chore: release v1.7.113-alpha

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/demo-images.yml

@@ -18,7 +18,7 @@ on:
     paths:
       - 'neode-ui/**'
       - 'docker-compose.demo.yml'
-      - '.github/workflows/demo-images.yml'
+      - '.gitea/workflows/demo-images.yml'
   workflow_dispatch:
 
 jobs:

Android/.gitignore

@@ -19,3 +19,7 @@ local.properties
 # updates then install over the top without an uninstall. Debug keys are not
 # secret (well-known password "android"); never commit a real release keystore.
 !/app/debug.keystore
+
+# Rust build outputs (archy-fips-core → jniLibs via buildRustArm64)
+/rust/archy-fips-core/target
+/app/src/main/jniLibs

Android/COMPANION_RELEASE.md

@@ -23,6 +23,10 @@ used by the `.githooks/pre-push` hook), which:
    **aborts** if any is missing.
 5. Stages the signed APK at `neode-ui/public/packages/archipelago-companion.apk`,
    commits, and pushes with `SHIP_COMPANION=1` (the sanctioned pre-push bypass).
+6. The first-launch companion modal and Android "Share this app" QR point at
+   `http://146.59.87.168:2100/packages/archipelago-companion.apk`. After the
+   repo artifact is built, mirror that exact APK to the VPS2-served path before
+   calling the release done.
 
 **Never** hand-roll `gradlew assembleDebug` + `cp` to the served path. That path
 skips the clean build and the signature enforcement and is exactly how a broken
@@ -82,13 +86,16 @@ home-screen app layouts wiped by an over-broad action.
 
 ## Verify the published download after shipping
 
-The download served to nodes is Gitea raw-on-main. Confirm the live bytes match
-what you built and signed:
+The checked-in artifact is Gitea raw-on-main. The QR/App Store download served
+to users is the VPS2 `:2100` URL. Confirm both live byte streams match what you
+built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
-curl -sS -o /tmp/live.apk "$URL"
-shasum -a 256 "$SERVED" /tmp/live.apk          # must match
-apksigner verify -v --min-sdk-version 21 /tmp/live.apk | grep -i "scheme"  # v1/v2/v3 = true
+GITEA_URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
+QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
+curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
+curl -sS -o /tmp/live-qr.apk "$QR_URL"
+shasum -a 256 "$SERVED" /tmp/live-gitea.apk /tmp/live-qr.apk  # all must match
+apksigner verify -v --min-sdk-version 21 /tmp/live-qr.apk | grep -i "scheme"  # v1/v2/v3 = true
 ```

Android/app/build.gradle.kts

@@ -11,12 +11,17 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 19
-        versionName = "0.4.15"
+        versionCode = 38
+        versionName = "0.5.18"
 
         vectorDrawables {
             useSupportLibrary = true
         }
+
+        // The embedded FIPS mesh (libarchy_fips_core.so) is built arm64-only,
+        // matching real handsets. FipsNative.available gates every call, so
+        // the app still runs as a plain companion elsewhere (e.g. x86 emu).
+        ndk { abiFilters += "arm64-v8a" }
     }
 
     signingConfigs {
@@ -80,6 +85,44 @@ android {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Embedded FIPS mesh: cross-compile Android/rust/archy-fips-core via cargo-ndk
+// into jniLibs before the native-libs merge, so a plain `gradlew assembleDebug`
+// builds the Rust too. Requires rustup target aarch64-linux-android, cargo-ndk,
+// and an NDK (ANDROID_NDK_HOME or the SDK's ndk/ dir).
+// ---------------------------------------------------------------------------
+val rustCrateDir = layout.projectDirectory.dir("../rust/archy-fips-core")
+val jniLibsDir = layout.projectDirectory.dir("src/main/jniLibs")
+
+tasks.register<Exec>("buildRustArm64") {
+    workingDir = rustCrateDir.asFile
+    inputs.dir(rustCrateDir.dir("src"))
+    inputs.file(rustCrateDir.file("Cargo.toml"))
+    outputs.dir(jniLibsDir)
+    // cargo/cargo-ndk live in ~/.cargo/bin, which Gradle's env may not have.
+    val home = System.getProperty("user.home")
+    environment("PATH", "$home/.cargo/bin:${System.getenv("PATH")}")
+    if (System.getenv("ANDROID_NDK_HOME") == null) {
+        val sdkNdk = file("$home/Library/Android/sdk/ndk")
+            .listFiles()?.maxByOrNull { it.name }
+        if (sdkNdk != null) environment("ANDROID_NDK_HOME", sdkNdk.absolutePath)
+    }
+    commandLine(
+        "cargo", "ndk",
+        "-t", "arm64-v8a",
+        "--platform", "26",
+        "-o", jniLibsDir.asFile.absolutePath,
+        "build", "--release",
+    )
+}
+
+tasks.matching {
+    it.name in listOf(
+        "mergeDebugNativeLibs", "mergeReleaseNativeLibs",
+        "mergeDebugJniLibFolders", "mergeReleaseJniLibFolders",
+    )
+}.configureEach { dependsOn("buildRustArm64") }
+
 dependencies {
     val composeBom = platform("androidx.compose:compose-bom:2024.05.00")
     implementation(composeBom)

Android/app/src/main/AndroidManifest.xml

@@ -7,6 +7,10 @@
     <!-- Pairing-QR scanner. Camera is optional: manual entry still works without one. -->
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-feature android:name="android.hardware.camera.any" android:required="false" />
+    <!-- Embedded FIPS mesh tunnel (ArchyVpnService) runs as a foreground service. -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
     <application
         android:name=".ArchipelagoApp"
@@ -19,6 +23,18 @@
         android:usesCleartextTraffic="true"
         tools:targetApi="35">
 
+        <!-- Party-screen "Share this app": exposes the copied APK from
+             cache/share/ to the system share sheet, nothing else. -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+
         <activity
             android:name=".MainActivity"
             android:exported="true"
@@ -39,6 +55,21 @@
                 <data android:scheme="archipelago" android:host="pair" />
             </intent-filter>
         </activity>
+
+        <!-- Embedded FIPS mesh node: split-tunnel VpnService (fd00::/8 only),
+             configured entirely by scanning the node's pairing QR. -->
+        <service
+            android:name=".fips.ArchyVpnService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse"
+            android:permission="android.permission.BIND_VPN_SERVICE">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="mesh-vpn-tunnel" />
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+        </service>
     </application>
 
 </manifest>

Android/app/src/main/java/com/archipelago/app/data/ServerPreferences.kt

@@ -19,25 +19,45 @@ data class ServerEntry(
     val port: String = "",
     val password: String = "",
     val name: String = "",
+    /** Node's FIPS mesh ULA (IPv6) — reachable from anywhere once meshed. */
+    val meshIp: String = "",
+    /** Node's FIPS npub — the durable identity. When present it, not the
+     *  address, is what identifies the entry: FIPS peers on npubs, IPs are
+     *  only dial hints (docs/companion-pairing-qr.md, npub-first contract). */
+    val npub: String = "",
 ) {
     /** Label to show in lists — the user-given name, or the address if unnamed. */
     fun displayName(): String = name.ifBlank { address }
 
+    /** Bracket bare IPv6 literals (the mesh ULA) so they form valid URLs. */
+    private fun urlHost(host: String): String =
+        if (host.contains(":") && !host.startsWith("[")) "[$host]" else host
+
     fun toUrl(): String {
         val scheme = if (useHttps) "https" else "http"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://$address$portSuffix"
+        return "$scheme://${urlHost(address)}$portSuffix"
     }
 
     fun toWsUrl(): String {
         val scheme = if (useHttps) "wss" else "ws"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://$address$portSuffix"
+        return "$scheme://${urlHost(address)}$portSuffix"
     }
 
-    // name is the trailing field so entries saved before naming existed
-    // (4 fields) still deserialize, with name defaulting to "".
-    fun serialize(): String = "$address|$useHttps|$port|$password|$name"
+    /** Mesh-address UI URL, or null when the node never advertised one. */
+    fun toMeshUrl(): String? =
+        meshIp.takeIf { it.isNotBlank() }?.let { "http://${urlHost(it)}" }
+
+    // name/meshIp/npub are trailing fields so entries saved before they
+    // existed (4/5/6 fields) still deserialize, defaulting to "".
+    fun serialize(): String = "$address|$useHttps|$port|$password|$name|$meshIp|$npub"
+
+    /** Same node as [other]? npub identity wins; address/port/scheme is the
+     *  fallback for LAN-only entries that never advertised FIPS. */
+    fun sameNode(other: ServerEntry): Boolean =
+        (npub.isNotBlank() && npub == other.npub) ||
+            (address == other.address && port == other.port && useHttps == other.useHttps)
 
     companion object {
         fun deserialize(raw: String): ServerEntry? {
@@ -49,6 +69,8 @@ data class ServerEntry(
                 port = parts.getOrElse(2) { "" },
                 password = parts.getOrElse(3) { "" },
                 name = parts.getOrElse(4) { "" },
+                meshIp = parts.getOrElse(5) { "" },
+                npub = parts.getOrElse(6) { "" },
             )
         }
     }
@@ -61,8 +83,11 @@ class ServerPreferences(private val context: Context) {
     private val activePortKey = stringPreferencesKey("active_port")
     private val activePasswordKey = stringPreferencesKey("active_password")
     private val activeNameKey = stringPreferencesKey("active_name")
+    private val activeMeshIpKey = stringPreferencesKey("active_mesh_ip")
+    private val activeNpubKey = stringPreferencesKey("active_npub")
     private val savedServersKey = stringSetPreferencesKey("saved_servers")
     private val introSeenKey = booleanPreferencesKey("intro_seen")
+    private val gestureHintSeenKey = booleanPreferencesKey("gesture_hint_seen")
 
     val activeServer: Flow<ServerEntry?> = context.dataStore.data.map { prefs ->
         val address = prefs[activeAddressKey] ?: return@map null
@@ -72,6 +97,8 @@ class ServerPreferences(private val context: Context) {
             port = prefs[activePortKey] ?: "",
             password = prefs[activePasswordKey] ?: "",
             name = prefs[activeNameKey] ?: "",
+            meshIp = prefs[activeMeshIpKey] ?: "",
+            npub = prefs[activeNpubKey] ?: "",
         )
     }
 
@@ -84,6 +111,11 @@ class ServerPreferences(private val context: Context) {
         prefs[introSeenKey] ?: false
     }
 
+    /** One-shot flag for the three-finger-hold teaching overlay. */
+    val gestureHintSeen: Flow<Boolean> = context.dataStore.data.map { prefs ->
+        prefs[gestureHintSeenKey] ?: false
+    }
+
     suspend fun setActiveServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             prefs[activeAddressKey] = server.address
@@ -91,6 +123,8 @@ class ServerPreferences(private val context: Context) {
             prefs[activePortKey] = server.port
             prefs[activePasswordKey] = server.password
             prefs[activeNameKey] = server.name
+            prefs[activeMeshIpKey] = server.meshIp
+            prefs[activeNpubKey] = server.npub
         }
         addSavedServer(server)
     }
@@ -102,6 +136,8 @@ class ServerPreferences(private val context: Context) {
             prefs.remove(activePortKey)
             prefs.remove(activePasswordKey)
             prefs.remove(activeNameKey)
+            prefs.remove(activeMeshIpKey)
+            prefs.remove(activeNpubKey)
         }
     }
 
@@ -113,63 +149,66 @@ class ServerPreferences(private val context: Context) {
     }
 
     /**
-     * Replace a saved server in place. Matches the existing entry by connection
-     * identity (address/port/scheme) so edits that change the name or password —
-     * or that touch a legacy 4-field entry — still update the right record. If the
-     * edited server is also the active one, the active record is kept in sync.
+     * Replace a saved server in place. Matches the existing entry by node
+     * identity — npub first, address/port/scheme as the LAN-only fallback
+     * (ServerEntry.sameNode) — so edits that change the name, password or even
+     * every address still update the right record. An edit form that doesn't
+     * carry the npub keeps the stored one. If the edited server is also the
+     * active one, the active record is kept in sync.
      */
     suspend fun updateSavedServer(original: ServerEntry, updated: ServerEntry) {
+        val toStore = updated.copy(npub = updated.npub.ifBlank { original.npub })
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
             val filtered = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == original.address &&
-                    e.port == original.port &&
-                    e.useHttps == original.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(original) == true
             }.toSet()
-            prefs[savedServersKey] = filtered + updated.serialize()
+            prefs[savedServersKey] = filtered + toStore.serialize()
 
-            val isActive = prefs[activeAddressKey] == original.address &&
-                (prefs[activePortKey] ?: "") == original.port &&
-                (prefs[activeHttpsKey] ?: false) == original.useHttps
+            val activeNpub = prefs[activeNpubKey] ?: ""
+            val isActive = (activeNpub.isNotBlank() && activeNpub == original.npub) ||
+                (
+                    prefs[activeAddressKey] == original.address &&
+                        (prefs[activePortKey] ?: "") == original.port &&
+                        (prefs[activeHttpsKey] ?: false) == original.useHttps
+                    )
             if (isActive) {
-                prefs[activeAddressKey] = updated.address
-                prefs[activeHttpsKey] = updated.useHttps
-                prefs[activePortKey] = updated.port
-                prefs[activePasswordKey] = updated.password
-                prefs[activeNameKey] = updated.name
+                prefs[activeAddressKey] = toStore.address
+                prefs[activeHttpsKey] = toStore.useHttps
+                prefs[activePortKey] = toStore.port
+                prefs[activePasswordKey] = toStore.password
+                prefs[activeNameKey] = toStore.name
+                prefs[activeMeshIpKey] = toStore.meshIp
+                prefs[activeNpubKey] = toStore.npub
             }
         }
     }
 
     /**
-     * Add a server, or update the entry with the same connection identity
-     * (address/port/scheme) — used by QR pairing so re-scanning a node never
-     * duplicates it. A blank incoming password/name keeps the stored value
-     * (a real node's QR never carries the password). Returns the merged entry.
+     * Add a server, or update the entry for the same node — npub first,
+     * address/port/scheme as the LAN-only fallback (ServerEntry.sameNode) —
+     * used by QR pairing so re-scanning a node never duplicates it, even after
+     * the LAN renumbered and every address changed (npub-first contract in
+     * docs/companion-pairing-qr.md). A blank incoming password/name keeps the
+     * stored value (a real node's QR never carries the password). Returns the
+     * merged entry.
      */
     suspend fun upsertServer(server: ServerEntry): ServerEntry {
         var merged = server
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            val existing = current.mapNotNull { ServerEntry.deserialize(it) }.firstOrNull {
-                it.address == server.address &&
-                    it.port == server.port &&
-                    it.useHttps == server.useHttps
-            }
+            val existing = current.mapNotNull { ServerEntry.deserialize(it) }
+                .firstOrNull { it.sameNode(server) }
             if (existing != null) {
                 merged = server.copy(
                     password = server.password.ifBlank { existing.password },
                     name = server.name.ifBlank { existing.name },
+                    meshIp = server.meshIp.ifBlank { existing.meshIp },
+                    npub = server.npub.ifBlank { existing.npub },
                 )
             }
             val filtered = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == server.address &&
-                    e.port == server.port &&
-                    e.useHttps == server.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(merged) == true
             }.toSet()
             prefs[savedServersKey] = filtered + merged.serialize()
         }
@@ -179,15 +218,11 @@ class ServerPreferences(private val context: Context) {
     suspend fun removeSavedServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            // Match by connection identity (address/port/scheme) rather than the
-            // exact serialized string, so a rename — or the legacy 4-field format
-            // saved before names existed — still removes the right entry.
+            // Match by node identity (npub, else address/port/scheme) rather
+            // than the exact serialized string, so a rename — or a legacy
+            // short-format entry — still removes the right record.
             prefs[savedServersKey] = current.filterNot { raw ->
-                val e = ServerEntry.deserialize(raw)
-                e != null &&
-                    e.address == server.address &&
-                    e.port == server.port &&
-                    e.useHttps == server.useHttps
+                ServerEntry.deserialize(raw)?.sameNode(server) == true
             }.toSet()
         }
     }
@@ -197,4 +232,10 @@ class ServerPreferences(private val context: Context) {
             prefs[introSeenKey] = true
         }
     }
+
+    suspend fun markGestureHintSeen() {
+        context.dataStore.edit { prefs ->
+            prefs[gestureHintSeenKey] = true
+        }
+    }
 }

Android/app/src/main/java/com/archipelago/app/data/ServerQrParser.kt

@@ -1,6 +1,8 @@
 package com.archipelago.app.data
 
 import android.net.Uri
+import com.archipelago.app.fips.AnchorPeer
+import com.archipelago.app.fips.FipsPairInfo
 
 /**
  * Result of parsing a pairing QR / deep link.
@@ -10,7 +12,11 @@ import android.net.Uri
  * user to update the app rather than call the code invalid.
  */
 sealed class PairResult {
-    data class Success(val server: ServerEntry) : PairResult()
+    data class Success(
+        val server: ServerEntry,
+        /** Mesh info when the node advertises FIPS (fnpub present). */
+        val fips: FipsPairInfo? = null,
+    ) : PairResult()
     object UnsupportedVersion : PairResult()
     object Invalid : PairResult()
 }
@@ -19,13 +25,18 @@ sealed class PairResult {
  * Parser for the companion pairing QR / OS deep link. Contract:
  * docs/companion-pairing-qr.md (repo root).
  *
- *   archipelago://pair?v=1&url=<percent-encoded origin>[&pw=<password>]
+ *   archipelago://pair?v=1&url=<origin>&name=…[&tok=…][&pw=…][&fnpub=…&fip=…&fhost=…&fudp=…&ftcp=…]
  *
  * - `url` is a full origin including scheme (http for LAN/mDNS nodes, https
  *   for the public demo); trailing slashes are normalized away.
- * - `pw` is only ever present for the public demo.
- * - Unknown extra query params are tolerated (forward compat under v=1 —
- *   `name` is already honored if present).
+ * - `tok` is a device token minted by the node; it goes through the password
+ *   field on purpose — the whole password auto-login path (WebSocket auth +
+ *   WebView form injection) then works unchanged, and the backend accepts
+ *   device tokens wherever it accepts the password. `pw` (demo only) wins if
+ *   both are ever present.
+ * - `fnpub`/`fip`/`fhost`/`fudp`/`ftcp` describe the node's FIPS mesh; their
+ *   absence just means LAN-only pairing (older node, or FIPS not provisioned).
+ * - Unknown extra query params are tolerated (forward compat under v=1).
  */
 object ServerQrParser {
     private const val SUPPORTED_MAJOR = 1
@@ -54,14 +65,64 @@ object ServerQrParser {
         val host = server.host
         if (host.isNullOrBlank()) return PairResult.Invalid
 
+        val fips = parseFips(uri)
+        val credential = uri.getQueryParameter("pw")?.takeIf { it.isNotBlank() }
+            ?: uri.getQueryParameter("tok")
+            ?: ""
+
         return PairResult.Success(
-            ServerEntry(
+            server = ServerEntry(
                 address = host,
                 useHttps = scheme == "https",
                 port = if (server.port != -1) server.port.toString() else "",
-                password = uri.getQueryParameter("pw") ?: "",
+                password = credential,
                 name = uri.getQueryParameter("name") ?: "",
-            )
+                meshIp = fips?.ula ?: "",
+                // npub is the durable identity — saved-server upserts match on
+                // it, so re-scanning after a LAN renumber updates in place.
+                npub = fips?.npub ?: "",
+            ),
+            fips = fips,
         )
     }
+
+    private fun parseFips(uri: Uri): FipsPairInfo? {
+        val npub = uri.getQueryParameter("fnpub")?.trim()
+        var host = uri.getQueryParameter("fhost")?.trim()
+        if (npub.isNullOrBlank() || host.isNullOrBlank()) return null
+        // A .fips fhost is a dead dial hint: Android's system DNS can't
+        // resolve .fips, so every handshake send fails and first connect
+        // falls back to slow anchor discovery. If the QR's `url` host is a
+        // real address, dial that instead (QRs minted while the node UI was
+        // browsed over the mesh carry npub….fips here).
+        if (host.endsWith(".fips")) {
+            val urlHost = uri.getQueryParameter("url")
+                ?.let { runCatching { Uri.parse(it).host }.getOrNull() }
+            if (!urlHost.isNullOrBlank() && !urlHost.endsWith(".fips")) host = urlHost
+        }
+        return FipsPairInfo(
+            npub = npub,
+            ula = uri.getQueryParameter("fip")?.trim().orEmpty(),
+            host = host,
+            udpPort = uri.getQueryParameter("fudp")?.toIntOrNull() ?: 2121,
+            tcpPort = uri.getQueryParameter("ftcp")?.toIntOrNull() ?: 8443,
+            anchors = parseAnchors(uri.getQueryParameter("fanchors")),
+        )
+    }
+
+    /** `fanchors` = comma-joined `npub@host:port/transport`; bad items skipped. */
+    private fun parseAnchors(raw: String?): List<AnchorPeer> {
+        if (raw.isNullOrBlank()) return emptyList()
+        return raw.split(",").mapNotNull { item ->
+            val at = item.indexOf('@')
+            val slash = item.lastIndexOf('/')
+            if (at <= 0 || slash <= at) return@mapNotNull null
+            val npub = item.substring(0, at).trim()
+            val addr = item.substring(at + 1, slash).trim()
+            val transport = item.substring(slash + 1).trim().lowercase()
+            if (npub.isBlank() || !addr.contains(":")) return@mapNotNull null
+            if (transport != "udp" && transport != "tcp") return@mapNotNull null
+            AnchorPeer(npub = npub, addr = addr, transport = transport)
+        }
+    }
 }

Android/app/src/main/java/com/archipelago/app/fips/ArchyVpnService.kt

@@ -0,0 +1,228 @@
+package com.archipelago.app.fips
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Intent
+import android.net.VpnService
+import android.os.Build
+import android.util.Log
+import com.archipelago.app.MainActivity
+import com.archipelago.app.R
+import com.archipelago.app.data.ServerPreferences
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+
+/**
+ * VpnService hosting the embedded FIPS mesh node.
+ *
+ * Split tunnel: only fd00::/8 (the FIPS ULA space) routes into the TUN, so
+ * normal phone traffic is untouched — this is mesh reachability, not a
+ * default-route VPN. The established fd is detached and handed to the Rust
+ * node (Node::start_with_tun_fd); the node owns it until stop.
+ */
+class ArchyVpnService : VpnService() {
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private var warmerJob: Job? = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_STOP) {
+            shutdown()
+            return START_NOT_STICKY
+        }
+        startForeground(NOTIFICATION_ID, buildNotification())
+        scope.launch { startMesh() }
+        return START_STICKY
+    }
+
+    private suspend fun startMesh() {
+        if (!FipsNative.available) {
+            shutdown()
+            return
+        }
+        val prefs = FipsPreferences(this)
+        val identity = FipsManager.ensureIdentity(prefs)
+        val peersJson = prefs.combinedPeersJson()
+        if (identity == null || peersJson == "[]") {
+            Log.w(TAG, "mesh not configured — stopping")
+            shutdown()
+            return
+        }
+        // Party mode: fixed inbound UDP bind so a nearby phone can dial us
+        // directly over a shared LAN/hotspot (no internet required).
+        val listenPort = if (prefs.partyListen()) PartyQr.PARTY_UDP_PORT else 0
+
+        // A fresh app open re-triggers the service. Tearing a HEALTHY mesh
+        // down to rebuild it costs ~8s of anchor+session bring-up on every
+        // launch (observed live: stop 00:34:38 → session back 00:34:49) and
+        // is what made "freshly loading the app" slow. Keep a running node;
+        // restart only when it's dead or a pairing changed the peer set.
+        if (FipsNative.isRunning() && !FipsManager.peersDirty) {
+            Log.i(TAG, "mesh already running — keeping warm sessions")
+            startSessionWarmer()
+            return
+        }
+        FipsManager.peersDirty = false
+        // Re-establishing while running would strand the old fd; restart clean.
+        if (FipsNative.isRunning()) FipsNative.stop()
+
+        val pfd = try {
+            Builder()
+                .setSession("Archipelago Mesh")
+                .setMtu(1280)
+                .addAddress(identity.address, 128)
+                .addRoute("fd00::", 8)
+                // The TUN is IPv6-only. Android blocks every address family
+                // the VPN has no address for — without this, bringing the
+                // mesh up cut ALL of the phone's IPv4 internet.
+                .allowFamily(android.system.OsConstants.AF_INET)
+                // And let apps that bind their own network skip the TUN
+                // entirely — this is mesh reachability, not a privacy VPN.
+                .allowBypass()
+                .apply {
+                    // Android 10+ treats VPN networks as METERED by default,
+                    // which flips the whole phone into data-saver behaviour
+                    // (background sync off, "metered" warnings) while the
+                    // mesh is up. It inherits the underlying network's real
+                    // metered state instead.
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) setMetered(false)
+                }
+                .establish()
+        } catch (e: Exception) {
+            Log.e(TAG, "VPN establish failed", e)
+            null
+        }
+        if (pfd == null) {
+            shutdown()
+            return
+        }
+
+        val fd = pfd.detachFd()
+        val result = FipsNative.start(identity.secret, peersJson, fd, listenPort)
+        Log.i(TAG, "mesh start: $result (listen=$listenPort)")
+        if (result.contains("\"error\"")) {
+            shutdown()
+        } else {
+            startSessionWarmer()
+            // Phone-to-phone chat/beam + the phone's own mesh-served page.
+            FlareServer.start(this, identity.address, identity.npub, prefs.partyName())
+            // Mutual pairing: when a phone that scanned OUR QR announces
+            // itself, store it as a party peer and re-run the mesh config so
+            // this side gets the peer + chat entry without scanning back.
+            FlareServer.onHello = { peer ->
+                scope.launch {
+                    prefs.upsertPartyPeer(peer)
+                    FipsManager.requestMeshRestart(this@ArchyVpnService)
+                }
+            }
+        }
+    }
+
+    /**
+     * Pre-warm + keep-warm mesh sessions to every known node ULA.
+     *
+     * Discovery + first session through the public tree can take 15s+
+     * (HANDOFF-2026-07-23 node diagnosis) — paying that cost here, the
+     * moment the tunnel is up, means the connect probe and WebView hit an
+     * established session instead of timing out on a cold one. The periodic
+     * touch afterwards keeps the session from idling out. Failed connects
+     * are expected and cheap; the attempt itself is what drives discovery.
+     */
+    private fun startSessionWarmer() {
+        warmerJob?.cancel()
+        warmerJob = scope.launch {
+            val prefs = ServerPreferences(this@ArchyVpnService)
+            val fipsPrefs = FipsPreferences(this@ArchyVpnService)
+            var round = 0
+            while (isActive && FipsNative.isRunning()) {
+                val targets = try {
+                    prefs.savedServers.first()
+                        .mapNotNull { it.meshIp.ifBlank { null } }
+                        .map { it to 80 } +
+                        // Party phones answer on the flare port, not :80.
+                        fipsPrefs.partyPeers().map { it.ula to PartyQr.FLARE_PORT }
+                } catch (_: Exception) {
+                    emptyList()
+                }.distinct()
+                for ((ula, port) in targets) {
+                    try {
+                        java.net.Socket().use { s ->
+                            s.connect(
+                                java.net.InetSocketAddress(java.net.InetAddress.getByName(ula), port),
+                                20_000,
+                            )
+                        }
+                    } catch (_: Exception) {
+                        // Cold path / node away — the connect attempt still
+                        // drove session establishment; try again next round.
+                    }
+                }
+                round++
+                // Aggressive for the first ~minute (session bring-up), then a
+                // slow keep-warm tick that costs nearly nothing.
+                delay(if (round < 12) 5_000 else 60_000)
+            }
+        }
+    }
+
+    private fun shutdown() {
+        warmerJob?.cancel()
+        FlareServer.stop()
+        FipsNative.stop()
+        stopForeground(STOP_FOREGROUND_REMOVE)
+        stopSelf()
+    }
+
+    override fun onDestroy() {
+        FipsNative.stop()
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    override fun onRevoke() {
+        // User pulled VPN permission from system settings.
+        shutdown()
+    }
+
+    private fun buildNotification(): Notification {
+        val manager = getSystemService(NotificationManager::class.java)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            manager.createNotificationChannel(
+                NotificationChannel(
+                    CHANNEL_ID,
+                    "Mesh connection",
+                    NotificationManager.IMPORTANCE_MIN,
+                ).apply { description = "Keeps the node reachable from anywhere" }
+            )
+        }
+        val tapIntent = PendingIntent.getActivity(
+            this,
+            0,
+            Intent(this, MainActivity::class.java),
+            PendingIntent.FLAG_IMMUTABLE,
+        )
+        return Notification.Builder(this, CHANNEL_ID)
+            .setContentTitle("Connected to your Archipelago")
+            .setContentText("Secure mesh link active")
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentIntent(tapIntent)
+            .setOngoing(true)
+            .build()
+    }
+
+    companion object {
+        const val ACTION_STOP = "com.archipelago.app.fips.STOP"
+        private const val CHANNEL_ID = "archy_mesh"
+        private const val NOTIFICATION_ID = 4841
+        private const val TAG = "ArchyVpnService"
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsManager.kt

@@ -0,0 +1,95 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import android.content.Intent
+import android.net.VpnService
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+
+/**
+ * Glue between pairing and the mesh: persists the node peer from a scanned
+ * QR and asks the UI to bring the tunnel up. There is deliberately no
+ * settings surface — scanning a node's QR is the entire configuration.
+ *
+ * The one unavoidable interaction is Android's VPN consent dialog
+ * (VpnService.prepare), which only an Activity can launch; [consentNeeded]
+ * signals AppNavHost to run it, once, on first pairing.
+ */
+object FipsManager {
+
+    /** Set when a pairing registered mesh info and the VPN needs starting. */
+    private val _consentNeeded = MutableStateFlow(false)
+    val consentNeeded: StateFlow<Boolean> = _consentNeeded
+
+    /** True after a pairing changed the peer set while the node was running —
+     *  tells the service a restart is genuinely needed (the ONLY case; a
+     *  routine app open must keep the warm mesh, not rebuild it). */
+    @Volatile
+    var peersDirty: Boolean = false
+
+    fun consentHandled() {
+        _consentNeeded.value = false
+    }
+
+    /**
+     * Persist mesh info from a pairing scan and request tunnel start.
+     * No-op on devices without the native lib (non-arm64).
+     */
+    suspend fun registerNode(context: Context, info: FipsPairInfo?, alias: String) {
+        if (info == null || !FipsNative.available) return
+        val prefs = FipsPreferences(context)
+        ensureIdentity(prefs)
+        prefs.upsertNodePeer(info, alias)
+        peersDirty = true
+        _consentNeeded.value = true
+    }
+
+    /** Generate-once mesh identity. Returns null only if the RNG/native fails. */
+    suspend fun ensureIdentity(prefs: FipsPreferences): FipsNative.Identity? {
+        prefs.identity()?.let { return it }
+        val generated = FipsNative.parseIdentity(FipsNative.generateIdentity()) ?: return null
+        prefs.saveIdentity(generated)
+        return generated
+    }
+
+    /**
+     * Start the mesh service if this device is paired and the user has already
+     * consented to the VPN (prepare() == null). Called on app start so the
+     * tunnel comes back without any interaction; first-time consent goes
+     * through AppNavHost instead.
+     */
+    suspend fun autoStartIfReady(context: Context) {
+        if (!FipsNative.available) return
+        val prefs = FipsPreferences(context)
+        if (prefs.identity() == null || !prefs.hasPeers()) return
+        if (VpnService.prepare(context) != null) return // consent missing — don't prompt here
+        startService(context)
+    }
+
+    fun startService(context: Context) {
+        val intent = Intent(context, ArchyVpnService::class.java)
+        context.startForegroundService(intent)
+    }
+
+    /**
+     * Re-run the mesh with current prefs (party listen toggled, peer added).
+     * Marks the peer set dirty so startMesh genuinely restarts the node —
+     * otherwise the keep-warm fast path would skip the new config.
+     * First-timers go through the consent flow.
+     */
+    fun requestMeshRestart(context: Context) {
+        if (!FipsNative.available) return
+        peersDirty = true
+        if (VpnService.prepare(context) == null) {
+            startService(context)
+        } else {
+            _consentNeeded.value = true
+        }
+    }
+
+    fun stopService(context: Context) {
+        val intent = Intent(context, ArchyVpnService::class.java)
+            .setAction(ArchyVpnService.ACTION_STOP)
+        context.startService(intent)
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsNative.kt

@@ -0,0 +1,49 @@
+package com.archipelago.app.fips
+
+import org.json.JSONObject
+
+/**
+ * JNI binding to the embedded FIPS mesh node (Android/rust/archy-fips-core,
+ * built into libarchy_fips_core.so by the buildRustArm64 gradle task).
+ *
+ * All calls return JSON strings; failures come back as {"error": "…"} rather
+ * than exceptions. [available] is false on ABIs the .so isn't built for
+ * (anything but arm64) — every caller must gate on it so the app still runs
+ * as a plain companion there.
+ */
+object FipsNative {
+    val available: Boolean = try {
+        System.loadLibrary("archy_fips_core")
+        true
+    } catch (_: Throwable) {
+        false
+    }
+
+    external fun generateIdentity(): String
+    external fun deriveIdentity(secret: String): String
+
+    /**
+     * [listenPort] 0 = outbound-only (default posture). Non-zero binds UDP on
+     * that port so a nearby phone can dial us directly (party mode); the node
+     * stays leaf-only either way.
+     */
+    external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String
+    external fun stop()
+    external fun isRunning(): Boolean
+    external fun statusJson(): String
+
+    data class Identity(val secret: String, val npub: String, val address: String)
+
+    /** Parse an identity JSON reply; null on {"error": …} or malformed. */
+    fun parseIdentity(json: String): Identity? = try {
+        val obj = JSONObject(json)
+        if (obj.has("error")) null
+        else Identity(
+            secret = obj.getString("secret"),
+            npub = obj.getString("npub"),
+            address = obj.getString("address"),
+        )
+    } catch (_: Exception) {
+        null
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/FipsPairInfo.kt

@@ -0,0 +1,29 @@
+package com.archipelago.app.fips
+
+/**
+ * Node mesh parameters carried by the pairing QR (fnpub/fip/fhost/fudp/ftcp —
+ * docs/companion-pairing-qr.md). The phone's embedded FIPS node dials
+ * host:udpPort / host:tcpPort claiming nothing; the mesh accepts inbound peers
+ * without registration, so possession of these params is all pairing takes.
+ */
+data class FipsPairInfo(
+    val npub: String,
+    /** Node's fips0 ULA — where its UI stays reachable once meshed. May be empty. */
+    val ula: String,
+    val host: String,
+    val udpPort: Int,
+    val tcpPort: Int,
+    /**
+     * Public rendezvous anchors (the node's seed-anchor list). The phone
+     * peers with these too, so it can route to the node via the mesh when
+     * the node's LAN endpoint isn't directly dialable.
+     */
+    val anchors: List<AnchorPeer> = emptyList(),
+)
+
+/** One rendezvous anchor from the QR's `fanchors` param (npub@addr/transport). */
+data class AnchorPeer(
+    val npub: String,
+    val addr: String,
+    val transport: String,
+)

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -0,0 +1,341 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import org.json.JSONArray
+import org.json.JSONObject
+import androidx.datastore.preferences.preferencesDataStore
+
+private val Context.fipsDataStore: DataStore<Preferences> by preferencesDataStore(name = "fips_prefs")
+
+// Archipelago-operated public anchor (vps2). Baked in so EVERY pairing yields
+// both paths — direct LAN p2p to the node AND a public rendezvous for
+// away-from-home — even when the scanned node is old enough that its QR
+// carries no fanchors. Keep in lockstep with
+// core/archipelago/src/fips/anchors.rs (ARCHY_ANCHOR_*).
+internal const val ARCHY_ANCHOR_NPUB =
+    "npub1dptaktwxv0mm245g2lqjykwm5ll0jpc6m3r4242ydfa9z7qe6urs3jvrak"
+internal const val ARCHY_ANCHOR_ADDR = "146.59.87.168:8444"
+internal const val ARCHY_ANCHOR_TRANSPORT = "tcp"
+
+/**
+ * Public FIPS network anchors (join.fips.network — the dual-transport TCP
+ * pair; keep in lockstep with core/archipelago/src/fips/anchors.rs
+ * fips_network_anchors()). Baked into every pairing at trailing priority so
+ * a degraded/unreachable vps2 anchor can never strand the phone: the mesh
+ * still joins the public tree and routes to the node through it.
+ */
+internal val PUBLIC_FIPS_ANCHORS = listOf(
+    Triple(
+        "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u",
+        "23.182.128.74:443",
+        "tcp",
+    ),
+    Triple(
+        "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98",
+        "217.77.8.91:443",
+        "tcp",
+    ),
+)
+
+/**
+ * Mesh identity + known node peers. Follows the same plaintext-DataStore
+ * storage model as ServerPreferences (the server password lives there the
+ * same way); the mesh secret only grants mesh membership, not node login.
+ */
+class FipsPreferences(private val context: Context) {
+
+    private val secretKey = stringPreferencesKey("fips_secret")
+    private val npubKey = stringPreferencesKey("fips_npub")
+    private val addressKey = stringPreferencesKey("fips_address")
+    /** JSON array of node peers in fips PeerConfig shape (see NodePeer). */
+    private val peersKey = stringPreferencesKey("fips_node_peers")
+    /** JSON array of phone party peers (PartyPeer shape, NOT PeerConfig). */
+    private val partyPeersKey = stringPreferencesKey("fips_party_peers")
+    /** Party mode: accept a direct inbound mesh link (UDP 2121). */
+    private val partyListenKey = booleanPreferencesKey("fips_party_listen")
+    /** Name shown in this phone's party QR and outgoing flares. */
+    private val partyNameKey = stringPreferencesKey("fips_party_name")
+
+    suspend fun identity(): FipsNative.Identity? {
+        val prefs = context.fipsDataStore.data.first()
+        val secret = prefs[secretKey] ?: return null
+        return FipsNative.Identity(
+            secret = secret,
+            npub = prefs[npubKey] ?: "",
+            address = prefs[addressKey] ?: "",
+        )
+    }
+
+    suspend fun saveIdentity(identity: FipsNative.Identity) {
+        context.fipsDataStore.edit { prefs ->
+            prefs[secretKey] = identity.secret
+            prefs[npubKey] = identity.npub
+            prefs[addressKey] = identity.address
+        }
+    }
+
+    suspend fun peersJson(): String {
+        val prefs = context.fipsDataStore.data.first()
+        return prefs[peersKey] ?: "[]"
+    }
+
+    suspend fun hasPeers(): Boolean = JSONArray(peersJson()).length() > 0
+
+    // ── Mesh Party (phone↔phone) ────────────────────────────────────────────
+
+    suspend fun partyListen(): Boolean =
+        context.fipsDataStore.data.first()[partyListenKey] ?: false
+
+    val partyListenFlow: Flow<Boolean>
+        get() = context.fipsDataStore.data.map { it[partyListenKey] ?: false }
+
+    suspend fun setPartyListen(enabled: Boolean) {
+        context.fipsDataStore.edit { it[partyListenKey] = enabled }
+    }
+
+    suspend fun partyName(): String =
+        context.fipsDataStore.data.first()[partyNameKey]
+            ?: android.os.Build.MODEL.orEmpty().ifBlank { "Phone" }
+
+    suspend fun setPartyName(name: String) {
+        context.fipsDataStore.edit { it[partyNameKey] = name.trim() }
+    }
+
+    val partyPeersFlow: Flow<List<PartyPeer>>
+        get() = context.fipsDataStore.data.map { parsePartyPeers(it[partyPeersKey] ?: "[]") }
+
+    suspend fun partyPeers(): List<PartyPeer> =
+        parsePartyPeers(context.fipsDataStore.data.first()[partyPeersKey] ?: "[]")
+
+    /** Matched by npub, so re-scanning updates the direct-dial address in place. */
+    suspend fun upsertPartyPeer(peer: PartyPeer) {
+        context.fipsDataStore.edit { prefs ->
+            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != peer.npub }
+            prefs[partyPeersKey] = toJson(kept + peer)
+        }
+    }
+
+    suspend fun removePartyPeer(npub: String) {
+        context.fipsDataStore.edit { prefs ->
+            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != npub }
+            prefs[partyPeersKey] = toJson(kept)
+        }
+    }
+
+    /**
+     * Node peers + direct-dial party peers, in the fips PeerConfig JSON the
+     * Rust node deserializes. Party peers get the best priority: on a shared
+     * LAN/hotspot the direct link beats every anchor path, and while off-LAN
+     * the failed dial is cheap (auto-reconnect keeps retrying, which is
+     * exactly what makes the link snap up the moment both phones share WiFi).
+     * Party peers without an underlay address are mesh-routed and need no
+     * entry here at all.
+     */
+    suspend fun combinedPeersJson(): String {
+        val merged = JSONArray(peersJson())
+        val party = partyPeers()
+        for (peer in party) {
+            if (peer.ip.isBlank() || peer.port <= 0) continue
+            merged.put(JSONObject().apply {
+                put("npub", peer.npub)
+                put("alias", hostSafeAlias(peer.name.ifBlank { "party-phone" }))
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", "udp")
+                    put("addr", "${peer.ip}:${peer.port}")
+                    put("priority", 5)
+                }))
+            })
+        }
+        // A party-only phone (never paired with a node) still needs a public
+        // rendezvous to reach its peers ACROSS the internet — without it, two
+        // bare phones would be hotspot/LAN-only. Node pairing normally bakes
+        // this anchor in; do the same when there are party peers.
+        if (party.isNotEmpty() &&
+            (0 until merged.length()).none {
+                merged.optJSONObject(it)?.optString("npub") == ARCHY_ANCHOR_NPUB
+            }
+        ) {
+            merged.put(JSONObject().apply {
+                put("npub", ARCHY_ANCHOR_NPUB)
+                put("alias", "archipelago-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", ARCHY_ANCHOR_TRANSPORT)
+                    put("addr", ARCHY_ANCHOR_ADDR)
+                    put("priority", 40)
+                }))
+            })
+        }
+        // Backfill anchor peers for entries paired before newer QR/app
+        // releases added them. `upsertNodePeer` persists these on re-scan, but
+        // startup must also self-heal old DataStore state so updating the APK is
+        // enough to get off-LAN redundancy.
+        if (merged.length() > 0) {
+            addAnchorIfMissing(merged, ARCHY_ANCHOR_NPUB, "archipelago-anchor", ARCHY_ANCHOR_ADDR, ARCHY_ANCHOR_TRANSPORT, 40)
+            for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+                val (npub, addr, transport) = anchor
+                addAnchorIfMissing(merged, npub, "fips-network-anchor-${i + 1}", addr, transport, 50 + i * 10)
+            }
+        }
+        return merged.toString()
+    }
+
+    private fun addAnchorIfMissing(
+        peers: JSONArray,
+        npub: String,
+        alias: String,
+        addr: String,
+        transport: String,
+        priority: Int,
+    ) {
+        if ((0 until peers.length()).any { peers.optJSONObject(it)?.optString("npub") == npub }) return
+        peers.put(JSONObject().apply {
+            put("npub", npub)
+            put("alias", alias)
+            put("addresses", JSONArray().put(JSONObject().apply {
+                put("transport", transport)
+                put("addr", addr)
+                put("priority", priority)
+            }))
+        })
+    }
+
+    private fun parsePartyPeers(json: String): List<PartyPeer> = try {
+        val arr = JSONArray(json)
+        (0 until arr.length()).mapNotNull { i ->
+            val o = arr.optJSONObject(i) ?: return@mapNotNull null
+            val npub = o.optString("npub")
+            val ula = o.optString("ula")
+            if (npub.isBlank() || ula.isBlank()) return@mapNotNull null
+            PartyPeer(
+                npub = npub,
+                ula = ula,
+                name = o.optString("name").ifBlank { "Phone" },
+                ip = o.optString("ip"),
+                port = o.optInt("port"),
+            )
+        }
+    } catch (_: Exception) {
+        emptyList()
+    }
+
+    private fun toJson(peers: List<PartyPeer>): String {
+        val arr = JSONArray()
+        for (p in peers) {
+            arr.put(JSONObject().apply {
+                put("npub", p.npub)
+                put("ula", p.ula)
+                put("name", p.name)
+                put("ip", p.ip)
+                put("port", p.port)
+            })
+        }
+        return arr.toString()
+    }
+
+    /**
+     * Add or update the node peer plus its rendezvous anchors (each matched
+     * by npub, so re-pairing updates addresses instead of duplicating).
+     * Stored directly in the fips PeerConfig JSON shape the Rust side
+     * deserializes. The node's direct addresses get the best priorities;
+     * anchors trail so the mesh prefers the direct path when it works.
+     */
+    suspend fun upsertNodePeer(info: FipsPairInfo, alias: String) {
+        val incoming = mutableListOf<JSONObject>()
+        incoming += JSONObject().apply {
+            put("npub", info.npub)
+            put("alias", hostSafeAlias(alias.ifBlank { "Archipelago" }))
+            val addresses = JSONArray()
+            // .fips hosts are unresolvable on Android (no system .fips DNS):
+            // storing one gives the mesh a dial target that fails every
+            // handshake and stalls first connect on anchor discovery.
