Yo Archy" wake word; stock models like "ok nabu" ship with the image).
+  category: home
+
+  # Hyphen name matches the runtime references (stack member table / startup
+  # order) so the orchestrator adopts a matching running container instead of
+  # recreating it.
+  container_name: pine-openwakeword
+
+  container:
+    image: docker.io/rhasspy/wyoming-openwakeword:2.1.0
+    pull_policy: if-not-present
+    network: archy-net
+    network_aliases: [pine-openwakeword]
+    # The image entrypoint binds tcp://0.0.0.0:10400. Preload the stock
+    # "ok nabu" model; /custom is where a trained custom model (yo_archy)
+    # drops in later — the engine picks up new .tflite files on restart.
+    custom_args: ["--preload-model", "ok_nabu", "--custom-model-dir", "/custom"]
+
+  dependencies:
+    - storage: 512Mi
+
+  resources:
+    memory_limit: 512Mi
+
+  security:
+    # cap-drop=ALL is applied by the orchestrator. A plain Python Wyoming server
+    # on an unprivileged port needs no added capabilities.
+    capabilities: []
+    readonly_root: false
+    no_new_privileges: true
+    network_policy: isolated
+
+  ports:
+    # Published so Home Assistant (on the pasta net) can reach the engine via
+    # host.containers.internal:10400 (the Wyoming integration endpoint).
+    - host: 10400
+      container: 10400
+      protocol: tcp
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine-openwakeword
+      target: /custom
+      options: [rw]
+
+  environment: []
+
+  health_check:
+    type: tcp
+    endpoint: localhost:10400
+    interval: 30s
+    timeout: 5s
+    retries: 5
+    start_period: 30s
+
+  metadata:
+    author: Rhasspy / Home Assistant
+    icon: /assets/img/app-icons/pine.svg
+    website: https://github.com/rhasspy/wyoming-openwakeword
+    repo: https://github.com/rhasspy/wyoming-openwakeword
+    license: MIT
+    tags:
+      - home
+      - voice
+      - wake-word
+      - wyoming
@@ -1,14 +1,15 @@
 app:
  id: pine
  name: Pine
-  version: "1.0.0"
-  description: A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.
+  version: "1.3.0"
+  description: A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.
  category: home

  # The user-facing launcher (app_id + container both "pine", matching the
  # runtime references + the live container so the orchestrator adopts it). A
-  # tiny nginx that serves the setup / status page for the voice stack. The two
-  # Wyoming engines (pine-whisper, pine-piper) are internal stack members.
+  # tiny nginx that serves the "Connect Pine to WiFi" provisioner page for the
+  # voice stack. The two Wyoming engines (pine-whisper, pine-piper) are internal
+  # stack members.
  container_name: pine

  container:
@@ -16,10 +17,20 @@ app:
    pull_policy: if-not-present
    network: archy-net
    network_aliases: [pine]
+    # The provisioner uses Web Bluetooth (Improv-over-BLE) to push WiFi creds to
+    # the PineVoice speaker. navigator.bluetooth only exists in a SECURE CONTEXT
+    # (https or localhost), so the launcher terminates TLS with a self-signed
+    # cert — otherwise the "Connect Pine to WiFi" button is inert on the LAN.
+    # Idempotent: kept as-is when crt+key already exist. Mirrors the netbird
+    # secure-context fix (#15).
+    generated_certs:
+      - crt: /var/lib/archipelago/pine/tls.crt
+        key: /var/lib/archipelago/pine/tls.key

  dependencies:
    - app_id: pine-whisper
    - app_id: pine-piper
+    - app_id: pine-openwakeword
    - storage: 128Mi

  resources:
@@ -27,7 +38,7 @@ app:

  security:
    # cap-drop=ALL is applied by the orchestrator. nginx (master as root, drops
-    # workers) binds :80 inside the container — needs the worker-drop caps +
+    # workers) binds :443 inside the container — needs the worker-drop caps +
    # NET_BIND_SERVICE for the privileged port.
    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE]
    readonly_root: false
@@ -35,11 +46,30 @@ app:
    network_policy: isolated

  ports:
+    # 10380 (http) is the Open target — the UI launches apps as
+    # http://host:10380 (resolveAppUrl). nginx there 301-redirects to the https
+    # listener on 10381, so the new tab lands on a secure context where
+    # navigator.bluetooth (the "Connect Pine to WiFi" provisioner) works.
    - host: 10380
      container: 80
      protocol: tcp
+    - host: 10381
+      container: 443
+      protocol: tcp

  volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine/nginx.conf
+      target: /etc/nginx/conf.d/default.conf
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.crt
+      target: /etc/nginx/tls.crt
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.key
+      target: /etc/nginx/tls.key
+      options: [ro]
    - type: bind
      source: /var/lib/archipelago/pine/index.html
      target: /usr/share/nginx/html/index.html
@@ -47,12 +77,33 @@ app:

  environment: []

-  # The setup / status page, written to the host before create and served
-  # read-only. Web-Bluetooth WiFi provisioning of the speaker only works from a
-  # secure/localhost context (not this LAN page), so the page documents that
-  # flow rather than embedding it — the live provisioner lives in the `pine`
-  # Gitea repo (index.html), run from a laptop on localhost.
  files:
+    - path: /var/lib/archipelago/pine/nginx.conf
+      overwrite: true
+      content: |
+        server {
+            listen 80;
+            server_name _;
+            return 301 https://$host:10381$request_uri;
+        }
+        server {
+            listen 443 ssl;
+            server_name _;
+            ssl_certificate /etc/nginx/tls.crt;
+            ssl_certificate_key /etc/nginx/tls.key;
+            root /usr/share/nginx/html;
+            index index.html;
+            # Live node facts for the status card — proxied to the node's
+            # public status tier so the (https) page can fetch same-origin.
+            location = /node-status {
+                proxy_pass http://host.containers.internal:80/api/pine/status;
+                proxy_http_version 1.1;
+                proxy_set_header Host $host;
+                proxy_connect_timeout 5s;
+                proxy_read_timeout 10s;
+            }
+            location / { try_files $uri $uri/ /index.html; }
+        }
    - path: /var/lib/archipelago/pine/index.html
      overwrite: true
      content: |
@@ -61,26 +112,42 @@ app:
        <head>
          <meta charset="utf-8">
          <meta name="viewport" content="width=device-width, initial-scale=1">
-          <title>Pine — private voice assistant</title>
+          <title>Pine — connect your speaker</title>
          <style>
            :root { color-scheme: dark; }
-            body { margin: 0; font: 16px/1.6 system-ui, sans-serif;
+            * { box-sizing: border-box; }
+            body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;
                   background: #0f1512; color: #e7efe9; }
-            .wrap { max-width: 720px; margin: 0 auto; padding: 40px 24px 80px; }
-            header { display: flex; align-items: center; gap: 16px; margin-bottom: 8px; }
-            header svg { width: 56px; height: 56px; flex: 0 0 auto; }
-            h1 { font-size: 28px; margin: 0; }
+            .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }
+            header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }
+            header svg { width: 52px; height: 52px; flex: 0 0 auto; }
+            h1 { font-size: 26px; margin: 0; }
            .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }
-            h2 { font-size: 18px; margin: 32px 0 8px; color: #b7e0c8; }
-            ol { padding-left: 22px; } li { margin: 6px 0; }
-            code { background: #1c2620; padding: 2px 6px; border-radius: 5px;
-                   font-size: 14px; color: #cfe9d9; }
            .card { background: #16201b; border: 1px solid #24332b;
-                    border-radius: 12px; padding: 16px 20px; margin: 16px 0; }
-            .row { display: flex; gap: 12px; align-items: baseline; }
-            .row b { min-width: 96px; color: #9fd3b6; }
-            a { color: #7fd6a6; }
-            footer { margin-top: 40px; color: #6d8578; font-size: 13px; }
+                    border-radius: 14px; padding: 20px; margin: 20px 0; }
+            .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }
+            .status .row b { min-width: 84px; color: #9fd3b6; }
+            .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;
+                           font-size: 13px; color: #cfe9d9; }
+            label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }
+            input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;
+                    background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;
+                    outline: none; }
+            input:focus { border-color: #4fae82; }
+            button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;
+                     font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;
+                     border-radius: 10px; cursor: pointer; transition: filter .15s; }
+            button:hover:not(:disabled) { filter: brightness(1.08); }
+            button:disabled { opacity: .45; cursor: default; }
+            #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;
+                   font-family: ui-monospace, monospace; white-space: pre-wrap;
+                   background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;
+                   color: #a9c6b6; max-height: 220px; overflow-y: auto; }
+            .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }
+            .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }
+            .ha b { color: #9fbfad; }
+            .insecure { display: none; background: #2a1f12; border-color: #4a3418;
+                        color: #e8c878; font-size: 13px; }
          </style>
        </head>
        <body>
@@ -92,61 +159,212 @@ app:
                <path d="M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z"/>
                <path d="M256 262 L392 430 L120 430 L256 262 Z"/>
              </g></svg>
-              <div>
-                <h1>Pine</h1>
-                <p class="tag">A private voice assistant that runs on your node.</p>
-              </div>
+              <div><h1>Pine</h1>
+                <p class="tag">Connect your speaker — everything stays on your node.</p></div>
            </header>

-            <p>Pine gives Home Assistant a local voice: your PineVoice speaker
-            hears you, <b>Whisper</b> turns speech into text on this node, and
-            <b>Piper</b> speaks the reply back — nothing leaves your home.</p>
-
-            <div class="card">
-              <div class="row"><b>Whisper (STT)</b><span>listening on
-                <code>host.containers.internal:10300</code></span></div>
-              <div class="row"><b>Piper (TTS)</b><span>listening on
-                <code>host.containers.internal:10200</code></span></div>
-              <div class="row"><b>Speaker</b><span>Wyoming satellite on
-                <code>&lt;speaker-ip&gt;:10700</code></span></div>
+            <div class="card status">
+              <div class="row"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>
+              <div class="row"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>
+              <div class="row"><b>Wake word</b><span>“Hey Jarvis” on the speaker (openWakeWord on <code>:10400</code>)</span></div>
+              <div class="row"><b>Speaker</b><span>put it in pairing mode — ring LED blinking yellow</span></div>
            </div>

-            <h2>1 · Get the speaker on WiFi</h2>
-            <ol>
-              <li>Web-Bluetooth provisioning needs a secure/localhost page, so
-                run the setup tool from the <code>pine</code> repo on a laptop:
-                <code>python3 -m http.server 8377 --bind 127.0.0.1</code>, then
-                open <code>http://localhost:8377</code> in Chrome.</li>
-              <li>Put the speaker in provisioning mode (ring LED blinking
-                yellow), enter your WiFi, and press the centre button when the
-                page asks for authorization.</li>
-              <li>Success: the log shows <code>✓ PROVISIONED</code> and the
-                speaker chimes.</li>
-            </ol>
+            <div class="card status">
+              <div class="row"><b>Node</b><span id="ns-node">checking…</span></div>
+              <div class="row"><b>Bitcoin</b><span id="ns-btc">—</span></div>
+              <div class="row"><b>Peers</b><span id="ns-peers">—</span></div>
+            </div>

-            <h2>2 · Wire it into Home Assistant</h2>
-            <ol>
-              <li>In Home Assistant: <b>Settings → Devices &amp; services</b>.
-                Add the two <b>Wyoming Protocol</b> integrations —
-                <code>host.containers.internal:10300</code> (Whisper) and
-                <code>:10200</code> (Piper).</li>
-              <li>Add the speaker as a third Wyoming device at
-                <code>&lt;speaker-ip&gt;:10700</code>.</li>
-              <li>Build an <b>Assist</b> pipeline: STT = faster-whisper,
-                TTS = Piper, then set it as the speaker's pipeline.</li>
-              <li>Say the wake word (<b>“Hey Jarvis”</b>) or press the speaker's
-                centre button, and talk to your home.</li>
-            </ol>
+            <div class="card insecure" id="insecure">
+              This page isn’t running over HTTPS, so the browser blocks Bluetooth.
+              Open it via its <b>https://…:10380</b> address (accept the self-signed
+              certificate) and the button below will work.
+            </div>

-            <footer>Pine · Whisper + Piper run locally on this Archipelago node.
-              No cloud, no account.</footer>
+            <div class="card">
+              <label for="ssid">WiFi network (SSID)</label>
+              <input id="ssid" autocomplete="off" spellcheck="false" placeholder="Your 2.4 GHz network">
+              <label for="pass">WiFi password — typed here, sent only over Bluetooth to the speaker</label>
+              <input id="pass" type="password" autocomplete="off">
+              <button id="go">Connect Pine to WiFi</button>
+              <div id="log">Ready. Click the button, then pick “PineVoice” in the Bluetooth popup.</div>
+            </div>
+
+            <p class="ha">After WiFi joins, one manual step remains — pair the
+              speaker in Home Assistant: <b>Settings → Devices &amp; services →
+              Add Wyoming Protocol</b>, host = the speaker’s IP, port
+              <b>10700</b>. Whisper, Piper, openWakeWord and the Assist pipeline
+              are wired up automatically when Pine installs. Wake word:
+              <b>“Hey Jarvis.”</b> Ask node things like <i>“what’s the block
+              height?”</i>, <i>“how many peers?”</i>, <i>“is the node
+              synced?”</i> or <i>“what’s my lightning balance?”</i> — and when a
+              Claude API key is set on the node, anything else gets answered by
+              Claude. New mesh messages are announced on the speaker too.</p>
+            <p class="ha">Troubleshooting: if it hears you (LED reacts) but answers
+              are silent, unplug and replug the speaker — an interrupted answer can
+              wedge its audio output until it reboots.</p>
          </div>
+
+          <script>
+          "use strict";
+          // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).
+          const SVC   = "00467768-6228-2272-4663-277478268000";
+          const CHAR_STATE  = "00467768-6228-2272-4663-277478268001";
+          const CHAR_ERROR  = "00467768-6228-2272-4663-277478268002";
+          const CHAR_RPC    = "00467768-6228-2272-4663-277478268003";
+          const CHAR_RESULT = "00467768-6228-2272-4663-277478268004";
+          const STATES = {1:"authorization required",2:"authorized",3:"provisioning…",4:"PROVISIONED"};
+          const ERRORS = {1:"invalid RPC packet",2:"unknown RPC command",
+            3:"unable to connect — wrong password, or the SSID isn't reachable on 2.4 GHz",
+            4:"not authorized — press the button on the device",5:"bad hostname",
+            255:"unknown device error"};
+
+          const logEl = document.getElementById("log");
+          const log = (msg, cls) => { const l = document.createElement("div");
+            if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);
+            logEl.scrollTop = logEl.scrollHeight; };
+          const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]
+            .map(b => b.toString(16).padStart(2, "0")).join(" ");
+
+          const btn = document.getElementById("go");
+          if (!navigator.bluetooth) {
+            document.getElementById("insecure").style.display = "block";
+            logEl.textContent = "Web Bluetooth unavailable — open this page over https (see note above).";
+          }
+
+          btn.addEventListener("click", async () => {
+            const ssid = document.getElementById("ssid").value.trim();
+            const pass = document.getElementById("pass").value;
+            if (!ssid) { log("Enter your WiFi network name first.", "err"); return; }
+            if (!navigator.bluetooth) { log("No Web Bluetooth — open this page over https.", "err"); return; }
+            btn.disabled = true; logEl.textContent = "";
+            let device;
+            try {
+              log("Opening Bluetooth device chooser…");
+              device = await navigator.bluetooth.requestDevice({
+                filters: [{ services: [SVC] }, { namePrefix: "PineVoice" }],
+                optionalServices: [SVC],
+              });
+              log(`Selected: ${device.name || "(unnamed)"}`);
+              device.addEventListener("gattserverdisconnected", () => log("BLE disconnected."));
+              log("Connecting…");
+              const gatt = await device.gatt.connect();
+              const svc = await gatt.getPrimaryService(SVC);
+              const stateChar  = await svc.getCharacteristic(CHAR_STATE);
+              const errorChar  = await svc.getCharacteristic(CHAR_ERROR);
+              const rpcChar    = await svc.getCharacteristic(CHAR_RPC);
+              const resultChar = await svc.getCharacteristic(CHAR_RESULT);
+
+              let done, fail;
+              const outcome = new Promise((res, rej) => { done = res; fail = rej; });
+              let authorize; const authorized = new Promise(res => { authorize = res; });
+              let state = -1;
+              const onState = (s, via = "") => {
+                if (s === state) return; state = s;
+                log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? "ok" : undefined);
+                if (s >= 2) authorize();
+                if (s === 4) done(null);
+              };
+              stateChar.addEventListener("characteristicvaluechanged",
+                e => onState(e.target.value.getUint8(0)));
+              errorChar.addEventListener("characteristicvaluechanged", e => {
+                const c = e.target.value.getUint8(0);
+                if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });
+              resultChar.addEventListener("characteristicvaluechanged", e => {
+                const v = e.target.value; log(`RPC result: ${hex(v)}`);
+                if (v.byteLength > 2 && v.getUint8(1) > 0) {
+                  const n = v.getUint8(2); const b = new Uint8Array(n);
+                  for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);
+                  done(new TextDecoder().decode(b)); } });
+              await stateChar.startNotifications();
+              await errorChar.startNotifications();
+              await resultChar.startNotifications();
+              onState((await stateChar.readValue()).getUint8(0));
+
+              const poller = setInterval(async () => {
+                try { onState((await stateChar.readValue()).getUint8(0), " (polled)");
+                  const ec = (await errorChar.readValue()).getUint8(0);
+                  if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);
+
+              let nextUrl;
+              try {
+                if (state === 1) {
+                  log("Authorization required — press the centre button on the speaker now.", "warn");
+                  await Promise.race([authorized, outcome,
+                    new Promise((_, rej) => setTimeout(
+                      () => rej(new Error("timed out waiting for the button press")), 60000))]);
+                  log("Authorized.", "ok");
+                }
+                const enc = new TextEncoder();
+                const sb = enc.encode(ssid), pb = enc.encode(pass);
+                const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);
+                const pkt = new Uint8Array([1, data.length, ...data, 0]);
+                pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);
+                log(`Sending WiFi credentials for “${ssid}”…`);
+                if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);
+                else await rpcChar.writeValue(pkt);
+                log("Credentials delivered — speaker acknowledged.", "ok");
+                log("Joining WiFi… (the speaker plays a sound within ~20s either way)");
+                const timeout = new Promise((_, rej) => setTimeout(
+                  () => rej(new Error("timed out after 60s waiting for the device")), 60000));
+                nextUrl = await Promise.race([outcome, timeout]);
+              } finally { clearInterval(poller); }
+
+              log("✓ PROVISIONED — the ring LED should breathe dim magenta.", "ok");
+              if (nextUrl) log(`Device reports next step: ${nextUrl}`, "ok");
+              try { gatt.disconnect(); } catch {}
+            } catch (err) {
+              log(`✗ ${err.name || "Error"}: ${err.message}`, "err");
+              if (err.name === "NotFoundError")
+                log("No speaker matched, or you closed the chooser. LED blinking yellow? "
+                  + "Hold the dot button 15s to reset.", "warn");
+              if (err.name === "NetworkError")
+                log("BLE link dropped — move closer, and make sure the Mac isn't already "
+                  + "paired to the speaker (it can hold the link exclusively).", "warn");
+              try { device?.gatt?.disconnect(); } catch {}
+            } finally { btn.disabled = false; }
+          });
+
+          // Live node status card — public tier of /api/pine/status via the
+          // same-origin /node-status proxy. Best-effort: failures just show
+          // "unavailable" and retry on the next tick.
+          const nsNode = document.getElementById("ns-node");
+          const nsBtc = document.getElementById("ns-btc");
+          const nsPeers = document.getElementById("ns-peers");
+          async function refreshNodeStatus() {
+            try {
+              const r = await fetch("/node-status", { cache: "no-store" });
+              if (!r.ok) throw new Error(String(r.status));
+              const s = await r.json();
+              const up = Math.floor((s.uptime_seconds || 0) / 3600);
+              nsNode.textContent = `Archipelago ${s.version || "?"} — up ${up}h`;
+              if (s.bitcoin && s.bitcoin.height != null) {
+                const pct = s.bitcoin.sync_percent;
+                nsBtc.textContent = `block ${s.bitcoin.height}` +
+                  (pct != null ? (pct >= 99.99 ? " — synced" : ` — ${pct}% synced`) : "");
+              } else {
+                nsBtc.textContent = "not running";
+              }
+              const btcPeers = s.bitcoin && s.bitcoin.peers != null ? s.bitcoin.peers : "?";
+              const meshPeers = s.mesh ? s.mesh.peers : 0;
+              nsPeers.textContent = `${btcPeers} bitcoin` +
+                (s.mesh && s.mesh.enabled ? `, ${meshPeers} mesh` : "");
+            } catch {
+              nsNode.textContent = "node status unavailable";
+              nsBtc.textContent = "—";
+              nsPeers.textContent = "—";
+            }
+          }
+          refreshNodeStatus();
+          setInterval(refreshNodeStatus, 30000);
+          </script>
        </body>
        </html>

  health_check:
    type: tcp
-    endpoint: localhost:80
+    endpoint: localhost:443
    interval: 30s
    timeout: 5s
    retries: 5
@@ -155,7 +373,7 @@ app:
  interfaces:
    main:
      name: Pine
-      description: Set up and check your private voice assistant
+      description: Connect your speaker to WiFi and check the voice assistant
      type: ui
      port: 10380
      protocol: http
@@ -95,7 +95,7 @@ dependencies = [

 [[package]]
 name = "archipelago"
-version = "1.7.109-alpha"
+version = "1.7.111-alpha"
 dependencies = [
 "anyhow",
 "archipelago-container",
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.109-alpha"
+version = "1.7.111-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
@@ -580,6 +580,26 @@ impl ApiHandler {
                self.handle_app_catalog_proxy().await
            }

+            // Pine node status — public tier (version/uptime/height/sync/peer
+            // counts) is unauthenticated like /bitcoin-status; Lightning
+            // balances + latest mesh message additionally require the bearer
+            // token the pine/HA seeder minted (or a valid session).
+            (Method::GET, "/api/pine/status") => {
+                let bearer = headers
+                    .get(hyper::header::AUTHORIZATION)
+                    .and_then(|v| v.to_str().ok())
+                    .and_then(|v| v.strip_prefix("Bearer "))
+                    .unwrap_or("");
+                let authorized = self.rpc_handler.pine_status_token_ok(bearer).await
+                    || self.is_authenticated(&headers).await;
+                let body = self.rpc_handler.pine_status_json(authorized).await;
+                Ok(build_response(
+                    StatusCode::OK,
+                    "application/json",
+                    hyper::Body::from(serde_json::to_vec(&body).unwrap_or_default()),
+                ))
+            }
+
            // LND connect info — nginx validates session cookie (presence check),
            // backend is bound to 127.0.0.1 so only nginx can reach it.
            // No backend auth check here because the LND UI iframe fetches this
@@ -456,6 +456,8 @@ impl RpcHandler {
            "system.factory-reset" => self.handle_system_factory_reset(params).await,
            "system.settings.get" => self.handle_system_settings_get(params).await,
            "system.settings.set" => self.handle_system_settings_set(params).await,
+            "system.kiosk-display.get" => self.handle_system_kiosk_display_get().await,
+            "system.kiosk-display.set" => self.handle_system_kiosk_display_set(params).await,

            // Opt-in anonymous analytics
            "analytics.get-status" => self.handle_analytics_get_status().await,
@@ -28,13 +28,20 @@ impl RpcHandler {
            ));
        }

+        // Zero-amount invoices need the amount supplied by the payer; LND's
+        // REST API takes it as an `amt` string alongside the payment request.
+        let amount_sats = params.get("amount_sats").and_then(|v| v.as_u64());
+
        info!("Paying Lightning invoice");

        let (client, macaroon_hex) = self.lnd_client().await?;

-        let pay_body = serde_json::json!({
+        let mut pay_body = serde_json::json!({
            "payment_request": payment_request,
        });
+        if let Some(amt) = amount_sats {
+            pay_body["amt"] = serde_json::json!(amt.to_string());
+        }

        let resp = client
            .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))
@@ -27,6 +27,7 @@ mod nostr;
 mod openwrt;
 mod package;
 mod peers;
+mod pine_status;
 mod response;
 mod router;
 mod security;
@@ -497,7 +497,12 @@ pub(super) fn all_container_names(package_id: &str) -> Vec<String> {
            "netbird-server".into(),
        ],
        // Pine voice-assistant stack: launcher + the two Wyoming engines.
-        "pine" => vec!["pine".into(), "pine-whisper".into(), "pine-piper".into()],
+        "pine" => vec![
+            "pine".into(),
+            "pine-whisper".into(),
+            "pine-piper".into(),
+            "pine-openwakeword".into(),
+        ],
        "nostr-vpn" => vec![
            "nostr-vpn".into(),
            "archy-nostr-vpn".into(),
@@ -598,6 +598,7 @@ pub(super) fn needs_archy_net(package_id: &str) -> bool {
            | "pine"
            | "pine-whisper"
            | "pine-piper"
+            | "pine-openwakeword"
    )
 }

