docs(security): genericize a node address in the RPC-proxy incident record

BITCOIN-RPC-PROXY-EXPOSURE.md's port claims verify against code (Bitcoin RPC on
127.0.0.1:8332, the bitcoin-ui proxy on 127.0.0.1:8334). But its incident
narrative named a specific node's LAN address (192.168.63.240, five times) on a
subnet the earlier 192.168.1.x sweep did not cover. Replaced with the RFC 5737
documentation address 192.0.2.240. The incident content — the exposure, the
probes, the fix — is unchanged and remains a legitimate public security record.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso.yml

@@ -0,0 +1,62 @@
+name: Build Archipelago release ISO (gated)
+
+# Resurrected from image-recipe/_archived/.gitea-workflows/build-iso-dev.yml.
+# Dispatch-only on purpose: the ISO is cut per release, not per push, and
+# the iso-builder runner is a live node — builds are deliberate events.
+on:
+  workflow_dispatch:
+
+jobs:
+  build-iso:
+    runs-on: iso-builder
+    timeout-minutes: 180
+    steps:
+      - name: Sync source to workspace
+        run: |
+          # Direct fetch + sync (actions/checkout token is broken on this Gitea)
+          REPO_DIR="$HOME/Projects/archy"
+          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
+          cd "$REPO_DIR" && git fetch origin main && git reset --hard origin/main
+          echo "=== Source at commit: $(git log --oneline -1) ==="
+
+      - name: Install ISO build dependencies
+        run: |
+          if dpkg -s debootstrap squashfs-tools xorriso isolinux syslinux-common mtools \
+               grub-efi-amd64-bin grub-pc-bin grub-common >/dev/null 2>&1; then
+            echo "ISO build deps already installed, skipping apt"
+          else
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq \
+              debootstrap squashfs-tools xorriso \
+              isolinux syslinux-common mtools \
+              grub-efi-amd64-bin grub-pc-bin grub-common
+          fi
+
+      - name: Build backend + frontend if stale
+        run: |
+          REPO_DIR="$HOME/Projects/archy"
+          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
+          cd "$REPO_DIR"
+          . "$HOME/.cargo/env" 2>/dev/null || true
+          VERSION=$(grep -m1 '^version' core/archipelago/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
+          if ! strings core/target/release/archipelago 2>/dev/null | grep -qF "$VERSION"; then
+            cargo build --release --manifest-path core/Cargo.toml -p archipelago
+          fi
+          if ! grep -rqoF "$VERSION" web/dist/neode-ui/assets/*.js 2>/dev/null; then
+            (cd neode-ui && npm ci && npm run build)
+          fi
+
+      - name: Gated ISO build (gates + build + smoke + qemu)
+        run: |
+          REPO_DIR="$HOME/Projects/archy"
+          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
+          cd "$REPO_DIR"
+          . "$HOME/.cargo/env" 2>/dev/null || true
+          bash scripts/build-iso-release.sh
+
+      - name: Report artifacts
+        if: always()
+        run: |
+          REPO_DIR="$HOME/Projects/archy"
+          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
+          ls -lh "$REPO_DIR"/image-recipe/results/*.iso 2>/dev/null | tail -3 || echo "no ISO produced"

.gitea/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
+#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN
@@ -18,7 +18,7 @@ on:
     paths:
       - 'neode-ui/**'
       - 'docker-compose.demo.yml'
-      - '.github/workflows/demo-images.yml'
+      - '.gitea/workflows/demo-images.yml'
   workflow_dispatch:
 
 jobs:

.gitea/workflows/post-install-tests.yml

@@ -4,13 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: 'Target node IP (e.g. 192.168.1.198)'
+        description: 'Target node IP or hostname'
         required: true
-        default: '192.168.1.198'
       password:
-        description: 'Node password (or "auto" for fresh install)'
+        description: 'Node UI password (leave blank to use the NODE_UI_PASSWORD secret)'
         required: false
-        default: 'auto'
 
 jobs:
   post-install-tests:
@@ -22,33 +20,46 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Run post-install tests on target
+      - name: Install SSH key
+        env:
+          SSH_KEY: ${{ secrets.NODE_SSH_KEY }}
         run: |
-          TARGET="${{ github.event.inputs.target }}"
-          PASSWORD="${{ github.event.inputs.password }}"
-          if [ "$PASSWORD" = "auto" ]; then
-            PASSWORD="testpass123!"
+          if [ -z "$SSH_KEY" ]; then
+            echo "ERROR: repository secret NODE_SSH_KEY is not configured."
+            echo "Post-install tests authenticate by key; password auth is not supported."
+            exit 1
           fi
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+      - name: Run post-install tests on target
+        env:
+          TARGET: ${{ github.event.inputs.target }}
+          NODE_PASSWORD: ${{ github.event.inputs.password }}
+          NODE_UI_PASSWORD: ${{ secrets.NODE_UI_PASSWORD }}
+          SSH_USER: ${{ vars.NODE_SSH_USER }}
+        run: |
+          PASSWORD="${NODE_PASSWORD:-$NODE_UI_PASSWORD}"
+          if [ -z "$PASSWORD" ]; then
+            echo "ERROR: no node password supplied (input or NODE_UI_PASSWORD secret)."
+            exit 1
+          fi
+          USER_NAME="${SSH_USER:-archipelago}"
 
           echo "══════════════════════════════════════════"
           echo "Running post-install tests on $TARGET"
           echo "══════════════════════════════════════════"
 
-          # Copy test script to target and run
-          sshpass -p 'archipelago' scp -o StrictHostKeyChecking=no \
+          scp -o StrictHostKeyChecking=accept-new \
             scripts/run-post-install-tests.sh \
-            archipelago@${TARGET}:/tmp/run-post-install-tests.sh 2>/dev/null || \
-          scp -o StrictHostKeyChecking=no \
-            scripts/run-post-install-tests.sh \
-            archipelago@${TARGET}:/tmp/run-post-install-tests.sh
+            "${USER_NAME}@${TARGET}:/tmp/run-post-install-tests.sh"
 
-          # Run tests (with sudo for service checks)
-          sshpass -p 'archipelago' ssh -o StrictHostKeyChecking=no \
-            archipelago@${TARGET} \
-            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'" 2>/dev/null || \
-          ssh -o StrictHostKeyChecking=no \
-            archipelago@${TARGET} \
-            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'"
+          # Password is passed over stdin, never as an argv the node's process
+          # list (or this job's log) would expose.
+          printf '%s' "$PASSWORD" | ssh -o StrictHostKeyChecking=accept-new \
+            "${USER_NAME}@${TARGET}" \
+            "sudo bash /tmp/run-post-install-tests.sh --password-stdin"
 
   frontend-tests:
     runs-on: ubuntu-latest

.github/pull_request_template.md

@@ -1,16 +1,16 @@
 ## Summary
 
-<!-- Brief description of what this PR does -->
+<!-- What changed and why? -->
 
-## Changes
+## Verification
 
--
+<!-- Commands run, devices tested, screenshots, or reason testing was not run. -->
 
 ## Checklist
 
-- [ ] TypeScript type-check passes (`npm run type-check`)
-- [ ] Frontend builds (`npm run build`)
-- [ ] Tests pass (`npm test`)
-- [ ] Rust clippy clean (if backend changes)
-- [ ] No new compiler warnings
-- [ ] Tested on live server
+- [ ] Rust formatting/clippy/tests pass when backend code changed.
+- [ ] Frontend type-check/build/tests pass when frontend code changed.
+- [ ] App manifests validate when app packaging changed.
+- [ ] Generated catalogs are updated when manifest-owned catalog fields changed.
+- [ ] Docs are updated for user-facing or developer-facing behavior changes.
+- [ ] No secrets, generated build outputs, local screenshots, or private host details are included.

.github/workflows/ci.yml

@@ -8,11 +8,11 @@ on:
 
 env:
   RUST_VERSION: stable
-  NODE_VERSION: 18
+  NODE_VERSION: 20
 
 jobs:
   rust:
-    name: Rust (fmt + clippy + test)
+    name: Rust
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -28,17 +28,35 @@ jobs:
           toolchain: ${{ env.RUST_VERSION }}
           components: rustfmt, clippy
 
-      - name: Check formatting
+      - name: Format
         run: cargo fmt --all -- --check
 
+      # KEY-05 layer (b) is enforced HERE, with no step of its own: core/clippy.toml
+      # bans the defaulted RNG entry points, and `-D warnings` already turns a
+      # `disallowed_methods` hit into a build failure. `--all-targets` covers tests
+      # too, deliberately. See docs/security/KEY-05-ENTROPY-ENFORCEMENT.md
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Tests
+      # KEY-05 layer (c) — see core/deny.toml for the policy and its rationale.
+      #
+      # The version is pinned deliberately. EmbarkStudios/cargo-deny-action exposes
+      # no input to pin the cargo-deny version, and an unpinned supply-chain checker
+      # is a contradiction in terms, so the tool is installed from crates.io — the
+      # source actually vetted at the 10-06 Task 5 legitimacy checkpoint — rather
+      # than by adding another unvetted action to this workflow.
+      #
+      # `check bans` ONLY: the advisories gate is not enabled (bans-only policy).
+      - name: Supply chain (cargo-deny)
+        run: |
+          cargo install --locked cargo-deny --version 0.20.2
+          cargo deny check bans
+
+      - name: Test
         run: cargo test --all-features
 
   frontend:
-    name: Frontend (type-check + lint)
+    name: Frontend
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -52,14 +70,54 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
+          cache: npm
           cache-dependency-path: neode-ui/package-lock.json
 
-      - name: Install dependencies
+      - name: Install
         run: npm ci
 
       - name: Type check
         run: npm run type-check
 
+      - name: Test
+        run: npm test
+
       - name: Build
         run: npm run build
+
+  manifests:
+    name: App Manifests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install YAML parser
+        run: python3 -m pip install --quiet pyyaml
+
+      - name: Validate manifests
+        run: |
+          for manifest in apps/*/manifest.yml; do
+            ./scripts/validate-app-manifest.sh --repo-audit "$manifest"
+          done
+
+      # The signed catalog overrides on-disk manifests on every node, so a
+      # catalog naming a registry host the deployed fleet does not trust breaks
+      # every install fleet-wide. Blocking, and cheap.
+      - name: Catalog registry trust floor
+        run: python3 scripts/check-catalog-registry-trust.py
+
+      # A stale image literal on the fallback install path deploys an old
+      # image after the manifest has moved on — how a withdrawn, vulnerable
+      # release gets installed post-fix. Blocking.
+      - name: Installer image pins
+        run: python3 scripts/check-installer-image-pins.py
+
+      # Advisory: shows where the release catalog has fallen behind the
+      # manifests in this repo. Not blocking, because the catalog can only be
+      # updated through the signing ceremony, so drift is expected between a
+      # manifest landing and the next signed release.
+      - name: Catalog drift (advisory)
+        continue-on-error: true
+        run: python3 scripts/check-app-catalog-drift.py --catalog releases/app-catalog.json --release

.github/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
+#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN

.gitignore

@@ -1,10 +1,9 @@
-# SSH keys (sandbox copies)
+# SSH keys and sandbox copies
 .ssh/
 
 # Rust build output
 target/
 **/target/
-Cargo.lock
 
 # Node.js
 node_modules/
@@ -12,7 +11,6 @@ node_modules/
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
-package-lock.json
 pnpm-debug.log*
 
 # Build outputs
@@ -21,6 +19,9 @@ dist-ssr/
 build/
 *.local
 
+# Vite build cache
+neode-ui/.vite/
+
 # IDE / editor
 .idea/
 .vscode/
@@ -28,49 +29,53 @@ build/
 *.swo
 *~
 .DS_Store
+._*
+Thumbs.db
 
 # Environment and local overrides
 .env
 .env.local
 .env.*.local
+.env.production
+core/.env.production
 scripts/deploy-config.sh
 
 # Logs
 logs/
 *.log
 
-# OS
-.DS_Store
-Thumbs.db
-
 # Testing
 coverage/
 .nyc_output/
 
-# Temporary files
-*.tmp
-*.temp
-
-# Build artifacts
+# Image / release artifacts
 *.iso
 *.img
 *.dmg
 *.app
+*.apk
+*.keystore
+*.s9pk
+*.tar.gz
 
-# Release artifacts live in Gitea Release attachments, not Git history.
+# Release artifacts live in release attachments, not Git history.
 releases/**
 !releases/
 !releases/manifest.json
-
-# macOS build output
-build/macos/
+# The signed app catalog and the registry trust floor are source, not build
+# output: nodes fetch the catalog from this path on main, and the floor is what
+# scripts/check-catalog-registry-trust.py checks it against. Both were being
+# swallowed by the rule above — app-catalog.json only stayed tracked because it
+# predates it.
+!releases/app-catalog.json
+!releases/registry-trust-floor.json
 
 # Image recipe output
 image-recipe/output/
 image-recipe/*.iso
 image-recipe/*.img
 
-# Loop tool artifacts (created in every subdirectory)
+# Loop tool artifacts
 */loop/
 loop/loop/
 loop/loop.log.bak
@@ -78,21 +83,62 @@ loop/loop.log.bak
 # Separate repos nested in tree
 web/
 
-._*
-
-# Resilience harness reports (generated, contains session cookies)
+# Resilience harness reports contain session cookies.
 scripts/resilience/reports/
 
 # Codex / pnpm / python caches / editor backups
 .codex
 .codex-target-*/
 .codex-tmp/
+.claude/
 .pnpm-store/
 **/__pycache__/
 *.bak
-.claude/scheduled_tasks.lock
 
 # Local evidence screenshots; intentional UI screenshots should live under an
 # app/docs asset path with a descriptive filename.
 Screenshot *.png
 uploads/
+
+# ── Local-only material ─────────────────────────────────────────────────────
+# Present on disk, never tracked: everything describing Archipelago's own
+# infrastructure or internal development process. The repo is source code and
+# guidelines only. Inventory: .local-only/manifest.txt — wipe: .local-only/wipe.sh
+/.local-only/
+/.planning/
+/loop/
+/docs/operations-runbook.md
+/docs/hotfix-process.md
+/docs/PRODUCTION-MASTER-PLAN.md
+/docs/UNIFIED-TASK-TRACKER.md
+/docs/FIPS-UPTIME-AND-UI-STATE-PLAN.md
+/docs/HANDOFF-2026-07-20-fips-peer-files.md
+/docs/HANDOFF-2026-07-23-companion-apk-deploy.md
+/docs/qr-scanner-snappiness-handover.md
+/docs/RETICULUM-TRANSPORT-PROGRESS.md
+/docs/combined-test-plan-2026-07-22.md
+/docs/pine-voice-release-test-plan.md
+/docs/OPEN-SOURCE-READINESS-PLAN.md
+/docs/archive/HANDOVER-2026-07-02-iso-feedback.md
+/docs/archive/SESSION-1.8.0-OTA-PROGRESS.md
+/docs/security/KEY-02-FLEET-ROTATION.md
+/docs/security/KEY-03-SIGNING-POSTURE.md
+/tests/production-quality/TRACKER.md
+/scripts/deploy-config-defaults.sh
+/scripts/deploy-tailscale.sh
+/scripts/deploy-to-target.sh
+/scripts/setup-target-dev.sh
+/scripts/setup-aiui-server.sh
+/scripts/setup-https-dev.sh
+/scripts/debug-frontend.sh
+/scripts/node-profile.sh
+/scripts/fleet-fips-pair.sh
+/scripts/fleet-fips-unpair.sh
+/image-recipe/sync-from-live.sh
+/docs/security/PHASE-10-VERIFICATION-GUIDE.md
+/docs/security/KEY-01-ON-NODE-VERIFICATION.md
+/docs/security/KEY-02-ROOTFS-EVIDENCE.md
+/docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md
+/image-recipe/INTEGRATION-GUIDE.md
+/docs/multinode-testing-plan.md
+/docs/bitcoin-version-bulletproof-rollout.md

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "indeedhub"]
 	path = indeedhub
-	url = http://146.59.87.168:3000/lfg2025/indeehub.git
+	url = https://source.archipelago-foundation.org/lfg2025/indeehub.git

Android/.gitignore

@@ -19,3 +19,7 @@ local.properties
 # updates then install over the top without an uninstall. Debug keys are not
 # secret (well-known password "android"); never commit a real release keystore.
 !/app/debug.keystore
+
+# Rust build outputs (archy-fips-core → jniLibs via buildRustArm64)
+/rust/archy-fips-core/target
+/app/src/main/jniLibs

Android/COMPANION_RELEASE.md

@@ -23,6 +23,10 @@ used by the `.githooks/pre-push` hook), which:
    **aborts** if any is missing.
 5. Stages the signed APK at `neode-ui/public/packages/archipelago-companion.apk`,
    commits, and pushes with `SHIP_COMPANION=1` (the sanctioned pre-push bypass).
+6. The first-launch companion modal and Android "Share this app" QR point at
+   `http://146.59.87.168:2100/packages/archipelago-companion.apk`. After the
+   repo artifact is built, mirror that exact APK to the VPS2-served path before
+   calling the release done.
 
 **Never** hand-roll `gradlew assembleDebug` + `cp` to the served path. That path
 skips the clean build and the signature enforcement and is exactly how a broken
@@ -82,13 +86,16 @@ home-screen app layouts wiped by an over-broad action.
 