+            if (info.udpPort > 0 && !info.host.endsWith(".fips")) {
+                addresses.put(JSONObject().apply {
+                    put("transport", "udp")
+                    put("addr", "${info.host}:${info.udpPort}")
+                    put("priority", 10)
+                })
+            }
+            if (info.tcpPort > 0 && !info.host.endsWith(".fips")) {
+                addresses.put(JSONObject().apply {
+                    put("transport", "tcp")
+                    put("addr", "${info.host}:${info.tcpPort}")
+                    put("priority", 20)
+                })
+            }
+            put("addresses", addresses)
+        }
+        for (anchor in info.anchors) {
+            if (anchor.npub == info.npub) continue
+            if (anchor.addr.substringBeforeLast(":").endsWith(".fips")) continue
+            incoming += JSONObject().apply {
+                put("npub", anchor.npub)
+                put("alias", "mesh-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", anchor.transport)
+                    put("addr", anchor.addr)
+                    put("priority", 30)
+                }))
+            }
+        }
+        // Guarantee the public anchor: without it, a QR from an older node
+        // leaves the phone LAN-only and pairing/connecting dies off-LAN.
+        if (info.npub != ARCHY_ANCHOR_NPUB &&
+            incoming.none { it.optString("npub") == ARCHY_ANCHOR_NPUB }
+        ) {
+            incoming += JSONObject().apply {
+                put("npub", ARCHY_ANCHOR_NPUB)
+                put("alias", "archipelago-anchor")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", ARCHY_ANCHOR_TRANSPORT)
+                    put("addr", ARCHY_ANCHOR_ADDR)
+                    put("priority", 40)
+                }))
+            }
+        }
+        // And the public FIPS network anchors at trailing priority, so one
+        // degraded rendezvous (vps2, 2026-07-24) can never strand the phone.
+        for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
+            val (npub, addr, transport) = anchor
+            if (info.npub == npub || incoming.any { it.optString("npub") == npub }) continue
+            incoming += JSONObject().apply {
+                put("npub", npub)
+                put("alias", "fips-network-anchor-${i + 1}")
+                put("addresses", JSONArray().put(JSONObject().apply {
+                    put("transport", transport)
+                    put("addr", addr)
+                    put("priority", 50 + i * 10)
+                }))
+            }
+        }
+        val incomingNpubs = incoming.map { it.optString("npub") }.toSet()
+        context.fipsDataStore.edit { prefs ->
+            val current = JSONArray(prefs[peersKey] ?: "[]")
+            val merged = JSONArray()
+            for (i in 0 until current.length()) {
+                val existing = current.optJSONObject(i) ?: continue
+                if (existing.optString("npub") !in incomingNpubs) merged.put(existing)
+            }
+            incoming.forEach { merged.put(it) }
+            prefs[peersKey] = merged.toString()
+        }
+    }
+}
+
+/**
+ * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
+ * that isn't a valid DNS label ("Framework PT" — the space) gets rejected and
+ * silently drops the peer from name resolution. Slug it instead of losing it.
+ */
+internal fun hostSafeAlias(alias: String): String =
+    alias.lowercase()
+        .replace(Regex("[^a-z0-9.-]+"), "-")
+        .trim('-', '.')
+        .ifBlank { "archipelago" }

Android/app/src/main/java/com/archipelago/app/fips/FlareServer.kt

@@ -0,0 +1,398 @@
+package com.archipelago.app.fips
+
+import android.content.Context
+import android.util.Log
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONObject
+import java.io.BufferedInputStream
+import java.io.File
+import java.io.InputStream
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.net.ServerSocket
+import java.net.Socket
+import java.util.UUID
+import java.util.concurrent.ExecutorService
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+
+/** One chat/photo message in a party conversation, keyed by the peer's npub. */
+data class FlareMessage(
+    val id: String,
+    val peerNpub: String,
+    val fromMe: Boolean,
+    val name: String,
+    val text: String = "",
+    val photoPath: String = "",
+    val ts: Long,
+    val status: Status = Status.RECEIVED,
+) {
+    enum class Status { SENDING, SENT, FAILED, RECEIVED }
+}
+
+/** In-memory conversation store (demo scope — nothing persists across restarts). */
+object FlareStore {
+    private val _messages = MutableStateFlow<List<FlareMessage>>(emptyList())
+    val messages: StateFlow<List<FlareMessage>> = _messages
+
+    fun add(message: FlareMessage) {
+        _messages.value = _messages.value + message
+    }
+
+    fun setStatus(id: String, status: FlareMessage.Status) {
+        _messages.value = _messages.value.map { if (it.id == id) it.copy(status = status) else it }
+    }
+}
+
+/**
+ * Minimal HTTP listener bound ONLY on this phone's mesh ULA — plain HTTP is
+ * fine there because FIPS is the encryption + peer-identity layer (same
+ * stance as the node's ULA-only peer listener). This is what makes the phone
+ * a *server* on the mesh: another phone (or `curl -6` from any mesh node)
+ * reaches it by npub-derived address with no port forwarding, DNS, or CA.
+ *
+ * FIPS authenticates the node, not the request (project doctrine), so inputs
+ * are still validated at this boundary: size caps, JSON shape, no
+ * client-controlled paths.
+ */
+object FlareServer {
+    private const val TAG = "FlareServer"
+    private const val MAX_PHOTO_BYTES = 8 * 1024 * 1024
+    private const val MAX_TEXT_CHARS = 4_000
+    private const val MAX_HEADER_BYTES = 16 * 1024
+
+    private var socket: ServerSocket? = null
+    private var pool: ExecutorService? = null
+    @Volatile private var identityName = "Phone"
+    @Volatile private var identityNpub = ""
+    @Volatile private var photoDir: File? = null
+
+    /** Invoked when a peer announces itself (POST /hello) — pairing used to
+     *  be one-way: only the SCANNING phone learned the other side, so the
+     *  scanned phone had no peer, no chat entry, no way in. The VPN service
+     *  wires this to upsert the peer + restart the mesh config. */
+    @Volatile var onHello: ((PartyPeer) -> Unit)? = null
+
+    @Synchronized
+    fun start(context: Context, ula: String, myNpub: String, myName: String) {
+        stop()
+        identityNpub = myNpub
+        identityName = myName
+        photoDir = File(context.cacheDir, "flare").apply { mkdirs() }
+        val pool = Executors.newCachedThreadPool().also { this.pool = it }
+        pool.execute {
+            try {
+                val server = ServerSocket().apply {
+                    reuseAddress = true
+                    bind(InetSocketAddress(InetAddress.getByName(ula), PartyQr.FLARE_PORT))
+                }
+                socket = server
+                Log.i(TAG, "flare listening on [$ula]:${PartyQr.FLARE_PORT}")
+                while (!server.isClosed) {
+                    val client = try {
+                        server.accept()
+                    } catch (_: Exception) {
+                        break
+                    }
+                    pool.execute { handle(client) }
+                }
+            } catch (e: Exception) {
+                Log.e(TAG, "flare server died: $e")
+            }
+        }
+    }
+
+    @Synchronized
+    fun stop() {
+        try {
+            socket?.close()
+        } catch (_: Exception) {
+        }
+        socket = null
+        pool?.shutdownNow()
+        pool = null
+    }
+
+    private fun handle(client: Socket) {
+        client.use { sock ->
+            sock.soTimeout = 30_000
+            try {
+                val input = BufferedInputStream(sock.getInputStream())
+                val requestLine = readLine(input) ?: return
+                val parts = requestLine.trim().split(" ")
+                if (parts.size < 2) return respond(sock, 400, json("bad_request"))
+                val (method, path) = parts[0] to parts[1]
+
+                var contentLength = 0
+                var from = ""
+                var fromName = ""
+                var headerBytes = requestLine.length
+                while (true) {
+                    val line = readLine(input) ?: return
+                    if (line.isEmpty()) break
+                    headerBytes += line.length
+                    if (headerBytes > MAX_HEADER_BYTES) return respond(sock, 431, json("headers_too_large"))
+                    val idx = line.indexOf(':')
+                    if (idx <= 0) continue
+                    val key = line.substring(0, idx).trim().lowercase()
+                    val value = line.substring(idx + 1).trim()
+                    when (key) {
+                        "content-length" -> contentLength = value.toIntOrNull() ?: 0
+                        "x-from" -> from = value.take(80)
+                        "x-name" -> fromName = value.take(80)
+                    }
+                }
+
+                when {
+                    method == "GET" && (path == "/" || path.startsWith("/?")) ->
+                        respondHtml(sock, profilePage())
+                    method == "POST" && path == "/hello" -> {
+                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receiveHello(String(body, Charsets.UTF_8))
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    method == "POST" && path == "/flare" -> {
+                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receiveFlare(String(body, Charsets.UTF_8))
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    method == "POST" && path == "/photo" -> {
+                        if (contentLength !in 1..MAX_PHOTO_BYTES) return respond(sock, 413, json("too_large"))
+                        if (!from.startsWith("npub1")) return respond(sock, 400, json("bad_request"))
+                        val body = readExactly(input, contentLength) ?: return
+                        receivePhoto(from, fromName, body)
+                        respond(sock, 200, """{"ok":true}""")
+                    }
+                    else -> respond(sock, 404, json("not_found"))
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "request failed: $e")
+            }
+        }
+    }
+
+    /** A peer that scanned OUR QR announces itself — mutual pairing. */
+    private fun receiveHello(body: String) {
+        val o = try {
+            JSONObject(body)
+        } catch (_: Exception) {
+            return
+        }
+        val from = o.optString("from")
+        val ula = o.optString("ula")
+        if (!from.startsWith("npub1") || !ula.startsWith("fd")) return
+        if (from == identityNpub) return
+        val peer = PartyPeer(
+            npub = from.take(80),
+            ula = ula.take(64),
+            name = o.optString("name").take(24).ifBlank { "Phone" },
+            ip = o.optString("ip").take(40),
+            port = o.optInt("port", 0),
+        )
+        onHello?.invoke(peer)
+        // Seed the conversation so the chat has a visible entry on this side.
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = peer.npub,
+                fromMe = false,
+                name = peer.name,
+                text = "👋 ${peer.name} joined the party",
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun receiveFlare(body: String) {
+        val o = try {
+            JSONObject(body)
+        } catch (_: Exception) {
+            return
+        }
+        val from = o.optString("from")
+        if (!from.startsWith("npub1")) return
+        val text = o.optString("text").take(MAX_TEXT_CHARS)
+        if (text.isBlank()) return
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = from,
+                fromMe = false,
+                name = o.optString("name").take(80).ifBlank { "Phone" },
+                text = text,
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun receivePhoto(from: String, fromName: String, bytes: ByteArray) {
+        // Server-generated filename — the sender never controls the path.
+        val dir = photoDir ?: return
+        val file = File(dir, "${UUID.randomUUID()}.jpg")
+        file.writeBytes(bytes)
+        FlareStore.add(
+            FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = from,
+                fromMe = false,
+                name = fromName.ifBlank { "Phone" },
+                photoPath = file.absolutePath,
+                ts = System.currentTimeMillis(),
+            )
+        )
+    }
+
+    private fun profilePage(): String {
+        val npub = identityNpub
+        val name = identityName
+        return """
+            <!doctype html><html><head><meta charset="utf-8">
+            <meta name="viewport" content="width=device-width,initial-scale=1">
+            <title>$name — on the mesh</title>
+            <style>
+              body{background:#0a0a0a;color:#eee;font-family:monospace;
+                   display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
+              .card{border:1px solid rgba(255,255,255,.12);border-radius:20px;padding:32px;
+                    max-width:560px;background:rgba(255,255,255,.04)}
+              h1{color:#f7931a;margin:0 0 8px;font-size:22px}
+              .npub{word-break:break-all;color:#888;font-size:12px;margin:12px 0}
+              p{line-height:1.5}
+            </style></head><body><div class="card">
+            <h1>⚡ $name</h1>
+            <div class="npub">$npub</div>
+            <p>This page is being served <b>by a phone</b>, addressed by its
+            cryptographic identity over the FIPS mesh.</p>
+            <p>No port forwarding. No DNS. No certificate authority. No cloud.
+            The key <i>is</i> the address — and the transport underneath can be
+            5G, WiFi, or a hotspot with no internet at all.</p>
+            </div></body></html>
+        """.trimIndent()
+    }
+
+    // ── tiny HTTP plumbing ──────────────────────────────────────────────────
+
+    /** Read one CRLF-terminated header line as ISO-8859-1; null on EOF. */
+    private fun readLine(input: InputStream): String? {
+        val sb = StringBuilder()
+        while (true) {
+            val b = input.read()
+            if (b == -1) return if (sb.isEmpty()) null else sb.toString()
+            if (b == '\n'.code) return sb.toString().trimEnd('\r')
+            sb.append(b.toChar())
+            if (sb.length > MAX_HEADER_BYTES) return null
+        }
+    }
+
+    private fun readExactly(input: InputStream, length: Int): ByteArray? {
+        val buf = ByteArray(length)
+        var off = 0
+        while (off < length) {
+            val n = input.read(buf, off, length - off)
+            if (n == -1) return null
+            off += n
+        }
+        return buf
+    }
+
+    private fun json(code: String) = """{"error":{"code":"$code","message":"request rejected"}}"""
+
+    private fun respond(sock: Socket, status: Int, body: String) =
+        writeResponse(sock, status, "application/json", body.toByteArray(Charsets.UTF_8))
+
+    private fun respondHtml(sock: Socket, body: String) =
+        writeResponse(sock, 200, "text/html; charset=utf-8", body.toByteArray(Charsets.UTF_8))
+
+    private fun writeResponse(sock: Socket, status: Int, contentType: String, body: ByteArray) {
+        val reason = when (status) {
+            200 -> "OK"; 400 -> "Bad Request"; 404 -> "Not Found"
+            413 -> "Payload Too Large"; 431 -> "Headers Too Large"
+            else -> "Error"
+        }
+        val head = "HTTP/1.1 $status $reason\r\n" +
+            "Content-Type: $contentType\r\n" +
+            "Content-Length: ${body.size}\r\n" +
+            "Connection: close\r\n\r\n"
+        sock.getOutputStream().apply {
+            write(head.toByteArray(Charsets.ISO_8859_1))
+            write(body)
+            flush()
+        }
+    }
+}
+
+/** Outbound flares: plain HTTP to the peer's ULA — FIPS encrypts underneath. */
+object FlareClient {
+    // Connect timeout must outlive cold mesh-session establishment (~15s via
+    // the public tree per HANDOFF-2026-07-23); the attempt itself drives
+    // session setup, same trick as the VPN service's session warmer.
+    private val http = OkHttpClient.Builder()
+        .connectTimeout(25, TimeUnit.SECONDS)
+        .readTimeout(15, TimeUnit.SECONDS)
+        .writeTimeout(60, TimeUnit.SECONDS)
+        .build()
+
+    private fun base(peer: PartyPeer) = "http://[${peer.ula}]:${PartyQr.FLARE_PORT}"
+
+    /** Announce myself to a freshly scanned peer so pairing becomes MUTUAL —
+     *  their phone gets me as a peer + a chat entry without scanning back.
+     *  Blocking — call from Dispatchers.IO. */
+    fun sendHello(
+        peer: PartyPeer,
+        myNpub: String,
+        myName: String,
+        myUla: String,
+        myIp: String?,
+        myPort: Int,
+    ): Boolean = try {
+        val body = JSONObject()
+            .put("from", myNpub)
+            .put("name", myName)
+            .put("ula", myUla)
+            .put("ip", myIp ?: "")
+            .put("port", if (myIp != null) myPort else 0)
+            .toString()
+            .toRequestBody("application/json".toMediaType())
+        http.newCall(
+            Request.Builder().url("${base(peer)}/hello").post(body).build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+
+    /** Blocking — call from Dispatchers.IO. */
+    fun sendText(peer: PartyPeer, myNpub: String, myName: String, text: String): Boolean = try {
+        val body = JSONObject()
+            .put("from", myNpub)
+            .put("name", myName)
+            .put("text", text)
+            .put("ts", System.currentTimeMillis())
+            .toString()
+            .toRequestBody("application/json".toMediaType())
+        http.newCall(
+            Request.Builder().url("${base(peer)}/flare").post(body).build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+
+    /** Blocking — call from Dispatchers.IO. */
+    fun sendPhoto(peer: PartyPeer, myNpub: String, myName: String, jpeg: ByteArray): Boolean = try {
+        http.newCall(
+            Request.Builder()
+                .url("${base(peer)}/photo")
+                .header("X-From", myNpub)
+                .header("X-Name", myName)
+                .post(jpeg.toRequestBody("image/jpeg".toMediaType()))
+                .build()
+        ).execute().use { it.isSuccessful }
+    } catch (_: Exception) {
+        false
+    }
+}

Android/app/src/main/java/com/archipelago/app/fips/PartyQr.kt

@@ -0,0 +1,102 @@
+package com.archipelago.app.fips
+
+import android.net.Uri
+import java.net.Inet4Address
+import java.net.NetworkInterface
+
+/**
+ * Phone↔phone mesh pairing ("Mesh Party") QR contract:
+ *
+ *   archipelago://party?v=1&npub=<npub>&ula=<fd..>&name=<name>[&ip=<v4>&port=<udp>]
+ *
+ * npub + ula alone are enough to chat *through* the mesh (anchors route by
+ * node address, no underlay info needed). ip/port are present only while the
+ * showing phone has its inbound UDP listener up (party mode) — the scanner
+ * then also gets a direct-dial link that works on a shared LAN/hotspot with
+ * no internet at all. Same versioning stance as the node pairing QR
+ * (docs/companion-pairing-qr.md): unknown params tolerated under v=1.
+ */
+data class PartyPeer(
+    val npub: String,
+    val ula: String,
+    val name: String,
+    /** Direct-dial underlay endpoint; empty when the peer wasn't listening. */
+    val ip: String = "",
+    val port: Int = 0,
+)
+
+object PartyQr {
+    const val SCHEME_HOST = "party"
+    private const val SUPPORTED_MAJOR = 1
+
+    /** UDP port a party-mode phone listens on (matches the node's mesh port). */
+    const val PARTY_UDP_PORT = 2121
+
+    /** Application-layer chat/beam port, bound only on the mesh ULA. */
+    const val FLARE_PORT = 5680
+
+    fun build(npub: String, ula: String, name: String, ip: String?, port: Int): String {
+        val b = Uri.Builder()
+            .scheme("archipelago")
+            .authority(SCHEME_HOST)
+            .appendQueryParameter("v", "1")
+            .appendQueryParameter("npub", npub)
+            .appendQueryParameter("ula", ula)
+            .appendQueryParameter("name", name)
+        if (!ip.isNullOrBlank() && port > 0) {
+            b.appendQueryParameter("ip", ip)
+            b.appendQueryParameter("port", port.toString())
+        }
+        return b.build().toString()
+    }
+
+    /** Null when [raw] is not a valid party QR (foreign codes just keep scanning). */
+    fun parse(raw: String): PartyPeer? {
+        val uri = try {
+            Uri.parse(raw.trim())
+        } catch (_: Exception) {
+            return null
+        }
+        if (!"archipelago".equals(uri.scheme, ignoreCase = true)) return null
+        if (uri.isOpaque || !SCHEME_HOST.equals(uri.host, ignoreCase = true)) return null
+        val major = uri.getQueryParameter("v")?.takeWhile { it.isDigit() }?.toIntOrNull() ?: return null
+        if (major != SUPPORTED_MAJOR) return null
+
+        val npub = uri.getQueryParameter("npub")?.trim().orEmpty()
+        val ula = uri.getQueryParameter("ula")?.trim().orEmpty()
+        if (!npub.startsWith("npub1") || !ula.startsWith("fd")) return null
+        return PartyPeer(
+            npub = npub,
+            ula = ula,
+            name = uri.getQueryParameter("name")?.trim().orEmpty().ifBlank { "Phone" },
+            ip = uri.getQueryParameter("ip")?.trim().orEmpty(),
+            port = uri.getQueryParameter("port")?.toIntOrNull() ?: 0,
+        )
+    }
+
+    /**
+     * This phone's private IPv4 on WiFi or its own hotspot, for the QR's
+     * direct-dial hint. Hotspot interfaces (ap/swlan/softap) win over wlan so
+     * the hotspot-host phone advertises the address its guests can reach.
+     */
+    fun localWifiIpv4(): String? {
+        val candidates = mutableListOf<Pair<String, String>>() // ifname → addr
+        try {
+            for (nif in NetworkInterface.getNetworkInterfaces()) {
+                if (!nif.isUp || nif.isLoopback) continue
+                for (addr in nif.inetAddresses) {
+                    if (addr is Inet4Address && addr.isSiteLocalAddress) {
+                        candidates += nif.name to addr.hostAddress.orEmpty()
+                    }
+                }
+            }
+        } catch (_: Exception) {
+            return null
+        }
+        val hotspot = candidates.firstOrNull {
+            it.first.startsWith("ap") || it.first.startsWith("swlan") || it.first.startsWith("softap")
+        }
+        return (hotspot ?: candidates.firstOrNull { it.first.startsWith("wlan") } ?: candidates.firstOrNull())
+            ?.second
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/GamepadLayout.kt

@@ -38,7 +38,7 @@ import com.archipelago.app.ui.theme.neoRaised
 @Composable
 fun GamepadLayout(
     onKey: (String) -> Unit,
-    onTwoFingerHold: () -> Unit,
+    onThreeFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     val surface = Neo.surface()
@@ -54,9 +54,9 @@ fun GamepadLayout(
                     do {
                         val ev = awaitPointerEvent()
                         val a = ev.changes.filter { !it.changedToUp() }
-                        if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
-                        if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onTwoFingerHold() }
-                        if (a.size < 2) t = 0L
+                        if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
+                        if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onThreeFingerHold() }
+                        if (a.size < 3) t = 0L
                     } while (ev.changes.any { it.pressed })
                 }
             }

Android/app/src/main/java/com/archipelago/app/ui/components/GestureHintOverlay.kt

@@ -0,0 +1,147 @@
+package com.archipelago.app.ui.components
+
+import androidx.compose.animation.core.LinearEasing
+import androidx.compose.animation.core.RepeatMode
+import androidx.compose.animation.core.animateFloat
+import androidx.compose.animation.core.infiniteRepeatable
+import androidx.compose.animation.core.rememberInfiniteTransition
+import androidx.compose.animation.core.tween
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.offset
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.remember
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.draw.scale
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import com.archipelago.app.R
+import com.archipelago.app.ui.theme.BitcoinOrange
+import kotlinx.coroutines.delay
+
+/**
+ * First-launch teaching overlay for the three-finger hold gesture. Three
+ * fingertip dots pulse in a "press" rhythm with an expanding ring while a
+ * short caption explains what the gesture opens. Dismissed by tapping
+ * anywhere (or automatically after a few seconds) — shown once, ever.
+ */
+@Composable
+fun GestureHintOverlay(onDismiss: () -> Unit) {
+    // Auto-dismiss so a user who taps nothing is never stuck behind the scrim.
+    LaunchedEffect(Unit) {
+        delay(6500)
+        onDismiss()
+    }
+
+    val transition = rememberInfiniteTransition(label = "gesture-hint")
+    // Fingertips press down together…
+    val press by transition.animateFloat(
+        initialValue = 1f,
+        targetValue = 0.86f,
+        animationSpec = infiniteRepeatable(tween(650), RepeatMode.Reverse),
+        label = "press",
+    )
+    // …while a ring ripples outward on each press cycle.
+    val ripple by transition.animateFloat(
+        initialValue = 0f,
+        targetValue = 1f,
+        animationSpec = infiniteRepeatable(tween(1300, easing = LinearEasing)),
+        label = "ripple",
+    )
+
+    Box(
+        modifier = Modifier
+            .fillMaxSize()
+            .background(Color.Black.copy(alpha = 0.72f))
+            .clickable(
+                interactionSource = remember { MutableInteractionSource() },
+                indication = null,
+                onClick = onDismiss,
+            ),
+        contentAlignment = Alignment.Center,
+    ) {
+        Column(horizontalAlignment = Alignment.CenterHorizontally) {
+            // Hand: three fingertip dots in a natural arc + ripple ring.
+            Box(Modifier.size(160.dp), contentAlignment = Alignment.Center) {
+                Box(
+                    Modifier
+                        .size(150.dp)
+                        .scale(0.4f + ripple * 0.6f)
+                        .border(
+                            2.dp,
+                            BitcoinOrange.copy(alpha = (1f - ripple) * 0.8f),
+                            CircleShape,
+                        ),
+                )
+                FingerDot(x = (-44).dp, y = 14.dp, scale = press)
+                FingerDot(x = 0.dp, y = (-12).dp, scale = press)
+                FingerDot(x = 44.dp, y = 8.dp, scale = press)
+            }
+
+            Spacer(Modifier.height(28.dp))
+
+            Text(
+                text = stringResource(R.string.gesture_hint_title),
+                style = MaterialTheme.typography.headlineSmall,
+                fontWeight = FontWeight.Bold,
+                color = Color.White,
+                textAlign = TextAlign.Center,
+            )
+            Spacer(Modifier.height(10.dp))
+            Text(
+                text = stringResource(R.string.gesture_hint_body),
+                style = MaterialTheme.typography.bodyMedium,
+                color = Color.White.copy(alpha = 0.7f),
+                textAlign = TextAlign.Center,
+                modifier = Modifier.padding(horizontal = 48.dp),
+            )
+
+            Spacer(Modifier.height(32.dp))
+
+            Box(
+                modifier = Modifier
+                    .clip(RoundedCornerShape(12.dp))
+                    .background(Color.White.copy(alpha = 0.12f))
+                    .clickable(onClick = onDismiss)
+                    .padding(horizontal = 28.dp, vertical = 12.dp),
+            ) {
+                Text(
+                    text = stringResource(R.string.gesture_hint_got_it),
+                    style = MaterialTheme.typography.labelLarge,
+                    color = Color.White,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun FingerDot(x: androidx.compose.ui.unit.Dp, y: androidx.compose.ui.unit.Dp, scale: Float) {
+    Box(
+        Modifier
+            .offset(x = x, y = y)
+            .size(26.dp)
+            .scale(scale)
+            .background(Color.White.copy(alpha = 0.92f), CircleShape),
+    )
+}

Android/app/src/main/java/com/archipelago/app/ui/components/MeshLoadingScreen.kt

@@ -0,0 +1,77 @@
+package com.archipelago.app.ui.components
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.size
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.ui.screens.PixelArtLogo
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceBlack
+import com.archipelago.app.ui.theme.TextMuted
+
+/**
+ * The branded "F*CK IPs" full-screen loader — shown whenever the app is
+ * dialing the node over the mesh (relaunch race, post-scan first connect),
+ * instead of an anonymous spinner. The point of the brand: what's loading
+ * is a connection to a cryptographic identity, not an IP.
+ */
+@Composable
+fun MeshLoadingScreen(message: String = "Dialing your node by its key — no IPs harmed") {
+    Box(
+        Modifier
+            .fillMaxSize()
+            .background(SurfaceBlack),
+        contentAlignment = Alignment.Center,
+    ) {
+        Column(horizontalAlignment = Alignment.CenterHorizontally) {
+            // The brand's circle-container logo (as on the connect screen /
+            // web login): pixel-art "a" centered in a black disc.
+            Box(
+                Modifier
+                    .size(120.dp)
+                    .clip(androidx.compose.foundation.shape.CircleShape)
+                    .background(Color.Black)
+                    .border(
+                        1.dp,
+                        Color.White.copy(alpha = 0.14f),
+                        androidx.compose.foundation.shape.CircleShape,
+                    ),
+                contentAlignment = Alignment.Center,
+            ) {
+                PixelArtLogo(Modifier.size(64.dp))
+            }
+            Spacer(Modifier.height(20.dp))
+            Text(
+                text = "F*CK IPs MESH",
+                color = BitcoinOrange,
+                fontSize = 18.sp,
+                fontWeight = FontWeight.Bold,
+                letterSpacing = 4.sp,
+            )
+            Spacer(Modifier.height(8.dp))
+            Text(
+                text = message,
+                color = TextMuted,
+                fontSize = 13.sp,
+                textAlign = TextAlign.Center,
+            )
+            Spacer(Modifier.height(24.dp))
+            CircularProgressIndicator(color = BitcoinOrange)
+        }
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/components/NESController.kt

@@ -116,7 +116,7 @@ fun NESController(
     Box(
         modifier = modifier
             .fillMaxSize()
-            .twoFingerHold(onMenu)
+            .threeFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -451,17 +451,17 @@ fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {
     }
 }
 
-/** Two-finger hold gesture modifier */
-fun Modifier.twoFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
+/** Three-finger hold gesture modifier (two fingers stay free for scrolling) */
+fun Modifier.threeFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
     awaitEachGesture {
         awaitFirstDown(requireUnconsumed = false)
         var t = 0L; var fired = false
         do {
             val ev = awaitPointerEvent()
             val a = ev.changes.filter { !it.changedToUp() }
-            if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
-            if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
-            if (a.size < 2) t = 0L
+            if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
+            if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
+            if (a.size < 3) t = 0L
         } while (ev.changes.any { it.pressed })
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESMenu.kt

@@ -86,6 +86,7 @@ fun NESMenu(
     onToggleMode: () -> Unit,
     onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)? = null,
+    onMeshParty: (() -> Unit)? = null,
 ) {
     AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
         Box(
@@ -94,7 +95,7 @@ fun NESMenu(
             contentAlignment = Alignment.Center,
         ) {
             AnimatedVisibility(visible = visible, enter = fadeIn() + scaleIn(initialScale = 0.95f), exit = fadeOut() + scaleOut(targetScale = 0.95f)) {
-                MenuPanel(servers, activeServer, isGamepadMode, controllerStyle, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onToggleMode, onToggleStyle, onBackToWebView)
+                MenuPanel(servers, activeServer, isGamepadMode, controllerStyle, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onToggleMode, onToggleStyle, onBackToWebView, onMeshParty)
             }
         }
     }
@@ -115,6 +116,7 @@ private fun MenuPanel(
     onToggleMode: () -> Unit,
     onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)?,
+    onMeshParty: (() -> Unit)?,
 ) {
     var showAdd by remember { mutableStateOf(false) }
     // The saved server being edited, or null when adding a new one.
@@ -284,6 +286,11 @@ private fun MenuPanel(
             onClick = onToggleStyle,
         )
 
+        // Phone↔phone mesh pairing + chat
+        if (onMeshParty != null) {
+            MenuItem(label = "Mesh Party", labelColor = BitcoinOrange, onClick = onMeshParty)
+        }
+
         // Back to dashboard
         if (onBackToWebView != null) {
             MenuItem(label = "Back to Dashboard", onClick = onBackToWebView)

Android/app/src/main/java/com/archipelago/app/ui/components/NESPortraitController.kt

@@ -50,7 +50,7 @@ fun NESPortraitController(
     Box(
         Modifier
             .fillMaxSize()
-            .twoFingerHold(onMenu)
+            .threeFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -87,7 +87,7 @@ fun NESPortraitController(
                     onMove = { dx, dy -> onMouseMove(dx, dy) },
                     onClick = { onMouseClick(it) },
                     onScroll = { dy -> onMouseScroll(dy) },
-                    onTwoFingerHold = onMenu,
+                    onThreeFingerHold = onMenu,
                     modifier = Modifier
                         .fillMaxWidth()
                         .weight(1f),

Android/app/src/main/java/com/archipelago/app/ui/components/QrScannerOverlay.kt

@@ -56,7 +56,6 @@ import androidx.compose.ui.viewinterop.AndroidView
 import androidx.core.content.ContextCompat
 import com.archipelago.app.R
 import com.archipelago.app.data.PairResult
-import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerQrParser
 import com.archipelago.app.ui.screens.GlassButton
 import com.archipelago.app.ui.theme.BitcoinOrange
@@ -82,7 +81,7 @@ import java.util.concurrent.Executors
 fun QrScannerOverlay(
     visible: Boolean,
     onDismiss: () -> Unit,
-    onServerScanned: (ServerEntry) -> Unit,
+    onServerScanned: (PairResult.Success) -> Unit,
 ) {
     val context = LocalContext.current
     var hasPermission by remember {
@@ -131,7 +130,7 @@ fun QrScannerOverlay(
                             when (val result = ServerQrParser.parse(text)) {
                                 is PairResult.Success -> {
                                     handled = true
-                                    onServerScanned(result.server)
+                                    onServerScanned(result)
                                 }
                                 is PairResult.UnsupportedVersion -> hintRes = R.string.update_app_for_qr
                                 is PairResult.Invalid -> hintRes = R.string.invalid_pairing_qr
@@ -218,13 +217,20 @@ fun QrScannerOverlay(
     }
 }
 
+/** Shared by the pairing scanner and the wallet scan modal. */
 @Composable
-private fun CameraQrPreview(onDecoded: (String) -> Unit) {
+internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
     val context = LocalContext.current
     val lifecycleOwner = LocalLifecycleOwner.current
     val currentOnDecoded by rememberUpdatedState(onDecoded)
     val previewView = remember {
-        PreviewView(context).apply { scaleType = PreviewView.ScaleType.FILL_CENTER }
+        PreviewView(context).apply {
+            scaleType = PreviewView.ScaleType.FILL_CENTER
+            // TextureView, not the SurfaceView default: SurfaceView punches a
+            // hole in the window, which black-flashes inside Compose fades and
+            // ignores rounded-corner clipping (wallet modal).
+            implementationMode = PreviewView.ImplementationMode.COMPATIBLE
+        }
     }
 
     DisposableEffect(Unit) {
@@ -283,7 +289,19 @@ private class QrCodeAnalyzer(private val onDecoded: (String) -> Unit) : ImageAna
         )
     }
 
+    private var lastAttempt = 0L
+
     override fun analyze(image: ImageProxy) {
+        // Decode ~7x/s, not on every frame: TRY_HARDER (plus the inverted
+        // retry) pegs a core when run at camera rate, and that CPU contention
+        // is what made the preview itself stutter. KEEP_ONLY_LATEST means the
+        // frames skipped here are simply dropped, so decodes stay current.
+        val now = System.currentTimeMillis()
+        if (now - lastAttempt < 140) {
+            image.close()
+            return
+        }
+        lastAttempt = now
         try {
             val plane = image.planes[0]
             val buffer = plane.buffer

Android/app/src/main/java/com/archipelago/app/ui/components/Trackpad.kt

@@ -32,7 +32,7 @@ fun Trackpad(
     onMove: (dx: Int, dy: Int) -> Unit,
     onClick: (button: Int) -> Unit,
     onScroll: (dy: Int) -> Unit,
-    onTwoFingerHold: () -> Unit,
+    onThreeFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     var fingers by remember { mutableIntStateOf(0) }
@@ -53,7 +53,7 @@ fun Trackpad(
                     val t0 = System.currentTimeMillis()
                     var maxPtrs = 1
                     var holdFired = false
-                    var twoStart = 0L
+                    var threeStart = 0L
                     var scrollAcc = 0f
                     fingers = 1
 
@@ -64,19 +64,24 @@ fun Trackpad(
                         fingers = active.size
 
                         when {
-                            active.size >= 2 -> {
-                                if (twoStart == 0L) twoStart = System.currentTimeMillis()
-                                if (!holdFired && System.currentTimeMillis() - twoStart > 500) {
+                            // Three fingers = hold for menu; two = scroll. Kept
+                            // on separate counts so a long two-finger scroll can
+                            // never fire the menu mid-gesture.
+                            active.size >= 3 -> {
+                                if (threeStart == 0L) threeStart = System.currentTimeMillis()
+                                if (!holdFired && System.currentTimeMillis() - threeStart > 500) {
                                     holdFired = true
-                                    onTwoFingerHold()
+                                    onThreeFingerHold()
                                 }
-                                if (!holdFired) {
-                                    val dy = active.map { it.positionChange().y }.average().toFloat()
-                                    scrollAcc += dy
-                                    if (kotlin.math.abs(scrollAcc) > 12f) {
-                                        onScroll(if (scrollAcc > 0) 1 else -1)
-                                        scrollAcc = 0f
-                                    }
+                                ev.changes.forEach { it.consume() }
+                            }
+                            active.size == 2 -> {
+                                threeStart = 0L
+                                val dy = active.map { it.positionChange().y }.average().toFloat()
+                                scrollAcc += dy
+                                if (kotlin.math.abs(scrollAcc) > 12f) {
+                                    onScroll(if (scrollAcc > 0) 1 else -1)
+                                    scrollAcc = 0f
                                 }
                                 ev.changes.forEach { it.consume() }
                             }
@@ -99,7 +104,11 @@ fun Trackpad(
         contentAlignment = Alignment.Center,
     ) {
         Text(
-            text = if (fingers >= 2) "hold for menu" else "",
+            text = when {
+                fingers >= 3 -> "hold for menu"
+                fingers == 2 -> "scroll"
+                else -> ""
+            },
             style = MaterialTheme.typography.labelSmall,
             color = muted.copy(alpha = 0.4f),
         )

Android/app/src/main/java/com/archipelago/app/ui/components/WalletQrScannerModal.kt

@@ -0,0 +1,294 @@
+package com.archipelago.app.ui.components
+
+import android.Manifest
+import android.content.Context
+import android.content.pm.PackageManager
+import android.graphics.BitmapFactory
+import android.net.Uri
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.aspectRatio
+import androidx.compose.foundation.layout.defaultMinSize
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
+import com.archipelago.app.R
+import com.archipelago.app.ui.screens.GlassButton
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.BinaryBitmap
+import com.google.zxing.DecodeHintType
+import com.google.zxing.MultiFormatReader
+import com.google.zxing.NotFoundException
+import com.google.zxing.RGBLuminanceSource
+import com.google.zxing.common.HybridBinarizer
+
+/**
+ * Native replacement for the web wallet's scan pane — same visual design as
+ * neode-ui's WalletScanModal (dark glass card, square preview, orange
+ * viewfinder, status strip) but the camera and decoding run natively, so the
+ * preview doesn't lag the way getUserMedia does inside a WebView.
+ *
+ * Decoded text is handed back to the page ([onDecoded]) which does all the
+ * detection/spend logic; the page in turn streams status lines (animated-QR
+ * progress, "not recognised" errors) back in via [status] and closes the
+ * modal through the JS bridge once it accepts a code.
+ */
+@Composable
+fun WalletQrScannerModal(
+    visible: Boolean,
+    status: Pair<String, Boolean>?, // message from the web page + isError
+    onDecoded: (String) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    val context = LocalContext.current
+    var hasPermission by remember {
+        mutableStateOf(
+            ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
+                PackageManager.PERMISSION_GRANTED
+        )
+    }
+    val permissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission()
+    ) { granted -> hasPermission = granted }
+
+    // Local error from a failed image upload; a fresh web status replaces it.
+    var uploadError by remember { mutableStateOf<String?>(null) }
+    val noQrMessage = stringResource(R.string.no_qr_in_image)
+    val imagePicker = rememberLauncherForActivityResult(
+        ActivityResultContracts.GetContent()
+    ) { uri ->
+        if (uri != null) {
+            val decoded = decodeQrFromUri(context, uri)
+            if (decoded != null) {
+                uploadError = null
+                onDecoded(decoded)
+            } else {
+                uploadError = noQrMessage
+            }
+        }
+    }
+
+    LaunchedEffect(visible) {
+        if (visible) {
+            uploadError = null
+            val granted = ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
+                PackageManager.PERMISSION_GRANTED
+            hasPermission = granted
+            if (!granted) permissionLauncher.launch(Manifest.permission.CAMERA)
+        }
+    }
+    LaunchedEffect(status) { if (status != null) uploadError = null }
+
+    AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
+        BackHandler { onDismiss() }
+        Box(
+            Modifier
+                .fillMaxSize()
+                .background(Color.Black.copy(alpha = 0.6f))
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = onDismiss,
+                ),
+            contentAlignment = Alignment.Center,
+        ) {
+            Column(
+                Modifier
+                    .padding(16.dp)
+                    .widthIn(max = 420.dp)
+                    .fillMaxWidth()
+                    .clip(RoundedCornerShape(24.dp))
+                    .background(Color(0xF212151C))
+                    .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(24.dp))
+                    .clickable(
+                        interactionSource = remember { MutableInteractionSource() },
+                        indication = null,
+                        onClick = {}, // swallow — only the scrim dismisses
+                    )
+                    .padding(24.dp),
+            ) {
+                // Header — mirrors the web modal's title row
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
+                    Text(
+                        text = stringResource(R.string.scan_to_send),
+                        style = MaterialTheme.typography.titleLarge,
+                        fontWeight = FontWeight.SemiBold,
+                        color = Color.White,
+                    )
+                    IconButton(onClick = onDismiss) {
+                        Icon(
+                            Icons.Default.Close,
+                            stringResource(R.string.close),
+                            tint = Color.White.copy(alpha = 0.7f),
+                        )
+                    }
+                }
+
+                Spacer(Modifier.height(8.dp))
+
+                // Square camera preview with the orange viewfinder
+                Box(
+                    Modifier
+                        .fillMaxWidth()
+                        .aspectRatio(1f)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(Color.Black.copy(alpha = 0.4f))
+                        .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(12.dp)),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    if (hasPermission) {
+                        // Throttle repeat frames: a static QR decodes ~20x/s but
+                        // the page only needs one; animated QRs still stream
+                        // because each frame's text differs.
+                        var lastText by remember { mutableStateOf("") }
+                        var lastSentAt by remember { mutableStateOf(0L) }
+                        CameraQrPreview(onDecoded = { text ->
+                            val now = System.currentTimeMillis()
+                            if (text != lastText || now - lastSentAt > 250) {
+                                lastText = text
+                                lastSentAt = now
+                                onDecoded(text)
+                            }
+                        })
+                        Box(
+                            Modifier
+                                .fillMaxSize(0.62f)
+                                .border(
+                                    2.dp,
+                                    BitcoinOrange.copy(alpha = 0.85f),
+                                    RoundedCornerShape(16.dp),
+                                ),
+                        )
+                    } else {
+                        Column(
+                            Modifier.padding(horizontal = 24.dp),
+                            horizontalAlignment = Alignment.CenterHorizontally,
+                            verticalArrangement = Arrangement.spacedBy(12.dp),
+                        ) {
+                            Text(
+                                text = stringResource(R.string.camera_permission_needed),
+                                color = Color.White.copy(alpha = 0.7f),
+                                style = MaterialTheme.typography.bodyMedium,
+                                textAlign = TextAlign.Center,
+                            )
+                            GlassButton(
+                                text = stringResource(R.string.grant_camera_access),
+                                onClick = { permissionLauncher.launch(Manifest.permission.CAMERA) },
+                                modifier = Modifier.fillMaxWidth().height(48.dp),
+                            )
+                        }
+                    }
+                }
+
+                Spacer(Modifier.height(16.dp))
+
+                // Status strip — same slot the web modal uses for hints/errors
+                val message = uploadError ?: status?.first
+                val isError = uploadError != null || status?.second == true
+                Box(
+                    Modifier
+                        .fillMaxWidth()
+                        .clip(RoundedCornerShape(8.dp))
+                        .background(Color.White.copy(alpha = 0.05f))
+                        .padding(12.dp)
+                        .defaultMinSize(minHeight = 24.dp),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Text(
+                        text = message?.takeIf { it.isNotBlank() }
+                            ?: stringResource(R.string.scan_wallet_hint),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = if (isError) Color(0xFFF87171) else Color.White.copy(alpha = 0.6f),
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                Spacer(Modifier.height(16.dp))
+
+                GlassButton(
+                    text = stringResource(R.string.upload_qr_image),
+                    onClick = { imagePicker.launch("image/*") },
+                    modifier = Modifier.fillMaxWidth().height(48.dp),
+                )
+            }
+        }
+    }
+}
+
+/** Decode a QR from a picked image, downsampled so huge photos stay cheap. */
+private fun decodeQrFromUri(context: Context, uri: Uri): String? {
+    return try {
+        val resolver = context.contentResolver
+        val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+        resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, bounds) }
+        var sample = 1
+        val maxDim = maxOf(bounds.outWidth, bounds.outHeight)
+        while (maxDim / (sample * 2) >= 1600) sample *= 2
+        val opts = BitmapFactory.Options().apply { inSampleSize = sample }
+        val bmp = resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, opts) }
+            ?: return null
+        val pixels = IntArray(bmp.width * bmp.height)
+        bmp.getPixels(pixels, 0, bmp.width, 0, 0, bmp.width, bmp.height)
+        val source = RGBLuminanceSource(bmp.width, bmp.height, pixels)
+        val reader = MultiFormatReader().apply {
+            setHints(
+                mapOf(
+                    DecodeHintType.POSSIBLE_FORMATS to listOf(BarcodeFormat.QR_CODE),
+                    DecodeHintType.TRY_HARDER to true,
+                )
+            )
+        }
+        try {
+            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source))).text
+        } catch (_: NotFoundException) {
+            // Light-on-dark QRs (dark-themed wallets) decode inverted.