@@ -629,7 +630,7 @@ pub(super) fn startup_order(package_id: &str) -> &'static [&'static str] {
            &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
        }
        "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
-        "pine" => &["pine-whisper", "pine-piper", "pine"],
+        "pine" => &["pine-whisper", "pine-piper", "pine-openwakeword", "pine"],
        "penpot" | "penpot-frontend" => &[
            "penpot-postgres",
            "penpot-valkey",
@@ -1563,6 +1563,15 @@ autopilot.active=false\n",
    /// Run post-install hooks (Nextcloud trusted domains, Bitcoin UI container).
    /// Critical hooks (credential setup, config) are awaited; UI container builds are background.
    async fn run_post_install_hooks(&self, package_id: &str) {
+        if matches!(package_id, "homeassistant" | "home-assistant")
+            && super::pine_ha::pine_engines_installed().await
+        {
+            // Pine was installed first: wire HA to its Wyoming engines now,
+            // then restart so the seeded storage is what HA loads.
+            if super::pine_ha::seed_home_assistant_pine_defaults().await {
+                super::pine_ha::restart_home_assistant_if_running().await;
+            }
+        }
        if package_id == "filebrowser" {
            // Generate a random password (32 bytes, hex-encoded)
            let mut buf = [0u8; 32];
@@ -3,6 +3,7 @@ mod config;
 mod dependencies;
 mod install;
 mod lifecycle;
+mod pine_ha;
 mod progress;
 mod runtime;
 mod set_config;
@@ -0,0 +1,803 @@
+//! Home Assistant <-> Pine voice-stack provisioning.
+//!
+//! The Pine app ships the Wyoming engines (pine-whisper :10300, pine-piper
+//! :10200, pine-openwakeword :10400) as plain containers. Home Assistant only
+//! uses them once a `wyoming` config entry exists for each, and once an
+//! Assist pipeline points at the resulting entities. Out of the box that
+//! meant clicking through HA's integration UI and building a pipeline by
+//! hand — so seed all of it directly into HA's `.storage` when both apps are
+//! present:
+//!
+//! - a `wyoming` config entry per engine,
+//! - an Assist pipeline wired to whisper + piper,
+//! - "ask Archy" voice intents backed by REST sensors on the node's
+//!   `/api/pine/status` endpoint (block height, peers, sync, balances),
+//! - a Claude conversation agent (HA's `anthropic` integration) using the
+//!   node's shared `secrets/claude-api-key`, set as the pipeline's brain with
+//!   `prefer_local_intents: true` so node questions stay local/free,
+//! - an automation announcing new mesh messages on any Assist satellite.
+//!
+//! Everything here is best-effort (warn, never fail an install): HA migrates
+//! the minimal store shapes we write to its current schema on boot, and skips
+//! entries that already exist, so re-running is idempotent.
+
+use serde_json::{json, Value};
+use tracing::{info, warn};
+
+/// Timestamp in the exact format HA writes to `.storage`
+/// (`2026-07-22T08:29:35.123456+00:00` — micros, `+00:00` offset), safe for
+/// Python's `datetime.fromisoformat`.
+fn ha_now() -> String {
+    chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Micros, false)
+}
+
+const HA_CONFIG_DIR: &str = "/var/lib/archipelago/home-assistant";
+const HA_STORAGE_DIR: &str = "/var/lib/archipelago/home-assistant/.storage";
+const NODE_SECRETS_DIR: &str = "/var/lib/archipelago/secrets";
+
+/// The Wyoming engines the Pine stack publishes on the host.
+/// HA runs under pasta, so the host is reachable as host.containers.internal.
+const PINE_ENGINES: [(&str, &str, u16); 3] = [
+    ("faster-whisper", "host.containers.internal", 10300),
+    ("piper", "host.containers.internal", 10200),
+    ("openwakeword", "host.containers.internal", 10400),
+];
+
+/// Entity id the Anthropic conversation subentry produces (device name
+/// "Claude conversation" -> slug). Deterministic on a fresh registry.
+const CLAUDE_CONVERSATION_ENTITY: &str = "conversation.claude_conversation";
+
+/// Seed Home Assistant with the Pine voice defaults. Called after the Pine
+/// stack installs and after Home Assistant installs (each side no-ops when
+/// the other is missing). HA picks the new entries up on its next start; the
+/// caller restarts the container when it is already running.
+///
+/// Returns true when anything was written (caller should restart HA).
+pub(super) async fn seed_home_assistant_pine_defaults() -> bool {
+    let storage = std::path::Path::new(HA_STORAGE_DIR);
+    if let Err(e) = tokio::fs::create_dir_all(storage).await {
+        warn!("pine/HA seed: cannot create {}: {}", HA_STORAGE_DIR, e);
+        return false;
+    }
+
+    let entries_changed = seed_wyoming_config_entries(storage).await;
+    let claude = seed_claude_conversation(storage).await;
+    let pipeline_changed = seed_assist_pipeline(
+        storage,
+        claude.available.then_some(CLAUDE_CONVERSATION_ENTITY),
+    )
+    .await;
+    let intents_changed = seed_voice_intents().await;
+    let automation_changed = seed_mesh_announce_automation().await;
+    entries_changed || claude.changed || pipeline_changed || intents_changed || automation_changed
+}
+
+// ---------------------------------------------------------------------------
+// Voice intents + REST sensors (configuration.yaml + custom_sentences)
+// ---------------------------------------------------------------------------
+
+/// Markers bounding the seeded block in configuration.yaml. The begin marker
+/// doubles as the legacy marker (early seeds had no end marker and always sat
+/// at EOF, so legacy upgrade = replace from begin marker to end of file).
+const VOICE_MARKER: &str = "# --- archipelago pine voice (seeded) ---";
+const VOICE_END_MARKER: &str = "# --- archipelago pine voice (end) ---";
+
+/// Read the pine status token (minting it on first use, 0600). The same
+/// token gates the sensitive tier of `/api/pine/status` (see
+/// `api::rpc::pine_status`), so seeding it into HA's REST sensor config is
+/// what lets HA — and only HA — read balances and mesh text.
+async fn ensure_status_token() -> Option<String> {
+    let dir = std::path::Path::new(NODE_SECRETS_DIR);
+    let path = dir.join(crate::api::rpc::pine_status::PINE_STATUS_TOKEN_FILE);
+    if let Ok(existing) = tokio::fs::read_to_string(&path).await {
+        let existing = existing.trim().to_string();
+        if !existing.is_empty() {
+            return Some(existing);
+        }
+    }
+    if let Err(e) = tokio::fs::create_dir_all(dir).await {
+        warn!("pine/HA seed: cannot create {}: {}", NODE_SECRETS_DIR, e);
+        return None;
+    }
+    let raw: [u8; 32] = rand::random();
+    let token = hex::encode(raw);
+    if let Err(e) = tokio::fs::write(&path, &token).await {
+        warn!("pine/HA seed: writing status token failed: {e}");
+        return None;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600));
+    }
+    info!("pine/HA seed: minted pine status token");
+    Some(token)
+}
+
+/// The seeded configuration.yaml block: REST sensors polling the node's
+/// status endpoint (through nginx on :80) + intent_script answers.
+fn voice_config_block(token: &str) -> String {
+    format!(
+        r#"{VOICE_MARKER}
+rest:
+  - resource: http://host.containers.internal/api/pine/status
+    headers:
+      Authorization: "Bearer {token}"
+    scan_interval: 30
+    sensor:
+      - name: "Archy Block Height"
+        unique_id: archy_block_height
+        value_template: "{{{{ value_json.bitcoin.height }}}}"
+      - name: "Archy Bitcoin Sync"
+        unique_id: archy_bitcoin_sync
+        unit_of_measurement: "%"
+        value_template: "{{{{ value_json.bitcoin.sync_percent }}}}"
+        availability: "{{{{ value_json.bitcoin.sync_percent is not none }}}}"
+      - name: "Archy Bitcoin Peers"
+        unique_id: archy_bitcoin_peers
+        value_template: "{{{{ value_json.bitcoin.peers }}}}"
+      - name: "Archy Mesh Peers"
+        unique_id: archy_mesh_peers
+        value_template: "{{{{ value_json.mesh.peers }}}}"
+      - name: "Archy Lightning Balance"
+        unique_id: archy_lightning_balance
+        unit_of_measurement: "sats"
+        value_template: "{{{{ (value_json.lightning or {{}}).get('channel_balance_sats') }}}}"
+        availability: "{{{{ (value_json.lightning or {{}}).get('channel_balance_sats') is not none }}}}"
+      - name: "Archy Onchain Balance"
+        unique_id: archy_onchain_balance
+        unit_of_measurement: "sats"
+        value_template: "{{{{ (value_json.lightning or {{}}).get('balance_sats') }}}}"
+        availability: "{{{{ (value_json.lightning or {{}}).get('balance_sats') is not none }}}}"
+      - name: "Archy Mesh Message"
+        unique_id: archy_mesh_message
+        value_template: "{{{{ (value_json.mesh_message or {{}}).get('id') }}}}"
+        json_attributes_path: "$.mesh_message"
+        json_attributes:
+          - from
+          - text
+          - timestamp
+intent_script:
+  ArchyBlockHeight:
+    description: >-
+      Get the current Bitcoin block height of this node. Use for any question
+      about the block height, chain tip, or number of blocks.
+    speech:
+      text: >-
+        {{% if states('sensor.archy_block_height') not in ['unknown', 'unavailable', 'None'] %}}
+          The block height is {{{{ states('sensor.archy_block_height') }}}}.
+        {{% else %}}
+          I can't read the block height right now.
+        {{% endif %}}
+  ArchyPeers:
+    description: >-
+      Get how many peers this node is connected to (bitcoin peers and mesh
+      radio peers). Use for any question about peer or connection counts.
+    speech:
+      text: >-
+        {{% set btc = states('sensor.archy_bitcoin_peers') %}}
+        {{% set mesh = states('sensor.archy_mesh_peers') %}}
+        {{% if btc not in ['unknown', 'unavailable', 'None'] %}}
+          The node has {{{{ btc }}}} bitcoin peers{{% if mesh not in ['unknown', 'unavailable', 'None'] and mesh | int(0) > 0 %}} and {{{{ mesh }}}} mesh peers{{% endif %}}.
+        {{% else %}}
+          I can't read the peer count right now.
+        {{% endif %}}
+  ArchySyncStatus:
+    description: >-
+      Get this node's Bitcoin sync status / progress percentage. Use for any
+      question about whether the node or bitcoin is synced, syncing, or up to
+      date.
+    speech:
+      text: >-
+        {{% set pct = states('sensor.archy_bitcoin_sync') %}}
+        {{% if pct in ['unknown', 'unavailable', 'None'] %}}
+          I can't read the sync status right now.
+        {{% elif pct | float(0) >= 99.99 %}}
+          The node is fully synced at block {{{{ states('sensor.archy_block_height') }}}}.
+        {{% else %}}
+          Bitcoin is {{{{ pct }}}} percent synced.
+        {{% endif %}}
+  ArchyLightningBalance:
+    description: >-
+      Get the Lightning wallet balance of this node in sats. Use for any
+      question about the lightning balance, wallet balance, or how many sats
+      are available.
+    speech:
+      text: >-
+        {{% set ln = states('sensor.archy_lightning_balance') %}}
+        {{% if ln not in ['unknown', 'unavailable', 'None'] %}}
+          Your Lightning balance is {{{{ ln }}}} sats.
+        {{% else %}}
+          I can't read the Lightning balance right now. Is Lightning set up on this node?
+        {{% endif %}}
+{VOICE_END_MARKER}
+"#
+    )
+}
+
+const VOICE_SENTENCES: &str = r#"language: "en"
+intents:
+  ArchyBlockHeight:
+    data:
+      - sentences:
+          - "what's the [current] block height"
+          - "what is the [current] block height"
+          - "[current] block height"
+          - "how many blocks [are there]"
+  ArchyPeers:
+    data:
+      - sentences:
+          - "how many peers [do I have]"
+          - "how many peers (is|are) [the node] connected to"
+          - "[node] peer count"
+  ArchySyncStatus:
+    data:
+      - sentences:
+          - "is (the node|bitcoin) [fully] synced"
+          - "[bitcoin] sync (status|progress|percent|percentage)"
+          - "how synced is (the node|bitcoin)"
+  ArchyLightningBalance:
+    data:
+      - sentences:
+          - "what's my lightning balance"
+          - "what is my lightning balance"
+          - "lightning balance"
+          - "how many sats (do I have|are in my wallet)"
+"#;
+
+/// Seed "ask Archy" node-info voice intents: custom sentences + a bounded
+/// intent_script/rest block in configuration.yaml. Upgrades earlier seeded
+/// blocks in place (including the pre-endpoint legacy block that ended at
+/// EOF); skips cleanly when the user defines intent_script/rest themselves
+/// outside our markers.
+async fn seed_voice_intents() -> bool {
+    let config_dir = std::path::Path::new(HA_CONFIG_DIR);
+    let config_yaml = config_dir.join("configuration.yaml");
+
+    let Some(token) = ensure_status_token().await else {
+        return false;
+    };
+    let desired_block = voice_config_block(&token);
+
+    // Sentences file (its own dir, no key-collision risk) — keep in sync.
+    let sentences_dir = config_dir.join("custom_sentences/en");
+    if let Err(e) = tokio::fs::create_dir_all(&sentences_dir).await {
+        warn!(
+            "pine/HA seed: cannot create {}: {}",
+            sentences_dir.display(),
+            e
+        );
+        return false;
+    }
+    let sentences_path = sentences_dir.join("archy.yaml");
+    let sentences_changed = tokio::fs::read_to_string(&sentences_path)
+        .await
+        .map(|cur| cur != VOICE_SENTENCES)
+        .unwrap_or(true);
+    if sentences_changed {
+        if let Err(e) = tokio::fs::write(&sentences_path, VOICE_SENTENCES).await {
+            warn!("pine/HA seed: writing custom sentences failed: {e}");
+            return false;
+        }
+    }
+
+    let existing = tokio::fs::read_to_string(&config_yaml)
+        .await
+        .unwrap_or_default();
+
+    let merged = if let Some(begin) = existing.find(VOICE_MARKER) {
+        if let Some(end) = existing.find(VOICE_END_MARKER) {
+            // Bounded block — replace when stale.
+            let after = end + VOICE_END_MARKER.len();
+            // Consume the trailing newline of the old block, if present.
+            let after = after + existing[after..].starts_with('\n') as usize;
+            let current = &existing[begin..after];
+            if current == desired_block {
+                return sentences_changed;
+            }
+            format!(
+                "{}{}{}",
+                &existing[..begin],
+                desired_block,
+                &existing[after..]
+            )
+        } else {
+            // Legacy block (no end marker) — it was always appended at EOF,
+            // possibly hand-edited on the node (e.g. the interim bitcoind
+            // socat sensor). Replace marker..EOF wholesale.
+            format!("{}{}", &existing[..begin], desired_block)
+        }
+    } else {
+        if existing.contains("intent_script:") || existing.contains("\nrest:") {
+            warn!("pine/HA seed: configuration.yaml already defines intent_script/rest — skipping voice intents");
+            return sentences_changed;
+        }
+        format!("{existing}\n{desired_block}")
+    };
+
+    let tmp = config_yaml.with_extension("yaml.tmp-seed");
+    if let Err(e) = tokio::fs::write(&tmp, &merged).await {
+        warn!("pine/HA seed: writing configuration.yaml failed: {e}");
+        return false;
+    }
+    if let Err(e) = tokio::fs::rename(&tmp, &config_yaml).await {
+        warn!("pine/HA seed: replacing configuration.yaml failed: {e}");
+        return false;
+    }
+    info!("pine/HA seed: voice intents + node-status sensors seeded");
+    true
+}
+
+// ---------------------------------------------------------------------------
+// Mesh-message announcements (automations.yaml)
+// ---------------------------------------------------------------------------
+
+const MESH_ANNOUNCE_AUTOMATION_ID: &str = "archy_mesh_announce";
+
+/// Announce new mesh messages on every Assist satellite. Only seeded into an
+/// empty/missing automations.yaml — merging into user-authored YAML risks
+/// mangling it, and anyone with existing automations can paste this one from
+/// the docs. Trigger conditions skip HA-restart transitions (unknown -> id).
+const MESH_ANNOUNCE_AUTOMATION: &str = r#"- id: archy_mesh_announce
+  alias: Announce mesh messages on Pine
+  description: Speak new mesh messages on the Pine speaker (seeded by Archipelago)
+  triggers:
+    - trigger: state
+      entity_id: sensor.archy_mesh_message
+  conditions:
+    - condition: template
+      value_template: >-
+        {{ trigger.from_state is not none
+           and trigger.from_state.state not in ['unknown', 'unavailable', 'None']
+           and trigger.to_state.state not in ['unknown', 'unavailable', 'None']
+           and trigger.from_state.state != trigger.to_state.state }}
+  actions:
+    - variables:
+        satellites: "{{ states.assist_satellite | map(attribute='entity_id') | list }}"
+    - condition: template
+      value_template: "{{ satellites | count > 0 }}"
+    - action: assist_satellite.announce
+      target:
+        entity_id: "{{ satellites }}"
+      data:
+        message: >-
+          New mesh message from {{ state_attr('sensor.archy_mesh_message', 'from') or 'unknown' }}:
+          {{ state_attr('sensor.archy_mesh_message', 'text') or '' }}
+  mode: queued
+  max: 5
+"#;
+
+async fn seed_mesh_announce_automation() -> bool {
+    let path = std::path::Path::new(HA_CONFIG_DIR).join("automations.yaml");
+    let existing = tokio::fs::read_to_string(&path).await.unwrap_or_default();
+    if existing.contains(MESH_ANNOUNCE_AUTOMATION_ID) {
+        return false;
+    }
+    let trimmed = existing.trim();
+    if !(trimmed.is_empty() || trimmed == "[]") {
+        warn!("pine/HA seed: automations.yaml has user content — skipping mesh announce seed");
+        return false;
+    }
+    if let Err(e) = tokio::fs::write(&path, MESH_ANNOUNCE_AUTOMATION).await {
+        warn!("pine/HA seed: writing automations.yaml failed: {e}");
+        return false;
+    }
+    info!("pine/HA seed: mesh-message announce automation seeded");
+    true
+}
+
+// ---------------------------------------------------------------------------
+// Claude conversation agent (anthropic config entry)
+// ---------------------------------------------------------------------------
+
+struct ClaudeSeed {
+    /// An anthropic entry exists (seeded now or already there) — the
+    /// pipeline may point at the Claude conversation entity.
+    available: bool,
+    /// This call wrote the store.
+    changed: bool,
+}
+
+/// Seed HA's `anthropic` integration from the node's shared Claude API key
+/// (`secrets/claude-api-key`, the same key the mesh `!ai` assistant uses).
+/// Skips when the key is absent or an anthropic entry already exists.
+async fn seed_claude_conversation(storage: &std::path::Path) -> ClaudeSeed {
+    let none = ClaudeSeed {
+        available: false,
+        changed: false,
+    };
+    let key = match tokio::fs::read_to_string(
+        std::path::Path::new(NODE_SECRETS_DIR).join("claude-api-key"),
+    )
+    .await
+    {
+        Ok(k) if !k.trim().is_empty() => k.trim().to_string(),
+        _ => {
+            info!("pine/HA seed: no claude-api-key on node — skipping Claude conversation agent");
+            return none;
+        }
+    };
+
+    let path = storage.join("core.config_entries");
+    let mut store = if tokio::fs::metadata(&path).await.is_ok() {
+        match read_store(&path).await {
+            Some(v) => v,
+            None => return none,
+        }
+    } else {
+        json!({
+            "version": 1,
+            "minor_version": 1,
+            "key": "core.config_entries",
+            "data": { "entries": [] }
+        })
+    };
+
+    let Some(entries) = store
+        .get_mut("data")
+        .and_then(|d| d.get_mut("entries"))
+        .and_then(|e| e.as_array_mut())
+    else {
+        warn!("pine/HA seed: core.config_entries has unexpected shape, leaving untouched");
+        return none;
+    };
+
+    if entries
+        .iter()
+        .any(|e| e.get("domain").and_then(Value::as_str) == Some("anthropic"))
+    {
+        return ClaudeSeed {
+            available: true,
+            changed: false,
+        };
+    }
+
+    let id = |raw: [u8; 16]| hex::encode(raw);
+    // Shape mirrors what HA 2026.7's anthropic config flow creates (entry
+    // version 2.4 with conversation + ai_task subentries). Bookkeeping
+    // fields (created_at/modified_at/discovery_keys) must be written here:
+    // the store already carries HA's current schema minor_version, so HA
+    // never migrates appended entries — a missing created_at is a
+    // KeyError that crash-loops HA at boot.
+    entries.push(json!({
+        "entry_id": id(rand::random()),
+        "version": 2,
+        "minor_version": 4,
+        "domain": "anthropic",
+        "title": "Claude",
+        "data": { "api_key": key },
+        "options": {},
+        "pref_disable_new_entities": false,
+        "pref_disable_polling": false,
+        "source": "user",
+        "unique_id": null,
+        "disabled_by": null,
+        "created_at": ha_now(),
+        "modified_at": ha_now(),
+        "discovery_keys": {},
+        "subentries": [
+            {
+                "subentry_id": id(rand::random()),
+                "subentry_type": "conversation",
+                "title": "Claude conversation",
+                "unique_id": null,
+                "data": {
+                    "recommended": true,
+                    "llm_hass_api": ["assist"],
+                    // Steers fuzzy phrasings onto the local Archy* intent
+                    // tools (cheap + exact) instead of free-form answers,
+                    // and keeps replies speaker-length.
+                    "prompt": "You are Archy, the voice of this Archipelago Bitcoin node, speaking through a smart speaker. Answers are spoken aloud: keep them to one or two short sentences, no markdown, no lists. When the user asks about the node — block height, sync status, peers, balances — call the matching Archy tool rather than answering from memory, even if the phrasing is loose. Only answer directly when no tool fits."
+                }
+            },
+            {
+                "subentry_id": id(rand::random()),
+                "subentry_type": "ai_task_data",
+                "title": "Claude AI Task",
+                "unique_id": null,
+                "data": { "recommended": true }
+            }
+        ]
+    }));
+
+    if !write_store(&path, &store).await {
+        return none;
+    }
+    info!("pine/HA seed: added Claude conversation agent (anthropic config entry)");
+    ClaudeSeed {
+        available: true,
+        changed: true,
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Wyoming config entries
+// ---------------------------------------------------------------------------
+
+/// Ensure `core.config_entries` has a `wyoming` entry per Pine engine.
+async fn seed_wyoming_config_entries(storage: &std::path::Path) -> bool {
+    let path = storage.join("core.config_entries");
+    let mut store = if tokio::fs::metadata(&path).await.is_ok() {
+        match read_store(&path).await {
+            Some(v) => v,
+            // Present but unreadable/corrupt: never overwrite it with a
+            // fresh store — that would throw away every integration.
+            None => return false,
+        }
+    } else {
+        json!({
+            "version": 1,
+            "minor_version": 1,
+            "key": "core.config_entries",
+            "data": { "entries": [] }
+        })
+    };
+
+    let Some(entries) = store
+        .get_mut("data")
+        .and_then(|d| d.get_mut("entries"))
+        .and_then(|e| e.as_array_mut())
+    else {
+        warn!("pine/HA seed: core.config_entries has unexpected shape, leaving untouched");
+        return false;
+    };
+
+    let mut added = false;
+    for (title, host, port) in PINE_ENGINES {
+        let exists = entries.iter().any(|e| {
+            e.get("domain").and_then(Value::as_str) == Some("wyoming")
+                && e.get("data")
+                    .and_then(|d| d.get("host"))
+                    .and_then(Value::as_str)
+                    == Some(host)
+                && e.get("data")
+                    .and_then(|d| d.get("port"))
+                    .and_then(Value::as_u64)
+                    == Some(port as u64)
+        });
+        if exists {
+            continue;
+        }
+        let entry_id: [u8; 16] = rand::random();
+        entries.push(json!({
+            "entry_id": hex::encode(entry_id),
+            "version": 1,
+            "minor_version": 1,
+            "domain": "wyoming",
+            "title": title,
+            "data": { "host": host, "port": port },
+            "options": {},
+            "pref_disable_new_entities": false,
+            "pref_disable_polling": false,
+            "source": "user",
+            "unique_id": null,
+            "disabled_by": null,
+            "created_at": ha_now(),
+            "modified_at": ha_now(),
+            "discovery_keys": {},
+            "subentries": []
+        }));
+        info!("pine/HA seed: added wyoming config entry {title} ({host}:{port})");
+        added = true;
+    }
+
+    if added && !write_store(&path, &store).await {
+        return false;
+    }
+    added
+}
+
+// ---------------------------------------------------------------------------
+// Assist pipeline
+// ---------------------------------------------------------------------------
+
+/// Ensure an Assist pipeline uses the Pine engines. Creates the store when
+/// missing; when it exists, repairs the pre-2024.6 conversation-agent id
+/// (`homeassistant` -> `conversation.home_assistant`) and — when a Claude
+/// agent is available — upgrades pipelines still on the default local agent
+/// to Claude with `prefer_local_intents: true` (node intents stay local/free,
+/// everything else goes to Claude).
+async fn seed_assist_pipeline(storage: &std::path::Path, claude_entity: Option<&str>) -> bool {
+    let path = storage.join("assist_pipeline.pipelines");
+
+    if let Some(mut store) = read_store(&path).await {
+        let Some(items) = store
+            .get_mut("data")
+            .and_then(|d| d.get_mut("items"))
+            .and_then(|i| i.as_array_mut())
+        else {
+            return false;
+        };
+        let mut changed = false;
+        for item in items.iter_mut() {
+            if item.get("conversation_engine").and_then(Value::as_str) == Some("homeassistant") {
+                item["conversation_engine"] = json!("conversation.home_assistant");
+                info!("pine/HA seed: repaired legacy conversation agent id in Assist pipeline");
+                changed = true;
+            }
+            if let Some(engine) = claude_entity {
+                if item.get("conversation_engine").and_then(Value::as_str)
+                    == Some("conversation.home_assistant")
+                {
+                    item["conversation_engine"] = json!(engine);
+                    item["prefer_local_intents"] = json!(true);
+                    info!("pine/HA seed: pipeline upgraded to Claude (local intents preferred)");
+                    changed = true;
+                }
+            }
+        }
+        if changed {
+            return write_store(&path, &store).await;
+        }
+        return false;
+    }
+
+    // ULID-shaped id (26 chars, Crockford base32) — HA only needs uniqueness.
+    let id: String = {
+        const ALPHABET: &[u8] = b"0123456789abcdefghjkmnpqrstvwxyz";
+        let raw: [u8; 26] = rand::random();
+        raw.iter()
+            .map(|b| ALPHABET[(*b % 32) as usize] as char)
+            .collect()
+    };
+    let store = json!({
+        "version": 1,
+        "minor_version": 1,
+        "key": "assist_pipeline.pipelines",
+        "data": {
+            "items": [{
+                "conversation_engine": claude_entity.unwrap_or("conversation.home_assistant"),
+                "conversation_language": "en",
+                "id": id,
+                "language": "en",
+                "name": "Pine (local)",
+                "prefer_local_intents": claude_entity.is_some(),
+                "stt_engine": "stt.faster_whisper",
+                "stt_language": "en",
+                "tts_engine": "tts.piper",
+                "tts_language": "en_GB",
+                "tts_voice": null,
+                "wake_word_entity": null,
+                "wake_word_id": null
+            }],
+            "preferred_item": id
+        }
+    });
+    if write_store(&path, &store).await {
+        info!("pine/HA seed: created default Assist pipeline (whisper + piper)");
+        return true;
+    }
+    false
+}
+
+// ---------------------------------------------------------------------------
+// Presence probes + HA restart
+// ---------------------------------------------------------------------------
+
+/// True when the Pine Wyoming engines are installed on this node (their shared
+/// data dir is created by the stack install).
+pub(super) async fn pine_engines_installed() -> bool {
+    tokio::fs::metadata("/var/lib/archipelago/pine")
+        .await
+        .is_ok()
+}
+
+/// True when Home Assistant has a config dir on this node (installed at some
+/// point; .storage may not exist until first boot, which seeding handles).
+pub(super) async fn home_assistant_installed() -> bool {
+    tokio::fs::metadata(HA_CONFIG_DIR).await.is_ok()
+}
+
+/// Restart the HA container so it loads the seeded storage. Best-effort: when
+/// the container doesn't exist (not yet created) the next start picks the
+/// seeds up anyway.
+pub(super) async fn restart_home_assistant_if_running() {
+    let running = tokio::process::Command::new("podman")
+        .args([
+            "ps",
+            "--format",
+            "{{.Names}}",
+            "--filter",
+            "name=homeassistant",
+        ])
+        .output()
+        .await
+        .map(|o| {
+            String::from_utf8_lossy(&o.stdout)
+                .lines()
+                .any(|l| l.trim() == "homeassistant")
+        })
+        .unwrap_or(false);
+    if !running {
+        return;
+    }
+    match tokio::process::Command::new("podman")
+        .args(["restart", "homeassistant"])
+        .output()
+        .await
+    {
+        Ok(o) if o.status.success() => info!("pine/HA seed: restarted homeassistant"),
+        Ok(o) => warn!(
+            "pine/HA seed: podman restart homeassistant failed: {}",
+            String::from_utf8_lossy(&o.stderr)
+        ),
+        Err(e) => warn!("pine/HA seed: podman restart homeassistant failed: {e}"),
+    }
+}
+
+async fn read_store(path: &std::path::Path) -> Option<Value> {
+    let raw = tokio::fs::read_to_string(path).await.ok()?;
+    match serde_json::from_str(&raw) {
+        Ok(v) => Some(v),
+        Err(e) => {
+            warn!(
+                "pine/HA seed: {} is not valid JSON ({}), leaving untouched",
+                path.display(),
+                e
+            );
+            None
+        }
+    }
+}
+
+async fn write_store(path: &std::path::Path, store: &Value) -> bool {
+    let pretty = match serde_json::to_string_pretty(store) {
+        Ok(s) => s,
+        Err(e) => {
+            warn!("pine/HA seed: serialize {} failed: {}", path.display(), e);
+            return false;
+        }
+    };
+    // Write via temp + rename so HA never reads a half-written store.
+    let tmp = path.with_extension("tmp-seed");
+    if let Err(e) = tokio::fs::write(&tmp, pretty).await {
+        warn!("pine/HA seed: write {} failed: {}", tmp.display(), e);
+        return false;
+    }
+    if let Err(e) = tokio::fs::rename(&tmp, path).await {
+        warn!("pine/HA seed: rename into {} failed: {}", path.display(), e);
+        return false;
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn voice_block_is_bounded_and_carries_token() {
+        let block = voice_config_block("deadbeef");
+        assert!(block.starts_with(VOICE_MARKER));
+        assert!(block.trim_end().ends_with(VOICE_END_MARKER));
+        assert!(block.contains("Bearer deadbeef"));
+        // Every intent the sentences file declares has a script answer.
+        for intent in [
+            "ArchyBlockHeight",
+            "ArchyPeers",
+            "ArchySyncStatus",
+            "ArchyLightningBalance",
+        ] {
+            assert!(block.contains(intent), "missing intent {intent}");
+            assert!(
+                VOICE_SENTENCES.contains(intent),
+                "missing sentences {intent}"
+            );
+        }
+    }
+
+    #[test]
+    fn legacy_block_replacement_drops_old_content() {
+        // Simulates the pre-endpoint node state: legacy marker + hand-edited
+        // socat/bitcoind sensor block at EOF.
+        let existing = format!(
+            "default_config:\n\n{VOICE_MARKER}\nrest:\n  - resource: http://host.containers.internal:18332/\n    username: archipelago\n"
+        );
+        let begin = existing.find(VOICE_MARKER).unwrap();
+        let desired = voice_config_block("tok");
+        let merged = format!("{}{}", &existing[..begin], desired);
+        assert!(!merged.contains("18332"));
+        assert!(merged.contains("Bearer tok"));
+        assert!(merged.starts_with("default_config:"));
+    }
+}
@@ -750,7 +750,7 @@ fn pine_stack_app_ids() -> &'static [&'static str] {
    // then the user-facing launcher ("pine", the nginx that serves the setup /
    // status page + is the Open target). Mirrors the pine startup_order in
    // dependencies.rs + the stack member table in app_ops.rs.
-    &["pine-whisper", "pine-piper", "pine"]
+    &["pine-whisper", "pine-piper", "pine-openwakeword", "pine"]
 }