 ## Verify the published download after shipping
 
-The download served to nodes is Gitea raw-on-main. Confirm the live bytes match
-what you built and signed:
+The checked-in artifact is Gitea raw-on-main. The QR/App Store download served
+to users is the VPS2 `:2100` URL. Confirm both live byte streams match what you
+built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
-curl -sS -o /tmp/live.apk "$URL"
-shasum -a 256 "$SERVED" /tmp/live.apk          # must match
-apksigner verify -v --min-sdk-version 21 /tmp/live.apk | grep -i "scheme"  # v1/v2/v3 = true
+GITEA_URL=https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/$SERVED
+QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
+curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
+curl -sS -o /tmp/live-qr.apk "$QR_URL"
+shasum -a 256 "$SERVED" /tmp/live-gitea.apk /tmp/live-qr.apk  # all must match
+apksigner verify -v --min-sdk-version 21 /tmp/live-qr.apk | grep -i "scheme"  # v1/v2/v3 = true
 ```

Android/app/build.gradle.kts

@@ -11,12 +11,17 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 19
-        versionName = "0.4.15"
+        versionCode = 45
+        versionName = "0.5.25"
 
         vectorDrawables {
             useSupportLibrary = true
         }
+
+        // The embedded FIPS mesh (libarchy_fips_core.so) is built arm64-only,
+        // matching real handsets. FipsNative.available gates every call, so
+        // the app still runs as a plain companion elsewhere (e.g. x86 emu).
+        ndk { abiFilters += "arm64-v8a" }
     }
 
     signingConfigs {
@@ -80,6 +85,44 @@ android {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Embedded FIPS mesh: cross-compile Android/rust/archy-fips-core via cargo-ndk
+// into jniLibs before the native-libs merge, so a plain `gradlew assembleDebug`
+// builds the Rust too. Requires rustup target aarch64-linux-android, cargo-ndk,
+// and an NDK (ANDROID_NDK_HOME or the SDK's ndk/ dir).
+// ---------------------------------------------------------------------------
+val rustCrateDir = layout.projectDirectory.dir("../rust/archy-fips-core")
+val jniLibsDir = layout.projectDirectory.dir("src/main/jniLibs")
+
+tasks.register<Exec>("buildRustArm64") {
+    workingDir = rustCrateDir.asFile
+    inputs.dir(rustCrateDir.dir("src"))
+    inputs.file(rustCrateDir.file("Cargo.toml"))
+    outputs.dir(jniLibsDir)
+    // cargo/cargo-ndk live in ~/.cargo/bin, which Gradle's env may not have.
+    val home = System.getProperty("user.home")
+    environment("PATH", "$home/.cargo/bin:${System.getenv("PATH")}")
+    if (System.getenv("ANDROID_NDK_HOME") == null) {
+        val sdkNdk = file("$home/Library/Android/sdk/ndk")
+            .listFiles()?.maxByOrNull { it.name }
+        if (sdkNdk != null) environment("ANDROID_NDK_HOME", sdkNdk.absolutePath)
+    }
+    commandLine(
+        "cargo", "ndk",
+        "-t", "arm64-v8a",
+        "--platform", "26",
+        "-o", jniLibsDir.asFile.absolutePath,
+        "build", "--release",
+    )
+}
+
+tasks.matching {
+    it.name in listOf(
+        "mergeDebugNativeLibs", "mergeReleaseNativeLibs",
+        "mergeDebugJniLibFolders", "mergeReleaseJniLibFolders",
+    )
+}.configureEach { dependsOn("buildRustArm64") }
+
 dependencies {
     val composeBom = platform("androidx.compose:compose-bom:2024.05.00")
     implementation(composeBom)

Android/app/src/main/AndroidManifest.xml

@@ -7,6 +7,10 @@
     <!-- Pairing-QR scanner. Camera is optional: manual entry still works without one. -->
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-feature android:name="android.hardware.camera.any" android:required="false" />
+    <!-- Embedded FIPS mesh tunnel (ArchyVpnService) runs as a foreground service. -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
     <application
         android:name=".ArchipelagoApp"
@@ -19,6 +23,18 @@
         android:usesCleartextTraffic="true"
         tools:targetApi="35">
 
+        <!-- Party-screen "Share this app": exposes the copied APK from
+             cache/share/ to the system share sheet, nothing else. -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+
         <activity
             android:name=".MainActivity"
             android:exported="true"
@@ -39,6 +55,21 @@
                 <data android:scheme="archipelago" android:host="pair" />
             </intent-filter>
         </activity>
+
+        <!-- Embedded FIPS mesh node: split-tunnel VpnService (fd00::/8 only),
+             configured entirely by scanning the node's pairing QR. -->
+        <service
+            android:name=".fips.ArchyVpnService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:permission="android.permission.BIND_VPN_SERVICE">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="mesh-vpn-tunnel" />
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+        </service>
     </application>
 
 </manifest>

Android/app/src/main/java/com/archipelago/app/data/ServerPreferences.kt

@@ -19,25 +19,45 @@ data class ServerEntry(
     val port: String = "",
     val password: String = "",
     val name: String = "",
+    /** Node's FIPS mesh ULA (IPv6) — reachable from anywhere once meshed. */
+    val meshIp: String = "",
+    /** Node's FIPS npub — the durable identity. When present it, not the
+     *  address, is what identifies the entry: FIPS peers on npubs, IPs are
+     *  only dial hints (docs/companion-pairing-qr.md, npub-first contract). */
+    val npub: String = "",
 ) {
     /** Label to show in lists — the user-given name, or the address if unnamed. */
     fun displayName(): String = name.ifBlank { address }
 
+    /** Bracket bare IPv6 literals (the mesh ULA) so they form valid URLs. */
+    private fun urlHost(host: String): String =
+        if (host.contains(":") && !host.startsWith("[")) "[$host]" else host
+
     fun toUrl(): String {
         val scheme = if (useHttps) "https" else "http"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://$address$portSuffix"
+        return "$scheme://${urlHost(address)}$portSuffix"
     }
 
     fun toWsUrl(): String {
         val scheme = if (useHttps) "wss" else "ws"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://$address$portSuffix"
+        return "$scheme://${urlHost(address)}$portSuffix"
     }
 
-    // name is the trailing field so entries saved before naming existed
-    // (4 fields) still deserialize, with name defaulting to "".
-    fun serialize(): String = "$address|$useHttps|$port|$password|$name"
+    /** Mesh-address UI URL, or null when the node never advertised one. */
+    fun toMeshUrl(): String? =
+        meshIp.takeIf { it.isNotBlank() }?.let { "http://${urlHost(it)}" }
+
+    // name/meshIp/npub are trailing fields so entries saved before they
+    // existed (4/5/6 fields) still deserialize, defaulting to "".
+    fun serialize(): String = "$address|$useHttps|$port|$password|$name|$meshIp|$npub"
+
+    /** Same node as [other]? npub identity wins; address/port/scheme is the
+     *  fallback for LAN-only entries that never advertised FIPS. */
+    fun sameNode(other: ServerEntry): Boolean =
+        (npub.isNotBlank() && npub == other.npub) ||
+            (address == other.address && port == other.port && useHttps == other.useHttps)
 
     companion object {
         fun deserialize(raw: String): ServerEntry? {
@@ -49,6 +69,8 @@ data class ServerEntry(
                 port = parts.getOrElse(2) { "" },
                 password = parts.getOrElse(3) { "" },
                 name = parts.getOrElse(4) { "" },
+                meshIp = parts.getOrElse(5) { "" },
+                npub = parts.getOrElse(6) { "" },
             )
         }
     }
@@ -61,8 +83,11 @@ class ServerPreferences(private val context: Context) {
     private val activePortKey = stringPreferencesKey("active_port")
     private val activePasswordKey = stringPreferencesKey("active_password")
     private val activeNameKey = stringPreferencesKey("active_name")
+    private val activeMeshIpKey = stringPreferencesKey("active_mesh_ip")
+    private val activeNpubKey = stringPreferencesKey("active_npub")
     private val savedServersKey = stringSetPreferencesKey("saved_servers")
     private val introSeenKey = booleanPreferencesKey("intro_seen")
+    private val gestureHintSeenKey = booleanPreferencesKey("gesture_hint_seen")
 
     val activeServer: Flow<ServerEntry?> = context.dataStore.data.map { prefs ->
         val address = prefs[activeAddressKey] ?: return@map null
@@ -72,6 +97,8 @@ class ServerPreferences(private val context: Context) {
             port = prefs[activePortKey] ?: "",
             password = prefs[activePasswordKey] ?: "",
             name = prefs[activeNameKey] ?: "",
+            meshIp = prefs[activeMeshIpKey] ?: "",
+            npub = prefs[activeNpubKey] ?: "",
         )
     }
 
@@ -84,6 +111,11 @@ class ServerPreferences(private val context: Context) {
         prefs[introSeenKey] ?: false
     }
 
+    /** One-shot flag for the three-finger-hold teaching overlay. */
+    val gestureHintSeen: Flow<Boolean> = context.dataStore.data.map { prefs ->
+        prefs[gestureHintSeenKey] ?: false
+    }
+
     suspend fun setActiveServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             prefs[activeAddressKey] = server.address
@@ -91,6 +123,8 @@ class ServerPreferences(private val context: Context) {
             prefs[activePortKey] = server.port
             prefs[activePasswordKey] = server.password
             prefs[activeNameKey] = server.name
+            prefs[activeMeshIpKey] = server.meshIp
+            prefs[activeNpubKey] = server.npub
         }
         addSavedServer(server)
     }
@@ -102,6 +136,8 @@ class ServerPreferences(private val context: Context) {
             prefs.remove(activePortKey)
             prefs.remove(activePasswordKey)
             prefs.remove(activeNameKey)
+            prefs.remove(activeMeshIpKey)
+            prefs.remove(activeNpubKey)
         }
     }
 
@@ -113,63 +149,66 @@ class ServerPreferences(private val context: Context) {
     }
 
     /**
-     * Replace a saved server in place. Matches the existing entry by connection
-     * identity (address/port/scheme) so edits that change the name or password —
-     * or that touch a legacy 4-field entry — still update the right record. If the
-     * edited server is also the active one, the active record is kept in sync.
+     * Replace a saved server in place. Matches the existing entry by node
+     * identity — npub first, address/port/scheme as the LAN-only fallback
+     * (ServerEntry.sameNode) — so edits that change the name, password or even
+     * every address still update the right record. An edit form that doesn't
+     * carry the npub keeps the stored one. If the edited server is also the
+     * active one, the active record is kept in sync.
      */
     suspend fun updateSavedServer(original: ServerEntry, updated: ServerEntry) {
+        val toStore = updated.copy(npub = updated.npub.ifBlank { original.npub })
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
             val filtered = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == original.address &&
-                    e.port == original.port &&
-                    e.useHttps == original.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(original) == true
             }.toSet()
-            prefs[savedServersKey] = filtered + updated.serialize()
+            prefs[savedServersKey] = filtered + toStore.serialize()
 
-            val isActive = prefs[activeAddressKey] == original.address &&
-                (prefs[activePortKey] ?: "") == original.port &&
-                (prefs[activeHttpsKey] ?: false) == original.useHttps
+            val activeNpub = prefs[activeNpubKey] ?: ""
+            val isActive = (activeNpub.isNotBlank() && activeNpub == original.npub) ||
+                (
+                    prefs[activeAddressKey] == original.address &&
+                        (prefs[activePortKey] ?: "") == original.port &&
+                        (prefs[activeHttpsKey] ?: false) == original.useHttps
+                    )
             if (isActive) {
-                prefs[activeAddressKey] = updated.address
-                prefs[activeHttpsKey] = updated.useHttps
-                prefs[activePortKey] = updated.port
-                prefs[activePasswordKey] = updated.password
-                prefs[activeNameKey] = updated.name
+                prefs[activeAddressKey] = toStore.address
+                prefs[activeHttpsKey] = toStore.useHttps
+                prefs[activePortKey] = toStore.port
+                prefs[activePasswordKey] = toStore.password
+                prefs[activeNameKey] = toStore.name
+                prefs[activeMeshIpKey] = toStore.meshIp
+                prefs[activeNpubKey] = toStore.npub
             }
         }
     }
 
     /**
-     * Add a server, or update the entry with the same connection identity
-     * (address/port/scheme) — used by QR pairing so re-scanning a node never
-     * duplicates it. A blank incoming password/name keeps the stored value
-     * (a real node's QR never carries the password). Returns the merged entry.
+     * Add a server, or update the entry for the same node — npub first,
+     * address/port/scheme as the LAN-only fallback (ServerEntry.sameNode) —
+     * used by QR pairing so re-scanning a node never duplicates it, even after
+     * the LAN renumbered and every address changed (npub-first contract in
+     * docs/companion-pairing-qr.md). A blank incoming password/name keeps the
+     * stored value (a real node's QR never carries the password). Returns the
+     * merged entry.
      */
     suspend fun upsertServer(server: ServerEntry): ServerEntry {
         var merged = server
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            val existing = current.mapNotNull { ServerEntry.deserialize(it) }.firstOrNull {
-                it.address == server.address &&
-                    it.port == server.port &&
-                    it.useHttps == server.useHttps
-            }
+            val existing = current.mapNotNull { ServerEntry.deserialize(it) }
+                .firstOrNull { it.sameNode(server) }
             if (existing != null) {
                 merged = server.copy(
                     password = server.password.ifBlank { existing.password },
                     name = server.name.ifBlank { existing.name },
+                    meshIp = server.meshIp.ifBlank { existing.meshIp },
+                    npub = server.npub.ifBlank { existing.npub },
                 )
             }
             val filtered = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == server.address &&
-                    e.port == server.port &&
-                    e.useHttps == server.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(merged) == true
             }.toSet()
             prefs[savedServersKey] = filtered + merged.serialize()
         }
@@ -179,15 +218,11 @@ class ServerPreferences(private val context: Context) {
     suspend fun removeSavedServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            // Match by connection identity (address/port/scheme) rather than the
-            // exact serialized string, so a rename — or the legacy 4-field format
-            // saved before names existed — still removes the right entry.
+            // Match by node identity (npub, else address/port/scheme) rather
+            // than the exact serialized string, so a rename — or a legacy
+            // short-format entry — still removes the right record.
             prefs[savedServersKey] = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == server.address &&
-                    e.port == server.port &&
-                    e.useHttps == server.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(server) == true
             }.toSet()
         }
     }
@@ -197,4 +232,10 @@ class ServerPreferences(private val context: Context) {
             prefs[introSeenKey] = true
         }
     }
+
+    suspend fun markGestureHintSeen() {
+        context.dataStore.edit { prefs ->
+            prefs[gestureHintSeenKey] = true
+        }
+    }
 }

Android/app/src/main/java/com/archipelago/app/data/ServerQrParser.kt

@@ -1,6 +1,8 @@
 package com.archipelago.app.data
 
 import android.net.Uri
+import com.archipelago.app.fips.AnchorPeer
+import com.archipelago.app.fips.FipsPairInfo
 
 /**
  * Result of parsing a pairing QR / deep link.
@@ -10,7 +12,11 @@ import android.net.Uri
  * user to update the app rather than call the code invalid.
  */
 sealed class PairResult {
-    data class Success(val server: ServerEntry) : PairResult()
+    data class Success(
+        val server: ServerEntry,
+        /** Mesh info when the node advertises FIPS (fnpub present). */
+        val fips: FipsPairInfo? = null,
+    ) : PairResult()
     object UnsupportedVersion : PairResult()
     object Invalid : PairResult()
 }
@@ -19,13 +25,18 @@ sealed class PairResult {
  * Parser for the companion pairing QR / OS deep link. Contract:
  * docs/companion-pairing-qr.md (repo root).
  *
- *   archipelago://pair?v=1&url=<percent-encoded origin>[&pw=<password>]
+ *   archipelago://pair?v=1&url=<origin>&name=…[&tok=…][&pw=…][&fnpub=…&fip=…&fhost=…&fudp=…&ftcp=…]
  *
  * - `url` is a full origin including scheme (http for LAN/mDNS nodes, https
  *   for the public demo); trailing slashes are normalized away.
- * - `pw` is only ever present for the public demo.
- * - Unknown extra query params are tolerated (forward compat under v=1 —
- *   `name` is already honored if present).
+ * - `tok` is a device token minted by the node; it goes through the password
+ *   field on purpose — the whole password auto-login path (WebSocket auth +
+ *   WebView form injection) then works unchanged, and the backend accepts
+ *   device tokens wherever it accepts the password. `pw` (demo only) wins if
+ *   both are ever present.
+ * - `fnpub`/`fip`/`fhost`/`fudp`/`ftcp` describe the node's FIPS mesh; their
+ *   absence just means LAN-only pairing (older node, or FIPS not provisioned).
+ * - Unknown extra query params are tolerated (forward compat under v=1).
  */
 object ServerQrParser {
     private const val SUPPORTED_MAJOR = 1
@@ -54,14 +65,64 @@ object ServerQrParser {
         val host = server.host
         if (host.isNullOrBlank()) return PairResult.Invalid
 
+        val fips = parseFips(uri)
+        val credential = uri.getQueryParameter("pw")?.takeIf { it.isNotBlank() }
+            ?: uri.getQueryParameter("tok")
+            ?: ""
+
         return PairResult.Success(
-            ServerEntry(
+            server = ServerEntry(
                 address = host,
                 useHttps = scheme == "https",
                 port = if (server.port != -1) server.port.toString() else "",
-                password = uri.getQueryParameter("pw") ?: "",
+                password = credential,
                 name = uri.getQueryParameter("name") ?: "",
-            )
+                meshIp = fips?.ula ?: "",
+                // npub is the durable identity — saved-server upserts match on
+                // it, so re-scanning after a LAN renumber updates in place.
+                npub = fips?.npub ?: "",
+            ),
+            fips = fips,
         )
     }
+
+    private fun parseFips(uri: Uri): FipsPairInfo? {
+        val npub = uri.getQueryParameter("fnpub")?.trim()
+        var host = uri.getQueryParameter("fhost")?.trim()
+        if (npub.isNullOrBlank() || host.isNullOrBlank()) return null
+        // A .fips fhost is a dead dial hint: Android's system DNS can't
+        // resolve .fips, so every handshake send fails and first connect
+        // falls back to slow anchor discovery. If the QR's `url` host is a
+        // real address, dial that instead (QRs minted while the node UI was
+        // browsed over the mesh carry npub….fips here).
+        if (host.endsWith(".fips")) {
+            val urlHost = uri.getQueryParameter("url")
+                ?.let { runCatching { Uri.parse(it).host }.getOrNull() }
+            if (!urlHost.isNullOrBlank() && !urlHost.endsWith(".fips")) host = urlHost
+        }
+        return FipsPairInfo(
+            npub = npub,
+            ula = uri.getQueryParameter("fip")?.trim().orEmpty(),
+            host = host,
+            udpPort = uri.getQueryParameter("fudp")?.toIntOrNull() ?: 2121,
+            tcpPort = uri.getQueryParameter("ftcp")?.toIntOrNull() ?: 8443,
+            anchors = parseAnchors(uri.getQueryParameter("fanchors")),
+        )
+    }
+
+    /** `fanchors` = comma-joined `npub@host:port/transport`; bad items skipped. */
+    private fun parseAnchors(raw: String?): List<AnchorPeer> {
+        if (raw.isNullOrBlank()) return emptyList()
+        return raw.split(",").mapNotNull { item ->
+            val at = item.indexOf('@')
+            val slash = item.lastIndexOf('/')
+            if (at <= 0 || slash <= at) return@mapNotNull null
+            val npub = item.substring(0, at).trim()
+            val addr = item.substring(at + 1, slash).trim()
+            val transport = item.substring(slash + 1).trim().lowercase()
+            if (npub.isBlank() || !addr.contains(":")) return@mapNotNull null
+            if (transport != "udp" && transport != "tcp") return@mapNotNull null
+            AnchorPeer(npub = npub, addr = addr, transport = transport)
+        }
+    }
 }

Android/app/src/main/java/com/archipelago/app/fips/ArchyVpnService.kt

@@ -0,0 +1,324 @@
+package com.archipelago.app.fips
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Intent
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import android.net.VpnService
+import android.os.Build
+import android.util.Log
+import com.archipelago.app.MainActivity
+import com.archipelago.app.R
+import com.archipelago.app.data.ServerPreferences
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+
+/**
+ * VpnService hosting the embedded FIPS mesh node.
+ *
+ * Split tunnel: only fd00::/8 (the FIPS ULA space) routes into the TUN, so
+ * normal phone traffic is untouched — this is mesh reachability, not a
+ * default-route VPN. The established fd is detached and handed to the Rust
+ * node (Node::start_with_tun_fd); the node owns it until stop.
+ */
+class ArchyVpnService : VpnService() {
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private var warmerJob: Job? = null
+
+    // Seamless transport handoff (Wi-Fi ⇄ 5G ⇄ future BLE). Without this the
+    // tunnel's underlying network stays pinned to the interface that was
+    // default when the VPN came up; when the phone leaves Wi-Fi for 5G the
+    // mesh sockets ride a dead network and sessions never recover until the
+    // app is restarted (user-reported 2026-07-27). The callback (a) re-pins
+    // the tunnel to the new default network via setUnderlyingNetworks and
+    // (b) forces an immediate mesh re-home so discovery + sessions rebuild
+    // on the new path within seconds instead of waiting out dead-link
+    // timeouts.
+    private var connectivityManager: ConnectivityManager? = null
+    private var networkCallback: ConnectivityManager.NetworkCallback? = null
+    @Volatile
+    private var currentUnderlying: Network? = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_STOP) {
+            shutdown()
+            return START_NOT_STICKY
+        }
+        startForeground(NOTIFICATION_ID, buildNotification())
+        scope.launch { startMesh() }
+        return START_STICKY
+    }
+
+    private suspend fun startMesh() {
+        if (!FipsNative.available) {
+            shutdown()
+            return
+        }
+        val prefs = FipsPreferences(this)
+        val identity = FipsManager.ensureIdentity(prefs)
+        val peersJson = prefs.combinedPeersJson()
+        if (identity == null || peersJson == "[]") {
+            Log.w(TAG, "mesh not configured — stopping")
+            shutdown()
+            return
+        }
+        // Party mode: fixed inbound UDP bind so a nearby phone can dial us
+        // directly over a shared LAN/hotspot (no internet required).
+        val listenPort = if (prefs.partyListen()) PartyQr.PARTY_UDP_PORT else 0
+
+        // A fresh app open re-triggers the service. Tearing a HEALTHY mesh
+        // down to rebuild it costs ~8s of anchor+session bring-up on every
+        // launch (observed live: stop 00:34:38 → session back 00:34:49) and
+        // is what made "freshly loading the app" slow. Keep a running node;
+        // restart only when it's dead or a pairing changed the peer set.
+        if (FipsNative.isRunning() && !FipsManager.peersDirty) {
+            Log.i(TAG, "mesh already running — keeping warm sessions")
+            startSessionWarmer()
+            return
+        }
+        FipsManager.peersDirty = false
+        // Re-establishing while running would strand the old fd; restart clean.
+        if (FipsNative.isRunning()) FipsNative.stop()
+
+        val pfd = try {
+            Builder()
+                .setSession("Archipelago Mesh")
+                .setMtu(1280)
+                .addAddress(identity.address, 128)
+                .addRoute("fd00::", 8)
+                // The TUN is IPv6-only. Android blocks every address family
+                // the VPN has no address for — without this, bringing the
+                // mesh up cut ALL of the phone's IPv4 internet.
+                .allowFamily(android.system.OsConstants.AF_INET)
+                // And let apps that bind their own network skip the TUN
+                // entirely — this is mesh reachability, not a privacy VPN.
+                .allowBypass()
+                .apply {
+                    // Android 10+ treats VPN networks as METERED by default,
+                    // which flips the whole phone into data-saver behaviour
+                    // (background sync off, "metered" warnings) while the
+                    // mesh is up. It inherits the underlying network's real
+                    // metered state instead.
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) setMetered(false)
+                }
+                .establish()
+        } catch (e: Exception) {
+            Log.e(TAG, "VPN establish failed", e)
+            null
+        }
+        if (pfd == null) {
+            shutdown()
+            return
+        }
+
+        val fd = pfd.detachFd()
+        val result = FipsNative.start(identity.secret, peersJson, fd, listenPort)
+        Log.i(TAG, "mesh start: $result (listen=$listenPort)")
+        if (result.contains("\"error\"")) {
+            shutdown()
+        } else {
+            startSessionWarmer()
+            registerNetworkHandoff()
+            // Phone-to-phone chat/beam + the phone's own mesh-served page.
+            FlareServer.start(this, identity.address, identity.npub, prefs.partyName())
+            // Mutual pairing: when a phone that scanned OUR QR announces
+            // itself, store it as a party peer and re-run the mesh config so
+            // this side gets the peer + chat entry without scanning back.
+            FlareServer.onHello = { peer ->
+                scope.launch {
+                    prefs.upsertPartyPeer(peer)
+                    FipsManager.requestMeshRestart(this@ArchyVpnService)
+                }
+            }
+        }
+    }
+
+    /**
+     * Pre-warm + keep-warm mesh sessions to every known node ULA.
+     *
+     * Discovery + first session through the public tree can take 15s+
+     * (from node diagnosis) — paying that cost here, the
+     * moment the tunnel is up, means the connect probe and WebView hit an
+     * established session instead of timing out on a cold one. The periodic
+     * touch afterwards keeps the session from idling out. Failed connects
+     * are expected and cheap; the attempt itself is what drives discovery.
+     */
+    private fun startSessionWarmer() {
+        warmerJob?.cancel()
+        warmerJob = scope.launch {
+            val prefs = ServerPreferences(this@ArchyVpnService)
+            val fipsPrefs = FipsPreferences(this@ArchyVpnService)
+            var round = 0
+            while (isActive && FipsNative.isRunning()) {
+                val targets = try {
+                    prefs.savedServers.first()
+                        .mapNotNull { it.meshIp.ifBlank { null } }
+                        .map { it to 80 } +
+                        // Party phones answer on the flare port, not :80.
+                        fipsPrefs.partyPeers().map { it.ula to PartyQr.FLARE_PORT }
+                } catch (_: Exception) {
+                    emptyList()
+                }.distinct()
+                if (round == 0) Log.i(TAG, "session warmer: ${targets.map { it.first }}")
+                // Probe all targets CONCURRENTLY with a short timeout — the
+                // old sequential 20s-per-target loop let one cold node starve
+                // every other target for the whole aggressive window.
+                targets.map { (ula, port) ->
+                    launch {
+                        try {
+                            java.net.Socket().use { s ->
+                                s.connect(
+                                    java.net.InetSocketAddress(
+                                        java.net.InetAddress.getByName(ula),
+                                        port,
+                                    ),
+                                    5_000,
+                                )
+                            }
+                        } catch (_: Exception) {
+                            // Cold path / node away — the attempt still drove
+                            // session establishment; try again next round.
+                        }
+                    }
+                }.forEach { it.join() }
+                round++
+                // Aggressive for the first ~minute (session bring-up), then a
+                // slow keep-warm tick that costs nearly nothing.
+                delay(if (round < 12) 5_000 else 60_000)
+            }
+        }
+    }
+
+    /**
+     * Track the phone's default network and hand the mesh over to it as the
+     * phone roams (Wi-Fi ⇄ 5G, and later BLE). Two actions per change:
+     *  1. setUnderlyingNetworks(new) — the tunnel's packets follow the live
+     *     network instead of dying on the one it launched with.
+     *  2. re-home the mesh — kick the session warmer so discovery + sessions
+     *     rebuild on the new path immediately; the node's own fast-reconnect
+     *     (1s) redials peers over the new route.
+     * onAvailable also fires for the FIRST network, which is how the initial
+     * underlying network gets set.
+     */
+    private fun registerNetworkHandoff() {
+        if (networkCallback != null) return
+        val cm = getSystemService(ConnectivityManager::class.java) ?: return
+        connectivityManager = cm
+        val request = NetworkRequest.Builder()
+            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+            .build()
+        val cb = object : ConnectivityManager.NetworkCallback() {
+            override fun onAvailable(network: Network) {
+                handoffTo(network)
+            }
+
+            override fun onLost(network: Network) {
+                // The lost network was our underlying one — clear the pin so
+                // the system falls back to whatever default remains; the next
+                // onAvailable re-pins explicitly.
+                if (network == currentUnderlying) {
+                    currentUnderlying = null
+                    runCatching { setUnderlyingNetworks(null) }
+                }
+            }
+        }
+        networkCallback = cb
+        // requestNetwork tracks the BEST network of the request; when the
+        // phone moves Wi-Fi→5G the callback re-fires onAvailable with the new
+        // one. (registerDefaultNetworkCallback would also work; requestNetwork
+        // lets us extend to BLE-capable transports later.)
+        runCatching { cm.requestNetwork(request, cb) }
+    }
+
+    private fun handoffTo(network: Network) {
+        val changed = network != currentUnderlying
+        currentUnderlying = network
+        // Always re-assert; cheap and covers capability changes on the same
+        // Network object.
+        runCatching { setUnderlyingNetworks(arrayOf(network)) }
+        if (changed && FipsNative.isRunning()) {
+            Log.i(TAG, "network handoff → re-homing mesh on new default network")
+            // Fresh warmer pass drives immediate rediscovery/session rebuild
+            // on the new path instead of waiting out dead-link timeouts.
+            startSessionWarmer()
+        }
+    }
+
+    private fun unregisterNetworkHandoff() {
+        val cm = connectivityManager
+        val cb = networkCallback
+        if (cm != null && cb != null) {
+            runCatching { cm.unregisterNetworkCallback(cb) }
+        }
+        networkCallback = null
+        connectivityManager = null
+        currentUnderlying = null
+    }
+
+    private fun shutdown() {
+        warmerJob?.cancel()
+        unregisterNetworkHandoff()
+        FlareServer.stop()
+        FipsNative.stop()
+        stopForeground(STOP_FOREGROUND_REMOVE)
+        stopSelf()
+    }
+
+    override fun onDestroy() {
+        unregisterNetworkHandoff()
+        FipsNative.stop()
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    override fun onRevoke() {
+        // User pulled VPN permission from system settings.
+        shutdown()
+    }
+
+    private fun buildNotification(): Notification {
+        val manager = getSystemService(NotificationManager::class.java)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            manager.createNotificationChannel(
+                NotificationChannel(
+                    CHANNEL_ID,
+                    "Mesh connection",
+                    NotificationManager.IMPORTANCE_MIN,
+                ).apply { description = "Keeps the node reachable from anywhere" }
+            )
+        }
+        val tapIntent = PendingIntent.getActivity(
+            this,
+            0,
+            Intent(this, MainActivity::class.java),
+            PendingIntent.FLAG_IMMUTABLE,
+        )
+        return Notification.Builder(this, CHANNEL_ID)
+            .setContentTitle("Connected to your Archipelago")
+            .setContentText("Secure mesh link active")
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentIntent(tapIntent)
+            .setOngoing(true)
+            .build()
+    }
+
+    companion object {
+        const val ACTION_STOP = "com.archipelago.app.fips.STOP"
+        private const val CHANNEL_ID = "archy_mesh"
+        private const val NOTIFICATION_ID = 4841
+        private const val TAG = "ArchyVpnService"
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsManager.kt

@@ -0,0 +1,103 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import android.content.Intent
+import android.net.VpnService
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+
+/**
+ * Glue between pairing and the mesh: persists the node peer from a scanned
+ * QR and asks the UI to bring the tunnel up. There is deliberately no
+ * settings surface — scanning a node's QR is the entire configuration.
+ *
+ * The one unavoidable interaction is Android's VPN consent dialog
+ * (VpnService.prepare), which only an Activity can launch; [consentNeeded]
+ * signals AppNavHost to run it, once, on first pairing.
+ */
+object FipsManager {
+
+    /** Set when a pairing registered mesh info and the VPN needs starting. */
+    private val _consentNeeded = MutableStateFlow(false)
+    val consentNeeded: StateFlow<Boolean> = _consentNeeded
+
+    /** True after a pairing changed the peer set while the node was running —
+     *  tells the service a restart is genuinely needed (the ONLY case; a
+     *  routine app open must keep the warm mesh, not rebuild it). */
+    @Volatile
+    var peersDirty: Boolean = false
+
+    fun consentHandled() {
+        _consentNeeded.value = false
+    }
+
+    /**
+     * Persist mesh info from a pairing scan and request tunnel start.
+     * No-op on devices without the native lib (non-arm64).
+     */
+    suspend fun registerNode(context: Context, info: FipsPairInfo?, alias: String) {
+        if (info == null || !FipsNative.available) return
+        val prefs = FipsPreferences(context)
+        ensureIdentity(prefs)
+        prefs.upsertNodePeer(info, alias)
+        peersDirty = true
+        // Restart the mesh with the new peer RIGHT NOW when consent already
+        // exists — relying on the consentNeeded collector left a running
+        // mesh on the OLD peer list whenever the collector wasn't active
+        // (fresh pairings looked dead until a full app restart).
+        if (VpnService.prepare(context) == null) {
+            startService(context)
+        } else {
+            _consentNeeded.value = true
+        }
+    }
+
+    /** Generate-once mesh identity. Returns null only if the RNG/native fails. */
+    suspend fun ensureIdentity(prefs: FipsPreferences): FipsNative.Identity? {
+        prefs.identity()?.let { return it }
+        val generated = FipsNative.parseIdentity(FipsNative.generateIdentity()) ?: return null
+        prefs.saveIdentity(generated)
+        return generated
+    }
+
+    /**
+     * Start the mesh service if this device is paired and the user has already
+     * consented to the VPN (prepare() == null). Called on app start so the
+     * tunnel comes back without any interaction; first-time consent goes
+     * through AppNavHost instead.
+     */
+    suspend fun autoStartIfReady(context: Context) {
+        if (!FipsNative.available) return
+        val prefs = FipsPreferences(context)
+        if (prefs.identity() == null || !prefs.hasPeers()) return
+        if (VpnService.prepare(context) != null) return // consent missing — don't prompt here
+        startService(context)
+    }
+
+    fun startService(context: Context) {
+        val intent = Intent(context, ArchyVpnService::class.java)
+        context.startForegroundService(intent)
+    }
+
+    /**
+     * Re-run the mesh with current prefs (party listen toggled, peer added).
+     * Marks the peer set dirty so startMesh genuinely restarts the node —
+     * otherwise the keep-warm fast path would skip the new config.
+     * First-timers go through the consent flow.
+     */
+    fun requestMeshRestart(context: Context) {
+        if (!FipsNative.available) return
+        peersDirty = true
+        if (VpnService.prepare(context) == null) {
+            startService(context)
+        } else {
+            _consentNeeded.value = true
+        }
+    }
+
+    fun stopService(context: Context) {
+        val intent = Intent(context, ArchyVpnService::class.java)
+            .setAction(ArchyVpnService.ACTION_STOP)
+        context.startService(intent)
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsNative.kt

@@ -0,0 +1,49 @@
+package com.archipelago.app.fips
+
+import org.json.JSONObject
+
+/**
+ * JNI binding to the embedded FIPS mesh node (Android/rust/archy-fips-core,
+ * built into libarchy_fips_core.so by the buildRustArm64 gradle task).
+ *
+ * All calls return JSON strings; failures come back as {"error": "…"} rather
+ * than exceptions. [available] is false on ABIs the .so isn't built for
+ * (anything but arm64) — every caller must gate on it so the app still runs
+ * as a plain companion there.
+ */
+object FipsNative {
+    val available: Boolean = try {
+        System.loadLibrary("archy_fips_core")
+        true
+    } catch (_: Throwable) {
+        false
+    }
+
+    external fun generateIdentity(): String
+    external fun deriveIdentity(secret: String): String
+
+    /**
+     * [listenPort] 0 = outbound-only (default posture). Non-zero binds UDP on
+     * that port so a nearby phone can dial us directly (party mode); the node
+     * stays leaf-only either way.
+     */
+    external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String
+    external fun stop()
+    external fun isRunning(): Boolean
+    external fun statusJson(): String
+
+    data class Identity(val secret: String, val npub: String, val address: String)
+
+    /** Parse an identity JSON reply; null on {"error": …} or malformed. */
+    fun parseIdentity(json: String): Identity? = try {
+        val obj = JSONObject(json)
+        if (obj.has("error")) null
+        else Identity(
+            secret = obj.getString("secret"),
+            npub = obj.getString("npub"),
+            address = obj.getString("address"),
+        )
+    } catch (_: Exception) {
+        null
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsPairInfo.kt

@@ -0,0 +1,29 @@
+package com.archipelago.app.fips
+
+/**
+ * Node mesh parameters carried by the pairing QR (fnpub/fip/fhost/fudp/ftcp —
+ * docs/companion-pairing-qr.md). The phone's embedded FIPS node dials
+ * host:udpPort / host:tcpPort claiming nothing; the mesh accepts inbound peers
+ * without registration, so possession of these params is all pairing takes.
+ */
+data class FipsPairInfo(
+    val npub: String,
+    /** Node's fips0 ULA — where its UI stays reachable once meshed. May be empty. */
+    val ula: String,
+    val host: String,
+    val udpPort: Int,
+    val tcpPort: Int,
+    /**
+     * Public rendezvous anchors (the node's seed-anchor list). The phone
+     * peers with these too, so it can route to the node via the mesh when
+     * the node's LAN endpoint isn't directly dialable.
+     */
+    val anchors: List<AnchorPeer> = emptyList(),
+)
+
+/** One rendezvous anchor from the QR's `fanchors` param (npub@addr/transport). */
+data class AnchorPeer(
+    val npub: String,
+    val addr: String,
+    val transport: String,
+)

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -0,0 +1,341 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import org.json.JSONArray
+import org.json.JSONObject
+import androidx.datastore.preferences.preferencesDataStore
+
+private val Context.fipsDataStore: DataStore<Preferences> by preferencesDataStore(name = "fips_prefs")
+
+// Archipelago-operated public anchor (vps2). Baked in so EVERY pairing yields
+// both paths — direct LAN p2p to the node AND a public rendezvous for
+// away-from-home — even when the scanned node is old enough that its QR
+// carries no fanchors. Keep in lockstep with
+// core/archipelago/src/fips/anchors.rs (ARCHY_ANCHOR_*).
+internal const val ARCHY_ANCHOR_NPUB =
+    "npub1dptaktwxv0mm245g2lqjykwm5ll0jpc6m3r4242ydfa9z7qe6urs3jvrak"
+internal const val ARCHY_ANCHOR_ADDR = "146.59.87.168:8444"
+internal const val ARCHY_ANCHOR_TRANSPORT = "tcp"
+
+/**
+ * Public FIPS network anchors (join.fips.network — the dual-transport TCP
+ * pair; keep in lockstep with core/archipelago/src/fips/anchors.rs
+ * fips_network_anchors()). Baked into every pairing at trailing priority so
+ * a degraded/unreachable vps2 anchor can never strand the phone: the mesh
+ * still joins the public tree and routes to the node through it.
+ */
+internal val PUBLIC_FIPS_ANCHORS = listOf(
+    Triple(
+        "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u",
+        "23.182.128.74:443",
+        "tcp",
+    ),
+    Triple(
+        "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98",
+        "217.77.8.91:443",
+        "tcp",
+    ),
+)
+
+/**
+ * Mesh identity + known node peers. Follows the same plaintext-DataStore
+ * storage model as ServerPreferences (the server password lives there the
+ * same way); the mesh secret only grants mesh membership, not node login.
+ */
+class FipsPreferences(private val context: Context) {
+
+    private val secretKey = stringPreferencesKey("fips_secret")
+    private val npubKey = stringPreferencesKey("fips_npub")
+    private val addressKey = stringPreferencesKey("fips_address")
+    /** JSON array of node peers in fips PeerConfig shape (see NodePeer). */
+    private val peersKey = stringPreferencesKey("fips_node_peers")
+    /** JSON array of phone party peers (PartyPeer shape, NOT PeerConfig). */
+    private val partyPeersKey = stringPreferencesKey("fips_party_peers")
+    /** Party mode: accept a direct inbound mesh link (UDP 2121). */
+    private val partyListenKey = booleanPreferencesKey("fips_party_listen")
+    /** Name shown in this phone's party QR and outgoing flares. */
+    private val partyNameKey = stringPreferencesKey("fips_party_name")
+
+    suspend fun identity(): FipsNative.Identity? {
+        val prefs = context.fipsDataStore.data.first()
+        val secret = prefs[secretKey] ?: return null
+        return FipsNative.Identity(
+            secret = secret,
+            npub = prefs[npubKey] ?: "",
+            address = prefs[addressKey] ?: "",
+        )
+    }
+
+    suspend fun saveIdentity(identity: FipsNative.Identity) {
+        context.fipsDataStore.edit { prefs ->
+            prefs[secretKey] = identity.secret
+            prefs[npubKey] = identity.npub
+            prefs[addressKey] = identity.address
+        }
+    }
+
+    suspend fun peersJson(): String {
+        val prefs = context.fipsDataStore.data.first()
+        return prefs[peersKey] ?: "[]"
+    }
+
+    suspend fun hasPeers(): Boolean = JSONArray(peersJson()).length() > 0
+
+    // ── Mesh Party (phone↔phone) ────────────────────────────────────────────
+
+    suspend fun partyListen(): Boolean =
+        context.fipsDataStore.data.first()[partyListenKey] ?: false
+
+    val partyListenFlow: Flow<Boolean>
+        get() = context.fipsDataStore.data.map { it[partyListenKey] ?: false }
+
+    suspend fun setPartyListen(enabled: Boolean) {
+        context.fipsDataStore.edit { it[partyListenKey] = enabled }
+    }
+
+    suspend fun partyName(): String =
+        context.fipsDataStore.data.first()[partyNameKey]
+            ?: android.os.Build.MODEL.orEmpty().ifBlank { "Phone" }
+
+    suspend fun setPartyName(name: String) {
+        context.fipsDataStore.edit { it[partyNameKey] = name.trim() }
+    }
+
+    val partyPeersFlow: Flow<List<PartyPeer>>
+        get() = context.fipsDataStore.data.map { parsePartyPeers(it[partyPeersKey] ?: "[]") }
+
+    suspend fun partyPeers(): List<PartyPeer> =
+        parsePartyPeers(context.fipsDataStore.data.first()[partyPeersKey] ?: "[]")
+
+    /** Matched by npub, so re-scanning updates the direct-dial address in place. */
+    suspend fun upsertPartyPeer(peer: PartyPeer) {
+        context.fipsDataStore.edit { prefs ->
+            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != peer.npub }
+            prefs[partyPeersKey] = toJson(kept + peer)
+        }
+    }
+
+    suspend fun removePartyPeer(npub: String) {
+        context.fipsDataStore.edit { prefs ->
+            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != npub }
+            prefs[partyPeersKey] = toJson(kept)
+        }
+    }
+
+    /**
+     * Node peers + direct-dial party peers, in the fips PeerConfig JSON the
+     * Rust node deserializes. Party peers get the best priority: on a shared
+     * LAN/hotspot the direct link beats every anchor path, and while off-LAN
+     * the failed dial is cheap (auto-reconnect keeps retrying, which is
+     * exactly what makes the link snap up the moment both phones share WiFi).
+     * Party peers without an underlay address are mesh-routed and need no
+     * entry here at all.
+     */
+    suspend fun combinedPeersJson(): String {
+        val merged = JSONArray(peersJson())
+        val party = partyPeers()
+        for (peer in party) {
+            if (peer.ip.isBlank() || peer.port <= 0) continue
+            merged.put(JSONObject().apply {
+                put("npub", peer.npub)
+                put("alias", hostSafeAlias(peer.name.ifBlank { "party-phone" }))
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", "udp")
+                    put("addr", "${peer.ip}:${peer.port}")
+                    put("priority", 5)
+                }))
+            })
+        }
+        // A party-only phone (never paired with a node) still needs a public
+        // rendezvous to reach its peers ACROSS the internet — without it, two
+        // bare phones would be hotspot/LAN-only. Node pairing normally bakes
+        // this anchor in; do the same when there are party peers.
+        if (party.isNotEmpty() &&
+            (0 until merged.length()).none {
+                merged.optJSONObject(it)?.optString("npub") == ARCHY_ANCHOR_NPUB
+            }
+        ) {
+            merged.put(JSONObject().apply {
+                put("npub", ARCHY_ANCHOR_NPUB)
+                put("alias", "archipelago-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", ARCHY_ANCHOR_TRANSPORT)
+                    put("addr", ARCHY_ANCHOR_ADDR)
+                    put("priority", 40)
+                }))
+            })
+        }
+        // Backfill anchor peers for entries paired before newer QR/app
+        // releases added them. `upsertNodePeer` persists these on re-scan, but
+        // startup must also self-heal old DataStore state so updating the APK is
+        // enough to get off-LAN redundancy.
+        if (merged.length() > 0) {
+            addAnchorIfMissing(merged, ARCHY_ANCHOR_NPUB, "archipelago-anchor", ARCHY_ANCHOR_ADDR, ARCHY_ANCHOR_TRANSPORT, 40)
+            for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+                val (npub, addr, transport) = anchor
+                addAnchorIfMissing(merged, npub, "fips-network-anchor-${i + 1}", addr, transport, 50 + i * 10)
+            }
+        }
+        return merged.toString()
+    }
+
+    private fun addAnchorIfMissing(
+        peers: JSONArray,
+        npub: String,
+        alias: String,
+        addr: String,
+        transport: String,
+        priority: Int,
+    ) {
+        if ((0 until peers.length()).any { peers.optJSONObject(it)?.optString("npub") == npub }) return
+        peers.put(JSONObject().apply {
+            put("npub", npub)
+            put("alias", alias)
+            put("addresses", JSONArray().put(JSONObject().apply {
+                put("transport", transport)
+                put("addr", addr)
+                put("priority", priority)
+            }))
+        })
+    }
+
+    private fun parsePartyPeers(json: String): List<PartyPeer> = try {
+        val arr = JSONArray(json)
+        (0 until arr.length()).mapNotNull { i ->
+            val o = arr.optJSONObject(i) ?: return@mapNotNull null
+            val npub = o.optString("npub")
+            val ula = o.optString("ula")
+            if (npub.isBlank() || ula.isBlank()) return@mapNotNull null
+            PartyPeer(
+                npub = npub,
+                ula = ula,
+                name = o.optString("name").ifBlank { "Phone" },
+                ip = o.optString("ip"),
+                port = o.optInt("port"),
+            )
+        }
+    } catch (_: Exception) {
+        emptyList()
+    }
+
+    private fun toJson(peers: List<PartyPeer>): String {
+        val arr = JSONArray()
+        for (p in peers) {
+            arr.put(JSONObject().apply {
+                put("npub", p.npub)
+                put("ula", p.ula)
+                put("name", p.name)
+                put("ip", p.ip)
+                put("port", p.port)
+            })
+        }
+        return arr.toString()
+    }
+
+    /**
+     * Add or update the node peer plus its rendezvous anchors (each matched
+     * by npub, so re-pairing updates addresses instead of duplicating).
+     * Stored directly in the fips PeerConfig JSON shape the Rust side
+     * deserializes. The node's direct addresses get the best priorities;
+     * anchors trail so the mesh prefers the direct path when it works.
+     */
+    suspend fun upsertNodePeer(info: FipsPairInfo, alias: String) {
+        val incoming = mutableListOf<JSONObject>()
+        incoming += JSONObject().apply {
+            put("npub", info.npub)
+            put("alias", hostSafeAlias(alias.ifBlank { "Archipelago" }))
+            val addresses = JSONArray()
+            // .fips hosts are unresolvable on Android (no system .fips DNS):
+            // storing one gives the mesh a dial target that fails every
+            // handshake and stalls first connect on anchor discovery.
+            if (info.udpPort > 0 && !info.host.endsWith(".fips")) {
+                addresses.put(JSONObject().apply {
+                    put("transport", "udp")
+                    put("addr", "${info.host}:${info.udpPort}")
+                    put("priority", 10)
+                })
+            }
+            if (info.tcpPort > 0 && !info.host.endsWith(".fips")) {
+                addresses.put(JSONObject().apply {
+                    put("transport", "tcp")
+                    put("addr", "${info.host}:${info.tcpPort}")
+                    put("priority", 20)
+                })
+            }
+            put("addresses", addresses)
+        }
+        for (anchor in info.anchors) {
+            if (anchor.npub == info.npub) continue
+            if (anchor.addr.substringBeforeLast(":").endsWith(".fips")) continue
+            incoming += JSONObject().apply {
+                put("npub", anchor.npub)
+                put("alias", "mesh-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", anchor.transport)
+                    put("addr", anchor.addr)
+                    put("priority", 30)
+                }))
+            }
+        }
+        // Guarantee the public anchor: without it, a QR from an older node
+        // leaves the phone LAN-only and pairing/connecting dies off-LAN.
+        if (info.npub != ARCHY_ANCHOR_NPUB &&
+            incoming.none { it.optString("npub") == ARCHY_ANCHOR_NPUB }
+        ) {
+            incoming += JSONObject().apply {
+                put("npub", ARCHY_ANCHOR_NPUB)
+                put("alias", "archipelago-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", ARCHY_ANCHOR_TRANSPORT)
+                    put("addr", ARCHY_ANCHOR_ADDR)
+                    put("priority", 40)
+                }))
+            }
+        }
+        // And the public FIPS network anchors at trailing priority, so one
+        // degraded rendezvous (vps2, 2026-07-24) can never strand the phone.
+        for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+            val (npub, addr, transport) = anchor
+            if (info.npub == npub || incoming.any { it.optString("npub") == npub }) continue
+            incoming += JSONObject().apply {
+                put("npub", npub)
+                put("alias", "fips-network-anchor-${i + 1}")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", transport)
+                    put("addr", addr)
+                    put("priority", 50 + i * 10)
+                }))
+            }
+        }
+        val incomingNpubs = incoming.map { it.optString("npub") }.toSet()
+        context.fipsDataStore.edit { prefs ->
+            val current = JSONArray(prefs[peersKey] ?: "[]")
+            val merged = JSONArray()
+            for (i in 0 until current.length()) {
+                val existing = current.optJSONObject(i) ?: continue
+                if (existing.optString("npub") !in incomingNpubs) merged.put(existing)
+            }
+            incoming.forEach { merged.put(it) }
+            prefs[peersKey] = merged.toString()
+        }
+    }
+}
+
+/**
+ * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
+ * that isn't a valid DNS label ("Test Node" — the space) gets rejected and
+ * silently drops the peer from name resolution. Slug it instead of losing it.
+ */
+internal fun hostSafeAlias(alias: String): String =
+    alias.lowercase()
+        .replace(Regex("[^a-z0-9.-]+"), "-")
+        .trim('-', '.')
+        .ifBlank { "archipelago" }

Android/app/src/main/java/com/archipelago/app/fips/FlareServer.kt

@@ -0,0 +1,398 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import android.util.Log
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONObject
+import java.io.BufferedInputStream
+import java.io.File
+import java.io.InputStream
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.net.ServerSocket
+import java.net.Socket
+import java.util.UUID
+import java.util.concurrent.ExecutorService
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+
+/** One chat/photo message in a party conversation, keyed by the peer's npub. */
+data class FlareMessage(
+    val id: String,
+    val peerNpub: String,
+    val fromMe: Boolean,
+    val name: String,
+    val text: String = "",
+    val photoPath: String = "",
+    val ts: Long,
+    val status: Status = Status.RECEIVED,
+) {
+    enum class Status { SENDING, SENT, FAILED, RECEIVED }
+}
+
+/** In-memory conversation store (demo scope — nothing persists across restarts). */
+object FlareStore {
+    private val _messages = MutableStateFlow<List<FlareMessage>>(emptyList())
+    val messages: StateFlow<List<FlareMessage>> = _messages
+
+    fun add(message: FlareMessage) {
+        _messages.value = _messages.value + message
+    }
+
+    fun setStatus(id: String, status: FlareMessage.Status) {
+        _messages.value = _messages.value.map { if (it.id == id) it.copy(status = status) else it }
+    }
+}
+
+/**
+ * Minimal HTTP listener bound ONLY on this phone's mesh ULA — plain HTTP is
+ * fine there because FIPS is the encryption + peer-identity layer (same
+ * stance as the node's ULA-only peer listener). This is what makes the phone
+ * a *server* on the mesh: another phone (or `curl -6` from any mesh node)
+ * reaches it by npub-derived address with no port forwarding, DNS, or CA.
+ *
+ * FIPS authenticates the node, not the request (project doctrine), so inputs
+ * are still validated at this boundary: size caps, JSON shape, no
+ * client-controlled paths.
+ */
+object FlareServer {
+    private const val TAG = "FlareServer"
+    private const val MAX_PHOTO_BYTES = 8 * 1024 * 1024
+    private const val MAX_TEXT_CHARS = 4_000
+    private const val MAX_HEADER_BYTES = 16 * 1024
+
+    private var socket: ServerSocket? = null
+    private var pool: ExecutorService? = null
+    @Volatile private var identityName = "Phone"
+    @Volatile private var identityNpub = ""
+    @Volatile private var photoDir: File? = null
+
+    /** Invoked when a peer announces itself (POST /hello) — pairing used to
+     *  be one-way: only the SCANNING phone learned the other side, so the
+     *  scanned phone had no peer, no chat entry, no way in. The VPN service
+     *  wires this to upsert the peer + restart the mesh config. */
+    @Volatile var onHello: ((PartyPeer) -> Unit)? = null
+
+    @Synchronized
+    fun start(context: Context, ula: String, myNpub: String, myName: String) {
+        stop()
+        identityNpub = myNpub
+        identityName = myName
+        photoDir = File(context.cacheDir, "flare").apply { mkdirs() }
+        val pool = Executors.newCachedThreadPool().also { this.pool = it }
+        pool.execute {
+            try {
+                val server = ServerSocket().apply {
+                    reuseAddress = true
+                    bind(InetSocketAddress(InetAddress.getByName(ula), PartyQr.FLARE_PORT))
+                }
+                socket = server
+                Log.i(TAG, "flare listening on [$ula]:${PartyQr.FLARE_PORT}")
+                while (!server.isClosed) {
+                    val client = try {
+                        server.accept()
+                    } catch (_: Exception) {
+                        break
+                    }
+                    pool.execute { handle(client) }
+                }
+            } catch (e: Exception) {
+                Log.e(TAG, "flare server died: $e")
+            }
+        }
+    }
+
+    @Synchronized
+    fun stop() {
+        try {
+            socket?.close()
+        } catch (_: Exception) {
+        }
+        socket = null
+        pool?.shutdownNow()
+        pool = null
+    }
+
+    private fun handle(client: Socket) {
+        client.use { sock ->
+            sock.soTimeout = 30_000
+            try {
+                val input = BufferedInputStream(sock.getInputStream())
+                val requestLine = readLine(input) ?: return
+                val parts = requestLine.trim().split(" ")
+                if (parts.size < 2) return respond(sock, 400, json("bad_request"))
+                val (method, path) = parts[0] to parts[1]
+
+                var contentLength = 0
+                var from = ""
+                var fromName = ""
+                var headerBytes = requestLine.length
+                while (true) {
+                    val line = readLine(input) ?: return
+                    if (line.isEmpty()) break
+                    headerBytes += line.length
+                    if (headerBytes > MAX_HEADER_BYTES) return respond(sock, 431, json("headers_too_large"))