+            reader.reset()
+            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source.invert()))).text
+        }
+    } catch (_: Exception) {
+        null
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/navigation/NavGraph.kt

@@ -1,5 +1,8 @@
 package com.archipelago.app.ui.navigation
 
+import android.net.VpnService
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
@@ -16,7 +19,10 @@ import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.data.ServerQrParser
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.screens.FlareScreen
 import com.archipelago.app.ui.screens.IntroScreen
+import com.archipelago.app.ui.screens.PartyScreen
 import com.archipelago.app.ui.screens.RemoteInputScreen
 import com.archipelago.app.ui.screens.ServerConnectScreen
 import com.archipelago.app.ui.screens.WebViewScreen
@@ -27,6 +33,8 @@ object Routes {
     const val SERVER_CONNECT = "server_connect"
     const val WEB_VIEW = "web_view"
     const val REMOTE_INPUT = "remote_input"
+    const val MESH_PARTY = "mesh_party"
+    const val FLARE = "flare"
 }
 
 @Composable
@@ -46,6 +54,34 @@ fun AppNavHost(
     // connect form so the user lands on the password prompt for that server.
     var pairPrefill by remember { mutableStateOf<ServerEntry?>(null) }
 
+    // Mesh tunnel: Android's VPN consent dialog is the single unavoidable
+    // interaction — it can only be launched from an Activity, so pairing
+    // paths raise FipsManager.consentNeeded and it is handled here, once.
+    val consentNeeded by FipsManager.consentNeeded.collectAsState()
+    val vpnConsentLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.StartActivityForResult()
+    ) { result ->
+        FipsManager.consentHandled()
+        if (result.resultCode == android.app.Activity.RESULT_OK) {
+            FipsManager.startService(context)
+        }
+    }
+    LaunchedEffect(consentNeeded) {
+        if (!consentNeeded) return@LaunchedEffect
+        val consentIntent = VpnService.prepare(context)
+        if (consentIntent == null) {
+            FipsManager.consentHandled()
+            FipsManager.startService(context)
+        } else {
+            vpnConsentLauncher.launch(consentIntent)
+        }
+    }
+
+    // Paired + previously consented → the mesh comes back silently on launch.
+    LaunchedEffect(Unit) {
+        FipsManager.autoStartIfReady(context)
+    }
+
     if (introSeen == null) return
 
     // Declared after the introSeen gate so it can't fire before the NavHost
@@ -58,6 +94,7 @@ fun AppNavHost(
                 // Pairing implies the app is installed and in use — skip the intro.
                 prefs.markIntroSeen()
                 val merged = prefs.upsertServer(result.server)
+                FipsManager.registerNode(context, result.fips, merged.displayName())
                 if (merged.password.isNotBlank()) {
                     // Demo flow: password came with the link — connect in one step.
                     prefs.setActiveServer(merged)
@@ -89,6 +126,9 @@ fun AppNavHost(
     ) {
         composable(Routes.INTRO) {
             IntroScreen(
+                onMeshParty = {
+                    navController.navigate(Routes.MESH_PARTY)
+                },
                 onContinue = {
                     scope.launch {
                         prefs.markIntroSeen()
@@ -125,6 +165,7 @@ fun AppNavHost(
                 WebViewScreen(
                     serverUrl = server.toUrl(),
                     serverPassword = server.password,
+                    meshFallbackUrl = server.toMeshUrl(),
                     onDisconnect = {
                         scope.launch {
                             prefs.clearActiveServer()
@@ -145,6 +186,22 @@ fun AppNavHost(
                 onBack = {
                     navController.popBackStack()
                 },
+                onMeshParty = {
+                    navController.navigate(Routes.MESH_PARTY)
+                },
+            )
+        }
+
+        composable(Routes.MESH_PARTY) {
+            PartyScreen(
+                onBack = { navController.popBackStack() },
+                onOpenChat = { navController.navigate(Routes.FLARE) },
+            )
+        }
+
+        composable(Routes.FLARE) {
+            FlareScreen(
+                onBack = { navController.popBackStack() },
             )
         }
     }

Android/app/src/main/java/com/archipelago/app/ui/screens/FlareScreen.kt

@@ -0,0 +1,359 @@
+package com.archipelago.app.ui.screens
+
+import android.graphics.Bitmap
+import android.graphics.BitmapFactory
+import android.net.Uri
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.navigationBarsPadding
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.lazy.rememberLazyListState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Image
+import androidx.compose.material3.Icon
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.OutlinedTextFieldDefaults
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.fips.FipsNative
+import com.archipelago.app.fips.FipsPreferences
+import com.archipelago.app.fips.FlareClient
+import com.archipelago.app.fips.FlareMessage
+import com.archipelago.app.fips.FlareStore
+import com.archipelago.app.fips.PartyPeer
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceDark
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.util.UUID
+
+private val BubbleTheirs = Color.White.copy(alpha = 0.07f)
+private val BubbleBorder = Color.White.copy(alpha = 0.08f)
+
+/**
+ * Flare — phone↔phone chat and photo beam over the FIPS mesh. Every byte is
+ * E2E encrypted by the mesh layer and addressed by npub; whether it travels
+ * via a public anchor (5G) or a direct hotspot link is invisible up here —
+ * which is the entire point.
+ */
+@Composable
+fun FlareScreen(onBack: () -> Unit) {
+    val context = LocalContext.current
+    val prefs = remember { FipsPreferences(context) }
+    val scope = rememberCoroutineScope()
+
+    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
+    var myName by remember { mutableStateOf("Phone") }
+    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
+    var selectedNpub by remember { mutableStateOf<String?>(null) }
+    val allMessages by FlareStore.messages.collectAsState()
+    var draft by remember { mutableStateOf("") }
+
+    LaunchedEffect(Unit) {
+        identity = FipsManager.ensureIdentity(prefs)
+        myName = prefs.partyName()
+    }
+    LaunchedEffect(peers) {
+        if (selectedNpub == null || peers.none { it.npub == selectedNpub }) {
+            selectedNpub = peers.firstOrNull()?.npub
+        }
+    }
+
+    val peer = peers.firstOrNull { it.npub == selectedNpub }
+    val messages = allMessages.filter { it.peerNpub == selectedNpub }
+    val listState = rememberLazyListState()
+    LaunchedEffect(messages.size) {
+        if (messages.isNotEmpty()) listState.animateScrollToItem(messages.size - 1)
+    }
+
+    fun sendText() {
+        val target = peer ?: return
+        val me = identity ?: return
+        val text = draft.trim()
+        if (text.isEmpty()) return
+        draft = ""
+        val msg = FlareMessage(
+            id = UUID.randomUUID().toString(),
+            peerNpub = target.npub,
+            fromMe = true,
+            name = myName,
+            text = text,
+            ts = System.currentTimeMillis(),
+            status = FlareMessage.Status.SENDING,
+        )
+        FlareStore.add(msg)
+        scope.launch(Dispatchers.IO) {
+            val ok = FlareClient.sendText(target, me.npub, myName, text)
+            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
+        }
+    }
+
+    fun sendPhoto(uri: Uri) {
+        val target = peer ?: return
+        val me = identity ?: return
+        scope.launch(Dispatchers.IO) {
+            val jpeg = compressPhoto(context, uri) ?: return@launch
+            // Local copy so our own bubble renders the sent photo.
+            val dir = File(context.cacheDir, "flare").apply { mkdirs() }
+            val local = File(dir, "${UUID.randomUUID()}.jpg").apply { writeBytes(jpeg) }
+            val msg = FlareMessage(
+                id = UUID.randomUUID().toString(),
+                peerNpub = target.npub,
+                fromMe = true,
+                name = myName,
+                photoPath = local.absolutePath,
+                ts = System.currentTimeMillis(),
+                status = FlareMessage.Status.SENDING,
+            )
+            FlareStore.add(msg)
+            val ok = FlareClient.sendPhoto(target, me.npub, myName, jpeg)
+            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
+        }
+    }
+
+    val photoPicker = rememberLauncherForActivityResult(
+        ActivityResultContracts.GetContent()
+    ) { uri -> uri?.let { sendPhoto(it) } }
+
+    BackHandler { onBack() }
+
+    Column(
+        Modifier
+            .fillMaxSize()
+            .background(SurfaceDark)
+            .statusBarsPadding()
+            .navigationBarsPadding()
+            .imePadding(),
+    ) {
+        // Header
+        Row(
+            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.SpaceBetween,
+        ) {
+            Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(6.dp))
+            Column(horizontalAlignment = Alignment.CenterHorizontally) {
+                Text("FLARE", color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
+                peer?.let {
+                    Text(
+                        it.name + if (it.ip.isNotBlank()) "  ·  direct+mesh" else "  ·  mesh",
+                        color = BitcoinOrange,
+                        fontSize = 11.sp,
+                    )
+                }
+            }
+            Spacer(Modifier.size(48.dp))
+        }
+
+        // Peer tabs when chatting with more than one phone
+        if (peers.size > 1) {
+            Row(
+                Modifier.fillMaxWidth().padding(horizontal = 16.dp),
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                peers.forEach { p ->
+                    val active = p.npub == selectedNpub
+                    Text(
+                        p.name,
+                        color = if (active) BitcoinOrange else TextMuted,
+                        fontSize = 13.sp,
+                        modifier = Modifier
+                            .clip(RoundedCornerShape(10.dp))
+                            .background(if (active) BitcoinOrange.copy(alpha = 0.12f) else Color.Transparent)
+                            .border(
+                                1.dp,
+                                if (active) BitcoinOrange.copy(alpha = 0.4f) else BubbleBorder,
+                                RoundedCornerShape(10.dp),
+                            )
+                            .clickable { selectedNpub = p.npub }
+                            .padding(horizontal = 12.dp, vertical = 6.dp),
+                    )
+                }
+            }
+        }
+
+        if (peer == null) {
+            Box(Modifier.weight(1f).fillMaxWidth(), contentAlignment = Alignment.Center) {
+                Text("No party peers yet — scan a phone first", color = TextMuted, fontSize = 14.sp)
+            }
+        } else {
+            LazyColumn(
+                state = listState,
+                modifier = Modifier.weight(1f).fillMaxWidth(),
+                contentPadding = androidx.compose.foundation.layout.PaddingValues(16.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                items(messages, key = { it.id }) { msg ->
+                    MessageBubble(msg)
+                }
+            }
+
+            // Composer
+            Row(
+                Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp),
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                Box(
+                    Modifier
+                        .size(48.dp)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(BubbleTheirs)
+                        .border(1.dp, BubbleBorder, RoundedCornerShape(12.dp))
+                        .clickable { photoPicker.launch("image/*") },
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Icon(Icons.Default.Image, "Beam a photo", tint = BitcoinOrange, modifier = Modifier.size(22.dp))
+                }
+                OutlinedTextField(
+                    value = draft,
+                    onValueChange = { draft = it },
+                    placeholder = { Text("Send a flare…", color = TextMuted, fontSize = 14.sp) },
+                    modifier = Modifier.weight(1f),
+                    singleLine = true,
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Send),
+                    keyboardActions = KeyboardActions(onSend = { sendText() }),
+                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp),
+                    colors = OutlinedTextFieldDefaults.colors(
+                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
+                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
+                        cursorColor = BitcoinOrange,
+                        focusedTextColor = TextPrimary,
+                        unfocusedTextColor = TextPrimary,
+                    ),
+                    shape = RoundedCornerShape(12.dp),
+                )
+                Box(
+                    Modifier
+                        .size(48.dp)
+                        .clip(RoundedCornerShape(12.dp))
+                        .background(BitcoinOrange.copy(alpha = 0.15f))
+                        .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+                        .clickable { sendText() },
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Text("➤", color = BitcoinOrange, fontSize = 18.sp)
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun MessageBubble(msg: FlareMessage) {
+    Row(
+        Modifier.fillMaxWidth(),
+        horizontalArrangement = if (msg.fromMe) Arrangement.End else Arrangement.Start,
+    ) {
+        Column(
+            Modifier
+                .widthIn(max = 300.dp)
+                .clip(RoundedCornerShape(16.dp))
+                .background(if (msg.fromMe) BitcoinOrange.copy(alpha = 0.14f) else BubbleTheirs)
+                .border(
+                    1.dp,
+                    if (msg.fromMe) BitcoinOrange.copy(alpha = 0.35f) else BubbleBorder,
+                    RoundedCornerShape(16.dp),
+                )
+                .padding(horizontal = 12.dp, vertical = 8.dp),
+        ) {
+            if (msg.photoPath.isNotBlank()) {
+                val bmp = remember(msg.photoPath) { BitmapFactory.decodeFile(msg.photoPath) }
+                bmp?.let {
+                    Image(
+                        bitmap = it.asImageBitmap(),
+                        contentDescription = "Beamed photo",
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .clip(RoundedCornerShape(10.dp)),
+                        contentScale = ContentScale.FillWidth,
+                    )
+                }
+            }
+            if (msg.text.isNotBlank()) {
+                Text(msg.text, color = TextPrimary, fontSize = 15.sp)
+            }
+            Text(
+                when (msg.status) {
+                    FlareMessage.Status.SENDING -> "sending…"
+                    FlareMessage.Status.SENT -> "sent · E2E via mesh"
+                    FlareMessage.Status.FAILED -> "failed — tap to retry later"
+                    FlareMessage.Status.RECEIVED -> msg.name
+                },
+                color = if (msg.status == FlareMessage.Status.FAILED) BitcoinOrange else TextMuted,
+                fontSize = 10.sp,
+                modifier = Modifier.padding(top = 2.dp),
+            )
+        }
+    }
+}
+
+/** Decode, downscale (≤1600px) and JPEG-compress a picked photo off-main. */
+private suspend fun compressPhoto(context: android.content.Context, uri: Uri): ByteArray? =
+    withContext(Dispatchers.IO) {
+        try {
+            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+            context.contentResolver.openInputStream(uri)?.use {
+                BitmapFactory.decodeStream(it, null, bounds)
+            }
+            var sample = 1
+            while (maxOf(bounds.outWidth, bounds.outHeight) / sample > 1600) sample *= 2
+            val opts = BitmapFactory.Options().apply { inSampleSize = sample }
+            val bitmap = context.contentResolver.openInputStream(uri)?.use {
+                BitmapFactory.decodeStream(it, null, opts)
+            } ?: return@withContext null
+            val out = ByteArrayOutputStream()
+            bitmap.compress(Bitmap.CompressFormat.JPEG, 80, out)
+            bitmap.recycle()
+            out.toByteArray()
+        } catch (_: Exception) {
+            null
+        }
+    }

Android/app/src/main/java/com/archipelago/app/ui/screens/IntroScreen.kt

@@ -55,7 +55,12 @@ import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.delay
 
 @Composable
-fun IntroScreen(onContinue: () -> Unit) {
+fun IntroScreen(
+    onContinue: () -> Unit,
+    // Mesh Party works with no node at all (phone↔phone) — offered right on
+    // the first screen so a friend who just got the app can join a party.
+    onMeshParty: () -> Unit = {},
+) {
     val logoAlpha = remember { Animatable(0f) }
     var showContent by remember { mutableStateOf(false) }
 
@@ -143,6 +148,14 @@ fun IntroScreen(onContinue: () -> Unit) {
                         onClick = onContinue,
                         modifier = Modifier.fillMaxWidth().height(56.dp),
                     )
+
+                    Spacer(modifier = Modifier.height(12.dp))
+
+                    GlassButton(
+                        text = stringResource(R.string.mesh_party),
+                        onClick = onMeshParty,
+                        modifier = Modifier.fillMaxWidth().height(48.dp),
+                    )
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/screens/PartyScreen.kt

@@ -0,0 +1,519 @@
+package com.archipelago.app.ui.screens
+
+import android.graphics.Bitmap
+import androidx.activity.compose.BackHandler
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.OutlinedTextFieldDefaults
+import androidx.compose.material3.Switch
+import androidx.compose.material3.SwitchDefaults
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.fips.FipsNative
+import com.archipelago.app.fips.FipsPreferences
+import com.archipelago.app.fips.FlareClient
+import com.archipelago.app.fips.PartyPeer
+import com.archipelago.app.fips.PartyQr
+import com.archipelago.app.ui.components.CameraQrPreview
+import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.SurfaceDark
+import com.archipelago.app.ui.theme.TextMuted
+import com.archipelago.app.ui.theme.TextPrimary
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.EncodeHintType
+import com.google.zxing.qrcode.QRCodeWriter
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+private val CardBg = Color.White.copy(alpha = 0.05f)
+private val CardBorder = Color.White.copy(alpha = 0.08f)
+
+/** Public companion download (vps2 demo host — serves the same APK as the
+ *  nodes' QR link). Rendered as the "Share this app" QR. */
+private const val APP_DOWNLOAD_URL =
+    "http://146.59.87.168:2100/packages/archipelago-companion.apk"
+
+/**
+ * Mesh Party — phone↔phone FIPS pairing. Show your QR, scan theirs, and the
+ * two embedded mesh nodes link up: through anchors when there's internet,
+ * directly over any shared WiFi/hotspot when there isn't.
+ */
+@Composable
+fun PartyScreen(
+    onBack: () -> Unit,
+    onOpenChat: () -> Unit,
+) {
+    val context = LocalContext.current
+    val prefs = remember { FipsPreferences(context) }
+    val scope = rememberCoroutineScope()
+
+    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
+    var name by remember { mutableStateOf("") }
+    var localIp by remember { mutableStateOf<String?>(null) }
+    var showScanner by remember { mutableStateOf(false) }
+    var showShareQr by remember { mutableStateOf(false) }
+    var scanHint by remember { mutableStateOf<String?>(null) }
+
+    // Camera permission — fresh installs (and reinstalls: uninstall wipes
+    // grants) land here with no CAMERA grant, and the raw preview just showed
+    // black. Ask the moment the scanner opens.
+    var hasCamera by remember {
+        mutableStateOf(
+            androidx.core.content.ContextCompat.checkSelfPermission(
+                context, android.Manifest.permission.CAMERA,
+            ) == android.content.pm.PackageManager.PERMISSION_GRANTED
+        )
+    }
+    val cameraPermLauncher = androidx.activity.compose.rememberLauncherForActivityResult(
+        androidx.activity.result.contract.ActivityResultContracts.RequestPermission()
+    ) { hasCamera = it }
+    LaunchedEffect(showScanner) {
+        if (showScanner && !hasCamera) {
+            cameraPermLauncher.launch(android.Manifest.permission.CAMERA)
+        }
+    }
+    val listenOn by prefs.partyListenFlow.collectAsState(initial = false)
+    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
+
+    LaunchedEffect(Unit) {
+        identity = FipsManager.ensureIdentity(prefs)
+        name = prefs.partyName()
+        // The hotspot/WiFi address can change while this screen is open
+        // (e.g. the user flips the hotspot on mid-demo) — keep it fresh.
+        while (true) {
+            localIp = withContext(Dispatchers.IO) { PartyQr.localWifiIpv4() }
+            delay(3_000)
+        }
+    }
+
+    val qrPayload = identity?.let { id ->
+        PartyQr.build(
+            npub = id.npub,
+            ula = id.address,
+            name = name.ifBlank { "Phone" },
+            ip = if (listenOn) localIp else null,
+            port = PartyQr.PARTY_UDP_PORT,
+        )
+    }
+    val qrBitmap = remember(qrPayload) { qrPayload?.let { renderQr(it) } }
+
+    BackHandler {
+        when {
+            showScanner -> showScanner = false
+            showShareQr -> showShareQr = false
+            else -> onBack()
+        }
+    }
+
+    Box(Modifier.fillMaxSize().background(SurfaceDark)) {
+        Column(
+            Modifier
+                .fillMaxSize()
+                .statusBarsPadding()
+                .verticalScroll(rememberScrollState())
+                .padding(horizontal = 24.dp, vertical = 16.dp),
+            verticalArrangement = Arrangement.spacedBy(14.dp),
+        ) {
+            Row(
+                Modifier.fillMaxWidth(),
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.SpaceBetween,
+            ) {
+                Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(8.dp))
+                Text("MESH PARTY", color = TextPrimary, fontSize = 17.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
+                Spacer(Modifier.size(56.dp))
+            }
+
+            // My QR card
+            Column(
+                Modifier
+                    .fillMaxWidth()
+                    .clip(RoundedCornerShape(20.dp))
+                    .background(CardBg)
+                    .border(1.dp, CardBorder, RoundedCornerShape(20.dp))
+                    .padding(18.dp),
+                horizontalAlignment = Alignment.CenterHorizontally,
+                verticalArrangement = Arrangement.spacedBy(12.dp),
+            ) {
+                qrBitmap?.let { bmp ->
+                    Box(
+                        Modifier
+                            .clip(RoundedCornerShape(16.dp))
+                            .background(Color.White)
+                            .padding(12.dp),
+                    ) {
+                        Image(
+                            bitmap = bmp.asImageBitmap(),
+                            contentDescription = "My mesh party QR",
+                            modifier = Modifier.size(220.dp),
+                        )
+                    }
+                } ?: Text("Mesh identity unavailable on this device", color = TextMuted, fontSize = 14.sp)
+
+                identity?.let {
+                    Text(
+                        it.npub.take(16) + "…" + it.npub.takeLast(6),
+                        color = TextMuted,
+                        fontSize = 12.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                OutlinedTextField(
+                    value = name,
+                    onValueChange = {
+                        name = it.take(24)
+                        scope.launch { prefs.setPartyName(name) }
+                    },
+                    placeholder = { Text("Your name", color = TextMuted, textAlign = TextAlign.Center, modifier = Modifier.fillMaxWidth()) },
+                    modifier = Modifier.fillMaxWidth().height(56.dp),
+                    singleLine = true,
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp, textAlign = TextAlign.Center),
+                    colors = OutlinedTextFieldDefaults.colors(
+                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
+                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
+                        cursorColor = BitcoinOrange,
+                        focusedTextColor = TextPrimary,
+                        unfocusedTextColor = TextPrimary,
+                    ),
+                    shape = RoundedCornerShape(12.dp),
+                )
+
+                // Direct-link toggle (hotspot mode)
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
+                    Column(Modifier.padding(end = 12.dp)) {
+                        Text("Accept direct links", color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
+                        Text(
+                            when {
+                                listenOn && localIp != null -> "Dialable at $localIp:${PartyQr.PARTY_UDP_PORT} — no internet needed"
+                                listenOn -> "Waiting for a WiFi/hotspot address…"
+                                else -> "Off — mesh routes via anchors only"
+                            },
+                            color = if (listenOn) BitcoinOrange else TextMuted,
+                            fontSize = 12.sp,
+                        )
+                    }
+                    Switch(
+                        checked = listenOn,
+                        onCheckedChange = { on ->
+                            scope.launch {
+                                prefs.setPartyListen(on)
+                                FipsManager.requestMeshRestart(context)
+                            }
+                        },
+                        colors = SwitchDefaults.colors(
+                            checkedTrackColor = BitcoinOrange,
+                            checkedThumbColor = Color.White,
+                        ),
+                    )
+                }
+            }
+
+            GlassButton(
+                text = "Scan a Phone",
+                onClick = { showScanner = true },
+                modifier = Modifier.fillMaxWidth().height(56.dp),
+            )
+
+            if (peers.isNotEmpty()) {
+                Text("PARTY PEERS", color = TextMuted, fontSize = 12.sp, letterSpacing = 2.sp)
+                peers.forEach { peer ->
+                    Row(
+                        Modifier
+                            .fillMaxWidth()
+                            .clip(RoundedCornerShape(14.dp))
+                            .background(CardBg)
+                            .border(1.dp, CardBorder, RoundedCornerShape(14.dp))
+                            .clickable { onOpenChat() }
+                            .padding(horizontal = 16.dp, vertical = 12.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.SpaceBetween,
+                    ) {
+                        Column(Modifier.padding(end = 8.dp)) {
+                            Text(peer.name, color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
+                            Text(
+                                peer.npub.take(14) + "…" + if (peer.ip.isNotBlank()) "  ·  direct ${peer.ip}" else "  ·  via mesh",
+                                color = TextMuted,
+                                fontSize = 11.sp,
+                            )
+                        }
+                        Text(
+                            "✕",
+                            color = TextMuted,
+                            fontSize = 16.sp,
+                            modifier = Modifier.clickable {
+                                scope.launch {
+                                    prefs.removePartyPeer(peer.npub)
+                                    FipsManager.requestMeshRestart(context)
+                                }
+                            }.padding(8.dp),
+                        )
+                    }
+                }
+                GlassButton(
+                    text = "Open Flare Chat",
+                    onClick = onOpenChat,
+                    modifier = Modifier.fillMaxWidth().height(56.dp),
+                )
+            } else {
+                Text(
+                    "Scan another phone's party QR (or let them scan yours) to link your mesh nodes — works over 5G via anchors, or over any shared WiFi/hotspot with zero internet.",
+                    color = TextMuted,
+                    fontSize = 13.sp,
+                    textAlign = TextAlign.Center,
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 8.dp),
+                )
+            }
+            Spacer(Modifier.height(12.dp))
+            // Hand the app itself to a friend: shares this install's own APK
+            // through the system sheet (Quick Share/Bluetooth), so a nearby
+            // phone gets the companion with zero internet — the whole party
+            // premise.
+            GlassButton(
+                text = "Share this app",
+                onClick = { showShareQr = true },
+                modifier = Modifier.fillMaxWidth().height(48.dp),
+            )
+            Spacer(Modifier.height(12.dp))
+        }
+
+        // "Share this app" — a QR of the public download link, so the other
+        // phone scans it with its normal camera and installs over any
+        // internet. (The vps2 demo host serves the same APK the nodes do.)
+        AnimatedVisibility(visible = showShareQr, enter = fadeIn(), exit = fadeOut()) {
+            Box(
+                Modifier
+                    .fillMaxSize()
+                    .background(Color.Black.copy(alpha = 0.94f))
+                    .clickable { showShareQr = false },
+                contentAlignment = Alignment.Center,
+            ) {
+                Column(horizontalAlignment = Alignment.CenterHorizontally) {
+                    val dlQr = remember { renderQr(APP_DOWNLOAD_URL) }
+                    dlQr?.let { bmp ->
+                        Box(
+                            Modifier
+                                .clip(RoundedCornerShape(16.dp))
+                                .background(Color.White)
+                                .padding(14.dp),
+                        ) {
+                            Image(
+                                bitmap = bmp.asImageBitmap(),
+                                contentDescription = "Companion download QR",
+                                modifier = Modifier.size(240.dp),
+                            )
+                        }
+                    }
+                    Spacer(Modifier.height(18.dp))
+                    Text(
+                        "Scan with any camera to download\nthe Archipelago Companion",
+                        color = TextPrimary,
+                        fontSize = 15.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                    Spacer(Modifier.height(10.dp))
+                    Text(
+                        "…or send the APK file directly",
+                        color = BitcoinOrange,
+                        fontSize = 13.sp,
+                        modifier = Modifier.clickable { shareCompanionApk(context) }.padding(8.dp),
+                    )
+                    Spacer(Modifier.height(6.dp))
+                    Text("Close", color = TextMuted, fontSize = 14.sp, modifier = Modifier.clickable { showShareQr = false }.padding(8.dp))
+                }
+            }
+        }
+
+        // Party QR scanner overlay
+        AnimatedVisibility(visible = showScanner, enter = fadeIn(), exit = fadeOut()) {
+            Box(Modifier.fillMaxSize().background(Color.Black)) {
+                if (!hasCamera) {
+                    Column(
+                        Modifier.align(Alignment.Center).padding(horizontal = 32.dp),
+                        horizontalAlignment = Alignment.CenterHorizontally,
+                        verticalArrangement = Arrangement.spacedBy(14.dp),
+                    ) {
+                        Text(
+                            "Camera access is needed to scan a party QR.",
+                            color = TextPrimary,
+                            fontSize = 15.sp,
+                            textAlign = TextAlign.Center,
+                        )
+                        GlassButton(
+                            text = "Grant camera access",
+                            onClick = { cameraPermLauncher.launch(android.Manifest.permission.CAMERA) },
+                            modifier = Modifier.fillMaxWidth().height(48.dp),
+                        )
+                    }
+                } else CameraQrPreview(onDecoded = { text ->
+                    val peer = PartyQr.parse(text)
+                    when {
+                        peer == null -> scanHint = "Not a mesh party QR"
+                        peer.npub == identity?.npub -> scanHint = "That's your own QR"
+                        else -> {
+                            showScanner = false
+                            scanHint = null
+                            scope.launch {
+                                prefs.upsertPartyPeer(peer)
+                                // Pick up the direct-dial PeerConfig (and the
+                                // listener, if ours is on) immediately.
+                                FipsManager.requestMeshRestart(context)
+                                // Pairing must be MUTUAL: announce ourselves so
+                                // the scanned phone gets us as a peer + a chat
+                                // entry without scanning back. Retried while
+                                // the fresh link/session comes up.
+                                val me = identity
+                                if (me != null) {
+                                    launch(Dispatchers.IO) {
+                                        for (attempt in 0 until 6) {
+                                            val ok = FlareClient.sendHello(
+                                                peer = peer,
+                                                myNpub = me.npub,
+                                                myName = name.ifBlank { "Phone" },
+                                                myUla = me.address,
+                                                myIp = if (listenOn) localIp else null,
+                                                myPort = PartyQr.PARTY_UDP_PORT,
+                                            )
+                                            if (ok) break
+                                            delay(3_000)
+                                        }
+                                    }
+                                }
+                                onOpenChat()
+                            }
+                        }
+                    }
+                })
+                Box(
+                    Modifier
+                        .align(Alignment.Center)
+                        .size(260.dp)
+                        .border(2.dp, BitcoinOrange.copy(alpha = 0.85f), RoundedCornerShape(20.dp)),
+                )
+                Text(
+                    "Close",
+                    color = TextPrimary,
+                    fontSize = 16.sp,
+                    modifier = Modifier
+                        .align(Alignment.TopEnd)
+                        .statusBarsPadding()
+                        .clickable { showScanner = false }
+                        .padding(20.dp),
+                )
+                scanHint?.let {
+                    Text(
+                        it,
+                        color = BitcoinOrange,
+                        fontSize = 14.sp,
+                        textAlign = TextAlign.Center,
+                        modifier = Modifier
+                            .align(Alignment.BottomCenter)
+                            .padding(bottom = 48.dp)
+                            .fillMaxWidth(),
+                    )
+                }
+            }
+        }
+    }
+
+    // Scan hints fade so the camera feels live again.
+    LaunchedEffect(scanHint) {
+        if (scanHint != null) {
+            delay(2500)
+            scanHint = null
+        }
+    }
+}
+
+/** Render a QR payload as a bitmap (dark modules on white). */
+private fun renderQr(payload: String, size: Int = 640): Bitmap? = try {
+    val matrix = QRCodeWriter().encode(
+        payload,
+        BarcodeFormat.QR_CODE,
+        size,
+        size,
+        mapOf(EncodeHintType.MARGIN to 1),
+    )
+    val pixels = IntArray(size * size)
+    for (y in 0 until size) {
+        for (x in 0 until size) {
+            pixels[y * size + x] = if (matrix[x, y]) 0xFF0A0A0A.toInt() else 0xFFFFFFFF.toInt()
+        }
+    }
+    Bitmap.createBitmap(pixels, size, size, Bitmap.Config.ARGB_8888)
+} catch (_: Exception) {
+    null
+}
+
+/** Share this install's own APK via the system share sheet — a nearby friend
+ *  gets the companion with no internet at all (Quick Share / Bluetooth). */
+private fun shareCompanionApk(context: android.content.Context) {
+    try {
+        val src = java.io.File(context.applicationInfo.sourceDir)
+        val dir = java.io.File(context.cacheDir, "share").apply { mkdirs() }
+        val out = java.io.File(dir, "archipelago-companion.apk")
+        src.copyTo(out, overwrite = true)
+        val uri = androidx.core.content.FileProvider.getUriForFile(
+            context, "${context.packageName}.fileprovider", out,
+        )
+        val send = android.content.Intent(android.content.Intent.ACTION_SEND).apply {
+            type = "application/vnd.android.package-archive"
+            putExtra(android.content.Intent.EXTRA_STREAM, uri)
+            addFlags(android.content.Intent.FLAG_GRANT_READ_URI_PERMISSION)
+        }
+        context.startActivity(
+            android.content.Intent.createChooser(send, "Share Archipelago Companion")
+                .addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK),
+        )
+    } catch (_: Exception) {
+        // No share targets / copy failed — nothing sensible to do here.
+    }
+}

Android/app/src/main/java/com/archipelago/app/ui/screens/RemoteInputScreen.kt

@@ -37,6 +37,7 @@ import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.unit.dp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.fips.FipsManager
 import com.archipelago.app.network.ConnectionState
 import com.archipelago.app.network.InputWebSocket
 import com.archipelago.app.ui.components.NESController
@@ -53,7 +54,7 @@ import com.archipelago.app.ui.theme.TextMuted
 import kotlinx.coroutines.launch
 
 @Composable
-fun RemoteInputScreen(onBack: () -> Unit) {
+fun RemoteInputScreen(onBack: () -> Unit, onMeshParty: (() -> Unit)? = null) {
     val context = LocalContext.current
     val prefs = remember { ServerPreferences(context) }
     val scope = rememberCoroutineScope()
@@ -171,7 +172,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                             onMove = { dx, dy -> ws.sendMouseMove(dx, dy) },
                             onClick = { ws.sendClick(it) },
                             onScroll = { ws.sendScroll(it) },
-                            onTwoFingerHold = { showModal = true },
+                            onThreeFingerHold = { showModal = true },
                             modifier = Modifier.fillMaxWidth().weight(1f)
                                 .padding(horizontal = 16.dp, vertical = 8.dp),
                         )
@@ -249,6 +250,7 @@ fun RemoteInputScreen(onBack: () -> Unit) {
                 controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
             },
             onBackToWebView = { showModal = false; onBack() },
+            onMeshParty = onMeshParty?.let { open -> { showModal = false; open() } },
         )
 
         // Pairing-QR scan launched from the menu's Add Server row. The menu stays
@@ -256,10 +258,11 @@ fun RemoteInputScreen(onBack: () -> Unit) {
         QrScannerOverlay(
             visible = showQrScanner,
             onDismiss = { showQrScanner = false },
-            onServerScanned = { server ->
+            onServerScanned = { scan ->
                 showQrScanner = false
                 scope.launch {
-                    val merged = prefs.upsertServer(server)
+                    val merged = prefs.upsertServer(scan.server)
+                    FipsManager.registerNode(context, scan.fips, merged.displayName())
                     if (activeServer == null) prefs.setActiveServer(merged)
                 }
             },

Android/app/src/main/java/com/archipelago/app/ui/screens/ServerConnectScreen.kt

@@ -71,8 +71,11 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
+import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.fips.FipsManager
+import com.archipelago.app.ui.components.MeshLoadingScreen
 import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.theme.BitcoinOrange
 import com.archipelago.app.ui.theme.ErrorRed
@@ -83,6 +86,7 @@ import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import com.archipelago.app.ui.theme.TextSecondary
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import java.net.HttpURLConnection
@@ -169,10 +173,35 @@ fun ServerConnectScreen(
         errorMessage = null
 
         scope.launch {
-            val result = testConnection(server)
+            var reachable = testConnection(server)
+
+            // LAN address didn't answer — phone off-LAN (5G) or DHCP moved the
+            // node. The scanned IP was only ever a dial hint; the node's real
+            // identity is its npub and its ULA is reachable from anywhere over
+            // the mesh. Bring the tunnel up and probe the ULA before failing.
+            if (!reachable && server.meshIp.isNotBlank()) {
+                FipsManager.autoStartIfReady(context)
+                val meshServer = server.copy(
+                    address = server.meshIp,
+                    useHttps = false,
+                    port = "",
+                )
+                // Mesh discovery + first session can take 15s+ through the
+                // public tree (HANDOFF-2026-07-23 node diagnosis), and on a
+                // first-ever pairing the VPN consent dialog is on screen at
+                // the same time — so probe patiently inside a 60s budget with
+                // per-attempt timeouts wide enough to ride out TCP
+                // retransmit backoff. The VPN service pre-warms the session
+                // in parallel (ArchyVpnService.startSessionWarmer).
+                val deadline = System.currentTimeMillis() + 60_000
+                while (!reachable && System.currentTimeMillis() < deadline) {
+                    reachable = testConnection(meshServer, timeoutMs = 15_000)
+                    if (!reachable) delay(3000)
+                }
+            }
             isConnecting = false
 
-            if (result) {
+            if (reachable) {
                 prefs.setActiveServer(server)
                 onConnected(server.toUrl())
             } else {
@@ -190,12 +219,14 @@ fun ServerConnectScreen(
     }
 
     // Pairing QR scanned: dedupe against saved servers, then either auto-connect
-    // (payload carried a password — the demo flow) or land on the password
-    // prompt with everything else filled in (real nodes never embed one).
-    fun onQrScanned(scanned: ServerEntry) {
+    // (payload carried a credential — demo password or a real node's device
+    // token) or land on the password prompt with everything else filled in.
+    // Mesh info (when present) is registered so the FIPS tunnel comes up too.
+    fun onQrScanned(scan: PairResult.Success) {
         showScanner = false
         scope.launch {
-            val merged = prefs.upsertServer(scanned)
+            val merged = prefs.upsertServer(scan.server)
+            FipsManager.registerNode(context, scan.fips, merged.displayName())
             prefill(merged)
             if (merged.password.isNotBlank()) {
                 connect(merged)
@@ -580,6 +611,14 @@ fun ServerConnectScreen(
             onDismiss = { showScanner = false },
             onServerScanned = { onQrScanned(it) },
         )
+
+        // Full-screen branded loader while the first connect runs — most
+        // visibly right after a pairing-QR scan, when the mesh may still be
+        // establishing (LAN probe → tunnel up → ULA probe can take a while).
+        // The small inline spinner stays for context; this owns the screen.
+        if (isConnecting) {
+            MeshLoadingScreen()
+        }
     }
 }
 
@@ -647,8 +686,10 @@ private fun sanitizeAddress(input: String): String {
         .trimEnd('/')
 }
 
-/** Test RPC connectivity. Accepts self-signed certs for local LAN servers. */
-private suspend fun testConnection(server: ServerEntry): Boolean {
+/** Test RPC connectivity. Accepts self-signed certs for local LAN servers.
+ *  [timeoutMs] is per-phase (connect / read) — mesh probes need far more
+ *  patience than LAN ones (first session through the tree can take 15s+). */
+private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000): Boolean {
     return withContext(Dispatchers.IO) {
         try {
             val url = URL("${server.toUrl()}/rpc/v1")
@@ -668,8 +709,8 @@ private suspend fun testConnection(server: ServerEntry): Boolean {
             }
 
             connection.requestMethod = "POST"
-            connection.connectTimeout = 5000
-            connection.readTimeout = 5000
+            connection.connectTimeout = timeoutMs
+            connection.readTimeout = timeoutMs
             connection.setRequestProperty("Content-Type", "application/json")
             connection.doOutput = true
             val body = """{"method":"server.echo","params":{"message":"ping"}}"""

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -23,20 +23,28 @@ import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.WindowInsetsSides
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.navigationBars
+import androidx.compose.foundation.layout.only
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.safeDrawing
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBars
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.windowInsetsBottomHeight
 import androidx.compose.foundation.layout.windowInsetsPadding
+import androidx.compose.foundation.layout.windowInsetsTopHeight
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
@@ -53,28 +61,47 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
+import androidx.compose.runtime.snapshotFlow
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.text.withStyle
 import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
 import androidx.compose.ui.viewinterop.AndroidView
+import android.webkit.ValueCallback
 import com.archipelago.app.R
+import com.archipelago.app.data.ServerPreferences
+import com.archipelago.app.ui.components.GestureHintOverlay
+import com.archipelago.app.ui.components.MeshLoadingScreen
+import com.archipelago.app.ui.components.WalletQrScannerModal
 import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.ErrorRed
 import com.archipelago.app.ui.theme.SurfaceBlack
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import org.json.JSONObject
 
 /** Open a URL in the phone's default browser (genuinely external links). */
 private fun openExternalUrl(context: android.content.Context, url: String) {
@@ -104,6 +131,82 @@ private fun isSameHost(url: String, base: String): Boolean {
     }
 }
 
+/** Kiosk WebView retained across navigation (remote ⇄ dashboard) so leaving
+ *  the kiosk and coming back reattaches the LIVE page — no reload, no
+ *  re-login, no reconnect. Dropped on retry/disconnect/server change. */
+private object KioskWebView {
+    var instance: WebView? = null
+    var url: String? = null
+
+    // Live-composition delegates for the JS bridges (see the factory) — the
+    // registered interface objects call through these, so reattaching the
+    // retained view re-points them instead of leaving stale closures.
+    var onRouteOutbound: (String) -> Unit = {}
+    var onOpenInApp: (String) -> Unit = {}
+    var onQrOpen: () -> Unit = {}
+    var onQrStatus: (String, Boolean) -> Unit = { _, _ -> }
+    var onQrClose: () -> Unit = {}
+
+    fun drop() {
+        instance?.let {
+            (it.parent as? ViewGroup)?.removeView(it)
+            it.destroy()
+        }
+        instance = null
+        url = null
+    }
+}
+
+/** Inject the safe-area CSS vars from the CURRENT window insets. Android
+ *  WebView doesn't populate env(safe-area-inset-*); worse, on a cold start
+ *  onPageFinished can run before the view is attached — rootWindowInsets is
+ *  null then, and injecting 0px collapsed the UI's top/bottom margins (and
+ *  put the tab bar inside the gesture zone, killing its taps). Called from
+ *  onPageFinished, from the window-insets listener (fires when real insets
+ *  arrive), and on reattach. */
+private fun injectSafeAreaVars(view: WebView) {
+    val insets = view.rootWindowInsets ?: return // listener re-fires when real
+    val density = view.resources.displayMetrics.density
+    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
+    val sab = (insets.getInsets(android.view.WindowInsets.Type.navigationBars()).bottom / density).toInt()
+    view.evaluateJavascript(
+        """
+        (function() {
+            var style = document.getElementById('archipelago-android-insets');
+            if (!style) {
+                style = document.createElement('style');
+                style.id = 'archipelago-android-insets';
+                document.head.appendChild(style);
+            }
+            style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
+        })();
+        """.trimIndent(),
+        null,
+    )
+}
+
+/** True when a TCP listener answers at [base]'s host:port within [timeoutMs]. */
+private fun tcpAnswers(base: String, timeoutMs: Int): Boolean = try {
+    val u = android.net.Uri.parse(base)
+    val port = if (u.port != -1) u.port else if (u.scheme == "https") 443 else 80
+    java.net.Socket().use {
+        it.connect(java.net.InetSocketAddress(u.host, port), timeoutMs)
+        true
+    }
+} catch (_: Exception) {
+    false
+}
+
+/** Fastest answering origin: LAN inside a short window, else the mesh ULA
+ *  (patient — a cold session may still be establishing), else LAN anyway so
+ *  the existing error/fallback path handles it. */
+private suspend fun pickStartUrl(lanUrl: String, meshUrl: String?): String =
+    withContext(Dispatchers.IO) {
+        if (tcpAnswers(lanUrl, 2500)) return@withContext lanUrl
+        if (meshUrl != null && tcpAnswers(meshUrl, 12_000)) return@withContext meshUrl
+        lanUrl
+    }
+
 /** Apply the WebView settings shared by the kiosk view and the in-app browser.
  *  These are tuned for SPA performance and parity with the mobile browser;
  *  none of them alter how a page renders visually. */
@@ -146,12 +249,45 @@ fun WebViewScreen(
     // non-blank, the login page is auto-filled and submitted — the one-step
     // demo flow from docs/companion-pairing-qr.md.
     serverPassword: String = "",
+    // Node's FIPS mesh URL (http://[fd…]). When the primary address fails on
+    // a main-frame load — typically the phone left the LAN — retry there
+    // before surfacing the error page: the mesh tunnel works from anywhere.
+    meshFallbackUrl: String? = null,
 ) {
     var isLoading by remember { mutableStateOf(true) }
+    // First kiosk load (often over the FIPS mesh) gets the full branded
+    // loader; later navigations keep just the slim top progress bar.
+    var firstLoadDone by remember { mutableStateOf(false) }
+    LaunchedEffect(Unit) {
+        snapshotFlow { isLoading }.first { !it }
+        firstLoadDone = true
+    }
     var loadProgress by remember { mutableIntStateOf(0) }
+    var triedMeshFallback by remember { mutableStateOf(false) }
     var hasError by remember { mutableStateOf(false) }
     var webView by remember { mutableStateOf<WebView?>(null) }
 
+    // Race LAN vs mesh BEFORE the WebView exists: Chromium pointed at an
+    // unreachable LAN IP burns a minute+ in connect retries before
+    // onReceivedError fires the mesh fallback — the "stuck connecting"
+    // stall. A raw TCP probe answers in milliseconds at home and fails in
+    // ~2.5s off-LAN, so startup lands on the right origin in seconds.
+    var startUrl by remember(serverUrl) { mutableStateOf<String?>(null) }
+    var raceNonce by remember { mutableIntStateOf(0) }
+    LaunchedEffect(serverUrl, meshFallbackUrl, raceNonce) {
+        // A retained live session exists — reattach instantly: no race, no
+        // reload, no re-login (remote ⇄ dashboard round trip).