 fn indeedhub_stack_app_ids() -> &'static [&'static str] {
@@ -1934,12 +1934,18 @@ impl RpcHandler {
        if let Some(orchestrated) =
            install_stack_via_orchestrator(self, "pine", pine_stack_app_ids()).await?
        {
+            Self::seed_pine_ha_defaults().await;
            return Ok(orchestrated);
        }

-        if let Some(adopted) =
-            adopt_stack_if_exists("pine", "pine", &["pine-whisper", "pine-piper", "pine"]).await?
+        if let Some(adopted) = adopt_stack_if_exists(
+            "pine",
+            "pine",
+            &["pine-whisper", "pine-piper", "pine-openwakeword", "pine"],
+        )
+        .await?
        {
+            Self::seed_pine_ha_defaults().await;
            return Ok(adopted);
        }

@@ -1947,6 +1953,17 @@ impl RpcHandler {
            "pine manifests not available on this node — the signed catalog must provide apps/pine-*/manifest.yml"
        )
    }
+
+    /// After a Pine install, wire Home Assistant to the new engines when HA is
+    /// on this node (the HA post-install hook covers the reverse order).
+    async fn seed_pine_ha_defaults() {
+        if !super::pine_ha::home_assistant_installed().await {
+            return;
+        }
+        if super::pine_ha::seed_home_assistant_pine_defaults().await {
+            super::pine_ha::restart_home_assistant_if_running().await;
+        }
+    }
 }

 #[cfg(test)]
@@ -0,0 +1,159 @@
+//! Node-status JSON for the Pine voice stack (`GET /api/pine/status`).
+//!
+//! Two tiers in one endpoint:
+//! - **Public** (no credentials): version, uptime, bitcoin height / sync /
+//!   peer count, mesh peer count. Feeds the Pine launcher page's live status
+//!   card — nothing here a LAN visitor couldn't already infer from the
+//!   existing unauthenticated `/bitcoin-status`.
+//! - **Token** (`Authorization: Bearer <pine-status-token>`): adds Lightning
+//!   balances and the most recent received mesh text message. Feeds the
+//!   Home Assistant REST sensors seeded by `package::pine_ha` — the seeder
+//!   mints the token into `data_dir/secrets/pine-status-token` (0600) and
+//!   embeds it in HA's configuration, so only HA (and the node owner) can
+//!   read balances or message text.
+//!
+//! Replaces the interim per-node socat forwarder + bitcoind-RPC-credentials-
+//! in-configuration.yaml stopgap used before this endpoint existed.
+
+use super::RpcHandler;
+use crate::mesh::types::MessageDirection;
+use serde_json::{json, Value};
+
+/// File under `data_dir/secrets/` holding the bearer token that unlocks the
+/// sensitive tier. Written by the pine/HA seeder, read per-request here.
+pub(crate) const PINE_STATUS_TOKEN_FILE: &str = "pine-status-token";
+
+/// Constant-time-ish equality — avoids early-exit timing on the token compare.
+fn token_eq(a: &str, b: &str) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    a.bytes()
+        .zip(b.bytes())
+        .fold(0u8, |acc, (x, y)| acc | (x ^ y))
+        == 0
+}
+
+impl RpcHandler {
+    /// True when `presented` matches the on-disk pine status token. Missing or
+    /// empty token file means the sensitive tier is locked (seeder not run).
+    pub(crate) async fn pine_status_token_ok(&self, presented: &str) -> bool {
+        let path = self
+            .config
+            .data_dir
+            .join("secrets")
+            .join(PINE_STATUS_TOKEN_FILE);
+        match tokio::fs::read_to_string(&path).await {
+            Ok(tok) => {
+                let tok = tok.trim();
+                !tok.is_empty() && token_eq(tok, presented.trim())
+            }
+            Err(_) => false,
+        }
+    }
+
+    /// Assemble the status document. `authorized` selects the token tier.
+    /// Every sub-source is best-effort: a dead bitcoind/LND/mesh never turns
+    /// the endpoint into an error — the field just reports what it can.
+    pub(crate) async fn pine_status_json(&self, authorized: bool) -> Value {
+        let bs = crate::bitcoin_status::get_bitcoin_status().await;
+        let bitcoin = {
+            let info = bs.blockchain_info.as_ref();
+            let height = info.and_then(|i| i.get("blocks")).and_then(Value::as_u64);
+            let progress = info
+                .and_then(|i| i.get("verificationprogress"))
+                .and_then(Value::as_f64);
+            let ibd = info
+                .and_then(|i| i.get("initialblockdownload"))
+                .and_then(Value::as_bool);
+            let peers = bs
+                .network_info
+                .as_ref()
+                .and_then(|n| n.get("connections"))
+                .and_then(Value::as_u64);
+            json!({
+                "ok": bs.ok,
+                "height": height,
+                "sync_percent": progress.map(|p| (p * 10000.0).round() / 100.0),
+                "ibd": ibd,
+                "peers": peers,
+            })
+        };
+
+        let (mesh, mesh_message) = {
+            let guard = self.mesh_service.read().await;
+            match guard.as_ref() {
+                Some(svc) => {
+                    let status = svc.status().await;
+                    let latest = if authorized {
+                        svc.messages(None)
+                            .await
+                            .iter()
+                            .rev()
+                            .find(|m| {
+                                m.direction == MessageDirection::Received
+                                    && m.message_type == "text"
+                            })
+                            .map(|m| {
+                                json!({
+                                    "id": m.id,
+                                    "from": m.peer_name.clone()
+                                        .unwrap_or_else(|| format!("contact {}", m.peer_contact_id)),
+                                    "text": m.plaintext,
+                                    "timestamp": m.timestamp,
+                                })
+                            })
+                    } else {
+                        None
+                    };
+                    (
+                        json!({ "enabled": status.enabled, "peers": status.peer_count }),
+                        latest,
+                    )
+                }
+                None => (json!({ "enabled": false, "peers": 0 }), None),
+            }
+        };
+
+        let lightning = if authorized {
+            match self.handle_lnd_getinfo().await {
+                Ok(info) => json!({
+                    "balance_sats": info.get("balance_sats"),
+                    "channel_balance_sats": info.get("channel_balance_sats"),
+                    "active_channels": info.get("num_active_channels"),
+                    "synced_to_chain": info.get("synced_to_chain"),
+                }),
+                Err(_) => Value::Null,
+            }
+        } else {
+            Value::Null
+        };
+
+        json!({
+            "ok": true,
+            "version": env!("CARGO_PKG_VERSION"),
+            "uptime_seconds": crate::crash_recovery::uptime_seconds(),
+            "bitcoin": bitcoin,
+            "mesh": mesh,
+            "lightning": lightning,
+            // Always an object: HA's REST sensor reads attributes via
+            // json_attributes_path "$.mesh_message", and a null there makes
+            // HA log a "JSON result was not a dictionary" warning every scan.
+            "mesh_message": mesh_message.unwrap_or_else(|| json!({})),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::token_eq;
+
+    #[test]
+    fn token_eq_matches_only_exact() {
+        assert!(token_eq("abc123", "abc123"));
+        assert!(!token_eq("abc123", "abc124"));
+        assert!(!token_eq("abc123", "abc12"));
+        assert!(!token_eq("", "x"));
+        assert!(token_eq("", ""));
+    }
+}
@@ -719,4 +719,94 @@ impl RpcHandler {
            _ => anyhow::bail!("Unknown setting: {}", key),
        }
    }
+
+    /// system.kiosk-display.get — Current kiosk display preset + whether this
+    /// node has a kiosk at all (no kiosk unit -> the Settings section hides).
+    pub(in crate::api::rpc) async fn handle_system_kiosk_display_get(
+        &self,
+    ) -> Result<serde_json::Value> {
+        let has_kiosk = tokio::fs::metadata("/etc/systemd/system/archipelago-kiosk.service")
+            .await
+            .is_ok();
+        let conf = tokio::fs::read_to_string(KIOSK_DISPLAY_CONF)
+            .await
+            .unwrap_or_default();
+        let preset = if conf.contains("ARCHIPELAGO_KIOSK_SCALE=1") {
+            "native"
+        } else if conf.contains("ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920") {
+            "balanced"
+        } else if conf.contains("ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280") {
+            "large"
+        } else {
+            "auto"
+        };
+        Ok(serde_json::json!({ "has_kiosk": has_kiosk, "preset": preset }))
+    }
+
+    /// system.kiosk-display.set — Write the kiosk display preset and restart
+    /// the kiosk (only if it is running) so it takes effect immediately. The
+    /// launcher sources /etc/archipelago/kiosk-display.conf at startup.
+    pub(in crate::api::rpc) async fn handle_system_kiosk_display_set(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let preset = params
+            .get("preset")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing preset"))?;
+
+        let conf = match preset {
+            // Resolution-derived default: 4K -> 2.0 (1920-wide layout),
+            // 1080p TV -> 1.5, laptop panels -> 1.0.
+            "auto" => String::new(),
+            // Biggest UI: every panel targets a 1280-wide layout.
+            "large" => "ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280\n".to_string(),
+            // Full-HD layout on any panel that can carry it.
+            "balanced" => "ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920\n".to_string(),
+            // No scaling: native CSS viewport, most content, smallest UI.
+            "native" => "ARCHIPELAGO_KIOSK_SCALE=1\n".to_string(),
+            other => anyhow::bail!("Unknown display preset: {other}"),
+        };
+
+        host_sudo(&["/usr/bin/mkdir", "-p", "/etc/archipelago"]).await?;
+        if conf.is_empty() {
+            let _ = host_sudo(&["/usr/bin/rm", "-f", KIOSK_DISPLAY_CONF]).await;
+        } else {
+            // tee via sudo — the backend runs unprivileged and /etc is root's.
+            let mut child = tokio::process::Command::new("/usr/bin/sudo")
+                .args(["-n", "/usr/bin/tee", KIOSK_DISPLAY_CONF])
+                .stdin(std::process::Stdio::piped())
+                .stdout(std::process::Stdio::null())
+                .stderr(std::process::Stdio::piped())
+                .spawn()
+                .context("spawn sudo tee for kiosk display conf")?;
+            use tokio::io::AsyncWriteExt;
+            if let Some(mut stdin) = child.stdin.take() {
+                stdin.write_all(conf.as_bytes()).await?;
+            }
+            let out = child.wait_with_output().await?;
+            if !out.status.success() {
+                anyhow::bail!(
+                    "writing {} failed: {}",
+                    KIOSK_DISPLAY_CONF,
+                    String::from_utf8_lossy(&out.stderr).trim()
+                );
+            }
+        }
+
+        // try-restart: only bounces a kiosk that is actually running, so this
+        // never starts a kiosk an operator disabled.
+        let _ = host_sudo(&[
+            "/usr/bin/systemctl",
+            "try-restart",
+            "archipelago-kiosk.service",
+        ])
+        .await;
+
+        info!(preset, "Kiosk display preset applied");
+        Ok(serde_json::json!({ "preset": preset, "applied": true }))
+    }
 }
+
+const KIOSK_DISPLAY_CONF: &str = "/etc/archipelago/kiosk-display.conf";
@@ -50,7 +50,7 @@ pub fn stack_member_app_ids(package_id: &str) -> &'static [&'static str] {
            &["archy-btcpay-db", "archy-nbxplorer", "btcpay-server"]
        }
        "netbird" => &["netbird-server", "netbird-dashboard", "netbird"],
-        "pine" => &["pine-whisper", "pine-piper", "pine"],
+        "pine" => &["pine-whisper", "pine-piper", "pine-openwakeword", "pine"],
        // The legacy umbrella id maps to the split stack (the orchestrator's
        // umbrella alias handles this too; listing it here keeps the RPC
        // layer's fan-out explicit).
@@ -80,6 +80,13 @@ const NGINX_LND_PROXY_BLOCK: &str = "\n    # LND REST proxy — backend handles
 /// block in image-recipe/configs/nginx-archipelago.conf.
 const NGINX_PEER_CONTENT_BLOCK: &str = "\n    # Peer content streaming proxy (B3) — Range-streams a peer's media file.\n    # Long read timeout: this path also serves full-file downloads of large\n    # media (#38), which can take minutes over Tor; 120s aborted them.\n    location /api/peer-content/ {\n        proxy_pass http://127.0.0.1:5678;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header Cookie $http_cookie;\n        proxy_set_header Range $http_range;\n        proxy_buffering off;\n        proxy_connect_timeout 10s;\n        proxy_read_timeout 900s;\n        error_page 502 503 = @backend_unavailable;\n        error_page 504 = @backend_timeout;\n    }\n";

+/// Inserted into every server block lacking the Pine node-status proxy.
+/// `/api/pine/status` serves the Pine launcher page's live status card and
+/// the seeded Home Assistant REST sensors (the sensitive tier is gated by a
+/// bearer token at the backend, so nginx just forwards). Kept in sync with
+/// the canonical block in image-recipe/configs/nginx-archipelago.conf.
+const NGINX_PINE_STATUS_BLOCK: &str = "\n    # Pine node status — live node facts for the Pine launcher page and the\n    # seeded Home Assistant sensors. Sensitive fields are token-gated at the\n    # backend; nginx only forwards.\n    location /api/pine/status {\n        proxy_pass http://127.0.0.1:5678;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header Authorization $http_authorization;\n        proxy_set_header Cookie $http_cookie;\n        proxy_connect_timeout 10s;\n        proxy_read_timeout 15s;\n        proxy_send_timeout 5s;\n        error_page 502 503 = @backend_unavailable;\n        error_page 504 = @backend_timeout;\n    }\n";
+
 /// B13 — Fedimint UI asset rewrite. Pre-fix nodes proxy /app/fedimint/ with only
 /// the nostr-provider injection (`sub_filter_once on`), so the UI's root-rooted
 /// CSS/JS asset URLs (href="/…", url("/…")) miss the proxy and load the SPA shell
@@ -854,6 +861,7 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
        && !content.contains("location /bitcoin-status");
    let missing_lnd_proxy = has_lnd_anchor && !content.contains("location /proxy/lnd/");
    let missing_peer_content = has_lnd_anchor && !content.contains("location /api/peer-content");
+    let missing_pine_status = has_lnd_anchor && !content.contains("location /api/pine/status");
    let has_lnd_dup_cors = content.contains(NGINX_LND_DUP_CORS);
    // B13: fedimint block present but lacking the asset-rewrite sub_filters.
    let needs_fedimint_css = content.contains("location /app/fedimint/")
@@ -862,6 +870,7 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
        && !missing_bitcoin_status
        && !missing_lnd_proxy
        && !missing_peer_content
+        && !missing_pine_status
        && !has_lnd_dup_cors
        && !needs_fedimint_css
    {
@@ -907,6 +916,22 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
        }
    }

+    if missing_pine_status {
+        // Same anchoring as the LND proxy: prepend to every server block that
+        // proxies to the backend.
+        let anchor = if patched.contains("    location /lnd-connect-info {") {
+            "    location /lnd-connect-info {"
+        } else {
+            "    location /electrs-status {"
+        };
+        if patched.contains(anchor) {
+            let replacement = format!("{}{}", NGINX_PINE_STATUS_BLOCK, anchor);
+            patched = patched.replace(anchor, &replacement);
+        } else {
+            warn!("nginx conf missing anchor — skipping /api/pine/status patch");
+        }
+    }
+
    if missing_peer_content {
        // Same anchoring as the LND proxy: prepend the block to every server
        // block so /api/peer-content/* reaches the backend instead of the SPA.
@@ -59,6 +59,7 @@ impl DockerPackageScanner {
            "netbird-dashboard",
            "pine-whisper",
            "pine-piper",
+            "pine-openwakeword",
            "buildx_buildkit_default",
        ];

@@ -284,7 +284,7 @@ impl QuadletUnit {
            let _ = writeln!(s, "PodmanArgs=--cpus={cpus}");
        }
        if let Some(h) = &self.health {
-            let _ = writeln!(s, "HealthCmd={}", h.cmd);
+            let _ = writeln!(s, "HealthCmd={}", h.cmd.replace('%', "%%"));
            let _ = writeln!(s, "HealthInterval={}", h.interval);
            let _ = writeln!(s, "HealthTimeout={}", h.timeout);
            let _ = writeln!(s, "HealthRetries={}", h.retries);
@@ -298,7 +298,7 @@ impl QuadletUnit {
            // images use `ENTRYPOINT ["bitcoind"]`, which turned the wrapper
            // into `bitcoind sh -lc ...` and crash-looped). Emitting
            // Entrypoint= makes the unit independent of the image's entrypoint.
-            let _ = writeln!(s, "Entrypoint={first}");
+            let _ = writeln!(s, "Entrypoint={}", first.replace('%', "%%"));
            let mut parts: Vec<String> = rest.to_vec();
            parts.extend(self.command.iter().cloned());
            if !parts.is_empty() {
@@ -335,11 +335,16 @@ impl QuadletUnit {
 /// the minimum quoting needed so quadlet's parser sees one element per
 /// item: anything containing whitespace, quotes, or shell metacharacters
 /// gets wrapped in double quotes with embedded `"` and `\` escaped.
+///
+/// `%` is escaped to `%%`: quadlet copies Exec= content into the generated
+/// service's ExecStart, where systemd expands `%` specifiers at load time —
+/// a bare `%s` in a manifest script silently became `/bin/bash` (the user's
+/// shell) and corrupted bitcoind's generated rpc.conf.
 fn shell_join(parts: &[String]) -> String {
    parts
        .iter()
        .map(|p| {
-            let p = p.replace(['\r', '\n'], " ");
+            let p = p.replace(['\r', '\n'], " ").replace('%', "%%");
            if p.is_empty() || p.chars().any(|c| c.is_whitespace() || "\"\\$`".contains(c)) {
                let escaped = p
                    .replace('\\', "\\\\")
@@ -355,7 +360,8 @@ fn shell_join(parts: &[String]) -> String {
 }

 fn quote_environment(env: &str) -> String {
-    let env = env.replace(['\r', '\n'], " ");
+    // `%` → `%%` for the same systemd-specifier reason as shell_join.
+    let env = env.replace(['\r', '\n'], " ").replace('%', "%%");
    if env.is_empty()
        || env
            .chars()
@@ -1122,6 +1128,20 @@ mod tests {
        );
    }