+                    val idx = line.indexOf(':')
+                    if (idx <= 0) continue
+                    val key = line.substring(0, idx).trim().lowercase()
+                    val value = line.substring(idx + 1).trim()
+                    when (key) {
+                        "content-length" -> contentLength = value.toIntOrNull() ?: 0
+                        "x-from" -> from = value.take(80)
+                        "x-name" -> fromName = value.take(80)
+                    }
+                }
+
+                when {
+                    method == "GET" && (path == "/" || path.startsWith("/?")) ->
+                        respondHtml(sock, profilePage())
+                    method == "POST" && path == "/hello" -> {
+                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receiveHello(String(body, Charsets.UTF_8))
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    method == "POST" && path == "/flare" -> {
+                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receiveFlare(String(body, Charsets.UTF_8))
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    method == "POST" && path == "/photo" -> {
+                        if (contentLength !in 1..MAX_PHOTO_BYTES) return respond(sock, 413, json("too_large"))
+                        if (!from.startsWith("npub1")) return respond(sock, 400, json("bad_request"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receivePhoto(from, fromName, body)
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    else -> respond(sock, 404, json("not_found"))
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "request failed: $e")
+            }
+        }
+    }
+
+    /** A peer that scanned OUR QR announces itself — mutual pairing. */
+    private fun receiveHello(body: String) {
+        val o = try {
+            JSONObject(body)
+        } catch (_: Exception) {
+            return
+        }
+        val from = o.optString("from")
+        val ula = o.optString("ula")
+        if (!from.startsWith("npub1") || !ula.startsWith("fd")) return
+        if (from == identityNpub) return
+        val peer = PartyPeer(
+            npub = from.take(80),
+            ula = ula.take(64),
+            name = o.optString("name").take(24).ifBlank { "Phone" },
+            ip = o.optString("ip").take(40),
+            port = o.optInt("port", 0),
+        )
+        onHello?.invoke(peer)
+        // Seed the conversation so the chat has a visible entry on this side.
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = peer.npub,
+                fromMe = false,
+                name = peer.name,
+                text = "👋 ${peer.name} joined the party",
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun receiveFlare(body: String) {
+        val o = try {
+            JSONObject(body)
+        } catch (_: Exception) {
+            return
+        }
+        val from = o.optString("from")
+        if (!from.startsWith("npub1")) return
+        val text = o.optString("text").take(MAX_TEXT_CHARS)
+        if (text.isBlank()) return
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = from,
+                fromMe = false,
+                name = o.optString("name").take(80).ifBlank { "Phone" },
+                text = text,
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun receivePhoto(from: String, fromName: String, bytes: ByteArray) {
+        // Server-generated filename — the sender never controls the path.
+        val dir = photoDir ?: return
+        val file = File(dir, "${UUID.randomUUID()}.jpg")
+        file.writeBytes(bytes)
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = from,
+                fromMe = false,
+                name = fromName.ifBlank { "Phone" },
+                photoPath = file.absolutePath,
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun profilePage(): String {
+        val npub = identityNpub
+        val name = identityName
+        return """
+            <!doctype html><html><head><meta charset="utf-8">
+            <meta name="viewport" content="width=device-width,initial-scale=1">
+            <title>$name — on the mesh</title>
+            <style>
+              body{background:#0a0a0a;color:#eee;font-family:monospace;
+                   display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
+              .card{border:1px solid rgba(255,255,255,.12);border-radius:20px;padding:32px;
+                    max-width:560px;background:rgba(255,255,255,.04)}
+              h1{color:#f7931a;margin:0 0 8px;font-size:22px}
+              .npub{word-break:break-all;color:#888;font-size:12px;margin:12px 0}
+              p{line-height:1.5}
+            </style></head><body><div class="card">
+            <h1>⚡ $name</h1>
+            <div class="npub">$npub</div>
+            <p>This page is being served <b>by a phone</b>, addressed by its
+            cryptographic identity over the FIPS mesh.</p>
+            <p>No port forwarding. No DNS. No certificate authority. No cloud.
+            The key <i>is</i> the address — and the transport underneath can be
+            5G, WiFi, or a hotspot with no internet at all.</p>
+            </div></body></html>
+        """.trimIndent()
+    }
+
+    // ── tiny HTTP plumbing ──────────────────────────────────────────────────
+
+    /** Read one CRLF-terminated header line as ISO-8859-1; null on EOF. */
+    private fun readLine(input: InputStream): String? {
+        val sb = StringBuilder()
+        while (true) {
+            val b = input.read()
+            if (b == -1) return if (sb.isEmpty()) null else sb.toString()
+            if (b == '\n'.code) return sb.toString().trimEnd('\r')
+            sb.append(b.toChar())
+            if (sb.length > MAX_HEADER_BYTES) return null
+        }
+    }
+
+    private fun readExactly(input: InputStream, length: Int): ByteArray? {
+        val buf = ByteArray(length)
+        var off = 0
+        while (off < length) {
+            val n = input.read(buf, off, length - off)
+            if (n == -1) return null
+            off += n
+        }
+        return buf
+    }
+
+    private fun json(code: String) = """{"error":{"code":"$code","message":"request rejected"}}"""
+
+    private fun respond(sock: Socket, status: Int, body: String) =
+        writeResponse(sock, status, "application/json", body.toByteArray(Charsets.UTF_8))
+
+    private fun respondHtml(sock: Socket, body: String) =
+        writeResponse(sock, 200, "text/html; charset=utf-8", body.toByteArray(Charsets.UTF_8))
+
+    private fun writeResponse(sock: Socket, status: Int, contentType: String, body: ByteArray) {
+        val reason = when (status) {
+            200 -> "OK"; 400 -> "Bad Request"; 404 -> "Not Found"
+            413 -> "Payload Too Large"; 431 -> "Headers Too Large"
+            else -> "Error"
+        }
+        val head = "HTTP/1.1 $status $reason\r\n" +
+            "Content-Type: $contentType\r\n" +
+            "Content-Length: ${body.size}\r\n" +
+            "Connection: close\r\n\r\n"
+        sock.getOutputStream().apply {
+            write(head.toByteArray(Charsets.ISO_8859_1))
+            write(body)
+            flush()
+        }
+    }
+}
+
+/** Outbound flares: plain HTTP to the peer's ULA — FIPS encrypts underneath. */
+object FlareClient {
+    // Connect timeout must outlive cold mesh-session establishment (~15s via
+    // the public tree); the attempt itself drives
+    // session setup, same trick as the VPN service's session warmer.
+    private val http = OkHttpClient.Builder()
+        .connectTimeout(25, TimeUnit.SECONDS)
+        .readTimeout(15, TimeUnit.SECONDS)
+        .writeTimeout(60, TimeUnit.SECONDS)
+        .build()
+
+    private fun base(peer: PartyPeer) = "http://[${peer.ula}]:${PartyQr.FLARE_PORT}"
+
+    /** Announce myself to a freshly scanned peer so pairing becomes MUTUAL —
+     *  their phone gets me as a peer + a chat entry without scanning back.
+     *  Blocking — call from Dispatchers.IO. */
+    fun sendHello(
+        peer: PartyPeer,
+        myNpub: String,
+        myName: String,
+        myUla: String,
+        myIp: String?,
+        myPort: Int,
+    ): Boolean = try {
+        val body = JSONObject()
+            .put("from", myNpub)
+            .put("name", myName)
+            .put("ula", myUla)
+            .put("ip", myIp ?: "")
+            .put("port", if (myIp != null) myPort else 0)
+            .toString()
+            .toRequestBody("application/json".toMediaType())
+        http.newCall(
+            Request.Builder().url("${base(peer)}/hello").post(body).build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+
+    /** Blocking — call from Dispatchers.IO. */
+    fun sendText(peer: PartyPeer, myNpub: String, myName: String, text: String): Boolean = try {
+        val body = JSONObject()
+            .put("from", myNpub)
+            .put("name", myName)
+            .put("text", text)
+            .put("ts", System.currentTimeMillis())
+            .toString()
+            .toRequestBody("application/json".toMediaType())
+        http.newCall(
+            Request.Builder().url("${base(peer)}/flare").post(body).build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+
+    /** Blocking — call from Dispatchers.IO. */
+    fun sendPhoto(peer: PartyPeer, myNpub: String, myName: String, jpeg: ByteArray): Boolean = try {
+        http.newCall(
+            Request.Builder()
+                .url("${base(peer)}/photo")
+                .header("X-From", myNpub)
+                .header("X-Name", myName)
+                .post(jpeg.toRequestBody("image/jpeg".toMediaType()))
+                .build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/PartyQr.kt

@@ -0,0 +1,102 @@
+package com.archipelago.app.fips
+
+import android.net.Uri
+import java.net.Inet4Address
+import java.net.NetworkInterface
+
+/**
+ * Phone↔phone mesh pairing ("Mesh Party") QR contract:
+ *
+ *   archipelago://party?v=1&npub=<npub>&ula=<fd..>&name=<name>[&ip=<v4>&port=<udp>]
+ *
+ * npub + ula alone are enough to chat *through* the mesh (anchors route by
+ * node address, no underlay info needed). ip/port are present only while the
+ * showing phone has its inbound UDP listener up (party mode) — the scanner
+ * then also gets a direct-dial link that works on a shared LAN/hotspot with
+ * no internet at all. Same versioning stance as the node pairing QR
+ * (docs/companion-pairing-qr.md): unknown params tolerated under v=1.
+ */
+data class PartyPeer(
+    val npub: String,
+    val ula: String,
+    val name: String,
+    /** Direct-dial underlay endpoint; empty when the peer wasn't listening. */
+    val ip: String = "",
+    val port: Int = 0,
+)
+
+object PartyQr {
+    const val SCHEME_HOST = "party"
+    private const val SUPPORTED_MAJOR = 1
+
+    /** UDP port a party-mode phone listens on (matches the node's mesh port). */
+    const val PARTY_UDP_PORT = 2121
+
+    /** Application-layer chat/beam port, bound only on the mesh ULA. */
+    const val FLARE_PORT = 5680
+
+    fun build(npub: String, ula: String, name: String, ip: String?, port: Int): String {
+        val b = Uri.Builder()
+            .scheme("archipelago")
+            .authority(SCHEME_HOST)
+            .appendQueryParameter("v", "1")
+            .appendQueryParameter("npub", npub)
+            .appendQueryParameter("ula", ula)
+            .appendQueryParameter("name", name)
+        if (!ip.isNullOrBlank() && port > 0) {
+            b.appendQueryParameter("ip", ip)
+            b.appendQueryParameter("port", port.toString())
+        }
+        return b.build().toString()
+    }
+
+    /** Null when [raw] is not a valid party QR (foreign codes just keep scanning). */
+    fun parse(raw: String): PartyPeer? {
+        val uri = try {
+            Uri.parse(raw.trim())
+        } catch (_: Exception) {
+            return null
+        }
+        if (!"archipelago".equals(uri.scheme, ignoreCase = true)) return null
+        if (uri.isOpaque || !SCHEME_HOST.equals(uri.host, ignoreCase = true)) return null
+        val major = uri.getQueryParameter("v")?.takeWhile { it.isDigit() }?.toIntOrNull() ?: return null
+        if (major != SUPPORTED_MAJOR) return null
+
+        val npub = uri.getQueryParameter("npub")?.trim().orEmpty()
+        val ula = uri.getQueryParameter("ula")?.trim().orEmpty()
+        if (!npub.startsWith("npub1") || !ula.startsWith("fd")) return null
+        return PartyPeer(
+            npub = npub,
+            ula = ula,
+            name = uri.getQueryParameter("name")?.trim().orEmpty().ifBlank { "Phone" },
+            ip = uri.getQueryParameter("ip")?.trim().orEmpty(),
+            port = uri.getQueryParameter("port")?.toIntOrNull() ?: 0,
+        )
+    }
+
+    /**
+     * This phone's private IPv4 on WiFi or its own hotspot, for the QR's
+     * direct-dial hint. Hotspot interfaces (ap/swlan/softap) win over wlan so
+     * the hotspot-host phone advertises the address its guests can reach.
+     */
+    fun localWifiIpv4(): String? {
+        val candidates = mutableListOf<Pair<String, String>>() // ifname → addr
+        try {
+            for (nif in NetworkInterface.getNetworkInterfaces()) {
+                if (!nif.isUp || nif.isLoopback) continue
+                for (addr in nif.inetAddresses) {
+                    if (addr is Inet4Address && addr.isSiteLocalAddress) {
+                        candidates += nif.name to addr.hostAddress.orEmpty()
+                    }
+                }
+            }
+        } catch (_: Exception) {
+            return null
+        }
+        val hotspot = candidates.firstOrNull {
+            it.first.startsWith("ap") || it.first.startsWith("swlan") || it.first.startsWith("softap")
+        }
+        return (hotspot ?: candidates.firstOrNull { it.first.startsWith("wlan") } ?: candidates.firstOrNull())
+            ?.second
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/GamepadLayout.kt

@@ -38,7 +38,7 @@ import com.archipelago.app.ui.theme.neoRaised
 @Composable
 fun GamepadLayout(
     onKey: (String) -> Unit,
-    onTwoFingerHold: () -> Unit,
+    onThreeFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     val surface = Neo.surface()
@@ -54,9 +54,9 @@ fun GamepadLayout(
                     do {
                         val ev = awaitPointerEvent()
                         val a = ev.changes.filter { !it.changedToUp() }
-                        if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
-                        if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onTwoFingerHold() }
-                        if (a.size < 2) t = 0L
+                        if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
+                        if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onThreeFingerHold() }
+                        if (a.size < 3) t = 0L
                     } while (ev.changes.any { it.pressed })
                 }
             }

Android/app/src/main/java/com/archipelago/app/ui/components/GestureHintOverlay.kt

@@ -0,0 +1,147 @@
+package com.archipelago.app.ui.components
+
+import androidx.compose.animation.core.LinearEasing
+import androidx.compose.animation.core.RepeatMode
+import androidx.compose.animation.core.animateFloat
+import androidx.compose.animation.core.infiniteRepeatable
+import androidx.compose.animation.core.rememberInfiniteTransition
+import androidx.compose.animation.core.tween
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.offset
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.remember
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.draw.scale
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import com.archipelago.app.R
+import com.archipelago.app.ui.theme.BitcoinOrange
+import kotlinx.coroutines.delay
+
+/**
+ * First-launch teaching overlay for the three-finger hold gesture. Three
+ * fingertip dots pulse in a "press" rhythm with an expanding ring while a
+ * short caption explains what the gesture opens. Dismissed by tapping
+ * anywhere (or automatically after a few seconds) — shown once, ever.
+ */
+@Composable
+fun GestureHintOverlay(onDismiss: () -> Unit) {
+    // Auto-dismiss so a user who taps nothing is never stuck behind the scrim.
+    LaunchedEffect(Unit) {
+        delay(6500)
+        onDismiss()
+    }
+
+    val transition = rememberInfiniteTransition(label = "gesture-hint")
+    // Fingertips press down together…
+    val press by transition.animateFloat(
+        initialValue = 1f,
+        targetValue = 0.86f,
+        animationSpec = infiniteRepeatable(tween(650), RepeatMode.Reverse),
+        label = "press",
+    )
+    // …while a ring ripples outward on each press cycle.
+    val ripple by transition.animateFloat(
+        initialValue = 0f,
+        targetValue = 1f,
+        animationSpec = infiniteRepeatable(tween(1300, easing = LinearEasing)),
+        label = "ripple",
+    )
+
+    Box(
+        modifier = Modifier
+            .fillMaxSize()
+            .background(Color.Black.copy(alpha = 0.72f))
+            .clickable(
+                interactionSource = remember { MutableInteractionSource() },
+                indication = null,
+                onClick = onDismiss,
+            ),
+        contentAlignment = Alignment.Center,
+    ) {
+        Column(horizontalAlignment = Alignment.CenterHorizontally) {
+            // Hand: three fingertip dots in a natural arc + ripple ring.
+            Box(Modifier.size(160.dp), contentAlignment = Alignment.Center) {
+                Box(
+                    Modifier
+                        .size(150.dp)
+                        .scale(0.4f + ripple * 0.6f)
+                        .border(
+                            2.dp,
+                            BitcoinOrange.copy(alpha = (1f - ripple) * 0.8f),
+                            CircleShape,
+                        ),
+                )
+                FingerDot(x = (-44).dp, y = 14.dp, scale = press)
+                FingerDot(x = 0.dp, y = (-12).dp, scale = press)
+                FingerDot(x = 44.dp, y = 8.dp, scale = press)
+            }
+
+            Spacer(Modifier.height(28.dp))
+
+            Text(
+                text = stringResource(R.string.gesture_hint_title),
+                style = MaterialTheme.typography.headlineSmall,
+                fontWeight = FontWeight.Bold,
+                color = Color.White,
+                textAlign = TextAlign.Center,
+            )
+            Spacer(Modifier.height(10.dp))
+            Text(
+                text = stringResource(R.string.gesture_hint_body),
+                style = MaterialTheme.typography.bodyMedium,
+                color = Color.White.copy(alpha = 0.7f),
+                textAlign = TextAlign.Center,
+                modifier = Modifier.padding(horizontal = 48.dp),
+            )
+
+            Spacer(Modifier.height(32.dp))
+
+            Box(
+                modifier = Modifier
+                    .clip(RoundedCornerShape(12.dp))
+                    .background(Color.White.copy(alpha = 0.12f))
+                    .clickable(onClick = onDismiss)
+                    .padding(horizontal = 28.dp, vertical = 12.dp),
+            ) {
+                Text(
+                    text = stringResource(R.string.gesture_hint_got_it),
+                    style = MaterialTheme.typography.labelLarge,
+                    color = Color.White,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun FingerDot(x: androidx.compose.ui.unit.Dp, y: androidx.compose.ui.unit.Dp, scale: Float) {
+    Box(
+        Modifier
+            .offset(x = x, y = y)
+            .size(26.dp)
+            .scale(scale)
+            .background(Color.White.copy(alpha = 0.92f), CircleShape),
+    )
+}

Android/app/src/main/java/com/archipelago/app/ui/components/MeshLoadingScreen.kt

@@ -0,0 +1,77 @@
+package com.archipelago.app.ui.components
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.size
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.ui.screens.PixelArtLogo
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceBlack
+import com.archipelago.app.ui.theme.TextMuted
+
+/**
+ * The branded "F*CK IPs" full-screen loader — shown whenever the app is
+ * dialing the node over the mesh (relaunch race, post-scan first connect),
+ * instead of an anonymous spinner. The point of the brand: what's loading
+ * is a connection to a cryptographic identity, not an IP.
+ */
+@Composable
+fun MeshLoadingScreen(message: String = "Dialing your node by its key — no IPs harmed") {
+    Box(
+        Modifier
+            .fillMaxSize()
+            .background(SurfaceBlack),
+        contentAlignment = Alignment.Center,
+    ) {
+        Column(horizontalAlignment = Alignment.CenterHorizontally) {
+            // The brand's circle-container logo (as on the connect screen /
+            // web login): pixel-art "a" centered in a black disc.
+            Box(
+                Modifier
+                    .size(120.dp)
+                    .clip(androidx.compose.foundation.shape.CircleShape)
+                    .background(Color.Black)
+                    .border(
+                        1.dp,
+                        Color.White.copy(alpha = 0.14f),
+                        androidx.compose.foundation.shape.CircleShape,
+                    ),
+                contentAlignment = Alignment.Center,
+            ) {
+                PixelArtLogo(Modifier.size(64.dp))
+            }
+            Spacer(Modifier.height(20.dp))
+            Text(
+                text = "F*CK IPs MESH",
+                color = BitcoinOrange,
+                fontSize = 18.sp,
+                fontWeight = FontWeight.Bold,
+                letterSpacing = 4.sp,
+            )
+            Spacer(Modifier.height(8.dp))
+            Text(
+                text = message,
+                color = TextMuted,
+                fontSize = 13.sp,
+                textAlign = TextAlign.Center,
+            )
+            Spacer(Modifier.height(24.dp))
+            CircularProgressIndicator(color = BitcoinOrange)
+        }
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/NESController.kt

@@ -23,6 +23,7 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Palette
 import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material3.Icon
 import androidx.compose.material3.Text
@@ -108,6 +109,7 @@ fun NESController(
     onKey: (String) -> Unit,
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
+    onToggleStyle: (() -> Unit)? = null,
     modifier: Modifier = Modifier,
 ) {
     val c = paletteFor(style)
@@ -116,7 +118,7 @@ fun NESController(
     Box(
         modifier = modifier
             .fillMaxSize()
-            .twoFingerHold(onMenu)
+            .threeFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -205,6 +207,7 @@ fun NESController(
                 ) {
                     PlayerPill(c, playerId, onPlayerToggle)
                     SettingsBtn(c, Modifier, onMenu)
+                    onToggleStyle?.let { StyleBtn(c, Modifier, it) }
                 }
             }
         }
@@ -431,6 +434,23 @@ fun SettingsBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Uni
     }
 }
 
+/** Dark/Classic style toggle — lives next to the settings gear (the menu hub
+ *  no longer carries it). */
+@Composable
+fun StyleBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Unit) {
+    var p by remember { mutableStateOf(false) }
+    Box(
+        modifier = modifier
+            .size(48.dp)
+            .clip(CircleShape)
+            .background(if (p) c.capsulePress else c.capsule)
+            .pointerInput(Unit) { detectTapGestures(onPress = { p = true; onClick(); tryAwaitRelease(); p = false }) },
+        contentAlignment = Alignment.Center,
+    ) {
+        Icon(Icons.Default.Palette, "Controller style", Modifier.size(26.dp), tint = c.labelMuted)
+    }
+}
+
 /** Player ID toggle pill (P1/P2/ALL) */
 @Composable
 fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {
@@ -451,17 +471,17 @@ fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {
     }
 }
 
-/** Two-finger hold gesture modifier */
-fun Modifier.twoFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
+/** Three-finger hold gesture modifier (two fingers stay free for scrolling) */
+fun Modifier.threeFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
     awaitEachGesture {
         awaitFirstDown(requireUnconsumed = false)
         var t = 0L; var fired = false
         do {
             val ev = awaitPointerEvent()
             val a = ev.changes.filter { !it.changedToUp() }
-            if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
-            if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
-            if (a.size < 2) t = 0L
+            if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
+            if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
+            if (a.size < 3) t = 0L
         } while (ev.changes.any { it.pressed })
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESMenu.kt

@@ -21,20 +21,40 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.filled.Bolt
+import androidx.compose.material.icons.filled.Dashboard
+import androidx.compose.material.icons.filled.Dns
+import androidx.compose.material.icons.filled.Groups
+import androidx.compose.material.icons.filled.Keyboard
+import androidx.compose.material.icons.filled.SportsEsports
+import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.QrCodeScanner
 import androidx.compose.material3.Icon
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.OutlinedTextFieldDefaults
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalClipboardManager
+import androidx.compose.ui.platform.LocalConfiguration
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.AnnotatedString
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.fips.FipsNative
+import com.archipelago.app.fips.FipsPreferences
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
@@ -51,7 +71,6 @@ import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.ControllerStyle
 import com.archipelago.app.ui.theme.SurfaceDark
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
@@ -75,26 +94,29 @@ fun NESMenu(
     visible: Boolean,
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
-    isGamepadMode: Boolean,
-    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)? = null,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onToggleMode: () -> Unit,
-    onToggleStyle: () -> Unit,
+    onRemote: () -> Unit,
+    onKeyboard: () -> Unit,
     onBackToWebView: (() -> Unit)? = null,
+    onMeshParty: (() -> Unit)? = null,
 ) {
     AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
+        // Contained hub overlay: a centred glass panel (not full-screen) that
+        // holds the card page and its sub-pages (Nodes, FIPS) and scrolls
+        // inside its own bounds when content is tall. Tapping the dimmed
+        // backdrop dismisses.
         Box(
             Modifier.fillMaxSize().background(Color.Black.copy(alpha = 0.7f))
                 .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) { onDismiss() },
             contentAlignment = Alignment.Center,
         ) {
             AnimatedVisibility(visible = visible, enter = fadeIn() + scaleIn(initialScale = 0.95f), exit = fadeOut() + scaleOut(targetScale = 0.95f)) {
-                MenuPanel(servers, activeServer, isGamepadMode, controllerStyle, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onToggleMode, onToggleStyle, onBackToWebView)
+                MenuPanel(servers, activeServer, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onRemote, onKeyboard, onBackToWebView, onMeshParty)
             }
         }
     }
@@ -104,17 +126,16 @@ fun NESMenu(
 private fun MenuPanel(
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
-    isGamepadMode: Boolean,
-    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)?,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onToggleMode: () -> Unit,
-    onToggleStyle: () -> Unit,
+    onRemote: () -> Unit,
+    onKeyboard: () -> Unit,
     onBackToWebView: (() -> Unit)?,
+    onMeshParty: (() -> Unit)?,
 ) {
     var showAdd by remember { mutableStateOf(false) }
     // The saved server being edited, or null when adding a new one.
@@ -122,14 +143,15 @@ private fun MenuPanel(
     var nm by remember { mutableStateOf("") }
     var addr by remember { mutableStateOf("") }
     var pwd by remember { mutableStateOf("") }
+    var https by remember { mutableStateOf(false) }
 
     fun resetForm() {
-        nm = ""; addr = ""; pwd = ""; showAdd = false; editing = null
+        nm = ""; addr = ""; pwd = ""; https = false; showAdd = false; editing = null
     }
 
     fun startEdit(server: ServerEntry) {
         editing = server
-        nm = server.name; addr = server.address; pwd = server.password
+        nm = server.name; addr = server.address; pwd = server.password; https = server.useHttps
         showAdd = false
     }
 
@@ -137,156 +159,381 @@ private fun MenuPanel(
         if (addr.isBlank()) return
         val orig = editing
         if (orig != null) {
-            // Preserve fields the compact form doesn't expose (scheme, port).
-            onEditServer(orig, orig.copy(address = addr, password = pwd, name = nm))
+            // Preserve port (compact form doesn't expose it); scheme is now editable.
+            onEditServer(orig, orig.copy(address = addr, useHttps = https, password = pwd, name = nm))
         } else {
-            onAddServer(ServerEntry(addr, false, password = pwd, name = nm))
+            onAddServer(ServerEntry(addr, https, password = pwd, name = nm))
         }
         resetForm()
     }
 
+    var page by remember { mutableStateOf(HubPage.HUB) }
+
     Column(
         modifier = Modifier
             .widthIn(max = 420.dp)
+            .fillMaxWidth()
             .padding(horizontal = 20.dp)
+            // Cap height just short of the full screen; the panel wraps short
+            // content and only scrolls in the rare case it outgrows this.
+            .heightIn(max = (LocalConfiguration.current.screenHeightDp * 0.92f).dp)
             .clip(RoundedCornerShape(PANEL_R))
-            .background(PanelBg)
+            .background(PanelBg.copy(alpha = 0.86f))
             .border(1.dp, PanelBorder, RoundedCornerShape(PANEL_R))
             .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) {}
-            .padding(22.dp),
-        verticalArrangement = Arrangement.spacedBy(10.dp),
+            .verticalScroll(rememberScrollState())
+            .padding(20.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
     ) {
-        // Title
-        Text(
-            "Menu",
-            color = TextPrimary,
-            fontSize = 18.sp,
-            fontWeight = FontWeight.SemiBold,
-            letterSpacing = 2.sp,
-            modifier = Modifier.fillMaxWidth(),
-            textAlign = TextAlign.Center,
-        )
-        Spacer(Modifier.height(2.dp))
-
-        // Servers
-        servers.forEach { server ->
-            val active = server.serialize() == activeServer?.serialize()
-            MenuItem(
-                label = server.displayName(),
-                selected = active,
-                onClick = { onSelectServer(server) },
-                onEdit = { startEdit(server) },
-                onRemove = { onRemoveServer(server) },
-            )
-        }
-
-        if (servers.isEmpty()) {
-            Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
-        }
-
-        // Add / edit server
-        if (showAdd || editing != null) {
-            Column(
-                Modifier
-                    .fillMaxWidth()
-                    .clip(RoundedCornerShape(ROW_R))
-                    .background(FieldBg)
-                    .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                    .padding(12.dp),
-                verticalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                Row(
-                    Modifier.fillMaxWidth(),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
+        // Header: back (on sub-pages) or title, and a close on the hub.
+        Row(
+            Modifier.fillMaxWidth(),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.SpaceBetween,
+        ) {
+            if (page == HubPage.HUB) {
+                Text("Menu", color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 2.sp)
+                IconRound(Icons.Default.Close, "Close") { onDismiss() }
+            } else {
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    IconRound(Icons.AutoMirrored.Filled.ArrowBack, "Back") { resetForm(); page = HubPage.HUB }
+                    Spacer(Modifier.width(12.dp))
                     Text(
-                        if (editing != null) "Edit Server" else "Add Server",
-                        color = TextMuted,
-                        fontSize = 13.sp,
-                        letterSpacing = 1.sp,
-                        fontWeight = FontWeight.Medium,
-                    )
-                    Text(
-                        "Cancel",
-                        color = TextMuted,
-                        fontSize = 13.sp,
-                        modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
+                        if (page == HubPage.NODES) "Nodes" else "FIPS Mesh",
+                        color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 1.sp,
                     )
                 }
-                GlassField(
-                    value = nm, onValueChange = { nm = it },
-                    placeholder = "Name (optional)",
-                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
-                )
-                GlassField(
-                    value = addr, onValueChange = { addr = it.trim() },
-                    placeholder = "192.168.1.100",
-                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
-                )
-                Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
-                    GlassField(
-                        value = pwd, onValueChange = { pwd = it },
-                        placeholder = "Password",
-                        modifier = Modifier.weight(1f),
-                        visualTransformation = PasswordVisualTransformation(),
-                        keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
-                        keyboardActions = KeyboardActions(onGo = { submit() }),
-                    )
-                    Box(
-                        Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
-                            .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
-                            .clickable { submit() },
-                        contentAlignment = Alignment.Center,
-                    ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
-                }
+                IconRound(Icons.Default.Close, "Close") { onDismiss() }
             }
-        } else {
-            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
-                Box(Modifier.weight(1f)) {
-                    MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
+        }
+        Spacer(Modifier.height(4.dp))
+
+        when (page) {
+            HubPage.HUB -> {
+                // Card page — one card per destination. Dashboard first: it's a
+                // peer of the others so three-finger → hub → Dashboard returns
+                // to the node UI, same shape as every other option.
+                if (onBackToWebView != null) {
+                    HubCard(Icons.Default.Dashboard, "Dashboard", "The node's web interface") { onBackToWebView() }
                 }
-                if (onScanQr != null) {
-                    // Add server by scanning the node's pairing QR
-                    Box(
+                HubCard(Icons.Default.SportsEsports, "Remote", "Game controller for the node") { onRemote() }
+                HubCard(Icons.Default.Keyboard, "Keyboard", "Type into the node") { onKeyboard() }
+                HubCard(Icons.Default.Dns, "Nodes", activeServer?.displayName() ?: "Add or switch servers") {
+                    page = HubPage.NODES
+                }
+                if (FipsNative.available) {
+                    HubCard(Icons.Default.Bolt, "FIPS Mesh", "Mesh identity & status") { page = HubPage.FIPS }
+                }
+                if (onMeshParty != null) {
+                    HubCard(Icons.Default.Groups, "Mesh Party", "Phone-to-phone chat & beam") { onMeshParty() }
+                }
+                // Dark/Classic style lives on the remote/keyboard screen next to
+                // the settings button — not here.
+            }
+
+            HubPage.NODES -> {
+                servers.forEach { server ->
+                    val active = server.serialize() == activeServer?.serialize()
+                    MenuItem(
+                        label = server.displayName(),
+                        selected = active,
+                        onClick = { onSelectServer(server) },
+                        onEdit = { startEdit(server) },
+                        onRemove = { onRemoveServer(server) },
+                    )
+                }
+                if (servers.isEmpty()) {
+                    Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
+                }
+
+                if (showAdd || editing != null) {
+                    Column(
                         Modifier
-                            .size(ROW_H)
+                            .fillMaxWidth()
                             .clip(RoundedCornerShape(ROW_R))
-                            .background(RowBg)
+                            .background(FieldBg)
                             .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                            .clickable { onScanQr() },
-                        contentAlignment = Alignment.Center,
+                            .padding(12.dp),
+                        verticalArrangement = Arrangement.spacedBy(8.dp),
                     ) {
-                        Icon(
-                            Icons.Default.QrCodeScanner,
-                            contentDescription = stringResource(R.string.add_server_qr),
-                            tint = BitcoinOrange,
-                            modifier = Modifier.size(24.dp),
+                        Row(
+                            Modifier.fillMaxWidth(),
+                            verticalAlignment = Alignment.CenterVertically,
+                            horizontalArrangement = Arrangement.SpaceBetween,
+                        ) {
+                            Text(
+                                if (editing != null) "Edit Server" else "Add Server",
+                                color = TextMuted, fontSize = 13.sp, letterSpacing = 1.sp, fontWeight = FontWeight.Medium,
+                            )
+                            Text(
+                                "Cancel", color = TextMuted, fontSize = 13.sp,
+                                modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
+                            )
+                        }
+                        GlassField(
+                            value = nm, onValueChange = { nm = it },
+                            placeholder = "Name (optional)",
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
                         )
+                        GlassField(
+                            value = addr, onValueChange = { addr = it.trim() },
+                            placeholder = "192.168.1.100",
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
+                        )
+                        Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
+                            GlassField(
+                                value = pwd, onValueChange = { pwd = it },
+                                placeholder = "Password",
+                                modifier = Modifier.weight(1f),
+                                visualTransformation = PasswordVisualTransformation(),
+                                keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
+                                keyboardActions = KeyboardActions(onGo = { submit() }),
+                            )
+                            Box(
+                                Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
+                                    .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+                                    .clickable { submit() },
+                                contentAlignment = Alignment.Center,
+                            ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
+                        }
+                        // HTTPS scheme toggle (available on both add and edit).
+                        Row(
+                            Modifier
+                                .fillMaxWidth()
+                                .clip(RoundedCornerShape(ROW_R))
+                                .clickable { https = !https }
+                                .padding(vertical = 2.dp),
+                            verticalAlignment = Alignment.CenterVertically,
+                            horizontalArrangement = Arrangement.SpaceBetween,
+                        ) {
+                            Text("Use HTTPS", color = TextMuted, fontSize = 13.sp)
+                            Box(
+                                Modifier
+                                    .width(46.dp).height(26.dp)
+                                    .clip(RoundedCornerShape(13.dp))
+                                    .background(if (https) BitcoinOrange.copy(alpha = 0.9f) else RowBg)
+                                    .border(1.dp, if (https) BitcoinOrange else RowBorder, RoundedCornerShape(13.dp)),
+                                contentAlignment = if (https) Alignment.CenterEnd else Alignment.CenterStart,
+                            ) {
+                                Box(
+                                    Modifier
+                                        .padding(horizontal = 3.dp)
+                                        .size(20.dp)
+                                        .clip(RoundedCornerShape(10.dp))
+                                        .background(if (https) Color.White else TextMuted),
+                                )
+                            }
+                        }
+                    }
+                } else {
+                    Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
+                        Box(Modifier.weight(1f)) {
+                            MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
+                        }
+                        if (onScanQr != null) {
+                            Box(
+                                Modifier
+                                    .size(ROW_H)
+                                    .clip(RoundedCornerShape(ROW_R))
+                                    .background(RowBg)
+                                    .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
+                                    .clickable { onScanQr() },
+                                contentAlignment = Alignment.Center,
+                            ) {
+                                Icon(
+                                    Icons.Default.QrCodeScanner,
+                                    contentDescription = stringResource(R.string.add_server_qr),
+                                    tint = BitcoinOrange,
+                                    modifier = Modifier.size(24.dp),
+                                )
+                            }
+                        }
                     }
                 }
             }
+
+            HubPage.FIPS -> {
+                FipsSection(embedded = true)
+            }
         }
+    }
+}
 
-        Spacer(Modifier.height(2.dp))
-        Box(Modifier.fillMaxWidth().height(1.dp).background(PanelBorder))
-        Spacer(Modifier.height(2.dp))
+private enum class HubPage { HUB, NODES, FIPS }
 
-        // Mode toggle
-        MenuItem(
-            label = if (isGamepadMode) "Switch to Keyboard" else "Switch to Gamepad",
-            onClick = onToggleMode,
+/** Big tappable destination card for the hub page: icon + title + subtitle. */
+@Composable
+private fun HubCard(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    title: String,
+    subtitle: String,
+    onClick: () -> Unit,
+) {
+    Row(
+        Modifier
+            .fillMaxWidth()
+            .clip(RoundedCornerShape(ROW_R))
+            .background(RowBg)
+            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
+            .clickable { onClick() }
+            .padding(16.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(14.dp),
+    ) {
+        Box(
+            Modifier.size(40.dp).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.14f)),
+            contentAlignment = Alignment.Center,
+        ) {
+            Icon(icon, contentDescription = title, tint = BitcoinOrange, modifier = Modifier.size(22.dp))
+        }
+        Column(Modifier.weight(1f)) {
+            Text(title, color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold)
+            Text(subtitle, color = TextMuted, fontSize = 12.sp, maxLines = 1)
+        }
+    }
+}
+
+/** Small circular icon button used in the hub header. */
+@Composable
+private fun IconRound(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    desc: String,
+    onClick: () -> Unit,
+) {
+    Box(
+        Modifier
+            .size(40.dp)
+            .clip(RoundedCornerShape(20.dp))
+            .background(RowBg)
+            .border(1.dp, RowBorder, RoundedCornerShape(20.dp))
+            .clickable { onClick() },
+        contentAlignment = Alignment.Center,
+    ) {
+        Icon(icon, contentDescription = desc, tint = TextPrimary, modifier = Modifier.size(20.dp))
+    }
+}
+
+/** Snapshot of the phone's mesh identity + state for the FIPS menu section. */
+private data class FipsInfo(
+    val available: Boolean,
+    val running: Boolean,
+    val npub: String,
+    val meshAddress: String,
+    val peerCount: Int,
+)
+
+/**
+ * FIPS mesh oversight: shows what the phone's embedded mesh node is doing —
+ * running state, its mesh identity (npub), its mesh address (fd…ULA), how
+ * many peers/anchors it's configured with — and a one-tap Reconnect that
+ * re-homes the mesh (also the manual fix if a network handoff ever misses).
+ * Collapsed by default so the menu stays compact.
+ */
+@Composable
+private fun FipsSection(embedded: Boolean = false) {
+    if (!FipsNative.available) return
+    val context = LocalContext.current
+    val clipboard = LocalClipboardManager.current
+    var expanded by remember { mutableStateOf(embedded) }
+    var info by remember { mutableStateOf<FipsInfo?>(null) }
+
+    // Load identity/state when the section opens (cheap DataStore + JSON read).
+    LaunchedEffect(expanded) {
+        if (expanded && info == null) {
+            val prefs = FipsPreferences(context)
+            val id = prefs.identity()
+            val peers = runCatching {
+                org.json.JSONArray(prefs.peersJson()).length()
+            }.getOrDefault(0)
+            info = FipsInfo(
+                available = true,
+                running = FipsNative.isRunning(),
+                npub = id?.npub.orEmpty(),
+                meshAddress = id?.address.orEmpty(),
+                peerCount = peers,
+            )
+        }
+    }
+
+    Column(Modifier.fillMaxWidth()) {
+        // Embedded in the hub's FIPS sub-page the header row would duplicate
+        // the page title, so only the standalone (collapsible) form shows it.
+        if (!embedded) MenuItem(
+            label = "FIPS Mesh",
+            labelColor = BitcoinOrange,
+            onClick = { expanded = !expanded },
         )
+        if (expanded) {
+            val i = info
+            Column(
+                Modifier
+                    .fillMaxWidth()
+                    .padding(top = 6.dp)
+                    .clip(RoundedCornerShape(ROW_R))
+                    .background(FieldBg)
+                    .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
+                    .padding(14.dp),
+                verticalArrangement = Arrangement.spacedBy(10.dp),
+            ) {
+                if (i == null) {
+                    Text("Loading…", color = TextMuted, fontSize = 13.sp)
+                } else {
+                    FipsRow("Status", if (i.running) "Connected" else "Stopped",
+                        valueColor = if (i.running) BitcoinOrange else TextMuted)
+                    if (i.meshAddress.isNotBlank()) {
+                        FipsRow("Mesh address", i.meshAddress, mono = true,
+                            onCopy = { clipboard.setText(AnnotatedString(i.meshAddress)) })
+                    }
+                    if (i.npub.isNotBlank()) {
+                        FipsRow("Identity (npub)", i.npub, mono = true,
+                            onCopy = { clipboard.setText(AnnotatedString(i.npub)) })
+                    }
+                    FipsRow("Peers & anchors", i.peerCount.toString())
+                    Text(
+                        "Your node reaches this phone over the mesh by its npub — no ports opened to the internet.",
+                        color = TextMuted, fontSize = 11.sp,
+                    )
+                    MenuItem(
+                        label = "Reconnect mesh",
+                        labelColor = BitcoinOrange,
+                        onClick = {
+                            FipsManager.requestMeshRestart(context)
+                            info = null
+                            if (!embedded) expanded = false
+                        },
+                    )
+                }
+            }
+        }
+    }
+}
 
-        // Style toggle
-        MenuItem(
-            label = if (controllerStyle == ControllerStyle.CLASSIC) "Style: Classic" else "Style: Dark",
-            onClick = onToggleStyle,
+@Composable
+private fun FipsRow(
+    label: String,
+    value: String,
+    valueColor: Color = TextPrimary,
+    mono: Boolean = false,
+    onCopy: (() -> Unit)? = null,
+) {
+    Row(
+        Modifier
+            .fillMaxWidth()
+            .then(if (onCopy != null) Modifier.clickable { onCopy() } else Modifier),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.SpaceBetween,
+    ) {
+        Text(label, color = TextMuted, fontSize = 12.sp, modifier = Modifier.width(120.dp))
+        Text(
+            value,
+            color = valueColor,
+            fontSize = if (mono) 11.sp else 13.sp,
+            fontWeight = FontWeight.Medium,
+            modifier = Modifier.weight(1f),
+            textAlign = TextAlign.End,
         )
-
-        // Back to dashboard
-        if (onBackToWebView != null) {
-            MenuItem(label = "Back to Dashboard", onClick = onBackToWebView)
+        if (onCopy != null) {
+            Text("⧉", color = TextMuted, fontSize = 13.sp, modifier = Modifier.padding(start = 8.dp))
         }
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESPortraitController.kt

@@ -43,6 +43,7 @@ fun NESPortraitController(
     onMouseScroll: (Int) -> Unit = { _ -> },
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
+    onToggleStyle: (() -> Unit)? = null,
 ) {
     val c = paletteFor(style)
     val isClassic = style == ControllerStyle.CLASSIC
@@ -50,7 +51,7 @@ fun NESPortraitController(
     Box(
         Modifier
             .fillMaxSize()
-            .twoFingerHold(onMenu)
+            .threeFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -87,7 +88,7 @@ fun NESPortraitController(
                     onMove = { dx, dy -> onMouseMove(dx, dy) },
                     onClick = { onMouseClick(it) },
                     onScroll = { dy -> onMouseScroll(dy) },
-                    onTwoFingerHold = onMenu,
+                    onThreeFingerHold = onMenu,
                     modifier = Modifier
                         .fillMaxWidth()
                         .weight(1f),
@@ -151,6 +152,10 @@ fun NESPortraitController(
                     PlayerPill(c, playerId, onPlayerToggle)
                     Spacer(Modifier.width(10.dp))
                     SettingsBtn(c, Modifier, onMenu)
+                    onToggleStyle?.let {
+                        Spacer(Modifier.width(10.dp))
+                        StyleBtn(c, Modifier, it)
+                    }
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/components/QrScannerOverlay.kt

@@ -56,7 +56,6 @@ import androidx.compose.ui.viewinterop.AndroidView
 import androidx.core.content.ContextCompat
 import com.archipelago.app.R
 import com.archipelago.app.data.PairResult
-import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerQrParser
 import com.archipelago.app.ui.screens.GlassButton
 import com.archipelago.app.ui.theme.BitcoinOrange
@@ -82,7 +81,7 @@ import java.util.concurrent.Executors
 fun QrScannerOverlay(
     visible: Boolean,
     onDismiss: () -> Unit,
-    onServerScanned: (ServerEntry) -> Unit,
+    onServerScanned: (PairResult.Success) -> Unit,
 ) {
     val context = LocalContext.current
     var hasPermission by remember {
@@ -131,7 +130,7 @@ fun QrScannerOverlay(
                             when (val result = ServerQrParser.parse(text)) {
                                 is PairResult.Success -> {
                                     handled = true
-                                    onServerScanned(result.server)
+                                    onServerScanned(result)
                                 }
                                 is PairResult.UnsupportedVersion -> hintRes = R.string.update_app_for_qr
                                 is PairResult.Invalid -> hintRes = R.string.invalid_pairing_qr
@@ -218,13 +217,20 @@ fun QrScannerOverlay(
     }
 }
 
+/** Shared by the pairing scanner and the wallet scan modal. */
 @Composable
-private fun CameraQrPreview(onDecoded: (String) -> Unit) {
+internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
     val context = LocalContext.current
     val lifecycleOwner = LocalLifecycleOwner.current
     val currentOnDecoded by rememberUpdatedState(onDecoded)
     val previewView = remember {
-        PreviewView(context).apply { scaleType = PreviewView.ScaleType.FILL_CENTER }
+        PreviewView(context).apply {
+            scaleType = PreviewView.ScaleType.FILL_CENTER
+            // TextureView, not the SurfaceView default: SurfaceView punches a
+            // hole in the window, which black-flashes inside Compose fades and
+            // ignores rounded-corner clipping (wallet modal).
+            implementationMode = PreviewView.ImplementationMode.COMPATIBLE
+        }
     }
 
     DisposableEffect(Unit) {
@@ -232,6 +238,7 @@ private fun CameraQrPreview(onDecoded: (String) -> Unit) {
         val mainExecutor = ContextCompat.getMainExecutor(context)
         val providerFuture = ProcessCameraProvider.getInstance(context)
         var provider: ProcessCameraProvider? = null
+        val focusScheduler = Executors.newSingleThreadScheduledExecutor()
 
         providerFuture.addListener({
             val p = providerFuture.get()
@@ -239,12 +246,15 @@ private fun CameraQrPreview(onDecoded: (String) -> Unit) {
             val preview = Preview.Builder().build().also {
                 it.setSurfaceProvider(previewView.surfaceProvider)
             }
-            // CameraX's analysis default is 640x480 — too few pixels per module
-            // to decode a modal-sized QR at arm's length. 1280x720 more than
-            // doubles the pixel density at negligible analysis cost.
+            // Dense Lightning-invoice QRs need BOTH enough pixels per module and
+            // sharp focus. 1280x720 + a far-focused camera (e.g. Pixel 9a's main
+            // lens, which won't focus close) left dense invoices undecodable
+            // while sparse address QRs still read — the "scanner doesn't pick up
+            // invoices" report. 1920x1080 roughly doubles module resolution so a
+            // QR held at the camera's actual focus distance still resolves.
             @Suppress("DEPRECATION")
             val analysis = ImageAnalysis.Builder()
-                .setTargetResolution(android.util.Size(1280, 720))
+                .setTargetResolution(android.util.Size(1920, 1080))
                 .setBackpressureStrategy(ImageAnalysis.STRATEGY_KEEP_ONLY_LATEST)
                 .build()
                 .also {
@@ -255,13 +265,27 @@ private fun CameraQrPreview(onDecoded: (String) -> Unit) {
                 }
             try {
                 p.unbindAll()
-                p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
+                val cam = p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
+                // Force a centre autofocus on a repeating tick. A hand-held QR is
+                // a static scene, so continuous-AF often never retriggers and the
+                // lens sits at its resting (far) focus — fatal for dense codes.
+                // A normalized centre point works before the view is measured.
+                val point = androidx.camera.core.SurfaceOrientedMeteringPointFactory(1f, 1f)
+                    .createPoint(0.5f, 0.5f)
+                val focusAction = androidx.camera.core.FocusMeteringAction.Builder(
+                    point,
+                    androidx.camera.core.FocusMeteringAction.FLAG_AF,
+                ).disableAutoCancel().build()
+                focusScheduler.scheduleWithFixedDelay({
+                    runCatching { cam.cameraControl.startFocusAndMetering(focusAction) }
+                }, 0, 2, java.util.concurrent.TimeUnit.SECONDS)
             } catch (_: Exception) {
                 // Camera unavailable — the user can dismiss and enter details manually.
             }
         }, mainExecutor)
 
         onDispose {
+            focusScheduler.shutdownNow()
             provider?.unbindAll()
             analysisExecutor.shutdown()
         }
@@ -283,7 +307,19 @@ private class QrCodeAnalyzer(private val onDecoded: (String) -> Unit) : ImageAna
         )
     }
 
+    private var lastAttempt = 0L
+
     override fun analyze(image: ImageProxy) {
+        // Decode ~7x/s, not on every frame: TRY_HARDER (plus the inverted
+        // retry) pegs a core when run at camera rate, and that CPU contention
+        // is what made the preview itself stutter. KEEP_ONLY_LATEST means the
+        // frames skipped here are simply dropped, so decodes stay current.
+        val now = System.currentTimeMillis()
+        if (now - lastAttempt < 140) {
+            image.close()
+            return
+        }
+        lastAttempt = now
         try {
             val plane = image.planes[0]
             val buffer = plane.buffer

Android/app/src/main/java/com/archipelago/app/ui/components/Trackpad.kt

@@ -32,7 +32,7 @@ fun Trackpad(
     onMove: (dx: Int, dy: Int) -> Unit,
     onClick: (button: Int) -> Unit,
     onScroll: (dy: Int) -> Unit,
-    onTwoFingerHold: () -> Unit,
+    onThreeFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     var fingers by remember { mutableIntStateOf(0) }
@@ -53,7 +53,7 @@ fun Trackpad(
                     val t0 = System.currentTimeMillis()
                     var maxPtrs = 1
                     var holdFired = false
-                    var twoStart = 0L
+                    var threeStart = 0L
                     var scrollAcc = 0f
                     fingers = 1
 
@@ -64,19 +64,24 @@ fun Trackpad(
                         fingers = active.size
 
                         when {
-                            active.size >= 2 -> {
-                                if (twoStart == 0L) twoStart = System.currentTimeMillis()
-                                if (!holdFired && System.currentTimeMillis() - twoStart > 500) {
+                            // Three fingers = hold for menu; two = scroll. Kept
+                            // on separate counts so a long two-finger scroll can
+                            // never fire the menu mid-gesture.
+                            active.size >= 3 -> {
+                                if (threeStart == 0L) threeStart = System.currentTimeMillis()
+                                if (!holdFired && System.currentTimeMillis() - threeStart > 500) {
                                     holdFired = true
-                                    onTwoFingerHold()
+                                    onThreeFingerHold()
                                 }
-                                if (!holdFired) {
-                                    val dy = active.map { it.positionChange().y }.average().toFloat()