+        if (KioskWebView.instance != null && KioskWebView.url == serverUrl) {
+            isLoading = false
+            startUrl = serverUrl
+            return@LaunchedEffect
+        }
+        val picked = pickStartUrl(serverUrl, meshFallbackUrl)
+        // Starting on the mesh: don't bounce back to it on error (it IS it).
+        if (picked != serverUrl) triedMeshFallback = true
+        startUrl = picked
+    }
+
     // Web-page camera access (wallet QR scanner). The WebView's default
     // WebChromeClient silently denies getUserMedia, so grant video capture —
     // asking for the app-level CAMERA permission first when needed.
@@ -171,6 +307,47 @@ fun WebViewScreen(
     // while this is shown, so closing it returns instantly with no reload.
     var inAppUrl by remember { mutableStateOf<String?>(null) }
 
+    // Same node = EITHER of its addresses. Over the mesh the kiosk's host is
+    // the ULA while app links may carry the LAN IP (and vice versa) —
+    // comparing against one host bounced same-node apps (Pine, Home
+    // Assistant, BTCPay) out to the phone's external browser.
+    fun isSameNode(url: String): Boolean =
+        isSameHost(url, serverUrl) ||
+            (meshFallbackUrl != null && isSameHost(url, meshFallbackUrl))
+
+    // Native wallet QR scanner, opened by the web UI via the ArchipelagoQr
+    // bridge; status lines stream back from the page while it's up.
+    var walletScannerVisible by remember { mutableStateOf(false) }
+    var walletScannerStatus by remember { mutableStateOf<Pair<String, Boolean>?>(null) }
+
+    // One-time three-finger-hold teaching overlay (initial=true: never flash
+    // it while DataStore is still loading).
+    val prefs = remember { ServerPreferences(webViewContext) }
+    val gestureHintSeen by prefs.gestureHintSeen.collectAsState(initial = true)
+    var gestureHintDismissed by remember { mutableStateOf(false) }
+    // Don't teach the gesture on top of the login/splash — arm the overlay
+    // ~2 minutes after the kiosk first finishes loading, once the user has
+    // settled in.
+    var gestureHintReady by remember { mutableStateOf(false) }
+    LaunchedEffect(Unit) {
+        snapshotFlow { isLoading }.first { !it }
+        delay(120_000)
+        gestureHintReady = true
+    }
+    val scope = rememberCoroutineScope()
+
+    // <input type="file"> support — without a chooser implementation the
+    // WebView silently ignores file inputs (broke the wallet's upload path).
+    var pendingFileChooser by remember { mutableStateOf<ValueCallback<Array<android.net.Uri>>?>(null) }
+    val fileChooserLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.StartActivityForResult(),
+    ) { result ->
+        pendingFileChooser?.onReceiveValue(
+            WebChromeClient.FileChooserParams.parseResult(result.resultCode, result.data),
+        )
+        pendingFileChooser = null
+    }
+
     BackHandler(enabled = inAppUrl == null && webView?.canGoBack() == true) {
         webView?.goBack()
     }
@@ -219,9 +396,16 @@ fun WebViewScreen(
                 GlassButton(
                     text = stringResource(R.string.retry),
                     onClick = {
+                        // Re-race LAN vs mesh — the network we're on may have
+                        // changed since the last pick. Drop the retained view:
+                        // an errored session must genuinely reload.
+                        KioskWebView.drop()
+                        webView = null
                         hasError = false
                         isLoading = true
-                        webView?.loadUrl(serverUrl)
+                        triedMeshFallback = false
+                        startUrl = null
+                        raceNonce++
                     },
                     modifier = Modifier.fillMaxWidth().height(56.dp),
                 )
@@ -230,17 +414,33 @@ fun WebViewScreen(
 
                 GlassButton(
                     text = stringResource(R.string.disconnect),
-                    onClick = onDisconnect,
+                    onClick = {
+                        KioskWebView.drop()
+                        onDisconnect()
+                    },
                     modifier = Modifier.fillMaxWidth().height(48.dp),
                 )
             }
+        } else if (startUrl == null) {
+            // Racing LAN vs mesh (≤2.5s at home, a few seconds off-LAN) —
+            // far cheaper than letting Chromium retry a dead LAN IP.
+            MeshLoadingScreen()
         } else {
             // Edge-to-edge WebView — background bleeds behind status bar.
             // Safe area values injected as CSS env() polyfill on each page load.
+            val initialUrl = startUrl ?: serverUrl
             AndroidView(
                 modifier = Modifier.fillMaxSize(),
                 factory = { context ->
-                    WebView(context).apply {
+                    // Reattach the retained kiosk WebView (remote ⇄ dashboard
+                    // must not reload the node UI). Everything configured
+                    // below is idempotent, and re-running it rebinds clients,
+                    // bridges and listeners to THIS composition's state —
+                    // stale closures from the previous visit are replaced.
+                    if (KioskWebView.url != serverUrl) KioskWebView.drop()
+                    val reused = KioskWebView.instance
+                    (reused ?: WebView(context)).apply {
+                        (parent as? ViewGroup)?.removeView(this)
                         layoutParams = ViewGroup.LayoutParams(
                             ViewGroup.LayoutParams.MATCH_PARENT,
                             ViewGroup.LayoutParams.MATCH_PARENT,
@@ -264,38 +464,90 @@ fun WebViewScreen(
 
                         val webViewRef = this
 
+                        // Re-inject the safe-area vars whenever REAL insets
+                        // arrive — on cold start onPageFinished often beats
+                        // window attachment and would otherwise bake in 0px.
+                        setOnApplyWindowInsetsListener { v, insets ->
+                            (v as? WebView)?.let { injectSafeAreaVars(it) }
+                            v.onApplyWindowInsets(insets)
+                        }
+
                         // Decide where an outbound URL goes:
                         //  - same host as the node  → in-app WebView overlay
                         //    (this is the "open in browser" target for apps the
                         //    kiosk couldn't iframe — keep the user inside the app)
                         //  - different host         → the phone's real browser
                         fun routeOutbound(url: String) {
-                            if (isSameHost(url, serverUrl)) {
+                            if (isSameNode(url)) {
                                 inAppUrl = url
                             } else {
                                 openExternalUrl(context, url)
                             }
                         }
 
+                        // Bridge callbacks are DELEGATED through the holder:
+                        // the interface objects registered on a retained
+                        // WebView survive recomposition, and re-registering
+                        // them doesn't reliably swap the JS-visible object
+                        // without a reload — with direct closures, a
+                        // remote ⇄ dashboard round trip left the bridges
+                        // writing to a dead composition's state ("apps don't
+                        // launch"). These assignments re-point the live
+                        // interface objects at THIS composition every attach.
+                        KioskWebView.onRouteOutbound = { url -> routeOutbound(url) }
+                        KioskWebView.onOpenInApp = { url -> inAppUrl = url }
+                        KioskWebView.onQrOpen = {
+                            walletScannerStatus = null
+                            walletScannerVisible = true
+                        }
+                        KioskWebView.onQrStatus = { msg, err -> walletScannerStatus = msg to err }
+                        KioskWebView.onQrClose = { walletScannerVisible = false }
+
                         // JS bridge. The web UI calls:
                         //   window.ArchipelagoNative.openExternal(url) — host-routed
                         //   window.ArchipelagoNative.openInApp(url)    — force in-app
                         // Falls back to window.open in a plain mobile browser.
-                        addJavascriptInterface(
+                        if (reused == null) addJavascriptInterface(
                             object {
                                 @android.webkit.JavascriptInterface
                                 fun openExternal(url: String) {
-                                    webViewRef.post { routeOutbound(url) }
+                                    webViewRef.post { KioskWebView.onRouteOutbound(url) }
                                 }
 
                                 @android.webkit.JavascriptInterface
                                 fun openInApp(url: String) {
-                                    webViewRef.post { inAppUrl = url }
+                                    webViewRef.post { KioskWebView.onOpenInApp(url) }
                                 }
                             },
                             "ArchipelagoNative",
                         )
 
+                        // Wallet QR bridge. The web scan modal calls:
+                        //   window.ArchipelagoQr.open()             — show the native scanner
+                        //   window.ArchipelagoQr.setStatus(msg, e)  — mirror status/progress lines
+                        //   window.ArchipelagoQr.close()            — code accepted, tear down
+                        // Decodes flow back through window.__archyQrResult(text);
+                        // a user cancel calls window.__archyQrCancelled().
+                        if (reused == null) addJavascriptInterface(
+                            object {
+                                @android.webkit.JavascriptInterface
+                                fun open() {
+                                    webViewRef.post { KioskWebView.onQrOpen() }
+                                }
+
+                                @android.webkit.JavascriptInterface
+                                fun setStatus(message: String, isError: Boolean) {
+                                    webViewRef.post { KioskWebView.onQrStatus(message, isError) }
+                                }
+
+                                @android.webkit.JavascriptInterface
+                                fun close() {
+                                    webViewRef.post { KioskWebView.onQrClose() }
+                                }
+                            },
+                            "ArchipelagoQr",
+                        )
+
                         webViewClient = object : WebViewClient() {
                             override fun onPageStarted(view: WebView?, url: String?, favicon: Bitmap?) {
                                 isLoading = true
@@ -306,38 +558,16 @@ fun WebViewScreen(
                                 isLoading = false
                                 if (view == null) return
 
-                                // Convert physical pixels → CSS pixels
-                                val density = view.resources.displayMetrics.density
-                                val satPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.statusBars())
-                                    ?.top ?: 0
-                                val sabPx = view.rootWindowInsets
-                                    ?.getInsets(android.view.WindowInsets.Type.navigationBars())
-                                    ?.bottom ?: 0
-                                val sat = (satPx / density).toInt()
-                                val sab = (sabPx / density).toInt()
-
-                                // Android WebView doesn't populate env(safe-area-inset-*).
-                                // Set CSS custom properties the web UI can use as fallback:
-                                //   var(--safe-area-top, env(safe-area-inset-top, 0px))
-                                view.evaluateJavascript(
-                                    """
-                                    (function() {
-                                        var style = document.getElementById('archipelago-android-insets');
-                                        if (!style) {
-                                            style = document.createElement('style');
-                                            style.id = 'archipelago-android-insets';
-                                            document.head.appendChild(style);
-                                        }
-                                        style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
-                                    })();
-                                    """.trimIndent(),
-                                    null,
-                                )
+                                injectSafeAreaVars(view)
 
                                 // Auto-login with the stored password (QR pairing /
-                                // saved server) — only on our own server's pages.
-                                if (serverPassword.isNotBlank() && url != null && url.startsWith(serverUrl)) {
+                                // saved server) — only on our own server's pages
+                                // (LAN origin or the mesh address).
+                                val onOwnServer = url != null && (
+                                    url.startsWith(serverUrl) ||
+                                        (meshFallbackUrl != null && url.startsWith(meshFallbackUrl))
+                                    )
+                                if (serverPassword.isNotBlank() && onOwnServer) {
                                     view.evaluateJavascript(buildAutoLoginScript(serverPassword), null)
                                 }
                             }
@@ -348,6 +578,15 @@ fun WebViewScreen(
                                 error: WebResourceError?,
                             ) {
                                 if (request?.isForMainFrame == true) {
+                                    val mesh = meshFallbackUrl
+                                    if (mesh != null && !triedMeshFallback &&
+                                        request.url?.toString()?.startsWith(mesh) != true
+                                    ) {
+                                        triedMeshFallback = true
+                                        isLoading = true
+                                        view?.loadUrl(mesh)
+                                        return
+                                    }
                                     hasError = true
                                     isLoading = false
                                 }
@@ -366,7 +605,7 @@ fun WebViewScreen(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameHost(u, serverUrl)) {
+                                if (u != null && isSameNode(u)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -380,6 +619,8 @@ fun WebViewScreen(
                                 val url = request?.url?.toString() ?: return false
                                 // Keep kiosk navigation (same origin incl. port) in place
                                 if (url.startsWith(serverUrl)) return false
+                                // Mesh address is the same server too
+                                if (meshFallbackUrl != null && url.startsWith(meshFallbackUrl)) return false
                                 // Same node (other port) → in-app; external → browser
                                 routeOutbound(url)
                                 return true
@@ -391,6 +632,27 @@ fun WebViewScreen(
                                 loadProgress = newProgress
                             }
 
+                            override fun onShowFileChooser(
+                                view: WebView?,
+                                filePathCallback: ValueCallback<Array<android.net.Uri>>?,
+                                fileChooserParams: FileChooserParams?,
+                            ): Boolean {
+                                pendingFileChooser?.onReceiveValue(null)
+                                pendingFileChooser = filePathCallback
+                                val intent = fileChooserParams?.createIntent()
+                                if (intent == null) {
+                                    pendingFileChooser = null
+                                    return false
+                                }
+                                return try {
+                                    fileChooserLauncher.launch(intent)
+                                    true
+                                } catch (_: Exception) {
+                                    pendingFileChooser = null
+                                    false
+                                }
+                            }
+
                             // Wallet QR scanner: grant the page camera access.
                             // Only video capture is granted — anything else the
                             // page asks for is denied as before.
@@ -446,22 +708,24 @@ fun WebViewScreen(
                             }
                         }
 
-                        // Two-finger hold (500ms) → navigate to remote input
-                        var twoFingerStart = 0L
-                        var twoFingerFired = false
+                        // Three-finger hold (500ms) → navigate to remote input.
+                        // Three fingers, not two: two-finger scroll/pinch on the
+                        // page collided with the old two-finger hold.
+                        var threeFingerStart = 0L
+                        var threeFingerFired = false
                         setOnTouchListener { _, event ->
                             val pointerCount = event.pointerCount
                             when (event.actionMasked) {
                                 android.view.MotionEvent.ACTION_POINTER_DOWN -> {
-                                    if (pointerCount >= 2) {
-                                        twoFingerStart = System.currentTimeMillis()
-                                        twoFingerFired = false
+                                    if (pointerCount >= 3) {
+                                        threeFingerStart = System.currentTimeMillis()
+                                        threeFingerFired = false
                                     }
                                 }
                                 android.view.MotionEvent.ACTION_MOVE -> {
-                                    if (pointerCount >= 2 && !twoFingerFired && twoFingerStart > 0) {
-                                        if (System.currentTimeMillis() - twoFingerStart > 500) {
-                                            twoFingerFired = true
+                                    if (pointerCount >= 3 && !threeFingerFired && threeFingerStart > 0) {
+                                        if (System.currentTimeMillis() - threeFingerStart > 500) {
+                                            threeFingerFired = true
                                             onRemoteInput()
                                         }
                                     }
@@ -469,8 +733,8 @@ fun WebViewScreen(
                                 android.view.MotionEvent.ACTION_UP,
                                 android.view.MotionEvent.ACTION_POINTER_UP,
                                 android.view.MotionEvent.ACTION_CANCEL -> {
-                                    if (event.pointerCount <= 2) {
-                                        twoFingerStart = 0L
+                                    if (event.pointerCount <= 3) {
+                                        threeFingerStart = 0L
                                     }
                                 }
                             }
@@ -478,7 +742,21 @@ fun WebViewScreen(
                         }
 
                         webView = this
-                        loadUrl(serverUrl)
+                        if (reused == null) {
+                            KioskWebView.instance = this
+                            KioskWebView.url = serverUrl
+                            loadUrl(initialUrl)
+                        } else {
+                            // Reattached views keep stale measurements until an
+                            // input event — that was the top/bottom UI being
+                            // wrong until a tap. Force a fresh pass, and re-sync
+                            // the page's safe-area vars while we're at it.
+                            post {
+                                requestLayout()
+                                invalidate()
+                                injectSafeAreaVars(this)
+                            }
+                        }
                     }
                 },
             )
@@ -497,15 +775,81 @@ fun WebViewScreen(
                 )
             }
 
+            // Branded first-load screen while the mesh session comes up.
+            AnimatedVisibility(
+                visible = isLoading && !firstLoadDone,
+                enter = fadeIn(),
+                exit = fadeOut(),
+            ) {
+                Column(
+                    Modifier.fillMaxSize().background(SurfaceBlack),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.Center,
+                ) {
+                    Text(
+                        buildAnnotatedString {
+                            withStyle(SpanStyle(color = ErrorRed)) { append("F*CK") }
+                            withStyle(SpanStyle(color = TextPrimary)) { append(" IPS") }
+                        },
+                        fontSize = 40.sp,
+                        fontWeight = FontWeight.Black,
+                        letterSpacing = 4.sp,
+                        textAlign = TextAlign.Center,
+                    )
+                    Spacer(Modifier.height(10.dp))
+                    Text(
+                        "connecting to your archipelago",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        letterSpacing = 1.sp,
+                    )
+                    Spacer(Modifier.height(28.dp))
+                    CircularProgressIndicator(color = BitcoinOrange)
+                }
+            }
+
             // In-app browser overlay for non-iframeable node apps. Rendered last
             // so it sits above the kiosk WebView, which stays alive underneath.
             inAppUrl?.let { target ->
                 InAppBrowser(
                     url = target,
                     serverUrl = serverUrl,
+                    meshUrl = meshFallbackUrl,
                     onClose = { inAppUrl = null },
                 )
             }
+
+            // Native wallet QR scanner, opened by the page via ArchipelagoQr.
+            WalletQrScannerModal(
+                visible = walletScannerVisible,
+                status = walletScannerStatus,
+                onDecoded = { text ->
+                    webView?.evaluateJavascript(
+                        "window.__archyQrResult && window.__archyQrResult(${JSONObject.quote(text)})",
+                        null,
+                    )
+                },
+                onDismiss = {
+                    walletScannerVisible = false
+                    webView?.evaluateJavascript(
+                        "window.__archyQrCancelled && window.__archyQrCancelled()",
+                        null,
+                    )
+                },
+            )
+
+            // First-launch teaching overlay for the three-finger hold — armed
+            // ~2 minutes after login so it never fights the splash/first look.
+            if (gestureHintReady && !gestureHintSeen && !gestureHintDismissed &&
+                !isLoading && inAppUrl == null
+            ) {
+                GestureHintOverlay(
+                    onDismiss = {
+                        gestureHintDismissed = true
+                        scope.launch { prefs.markGestureHintSeen() }
+                    },
+                )
+            }
         }
     }
 }
@@ -544,9 +888,14 @@ private fun fetchFavicon(pageUrl: String): Bitmap? {
 private fun InAppBrowser(
     url: String,
     serverUrl: String,
+    meshUrl: String? = null,
     onClose: () -> Unit,
 ) {
     val context = LocalContext.current
+    // Same-node check across BOTH node addresses (LAN + mesh ULA) — see the
+    // kiosk's isSameNode; a mismatch here bounced app links to the browser.
+    fun isSameNode(u: String): Boolean =
+        isSameHost(u, serverUrl) || (meshUrl != null && isSameHost(u, meshUrl))
     var browser by remember { mutableStateOf<WebView?>(null) }
     var title by remember { mutableStateOf(android.net.Uri.parse(url).host ?: url) }
     var favicon by remember { mutableStateOf<Bitmap?>(null) }
@@ -586,7 +935,13 @@ private fun InAppBrowser(
         modifier = Modifier
             .fillMaxSize()
             .background(SurfaceBlack)
-            .windowInsetsPadding(WindowInsets.safeDrawing),
+            // Bottom inset handled by the touch-shield strip below the bar —
+            // NOT by padding: a padded area only paints, it doesn't consume,
+            // so taps in the gesture strip fell straight THROUGH this overlay
+            // into the kiosk's tab bar behind it (accidental AIUI-tab hits).
+            .windowInsetsPadding(
+                WindowInsets.safeDrawing.only(WindowInsetsSides.Horizontal + WindowInsetsSides.Top)
+            ),
     ) {
         // WebView + loading overlay fill the area above the bottom control bar.
         Box(modifier = Modifier.weight(1f).fillMaxWidth()) {
@@ -660,7 +1015,7 @@ private fun InAppBrowser(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameHost(u, serverUrl)) {
+                                if (u != null && isSameNode(u)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -674,7 +1029,7 @@ private fun InAppBrowser(
                                 val u = request?.url?.toString() ?: return false
                                 // Stay in the overlay for same-node navigation;
                                 // hand genuinely external links to the real browser.
-                                if (isSameHost(u, serverUrl)) return false
+                                if (isSameNode(u)) return false
                                 openExternalUrl(ctx, u)
                                 return true
                             }
@@ -775,6 +1130,21 @@ private fun InAppBrowser(
                 )
             }
         }
+
+        // Touch-shield over the gesture-nav strip: solid black AND consumes
+        // taps — stray touches below the control bar landed on the kiosk's
+        // tab bar behind this overlay (opening the AIUI chat by accident).
+        Box(
+            Modifier
+                .fillMaxWidth()
+                .windowInsetsBottomHeight(WindowInsets.navigationBars)
+                .background(Color.Black)
+                .clickable(
+                    interactionSource = remember { MutableInteractionSource() },
+                    indication = null,
+                    onClick = {},
+                ),
+        )
     }
 }
 

Android/app/src/main/res/values/strings.xml

@@ -11,6 +11,7 @@
     <string name="welcome_title">Your Sovereign\nPersonal Server</string>
     <string name="welcome_subtitle">Bitcoin node, app platform, and private cloud — all in one box you control.</string>
     <string name="get_started">Get Started</string>
+    <string name="mesh_party">Mesh Party</string>
     <string name="use_https">Use HTTPS</string>
     <string name="port_label">Port (optional)</string>
     <string name="saved_servers">Saved Servers</string>
@@ -41,4 +42,11 @@
     <string name="edit_server_title">Edit Server</string>
     <string name="save_changes">Save Changes</string>
     <string name="cancel">Cancel</string>
+    <string name="gesture_hint_title">Hold with three fingers</string>
+    <string name="gesture_hint_body">Anywhere in the app — opens the remote control and menu</string>
+    <string name="gesture_hint_got_it">Got it</string>
+    <string name="scan_to_send">Scan to send</string>
+    <string name="scan_wallet_hint">Point the camera at a Lightning invoice, Bitcoin address, Cashu or Fedimint code</string>
+    <string name="upload_qr_image">Upload image</string>
+    <string name="no_qr_in_image">No QR code found in that image — try another, closer and well-lit</string>
 </resources>

Android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- FileProvider scope for the party-screen "Share this app" APK handoff. -->
+<paths>
+    <cache-path name="share" path="share/" />
+</paths>

Android/rust/archy-fips-core/Cargo.toml

@@ -0,0 +1,48 @@
+# Embedded FIPS mesh node for the Archipelago companion app.
+#
+# Built for Android via cargo-ndk (see Android/app/build.gradle.kts, task
+# buildRustArm64) into app/src/main/jniLibs/arm64-v8a/libarchy_fips_core.so.
+# Also builds on the host so `cargo test` covers the non-JNI logic.
+#
+# `fips` is pinned to the fips-native fork rev that this integration was
+# developed against — the fork carries Android support upstream lacks
+# (Tun::from_fd for a VpnService-owned fd, cfg(target_os = "android") paths).
+# Override with a local checkout when hacking on fips itself:
+#   CARGO_NET_OFFLINE=false cargo ndk ... --config 'patch."https://github.com/9qeklajc/fips-native".fips.path="/path/to/fips-native/fips"'
+[package]
+name = "archy-fips-core"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+publish = false
+
+[lib]
+name = "archy_fips_core"
+# rlib for host tests; cdylib for the Android shared library.
+crate-type = ["lib", "cdylib"]
+
+[dependencies]
+# default-features drops the ratatui TUI; tun-support enables Node::start_with_tun_fd.
+# Zazawowow/fips-native `fast-join-pinned` = upstream pinned rev 46494a74 +
+# discovery re-fire on topology change (fresh 5G join: first route no longer
+# waits out doomed pre-join lookups). Upstream 9qeklajc denies pushes.
+fips = { git = "https://github.com/Zazawowow/fips-native", rev = "07d21d4482be56b14295d2525e41f8386d1bfe6f", default-features = false, features = ["tun-support"] }
+anyhow = "1.0"
+serde_json = "1.0"
+hex = "0.4"
+# OS CSPRNG for identity generation (crypto rule: no thread-local RNG for keys).
+getrandom = "0.2"
+tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros"] }
+tracing = "0.1"
+# fcntl: force the VpnService TUN fd into blocking mode (see mesh::start).
+libc = "0.2"
+
+# The JNI surface only exists on Android; host builds skip it and drive the
+# mesh module directly (tests).
+[target.'cfg(target_os = "android")'.dependencies]
+jni = "0.21"
+# Bridge `tracing` (ours + fips) to logcat: `adb logcat -s archy-fips`.
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+paranoid-android = "0.2"
+
+[workspace]

Android/rust/archy-fips-core/src/jni_glue.rs

@@ -0,0 +1,129 @@
+//! JNI surface for `com.archipelago.app.fips.FipsNative` — JSON over strings,
+//! no codegen (the myco / nostr-vpn embedding pattern). Errors come back as
+//! `{"error": "…"}` so Kotlin never sees a raw exception from native code.
+
+use std::sync::Once;
+
+use jni::objects::{JClass, JString};
+use jni::sys::{jboolean, jint, jstring};
+use jni::JNIEnv;
+
+use crate::mesh;
+
+static LOG_INIT: Once = Once::new();
+
+fn init_logging() {
+    LOG_INIT.call_once(|| {
+        use tracing_subscriber::layer::SubscriberExt;
+        use tracing_subscriber::util::SubscriberInitExt;
+        let _ = tracing_subscriber::registry()
+            .with(tracing_subscriber::EnvFilter::new("info"))
+            .with(paranoid_android::layer("archy-fips"))
+            .try_init();
+    });
+}
+
+fn jstr(env: &mut JNIEnv, s: &JString) -> String {
+    env.get_string(s).map(|s| s.into()).unwrap_or_default()
+}
+
+fn out(env: &JNIEnv, s: String) -> jstring {
+    env.new_string(s)
+        .map(|s| s.into_raw())
+        .unwrap_or(std::ptr::null_mut())
+}
+
+fn err_json(e: impl std::fmt::Display) -> String {
+    serde_json::json!({ "error": e.to_string() }).to_string()
+}
+
+fn identity_json(info: &mesh::IdentityInfo) -> String {
+    serde_json::json!({
+        "secret": info.secret_hex,
+        "npub": info.npub,
+        "address": info.address,
+    })
+    .to_string()
+}
+
+/// Kotlin: `external fun generateIdentity(): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_generateIdentity(
+    env: JNIEnv,
+    _class: JClass,
+) -> jstring {
+    init_logging();
+    let json = match mesh::generate_identity() {
+        Ok(info) => identity_json(&info),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun deriveIdentity(secret: String): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_deriveIdentity(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret: JString,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret);
+    let json = match mesh::derive_identity(&secret) {
+        Ok(info) => identity_json(&info),
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String`
+/// Returns `{"npub": "...", "address": "..."}` or `{"error": "..."}`.
+/// `listenPort` 0 = outbound-only; non-zero = fixed UDP bind (party mode).
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_start(
+    mut env: JNIEnv,
+    _class: JClass,
+    secret: JString,
+    peers_json: JString,
+    tun_fd: jint,
+    listen_port: jint,
+) -> jstring {
+    init_logging();
+    let secret = jstr(&mut env, &secret);
+    let peers = jstr(&mut env, &peers_json);
+    let listen_port = u16::try_from(listen_port).unwrap_or(0);
+    let json = match mesh::start(&secret, &peers, tun_fd, listen_port) {
+        Ok((npub, address)) => {
+            serde_json::json!({ "npub": npub, "address": address }).to_string()
+        }
+        Err(e) => err_json(e),
+    };
+    out(&env, json)
+}
+
+/// Kotlin: `external fun stop()`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_stop(
+    _env: JNIEnv,
+    _class: JClass,
+) {
+    mesh::stop();
+}
+
+/// Kotlin: `external fun isRunning(): Boolean`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_isRunning(
+    _env: JNIEnv,
+    _class: JClass,
+) -> jboolean {
+    mesh::is_running() as jboolean
+}
+
+/// Kotlin: `external fun statusJson(): String`
+#[no_mangle]
+pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_statusJson(
+    env: JNIEnv,
+    _class: JClass,
+) -> jstring {
+    out(&env, mesh::status_json())
+}

Android/rust/archy-fips-core/src/lib.rs

@@ -0,0 +1,17 @@
+//! Embedded FIPS mesh node for the Archipelago companion app.
+//!
+//! The phone runs a real, leaf-only FIPS node in-process: Android's
+//! `VpnService` owns the TUN fd (routing only `fd00::/8`, so normal traffic
+//! never touches the tunnel) and hands it to [`fips::Node::start_with_tun_fd`].
+//! Peering is outbound-only — the pairing QR carries the node's npub and
+//! transport endpoints, and FIPS nodes accept inbound peers without prior
+//! registration, so no server-side enrollment step exists.
+//!
+//! The JNI surface (`jni_glue`, Android-only) is deliberately tiny and
+//! JSON-over-strings, mirroring the myco / nostr-vpn embedding pattern:
+//! `generateIdentity`, `deriveIdentity`, `start`, `stop`, `isRunning`.
+
+pub mod mesh;
+
+#[cfg(target_os = "android")]
+mod jni_glue;

Android/rust/archy-fips-core/src/mesh.rs

@@ -0,0 +1,295 @@
+//! Mesh lifecycle: identity, config assembly, and the node task.
+//!
+//! Host-buildable (no JNI) so the config/identity logic is unit-testable;
+//! only [`start`] needs a real TUN fd and therefore only runs on-device.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use anyhow::{anyhow, Context, Result};
+use fips::config::{PeerConfig, TransportInstances, UdpConfig};
+use fips::{Config, Identity, Node};
+use tokio::sync::Notify;
+
+/// How long `start` waits for the node to come up (TUN attach + transports).
+const START_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// How long `stop` waits for the node task to drain.
+const STOP_TIMEOUT: Duration = Duration::from_secs(5);
+
+struct MeshHandle {
+    runtime: tokio::runtime::Runtime,
+    task: Option<tokio::task::JoinHandle<()>>,
+    shutdown: Arc<Notify>,
+    running: Arc<AtomicBool>,
+    npub: String,
+    address: String,
+}
+
+static MESH: Mutex<Option<MeshHandle>> = Mutex::new(None);
+
+#[derive(Debug, Clone)]
+pub struct IdentityInfo {
+    pub secret_hex: String,
+    pub npub: String,
+    /// The phone's own ULA on the mesh (fd::/8), for VpnService.addAddress.
+    pub address: String,
+}
+
+/// Generate a fresh mesh identity from the OS CSPRNG.
+pub fn generate_identity() -> Result<IdentityInfo> {
+    // ~1 in 2^128 chance a candidate is off the curve; loop regardless.
+    loop {
+        let mut bytes = [0u8; 32];
+        getrandom::getrandom(&mut bytes).context("OS RNG")?;
+        if let Ok(id) = Identity::from_secret_bytes(&bytes) {
+            return Ok(IdentityInfo {
+                secret_hex: hex::encode(bytes),
+                npub: id.npub(),
+                address: id.address().to_ipv6().to_string(),
+            });
+        }
+    }
+}
+
+/// Re-derive npub + ULA from a stored secret.
+pub fn derive_identity(secret: &str) -> Result<IdentityInfo> {
+    let id = Identity::from_secret_str(secret).map_err(|e| anyhow!("bad secret: {e}"))?;
+    Ok(IdentityInfo {
+        secret_hex: secret.to_string(),
+        npub: id.npub(),
+        address: id.address().to_ipv6().to_string(),
+    })
+}
+
+/// Build the phone-side node config: leaf-only (never routes third-party
+/// traffic — battery), no DNS responder, TUN enabled but attached to the
+/// VpnService fd rather than created.
+///
+/// `listen_port` 0 = ephemeral UDP (outbound-only, the default posture).
+/// Non-zero = fixed UDP bind so a nearby phone can dial us directly over a
+/// local link (party mode); leaf_only still guarantees we never carry
+/// third-party transit even while accepting an inbound link.
+pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> Config {
+    let mut cfg = Config::default();
+    cfg.node.identity.nsec = Some(secret.to_string());
+    cfg.node.identity.persistent = false;
+    cfg.node.leaf_only = true;
+    cfg.tun.enabled = true;
+    cfg.tun.mtu = Some(1280);
+    cfg.dns.enabled = false;
+    cfg.transports.udp = TransportInstances::Single(UdpConfig {
+        bind_addr: Some(format!("0.0.0.0:{listen_port}")),
+        ..Default::default()
+    });
+    // TCP with no bind_addr = outbound-only (fallback when UDP is blocked).
+    cfg.transports.tcp = TransportInstances::Single(Default::default());
+    // Fast-connect profile — a phone opens the app and expects the node NOW.
+    // Stock pacing is tuned for always-on routers: a failed discovery backs
+    // off 30s, session resends gap out to 8-16s, dead links redial at
+    // 5s→300s. Over 5G that stacked into a ~40s first connect (observed
+    // 2026-07-24: anchor +10s, session +40s). Retries only fire while a
+    // link/session is down, so steady-state traffic is unchanged.
+    cfg.node.retry.base_interval_secs = 1; // dead-link redial 1s,2s,4s…
+    cfg.node.retry.max_backoff_secs = 30; // …capped at 30s, not 5 min
+    cfg.node.retry.max_retries = 30;
+    cfg.node.rate_limit.handshake_resend_interval_ms = 400;
+    cfg.node.rate_limit.handshake_resend_backoff = 1.5;
+    cfg.node.rate_limit.handshake_max_resends = 10;
+    cfg.node.discovery.backoff_base_secs = 1; // failed lookup retries fast
+    cfg.node.discovery.backoff_max_secs = 30;
+    cfg.node.discovery.retry_interval_secs = 2;
+    cfg.node.discovery.max_attempts = 3;
+    // Lookups launched before the tree position settles are doomed; a 10s
+    // completion timeout made each one cost 10s before the 1s retry could
+    // fire (observed: 19s to a route on a fresh join). Fail fast instead —
+    // the resend-within-window above still gives each attempt two shots.
+    cfg.node.discovery.timeout_secs = 5;
+    cfg.peers = peers;
+    cfg
+}
+
+/// Parse the peers JSON handed over from Kotlin. Shape = fips `PeerConfig`:
+/// `[{"npub":"…","alias":"…","addresses":[{"transport":"udp","addr":"host:2121","priority":10},…]}]`
+pub fn parse_peers(peers_json: &str) -> Result<Vec<PeerConfig>> {
+    serde_json::from_str(peers_json).context("peers JSON")
+}
+
+/// Start the mesh node on the given TUN fd (from `VpnService.establish()`,
+/// detached — the node owns it from here). Returns (npub, ula) on success.
+/// Any previously running node is stopped first.
+pub fn start(secret: &str, peers_json: &str, tun_fd: i32, listen_port: u16) -> Result<(String, String)> {
+    stop();
+
+    // Android hands the VpnService TUN fd over in non-blocking mode on some
+    // OS builds. The fips TUN reader is a dedicated blocking-read thread that
+    // treats EAGAIN as fatal — the loop died at startup ("TUN read error …
+    // Try again (os error 11)" on-device), so sessions came up but no packet
+    // ever entered the mesh. Force the fd into the blocking mode the reader
+    // is designed for.
+    unsafe {
+        let flags = libc::fcntl(tun_fd, libc::F_GETFL);
+        if flags >= 0 && (flags & libc::O_NONBLOCK) != 0 {
+            libc::fcntl(tun_fd, libc::F_SETFL, flags & !libc::O_NONBLOCK);
+        }
+    }
+
+    let peers = parse_peers(peers_json)?;
+    let config = build_config(secret, peers, listen_port);
+    let mut node = Node::new(config).map_err(|e| anyhow!("node init: {e}"))?;
+    let npub = node.npub();
+    let address = node.identity().address().to_ipv6().to_string();
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .thread_name("archy-fips")
+        .build()
+        .context("tokio runtime")?;
+
+    let shutdown = Arc::new(Notify::new());
+    let running = Arc::new(AtomicBool::new(false));
+    let (started_tx, started_rx) = tokio::sync::oneshot::channel::<Result<()>>();
+
+    let task = {
+        let shutdown = shutdown.clone();
+        let running = running.clone();
+        runtime.spawn(async move {
+            match node.start_with_tun_fd(tun_fd).await {
+                Ok(()) => {
+                    running.store(true, Ordering::SeqCst);
+                    let _ = started_tx.send(Ok(()));
+                }
+                Err(e) => {
+                    let _ = started_tx.send(Err(anyhow!("node start: {e}")));
+                    return;
+                }
+            }
+            tokio::select! {
+                result = node.run_rx_loop() => {
+                    if let Err(e) = result {
+                        tracing::error!("mesh rx loop error: {e}");
+                    }
+                }
+                _ = shutdown.notified() => {}
+            }
+            if let Err(e) = node.stop().await {
+                tracing::warn!("mesh stop: {e}");
+            }
+            running.store(false, Ordering::SeqCst);
+        })
+    };
+
+    let started = runtime
+        .block_on(async { tokio::time::timeout(START_TIMEOUT, started_rx).await })
+        .map_err(|_| anyhow!("node start timed out"))?
+        .map_err(|_| anyhow!("node task died during start"))?;
+    if let Err(e) = started {
+        runtime.shutdown_background();
+        return Err(e);
+    }
+
+    *MESH.lock().unwrap() = Some(MeshHandle {
+        runtime,
+        task: Some(task),
+        shutdown,
+        running,
+        npub: npub.clone(),
+        address: address.clone(),
+    });
+    Ok((npub, address))
+}
+
+/// Stop the mesh node if running. Idempotent.
+pub fn stop() {
+    let Some(mut handle) = MESH.lock().unwrap().take() else {
+        return;
+    };
+    handle.shutdown.notify_waiters();
+    if let Some(task) = handle.task.take() {
+        let _ = handle
+            .runtime
+            .block_on(async { tokio::time::timeout(STOP_TIMEOUT, task).await });
+    }
+    handle.runtime.shutdown_background();
+}
+
+pub fn is_running() -> bool {
+    MESH.lock()
+        .unwrap()
+        .as_ref()
+        .map(|h| h.running.load(Ordering::SeqCst))
+        .unwrap_or(false)
+}
+
+/// `{running, npub, address}` for the Kotlin status surface.
+pub fn status_json() -> String {
+    let guard = MESH.lock().unwrap();
+    match guard.as_ref() {
+        Some(h) => serde_json::json!({
+            "running": h.running.load(Ordering::SeqCst),
+            "npub": h.npub,
+            "address": h.address,
+        })
+        .to_string(),
+        None => serde_json::json!({ "running": false }).to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn identity_roundtrip() {
+        let a = generate_identity().unwrap();
+        let b = derive_identity(&a.secret_hex).unwrap();
+        assert_eq!(a.npub, b.npub);
+        assert_eq!(a.address, b.address);
+        // ULA in fd::/8
+        assert!(a.address.starts_with("fd"));
+    }
+
+    #[test]
+    fn peers_json_parses_into_peer_config() {
+        let peers = parse_peers(
+            r#"[{
+                "npub": "npub1abc",
+                "alias": "My Archipelago",
+                "addresses": [
+                    {"transport": "udp", "addr": "192.168.1.228:2121", "priority": 10},
+                    {"transport": "tcp", "addr": "192.168.1.228:8443", "priority": 20}
+                ]
+            }]"#,
+        )
+        .unwrap();
+        assert_eq!(peers.len(), 1);
+        assert_eq!(peers[0].addresses.len(), 2);
+        assert!(peers[0].is_auto_connect());
+    }
+
+    #[test]
+    fn config_is_leaf_only_with_tun() {
+        let id = generate_identity().unwrap();
+        let cfg = build_config(&id.secret_hex, vec![], 0);
+        assert!(cfg.node.leaf_only);
+        assert!(cfg.tun.enabled);
+        assert_eq!(cfg.tun.mtu(), 1280);
+        assert!(!cfg.dns.enabled);
+        assert!(!cfg.transports.udp.is_empty());
+        assert!(!cfg.transports.tcp.is_empty());
+    }
+
+    #[test]
+    fn listen_port_sets_fixed_udp_bind() {
+        let id = generate_identity().unwrap();
+        let cfg = build_config(&id.secret_hex, vec![], 2121);
+        // Party mode keeps leaf_only — accepting a link is not routing transit.
+        assert!(cfg.node.leaf_only);
+        let TransportInstances::Single(udp) = &cfg.transports.udp else {
+            panic!("expected single UDP transport");
+        };
+        assert_eq!(udp.bind_addr.as_deref(), Some("0.0.0.0:2121"));
+    }
+}

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## v1.7.113-alpha (2026-07-25)
+
+- Fixed a money bug in Cashu ecash sends: the token you handed a recipient could carry your own change proofs along with it, letting the same sats be credited twice. Change now stays in your wallet — only the amount you meant to send leaves it.
+- Closing a Lightning channel is no longer a leap of faith. The close used to hang (or time out with an error) even though it had actually gone through; it now comes back within seconds with the closing transaction ID. Channels mid-close appear in the channel list as Closing or Force-closing with their transaction attached, and a new closed-channels history keeps past closes visible instead of letting them vanish from the list.
+- The wallet card now leads with your total bitcoin across everything, and the on-chain balance gets its own chain icon so the rows read at a glance.
+- The companion phone app (0.5.15) connects dramatically faster away from home: a cold connect over 5G dropped from 40+ seconds to about 5. First connects no longer stall on unreachable mesh dial hints, fresh joins fail fast and retry instead of waiting out long timeouts, and the phone re-announces itself the moment the network around it changes. The node side's mesh-join handling was hardened to match.
+
+## v1.7.112-alpha (2026-07-23)
+
+- Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.
+- Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.
+- The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.
+- Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.
+- Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.
+- The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.
+- Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.
+- Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.
+- Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.
+- Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.
+- Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.
+- A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.
+- Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.
+- If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.
+- Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.
+- Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.
+- Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.
+- Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.
+- The speaker now announces the very first mesh message a node ever receives, and DMs announce just like channel messages (a safety guard against announcement storms was quietly swallowing them). Announcements also react about twice as fast.
+- Opening a Lightning channel right after the node starts no longer fails with a scary red error. The node quietly retries while Lightning finishes waking up, and if it's still not ready you get a calm "still finishing its startup — try again shortly" notice instead.
+- Viewing a transaction works on every node now, including small ones. Nodes with pruned bitcoin storage can't run the Mempool explorer app; transaction links now open your choice of external explorer instead (tx1138.com by default) — after a clear one-time warning that a third-party server will see which transaction you looked up. Set your preferred explorer in Wallet Settings → the new On-chain tab.
+- Voice commands respond noticeably faster: speech recognition now transcribes in roughly half the time, with identical accuracy on short commands.
+- Scanning a Lightning invoice with your phone's camera is far more reliable — dense invoice QR codes that the photo scanner missed are now read by the phone's native barcode engine.
+- The companion app's pairing QR always contains an address your phone can actually reach. If you manage your node over a VPN (Tailscale), the QR used to embed the VPN address, and pairing silently failed; it now advertises the node's home-network address.
+- Peer requests sent from Nostr discovery now actually arrive: your node checks for incoming requests every five minutes by itself (previously they sat unseen until someone manually pressed "Poll"), requests publish to all your configured relays instead of two hardcoded ones, and a failed send tells you instead of pretending it worked.
+- The Connected Nodes list refreshes instantly. It previously froze for up to 30 seconds per offline peer while checking who's reachable, one peer at a time; the checks now run all at once in the background while the list shows immediately.
+- Apps opened from inside a window (like a transaction from the wallet) now animate smoothly on top instead of loading invisibly underneath.
+- Settings-style windows keep their tabs pinned at the top and their buttons pinned at the bottom; only the middle scrolls. The wallet's tabs are now Channels / Cashu / Fedi / Ark / On-chain so all five fit.
+- On the TV screen, menus no longer flash open and instantly close. And the interface never follows your computer's light/dark preference anymore — dropdowns and other native controls stay dark on every device.
+- Error messages tell you what's actually wrong: "Insufficient balance: need 80 sats, have 0 sats" now reaches your screen instead of "Operation failed. Check server logs."
+- Installing Mempool no longer refuses to start while ElectrumX is mid-resync (it connects by itself once ElectrumX is ready), and installs no longer fail just because the system was momentarily busy.
+- Much quieter logs: the node no longer tries to start containers that are already running (hundreds of harmless-but-alarming errors per day), and a node that's offline stops hammering unreachable servers every 30 seconds with rebuild attempts.
+- Phones pairing with the companion app connect over the node's embedded mesh for remote access, with instant QR pairing and per-device access tokens (contributed alongside this release).
+
 ## v1.7.111-alpha (2026-07-22)
 
 - Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — "what's the block height?", "how many peers am I connected to?", "is bitcoin synced?", "what's my Lightning balance?" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.

apps/fedimint-gateway/manifest.yml

@@ -9,13 +9,22 @@ app:
     pull_policy: if-not-present
     network: archy-net
     entrypoint: ["sh", "-lc"]
+    # The bitcoind host comes from $FM_BITCOIND_URL, filled by the
+    # {{BITCOIN_HOST}} derived-env below — it resolves to whichever bitcoin
+    # container is actually running (Knots, Core, or any future distro archy
+    # ships), so the gateway is never pinned to one node's container name.