+    #[test]
+    fn percent_is_escaped_for_systemd_specifiers() {
+        // Regression: a bare `%s` in an Exec= line is a systemd specifier
+        // (user's shell = /bin/bash) once quadlet copies it into the
+        // generated ExecStart — bitcoind's rpc.conf came out as
+        // `rpcuser=/bin/bash` and every RPC consumer got 401s.
+        assert_eq!(
+            shell_join(&["printf 'rpcuser=%s' \"$U\"".to_string()]),
+            "\"printf 'rpcuser=%%s' \\\"$$U\\\"\""
+        );
+        assert_eq!(shell_join(&["--fmt=%h:%p".to_string()]), "--fmt=%%h:%%p");
+        assert_eq!(quote_environment("FMT=%m"), "FMT=%%m");
+    }
+
    #[test]
    fn restart_policy_emits_correct_systemd_string() {
        assert_eq!(RestartPolicy::Always.as_systemd(), "always");
@@ -768,6 +768,7 @@ fn should_auto_start_stopped_container(name: &str, include_stack_members: bool)
                | "netbird"
                | "pine-whisper"
                | "pine-piper"
+                | "pine-openwakeword"
                | "pine"
        )
 }
@@ -836,9 +837,10 @@ fn stack_recovery_specs() -> &'static [StackRecoverySpec] {
            aliases: &[
                ("pine-whisper", "pine-whisper"),
                ("pine-piper", "pine-piper"),
+                ("pine-openwakeword", "pine-openwakeword"),
                ("pine", "pine"),
            ],
-            containers: &["pine-whisper", "pine-piper", "pine"],
+            containers: &["pine-whisper", "pine-piper", "pine-openwakeword", "pine"],
            // The launcher only depends on the two engines; whisper is the
            // heaviest/first member, so treat it as the stack anchor (its
            // presence means the stack was really installed, not orphan debris).
@@ -0,0 +1,60 @@
+# Framework PT test plan — Pine voice epic (pre-release gate)
+
+Target node: **framework-pt** (`100.65.115.109`, LAN 192.168.1.249). Run after
+BOTH agents' work is merged, with the dev binary sideloaded and the signed
+catalog (pine 1.3.0 + pine-openwakeword) published. Every ❑ must pass before
+the release ritual starts. Items marked **(user)** need a human in the room.
+
+## A. Deploy / prerequisites
+- ❑ A1 Dev binary sideloaded, `archipelago` service active, no crash-loop in journal.
+- ❑ A2 nginx self-heal added `location /api/pine/status` to every server block; `nginx -t` passes; nginx reloaded.
+- ❑ A3 Signed catalog with pine 1.3.0 + pine-openwakeword live at the raw URL; node refreshed it (hourly sweep or "Check for updates").
+
+## B. `/api/pine/status` endpoint
+- ❑ B1 Public tier through nginx (`curl http://127.0.0.1/api/pine/status`): version, uptime, bitcoin height/sync_percent/peers, mesh peers. `lightning` null, `mesh_message` absent.
+- ❑ B2 Wrong bearer token → still public-only (no balances). Correct token (from `/var/lib/archipelago/secrets/pine-status-token`) → lightning balances + latest mesh message present.
+- ❑ B3 Reachable from inside the HA container via `host.containers.internal:80`.
+- ❑ B4 Token file is 0600, owned by the service user.
+
+## C. Stack / openwakeword container
+- ❑ C1 Reconcile installs `pine-openwakeword` (wyoming-openwakeword 2.1.0), healthy on :10400.
+- ❑ C2 Existing pine-whisper / pine-piper / pine were ADOPTED, not recreated — model data dirs untouched.
+- ❑ C3 `archipelago` service restart → all four pine containers come back (crash-recovery stack spec).
+- ❑ C4 UI: openwakeword listed under Services (no extra store card); Pine card shows 1.3.0.
+
+## D. Home Assistant seeding
+- ❑ D1 configuration.yaml: legacy hand-staged block (bitcoind :18332 + plaintext RPC creds) fully replaced by the bounded token-based block.
+- ❑ D2 `custom_sentences/en/archy.yaml` carries all four intents.
+- ❑ D3 `.storage/core.config_entries`: wyoming entry for openwakeword (:10400) + `anthropic` entry (Claude, conversation + ai_task subentries).
+- ❑ D4 Pipeline: `conversation_engine = conversation.claude_conversation`, `prefer_local_intents: true`.
+- ❑ D5 automations.yaml: `archy_mesh_announce` seeded.
+- ❑ D6 HA restarts clean — no setup errors for anthropic / wyoming / rest / intent_script in `podman logs homeassistant`.
+- ❑ D7 Sensors report real values: archy_block_height, archy_bitcoin_sync, archy_bitcoin_peers, archy_mesh_peers, archy_lightning_balance (or clean unavailable if LND absent), archy_mesh_message.
+
+## E. Voice / intents (API level first, then live speaker)
+- ❑ E1 Exact phrase "what's the block height" → answered by the LOCAL intent (correct height, no Anthropic API call in HA logs).
+- ❑ E2 Fuzzy phrase (e.g. "how tall is the chain right now") → Claude routes to the ArchyBlockHeight tool; answer contains the real height.
+- ❑ E3 "how many peers", "is the node synced", "what's my lightning balance" → correct spoken-length answers.
+- ❑ E4 Off-topic question → Claude answers, 1–2 sentences, no markdown.
+- ❑ E5 **(user)** Live speaker: "Hey Jarvis, what's the block height" → audible correct answer.
+- ❑ E6 Mesh announce: new received mesh text (or manual `assist_satellite.announce` if no radio) → speaker announces sender + text; no announce storm on HA restart.
+
+## F. Pine launcher page (1.3.0)
+- ❑ F1 Page on :10380→:10381 shows the live node card (version, uptime, block, sync, peers) within ~5s.
+- ❑ F2 `/node-status` proxy works (pine nginx resolves host.containers.internal at startup — container must not crash-loop).
+- ❑ F3 "Connect Pine to WiFi" provisioner still intact (no JS errors on load).
+
+## G. Cleanup / regression sweep
+- ❑ G1 Both stray socat 18332 forwarders killed; sensors still work via the endpoint.
+- ❑ G2 No bitcoind RPC credentials anywhere in HA config.
+- ❑ G3 Pre-existing HA function intact: whisper/piper entities, PineVoice satellite pairing, other integrations.
+- ❑ G4 nginx regressions: `/health`, `/bitcoin-status`, `/api/app-catalog`, `/proxy/lnd/` all still proxied post-patch.
+- ❑ G5 **(user)** Mobile Home: wallet card sits directly under My Apps; desktop layout unchanged.
+- ❑ G6 Other agent's changes re-verified after merge (their own checklist).
+
+## H. Production-readiness (release ritual gate)
+- ❑ H1 `cargo test` workspace green; frontend builds; drift check `--release --strict` green.
+- ❑ H2 `tests/lifecycle/run-gate.sh` re-run ON .228 (stack membership changed → lifecycle gate rule applies).
+- ❑ H3 Catalog regenerated → signed (ceremony) → published via gitea-ai; verified at the raw URL.
+- ❑ H4 Changelog (layman-readable) + `scripts/sync-whats-new.py` + version bump; release ritual per v1.7.110 notes (push main via gitea-ai BEFORE publish; sign manifest AFTER create-release).
+- ❑ H5 No secrets in any commit; frontend tarball flat + APK policy per release notes.
@@ -384,6 +384,7 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
    chromium \
    unclutter \
    fonts-liberation \
+    fonts-noto-color-emoji \
    xfonts-base \
    plymouth \
    plymouth-themes \
@@ -22,6 +22,11 @@ if [ "$X_READY" != "true" ]; then
    exit 1
 fi

+# Settings-managed display overrides (system.kiosk-display.set writes this
+# file, then restarts the kiosk): may set ARCHIPELAGO_KIOSK_SCALE,
+# ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH or ARCHIPELAGO_KIOSK_MAX_WIDTH.
+[ -f /etc/archipelago/kiosk-display.conf ] && . /etc/archipelago/kiosk-display.conf
+
 KIOSK_SAFE_AREA_X_PX=${ARCHIPELAGO_KIOSK_SAFE_AREA_X_PX:-}
 KIOSK_SAFE_AREA_Y_PX=${ARCHIPELAGO_KIOSK_SAFE_AREA_Y_PX:-}

@@ -54,6 +59,25 @@ configure_display() {
    ' /tmp/archipelago-kiosk-xrandr.txt)
    [ -n "$mode" ] || mode=1920x1080

+    # Optional resolution cap for weak hardware: ARCHIPELAGO_KIOSK_MAX_WIDTH=1920
+    # drops a 4K panel to its best <=1920-wide mode (the TV upscales) so the
+    # software rasterizer paints 1/4 the pixels. Off by default — native mode
+    # is sharp and fits the tile budget now that --window-size is in DIPs.
+    local max_w=${ARCHIPELAGO_KIOSK_MAX_WIDTH:-0}
+    if [ "$max_w" -gt 0 ] 2>/dev/null && [ "${mode%x*}" -gt "$max_w" ] 2>/dev/null; then
+        local capped
+        capped=$(awk -v out="$output" -v maxw="$max_w" '
+            $1 == out { active = 1; next }
+            active && /^[[:space:]]+[0-9]+x[0-9]+/ {
+                split($1, wh, "x")
+                if (wh[1] + 0 <= maxw && wh[1] + 0 > best_w) { best_w = wh[1] + 0; best = $1 }
+            }
+            active && /^[^[:space:]]/ { active = 0 }
+            END { if (best) print best }
+        ' /tmp/archipelago-kiosk-xrandr.txt)
+        [ -n "$capped" ] && mode=$capped
+    fi
+
    # Kiosk should use one native output. A spanning desktop makes Chromium land
    # on the laptop panel or stretch across both outputs.
    for internal in $(awk '/ connected/ && $1 ~ /^eDP|^LVDS/{print $1}' /tmp/archipelago-kiosk-xrandr.txt); do
@@ -90,9 +114,17 @@ configure_display
 # panel becomes a 3840px-wide viewport and the UI renders tiny — and a
 # keyboard-less kiosk can't zoom. Derive Chromium's device-scale-factor from
 # the detected panel width so the *effective* CSS viewport lands near a
-# comfortable across-the-room target, scaling the whole UI up on big screens:
-#   1920x1080 -> 1.50 | 2560x1440 -> 2.00 | 3840x2160 -> 3.00 (clamped 1.0-3.0)
-KIOSK_TARGET_CSS_WIDTH=${ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH:-1280}
+# comfortable target. Panels >=2560 wide get a 1920-wide layout (4K -> scale
+# 2.0 — user-validated on a 72" TV: spacious desktop layout, 2x sharp);
+# smaller panels get a 1280-wide layout (1920 -> 1.50, laptops -> 1.0).
+if [ -z "${ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH:-}" ]; then
+    if [ "$KIOSK_MODE_W" -ge 2560 ] 2>/dev/null; then
+        ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1920
+    else
+        ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH=1280
+    fi
+fi
+KIOSK_TARGET_CSS_WIDTH=$ARCHIPELAGO_KIOSK_TARGET_CSS_WIDTH
 if [ -n "${ARCHIPELAGO_KIOSK_SCALE:-}" ]; then
    KIOSK_SCALE=$ARCHIPELAGO_KIOSK_SCALE
 else
@@ -100,6 +132,14 @@ else
        'BEGIN{if(t<=0)t=1280; s=w/t; s=int(s*4+0.5)/4; if(s<1)s=1; if(s>3)s=3; printf "%.2f", s}')
 fi

+# Chromium's --window-size is in DIPs (CSS px), not physical pixels: at scale S
+# the window paints S x larger. This X session has no window manager, so
+# --kiosk/--start-fullscreen cannot snap an oversized window back to the panel
+# — it just hangs off the right/bottom edges (content cropped, background art
+# offscreen). Size the window in DIPs so DIPs x scale = the panel exactly.
+KIOSK_WIN_W=$(awk -v w="$KIOSK_MODE_W" -v s="$KIOSK_SCALE" 'BEGIN{printf "%d", w/s}')
+KIOSK_WIN_H=$(awk -v h="$KIOSK_MODE_H" -v s="$KIOSK_SCALE" 'BEGIN{printf "%d", h/s}')
+
 xhost +SI:localuser:archipelago 2>/dev/null || true
 xsetroot -solid black 2>/dev/null || true
 xset s off 2>/dev/null || true
@@ -157,7 +197,7 @@ while true; do
      --disable-component-update \
      $GPU_FLAGS \
      --renderer-process-limit=2 \
-      --window-size=${KIOSK_MODE_W},${KIOSK_MODE_H} \
+      --window-size=${KIOSK_WIN_W},${KIOSK_WIN_H} \
      --window-position=0,0 \
      --start-fullscreen \
      --force-device-scale-factor=${KIOSK_SCALE} \
@@ -236,6 +236,22 @@ server {
        error_page 504 = @backend_timeout;
    }

+    # Pine node status — live node facts for the Pine launcher page and the
+    # seeded Home Assistant sensors. Sensitive fields are token-gated at the
+    # backend; nginx only forwards.
+    location /api/pine/status {
+        proxy_pass http://127.0.0.1:5678;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header Cookie $http_cookie;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 15s;
+        proxy_send_timeout 5s;
+        error_page 502 503 = @backend_unavailable;
+        error_page 504 = @backend_timeout;
+    }
+
    location /lnd-connect-info {
        proxy_pass http://127.0.0.1:5678/lnd-connect-info;
        proxy_http_version 1.1;
@@ -1022,6 +1038,22 @@ server {
        error_page 504 = @backend_timeout;
    }

+    # Pine node status — live node facts for the Pine launcher page and the
+    # seeded Home Assistant sensors. Sensitive fields are token-gated at the
+    # backend; nginx only forwards.
+    location /api/pine/status {
+        proxy_pass http://127.0.0.1:5678;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header Cookie $http_cookie;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 15s;
+        proxy_send_timeout 5s;
+        error_page 502 503 = @backend_unavailable;
+        error_page 504 = @backend_timeout;
+    }
+
    location /lnd-connect-info {
        proxy_pass http://127.0.0.1:5678/lnd-connect-info;
        proxy_http_version 1.1;
@@ -228,7 +228,9 @@ function seedMockState() {
  return {
    analyticsEnabled: false,
    nodeVisibility: 'discoverable',
-    nostrDiscovery: true,
+    // Discovery starts OFF, matching the production default — enabling it in
+    // the UI walks through the presence-signing overlay.
+    nostrDiscovery: false,
    pendingPeerRequests: [
      {
        id: 'preq-demo-1',
@@ -1634,7 +1636,14 @@ app.post('/rpc/v1', (req, res) => {
        return res.json({ result: { event_id: 'mock-event-id', success: 2, failed: 0 } })
      }
      case 'node.nostr-pubkey': {
-        return res.json({ result: { nostr_pubkey: 'mock-nostr-pubkey-hex' } })
+        // Exact shape of the real handler (node.rs handle_node_nostr_pubkey):
+        // the node's dedicated discovery key — hex + genuine bech32 npub
+        // (deliberately NOT one of the personal identity keys; discovery
+        // presence events are always signed with this separate node key).
+        return res.json({ result: {
+          nostr_pubkey: 'c9f0a2e84b71d3568e0f4a6b2c8d1e97a3b5c7d9e1f2a4b6c8d0e2f4a6b8c0d2',
+          nostr_npub: 'npub1e8c296ztw8f4drs0ff4jerg7j73mt37eu8e2fdkg6r30ff4ccrfq8j5vuy',
+        } })
      }

      case 'node.signChallenge': {
@@ -1,22 +1,25 @@
 {
  "name": "neode-ui",
-  "version": "1.7.109-alpha",
+  "version": "1.7.111-alpha",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "neode-ui",
-      "version": "1.7.109-alpha",
+      "version": "1.7.111-alpha",
      "dependencies": {
        "@types/dompurify": "^3.0.5",
        "@vue-leaflet/vue-leaflet": "^0.10.1",
+        "buffer": "^6.0.3",
        "d3": "^7.9.0",
        "dompurify": "^3.3.3",
        "fast-json-patch": "^3.1.1",
        "fuse.js": "^7.1.0",
        "leaflet": "^1.9.4",
        "pinia": "^3.0.4",
+        "qr-scanner": "^1.4.2",
        "qrcode": "^1.5.4",
+        "qrloop": "^1.4.1",
        "vue": "^3.5.24",
        "vue-i18n": "^11.3.0",
        "vue-router": "^4.6.3"
@@ -3896,6 +3899,12 @@
        "undici-types": "~7.16.0"
      }
    },
+    "node_modules/@types/offscreencanvas": {
+      "version": "2019.7.3",
+      "resolved": "https://registry.npmjs.org/@types/offscreencanvas/-/offscreencanvas-2019.7.3.tgz",
+      "integrity": "sha512-ieXiYmgSRXUDeOntE1InxjWyvEelZGP63M+cGuquuRLuIKKT1osnkXjxev9B7d1nXSug5vpunx+gNlbVxMlC9A==",
+      "license": "MIT"
+    },
    "node_modules/@types/qrcode": {
      "version": "1.5.6",
      "resolved": "https://registry.npmjs.org/@types/qrcode/-/qrcode-1.5.6.tgz",
@@ -4727,7 +4736,6 @@
      "version": "1.5.1",
      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "dev": true,
      "funding": [
        {
          "type": "github",
@@ -4801,6 +4809,31 @@
        "readable-stream": "^3.4.0"
      }
    },
+    "node_modules/bl/node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
    "node_modules/body-parser": {
      "version": "1.20.4",
      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
@@ -4901,10 +4934,9 @@
      }
    },
    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
      "funding": [
        {
          "type": "github",
@@ -4922,7 +4954,7 @@
      "license": "MIT",
      "dependencies": {
        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "ieee754": "^1.2.1"
      }
    },
    "node_modules/buffer-from": {
@@ -5099,6 +5131,15 @@
        "node": ">=8"
      }
    },
+    "node_modules/charenc": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz",
+      "integrity": "sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": "*"
+      }
+    },
    "node_modules/check-error": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.3.tgz",
@@ -5499,6 +5540,15 @@
        "node": ">= 8"
      }
    },
+    "node_modules/crypt": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz",
+      "integrity": "sha512-mCxBlsHFYh9C+HVpiEacem8FEBnMXgU9gy4zmNC+SXAZNB/1idgp/aulFJ4FgCi7GPEVbfyng092GqL2k2rmow==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": "*"
+      }
+    },
    "node_modules/crypto-random-string": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
@@ -7408,7 +7458,6 @@
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "dev": true,
      "funding": [
        {
          "type": "github",
@@ -7564,6 +7613,12 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
+    "node_modules/is-buffer": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
+      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
+      "license": "MIT"
+    },
    "node_modules/is-callable": {
      "version": "1.2.7",
      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
@@ -8358,6 +8413,17 @@
        "node": ">= 0.4"
      }
    },
+    "node_modules/md5": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz",
+      "integrity": "sha512-T1GITYmFaKuO91vxyoQMFETst+O71VUPEU3ze5GNzDm0OWdP8v1ziTaAEPUr/3kLsY3Sftgz242A1SetQiDL7g==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "charenc": "0.0.2",
+        "crypt": "0.0.2",
+        "is-buffer": "~1.1.6"
+      }
+    },
    "node_modules/media-typer": {
      "version": "0.3.0",
      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -9193,6 +9259,15 @@
        "node": ">=6"
      }
    },
+    "node_modules/qr-scanner": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/qr-scanner/-/qr-scanner-1.4.2.tgz",
+      "integrity": "sha512-kV1yQUe2FENvn59tMZW6mOVfpq9mGxGf8l6+EGaXUOd4RBOLg7tRC83OrirM5AtDvZRpdjdlXURsHreAOSPOUw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/offscreencanvas": "^2019.6.4"
+      }
+    },
    "node_modules/qrcode": {
      "version": "1.5.4",
      "resolved": "https://registry.npmjs.org/qrcode/-/qrcode-1.5.4.tgz",
@@ -9317,6 +9392,16 @@
        "node": ">=6"
      }
    },
+    "node_modules/qrloop": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/qrloop/-/qrloop-1.4.1.tgz",
+      "integrity": "sha512-LXkwCl1Qd8imTHb+KqjMn+cHmuncyFT81AXoooWJvbG3+g9q61l9udSRPgY4cgl+5goQHuAK4teEdUF6UErYXw==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^6.0.3",
+        "md5": "^2.3.0"
+      }
+    },
    "node_modules/qs": {
      "version": "6.14.2",
      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
@@ -1,7 +1,7 @@
 {
  "name": "neode-ui",
  "private": true,
-  "version": "1.7.109-alpha",
+  "version": "1.7.111-alpha",
  "type": "module",
  "scripts": {
    "start": "./start-dev.sh",
@@ -26,13 +26,16 @@
  "dependencies": {
    "@types/dompurify": "^3.0.5",
    "@vue-leaflet/vue-leaflet": "^0.10.1",
+    "buffer": "^6.0.3",
    "d3": "^7.9.0",
    "dompurify": "^3.3.3",
    "fast-json-patch": "^3.1.1",
    "fuse.js": "^7.1.0",
    "leaflet": "^1.9.4",
    "pinia": "^3.0.4",
+    "qr-scanner": "^1.4.2",
    "qrcode": "^1.5.4",
+    "qrloop": "^1.4.1",
    "vue": "^3.5.24",
    "vue-i18n": "^11.3.0",
    "vue-router": "^4.6.3"
@@ -351,12 +351,12 @@
    {
      "id": "homeassistant",
      "title": "Home Assistant",
-      "version": "2024.1.0",
+      "version": "2026.7.3",
      "description": "Open source home automation platform. Control and monitor your smart home devices.",
      "icon": "/assets/img/app-icons/homeassistant.png",
      "author": "Home Assistant",
      "category": "home",
-      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2024.1",
+      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2026.7.3",
      "repoUrl": "https://github.com/home-assistant/core",
      "containerConfig": {
        "ports": [
@@ -373,8 +373,8 @@
    {
      "id": "pine",
      "title": "Pine",
-      "version": "1.0.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
+      "version": "1.3.0",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
      "icon": "/assets/img/app-icons/pine.svg",
      "author": "Archipelago",
      "category": "home",
@@ -131,6 +131,13 @@ function syncKioskSafeArea() {
  // (--in-process-gpu / --disable-gpu), where heavy compositing effects
  // (3D bg layers, animated mix-blend overlays) fail and paint black.
  document.documentElement.classList.toggle('kiosk-mode', isKiosk)
+  if (isKiosk) {
+    // AIUI (same-origin iframe) themes from localStorage['aiui-theme'], and a
+    // stored value beats its prefers-color-scheme fallback. Kiosk profiles
+    // that ran before the launcher forced a dark color-scheme have "light"
+    // baked in — white panels on an otherwise dark TV UI — so pin it dark.
+    try { localStorage.setItem('aiui-theme', 'dark') } catch { /* storage full/denied */ }
+  }
  const rawSafeArea = localStorage.getItem('archipelago_kiosk_safe_area_px') || '0'
  const safeArea = /^\d{1,3}$/.test(rawSafeArea) ? Number(rawSafeArea) : 0
  const rawSafeAreaX = localStorage.getItem('archipelago_kiosk_safe_area_x_px') || rawSafeArea
@@ -152,13 +159,12 @@ watch(() => appStore.isAuthenticated, (authenticated) => {
  if (authenticated) {
    messageToast.startPolling()
    screensaverStore.resetInactivityTimer()
-    // Don't start relay on kiosk — kiosk gets input via xdotool (system-level),
-    // relay would duplicate every keystroke/click as DOM events
-    const isKiosk = localStorage.getItem('kiosk') === 'true'
-      || new URLSearchParams(window.location.search).has('kiosk')
-    if (!isKiosk) {
-      startRemoteRelay()
-    }
+    // Kiosk included: the backend's remote-input path is relay-only (it
+    // validates and broadcasts; it never runs xdotool), so the browser-side
+    // relay is the ONLY consumer of companion input. Skipping it on kiosk —
+    // an assumption from a long-gone system-level xdotool injector — left
+    // TVs deaf to the companion remote.
+    startRemoteRelay()
  } else {
    messageToast.stopPolling()
    toastMessage.value = { show: false, text: '', fromPubkey: '' }
@@ -27,9 +27,8 @@
        <div class="flex-1 min-w-0">
          <p class="text-white/90 text-sm font-semibold mb-0.5">Open a channel with Zeus</p>
          <p class="text-white/55 text-xs leading-relaxed">
-            Pair your node with the Zeus mobile wallet — open a channel to their Olympus node and
-            start sending and receiving Lightning payments from your phone.
-            Minimum 150,000 · maximum 1,500,000 sats.
+            Open a channel with Zeus Olympus node and start sending and receiving Lightning
+            payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.
          </p>
        </div>
        <div class="flex sm:flex-col items-center gap-2 shrink-0">
@@ -72,6 +72,12 @@

        <div class="flex gap-3">
          <button @click="close" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">{{ t('common.close') }}</button>
+          <button @click="$emit('scan')" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-2">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+            Scan
+          </button>
          <button @click="receive" :disabled="processing" class="flex-1 glass-button glass-button-success px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50">
            {{ processing ? t('receiveBitcoin.processing') : receiveMethod === 'onchain' ? t('receiveBitcoin.generateAddress') : receiveMethod === 'lightning' ? t('receiveBitcoin.createInvoice') : receiveMethod === 'ark' ? 'Get Ark address' : t('receiveBitcoin.receive') }}
          </button>
@@ -95,7 +101,7 @@ const props = defineProps<{
  /** Generate an on-chain address immediately when the modal opens */
  autoGenerate?: boolean
 }>()
-const emit = defineEmits<{ close: []; received: [] }>()
+const emit = defineEmits<{ close: []; received: []; scan: [] }>()

 watch(() => props.show, (open) => {
  if (open && props.autoGenerate && receiveMethod.value === 'onchain' && !onchainAddress.value) {
@@ -69,6 +69,12 @@