-                                    scrollAcc += dy
-                                    if (kotlin.math.abs(scrollAcc) > 12f) {
-                                        onScroll(if (scrollAcc > 0) 1 else -1)
-                                        scrollAcc = 0f
-                                    }
+                                ev.changes.forEach { it.consume() }
+                            }
+                            active.size == 2 -> {
+                                threeStart = 0L
+                                val dy = active.map { it.positionChange().y }.average().toFloat()
+                                scrollAcc += dy
+                                if (kotlin.math.abs(scrollAcc) > 12f) {
+                                    onScroll(if (scrollAcc > 0) 1 else -1)
+                                    scrollAcc = 0f
                                 }
                                 ev.changes.forEach { it.consume() }
                             }
@@ -99,7 +104,11 @@ fun Trackpad(
         contentAlignment = Alignment.Center,
     ) {
         Text(
-            text = if (fingers >= 2) "hold for menu" else "",
+            text = when {
+                fingers >= 3 -> "hold for menu"
+                fingers == 2 -> "scroll"
+                else -> ""
+            },
             style = MaterialTheme.typography.labelSmall,
             color = muted.copy(alpha = 0.4f),
         )

Android/app/src/main/java/com/archipelago/app/ui/components/WalletQrScannerModal.kt

@@ -0,0 +1,294 @@
+package com.archipelago.app.ui.components
+
+import android.Manifest
+import android.content.Context
+import android.content.pm.PackageManager
+import android.graphics.BitmapFactory
+import android.net.Uri
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.aspectRatio
+import androidx.compose.foundation.layout.defaultMinSize
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import com.archipelago.app.R
+import com.archipelago.app.ui.screens.GlassButton
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.BinaryBitmap
+import com.google.zxing.DecodeHintType
+import com.google.zxing.MultiFormatReader
+import com.google.zxing.NotFoundException
+import com.google.zxing.RGBLuminanceSource
+import com.google.zxing.common.HybridBinarizer
+
+/**
+ * Native replacement for the web wallet's scan pane — same visual design as
+ * neode-ui's WalletScanModal (dark glass card, square preview, orange
+ * viewfinder, status strip) but the camera and decoding run natively, so the
+ * preview doesn't lag the way getUserMedia does inside a WebView.
+ *
+ * Decoded text is handed back to the page ([onDecoded]) which does all the
+ * detection/spend logic; the page in turn streams status lines (animated-QR
+ * progress, "not recognised" errors) back in via [status] and closes the
+ * modal through the JS bridge once it accepts a code.
+ */
+@Composable
+fun WalletQrScannerModal(
+    visible: Boolean,
+    status: Pair<String, Boolean>?, // message from the web page + isError
+    onDecoded: (String) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    val context = LocalContext.current
+    var hasPermission by remember {
+        mutableStateOf(
+            ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
+                PackageManager.PERMISSION_GRANTED
+        )
+    }
+    val permissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission()
+    ) { granted -> hasPermission = granted }
+
+    // Local error from a failed image upload; a fresh web status replaces it.
+    var uploadError by remember { mutableStateOf<String?>(null) }
+    val noQrMessage = stringResource(R.string.no_qr_in_image)
+    val imagePicker = rememberLauncherForActivityResult(
+        ActivityResultContracts.GetContent()
+    ) { uri ->
+        if (uri != null) {
+            val decoded = decodeQrFromUri(context, uri)
+            if (decoded != null) {
+                uploadError = null
+                onDecoded(decoded)
+            } else {
+                uploadError = noQrMessage
+            }
+        }
+    }
+
+    LaunchedEffect(visible) {
+        if (visible) {
+            uploadError = null
+            val granted = ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
+                PackageManager.PERMISSION_GRANTED
+            hasPermission = granted
+            if (!granted) permissionLauncher.launch(Manifest.permission.CAMERA)
+        }
+    }
+    LaunchedEffect(status) { if (status != null) uploadError = null }
+
+    AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
+        BackHandler { onDismiss() }
+        Box(
+            Modifier
+                .fillMaxSize()
+                .background(Color.Black.copy(alpha = 0.6f))
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = onDismiss,
+                ),
+            contentAlignment = Alignment.Center,
+        ) {
+            Column(
+                Modifier
+                    .padding(16.dp)
+                    .widthIn(max = 420.dp)
+                    .fillMaxWidth()
+                    .clip(RoundedCornerShape(24.dp))
+                    .background(Color(0xF212151C))
+                    .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(24.dp))
+                    .clickable(
+                        interactionSource = remember { MutableInteractionSource() },
+                        indication = null,
+                        onClick = {}, // swallow — only the scrim dismisses
+                    )
+                    .padding(24.dp),
+            ) {
+                // Header — mirrors the web modal's title row
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
+                    Text(
+                        text = stringResource(R.string.scan_to_send),
+                        style = MaterialTheme.typography.titleLarge,
+                        fontWeight = FontWeight.SemiBold,
+                        color = Color.White,
+                    )
+                    IconButton(onClick = onDismiss) {
+                        Icon(
+                            Icons.Default.Close,
+                            stringResource(R.string.close),
+                            tint = Color.White.copy(alpha = 0.7f),
+                        )
+                    }
+                }
+
+                Spacer(Modifier.height(8.dp))
+
+                // Square camera preview with the orange viewfinder
+                Box(
+                    Modifier
+                        .fillMaxWidth()
+                        .aspectRatio(1f)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(Color.Black.copy(alpha = 0.4f))
+                        .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(12.dp)),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    if (hasPermission) {
+                        // Throttle repeat frames: a static QR decodes ~20x/s but
+                        // the page only needs one; animated QRs still stream
+                        // because each frame's text differs.
+                        var lastText by remember { mutableStateOf("") }
+                        var lastSentAt by remember { mutableStateOf(0L) }
+                        CameraQrPreview(onDecoded = { text ->
+                            val now = System.currentTimeMillis()
+                            if (text != lastText || now - lastSentAt > 250) {
+                                lastText = text
+                                lastSentAt = now
+                                onDecoded(text)
+                            }
+                        })
+                        Box(
+                            Modifier
+                                .fillMaxSize(0.62f)
+                                .border(
+                                    2.dp,
+                                    BitcoinOrange.copy(alpha = 0.85f),
+                                    RoundedCornerShape(16.dp),
+                                ),
+                        )
+                    } else {
+                        Column(
+                            Modifier.padding(horizontal = 24.dp),
+                            horizontalAlignment = Alignment.CenterHorizontally,
+                            verticalArrangement = Arrangement.spacedBy(12.dp),
+                        ) {
+                            Text(
+                                text = stringResource(R.string.camera_permission_needed),
+                                color = Color.White.copy(alpha = 0.7f),
+                                style = MaterialTheme.typography.bodyMedium,
+                                textAlign = TextAlign.Center,
+                            )
+                            GlassButton(
+                                text = stringResource(R.string.grant_camera_access),
+                                onClick = { permissionLauncher.launch(Manifest.permission.CAMERA) },
+                                modifier = Modifier.fillMaxWidth().height(48.dp),
+                            )
+                        }
+                    }
+                }
+
+                Spacer(Modifier.height(16.dp))
+
+                // Status strip — same slot the web modal uses for hints/errors
+                val message = uploadError ?: status?.first
+                val isError = uploadError != null || status?.second == true
+                Box(
+                    Modifier
+                        .fillMaxWidth()
+                        .clip(RoundedCornerShape(8.dp))
+                        .background(Color.White.copy(alpha = 0.05f))
+                        .padding(12.dp)
+                        .defaultMinSize(minHeight = 24.dp),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Text(
+                        text = message?.takeIf { it.isNotBlank() }
+                            ?: stringResource(R.string.scan_wallet_hint),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = if (isError) Color(0xFFF87171) else Color.White.copy(alpha = 0.6f),
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                Spacer(Modifier.height(16.dp))
+
+                GlassButton(
+                    text = stringResource(R.string.upload_qr_image),
+                    onClick = { imagePicker.launch("image/*") },
+                    modifier = Modifier.fillMaxWidth().height(48.dp),
+                )
+            }
+        }
+    }
+}
+
+/** Decode a QR from a picked image, downsampled so huge photos stay cheap. */
+private fun decodeQrFromUri(context: Context, uri: Uri): String? {
+    return try {
+        val resolver = context.contentResolver
+        val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+        resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, bounds) }
+        var sample = 1
+        val maxDim = maxOf(bounds.outWidth, bounds.outHeight)
+        while (maxDim / (sample * 2) >= 1600) sample *= 2
+        val opts = BitmapFactory.Options().apply { inSampleSize = sample }
+        val bmp = resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, opts) }
+            ?: return null
+        val pixels = IntArray(bmp.width * bmp.height)
+        bmp.getPixels(pixels, 0, bmp.width, 0, 0, bmp.width, bmp.height)
+        val source = RGBLuminanceSource(bmp.width, bmp.height, pixels)
+        val reader = MultiFormatReader().apply {
+            setHints(
+                mapOf(
+                    DecodeHintType.POSSIBLE_FORMATS to listOf(BarcodeFormat.QR_CODE),
+                    DecodeHintType.TRY_HARDER to true,
+                )
+            )
+        }
+        try {
+            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source))).text
+        } catch (_: NotFoundException) {
+            // Light-on-dark QRs (dark-themed wallets) decode inverted.
+            reader.reset()
+            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source.invert()))).text
+        }
+    } catch (_: Exception) {
+        null
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/navigation/NavGraph.kt

@@ -1,5 +1,8 @@
 package com.archipelago.app.ui.navigation
 
+import android.net.VpnService
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
@@ -9,14 +12,19 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.platform.LocalContext
+import androidx.navigation.NavType
 import androidx.navigation.compose.NavHost
 import androidx.navigation.compose.composable
 import androidx.navigation.compose.rememberNavController
+import androidx.navigation.navArgument
 import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.data.ServerQrParser
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.screens.FlareScreen
 import com.archipelago.app.ui.screens.IntroScreen
+import com.archipelago.app.ui.screens.PartyScreen
 import com.archipelago.app.ui.screens.RemoteInputScreen
 import com.archipelago.app.ui.screens.ServerConnectScreen
 import com.archipelago.app.ui.screens.WebViewScreen
@@ -27,6 +35,8 @@ object Routes {
     const val SERVER_CONNECT = "server_connect"
     const val WEB_VIEW = "web_view"
     const val REMOTE_INPUT = "remote_input"
+    const val MESH_PARTY = "mesh_party"
+    const val FLARE = "flare"
 }
 
 @Composable
@@ -46,6 +56,34 @@ fun AppNavHost(
     // connect form so the user lands on the password prompt for that server.
     var pairPrefill by remember { mutableStateOf<ServerEntry?>(null) }
 
+    // Mesh tunnel: Android's VPN consent dialog is the single unavoidable
+    // interaction — it can only be launched from an Activity, so pairing
+    // paths raise FipsManager.consentNeeded and it is handled here, once.
+    val consentNeeded by FipsManager.consentNeeded.collectAsState()
+    val vpnConsentLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.StartActivityForResult()
+    ) { result ->
+        FipsManager.consentHandled()
+        if (result.resultCode == android.app.Activity.RESULT_OK) {
+            FipsManager.startService(context)
+        }
+    }
+    LaunchedEffect(consentNeeded) {
+        if (!consentNeeded) return@LaunchedEffect
+        val consentIntent = VpnService.prepare(context)
+        if (consentIntent == null) {
+            FipsManager.consentHandled()
+            FipsManager.startService(context)
+        } else {
+            vpnConsentLauncher.launch(consentIntent)
+        }
+    }
+
+    // Paired + previously consented → the mesh comes back silently on launch.
+    LaunchedEffect(Unit) {
+        FipsManager.autoStartIfReady(context)
+    }
+
     if (introSeen == null) return
 
     // Declared after the introSeen gate so it can't fire before the NavHost
@@ -58,6 +96,7 @@ fun AppNavHost(
                 // Pairing implies the app is installed and in use — skip the intro.
                 prefs.markIntroSeen()
                 val merged = prefs.upsertServer(result.server)
+                FipsManager.registerNode(context, result.fips, merged.displayName())
                 if (merged.password.isNotBlank()) {
                     // Demo flow: password came with the link — connect in one step.
                     prefs.setActiveServer(merged)
@@ -89,6 +128,9 @@ fun AppNavHost(
     ) {
         composable(Routes.INTRO) {
             IntroScreen(
+                onMeshParty = {
+                    navController.navigate(Routes.MESH_PARTY)
+                },
                 onContinue = {
                     scope.launch {
                         prefs.markIntroSeen()
@@ -125,6 +167,7 @@ fun AppNavHost(
                 WebViewScreen(
                     serverUrl = server.toUrl(),
                     serverPassword = server.password,
+                    meshFallbackUrl = server.toMeshUrl(),
                     onDisconnect = {
                         scope.launch {
                             prefs.clearActiveServer()
@@ -136,15 +179,46 @@ fun AppNavHost(
                     onRemoteInput = {
                         navController.navigate(Routes.REMOTE_INPUT)
                     },
+                    onRemoteKeyboard = {
+                        navController.navigate("${Routes.REMOTE_INPUT}?keyboard=true")
+                    },
+                    onMeshParty = {
+                        navController.navigate(Routes.MESH_PARTY)
+                    },
                 )
             }
         }
 
-        composable(Routes.REMOTE_INPUT) {
+        composable(
+            "${Routes.REMOTE_INPUT}?keyboard={keyboard}",
+            arguments = listOf(
+                navArgument("keyboard") {
+                    type = NavType.BoolType
+                    defaultValue = false
+                },
+            ),
+        ) { entry ->
             RemoteInputScreen(
                 onBack = {
                     navController.popBackStack()
                 },
+                onMeshParty = {
+                    navController.navigate(Routes.MESH_PARTY)
+                },
+                startInKeyboard = entry.arguments?.getBoolean("keyboard") == true,
+            )
+        }
+
+        composable(Routes.MESH_PARTY) {
+            PartyScreen(
+                onBack = { navController.popBackStack() },
+                onOpenChat = { navController.navigate(Routes.FLARE) },
+            )
+        }
+
+        composable(Routes.FLARE) {
+            FlareScreen(
+                onBack = { navController.popBackStack() },
             )
         }
     }

Android/app/src/main/java/com/archipelago/app/ui/screens/FlareScreen.kt

@@ -0,0 +1,359 @@
+package com.archipelago.app.ui.screens
+
+import android.graphics.Bitmap
+import android.graphics.BitmapFactory
+import android.net.Uri
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.navigationBarsPadding
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.lazy.rememberLazyListState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Image
+import androidx.compose.material3.Icon
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.OutlinedTextFieldDefaults
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.fips.FipsNative
+import com.archipelago.app.fips.FipsPreferences
+import com.archipelago.app.fips.FlareClient
+import com.archipelago.app.fips.FlareMessage
+import com.archipelago.app.fips.FlareStore
+import com.archipelago.app.fips.PartyPeer
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceDark
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.util.UUID
+
+private val BubbleTheirs = Color.White.copy(alpha = 0.07f)
+private val BubbleBorder = Color.White.copy(alpha = 0.08f)
+
+/**
+ * Flare — phone↔phone chat and photo beam over the FIPS mesh. Every byte is
+ * E2E encrypted by the mesh layer and addressed by npub; whether it travels
+ * via a public anchor (5G) or a direct hotspot link is invisible up here —
+ * which is the entire point.
+ */
+@Composable
+fun FlareScreen(onBack: () -> Unit) {
+    val context = LocalContext.current
+    val prefs = remember { FipsPreferences(context) }
+    val scope = rememberCoroutineScope()
+
+    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
+    var myName by remember { mutableStateOf("Phone") }
+    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
+    var selectedNpub by remember { mutableStateOf<String?>(null) }
+    val allMessages by FlareStore.messages.collectAsState()
+    var draft by remember { mutableStateOf("") }
+
+    LaunchedEffect(Unit) {
+        identity = FipsManager.ensureIdentity(prefs)
+        myName = prefs.partyName()
+    }
+    LaunchedEffect(peers) {
+        if (selectedNpub == null || peers.none { it.npub == selectedNpub }) {
+            selectedNpub = peers.firstOrNull()?.npub
+        }
+    }
+
+    val peer = peers.firstOrNull { it.npub == selectedNpub }
+    val messages = allMessages.filter { it.peerNpub == selectedNpub }
+    val listState = rememberLazyListState()
+    LaunchedEffect(messages.size) {
+        if (messages.isNotEmpty()) listState.animateScrollToItem(messages.size - 1)
+    }
+
+    fun sendText() {
+        val target = peer ?: return
+        val me = identity ?: return
+        val text = draft.trim()
+        if (text.isEmpty()) return
+        draft = ""
+        val msg = FlareMessage(
+            id = UUID.randomUUID().toString(),
+            peerNpub = target.npub,
+            fromMe = true,
+            name = myName,
+            text = text,
+            ts = System.currentTimeMillis(),
+            status = FlareMessage.Status.SENDING,
+        )
+        FlareStore.add(msg)
+        scope.launch(Dispatchers.IO) {
+            val ok = FlareClient.sendText(target, me.npub, myName, text)
+            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
+        }
+    }
+
+    fun sendPhoto(uri: Uri) {
+        val target = peer ?: return
+        val me = identity ?: return
+        scope.launch(Dispatchers.IO) {
+            val jpeg = compressPhoto(context, uri) ?: return@launch
+            // Local copy so our own bubble renders the sent photo.
+            val dir = File(context.cacheDir, "flare").apply { mkdirs() }
+            val local = File(dir, "${UUID.randomUUID()}.jpg").apply { writeBytes(jpeg) }
+            val msg = FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = target.npub,
+                fromMe = true,
+                name = myName,
+                photoPath = local.absolutePath,
+                ts = System.currentTimeMillis(),
+                status = FlareMessage.Status.SENDING,
+            )
+            FlareStore.add(msg)
+            val ok = FlareClient.sendPhoto(target, me.npub, myName, jpeg)
+            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
+        }
+    }
+
+    val photoPicker = rememberLauncherForActivityResult(
+        ActivityResultContracts.GetContent()
+    ) { uri -> uri?.let { sendPhoto(it) } }
+
+    BackHandler { onBack() }
+
+    Column(
+        Modifier
+            .fillMaxSize()
+            .background(SurfaceDark)
+            .statusBarsPadding()
+            .navigationBarsPadding()
+            .imePadding(),
+    ) {
+        // Header
+        Row(
+            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.SpaceBetween,
+        ) {
+            Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(6.dp))
+            Column(horizontalAlignment = Alignment.CenterHorizontally) {
+                Text("FLARE", color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
+                peer?.let {
+                    Text(
+                        it.name + if (it.ip.isNotBlank()) "  ·  direct+mesh" else "  ·  mesh",
+                        color = BitcoinOrange,
+                        fontSize = 11.sp,
+                    )
+                }
+            }
+            Spacer(Modifier.size(48.dp))
+        }
+
+        // Peer tabs when chatting with more than one phone
+        if (peers.size > 1) {
+            Row(
+                Modifier.fillMaxWidth().padding(horizontal = 16.dp),
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                peers.forEach { p ->
+                    val active = p.npub == selectedNpub
+                    Text(
+                        p.name,
+                        color = if (active) BitcoinOrange else TextMuted,
+                        fontSize = 13.sp,
+                        modifier = Modifier
+                            .clip(RoundedCornerShape(10.dp))
+                            .background(if (active) BitcoinOrange.copy(alpha = 0.12f) else Color.Transparent)
+                            .border(
+                                1.dp,
+                                if (active) BitcoinOrange.copy(alpha = 0.4f) else BubbleBorder,
+                                RoundedCornerShape(10.dp),
+                            )
+                            .clickable { selectedNpub = p.npub }
+                            .padding(horizontal = 12.dp, vertical = 6.dp),
+                    )
+                }
+            }
+        }
+
+        if (peer == null) {
+            Box(Modifier.weight(1f).fillMaxWidth(), contentAlignment = Alignment.Center) {
+                Text("No party peers yet — scan a phone first", color = TextMuted, fontSize = 14.sp)
+            }
+        } else {
+            LazyColumn(
+                state = listState,
+                modifier = Modifier.weight(1f).fillMaxWidth(),
+                contentPadding = androidx.compose.foundation.layout.PaddingValues(16.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                items(messages, key = { it.id }) { msg ->
+                    MessageBubble(msg)
+                }
+            }
+
+            // Composer
+            Row(
+                Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp),
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                Box(
+                    Modifier
+                        .size(48.dp)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(BubbleTheirs)
+                        .border(1.dp, BubbleBorder, RoundedCornerShape(12.dp))
+                        .clickable { photoPicker.launch("image/*") },
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Icon(Icons.Default.Image, "Beam a photo", tint = BitcoinOrange, modifier = Modifier.size(22.dp))
+                }
+                OutlinedTextField(
+                    value = draft,
+                    onValueChange = { draft = it },
+                    placeholder = { Text("Send a flare…", color = TextMuted, fontSize = 14.sp) },
+                    modifier = Modifier.weight(1f),
+                    singleLine = true,
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Send),
+                    keyboardActions = KeyboardActions(onSend = { sendText() }),
+                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp),
+                    colors = OutlinedTextFieldDefaults.colors(
+                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
+                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
+                        cursorColor = BitcoinOrange,
+                        focusedTextColor = TextPrimary,
+                        unfocusedTextColor = TextPrimary,
+                    ),
+                    shape = RoundedCornerShape(12.dp),
+                )
+                Box(
+                    Modifier
+                        .size(48.dp)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(BitcoinOrange.copy(alpha = 0.15f))
+                        .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+                        .clickable { sendText() },
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Text("➤", color = BitcoinOrange, fontSize = 18.sp)
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun MessageBubble(msg: FlareMessage) {
+    Row(
+        Modifier.fillMaxWidth(),
+        horizontalArrangement = if (msg.fromMe) Arrangement.End else Arrangement.Start,
+    ) {
+        Column(
+            Modifier
+                .widthIn(max = 300.dp)
+                .clip(RoundedCornerShape(16.dp))
+                .background(if (msg.fromMe) BitcoinOrange.copy(alpha = 0.14f) else BubbleTheirs)
+                .border(
+                    1.dp,
+                    if (msg.fromMe) BitcoinOrange.copy(alpha = 0.35f) else BubbleBorder,
+                    RoundedCornerShape(16.dp),
+                )
+                .padding(horizontal = 12.dp, vertical = 8.dp),
+        ) {
+            if (msg.photoPath.isNotBlank()) {
+                val bmp = remember(msg.photoPath) { BitmapFactory.decodeFile(msg.photoPath) }
+                bmp?.let {
+                    Image(
+                        bitmap = it.asImageBitmap(),
+                        contentDescription = "Beamed photo",
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .clip(RoundedCornerShape(10.dp)),
+                        contentScale = ContentScale.FillWidth,
+                    )
+                }
+            }
+            if (msg.text.isNotBlank()) {
+                Text(msg.text, color = TextPrimary, fontSize = 15.sp)
+            }
+            Text(
+                when (msg.status) {
+                    FlareMessage.Status.SENDING -> "sending…"
+                    FlareMessage.Status.SENT -> "sent · E2E via mesh"
+                    FlareMessage.Status.FAILED -> "failed — tap to retry later"
+                    FlareMessage.Status.RECEIVED -> msg.name
+                },
+                color = if (msg.status == FlareMessage.Status.FAILED) BitcoinOrange else TextMuted,
+                fontSize = 10.sp,
+                modifier = Modifier.padding(top = 2.dp),
+            )
+        }
+    }
+}
+
+/** Decode, downscale (≤1600px) and JPEG-compress a picked photo off-main. */
+private suspend fun compressPhoto(context: android.content.Context, uri: Uri): ByteArray? =
+    withContext(Dispatchers.IO) {
+        try {
+            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+            context.contentResolver.openInputStream(uri)?.use {
+                BitmapFactory.decodeStream(it, null, bounds)
+            }
+            var sample = 1
+            while (maxOf(bounds.outWidth, bounds.outHeight) / sample > 1600) sample *= 2
+            val opts = BitmapFactory.Options().apply { inSampleSize = sample }
+            val bitmap = context.contentResolver.openInputStream(uri)?.use {
+                BitmapFactory.decodeStream(it, null, opts)
+            } ?: return@withContext null
+            val out = ByteArrayOutputStream()
+            bitmap.compress(Bitmap.CompressFormat.JPEG, 80, out)
+            bitmap.recycle()
+            out.toByteArray()
+        } catch (_: Exception) {
+            null
+        }
+    }

Android/app/src/main/java/com/archipelago/app/ui/screens/IntroScreen.kt

@@ -55,7 +55,12 @@ import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.delay
 
 @Composable
-fun IntroScreen(onContinue: () -> Unit) {
+fun IntroScreen(
+    onContinue: () -> Unit,
+    // Mesh Party works with no node at all (phone↔phone) — offered right on
+    // the first screen so a friend who just got the app can join a party.
+    onMeshParty: () -> Unit = {},
+) {
     val logoAlpha = remember { Animatable(0f) }
     var showContent by remember { mutableStateOf(false) }
 
@@ -143,6 +148,14 @@ fun IntroScreen(onContinue: () -> Unit) {
                         onClick = onContinue,
                         modifier = Modifier.fillMaxWidth().height(56.dp),
                     )
+
+                    Spacer(modifier = Modifier.height(12.dp))
+
+                    GlassButton(
+                        text = stringResource(R.string.mesh_party),
+                        onClick = onMeshParty,
+                        modifier = Modifier.fillMaxWidth().height(48.dp),
+                    )
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/screens/PartyScreen.kt

@@ -0,0 +1,519 @@
+package com.archipelago.app.ui.screens
+
+import android.graphics.Bitmap
+import androidx.activity.compose.BackHandler
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.OutlinedTextFieldDefaults
+import androidx.compose.material3.Switch
+import androidx.compose.material3.SwitchDefaults
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.fips.FipsNative
+import com.archipelago.app.fips.FipsPreferences
+import com.archipelago.app.fips.FlareClient
+import com.archipelago.app.fips.PartyPeer
+import com.archipelago.app.fips.PartyQr
+import com.archipelago.app.ui.components.CameraQrPreview
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceDark
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.EncodeHintType
+import com.google.zxing.qrcode.QRCodeWriter
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+private val CardBg = Color.White.copy(alpha = 0.05f)
+private val CardBorder = Color.White.copy(alpha = 0.08f)
+
+/** Public companion download (vps2 demo host — serves the same APK as the
+ *  nodes' QR link). Rendered as the "Share this app" QR. */
+private const val APP_DOWNLOAD_URL =
+    "http://146.59.87.168:2100/packages/archipelago-companion.apk"
+
+/**
+ * Mesh Party — phone↔phone FIPS pairing. Show your QR, scan theirs, and the
+ * two embedded mesh nodes link up: through anchors when there's internet,
+ * directly over any shared WiFi/hotspot when there isn't.
+ */
+@Composable
+fun PartyScreen(
+    onBack: () -> Unit,
+    onOpenChat: () -> Unit,
+) {
+    val context = LocalContext.current
+    val prefs = remember { FipsPreferences(context) }
+    val scope = rememberCoroutineScope()
+
+    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
+    var name by remember { mutableStateOf("") }
+    var localIp by remember { mutableStateOf<String?>(null) }
+    var showScanner by remember { mutableStateOf(false) }
+    var showShareQr by remember { mutableStateOf(false) }
+    var scanHint by remember { mutableStateOf<String?>(null) }
+
+    // Camera permission — fresh installs (and reinstalls: uninstall wipes
+    // grants) land here with no CAMERA grant, and the raw preview just showed
+    // black. Ask the moment the scanner opens.
+    var hasCamera by remember {
+        mutableStateOf(
+            androidx.core.content.ContextCompat.checkSelfPermission(
+                context, android.Manifest.permission.CAMERA,
+            ) == android.content.pm.PackageManager.PERMISSION_GRANTED
+        )
+    }
+    val cameraPermLauncher = androidx.activity.compose.rememberLauncherForActivityResult(
+        androidx.activity.result.contract.ActivityResultContracts.RequestPermission()
+    ) { hasCamera = it }
+    LaunchedEffect(showScanner) {
+        if (showScanner && !hasCamera) {
+            cameraPermLauncher.launch(android.Manifest.permission.CAMERA)
+        }
+    }
+    val listenOn by prefs.partyListenFlow.collectAsState(initial = false)
+    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
+
+    LaunchedEffect(Unit) {
+        identity = FipsManager.ensureIdentity(prefs)
+        name = prefs.partyName()
+        // The hotspot/WiFi address can change while this screen is open
+        // (e.g. the user flips the hotspot on mid-demo) — keep it fresh.
+        while (true) {
+            localIp = withContext(Dispatchers.IO) { PartyQr.localWifiIpv4() }
+            delay(3_000)
+        }
+    }
+
+    val qrPayload = identity?.let { id ->
+        PartyQr.build(
+            npub = id.npub,
+            ula = id.address,
+            name = name.ifBlank { "Phone" },
+            ip = if (listenOn) localIp else null,
+            port = PartyQr.PARTY_UDP_PORT,
+        )
+    }
+    val qrBitmap = remember(qrPayload) { qrPayload?.let { renderQr(it) } }
+
+    BackHandler {
+        when {
+            showScanner -> showScanner = false
+            showShareQr -> showShareQr = false
+            else -> onBack()
+        }
+    }
+
+    Box(Modifier.fillMaxSize().background(SurfaceDark)) {
+        Column(
+            Modifier
+                .fillMaxSize()
+                .statusBarsPadding()
+                .verticalScroll(rememberScrollState())
+                .padding(horizontal = 24.dp, vertical = 16.dp),
+            verticalArrangement = Arrangement.spacedBy(14.dp),
+        ) {
+            Row(
+                Modifier.fillMaxWidth(),
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.SpaceBetween,
+            ) {
+                Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(8.dp))
+                Text("MESH PARTY", color = TextPrimary, fontSize = 17.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
+                Spacer(Modifier.size(56.dp))
+            }
+
+            // My QR card
+            Column(
+                Modifier
+                    .fillMaxWidth()
+                    .clip(RoundedCornerShape(20.dp))
+                    .background(CardBg)
+                    .border(1.dp, CardBorder, RoundedCornerShape(20.dp))
+                    .padding(18.dp),
+                horizontalAlignment = Alignment.CenterHorizontally,
+                verticalArrangement = Arrangement.spacedBy(12.dp),
+            ) {
+                qrBitmap?.let { bmp ->
+                    Box(
+                        Modifier
+                            .clip(RoundedCornerShape(16.dp))
+                            .background(Color.White)
+                            .padding(12.dp),
+                    ) {
+                        Image(
+                            bitmap = bmp.asImageBitmap(),
+                            contentDescription = "My mesh party QR",
+                            modifier = Modifier.size(220.dp),
+                        )
+                    }
+                } ?: Text("Mesh identity unavailable on this device", color = TextMuted, fontSize = 14.sp)
+
+                identity?.let {
+                    Text(
+                        it.npub.take(16) + "…" + it.npub.takeLast(6),
+                        color = TextMuted,
+                        fontSize = 12.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                OutlinedTextField(
+                    value = name,
+                    onValueChange = {
+                        name = it.take(24)
+                        scope.launch { prefs.setPartyName(name) }
+                    },
+                    placeholder = { Text("Your name", color = TextMuted, textAlign = TextAlign.Center, modifier = Modifier.fillMaxWidth()) },
+                    modifier = Modifier.fillMaxWidth().height(56.dp),
+                    singleLine = true,
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp, textAlign = TextAlign.Center),
+                    colors = OutlinedTextFieldDefaults.colors(
+                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
+                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
+                        cursorColor = BitcoinOrange,
+                        focusedTextColor = TextPrimary,
+                        unfocusedTextColor = TextPrimary,
+                    ),
+                    shape = RoundedCornerShape(12.dp),
+                )
+
+                // Direct-link toggle (hotspot mode)
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
+                    Column(Modifier.padding(end = 12.dp)) {
+                        Text("Accept direct links", color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
+                        Text(
+                            when {
+                                listenOn && localIp != null -> "Dialable at $localIp:${PartyQr.PARTY_UDP_PORT} — no internet needed"
+                                listenOn -> "Waiting for a WiFi/hotspot address…"
+                                else -> "Off — mesh routes via anchors only"
+                            },
+                            color = if (listenOn) BitcoinOrange else TextMuted,
+                            fontSize = 12.sp,
+                        )
+                    }
+                    Switch(
+                        checked = listenOn,
+                        onCheckedChange = { on ->
+                            scope.launch {
+                                prefs.setPartyListen(on)
+                                FipsManager.requestMeshRestart(context)
+                            }
+                        },
+                        colors = SwitchDefaults.colors(
+                            checkedTrackColor = BitcoinOrange,
+                            checkedThumbColor = Color.White,
+                        ),
+                    )
+                }
+            }
+
+            GlassButton(
+                text = "Scan a Phone",
+                onClick = { showScanner = true },
+                modifier = Modifier.fillMaxWidth().height(56.dp),
+            )
+
+            if (peers.isNotEmpty()) {
+                Text("PARTY PEERS", color = TextMuted, fontSize = 12.sp, letterSpacing = 2.sp)
+                peers.forEach { peer ->
+                    Row(
+                        Modifier
+                            .fillMaxWidth()
+                            .clip(RoundedCornerShape(14.dp))
+                            .background(CardBg)
+                            .border(1.dp, CardBorder, RoundedCornerShape(14.dp))
+                            .clickable { onOpenChat() }
+                            .padding(horizontal = 16.dp, vertical = 12.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.SpaceBetween,
+                    ) {
+                        Column(Modifier.padding(end = 8.dp)) {
+                            Text(peer.name, color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
+                            Text(
+                                peer.npub.take(14) + "…" + if (peer.ip.isNotBlank()) "  ·  direct ${peer.ip}" else "  ·  via mesh",
+                                color = TextMuted,
+                                fontSize = 11.sp,
+                            )
+                        }
+                        Text(
+                            "✕",
+                            color = TextMuted,
+                            fontSize = 16.sp,
+                            modifier = Modifier.clickable {
+                                scope.launch {
+                                    prefs.removePartyPeer(peer.npub)
+                                    FipsManager.requestMeshRestart(context)
+                                }
+                            }.padding(8.dp),
+                        )
+                    }
+                }
+                GlassButton(
+                    text = "Open Flare Chat",
+                    onClick = onOpenChat,
+                    modifier = Modifier.fillMaxWidth().height(56.dp),
+                )
+            } else {
+                Text(
+                    "Scan another phone's party QR (or let them scan yours) to link your mesh nodes — works over 5G via anchors, or over any shared WiFi/hotspot with zero internet.",
+                    color = TextMuted,
+                    fontSize = 13.sp,
+                    textAlign = TextAlign.Center,
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 8.dp),
+                )
+            }
+            Spacer(Modifier.height(12.dp))
+            // Hand the app itself to a friend: shares this install's own APK
+            // through the system sheet (Quick Share/Bluetooth), so a nearby
+            // phone gets the companion with zero internet — the whole party
+            // premise.
+            GlassButton(
+                text = "Share this app",
+                onClick = { showShareQr = true },
+                modifier = Modifier.fillMaxWidth().height(48.dp),
+            )
+            Spacer(Modifier.height(12.dp))
+        }
+
+        // "Share this app" — a QR of the public download link, so the other
+        // phone scans it with its normal camera and installs over any
+        // internet. (The vps2 demo host serves the same APK the nodes do.)
+        AnimatedVisibility(visible = showShareQr, enter = fadeIn(), exit = fadeOut()) {
+            Box(
+                Modifier
+                    .fillMaxSize()
+                    .background(Color.Black.copy(alpha = 0.94f))
+                    .clickable { showShareQr = false },
+                contentAlignment = Alignment.Center,
+            ) {
+                Column(horizontalAlignment = Alignment.CenterHorizontally) {
+                    val dlQr = remember { renderQr(APP_DOWNLOAD_URL) }
+                    dlQr?.let { bmp ->
+                        Box(
+                            Modifier
+                                .clip(RoundedCornerShape(16.dp))
+                                .background(Color.White)
+                                .padding(14.dp),
+                        ) {
+                            Image(
+                                bitmap = bmp.asImageBitmap(),
+                                contentDescription = "Companion download QR",
+                                modifier = Modifier.size(240.dp),
+                            )
+                        }
+                    }
+                    Spacer(Modifier.height(18.dp))
+                    Text(
+                        "Scan with any camera to download\nthe Archipelago Companion",
+                        color = TextPrimary,
+                        fontSize = 15.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                    Spacer(Modifier.height(10.dp))
+                    Text(
+                        "…or send the APK file directly",
+                        color = BitcoinOrange,
+                        fontSize = 13.sp,
+                        modifier = Modifier.clickable { shareCompanionApk(context) }.padding(8.dp),
+                    )
+                    Spacer(Modifier.height(6.dp))
+                    Text("Close", color = TextMuted, fontSize = 14.sp, modifier = Modifier.clickable { showShareQr = false }.padding(8.dp))
+                }
+            }
+        }
+
+        // Party QR scanner overlay
+        AnimatedVisibility(visible = showScanner, enter = fadeIn(), exit = fadeOut()) {
+            Box(Modifier.fillMaxSize().background(Color.Black)) {
+                if (!hasCamera) {
+                    Column(
+                        Modifier.align(Alignment.Center).padding(horizontal = 32.dp),
+                        horizontalAlignment = Alignment.CenterHorizontally,
+                        verticalArrangement = Arrangement.spacedBy(14.dp),
+                    ) {
+                        Text(
+                            "Camera access is needed to scan a party QR.",
+                            color = TextPrimary,
+                            fontSize = 15.sp,
+                            textAlign = TextAlign.Center,
+                        )
+                        GlassButton(
+                            text = "Grant camera access",
+                            onClick = { cameraPermLauncher.launch(android.Manifest.permission.CAMERA) },
+                            modifier = Modifier.fillMaxWidth().height(48.dp),
+                        )
+                    }
+                } else CameraQrPreview(onDecoded = { text ->
+                    val peer = PartyQr.parse(text)
+                    when {
+                        peer == null -> scanHint = "Not a mesh party QR"
+                        peer.npub == identity?.npub -> scanHint = "That's your own QR"
+                        else -> {
+                            showScanner = false
+                            scanHint = null
+                            scope.launch {
+                                prefs.upsertPartyPeer(peer)
+                                // Pick up the direct-dial PeerConfig (and the
+                                // listener, if ours is on) immediately.
+                                FipsManager.requestMeshRestart(context)
+                                // Pairing must be MUTUAL: announce ourselves so
+                                // the scanned phone gets us as a peer + a chat
+                                // entry without scanning back. Retried while
+                                // the fresh link/session comes up.
+                                val me = identity
+                                if (me != null) {
+                                    launch(Dispatchers.IO) {
+                                        for (attempt in 0 until 6) {
+                                            val ok = FlareClient.sendHello(
+                                                peer = peer,
+                                                myNpub = me.npub,
+                                                myName = name.ifBlank { "Phone" },
+                                                myUla = me.address,
+                                                myIp = if (listenOn) localIp else null,
+                                                myPort = PartyQr.PARTY_UDP_PORT,
+                                            )
+                                            if (ok) break
+                                            delay(3_000)
+                                        }
+                                    }
+                                }
+                                onOpenChat()
+                            }
+                        }
+                    }
+                })
+                Box(
+                    Modifier
+                        .align(Alignment.Center)
+                        .size(260.dp)
+                        .border(2.dp, BitcoinOrange.copy(alpha = 0.85f), RoundedCornerShape(20.dp)),
+                )
+                Text(
+                    "Close",
+                    color = TextPrimary,
+                    fontSize = 16.sp,
+                    modifier = Modifier
+                        .align(Alignment.TopEnd)
+                        .statusBarsPadding()
+                        .clickable { showScanner = false }
+                        .padding(20.dp),
+                )
+                scanHint?.let {
+                    Text(
+                        it,
+                        color = BitcoinOrange,
+                        fontSize = 14.sp,
+                        textAlign = TextAlign.Center,
+                        modifier = Modifier
+                            .align(Alignment.BottomCenter)
+                            .padding(bottom = 48.dp)
+                            .fillMaxWidth(),
+                    )
+                }
+            }
+        }
+    }
+
+    // Scan hints fade so the camera feels live again.
+    LaunchedEffect(scanHint) {
+        if (scanHint != null) {
+            delay(2500)
+            scanHint = null
+        }
+    }
+}
+
+/** Render a QR payload as a bitmap (dark modules on white). */
+private fun renderQr(payload: String, size: Int = 640): Bitmap? = try {
+    val matrix = QRCodeWriter().encode(
+        payload,
+        BarcodeFormat.QR_CODE,
+        size,
+        size,
+        mapOf(EncodeHintType.MARGIN to 1),
+    )
+    val pixels = IntArray(size * size)
+    for (y in 0 until size) {
+        for (x in 0 until size) {
+            pixels[y * size + x] = if (matrix[x, y]) 0xFF0A0A0A.toInt() else 0xFFFFFFFF.toInt()
+        }
+    }
+    Bitmap.createBitmap(pixels, size, size, Bitmap.Config.ARGB_8888)
+} catch (_: Exception) {
+    null
+}
+
+/** Share this install's own APK via the system share sheet — a nearby friend
+ *  gets the companion with no internet at all (Quick Share / Bluetooth). */
+private fun shareCompanionApk(context: android.content.Context) {
+    try {
+        val src = java.io.File(context.applicationInfo.sourceDir)
+        val dir = java.io.File(context.cacheDir, "share").apply { mkdirs() }
+        val out = java.io.File(dir, "archipelago-companion.apk")
+        src.copyTo(out, overwrite = true)
+        val uri = androidx.core.content.FileProvider.getUriForFile(
+            context, "${context.packageName}.fileprovider", out,
+        )
+        val send = android.content.Intent(android.content.Intent.ACTION_SEND).apply {
+            type = "application/vnd.android.package-archive"
+            putExtra(android.content.Intent.EXTRA_STREAM, uri)
+            addFlags(android.content.Intent.FLAG_GRANT_READ_URI_PERMISSION)
+        }
+        context.startActivity(
+            android.content.Intent.createChooser(send, "Share Archipelago Companion")
+                .addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK),
+        )
+    } catch (_: Exception) {
+        // No share targets / copy failed — nothing sensible to do here.
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/screens/RemoteInputScreen.kt

@@ -4,8 +4,10 @@ import android.content.res.Configuration
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.WindowInsets
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -37,6 +39,7 @@ import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.unit.dp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.fips.FipsManager
 import com.archipelago.app.network.ConnectionState
 import com.archipelago.app.network.InputWebSocket
 import com.archipelago.app.ui.components.NESController
@@ -53,7 +56,12 @@ import com.archipelago.app.ui.theme.TextMuted
 import kotlinx.coroutines.launch
 
 @Composable
-fun RemoteInputScreen(onBack: () -> Unit) {
+fun RemoteInputScreen(
+    onBack: () -> Unit,
+    onMeshParty: (() -> Unit)? = null,
+    // Land on the keyboard instead of the gamepad (hub menu's Keyboard card).
+    startInKeyboard: Boolean = false,
+) {
     val context = LocalContext.current
     val prefs = remember { ServerPreferences(context) }
     val scope = rememberCoroutineScope()
@@ -62,7 +70,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
     val savedServers by prefs.savedServers.collectAsState(initial = emptyList())
     val activeServer by prefs.activeServer.collectAsState(initial = null)
 
-    var isGamepadMode by remember { mutableStateOf(true) }
+    var isGamepadMode by remember { mutableStateOf(!startInKeyboard) }
     var showModal by remember { mutableStateOf(false) }
     var showQrScanner by remember { mutableStateOf(false) }
     var controllerStyle by remember { mutableStateOf(ControllerStyle.DARK) }
@@ -89,6 +97,9 @@ fun RemoteInputScreen(onBack: () -> Unit) {
         playerId = when (playerId) { 0 -> 1; 1 -> 2; else -> 0 }
         ws.playerId = playerId
     }
+    fun toggleStyle() {
+        controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
+    }
     val connectionState by ws.state.collectAsState()
     val lifecycleOwner = LocalLifecycleOwner.current
 
@@ -152,6 +163,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                 onKey = { ws.sendKey(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
+                onToggleStyle = ::toggleStyle,
             )
             isGamepadMode && !isLandscape -> NESPortraitController(
                 style = controllerStyle,
@@ -162,6 +174,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                 onMouseScroll = { ws.sendScroll(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
+                onToggleStyle = ::toggleStyle,
             )
             else -> {
                 // Keyboard mode: trackpad fills top, keyboard pinned bottom
@@ -171,7 +184,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                             onMove = { dx, dy -> ws.sendMouseMove(dx, dy) },
                             onClick = { ws.sendClick(it) },
                             onScroll = { ws.sendScroll(it) },
-                            onTwoFingerHold = { showModal = true },
+                            onThreeFingerHold = { showModal = true },
                             modifier = Modifier.fillMaxWidth().weight(1f)
                                 .padding(horizontal = 16.dp, vertical = 8.dp),
                         )
@@ -181,12 +194,20 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                             modifier = Modifier.fillMaxWidth(),
                         )
                     }
-                    // Settings icon top-right in keyboard mode
-                    com.archipelago.app.ui.components.SettingsBtn(
-                        c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
-                        modifier = Modifier.align(Alignment.TopEnd).padding(8.dp),
-                        onClick = { showModal = true },
-                    )
+                    // Settings + style icons top-right in keyboard mode
+                    Row(
+                        Modifier.align(Alignment.TopEnd).padding(8.dp),
+                        horizontalArrangement = Arrangement.spacedBy(8.dp),
+                    ) {
+                        com.archipelago.app.ui.components.SettingsBtn(
+                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
+                            onClick = { showModal = true },
+                        )
+                        com.archipelago.app.ui.components.StyleBtn(
+                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
+                            onClick = ::toggleStyle,
+                        )
+                    }
                 }
             }
         }
@@ -209,8 +230,6 @@ fun RemoteInputScreen(onBack: () -> Unit) {
             visible = showModal,
             servers = savedServers,
             activeServer = activeServer,
-            isGamepadMode = isGamepadMode,
-            controllerStyle = controllerStyle,
             onDismiss = { showModal = false },
             onSelectServer = { server ->
                 scope.launch { ws.disconnect(); prefs.setActiveServer(server) }; showModal = false
@@ -244,11 +263,10 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                     }
                 }
             },
-            onToggleMode = { isGamepadMode = !isGamepadMode; showModal = false },
-            onToggleStyle = {
-                controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
-            },
+            onRemote = { isGamepadMode = true; showModal = false },
+            onKeyboard = { isGamepadMode = false; showModal = false },
             onBackToWebView = { showModal = false; onBack() },
+            onMeshParty = onMeshParty?.let { open -> { showModal = false; open() } },
         )
 
         // Pairing-QR scan launched from the menu's Add Server row. The menu stays
@@ -256,10 +274,11 @@ fun RemoteInputScreen(onBack: () -> Unit) {
         QrScannerOverlay(
             visible = showQrScanner,
             onDismiss = { showQrScanner = false },
-            onServerScanned = { server ->
+            onServerScanned = { scan ->
                 showQrScanner = false
                 scope.launch {
-                    val merged = prefs.upsertServer(server)
+                    val merged = prefs.upsertServer(scan.server)
+                    FipsManager.registerNode(context, scan.fips, merged.displayName())
                     if (activeServer == null) prefs.setActiveServer(merged)
                 }
             },

Android/app/src/main/java/com/archipelago/app/ui/screens/ServerConnectScreen.kt

@@ -71,8 +71,11 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
+import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.components.MeshLoadingScreen
 import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.theme.BitcoinOrange
 import com.archipelago.app.ui.theme.ErrorRed
@@ -83,6 +86,7 @@ import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import com.archipelago.app.ui.theme.TextSecondary
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import java.net.HttpURLConnection
@@ -169,10 +173,35 @@ fun ServerConnectScreen(
         errorMessage = null
 
         scope.launch {
-            val result = testConnection(server)
+            var reachable = testConnection(server)
+
+            // LAN address didn't answer — phone off-LAN (5G) or DHCP moved the
+            // node. The scanned IP was only ever a dial hint; the node's real
+            // identity is its npub and its ULA is reachable from anywhere over
+            // the mesh. Bring the tunnel up and probe the ULA before failing.
+            if (!reachable && server.meshIp.isNotBlank()) {
+                FipsManager.autoStartIfReady(context)
+                val meshServer = server.copy(
+                    address = server.meshIp,
+                    useHttps = false,
+                    port = "",
+                )
+                // Mesh discovery + first session can take 15s+ through the
+                // public tree (per node diagnosis), and on a
+                // first-ever pairing the VPN consent dialog is on screen at
+                // the same time — so probe patiently inside a 60s budget with
+                // per-attempt timeouts wide enough to ride out TCP
+                // retransmit backoff. The VPN service pre-warms the session
+                // in parallel (ArchyVpnService.startSessionWarmer).
+                val deadline = System.currentTimeMillis() + 60_000
+                while (!reachable && System.currentTimeMillis() < deadline) {
+                    reachable = testConnection(meshServer, timeoutMs = 15_000)
+                    if (!reachable) delay(3000)
+                }
+            }
             isConnecting = false
 
-            if (result) {
+            if (reachable) {
                 prefs.setActiveServer(server)
                 onConnected(server.toUrl())
             } else {
@@ -190,12 +219,14 @@ fun ServerConnectScreen(
     }
 
     // Pairing QR scanned: dedupe against saved servers, then either auto-connect
-    // (payload carried a password — the demo flow) or land on the password
-    // prompt with everything else filled in (real nodes never embed one).