+    # (Was hardcoded http://host.archipelago:8332 — the host gateway IP where
+    # bitcoind does not listen — which crash-looped the gateway, 2026-07-22.)
     custom_args:
       - >-
         if [ -f /lnd/tls.cert ] && [ -f /lnd/data/chain/bitcoin/mainnet/admin.macaroon ]; then
-          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url http://host.archipelago:8332 --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" lnd --lnd-rpc-host lnd:10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/data/chain/bitcoin/mainnet/admin.macaroon;
+          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url "$FM_BITCOIND_URL" --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" lnd --lnd-rpc-host lnd:10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/data/chain/bitcoin/mainnet/admin.macaroon;
         else
-          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url http://host.archipelago:8332 --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" ldk --ldk-lightning-port 9737 --ldk-alias archipelago-gateway;
+          exec gatewayd --data-dir /data --listen 0.0.0.0:8176 --bcrypt-password-hash "$FEDI_HASH" --network bitcoin --bitcoind-url "$FM_BITCOIND_URL" --bitcoind-username "$FM_BITCOIND_USERNAME" --bitcoind-password "$FM_BITCOIND_PASSWORD" ldk --ldk-lightning-port 9737 --ldk-alias archipelago-gateway;
         fi
+    derived_env:
+      - key: FM_BITCOIND_URL
+        template: "http://{{BITCOIN_HOST}}:8332"
     # The gateway's admin API is gated by a bcrypt password hash. Generate it on
     # first install (random password + its bcrypt hash, both 0600 rootless-owned)
     # so the app installs from its manifest alone — `fedimint-gateway-hash` holds

apps/fedimint/manifest.yml

@@ -21,6 +21,11 @@ app:
         template: fedimint://{{HOST_MDNS}}:8173
       - key: FM_API_URL
         template: ws://{{HOST_MDNS}}:8174
+      # Resolves to whichever bitcoin container is running (Knots/Core/future
+      # distro) instead of a hardcoded name — the guardian works on any node
+      # regardless of which Bitcoin software it runs.
+      - key: FM_BITCOIND_URL
+        template: "http://{{BITCOIN_HOST}}:8332"
     secret_env:
       - key: FM_BITCOIND_PASSWORD
         secret_file: bitcoin-rpc-password
@@ -62,7 +67,8 @@ app:
 
   environment:
     - FM_DATA_DIR=/data
-    - FM_BITCOIND_URL=http://bitcoin-knots:8332
+    # FM_BITCOIND_URL comes from derived_env ({{BITCOIN_HOST}}) above, not a
+    # hardcoded name — do not re-add it here.
     - FM_BITCOIND_USERNAME=archipelago
     - FM_BITCOIN_NETWORK=bitcoin
     - FM_BIND_P2P=0.0.0.0:8173

apps/pine-whisper/manifest.yml

@@ -1,7 +1,11 @@
 app:
   id: pine-whisper
   name: Pine Whisper (STT)
-  version: "3.4.1"
+  # App revision 3.4.2 = upstream wyoming-whisper 3.4.1 image + tuned args
+  # (--beam-size 1). Bumped past the image version so catalog-driven nodes
+  # pick up the args change; the pre-release form "3.4.1-1" would compare
+  # LOWER than 3.4.1 under semver and never roll out.
+  version: "3.4.2"
   description: Wyoming-protocol faster-whisper speech-to-text engine. Internal Pine voice-assistant stack member — turns speech captured by a PineVoice satellite into text for Home Assistant Assist.
   category: home
 
@@ -18,7 +22,11 @@ app:
     network_aliases: [pine-whisper]
     # The image entrypoint already binds tcp://0.0.0.0:10300; these args only
     # pick the model + language (mirrors the pine ha-stack.yml compose command).
-    custom_args: ["--model", "base-int8", "--language", "en"]
+    # --beam-size 1: the image default is 5 on x86 (1 on ARM). Benchmarked on
+    # framework-pt (i5-1135G7, base-int8): beam 1 transcribes the same text
+    # ~45% faster — the standard low-latency setting for short voice commands
+    # (HA's own whisper add-on defaults to 1).
+    custom_args: ["--model", "base-int8", "--language", "en", "--beam-size", "1"]
 
   dependencies:
     - storage: 2Gi

core/Cargo.lock

@@ -95,7 +95,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.111-alpha"
+version = "1.7.112-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
@@ -145,6 +145,7 @@ dependencies = [
  "serde_yaml",
  "serial2-tokio",
  "sha2 0.10.9",
+ "socket2 0.5.10",
  "tar",
  "tempfile",
  "thiserror 1.0.69",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.111-alpha"
+version = "1.7.113-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
@@ -22,6 +22,9 @@ iroh-swarm = ["dep:iroh", "dep:iroh-blobs"]
 [dependencies]
 # Core dependencies
 tokio = { version = "1", features = ["full"] }
+# Mesh port mirror: needs IPV6_V6ONLY on [::] listeners so they coexist with
+# the containers' own 0.0.0.0 binds (std/tokio don't expose the sockopt).
+socket2 = "0.5"
 libc = "0.2"   # process-group signalling for the supervised reticulum daemon
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"

core/archipelago/src/api/handler/content.rs

@@ -188,7 +188,7 @@ impl ApiHandler {
             }
         };
         let price_sats = match &item.access {
-            content_server::AccessControl::Paid { price_sats } => *price_sats,
+            content_server::AccessControl::Paid { price_sats, .. } => *price_sats,
             _ => {
                 // Not a paid item — no invoice to issue.
                 return Ok(build_response(
@@ -198,6 +198,15 @@ impl ApiHandler {
                 ));
             }
         };
+        if !content_server::method_accepted(&item.access, "lightning") {
+            return Ok(build_response(
+                StatusCode::BAD_REQUEST,
+                "application/json",
+                hyper::Body::from(
+                    r#"{"error":"The seller does not accept Lightning for this item"}"#,
+                ),
+            ));
+        }
 
         let memo = format!("Archipelago peer file {content_id}");
         match self
@@ -315,7 +324,18 @@ impl ApiHandler {
             .unwrap_or_default();
         let price_sats = match catalog.items.iter().find(|i| i.id == content_id) {
             Some(i) => match &i.access {
-                content_server::AccessControl::Paid { price_sats } => *price_sats,
+                content_server::AccessControl::Paid { price_sats, .. } => {
+                    if !content_server::method_accepted(&i.access, "onchain") {
+                        return Ok(build_response(
+                            StatusCode::BAD_REQUEST,
+                            "application/json",
+                            hyper::Body::from(
+                                r#"{"error":"The seller does not accept on-chain payment for this item"}"#,
+                            ),
+                        ));
+                    }
+                    *price_sats
+                }
                 _ => {
                     return Ok(build_response(
                         StatusCode::BAD_REQUEST,

core/archipelago/src/api/rpc/auth.rs

@@ -9,6 +9,23 @@ impl RpcHandler {
         params: Option<serde_json::Value>,
     ) -> Result<serde_json::Value> {
         let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+
+        // Companion device-token login: minted via auth.createDeviceToken and
+        // carried by the pairing QR. Verified here so it shares the login rate
+        // limiter with password attempts.
+        if let Some(token) = params.get("token").and_then(|v| v.as_str()) {
+            return match crate::device_tokens::verify(&self.config.data_dir, token).await {
+                Some(device) => {
+                    tracing::info!("[onboarding] device-token login ({device})");
+                    Ok(serde_json::Value::Null)
+                }
+                None => {
+                    tracing::warn!("[onboarding] device-token login failed");
+                    Err(anyhow::anyhow!("Invalid device token"))
+                }
+            };
+        }
+
         let password = params
             .get("password")
             .and_then(|v| v.as_str())
@@ -32,6 +49,15 @@ impl RpcHandler {
 
         let valid = self.auth_manager.verify_password(password).await?;
         if !valid {
+            // The companion app sends its device token through the password
+            // field (it reuses the whole password auto-login path, including
+            // the WebView form). Accept a valid token here so that path works.
+            if let Some(device) =
+                crate::device_tokens::verify(&self.config.data_dir, password).await
+            {
+                tracing::info!("[onboarding] device-token login via password field ({device})");
+                return Ok(serde_json::Value::Null);
+            }
             tracing::warn!("[onboarding] login failed — wrong password");
             return Err(anyhow::anyhow!("Password Incorrect"));
         }
@@ -73,6 +99,56 @@ impl RpcHandler {
         Ok(serde_json::Value::Null)
     }
 
+    /// Mint a device token for the companion pairing QR. Session-gated by the
+    /// dispatcher (not in UNAUTHENTICATED_METHODS), so only a logged-in web UI
+    /// can mint one. The plaintext token is returned exactly once.
+    pub(super) async fn handle_auth_create_device_token(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let mut name = params
+            .as_ref()
+            .and_then(|p| p.get("name"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("companion")
+            .trim()
+            .to_string();
+        if name.is_empty() || name.len() > 64 {
+            return Err(anyhow::anyhow!("Device name must be 1-64 characters"));
+        }
+        // The default name was a single shared slot: every pairing popup
+        // replaced the previous phone's token, silently logging out the
+        // first phone the moment a second one paired. Default-named mints
+        // get a unique suffix so each device keeps its own credential;
+        // explicitly named devices keep replace-in-place semantics.
+        if name == "companion" {
+            name = format!("companion-{}", hex::encode(rand::random::<[u8; 2]>()));
+        }
+        let token = crate::device_tokens::create(&self.config.data_dir, &name).await?;
+        Ok(serde_json::json!({ "name": name, "token": token }))
+    }
+
+    pub(super) async fn handle_auth_list_device_tokens(&self) -> Result<serde_json::Value> {
+        let tokens = crate::device_tokens::list(&self.config.data_dir).await;
+        Ok(serde_json::json!(tokens
+            .iter()
+            .map(|t| serde_json::json!({ "name": t.name, "created": t.created }))
+            .collect::<Vec<_>>()))
+    }
+
+    pub(super) async fn handle_auth_revoke_device_token(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let name = params
+            .as_ref()
+            .and_then(|p| p.get("name"))
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing name"))?;
+        let removed = crate::device_tokens::remove(&self.config.data_dir, name).await?;
+        Ok(serde_json::json!({ "removed": removed }))
+    }
+
     pub(super) async fn handle_auth_logout(&self) -> Result<serde_json::Value> {
         tracing::info!("[onboarding] logout");
         Ok(serde_json::Value::Null)

core/archipelago/src/api/rpc/content.rs

@@ -179,7 +179,24 @@ impl RpcHandler {
                 if price == 0 {
                     return Err(anyhow::anyhow!("Paid content requires price_sats > 0"));
                 }
-                AccessControl::Paid { price_sats: price }
+                // Optional list of payment methods the sharer accepts.
+                // Absent/empty = all methods (backward compatible).
+                const KNOWN_METHODS: [&str; 4] = ["lightning", "onchain", "ecash", "fedimint"];
+                let accepted: Vec<String> = params
+                    .get("accepted_methods")
+                    .and_then(|v| v.as_array())
+                    .map(|arr| {
+                        arr.iter()
+                            .filter_map(|m| m.as_str())
+                            .filter(|m| KNOWN_METHODS.contains(m))
+                            .map(str::to_string)
+                            .collect()
+                    })
+                    .unwrap_or_default();
+                AccessControl::Paid {
+                    price_sats: price,
+                    accepted,
+                }
             }
             _ => return Err(anyhow::anyhow!("Invalid access type: {}", access_type)),
         };
@@ -412,6 +429,51 @@ impl RpcHandler {
             return Err(anyhow::anyhow!("Invalid v3 onion address"));
         }
 
+        // NEVER pay twice for content we already own (2026-07-22: a file
+        // shared twice produced two catalog ids for the same bytes and the
+        // buyer paid both). Guard BEFORE any ecash is minted, matching both
+        // by exact (onion, content_id) and by (onion, filename) — the latter
+        // catches duplicate ids pointing at the same file on the same
+        // seller. The owned copy is served from the local cache instead.
+        {
+            let filename = params.get("filename").and_then(|v| v.as_str());
+            let owned = crate::content_owned::list_owned(&self.config.data_dir).await;
+            let already = owned.iter().find(|o| {
+                o.onion == onion
+                    && (o.content_id == content_id
+                        || filename.is_some_and(|f| {
+                            !f.is_empty()
+                                && o.filename.trim_start_matches('/') == f.trim_start_matches('/')
+                        }))
+            });
+            if let Some(o) = already {
+                tracing::info!(
+                    onion,
+                    content_id,
+                    owned_as = %o.content_id,
+                    "paid download: already owned — serving cached copy, NOT paying again"
+                );
+                if let Some((mime, bytes)) =
+                    crate::content_owned::read_owned(&self.config.data_dir, &o.onion, &o.content_id)
+                        .await
+                {
+                    use base64::Engine;
+                    return Ok(serde_json::json!({
+                        "owned": true,
+                        "already_owned": true,
+                        "filename": o.filename,
+                        "mime_type": mime,
+                        "size_bytes": bytes.len(),
+                        "paid_sats": 0,
+                        "data_base64":
+                            base64::engine::general_purpose::STANDARD.encode(&bytes),
+                    }));
+                }
+                // Cache record exists but bytes are gone — fall through and
+                // repurchase rather than stranding the user.
+            }
+        }
+
         // `method` pins the backend the user confirmed in the UI ("cashu" |
         // "fedimint"); absent = auto (Cashu first, then Fedimint). The seller's
         // verify_payment_token accepts either, so a node whose balance lives in
@@ -590,6 +652,51 @@ impl RpcHandler {
             tracing::warn!("paid download: failed to cache purchased content (non-fatal): {e:#}");
         }
 
+        // Auto-file the purchase into the user's Files area (2026-07-22):
+        // Photos for images/video, Music for audio, Documents otherwise —
+        // same buckets the Cloud view uses. The in-app viewer still plays
+        // from the purchase cache; this makes the file ALSO show up where
+        // files live, on every device, without relying on a browser
+        // download. Best-effort: never fail a paid download over it.
+        {
+            let folder = if mime_type.starts_with("image/") || mime_type.starts_with("video/") {
+                "Photos"
+            } else if mime_type.starts_with("audio/") {
+                "Music"
+            } else {
+                "Documents"
+            };
+            let base = std::path::Path::new(&filename)
+                .file_name()
+                .and_then(|n| n.to_str())
+                .unwrap_or("download")
+                .to_string();
+            let dir = self.config.data_dir.join("filebrowser").join(folder);
+            if let Err(e) = tokio::fs::create_dir_all(&dir).await {
+                tracing::warn!("paid download: cannot create {}: {e}", dir.display());
+            } else {
+                // Don't clobber an existing file of the same name: "x.jpg"
+                // → "x (2).jpg" etc.
+                let mut target = dir.join(&base);
+                let (stem, ext) = match base.rsplit_once('.') {
+                    Some((s, e)) if !s.is_empty() => (s.to_string(), format!(".{e}")),
+                    _ => (base.clone(), String::new()),
+                };
+                let mut n = 2;
+                while target.exists() {
+                    target = dir.join(format!("{stem} ({n}){ext}"));
+                    n += 1;
+                }
+                match tokio::fs::write(&target, &bytes).await {
+                    Ok(()) => tracing::info!("paid download: filed into {}", target.display()),
+                    Err(e) => tracing::warn!(
+                        "paid download: filing into {} failed (non-fatal): {e}",
+                        target.display()
+                    ),
+                }
+            }
+        }
+
         use base64::Engine;
         let encoded = base64::engine::general_purpose::STANDARD.encode(&bytes);
 

core/archipelago/src/api/rpc/dispatcher.rs

@@ -26,6 +26,9 @@ impl RpcHandler {
             "auth.onboardingComplete" => self.handle_auth_onboarding_complete().await,
             "auth.isOnboardingComplete" => self.handle_auth_is_onboarding_complete().await,
             "auth.resetOnboarding" => self.handle_auth_reset_onboarding(params).await,
+            "auth.createDeviceToken" => self.handle_auth_create_device_token(params).await,
+            "auth.listDeviceTokens" => self.handle_auth_list_device_tokens().await,
+            "auth.revokeDeviceToken" => self.handle_auth_revoke_device_token(params).await,
 
             // Seed management (BIP-39 mnemonic)
             "seed.generate" => self.handle_seed_generate().await,
@@ -121,6 +124,7 @@ impl RpcHandler {
             }
             "lnd.getinfo" => self.handle_lnd_getinfo().await,
             "lnd.listchannels" => self.handle_lnd_listchannels().await,
+            "lnd.closedchannels" => self.handle_lnd_closedchannels().await,
             "lnd.openchannel" => self.handle_lnd_openchannel(params).await,
             "lnd.closechannel" => self.handle_lnd_closechannel(params).await,
             "lnd.newaddress" => self.handle_lnd_newaddress().await,
@@ -257,6 +261,7 @@ impl RpcHandler {
             "wallet.fedimint-join" => self.handle_wallet_fedimint_join(params).await,
             "wallet.fedimint-leave" => self.handle_wallet_fedimint_leave(params).await,
             "wallet.fedimint-balance" => self.handle_wallet_fedimint_balance().await,
+            "wallet.fedimint-send" => self.handle_wallet_fedimint_send(params).await,
 
             // Ark protocol (via barkd sidecar)
             "wallet.ark-status" => self.handle_wallet_ark_status().await,
@@ -383,6 +388,7 @@ impl RpcHandler {
 
             // Mesh networking (Meshcore LoRa)
             "mesh.status" => self.handle_mesh_status().await,
+            "mesh.probe-device" => self.handle_mesh_probe_device(params).await,
             "mesh.peers" => self.handle_mesh_peers().await,
             "mesh.messages" => self.handle_mesh_messages(params).await,
             "mesh.debug-dump" => self.handle_mesh_debug_dump().await,
@@ -486,6 +492,7 @@ impl RpcHandler {
 
             // FIPS mesh transport
             "fips.status" => self.handle_fips_status().await,
+            "fips.pair-info" => self.handle_fips_pair_info().await,
             "fips.check-update" => self.handle_fips_check_update().await,
             "fips.apply-update" => self.handle_fips_apply_update().await,
             "fips.install" => self.handle_fips_install().await,

core/archipelago/src/api/rpc/fedimint.rs

@@ -118,6 +118,31 @@ impl RpcHandler {
         Ok(serde_json::json!({ "removed": removed }))
     }
 
+    /// `wallet.fedimint-send` — spend ecash notes from any joined federation
+    /// with sufficient balance. Returns the notes token for the recipient
+    /// (rendered as text + QR by the send modal — the wallet's Fedi rail,
+    /// split from Cashu 2026-07-22). The heavy lifting already existed in
+    /// `fedimint_client::spend_from_any`; it was simply never exposed.
+    pub(super) async fn handle_wallet_fedimint_send(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let amount_sats = params
+            .as_ref()
+            .and_then(|p| p.get("amount_sats"))
+            .and_then(|v| v.as_u64())
+            .ok_or_else(|| anyhow::anyhow!("Missing amount_sats"))?;
+        anyhow::ensure!(amount_sats > 0, "must be at least 1 sat");
+        let (token, federation_id) =
+            crate::wallet::fedimint_client::spend_from_any(&self.config.data_dir, amount_sats)
+                .await?;
+        Ok(serde_json::json!({
+            "token": token,
+            "federation_id": federation_id,
+            "amount_sats": amount_sats,
+        }))
+    }
+
     /// `wallet.fedimint-balance` — total sats across all joined federations.
     pub(super) async fn handle_wallet_fedimint_balance(&self) -> Result<serde_json::Value> {
         // Soft-fail to zero when clientd isn't installed/running, so the unified

core/archipelago/src/api/rpc/fips.rs

@@ -16,6 +16,55 @@ impl RpcHandler {
         Ok(serde_json::to_value(status)?)
     }
 
+    /// Everything the companion app needs to join this node's mesh, embedded
+    /// in the pairing QR by the web UI: the daemon's npub (identity to dial),
+    /// the fips0 ULA (where the UI is reachable once the phone is meshed),
+    /// and the transport ports on this host. The QR builder supplies the
+    /// host/IP itself — it knows which origin the browser reached the node on.
+    pub(super) async fn handle_fips_pair_info(&self) -> Result<serde_json::Value> {
+        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
+        let npub = crate::identity::fips_npub(&identity_dir)
+            .await?
+            .ok_or_else(|| {
+                anyhow::anyhow!("FIPS identity not provisioned yet — complete onboarding first")
+            })?;
+        let ula = fips::iface::fips0_ula().map(|ip| ip.to_string());
+        // The node's seed anchors ride along so the phone can rendezvous
+        // through the same public mesh points when the node's LAN endpoint
+        // isn't directly dialable (phone away from home, node behind NAT).
+        let mut anchor_list = fips::anchors::load(&self.config.data_dir)
+            .await
+            .unwrap_or_default();
+        // Pairing must always carry a public rendezvous point: without one the
+        // phone is IP-bound to the LAN host it scanned and goes dark the
+        // moment it leaves that network. This is a pairing hint only — the
+        // node's own anchor file is not modified, so an operator's removal of
+        // the default anchors still sticks for the node itself.
+        if !anchor_list
+            .iter()
+            .any(|a| a.npub == fips::anchors::ARCHY_ANCHOR_NPUB)
+        {
+            anchor_list.push(fips::anchors::archy_anchor());
+        }
+        let anchors = anchor_list
+            .into_iter()
+            .map(|a| {
+                serde_json::json!({
+                    "npub": a.npub,
+                    "addr": a.address,
+                    "transport": a.transport,
+                })
+            })
+            .collect::<Vec<_>>();
+        Ok(serde_json::json!({
+            "npub": npub,
+            "ula": ula,
+            "udp_port": fips::PUBLISHED_UDP_PORT,
+            "tcp_port": fips::DEFAULT_TCP_PORT,
+            "anchors": anchors,
+        }))
+    }
+
     pub(super) async fn handle_fips_check_update(&self) -> Result<serde_json::Value> {
         let check = fips::update::check().await?;
         Ok(serde_json::to_value(check)?)

core/archipelago/src/api/rpc/handshake.rs

@@ -86,7 +86,7 @@ impl RpcHandler {
             let did = crate::identity::did_key_from_pubkey_hex(&data.server_info.pubkey)
                 .unwrap_or_default();
             let version = data.server_info.version.clone();
-            let relays = self.config.nostr_relays.clone();
+            let relays = self.handshake_relays().await;
             let tor_proxy = self.config.nostr_tor_proxy.clone();
             tokio::spawn(async move {
                 if let Err(e) = nostr_handshake::publish_presence(
@@ -106,6 +106,17 @@ impl RpcHandler {
         Ok(serde_json::json!({ "enabled": enabled }))
     }
 
+    /// The relay set every handshake operation uses: the user-managed relay
+    /// list (Settings → Relays, `nostr_relays.json`) merged with the config
+    /// defaults. Before 2026-07-22 handshake send/poll used ONLY the two
+    /// hardcoded config relays (one of which is defunct) and ignored user
+    /// relay edits entirely — so a sender publishing where the receiver
+    /// never read was a routine, silent way for peer requests to vanish.
+    pub(super) async fn handshake_relays(&self) -> Vec<String> {
+        crate::nostr_relays::merged_relay_list(&self.config.data_dir, &self.config.nostr_relays)
+            .await
+    }
+
     /// Discover discoverable nodes via Nostr presence events.
     /// Returns (nostr_pubkey, npub, DID, version) only — never an onion.
     pub(super) async fn handle_handshake_discover(&self) -> Result<serde_json::Value> {
@@ -113,9 +124,10 @@ impl RpcHandler {
         // to query relays as long as the user is actively browsing — they're
         // an anonymous observer of presence events, not publishing anything.
         let identity_dir = self.config.data_dir.join("identity");
+        let relays = self.handshake_relays().await;
         let nodes = nostr_handshake::discover_nodes(
             &identity_dir,
-            &self.config.nostr_relays,
+            &relays,
             self.config.nostr_tor_proxy.as_deref(),
         )
         .await?;
@@ -161,7 +173,7 @@ impl RpcHandler {
             our_version,
             our_name,
             message,
-            &self.config.nostr_relays,
+            &self.handshake_relays().await,
             self.config.nostr_tor_proxy.as_deref(),
         )
         .await?;
@@ -191,6 +203,40 @@ impl RpcHandler {
     /// - `PeerReject`   → mark matching outbound row as `Rejected`
     ///
     /// Never auto-adds peers, never auto-responds, never sends our onion.
+    /// Background relay poll (2026-07-22): before this, `handshake.poll` ran
+    /// ONLY when a user opened Federation and pressed the Poll button — a
+    /// peer request sat on the relay until the target's operator happened to
+    /// click, i.e. for most nodes forever ("requests never arrive"). Runs the
+    /// same poll+dispatch as the RPC (the disabled gate inside still applies)
+    /// and nudges the websocket revision when anything new lands so open UIs
+    /// refresh immediately.
+    pub async fn background_handshake_poll(self: &std::sync::Arc<Self>) {
+        match self.handle_handshake_poll().await {
+            Ok(res) => {
+                let new = res
+                    .get("new_requests")
+                    .and_then(|v| v.as_array())
+                    .map(|a| a.len())
+                    .unwrap_or(0);
+                let applied = res
+                    .get("applied_invites")
+                    .and_then(|v| v.as_array())
+                    .map(|a| a.len())
+                    .unwrap_or(0);
+                if new > 0 || applied > 0 {
+                    tracing::info!(
+                        new_requests = new,
+                        applied_invites = applied,
+                        "handshake poll: inbound peer activity"
+                    );
+                    let (data, _) = self.state_manager.get_snapshot().await;
+                    self.state_manager.update_data(data).await;
+                }
+            }
+            Err(e) => tracing::debug!("background handshake poll failed: {e:#}"),
+        }
+    }
+
     pub(super) async fn handle_handshake_poll(&self) -> Result<serde_json::Value> {
         // Runtime gate: if the user hasn't enabled discoverability, don't
         // touch the relays. The poll endpoint is a hard no-op until they
@@ -207,9 +253,10 @@ impl RpcHandler {
             }));
         }
         let identity_dir = self.config.data_dir.join("identity");
+        let relays = self.handshake_relays().await;
         let handshakes = nostr_handshake::poll_handshakes(
             &identity_dir,
-            &self.config.nostr_relays,
+            &relays,
             self.config.nostr_tor_proxy.as_deref(),
             None,
         )

core/archipelago/src/api/rpc/lnd/channels.rs

@@ -5,6 +5,21 @@ use tracing::info;
 
 use super::LND_REST_BASE_URL;
 
+/// LND rejects RPCs with "server is still in the process of starting" for a
+/// short window after wallet unlock (p2p/graph subsystems still loading).
+/// Transient by design — match it so callers retry and, if it persists,
+/// surface a calm notice instead of a scary failure. The exact phrase below
+/// is what the frontend keys its softer (non-red) styling on.
+fn lnd_still_starting(msg: &str) -> bool {
+    let m = msg.to_ascii_lowercase();
+    m.contains("in the process of starting") || m.contains("server is still starting")
+}
+
+/// User-facing text for the still-starting state. Deliberately calm: this is
+/// a "wait a moment", not an error.
+const LND_STARTING_MSG: &str = "Your Lightning node is still finishing its startup — this \
+     usually takes a minute or two after the node comes online. Please try again shortly.";
+
 #[derive(Debug, Serialize)]
 struct ChannelInfo {
     chan_id: String,
@@ -15,6 +30,8 @@ struct ChannelInfo {
     active: bool,
     status: String,
     channel_point: String,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    closing_txid: String,
 }
 
 #[derive(Debug, Serialize)]
@@ -43,6 +60,10 @@ struct LndChannel {
 #[derive(Debug, Deserialize, Default)]
 struct LndPendingChannelsResponse {
     pending_open_channels: Option<Vec<LndPendingOpenChannel>>,
+    // Cooperative closes waiting for their closing tx to confirm
+    waiting_close_channels: Option<Vec<LndWaitingCloseChannel>>,
+    // Force closes serving out their timelock
+    pending_force_closing_channels: Option<Vec<LndForceClosingChannel>>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -50,6 +71,18 @@ struct LndPendingOpenChannel {
     channel: Option<LndPendingChannel>,
 }
 
+#[derive(Debug, Deserialize)]
+struct LndWaitingCloseChannel {
+    channel: Option<LndPendingChannel>,
+    closing_txid: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LndForceClosingChannel {
+    channel: Option<LndPendingChannel>,
+    closing_txid: Option<String>,
+}
+
 #[derive(Debug, Deserialize)]
 struct LndPendingChannel {
     remote_node_pub: Option<String>,
@@ -59,6 +92,52 @@ struct LndPendingChannel {
     channel_point: Option<String>,
 }
 
+impl LndPendingChannel {
+    fn into_channel_info(self, status: &str, closing_txid: Option<String>) -> ChannelInfo {
+        let parse = |s: &Option<String>| s.as_deref().and_then(|v| v.parse().ok()).unwrap_or(0);
+        ChannelInfo {
+            chan_id: String::new(),
+            remote_pubkey: self.remote_node_pub.clone().unwrap_or_default(),
+            capacity: parse(&self.capacity),
+            local_balance: parse(&self.local_balance),
+            remote_balance: parse(&self.remote_balance),
+            active: false,
+            status: status.into(),
+            channel_point: self.channel_point.unwrap_or_default(),
+            closing_txid: closing_txid.unwrap_or_default(),
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Default)]
+struct LndClosedChannelsResponse {
+    channels: Option<Vec<LndClosedChannel>>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LndClosedChannel {
+    chan_id: Option<String>,
+    remote_pubkey: Option<String>,
+    capacity: Option<String>,
+    settled_balance: Option<String>,
+    close_type: Option<String>,
+    closing_tx_hash: Option<String>,
+    channel_point: Option<String>,
+    close_height: Option<i64>,
+}
+
+#[derive(Debug, Serialize)]
+struct ClosedChannelInfo {
+    chan_id: String,
+    remote_pubkey: String,
+    capacity: i64,
+    settled_balance: i64,
+    close_type: String,
+    closing_tx_hash: String,
+    channel_point: String,
+    close_height: i64,
+}
+
 impl RpcHandler {
     pub(in crate::api::rpc) async fn handle_lnd_listchannels(&self) -> Result<serde_json::Value> {
         let (client, macaroon_hex) = self.lnd_client().await?;
@@ -116,6 +195,7 @@ impl RpcHandler {
                         "inactive".into()
                     },
                     channel_point: ch.channel_point.unwrap_or_default(),
+                    closing_txid: String::new(),
                 }
             })
             .collect();
@@ -123,31 +203,20 @@ impl RpcHandler {
         let mut pending_channels: Vec<ChannelInfo> = Vec::new();
         for pch in pending_resp.pending_open_channels.unwrap_or_default() {
             if let Some(ch) = pch.channel {
-                let capacity: i64 = ch
-                    .capacity
-                    .as_deref()
-                    .and_then(|s| s.parse().ok())
-                    .unwrap_or(0);
-                let local: i64 = ch
-                    .local_balance
-                    .as_deref()
-                    .and_then(|s| s.parse().ok())
-                    .unwrap_or(0);
-                let remote: i64 = ch
-                    .remote_balance
-                    .as_deref()
-                    .and_then(|s| s.parse().ok())
-                    .unwrap_or(0);
-                pending_channels.push(ChannelInfo {
-                    chan_id: String::new(),
-                    remote_pubkey: ch.remote_node_pub.unwrap_or_default(),
-                    capacity,
-                    local_balance: local,
-                    remote_balance: remote,
-                    active: false,
-                    status: "pending_open".into(),
-                    channel_point: ch.channel_point.unwrap_or_default(),
-                });
+                pending_channels.push(ch.into_channel_info("pending_open", None));
+            }
+        }
+        for wch in pending_resp.waiting_close_channels.unwrap_or_default() {
+            if let Some(ch) = wch.channel {
+                pending_channels.push(ch.into_channel_info("closing", wch.closing_txid));
+            }
+        }
+        for fch in pending_resp
+            .pending_force_closing_channels
+            .unwrap_or_default()
+        {
+            if let Some(ch) = fch.channel {
+                pending_channels.push(ch.into_channel_info("force_closing", fch.closing_txid));
             }
         }
 
@@ -251,25 +320,45 @@ impl RpcHandler {
                 "perm": false,
                 "timeout": "30"
             });
-            let connect_resp = client
-                .post(format!("{LND_REST_BASE_URL}/v1/peers"))
-                .header("Grpc-Metadata-macaroon", &macaroon_hex)
-                .json(&connect_body)
-                .timeout(std::time::Duration::from_secs(35))
-                .send()
-                .await
-                .context("Failed to connect to peer")?;
+            // Right after wallet unlock, LND's RPC answers while its p2p
+            // server is still spinning up, and every connect attempt gets
+            // "server is still in the process of starting". That's a
+            // transient state, not a failure — it clears in seconds — so
+            // retry quietly for ~30s before surfacing a calm, non-scary
+            // notice (the frontend styles LND_STARTING_MSG as info, not red).
+            let mut attempt = 0u32;
+            loop {
+                let connect_resp = client
+                    .post(format!("{LND_REST_BASE_URL}/v1/peers"))
+                    .header("Grpc-Metadata-macaroon", &macaroon_hex)
+                    .json(&connect_body)
+                    .timeout(std::time::Duration::from_secs(35))
+                    .send()
+                    .await
+                    .context("Failed to connect to peer")?;
 
-            if !connect_resp.status().is_success() {
+                if connect_resp.status().is_success() {
+                    break;
+                }
                 let body: serde_json::Value = connect_resp.json().await.unwrap_or_default();
                 let msg = body
                     .get("message")
                     .and_then(|v| v.as_str())
                     .unwrap_or("Unknown error");
                 // LND returns an error if we already have this peer — that is fine
-                if !msg.contains("already connected") {
-                    return Err(anyhow::anyhow!("Failed to connect to peer: {}", msg));
+                if msg.contains("already connected") {
+                    break;
                 }
+                if lnd_still_starting(msg) && attempt < 5 {
+                    attempt += 1;
+                    info!(attempt, "LND still starting — retrying peer connect in 6s");
+                    tokio::time::sleep(std::time::Duration::from_secs(6)).await;
+                    continue;
+                }
+                if lnd_still_starting(msg) {
+                    return Err(anyhow::anyhow!("{LND_STARTING_MSG}"));
+                }
+                return Err(anyhow::anyhow!("Failed to connect to peer: {}", msg));
             }
         }
 
@@ -305,12 +394,55 @@ impl RpcHandler {
                 .get("message")
                 .and_then(|v| v.as_str())
                 .unwrap_or("Unknown error");
+            if lnd_still_starting(msg) {
+                return Err(anyhow::anyhow!("{LND_STARTING_MSG}"));
+            }
             return Err(anyhow::anyhow!("Failed to open channel: {}", msg));
         }
 
         Ok(body)
     }
 
+    pub(in crate::api::rpc) async fn handle_lnd_closedchannels(&self) -> Result<serde_json::Value> {
+        let (client, macaroon_hex) = self.lnd_client().await?;
+
+        let resp: LndClosedChannelsResponse = client
+            .get(format!("{LND_REST_BASE_URL}/v1/channels/closed"))
+            .header("Grpc-Metadata-macaroon", &macaroon_hex)
+            .send()
+            .await
+            .context("LND REST connection failed")?
+            .json()
+            .await
+            .context("Failed to parse LND closed channels response")?;
+
+        let channels: Vec<ClosedChannelInfo> = resp
+            .channels
+            .unwrap_or_default()
+            .into_iter()
+            .map(|ch| ClosedChannelInfo {
+                chan_id: ch.chan_id.unwrap_or_default(),
+                remote_pubkey: ch.remote_pubkey.unwrap_or_default(),
+                capacity: ch
+                    .capacity
+                    .as_deref()
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(0),
+                settled_balance: ch
+                    .settled_balance
+                    .as_deref()
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(0),
+                close_type: ch.close_type.unwrap_or_default(),
+                closing_tx_hash: ch.closing_tx_hash.unwrap_or_default(),
+                channel_point: ch.channel_point.unwrap_or_default(),
+                close_height: ch.close_height.unwrap_or(0),
+            })
+            .collect();
+
+        Ok(serde_json::json!({ "channels": channels }))
+    }
+
     pub(in crate::api::rpc) async fn handle_lnd_closechannel(
         &self,
         params: Option<serde_json::Value>,
@@ -351,27 +483,35 @@ impl RpcHandler {
             "Closing Lightning channel"
         );
 
-        let (client, macaroon_hex) = self.lnd_client().await?;
+        let (_, macaroon_hex) = self.lnd_client().await?;
+
+        // The close endpoint is server-streaming: LND holds the connection
+        // open and emits updates until the closing tx CONFIRMS on-chain
+        // (potentially hours). Reading the whole body hangs the RPC even
+        // though the close already went through, and the shared lnd_client's
+        // 15s total timeout would abort the stream mid-read. Use a dedicated
+        // client and return as soon as the first streamed update arrives.
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .connect_timeout(std::time::Duration::from_secs(10))
+            .danger_accept_invalid_certs(true)
+            .build()
+            .context("Failed to create streaming HTTP client")?;
 
         let url = format!(
             "{LND_REST_BASE_URL}/v1/channels/{}/{}?force={}",
             parts[0], parts[1], force
         );
 
-        let resp = client
+        let mut resp = client
             .delete(&url)
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
             .context("Failed to close channel")?;
 
-        let status = resp.status();
-        let body: serde_json::Value = resp
-            .json()
-            .await
-            .context("Failed to parse close channel response")?;
-
-        if !status.is_success() {
+        if !resp.status().is_success() {
+            let body: serde_json::Value = resp.json().await.unwrap_or_default();
             let msg = body
                 .get("message")
                 .and_then(|v| v.as_str())
@@ -379,6 +519,56 @@ impl RpcHandler {
             return Err(anyhow::anyhow!("Failed to close channel: {}", msg));
         }
 
-        Ok(serde_json::json!({ "success": true }))
+        // First streamed line is {"result":{"close_pending":…}} on success or
+        // {"error":…} — the stream reports errors in-band after a 200.
+        let mut buf: Vec<u8> = Vec::new();
+        let first_update = tokio::time::timeout(std::time::Duration::from_secs(25), async {
+            while let Some(chunk) = resp.chunk().await? {
+                buf.extend_from_slice(&chunk);
+                let line = match buf.iter().position(|&b| b == b'\n') {
+                    Some(pos) => &buf[..pos],
+                    None => &buf[..],
+                };
+                if let Ok(v) = serde_json::from_slice::<serde_json::Value>(line) {
+                    return Ok::<_, anyhow::Error>(Some(v));
+                }
+            }
+            Ok(None)
+        })
+        .await;
+
+        match first_update {
+            Ok(Ok(Some(update))) => {
+                if let Some(err) = update.get("error") {
+                    let msg = err
+                        .get("message")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("Unknown error");
+                    return Err(anyhow::anyhow!("Failed to close channel: {}", msg));
+                }
+                // txid arrives base64-encoded in internal byte order; flip it
+                // into the display order explorers use.
+                use base64::Engine as _;
+                let closing_txid = update
+                    .pointer("/result/close_pending/txid")
+                    .and_then(|v| v.as_str())
+                    .and_then(|b64| base64::engine::general_purpose::STANDARD.decode(b64).ok())
+                    .map(|mut bytes| {
+                        bytes.reverse();
+                        hex::encode(bytes)
+                    })
+                    .unwrap_or_default();
+                info!(channel_point, closing_txid, "Channel close initiated");
+                Ok(serde_json::json!({ "success": true, "closing_txid": closing_txid }))
+            }
+            Ok(Ok(None)) => Err(anyhow::anyhow!(
+                "LND ended the close stream without an update — check the channel list"
+            )),
+            Ok(Err(e)) => Err(e).context("Failed reading close channel response"),
+            // No update inside the window: the close is almost certainly still
+            // negotiating with the peer — report initiated, the channel list
+            // will show it under Closing.
+            Err(_) => Ok(serde_json::json!({ "success": true, "closing_txid": "" })),
+        }
     }
 }

core/archipelago/src/api/rpc/lnd/mod.rs

@@ -56,6 +56,172 @@ pub(crate) async fn read_lnd_admin_macaroon() -> Result<Vec<u8>> {
     }
 }
 
+/// Real-time wallet push (user req 2026-07-22): the UI must reflect an
+/// incoming on-chain transaction the moment the node sees it, not on the
+/// next poll. Streams LND's `/v1/transactions/subscribe` — it fires on
+/// 0-conf mempool arrival AND again on each confirmation — and nudges the
+/// shared data-model revision on every event; /ws/db pushes that to every
+/// connected client and the frontend refetches wallet balance/transactions.
+/// Reconnects forever with capped backoff: LND restarting, wallet locked, or
+/// LND not installed yet all just mean "try again shortly".
+pub(crate) fn spawn_lnd_tx_watcher(state_manager: std::sync::Arc<crate::state::StateManager>) {
+    tokio::spawn(async move {
+        let mut delay = std::time::Duration::from_secs(5);
+        loop {
+            match stream_lnd_transactions(&state_manager).await {
+                // Stream ended cleanly (LND shutdown) — resume fast.
+                Ok(()) => delay = std::time::Duration::from_secs(5),
+                Err(e) => {
+                    tracing::debug!("lnd tx watcher: {e:#} — retrying in {delay:?}");
+                }
+            }
+            tokio::time::sleep(delay).await;
+            delay = (delay * 2).min(std::time::Duration::from_secs(120));
+        }
+    });
+}
+
+async fn stream_lnd_transactions(sm: &crate::state::StateManager) -> Result<()> {
+    let macaroon_hex = hex::encode(read_lnd_admin_macaroon().await?);
+    // Dedicated client: the shared lnd_client() carries a 15s total timeout,
+    // which would kill this deliberately long-lived stream.
+    let client = reqwest::Client::builder()
+        .no_proxy()
+        .connect_timeout(std::time::Duration::from_secs(10))
+        .danger_accept_invalid_certs(true)
+        .build()
+        .context("Failed to create streaming HTTP client")?;
+    let mut resp = client
+        .get(format!("{LND_REST_BASE_URL}/v1/transactions/subscribe"))
+        .header("Grpc-Metadata-macaroon", &macaroon_hex)
+        .send()
+        .await
+        .context("subscribe request failed")?;
+    anyhow::ensure!(
+        resp.status().is_success(),
+        "transactions/subscribe returned {}",
+        resp.status()
+    );
+    tracing::info!("lnd tx watcher: streaming wallet transaction events");
+    while let Some(chunk) = resp.chunk().await? {
+        if chunk.is_empty() {
+            continue;
+        }
+        // Any streamed event = wallet activity. Revision bump is the push
+        // contract (same pattern as the mesh-peer bridge in server.rs) — the
+        // clients refetch, so we don't need to parse the event body.
+        let (data, _) = sm.get_snapshot().await;
+        sm.update_data(data).await;
+        tracing::debug!(
+            bytes = chunk.len(),
+            "lnd tx watcher: wallet tx event — nudged ws clients"
+        );
+    }
+    Ok(())
+}
+
+/// LND wedge watchdog (2026-07-22, "100% uptime"): framework-pt's LND sat
+/// for 14 HOURS with its RPC answering but the server never finishing
+/// startup — synced_to_chain=false, zero peers, every channel inactive —
+/// and nothing noticed until a human tried to open a channel. The wedge
+/// signature is precise: RPC healthy while (!synced_to_chain, or zero peers
+/// with channels that need a peer) persists. A restart reliably clears it
+/// (the backend-churn wedge is a known lnd+rpcpolling failure mode), so
+/// after 15 consecutive bad minutes we bounce the container ourselves, with
+/// a 30-minute cooldown so a genuinely broken LND can't restart-loop.
+/// RPC-unreachable and locked-wallet states are deliberately NOT handled
+/// here — container-down is crash-recovery's job, and unlocking needs the
+/// operator.