        <div class="flex gap-3">
          <button @click="close" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">{{ t('common.close') }}</button>
+          <button @click="$emit('scan')" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm font-medium flex items-center justify-center gap-2">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+            Scan
+          </button>
          <button @click="send" :disabled="processing || (!amount && !isSweep)" class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50">
            {{ processing ? t('common.sending') : t('common.send') }}
          </button>
@@ -85,7 +91,7 @@ import BaseModal from '@/components/BaseModal.vue'
 const { t } = useI18n()

 const props = defineProps<{ show: boolean }>()
-const emit = defineEmits<{ close: []; sent: [] }>()
+const emit = defineEmits<{ close: []; sent: []; scan: [] }>()

 const sendMethod = ref<'auto' | 'lightning' | 'onchain' | 'ecash' | 'ark'>('auto')
 const amount = ref<number>(0)
@@ -0,0 +1,752 @@
+<template>
+  <Teleport to="body">
+    <Transition name="modal">
+      <div
+        v-if="show"
+        class="fixed inset-0 z-[3000] flex items-center justify-center p-4"
+        @click.self="close"
+      >
+        <div class="absolute inset-0 bg-black/60 backdrop-blur-md"></div>
+        <div
+          ref="modalRef"
+          class="glass-card p-6 w-full max-w-md relative z-10 overflow-hidden"
+          role="dialog"
+          aria-modal="true"
+          @click.stop
+        >
+          <!-- Header -->
+          <div class="flex items-center justify-between gap-4 mb-4">
+            <div class="flex items-center gap-2 min-w-0">
+              <button
+                v-if="pane !== 'scan'"
+                @click="goBack"
+                class="p-2 -ml-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors shrink-0"
+                aria-label="Back"
+              >
+                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
+                </svg>
+              </button>
+              <h3 class="text-xl font-semibold text-white truncate">{{ paneTitle }}</h3>
+            </div>
+            <button
+              @click="close"
+              class="p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors shrink-0"
+              aria-label="Close"
+            >
+              <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+            </button>
+          </div>
+
+          <Transition :name="direction === 'forward' ? 'pane-forward' : 'pane-back'" mode="out-in">
+            <!-- ============ SCAN PANE ============ -->
+            <div v-if="pane === 'scan'" key="scan">
+              <div class="relative w-full aspect-square rounded-xl overflow-hidden bg-black/40 border border-white/10 mb-4">
+                <!-- opacity (not v-if/v-show): the scanner needs the element, and a
+                     source-less <video> flashes a native play glyph in Android WebViews -->
+                <video ref="videoElement" class="w-full h-full object-cover transition-opacity duration-200" :class="isScanning ? 'opacity-100' : 'opacity-0'" autoplay muted playsinline></video>
+                <!-- Viewfinder -->
+                <div class="absolute inset-0 flex items-center justify-center pointer-events-none">
+                  <div class="scan-viewfinder"></div>
+                </div>
+                <!-- While auto-start is settling, show only a quiet spinner — the
+                     Start/Take-photo buttons are the FALLBACK, not a splash screen -->
+                <div v-if="!isScanning && autoStarting" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
+                  <svg class="w-8 h-8 text-white/40 animate-spin" fill="none" viewBox="0 0 24 24">
+                    <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" />
+                    <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8v3a5 5 0 00-5 5H4z" />
+                  </svg>
+                </div>
+                <div v-else-if="!isScanning" class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-black/50">
+                  <svg class="w-10 h-10 text-white/40" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M3 9a2 2 0 012-2h.93a2 2 0 001.664-.89l.812-1.22A2 2 0 0110.07 4h3.86a2 2 0 011.664.89l.812 1.22A2 2 0 0018.07 7H19a2 2 0 012 2v9a2 2 0 01-2 2H5a2 2 0 01-2-2V9z" />
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15 13a3 3 0 11-6 0 3 3 0 016 0z" />
+                  </svg>
+                  <button v-if="!liveCameraUnavailable" @click="startScanning" class="glass-button px-4 py-2 rounded-lg text-sm font-medium">
+                    {{ cameraError ? 'Retry camera' : 'Start camera' }}
+                  </button>
+                  <!-- Insecure-context fallback: live getUserMedia preview needs
+                       HTTPS, but the native camera via a file input does not —
+                       snap a photo of the QR and decode it locally. -->
+                  <button @click="photoInput?.click()" class="glass-button px-4 py-2 rounded-lg text-sm font-medium">
+                    Take photo of QR
+                  </button>
+                  <input
+                    ref="photoInput"
+                    type="file"
+                    accept="image/*"
+                    capture="environment"
+                    class="hidden"
+                    @change="onPhotoPicked"
+                  />
+                </div>
+              </div>
+
+              <div class="mb-4 p-3 bg-white/5 rounded-lg min-h-[3rem] flex items-center justify-center">
+                <p class="text-sm text-center" :class="scanStatusIsError ? 'text-red-400' : 'text-white/60'">
+                  {{ scanStatus || 'Point the camera at a Lightning invoice, Bitcoin address, Cashu or Fedimint code' }}
+                </p>
+              </div>
+
+              <!-- Paste fallback (also the path on camera-less nodes) -->
+              <div class="flex gap-2">
+                <input
+                  v-model="pasteInput"
+                  type="text"
+                  placeholder="…or paste an invoice / address / token"
+                  class="flex-1 input-glass font-mono text-xs"
+                  @keydown.enter="submitPaste"
+                />
+                <button @click="submitPaste" :disabled="!pasteInput.trim()" class="glass-button px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-40">
+                  Use
+                </button>
+              </div>
+            </div>
+
+            <!-- ============ AMOUNT / CONFIRM PANE ============ -->
+            <div v-else-if="pane === 'amount'" key="amount">
+              <!-- Rail + destination summary -->
+              <div class="flex items-center gap-3 p-3 bg-white/5 rounded-lg mb-4">
+                <span class="w-9 h-9 rounded-lg bg-white/10 flex items-center justify-center shrink-0" :class="railColor">
+                  <span v-if="rail === 'onchain'" class="text-lg font-bold">&#x20bf;</span>
+                  <svg v-else-if="rail === 'lightning'" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                  </svg>
+                  <!-- SVG, not 🥜: kiosk images ship no color-emoji font -->
+                  <svg v-else-if="rail === 'cashu'" class="w-5 h-5" role="img" aria-label="Cashu" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 9V7a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2m2 4h10a2 2 0 002-2v-6a2 2 0 00-2-2H9a2 2 0 00-2 2v6a2 2 0 002 2zm7-5a2 2 0 11-4 0 2 2 0 014 0z" />
+                  </svg>
+                  <svg v-else class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a4 4 0 00-3-3.87M9 20H4v-2a4 4 0 013-3.87m6-.13a4 4 0 10-4-4 4 4 0 004 4zm6 0a4 4 0 10-3-6.65" />
+                  </svg>
+                </span>
+                <div class="min-w-0">
+                  <p class="text-sm font-medium text-white">{{ railLabel }}</p>
+                  <p class="text-[11px] text-white/40 font-mono truncate">{{ destDisplay }}</p>
+                </div>
+              </div>
+
+              <!-- Federation join is a confirm, not an amount entry -->
+              <template v-if="action === 'fedimint-join'">
+                <p class="text-sm text-white/70 mb-4">
+                  This is a Fedimint federation invite. Join it to hold and send ecash backed by this federation.
+                </p>
+              </template>
+
+              <template v-else>
+                <!-- Amount -->
+                <div class="mb-3">
+                  <div class="flex items-center justify-between mb-1">
+                    <label class="text-white/60 text-sm">Amount (sats)</label>
+                    <span v-if="amountLocked" class="text-[11px] px-2 py-0.5 rounded-full bg-white/10 text-white/50">set by invoice</span>
+                  </div>
+                  <input
+                    v-model.number="amount"
+                    type="number"
+                    min="1"
+                    inputmode="numeric"
+                    placeholder="0"
+                    :disabled="amountLocked || sendMax"
+                    class="w-full input-glass text-2xl font-semibold text-center disabled:opacity-70"
+                  />
+                </div>
+
+                <!-- Presets + Max -->
+                <div v-if="!amountLocked" class="grid grid-cols-5 gap-2 mb-4">
+                  <button
+                    v-for="preset in PRESETS"
+                    :key="preset"
+                    @click="applyPreset(preset)"
+                    :disabled="balance !== null && preset > balance"
+                    class="px-1 py-1.5 rounded-lg text-xs font-medium transition-colors disabled:opacity-30"
+                    :class="!sendMax && amount === preset ? 'bg-white/20 text-white' : 'bg-white/5 text-white/60 hover:bg-white/10 hover:text-white/90'"
+                  >{{ formatPreset(preset) }}</button>
+                  <button
+                    @click="toggleMax"
+                    class="px-1 py-1.5 rounded-lg text-xs font-semibold transition-colors"
+                    :class="sendMax ? 'bg-orange-500/25 text-orange-300 border border-orange-500/40' : 'bg-white/5 text-white/60 hover:bg-white/10 hover:text-white/90'"
+                  >Max</button>
+                </div>
+
+                <!-- Live balance impact -->
+                <div class="rounded-lg border border-white/10 divide-y divide-white/5 mb-4">
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">{{ railLabel }} balance</span>
+                    <span class="text-sm font-medium" :class="railColor">
+                      {{ balance === null ? '…' : balance.toLocaleString() + ' sats' }}
+                    </span>
+                  </div>
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">This send</span>
+                    <span class="text-sm font-medium text-white/80">−{{ effectiveAmount.toLocaleString() }} sats</span>
+                  </div>
+                  <div class="flex items-center justify-between px-3 py-2">
+                    <span class="text-xs text-white/50">Balance after</span>
+                    <span class="text-sm font-semibold" :class="insufficient ? 'text-red-400' : 'text-white'">
+                      {{ balance === null ? '…' : balanceAfter.toLocaleString() + ' sats' }}
+                    </span>
+                  </div>
+                </div>
+                <p v-if="insufficient" class="text-xs text-red-400 mb-3">Not enough {{ railLabel }} balance for this amount.</p>
+                <p v-else-if="sendMax && rail === 'onchain'" class="text-xs text-white/50 mb-3">Sweeps the entire on-chain balance minus network fees.</p>
+              </template>
+
+              <div v-if="error" class="mb-3 alert-error text-sm">{{ error }}</div>
+
+              <div class="flex gap-3">
+                <button @click="goBack" class="flex-1 glass-button px-4 py-2 rounded-lg text-sm">Back</button>
+                <button
+                  @click="confirmSend"
+                  :disabled="processing || (action !== 'fedimint-join' && (insufficient || (effectiveAmount <= 0 && !sendMax)))"
+                  class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium disabled:opacity-50"
+                >
+                  {{ processing ? 'Sending…' : confirmLabel }}
+                </button>
+              </div>
+            </div>
+
+            <!-- ============ SUCCESS PANE ============ -->
+            <div v-else key="success" class="text-center py-2">
+              <div class="inline-flex items-center justify-center w-24 h-24 rounded-full mx-auto mb-5 success-ring">
+                <svg class="w-14 h-14 text-green-400" fill="none" stroke="currentColor" stroke-width="3" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+                </svg>
+              </div>
+
+              <div v-if="successAmount > 0" class="text-5xl font-black text-green-400 mb-1">
+                {{ successAmount.toLocaleString() }}<span class="text-2xl font-bold text-green-400/70"> sats</span>
+              </div>
+              <div class="text-2xl font-bold tracking-widest text-white mb-2">{{ successVerb }}</div>
+              <p class="text-sm text-white/50 mb-1">{{ successDetail }}</p>
+              <p v-if="successRef" class="text-[11px] text-white/30 font-mono break-all px-4 mb-4">{{ successRef }}</p>
+
+              <div v-if="balance !== null" class="inline-flex items-center gap-2 px-3 py-1.5 rounded-full bg-white/5 text-xs text-white/60 mb-5">
+                <span :class="railColor">{{ railLabel }}</span>
+                <span>balance now {{ balance.toLocaleString() }} sats</span>
+              </div>
+
+              <button
+                @click="close"
+                class="w-full py-3 rounded-xl font-semibold text-base bg-white/10 hover:bg-white/20 text-white transition-colors"
+              >
+                Done
+              </button>
+            </div>
+          </Transition>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, watch, onUnmounted, nextTick } from 'vue'
+import QrScanner from 'qr-scanner'
+import { rpcClient } from '@/api/rpc-client'
+import { useAnimatedQRDecoder } from '@/composables/useAnimatedQRDecoder'
+import { useModalKeyboard } from '@/composables/useModalKeyboard'
+import { useBodyScrollLock } from '@/composables/useBodyScrollLock'
+
+type Rail = 'onchain' | 'lightning' | 'cashu' | 'fedimint'
+type Action = 'pay-invoice' | 'send-onchain' | 'redeem-token' | 'fedimint-join'
+type Pane = 'scan' | 'amount' | 'success'
+
+const PRESETS = [21, 2100, 21000, 100000]
+
+const props = defineProps<{ show: boolean }>()
+const emit = defineEmits<{ close: []; sent: [] }>()
+
+const modalRef = ref<HTMLElement | null>(null)
+useModalKeyboard(modalRef, computed(() => props.show), close)
+useBodyScrollLock(computed(() => props.show))
+
+// --- Pane state ---
+const pane = ref<Pane>('scan')
+const direction = ref<'forward' | 'back'>('forward')
+const paneTitle = computed(() => {
+  if (pane.value === 'scan') return 'Scan to send'
+  if (pane.value === 'success') return 'Success'
+  if (action.value === 'fedimint-join') return 'Join federation'
+  if (action.value === 'redeem-token') return 'Redeem'
+  return 'Send'
+})
+
+function goTo(p: Pane, dir: 'forward' | 'back' = 'forward') {
+  direction.value = dir
+  pane.value = p
+}
+
+function goBack() {
+  if (pane.value === 'amount') {
+    error.value = ''
+    goTo('scan', 'back')
+    nextTick(() => { if (!liveCameraUnavailable.value) startScanning() })
+  } else if (pane.value === 'success') {
+    close()
+  }
+}
+
+// --- Scanner ---
+const videoElement = ref<HTMLVideoElement | null>(null)
+const isScanning = ref(false)
+// True while a camera-start attempt is in flight (incl. the automatic one on
+// open) — the fallback buttons stay hidden until it resolves, so they don't
+// flash for a second on every open.
+const autoStarting = ref(false)
+const scanStatus = ref('')
+const scanStatusIsError = ref(false)
+const cameraError = ref(false)
+const pasteInput = ref('')
+const qrScanner = ref<QrScanner | null>(null)
+const animatedDecoder = useAnimatedQRDecoder()
+
+async function startScanning() {
+  cameraError.value = false
+  scanStatusIsError.value = false
+  autoStarting.value = true
+  try {
+    if (!videoElement.value) return
+    if (!navigator.mediaDevices?.getUserMedia) {
+      throw new Error(
+        location.protocol !== 'https:' && !['localhost', '127.0.0.1'].includes(location.hostname)
+          ? 'Camera needs HTTPS — paste the code below instead'
+          : 'No camera available — paste the code below instead'
+      )
+    }
+    qrScanner.value = new QrScanner(
+      videoElement.value,
+      (result) => handleScanned(result.data),
+      {
+        returnDetailedScanResult: true,
+        highlightScanRegion: false,
+        preferredCamera: 'environment',
+        // 4/s decodes plenty fast for a hand-held QR while keeping the
+        // preview smooth on phone WebViews (10/s visibly lagged the video).
+        maxScansPerSecond: 4,
+      }
+    )
+    await qrScanner.value.start()
+    isScanning.value = true
+    scanStatus.value = ''
+  } catch (err) {
+    cameraError.value = true
+    scanStatusIsError.value = true
+    scanStatus.value = err instanceof Error ? err.message : 'Unable to access camera'
+  } finally {
+    autoStarting.value = false
+  }
+}
+
+function stopScanning() {
+  qrScanner.value?.stop()
+  qrScanner.value?.destroy()
+  qrScanner.value = null
+  isScanning.value = false
+}
+
+function submitPaste() {
+  const text = pasteInput.value.trim()
+  if (!text) return
+  handleScanned(text)
+}
+
+// --- Photo-capture fallback (works without a secure context) ---
+// getUserMedia is unreachable over plain http (navigator.mediaDevices is
+// undefined), but <input capture> opens the native camera in any browser,
+// PWA or WebView; the shot is decoded locally by qr-scanner's scanImage.
+const photoInput = ref<HTMLInputElement | null>(null)
+const liveCameraUnavailable = computed(() => !navigator.mediaDevices?.getUserMedia)
+
+async function onPhotoPicked(e: Event) {
+  const input = e.target as HTMLInputElement
+  const file = input.files?.[0]
+  if (!file) return
+  try {
+    const result = await QrScanner.scanImage(file, { returnDetailedScanResult: true })
+    handleScanned(result.data)
+  } catch {
+    scanStatusIsError.value = true
+    scanStatus.value = 'No QR code found in that photo — try again, closer and well-lit'
+  } finally {
+    input.value = ''
+  }
+}
+
+// --- Detection (ported from k484's scanner) ---
+const rail = ref<Rail>('lightning')
+const action = ref<Action>('pay-invoice')
+const dest = ref('')
+const amount = ref<number>(0)
+const amountLocked = ref(false)
+const sendMax = ref(false)
+
+const railLabel = computed(() => ({
+  onchain: 'On-chain',
+  lightning: 'Lightning',
+  cashu: 'Cashu',
+  fedimint: 'Fedimint',
+}[rail.value]))
+
+const railColor = computed(() => ({
+  onchain: 'text-orange-500',
+  lightning: 'text-yellow-400',
+  cashu: 'text-purple-400',
+  fedimint: 'text-blue-400',
+}[rail.value]))
+
+const destDisplay = computed(() =>
+  dest.value.length > 46 ? `${dest.value.slice(0, 26)}…${dest.value.slice(-14)}` : dest.value
+)
+
+const confirmLabel = computed(() => {
+  if (action.value === 'fedimint-join') return 'Join'
+  if (action.value === 'redeem-token') return 'Redeem'
+  return 'Send'
+})
+
+/** Amount encoded in a BOLT11 invoice's human-readable part, in sats (null = zero-amount). */
+function parseBolt11AmountSats(invoice: string): number | null {
+  const m = /^ln(?:bcrt|bc|tb)(\d+)?([munp])?1/.exec(invoice.toLowerCase())
+  if (!m || !m[1]) return null
+  const value = Number(m[1])
+  const mult = { m: 1e-3, u: 1e-6, n: 1e-9, p: 1e-12 }[m[2] as 'm' | 'u' | 'n' | 'p'] ?? 1
+  return Math.round(value * mult * 1e8)
+}
+
+function isLightningInvoice(text: string): boolean {
+  const t = text.toLowerCase()
+  return t.startsWith('lnbc') || t.startsWith('lntb') || t.startsWith('lnbcrt')
+}
+
+function isOnchainAddress(text: string): boolean {
+  return /^(bc1|tb1|bcrt1)[a-z0-9]{20,90}$/i.test(text) || /^[13][a-km-zA-HJ-NP-Z1-9]{25,40}$/.test(text)
+}
+
+function isCashuToken(text: string): boolean {
+  return text.startsWith('cashuA') || text.startsWith('cashuB')
+}
+
+function isFedimintInvite(text: string): boolean {
+  return text.startsWith('fed11')
+}
+
+function isFedimintToken(text: string): boolean {
+  return /^AwE/.test(text)
+}
+
+function isAnimatedFrame(text: string): boolean {
+  return text.startsWith('B$') || text.startsWith('AAAH') || text.startsWith('ZAAE') || text.startsWith('AAA')
+}
+
+function handleScanned(raw: string) {
+  let text = raw.trim()
+  scanStatusIsError.value = false
+
+  // Animated multi-frame QR (large Fedimint tokens): keep collecting frames
+  if (isAnimatedFrame(text)) {
+    animatedDecoder.addFrame(text)
+    if (animatedDecoder.isComplete.value && animatedDecoder.decodedData.value) {
+      const token = animatedDecoder.decodedData.value
+      animatedDecoder.reset()
+      acceptDetected(token)
+    } else {
+      scanStatus.value = `Animated code… ${animatedDecoder.progressText()}`
+    }
+    return
+  }
+
+  acceptDetected(text)
+}
+
+function acceptDetected(raw: string) {
+  let text = raw.trim()
+  let bip21AmountSats: number | null = null
+
+  // URI schemes
+  if (text.toLowerCase().startsWith('lightning:')) text = text.slice(10)
+  if (text.toLowerCase().startsWith('bitcoin:')) {
+    try {
+      const uri = new URL(text)
+      const lnParam = uri.searchParams.get('lightning')
+      const amt = uri.searchParams.get('amount')
+      if (amt && !Number.isNaN(Number(amt))) bip21AmountSats = Math.round(Number(amt) * 1e8)
+      // Prefer the unified lightning param when present, else the address
+      text = lnParam || text.slice(8).split('?')[0] || ''
+    } catch {
+      text = text.slice(8).split('?')[0] || ''
+    }
+  }
+
+  if (isLightningInvoice(text)) {
+    rail.value = 'lightning'
+    action.value = 'pay-invoice'
+    dest.value = text
+    const invoiceAmount = parseBolt11AmountSats(text)
+    // Zero-amount invoice inside a unified BIP21 URI: prefill from amount=
+    amount.value = invoiceAmount ?? bip21AmountSats ?? 0
+    amountLocked.value = invoiceAmount !== null
+  } else if (isCashuToken(text)) {
+    rail.value = 'cashu'
+    action.value = 'redeem-token'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isFedimintInvite(text)) {
+    rail.value = 'fedimint'
+    action.value = 'fedimint-join'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isFedimintToken(text)) {
+    rail.value = 'fedimint'
+    action.value = 'redeem-token'
+    dest.value = text
+    amount.value = 0
+    amountLocked.value = true
+  } else if (isOnchainAddress(text)) {
+    rail.value = 'onchain'
+    action.value = 'send-onchain'
+    dest.value = text
+    amount.value = bip21AmountSats ?? 0
+    amountLocked.value = false
+  } else if (text.toLowerCase().startsWith('lno1')) {
+    // BOLT12 offer — LND (this node's Lightning backend) can't pay offers yet
+    scanStatusIsError.value = true
+    scanStatus.value = 'BOLT12 offers aren\'t supported yet — ask the recipient for a BOLT11 invoice'
+    return
+  } else if (text.toLowerCase().startsWith('lnurl1') || /^[\w.+-]+@[\w-]+(\.[\w-]+)+$/.test(text)) {
+    // LNURL-pay / lightning address — needs an HTTP callback flow we don't do yet
+    scanStatusIsError.value = true
+    scanStatus.value = 'LNURL and lightning addresses aren\'t supported yet — ask for a BOLT11 invoice'
+    return
+  } else {
+    scanStatusIsError.value = true
+    scanStatus.value = 'Not a recognised invoice, address or token'
+    return
+  }
+
+  sendMax.value = false
+  error.value = ''
+  stopScanning()
+  loadBalance()
+
+  // Tokens carry their own value — redeem straight away, success screen follows
+  if (action.value === 'redeem-token') {
+    goTo('amount')
+    confirmSend()
+  } else {
+    goTo('amount')
+  }
+}
+
+// --- Balance for the active rail ---
+const balance = ref<number | null>(null)
+
+async function loadBalance() {
+  balance.value = null
+  try {
+    if (rail.value === 'cashu') {
+      const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.ecash-balance' })
+      balance.value = res.balance_sats ?? 0
+    } else if (rail.value === 'fedimint') {
+      const res = await rpcClient.call<{ balance_sats: number }>({ method: 'wallet.fedimint-balance' })
+      balance.value = res.balance_sats ?? 0
+    } else {
+      const res = await rpcClient.call<{ balance_sats: number; channel_balance_sats: number }>({ method: 'lnd.getinfo' })
+      balance.value = rail.value === 'onchain' ? (res.balance_sats ?? 0) : (res.channel_balance_sats ?? 0)
+    }
+  } catch {
+    balance.value = null
+  }
+}
+
+const effectiveAmount = computed(() => {
+  if (sendMax.value) return balance.value ?? 0
+  return amount.value > 0 ? Math.floor(amount.value) : 0
+})
+const balanceAfter = computed(() => (balance.value ?? 0) - effectiveAmount.value)
+const insufficient = computed(() =>
+  action.value !== 'fedimint-join' && action.value !== 'redeem-token' &&
+  balance.value !== null && effectiveAmount.value > balance.value
+)
+
+function applyPreset(preset: number) {
+  sendMax.value = false
+  amount.value = preset
+}
+
+function toggleMax() {
+  sendMax.value = !sendMax.value
+  if (sendMax.value && balance.value !== null && rail.value !== 'onchain') {
+    amount.value = balance.value
+  }
+}
+
+function formatPreset(preset: number): string {
+  return preset >= 1000 ? `${(preset / 1000).toLocaleString()}k` : String(preset)
+}
+
+// --- Send / redeem / join ---
+const processing = ref(false)
+const error = ref('')
+const successAmount = ref(0)
+const successVerb = ref('SENT')
+const successDetail = ref('')
+const successRef = ref('')
+
+async function confirmSend() {
+  if (processing.value) return
+  processing.value = true
+  error.value = ''
+  try {
+    if (action.value === 'pay-invoice') {
+      const params: Record<string, unknown> = { payment_request: dest.value }
+      if (!amountLocked.value && effectiveAmount.value > 0) params.amount_sats = effectiveAmount.value
+      const res = await rpcClient.call<{ payment_hash: string; amount_sats: number }>({
+        method: 'lnd.payinvoice',
+        params,
+        timeout: 60000,
+      })
+      successAmount.value = res.amount_sats || effectiveAmount.value
+      successVerb.value = 'PAID'
+      successDetail.value = 'Lightning invoice paid'
+      successRef.value = res.payment_hash
+    } else if (action.value === 'send-onchain') {
+      const res = await rpcClient.call<{ txid: string }>({
+        method: 'lnd.sendcoins',
+        params: sendMax.value
+          ? { addr: dest.value, send_all: true }
+          : { addr: dest.value, amount: effectiveAmount.value },
+        timeout: 60000,
+      })
+      successAmount.value = sendMax.value ? (balance.value ?? 0) : effectiveAmount.value
+      successVerb.value = 'SENT'
+      successDetail.value = 'On-chain transaction broadcast'
+      successRef.value = res.txid
+    } else if (action.value === 'redeem-token') {
+      const res = await rpcClient.call<{ received_sats: number; kind: string }>({
+        method: 'wallet.ecash-receive',
+        params: { token: dest.value },
+        timeout: 60000,
+      })
+      rail.value = res.kind === 'fedimint' ? 'fedimint' : 'cashu'
+      successAmount.value = res.received_sats || 0
+      successVerb.value = 'RECEIVED'
+      successDetail.value = `${res.kind === 'fedimint' ? 'Fedimint' : 'Cashu'} token redeemed`
+      successRef.value = ''
+    } else {
+      await rpcClient.call({
+        method: 'wallet.fedimint-join',
+        params: { invite_code: dest.value },
+        timeout: 60000,
+      })
+      successAmount.value = 0
+      successVerb.value = 'JOINED'
+      successDetail.value = 'Federation joined — you can now hold its ecash'
+      successRef.value = ''
+    }
+    await loadBalance()
+    goTo('success')
+    emit('sent')
+  } catch (err) {
+    error.value = err instanceof Error ? err.message : 'Send failed'
+    // Token redeems jump straight from scan; surface the failure on the amount pane
+    if (pane.value !== 'amount') goTo('amount')
+  } finally {
+    processing.value = false
+  }
+}
+
+// --- Lifecycle ---
+function resetAll() {
+  stopScanning()
+  animatedDecoder.reset()
+  pane.value = 'scan'
+  direction.value = 'forward'
+  scanStatus.value = ''
+  scanStatusIsError.value = false
+  cameraError.value = false
+  pasteInput.value = ''
+  dest.value = ''
+  amount.value = 0
+  amountLocked.value = false
+  sendMax.value = false
+  balance.value = null
+  processing.value = false
+  error.value = ''
+}
+
+function close() {
+  resetAll()
+  emit('close')
+}
+
+watch(() => props.show, (open) => {
+  if (open) {
+    resetAll()
+    nextTick(() => { if (!liveCameraUnavailable.value) startScanning() })
+  } else {
+    stopScanning()
+  }
+})
+
+onUnmounted(stopScanning)
+</script>
+
+<style scoped>
+.modal-enter-active,
+.modal-leave-active {
+  transition: opacity 0.2s ease;
+}
+.modal-enter-from,
+.modal-leave-to {
+  opacity: 0;
+}
+.modal-enter-active .glass-card,
+.modal-leave-active .glass-card {
+  transition: transform 0.2s ease;
+}
+.modal-enter-from .glass-card,
+.modal-leave-to .glass-card {
+  transform: scale(0.95);
+}
+
+/* Horizontal pane slide: forward = new pane arrives from the right */
+.pane-forward-enter-active,
+.pane-forward-leave-active,
+.pane-back-enter-active,
+.pane-back-leave-active {
+  transition: transform 0.22s ease, opacity 0.22s ease;
+}
+.pane-forward-enter-from {
+  transform: translateX(40px);
+  opacity: 0;
+}
+.pane-forward-leave-to {
+  transform: translateX(-40px);
+  opacity: 0;
+}
+.pane-back-enter-from {
+  transform: translateX(-40px);
+  opacity: 0;
+}
+.pane-back-leave-to {
+  transform: translateX(40px);
+  opacity: 0;
+}
+
+.scan-viewfinder {
+  width: 62%;
+  height: 62%;
+  border-radius: 1rem;
+  border: 2px solid rgba(249, 115, 22, 0.85);
+  box-shadow: 0 0 0 9999px rgba(0, 0, 0, 0.35);
+}
+
+.success-ring {
+  background: rgba(16, 185, 129, 0.12);
+  box-shadow: 0 0 40px rgba(16, 185, 129, 0.25);
+}
+</style>
@@ -0,0 +1,60 @@
+import { ref } from 'vue'
+import {
+  parseFramesReducer,
+  areFramesComplete,
+  framesToData,
+  totalNumberOfFrames,
+  currentNumberOfFrames,
+} from 'qrloop'
+
+/**
+ * Collects animated-QR frames (qrloop format, as used by k484 for large
+ * Fedimint tokens) and reassembles them into the original token string.
+ */
+export function useAnimatedQRDecoder() {
+  const framesState = ref<ReturnType<typeof parseFramesReducer> | null>(null)
+  const isComplete = ref(false)
+  const decodedData = ref<string | null>(null)
+  const uniqueFrames = ref<Set<string>>(new Set())
+
+  /** Feed one scanned frame; returns true once the full payload is decoded. */
+  function addFrame(frame: string): boolean {
+    if (isComplete.value) return true
+    if (uniqueFrames.value.has(frame)) return false
+    uniqueFrames.value.add(frame)
+
+    try {
+      framesState.value = parseFramesReducer(framesState.value, frame)
+      if (areFramesComplete(framesState.value)) {
+        const dataBuffer = framesToData(framesState.value)
+        // Tokens travel as URL-safe base64
+        decodedData.value = dataBuffer
+          .toString('base64')
+          .replace(/\+/g, '-')
+          .replace(/\//g, '_')
+        isComplete.value = true
+        return true
+      }
+      return false
+    } catch {
+      // A frame that qrloop rejects may just be a different QR format
+      return false
+    }
+  }
+
+  function progressText(): string {
+    if (!framesState.value) return ''
+    const total = totalNumberOfFrames(framesState.value)
+    const current = currentNumberOfFrames(framesState.value)
+    return `${current}/${total} frames`
+  }
+
+  function reset() {
+    framesState.value = null
+    uniqueFrames.value.clear()
+    isComplete.value = false
+    decodedData.value = null
+  }
+
+  return { isComplete, decodedData, addFrame, reset, progressText }
+}
@@ -15,7 +15,7 @@ const FUND_WALLET_STEP: GoalStep = {
  id: 'fund-wallet',
  title: 'Fund Your Bitcoin Wallet',
  description:
-    "Send bitcoin to your node's on-chain wallet so it can open a Lightning channel. Zeus channels need between 150,000 and 1,500,000 sats. Funding unlocks once your node finishes syncing the blockchain.",
+    "Send bitcoin to your node's on-chain wallet so it can open a Lightning channel. Zeus channels: minimum 150,000 · maximum 1,500,000 on-chain sats required. Funding unlocks once your node finishes syncing the blockchain.",
  action: 'fund',
  isAutomatic: false,
  icon: '/assets/img/app-icons/bitcoin-knots.webp',
@@ -51,7 +51,7 @@ export const GOALS: GoalDefinition[] = [
        id: 'open-zeus-channel',
        title: 'Open a Channel with Zeus',
        description:
-          'Open a Lightning channel to Zeus, the mobile wallet that pairs perfectly with your node. Fund it with 150,000–1,500,000 sats and your shop can accept instant Lightning payments.',
+          'Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.',
        action: 'configure',
        isAutomatic: false,
        icon: ZEUS_ICON,
@@ -106,7 +106,7 @@ export const GOALS: GoalDefinition[] = [
        id: 'open-channel',
        title: 'Open a Channel with Zeus',
        description:
-          'Open your first payment channel to Zeus, the mobile wallet built for nodes like yours (150,000–1,500,000 sats). You can then send and receive Lightning payments from your phone.',
+          'Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required.',
        action: 'configure',
        isAutomatic: false,
        icon: ZEUS_ICON,
@@ -208,7 +208,7 @@ export const GOALS: GoalDefinition[] = [
        id: 'open-channels',
        title: 'Open Payment Channels',
        description:
-          'Open channels with well-connected nodes to start routing payments. A great first channel is Zeus (150,000–1,500,000 sats) — it also puts your node in your pocket. More channels means more routing opportunities.',
+          'Open channels with well-connected nodes to start routing payments. A great first channel is Zeus Olympus (minimum 150,000 · maximum 1,500,000 on-chain sats) — it also puts your node in your pocket. More channels means more routing opportunities.',
        action: 'configure',
        isAutomatic: false,
        icon: ZEUS_ICON,
@@ -88,9 +88,9 @@ const router = createRouter({
      // normal app (onboarding → login → dashboard) like any other client.
      // This route only persists kiosk mode + safe-area insets, then redirects
      // to the root app. The launcher still points Chromium here (not directly
-      // at `/`) so the 'kiosk' flag gets set — App.vue uses it to skip the
-      // remote relay, which would otherwise double xdotool input on the kiosk
-      // display. Public so the auth guard doesn't bounce us before beforeEnter.
+      // at `/`) so the 'kiosk' flag gets set — App.vue keys kiosk-only styling
+      // (kiosk-mode/kiosk-safe-area classes, dark AIUI pin) off it. Public so
+      // the auth guard doesn't bounce us before beforeEnter.
      path: '/kiosk',
      name: 'kiosk',
      meta: { public: true },
@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { setActivePinia, createPinia } from 'pinia'