-    fun onQrScanned(scanned: ServerEntry) {
+    // (payload carried a credential — demo password or a real node's device
+    // token) or land on the password prompt with everything else filled in.
+    // Mesh info (when present) is registered so the FIPS tunnel comes up too.
+    fun onQrScanned(scan: PairResult.Success) {
         showScanner = false
         scope.launch {
-            val merged = prefs.upsertServer(scanned)
+            val merged = prefs.upsertServer(scan.server)
+            FipsManager.registerNode(context, scan.fips, merged.displayName())
             prefill(merged)
             if (merged.password.isNotBlank()) {
                 connect(merged)
@@ -580,6 +611,14 @@ fun ServerConnectScreen(
             onDismiss = { showScanner = false },
             onServerScanned = { onQrScanned(it) },
         )
+
+        // Full-screen branded loader while the first connect runs — most
+        // visibly right after a pairing-QR scan, when the mesh may still be
+        // establishing (LAN probe → tunnel up → ULA probe can take a while).
+        // The small inline spinner stays for context; this owns the screen.
+        if (isConnecting) {
+            MeshLoadingScreen()
+        }
     }
 }
 
@@ -647,8 +686,10 @@ private fun sanitizeAddress(input: String): String {
         .trimEnd('/')
 }
 
-/** Test RPC connectivity. Accepts self-signed certs for local LAN servers. */
-private suspend fun testConnection(server: ServerEntry): Boolean {
+/** Test RPC connectivity. Accepts self-signed certs for local LAN servers.
+ *  [timeoutMs] is per-phase (connect / read) — mesh probes need far more
+ *  patience than LAN ones (first session through the tree can take 15s+). */
+private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000): Boolean {
     return withContext(Dispatchers.IO) {
         try {
             val url = URL("${server.toUrl()}/rpc/v1")
@@ -668,8 +709,8 @@ private suspend fun testConnection(server: ServerEntry): Boolean {
             }
 
             connection.requestMethod = "POST"
-            connection.connectTimeout = 5000
-            connection.readTimeout = 5000
+            connection.connectTimeout = timeoutMs
+            connection.readTimeout = timeoutMs
             connection.setRequestProperty("Content-Type", "application/json")
             connection.doOutput = true
             val body = """{"method":"server.echo","params":{"message":"ping"}}"""

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -23,20 +23,28 @@ import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.WindowInsetsSides
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.navigationBars
+import androidx.compose.foundation.layout.only
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.safeDrawing
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBars
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.windowInsetsBottomHeight
 import androidx.compose.foundation.layout.windowInsetsPadding
+import androidx.compose.foundation.layout.windowInsetsTopHeight
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
@@ -53,28 +61,50 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
+import androidx.compose.runtime.snapshotFlow
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.text.withStyle
 import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
 import androidx.compose.ui.viewinterop.AndroidView
+import android.webkit.ValueCallback
 import com.archipelago.app.R
+import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.components.GestureHintOverlay
+import com.archipelago.app.ui.components.MeshLoadingScreen
+import com.archipelago.app.ui.components.NESMenu
+import com.archipelago.app.ui.components.QrScannerOverlay
+import com.archipelago.app.ui.components.WalletQrScannerModal
 import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.ErrorRed
 import com.archipelago.app.ui.theme.SurfaceBlack
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import org.json.JSONObject
 
 /** Open a URL in the phone's default browser (genuinely external links). */
 private fun openExternalUrl(context: android.content.Context, url: String) {
@@ -104,6 +134,158 @@ private fun isSameHost(url: String, base: String): Boolean {
     }
 }
 
+/** Kiosk WebView retained across navigation (remote ⇄ dashboard) so leaving
+ *  the kiosk and coming back reattaches the LIVE page — no reload, no
+ *  re-login, no reconnect. Dropped on retry/disconnect/server change. */
+private object KioskWebView {
+    var instance: WebView? = null
+    var url: String? = null
+
+    // Live-composition delegates for the JS bridges (see the factory) — the
+    // registered interface objects call through these, so reattaching the
+    // retained view re-points them instead of leaving stale closures.
+    var onRouteOutbound: (String) -> Unit = {}
+    var onOpenInApp: (String) -> Unit = {}
+    var onQrOpen: () -> Unit = {}
+    var onQrStatus: (String, Boolean) -> Unit = { _, _ -> }
+    var onQrClose: () -> Unit = {}
+
+    fun drop() {
+        instance?.let {
+            (it.parent as? ViewGroup)?.removeView(it)
+            it.destroy()
+        }
+        instance = null
+        url = null
+    }
+}
+
+/** Inject the safe-area CSS vars from the CURRENT window insets. Android
+ *  WebView doesn't populate env(safe-area-inset-*); worse, on a cold start
+ *  onPageFinished can run before the view is attached — rootWindowInsets is
+ *  null then, and injecting 0px collapsed the UI's top/bottom margins (and
+ *  put the tab bar inside the gesture zone, killing its taps). Called from
+ *  onPageFinished, from the window-insets listener (fires when real insets
+ *  arrive), and on reattach. */
+private fun injectSafeAreaVars(view: WebView) {
+    val insets = view.rootWindowInsets ?: return // listener re-fires when real
+    val density = view.resources.displayMetrics.density
+    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
+    val sab = (insets.getInsets(android.view.WindowInsets.Type.navigationBars()).bottom / density).toInt()
+    view.evaluateJavascript(
+        """
+        (function() {
+            var style = document.getElementById('archipelago-android-insets');
+            if (!style) {
+                style = document.createElement('style');
+                style.id = 'archipelago-android-insets';
+                document.head.appendChild(style);
+            }
+            style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
+            // Vue components sample the var into reactive state; tell them it
+            // changed (an authenticated session can mount before we run).
+            window.dispatchEvent(new CustomEvent('archy-insets', { detail: { top: ${sat}, bottom: ${sab} } }));
+        })();
+        """.trimIndent(),
+        null,
+    )
+}
+
+/** In-app browser pages (node apps + same-node links) don't consume the
+ *  neode-ui `--safe-area-top` var, so with the WebView drawing edge-to-edge
+ *  their content ran up under the status bar. Pad the document body down by
+ *  the status-bar height: the padded strip shows the page's OWN background
+ *  (padding is inside the element), so the bar keeps the page colour while
+ *  content starts below it — the pre-edge-to-edge look, without the black bar.
+ *
+ *  Body padding only moves normal-flow content. fixed/sticky elements anchored
+ *  at the viewport top (IndeeHub's floating header) stayed glued under the
+ *  status bar, so we also push each of those down by the inset — once, marked
+ *  via data attribute — and keep a throttled MutationObserver running so
+ *  headers an SPA mounts after load get the same treatment.
+ *  Idempotent; runs on start (early) and finish (after the app rewrites head). */
+private fun injectTopInset(view: WebView) {
+    val insets = view.rootWindowInsets ?: return
+    val density = view.resources.displayMetrics.density
+    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
+    if (sat <= 0) return
+    view.evaluateJavascript(
+        """
+        (function() {
+            var SAT = $sat;
+            var s = document.getElementById('archy-top-inset');
+            if (!s) {
+                s = document.createElement('style');
+                s.id = 'archy-top-inset';
+                (document.head || document.documentElement).appendChild(s);
+            }
+            s.textContent =
+                'body{padding-top:' + SAT + 'px!important;box-sizing:border-box!important;}';
+            function push(el) {
+                if (el.dataset.archyInset) return;
+                var cs = getComputedStyle(el);
+                if (cs.position !== 'fixed' && cs.position !== 'sticky') return;
+                var top = parseFloat(cs.top); // 'auto' -> NaN skips bottom bars
+                if (isNaN(top) || top >= SAT) return;
+                el.style.setProperty('top', (top + SAT) + 'px', 'important');
+                el.dataset.archyInset = '1';
+            }
+            function sweep() {
+                if (!document.body) return;
+                // Fixed/sticky bars live shallow in the tree (portals mount on
+                // body); depth cap keeps the computed-style pass off big lists.
+                var els = document.body.querySelectorAll(
+                    'body > *, body > * > *, body > * > * > *, body > * > * > * > *');
+                for (var i = 0; i < els.length; i++) push(els[i]);
+            }
+            sweep();
+            if (!window.__archyInsetObserver) {
+                var queued = false, last = 0;
+                window.__archyInsetObserver = new MutationObserver(function() {
+                    if (queued) return;
+                    queued = true;
+                    var wait = Math.max(0, 250 - (Date.now() - last));
+                    setTimeout(function() {
+                        queued = false;
+                        last = Date.now();
+                        sweep();
+                    }, wait);
+                });
+                window.__archyInsetObserver.observe(document.documentElement,
+                    { childList: true, subtree: true });
+            }
+        })();
+        """.trimIndent(),
+        null,
+    )
+}
+
+/** True when a TCP listener answers at [base]'s host:port within [timeoutMs]. */
+private fun tcpAnswers(base: String, timeoutMs: Int): Boolean = try {
+    val u = android.net.Uri.parse(base)
+    val port = if (u.port != -1) u.port else if (u.scheme == "https") 443 else 80
+    java.net.Socket().use {
+        it.connect(java.net.InetSocketAddress(u.host, port), timeoutMs)
+        true
+    }
+} catch (_: Exception) {
+    false
+}
+
+/** Fastest answering origin: LAN inside a short window, else the mesh ULA
+ *  (patient — a cold session may still be establishing). If NEITHER answers,
+ *  fall back to the mesh URL when we have one — off-LAN the LAN IP is
+ *  unreachable, and loading it just produced a confusing "can't reach
+ *  192.168.x.x" error page (user-reported 2026-07-27). Targeting the mesh URL
+ *  instead means the load retries against the path that's actually coming up,
+ *  and any error shows the mesh address rather than a dead LAN IP. */
+private suspend fun pickStartUrl(lanUrl: String, meshUrl: String?): String =
+    withContext(Dispatchers.IO) {
+        if (tcpAnswers(lanUrl, 2500)) return@withContext lanUrl
+        if (meshUrl != null && tcpAnswers(meshUrl, 12_000)) return@withContext meshUrl
+        meshUrl ?: lanUrl
+    }
+
 /** Apply the WebView settings shared by the kiosk view and the in-app browser.
  *  These are tuned for SPA performance and parity with the mobile browser;
  *  none of them alter how a page renders visually. */
@@ -142,16 +324,53 @@ fun WebViewScreen(
     serverUrl: String,
     onDisconnect: () -> Unit,
     onRemoteInput: () -> Unit = {},
+    // Like onRemoteInput but landing on the keyboard (the hub menu's Keyboard card).
+    onRemoteKeyboard: () -> Unit = {},
+    // Opens the phone-to-phone Mesh Party screen; null hides its hub card.
+    onMeshParty: (() -> Unit)? = null,
     // Stored password for this server (from QR pairing or manual entry). When
     // non-blank, the login page is auto-filled and submitted — the one-step
     // demo flow from docs/companion-pairing-qr.md.
     serverPassword: String = "",
+    // Node's FIPS mesh URL (http://[fd…]). When the primary address fails on
+    // a main-frame load — typically the phone left the LAN — retry there
+    // before surfacing the error page: the mesh tunnel works from anywhere.
+    meshFallbackUrl: String? = null,
 ) {
     var isLoading by remember { mutableStateOf(true) }
+    // First kiosk load (often over the FIPS mesh) gets the full branded
+    // loader; later navigations keep just the slim top progress bar.
+    var firstLoadDone by remember { mutableStateOf(false) }
+    LaunchedEffect(Unit) {
+        snapshotFlow { isLoading }.first { !it }
+        firstLoadDone = true
+    }
     var loadProgress by remember { mutableIntStateOf(0) }
+    var triedMeshFallback by remember { mutableStateOf(false) }
     var hasError by remember { mutableStateOf(false) }
     var webView by remember { mutableStateOf<WebView?>(null) }
 
+    // Race LAN vs mesh BEFORE the WebView exists: Chromium pointed at an
+    // unreachable LAN IP burns a minute+ in connect retries before
+    // onReceivedError fires the mesh fallback — the "stuck connecting"
+    // stall. A raw TCP probe answers in milliseconds at home and fails in
+    // ~2.5s off-LAN, so startup lands on the right origin in seconds.
+    var startUrl by remember(serverUrl) { mutableStateOf<String?>(null) }
+    var raceNonce by remember { mutableIntStateOf(0) }
+    LaunchedEffect(serverUrl, meshFallbackUrl, raceNonce) {
+        // A retained live session exists — reattach instantly: no race, no
+        // reload, no re-login (remote ⇄ dashboard round trip).
+        if (KioskWebView.instance != null && KioskWebView.url == serverUrl) {
+            isLoading = false
+            startUrl = serverUrl
+            return@LaunchedEffect
+        }
+        val picked = pickStartUrl(serverUrl, meshFallbackUrl)
+        // Starting on the mesh: don't bounce back to it on error (it IS it).
+        if (picked != serverUrl) triedMeshFallback = true
+        startUrl = picked
+    }
+
     // Web-page camera access (wallet QR scanner). The WebView's default
     // WebChromeClient silently denies getUserMedia, so grant video capture —
     // asking for the app-level CAMERA permission first when needed.
@@ -171,6 +390,55 @@ fun WebViewScreen(
     // while this is shown, so closing it returns instantly with no reload.
     var inAppUrl by remember { mutableStateOf<String?>(null) }
 
+    // Same node = EITHER of its addresses. Over the mesh the kiosk's host is
+    // the ULA while app links may carry the LAN IP (and vice versa) —
+    // comparing against one host bounced same-node apps (Pine, Home
+    // Assistant, BTCPay) out to the phone's external browser.
+    fun isSameNode(url: String): Boolean =
+        isSameHost(url, serverUrl) ||
+            (meshFallbackUrl != null && isSameHost(url, meshFallbackUrl))
+
+    // Native wallet QR scanner, opened by the web UI via the ArchipelagoQr
+    // bridge; status lines stream back from the page while it's up.
+    var walletScannerVisible by remember { mutableStateOf(false) }
+    var walletScannerStatus by remember { mutableStateOf<Pair<String, Boolean>?>(null) }
+
+    // One-time three-finger-hold teaching overlay (initial=true: never flash
+    // it while DataStore is still loading).
+    val prefs = remember { ServerPreferences(webViewContext) }
+
+    // Hub menu overlay state — the three-finger hold opens the menu right here
+    // over the dashboard (it used to jump to the remote screen).
+    val savedServers by prefs.savedServers.collectAsState(initial = emptyList())
+    val activeServer by prefs.activeServer.collectAsState(initial = null)
+    var showHubMenu by remember { mutableStateOf(false) }
+    var showPairScanner by remember { mutableStateOf(false) }
+
+    val gestureHintSeen by prefs.gestureHintSeen.collectAsState(initial = true)
+    var gestureHintDismissed by remember { mutableStateOf(false) }
+    // Don't teach the gesture on top of the login/splash — arm the overlay
+    // ~2 minutes after the kiosk first finishes loading, once the user has
+    // settled in.
+    var gestureHintReady by remember { mutableStateOf(false) }
+    LaunchedEffect(Unit) {
+        snapshotFlow { isLoading }.first { !it }
+        delay(120_000)
+        gestureHintReady = true
+    }
+    val scope = rememberCoroutineScope()
+
+    // <input type="file"> support — without a chooser implementation the
+    // WebView silently ignores file inputs (broke the wallet's upload path).
+    var pendingFileChooser by remember { mutableStateOf<ValueCallback<Array<android.net.Uri>>?>(null) }
+    val fileChooserLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.StartActivityForResult(),
+    ) { result ->
+        pendingFileChooser?.onReceiveValue(
+            WebChromeClient.FileChooserParams.parseResult(result.resultCode, result.data),
+        )
+        pendingFileChooser = null
+    }
+
     BackHandler(enabled = inAppUrl == null && webView?.canGoBack() == true) {
         webView?.goBack()
     }
@@ -219,9 +487,16 @@ fun WebViewScreen(
                 GlassButton(
                     text = stringResource(R.string.retry),
                     onClick = {
+                        // Re-race LAN vs mesh — the network we're on may have
+                        // changed since the last pick. Drop the retained view:
+                        // an errored session must genuinely reload.
+                        KioskWebView.drop()
+                        webView = null
                         hasError = false
                         isLoading = true
-                        webView?.loadUrl(serverUrl)
+                        triedMeshFallback = false
+                        startUrl = null
+                        raceNonce++
                     },
                     modifier = Modifier.fillMaxWidth().height(56.dp),
                 )
@@ -230,17 +505,33 @@ fun WebViewScreen(
 
                 GlassButton(
                     text = stringResource(R.string.disconnect),
-                    onClick = onDisconnect,
+                    onClick = {
+                        KioskWebView.drop()
+                        onDisconnect()
+                    },
                     modifier = Modifier.fillMaxWidth().height(48.dp),
                 )
             }
+        } else if (startUrl == null) {
+            // Racing LAN vs mesh (≤2.5s at home, a few seconds off-LAN) —
+            // far cheaper than letting Chromium retry a dead LAN IP.
+            MeshLoadingScreen()
         } else {
             // Edge-to-edge WebView — background bleeds behind status bar.
             // Safe area values injected as CSS env() polyfill on each page load.
+            val initialUrl = startUrl ?: serverUrl
             AndroidView(
                 modifier = Modifier.fillMaxSize(),
                 factory = { context ->
-                    WebView(context).apply {
+                    // Reattach the retained kiosk WebView (remote ⇄ dashboard
+                    // must not reload the node UI). Everything configured
+                    // below is idempotent, and re-running it rebinds clients,
+                    // bridges and listeners to THIS composition's state —
+                    // stale closures from the previous visit are replaced.
+                    if (KioskWebView.url != serverUrl) KioskWebView.drop()
+                    val reused = KioskWebView.instance
+                    (reused ?: WebView(context)).apply {
+                        (parent as? ViewGroup)?.removeView(this)
                         layoutParams = ViewGroup.LayoutParams(
                             ViewGroup.LayoutParams.MATCH_PARENT,
                             ViewGroup.LayoutParams.MATCH_PARENT,
@@ -264,38 +555,90 @@ fun WebViewScreen(
 
                         val webViewRef = this
 
+                        // Re-inject the safe-area vars whenever REAL insets
+                        // arrive — on cold start onPageFinished often beats
+                        // window attachment and would otherwise bake in 0px.
+                        setOnApplyWindowInsetsListener { v, insets ->
+                            (v as? WebView)?.let { injectSafeAreaVars(it) }
+                            v.onApplyWindowInsets(insets)
+                        }
+
                         // Decide where an outbound URL goes:
                         //  - same host as the node  → in-app WebView overlay
                         //    (this is the "open in browser" target for apps the
                         //    kiosk couldn't iframe — keep the user inside the app)
                         //  - different host         → the phone's real browser
                         fun routeOutbound(url: String) {
-                            if (isSameHost(url, serverUrl)) {
+                            if (isSameNode(url)) {
                                 inAppUrl = url
                             } else {
                                 openExternalUrl(context, url)
                             }
                         }
 
+                        // Bridge callbacks are DELEGATED through the holder:
+                        // the interface objects registered on a retained
+                        // WebView survive recomposition, and re-registering
+                        // them doesn't reliably swap the JS-visible object
+                        // without a reload — with direct closures, a
+                        // remote ⇄ dashboard round trip left the bridges
+                        // writing to a dead composition's state ("apps don't
+                        // launch"). These assignments re-point the live
+                        // interface objects at THIS composition every attach.
+                        KioskWebView.onRouteOutbound = { url -> routeOutbound(url) }
+                        KioskWebView.onOpenInApp = { url -> inAppUrl = url }
+                        KioskWebView.onQrOpen = {
+                            walletScannerStatus = null
+                            walletScannerVisible = true
+                        }
+                        KioskWebView.onQrStatus = { msg, err -> walletScannerStatus = msg to err }
+                        KioskWebView.onQrClose = { walletScannerVisible = false }
+
                         // JS bridge. The web UI calls:
                         //   window.ArchipelagoNative.openExternal(url) — host-routed
                         //   window.ArchipelagoNative.openInApp(url)    — force in-app
                         // Falls back to window.open in a plain mobile browser.
-                        addJavascriptInterface(
+                        if (reused == null) addJavascriptInterface(
                             object {
                                 @android.webkit.JavascriptInterface
                                 fun openExternal(url: String) {
-                                    webViewRef.post { routeOutbound(url) }
+                                    webViewRef.post { KioskWebView.onRouteOutbound(url) }
                                 }
 
                                 @android.webkit.JavascriptInterface
                                 fun openInApp(url: String) {
-                                    webViewRef.post { inAppUrl = url }
+                                    webViewRef.post { KioskWebView.onOpenInApp(url) }
                                 }
                             },
                             "ArchipelagoNative",
                         )
 
+                        // Wallet QR bridge. The web scan modal calls:
+                        //   window.ArchipelagoQr.open()             — show the native scanner
+                        //   window.ArchipelagoQr.setStatus(msg, e)  — mirror status/progress lines
+                        //   window.ArchipelagoQr.close()            — code accepted, tear down
+                        // Decodes flow back through window.__archyQrResult(text);
+                        // a user cancel calls window.__archyQrCancelled().
+                        if (reused == null) addJavascriptInterface(
+                            object {
+                                @android.webkit.JavascriptInterface
+                                fun open() {
+                                    webViewRef.post { KioskWebView.onQrOpen() }
+                                }
+
+                                @android.webkit.JavascriptInterface
+                                fun setStatus(message: String, isError: Boolean) {
+                                    webViewRef.post { KioskWebView.onQrStatus(message, isError) }
+                                }
+
+                                @android.webkit.JavascriptInterface
+                                fun close() {
+                                    webViewRef.post { KioskWebView.onQrClose() }
+                                }
+                            },
+                            "ArchipelagoQr",
+                        )
+
                         webViewClient = object : WebViewClient() {
                             override fun onPageStarted(view: WebView?, url: String?, favicon: Bitmap?) {
                                 isLoading = true
@@ -306,38 +649,16 @@ fun WebViewScreen(
                                 isLoading = false
                                 if (view == null) return
 
-                                // Convert physical pixels → CSS pixels
-                                val density = view.resources.displayMetrics.density
-                                val satPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.statusBars())
-                                    ?.top ?: 0
-                                val sabPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.navigationBars())
-                                    ?.bottom ?: 0
-                                val sat = (satPx / density).toInt()
-                                val sab = (sabPx / density).toInt()
-
-                                // Android WebView doesn't populate env(safe-area-inset-*).
-                                // Set CSS custom properties the web UI can use as fallback:
-                                //   var(--safe-area-top, env(safe-area-inset-top, 0px))
-                                view.evaluateJavascript(
-                                    """
-                                    (function() {
-                                        var style = document.getElementById('archipelago-android-insets');
-                                        if (!style) {
-                                            style = document.createElement('style');
-                                            style.id = 'archipelago-android-insets';
-                                            document.head.appendChild(style);
-                                        }
-                                        style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
-                                    })();
-                                    """.trimIndent(),
-                                    null,
-                                )
+                                injectSafeAreaVars(view)
 
                                 // Auto-login with the stored password (QR pairing /
-                                // saved server) — only on our own server's pages.
-                                if (serverPassword.isNotBlank() && url != null && url.startsWith(serverUrl)) {
+                                // saved server) — only on our own server's pages
+                                // (LAN origin or the mesh address).
+                                val onOwnServer = url != null && (
+                                    url.startsWith(serverUrl) ||
+                                        (meshFallbackUrl != null && url.startsWith(meshFallbackUrl))
+                                    )
+                                if (serverPassword.isNotBlank() && onOwnServer) {
                                     view.evaluateJavascript(buildAutoLoginScript(serverPassword), null)
                                 }
                             }
@@ -348,6 +669,15 @@ fun WebViewScreen(
                                 error: WebResourceError?,
                             ) {
                                 if (request?.isForMainFrame == true) {
+                                    val mesh = meshFallbackUrl
+                                    if (mesh != null && !triedMeshFallback &&
+                                        request.url?.toString()?.startsWith(mesh) != true
+                                    ) {
+                                        triedMeshFallback = true
+                                        isLoading = true
+                                        view?.loadUrl(mesh)
+                                        return
+                                    }
                                     hasError = true
                                     isLoading = false
                                 }
@@ -366,7 +696,7 @@ fun WebViewScreen(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameHost(u, serverUrl)) {
+                                if (u != null && isSameNode(u)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -380,6 +710,8 @@ fun WebViewScreen(
                                 val url = request?.url?.toString() ?: return false
                                 // Keep kiosk navigation (same origin incl. port) in place
                                 if (url.startsWith(serverUrl)) return false
+                                // Mesh address is the same server too
+                                if (meshFallbackUrl != null && url.startsWith(meshFallbackUrl)) return false
                                 // Same node (other port) → in-app; external → browser
                                 routeOutbound(url)
                                 return true
@@ -391,6 +723,27 @@ fun WebViewScreen(
                                 loadProgress = newProgress
                             }
 
+                            override fun onShowFileChooser(
+                                view: WebView?,
+                                filePathCallback: ValueCallback<Array<android.net.Uri>>?,
+                                fileChooserParams: FileChooserParams?,
+                            ): Boolean {
+                                pendingFileChooser?.onReceiveValue(null)
+                                pendingFileChooser = filePathCallback
+                                val intent = fileChooserParams?.createIntent()
+                                if (intent == null) {
+                                    pendingFileChooser = null
+                                    return false
+                                }
+                                return try {
+                                    fileChooserLauncher.launch(intent)
+                                    true
+                                } catch (_: Exception) {
+                                    pendingFileChooser = null
+                                    false
+                                }
+                            }
+
                             // Wallet QR scanner: grant the page camera access.
                             // Only video capture is granted — anything else the
                             // page asks for is denied as before.
@@ -446,31 +799,34 @@ fun WebViewScreen(
                             }
                         }
 
-                        // Two-finger hold (500ms) → navigate to remote input
-                        var twoFingerStart = 0L
-                        var twoFingerFired = false
+                        // Three-finger hold (500ms) → open the hub menu overlay
+                        // in place (Remote/Keyboard cards do the navigating).
+                        // Three fingers, not two: two-finger scroll/pinch on the
+                        // page collided with the old two-finger hold.
+                        var threeFingerStart = 0L
+                        var threeFingerFired = false
                         setOnTouchListener { _, event ->
                             val pointerCount = event.pointerCount
                             when (event.actionMasked) {
                                 android.view.MotionEvent.ACTION_POINTER_DOWN -> {
-                                    if (pointerCount >= 2) {
-                                        twoFingerStart = System.currentTimeMillis()
-                                        twoFingerFired = false
+                                    if (pointerCount >= 3) {
+                                        threeFingerStart = System.currentTimeMillis()
+                                        threeFingerFired = false
                                     }
                                 }
                                 android.view.MotionEvent.ACTION_MOVE -> {
-                                    if (pointerCount >= 2 && !twoFingerFired && twoFingerStart > 0) {
-                                        if (System.currentTimeMillis() - twoFingerStart > 500) {
-                                            twoFingerFired = true
-                                            onRemoteInput()
+                                    if (pointerCount >= 3 && !threeFingerFired && threeFingerStart > 0) {
+                                        if (System.currentTimeMillis() - threeFingerStart > 500) {
+                                            threeFingerFired = true
+                                            showHubMenu = true
                                         }
                                     }
                                 }
                                 android.view.MotionEvent.ACTION_UP,
                                 android.view.MotionEvent.ACTION_POINTER_UP,
                                 android.view.MotionEvent.ACTION_CANCEL -> {
-                                    if (event.pointerCount <= 2) {
-                                        twoFingerStart = 0L
+                                    if (event.pointerCount <= 3) {
+                                        threeFingerStart = 0L
                                     }
                                 }
                             }
@@ -478,7 +834,21 @@ fun WebViewScreen(
                         }
 
                         webView = this
-                        loadUrl(serverUrl)
+                        if (reused == null) {
+                            KioskWebView.instance = this
+                            KioskWebView.url = serverUrl
+                            loadUrl(initialUrl)
+                        } else {
+                            // Reattached views keep stale measurements until an
+                            // input event — that was the top/bottom UI being
+                            // wrong until a tap. Force a fresh pass, and re-sync
+                            // the page's safe-area vars while we're at it.
+                            post {
+                                requestLayout()
+                                invalidate()
+                                injectSafeAreaVars(this)
+                            }
+                        }
                     }
                 },
             )
@@ -497,16 +867,144 @@ fun WebViewScreen(
                 )
             }
 
+            // Branded first-load screen while the mesh session comes up.
+            AnimatedVisibility(
+                visible = isLoading && !firstLoadDone,
+                enter = fadeIn(),
+                exit = fadeOut(),
+            ) {
+                Column(
+                    Modifier.fillMaxSize().background(SurfaceBlack),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.Center,
+                ) {
+                    Text(
+                        buildAnnotatedString {
+                            withStyle(SpanStyle(color = ErrorRed)) { append("F*CK") }
+                            withStyle(SpanStyle(color = TextPrimary)) { append(" IPS") }
+                        },
+                        fontSize = 40.sp,
+                        fontWeight = FontWeight.Black,
+                        letterSpacing = 4.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                    Spacer(Modifier.height(10.dp))
+                    Text(
+                        "connecting to your archipelago",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        letterSpacing = 1.sp,
+                    )
+                    Spacer(Modifier.height(28.dp))
+                    CircularProgressIndicator(color = BitcoinOrange)
+                }
+            }
+
             // In-app browser overlay for non-iframeable node apps. Rendered last
             // so it sits above the kiosk WebView, which stays alive underneath.
             inAppUrl?.let { target ->
                 InAppBrowser(
                     url = target,
                     serverUrl = serverUrl,
+                    meshUrl = meshFallbackUrl,
                     onClose = { inAppUrl = null },
                 )
             }
+
+            // Native wallet QR scanner, opened by the page via ArchipelagoQr.
+            WalletQrScannerModal(
+                visible = walletScannerVisible,
+                status = walletScannerStatus,
+                onDecoded = { text ->
+                    webView?.evaluateJavascript(
+                        "window.__archyQrResult && window.__archyQrResult(${JSONObject.quote(text)})",
+                        null,
+                    )
+                },
+                onDismiss = {
+                    walletScannerVisible = false
+                    webView?.evaluateJavascript(
+                        "window.__archyQrCancelled && window.__archyQrCancelled()",
+                        null,
+                    )
+                },
+            )
+
+            // First-launch teaching overlay for the three-finger hold — armed
+            // ~2 minutes after login so it never fights the splash/first look.
+            if (gestureHintReady && !gestureHintSeen && !gestureHintDismissed &&
+                !isLoading && inAppUrl == null
+            ) {
+                GestureHintOverlay(
+                    onDismiss = {
+                        gestureHintDismissed = true
+                        scope.launch { prefs.markGestureHintSeen() }
+                    },
+                )
+            }
         }
+
+        // Hub menu overlay — opened by the three-finger hold, drawn above
+        // everything (also reachable from the error screen, where switching
+        // servers is exactly what's needed).
+        NESMenu(
+            visible = showHubMenu,
+            servers = savedServers,
+            activeServer = activeServer,
+            onDismiss = { showHubMenu = false },
+            onSelectServer = { server ->
+                showHubMenu = false
+                scope.launch { prefs.setActiveServer(server) }
+            },
+            onAddServer = { server ->
+                scope.launch {
+                    prefs.addSavedServer(server)
+                    if (activeServer == null) prefs.setActiveServer(server)
+                }
+            },
+            onScanQr = { showPairScanner = true },
+            onEditServer = { original, updated ->
+                scope.launch {
+                    prefs.updateSavedServer(original, updated)
+                    // Editing the live server reloads the kiosk with the new
+                    // address/credentials via the activeServer recomposition.
+                    if (original.serialize() == activeServer?.serialize()) {
+                        prefs.setActiveServer(updated)
+                    }
+                }
+            },
+            onRemoveServer = { server ->
+                scope.launch {
+                    prefs.removeSavedServer(server)
+                    // Nothing left to show — back to the Connect screen.
+                    val remaining = savedServers.count { it.serialize() != server.serialize() }
+                    if (remaining == 0) {
+                        prefs.clearActiveServer()
+                        showHubMenu = false
+                        onDisconnect()
+                    }
+                }
+            },
+            onRemote = { showHubMenu = false; onRemoteInput() },
+            onKeyboard = { showHubMenu = false; onRemoteKeyboard() },
+            onBackToWebView = { showHubMenu = false },
+            onMeshParty = onMeshParty?.let { open -> { showHubMenu = false; open() } },
+        )
+
+        // Pairing-QR scan launched from the menu's Nodes page; the menu stays
+        // open behind it so the new entry appears as soon as it closes.
+        QrScannerOverlay(
+            visible = showPairScanner,
+            onDismiss = { showPairScanner = false },
+            onServerScanned = { scan ->
+                showPairScanner = false
+                scope.launch {
+                    val merged = prefs.upsertServer(scan.server)
+                    FipsManager.registerNode(webViewContext, scan.fips, merged.displayName())
+                    if (activeServer == null) prefs.setActiveServer(merged)
+                }
+            },
+        )
     }
 }
 
@@ -544,11 +1042,26 @@ private fun fetchFavicon(pageUrl: String): Bitmap? {
 private fun InAppBrowser(
     url: String,
     serverUrl: String,
+    meshUrl: String? = null,
     onClose: () -> Unit,
 ) {
     val context = LocalContext.current
+    // Same-node check across BOTH node addresses (LAN + mesh ULA) — see the
+    // kiosk's isSameNode; a mismatch here bounced app links to the browser.
+    fun isSameNode(u: String): Boolean =
+        isSameHost(u, serverUrl) || (meshUrl != null && isSameHost(u, meshUrl))
     var browser by remember { mutableStateOf<WebView?>(null) }
-    var title by remember { mutableStateOf(android.net.Uri.parse(url).host ?: url) }
+    // Loader title: never show a raw IP host — a mesh ULA like
+    // [fd79:1aa:…] is technically the host but reads as garbage on the
+    // loading screen. Show a neutral name until the page reports its
+    // real <title> (onReceivedTitle upgrades it).
+    var title by remember {
+        mutableStateOf(
+            android.net.Uri.parse(url).host
+                ?.takeUnless { it.contains(':') || it.matches(Regex("^\\d+(\\.\\d+){3}$")) }
+                ?: "Archipelago",
+        )
+    }
     var favicon by remember { mutableStateOf<Bitmap?>(null) }
     var progress by remember { mutableIntStateOf(0) }
     var loading by remember { mutableStateOf(true) }
@@ -586,7 +1099,22 @@ private fun InAppBrowser(
         modifier = Modifier
             .fillMaxSize()
             .background(SurfaceBlack)
-            .windowInsetsPadding(WindowInsets.safeDrawing),
+            // Whole-overlay touch shield: every touch not handled by a child
+            // (control-bar gaps, inset strips) dies here instead of falling
+            // through to the kiosk's tab bar behind (a near-miss on Close
+            // was opening the AIUI tab underneath).
+            .clickable(
+                interactionSource = remember { MutableInteractionSource() },
+                indication = null,
+                onClick = {},
+            )
+            // Bottom inset handled by the touch-shield strip below the bar.
+            // No TOP inset padding: the WebView draws edge-to-edge behind the
+            // status bar so the app's own background fills it — the padded
+            // version painted an opaque black bar there (user-rejected look).
+            .windowInsetsPadding(
+                WindowInsets.safeDrawing.only(WindowInsetsSides.Horizontal)
+            ),
     ) {
         // WebView + loading overlay fill the area above the bottom control bar.
         Box(modifier = Modifier.weight(1f).fillMaxWidth()) {
@@ -637,12 +1165,14 @@ private fun InAppBrowser(
                         webViewClient = object : WebViewClient() {
                             override fun onPageStarted(view: WebView?, u: String?, favicon: Bitmap?) {
                                 loading = true
+                                view?.let { injectTopInset(it) }
                             }
 
                             override fun onPageFinished(view: WebView?, u: String?) {
                                 loading = false
                                 canGoBack = view?.canGoBack() == true
                                 canGoForward = view?.canGoForward() == true
+                                view?.let { injectTopInset(it) }
                             }
 
                             override fun doUpdateVisitedHistory(view: WebView?, u: String?, isReload: Boolean) {
@@ -660,7 +1190,7 @@ private fun InAppBrowser(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameHost(u, serverUrl)) {
+                                if (u != null && isSameNode(u)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -674,7 +1204,7 @@ private fun InAppBrowser(
                                 val u = request?.url?.toString() ?: return false
                                 // Stay in the overlay for same-node navigation;
                                 // hand genuinely external links to the real browser.
-                                if (isSameHost(u, serverUrl)) return false
+                                if (isSameNode(u)) return false
                                 openExternalUrl(ctx, u)
                                 return true
                             }
@@ -775,6 +1305,21 @@ private fun InAppBrowser(
                 )
             }
         }
+
+        // Touch-shield over the gesture-nav strip: solid black AND consumes
+        // taps — stray touches below the control bar landed on the kiosk's
+        // tab bar behind this overlay (opening the AIUI chat by accident).
+        Box(
+            Modifier
+                .fillMaxWidth()
+                .windowInsetsBottomHeight(WindowInsets.navigationBars)
+                .background(Color.Black)
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = {},
+                ),
+        )
     }
 }
 

Android/app/src/main/res/values/strings.xml

@@ -11,6 +11,7 @@
     <string name="welcome_title">Your Sovereign\nPersonal Server</string>
     <string name="welcome_subtitle">Bitcoin node, app platform, and private cloud — all in one box you control.</string>
     <string name="get_started">Get Started</string>
+    <string name="mesh_party">Mesh Party</string>
     <string name="use_https">Use HTTPS</string>
     <string name="port_label">Port (optional)</string>
     <string name="saved_servers">Saved Servers</string>
@@ -41,4 +42,11 @@
     <string name="edit_server_title">Edit Server</string>
     <string name="save_changes">Save Changes</string>
     <string name="cancel">Cancel</string>
+    <string name="gesture_hint_title">Hold with three fingers</string>
+    <string name="gesture_hint_body">Anywhere in the app — opens the remote control and menu</string>
+    <string name="gesture_hint_got_it">Got it</string>
+    <string name="scan_to_send">Scan to send</string>
+    <string name="scan_wallet_hint">Point the camera at a Lightning invoice, Bitcoin address, Cashu or Fedimint code</string>
+    <string name="upload_qr_image">Upload image</string>
+    <string name="no_qr_in_image">No QR code found in that image — try another, closer and well-lit</string>
 </resources>

Android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- FileProvider scope for the party-screen "Share this app" APK handoff. -->
+<paths>
+    <cache-path name="share" path="share/" />
+</paths>

Android/rust/archy-fips-core/Cargo.toml

@@ -0,0 +1,48 @@
+# Embedded FIPS mesh node for the Archipelago companion app.
+#
+# Built for Android via cargo-ndk (see Android/app/build.gradle.kts, task
+# buildRustArm64) into app/src/main/jniLibs/arm64-v8a/libarchy_fips_core.so.
+# Also builds on the host so `cargo test` covers the non-JNI logic.
+#
+# `fips` is pinned to the fips-native fork rev that this integration was
+# developed against — the fork carries Android support upstream lacks
+# (Tun::from_fd for a VpnService-owned fd, cfg(target_os = "android") paths).
+# Override with a local checkout when hacking on fips itself:
+#   CARGO_NET_OFFLINE=false cargo ndk ... --config 'patch."https://github.com/9qeklajc/fips-native".fips.path="/path/to/fips-native/fips"'
+[package]
+name = "archy-fips-core"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+publish = false
+
+[lib]
+name = "archy_fips_core"
+# rlib for host tests; cdylib for the Android shared library.
+crate-type = ["lib", "cdylib"]
+
+[dependencies]
+# default-features drops the ratatui TUI; tun-support enables Node::start_with_tun_fd.
+# Zazawowow/fips-native `fast-join-pinned` = upstream pinned rev 46494a74 +
+# discovery re-fire on topology change (fresh 5G join: first route no longer
+# waits out doomed pre-join lookups). Upstream 9qeklajc denies pushes.
+fips = { git = "https://github.com/Zazawowow/fips-native", rev = "07d21d4482be56b14295d2525e41f8386d1bfe6f", default-features = false, features = ["tun-support"] }
+anyhow = "1.0"
+serde_json = "1.0"
+hex = "0.4"
+# OS CSPRNG for identity generation (crypto rule: no thread-local RNG for keys).
+getrandom = "0.2"
+tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros"] }
+tracing = "0.1"
+# fcntl: force the VpnService TUN fd into blocking mode (see mesh::start).
+libc = "0.2"
+
+# The JNI surface only exists on Android; host builds skip it and drive the
+# mesh module directly (tests).
+[target.'cfg(target_os = "android")'.dependencies]
+jni = "0.21"
+# Bridge `tracing` (ours + fips) to logcat: `adb logcat -s archy-fips`.
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+paranoid-android = "0.2"
+
+[workspace]

Android/rust/archy-fips-core/src/jni_glue.rs

@@ -0,0 +1,129 @@
+//! JNI surface for `com.archipelago.app.fips.FipsNative` — JSON over strings,
+//! no codegen (the myco / nostr-vpn embedding pattern). Errors come back as
+//! `{"error": "…"}` so Kotlin never sees a raw exception from native code.
+
+use std::sync::Once;
+
+use jni::objects::{JClass, JString};
+use jni::sys::{jboolean, jint, jstring};
+use jni::JNIEnv;
+
+use crate::mesh;
+
+static LOG_INIT: Once = Once::new();
+
+fn init_logging() {
+    LOG_INIT.call_once(|| {
+        use tracing_subscriber::layer::SubscriberExt;
+        use tracing_subscriber::util::SubscriberInitExt;
+        let _ = tracing_subscriber::registry()
+            .with(tracing_subscriber::EnvFilter::new("info"))
+            .with(paranoid_android::layer("archy-fips"))
+            .try_init();
+    });
+}
+
+fn jstr(env: &mut JNIEnv, s: &JString) -> String {
+    env.get_string(s).map(|s| s.into()).unwrap_or_default()
+}
+
+fn out(env: &JNIEnv, s: String) -> jstring {
+    env.new_string(s)
+        .map(|s| s.into_raw())
+        .unwrap_or(std::ptr::null_mut())
+}
+
+fn err_json(e: impl std::fmt::Display) -> String {
+    serde_json::json!({ "error": e.to_string() }).to_string()
+}
+
+fn identity_json(info: &mesh::IdentityInfo) -> String {
+    serde_json::json!({
+        "secret": info.secret_hex,
+        "npub": info.npub,
+        "address": info.address,
+    })
+    .to_string()
+}
+
+/// Kotlin: `external fun generateIdentity(): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_generateIdentity(
+    env: JNIEnv,
+    _class: JClass,
+) -> jstring {
+    init_logging();
+    let json = match mesh::generate_identity() {
+        Ok(info) => identity_json(&info),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun deriveIdentity(secret: String): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_deriveIdentity(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret: JString,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret);
+    let json = match mesh::derive_identity(&secret) {
+        Ok(info) => identity_json(&info),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String`
+/// Returns `{"npub": "...", "address": "..."}` or `{"error": "..."}`.
+/// `listenPort` 0 = outbound-only; non-zero = fixed UDP bind (party mode).
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_start(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret: JString,
+    peers_json: JString,
+    tun_fd: jint,
+    listen_port: jint,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret);
+    let peers = jstr(&mut env, &peers_json);
+    let listen_port = u16::try_from(listen_port).unwrap_or(0);
+    let json = match mesh::start(&secret, &peers, tun_fd, listen_port) {
+        Ok((npub, address)) => {
+            serde_json::json!({ "npub": npub, "address": address }).to_string()
+        }
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun stop()`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_stop(
+    _env: JNIEnv,
+    _class: JClass,
+) {
+    mesh::stop();
+}
+
+/// Kotlin: `external fun isRunning(): Boolean`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_isRunning(
+    _env: JNIEnv,
+    _class: JClass,
+) -> jboolean {
+    mesh::is_running() as jboolean
+}
+
+/// Kotlin: `external fun statusJson(): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_statusJson(
+    env: JNIEnv,
+    _class: JClass,
+) -> jstring {
+    out(&env, mesh::status_json())
+}

Android/rust/archy-fips-core/src/lib.rs

@@ -0,0 +1,17 @@
+//! Embedded FIPS mesh node for the Archipelago companion app.
+//!
+//! The phone runs a real, leaf-only FIPS node in-process: Android's
+//! `VpnService` owns the TUN fd (routing only `fd00::/8`, so normal traffic
+//! never touches the tunnel) and hands it to [`fips::Node::start_with_tun_fd`].
+//! Peering is outbound-only — the pairing QR carries the node's npub and
+//! transport endpoints, and FIPS nodes accept inbound peers without prior
+//! registration, so no server-side enrollment step exists.
+//!
+//! The JNI surface (`jni_glue`, Android-only) is deliberately tiny and
+//! JSON-over-strings, mirroring the myco / nostr-vpn embedding pattern:
+//! `generateIdentity`, `deriveIdentity`, `start`, `stop`, `isRunning`.
+
+pub mod mesh;
+
+#[cfg(target_os = "android")]
+mod jni_glue;

Android/rust/archy-fips-core/src/mesh.rs

@@ -0,0 +1,295 @@
+//! Mesh lifecycle: identity, config assembly, and the node task.
+//!
+//! Host-buildable (no JNI) so the config/identity logic is unit-testable;
+//! only [`start`] needs a real TUN fd and therefore only runs on-device.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use anyhow::{anyhow, Context, Result};
+use fips::config::{PeerConfig, TransportInstances, UdpConfig};
+use fips::{Config, Identity, Node};
+use tokio::sync::Notify;
+
+/// How long `start` waits for the node to come up (TUN attach + transports).
+const START_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// How long `stop` waits for the node task to drain.
+const STOP_TIMEOUT: Duration = Duration::from_secs(5);
+
+struct MeshHandle {
+    runtime: tokio::runtime::Runtime,
+    task: Option<tokio::task::JoinHandle<()>>,
+    shutdown: Arc<Notify>,
+    running: Arc<AtomicBool>,
+    npub: String,
+    address: String,
+}
+
+static MESH: Mutex<Option<MeshHandle>> = Mutex::new(None);
+
+#[derive(Debug, Clone)]
+pub struct IdentityInfo {
+    pub secret_hex: String,
+    pub npub: String,
+    /// The phone's own ULA on the mesh (fd::/8), for VpnService.addAddress.
+    pub address: String,
+}
+
+/// Generate a fresh mesh identity from the OS CSPRNG.
+pub fn generate_identity() -> Result<IdentityInfo> {
+    // ~1 in 2^128 chance a candidate is off the curve; loop regardless.
+    loop {
+        let mut bytes = [0u8; 32];
+        getrandom::getrandom(&mut bytes).context("OS RNG")?;
+        if let Ok(id) = Identity::from_secret_bytes(&bytes) {
+            return Ok(IdentityInfo {
+                secret_hex: hex::encode(bytes),
+                npub: id.npub(),
+                address: id.address().to_ipv6().to_string(),
+            });
+        }
+    }
+}
+
+/// Re-derive npub + ULA from a stored secret.
+pub fn derive_identity(secret: &str) -> Result<IdentityInfo> {
+    let id = Identity::from_secret_str(secret).map_err(|e| anyhow!("bad secret: {e}"))?;
+    Ok(IdentityInfo {
+        secret_hex: secret.to_string(),
+        npub: id.npub(),
+        address: id.address().to_ipv6().to_string(),
+    })
+}
+
+/// Build the phone-side node config: leaf-only (never routes third-party
+/// traffic — battery), no DNS responder, TUN enabled but attached to the
+/// VpnService fd rather than created.
+///
+/// `listen_port` 0 = ephemeral UDP (outbound-only, the default posture).
+/// Non-zero = fixed UDP bind so a nearby phone can dial us directly over a
+/// local link (party mode); leaf_only still guarantees we never carry
+/// third-party transit even while accepting an inbound link.
+pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> Config {
+    let mut cfg = Config::default();
+    cfg.node.identity.nsec = Some(secret.to_string());
+    cfg.node.identity.persistent = false;
+    cfg.node.leaf_only = true;
+    cfg.tun.enabled = true;
+    cfg.tun.mtu = Some(1280);
+    cfg.dns.enabled = false;
+    cfg.transports.udp = TransportInstances::Single(UdpConfig {
+        bind_addr: Some(format!("0.0.0.0:{listen_port}")),
+        ..Default::default()
+    });
+    // TCP with no bind_addr = outbound-only (fallback when UDP is blocked).
+    cfg.transports.tcp = TransportInstances::Single(Default::default());
+    // Fast-connect profile — a phone opens the app and expects the node NOW.
+    // Stock pacing is tuned for always-on routers: a failed discovery backs
+    // off 30s, session resends gap out to 8-16s, dead links redial at
+    // 5s→300s. Over 5G that stacked into a ~40s first connect (observed
+    // 2026-07-24: anchor +10s, session +40s). Retries only fire while a
+    // link/session is down, so steady-state traffic is unchanged.
+    cfg.node.retry.base_interval_secs = 1; // dead-link redial 1s,2s,4s…
+    cfg.node.retry.max_backoff_secs = 30; // …capped at 30s, not 5 min
+    cfg.node.retry.max_retries = 30;
+    cfg.node.rate_limit.handshake_resend_interval_ms = 400;
+    cfg.node.rate_limit.handshake_resend_backoff = 1.5;
+    cfg.node.rate_limit.handshake_max_resends = 10;
+    cfg.node.discovery.backoff_base_secs = 1; // failed lookup retries fast
+    cfg.node.discovery.backoff_max_secs = 30;
+    cfg.node.discovery.retry_interval_secs = 2;
+    cfg.node.discovery.max_attempts = 3;
+    // Lookups launched before the tree position settles are doomed; a 10s
+    // completion timeout made each one cost 10s before the 1s retry could
+    // fire (observed: 19s to a route on a fresh join). Fail fast instead —
+    // the resend-within-window above still gives each attempt two shots.
+    cfg.node.discovery.timeout_secs = 5;
+    cfg.peers = peers;
+    cfg
+}
+
+/// Parse the peers JSON handed over from Kotlin. Shape = fips `PeerConfig`:
+/// `[{"npub":"…","alias":"…","addresses":[{"transport":"udp","addr":"host:2121","priority":10},…]}]`
+pub fn parse_peers(peers_json: &str) -> Result<Vec<PeerConfig>> {
+    serde_json::from_str(peers_json).context("peers JSON")
+}
+
+/// Start the mesh node on the given TUN fd (from `VpnService.establish()`,
+/// detached — the node owns it from here). Returns (npub, ula) on success.
+/// Any previously running node is stopped first.
+pub fn start(secret: &str, peers_json: &str, tun_fd: i32, listen_port: u16) -> Result<(String, String)> {
+    stop();
+
+    // Android hands the VpnService TUN fd over in non-blocking mode on some
+    // OS builds. The fips TUN reader is a dedicated blocking-read thread that
+    // treats EAGAIN as fatal — the loop died at startup ("TUN read error …
+    // Try again (os error 11)" on-device), so sessions came up but no packet
+    // ever entered the mesh. Force the fd into the blocking mode the reader
+    // is designed for.
+    unsafe {
+        let flags = libc::fcntl(tun_fd, libc::F_GETFL);
+        if flags >= 0 && (flags & libc::O_NONBLOCK) != 0 {
+            libc::fcntl(tun_fd, libc::F_SETFL, flags & !libc::O_NONBLOCK);
+        }
+    }
+
+    let peers = parse_peers(peers_json)?;
+    let config = build_config(secret, peers, listen_port);