+pub(crate) fn spawn_lnd_health_watchdog() {
+    tokio::spawn(async move {
+        let mut bad_minutes: u32 = 0;
+        let mut last_restart: Option<tokio::time::Instant> = None;
+        loop {
+            tokio::time::sleep(std::time::Duration::from_secs(60)).await;
+            let Ok(bytes) = read_lnd_admin_macaroon().await else {
+                bad_minutes = 0; // no LND on this node (or not set up yet)
+                continue;
+            };
+            let macaroon_hex = hex::encode(bytes);
+            let Ok(client) = reqwest::Client::builder()
+                .no_proxy()
+                .timeout(std::time::Duration::from_secs(10))
+                .danger_accept_invalid_certs(true)
+                .build()
+            else {
+                continue;
+            };
+            let Ok(resp) = client
+                .get(format!("{LND_REST_BASE_URL}/v1/getinfo"))
+                .header("Grpc-Metadata-macaroon", &macaroon_hex)
+                .send()
+                .await
+            else {
+                bad_minutes = 0; // down/locked — not the wedge signature
+                continue;
+            };
+            let Ok(info) = resp.json::<serde_json::Value>().await else {
+                bad_minutes = 0;
+                continue;
+            };
+            let synced = info
+                .get("synced_to_chain")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(true);
+            let peers = info.get("num_peers").and_then(|v| v.as_u64()).unwrap_or(0);
+            let channels = info
+                .get("num_active_channels")
+                .and_then(|v| v.as_u64())
+                .unwrap_or(0)
+                + info
+                    .get("num_inactive_channels")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(0)
+                + info
+                    .get("num_pending_channels")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(0);
+            let wedged = !synced || (channels > 0 && peers == 0);
+            if !wedged {
+                bad_minutes = 0;
+                continue;
+            }
+            bad_minutes += 1;
+            if bad_minutes < 15 {
+                continue;
+            }
+            if last_restart
+                .map(|t| t.elapsed() < std::time::Duration::from_secs(1800))
+                .unwrap_or(false)
+            {
+                continue;
+            }
+            tracing::warn!(
+                synced_to_chain = synced,
+                num_peers = peers,
+                channels,
+                "LND wedged for {bad_minutes} minutes (RPC up, server never ready) — restarting the lnd container"
+            );
+            let out = tokio::process::Command::new("podman")
+                .args(["restart", "lnd"])
+                .output()
+                .await;
+            match out {
+                Ok(o) if o.status.success() => {
+                    tracing::info!("LND watchdog restart complete");
+                }
+                Ok(o) => tracing::warn!(
+                    "LND watchdog restart failed: {}",
+                    String::from_utf8_lossy(&o.stderr).trim()
+                ),
+                Err(e) => tracing::warn!("LND watchdog restart failed: {e}"),
+            }
+            last_restart = Some(tokio::time::Instant::now());
+            bad_minutes = 0;
+        }
+    });
+}
+
 impl RpcHandler {
     /// Helper: create an authenticated LND REST client.
     /// Returns an HTTP client configured for LND's self-signed TLS and the

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -62,6 +62,14 @@ impl RpcHandler {
                 .get("message")
                 .and_then(|v| v.as_str())
                 .unwrap_or("Unknown error");
+            // Invoices are short-lived; retrying the same one can never
+            // succeed, so tell the user the way out instead of just the fact.
+            if msg.contains("invoice expired") {
+                return Err(anyhow::anyhow!(
+                    "Payment failed: this invoice has expired ({}). Ask the recipient for a fresh invoice and try again.",
+                    msg.trim_start_matches("invoice expired. ")
+                ));
+            }
             return Err(anyhow::anyhow!("Payment failed: {}", msg));
         }
 

core/archipelago/src/api/rpc/mesh/messaging.rs

@@ -181,6 +181,11 @@ impl RpcHandler {
                 config.lora_radio_params = Some(parsed);
             }
         }
+        // Hot-swap "keep as is": false = never write config to the radio
+        // (region/channel/PHY/advert name) — use it exactly as flashed.
+        if let Some(manage) = params.get("manage_radio").and_then(|v| v.as_bool()) {
+            config.manage_radio = manage;
+        }
         // Firmware pin: probe only the named firmware on the port ("auto"/""
         // clears the pin and restores strict-probe auto-detect).
         if let Some(kind) = params.get("device_kind").and_then(|v| v.as_str()) {

core/archipelago/src/api/rpc/mesh/status.rs

@@ -52,6 +52,9 @@ impl RpcHandler {
                     .map(|k| k.to_string().to_lowercase())
                     .into(),
             );
+            // Hot-swap "keep as is" state: false = archipelago never writes
+            // config to the radio (see MeshConfig::manage_radio).
+            obj.insert("manage_radio".into(), config.manage_radio.into());
             // USB identity per detected port so the setup modal can show the
             // actual board (product string on native-USB boards, vid:pid as
             // the fallback for bridge chips).
@@ -78,6 +81,35 @@ impl RpcHandler {
         Ok(value)
     }
 
+    /// mesh.probe-device — Identify the firmware on a detected serial port and
+    /// read its current configuration WITHOUT provisioning it. Powers the
+    /// hot-swap "device detected" modal's current-details view. The path must
+    /// be one of the currently detected candidate ports (no arbitrary device
+    /// paths), and probing the live session's own port is refused.
+    pub(in crate::api::rpc) async fn handle_mesh_probe_device(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let path = params
+            .as_ref()
+            .and_then(|p| p.get("path"))
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing path"))?
+            .to_string();
+        let detected = mesh::detect_devices().await;
+        anyhow::ensure!(
+            detected.iter().any(|d| d == &path),
+            "{path} is not a detected mesh-radio candidate port"
+        );
+        let service = self.mesh_service.read().await;
+        let probe = match service.as_ref() {
+            Some(svc) => svc.probe_device(&path).await?,
+            // No mesh service yet (radio never enabled) — probe directly.
+            None => mesh::listener::probe_device(&path).await?,
+        };
+        Ok(serde_json::to_value(probe)?)
+    }
+
     /// mesh.peers — List discovered mesh peers.
     pub(in crate::api::rpc) async fn handle_mesh_peers(&self) -> Result<serde_json::Value> {
         let service = self.mesh_service.read().await;

core/archipelago/src/api/rpc/middleware.rs

@@ -73,6 +73,20 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "Mempool requires",
         "Container",
         "Image",
+        // Wallet-actionable errors: masking "Insufficient balance: need 80
+        // sats, have 0 sats" behind "Operation failed. Check server logs."
+        // sent the operator to journalctl for a message that was written for
+        // them in the first place (ecash send, 2026-07-22).
+        "Insufficient balance",
+        "Insufficient funds",
+        // Lightning payment failures carry LND's reason ("invoice expired.
+        // Valid until …", "no route", …) — the user can act on every one of
+        // them, and masking sent the operator to journalctl (invoice-expired
+        // send, 2026-07-23).
+        "Payment failed",
+        "Invalid payment request",
+        "Missing 'payment_request'",
+        "Your Lightning node is still finishing",
         "Bitcoin address",
         "No router",
         "No OpenWrt",
@@ -151,6 +165,25 @@ mod sanitize_tests {
         }
     }
 
+    #[test]
+    fn lightning_payment_errors_pass_through() {
+        // LND's payment-failure reasons are written for the payer — masking
+        // "invoice expired" as "Check server logs" left a user retrying a
+        // dead invoice (framework-pt, 2026-07-23).
+        for msg in [
+            "Payment failed: this invoice has expired (Valid until 2026-07-23 07:41:42 +0000 UTC). Ask the recipient for a fresh invoice and try again.",
+            "Payment failed: unable to find a path to destination",
+            "Invalid payment request: must be a Lightning invoice (lnbc...)",
+            "Missing 'payment_request' parameter",
+        ] {
+            assert_ne!(
+                sanitize_error_message(msg),
+                "Operation failed. Check server logs for details.",
+                "masked: {msg}"
+            );
+        }
+    }
+
     #[test]
     fn internal_errors_stay_generic() {
         assert_eq!(

core/archipelago/src/api/rpc/mod.rs

@@ -15,7 +15,7 @@ mod fips;
 mod handshake;
 mod identity;
 mod interfaces;
-pub(in crate::api) mod lnd;
+pub(crate) mod lnd;
 mod marketplace;
 mod mesh;
 mod middleware;
@@ -26,6 +26,7 @@ mod node;
 mod nostr;
 mod openwrt;
 mod package;
+pub(crate) use package::wyoming_satellite_keeper;
 mod peers;
 mod pine_status;
 mod response;
@@ -532,9 +533,31 @@ impl RpcHandler {
             self.login_rate_limiter.record_failure(client_ip).await;
         }
 
-        // On successful login, check if 2FA is required
+        // On successful login, check if 2FA is required. Device-token logins
+        // (companion pairing QR) skip the TOTP challenge like remember-me does:
+        // the token was minted from an already-authenticated session, and there
+        // is no password with which to decrypt the TOTP secret anyway.
         if method == "auth.login" && rpc_resp.error.is_none() {
-            let totp_enabled = self.auth_manager.is_totp_enabled().await.unwrap_or(false);
+            let password = login_params
+                .as_ref()
+                .and_then(|p| p.get("password"))
+                .and_then(|v| v.as_str());
+            let is_token_login = login_params
+                .as_ref()
+                .and_then(|p| p.get("token"))
+                .and_then(|v| v.as_str())
+                .is_some()
+                || match password {
+                    // Companion device tokens also arrive through the password
+                    // field (see handle_auth_login) — those logins get a full
+                    // session too; there's no password to decrypt TOTP with.
+                    Some(pw) => crate::device_tokens::verify(&self.config.data_dir, pw)
+                        .await
+                        .is_some(),
+                    None => false,
+                };
+            let totp_enabled =
+                !is_token_login && self.auth_manager.is_totp_enabled().await.unwrap_or(false);
             if totp_enabled {
                 let password = login_params
                     .as_ref()

core/archipelago/src/api/rpc/package/dependencies.rs

@@ -206,19 +206,24 @@ pub(super) fn check_install_deps(package_id: &str, deps: &RunningDeps) -> Result
             "BTCPay Server requires a running Bitcoin node (Bitcoin Knots). \
              Please install and start Bitcoin Knots first."
         )),
-        "mempool" | "mempool-web" if !deps.has_bitcoin || !deps.has_electrumx => {
-            let mut missing = vec![];
-            if !deps.has_bitcoin {
-                missing.push("Bitcoin Knots");
-            }
-            if !deps.has_electrumx {
-                missing.push("ElectrumX");
-            }
-            Err(anyhow::anyhow!(
-                "Mempool requires {} to be running. Please install and start {} first.",
-                missing.join(" and "),
-                missing.join(" and ")
-            ))
+        "mempool" | "mempool-web" if !deps.has_bitcoin => Err(anyhow::anyhow!(
+            "Mempool requires Bitcoin Knots to be running. \
+             Please install and start Bitcoin Knots first."
+        )),
+        // ElectrumX is deliberately NOT a hard gate for mempool: mempool-api
+        // reconnects to electrum on its own (verified live — it retries
+        // ECONNREFUSED in a loop and comes good when electrum starts
+        // listening), and an ElectrumX mid-resync can be legitimately down
+        // for DAYS. The hard gate here blocked repeated mempool installs on
+        // .116 (2026-07-22) while electrumx was compacting. Block/fee views
+        // work from bitcoind immediately; address lookups light up when
+        // ElectrumX finishes.
+        "mempool" | "mempool-web" if !deps.has_electrumx => {
+            info!(
+                "Mempool installing while ElectrumX is not running — \
+                 mempool-api reconnects automatically once ElectrumX is up"
+            );
+            Ok(())
         }
         "fedimint" if !deps.has_bitcoin => {
             info!("Fedimint installing without local Bitcoin node — configure remote Bitcoin RPC in Fedimint guardian setup");
@@ -298,9 +303,10 @@ fn missing_install_deps(package_id: &str, deps: &RunningDeps) -> Vec<MissingDep>
             if !deps.has_bitcoin {
                 missing.push(BITCOIN);
             }
-            if !deps.has_electrumx {
-                missing.push(ELECTRUM);
-            }
+            // ElectrumX intentionally not required — see check_install_deps:
+            // mempool-api reconnects when electrum comes up, and a resyncing
+            // ElectrumX can be down for days (the 3-minute bounded wait here
+            // would still fail the install for no benefit).
         }
         // fedimint deliberately absent: check_install_deps allows it without
         // a local Bitcoin node (remote RPC configured in guardian setup).
@@ -1111,7 +1117,11 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn mempool_waits_on_both_bitcoin_and_electrumx() {
+        async fn mempool_waits_on_bitcoin_only() {
+            // ElectrumX is deliberately NOT gated (2026-07-22): a resyncing
+            // ElectrumX can be down for days and mempool-api reconnects on
+            // its own, so the wait only covers Bitcoin — even when electrumx
+            // is installed and stopped.
             let calls = Arc::new(AtomicU32::new(0));
             let (labels, sink) = label_sink();
             let probe_calls = Arc::clone(&calls);
@@ -1119,8 +1129,8 @@ mod tests {
                 "mempool",
                 move || {
                     let n = probe_calls.fetch_add(1, Ordering::SeqCst);
-                    // Bitcoin comes up on probe 2, electrumx on probe 3.
-                    async move { Ok(probe(n >= 1, n >= 2, &["bitcoin-knots", "electrumx"])) }
+                    // Bitcoin comes up on probe 2; electrumx never does.
+                    async move { Ok(probe(n >= 1, false, &["bitcoin-knots", "electrumx"])) }
                 },
                 sink,
                 36,
@@ -1131,22 +1141,19 @@ mod tests {
             let labels = labels.lock().unwrap();
             assert_eq!(
                 labels.as_slice(),
-                &[
-                    "Waiting for Bitcoin and ElectrumX to start…".to_string(),
-                    "Waiting for ElectrumX to start…".to_string(),
-                ]
+                &["Waiting for Bitcoin to start…".to_string()]
             );
         }
 
         #[tokio::test]
-        async fn mempool_fails_fast_when_one_dep_is_not_installed() {
-            // Bitcoin is installed (waiting could help) but ElectrumX is not
-            // installed at all — waiting can never satisfy the gate, so fail
-            // fast with the canonical message.
+        async fn mempool_fails_fast_when_bitcoin_is_not_installed() {
+            // Bitcoin isn't installed at all — waiting can never satisfy the
+            // gate, so fail fast with the canonical message. (A missing
+            // ElectrumX no longer blocks anything.)
             let (labels, sink) = label_sink();
             let err = wait_for_install_deps(
                 "mempool",
-                || async { Ok(probe(false, false, &["bitcoin-knots"])) },
+                || async { Ok(probe(false, false, &["electrumx"])) },
                 sink,
                 36,
                 Duration::ZERO,

core/archipelago/src/api/rpc/package/mod.rs

@@ -4,6 +4,7 @@ mod dependencies;
 mod install;
 mod lifecycle;
 mod pine_ha;
+pub(crate) use pine_ha::wyoming_satellite_keeper;
 mod progress;
 mod runtime;
 mod set_config;

core/archipelago/src/api/rpc/package/pine_ha.rs

@@ -123,7 +123,11 @@ rest:
   - resource: http://host.containers.internal/api/pine/status
     headers:
       Authorization: "Bearer {token}"
-    scan_interval: 30
+    # 15s: the mesh-message sensor only carries the LATEST message id, so two
+    # messages inside one poll window coalesce and only the newest announces
+    # (observed on framework-pt 2026-07-22). Halving the window halves both
+    # the announce lag and the coalescing odds; the endpoint is local + cheap.
+    scan_interval: 15
     sensor:
       - name: "Archy Block Height"
         unique_id: archy_block_height
@@ -337,7 +341,14 @@ const MESH_ANNOUNCE_AUTOMATION_ID: &str = "archy_mesh_announce";
 /// Announce new mesh messages on every Assist satellite. Only seeded into an
 /// empty/missing automations.yaml — merging into user-authored YAML risks
 /// mangling it, and anyone with existing automations can paste this one from
-/// the docs. Trigger conditions skip HA-restart transitions (unknown -> id).
+/// the docs. Trigger conditions skip HA-restart transitions (unknown -> id)
+/// but deliberately allow `None`/`unavailable` -> id: `None` is the sensor's
+/// state before the first-ever received message (and again whenever the mesh
+/// message store restarts empty), and `unavailable` follows any endpoint
+/// blip — blocking those swallowed the first DM a fresh node ever received
+/// (framework-pt, 2026-07-22). HA restarts still can't re-announce an old
+/// message: rest sensors don't restore state, so the post-restart transition
+/// is always from `unknown`.
 const MESH_ANNOUNCE_AUTOMATION: &str = r#"- id: archy_mesh_announce
   alias: Announce mesh messages on Pine
   description: Speak new mesh messages on the Pine speaker (seeded by Archipelago)
@@ -348,7 +359,7 @@ const MESH_ANNOUNCE_AUTOMATION: &str = r#"- id: archy_mesh_announce
     - condition: template
       value_template: >-
         {{ trigger.from_state is not none
-           and trigger.from_state.state not in ['unknown', 'unavailable', 'None']
+           and trigger.from_state.state != 'unknown'
            and trigger.to_state.state not in ['unknown', 'unavailable', 'None']
            and trigger.from_state.state != trigger.to_state.state }}
   actions:
@@ -371,6 +382,22 @@ async fn seed_mesh_announce_automation() -> bool {
     let path = std::path::Path::new(HA_CONFIG_DIR).join("automations.yaml");
     let existing = tokio::fs::read_to_string(&path).await.unwrap_or_default();
     if existing.contains(MESH_ANNOUNCE_AUTOMATION_ID) {
+        // v1 of the seeded condition also blocked `None`/`unavailable` -> id
+        // transitions, swallowing the first-ever received message. Upgrade by
+        // replacing exactly that clause; anything else in the file (including
+        // user-added automations) is left untouched.
+        const V1_CLAUSE: &str =
+            "trigger.from_state.state not in ['unknown', 'unavailable', 'None']";
+        const V2_CLAUSE: &str = "trigger.from_state.state != 'unknown'";
+        if existing.contains(V1_CLAUSE) {
+            let upgraded = existing.replace(V1_CLAUSE, V2_CLAUSE);
+            if let Err(e) = tokio::fs::write(&path, upgraded).await {
+                warn!("pine/HA seed: upgrading automations.yaml failed: {e}");
+                return false;
+            }
+            info!("pine/HA seed: mesh announce automation upgraded (first message announces)");
+            return true;
+        }
         return false;
     }
     let trimmed = existing.trim();
@@ -670,6 +697,193 @@ async fn seed_assist_pipeline(storage: &std::path::Path, claude_entity: Option<&
     false
 }
 
+// ---------------------------------------------------------------------------
+// Wyoming satellite keeper
+// ---------------------------------------------------------------------------
+
+/// Keep IP-pinned Wyoming satellite entries (voice speakers) reachable.
+///
+/// HA's zeroconf discovery stores a satellite as a fixed LAN IP. DHCP
+/// renumbering — or the whole node moving to a different network — strands
+/// the entry and the speaker silently drops (framework-pt 2026-07-23: entry
+/// pinned to 192.168.1.241 while the LAN had become 192.168.63.0/24). HA
+/// never re-resolves on its own. This keeper probes each satellite entry and,
+/// when one stops answering, sweeps the node's local /24s for the same
+/// Wyoming port and rewrites the entry to the address that answers.
+pub(crate) async fn wyoming_satellite_keeper() {
+    loop {
+        if home_assistant_installed().await {
+            heal_wyoming_satellites().await;
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(300)).await;
+    }
+}
+
+async fn tcp_alive(host: &str, port: u16, ms: u64) -> bool {
+    matches!(
+        tokio::time::timeout(
+            std::time::Duration::from_millis(ms),
+            tokio::net::TcpStream::connect((host, port)),
+        )
+        .await,
+        Ok(Ok(_))
+    )
+}
+
+/// The node's own global IPv4 addresses. Loopback/CGNAT (tailscale) ranges are
+/// excluded — satellites live on real LANs.
+async fn local_ipv4_addresses() -> Vec<std::net::Ipv4Addr> {
+    let Ok(out) = tokio::process::Command::new("ip")
+        .args(["-4", "-o", "addr", "show", "scope", "global"])
+        .output()
+        .await
+    else {
+        return Vec::new();
+    };
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter_map(|l| {
+            let cidr = l.split_whitespace().nth(3)?;
+            let ip: std::net::Ipv4Addr = cidr.split('/').next()?.parse().ok()?;
+            let o = ip.octets();
+            // 100.64.0.0/10 — tailscale/CGNAT, never a speaker LAN.
+            if o[0] == 100 && (64..128).contains(&o[1]) {
+                return None;
+            }
+            Some(ip)
+        })
+        .collect()
+}
+
+/// Sweep the /24 of every local interface for something answering `port`.
+/// First responder wins; the node's own addresses are skipped.
+async fn find_satellite(port: u16) -> Option<String> {
+    let self_ips = local_ipv4_addresses().await;
+    for base in self_ips.iter().map(|ip| ip.octets()) {
+        let mut set = tokio::task::JoinSet::new();
+        for i in 1..255u8 {
+            let ip = std::net::Ipv4Addr::new(base[0], base[1], base[2], i);
+            if self_ips.contains(&ip) {
+                continue;
+            }
+            set.spawn(async move {
+                tcp_alive(&ip.to_string(), port, 500)
+                    .await
+                    .then(|| ip.to_string())
+            });
+        }
+        while let Some(res) = set.join_next().await {
+            if let Ok(Some(ip)) = res {
+                return Some(ip);
+            }
+        }
+    }
+    None
+}
+
+/// One keeper pass: re-point dead IP-pinned wyoming entries at wherever their
+/// port now answers. Stops HA before editing the store (HA flushes its own
+/// in-memory copy on shutdown, which would clobber a live edit) and starts it
+/// again after.
+async fn heal_wyoming_satellites() {
+    let path = std::path::Path::new(HA_STORAGE_DIR).join("core.config_entries");
+    let Some(store) = read_store(&path).await else {
+        return;
+    };
+    let Some(entries) = store
+        .get("data")
+        .and_then(|d| d.get("entries"))
+        .and_then(|e| e.as_array())
+    else {
+        return;
+    };
+
+    // (host, port, new_host) for every stranded satellite we can re-resolve.
+    let mut moves: Vec<(String, u16, String)> = Vec::new();
+    for e in entries {
+        if e.get("domain").and_then(Value::as_str) != Some("wyoming") {
+            continue;
+        }
+        let Some(host) = e
+            .get("data")
+            .and_then(|d| d.get("host"))
+            .and_then(Value::as_str)
+        else {
+            continue;
+        };
+        // Engines use host.containers.internal — only IP-pinned entries drift.
+        if host.parse::<std::net::Ipv4Addr>().is_err() {
+            continue;
+        }
+        let port = e
+            .get("data")
+            .and_then(|d| d.get("port"))
+            .and_then(Value::as_u64)
+            .unwrap_or(0) as u16;
+        if port == 0 || tcp_alive(host, port, 1500).await {
+            continue;
+        }
+        let Some(new_host) = find_satellite(port).await else {
+            info!("pine/HA keeper: satellite {host}:{port} unreachable and not found on any local /24 yet");
+            continue;
+        };
+        if new_host != host {
+            moves.push((host.to_string(), port, new_host));
+        }
+    }
+    if moves.is_empty() {
+        return;
+    }
+
+    // Stop HA, re-read + rewrite the store, start HA.
+    let _ = tokio::process::Command::new("podman")
+        .args(["stop", "homeassistant"])
+        .output()
+        .await;
+    if let Some(mut store) = read_store(&path).await {
+        let mut changed = false;
+        if let Some(entries) = store
+            .get_mut("data")
+            .and_then(|d| d.get_mut("entries"))
+            .and_then(|e| e.as_array_mut())
+        {
+            for e in entries.iter_mut() {
+                if e.get("domain").and_then(Value::as_str) != Some("wyoming") {
+                    continue;
+                }
+                let host = e
+                    .get("data")
+                    .and_then(|d| d.get("host"))
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+                    .to_string();
+                let port = e
+                    .get("data")
+                    .and_then(|d| d.get("port"))
+                    .and_then(Value::as_u64)
+                    .unwrap_or(0) as u16;
+                if let Some((_, _, new_host)) =
+                    moves.iter().find(|(h, p, _)| *h == host && *p == port)
+                {
+                    if let Some(data) = e.get_mut("data") {
+                        data["host"] = json!(new_host);
+                    }
+                    e["modified_at"] = json!(ha_now());
+                    info!("pine/HA keeper: satellite moved {host}:{port} -> {new_host}:{port}");
+                    changed = true;
+                }
+            }
+        }
+        if changed {
+            write_store(&path, &store).await;
+        }
+    }
+    let _ = tokio::process::Command::new("podman")
+        .args(["start", "homeassistant"])
+        .output()
+        .await;
+}
+
 // ---------------------------------------------------------------------------
 // Presence probes + HA restart
 // ---------------------------------------------------------------------------

core/archipelago/src/api/rpc/package/stacks.rs

@@ -12,7 +12,11 @@ use tracing::info;
 
 use super::install::{install_log, patch_indeedhub_nostr_provider};
 
-const PODMAN_STACK_PROBE_TIMEOUT: Duration = Duration::from_secs(10);
+// 45s, not 10s: under heavy disk load (e.g. an ElectrumX resync/compaction
+// hammering the same SSD) a plain `podman ps` was observed taking >10s on
+// .116 (2026-07-22), failing a mempool install at the probe step for no real
+// reason. Podman being slow is not podman being dead.
+const PODMAN_STACK_PROBE_TIMEOUT: Duration = Duration::from_secs(45);
 const PODMAN_STACK_LOG_TIMEOUT: Duration = Duration::from_secs(15);
 const PODMAN_STACK_PULL_TIMEOUT: Duration = Duration::from_secs(600);
 const PODMAN_STACK_REMOVE_TIMEOUT: Duration = Duration::from_secs(90);

core/archipelago/src/api/rpc/system/handlers.rs

@@ -139,9 +139,17 @@ impl RpcHandler {
             .await
             .map(|s| s.trim().to_string())
             .unwrap_or_else(|_| "archipelago".to_string());
+        // LAN IPv4 rides along for the companion pairing QR: when the
+        // operator's browser reaches this node over Tailscale/VPN or
+        // localhost, that origin is useless to a phone on the LAN — the QR
+        // must advertise an address the phone can actually dial
+        // (2026-07-22: a pairing QR carried a tailnet 100.x IP and the
+        // companion could never connect).
+        let lan_ip = crate::host_ip::primary_host_ipv4().await;
         Ok(serde_json::json!({
             "hostname": hostname,
             "mdns_hostname": format!("{hostname}.local"),
+            "lan_ip": lan_ip,
         }))
     }
 

core/archipelago/src/bootstrap.rs

@@ -39,6 +39,28 @@ const KIOSK_LAUNCHER: &str =
 const KIOSK_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-kiosk.service";
 const KIOSK_LAUNCHER_PATH: &str = "/usr/local/bin/archipelago-kiosk-launcher";
 
+// HDMI audio (kiosk nodes): ISOs built before 2026-07-23 shipped no audio
+// stack at all even though the kiosk launcher expects PipeWire-Pulse, and the
+// kiosk's boot-time modeset can race the i915→HDA audio-component bind so the
+// HDMI ELD is lost and every HDMI profile stays unavailable (silent failure).
+// The router daemon handles routing + the ELD re-modeset nudge; this heal
+// installs the packages, group membership, script and unit on deployed nodes.
+const AUDIO_ROUTER: &str =
+    include_str!("../../../image-recipe/configs/archipelago-audio-router.sh");
+const AUDIO_SERVICE: &str =
+    include_str!("../../../image-recipe/configs/archipelago-audio-router.service");
+const AUDIO_ROUTER_PATH: &str = "/usr/local/bin/archipelago-audio-router";
+const AUDIO_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-audio-router.service";
+
+// Gamepad→keyboard bridge (TV input inside every app iframe) — same
+// splice-from-configs + self-heal pattern as the audio router.
+const GAMEPAD_KEYS: &str =
+    include_str!("../../../image-recipe/configs/archipelago-gamepad-keys.py");
+const GAMEPAD_SERVICE: &str =
+    include_str!("../../../image-recipe/configs/archipelago-gamepad-keys.service");
+const GAMEPAD_KEYS_PATH: &str = "/usr/local/bin/archipelago-gamepad-keys";
+const GAMEPAD_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-gamepad-keys.service";
+
 // Journald log-volume policy (size cap + per-service rate limit). Fresh ISOs
 // write the identical file at build time (image-recipe/_archived/
 // build-auto-installer-iso.sh); this heals already-deployed nodes via OTA.
@@ -794,6 +816,137 @@ pub async fn ensure_kiosk_hardened() {
     }
 }
 
+/// HDMI-audio self-heal for kiosk nodes: install the PipeWire stack (older
+/// ISOs shipped none), put the archipelago user in `audio` (PipeWire runs
+/// under the lingering user manager — no logind seat, so no udev ACLs on
+/// /dev/snd), and keep the audio-router daemon (HDMI routing + ELD boot-race
+/// nudge) installed and current. No-op on nodes without the kiosk — audio
+/// only matters where media plays on an attached display.
+pub async fn ensure_audio_stack() {
+    if fs::metadata(KIOSK_SERVICE_PATH).await.is_err() {
+        return; // no kiosk → no display audio to route
+    }
+
+    // Package install runs via systemd-run (host_sudo), outside the service
+    // sandbox — /usr and the dpkg database are read-only in our namespace.
+    if fs::metadata("/usr/bin/pactl").await.is_err() {
+        info!("audio: PipeWire stack missing — installing packages");
+        let _ = host_sudo(&["apt-get", "update", "-qq"]).await;
+        match host_sudo(&[
+            "apt-get",
+            "install",
+            "-y",
+            "-qq",
+            "--no-install-recommends",
+            "pipewire",
+            "pipewire-pulse",
+            "pipewire-alsa",
+            "wireplumber",
+            "alsa-utils",
+        ])
+        .await
+        {
+            Ok(s) if s.success() => info!("audio: PipeWire stack installed"),
+            Ok(s) => {
+                warn!(
+                    "audio: package install exited with {} — will retry next start",
+                    s
+                );
+                return;
+            }
+            Err(e) => {
+                warn!(
+                    "audio: package install failed: {:#} — will retry next start",
+                    e
+                );
+                return;
+            }
+        }
+    }
+
+    let _ = host_sudo(&["usermod", "-aG", "audio", "archipelago"]).await;
+
+    let unit_was_missing = fs::metadata(AUDIO_SERVICE_PATH).await.is_err();
+    let script_changed = write_root_if_needed(AUDIO_ROUTER_PATH, AUDIO_ROUTER)
+        .await
+        .unwrap_or(false);
+    if script_changed {
+        let _ = host_sudo(&["chmod", "+x", AUDIO_ROUTER_PATH]).await;
+    }
+    let unit_changed = write_root_if_needed(AUDIO_SERVICE_PATH, AUDIO_SERVICE)
+        .await
+        .unwrap_or(false);
+
+    if script_changed || unit_changed {
+        if let Err(e) = host_sudo(&["systemctl", "daemon-reload"]).await {
+            warn!("audio: daemon-reload failed: {:#}", e);
+        }
+    }
+    if unit_was_missing {
+        // First install on this node — bring it up now and on every boot.
+        let _ = host_sudo(&[
+            "systemctl",
+            "enable",
+            "--now",
+            "archipelago-audio-router.service",
+        ])
+        .await;
+        info!("audio: router installed and enabled (HDMI routing + ELD heal)");
+    } else if script_changed || unit_changed {
+        // Content update: restart only if it's running — never re-enable a
+        // unit an operator deliberately disabled.
+        let _ = host_sudo(&[
+            "systemctl",
+            "try-restart",
+            "archipelago-audio-router.service",
+        ])
+        .await;
+        info!("audio: router updated");
+    }
+}
+
+/// Gamepad→keyboard bridge self-heal for kiosk nodes: keeps the evdev→uinput
+/// daemon (controller works inside every app iframe on the TV) installed and
+/// current. Same gating as audio: no kiosk → no display input to bridge.
+pub async fn ensure_gamepad_keys() {
+    if fs::metadata(KIOSK_SERVICE_PATH).await.is_err() {
+        return;
+    }
+    let unit_was_missing = fs::metadata(GAMEPAD_SERVICE_PATH).await.is_err();
+    let script_changed = write_root_if_needed(GAMEPAD_KEYS_PATH, GAMEPAD_KEYS)
+        .await
+        .unwrap_or(false);
+    if script_changed {
+        let _ = host_sudo(&["chmod", "+x", GAMEPAD_KEYS_PATH]).await;
+    }
+    let unit_changed = write_root_if_needed(GAMEPAD_SERVICE_PATH, GAMEPAD_SERVICE)
+        .await
+        .unwrap_or(false);
+    if script_changed || unit_changed {
+        if let Err(e) = host_sudo(&["systemctl", "daemon-reload"]).await {
+            warn!("gamepad bridge: daemon-reload failed: {:#}", e);
+        }
+    }
+    if unit_was_missing {
+        let _ = host_sudo(&[
+            "systemctl",
+            "enable",
+            "--now",
+            "archipelago-gamepad-keys.service",
+        ])
+        .await;
+        info!("gamepad: bridge installed and enabled (TV controller input)");
+    } else if script_changed || unit_changed {
+        let _ = host_sudo(&[
+            "systemctl",
+            "try-restart",
+            "archipelago-gamepad-keys.service",
+        ])
+        .await;
+        info!("gamepad: bridge updated");
+    }
+}
+
 /// Patch the nginx site config to add missing backend proxy blocks. Older ISO
 /// configs shipped individual per-endpoint `location` blocks, so missing
 /// endpoints silently fell through to the SPA `index.html` and the frontend
@@ -866,6 +1019,13 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     // B13: fedimint block present but lacking the asset-rewrite sub_filters.
     let needs_fedimint_css = content.contains("location /app/fedimint/")
         && !content.contains("'href=\"/' 'href=\"/app/fedimint/'");
+    // Companion mesh access: phones reach this node over FIPS at its fips0
+    // ULA (http://[fdxx:…]). Configs shipped before 2026-07-23 listened on
+    // IPv4 only, so the ULA could never connect — nothing answered [::]:80.
+    let missing_v6_http =
+        content.contains("listen 80 default_server;") && !content.contains("listen [::]:80");
+    let missing_v6_https =
+        content.contains("listen 443 ssl default_server;") && !content.contains("listen [::]:443");
     if !missing_app_catalog
         && !missing_bitcoin_status
         && !missing_lnd_proxy
@@ -873,12 +1033,27 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
         && !missing_pine_status
         && !has_lnd_dup_cors
         && !needs_fedimint_css
+        && !missing_v6_http
+        && !missing_v6_https
     {
         return Ok(false);
     }
 
     let mut patched = content.clone();
 
+    if missing_v6_http {
+        patched = patched.replace(
+            "listen 80 default_server;",
+            "listen 80 default_server;\n    listen [::]:80 default_server;",
+        );
+    }
+    if missing_v6_https {
+        patched = patched.replace(
+            "listen 443 ssl default_server;",
+            "listen 443 ssl default_server;\n    listen [::]:443 ssl default_server;",
+        );
+    }
+
     if has_lnd_dup_cors {
         // Drop the redundant nginx-side CORS headers so the backend's single
         // validated Access-Control-Allow-Origin is the only one returned.

core/archipelago/src/container/boot_reconciler.rs

@@ -108,17 +108,32 @@ impl BootReconciler {
             let orchestrator = self.orchestrator.clone();
             let interval = self.interval;
             Some(tokio::spawn(async move {
+                let mut failure_rounds: u32 = 0;
                 loop {
                     let installed = orchestrator.manifest_ids().await;
-                    for (companion, err) in crate::container::companion::reconcile(&installed).await
-                    {
+                    let failures = crate::container::companion::reconcile(&installed).await;
+                    for (companion, err) in &failures {
                         tracing::warn!(
                             companion = %companion,
                             error = %err,
                             "companion reconcile failed"
                         );
                     }
-                    time::sleep(interval).await;
+                    // A failed repair can involve registry pulls and full
+                    // image builds; retrying every 30s hammered unreachable
+                    // registries ~174×/image/day on an offline node
+                    // (archy-x250-dev log sweep, 2026-07-22). Back off
+                    // exponentially while rounds keep failing — 30s doubling
+                    // to a 1h cap — and reset the moment a round is clean.
+                    failure_rounds = if failures.is_empty() {
+                        0
+                    } else {
+                        failure_rounds.saturating_add(1)
+                    };
+                    let backoff = interval
+                        .saturating_mul(2u32.saturating_pow(failure_rounds.min(7)))
+                        .min(Duration::from_secs(3600));
+                    time::sleep(backoff).await;
                 }
             }))
         } else {

core/archipelago/src/container/prod_orchestrator.rs

@@ -3094,8 +3094,9 @@ impl ProdContainerOrchestrator {
                 .unwrap_or_else(|| "bitcoin-knots".to_string());
         }
         #[allow(unreachable_code)]
-        // Mirrors api::rpc::package::dependencies (the legacy install path);
-        // both Bitcoin node variants are reachable on archy-net by name.
+        // The known Bitcoin node containers, preferred in order. Any archy
+        // Bitcoin distribution runs as a container named `bitcoin-<distro>`
+        // (or bare `bitcoin`), all reachable on archy-net by name.
         const BITCOIN_NAMES: &[&str] = &["bitcoin-knots", "bitcoin-core", "bitcoin"];
         let names = tokio::process::Command::new("podman")
             .args(["ps", "--format", "{{.Names}}"])
@@ -3105,12 +3106,23 @@ impl ProdContainerOrchestrator {
             .filter(|o| o.status.success())
             .map(|o| String::from_utf8_lossy(&o.stdout).into_owned())
             .unwrap_or_default();
-        names
-            .lines()
-            .map(|l| l.trim())
-            .find(|name| BITCOIN_NAMES.contains(name))
-            .map(|name| name.to_string())
-            .unwrap_or_else(|| "bitcoin-knots".to_string())
+        let running: Vec<&str> = names.lines().map(|l| l.trim()).collect();
+        // Prefer a known name in priority order…
+        if let Some(hit) = BITCOIN_NAMES.iter().find(|n| running.contains(n)) {
+            return hit.to_string();
+        }
+        // …else accept ANY running `bitcoin-*` / `bitcoin` container, so a
+        // future Bitcoin distribution archy ships works without editing this
+        // list (user req 2026-07-22). Excludes companions/sidecars like
+        // `bitcoin-ui` and `archy-*`.
+        if let Some(other) = running.iter().find(|n| {
+            (**n == "bitcoin" || n.starts_with("bitcoin-"))
+                && !n.ends_with("-ui")
+                && !n.starts_with("archy-")
+        }) {
+            return other.to_string();
+        }
+        "bitcoin-knots".to_string()
     }
 
     #[cfg(test)]
@@ -3247,10 +3259,10 @@ impl ProdContainerOrchestrator {
         let mut env = manifest.app.environment.clone();
         env.extend(manifest.app.container.resolve_derived_env(&facts));
 
-        if manifest.app.id == "fedimint" || manifest.app.id == "fedimintd" {
-            env.retain(|entry| !entry.starts_with("FM_BITCOIND_URL="));
-            env.push("FM_BITCOIND_URL=http://bitcoin-knots:8332".to_string());
-        }
+        // FM_BITCOIND_URL now comes from the manifest's {{BITCOIN_HOST}}
+        // derived_env (works on Knots/Core/any distro). The old hardcoded
+        // `bitcoin-knots` override was removed 2026-07-22 — it defeated the
+        // derived-env and broke Core nodes.
 
         let provider = FileSecretsProvider {
             root: self.secrets_dir.clone(),

core/archipelago/src/content_server.rs

@@ -51,9 +51,25 @@ pub enum AccessControl {
     PeersOnly,
     Paid {
         price_sats: u64,
+        /// Payment methods the sharer accepts: "lightning", "onchain",
+        /// "ecash", "fedimint". Empty = everything — which is also what
+        /// catalogs written before this field deserialize to.
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        accepted: Vec<String>,
     },
 }
 
+/// Does the sharer accept this payment method for the item? Empty list =
+/// all methods (pre-field catalogs and "no preference").
+pub fn method_accepted(access: &AccessControl, method: &str) -> bool {
+    match access {
+        AccessControl::Paid { accepted, .. } => {
+            accepted.is_empty() || accepted.iter().any(|m| m == method)
+        }
+        _ => true,
+    }
+}
+
 #[derive(Debug, Default, Serialize, Deserialize)]
 pub struct ContentCatalog {
     pub items: Vec<ContentItem>,
@@ -126,12 +142,29 @@ pub fn content_file_path(data_dir: &Path, item: &ContentItem) -> PathBuf {
 }
 
 /// Add a content item to the catalog.
+///
+/// Idempotent per FILE, not just per id: `content.add` mints a fresh UUID on
+/// every call, so id-only dedup let the same file be shared twice as two
+/// separately-priced entries — and a buyer paid twice for one file
+/// (2026-07-22). Same filename → update the existing entry in place and
+/// keep its id, so existing buyers' owned records stay valid.
 pub async fn add_item(data_dir: &Path, item: ContentItem) -> Result<ContentCatalog> {
     let mut catalog = load_catalog(data_dir).await?;
     if catalog.items.iter().any(|i| i.id == item.id) {
         return Err(anyhow::anyhow!("Content item '{}' already exists", item.id));
     }
-    catalog.items.push(item);
+    let norm = |f: &str| f.trim_start_matches('/').to_string();
+    if let Some(existing) = catalog
+        .items
+        .iter_mut()
+        .find(|i| norm(&i.filename) == norm(&item.filename))
+    {
+        let keep_id = existing.id.clone();
+        *existing = item;
+        existing.id = keep_id;
+    } else {
+        catalog.items.push(item);
+    }
     save_catalog(data_dir, &catalog).await?;
     Ok(catalog)
 }
@@ -252,20 +285,26 @@ pub async fn serve_content(
 
     // Check access control
     match &item.access {
-        AccessControl::Paid { price_sats } => {
+        AccessControl::Paid { price_sats, .. } => {
             // Two ways to satisfy payment:
             //  (a) a valid ecash token (the local-wallet fast path), or
             //  (b) a Lightning-invoice payment hash this node issued and has
             //      since confirmed settled (the "pay from any wallet" path, #46).
+            // Each path only counts when the sharer accepts that method.
             let mut authorized = false;
             if let Some(token) = payment_token {
-                if verify_payment_token(data_dir, token, *price_sats).await {
+                if (method_accepted(&item.access, "ecash")
+                    || method_accepted(&item.access, "fedimint"))
+                    && verify_payment_token(data_dir, token, *price_sats).await
+                {
                     authorized = true;
                 }
             }
             if !authorized {
                 if let Some(hash) = invoice_hash {
-                    if crate::content_invoice::is_paid_for(hash, id).await {
+                    if method_accepted(&item.access, "lightning")
+                        && crate::content_invoice::is_paid_for(hash, id).await
+                    {
                         authorized = true;
                     }
                 }

core/archipelago/src/crash_recovery.rs

@@ -403,6 +403,14 @@ pub async fn recover_containers(containers: &[RunningContainerRecord]) -> Recove
     pending_boot_starts_add(containers.iter().map(|r| r.name.clone()));
 
     for (i, record) in containers.iter().enumerate() {
+        // Skip containers that are already up — `podman start` on a running
+        // container produces the noisy benign conmon "Failed to create
+        // container" + cgroup Permission-denied journal pair (fleet log
+        // sweep 2026-07-22).
+        if container_state(&record.name).await.as_deref() == Some("running") {
+            report.recovered += 1;
+            continue;
+        }
         info!(
             "Recovering container: {} (image: {})",
             record.name, record.image
@@ -936,14 +944,21 @@ async fn container_state(container: &str) -> Option<String> {
 }
 
 async fn start_existing_container(container: &str) -> bool {
-    info!("Recovering stack container: {}", container);
     let timeout = match container {
         "immich_server" | "netbird-server" => Duration::from_secs(120),
         _ => Duration::from_secs(90),
     };
-    if container_state(container).await.as_deref() == Some("initialized") {
-        cleanup_container_runtime_state(container).await;
+    match container_state(container).await.as_deref() {
+        // Already up — `podman start` on a running container makes conmon
+        // try to join the live cgroup and fail with a scary "Failed to
+        // create container: exit status 1" + cgroup.procs Permission denied
+        // pair in the journal. Fleet log sweep 2026-07-22 found hundreds of
+        // these per day per node, all benign. Skip instead.
+        Some("running") => return true,
+        Some("initialized") => cleanup_container_runtime_state(container).await,
+        _ => {}
     }
+    info!("Recovering stack container: {}", container);
     match podman_output(&["start", container], timeout).await {
         Ok(output) if output.status.success() => {
             tokio::time::sleep(Duration::from_secs(3)).await;

core/archipelago/src/device_tokens.rs

@@ -0,0 +1,131 @@
+//! Companion device tokens — long-lived bearer credentials minted from an
+//! authenticated session, so the pairing QR can log a phone in without
+//! carrying the admin password (which the browser never has anyway).
+//!
+//! Only the SHA-256 of each token is persisted (`device-tokens.json` in the
+//! data dir); the plaintext is returned exactly once at mint time and rides
+//! the QR as the `tok` param. Verification goes through `auth.login`'s
+//! `token` param and is covered by the same login rate limiter as passwords.
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::path::{Path, PathBuf};
+use tokio::fs;
+
+const TOKENS_FILE: &str = "device-tokens.json";
+
+/// Cap on stored tokens; re-pairing the same device name replaces its entry,
+/// so this only limits the number of *distinct* device names.
+const MAX_TOKENS: usize = 32;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeviceToken {
+    pub name: String,
+    /// Hex SHA-256 of the plaintext token.
+    pub hash: String,
+    /// Unix seconds at mint time.