 // vi.hoisted runs before vi.mock hoisting
@@ -43,6 +43,40 @@ describe('useAppLauncherStore', () => {
    expect(store.title).toBe('')
  })

+  describe('companion app (native bridge)', () => {
+    const openInApp = vi.fn()
+    beforeEach(() => {
+      ;(window as any).ArchipelagoNative = { openInApp, openExternal: vi.fn() }
+      openInApp.mockClear()
+    })
+    afterEach(() => {
+      delete (window as any).ArchipelagoNative
+    })
+
+    it('openSession hands iframeable apps to the native WebView, never the iframe session', () => {
+      const store = useAppLauncherStore()
+      store.openSession('filebrowser')
+      expect(openInApp).toHaveBeenCalledWith(expect.stringContaining(':8083'))
+      expect(store.panelAppId).toBeNull()
+      expect(store.isOpen).toBe(false)
+      expect(mockWindowOpen).not.toHaveBeenCalled()
+    })
+
+    it('openSession carries deep-link paths into the WebView URL', () => {
+      const store = useAppLauncherStore()
+      store.openSession('mempool', { path: '/tx/abc123' })
+      expect(openInApp).toHaveBeenCalledWith(expect.stringContaining('/tx/abc123'))
+      expect(store.panelAppId).toBeNull()
+    })
+
+    it('open() never falls through to the iframe overlay', () => {
+      const store = useAppLauncherStore()
+      store.open({ url: 'http://192.168.1.228:9999', title: 'Unknown app' })
+      expect(openInApp).toHaveBeenCalledWith('http://192.168.1.228:9999')
+      expect(store.isOpen).toBe(false)
+    })
+  })
+
  it('routes known port apps to full-page session', () => {
    const store = useAppLauncherStore()

@@ -3,7 +3,9 @@ import { ref, watch } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
 import { recordAppLaunch } from '@/utils/appUsage'
 import { requestExternalOpen } from '@/api/remote-relay'
-import { openInAppOrNewTab } from '@/utils/openExternal'
+import { openInAppOrNewTab, isCompanionApp } from '@/utils/openExternal'
+import { resolveAppUrl } from '@/views/appSession/appSessionConfig'
+import { useAppStore } from '@/stores/app'
 import { IS_DEMO, isDemoApp, isDemoExternal, demoAppUrl } from '@/composables/useDemoIntro'

 /**
@@ -215,6 +217,19 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
    recordAppLaunch(appId)
    const mobile = isMobileViewport()

+    // Companion app: EVERY app opens in the native in-app WebView — never an
+    // iframe. The WebView is more performant on the phone and carries the
+    // native back/forward/reload/close controls. Plain mobile browsers (PWA)
+    // keep the iframe session below.
+    if (!IS_DEMO && isCompanionApp()) {
+      const runtimeUrl = useAppStore().data?.['package-data']?.[appId]?.installed?.['interface-addresses']?.main?.['lan-address'] || undefined
+      const launchUrl = directAppUrl(appId) || resolveAppUrl(appId, opts.path, runtimeUrl)
+      if (launchUrl) {
+        openInAppOrNewTab(launchUrl)
+        return
+      }
+    }
+
    // Demo: apps backed by a real external site that blocks iframing open
    // externally; everything else demoable renders in the in-app session.
    if (IS_DEMO && isDemoExternal(appId)) {
@@ -309,6 +324,13 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
      return
    }

+    // Companion app: never fall through to the iframe overlay — hand the URL
+    // to the native in-app WebView instead (see openSession).
+    if (!IS_DEMO && isCompanionApp()) {
+      openInAppOrNewTab(launchUrl)
+      return
+    }
+
    previousActiveElement = (document.activeElement as HTMLElement) || null
    url.value = launchUrl
    title.value = payload.title
@@ -1417,6 +1417,15 @@ html.kiosk-safe-area body {
  width: 100vw;
  height: 100vh;
  overflow: hidden;
+}
+/* Black fill on BODY only, never on the root element. With a background on
+   <html>, body's background no longer propagates to the canvas and instead
+   paints as a normal block background — which by CSS paint order lands ON TOP
+   of negative-z-index descendants, i.e. over .bg-perspective-container
+   (z-index -10): every dashboard/login background image rendered as solid
+   black on kiosk displays. Body-only matches the non-kiosk pages, where the
+   art has always shown. */
+html.kiosk-safe-area body {
  background: #000;
 }

@@ -0,0 +1,9 @@
+declare module 'qrloop' {
+  export type FramesState = unknown
+  export function parseFramesReducer(state: FramesState | null, frame: string): FramesState
+  export function areFramesComplete(state: FramesState): boolean
+  export function framesToData(state: FramesState): { toString(encoding: string): string }
+  export function totalNumberOfFrames(state: FramesState): number
+  export function currentNumberOfFrames(state: FramesState): number
+  export function progressOfFrames(state: FramesState): number
+}
@@ -100,3 +100,29 @@ export function meshcorePlanFor(code: string | null | undefined): MeshcorePlan |
  if (!code) return undefined
  return MESHCORE_PLANS[code.toUpperCase()]
 }
+
+/** A named MeshCore RF preset for the Device-panel dropdown. */
+export interface MeshcoreRfPreset {
+  id: string
+  label: string
+  freqMhz: number
+  bwKhz: number
+  sf: number
+  cr: number
+}
+
+/**
+ * Prepopulated MeshCore RF plans by country/region for the Device panel's
+ * preset dropdown ("Custom" in the UI unlocks free entry). Values are only
+ * added here when verifiable: the MeshCore community plans above, the
+ * MeshCore firmware's own build defaults (platformio.ini `arduino_base`:
+ * 869.618/62.5/SF8, CR default 5; companion example: 915.0/250/SF10/CR5),
+ * and operator-attested deployment plans.
+ */
+export const MESHCORE_RF_PRESETS: MeshcoreRfPreset[] = [
+  { id: 'eu_868', label: 'Europe / UK — 869.525 MHz, 250 kHz, SF11, CR4/5', freqMhz: 869.525, bwKhz: 250, sf: 11, cr: 5 },
+  { id: 'pt', label: 'Portugal — 869.618 MHz, 62.5 kHz, SF8, CR4/8', freqMhz: 869.618, bwKhz: 62.5, sf: 8, cr: 8 },
+  { id: 'fw_default', label: 'MeshCore firmware default — 869.618 MHz, 62.5 kHz, SF8, CR4/5', freqMhz: 869.618, bwKhz: 62.5, sf: 8, cr: 5 },
+  { id: 'us_anz_915', label: 'US / Canada / ANZ — 915.0 MHz, 250 kHz, SF10, CR4/5', freqMhz: 915.0, bwKhz: 250, sf: 10, cr: 5 },
+  { id: 'eu_433', label: 'Europe (433 MHz) — 433.65 MHz, 250 kHz, SF11, CR4/5', freqMhz: 433.65, bwKhz: 250, sf: 11, cr: 5 },
+]
@@ -18,6 +18,16 @@ function nativeBridge(): ArchipelagoNativeBridge | undefined {
  return (window as unknown as { ArchipelagoNative?: ArchipelagoNativeBridge }).ArchipelagoNative
 }

+/**
+ * True when running inside the Android companion app (native WebView shell).
+ * The shell injects `window.ArchipelagoNative`; a plain mobile browser / PWA
+ * never has it.
+ */
+export function isCompanionApp(): boolean {
+  const native = nativeBridge()
+  return !!native && typeof native.openInApp === 'function'
+}
+
 export function openExternalUrl(url: string): void {
  if (!url) return
  const native = nativeBridge()
@@ -546,35 +546,14 @@ onBeforeUnmount(() => {
  opacity: 0.5;
 }

-/* Mode dropdown */
-.mode-option {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  width: 100%;
-  padding: 10px 14px;
-  font-size: 13px;
-  color: rgba(255, 255, 255, 0.7);
-  transition: all 0.15s ease;
-  text-align: left;
-}
-.mode-option:hover {
-  background: rgba(255, 255, 255, 0.08);
-  color: white;
-}
-.mode-option-active {
+/* Active display-mode button in the header bar */
+.app-session-btn-active {
  color: #fb923c;
-  background: rgba(251, 146, 60, 0.08);
+  background: rgba(251, 146, 60, 0.12);
 }
-
-.menu-fade-enter-active,
-.menu-fade-leave-active {
-  transition: opacity 0.15s ease, transform 0.15s ease;
-}
-.menu-fade-enter-from,
-.menu-fade-leave-to {
-  opacity: 0;
-  transform: translateY(-4px);
+.app-session-btn-active:hover {
+  color: #fb923c;
+  background: rgba(251, 146, 60, 0.18);
 }

 .content-fade-enter-active,
@@ -52,36 +52,108 @@
           manages everything related to peering. The toggle directly mutates
           the `nostr_discovery_enabled` config flag — backend defaults to OFF
           and nothing is published until the user explicitly turns it on. -->
-      <div class="glass-card p-4 mb-6 flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
-        <div class="min-w-0">
-          <div class="flex items-center gap-2">
-            <span class="text-sm font-medium text-white">Nostr discoverability</span>
-            <span
-              class="inline-block px-2 py-0.5 text-[10px] uppercase tracking-wide rounded"
-              :class="discoveryEnabled ? 'bg-green-500/20 text-green-300' : 'bg-white/10 text-white/50'"
-            >{{ discoveryEnabled ? 'On' : 'Off' }}</span>
+      <div class="glass-card p-4 mb-6">
+        <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
+          <div class="min-w-0">
+            <div class="flex items-center gap-2">
+              <span class="text-sm font-medium text-white">Nostr discoverability</span>
+              <span
+                class="inline-block px-2 py-0.5 text-[10px] uppercase tracking-wide rounded"
+                :class="discoveryEnabled ? 'bg-green-500/20 text-green-300' : 'bg-white/10 text-white/50'"
+              >{{ discoveryEnabled ? 'On' : 'Off' }}</span>
+            </div>
+            <p class="text-xs text-white/60 mt-1">
+              When on, this node publishes a presence event (DID + npub only — never an onion)
+              so other nodes can find you and request to peer. Inbound requests land in the
+              panel below for your approval. Off by default.
+            </p>
+            <button
+              class="text-xs text-white/50 hover:text-white/80 underline underline-offset-2 mt-1"
+              @click="showSigningInfo = !showSigningInfo"
+            >
+              {{ showSigningInfo ? 'Hide signing details' : 'Signing details' }}
+            </button>
+          </div>
+          <div class="flex items-center gap-2 shrink-0">
+            <button
+              class="px-3 py-1.5 glass-button glass-button-sm rounded text-xs text-white/90 hover:text-white disabled:opacity-50"
+              :disabled="discoveryToggling"
+              @click="toggleDiscovery"
+            >
+              {{ discoveryToggling ? '…' : (discoveryEnabled ? 'Disable' : 'Enable') }}
+            </button>
+            <button
+              class="px-3 py-1.5 glass-button glass-button-sm rounded text-xs text-white/90 hover:text-white disabled:opacity-50"
+              :disabled="!discoveryEnabled"
+              @click="showDiscoverModal = true"
+            >
+              Discover Nodes
+            </button>
          </div>
-          <p class="text-xs text-white/60 mt-1">
-            When on, this node publishes a presence event (DID + npub only — never an onion)
-            so other nodes can find you and request to peer. Inbound requests land in the
-            panel below for your approval. Off by default.
-          </p>
        </div>
-        <div class="flex items-center gap-2 shrink-0">
-          <button
-            class="px-3 py-1.5 glass-button glass-button-sm rounded text-xs text-white/90 hover:text-white disabled:opacity-50"
-            :disabled="discoveryToggling"
-            @click="toggleDiscovery"
-          >
-            {{ discoveryToggling ? '…' : (discoveryEnabled ? 'Disable' : 'Enable') }}
-          </button>
-          <button
-            class="px-3 py-1.5 glass-button glass-button-sm rounded text-xs text-white/90 hover:text-white disabled:opacity-50"
-            :disabled="!discoveryEnabled"
-            @click="showDiscoverModal = true"
-          >
-            Discover Nodes
-          </button>
+
+        <!-- Signing details: shows WHO signs the presence event (always the
+             node's own discovery key — deliberately not pickable, so a user's
+             personal Web5/Nostr identities can never be burned for node
+             discovery) and a human-readable view of WHAT gets signed. -->
+        <div v-if="showSigningInfo" class="mt-4 pt-4 border-t border-white/10 space-y-3">
+          <div>
+            <label class="block text-[10px] uppercase tracking-wide text-white/40 mb-1">Signer</label>
+            <!-- Same row style as the NostrIdentityPicker overlay, but locked:
+                 node discovery always signs with the node's own key, never a
+                 personal identity, so there is nothing to pick. -->
+            <div class="w-full sm:max-w-md p-3 rounded-lg bg-white/[0.03] ring-1 ring-white/10">
+              <div class="flex items-center gap-3">
+                <div class="w-9 h-9 rounded-lg flex items-center justify-center shrink-0 bg-white/10 text-white/80">
+                  <span class="text-sm font-bold">{{ (appStore.serverName || 'N').charAt(0).toUpperCase() }}</span>
+                </div>
+                <div class="flex-1 min-w-0">
+                  <div class="flex items-center gap-2">
+                    <span class="text-white font-semibold text-sm truncate">{{ appStore.serverName || 'This node' }}</span>
+                    <span class="text-[10px] px-1.5 py-0.5 rounded bg-white/10 text-white/60">node identity</span>
+                  </div>
+                  <div class="mt-0.5">
+                    <span class="text-white/35 text-xs font-mono truncate">{{ nodeNpub ? truncateNpub(nodeNpub) : 'loading…' }}</span>
+                  </div>
+                </div>
+                <svg class="w-4 h-4 text-white/30 shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2" aria-label="Locked">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 10-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 002.25-2.25v-6.75a2.25 2.25 0 00-2.25-2.25H6.75a2.25 2.25 0 00-2.25 2.25v6.75a2.25 2.25 0 002.25 2.25z" />
+                </svg>
+              </div>
+            </div>
+            <p class="text-[11px] text-white/40 mt-1">
+              Presence events are always signed with this node's dedicated discovery key.
+              Your personal identities are never used for node discovery, so unlike the app
+              sign-in overlay there is nothing to choose here.
+            </p>
+          </div>
+          <div>
+            <label class="block text-[10px] uppercase tracking-wide text-white/40 mb-1">What gets signed &amp; published</label>
+            <dl class="text-xs space-y-1.5">
+              <div class="flex flex-col sm:flex-row sm:gap-2">
+                <dt class="text-white/50 shrink-0 sm:w-28">Identity (DID)</dt>
+                <dd class="text-white/80 font-mono break-all">{{ selfDid || '—' }}</dd>
+              </div>
+              <div class="flex flex-col sm:flex-row sm:gap-2">
+                <dt class="text-white/50 shrink-0 sm:w-28">Signing key</dt>
+                <dd class="text-white/80 font-mono break-all">{{ nodeNpub || '—' }}</dd>
+              </div>
+              <div class="flex flex-col sm:flex-row sm:gap-2">
+                <dt class="text-white/50 shrink-0 sm:w-28">Software version</dt>
+                <dd class="text-white/80">{{ appVersion || '—' }}</dd>
+              </div>
+              <div class="flex flex-col sm:flex-row sm:gap-2">
+                <dt class="text-white/50 shrink-0 sm:w-28">Event format</dt>
+                <dd class="text-white/80">Nostr kind 30078, replaceable (NIP-33), tag <span class="font-mono">archipelago-node</span></dd>
+              </div>
+            </dl>
+            <p class="text-[11px] text-white/40 mt-2">
+              Every presence event carries a Schnorr signature (NIP-01) made with the key
+              above — relays reject unsigned events, so anything you see via discovery was
+              cryptographically signed by its node. Your onion address is never part of this
+              event; it is only shared over encrypted DMs (NIP-44) after you approve a peer.
+            </p>
+          </div>
        </div>
      </div>
      <div v-if="discoveryError" class="mb-4 text-xs text-red-400">{{ discoveryError }}</div>
@@ -140,6 +212,17 @@
      @close="showDiscoverModal = false"
      @sent="loadPendingRequests"
    />
+
+    <PresenceSignModal
+      :show="showPresenceSignModal"
+      :server-name="appStore.serverName"
+      :npub="nodeNpub"
+      :did="selfDid"
+      :version="appVersion"
+      :busy="discoveryToggling"
+      @confirm="confirmPresenceSign"
+      @cancel="showPresenceSignModal = false"
+    />
  </div>
 </template>