+    let mut node = Node::new(config).map_err(|e| anyhow!("node init: {e}"))?;
+    let npub = node.npub();
+    let address = node.identity().address().to_ipv6().to_string();
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .thread_name("archy-fips")
+        .build()
+        .context("tokio runtime")?;
+
+    let shutdown = Arc::new(Notify::new());
+    let running = Arc::new(AtomicBool::new(false));
+    let (started_tx, started_rx) = tokio::sync::oneshot::channel::<Result<()>>();
+
+    let task = {
+        let shutdown = shutdown.clone();
+        let running = running.clone();
+        runtime.spawn(async move {
+            match node.start_with_tun_fd(tun_fd).await {
+                Ok(()) => {
+                    running.store(true, Ordering::SeqCst);
+                    let _ = started_tx.send(Ok(()));
+                }
+                Err(e) => {
+                    let _ = started_tx.send(Err(anyhow!("node start: {e}")));
+                    return;
+                }
+            }
+            tokio::select! {
+                result = node.run_rx_loop() => {
+                    if let Err(e) = result {
+                        tracing::error!("mesh rx loop error: {e}");
+                    }
+                }
+                _ = shutdown.notified() => {}
+            }
+            if let Err(e) = node.stop().await {
+                tracing::warn!("mesh stop: {e}");
+            }
+            running.store(false, Ordering::SeqCst);
+        })
+    };
+
+    let started = runtime
+        .block_on(async { tokio::time::timeout(START_TIMEOUT, started_rx).await })
+        .map_err(|_| anyhow!("node start timed out"))?
+        .map_err(|_| anyhow!("node task died during start"))?;
+    if let Err(e) = started {
+        runtime.shutdown_background();
+        return Err(e);
+    }
+
+    *MESH.lock().unwrap() = Some(MeshHandle {
+        runtime,
+        task: Some(task),
+        shutdown,
+        running,
+        npub: npub.clone(),
+        address: address.clone(),
+    });
+    Ok((npub, address))
+}
+
+/// Stop the mesh node if running. Idempotent.
+pub fn stop() {
+    let Some(mut handle) = MESH.lock().unwrap().take() else {
+        return;
+    };
+    handle.shutdown.notify_waiters();
+    if let Some(task) = handle.task.take() {
+        let _ = handle
+            .runtime
+            .block_on(async { tokio::time::timeout(STOP_TIMEOUT, task).await });
+    }
+    handle.runtime.shutdown_background();
+}
+
+pub fn is_running() -> bool {
+    MESH.lock()
+        .unwrap()
+        .as_ref()
+        .map(|h| h.running.load(Ordering::SeqCst))
+        .unwrap_or(false)
+}
+
+/// `{running, npub, address}` for the Kotlin status surface.
+pub fn status_json() -> String {
+    let guard = MESH.lock().unwrap();
+    match guard.as_ref() {
+        Some(h) => serde_json::json!({
+            "running": h.running.load(Ordering::SeqCst),
+            "npub": h.npub,
+            "address": h.address,
+        })
+        .to_string(),
+        None => serde_json::json!({ "running": false }).to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn identity_roundtrip() {
+        let a = generate_identity().unwrap();
+        let b = derive_identity(&a.secret_hex).unwrap();
+        assert_eq!(a.npub, b.npub);
+        assert_eq!(a.address, b.address);
+        // ULA in fd::/8
+        assert!(a.address.starts_with("fd"));
+    }
+
+    #[test]
+    fn peers_json_parses_into_peer_config() {
+        let peers = parse_peers(
+            r#"[{
+                "npub": "npub1abc",
+                "alias": "My Archipelago",
+                "addresses": [
+                    {"transport": "udp", "addr": "192.0.2.10:2121", "priority": 10},
+                    {"transport": "tcp", "addr": "192.0.2.10:8443", "priority": 20}
+                ]
+            }]"#,
+        )
+        .unwrap();
+        assert_eq!(peers.len(), 1);
+        assert_eq!(peers[0].addresses.len(), 2);
+        assert!(peers[0].is_auto_connect());
+    }
+
+    #[test]
+    fn config_is_leaf_only_with_tun() {
+        let id = generate_identity().unwrap();
+        let cfg = build_config(&id.secret_hex, vec![], 0);
+        assert!(cfg.node.leaf_only);
+        assert!(cfg.tun.enabled);
+        assert_eq!(cfg.tun.mtu(), 1280);
+        assert!(!cfg.dns.enabled);
+        assert!(!cfg.transports.udp.is_empty());
+        assert!(!cfg.transports.tcp.is_empty());
+    }
+
+    #[test]
+    fn listen_port_sets_fixed_udp_bind() {
+        let id = generate_identity().unwrap();
+        let cfg = build_config(&id.secret_hex, vec![], 2121);
+        // Party mode keeps leaf_only — accepting a link is not routing transit.
+        assert!(cfg.node.leaf_only);
+        let TransportInstances::Single(udp) = &cfg.transports.udp else {
+            panic!("expected single UDP transport");
+        };
+        assert_eq!(udp.bind_addr.as_deref(), Some("0.0.0.0:2121"));
+    }
+}

CHANGELOG.md

@@ -1,5 +1,198 @@
 # Changelog
 
+## v1.7.126-alpha (2026-08-07)
+
+- **The most important fix in this release: the update button could take you backwards onto a version withdrawn for a security hole.** BTCPay Server published 2.4.2 to close a flaw that was being actively exploited — a way past two-factor authentication. Nodes that had already moved to 2.4.2 were then shown an "Update" button offering 2.3.9, the very release being withdrawn, and taking it would have rolled the node back onto the vulnerable version. The cause was that the node only asked whether the two version numbers differed, never which was newer, so any stale record anywhere could present a rollback as an upgrade. It now refuses to offer a lower version as an update, so a stale record fails safe instead of becoming a trap. BTCPay itself is on 2.4.2, and every place that still named the old version — including the fallback installer, which would have installed it outright — has been corrected.
+- **An app now reports its own version, not a helper's.** Where an app is made of several parts, the node could read the version of the wrong part: BTCPay showed as "15.17", which is the version of its database, while offering an update to 2.4.2. That is the number update decisions are made from, so a nonsensical pair was being presented as a legitimate upgrade. When the node cannot identify an app's own container it now says so rather than guessing at a neighbour.
+- **Your node issues its own certificate, so apps stop being flagged as insecure.** Each node now has its own certificate authority, with a one-step install from Settings, and app screens are served over the same secure connection as the dashboard rather than dropping back to an unprotected one. Apps answer on both the secure and plain address on the same port, so nothing that worked before stops working.
+- **An app that is still starting says "starting".** It previously reported "App not reachable", which reads as a failure when the app is simply warming up.
+- **Updates and app downloads now come from a proper domain name.** They previously used a bare numeric address over an unprotected connection. Downloads are now encrypted in transit, and the old address is kept as an automatic fallback for nodes whose clock or name lookup is off — the signature, not the address, is what makes either source safe.
+- Also in this release: the tool app developers run to check their app description no longer rejects every valid file (it needed a program most machines do not have, and reported the missing program as a broken file); and the node's own security audit, which had been reporting all-clear, now actually inspects the files where credentials had been sitting.
+- Housekeeping, disclosed rather than buried: this release removes Archipelago's own infrastructure details from the published source — machine names, addresses and internal working notes — ahead of the code being opened to the public. No behaviour changes for your node.
+- Known gaps, unchanged from the last release: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
+## v1.7.125-alpha (2026-08-06)
+
+- **The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.** Since the gate went up, those screens loaded their frame and then showed every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential, and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.
+- **IndeeHub heals itself.** Three separate faults fixed: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted roughly ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — it would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. The storage fault fixes the same trap for every future multi-part app.
+- **A missing piece of a running app now gets put back automatically.** If one container of a multi-part app disappears while its siblings are still running, the node treats that as a hole to repair rather than a choice to respect, and rebuilds the missing piece. An app you actually uninstalled stays uninstalled.
+- **Send and Receive open clean every time.** Whatever you typed last — an address, an amount, and above all an armed "send all funds" toggle — no longer quietly carries over into the next payment. Choosing "send all funds" also shows the amount being swept instead of a confusing 0.
+- **A sweep that cannot happen now says why.** Trying to sweep a balance that is below Bitcoin's dust minimum (about 546 sats) or not yet confirmed used to fail with "check server logs"; it now explains that no transaction can be built from those coins.
+- **The camera scanner option no longer vanishes on desktop.** Browsers only allow the live camera on secure (HTTPS) pages, and the scan window silently hid the camera choice on plain connections — which read as "the scanner is gone". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.
+- **App data folders can no longer be "repaired" into a state the app cannot use.** When the node fixed a folder's ownership through its fallback path, it wrote the container's raw user number instead of the translated one, so the fix reported success while the app still could not open its own files — one node's BotFights restarted every ten seconds over exactly this. The translation is now applied.
+- Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.
+- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
+## v1.7.124-alpha (2026-08-05)
+
+- **The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing "server starting" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.
+- **Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.
+- **Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.
+- **Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.
+- **The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.
+- **The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.
+- **You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.
+- Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.
+- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
+## v1.7.123-alpha (2026-08-05)
+
+- **Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.
+- **What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.
+- All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.
+- **Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.
+- Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.
+- Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.
+- Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release.
+
+## v1.7.122-alpha (2026-08-04)
+
+- **Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.
+- **The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.
+- **A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.
+- **Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.
+- Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.
+- The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.
+- **The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.
+- Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
+
+## v1.7.121-alpha (2026-08-04)
+
+- **Making another node "Trusted" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.
+- **Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.
+- The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.
+- The Lightning screen will actually update from now on. Its image was set to "latest", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.
+- Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.
+- Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.
+- Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.
+- Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision).
+
+## v1.7.120-alpha (2026-08-02)
+
+- **Security, and the reason to take this update: two ports on your node handed anyone who could reach them complete control of your money, with no password.** The Lightning app's port answered a plain web request with the LND admin macaroon, the TLS certificate and the node's onion address — everything needed to drain the wallet remotely, and the onion meant an attacker kept that ability even after losing access to your network. The Bitcoin app's port reached Bitcoin Core's control interface using credentials the node itself supplied on the caller's behalf, with a wallet loaded. Anything on your home network, your Tailscale network or the mesh could use either one. Both now require you to be logged in. If your node has been reachable by anyone you do not fully trust, treat the Lightning macaroon and the Bitcoin RPC password as known to them.
+- The Bitcoin and Lightning app screens can no longer be published as public Tor addresses automatically. They were one app-id away from being handed a worldwide, permanent address as a silent side effect of being installed — which would have re-opened the hole above to the entire internet. Turning Tor on for them deliberately still works; it just never happens on its own.
+- **Fixes shipped inside the program now actually reach apps that your system keeps running.** A container the node had been told to uninstall, but that the system service manager kept alive anyway, was quietly skipped by the part of the node that applies configuration — so it never received updates that shipped with the program. This was found the hard way: the Bitcoin control-interface fix above appeared to be installed and silently was not, while the Lightning half applied correctly, which is the most misleading way for a security fix to fail. Both halves are now proven to land on a real node.
+- The Lightning and Bitcoin node screens have been rebuilt to match what umbrelOS offers. Lightning gains Overview, Channels, Activity, Insights, Connect and Settings tabs with a sats/BTC switch; Bitcoin gains Insights, Peers, Connect and Sharing. Along the way: every copy button on those screens silently did nothing (the browser blocks clipboard access inside an embedded page) and now works; the channels link led to a dead page; and Node ID showed a bare key instead of the full address someone can actually connect to.
+- Updates to the Bitcoin screen show up without a hard refresh. The page was being cached by the browser, so a freshly updated screen kept rendering the previous one.
+- The AI sidebar loads again. It was asking for its program files at an address that pointed at the main app's files, where they do not exist, so it silently loaded nothing.
+- The navigation above the bottom bar no longer follows you between screens. Back buttons and the mesh tab bar stayed pinned over every other page once you had visited the screen that owns them. Keeping tabs loaded in the background — the change that made switching between them instant — means leaving a screen hides it rather than destroying it, and this floating navigation sits outside the screen it belongs to, so it was never being hidden with it. It is now tied to whether its own screen is on display. The speed is unchanged: the screens are still kept loaded, so returning to one is still instant.
+- Wallet: Lightning actions are now offered based on whether you actually have a usable channel rather than just a running node, sending is gated the same way, and an invoice you cannot yet receive offers to install a Lightning node instead of simply failing.
+- Onboarding and viewing fixes: the "I have written down my recovery words" tickbox is findable on short screens, paid pictures and videos open in the app's own viewer with a visible loading state instead of a blank browser tab, picture-in-picture survives changing tabs, and the FIPS/Tor labels on peer cards stay put instead of wrapping into the card below.
+- Key-material hardening across the node: a node that is already set up refuses to have its identity replaced by an unauthenticated request; first-boot secret generation now fails loudly instead of silently continuing with shared keys; the node proves its TLS certificate and key are actually a matching pair; the Bitcoin Core wallet path that kept a second copy of your spending key outside the encrypted store has been removed; and every place the node generates a key, token or nonce now names its source of randomness explicitly, enforced at build time.
+- Federation and mesh: a rotated gateway credential now reaches the already-running container instead of leaving the old one in place, sync failures are surfaced to you instead of being swallowed, and nodes can share their Lightning connection details with a chosen peer over the mesh — the groundwork for opening channels with nodes you already talk to.
+- Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. Two nodes on the fleet still share SSH host keys with each other (detection shipped, rotation is a deliberate operator decision and has not been performed). Bitcoin Core can now reach Tor from its container, but is not yet routed through it — the network mode is becoming a setting you choose, and until then Core's peers remain on the clear internet.
+
+## v1.7.119-alpha (2026-07-31)
+
+- Wallet payments now work on nodes whose channels are private/unannounced. Every invoice-creation call site — the wallet's own Receive flow, and the seller-side paid-content/peer-files flow — only ever sent LND the amount and memo, so LND defaulted private to false and returned invoices with no route hints. Any node whose only usable channel is private or unannounced (the common shape for a channel someone opened to you) was silently unpayable through the wallet, and unpayable through paid file/content sales too. Both call sites now set LND's private flag correctly; this was broken in the field and is the main reason for this release.
+- Tor and the mesh's Tor fallback are reliable again. The node's background "doctor" health-checker was fighting Tor over the permission bits on its own hidden-service directory: it compared the directory's mode against the literal string "700", but Tor's own setgid hidden-service mode is 2700 — a value the doctor's check never recognized as correct. Every ~5 minutes it "corrected" the mode back to 700 and restarted Tor to apply it, and Tor immediately reasserted 2700 — a permanent restart loop that meant Tor could never hold onto its consensus/HSDir cache long enough to be useful, breaking the mesh's Tor fallback path entirely. The check now compares only the owner/group/other bits that actually matter (both 700 and 2700 pass; genuinely wrong modes like 750 or 2755 are still corrected and restart Tor), plus a 30-minute restart backoff so no future condition can reproduce the storm.
+- Wallet balances and your node's own FIPS identity key (npub) are no longer written to the browser's sessionStorage — caught by an audit of the page-caching work below. Every cache call site in the app now makes an explicit, reviewed decision about whether its data is allowed to persist across a reload, and a one-time migration purges any legacy, unaudited snapshot left behind by an older build.
+- Server, Home, Mesh, Chat/AI chat, and the secondary screens (app details, marketplace, cloud, federation, monitoring, router/OpenWrt) now load instantly from cache when you revisit them and refresh quietly in the background, instead of blanking and re-fetching everything on every tab switch — this closes out the page-performance work started back in v1.7.116/117.
+- App updates (including this one) now apply automatically in the background instead of waiting on a tap-to-update prompt, matching how kiosk/TV installs already behaved — the reload still waits for any in-progress splash/dashboard animation to finish first, so it won't land mid-motion. This was a direct, explicit decision made with the mid-payment-reload risk spelled out in advance; reverting to a confirmation prompt for beta is a one-line change if wanted later.
+- Known gap, disclosed rather than buried: the project's 5x production lifecycle gate (install/UI/stop/start/restart/reinstall/reboot-survive/archipelago-restart-survive/uninstall, run on a real node — CLAUDE.md's own definition of done before a release tag) was NOT run for this release, because its target node was unreachable and running it here would have required rebooting a shared, live build machine out from under other active work. This release's own automated gates (release-gate harness, strict catalog-drift check, the full cargo test suite, a mount-level ISO smoke test, and a headless QEMU boot test) all still ran and passed — this is specifically about the separate 5x real-node lifecycle gate, which is still outstanding and should be run as soon as the node is reachable again.
+
+## v1.7.118-alpha (2026-07-29)
+
+- Fixes mesh radios dropping off on nodes that took the v1.7.117 update. Updates only ever replaced the main program, never the packaged radio helpers — so updated nodes were left running an older radio daemon that didn't understand a new option and quietly gave up, showing "device not connected" with a Connect button that did nothing. The node now checks what its radio daemon supports before using new options, and updates finally carry the radio helpers themselves, so every node gets current radio support with the update instead of only from a fresh install.
+- The in-app "Flash LoRa" flow works on updated nodes. The RNode flashing tool was only ever included on freshly installed nodes; everywhere else flashing failed with a cryptic "No such file or directory". The tool now ships with updates and is included on new install images, and if it's somehow still missing the error says exactly what to do instead.
+- Message notification badges finally remember what you've read. Unread counts were only kept in memory, so every visit re-counted old messages as new — including a phantom badge for chats with nothing new in them. Read-state is now saved on the device, opening a chat marks all its linked conversations read, and history no longer re-badges after a reload.
+- Every mesh message now has a visible "⋯" button that opens the route view: watch the path your message took animate — sender and receiver appear, a pulse travels the link, and each relay hop lights up in order — with signal quality for radio links and delivery status. (Tapping the transport pill still works too.)
+
+## v1.7.117-alpha (2026-07-29)
+
+- Flash your LoRa radio from inside the app. The Mesh page now has a "Flash LoRa" button that opens a guided flow: pick the firmware family (MeshCore, Meshtastic, or Reticulum RNode) and your board, and the node downloads the latest release and flashes it with live progress — no external flasher website, no cables to a computer. The same flow appears when a freshly plugged-in radio is detected, and a long list of flashing pitfalls was fixed along the way: radios no longer boot-loop after a flash, failures show the real error instead of silently bouncing back, wedged flash jobs can't get stuck forever, and board auto-detection no longer misidentifies Heltec boards.
+- Every Archipelago node now acts as a Reticulum relay. Nodes forward mesh traffic and re-broadcast peer announcements, so two radios that can't hear each other directly can still discover and message each other through any Archipelago node in between — your nodes become infrastructure for the whole neighbourhood mesh, including non-Archipelago apps like Sideband.
+- Reticulum (RNode) radios are now first-class mesh citizens. Radios are reliably detected on node startup (a boot-timing race used to leave them unclaimed), settings changes apply live without a restart, your node's name propagates over the Reticulum network so other apps like Sideband see it properly, and a crashed Reticulum daemon is detected and restarted automatically. Photo and file attachments sent over Reticulum now actually arrive — four separate delivery bugs were found and fixed, verified end-to-end over real radio hardware.
+- Messages to contacts that exist on both the internet mesh and a LoRa radio now prefer the radio when it's live, and attachments follow the same path — so co-located nodes talk over the air even when the internet path exists.
+- Mesh chat polish: each message in the image viewer shows which transport carried it, a new hop-route view shows the path a message took, reactions moved into a tidy dropdown, and read-tracking now reflects what you've actually seen. The Refresh and Broadcast buttons give real feedback, and the radio-setup modal shows honest probe progress instead of freezing.
+- The wallet transactions list works properly on phones now: it scrolls (it silently couldn't on touch screens before), and the All / On-chain / Lightning / Ecash filter tabs stay pinned at the top with a subtle blur while the list scrolls underneath.
+- Backend services no longer masquerade as launchable apps. Anything without a real web interface — databases, APIs, background workers, including stacks you deploy by hand for testing — now files under Services with no Launch button. Apps declare their interface in their manifest; for everything else the node checks the port itself to see whether a browser page actually lives there.
+- Lightning payments that take a while (slow multi-hop routes) are no longer reported as failed while they're still in flight. The wallet now waits properly, shows an honest "pending" state, and reports the true final outcome.
+- Server pages feel instant: Server, Federation, Lightning channels, Monitoring, wallet, Cloud, and Credentials screens now render immediately from a shared cache and refresh live in the background (including push updates over the node's websocket), instead of blanking while every panel refetches.
+- The node stays responsive under heavy load: the connection handler now sheds excess load instead of stalling everything behind it, and companion-app probes no longer trigger container builds during routine checks.
+- FIPS mesh uptime hardening continues: the node's peer port is opened explicitly everywhere, LAN anchors use the right port, direct peering between co-located nodes works again, dials fail fast instead of hanging, and a connectivity watcher re-applies anchors immediately when the network comes back.
+- FIPS startup is more reliable on nodes that have the packaged `fips.service` instead of Archipelago's `archipelago-fips.service`. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.
+- App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.
+- Companion app 0.5.25: a redesigned settings hub (three-finger tap opens it over the dashboard), seamless transport handoff with FIPS mesh settings, the wallet scanner reads dense invoice QR codes, app webviews clear the phone status bar with an HTTPS toggle on add/edit, and off-LAN loads fall back to the mesh URL instead of a dead LAN address.
+- Public-source preparation now includes a Nostr Git hosting plan using `ngit`, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.
+
+## v1.7.116-alpha (2026-07-27)
+
+- Nodes no longer get stuck on "server starting up" after an update or reboot. On a node running many apps, the backend used to spend minutes recovering containers before it told the system it was ready, and anything that touched it during that window could leave it down for good. It now reports ready immediately and recovers in the background, and it always restarts itself if it ever does go down.
+- Installing apps no longer crashes the node. A change that made app screens reachable over the mesh was accidentally holding onto every app's network port in advance — so installing an app like Grafana, Photoprism, Uptime Kuma, or Jellyfin collided with it and the port-cleanup step took the whole backend down, rolling the install back. Installs are now clean and the backend can never be caught by that cleanup.
+- Rolls up everything from v1.7.115: app screens and the dashboard load over the mesh out of the box (firewall openings shipped automatically, IPv6 support end to end), and nodes rejoin the mesh in seconds after their rendezvous point restarts.
+
+## v1.7.115-alpha (2026-07-26)
+
+- The companion app can reach your node's screen from anywhere again. The recent security hardening locked down the node's mesh interface so tightly that the dashboard itself was blocked — the phone would pair and connect, then sit on a blank screen. The node now explicitly opens its own web interface (and only that) through the mesh firewall on every install and upgrade, so the phone's view of your node works out of the box, on any network, and can't silently break in a future update.
+- The node's web interface also answers on IPv6 everywhere it answers on IPv4 — the mesh runs entirely on IPv6, and one v4-only listener was enough to make a working connection show nothing.
+- Nodes now come back onto the mesh in seconds instead of minutes after their rendezvous anchor restarts: the fast-reconnect tuning proven on the phone this week is now baked into every node's mesh configuration, and it survives upgrades.
+
+## v1.7.114-alpha (2026-07-26)
+
+- Plugging in a mesh radio no longer traps it in an endless reboot loop. The device detector itself was causing it: every scan pulsed the radio's reset line, the same board was probed twice under two names, and retries came so fast the radio never finished booting before the next reset hit. Detection now gives the board real time to boot, probes it once, backs off properly between attempts, and no longer fights the "device detected" popup for the port. Radios that could never connect now come up within a minute of being plugged in.
+- The Lightning channels screen now has All / Active / Pending / Closed tabs. Pending gathers everything in motion (opening, closing, force-closing — each with its own status dot and a link to the closing transaction), and Closed is a real history: how each channel ended, what settled back to you, and the closing transaction for each.
+- Sending bitcoin on-chain now puts you in charge of the network fee: pick Fast, Standard, or Slow (Standard is the default), or set your own target blocks or sats-per-vByte. The confirmation step shows the estimated fee for your chosen speed before any money moves.
+- Type on-chain amounts in whichever unit you think in — a sats/BTC switch on the amount field converts as you type.
+- Back up your seed by scanning it. Every recovery-phrase screen (onboarding, Settings, and the Lightning wallet seed) now has Words and QR code tabs — words always shown first. The QR for your node's recovery phrase uses the SeedQR standard, so hardware wallets like Passport Prime, SeedSigner, and Keystone can import it with a single scan (a plain-text option remains for wallets that read the phrase as text). The Lightning seed's QR is plain text with an honest note: it's an LND-format seed that restores into Lightning wallets like Zeus or Blixt, not into hardware wallets.
+
+## v1.7.113-alpha (2026-07-25)
+
+- Fixed a money bug in Cashu ecash sends: the token you handed a recipient could carry your own change proofs along with it, letting the same sats be credited twice. Change now stays in your wallet — only the amount you meant to send leaves it.
+- Closing a Lightning channel is no longer a leap of faith. The close used to hang (or time out with an error) even though it had actually gone through; it now comes back within seconds with the closing transaction ID. Channels mid-close appear in the channel list as Closing or Force-closing with their transaction attached, and a new closed-channels history keeps past closes visible instead of letting them vanish from the list.
+- The wallet card now leads with your total bitcoin across everything, and the on-chain balance gets its own chain icon so the rows read at a glance.
+- The companion phone app (0.5.15) connects dramatically faster away from home: a cold connect over 5G dropped from 40+ seconds to about 5. First connects no longer stall on unreachable mesh dial hints, fresh joins fail fast and retry instead of waiting out long timeouts, and the phone re-announces itself the moment the network around it changes. The node side's mesh-join handling was hardened to match.
+
+## v1.7.112-alpha (2026-07-23)
+
+- Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.
+- Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.
+- The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.
+- Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.
+- Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.
+- The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.
+- Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.
+- Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.
+- Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.
+- Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.
+- Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.
+- A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.
+- Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.
+- If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.
+- Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.
+- Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.
+- Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.
+- Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.
+- The speaker now announces the very first mesh message a node ever receives, and DMs announce just like channel messages (a safety guard against announcement storms was quietly swallowing them). Announcements also react about twice as fast.
+- Opening a Lightning channel right after the node starts no longer fails with a scary red error. The node quietly retries while Lightning finishes waking up, and if it's still not ready you get a calm "still finishing its startup — try again shortly" notice instead.
+- Viewing a transaction works on every node now, including small ones. Nodes with pruned bitcoin storage can't run the Mempool explorer app; transaction links now open your choice of external explorer instead (tx1138.com by default) — after a clear one-time warning that a third-party server will see which transaction you looked up. Set your preferred explorer in Wallet Settings → the new On-chain tab.
+- Voice commands respond noticeably faster: speech recognition now transcribes in roughly half the time, with identical accuracy on short commands.
+- Scanning a Lightning invoice with your phone's camera is far more reliable — dense invoice QR codes that the photo scanner missed are now read by the phone's native barcode engine.
+- The companion app's pairing QR always contains an address your phone can actually reach. If you manage your node over a VPN (Tailscale), the QR used to embed the VPN address, and pairing silently failed; it now advertises the node's home-network address.
+- Peer requests sent from Nostr discovery now actually arrive: your node checks for incoming requests every five minutes by itself (previously they sat unseen until someone manually pressed "Poll"), requests publish to all your configured relays instead of two hardcoded ones, and a failed send tells you instead of pretending it worked.
+- The Connected Nodes list refreshes instantly. It previously froze for up to 30 seconds per offline peer while checking who's reachable, one peer at a time; the checks now run all at once in the background while the list shows immediately.
+- Apps opened from inside a window (like a transaction from the wallet) now animate smoothly on top instead of loading invisibly underneath.
+- Settings-style windows keep their tabs pinned at the top and their buttons pinned at the bottom; only the middle scrolls. The wallet's tabs are now Channels / Cashu / Fedi / Ark / On-chain so all five fit.
+- On the TV screen, menus no longer flash open and instantly close. And the interface never follows your computer's light/dark preference anymore — dropdowns and other native controls stay dark on every device.
+- Error messages tell you what's actually wrong: "Insufficient balance: need 80 sats, have 0 sats" now reaches your screen instead of "Operation failed. Check server logs."
+- Installing Mempool no longer refuses to start while ElectrumX is mid-resync (it connects by itself once ElectrumX is ready), and installs no longer fail just because the system was momentarily busy.
+- Much quieter logs: the node no longer tries to start containers that are already running (hundreds of harmless-but-alarming errors per day), and a node that's offline stops hammering unreachable servers every 30 seconds with rebuild attempts.
+- Phones pairing with the companion app connect over the node's embedded mesh for remote access, with instant QR pairing and per-device access tokens (contributed alongside this release).
+
+## v1.7.111-alpha (2026-07-22)
+
+- Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — "what's the block height?", "how many peers am I connected to?", "is bitcoin synced?", "what's my Lightning balance?" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.
+- Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom "Yo Archy" wake word is in the works.)
+- Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.
+- Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.
+- The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.
+- Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.
+- Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text "/bin/bash"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.
+- Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.
+- Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.
+- On the phone home screen, the wallet card moved up to sit right under My Apps.
+- Home Assistant updated to 2026.7.3, which keeps voice satellites (like Pine's speaker) connected reliably.
+
 ## v1.7.110-alpha (2026-07-21)
 
 - Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.
@@ -314,7 +507,7 @@
 - NetBird's browser proxy now sends API, OAuth, relay, WebSocket, and management traffic through the stable host-published server port at `169.254.1.2:8086`, avoiding stale rootless Podman DNS/IPs after `netbird-server` restarts.
 - Mobile App Store category chips now stay visible above the tab bar, Discover is available on mobile, and category selection updates the page route/query so the selected category is actually shown.
 - Apps that require a real browser tab now open directly from the app icon tap instead of first entering an in-shell app-session route, including BTCPay, Grafana, Home Assistant, Vaultwarden, Nextcloud, Portainer, OnlyOffice, Tailscale, Uptime Kuma, Gitea, and Nginx Proxy Manager.
-- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`; live checks on `100.70.96.88` confirmed Saleor dashboard `9010`/API `8000` and NetBird API/OAuth routes survive `netbird-server` restart.
+- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`; live checks on a fleet node confirmed Saleor dashboard `9010`/API `8000` and NetBird API/OAuth routes survive `netbird-server` restart.
 
 ## v1.7.75-alpha (2026-05-19)
 
@@ -347,7 +540,7 @@
 
 ## v1.7.71-alpha (2026-05-19)
 
-- NetBird stack installs now pre-create `/var/lib/archipelago/netbird/data` before binding it into `netbird-server`, fixing the failed install/start path seen on `100.70.96.88` where Podman rejected the missing host directory.
+- NetBird stack installs now pre-create `/var/lib/archipelago/netbird/data` before binding it into `netbird-server`, fixing the failed install/start path seen on a fleet node where Podman rejected the missing host directory.
 - NetBird start/restart ordering now starts `netbird-server` before the dashboard container so lifecycle actions bring the control plane up before the UI.
 - App-session invalid IDs and panel-mode fallbacks now return to `/dashboard/apps`, avoiding the stale `/apps` route that could render a 404.
 - Mobile launches for apps that block iframes now stay inside the Archipelago app-session fallback instead of automatically opening an external browser tab.
@@ -365,7 +558,7 @@
 ## v1.7.69-alpha (2026-05-19)
 
 - App installs now allow up to 10 minutes for the initial `package.install` RPC to return, matching slow container image pulls and preventing apps from disappearing from My Apps while the backend is still pulling or retrying mirrors.
-- Live diagnostics on `100.70.96.88` confirmed the Gitea install did not fail; the primary registry pull timed out after 300 seconds, the fallback mirror succeeded, and Gitea came up healthy on `3001` while the frontend had already timed out at 15 seconds.
+- Live diagnostics on a fleet node confirmed the Gitea install did not fail; the primary registry pull timed out after 300 seconds, the fallback mirror succeeded, and Gitea came up healthy on `3001` while the frontend had already timed out at 15 seconds.
 - Gitea and other Docker-image app installs now stay visible during slow registry pulls instead of being marked as failed by the browser before backend install progress can complete.
 - Gitea is now categorized as a known Data app in My Apps, so a running Gitea container appears with installed apps instead of being filtered into the Websites/Services split.
 - NetBird `0.71.2` is now available in the app catalog and fallback marketplace data as a recommended networking app using the official `docker.io/netbirdio/netbird:0.71.2` image.
@@ -383,8 +576,8 @@
 - App session close buttons now return to the previous dashboard screen when possible and otherwise fall back to My Apps, avoiding the 404 page after closing an app launched from an invalid or stale history entry.
 - System Update confirmation and mirror modals now teleport to the document body with a full-screen overlay, so they cover the whole app instead of only the right-hand dashboard panel.
 - Mobile app launches stay inside Archipelago's app-session webview and hide desktop-only new-tab launch affordances, including apps such as Home Assistant that previously looked like they would leave the mobile shell.
-- Live recovery on `100.70.96.88` upgraded only the `btcpay-server` container to `docker.io/btcpayserver/btcpayserver:2.3.9`, preserved the existing datadir and Postgres database, and confirmed the container is healthy after a pre-upgrade backup.
-- Public validation confirmed `spay.tx1138.com`/`www` redirect to BTCPay login over HTTPS and `sapien.tx1138.com`/`www` serve the L484 page over HTTPS using the issued Let's Encrypt certificates.
+- Live recovery on a fleet node upgraded only the `btcpay-server` container to `docker.io/btcpayserver/btcpayserver:2.3.9`, preserved the existing datadir and Postgres database, and confirmed the container is healthy after a pre-upgrade backup.
+- Public validation confirmed ``the BTCPay host`/`www` redirect to BTCPay login over HTTPS and `the L484 host`/`www` serve the L484 page over HTTPS using the issued Let's Encrypt certificates.
 
 ## v1.7.67-alpha (2026-05-18)
 
@@ -393,18 +586,18 @@
 - Settings What's New is filled through `v1.7.67-alpha`, including the missing historical `v1.7.44-alpha` through `v1.7.66-alpha` entries.
 - Bitcoin/Knots/Core shell lifecycle specs now match the Rust app config memory policy: 8 GiB on normal hosts, 4 GiB on low-memory hosts, and pruned Knots uses a larger dbcache on hosts with enough RAM to improve IBD throughput.
 - ElectrumX/electrs shell lifecycle specs now match the 4 GiB memory policy used by the Rust app config, reducing drift between first boot, reconcile, and app lifecycle paths.
-- Live assessment of `100.70.96.88` identified the current IBD bottlenecks as CPU/thermal/I/O pressure rather than RAM exhaustion, with follow-up work planned for existing-node swap repair, kiosk Chromium CPU reduction, and reconcile failure cleanup.
+- Live assessment of a fleet node identified the current IBD bottlenecks as CPU/thermal/I/O pressure rather than RAM exhaustion, with follow-up work planned for existing-node swap repair, kiosk Chromium CPU reduction, and reconcile failure cleanup.
 
 ## v1.7.66-alpha (2026-05-18)
 
 - Nginx Proxy Manager stale-port repair now detects stopped or `Created` Podman records by inspecting `podman ps -a` port metadata, covering records where `podman port nginx-proxy-manager` returns no mapping until start.
-- Live recovery on `100.70.96.88` removed only the stale Nginx Proxy Manager container record and recreated it with `8081:81`, `8084:80`, and `8444:443`, preserving `/var/lib/archipelago/nginx-proxy-manager` data.
+- Live recovery on a fleet node removed only the stale Nginx Proxy Manager container record and recreated it with `8081:81`, `8084:80`, and `8444:443`, preserving `/var/lib/archipelago/nginx-proxy-manager` data.
 - Validation confirmed Nginx Proxy Manager recovered as healthy and responds through direct admin port `8081`, host compatibility port `81`, and `/app/nginx-proxy-manager/`.
 
 ## v1.7.65-alpha (2026-05-18)
 
 - Orchestrator-backed app starts now run the same pre-start repairs as the legacy Podman path, so Nginx Proxy Manager stale `81:81` container metadata is removed and recreated before the orchestrator tries to start it.
-- Live diagnostics on `100.70.96.88` confirmed host nginx is healthy while Nginx Proxy Manager has no listeners on `8081`, `8084`, or `8444`, causing host nginx `502` responses for NPM proxy paths.
+- Live diagnostics on a fleet node confirmed host nginx is healthy while Nginx Proxy Manager has no listeners on `8081`, `8084`, or `8444`, causing host nginx `502` responses for NPM proxy paths.
 
 ## v1.7.64-alpha (2026-05-18)
 
@@ -429,7 +622,7 @@
 - Multi-container stack installs now keep their app card in the `Installing` state for up to 20 minutes while dependency containers are being pulled and prepared.
 - BTCPay Server installs no longer appear to vanish or fail after two minutes while Postgres and NBXplorer are still being created before the primary `btcpay-server` container exists.
 - The stale-transition escape hatch remains short for start, stop, restart, update, and removal operations, so genuinely wedged lifecycle actions still recover quickly.
-- Live validation on `100.70.96.88` confirmed BTCPay Server completed installation and responds on port `23000` with the expected HTTP redirect.
+- Live validation on a fleet node confirmed BTCPay Server completed installation and responds on port `23000` with the expected HTTP redirect.
 
 ## v1.7.60-alpha (2026-05-18)
 
@@ -437,7 +630,7 @@
 - Mesh radio auto-detection now skips known non-mesh serial devices such as Sierra Wireless LTE modems and Zooz/Z-Wave sticks, avoiding interference with production peripherals.
 - Meshtastic config sync now sends `want_config_id` with the correct protobuf wire type, fixing radio-side `ignore malformed toradio` errors and allowing node-info/contact ingestion.
 - The stable `/dev/mesh-radio` udev rule no longer claims every `ttyACM*` device; it only matches known mesh USB serial adapters and known USB CDC ACM radio vendors.
-- Live validation on `100.70.96.88` confirmed Archipelago selects `/dev/ttyUSB0`, identifies the Meshtastic node, and refreshes 103 mesh contacts.
+- Live validation on a fleet node confirmed Archipelago selects `/dev/ttyUSB0`, identifies the Meshtastic node, and refreshes 103 mesh contacts.
 
 ## v1.7.59-alpha (2026-05-17)
 
@@ -461,7 +654,7 @@
 - Host nginx now serves `/assets/*` hashed frontend chunks as immutable static files with a hard 404 on misses instead of falling back to `index.html`, preventing strict MIME errors when a browser has a stale pre-update HTML shell.
 - The SPA HTML shell and service-worker files now revalidate on every load, reducing stale frontend references after OTA updates.
 - OTA runtime promotion now installs the bundled `nginx-archipelago.conf` into `/etc/nginx/sites-available/archipelago` and reloads nginx after a successful config test, so frontend cache/fallback fixes reach existing nodes without a manual deploy.
-- Local validation passed with `cargo check -p archipelago`; live SSH testing against `100.70.96.88` was not completed because temporary public-key authentication was rejected on the target.
+- Local validation passed with `cargo check -p archipelago`; live SSH testing against a fleet node was not completed because temporary public-key authentication was rejected on the target.
 
 ## v1.7.57-alpha (2026-05-17)
 
@@ -542,7 +735,7 @@
 - Health monitor no longer pages "Auto-restart failed" for orphaned containers. After a variant switch (bitcoin-core ↔ bitcoin-knots) the previous variant's container could survive uninstall and the health monitor would try restarting it forever. Now skipped silently with a debug log.
 - Apps no longer disappear from My Apps when an install fails. The card stays visible with state=Stopped so the user can retry or uninstall, with the failure reason surfaced via the new install_progress.message field.
 - "Downloading…" progress now actually advances during multi-image stack pulls. Was sticking at 20% until all pulls finished; now interpolates 20%→70% based on which image of N has landed.
-- Pulled four docker.io images (bitcoin, gitea, nextcloud, valkey) into the lfg2025 registries on OVH and tx1138. Removes a docker.io dependency from first-boot installs.
+- Pulled four docker.io images (bitcoin, gitea, nextcloud, valkey) into the lfg2025 registries on the registry mirrors. Removes a docker.io dependency from first-boot installs.
 - Resilience harness improvements: install-fail entries no longer vanish, install/uninstall/probe cells are timing-tolerant (60s retry on ui_probe and auth_probe), dep snapshots no longer leak companion containers into the dependent app's "new containers" set.
 
 ## v1.7.45-alpha (2026-04-29)
@@ -588,7 +781,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Infrastructure
 - CI pipeline added (.github/workflows/ci.yml) — cargo fmt, clippy, tests + frontend type-check, build
-- Update system now fetches from git.tx1138.com Gitea instance (configurable via ARCHIPELAGO_UPDATE_URL)
+- Update system now fetches from the release Gitea instance (configurable via ARCHIPELAGO_UPDATE_URL)
 - Cleaned up stale git branches (app-store, overnight/2026-03-12, overnight/2026-03-13)
 
 ## [1.3.0] - 2026-03-19

CLAUDE.md

@@ -1,84 +1,72 @@
-# Archipelago — agent guide
+# Archipelago — contributor guide
 
-## ✅ Single-node production gate is GREEN (2026-06-23)
+This file orients anyone (human or AI) working in this repository: the
+invariants that must hold, how to build and verify, and where the deeper
+design docs live. The authoritative behaviour is always the code in `core/`.
 
-`tests/lifecycle/run-gate.sh` is **5/5 on .228, 0 failures** — the single-node exit
-criterion is met and the priority banner is demoted. Next exit-criteria: the
-**multinode pass** (`docs/multinode-testing-plan.md`) and workstreams B/C/D.
+**Read [`docs/ROADMAP.md`](docs/ROADMAP.md) for where the project is going** and
+[`docs/README.md`](docs/README.md) for the full documentation index.
 
-**For day-to-day work, use `docs/UNIFIED-TASK-TRACKER.md`** — the consolidated,
-priority-ordered "what's left" list across the 1.8.0 OTA and master-plan docs
-(fastest/simplest tasks first). It supersedes hunting through the two source docs
-below for open items; those remain the narrative/history.
+The north star: a world-class, **developer-ready app platform** — every app
+manifest-driven, rootless, secure, and 100%-uptime-capable, with third-party
+developers publishing via an external/decentralized registry.
 
-**Read `docs/PRODUCTION-MASTER-PLAN.md` first** — it is still the authoritative plan
-for the north star: a world-class, **developer-ready app platform** where every app
-is manifest-driven, manifests ship via the **signed registry** (not OTA disk files),
-and **third-party developers publish apps via an external/decentralized registry** —
-all rootless, secure, robust, and 100%-uptime-capable. It no longer overrides all
-ad-hoc direction now that the gate is green, but it remains the source of truth for
-sequencing the remaining workstreams.
+Detailed sub-plans:
+- App platform / packaging phases + security model → [`docs/APP-PACKAGING-MIGRATION-PLAN.md`](docs/APP-PACKAGING-MIGRATION-PLAN.md)
+- Registry-distributed manifests → [`docs/registry-manifest-design.md`](docs/registry-manifest-design.md)
+- External/decentralized marketplace for devs → [`docs/marketplace-protocol.md`](docs/marketplace-protocol.md)
+- App manifest schema → [`docs/app-manifest-spec.md`](docs/app-manifest-spec.md)
+- Production test gate → [`tests/lifecycle/TESTING.md`](tests/lifecycle/TESTING.md)
 
-Detailed sub-plans (all linked from the master):
-- App platform / packaging phases + security model → `docs/APP-PACKAGING-MIGRATION-PLAN.md`
-- Registry-distributed manifests (in progress) → `docs/registry-manifest-design.md`
-- External/decentralized marketplace for devs → `docs/marketplace-protocol.md`
-- Current per-app state → `docs/archive/app-registry-status-2026-06-21.md`
-- Production test gate (exit criterion) → `tests/lifecycle/TESTING.md`
+## Commit & push every unit of work
 
-## Commit & push every unit of work (never violate)
-
-**The #1 process rule: work is not "done" until it is committed AND pushed.** This
-exists because finished work has been lost/clobbered by sitting uncommitted in the
-shared tree across agents and sessions. To prevent that:
+Work is not "done" until it is committed **and** pushed. Finished work has been
+lost by sitting uncommitted in a shared tree across sessions. To prevent that:
 
 - **Commit each feature/fix the moment it works** — one focused, self-contained
-  commit per logical change (it compiles and its targeted tests pass). Do not let
+  commit per logical change (it compiles and its targeted tests pass). Don't let
   unrelated changes accumulate uncommitted.
-- **Push immediately after committing** so nothing lives only on one machine. `main`
-  is protected → push via `git push gitea-ai main` (account `ai`, see the memory
-  note); feature branches push to their own remote.
-- **Never leave a stack of finished work uncommitted** overnight or when handing off
-  between agents — if you must pause mid-change, commit a clearly-labelled WIP
-  checkpoint rather than leaving it dirty.
-- **Stage explicitly by path** (`git add <paths>`) when another agent's uncommitted
-  work shares the tree — never `git add -A` / `git commit -a`, which clobbers or
-  entangles their changes.
-- **Never commit or push secrets** (mnemonics, private keys, API tokens). Signing is
-  done offline; artifacts (catalog/manifest) are signed, not the keys.
-- Commit messages end with the `Co-Authored-By: Claude …` trailer.
+- **Push immediately after committing** so nothing lives only on one machine.
+- **Never leave a stack of finished work uncommitted** overnight or when handing
+  off — if you must pause mid-change, commit a clearly-labelled WIP checkpoint
+  rather than leaving the tree dirty.
+- **Stage explicitly by path** (`git add <paths>`) when another contributor's
+  uncommitted work shares the tree — never `git add -A` / `git commit -a`, which
+  clobbers or entangles their changes.
+- **Never commit secrets** (mnemonics, private keys, API tokens). Signing is done
+  offline; artifacts (catalog/manifest) are signed, not the keys.
 
 ## Invariants (never violate)
 
 - **Rootless Podman only.** No rootful, no Docker-socket mounts, no privileged
   containers unless explicitly approved.
 - **No per-app Rust installers / no OS-level reliance.** Apps are declarative;
-  the orchestrator owns the lifecycle. `install_immich_stack` (hardcoded
-  `podman run` + `sudo chown`) is the anti-pattern being deleted, not a template.
+  the orchestrator owns the lifecycle. A hardcoded `podman run` + `sudo chown`
+  installer is the anti-pattern being deleted, not a template.
 - **Secrets are manifest-declared** (`generated_secrets`, materialised by
   `container::secrets`, 0600/rootless) — never hardcoded, per-app, or logged.
 - **Migrations never destroy data** — preserve `/var/lib/archipelago/<app>`,
   secrets, credentials, ports, and adoption container names; keep a rollback path.
-- **Verify on the real node .228 before any tag.** (Fleet-wide multinode
-  verification is a separate plan: `docs/multinode-testing-plan.md`.)
+- **Verify on a real node before any release tag.**
 
 ## Build / verify
 
-- Rust workspace root is `core/` (no Cargo.toml at repo root). `cargo` from `core/`.
+- Rust workspace root is `core/` (no Cargo.toml at repo root). Run `cargo` from `core/`.
 - If a `cargo test`/build hits `rust-lld: undefined hidden symbol`, it's
   incremental-cache corruption — rebuild with `CARGO_INCREMENTAL=0`.
 - Frontend: `neode-ui/` → `npm run build` outputs to `web/dist/neode-ui/`.
-  Grep the built bundle for new strings before shipping (build can silently no-op).
-- App manifests load from disk on nodes at `/opt/archipelago/apps/*/manifest.yml`
-  (today); the goal is to distribute them via the signed catalog instead.
+  Grep the built bundle for new strings before shipping (the build can silently
+  no-op).
+- App manifests are delivered inside the **signed catalog** (`releases/app-catalog.json`),
+  whose entry overrides the on-disk `/opt/archipelago/apps/*/manifest.yml`
+  (origin-wins; disk is the fallback). Editing a disk manifest alone does **not**
+  change a catalog-covered app — regenerate and re-sign the catalog.
 
 ## Production test gate (definition of done)
 
-`tests/lifecycle/run-gate.sh` green across install / UI / stop / start / restart /
-reinstall / reboot-survive / archipelago-restart-survive / uninstall — **5× on
-.228** (`ARCHY_ITERATIONS=5`). **Run the gate ON the node** (it uses local podman/systemctl/bitcoin
-probes), not via RPC from another host. **✅ GREEN 2026-06-23 (5/5, 0 not-ok)** — keep it
-green (re-run after orchestrator/lifecycle changes); regressions are top priority again.
-**Multinode testing (.198 + the rest of the fleet) is a SEPARATE plan** —
-`docs/multinode-testing-plan.md` — not part of this single-node gate criterion, and is
-the next exit criterion now that single-node is green.
+`tests/lifecycle/run-gate.sh` must be green across install / UI / stop / start /
+restart / reinstall / reboot-survive / archipelago-restart-survive / uninstall.
+**Run the gate on the node** (it uses local podman/systemctl/bitcoin probes), not
+via RPC from another host, and re-run it after any orchestrator/lifecycle change.
+Multinode / fleet testing is a separate pass. See
+[`tests/lifecycle/TESTING.md`](tests/lifecycle/TESTING.md).

CODE_OF_CONDUCT.md

@@ -0,0 +1,19 @@
+# Code of Conduct
+
+## Our standard
+
+Be direct, respectful, and focused on the work. Healthy disagreement is welcome;
+harassment, personal attacks, and discriminatory language are not.
+
+## Scope
+
+This code of conduct applies to project repositories, issue trackers, pull
+requests, documentation, chat, and community spaces connected to Archipelago.
+
+## Enforcement
+
+Maintainers may edit, hide, or remove comments and may restrict participation
+for behavior that makes collaboration unsafe or unproductive.
+
+Report conduct concerns privately through the repository owner account or the
+private contact channel listed on the project homepage.

CONTRIBUTING.md

@@ -1,161 +1,100 @@
 # Contributing to Archipelago
 
-Thank you for your interest in contributing to Archipelago! This document covers the process for contributing code, reporting bugs, and submitting apps.
+This project is preparing for public developer contribution. The highest-value
+contributions are focused fixes, tests, app manifests, documentation
+improvements, and clear bug reports with reproducible evidence.
 
-## Code of Conduct
+## Development setup
 
-Be respectful. We follow the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
-
-## Getting Started
-
-1. Fork the repository on the project's Gitea instance
-2. Clone your fork: `git clone <your-fork-url>/archy.git`
-3. Set up the dev environment (see `docs/developer-guide.md`)
-4. Create a feature branch: `git checkout -b feature/your-feature`
-
-## Development Setup
-
-### Frontend (Vue.js)
+### Frontend
 