+    pub created: u64,
+}
+
+fn tokens_path(data_dir: &Path) -> PathBuf {
+    data_dir.join(TOKENS_FILE)
+}
+
+async fn load(data_dir: &Path) -> Vec<DeviceToken> {
+    match fs::read(tokens_path(data_dir)).await {
+        Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_default(),
+        Err(_) => Vec::new(),
+    }
+}
+
+async fn save(data_dir: &Path, tokens: &[DeviceToken]) -> Result<()> {
+    let bytes = serde_json::to_vec_pretty(tokens)?;
+    fs::write(tokens_path(data_dir), bytes)
+        .await
+        .context("write device-tokens.json")
+}
+
+fn hash_hex(token: &str) -> String {
+    hex::encode(Sha256::digest(token.as_bytes()))
+}
+
+fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    a.iter().zip(b).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
+/// Mint a new token for `name`. An existing token with the same name is
+/// replaced, so re-showing the pairing QR never piles up stale entries.
+/// Returns the plaintext token — the only time it ever exists outside the QR.
+pub async fn create(data_dir: &Path, name: &str) -> Result<String> {
+    let token_bytes: [u8; 32] = rand::random();
+    let token = hex::encode(token_bytes);
+
+    let mut tokens = load(data_dir).await;
+    tokens.retain(|t| t.name != name);
+    if tokens.len() >= MAX_TOKENS {
+        tokens.remove(0);
+    }
+    tokens.push(DeviceToken {
+        name: name.to_string(),
+        hash: hash_hex(&token),
+        created: std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0),
+    });
+    save(data_dir, &tokens).await?;
+    Ok(token)
+}
+
+/// Verify a candidate token. Returns the device name it was minted for.
+pub async fn verify(data_dir: &Path, candidate: &str) -> Option<String> {
+    let candidate_hash = hash_hex(candidate);
+    load(data_dir)
+        .await
+        .iter()
+        .find(|t| ct_eq(t.hash.as_bytes(), candidate_hash.as_bytes()))
+        .map(|t| t.name.clone())
+}
+
+/// List stored tokens (hashes only — plaintexts are unrecoverable).
+pub async fn list(data_dir: &Path) -> Vec<DeviceToken> {
+    load(data_dir).await
+}
+
+/// Remove the token minted for `name`. Returns whether one existed.
+pub async fn remove(data_dir: &Path, name: &str) -> Result<bool> {
+    let mut tokens = load(data_dir).await;
+    let before = tokens.len();
+    tokens.retain(|t| t.name != name);
+    let removed = tokens.len() != before;
+    if removed {
+        save(data_dir, &tokens).await?;
+    }
+    Ok(removed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn mint_verify_replace_remove() {
+        let dir = tempfile::tempdir().unwrap();
+        let token = create(dir.path(), "phone").await.unwrap();
+        assert_eq!(verify(dir.path(), &token).await.as_deref(), Some("phone"));
+        assert!(verify(dir.path(), "not-a-token").await.is_none());
+
+        // Re-minting the same name invalidates the old token.
+        let token2 = create(dir.path(), "phone").await.unwrap();
+        assert!(verify(dir.path(), &token).await.is_none());
+        assert_eq!(verify(dir.path(), &token2).await.as_deref(), Some("phone"));
+        assert_eq!(list(dir.path()).await.len(), 1);
+
+        assert!(remove(dir.path(), "phone").await.unwrap());
+        assert!(verify(dir.path(), &token2).await.is_none());
+    }
+}

core/archipelago/src/fips/anchors.rs

@@ -81,6 +81,29 @@ pub fn archy_anchor() -> SeedAnchor {
     }
 }
 
+/// Public FIPS-network anchors from join.fips.network (adverts published as
+/// Nostr kind-37195 `fips-overlay-v1` events, refreshed hourly). Of the eight
+/// live test anchors (2026-07-22), these two are the dual-transport ones —
+/// they answer on TCP as well as UDP, and TCP is what traverses restrictive
+/// networks. The remaining six are UDP-only; add them per-node via
+/// `fips.add-seed-anchor` if more rendezvous diversity is wanted.
+pub fn fips_network_anchors() -> Vec<SeedAnchor> {
+    vec![
+        SeedAnchor {
+            npub: "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u".to_string(),
+            address: "23.182.128.74:443".to_string(),
+            transport: "tcp".to_string(),
+            label: "FIPS network anchor (join.fips.network)".to_string(),
+        },
+        SeedAnchor {
+            npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98".to_string(),
+            address: "217.77.8.91:443".to_string(),
+            transport: "tcp".to_string(),
+            label: "FIPS network anchor (join.fips.network)".to_string(),
+        },
+    ]
+}
+
 /// The default anchor set carried implicitly by `load()` on nodes that have
 /// never edited their anchor list, so every node dials them without operator
 /// action. Multiple anchors so one unreachable rendezvous host can't strand a
@@ -88,7 +111,9 @@ pub fn archy_anchor() -> SeedAnchor {
 /// network can reach wins. The Archipelago-operated anchor is listed first
 /// because it is reachable from the widest set of networks.
 pub fn default_public_anchors() -> Vec<SeedAnchor> {
-    vec![archy_anchor(), default_public_anchor()]
+    let mut anchors = vec![archy_anchor(), default_public_anchor()];
+    anchors.extend(fips_network_anchors());
+    anchors
 }
 
 /// One seed-anchor entry. `address` must be directly dialable (IP or
@@ -131,7 +156,24 @@ pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
         .with_context(|| format!("read {}", path.display()))?;
     let anchors: Vec<SeedAnchor> =
         serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
-    Ok(anchors)
+    Ok(repair_legacy_anchor_set(anchors))
+}
+
+/// Add the newer redundant public TCP anchors to legacy files that only carry
+/// the Archipelago-operated vps2 anchor. A deliberately custom/private anchor
+/// list remains authoritative; this only repairs the exact stale shape shipped
+/// before the join.fips.network anchors became defaults.
+fn repair_legacy_anchor_set(mut anchors: Vec<SeedAnchor>) -> Vec<SeedAnchor> {
+    let has_archy = anchors.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB);
+    let has_fips_network = fips_network_anchors()
+        .iter()
+        .any(|default| anchors.iter().any(|a| a.npub == default.npub));
+    if has_archy && !has_fips_network {
+        for anchor in fips_network_anchors() {
+            anchors.push(anchor);
+        }
+    }
+    anchors
 }
 
 /// Persist the list. Overwrites atomically via write-then-rename so a
@@ -313,6 +355,30 @@ mod tests {
         assert!(got.iter().all(|a| a.transport == "tcp"));
     }
 
+    #[tokio::test]
+    async fn load_repairs_legacy_archy_only_anchor_file() {
+        let dir = tempfile::tempdir().unwrap();
+        save(dir.path(), &[archy_anchor()]).await.unwrap();
+
+        let got = load(dir.path()).await.unwrap();
+        assert!(got.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB));
+        for anchor in fips_network_anchors() {
+            assert!(got.iter().any(|a| a.npub == anchor.npub));
+        }
+    }
+
+    #[tokio::test]
+    async fn load_keeps_private_anchor_file_authoritative() {
+        let dir = tempfile::tempdir().unwrap();
+        let private = mk("npub1private");
+        save(dir.path(), std::slice::from_ref(&private))
+            .await
+            .unwrap();
+
+        let got = load(dir.path()).await.unwrap();
+        assert_eq!(got, vec![private]);
+    }
+
     #[tokio::test]
     async fn removing_one_default_persists_and_keeps_the_other() {
         // Editing the anchor list (here removing one default) makes the file
@@ -331,10 +397,10 @@ mod tests {
         // Removing every default leaves an empty authoritative list that must
         // not be re-seeded on next load.
         let dir = tempfile::tempdir().unwrap();
-        remove(dir.path(), ARCHY_ANCHOR_NPUB).await.unwrap();
-        let list = remove(dir.path(), DEFAULT_PUBLIC_ANCHOR_NPUB)
-            .await
-            .unwrap();
+        let mut list = Vec::new();
+        for anchor in default_public_anchors() {
+            list = remove(dir.path(), &anchor.npub).await.unwrap();
+        }
         assert!(list.is_empty());
         let got = load(dir.path()).await.unwrap();
         assert!(got.is_empty(), "defaults must stay removed once edited");

core/archipelago/src/fips/config.rs

@@ -15,7 +15,7 @@ use std::path::Path;
 use tokio::process::Command;
 
 use super::{
-    DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_TCP_PORT, DEFAULT_UDP_PORT,
+    DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_TCP_PORT, PUBLISHED_UDP_PORT,
 };
 
 /// Header prepended to the generated YAML. serde doesn't emit comments, so
@@ -137,7 +137,7 @@ impl Default for FipsConfig {
             },
             transports: TransportsSection {
                 udp: TransportBind {
-                    bind_addr: format!("0.0.0.0:{DEFAULT_UDP_PORT}"),
+                    bind_addr: format!("0.0.0.0:{PUBLISHED_UDP_PORT}"),
                 },
                 tcp: TransportBind {
                     bind_addr: format!("0.0.0.0:{DEFAULT_TCP_PORT}"),
@@ -293,7 +293,7 @@ mod tests {
     fn test_rendered_yaml_matches_upstream_schema() {
         let yaml = render_config_yaml();
         assert!(yaml.contains("persistent: true"));
-        assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_UDP_PORT)));
+        assert!(yaml.contains(&format!("0.0.0.0:{}", PUBLISHED_UDP_PORT)));
         assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_TCP_PORT)));
         assert!(yaml.contains("udp:"));
         assert!(yaml.contains("tcp:"));
@@ -329,7 +329,7 @@ dns:
   bind_addr: 127.0.0.1
 transports:
   udp:
-    bind_addr: 0.0.0.0:8668
+    bind_addr: 0.0.0.0:2121
   tcp:
     bind_addr: 0.0.0.0:8443
 peers: []

core/archipelago/src/fips/mod.rs

@@ -119,6 +119,15 @@ pub const UPSTREAM_REPO: &str = "jmcorgan/fips";
 /// Default UDP port the daemon listens on.
 pub const DEFAULT_UDP_PORT: u16 = 8668;
 
+/// UDP port archipelago actually publishes/binds for the daemon. The
+/// container publishes `2121:2121/udp` (see `package/config.rs`) and every
+/// peer roster in the fleet dials `<host>:2121`, but the rendered daemon
+/// config used to bind upstream's 8668 — leaving inbound UDP dead on
+/// bridged-network installs and everything silently riding TCP 8443. The
+/// bind now uses this port so the published mapping, the fleet rosters,
+/// and the pairing QR all agree.
+pub const PUBLISHED_UDP_PORT: u16 = 2121;
+
 /// Default TCP port the daemon listens on. Used as a fallback when a
 /// peer can't be reached over UDP — common on networks that block UDP
 /// (corporate/guest wifi) and the path the public fips.v0l.io anchor

core/archipelago/src/fips/service.rs

@@ -81,6 +81,7 @@ async fn sudo_systemctl(verb: &str, unit: &str) -> Result<()> {
 /// Unmask + start + enable the FIPS service. Idempotent — safe to call
 /// on every backend startup once the key is on disk.
 pub async fn activate(unit: &str) -> Result<()> {
+    kill_stale_daemons().await?;
     // Order matters: unmask before enable/start, otherwise enable fails
     // on a masked unit.
     sudo_systemctl("unmask", unit).await?;
@@ -94,9 +95,42 @@ pub async fn stop(unit: &str) -> Result<()> {
 }
 
 pub async fn restart(unit: &str) -> Result<()> {
+    kill_stale_daemons().await?;
     sudo_systemctl("restart", unit).await
 }
 
+/// Kill orphaned `fips` processes not owned by either known systemd unit.
+///
+/// Field failure, 2026-07-24: a stale daemon survived outside systemd and kept
+/// `0.0.0.0:8443` bound. The supervised daemon then started UDP-only, so every
+/// TCP seed-anchor connect failed with "no operational transport" and phones
+/// on 5G could not discover the node. We keep the cleanup narrow: preserve the
+/// MainPID of both units and terminate only extra `pgrep -x fips` matches.
+pub async fn kill_stale_daemons() -> Result<()> {
+    let script = format!(
+        r#"keep="$(systemctl show -p MainPID --value {managed} 2>/dev/null; systemctl show -p MainPID --value {upstream} 2>/dev/null)"
+for pid in $(pgrep -x fips 2>/dev/null || true); do
+  case " $keep " in
+    *" $pid "*) ;;
+    *) kill "$pid" 2>/dev/null || true ;;
+  esac
+done
+"#,
+        managed = super::SERVICE_UNIT,
+        upstream = super::UPSTREAM_SERVICE_UNIT,
+    );
+    let out = Command::new("sudo")
+        .args(["sh", "-c", &script])
+        .output()
+        .await
+        .context("sudo stale fips cleanup failed to launch")?;
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr).trim().to_string();
+        anyhow::bail!("stale fips cleanup failed: {}", stderr);
+    }
+    Ok(())
+}
+
 /// Resolve which systemd unit is actually supervising the fips daemon
 /// on this host. Nodes installed from the archipelago ISO run
 /// `archipelago-fips.service`; nodes that were apt-installed (or had

core/archipelago/src/main.rs

@@ -45,6 +45,7 @@ mod content_server;
 mod crash_recovery;
 mod credentials;
 mod data_model;
+mod device_tokens;
 mod disk_monitor;
 mod electrs_status;
 mod federation;
@@ -55,6 +56,7 @@ mod identity;
 mod identity_manager;
 mod marketplace;
 mod mesh;
+mod mesh_ports;
 mod monitoring;
 mod names;
 mod network;
@@ -385,6 +387,23 @@ async fn main() -> Result<()> {
     // flags) on already-deployed nodes via OTA; no-op if the kiosk isn't installed.
     tokio::spawn(bootstrap::ensure_kiosk_hardened());
 
+    // HDMI audio: install the PipeWire stack + audio-router daemon on kiosk
+    // nodes (older ISOs shipped no audio stack; the router also heals the
+    // boot-time ELD race that leaves HDMI silently unavailable).
+    tokio::spawn(bootstrap::ensure_audio_stack());
+
+    // TV input: gamepad→keyboard bridge so controllers work inside every app
+    // iframe on kiosk nodes (docs/tv-input-iframe-apps.md).
+    tokio::spawn(bootstrap::ensure_gamepad_keys());
+
+    // Mesh access: mirror IPv4-published app ports onto [::] so direct-port
+    // app URLs (http://[<fips0 ULA>]:<port>) work from the companion.
+    tokio::spawn(mesh_ports::run_mesh_port_mirror());
+
+    // Pine voice: re-point IP-pinned Wyoming satellite entries (speakers) when
+    // DHCP renumbering strands them — HA never re-resolves on its own.
+    tokio::spawn(api::rpc::wyoming_satellite_keeper());
+
     // Spawn periodic container snapshot (for crash recovery)
     crash_recovery::spawn_snapshot_task(config.data_dir.clone());
 

core/archipelago/src/mesh/listener/mod.rs

@@ -15,13 +15,15 @@ mod frames;
 mod node_cmd;
 mod session;
 
+pub(crate) use session::{probe_device, DeviceProbe};
+
 use super::types::*;
 use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::{broadcast, mpsc, RwLock};
-use tracing::{error, info};
+use tracing::{error, info, warn};
 
 /// How often to broadcast our identity advertisement (seconds).
 const ADVERT_INTERVAL: Duration = Duration::from_secs(60);
@@ -52,6 +54,22 @@ const RX_STALL_TIMEOUT: Duration = Duration::from_secs(1800);
 /// Maximum stored messages (circular buffer).
 const MAX_MESSAGES: usize = 100;
 
+/// On-disk message-history file under `data_dir/` (written by
+/// `spawn_message_persister`, restored by `load_persisted_messages`).
+const MESSAGES_FILE: &str = "mesh-messages.json";
+
+/// Serialized form of the persisted history. `send_seqs` rides along because
+/// the per-target outbound sequence counters must survive restarts too:
+/// receivers dedup on (sender_pubkey, sender_seq), so a node that reboots and
+/// starts counting from 1 again has its first messages silently dropped by
+/// every peer that already saw those sequence numbers.
+#[derive(serde::Serialize, serde::Deserialize)]
+struct PersistedMessages {
+    messages: Vec<MeshMessage>,
+    #[serde(default)]
+    send_seqs: HashMap<u32, u64>,
+}
+
 /// Check if two ISO8601 timestamps are within N seconds of each other.
 fn within_seconds_iso(ts1: &str, ts2: &str, secs: i64) -> bool {
     use chrono::DateTime;
@@ -402,6 +420,100 @@ impl MeshState {
         let count = self.peers.read().await.len();
         self.status.write().await.peer_count = count;
     }
+
+    /// Restore the persisted message history + outbound sequence counters.
+    /// Called once at service startup, before the listener spawns. Missing
+    /// file (fresh node) is normal; a corrupt file is logged and skipped
+    /// rather than blocking mesh startup.
+    pub async fn load_persisted_messages(&self) {
+        let path = self.data_dir.join(MESSAGES_FILE);
+        let bytes = match tokio::fs::read(&path).await {
+            Ok(b) => b,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return,
+            Err(e) => {
+                warn!("mesh: reading {} failed: {e}", path.display());
+                return;
+            }
+        };
+        let persisted: PersistedMessages = match serde_json::from_slice(&bytes) {
+            Ok(p) => p,
+            Err(e) => {
+                warn!(
+                    "mesh: parsing {} failed (skipping restore): {e}",
+                    path.display()
+                );
+                return;
+            }
+        };
+        let count = persisted.messages.len();
+        let max_id = persisted.messages.iter().map(|m| m.id).max().unwrap_or(0);
+        *self.messages.write().await = persisted.messages.into();
+        if !persisted.send_seqs.is_empty() {
+            *self.next_send_seq.write().await = persisted.send_seqs;
+        }
+        {
+            let mut id = self.next_message_id.write().await;
+            if *id <= max_id {
+                *id = max_id + 1;
+            }
+        }
+        info!(
+            "mesh: restored {count} persisted messages (next id {})",
+            max_id + 1
+        );
+    }
+}
+
+/// Persist the message history on a low-rate timer instead of hooking every
+/// mutation path (store, delivered/transport/encrypted stamps, edits, deletes,
+/// read-receipt prunes — and whatever gets added next). Serializing ≤100
+/// messages every few seconds is trivial; the write is skipped when nothing
+/// changed, and at most the last few seconds of history are lost on a hard
+/// kill — versus the entire history, which is what a restart cost before this
+/// existed. Atomic write-then-rename, 0600 (DM plaintext lives in this file).
+pub fn spawn_message_persister(state: Arc<MeshState>) {
+    tokio::spawn(async move {
+        use std::os::unix::fs::PermissionsExt;
+        let path = state.data_dir.join(MESSAGES_FILE);
+        let tmp = path.with_extension("json.tmp");
+        let mut last_written: Option<Vec<u8>> = None;
+        let mut tick = tokio::time::interval(Duration::from_secs(5));
+        tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        loop {
+            tick.tick().await;
+            let snapshot = PersistedMessages {
+                messages: state.messages.read().await.iter().cloned().collect(),
+                send_seqs: state.next_send_seq.read().await.clone(),
+            };
+            let json = match serde_json::to_vec_pretty(&snapshot) {
+                Ok(j) => j,
+                Err(e) => {
+                    warn!("mesh: serializing message history failed: {e}");
+                    continue;
+                }
+            };
+            if last_written.as_deref() == Some(json.as_slice()) {
+                continue;
+            }
+            if let Err(e) = tokio::fs::write(&tmp, &json).await {
+                warn!("mesh: writing {} failed: {e}", tmp.display());
+                continue;
+            }
+            let perms = std::fs::Permissions::from_mode(0o600);
+            if let Err(e) = tokio::fs::set_permissions(&tmp, perms).await {
+                warn!("mesh: chmod {} failed: {e}", tmp.display());
+            }
+            if let Err(e) = tokio::fs::rename(&tmp, &path).await {
+                warn!(
+                    "mesh: renaming {} -> {} failed: {e}",
+                    tmp.display(),
+                    path.display()
+                );
+                continue;
+            }
+            last_written = Some(json);
+        }
+    });
 }
 
 /// Spawn the background mesh listener task.
@@ -425,6 +537,7 @@ pub fn spawn_mesh_listener(
     channel_name: Option<String>,
     device_kind: Option<super::types::DeviceType>,
     reticulum_tcp: Option<super::types::ReticulumTcpConfig>,
+    manage_radio: bool,
     shutdown: tokio::sync::watch::Receiver<bool>,
     cmd_rx: mpsc::Receiver<MeshCommand>,
 ) -> tokio::task::JoinHandle<()> {
@@ -461,6 +574,7 @@ pub fn spawn_mesh_listener(
                 channel_name.as_deref(),
                 device_kind,
                 reticulum_tcp.clone(),
+                manage_radio,
                 &mut shutdown,
                 &mut cmd_rx,
             )
@@ -500,11 +614,17 @@ pub fn spawn_mesh_listener(
                 }
             }
 
-            // Update status to disconnected
+            // Update status to disconnected. device_type/firmware_version are
+            // reset too — they were previously left holding the LAST radio's
+            // identity, so after a hot-swap the UI showed the old firmware
+            // ("meshcore, disconnected") while a different stick sat in the
+            // port. Unknown-until-next-successful-connect is the honest state.
             {
                 let mut status = state.status.write().await;
                 status.device_connected = false;
                 status.device_path = None;
+                status.device_type = super::types::DeviceType::Unknown;
+                status.firmware_version = None;
             }
             let _ = state.event_tx.send(MeshEvent::DeviceDisconnected);
 

core/archipelago/src/mesh/listener/session.rs

@@ -340,6 +340,102 @@ async fn auto_detect_and_open(
     )
 }
 
+/// What the hot-swap probe learned about a just-plugged radio, without
+/// provisioning anything. Serialized straight into the `mesh.probe-device`
+/// RPC response for the device setup modal.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct DeviceProbe {
+    pub path: String,
+    /// "reticulum" | "meshcore" | "meshtastic"
+    pub kind: String,
+    pub firmware_version: Option<String>,
+    pub node_id: Option<u32>,
+    pub advert_name: Option<String>,
+    /// Meshtastic-only: current radio config, read via `want_config`.
+    pub region: Option<String>,
+    pub modem_preset: Option<String>,
+    pub primary_channel: Option<String>,
+    pub secondary_channel: Option<String>,
+    pub max_contacts: Option<u16>,
+}
+
+/// Probe a serial port for a mesh radio WITHOUT provisioning it: identify the
+/// firmware (same strict Reticulum→Meshcore→Meshtastic order as auto-detect,
+/// for the same RNode-wedging reason) and read what's currently configured on
+/// it. The port is released when this returns, so the listener's reconnect
+/// loop can pick the device up afterwards. Reticulum uses the bare KISS
+/// DETECT probe — no daemon spawn just to identify a stick.
+pub(crate) async fn probe_device(path: &str) -> Result<DeviceProbe> {
+    // The listener's reconnect loop may hold this port for ~10s of every
+    // backoff cycle, and Linux happily double-opens a tty — two concurrent
+    // handshakes corrupt each other into silence (observed on framework-pt:
+    // every firmware "failed" while the listener was mid-cycle). Retry across
+    // the listener's idle gaps instead of failing on first collision.
+    let mut last_err = None;
+    for attempt in 0..3u32 {
+        if attempt > 0 {
+            tokio::time::sleep(Duration::from_secs(7)).await;
+        }
+        match probe_device_once(path).await {
+            Ok(p) => return Ok(p),
+            Err(e) => last_err = Some(e),
+        }
+    }
+    Err(last_err.unwrap_or_else(|| anyhow::anyhow!("probe failed")))
+}
+
+async fn probe_device_once(path: &str) -> Result<DeviceProbe> {
+    if super::super::reticulum::probe_rnode(path).await.is_ok() {
+        return Ok(DeviceProbe {
+            path: path.to_string(),
+            kind: "reticulum".to_string(),
+            firmware_version: Some("RNode (KISS)".to_string()),
+            node_id: None,
+            advert_name: None,
+            region: None,
+            modem_preset: None,
+            primary_channel: None,
+            secondary_channel: None,
+            max_contacts: None,
+        });
+    }
+    if let Ok(mut dev) = MeshcoreDevice::open(path).await {
+        if let Ok(info) = dev.initialize().await {
+            let queried = dev.query_device_info().await;
+            return Ok(DeviceProbe {
+                path: path.to_string(),
+                kind: "meshcore".to_string(),
+                firmware_version: queried.as_ref().map(|(v, _)| v.clone()),
+                node_id: Some(info.node_id),
+                advert_name: dev.advert_name(),
+                region: None,
+                modem_preset: None,
+                primary_channel: None,
+                secondary_channel: None,
+                max_contacts: queried.map(|(_, m)| m).or(Some(info.max_contacts)),
+            });
+        }
+    }
+    if let Ok(mut dev) = MeshtasticDevice::open(path).await {
+        if let Ok(info) = dev.initialize().await {
+            let cfg = dev.probed_config();
+            return Ok(DeviceProbe {
+                path: path.to_string(),
+                kind: "meshtastic".to_string(),
+                firmware_version: Some(info.firmware_version.clone()),
+                node_id: Some(info.node_id),
+                advert_name: dev.advert_name(),
+                region: cfg.region,
+                modem_preset: cfg.modem_preset,
+                primary_channel: cfg.primary_channel,
+                secondary_channel: cfg.secondary_channel,
+                max_contacts: Some(info.max_contacts),
+            });
+        }
+    }
+    anyhow::bail!("no supported mesh radio firmware answered on {path}")
+}
+
 async fn open_preferred_path(
     path: &str,
     data_dir: &Path,
@@ -859,6 +955,7 @@ pub(super) async fn run_mesh_session(
     channel_name: Option<&str>,
     device_kind: Option<DeviceType>,
     reticulum_tcp: Option<ReticulumTcpConfig>,
+    manage_radio: bool,
     shutdown: &mut tokio::sync::watch::Receiver<bool>,
     cmd_rx: &mut mpsc::Receiver<MeshCommand>,
 ) -> Result<()> {
@@ -923,8 +1020,15 @@ pub(super) async fn run_mesh_session(
     // re-handshake the freshly-rebooted radio (and then set its name on the
     // reconnect, where the region already matches and no reboot occurs).
     use std::sync::atomic::Ordering;
+    if !manage_radio {
+        // Keep-as-is mode (hot-swap "keep as is" decision): the operator told
+        // us to use whatever is flashed/configured on this radio. Skip every
+        // config write below — region, channel, PHY params, advert name — and
+        // run with the device's own settings.
+        info!("manage_radio=false — leaving the radio's own configuration untouched");
+    }
     let region_attempts = REGION_PROVISION_ATTEMPTS.load(Ordering::Relaxed);
-    if region_attempts < MAX_REGION_PROVISION_ATTEMPTS {
+    if manage_radio && region_attempts < MAX_REGION_PROVISION_ATTEMPTS {
         match device.ensure_lora_region(lora_region).await {
             Ok(true) => {
                 REGION_PROVISION_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
@@ -943,7 +1047,7 @@ pub(super) async fn run_mesh_session(
             Ok(false) => REGION_PROVISION_ATTEMPTS.store(0, Ordering::Relaxed),
             Err(e) => warn!("Failed to provision LoRa region: {}", e),
         }
-    } else if lora_region.is_some() {
+    } else if manage_radio && lora_region.is_some() {
         warn!(
             region = lora_region.unwrap_or(""),
             attempts = MAX_REGION_PROVISION_ATTEMPTS,
@@ -958,7 +1062,7 @@ pub(super) async fn run_mesh_session(
     // the radio). Without a matching channel two same-region radios still can't
     // decode each other's traffic. Same retry-cap + restart-on-change pattern.
     let channel_attempts = CHANNEL_PROVISION_ATTEMPTS.load(Ordering::Relaxed);
-    if channel_attempts < MAX_REGION_PROVISION_ATTEMPTS {
+    if manage_radio && channel_attempts < MAX_REGION_PROVISION_ATTEMPTS {
         match device.ensure_channel(channel_name).await {
             Ok(true) => {
                 CHANNEL_PROVISION_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
@@ -974,7 +1078,7 @@ pub(super) async fn run_mesh_session(
             Ok(false) => CHANNEL_PROVISION_ATTEMPTS.store(0, Ordering::Relaxed),
             Err(e) => warn!("Failed to provision mesh channel: {}", e),
         }
-    } else if channel_name.is_some() {
+    } else if manage_radio && channel_name.is_some() {
         warn!(
             channel = channel_name.unwrap_or(""),
             attempts = MAX_REGION_PROVISION_ATTEMPTS,
@@ -991,7 +1095,9 @@ pub(super) async fn run_mesh_session(
     // versions), so we send the set-command once per configured value and never
     // reboot-loop a radio that refuses it. The firmware reboots on RESP_OK, so
     // a successful write restarts the session like the region path.
-    if let (Some(params), MeshRadioDevice::Meshcore(dev)) = (lora_radio_params, &mut device) {
+    if let (true, Some(params), MeshRadioDevice::Meshcore(dev)) =
+        (manage_radio, lora_radio_params, &mut device)
+    {
         let marker_path = data_dir.join("meshcore-radio-params.json");
         let applied: Option<crate::mesh::LoraRadioParams> = tokio::fs::read(&marker_path)
             .await
@@ -1040,23 +1146,27 @@ pub(super) async fn run_mesh_session(
     }
 
     // Set advert name to the server's human-readable name (e.g. "ThinkPad"),
-    // falling back to the DID fragment if no name is configured.
-    let advert_name = if let Some(name) = server_name {
-        // Meshcore firmware limits advert names — truncate to 20 chars
-        name.chars().take(20).collect::<String>()
-    } else {
-        let short_did = our_did.chars().skip(8).take(8).collect::<String>();
-        format!("Archy-{}", short_did)
-    };
-    if let Err(e) = device.set_advert_name(&advert_name).await {
-        warn!("Failed to set advert name: {}", e);
-    } else {
-        // Reflect the post-set name in MeshStatus too so the UI can filter
-        // its own radio echo from the peer list. Without this, the status
-        // still carries whatever pre-set name the firmware reported and the
-        // self-filter never matches.
-        let mut status = state.status.write().await;
-        status.self_advert_name = Some(advert_name.clone());
+    // falling back to the DID fragment if no name is configured. Skipped in
+    // keep-as-is mode — the radio keeps the name it came with (already
+    // reflected in status from the connect handshake).
+    if manage_radio {
+        let advert_name = if let Some(name) = server_name {
+            // Meshcore firmware limits advert names — truncate to 20 chars
+            name.chars().take(20).collect::<String>()
+        } else {
+            let short_did = our_did.chars().skip(8).take(8).collect::<String>();
+            format!("Archy-{}", short_did)
+        };
+        if let Err(e) = device.set_advert_name(&advert_name).await {
+            warn!("Failed to set advert name: {}", e);
+        } else {
+            // Reflect the post-set name in MeshStatus too so the UI can filter
+            // its own radio echo from the peer list. Without this, the status
+            // still carries whatever pre-set name the firmware reported and the
+            // self-filter never matches.
+            let mut status = state.status.write().await;
+            status.self_advert_name = Some(advert_name.clone());
+        }
     }
 
     // Broadcast our advertisement so other nodes can discover us

core/archipelago/src/mesh/meshtastic.rs

@@ -167,7 +167,43 @@ pub struct MeshtasticDevice {
     pending_reinit: bool,
 }
 
+/// Read-only snapshot of the radio config learned during `initialize`'s
+/// `want_config` stream — surfaced by the hot-swap probe so the setup modal
+/// can show what's currently on a just-plugged radio.
+#[derive(Debug, Clone)]
+pub struct MeshtasticProbedConfig {
+    pub region: Option<String>,
+    pub modem_preset: Option<String>,
+    pub primary_channel: Option<String>,
+    pub secondary_channel: Option<String>,
+}
+
 impl MeshtasticDevice {
+    /// See [`MeshtasticProbedConfig`]. Everything here was learned via reads
+    /// (`want_config`) — safe for a probe that must not modify the device.
+    pub fn probed_config(&self) -> MeshtasticProbedConfig {
+        MeshtasticProbedConfig {
+            region: self
+                .current_region
+                .and_then(region_code_to_name)
+                .map(str::to_string),
+            modem_preset: self
+                .current_modem_preset
+                .and_then(modem_preset_name)
+                .map(str::to_string),
+            primary_channel: self.current_primary_channel.as_ref().map(|(name, _)| {
+                if name.is_empty() {
+                    "(default public)".to_string()
+                } else {
+                    name.clone()
+                }
+            }),
+            secondary_channel: self
+                .current_secondary_channel
+                .as_ref()
+                .map(|(name, _)| name.clone()),
+        }
+    }
     pub async fn open(path: &str) -> Result<Self> {
         match tokio::fs::metadata(path).await {
             Ok(meta) => {
@@ -1321,6 +1357,53 @@ fn derive_channel_psk(channel_name: &str) -> Vec<u8> {
 /// Map a Meshtastic `RegionCode` name (as set in `mesh-config.json`, e.g.
 /// "EU_868", "US", "ANZ") to its protobuf enum value. Case-insensitive.
 /// Returns `None` for an unrecognised name so we never write a bogus region.
+/// Inverse of `region_name_to_code` — for showing a probed radio's current
+/// region to the user (hot-swap setup modal).
+pub(crate) fn region_code_to_name(code: u32) -> Option<&'static str> {
+    Some(match code {
+        0 => "UNSET",
+        1 => "US",
+        2 => "EU_433",
+        3 => "EU_868",
+        4 => "CN",
+        5 => "JP",
+        6 => "ANZ",
+        7 => "KR",
+        8 => "TW",
+        9 => "RU",
+        10 => "IN",
+        11 => "NZ_865",
+        12 => "TH",
+        13 => "LORA_24",
+        14 => "UA_433",
+        15 => "UA_868",
+        16 => "MY_433",
+        17 => "MY_919",
+        18 => "SG_923",
+        19 => "PH_433",
+        20 => "PH_868",
+        21 => "PH_915",
+        22 => "ANZ_433",
+        _ => return None,
+    })
+}
+
+/// Meshtastic `Config.LoRaConfig.ModemPreset` enum names, for display.
+pub(crate) fn modem_preset_name(code: u32) -> Option<&'static str> {
+    Some(match code {
+        0 => "LONG_FAST",
+        1 => "LONG_SLOW",
+        2 => "VERY_LONG_SLOW",
+        3 => "MEDIUM_SLOW",
+        4 => "MEDIUM_FAST",
+        5 => "SHORT_SLOW",
+        6 => "SHORT_FAST",
+        7 => "LONG_MODERATE",
+        8 => "SHORT_TURBO",
+        _ => return None,
+    })
+}
+
 pub(crate) fn region_name_to_code(name: &str) -> Option<u32> {
     Some(match name.trim().to_uppercase().as_str() {
         "UNSET" => 0,

core/archipelago/src/mesh/mod.rs

@@ -420,6 +420,12 @@ pub struct MeshConfig {
     /// serial-only/auto-detect behavior unchanged.
     #[serde(default)]
     pub reticulum_tcp: Option<types::ReticulumTcpConfig>,
+    /// Whether archipelago manages the radio's configuration (region, shared
+    /// channel, PHY params, advert name) on connect. `true` (default) is
+    /// today's behavior. `false` = the hot-swap modal's "keep as is": use the
+    /// radio exactly as flashed — no config writes at all.
+    #[serde(default = "default_true")]
+    pub manage_radio: bool,
 }
 
 /// True when `name` is a LoRa region the Meshtastic driver can program
@@ -458,6 +464,7 @@ impl Default for MeshConfig {
             assistant_allowed_contacts: Vec::new(),
             device_kind: None,
             reticulum_tcp: None,
+            manage_radio: true,
         }
     }
 }
@@ -691,6 +698,13 @@ impl MeshService {
             }
         }
 
+        // Restore the message history + outbound send-sequence counters, then
+        // keep them persisted. Until 2026-07-22 both were RAM-only: every
+        // restart wiped the chat history, and the reset sequence counters made
+        // peers drop the first post-reboot messages as (pubkey, seq) replays.
+        state.load_persisted_messages().await;
+        listener::spawn_message_persister(Arc::clone(&state));
+
         Ok(Self {
             state,
             config,
@@ -748,6 +762,7 @@ impl MeshService {
             self.config.channel_name.clone(),
             self.config.device_kind,
             self.config.reticulum_tcp.clone(),
+            self.config.manage_radio,
             shutdown_rx,
             cmd_rx,
         );
@@ -1004,6 +1019,21 @@ impl MeshService {
         self.state.peers.read().await.values().cloned().collect()
     }
 
+    /// Probe a serial port for a mesh radio without provisioning or keeping
+    /// it — powers the hot-swap "device detected" modal's current-details
+    /// view. Refuses to probe the port the live session currently occupies
+    /// (the probe would steal the serial port from under the session); a
+    /// detected-but-not-connected port is fair game, accepting a benign race
+    /// with the reconnect loop (whichever loses just retries).
+    pub async fn probe_device(&self, path: &str) -> Result<listener::DeviceProbe> {
+        let status = self.state.status.read().await;
+        if status.device_connected && status.device_path.as_deref() == Some(path) {
+            anyhow::bail!("{path} is the active mesh radio — already connected");
+        }
+        drop(status);
+        listener::probe_device(path).await
+    }
+
     /// Get message history.
     pub async fn messages(&self, limit: Option<usize>) -> Vec<MeshMessage> {
         let messages = self.state.messages.read().await;

core/archipelago/src/mesh/protocol.rs

@@ -353,6 +353,28 @@ pub fn build_get_stats() -> Vec<u8> {
 
 // ─── Response parsers ───────────────────────────────────────────────────
 
+/// Decode a device/contact name from raw frame bytes, defensively.
+///
+/// Name fields sit at firmware-version-dependent offsets; when an offset
+/// lands inside binary data (path/pubkey bytes), `from_utf8_lossy` used to
+/// hand the UI replacement-character soup ("�\u{618}…"). Strict rules: valid
+/// UTF-8 up to the first NUL, no control characters, at least one
+/// non-whitespace char — anything else gets the caller's readable fallback.
+fn decode_mesh_name(bytes: &[u8], fallback: &str) -> String {
+    let end = bytes.iter().position(|&b| b == 0).unwrap_or(bytes.len());
+    match std::str::from_utf8(&bytes[..end]) {
+        Ok(s) => {
+            let s = s.trim();
+            if !s.is_empty() && s.chars().all(|c| !c.is_control()) {
+                s.to_string()
+            } else {
+                fallback.to_string()
+            }
+        }
+        Err(_) => fallback.to_string(),
+    }
+}
+
 /// Parse RESP_DEVICE_INFO (0x0D) response.
 /// Returns firmware version string and device capabilities.
 pub fn parse_device_info(data: &[u8]) -> Result<(String, u16)> {
@@ -384,15 +406,12 @@ pub fn parse_self_info(data: &[u8]) -> Result<(u32, String)> {
 
     let node_id = u32::from_le_bytes([data[0], data[1], data[2], data[3]]);
 
-    // Name follows after fixed fields — find it by scanning for printable ASCII
+    // Name follows after fixed fields. A firmware whose fixed-field layout
+    // differs would put binary here — decode defensively so the settings
+    // panel never shows byte soup.
     let name_start = 4;
     let name = if data.len() > name_start {
-        let name_end = data[name_start..]
-            .iter()
-            .position(|&b| b == 0)
-            .map(|p| name_start + p)
-            .unwrap_or(data.len());
-        String::from_utf8_lossy(&data[name_start..name_end]).to_string()
+        decode_mesh_name(&data[name_start..], &format!("node-{node_id:08x}"))
     } else {
         String::new()
     };
@@ -453,12 +472,11 @@ pub fn parse_contact(data: &[u8]) -> Result<ParsedContact> {
     // name at data[99..131] (32 bytes)
     let name_start = 99.min(data.len());
     let name_end = (name_start + 32).min(data.len());
+    let short_id = format!("{}...", &public_key_hex[..8]);
     let advert_name = if data.len() > name_start {
-        String::from_utf8_lossy(&data[name_start..name_end])
-            .trim_end_matches('\0')
-            .to_string()
+        decode_mesh_name(&data[name_start..name_end], &short_id)
     } else {
-        format!("{}...", &public_key_hex[..8])
+        short_id
     };
 
     // last_advert at data[131..135]

core/archipelago/src/mesh/reticulum.rs

@@ -1083,7 +1083,7 @@ fn parse_hash16(hex_str: &str) -> Result<[u8; 16]> {
 /// Send the verified RNode KISS detect sequence and look for `DETECT_RESP`.
 /// Bytes confirmed against the canonical Reticulum source — see the module
 /// doc comment and `docs/RETICULUM-TRANSPORT-PROGRESS.md`.
-async fn probe_rnode(path: &str) -> Result<()> {
+pub(crate) async fn probe_rnode(path: &str) -> Result<()> {
     let port = serial2_tokio::SerialPort::open(path, PROBE_BAUD)
         .with_context(|| format!("Failed to open {} for Reticulum probe", path))?;
     // ESP32-S3 native-USB boards (Heltec V3/V4 etc. — no separate USB-UART

core/archipelago/src/mesh/serial.rs

@@ -149,6 +149,35 @@ impl MeshcoreDevice {
         Ok(info)
     }
 
+    /// The advert name learned from SELF_INFO during `initialize`.
+    pub fn advert_name(&self) -> Option<String> {
+        self.advert_name.clone()
+    }
+
+    /// Read firmware version + contact capacity via CMD_DEVICE_QUERY (0x16).
+    /// Read-only — used by the hot-swap probe to show what's on a
+    /// just-plugged radio. Tolerates interleaved push frames and firmware
+    /// that doesn't answer the query (returns None rather than erroring).
+    pub async fn query_device_info(&mut self) -> Option<(String, u16)> {
+        if self
+            .send_raw(&protocol::build_device_query())
+            .await
+            .is_err()
+        {
+            return None;
+        }
+        for _ in 0..5 {
+            match self.recv_frame_timeout(Duration::from_secs(2)).await {
+                Ok(f) if f.code == protocol::RESP_DEVICE_INFO => {
+                    return protocol::parse_device_info(&f.data).ok();
+                }
+                Ok(_) => continue, // push notification — keep waiting
+                Err(_) => return None,
+            }
+        }
+        None
+    }
+
     /// Set the advertised name on the mesh network.
     pub async fn set_advert_name(&mut self, name: &str) -> Result<()> {
         self.send_raw(&protocol::build_set_advert_name(name))
@@ -543,6 +572,12 @@ pub struct DetectedDeviceInfo {
     pub pid: Option<String>,
     pub product: Option<String>,
     pub manufacturer: Option<String>,
+    /// Unix epoch seconds of the /dev node's creation — udev recreates the
+    /// node on every plug, so this changes on each replug. The UI keys its
+    /// "Not Now" dismissals on (path, plugged_at): swapping a stick (or
+    /// unplug/replug faster than a status poll) invalidates old dismissals
+    /// and the setup modal fires again, per the hot-swap UX (2026-07-22).
+    pub plugged_at: Option<u64>,
 }
 
 /// Like `detect_serial_devices`, but with USB metadata per port.
@@ -550,12 +585,19 @@ pub async fn detect_serial_devices_info() -> Vec<DetectedDeviceInfo> {
     let mut out = Vec::new();
     for path in detect_serial_devices().await {
         let usb = usb_info_for_tty(&path).await;
+        let plugged_at = tokio::fs::metadata(&path)
+            .await
+            .ok()
+            .and_then(|m| m.modified().ok())
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+            .map(|d| d.as_secs());
         out.push(DetectedDeviceInfo {
             path,
             vid: usb.0,
             pid: usb.1,
             product: usb.2,
             manufacturer: usb.3,
+            plugged_at,
         });
     }
     out

core/archipelago/src/mesh_ports.rs

@@ -0,0 +1,145 @@
+//! Mirror IPv4-published app ports onto IPv6 for mesh access.
+//!
+//! The companion (and anything else on the FIPS mesh) reaches this node at
+//! its fips0 ULA. The web UI builds app links from the current host + each
+//! app's DIRECT port (Direct Port Rule) — but rootless-podman published
+//! ports bind 0.0.0.0 only, so `http://[<ULA>]:8334` was refused for every
+//! catalog app even after nginx :80 learned IPv6 (2026-07-23, third
+//! "the node wasn't listening on v6" bug of the night).
+//!
+//! Instead of touching the container layer (port-publish changes would
+//! recreate every container), a reconcile loop mirrors the host's public
+//! IPv4 listeners: any port ≥1024 listening on 0.0.0.0 without an IPv6
+//! any-address listener gets a v6-only `[::]:<port>` forwarder to
+//! `127.0.0.1:<port>`. Ports appear/disappear with app install/remove, so
+//! the mirror follows `/proc/net/tcp*` rather than the catalog — companion
+//! containers with hardcoded ports (bitcoin-ui :8334) are covered the same
+//! as manifest-declared ones. Nothing is exposed that IPv4 didn't already
+//! expose to the LAN; the ULA is the established remote-access surface.
+
+use std::collections::{HashMap, HashSet};
+use std::net::{Ipv6Addr, SocketAddrV6};
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use tokio::task::JoinHandle;
+use tracing::{debug, info, warn};
+
+const RECONCILE_INTERVAL: Duration = Duration::from_secs(15);
+/// Never mirror system ports; nginx (80/443) handles its own v6 listeners.