@@ -148,6 +231,7 @@ import { ref, computed, onMounted, onUnmounted } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
 import { useTransportStore } from '@/stores/transport'
 import { useAppStore } from '@/stores/app'
+import { useSyncStore } from '@/stores/sync'
 import NetworkMap from '@/components/federation/NetworkMap.vue'
 import FederationHeader from './federation/FederationHeader.vue'
 import RotateDidModal from './federation/RotateDidModal.vue'
@@ -157,12 +241,14 @@ import NodeDetailModal from './federation/NodeDetailModal.vue'
 import JoinModal from './federation/JoinModal.vue'
 import PendingRequestsPanel from './federation/PendingRequestsPanel.vue'
 import DiscoverModal from './federation/DiscoverModal.vue'
+import PresenceSignModal from './federation/PresenceSignModal.vue'
 import type { FederatedNode, DwnStatus, SyncResult } from './federation/types'
 import type { PendingPeerRequest } from '@/api/rpc-client'
 import { nodeName, timeAgo } from './federation/utils'

 const transportStore = useTransportStore()
 const appStore = useAppStore()
+const syncStore = useSyncStore()

 const nodes = ref<FederatedNode[]>([])
 const loading = ref(true)
@@ -253,7 +339,7 @@ const dwnSyncLabel = computed(() => {
    case 'synced': return 'Synced'
    case 'syncing': return 'Syncing...'
    case 'error': return 'Error'
-    default: return dwnStatus.value.sync_status
+    default: return dwnStatus.value.sync_status || 'Unknown'
  }
 })

@@ -271,6 +357,26 @@ const discoveryEnabled = ref(false)
 const discoveryToggling = ref(false)
 const discoveryError = ref('')
 const showDiscoverModal = ref(false)
+// Signing-details disclosure: who signs the presence event (always the node's
+// own discovery key) and a human-readable view of the signed content.
+const showSigningInfo = ref(false)
+const showPresenceSignModal = ref(false)
+const nodeNpub = ref('')
+const appVersion = computed(() => syncStore.serverInfo?.version || '')
+
+function truncateNpub(npub: string): string {
+  if (npub.length <= 20) return npub
+  return npub.slice(0, 12) + '...' + npub.slice(-6)
+}
+
+async function loadNodeNpub() {
+  try {
+    const res = await rpcClient.call<{ nostr_npub?: string }>({ method: 'node.nostr-pubkey' })
+    if (res?.nostr_npub) nodeNpub.value = res.nostr_npub
+  } catch {
+    // Nostr key not provisioned yet — panel shows a placeholder
+  }
+}
 const pendingRequests = ref<PendingPeerRequest[]>([])
 const pollingHandshake = ref(false)
 const pendingBusyId = ref<string | null>(null)
@@ -285,11 +391,19 @@ async function loadDiscoveryState() {
 }

 async function toggleDiscovery() {
+  if (!discoveryEnabled.value) {
+    // Enabling publishes a signed presence event — surface the signer overlay
+    // first so the user sees exactly what gets signed and with which key.
+    // Nothing is published until they confirm.
+    if (!nodeNpub.value) loadNodeNpub()
+    showPresenceSignModal.value = true
+    return
+  }
+  // Disabling publishes nothing new — apply immediately.
  discoveryToggling.value = true
  discoveryError.value = ''
-  const next = !discoveryEnabled.value
  try {
-    const result = await rpcClient.nostrSetDiscovery(next)
+    const result = await rpcClient.nostrSetDiscovery(false)
    discoveryEnabled.value = !!result.enabled
  } catch (e: unknown) {
    discoveryError.value = e instanceof Error ? e.message : 'Failed to toggle discoverability'
@@ -298,6 +412,20 @@ async function toggleDiscovery() {
  }
 }

+async function confirmPresenceSign() {
+  discoveryToggling.value = true
+  discoveryError.value = ''
+  try {
+    const result = await rpcClient.nostrSetDiscovery(true)
+    discoveryEnabled.value = !!result.enabled
+    showPresenceSignModal.value = false
+  } catch (e: unknown) {
+    discoveryError.value = e instanceof Error ? e.message : 'Failed to enable discoverability'
+  } finally {
+    discoveryToggling.value = false
+  }
+}
+
 async function loadPendingRequests() {
  try {
    const result = await rpcClient.federationListPendingRequests()
@@ -557,6 +685,7 @@ onMounted(async () => {
  loadDwnStatus()
  loadDiscoveryState()
  loadPendingRequests()
+  loadNodeNpub()
  transportStore.fetchPeers()
  try {
    const result = await rpcClient.getNodeDid()
@@ -125,7 +125,7 @@
                            {{ walletOnchainSats.toLocaleString() }} sats
                          </span>
                        </div>
-                        <p class="text-xs text-white/45 mt-1">Zeus channels need 150,000–1,500,000 sats.</p>
+                        <p class="text-xs text-white/45 mt-1">Minimum 150,000 · maximum 1,500,000 on-chain sats required.</p>
                      </div>
                      <div class="flex flex-wrap gap-2">
                        <button
@@ -205,7 +205,7 @@
    <!-- Fund-wallet receive modal (on-chain address + QR, Zeus limits noted) -->
    <ReceiveBitcoinModal
      :show="showFundModal"
-      note="Fund your Lightning channel: Zeus channels need a minimum of 150,000 and a maximum of 1,500,000 sats."
+      note="Fund your Lightning channel: minimum 150,000 · maximum 1,500,000 on-chain sats required."
      auto-generate
      @close="showFundModal = false"
    />
@@ -67,7 +67,7 @@
        :class="{ 'opacity-0 pointer-events-none': showWelcomeBlock && !animateCards }"
      >
        <!-- My Apps Overview -->
-        <div data-controller-container tabindex="0" class="home-card controller-focusable" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 0">
+        <div data-controller-container tabindex="0" class="home-card controller-focusable order-1 lg:order-none" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 0">
          <div class="home-card-shell">
            <div class="home-card-inner p-6 flex flex-col h-full min-h-0">
              <div class="home-card-header flex items-start justify-between mb-4 shrink-0">
@@ -101,7 +101,7 @@
        </div>

        <!-- Cloud Overview -->
-        <div data-controller-container tabindex="0" class="home-card controller-focusable" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 1">
+        <div data-controller-container tabindex="0" class="home-card controller-focusable order-3 lg:order-none" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 1">
          <div class="home-card-shell">
            <div class="home-card-inner p-6 flex flex-col h-full min-h-0">
              <div class="home-card-header flex items-start justify-between mb-4 shrink-0">
@@ -127,6 +127,7 @@

        <!-- Wallet Overview -->
        <HomeWalletCard
+          class="order-2 lg:order-none"
          :animate="animateCards"
          :wallet-connected="walletConnected"
          :wallet-onchain="walletOnchain"
@@ -136,6 +137,7 @@
          :wallet-ark="walletArk"
          :wallet-transactions="walletTransactions"
          :is-dev="isDev"
+          @show-scan="showScanModal = true"
          @show-send="showSendModal = true"
          @show-receive="showReceiveModal = true"
          @show-transactions="showTransactionsModal = true"
@@ -145,7 +147,7 @@
        />

        <!-- Network Overview -->
-        <div data-controller-container tabindex="0" class="home-card controller-focusable" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 3">
+        <div data-controller-container tabindex="0" class="home-card controller-focusable order-4 lg:order-none" :class="{ 'home-card-animate': animateCards }" style="--card-stagger: 3">
          <div class="home-card-shell">
            <div class="home-card-inner p-6 flex flex-col h-full min-h-0">
              <div class="home-card-header flex items-start justify-between mb-4 shrink-0">
@@ -191,7 +193,7 @@
          v-if="homeRecommendedApps.length > 0"
          data-controller-container
          tabindex="0"
-          class="home-card controller-focusable lg:col-span-2"
+          class="home-card controller-focusable lg:col-span-2 order-5 lg:order-none"
          :class="{ 'home-card-animate': animateCards }"
          style="--card-stagger: 4"
        >
@@ -238,7 +240,7 @@
        <!-- Quick Start Goals -->
        <div
          v-if="showQuickStart"
-          class="home-card lg:col-span-2 transition-opacity duration-300"
+          class="home-card lg:col-span-2 transition-opacity duration-300 order-6 lg:order-none"
          :class="{ 'home-card-animate': animateCards, 'opacity-0 pointer-events-none': showWelcomeBlock && !animateCards }"
          style="--card-stagger: 5"
        >
@@ -264,6 +266,7 @@

        <!-- System Stats -->
        <HomeSystemCard
+          class="order-7 lg:order-none"
          :animate="animateCards"
          :loaded="systemStatsLoaded"
          :stats="systemStats"
@@ -278,8 +281,9 @@
    </div>

    <!-- Wallet Modals -->
-    <SendBitcoinModal :show="showSendModal" @close="showSendModal = false" @sent="loadWeb5Status()" />
-    <ReceiveBitcoinModal :show="showReceiveModal" @close="showReceiveModal = false" @received="loadWeb5Status()" />
+    <WalletScanModal :show="showScanModal" @close="showScanModal = false" @sent="loadWeb5Status()" />
+    <SendBitcoinModal :show="showSendModal" @close="showSendModal = false" @sent="loadWeb5Status()" @scan="showSendModal = false; showScanModal = true" />
+    <ReceiveBitcoinModal :show="showReceiveModal" @close="showReceiveModal = false" @received="loadWeb5Status()" @scan="showReceiveModal = false; showScanModal = true" />
    <TransactionsModal :show="showTransactionsModal" :transactions="walletTransactions" @close="showTransactionsModal = false" />
    <WalletSettingsModal :show="showWalletSettingsModal" @close="showWalletSettingsModal = false" @changed="loadWeb5Status()" />
  </div>
@@ -289,6 +293,7 @@
 import { computed, ref, watch, onBeforeUnmount, onMounted } from 'vue'
 import { RouterLink, useRoute, useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
+import WalletScanModal from '@/components/WalletScanModal.vue'
 import SendBitcoinModal from '@/components/SendBitcoinModal.vue'
 import ReceiveBitcoinModal from '@/components/ReceiveBitcoinModal.vue'
 import TransactionsModal from '@/components/TransactionsModal.vue'
@@ -517,7 +522,7 @@ onMounted(async () => {
 })

 // Wallet modals
-const showSendModal = ref(false); const showReceiveModal = ref(false); const showTransactionsModal = ref(false); const showWalletSettingsModal = ref(false)
+const showScanModal = ref(false); const showSendModal = ref(false); const showReceiveModal = ref(false); const showTransactionsModal = ref(false); const showWalletSettingsModal = ref(false)

 async function devFaucet() { try { await rpcClient.call({ method: 'dev.faucet', params: { amount_sats: 1_000_000 } }); await loadWeb5Status() } catch { /* ignore */ } }

@@ -699,8 +699,12 @@ video.bg-layer {
 :global(html.kiosk-mode .perspective-container) {
  perspective: none !important;
 }
+/* Scoped to the onboarding viewport: a bare `.view-wrapper` match also killed
+   the dashboard's route transitions on kiosk (transform:none !important beats
+   the transition classes), freezing every tab change. The dashboard has its
+   own kiosk-safe 2D transition overrides in dashboard-styles.css. */
 :global(html.kiosk-mode .bg-layer),
-:global(html.kiosk-mode .view-wrapper) {
+:global(html.kiosk-mode .onb-viewport .view-wrapper) {
  transform: none !important;
  transform-style: flat !important;
  backface-visibility: visible !important;
@@ -22,63 +22,41 @@
      </svg>
    </button>

-    <!-- Display mode selector -->
-    <div class="relative" ref="modeMenuRef">
+    <!-- Display mode: one-click switch -->
+    <div class="flex items-center gap-0.5">
      <button
        class="app-session-btn"
-        aria-label="Display mode"
-        title="Display mode"
-        @click="showModeMenu = !showModeMenu"
+        :class="{ 'app-session-btn-active': displayMode === 'panel' }"
+        aria-label="Right panel"
+        title="Right panel"
+        @click="$emit('setMode', 'panel')"
      >
-        <!-- Panel icon -->
-        <svg v-if="displayMode === 'panel'" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 3v18m12-18H3a1 1 0 00-1 1v16a1 1 0 001 1h18a1 1 0 001-1V4a1 1 0 00-1-1z" />
        </svg>
-        <!-- Overlay icon -->
-        <svg v-else-if="displayMode === 'overlay'" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+      </button>
+      <button
+        class="app-session-btn"
+        :class="{ 'app-session-btn-active': displayMode === 'overlay' }"
+        aria-label="Over whole app"
+        title="Over whole app"
+        @click="$emit('setMode', 'overlay')"
+      >
+        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 5a1 1 0 011-1h14a1 1 0 011 1v14a1 1 0 01-1 1H5a1 1 0 01-1-1V5z" />
        </svg>
-        <!-- Fullscreen icon -->
-        <svg v-else class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+      </button>
+      <button
+        class="app-session-btn"
+        :class="{ 'app-session-btn-active': displayMode === 'fullscreen' }"
+        aria-label="Open fullscreen"
+        title="Open fullscreen"
+        @click="$emit('setMode', 'fullscreen')"
+      >
+        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 8V4m0 0h4M4 4l5 5m11-1V4m0 0h-4m4 0l-5 5M4 16v4m0 0h4m-4 0l5-5m11 5v-4m0 4h-4m4 0l-5-5" />
        </svg>
      </button>
-
-      <!-- Dropdown -->
-      <Transition name="menu-fade">
-        <div v-if="showModeMenu" class="absolute right-0 top-full mt-1 w-48 bg-black/90 border border-white/10 rounded-lg backdrop-blur-xl shadow-2xl overflow-hidden z-50">
-          <button
-            class="mode-option"
-            :class="{ 'mode-option-active': displayMode === 'panel' }"
-            @click="selectMode('panel')"
-          >
-            <svg class="w-4 h-4 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 3v18m12-18H3a1 1 0 00-1 1v16a1 1 0 001 1h18a1 1 0 001-1V4a1 1 0 00-1-1z" />
-            </svg>
-            <span>Right panel</span>
-          </button>
-          <button
-            class="mode-option"
-            :class="{ 'mode-option-active': displayMode === 'overlay' }"
-            @click="selectMode('overlay')"
-          >
-            <svg class="w-4 h-4 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 5a1 1 0 011-1h14a1 1 0 011 1v14a1 1 0 01-1 1H5a1 1 0 01-1-1V5z" />
-            </svg>
-            <span>Over whole app</span>
-          </button>
-          <button
-            class="mode-option"
-            :class="{ 'mode-option-active': displayMode === 'fullscreen' }"
-            @click="selectMode('fullscreen')"
-          >
-            <svg class="w-4 h-4 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 8V4m0 0h4M4 4l5 5m11-1V4m0 0h-4m4 0l-5 5M4 16v4m0 0h4m-4 0l5-5m11 5v-4m0 4h-4m4 0l-5-5" />
-            </svg>
-            <span>Open fullscreen</span>
-          </button>
-        </div>
-      </Transition>
    </div>

    <button class="app-session-btn" aria-label="Open in new tab" title="Open in new tab" @click="$emit('openNewTab')">
@@ -98,7 +76,6 @@
 </template>

 <script setup lang="ts">
-import { ref, onMounted, onBeforeUnmount } from 'vue'
 import type { DisplayMode } from './appSessionConfig'

 defineProps<{
@@ -107,7 +84,7 @@ defineProps<{
  displayMode: DisplayMode
 }>()

-const emit = defineEmits<{
+defineEmits<{
  goBack: []
  goForward: []
  refresh: []
@@ -115,26 +92,4 @@ const emit = defineEmits<{
  close: []
  setMode: [mode: DisplayMode]
 }>()
-
-const showModeMenu = ref(false)
-const modeMenuRef = ref<HTMLElement | null>(null)
-
-function selectMode(mode: DisplayMode) {
-  showModeMenu.value = false
-  emit('setMode', mode)
-}
-
-function onClickOutside(e: MouseEvent) {
-  if (showModeMenu.value && modeMenuRef.value && !modeMenuRef.value.contains(e.target as Node)) {
-    showModeMenu.value = false
-  }
-}
-
-onMounted(() => {
-  document.addEventListener('click', onClickOutside)
-})
-
-onBeforeUnmount(() => {
-  document.removeEventListener('click', onClickOutside)
-})
 </script>
@@ -81,6 +81,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
  "nostr-rs-relay": "Nostr Relay (Rust)",
  "photoprism": "PhotoPrism",
  "pine": "Pine",
+  "pine-openwakeword": "Pine Wake Word (openWakeWord)",
  "pine-piper": "Pine Piper (TTS)",
  "pine-whisper": "Pine Whisper (STT)",
  "portainer": "Portainer",
@@ -29,7 +29,7 @@ export const SERVICE_NAMES = new Set([
  // Pine voice-assistant stack: the two Wyoming engines are backends (STT/TTS)
  // reached by Home Assistant over host.containers.internal — the user-facing
  // card is "pine" (the setup/status launcher), so the engines go to Services.
-  'pine-whisper', 'pine-piper',
+  'pine-whisper', 'pine-piper', 'pine-openwakeword',
 ])

 const INTERNAL_TOOLING_NAMES = new Set([
@@ -756,6 +756,38 @@ html.kiosk-mode .dashboard-view .bg-layer {
  transition: opacity 0.45s ease;
 }