 ```bash
 cd neode-ui
 npm install
-npm start          # Dev server on :8100
-npm run type-check # TypeScript validation
-npm run build      # Production build
-npm test           # Run tests
+npm start
+npm run type-check
+npm test
 ```
 
-### Backend (Rust)
-
-Build on a Linux server (Debian 13), **not** macOS:
+### Backend
 
 ```bash
-cargo clippy --all-targets --all-features
-cargo fmt --all
+cd core
+cargo fmt --all -- --check
+cargo clippy --all-targets --all-features -- -D warnings
 cargo test --all-features
 ```
 
-### Deploy to dev server
+Linux is required for host integration work involving Podman, systemd,
+networking, or image builds. Frontend development works locally with the mock
+backend.
+
+## App manifests
+
+App packages live under `apps/<app-id>/manifest.yml` and use the schema
+documented in [docs/app-manifest-spec.md](docs/app-manifest-spec.md). Validate
+before submitting:
 
 ```bash
-./scripts/deploy-to-target.sh --live
+./scripts/validate-app-manifest.sh apps/<app-id>/manifest.yml
+python3 scripts/generate-app-catalog.py
+python3 scripts/check-app-catalog-drift.py --release --strict
 ```
 
-## Code Style
+App submissions must:
 
-### Frontend (TypeScript + Vue)
+- pin container image versions;
+- avoid hardcoded secrets;
+- use `security.no_new_privileges: true`;
+- use `security.readonly_root: true` unless the manifest explains why writable
+  root is required;
+- request only necessary Linux capabilities;
+- store durable data under `/var/lib/archipelago/<app-id>/`;
+- define truthful health checks and launch interfaces for user-facing UIs.
 
-- `<script setup lang="ts">` — always Composition API
-- TypeScript strict mode — no `any`, use `unknown` or proper types
-- Global CSS classes in `src/style.css` — never inline Tailwind in components
-- Pinia for state management — focused single-purpose stores
-- Use `@/api/rpc-client.ts` for RPC calls
+## Code style
 
-### Backend (Rust)
+- Rust: prefer `?` over `unwrap()`/`expect()` in production paths.
+- Rust: use `tracing` for structured logs.
+- TypeScript: avoid `any`; use explicit types or `unknown`.
+- Vue: prefer `<script setup lang="ts">`.
+- Keep changes scoped; do not mix drive-by refactors with behavioral changes.
+- Remove dead code rather than commenting it out.
+- Add tests for new behavior and regression tests for bug fixes.
 
-- No `unwrap()` or `expect()` in production code — use `?` operator
-- `thiserror` for library errors, `anyhow` for application errors
-- `tracing` for structured logging — never `println!`
-- Run `cargo clippy` and `cargo fmt` before commits
+## Pull requests
 
-### General
+1. Open one focused PR per behavior or documentation change.
+2. Explain what changed, why it changed, and how it was verified.
+3. Include screenshots for UI changes.
+4. Link relevant issues or docs.
+5. Keep generated catalog changes in sync with manifest changes.
 
-- Functions under 50 lines, single responsibility
-- Comment WHY not WHAT
-- Remove dead code — never comment it out
-- No `TODO`/`FIXME` in commits
+Suggested commit format:
 
-## Commit Format
-
-```
-type: description
+```text
+feat: add backup scheduling
+fix: reject unsafe manifest volume
+docs: clarify app deployment flow
+test: cover catalog drift check
 ```
 
-**Types**: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`, `perf:`
+## Reporting bugs
 
-Examples:
-- `feat: add backup scheduling to settings page`
-- `fix: handle WiFi connection timeout gracefully`
-- `test: add unit tests for RPC client retry logic`
+Include:
 
-## Pull Request Process
+- exact version or commit;
+- host platform and architecture;
+- steps to reproduce;
+- expected and actual behavior;
+- logs from the relevant component;
+- screenshots for UI issues.
 
-1. Ensure your branch is up to date with `main`
-2. All checks must pass: TypeScript, build, tests, clippy
-3. Include a clear description of what changed and why
-4. Link any related issues
-5. Request review from a maintainer
+## Security
 
-### PR Checklist
-
-- [ ] TypeScript type-check passes (`npm run type-check`)
-- [ ] Frontend builds (`npm run build`)
-- [ ] Tests pass (`npm test`)
-- [ ] Rust clippy clean (`cargo clippy --all-targets --all-features`)
-- [ ] No new compiler warnings
-- [ ] Follows code style guidelines above
-
-## Testing Requirements
-
-- New features need tests
-- Bug fixes need a regression test
-- Frontend: Vitest + Vue Test Utils
-- Backend: `#[test]` and `#[tokio::test]`
-- Target: maintain or improve existing coverage
-
-## Reporting Bugs
-
-Use the **Bug Report** issue template. Include:
-
-1. Steps to reproduce
-2. Expected behavior
-3. Actual behavior
-4. System info (hardware, OS version, Archipelago version)
-5. Screenshots if applicable
-6. Relevant logs (`journalctl -u archipelago`)
-
-## Feature Requests
-
-Use the **Feature Request** issue template. Include:
-
-1. Problem description
-2. Proposed solution
-3. Alternatives considered
-4. Impact on existing users
-
-## App Submissions
-
-To submit an app for the Archipelago marketplace:
-
-1. Create a manifest following `docs/app-manifest-spec.md`
-2. Ensure the container image is published to a public registry
-3. Test on Archipelago hardware (x86_64 and ARM64 if possible)
-4. Open a PR adding the app to the curated list
-5. Include: app description, icon, resource requirements, dependencies
-
-### App Requirements
-
-- Container must run as non-root (UID > 1000)
-- `readonly_root: true` unless explicitly justified
-- Drop all capabilities except those required
-- `no-new-privileges: true`
-- Pin specific image versions (no `latest` tag)
-- No hardcoded secrets
-
-## Security Disclosure
-
-**Do NOT open public issues for security vulnerabilities.**
-
-Email security concerns to the maintainers directly. Include:
-
-1. Description of the vulnerability
-2. Steps to reproduce
-3. Potential impact
-4. Suggested fix (if any)
-
-We will acknowledge receipt within 48 hours and provide a timeline for a fix.
+Do not report vulnerabilities in public issues. Follow [SECURITY.md](SECURITY.md).
 
 ## License
 
-By contributing, you agree that your contributions will be licensed under the same license as the project.
+By contributing, you agree that your contribution is licensed under the
+project's MIT License.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dorian and the Archipelago Project contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

NOTICE

@@ -0,0 +1,73 @@
+# Archipelago — Third-Party Notices
+
+Archipelago is licensed under the MIT License (see LICENSE).
+This file lists third-party components included in this repository and its
+release artifacts, with their licenses and required attributions.
+
+## Embedded / vendored components
+
+- **FIPS mesh networking** — https://github.com/jmcorgan/fips
+  Copyright (c) 2026 Johnathan Corgan. MIT License.
+  Used as the embedded mesh VPN in the OS (`fips` daemon, pinned v0.4.1) and
+  compiled into the Android companion app (`Android/rust/archy-fips-core`).
+
+- **QR Code Generator for JavaScript** — http://www.d-project.com/
+  Copyright (c) 2009 Kazuhiko Arase. MIT License.
+  Vendored at `docker/lnd-ui/qrcode.js` and `docker/electrs-ui/qrcode.js`
+  (original headers preserved).
+
+- **nostr-rs-relay** — https://github.com/scsibug/nostr-rs-relay — MIT License.
+  Binary extracted into the OS image at `/opt/archipelago/bin/`.
+
+- **Reticulum (RNS) and LXMF** — https://github.com/markqvist/Reticulum
+  Copyright Mark Qvist. Distributed under the Reticulum License (an MIT-style
+  license with field-of-use restrictions: no use in systems designed to harm
+  human beings, and no use in AI/ML training datasets). The optional
+  `archy-reticulum-daemon` binary bundles RNS 1.3.5 and LXMF 1.0.1. The
+  Reticulum License is NOT an OSI-approved open-source license; it applies
+  only to that optional component, not to Archipelago itself.
+
+## Fonts
+
+- **Montserrat** — SIL Open Font License 1.1
+  (`neode-ui/public/assets/fonts/Montserrat/OFL.txt`).
+- **Open Sans** — Apache License 2.0
+  (`neode-ui/public/assets/fonts/Open_Sans/LICENSE.txt`).
+
+## Artwork and icons
+
+- **Mesh device artwork** (`neode-ui/public/assets/img/mesh-devices/`):
+  device illustrations from the Meshtastic project — https://meshtastic.org
+  © Meshtastic contributors, GPL-3.0. Meshtastic® is a registered trademark
+  of Meshtastic LLC. See the ATTRIBUTION.md in that directory.
+- Some UI icons are derived from **game-icons.net** (CC BY 3.0 — see
+  ATTRIBUTION.md in `neode-ui/public/assets/icon/`) and **pixelarticons**
+  (MIT, https://github.com/halfmage/pixelarticons).
+- Third-party application logos under `neode-ui/public/assets/img/app-icons/`
+  and `service-icons/` are trademarks of their respective owners, used solely
+  to identify the corresponding applications. No endorsement is implied.
+
+## Original media
+
+All demo content (music, photos, posters in `demo/`), UI sound effects,
+background images, and intro video in `neode-ui/public/assets/` are original
+works created and owned by the Archipelago project author, released with the
+project. The welcome voice line (`welcome-noderunner.mp3`) was generated with
+ElevenLabs TTS under a commercial-use plan.
+
+## Redistributed software (ISO and container registry)
+
+The Archipelago OS image is based on Debian and redistributes Debian packages
+(including the Linux kernel, GRUB, and non-free firmware/microcode blobs
+required for hardware support); per-package license texts are preserved at
+`/usr/share/doc/*/copyright` in the installed system, and corresponding source
+is available via Debian (https://snapshot.debian.org) as referenced in each
+release's notes. Container images offered through the app catalog and mirror
+registry remain under their upstream licenses (including GPL/AGPL software
+such as mempool, Nextcloud, Vaultwarden, SearXNG, PhotoPrism, Immich,
+Jellyfin, MariaDB, AdGuard Home, and strfry); source links are provided in
+the app catalog. The modified mempool-frontend image is built from
+`docker/mempool-frontend/` in this repository (AGPL-3.0 corresponding source).
+
+Full per-crate and per-package license inventories for release binaries are
+generated at build time (see THIRD-PARTY-LICENSES files in release artifacts).

README.md

@@ -1,8 +1,11 @@
 # Archipelago
 
-> Self-Sovereign Bitcoin Node OS
+> Self-sovereign Bitcoin node OS and manifest-driven app platform.
 
-**Archipelago** is a bootable personal server OS. Flash it to a USB drive, install on any x86_64 or ARM64 machine, and manage Bitcoin infrastructure, self-hosted apps, mesh communication, and decentralized identity through a glassmorphism web UI.
+Archipelago is a bootable personal server OS for Bitcoin infrastructure,
+self-hosted apps, mesh communication, decentralized identity, and federation.
+Apps are packaged as declarative `manifest.yml` files and run as rootless
+Podman containers managed by the Rust backend.
 
 [![Debian 13](https://img.shields.io/badge/Debian-13%20Trixie-a80030)](https://www.debian.org/)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
@@ -10,193 +13,100 @@
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
 [![Version](https://img.shields.io/badge/version-1.8.0--alpha-blue)]()
 
-## Philosophy
+## What is here
 
-Archipelago is being built as a **developer-ready app platform**, not a fixed appliance:
+- `core/` - Rust workspace: backend API, container runtime, security, OpenWrt
+  helpers, and performance/resource management.
+- `neode-ui/` - Vue 3 + TypeScript frontend.
+- `apps/` - app manifests and custom app container sources.
+- `docker/` - supporting container build contexts for UI companion surfaces.
+- `image-recipe/` - bootable image/ISO build inputs.
+- `Android/` - Android companion app.
+- `scripts/` - development, release, deployment, and validation tooling.
+- `docs/` - architecture, app packaging, operations, API, and roadmap docs.
 
-- **Manifest-driven apps.** Every app is declared in a single `manifest.yml` — image, ports, volumes, secrets, health checks, security policy. The orchestrator owns the entire lifecycle; there is no per-app installer code and no host-level provisioning.
-- **Signed distribution.** App manifests ship inside an Ed25519-signed catalog verified against a pinned release-root key, not as loose files on disk. OTA release manifests are signed the same way.
-- **Decentralized marketplace.** Third-party developers publish apps via Nostr-based discovery (NIP-78) with DID-signed manifests and federation-weighted trust scoring — no gatekept central store.
-- **Rootless and secure by default.** Rootless Podman only. Read-only root, no-new-privileges, capability allow-list, secrets materialised 0600 and never logged. Never rootful, never a Docker socket mount.
-- **100%-uptime-capable.** Every container is a systemd Quadlet unit under `user.slice` that survives backend restarts; a level-triggered reconciler self-heals drift every 30 seconds; migrations never destroy data.
+## Platform model
 
-## Features
+Archipelago is built as a developer-ready app platform, not a fixed appliance:
 
-### Bitcoin Infrastructure
-- **Bitcoin Core and Bitcoin Knots** full nodes with per-app version pinning and bulletproof version switching, automatic prune/full mode based on disk size
-- **LND** and **Core Lightning** with channel management
-- **ElectrumX** Electrum server for wallet connectivity
-- **BTCPay Server** for accepting Bitcoin payments
-- **Mempool** block explorer and fee estimator
-- **Fedimint** federation guardian, gateway, and client — plus Cashu ecash wallet support
+- Apps are declared in `apps/<app-id>/manifest.yml`.
+- The Rust parser in `core/container/src/manifest.rs` is the canonical schema.
+- The orchestrator compiles manifests to rootless Podman/Quadlet runtime state.
+- App data lives under `/var/lib/archipelago/<app-id>/`.
+- Secrets are generated or read from `/var/lib/archipelago/secrets/` and
+  injected through Podman secrets rather than static environment values.
+- Release and app catalogs are signed and verified against a pinned trust
+  anchor.
 
-### Self-Hosted Apps (50+)
-Storage (FileBrowser, Immich, Nextcloud), Productivity (Vaultwarden), Media (Jellyfin, PhotoPrism, IndeeHub), Search (SearXNG), Network (NetBird, Tailscale), Home (Home Assistant), Nostr (nostr-rs-relay, strfry), Dev/Ops (Gitea, Grafana, Portainer, Uptime Kuma), and more — 27 curated in the store UI, 50+ packaged as manifests.
+Start with:
 
-### Mesh Networking (tri-protocol)
-- **Meshtastic**, **MeshCore**, and **Reticulum (RNS/LXMF)** LoRa transports behind one mesh chat UI
-- End-to-end encryption with X3DH key agreement + double-ratchet
-- RNode radio support with an OS-level `archy-rnodeconf` tool; interop verified against Sideband
-- Image/voice attachments, mesh AI assistant (`!ai`), Bitcoin balance relay over mesh
+- [Architecture](docs/architecture.md)
+- [Developer Guide](docs/developer-guide.md)
+- [App Developer Guide](docs/app-developer-guide.md)
+- [App Manifest Spec](docs/app-manifest-spec.md)
+- [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md)
+- [Troubleshooting](docs/troubleshooting.md)
 
-### Decentralized Identity
-- Ed25519 node identity with DID Documents (did:key)
-- Multi-identity management (Personal/Business/Anonymous)
-- W3C Verifiable Credentials issuance and verification
-- Nostr integration: NIP-33 node discovery, NIP-44/NIP-04 encryption, NIP-07 signer bridge for iframe apps, relay hosting
-- Decentralized Web Node (DWN) record sync between federated nodes over Tor
+## Quick start
 
-### Multi-Node Federation
-- Invite-based node joining over Tor hidden services
-- Trust levels (Trusted/Verified/Untrusted) with DID-based auth
-- State sync and app deployment across federated nodes
-- File sharing with access controls (free/peers-only/paid via Lightning, on-chain, or ecash)
-
-### System Updates
-- OTA updates from a self-hosted Gitea release server, Ed25519-signature-verified against a pinned release-root key
-- Resumable downloads, automatic pre-update backup, rollback with a post-update self-verify window
-- Manual, scheduled-check, and auto-apply modes (auto-apply refuses unsigned manifests)
-
-### Security
-- Argon2id password hashing (transparent upgrade from legacy hashes), ChaCha20-Poly1305 encrypted secrets at rest
-- Rootless Podman: read-only root, cap-drop ALL with a reviewed allow-list, no-new-privileges
-- Signed release manifests and signed app catalog (Ed25519, pinned trust anchor)
-- TOTP two-factor authentication, per-endpoint rate limiting, CSRF protection
-- AppArmor profiles for container confinement; Tor hidden services for inter-node traffic
-- Independent security audit of an early version archived in [`docs/archive/`](docs/archive/security-code-audit-2026-03.md); top findings since remediated
-
-## Roadmap
-
-**Done**
-- Single-node production gate **green** — install / stop / start / restart / reinstall / reboot-survive / uninstall, 5 consecutive full runs with zero failures on real hardware
-- Quadlet migration validated (all backends as `user.slice` services on the canary node)
-- Release signing ceremony completed — release-root key pinned, catalog and OTA manifests signed
-- Reticulum third mesh transport (real-RF LoRa gates passed), Bitcoin Core/Knots multi-version switching, decentralized marketplace backend, public demo
-
-**In progress**
-- Multinode pass: the same production gate across the whole test fleet ([`docs/multinode-testing-plan.md`](docs/multinode-testing-plan.md))
-- Quadlet default flip fleet-wide + container-flapping elimination
-- 1.8.0 release hardening tail ([`docs/1.8.0-RELEASE-HARDENING-PLAN.md`](docs/1.8.0-RELEASE-HARDENING-PLAN.md)): OTA upgrade soak on real hardware, ISO/image hardening (per-device keys, no default creds, signed ISO)
-
-**Planned**
-- Developer CLI (`archy app validate/render/install/test`) to open third-party app publishing
-- External marketplace trust UX + publishing tooling ([`docs/marketplace-protocol.md`](docs/marketplace-protocol.md))
-- DHT/P2P distribution of releases and app images ([`docs/dht-distribution-design.md`](docs/dht-distribution-design.md))
-- P2P encrypted voice/video over Tor, dual-ecash (Fedimint + Cashu) phases, paid streaming, hardware signer support
-
-The live, priority-ordered task list is [`docs/UNIFIED-TASK-TRACKER.md`](docs/UNIFIED-TASK-TRACKER.md); the full narrative plan is [`docs/PRODUCTION-MASTER-PLAN.md`](docs/PRODUCTION-MASTER-PLAN.md).
-
-## Quick Start
-
-### Install from ISO
-
-1. Build or download the ISO for your architecture (x86_64 or ARM64) — see [`image-recipe/`](image-recipe/)
-2. Flash to USB drive with Balena Etcher or `dd`
-3. Boot from USB on target hardware and follow the automated installer
-4. Access the web UI at `http://<device-ip>`
-5. Set your password and complete the onboarding wizard (seed backup, DID identity)
-
-### Supported Hardware
-
-| Platform | Examples | Minimum |
-|----------|----------|---------|
-| **x86_64** | Intel NUC, mini PCs, any 64-bit PC | 4GB RAM, 32GB storage |
-| **ARM64** | Raspberry Pi 5, ARM64 SBCs | 4GB RAM, 32GB storage |
-
-**Recommended**: 8GB+ RAM, 1TB+ NVMe SSD (for a full Bitcoin node). Optional: an RNode-compatible LoRa radio for mesh networking.
-
-## Development
-
-### Prerequisites
-- macOS or Linux for frontend development
-- Linux dev server (Debian 13) for backend builds — **never build Rust on macOS for Linux**
-- Node.js 20+, Rust stable toolchain
-
-### Frontend Development
+### Frontend
 
 ```bash
 cd neode-ui
 npm install
-npm start          # Dev server on http://localhost:8100 (mock backend on :5959)
-npm run type-check # TypeScript validation
-npm run build      # Production build → web/dist/neode-ui/
+npm start
 ```
 
-### Backend Development
+The dev UI runs at `http://localhost:8100` with a mock backend on `:5959`.
+
+### Backend
 
 ```bash
-cd core            # Rust workspace root (no Cargo.toml at repo root)
+cd core
 cargo build
-cargo test
+cargo test --all-features
 ```
 
-### Deploy to a Test Node
+Linux is the supported backend runtime and release-build target. macOS is fine
+for frontend work and many Rust compile/test loops, but host integration tests
+that touch Podman, systemd, networking, or image build paths require Linux.
+
+### App manifests
 
 ```bash
-./scripts/deploy-to-target.sh --live   # Deploy to primary dev server
-./scripts/deploy-to-target.sh --both   # Deploy to both LAN servers
+./scripts/validate-app-manifest.sh apps/filebrowser/manifest.yml
+python3 scripts/generate-app-catalog.py
+python3 scripts/check-app-catalog-drift.py --release --strict
 ```
 
-### Release (tarball-only)
+`scripts/generate-app-catalog.py` requires Python with PyYAML installed.
 