+/* Kiosk: keep tab changes animated with cheap 2D moves. The 3D depth
+   transitions (translateZ + blur + preserve-3d) drop frames / paint black
+   under the software compositor, and the onboarding-era blanket
+   `transform: none` on .view-wrapper killed tab motion entirely. Plain 2D
+   scale + opacity composites fine there. */
+html.kiosk-mode .depth-forward-enter-active.view-wrapper,
+html.kiosk-mode .depth-forward-leave-active.view-wrapper,
+html.kiosk-mode .depth-back-enter-active.view-wrapper,
+html.kiosk-mode .depth-back-leave-active.view-wrapper {
+  transition: transform 0.45s ease, opacity 0.45s ease;
+  transform-style: flat;
+  backface-visibility: visible;
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-enter-from.view-wrapper,
+html.kiosk-mode .depth-back-leave-to.view-wrapper {
+  transform: scale(0.94);
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-leave-to.view-wrapper,
+html.kiosk-mode .depth-back-enter-from.view-wrapper {
+  transform: scale(1.05);
+  filter: none !important;
+}
+html.kiosk-mode .depth-forward-enter-to.view-wrapper,
+html.kiosk-mode .depth-forward-leave-from.view-wrapper,
+html.kiosk-mode .depth-back-enter-to.view-wrapper,
+html.kiosk-mode .depth-back-leave-from.view-wrapper {
+  transform: scale(1);
+  filter: none !important;
+}
+
 /* Background glitch effect layers - World Fair style */
 .bg-glitch-layer-1,
 .bg-glitch-layer-2,
@@ -0,0 +1,264 @@
+<template>
+  <Teleport to="body">
+    <Transition name="presence-sign">
+      <div
+        v-if="show"
+        class="fixed inset-0 z-[3100] flex items-center justify-center p-4"
+        @click="$emit('cancel')"
+      >
+        <!-- Backdrop — frosted blur, same treatment as the app signer overlay -->
+        <div class="absolute inset-0 bg-black/40 backdrop-blur-2xl"></div>
+
+        <div
+          ref="modalRef"
+          @click.stop
+          role="dialog"
+          aria-modal="true"
+          aria-label="Sign and publish node presence"
+          class="relative z-10 w-full max-w-lg flex flex-col min-h-0 max-h-full"
+        >
+          <!-- Header: glass disc + radial viz ring, mirroring NostrIdentityPicker -->
+          <div class="relative mb-4 sm:mb-6 flex flex-col items-center shrink-0">
+            <div class="presence-hero">
+              <div class="presence-viz-ring">
+                <div
+                  v-for="(_, i) in 48"
+                  :key="i"
+                  class="presence-viz-segment"
+                  :style="{ '--seg-i': i, '--seg-deg': `${(i / 48) * 360}deg` }"
+                />
+              </div>
+              <div class="presence-glass-border">
+                <div class="presence-glass-inner">
+                  <svg class="w-9 h-9 text-white/90" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 10-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 002.25-2.25v-6.75a2.25 2.25 0 00-2.25-2.25H6.75a2.25 2.25 0 00-2.25 2.25v6.75a2.25 2.25 0 002.25 2.25z" />
+                  </svg>
+                </div>
+              </div>
+            </div>
+
+            <h2 class="mt-5 text-lg font-semibold text-white">Sign &amp; Publish Presence</h2>
+            <p class="mt-1 text-white/25 tracking-widest uppercase" style="font-size: 10px;">Nostr node discovery</p>
+          </div>
+
+          <!-- Scrollable content: on short viewports (small phones) this card
+               shrinks and scrolls internally so the action buttons stay in view -->
+          <div class="glass-card p-4 space-y-4 overflow-y-auto min-h-0 overscroll-contain">
+            <!-- Signer: single locked row, same look as the identity picker rows.
+                 Node discovery always signs with the node's own key — never a
+                 personal identity — so there is deliberately nothing to pick. -->
+            <div>
+              <div class="text-[10px] uppercase tracking-wide text-white/40 mb-1.5">Signer</div>
+              <div class="w-full p-3 rounded-lg bg-white/10 ring-1 ring-white/20">
+                <div class="flex items-center gap-3">
+                  <div class="w-9 h-9 rounded-lg flex items-center justify-center shrink-0 bg-white/10 text-white/80">
+                    <span class="text-sm font-bold">{{ (serverName || 'N').charAt(0).toUpperCase() }}</span>
+                  </div>
+                  <div class="flex-1 min-w-0">
+                    <div class="flex items-center gap-2">
+                      <span class="text-white font-semibold text-sm truncate">{{ serverName || 'This node' }}</span>
+                      <span class="text-[10px] px-1.5 py-0.5 rounded bg-white/10 text-white/60">node identity</span>
+                    </div>
+                    <div class="mt-0.5">
+                      <span class="text-white/35 text-xs font-mono truncate">{{ npub ? truncateNpub(npub) : 'loading…' }}</span>
+                    </div>
+                  </div>
+                  <svg class="w-4 h-4 text-white/30 shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2" aria-label="Locked">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 10-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 002.25-2.25v-6.75a2.25 2.25 0 00-2.25-2.25H6.75a2.25 2.25 0 00-2.25 2.25v6.75a2.25 2.25 0 002.25 2.25z" />
+                  </svg>
+                </div>
+              </div>
+              <p class="text-[11px] text-white/40 mt-1.5">
+                Presence events are always signed with this node's dedicated discovery key —
+                your personal identities are never used, so there is nothing to choose.
+              </p>
+            </div>
+
+            <!-- Human-readable view of the exact content that gets signed -->
+            <div>
+              <div class="text-[10px] uppercase tracking-wide text-white/40 mb-1.5">What gets signed &amp; published</div>
+              <dl class="text-xs space-y-1.5">
+                <div class="flex flex-col sm:flex-row sm:gap-2">
+                  <dt class="text-white/50 shrink-0 sm:w-28">Identity (DID)</dt>
+                  <dd class="text-white/80 font-mono break-all">{{ did || '—' }}</dd>
+                </div>
+                <div class="flex flex-col sm:flex-row sm:gap-2">
+                  <dt class="text-white/50 shrink-0 sm:w-28">Signing key</dt>
+                  <dd class="text-white/80 font-mono break-all">{{ npub || '—' }}</dd>
+                </div>
+                <div class="flex flex-col sm:flex-row sm:gap-2">
+                  <dt class="text-white/50 shrink-0 sm:w-28">Software version</dt>
+                  <dd class="text-white/80">{{ version || '—' }}</dd>
+                </div>
+                <div class="flex flex-col sm:flex-row sm:gap-2">
+                  <dt class="text-white/50 shrink-0 sm:w-28">Event format</dt>
+                  <dd class="text-white/80">Nostr kind 30078, replaceable (NIP-33), tag <span class="font-mono">archipelago-node</span></dd>
+                </div>
+              </dl>
+              <p class="text-[11px] text-white/40 mt-2">
+                Every presence event carries a Schnorr signature (NIP-01) made with the key
+                above — relays reject unsigned events. Your onion address is never part of
+                this event; it is only shared over encrypted DMs (NIP-44) after you approve
+                a peer.
+              </p>
+            </div>
+          </div>
+
+          <!-- Actions -->
+          <div class="flex gap-3 mt-4 shrink-0">
+            <button @click="$emit('cancel')" class="glass-button flex-1 py-3 rounded-lg text-sm font-medium text-white/70">
+              Cancel
+            </button>
+            <button
+              @click="$emit('confirm')"
+              :disabled="busy"
+              class="flex-1 py-3 rounded-lg text-sm font-semibold transition-all duration-200 bg-white/10 text-white hover:bg-white/15 disabled:opacity-30 disabled:cursor-not-allowed"
+            >
+              {{ busy ? 'Publishing…' : 'Sign & Publish' }}
+            </button>
+          </div>
+
+          <p class="mt-3 text-center text-[10px] text-white/20 tracking-widest shrink-0">
+            NIP-01 &middot; SECP256K1 &middot; SCHNORR &middot; Signed locally
+          </p>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { ref, computed } from 'vue'
+import { useModalKeyboard } from '@/composables/useModalKeyboard'
+
+const props = defineProps<{
+  show: boolean
+  serverName: string
+  npub: string
+  did: string
+  version: string
+  busy?: boolean
+}>()
+
+const emit = defineEmits<{
+  confirm: []
+  cancel: []
+}>()
+
+const modalRef = ref<HTMLElement | null>(null)
+useModalKeyboard(modalRef, computed(() => props.show), () => emit('cancel'))
+
+function truncateNpub(npub: string): string {
+  if (npub.length <= 20) return npub
+  return npub.slice(0, 12) + '...' + npub.slice(-6)
+}
+</script>
+
+<style scoped>
+/* Hero container — same dimensions/pattern as the NostrIdentityPicker overlay */
+.presence-hero {
+  position: relative;
+  width: 148px;
+  height: 148px;
+}
+
+/* Small phones: shrink the hero so the signed-info card keeps most of the
+   viewport; the card itself scrolls internally when it still doesn't fit. */
+@media (max-width: 480px), (max-height: 740px) {
+  .presence-hero {
+    width: 96px;
+    height: 96px;
+    transform: scale(0.9);
+  }
+  .presence-viz-segment {
+    --seg-radius: -40px;
+    height: 10px;
+  }
+  .presence-glass-border {
+    width: 72px;
+    height: 72px;
+  }
+}
+
+.presence-viz-ring {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  pointer-events: none;
+}
+
+.presence-viz-segment {
+  position: absolute;
+  left: 50%;
+  top: 50%;
+  width: 2.5px;
+  height: 14px;
+  margin-left: -1.25px;
+  margin-top: -7px;
+  background: linear-gradient(to bottom, rgba(250, 250, 250, 0.4), rgba(250, 250, 250, 0.06));
+  border-radius: 1.5px;
+  transform-origin: center center;
+  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px));
+  animation: presence-seg-pulse 14s ease-in-out infinite;
+  animation-delay: calc(var(--seg-i) * 0.02s);
+}
+
+@keyframes presence-seg-pulse {
+  0%     { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  7.1%   { opacity: 0.7;  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1); }
+  14.3%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  21.4%  { opacity: 0.7;  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1); }
+  28.6%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  35.7%  { opacity: 0.7;  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1); }
+  42.9%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  50%    { opacity: 0.7;  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1); }
+  57.1%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  64.3%  { opacity: 0.7;  transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1); }
+  71.4%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  78.6%  { opacity: 1;    transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1.5); }
+  85.7%  { opacity: 1;    transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(1.5); }
+  92.9%  { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+  100%   { opacity: 0.15; transform: rotate(var(--seg-deg)) translateY(var(--seg-radius, -60px)) scaleY(0.4); }
+}
+
+.presence-glass-border {
+  position: absolute;
+  left: 50%;
+  top: 50%;
+  transform: translate(-50%, -50%);
+  width: 104px;
+  height: 104px;
+  border-radius: 9999px;
+  padding: 3px;
+  background: linear-gradient(135deg, rgba(255, 255, 255, 0.6) 0%, rgba(0, 0, 0, 0.8) 100%);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
+  filter: drop-shadow(0 0 24px rgba(255, 255, 255, 0.08));
+}
+
+.presence-glass-inner {
+  width: 100%;
+  height: 100%;
+  border-radius: 9999px;
+  background: #000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+/* Modal transitions — same curve as the identity picker */
+.presence-sign-enter-active,
+.presence-sign-leave-active {
+  transition: opacity 0.4s ease;
+}
+.presence-sign-enter-active > .relative {
+  transition: transform 0.5s cubic-bezier(0.22, 1, 0.36, 1), opacity 0.4s ease;
+}
+.presence-sign-leave-active > .relative {
+  transition: transform 0.25s ease, opacity 0.2s ease;
+}
+.presence-sign-enter-from { opacity: 0; }
+.presence-sign-enter-from > .relative { transform: translateY(24px) scale(0.94); opacity: 0; }
+.presence-sign-leave-to { opacity: 0; }
+.presence-sign-leave-to > .relative { transform: translateY(10px) scale(0.98); opacity: 0; }
+</style>
@@ -122,7 +122,11 @@
          </div>
          <div class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
            <div class="flex items-center gap-3">
-              <span class="w-5 h-5 text-base leading-none flex items-center justify-center" role="img" aria-label="Cashu">🥜</span>
+              <!-- Inline SVG, not an emoji: kiosk images ship no color-emoji
+                   font, so 🥜 rendered as a tofu box on TVs -->
+              <svg class="w-5 h-5 text-purple-400" role="img" aria-label="Cashu" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 9V7a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2m2 4h10a2 2 0 002-2v-6a2 2 0 00-2-2H9a2 2 0 00-2 2v6a2 2 0 002 2zm7-5a2 2 0 11-4 0 2 2 0 014 0z" />
+              </svg>
              <span class="text-sm text-white/80">Cashu</span>
            </div>
            <span class="text-purple-400 text-sm font-medium">{{ walletEcash.toLocaleString() }} sats</span>
@@ -139,25 +143,37 @@
          <!-- Only rendered once barkd reports a balance — most nodes don't run the Ark sidecar -->
          <div v-if="(walletArk ?? 0) > 0" class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
            <div class="flex items-center gap-3">
-              <span class="w-5 h-5 text-base leading-none flex items-center justify-center" role="img" aria-label="Ark">⚓</span>
+              <svg class="w-5 h-5 text-teal-400" role="img" aria-label="Ark" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8a2.5 2.5 0 10-2.5-2.5A2.5 2.5 0 0012 8zm0 0v13m-7-7c0 3.87 3.13 7 7 7s7-3.13 7-7m-14 0H3m18 0h-2" />
+              </svg>
              <span class="text-sm text-white/80">Ark</span>
            </div>
            <span class="text-teal-400 text-sm font-medium">{{ (walletArk ?? 0).toLocaleString() }} sats</span>
          </div>
        </div>
-        <div class="home-card-buttons grid gap-2 mt-auto pt-4 shrink-0" :class="isDev ? 'grid-cols-4' : 'grid-cols-3'">
-          <button @click="$emit('showSend')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+        <div class="home-card-buttons flex gap-2 mt-auto pt-4 shrink-0">
+          <button @click="$emit('showSend')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
            {{ t('common.send') }}
          </button>
-          <button @click="$emit('showReceive')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+          <button @click="$emit('showReceive')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
            Receive
          </button>
-          <button @click="$emit('showTransactions')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
+          <button @click="$emit('showTransactions')" class="home-card-btn flex-1 px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">
            Transactions
          </button>
          <button v-if="isDev" @click="$emit('faucet')" class="home-card-btn px-3 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors text-green-400">
            Faucet
          </button>
+          <button
+            @click="$emit('showScan')"
+            aria-label="Scan QR to send"
+            title="Scan QR to send"
+            class="home-card-btn px-3 py-2 glass-button rounded-lg transition-colors shrink-0 flex items-center justify-center"
+          >
+            <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8V6a2 2 0 012-2h2M3 16v2a2 2 0 002 2h2m10-16h2a2 2 0 012 2v2m-4 12h2a2 2 0 002-2v-2M7 12h10" />
+            </svg>
+          </button>
        </div>
      </div>
    </div>
@@ -197,6 +213,7 @@ const props = defineProps<{
 }>()

 defineEmits<{
+  showScan: []
  showSend: []
  showReceive: []
  showTransactions: []
@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { ref, computed, watch } from 'vue'
 import { useMeshStore } from '@/stores/mesh'
-import { LORA_REGIONS, regionByCode, meshcorePlanFor } from '@/utils/loraRegions'
+import { LORA_REGIONS, regionByCode, meshcorePlanFor, MESHCORE_RF_PRESETS } from '@/utils/loraRegions'

 const mesh = useMeshStore()

@@ -54,15 +54,49 @@ watch(
      | null
      | undefined
    if (rp) {
+      applyingPreset = true
      form.value.rfFreqMhz = String(rp.freq_khz / 1000)
      form.value.rfBwKhz = String(rp.bw_hz / 1000)
      form.value.rfSf = String(rp.sf)
      form.value.rfCr = String(rp.cr)
+      // Show the matching named preset if the stored values are one; else Custom.
+      const match = MESHCORE_RF_PRESETS.find(
+        (p) =>
+          Math.round(p.freqMhz * 1000) === rp.freq_khz &&
+          Math.round(p.bwKhz * 1000) === rp.bw_hz &&
+          p.sf === rp.sf &&
+          p.cr === rp.cr,
+      )
+      rfPreset.value = match ? match.id : 'custom'
+      applyingPreset = false
    }
  },
  { immediate: true },
 )

+// RF preset dropdown: picking a named plan fills the four fields; hand-editing
+// any field flips the dropdown to Custom so it never misrepresents the values.
+const rfPreset = ref('')
+let applyingPreset = false
+function selectRfPreset(id: string) {
+  rfPreset.value = id
+  if (id === 'custom' || id === '') return
+  const p = MESHCORE_RF_PRESETS.find((x) => x.id === id)
+  if (!p) return
+  applyingPreset = true
+  form.value.rfFreqMhz = String(p.freqMhz)
+  form.value.rfBwKhz = String(p.bwKhz)
+  form.value.rfSf = String(p.sf)
+  form.value.rfCr = String(p.cr)
+  applyingPreset = false
+}
+watch(
+  () => [form.value.rfFreqMhz, form.value.rfBwKhz, form.value.rfSf, form.value.rfCr],
+  () => {
+    if (!applyingPreset && rfPreset.value && rfPreset.value !== 'custom') rfPreset.value = 'custom'
+  },
+)
+
 const selectedRegion = computed(() => regionByCode(form.value.region))
 const deviceType = computed(() => mesh.status?.device_type ?? 'unknown')
 // Firmware whose options apply: explicit pin wins, else the connected type.
@@ -78,14 +112,31 @@ async function saveSettings() {
  saveError.value = null
  saveDone.value = false
  try {
-    // MeshCore RF params: send only when all four are filled (partial input
-    // is a user error surfaced by the API's range validation; all-empty
-    // means "leave the radio's flashed settings alone").
-    const rf = [form.value.rfFreqMhz, form.value.rfBwKhz, form.value.rfSf, form.value.rfCr]
-    const rfAll = rf.every((v) => String(v).trim() !== '')
-    const rfAny = rf.some((v) => String(v).trim() !== '')
-    if (rfAny && !rfAll) {
-      throw new Error('Fill in all four RF fields (frequency, bandwidth, SF, CR) or leave all empty')
+    // MeshCore RF params: a named preset sends its plan; Custom sends the
+    // four fields (all required — partial input is an error); "Keep the
+    // radio's current settings" omits the key so the config is untouched.
+    let rfParams: { freq_khz: number; bw_hz: number; sf: number; cr: number } | undefined
+    if (rfPreset.value && rfPreset.value !== 'custom') {
+      const p = MESHCORE_RF_PRESETS.find((x) => x.id === rfPreset.value)
+      if (p) {
+        rfParams = {
+          freq_khz: Math.round(p.freqMhz * 1000),
+          bw_hz: Math.round(p.bwKhz * 1000),
+          sf: p.sf,
+          cr: p.cr,
+        }
+      }
+    } else if (rfPreset.value === 'custom') {
+      const rf = [form.value.rfFreqMhz, form.value.rfBwKhz, form.value.rfSf, form.value.rfCr]
+      if (!rf.every((v) => String(v).trim() !== '')) {
+        throw new Error('Fill in all four RF fields (frequency, bandwidth, SF, CR)')
+      }
+      rfParams = {
+        freq_khz: Math.round(parseFloat(form.value.rfFreqMhz) * 1000),
+        bw_hz: Math.round(parseFloat(form.value.rfBwKhz) * 1000),
+        sf: parseInt(form.value.rfSf, 10),
+        cr: parseInt(form.value.rfCr, 10),
+      }
    }
    await mesh.configure({
      lora_region: form.value.region,
@@ -93,16 +144,7 @@ async function saveSettings() {
      channel_name: form.value.channel.trim() || 'archipelago',
      ...(form.value.name.trim() ? { advert_name: form.value.name.trim() } : {}),
      broadcast_identity: form.value.broadcastIdentity,
-      ...(rfAll
-        ? {
-            lora_radio_params: {
-              freq_khz: Math.round(parseFloat(form.value.rfFreqMhz) * 1000),
-              bw_hz: Math.round(parseFloat(form.value.rfBwKhz) * 1000),
-              sf: parseInt(form.value.rfSf, 10),
-              cr: parseInt(form.value.rfCr, 10),
-            },
-          }
-        : {}),
+      ...(rfParams ? { lora_radio_params: rfParams } : {}),
    })
    saveDone.value = true
    setTimeout(() => { saveDone.value = false }, 3000)
@@ -187,7 +229,15 @@ async function saveSettings() {
           flashed settings untouched. -->
      <div v-if="effectiveKind === 'meshcore'" class="mt-4">
        <h5 class="text-xs font-semibold text-white/80 mb-2">MeshCore RF parameters</h5>
-        <div class="grid gap-3 grid-cols-2 sm:grid-cols-4">
+        <div class="mb-3">
+          <label class="block text-xs text-white/60 mb-1">Frequency plan</label>
+          <select :value="rfPreset" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" @change="selectRfPreset(($event.target as HTMLSelectElement).value)">
+            <option value="">Keep the radio's current settings</option>
+            <option v-for="p in MESHCORE_RF_PRESETS" :key="p.id" :value="p.id">{{ p.label }}</option>
+            <option value="custom">Custom…</option>
+          </select>
+        </div>
+        <div v-if="rfPreset === 'custom'" class="grid gap-3 grid-cols-2 sm:grid-cols-4">
          <div>
            <label class="block text-xs text-white/60 mb-1">Frequency (MHz)</label>
            <input v-model="form.rfFreqMhz" inputmode="decimal" placeholder="869.618" class="w-full rounded-lg bg-white/[0.06] border border-white/10 text-white px-3 py-2 text-sm focus:outline-none focus:border-orange-400/60" />
@@ -362,6 +362,43 @@ init()
              </button>
            </div>
            <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.111-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.111-alpha</span>
+                  <span class="text-xs text-white/40">July 22, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — "what's the block height?", "how many peers am I connected to?", "is bitcoin synced?", "what's my Lightning balance?" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.</p>
+                  <p>Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom "Yo Archy" wake word is in the works.)</p>
+                  <p>Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.</p>
+                  <p>Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.</p>
+                  <p>The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.</p>
+                  <p>Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.</p>
+                  <p>Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text "/bin/bash"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.</p>
+                  <p>Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.</p>
+                  <p>Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.</p>
+                  <p>On the phone home screen, the wallet card moved up to sit right under My Apps.</p>
+                  <p>Home Assistant updated to 2026.7.3, which keeps voice satellites (like Pine's speaker) connected reliably.</p>
+                </div>
+              </div>
+              <!-- v1.7.110-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.110-alpha</span>
+                  <span class="text-xs text-white/40">July 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.</p>
+                  <p>The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.</p>
+                  <p>You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.</p>
+                  <p>The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.</p>
+                  <p>The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).</p>
+                  <p>Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.</p>
+                  <p>The Lightning setup guidance now reads the same everywhere: "Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."</p>
+                  <p>Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen.</p>
+                </div>
+              </div>
              <!-- v1.7.109-alpha -->
              <div>
                <div class="flex items-center gap-2 mb-3">
@@ -0,0 +1,82 @@
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+// Kiosk display resolution/scaling presets. Only shown on nodes that actually
+// have a kiosk display (has_kiosk from the backend).
+const hasKiosk = ref(false)
+const preset = ref('auto')
+const applying = ref(false)
+const error = ref('')
+
+const presets = [
+  {
+    id: 'auto',
+    label: 'Auto (recommended)',
+    description: 'Pick a comfortable size for the detected screen — 4K TVs get a Full-HD-sized layout at double sharpness.',
+  },
+  {
+    id: 'large',
+    label: 'Large UI',
+    description: 'Biggest text and buttons — easiest to read from across the room, fits less on screen.',
+  },
+  {
+    id: 'balanced',
+    label: 'Balanced',
+    description: 'Desktop-sized layout on any screen that can carry it — more on screen, still sharp.',
+  },
+  {
+    id: 'native',
+    label: 'Native (no scaling)',
+    description: 'Use the screen’s full native resolution 1:1 — the most content, the smallest UI.',
+  },
+]
+
+onMounted(async () => {
+  try {
+    const res = await rpcClient.call<{ has_kiosk: boolean; preset: string }>({ method: 'system.kiosk-display.get' })
+    hasKiosk.value = res.has_kiosk
+    preset.value = res.preset
+  } catch { /* backend without the RPC — leave the section hidden */ }
+})
+
+async function apply(id: string) {
+  if (applying.value || id === preset.value) return
+  applying.value = true
+  error.value = ''
+  const prev = preset.value
+  preset.value = id
+  try {
+    await rpcClient.call({ method: 'system.kiosk-display.set', params: { preset: id }, timeout: 20000 })
+  } catch (e: unknown) {
+    preset.value = prev
+    error.value = e instanceof Error ? e.message : 'Failed to apply display setting'
+  } finally {
+    applying.value = false
+  }
+}
+</script>
+
+<template>
+  <!-- Kiosk Display Section — only on nodes with an attached kiosk screen -->
+  <div v-if="hasKiosk" class="glass-card px-6 py-6 mb-6">
+    <h2 class="text-xl font-semibold text-white/96 mb-2">Display</h2>
+    <p class="text-sm text-white/60 mb-6">
+      How big the interface renders on the screen attached to this node. Changing this restarts the on-screen display.
+    </p>
+    <div data-controller-container tabindex="0" class="grid grid-cols-1 md:grid-cols-2 gap-4">
+      <button
+        v-for="p in presets"
+        :key="p.id"
+        :disabled="applying"
+        @click="apply(p.id)"
+        class="path-option-card text-left p-5 disabled:opacity-60"
+        :class="{ 'path-option-card--selected': preset === p.id }"
+      >
+        <div class="font-medium text-white/90 mb-1">{{ p.label }}</div>
+        <p class="text-sm text-white/60">{{ p.description }}</p>
+      </button>
+    </div>
+    <div v-if="error" class="mt-4 alert-error text-sm">{{ error }}</div>
+  </div>
+</template>
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
+import KioskDisplaySection from '@/views/settings/KioskDisplaySection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
@@ -10,6 +11,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'

 <template>
  <InterfaceModeSection />
+  <KioskDisplaySection />
  <ClaudeAuthSection />
  <AIDataAccessSection />
  <WebhookSection />
@@ -1,27 +1,36 @@
 {
-  "version": "1.7.109-alpha",
-  "release_date": "2026-07-21",
  "changelog": [
-    "Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice \u2014 speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.",
-    "Your node can now program its MeshCore radio's RF settings \u2014 frequency, bandwidth, spreading factor, and coding rate \u2014 from Mesh \u2192 Device settings. Radios that were flashed with mismatched settings could hear that other radios exist but never decode their messages, and until now the only fix was a separate phone app. Set the values once and the node programs the radio automatically (it restarts once to apply); every radio on your mesh must use the same values to talk to each other.",
-    "The Device settings panel is tidier: values you can edit (name, region, channel) are no longer also shown as separate read-only rows."
+    "Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — \"what's the block height?\", \"how many peers am I connected to?\", \"is bitcoin synced?\", \"what's my Lightning balance?\" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.",
+    "Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom \"Yo Archy\" wake word is in the works.)",
+    "Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.",
+    "Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.",
+    "The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.",
+    "Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.",
+    "Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text \"/bin/bash\"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.",
+    "Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.",
+    "Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.",
+    "On the phone home screen, the wallet card moved up to sit right under My Apps."
  ],
  "components": [
    {
+      "current_version": "1.7.111-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago",
      "name": "archipelago",
-      "current_version": "1.7.109-alpha",
-      "new_version": "1.7.109-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.109-alpha/archipelago",
-      "sha256": "c98322aeb1d7eb223d122052657a4dd67cd284bbb862a79ff9439b35cffd6607",
-      "size_bytes": 50201840
+      "new_version": "1.7.111-alpha",
+      "sha256": "9e50577470cb4c5dd67b4316a3efaaa87e7afac15a8b5c2e3841edc6c3ed6550",
+      "size_bytes": 50615920
    },
    {
-      "name": "archipelago-frontend-1.7.109-alpha.tar.gz",
-      "current_version": "1.7.109-alpha",
-      "new_version": "1.7.109-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.109-alpha/archipelago-frontend-1.7.109-alpha.tar.gz",
-      "sha256": "8cff430874eeed385ecc862e3b56c9e338587981684285a5b0ce22c97849a012",
-      "size_bytes": 174604264
+      "current_version": "1.7.111-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago-frontend-1.7.111-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.111-alpha.tar.gz",
+      "new_version": "1.7.111-alpha",
+      "sha256": "3ea73cd8e98312b3b6877e00434363fe575362e7b2b134e03a9004d4e42930c9",
+      "size_bytes": 174650727
    }
-  ]
+  ],
+  "release_date": "2026-07-22",
+  "signature": "1cc569a121f2cc5560840198115732155db4ee037ea98c4be8cf9ef8a7b227e26dc686a88a779f1e40daaa94b5cb44083b78147f45398a29188bf2834488eb03",
+  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
+  "version": "1.7.111-alpha"
 }
@@ -1,27 +1,36 @@
 {
-  "version": "1.7.109-alpha",
-  "release_date": "2026-07-21",
  "changelog": [
-    "Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice \u2014 speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.",
-    "Your node can now program its MeshCore radio's RF settings \u2014 frequency, bandwidth, spreading factor, and coding rate \u2014 from Mesh \u2192 Device settings. Radios that were flashed with mismatched settings could hear that other radios exist but never decode their messages, and until now the only fix was a separate phone app. Set the values once and the node programs the radio automatically (it restarts once to apply); every radio on your mesh must use the same values to talk to each other.",
-    "The Device settings panel is tidier: values you can edit (name, region, channel) are no longer also shown as separate read-only rows."
+    "Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — \"what's the block height?\", \"how many peers am I connected to?\", \"is bitcoin synced?\", \"what's my Lightning balance?\" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.",
+    "Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom \"Yo Archy\" wake word is in the works.)",
+    "Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.",
+    "Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.",
+    "The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.",
+    "Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.",
+    "Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text \"/bin/bash\"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.",
+    "Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.",
+    "Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.",
+    "On the phone home screen, the wallet card moved up to sit right under My Apps."
  ],
  "components": [
    {
+      "current_version": "1.7.111-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago",
      "name": "archipelago",
-      "current_version": "1.7.109-alpha",
-      "new_version": "1.7.109-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.109-alpha/archipelago",
-      "sha256": "c98322aeb1d7eb223d122052657a4dd67cd284bbb862a79ff9439b35cffd6607",
-      "size_bytes": 50201840
+      "new_version": "1.7.111-alpha",
+      "sha256": "9e50577470cb4c5dd67b4316a3efaaa87e7afac15a8b5c2e3841edc6c3ed6550",
+      "size_bytes": 50615920
    },
    {
-      "name": "archipelago-frontend-1.7.109-alpha.tar.gz",
-      "current_version": "1.7.109-alpha",
-      "new_version": "1.7.109-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.109-alpha/archipelago-frontend-1.7.109-alpha.tar.gz",
-      "sha256": "8cff430874eeed385ecc862e3b56c9e338587981684285a5b0ce22c97849a012",
-      "size_bytes": 174604264
+      "current_version": "1.7.111-alpha",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.111-alpha/archipelago-frontend-1.7.111-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.111-alpha.tar.gz",
+      "new_version": "1.7.111-alpha",
+      "sha256": "3ea73cd8e98312b3b6877e00434363fe575362e7b2b134e03a9004d4e42930c9",
+      "size_bytes": 174650727
    }
-  ]
+  ],
+  "release_date": "2026-07-22",
+  "signature": "1cc569a121f2cc5560840198115732155db4ee037ea98c4be8cf9ef8a7b227e26dc686a88a779f1e40daaa94b5cb44083b78147f45398a29188bf2834488eb03",
+  "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
+  "version": "1.7.111-alpha"
 }
@@ -41,6 +41,7 @@ INTERNAL_MANIFEST_IDS = {
    "netbird-server",
    "pine-whisper",
    "pine-piper",
+    "pine-openwakeword",
 }

 LEGACY_STACK_CATALOG_IDS = {
@@ -31,7 +31,7 @@ POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
 BTCPAY_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"

 # Apps
-HOMEASSISTANT_IMAGE="$ARCHY_REGISTRY/home-assistant:2024.1"
+HOMEASSISTANT_IMAGE="$ARCHY_REGISTRY/home-assistant:2026.7.3"
 GRAFANA_IMAGE="$ARCHY_REGISTRY/grafana:10.2.0"
 UPTIME_KUMA_IMAGE="$ARCHY_REGISTRY/uptime-kuma:1"
 JELLYFIN_IMAGE="$ARCHY_REGISTRY/jellyfin:10.8.13"