-Releases ship as a backend binary and a frontend tarball referenced by
-`releases/manifest.json`, published to the self-hosted Gitea release server.
+## Documentation map
 
-```bash
-./scripts/create-release.sh 1.2.3
-git push origin main --tags
-```
-
-## Architecture
-
-```
-Debian 13 (Trixie)
-  ├── Rootless Podman — every app a systemd Quadlet unit under user.slice
-  ├── Nginx (reverse proxy, security headers, rate limiting)
-  ├── Rust Backend (JSON-RPC API on 127.0.0.1:5678, ~380 RPC methods)
-  │     ├── core/archipelago/  — API, orchestrator + reconciler, mesh, identity,
-  │     │                        federation, wallet, updates, marketplace
-  │     ├── core/container/    — Podman client, manifest schema, Quadlet compiler,
-  │     │                        health monitor, signed app catalog
-  │     ├── core/security/     — AppArmor/seccomp policy, secrets manager
-  │     ├── core/openwrt/      — TollGate gateway provisioning (SSH/UCI)
-  │     └── core/performance/  — resource limits
-  ├── Vue 3 Frontend (Composition API + TypeScript strict + Pinia + Tailwind, PWA)
-  │     └── Three UI modes (Pro/Easy/Chat) + gamepad navigation + i18n
-  ├── Reticulum daemon (supervised Python/PyInstaller, one per LoRa radio)
-  └── System Tor (hidden services, SOCKS5 proxy)
-```
-
-~117,000 lines of Rust | ~69,000 lines of TypeScript/Vue | 51 packaged apps | Android companion app
-
-## Documentation
+The full, grouped index lives at **[docs/README.md](docs/README.md)**. The most
+common entry points:
 
 | Doc | Purpose |
 |-----|---------|
-| [Architecture](docs/architecture.md) | System design, crate map, data paths |
-| [Developer Guide](docs/developer-guide.md) | Dev setup, workflow, code conventions |
-| [API Reference](docs/api-reference.md) | RPC endpoint reference |
-| [App Developer Guide](docs/app-developer-guide.md) | Building and publishing apps |
-| [App Manifest Spec](docs/app-manifest-spec.md) | The `manifest.yml` schema |
-| [User Walkthrough](docs/user-walkthrough.md) | End-user installation and usage guide |
-| [Troubleshooting](docs/troubleshooting.md) | Diagnostic scenarios and solutions |
-| [Operations Runbook](docs/operations-runbook.md) | Ops commands and emergency recovery |
-| [Production Master Plan](docs/PRODUCTION-MASTER-PLAN.md) | North star and workstream narrative |
-| [Unified Task Tracker](docs/UNIFIED-TASK-TRACKER.md) | Live, priority-ordered open items |
-| [Test Gate](tests/lifecycle/TESTING.md) | Production lifecycle test gate (definition of done) |
-| [Archive](docs/archive/) | Historical audits, session logs, shipped designs |
+| [Architecture](docs/architecture.md) | System layers, crates, data paths, security model |
+| [Developer Guide](docs/developer-guide.md) | Local setup, code workflow, testing |
+| [API Reference](docs/api-reference.md) | JSON-RPC API overview |
+| [App Developer Guide](docs/app-developer-guide.md) | How to package and test apps |
+| [App Manifest Spec](docs/app-manifest-spec.md) | Manifest schema and validation rules |
+| [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md) | ngit/NIP-34 contribution workflow and maintainer model |
+| [Apps README](apps/README.md) | Packaged app catalog overview |
+| [Image Recipe](image-recipe/README.md) | Bootable image build flow |
+| [Roadmap](docs/ROADMAP.md) | Shipped, in-progress, and planned work |
+| [Archive](docs/archive/) | Historical plans, audits, and handoffs |
 
 ## Contributing
 
-1. Fork the repository
-2. Create a feature branch (`feature/description`)
-3. Follow the coding standards in [CONTRIBUTING.md](CONTRIBUTING.md) and [CLAUDE.md](CLAUDE.md)
-4. Submit a pull request
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. For
+security issues, follow [SECURITY.md](SECURITY.md) and do not open a public
+issue.
 
 ## License
 
-[MIT License](LICENSE)
-
-## Acknowledgments
-
-Built with: [Rust](https://www.rust-lang.org/), [Vue.js](https://vuejs.org/), [Podman](https://podman.io/), [Bitcoin Core](https://bitcoin.org/), [LND](https://lightning.engineering/), [Reticulum](https://reticulum.network/), [Debian](https://www.debian.org/)
+Archipelago is licensed under the [MIT License](LICENSE). Third-party notices
+are listed in [NOTICE](NOTICE) and generated license inventories in component
+release artifacts.

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Reporting vulnerabilities
+
+Please do not open a public issue for a security vulnerability.
+
+Until a dedicated security intake address is published, report privately to the
+project maintainer through the repository owner account or the private contact
+channel listed on the project homepage.
+
+Include:
+
+- affected commit, version, or release;
+- affected component;
+- reproduction steps;
+- expected impact;
+- logs, proof of concept, or packet captures when relevant;
+- whether the issue is already public.
+
+We aim to acknowledge credible reports within 48 hours and coordinate fixes
+before public disclosure.
+
+## Scope
+
+Security-sensitive areas include:
+
+- authentication, session handling, CSRF, and rate limiting;
+- release and app-catalog signature verification;
+- container manifest validation and runtime compilation;
+- Podman/Quadlet isolation, capabilities, volumes, and secret injection;
+- backup encryption and key derivation;
+- federation, Tor, Nostr, mesh, DID, and credential flows;
+- Android companion pairing and device-token handling.
+
+## Supported versions
+
+Archipelago is currently pre-1.0 alpha software. Security fixes target the
+current `main` branch and the latest published alpha release.

app-catalog/README.md

@@ -21,7 +21,7 @@ Add an entry to `catalog.json`:
   "icon": "/assets/img/app-icons/my-app.svg",
   "author": "Author",
   "category": "data",
-  "dockerImage": "146.59.87.168:3000/lfg2025/my-app:1.0.0",
+  "dockerImage": "source.archipelago-foundation.org/lfg2025/my-app:1.0.0",
   "repoUrl": "https://github.com/...",
   "containerConfig": {
     "ports": ["8080:8080"],

app-catalog/catalog.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
   "updated": "2026-04-22T00:00:00Z",
-  "registry": "146.59.87.168:3000/lfg2025",
+  "registry": "source.archipelago-foundation.org/lfg2025",
   "featured": {
     "id": "indeedhub",
     "banner": "/assets/img/featured/indeedhub-banner.jpg",
@@ -19,7 +19,7 @@
       "author": "Bitcoin Knots",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin-knots:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest",
       "repoUrl": "https://github.com/bitcoinknots/bitcoin"
     },
     {
@@ -31,7 +31,7 @@
       "author": "Bitcoin Core contributors",
       "category": "money",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/bitcoin:28.4",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/bitcoin:28.4",
       "repoUrl": "https://github.com/bitcoin/bitcoin"
     },
     {
@@ -43,7 +43,7 @@
       "author": "Lightning Labs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
       "repoUrl": "https://github.com/lightningnetwork/lnd",
       "requires": [
         "bitcoin-knots"
@@ -52,13 +52,13 @@
     {
       "id": "btcpay-server",
       "title": "BTCPay Server",
-      "version": "2.3.9",
+      "version": "2.4.2",
       "description": "Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.",
       "icon": "/assets/img/app-icons/btcpay-server.png",
       "author": "BTCPay Server Foundation",
       "category": "commerce",
       "tier": "core",
-      "dockerImage": "docker.io/btcpayserver/btcpayserver:2.3.9",
+      "dockerImage": "docker.io/btcpayserver/btcpayserver:2.4.2",
       "repoUrl": "https://github.com/btcpayserver/btcpayserver",
       "requires": [
         "bitcoin-knots"
@@ -73,7 +73,7 @@
       "author": "Mempool",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
       "repoUrl": "https://github.com/mempool/mempool",
       "requires": [
         "bitcoin-knots",
@@ -89,7 +89,7 @@
       "author": "Luke Childs",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/electrumx:v1.18.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0",
       "repoUrl": "https://github.com/spesmilo/electrumx",
       "requires": [
         "bitcoin-knots"
@@ -103,18 +103,18 @@
       "icon": "/assets/img/app-icons/indeedhub.png",
       "author": "IndeeHub",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/indeedhub:1.0.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0",
       "repoUrl": "https://github.com/indeedhub/indeedhub"
     },
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.1.0",
+      "version": "1.2.11",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.1.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/botfights:1.2.11",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [
@@ -172,7 +172,7 @@
       "author": "File Browser",
       "category": "data",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/filebrowser:v2.27.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
       "repoUrl": "https://github.com/filebrowser/filebrowser",
       "containerConfig": {
         "ports": [
@@ -223,7 +223,7 @@
       "author": "Vaultwarden",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/vaultwarden:1.30.0-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
       "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
@@ -243,7 +243,7 @@
       "author": "SearXNG",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/searxng:latest",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/searxng:latest",
       "repoUrl": "https://github.com/searxng/searxng",
       "containerConfig": {
         "ports": [
@@ -262,7 +262,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fedimintd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint"
     },
     {
@@ -274,7 +274,7 @@
       "author": "Fedimint",
       "category": "money",
       "tier": "core",
-      "dockerImage": "146.59.87.168:3000/lfg2025/fmcd:0.8.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fmcd:0.8.1",
       "repoUrl": "https://github.com/minmoto/fmcd"
     },
     {
@@ -285,7 +285,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/gatewayd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
       "repoUrl": "https://github.com/fedimint/fedimint",
       "containerConfig": {
         "ports": [
@@ -306,7 +306,7 @@
       "icon": "/assets/img/app-icons/bark.png",
       "author": "Second",
       "category": "money",
-      "dockerImage": "146.59.87.168:3000/lfg2025/barkd:0.3.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/barkd:0.3.0",
       "repoUrl": "https://gitlab.com/ark-bitcoin/bark",
       "containerConfig": {
         "ports": [
@@ -325,7 +325,7 @@
       "icon": "/assets/img/app-icons/jellyfin.webp",
       "author": "Jellyfin",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/jellyfin:10.8.13",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
       "repoUrl": "https://github.com/jellyfin/jellyfin",
       "containerConfig": {
         "ports": [
@@ -345,18 +345,18 @@
       "icon": "/assets/img/app-icons/immich.png",
       "author": "Immich",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/immich-server:release",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/immich-server:release",
       "repoUrl": "https://github.com/immich-app/immich"
     },
     {
       "id": "homeassistant",
       "title": "Home Assistant",
-      "version": "2024.1.0",
+      "version": "2026.7.3",
       "description": "Open source home automation platform. Control and monitor your smart home devices.",
       "icon": "/assets/img/app-icons/homeassistant.png",
       "author": "Home Assistant",
       "category": "home",
-      "dockerImage": "146.59.87.168:3000/lfg2025/home-assistant:2024.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
       "repoUrl": "https://github.com/home-assistant/core",
       "containerConfig": {
         "ports": [
@@ -373,8 +373,8 @@
     {
       "id": "pine",
       "title": "Pine",
-      "version": "1.1.1",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
+      "version": "1.3.0",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
       "icon": "/assets/img/app-icons/pine.svg",
       "author": "Archipelago",
       "category": "home",
@@ -414,7 +414,7 @@
       "author": "Tailscale",
       "category": "networking",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/tailscale:stable",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/tailscale:stable",
       "repoUrl": "https://github.com/tailscale/tailscale",
       "containerConfig": {
         "ports": [
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "146.59.87.168:3000/lfg2025/portainer:2.19.4",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
@@ -487,7 +487,7 @@
       "author": "Uptime Kuma",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "146.59.87.168:3000/lfg2025/uptime-kuma:1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/uptime-kuma:1",
       "repoUrl": "https://github.com/louislam/uptime-kuma",
       "containerConfig": {
         "ports": [
@@ -514,7 +514,7 @@
       "icon": "/assets/img/app-icons/photoprism.svg",
       "author": "PhotoPrism",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/photoprism:240915",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/photoprism:240915",
       "repoUrl": "https://github.com/photoprism/photoprism",
       "containerConfig": {
         "ports": [
@@ -537,7 +537,7 @@
       "icon": "/assets/img/app-icons/nextcloud.webp",
       "author": "Nextcloud",
       "category": "data",
-      "dockerImage": "146.59.87.168:3000/lfg2025/nextcloud:29",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/nextcloud:29",
       "repoUrl": "https://github.com/nextcloud/server",
       "containerConfig": {
         "ports": [

apps/DEVELOPMENT.md

@@ -76,7 +76,17 @@ podman run -p 18084:8080 \
 
 ## Integration Checklist
 
-Adding a new app requires updates in multiple places. See the full checklist in [CLAUDE.md](../CLAUDE.md) under "App Integration Checklist".
+Adding a new app requires updates in multiple places:
+
+- add `apps/<app-id>/manifest.yml`;
+- add a Dockerfile and source directory only when the app is built locally;
+- choose non-conflicting ports from [PORTS.md](./PORTS.md);
+- declare `interfaces.main` for user-facing web UIs;
+- declare generated secrets instead of hardcoding credentials;
+- run `./scripts/validate-app-manifest.sh apps/<app-id>/manifest.yml`;
+- regenerate catalogs with `python3 scripts/generate-app-catalog.py`;
+- verify drift with `python3 scripts/check-app-catalog-drift.py --release --strict`;
+- test install, launch, stop, start, restart, uninstall, and reinstall.
 
 ## Port Assignments
 

apps/aiui/manifest.yml

@@ -28,6 +28,7 @@ app:
       container: 80
       protocol: tcp
       bind: 127.0.0.1  # Only accessible via nginx proxy, not externally
+      auth: local
 
   health_check:
     type: http

apps/archy-btcpay-db/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Postgres backend for BTCPay and NBXplorer.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/postgres:15.17
+    image: source.archipelago-foundation.org/lfg2025/postgres:15.17
     pull_policy: if-not-present
     network: archy-net
     data_uid: "100998:100998"

apps/archy-mempool-db/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: MariaDB backend for the mempool explorer stack.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mariadb:11.4.10
+    image: source.archipelago-foundation.org/lfg2025/mariadb:11.4.10
     pull_policy: if-not-present
     network: archy-net
     data_uid: "100998:100998"

apps/archy-mempool-web/manifest.yml

@@ -6,7 +6,7 @@ app:
   container_name: mempool
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
     pull_policy: if-not-present
     network: archy-net
 
@@ -26,6 +26,8 @@ app:
     - host: 4080
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   environment:
     - FRONTEND_HTTP_PORT=8080

apps/archy-nbxplorer/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: BTCPay blockchain indexer service.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/nbxplorer:2.6.0
+    image: source.archipelago-foundation.org/lfg2025/nbxplorer:2.6.0
     pull_policy: if-not-present
     network: archy-net
     secret_env:
@@ -33,6 +33,8 @@ app:
     - host: 32838
       container: 32838
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind

apps/barkd/manifest.yml

@@ -10,7 +10,7 @@ app:
     # apps/barkd/Dockerfile and pushed to the node registry. Pin the tag to
     # match the REST shapes coded in core/archipelago/src/wallet/ark_client.rs
     # (validated against barkd 0.3.0 on signet, 2026-07-14).
-    image: 146.59.87.168:3000/lfg2025/barkd:0.3.0
+    image: source.archipelago-foundation.org/lfg2025/barkd:0.3.0
     pull_policy: if-not-present
     network: archy-net
     # The entrypoint installs the shared secret below via `barkd secret
@@ -51,6 +51,8 @@ app:
     - host: 3535
       container: 3535
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Holds the wallet DB, mnemonic and auth token. ARK funds are recoverable

apps/bitcoin-core/manifest.yml

@@ -7,7 +7,7 @@ app:
   container_name: bitcoin-core
 
   container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin:28.4
+    image: source.archipelago-foundation.org/lfg2025/bitcoin:28.4
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]
@@ -35,6 +35,12 @@ app:
         fi;
         RPC_USER="$(printenv BITCOIN_RPC_USER)";
         RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
+        if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
+          echo "archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF" >&2;
+        fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +49,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
@@ -82,9 +88,13 @@ app:
       container: 8332
       protocol: tcp
       bind: 127.0.0.1
+      auth: local
     - host: 8333
       container: 8333
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.
 
   volumes:
     - type: bind

apps/bitcoin-knots/manifest.yml

@@ -7,7 +7,7 @@ app:
   container_name: bitcoin-knots
 
   container:
-    image: 146.59.87.168:3000/lfg2025/bitcoin-knots:latest
+    image: source.archipelago-foundation.org/lfg2025/bitcoin-knots:latest
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]
@@ -35,6 +35,12 @@ app:
         fi;
         RPC_USER="$(printenv BITCOIN_RPC_USER)";
         RPC_PASS="$(printenv BITCOIN_RPC_PASS)";
+        RPC_CONF="/tmp/rpc.conf";
+        umask 077;
+        { echo "rpcuser=$RPC_USER"; echo "rpcpassword=$RPC_PASS"; } > "$RPC_CONF";
+        if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then
+          echo "archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF" >&2;
+        fi;
         RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)";
         DISK_GB_VALUE="$(printenv DISK_GB || true)";
         RPC_HEADROOM="-rpcthreads=16 -rpcworkqueue=256";
@@ -43,9 +49,9 @@ app:
           RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips";
         fi;
         if [ "${DISK_GB_VALUE:-0}" -lt 1000 ]; then
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         else
-          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -noconf -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASS";
+          exec "$BITCOIND" -datadir=/home/bitcoin/.bitcoin -conf="$RPC_CONF" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;
         fi
     derived_env:
       - key: DISK_GB
@@ -82,9 +88,13 @@ app:
       container: 8332
       protocol: tcp
       bind: 127.0.0.1
+      auth: local
     - host: 8333
       container: 8333
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.
 
   volumes:
     - type: bind

apps/bitcoin-ui/manifest.yml

@@ -31,7 +31,22 @@ app:
   # proxies to 127.0.0.1:8332 which is where the bitcoin backend binds
   # its RPC. `ports:` is intentionally empty because host networking
   # bypasses port mapping.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the Bitcoin screen unauthenticated on every interface.
+  ports:
+    - host: 8334
+      container: 8334
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes:
     # Bind-mount the rendered nginx.conf read-only. The prod orchestrator

apps/botfights/manifest.yml

@@ -1,13 +1,45 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.1.0
+  version: 1.2.11
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.1.0
+    image: source.archipelago-foundation.org/lfg2025/botfights:1.2.11
     pull_policy: always
+    # Auto-generated on first install (random hex, 0600, rootless-owned). The
+    # 1.2.x image's server/src/middleware/jwt.ts throws at module import when
+    # JWT_SECRET is unset and NODE_ENV=production, so a fresh install without
+    # this crash-loops immediately. hex32 (not base64, unlike netbird) because
+    # jwt.ts uses the value directly as an HMAC key with no decode step.
+    generated_secrets:
+      - name: botfights-jwt-secret
+        kind: hex32
+    secret_env:
+      - key: JWT_SECRET
+        secret_file: botfights-jwt-secret
+    # Was missing entirely (found live during a fresh install on a second
+    # node): without it, the orchestrator's bind-dir ownership fixup only
+    # fires via a same-owner-as-anchor fallback that assumes an app with no
+    # data_uid runs as container-internal root — but this app runs as a
+    # non-root system user, so that fallback doesn't apply either. The bind
+    # mount ended up unwritable, crash-looping the container on startup
+    # (SqliteError: unable to open database file). Same pattern as
+    # apps/fedimint-clientd/manifest.yml and apps/barkd/manifest.yml.
+    #
+    # 999, not 1001: the image's Dockerfile does `useradd --system` with no
+    # explicit UID, which lands at 999 (confirmed via `podman exec botfights
+    # id` — uid=999(botfights) gid=999(botfights)), not the security.user
+    # value below. security.user is not currently read by the non-Quadlet
+    # install path this app uses (only quadlet.rs consumes
+    # security.{capabilities,readonly_root,no_new_privileges,network_policy}
+    # for companion containers) — it's descriptive metadata here, not
+    # enforced. A first pass at this fix used 1001 (copying the
+    # fedimint-clientd/barkd pattern without verifying against this image)
+    # and still crash-looped; corrected after inspecting the running
+    # container's actual UID.
+    data_uid: "999:999"
 
   dependencies:
     - storage: 500Mi
@@ -21,7 +53,7 @@ app:
     capabilities: []
     readonly_root: true
     no_new_privileges: true
-    user: 1001
+    user: 999
     seccomp_profile: default
     network_policy: bridge
     apparmor_profile: default
@@ -30,10 +62,21 @@ app:
     - host: 9100
       container: 9100
       protocol: tcp  # Web UI + API
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
+    # A bare relative source (was "botfights-data", no leading slash) is
+    # inconsistent with every other app's manifest, which uses an absolute
+    # host path — found live during a fresh install on a second node:
+    # resolved to /var/lib/archipelago/botfights on a test node (by
+    # accident of that node's specific state) but /home/archipelago/
+    # botfights-data on a different node, which doesn't exist there,
+    # crash-looping the container on a real SqliteError: unable to open
+    # database file. Absolute path removes the ambiguity entirely, matching
+    # apps/netbird-server/manifest.yml and every other app's convention.
     - type: bind
-      source: botfights-data
+      source: /var/lib/archipelago/botfights
       target: /app/server/data
     - type: tmpfs
       target: /tmp
@@ -41,6 +84,19 @@ app:
 
   environment:
     - NODE_ENV=production
+    - PORT=9100
+    # Default-on shared public arena federation (BOT-03/D-03): this node's
+    # BotFights becomes a thin client of the Foundation's well-known arena —
+    # all nodes see all fighters, fights cross nodes. This is a rendezvous,
+    # not an authority: any node can host its own arena (same image, just
+    # without this var set), and an operator can remove this line entirely to
+    # run a fully standalone, node-local arena instead.
+    - ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org
+    # Tells the app it is embedded (first-party) in the node dashboard's
+    # iframe, so it can safely disable X-Frame-Options: SAMEORIGIN — see
+    # server/src/app.ts in the botfight repo. Without this the 1.2.x image's
+    # default security headers block the dashboard iframe entirely.
+    - ARCHY_EMBEDDED=1
 
   health_check:
     type: http

apps/btcpay-server/manifest.yml

@@ -1,11 +1,11 @@
 app:
   id: btcpay-server
   name: BTCPay Server
-  version: 2.3.9
+  version: 2.4.2
   description: Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.
 
   container:
-    image: docker.io/btcpayserver/btcpayserver:2.3.9
+    image: docker.io/btcpayserver/btcpayserver:2.4.2
     pull_policy: if-not-present
     network: archy-net
     secret_env:
@@ -45,6 +45,8 @@ app:
     - host: 23000
       container: 49392
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/core-lightning/manifest.yml

@@ -31,9 +31,15 @@ app:
     - host: 9736
       container: 9735
       protocol: tcp  # P2P (using 9736 to avoid conflict with LND)
+      auth: none
+      auth_rationale: >-
+        Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.
     - host: 9835
       container: 9835
       protocol: tcp  # gRPC
+      auth: none
+      auth_rationale: >-
+        Core Lightning gRPC, authenticated by mutual TLS client certificates.
     
   volumes:
     - type: bind

apps/did-wallet/manifest.yml

@@ -30,6 +30,8 @@ app:
     - host: 8088
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/electrs-ui/manifest.yml

@@ -23,7 +23,22 @@ app:
     network_policy: host
 
   # Host networking: nginx listens on 50002 directly on the host IP.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the Electrs screen unauthenticated on every interface.
+  ports:
+    - host: 50002
+      container: 50002
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

apps/electrumx/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Electrum server indexing Bitcoin chain data for lightweight wallet queries.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/electrumx:v1.18.0
+    image: source.archipelago-foundation.org/lfg2025/electrumx:v1.18.0
     pull_policy: if-not-present
     network: archy-net
     data_uid: "1000:1000"
@@ -45,6 +45,9 @@ app:
     - host: 50001
       container: 50001
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Electrum wire protocol over TCP. Electrum wallets speak it directly and cannot hold a session cookie.
 
   volumes:
     - type: bind

apps/fedimint-clientd/manifest.yml

@@ -9,7 +9,7 @@ app:
     # 0.8.2 — iroh-capable). No usable upstream image exists, so we build + push
     # this to the node registry. Pin the tag to match the REST shapes coded in
     # core/archipelago/src/wallet/fedimint_client.rs (validated against 0.8.2).
-    image: 146.59.87.168:3000/lfg2025/fmcd:0.8.1
+    image: source.archipelago-foundation.org/lfg2025/fmcd:0.8.1
     pull_policy: if-not-present
     network: archy-net
     # No entrypoint override: the image's resilient `fmcd-run` launcher loops
@@ -66,6 +66,8 @@ app:
     - host: 8178
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Same dir the first-boot bundled path uses + where the wallet bridge reads

apps/fedimint-gateway/manifest.yml

@@ -5,17 +5,26 @@ app:
   description: Fedimint gateway service with automatic LND-or-LDK backend selection.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/gatewayd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]
+    # The bitcoind host comes from $FM_BITCOIND_URL, filled by the
+    # {{BITCOIN_HOST}} derived-env below — it resolves to whichever bitcoin
+    # container is actually running (Knots, Core, or any future distro archy
+    # ships), so the gateway is never pinned to one node's container name.
+    # (Was hardcoded http://host.archipelago:8332 — the host gateway IP where
+    # bitcoind does not listen — which crash-looped the gateway, 2026-07-22.)
     custom_args:
       - >-
         if [ -f /lnd/tls.cert ] && [ -f /lnd/data/chain/bitcoin/mainnet/admin.macaroon ]; then
-          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url http://host.archipelago:8332 --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" lnd --lnd-rpc-host lnd:10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/data/chain/bitcoin/mainnet/admin.macaroon;
+          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url "$FM_BITCOIND_URL" --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" lnd --lnd-rpc-host lnd:10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/data/chain/bitcoin/mainnet/admin.macaroon;
         else
-          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url http://host.archipelago:8332 --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" ldk --ldk-lightning-port 9737 --ldk-alias archipelago-gateway;
+          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url "$FM_BITCOIND_URL" --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" ldk --ldk-lightning-port 9737 --ldk-alias archipelago-gateway;
         fi
+    derived_env:
+      - key: FM_BITCOIND_URL
+        template: "http://{{BITCOIN_HOST}}:8332"
     # The gateway's admin API is gated by a bcrypt password hash. Generate it on
     # first install (random password + its bcrypt hash, both 0600 rootless-owned)
     # so the app installs from its manifest alone — `fedimint-gateway-hash` holds
@@ -51,9 +60,17 @@ app:
     - host: 8176
       container: 8176
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint gateway API, protected by its own bcrypt password (--bcrypt-password-hash)
+        and reached by federation peers and clients that cannot hold a browser session.
     - host: 9737
       container: 9737
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        LDK Lightning p2p for the gateway. The BOLT-8 noise handshake authenticates and
+        encrypts the connection itself.
 
   volumes:
     - type: bind

apps/fedimint/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/fedimintd:v0.10.0
+    image: source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]
@@ -21,6 +21,11 @@ app:
         template: fedimint://{{HOST_MDNS}}:8173
       - key: FM_API_URL
         template: ws://{{HOST_MDNS}}:8174
+      # Resolves to whichever bitcoin container is running (Knots/Core/future
+      # distro) instead of a hardcoded name — the guardian works on any node
+      # regardless of which Bitcoin software it runs.
+      - key: FM_BITCOIND_URL
+        template: "http://{{BITCOIN_HOST}}:8332"
     secret_env:
       - key: FM_BITCOIND_PASSWORD
         secret_file: bitcoin-rpc-password
@@ -45,14 +50,31 @@ app:
     - host: 8173
       container: 8173
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint guardian consensus. Other guardians speak the federation's own
+        authenticated protocol here; a login page would break consensus.
     - host: 8174
       container: 8174
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Fedimint guardian API for federation clients, which authenticate to the
+        federation itself and cannot hold a browser session.
     # Public launch port 8175 is owned by archy-fedimint-ui, which serves a
     # wait page while Bitcoin syncs and proxies here after fedimintd starts.
+    # 8175 is NOT declared here. It is served by the archy-fedimint-ui
+    # companion, a different container, and declaring it on this app made the
+    # orchestrator try to publish 8175 from fedimintd — colliding with the
+    # companion that already holds it, so start_container failed forever and
+    # fedimint crash-looped (100.82.34.38, 2026-08-05). The companion's nginx
+    # is pinned to 127.0.0.1, which is what actually closes that port; the
+    # gate reports it rather than fronting it.
     - host: 8177
       container: 8175
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind
@@ -62,7 +84,8 @@ app:
 
   environment:
     - FM_DATA_DIR=/data
-    - FM_BITCOIND_URL=http://bitcoin-knots:8332
+    # FM_BITCOIND_URL comes from derived_env ({{BITCOIN_HOST}}) above, not a
+    # hardcoded name — do not re-add it here.
     - FM_BITCOIND_USERNAME=archipelago
     - FM_BITCOIN_NETWORK=bitcoin
     - FM_BIND_P2P=0.0.0.0:8173

apps/filebrowser/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Baseline Archipelago file manager service.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
     pull_policy: if-not-present
     network: archy-net
     custom_args: ["--config", "/data/.filebrowser.json"]
@@ -27,6 +27,8 @@ app:
     - host: 8083
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/fips-ui/manifest.yml

@@ -27,7 +27,22 @@ app:
   # Host networking: nginx listens on 8336 directly on the host IP and
   # proxies to 127.0.0.1:5678 (the archipelago RPC). `ports:` is
   # intentionally empty because host networking bypasses port mapping.
-  ports: []
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the FIPS mesh screen unauthenticated on every interface.
+  ports:
+    - host: 8336
+      container: 8336
+      protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

apps/gitea/manifest.yml

@@ -26,9 +26,14 @@ app:
     - host: 3001
       container: 3000
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
     - host: 2222
       container: 22
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Git over SSH, authenticated by the user's own SSH keypair. Not HTTP, so the gate cannot serve a login page here.
 
   volumes:
     - type: bind

apps/grafana/manifest.yml

@@ -31,6 +31,8 @@ app:
     - host: 3000
       container: 3000
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/home-assistant/Dockerfile

@@ -1,5 +1,5 @@
 # Home Assistant - uses official image
-FROM homeassistant/home-assistant:2024.1
+FROM homeassistant/home-assistant:2026.7.3
 
 # Default configuration is in the image
 # No additional setup needed

apps/home-assistant/manifest.yml

@@ -1,11 +1,11 @@
 app:
   id: homeassistant
   name: Home Assistant
-  version: 2024.1.0
+  version: 2026.7.3
   description: Open source home automation platform. Control and monitor your smart home devices.
   
   container:
-    image: 146.59.87.168:3000/lfg2025/home-assistant:2024.1
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3
     pull_policy: if-not-present
     network: pasta
     
@@ -30,6 +30,8 @@ app:
     - host: 8123
       container: 8123
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/immich-postgres/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: immich_postgres
 
   container:
-    image: 146.59.87.168:3000/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    image: source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
     pull_policy: if-not-present
     network: archy-net
     # postgres drops to its own uid (container 999 → host 100998 under rootless),

apps/immich-redis/manifest.yml

@@ -9,7 +9,7 @@ app:
   container_name: immich_redis
 
   container:
-    image: 146.59.87.168:3000/lfg2025/valkey:7-alpine
+    image: source.archipelago-foundation.org/lfg2025/valkey:7-alpine
     pull_policy: if-not-present
     network: archy-net
 

apps/immich/manifest.yml

@@ -13,7 +13,7 @@ app:
   container_name: immich_server
 
   container:
-    image: 146.59.87.168:3000/lfg2025/immich-server:release
+    image: source.archipelago-foundation.org/lfg2025/immich-server:release
     pull_policy: if-not-present
     network: archy-net
     secret_env:
@@ -44,6 +44,8 @@ app:
     - host: 2283
       container: 2283
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/indeedhub-api/manifest.yml

@@ -12,7 +12,7 @@ app:
   container_name: indeedhub-api
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-api:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-api:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [api]

apps/indeedhub-ffmpeg/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-ffmpeg
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub-ffmpeg:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub-ffmpeg:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
     secret_env:

apps/indeedhub-minio/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-minio
 
   container:
-    image: 146.59.87.168:3000/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
+    image: source.archipelago-foundation.org/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [minio]

apps/indeedhub-postgres/manifest.yml

@@ -14,7 +14,7 @@ app:
   container_name: indeedhub-postgres
 
   container:
-    image: 146.59.87.168:3000/lfg2025/postgres:16.13-alpine
+    image: source.archipelago-foundation.org/lfg2025/postgres:16.13-alpine
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [postgres]

apps/indeedhub-redis/manifest.yml

@@ -10,7 +10,7 @@ app:
   container_name: indeedhub-redis
 
   container:
-    image: 146.59.87.168:3000/lfg2025/redis:7.4.8-alpine
+    image: source.archipelago-foundation.org/lfg2025/redis:7.4.8-alpine
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [redis]
@@ -22,7 +22,13 @@ app:
     memory_limit: 256Mi
 
   security:
-    capabilities: [SETGID, SETUID]
+    # The alpine entrypoint runs as container-root, `find`s /data to chown
+    # anything not owned by the redis user, then su-execs to it. Under the
+    # orchestrator's --cap-drop=ALL, root cannot traverse the 0700
+    # appendonlydir owned by uid 999 without DAC_OVERRIDE (observed
+    # crash-looping ~4k restarts on a test node) — CHOWN is what the find's
+    # -exec chown needs on adopted legacy data.
+    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID]
     readonly_root: false
     network_policy: isolated
 

apps/indeedhub-relay/manifest.yml

@@ -11,7 +11,7 @@ app:
   container_name: indeedhub-relay
 
   container:
-    image: 146.59.87.168:3000/lfg2025/nostr-rs-relay:0.9.0
+    image: source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [relay]

apps/indeedhub/manifest.yml

@@ -12,7 +12,7 @@ app:
   container_name: indeedhub
 
   container:
-    image: 146.59.87.168:3000/lfg2025/indeedhub:1.0.0
+    image: source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0
     pull_policy: if-not-present
     network: indeedhub-net
 
@@ -38,6 +38,8 @@ app:
     - host: 7778
       container: 7777
       protocol: tcp  # Web UI. Port 7777 on the host is reserved for the Nostr relay.
+      bind: 127.0.0.1
+      auth: gated
 
   # Writable scratch the baked nginx needs; matches the legacy installer's
   # --tmpfs /run + /var/cache/nginx.

apps/indeedhub/push-to-registry.sh

@@ -12,7 +12,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FRONTEND_DIR="${INDEEHUB_FRONTEND:-$HOME/Projects/indeehub-frontend}"
 VERSION="${1:-latest}"
-REGISTRY="${REGISTRY:-146.59.87.168:3000}"
+REGISTRY="${REGISTRY:-source.archipelago-foundation.org}"
 NAMESPACE="${NAMESPACE:-lfg2025}"
 IMAGE_NAME="indeedhub"
 RUNTIME="${RUNTIME:-podman}"

apps/jellyfin/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Free media server. Stream movies, music, and photos.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/jellyfin:10.8.13
+    image: source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13
     pull_policy: if-not-present
     network: pasta
 
@@ -25,6 +25,8 @@ app:
     - host: 8096
       container: 8096
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/lightning-stack/manifest.yml

@@ -32,12 +32,23 @@ app:
     - host: 9738
       container: 9735
       protocol: tcp  # P2P
+      auth: none
+      auth_rationale: >-
+        Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.
     - host: 10010
       container: 10009
       protocol: tcp  # gRPC
+      auth: none
+      auth_rationale: >-
+        LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.
+    # Mirrors lnd's 18080 exemption — same LND REST API, same macaroon auth.
     - host: 8091
       container: 8080
       protocol: tcp  # REST/Web UI
+      auth: none
+      auth_rationale: >-
+        LND REST, authenticated by macaroon over TLS. A browser login page would break
+        Zeus and every non-browser wallet client, exactly as for lnd's 18080.
     
   volumes:
     - type: bind

apps/lnd-ui/manifest.yml

@@ -22,14 +22,35 @@ app:
 
   security:
     readonly_root: false
-    network_policy: bridge
+    network_policy: host
 
-  # Bridge networking via archy-net. Container nginx listens on 80;
-  # host nginx proxies /app/lnd/ -> 127.0.0.1:18083 -> container:80.
+  # Host networking: the container's nginx listens on 18083 directly (see
+  # docker/lnd-ui/nginx.conf), because it has to proxy the archipelago backend
+  # on 127.0.0.1:5678 same-origin — a bridge container cannot reach that, and
+  # the cross-origin fallback broke the app on http-only nodes. `ports:` is
+  # intentionally empty because host networking bypasses port mapping, exactly
+  # as in apps/bitcoin-ui/manifest.yml.
+  #
+  # This previously declared `bridge` with 18083:80, which publishes the host
+  # port to a container port where nothing listens. scripts/container-specs.sh
+  # carried the identical mistake and was fixed alongside this; recreating from
+  # it on a test node left :18083 refusing connections.
+  # Declared so the APP GATE can see this port. Host networking means Podman
+  # publishes nothing (quadlet skips PublishPort in host mode), so `bind:` here
+  # is a statement of where the container's own nginx listens — 127.0.0.1 —
+  # not a publish instruction. Without this declaration the gate had no idea
+  # the port existed: it was neither protected nor listed as unprotected, and
+  # served the LND screen unauthenticated on every interface.
   ports:
     - host: 18083
-      container: 80
+      container: 18083
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

apps/lnd/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
     pull_policy: if-not-present
     network: archy-net
     # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or
@@ -38,12 +38,21 @@ app:
     - host: 9735
       container: 9735
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.
     - host: 10009
       container: 10009
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        LND gRPC, authenticated by macaroon over TLS. Zeus and other remote wallets depend on reaching this directly.
     - host: 18080
       container: 8080
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client.
 
   volumes:
     - type: bind

apps/mempool-api/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Backend API for mempool explorer.
 
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-backend:v3.0.0
+    image: source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0
     pull_policy: if-not-present
     network: archy-net
     # CORE_RPC_HOST must follow the node's actual Bitcoin container — Knots or
@@ -42,6 +42,8 @@ app:
     - host: 8999
       container: 8999
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind

apps/mempool/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.
   
   container:
-    image: 146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1
+    image: source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1
     image_signature: cosign://...
     pull_policy: if-not-present
     
@@ -33,6 +33,8 @@ app:
     - host: 4080
       container: 8080  # mempool-frontend nginx listens on 8080 (FRONTEND_HTTP_PORT=8080)
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/morphos-server/manifest.yml

@@ -30,6 +30,8 @@ app:
     - host: 8089
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/netbird-server/manifest.yml

@@ -48,9 +48,17 @@ app:
     - host: 8086
       container: 80
       protocol: tcp   # management API + embedded OIDC issuer (/oauth2)
+      auth: none
+      auth_rationale: >-
+        NetBird management API and its OIDC issuer. Enrolled devices authenticate
+        themselves with setup keys and JWTs, and they cannot hold a browser session —
+        a login page here would disconnect every VPN client on the network.
     - host: 3478
       container: 3478
       protocol: udp   # STUN — must be UDP; tcp here breaks relay discovery
+      auth: none
+      auth_rationale: >-
+        STUN over UDP for NAT traversal; it must answer unauthenticated probes to do its job at all.
 
   volumes:
     - type: bind

apps/netbird/manifest.yml

@@ -44,6 +44,11 @@ app:
     - host: 8087
       container: 443
       protocol: tcp
+      auth: none
+      auth_rationale: >-
+        NetBird dashboard over TLS, with its own login. The gate speaks plain HTTP,
+        so fronting this port would break the secure context the dashboard requires
+        (issue #15) and the certificate clients pin.
 
   volumes:
     - type: bind