+const MIN_PORT: u16 = 1024;
+
+/// Entry point — spawned from main; runs for the process lifetime.
+pub async fn run_mesh_port_mirror() {
+    let mut active: HashMap<u16, JoinHandle<()>> = HashMap::new();
+    loop {
+        match reconcile(&mut active).await {
+            Ok(()) => {}
+            Err(e) => debug!("mesh-ports: reconcile skipped: {e:#}"),
+        }
+        tokio::time::sleep(RECONCILE_INTERVAL).await;
+    }
+}
+
+async fn reconcile(active: &mut HashMap<u16, JoinHandle<()>>) -> Result<()> {
+    let v4 = listening_ports("/proc/net/tcp", 8).await?;
+    let v6 = listening_ports("/proc/net/tcp6", 32).await?;
+
+    // Drop mirrors whose backing IPv4 listener vanished (app removed/stopped).
+    active.retain(|port, handle| {
+        if v4.contains(port) && !handle.is_finished() {
+            true
+        } else {
+            handle.abort();
+            info!("mesh-ports: released [::]:{port} (backing 0.0.0.0 listener gone)");
+            false
+        }
+    });
+
+    for port in v4 {
+        if port < MIN_PORT || active.contains_key(&port) {
+            continue;
+        }
+        // A foreign IPv6 any-listener already serves this port (our own
+        // mirrors are excluded above via `active`).
+        if v6.contains(&port) {
+            continue;
+        }
+        match spawn_forwarder(port) {
+            Ok(handle) => {
+                info!("mesh-ports: mirroring [::]:{port} -> 127.0.0.1:{port}");
+                active.insert(port, handle);
+            }
+            Err(e) => debug!("mesh-ports: cannot mirror port {port}: {e:#}"),
+        }
+    }
+    Ok(())
+}
+
+/// Ports in LISTEN state bound to the any-address, parsed from /proc/net/tcp
+/// (`addr_hex_len` 8) or /proc/net/tcp6 (32).
+async fn listening_ports(path: &str, addr_hex_len: usize) -> Result<HashSet<u16>> {
+    let raw = tokio::fs::read_to_string(path)
+        .await
+        .with_context(|| format!("read {path}"))?;
+    let any_addr = "0".repeat(addr_hex_len);
+    let mut ports = HashSet::new();
+    for line in raw.lines().skip(1) {
+        let mut cols = line.split_whitespace();
+        let (Some(_sl), Some(local), Some(_rem), Some(state)) =
+            (cols.next(), cols.next(), cols.next(), cols.next())
+        else {
+            continue;
+        };
+        if state != "0A" {
+            continue; // not LISTEN
+        }
+        let Some((addr, port_hex)) = local.split_once(':') else {
+            continue;
+        };
+        if addr != any_addr {
+            continue;
+        }
+        if let Ok(port) = u16::from_str_radix(port_hex, 16) {
+            ports.insert(port);
+        }
+    }
+    Ok(ports)
+}
+
+/// A v6-only listener on [::]:port forwarding each connection to 127.0.0.1:port.
+fn spawn_forwarder(port: u16) -> Result<JoinHandle<()>> {
+    use socket2::{Domain, Protocol, Socket, Type};
+    let socket =
+        Socket::new(Domain::IPV6, Type::STREAM, Some(Protocol::TCP)).context("create v6 socket")?;
+    // v6only so we coexist with the app's own 0.0.0.0:<port> bind.
+    socket.set_only_v6(true).context("set v6only")?;
+    socket.set_reuse_address(true).ok();
+    socket.set_nonblocking(true).context("set nonblocking")?;
+    let addr = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, port, 0, 0);
+    socket.bind(&addr.into()).context("bind [::]")?;
+    socket.listen(128).context("listen")?;
+    let listener =
+        tokio::net::TcpListener::from_std(socket.into()).context("register with tokio")?;
+
+    Ok(tokio::spawn(async move {
+        loop {
+            let (mut inbound, _peer) = match listener.accept().await {
+                Ok(conn) => conn,
+                Err(e) => {
+                    warn!("mesh-ports: accept failed on [::]:{port}: {e}");
+                    tokio::time::sleep(Duration::from_millis(500)).await;
+                    continue;
+                }
+            };
+            tokio::spawn(async move {
+                match tokio::net::TcpStream::connect(("127.0.0.1", port)).await {
+                    Ok(mut upstream) => {
+                        let _ = tokio::io::copy_bidirectional(&mut inbound, &mut upstream).await;
+                    }
+                    Err(e) => debug!("mesh-ports: upstream 127.0.0.1:{port} refused: {e}"),
+                }
+            });
+        }
+    }))
+}

core/archipelago/src/node_message.rs

@@ -406,7 +406,10 @@ pub async fn check_peer_reachable(onion: &str, fips_npub: Option<&str>) -> Resul
     validate_onion(onion)?;
     match crate::fips::dial::PeerRequest::new(fips_npub, onion, "/health")
         .service(crate::settings::transport::PeerService::Messaging)
-        .timeout(std::time::Duration::from_secs(30))
+        // 12s, not 30s: this is a liveness dot, not a data transfer. A Tor
+        // circuit that hasn't answered /health in 12s is "offline" for UI
+        // purposes; the old 30s made the Connected Nodes probes crawl.
+        .timeout(std::time::Duration::from_secs(12))
         .send_get()
         .await
     {

core/archipelago/src/nostr_handshake.rs

@@ -307,9 +307,19 @@ async fn send_handshake_message(
 
     let builder = EventBuilder::new(Kind::EncryptedDirectMessage, encrypted)
         .tag(Tag::public_key(recipient_pk));
-    let _ = client.send_event_builder(builder).await;
+    // Surface real delivery failures. Before 2026-07-22 this was `let _ =`,
+    // so a request no relay accepted still reported ok:true to the UI and
+    // the sender believed it was delivered.
+    let send = client.send_event_builder(builder).await;
     client.disconnect().await;
-    Ok(())
+    match send {
+        Ok(output) if !output.success.is_empty() => Ok(()),
+        Ok(output) => anyhow::bail!(
+            "no relay accepted the handshake event (tried {}, all failed)",
+            output.failed.len()
+        ),
+        Err(e) => anyhow::bail!("failed to publish handshake event: {e}"),
+    }
 }
 
 /// Send a `PeerRequest` to a discovered node's nostr pubkey. We never

core/archipelago/src/nostr_relays.rs

@@ -47,6 +47,21 @@ const DEFAULT_RELAYS: &[&str] = &[
     "wss://relay.current.fyi",
 ];
 
+/// The union of the boot-config relay list and the user-managed (enabled)
+/// relays — the set every nostr-facing operation should use, so senders and
+/// receivers always overlap regardless of which list the operator edited.
+pub async fn merged_relay_list(data_dir: &Path, config_relays: &[String]) -> Vec<String> {
+    let mut relays: Vec<String> = config_relays.to_vec();
+    if let Ok(store) = load_relays(data_dir).await {
+        for r in store.relays {
+            if r.enabled && !relays.contains(&r.url) {
+                relays.push(r.url);
+            }
+        }
+    }
+    relays
+}
+
 pub async fn load_relays(data_dir: &Path) -> Result<RelayStore> {
     let path = data_dir.join(RELAYS_FILE);
     if !path.exists() {

core/archipelago/src/server.rs

@@ -101,6 +101,15 @@ impl Server {
         }
         state_manager.update_data(data.clone()).await;
 
+        // Real-time wallet push: stream LND transaction events → websocket
+        // revision nudges, so an incoming on-chain tx shows in the UI within
+        // seconds of hitting the mempool (works whenever LND is up; retries
+        // forever otherwise). User req 2026-07-22.
+        crate::api::rpc::lnd::spawn_lnd_tx_watcher(state_manager.clone());
+        // LND wedge watchdog — self-heal the silent "RPC up, server never
+        // ready" state instead of waiting for a human (100%-uptime req).
+        crate::api::rpc::lnd::spawn_lnd_health_watchdog();
+
         // Retry Tor address in background — Tor may not be ready at startup
         if data.server_info.tor_address.is_none() {
             let sm = state_manager.clone();
@@ -203,9 +212,15 @@ impl Server {
             let did =
                 identity::did_key_from_pubkey_hex(&data.server_info.pubkey).unwrap_or_default();
             let version = data.server_info.version.clone();
-            let relays = config.nostr_relays.clone();
+            // Merged relay set (config + user-managed) — publish presence
+            // where handshake peers actually read (2026-07-22 unification).
+            let data_dir_for_relays = config.data_dir.clone();
+            let config_relays = config.nostr_relays.clone();
             let tor_proxy = config.nostr_tor_proxy.clone();
             tokio::spawn(async move {
+                let relays =
+                    crate::nostr_relays::merged_relay_list(&data_dir_for_relays, &config_relays)
+                        .await;
                 if let Err(e) = nostr_handshake::publish_presence(
                     &identity_dir,
                     &did,
@@ -247,6 +262,23 @@ impl Server {
             .await?,
         );
 
+        // Background handshake poll: fetch inbound nostr peer requests every
+        // 5 minutes instead of only when a user presses the Federation Poll
+        // button (requests used to sit on relays unseen — 2026-07-22). The
+        // handler's own discoverability gate makes this a no-op until the
+        // user opts in.
+        {
+            let rpc = api_handler.rpc_handler().clone();
+            tokio::spawn(async move {
+                let mut tick = tokio::time::interval(std::time::Duration::from_secs(300));
+                tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+                loop {
+                    tick.tick().await;
+                    rpc.background_handshake_poll().await;
+                }
+            });
+        }
+
         // Initialize mesh networking service (if config has enabled: true)
         {
             let data_dir = config.data_dir.clone();

core/archipelago/src/wallet/ecash.rs

@@ -632,11 +632,30 @@ pub async fn send_token_at(data_dir: &Path, mint_url: &str, amount_sats: u64) ->
         // Mark original proofs as spent
         wallet.mark_spent(&indices);
 
-        // Separate send proofs from change proofs
-        let (send, change): (Vec<_>, Vec<_>) = swap_result
-            .new_proofs
-            .into_iter()
-            .partition(|p| send_denoms.contains(&p.amount));
+        // Separate send proofs from change proofs BY COUNT, not membership:
+        // partition(contains) put EVERY proof whose denomination appeared in
+        // send_denoms into the token — when change shared a denomination with
+        // the send (worst case: spending from a proof worth exactly 2× the
+        // amount, send [n] + change [n]), the change proofs rode along and the
+        // receiver was credited double. Consume exactly one proof per needed
+        // send denomination; everything else is change.
+        let mut send_needed = send_denoms.clone();
+        let mut send: Vec<Proof> = Vec::new();
+        let mut change: Vec<Proof> = Vec::new();
+        for p in swap_result.new_proofs {
+            if let Some(pos) = send_needed.iter().position(|&d| d == p.amount) {
+                send_needed.swap_remove(pos);
+                send.push(p);
+            } else {
+                change.push(p);
+            }
+        }
+        if !send_needed.is_empty() {
+            anyhow::bail!(
+                "Mint swap returned incomplete send denominations (missing {:?})",
+                send_needed
+            );
+        }
 
         // Add change proofs back to wallet
         if !change.is_empty() {

demo/aiui/index.html

@@ -3,6 +3,12 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
+    <!-- Must agree with the embedding neode-ui shell (color-scheme: dark):
+         browsers only honor a transparent same-origin iframe canvas when
+         embedder and iframe use the SAME color-scheme — without this, the
+         shell's :root{color-scheme:dark} forces this frame opaque and the
+         background art behind the chat vanishes (2026-07-23). -->
+    <meta name="color-scheme" content="dark light" />
     <meta name="theme-color" content="#0a0a0a" media="(prefers-color-scheme: dark)" />
     <meta name="theme-color" content="#faf9f6" media="(prefers-color-scheme: light)" />
     <meta name="mobile-web-app-capable" content="yes" />

docs/HANDOFF-2026-07-23-companion-apk-deploy.md

@@ -0,0 +1,205 @@
+# HANDOFF — deploy companion APK 0.5.1 (vc21) to nodes
+
+**For: the agent on archi-dev-box.** User-reported failure this evening:
+pairing flow on Framework PT — downloaded the companion from the node's
+QR, then the pairing scan didn't work. The APK the node serves predates
+today's scanner fixes; the pipeline below gets the fixed build into the
+user's hands.
+
+## What changed on main today (all merged)
+
+- **Pairing-scanner fix** (`QrScannerOverlay.kt`): ZXing decode attempts are
+  frame-gated (~7/s, was every frame — the CPU contention made the preview
+  stutter badly enough to never decode) and PreviewView uses TextureView (no
+  more black flash on open). This is the likely fix for "doesn't scan".
+- Three-finger menu gesture (was two-finger, collided with scroll) + one-time
+  teaching overlay ~2 min after login.
+- Native wallet QR scanner behind `window.ArchipelagoQr` + WebView file-chooser
+  support; web scan modal hands live scanning to it.
+- npub-keyed saved servers (pairing contract item 1, PR #106).
+- Served APK refreshed: `neode-ui/public/packages/archipelago-companion.apk`
+  is now **0.5.3 / versionCode 23**. On top of the 0.5.1 scanner fixes it
+  guarantees dual-path peering — the node's LAN endpoint (direct p2p, npub-
+  keyed dial hints) AND the Archipelago public anchor (vps2, baked into the
+  app so even an old node's QR can't leave the phone LAN-only) — and fixes
+  the two field failures from the user's 5G test (screenshots, 21:54):
+  - **Mesh VPN no longer kills the phone's internet** — the IPv6-only TUN
+    never called `allowFamily(AF_INET)`, so Android blocked all IPv4 while
+    the mesh was up. Now allowed (+ `allowBypass`).
+  - **Off-LAN connect works** — `connect()` no longer hard-fails when the
+    scanned LAN IP doesn't answer; it brings the mesh up and probes the
+    node's ULA (`meshIp`) with retries before reporting failure.
+
+## What to do
+
+1. Redeploy the web-ui bundle from current main to the active nodes —
+   web root `/opt/archipelago/web-ui/` (NOT a neode-ui/ subfolder), all
+   nodes the user pairs against, at minimum the one Framework PT scans.
+2. Verify the served artifact really updated:
+   `curl -sI http://<node>/packages/archipelago-companion.apk` — size should
+   change (~27 MB build of 2026-07-23), or pull it and check
+   `aapt dump badging` shows `versionCode='21' versionName='0.5.1'`.
+3. The demo stack gets its images from CI (run 100 pushed today with the new
+   web bundle) — confirm the Portainer stack re-pulled, or trigger its
+   redeploy, so the demo QR also serves vc21.
+4. **Node side is half the 5G story**: away-from-home reachability needs the
+   NODE connected to the public anchor too. On Framework PT (and any test
+   node): deploy current main (node-side npub-first `fips.pair-info`), then
+   verify `sudo -n fipsctl show status` reports the anchor connected —
+   `fips.reconnect` RPC if not. A phone can dial the anchor perfectly and
+   still fail if the node never enrolled with it.
+5. Re-test the user's exact flows with **vc24** (updates any older install in
+   place): (a) pair ON the LAN, then switch the phone to 5G — the UI must
+   come up via the mesh ULA; (b) pair while ALREADY on 5G (never on the
+   node's LAN) — scan, VPN consent, and the connect must succeed through
+   the anchor.
+
+## Live diagnosis update (22:30–22:50, phone on adb — Mac agent)
+
+vc23 on-device testing found and fixed the phone-side blocker, and narrowed
+what remains to the node side. State as of vc24:
+
+- **Fixed: TUN reader died at startup.** Android hands the VpnService fd over
+  non-blocking; the fips fork's blocking reader thread treats EAGAIN as fatal
+  ("TUN read error … Try again (os error 11)") — so mesh sessions came up but
+  NO packet ever entered the tunnel. archy-fips-core now forces the fd
+  blocking before `start_with_tun_fd`. Verified on-device: reader survives,
+  and the 30s anchor-link flap disappeared with it (stable 8+ min on 5G).
+- **Fixed: VPN marked not-metered** (`setMetered(false)`) — Android 10+
+  defaults VPNs to metered, putting the phone into data-restricted behaviour
+  while the mesh is up. Note the user's phone also has system **always-on
+  VPN** enabled for the app (`always_on_vpn_app`), a Settings-side toggle.
+- **Verified good on-device**: peer store has node (LAN udp/tcp hints) + vps2
+  anchor; saved server is npub-keyed with ULA; anchor session establishes
+  from 5G in ~6s; VPN is bypassable, VALIDATED, only fd00::/8 routed.
+- **REMAINING BLOCKER (node side)**: from the phone (app uid), ping6 and
+  HTTP to the node's ULA `fd79:1aa:b9e9:4c9f:1f80:5376:9385:1824` get no
+  reply — packets enter the mesh, nothing returns. Phone↔anchor works, so
+  suspect phone-fork ↔ node-daemon session/routing mismatch (FIPS wire
+  format is not stable across revs; phone pins fips-native fork 46494a74).
+  From Framework PT please capture:
+    - `fipsctl show status` (daemon version + anchor state)
+    - `fipsctl show sessions` and `show bloom` while the phone pings
+    - `ping6 <phone ULA fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586>` from the
+      node (tests the reverse path)
+    - `ip addr show fips0` + confirm the web server listens on `[::]:80`
+  Report whether the node ever sees a session attempt from
+  `npub132c5whrsa6ccs0eylcpzaejq9uxul5ldvczz0axq78dh7fxkqj9st4uvzu`.
+
+## Node-side diagnosis complete (23:00–23:30, archi-dev-box agent)
+
+Chain of findings, each verified live:
+
+1. **FIXED: nginx had no IPv6 listener anywhere** — every shipped config
+   listened on 0.0.0.0 only, so `http://[<ULA>]` could NEVER connect on any
+   node, ever. Live-fixed on framework-pt + .116, canonical conf + bootstrap
+   self-heal shipped (`1e89362e`), heal binary deployed. ULA HTTP verified
+   answering on both nodes (local + over-mesh).
+2. Firewall clean, fd00::/8 routes correct both ends, wire compat proven
+   (node + vps2 anchor both run fips 0.4.1 rev 15db6471db — the latest
+   upstream stable; nothing newer exists).
+3. **THE REMAINING PROBLEM IS MESH SESSION PATH QUALITY.** From the vps2
+   anchor — a DIRECT connected peer — `GET /health` on the node's ULA takes
+   **15–17 s per request and intermittently fails outright** (nginx logs
+   show 499 client-gave-up then 200; TCP SYN-retransmit backoff signature).
+   Session MMP is wildly asymmetric: node→vps2 srtt 204 ms, **vps2→node
+   srtt 4270 ms** — on a direct link whose raw RTT is 4 ms. Session traffic
+   is not riding the direct link; it appears to route through the ~1271-node
+   public tree (node's tree root is the public 00001a8c, depth 8; the node's
+   log also shows chronic "Discovery lookup timed out" for other targets).
+4. The phone's npub never appears in the node's sessions — consistent with
+   discovery/handshake dying on the same degraded tree path, and the app's
+   ~8 s probe window being far smaller than the observed 15 s+ first-request
+   latency even on the GOOD path.
+
+### Recommendations
+
+- **App side (Mac agent):** widen the ULA probe/connect window to ≥30 s
+  with retransmit-friendly pacing, and PRE-WARM the mesh session (start
+  pinging the node ULA as soon as the VPN is up, decoupled from the UI
+  probe) so the WebView hits a warm session.
+- **Infra decision (user):** consider detaching the fleet from the public
+  v0l mesh — private tree rooted at the vps2 anchor (drop the legacy
+  185.18.221.160 seed anchor fleet-wide AND vps2's public peering). A
+  2-hop private tree would make session paths ride the direct links and
+  should collapse latency to ms. Trade-off: no reachability to/from the
+  broader public mesh.
+- **Upstream:** report the direct-peer session-path asymmetry to
+  jmcorgan/fips (0.4.1).
+
+## App-side recommendations implemented (23:30–23:50, Mac agent — 0.5.5/vc25)
+
+- Connect probe: mesh ULA now probed inside a **60s budget** with 15s
+  per-phase timeouts (rides out TCP retransmit backoff), replacing the old
+  ~8s window.
+- **Session pre-warm**: the VPN service starts probing every saved node ULA
+  the moment the tunnel is up (5s cadence for the first minute, then a 60s
+  keep-warm tick) — discovery/handshake cost is paid in the background, and
+  the session never idles out while the mesh is connected.
+- (A phone-side ping test in this window still showed zero replies — that
+  measurement predated the vps2 daemon restart below and is superseded.)
+
+## RESOLVED — root cause was vps2's degraded daemon, NOT the public tree (23:45)
+
+The privatize-the-mesh recommendation above is WITHDRAWN. Final diagnosis:
+vps2's fips daemon (3 days uptime, 0.2% CPU, idle box) had internally
+degraded — EVERY link it carried showed ~4.5 s RTT (even to peers 30 ms
+away), and since the anchor sits on the phone↔node path, everything through
+it inherited that. `systemctl restart fips` on vps2 restored link RTTs to
+40–340 ms, and anchor→node mesh HTTP went from 14–17 s (intermittent hard
+fails) to a steady **165–275 ms**. Node↔node direct sessions were always
+fine (.116→framework-pt ULA HTTP: 894 ms cold, sub-second warm) — the
+user's read was correct.
+
+Actions taken: dead legacy anchor (185.18.221.160) removed from
+framework-pt + .116 seed files (fleet keeps vps2 + public-mesh membership
+via vps2 — we stay in the open mesh); fresh daemons on both nodes;
+**vps2 fips now has RuntimeMaxSec=1d + Restart=always** so a wedged anchor
+daemon can never rot for days again. Report the slow-degradation behaviour
+upstream (jmcorgan/fips, 0.4.1): long-running daemon in a ~1400-node mesh
+accumulates multi-second link latency at idle CPU, cleared by restart.
+
+Phone side: vc25's 60 s probe + pre-warm now has a millisecond-latency mesh
+to work with. Ready for the user's 5G test.
+
+## NEXT (00:05, Mac agent → dev-box agent): app direct ports are IPv4-only over the mesh
+
+The kiosk loads over the ULA now — but opening any APP dies with
+`ERR_CONNECTION_REFUSED` at `http://[<ULA>]:<port>/`. User-hit first on
+**Bitcoin Knots (:8334)**, and it will be every catalog app: the web UI
+builds app URLs from the current host + the app's DIRECT port (Direct Port
+Rule), and container-published ports only bind 0.0.0.0. Verified:
+`192.168.63.249:8334` → HTTP 200 (nginx), ULA:8334 → refused. Same disease
+as your :80 nginx fix, one layer down.
+
+Fix must cover EVERY catalog app port and survive app install/remove. Two
+shapes; pick what fits the container layer best:
+
+1. **IPv6 publish at the container layer** — publish on `[::]` too
+   (pasta/rootless podman support address-specific `-p`), wired into the
+   container manager so new apps inherit it; or
+2. **Host-side v6→v4 forwarders** — generated nginx `stream {}` (or
+   systemd-socket) units: `listen [::]:<port>` → `127.0.0.1:<port>`, one per
+   catalog app port, regenerated on app install/remove, boot-time
+   self-healed like the :80 fix. Keeps the Direct Port Rule URL contract
+   without touching containers.
+
+Either way: extend the bootstrap self-heal, and verify from the MESH side
+(curl the ULA on 2–3 app ports incl. :8334 from vps2 or .116) — not just
+from the LAN.
+
+## DONE (00:30, dev-box agent): app direct ports live over the mesh
+
+Shape 2-variant implemented INSIDE the backend (`mesh_ports.rs`, `2ad57c63`):
+a reconcile loop mirrors every public IPv4 listener (>=1024, bound 0.0.0.0,
+no existing IPv6 any-listener) as a v6-ONLY `[::]:<port>` forwarder to
+`127.0.0.1:<port>`, following `/proc/net/tcp*` every 15s — so app
+install/remove and hardcoded companion ports (bitcoin-ui :8334) are covered
+with zero container changes and no generated units; self-healing because it
+lives in the binary. Strictly ADDITIVE: IPv4/LAN/Tor paths untouched, v6only
+cannot intercept v4, foreign IPv6 listeners win.
+
+Verified FROM THE MESH (vps2 → node ULA): :8334 HTTP 200 (466ms),
+:18083 200 (306ms), :50002 200 (239ms); LAN :8334 still 200. Deployed to
+framework-pt + .116 (binary sha 52ac0d8a…). Direct-port apps should now
+open in the companion over 5G.

docs/combined-test-plan-2026-07-22.md

@@ -0,0 +1,118 @@
+# Combined test session — 2026-07-22 batch (one sitting)
+
+Staged on **framework-pt** (`100.65.115.109`) AND **archi thinkpad** (this
+machine's node) so everything can be tested in one pass. Items marked ✅ were
+already verified by the agent on a node; ❑ items need a human.
+
+**What's in this batch:** mesh message/DM persistence across restarts ·
+first-message + DM announce fix · 15s announce poll · radio hot-swap modal
+(probe / keep-as-is / apply-settings) · whisper beam-1 (release-gated, see §D) ·
+real-time wallet push (0-conf tx shows in seconds) · calm Lightning
+"still starting" notice · external tx-explorer fallback with consent modal +
+wallet-settings On-chain tab · apps open ABOVE modals with the launch
+animation · mempool installs no longer blocked by a resyncing ElectrumX ·
+[pending: other agents' two push sets — section F fills in when their code
+lands].
+
+## H. Wallet & explorer (new — test on the thinkpad node, it's pruned)
+
+1. ❑ **Real-time tx display:** send a small on-chain amount to this node's
+   wallet → the balance and the yellow "unconfirmed" transaction appear
+   within a few seconds of broadcast, no refresh, no wallet action.
+2. ❑ **External explorer consent:** with no local Mempool app running, tap a
+   transaction → amber consent modal explains it opens on another node's
+   mempool (default tx1138.com, placeholder mempool.guide, editable) →
+   Open Explorer opens `<explorer>/tx/<hash>` in a new tab. Tick "don't ask
+   again" and confirm the next tap opens directly.
+3. ❑ **Wallet Settings → On-chain tab:** explorer URL editable, warning shown,
+   "don't warn" toggle; tabs now read Channels / Cashu / Fedi / Ark / On-chain
+   and fit on one row (check mobile too).
+4. ❑ **Modal → app animation:** on a node WITH Mempool running, open
+   Transactions and tap a tx → the Mempool app animates in ABOVE the modal
+   (previously loaded invisibly underneath); closing it returns to the modal.
+5. ❑ **Lightning "still starting":** right after a node restart, try opening a
+   channel → either it just works (silent retry) or a calm amber ⏳ notice
+   appears — never the red "Failed to connect to peer" error.
+
+---
+
+## A. Staged state (agent-verified before you start)
+
+- ✅ Dev binary (persistence + announce seeder + hot-swap) on
+  `/usr/local/bin/archipelago`, service healthy, no crash-loop.
+- ✅ Frontend bundle with the new device modal at `/opt/archipelago/web-ui`.
+- ✅ Seeder re-ran: `automations.yaml` upgraded v1→v2 (first-message announce),
+  `configuration.yaml` rest block at `scan_interval: 15`, HA restarted clean.
+- ✅ `mesh-messages.json` persisting + restored across a service restart.
+- ✅ `mesh.probe-device` returns real firmware details for the plugged stick.
+
+## B. Mesh history survives restarts (the "messages go missing" fix)
+
+1. ❑ Open Mesh chat — your existing DM/channel history from today is visible.
+2. ❑ Send one channel message and one DM (either direction).
+3. ❑ Reboot the whole node (not just the service). After it's back: history
+   still there, including the two new messages, correct timestamps/senders.
+4. ❑ Send a NEW message to another node right after the reboot and confirm the
+   other side receives it (this exercises the send-seq fix — before it, the
+   first post-reboot sends were silently dropped by peers as replays).
+
+## C. Speaker announcements
+
+1. ❑ Have another node send a **public channel** message → speaker announces
+   sender + text within ~15s (was ~30s).
+2. ❑ Have another node send you a **DM** → speaker announces it the same way.
+3. ❑ Restart Home Assistant (or the node) → the last old message is NOT
+   re-announced (no announce storm).
+4. ❑ (First-message case — the original bug — only reproducible on a node with
+   an empty history: optional, covered by agent verification of the guard.)
+
+## D. Voice (regression + speed)
+
+1. ❑ "Hey Jarvis, what's the block height" and one fuzzy phrasing — same
+   correct answers as before (no behavior change is the pass condition).
+2. ⓘ The ~45% faster speech-to-text (whisper beam-1) ships via the **signed
+   catalog in the release** — it is NOT on the node during this test session.
+   Benchmarked on this exact hardware: identical transcripts, 0.94s → 0.51s.
+
+## E. Radio hot-swap modal (your Reticulum stick is already plugged in)
+
+1. ❑ Open the web UI anywhere — within ~30s a "Mesh Radio Detected" modal
+   appears showing the stick on `/dev/ttyACM0`, with a card of what's on it
+   (firmware badge: Reticulum RNode / MeshCore / Meshtastic + current
+   name/region/channels where the firmware exposes them).
+2. ❑ Press **Keep As Is** → mesh connects using the radio exactly as flashed
+   (check Mesh → Device tab: connected, firmware type correct; nothing on the
+   radio changed).
+3. ❑ Unplug the stick, plug the old MeshCore one → the modal appears AGAIN
+   (every plug re-triggers, same or different /dev path).
+4. ❑ This time press **Set Up with Archipelago Settings** → second screen
+   shows channel `archipelago`, your region, and the node's RF params (the
+   validated Portugal preset on this fleet) BEFORE anything is written;
+   confirm → radio provisions and joins the mesh.
+5. ❑ Swap sticks once more with no UI interaction except "Keep As Is" — chat
+   still works end-to-end afterwards (hot-swap without ceremony).
+
+## F. Companion pairing + mobile onboarding (other agent — push set #1, MERGED)
+
+1. ❑ Companion app: pair with the node via the new named QR (device tokens) —
+   pairing completes instantly, device appears in the paired-devices list.
+2. ❑ Remote access now rides the embedded FIPS mesh (WireGuard replaced):
+   with the phone OFF the node's WiFi, the companion still reaches the node.
+3. ❑ The reworked mobile onboarding/intro overlay screens flow correctly on
+   first launch of the new APK (in-tarball APK is the 27MB build).
+4. ❑ (Push set #2 from the other agents is still pending — the release waits
+   for it; this staged build does NOT include it yet.)
+
+## G. Quick regressions
+
+1. ❑ Pine launcher page (:10380) still shows the live node card; "Connect
+   Pine to WiFi" button loads without JS errors.
+2. ❑ Mobile Home: wallet card directly under My Apps (G5 from the voice epic).
+3. ❑ Mesh RF settings panel (Mesh → Device) still loads and saves.
+
+---
+
+After this passes: fold the batch + other agent's work into the next release
+(OTA binary + frontend tarball + catalog regen/sign/publish for pine-whisper
+3.4.2), then re-run `tests/lifecycle/run-gate.sh` on .228 (back online as
+Tailscale `shorty-s`).

docs/companion-pairing-qr.md

@@ -22,7 +22,7 @@ the public demo) gained a second screen:
 A single URI, also usable as an OS deep link:
 
 ```
-archipelago://pair?v=1&url=<percent-encoded server URL>[&pw=<percent-encoded password>]
+archipelago://pair?v=1&url=<origin>&name=<display name>[&tok=<device token>][&pw=<password>][&fnpub=…&fip=…&fhost=…&fudp=…&ftcp=…]
 ```
 
 Query parameters:
@@ -31,7 +31,14 @@ Query parameters:
 |-------|----------|---------|
 | `v`   | yes      | Payload version, currently `1`. Reject/ignore unknown majors gracefully — show "please update the app". |
 | `url` | yes      | Full origin the app should connect to, scheme included: `https://demo.archipelago-foundation.org`, `http://archipelago.local`, `http://192.168.1.228`, etc. No trailing slash guaranteed either way — normalize. |
+| `name`| no       | Display name for the server entry. Real nodes send the configured server name, or `My Archipelago` when it's still the factory default. |
+| `tok` | no       | **Device token** minted via `auth.createDeviceToken` when the QR is rendered. The app logs in with `{"method":"auth.login","params":{"token":"…"}}` — same endpoint, same rate limiter, skips TOTP (the token was minted from an authenticated session). Long-lived until re-minted (re-showing the pair screen replaces the `companion` token) or revoked (`auth.revokeDeviceToken`). Scan → instantly connected, no typing. |
 | `pw`  | no       | Login password. **Only present in the public demo** (shared demo password `entertoexit`). Real nodes never embed a password — the frontend doesn't have it. |
+| `fnpub` | no     | Node's FIPS mesh identity (bech32 npub of the daemon's seed-derived key). Presence of this param means "this node speaks FIPS — mesh with it". |
+| `fip` | no       | Node's `fips0` ULA (IPv6). Once the phone is meshed, the node's UI stays reachable at `http://[<fip>]` from anywhere — this is the remote-access address (replaces the old WireGuard 10.44.0.1 flow). |
+| `fhost` | no     | Host the phone's embedded FIPS dials (same host `url` resolved to). |
+| `fudp` / `ftcp` | no | Mesh transport ports on `fhost` (currently 2121/udp and 8443/tcp). |
+| `fanchors` | no | Comma-joined `npub@host:port/transport` rendezvous anchors, capped at 4. **The FIRST entry is the paired node itself** (`fnpub` at its current LAN host — the addr is a dial *hint*, the npub is the identity). The remaining entries are the node's seed anchors, and the node guarantees the Archipelago public anchor (vps2, `146.59.87.168:8444/tcp`) is present even if the operator trimmed their own list — so the phone can always rendezvous through the public mesh when the LAN endpoint is unreachable (away from home / NAT). |
 
 Examples the web UI actually emits:
 
@@ -65,12 +72,52 @@ Examples the web UI actually emits:
      the parse on scheme.
    - Bad/foreign QR → clear error, stay on the scan screen.
 
-## Notes / future extensions (not in v1)
+## Landed extensions (2026-07-22)
 
-- A real-node pairing **token** instead of a password (backend mints a one-time
-  token, QR carries it, app exchanges it for a session) — needs a backend RPC;
-  the `v` param exists so we can bump when this lands.
-- Optional `name` param (node display name) so the app labels the entry nicely.
+- **Device token** (`tok`) — real nodes now pair instantly; see the param table.
+  Minting replaces the previous `companion` token, so merely re-opening the pair
+  screen invalidates a previously issued token (the phone's session/remember
+  cookies keep working; a re-scan re-pairs).
+- **`name`** — the app labels the entry with the node's server name
+  ("My Archipelago" when unset).
+- **FIPS mesh params** (`fnpub`/`fip`/`fhost`/`fudp`/`ftcp`/`fanchors`) — the
+  companion app embeds a leaf-only FIPS node (Android/rust/archy-fips-core)
+  behind a split-tunnel VpnService and dials the node + rendezvous anchors on
+  scan. This replaces the WireGuard install/tunnel onboarding screens entirely;
+  remote access = the node's fips0 ULA (`fip`), which the WebView falls back to
+  automatically when the LAN address stops answering.
+
+## npub-first connectivity (2026-07-23 — REQUIRED app-side changes)
+
+The QR used to be effectively IP-first: the app connected to `url`/`fhost` and
+broke as soon as the LAN renumbered or the phone left home. FIPS peers on
+**npubs**; IPs are only dial hints. The app must treat them that way:
+
+1. **Identity = `fnpub`.** The saved server entry is keyed by the node's npub
+   (fall back to origin only when the QR has no FIPS params). Re-scanning the
+   same npub updates the entry even if every address changed.
+2. **Peer with the node itself as the first anchor** (`fanchors[0]`): on LAN
+   this is direct p2p over FIPS (mDNS/known-endpoint dial via archy-fips-core
+   v0.4+, which discovers LAN peers without any IP pinning), so it keeps
+   working after DHCP renumbering.
+3. **Peer with the public anchors too** (remaining `fanchors` entries — the
+   Archipelago vps2 anchor is always included by the node): away from LAN the
+   phone routes to the node's npub via the public mesh and reaches the UI at
+   `http://[<fip>]` (the fips0 ULA).
+4. **Address selection order** for the WebView: LAN `url` when it answers →
+   ULA `fip` over the mesh otherwise. Never hard-fail because the scanned LAN
+   IP stopped existing.
+
+(Node-side counterpart shipped 2026-07-23: `fips.pair-info` always includes
+the vps2 public anchor, and the web UI prepends the node's self-anchor to
+`fanchors`.)
+
+App-side status: items 2/3 were already covered by `FipsPreferences.
+upsertNodePeer` (npub-matched peers, self-anchor dedup) and item 4 by the
+WebView's `meshFallbackUrl` retry. Item 1 shipped 2026-07-23: `ServerEntry`
+carries `npub` (trailing serialization field, legacy entries still parse) and
+`ServerPreferences` matches saved/active entries via `sameNode` — npub first,
+address/port/scheme only as the LAN-only fallback.
 
 ## Testing checklist (app side)
 

docs/pine-voice-commands.md

@@ -0,0 +1,170 @@
+# Pine voice commands — the "what can I say" book
+
+Everything here is spoken to the speaker after the wake word: **"Hey Jarvis, …"**
+
+How it decides who answers you:
+- **Exact-ish phrases** (sections 1–4) are matched **locally on your node** — instant,
+  free, works with no internet and no API key.
+- **Anything else** goes to **Claude ("Archy")**, which either calls the same node
+  tools behind the scenes (so loose phrasings still get real numbers) or just
+  answers the question. Needs the Anthropic API key that Pine seeds.
+- **Mesh announcements** need nobody to say anything — the speaker pipes up on its
+  own when a mesh message arrives.
+
+---
+
+## 1. Bitcoin — block height (local, instant)
+
+- "what's the block height"
+- "what's the current block height"
+- "what is the block height"
+- "block height"
+- "current block height"
+- "how many blocks"
+- "how many blocks are there"
+
+## 2. Peers — bitcoin **and** mesh in one answer (local, instant)
+
+The answer includes both your bitcoin peer count and your mesh peer count.
+
+- "how many peers"
+- "how many peers do I have"
+- "how many peers is the node connected to"
+- "peer count"
+- "node peer count"
+
+## 3. Sync status (local, instant)
+
+Fully synced → it tells you the block it's synced to. Still syncing → the percent.
+
+- "is the node synced"
+- "is bitcoin synced"
+- "is the node fully synced"
+- "is bitcoin fully synced"
+- "how synced is the node"
+- "how synced is bitcoin"
+- "sync status"
+- "bitcoin sync status"
+- "sync progress"
+- "sync percentage"
+
+## 4. Lightning balance (local, instant)
+
+- "what's my lightning balance"
+- "what is my lightning balance"
+- "lightning balance"
+- "how many sats do I have"
+- "how many sats are in my wallet"
+
+---
+
+## 5. Same questions, said like a human (Claude routes to the node)
+
+The point of the AI brain: you don't have to remember the magic words. All of
+these end in the same real numbers as sections 1–4:
+
+- "how tall is the chain right now"
+- "what block are we on"
+- "is my bitcoin thing done downloading yet"
+- "how far along is the sync"
+- "are we caught up with the blockchain"
+- "how's my node doing"
+- "is everything okay with the node"
+- "how many people is my node talking to"
+- "is anyone connected to my node"
+- "am I rich in lightning"
+- "how much money is in my lightning wallet"
+- "do I have any sats"
+- "what's my node's status"
+
+## 6. Mesh
+
+**Hands-free announcements** — when a mesh text arrives, the speaker announces it
+by itself: *"New mesh message from ⟨sender⟩: ⟨text⟩"*. Nothing to say; just have
+someone send you one.
+
+**Asking about the mesh:**
+
+- "how many peers" — the local answer already includes mesh peers
+- "how many mesh peers do I have"
+- "am I connected to the mesh"
+- "what was the last mesh message"
+- "who sent the last mesh message"
+- "read me the latest mesh message"
+- "did I get any mesh messages"
+
+(The last-message questions go through Claude reading the mesh sensor — phrasing
+is free-form.)
+
+## 7. Ask the AI anything
+
+Short spoken answers, one or two sentences, no robot-reading-markdown. A sampler
+by mood:
+
+**Bitcoin & lightning, explained**
+- "what actually happens when a block is mined"
+- "explain the halving like I'm five"
+- "what's the difference between on-chain and lightning"
+- "why do confirmations matter"
+- "what's a mempool"
+- "is it normal for sync to take days"
+
+**Everyday brain**
+- "why is the sky blue"
+- "how long do I boil an egg"
+- "what can I cook with eggs and spinach"
+- "what's 15 percent of 84"
+- "how many ounces in a kilo"
+- "what's 21 million divided by 8 billion"
+- "how do you say good morning in Portuguese"
+- "give me a word that rhymes with orange"
+
+**Fun**
+- "tell me a joke"
+- "tell me a bitcoin joke"
+- "give me a fun fact"
+- "tell me a two-sentence scary story"
+- "settle an argument: is a hotdog a sandwich"
+
+**Advice-ish**
+- "what should I name my node"
+- "give me one tip for keeping my seed phrase safe"
+- "what's a good way to explain my node to my mum"
+
+Follow-ups work conversationally — ask something, then "and why is that?" without
+re-explaining yourself.
+
+## 8. Built-in assistant basics (Home Assistant, local)
+
+- "what time is it"
+- "what's the date today"
+- "set a timer for 5 minutes" / "cancel the timer" / "how long is left on the
+  timer" — *timer support depends on the PineVoice satellite build; try it once
+  and you'll know.*
+- "nevermind" / "cancel" — bail out of a listening session.
+
+## 9. Smart home (only if you've got devices in Home Assistant)
+
+Pine rides on Home Assistant Assist, so if you ever add exposed devices
+(lights, plugs, sensors), the standard grammar lights up automatically:
+
+- "turn on the living room light" / "turn off everything"
+- "is the front door locked"
+- "what's the temperature inside"
+
+No devices → these politely fail; nothing to test today.
+
+## 10. Known not-to-work (yet) — don't burn time on these
+
+- **Sending** a mesh message by voice ("tell Bob I'm on my way") — receive/announce
+  only, for now.
+- Controlling the node by voice ("restart bitcoin", "install an app") — read-only
+  on purpose.
+- Long memory across sessions — each conversation is fresh.
+
+---
+
+## If something misbehaves
+
+Say exactly what you said, what it answered (or didn't), and roughly when — the
+node keeps logs of every pipeline run and it's usually a one-look diagnosis.

docs/tv-input-iframe-apps.md

@@ -0,0 +1,84 @@
+# TV input: keyboard/gamepad inside iframe apps — design
+
+**Goal (2026-07-23, user requirement):** on a TV/kiosk node, keyboard and
+gamepad control must work *inside iframe apps* (IndeeHub, Jellyfin, fedimint
+UI, AIUI…), easily and globally — no per-app hacks.
+
+## What already exists
+
+- `neode-ui/src/composables/useControllerNav.ts` — a complete spatial-nav
+  system for the shell: reads gamepads (`navigator.getGamepads`), moves focus
+  between `data-controller-container` regions, plays nav sounds. It stops at
+  iframe boundaries: nothing is forwarded into frames.
+- Keyboard focus DOES enter iframes natively (click/Tab into the frame), and a
+  focused iframe receives all keys — same- or cross-origin. The gap is
+  gamepad→app and deliberate focus handoff shell↔frame.
+- Kiosk Chromium is our process (archipelago-kiosk-launcher), X11, and the ISO
+  already ships `xdotool`. Most app iframes are **cross-origin**
+  (`http://host:port`), so shell-side script injection is impossible for them;
+  only the nginx-proxied `/app/...` ones are same-origin.
+
+## Recommended architecture — two layers, both global
+
+### Layer 1 (OS, kiosk nodes): gamepad → virtual keyboard, kernel-level
+
+A small host daemon (`archipelago-gamepad-keys`) on kiosk nodes:
+
+- reads game controllers via evdev (`/dev/input/event*`, capability
+  BTN_GAMEPAD), hotplug-aware (udev monitor or 5s rescan — same pattern as the
+  audio router);
+- emits a **uinput virtual keyboard**: D-pad/left-stick → arrow keys, A →
+  Enter, B → Escape, X → Space (play/pause), Y → `f` (fullscreen in most
+  players), shoulders → Tab / Shift+Tab, Start → Enter, Select → Escape;
+- ships exactly like the audio router: `image-recipe/configs/` script + unit,
+  spliced into the ISO, `include_str!` self-heal in `bootstrap.rs`, gated on
+  the kiosk being installed. The `archipelago` user is in `input` group OR the
+  unit runs as root (uinput needs it anyway — run as root, it's ~100 lines of
+  evdev→uinput with no network).
+
+Why this layer wins: the browser sees a real keyboard, so **every iframe —
+any origin, any app — just works** the way it does for a physical keyboard
+today. Video players, web games, AIUI: all of them already have keyboard
+bindings. Zero app cooperation, zero web-platform security fights.
+
+### Layer 2 (shell): deliberate focus handoff into/out of frames
+
+Small extension to `useControllerNav`:
+
+- When spatial nav selects an app-session container and the user presses
+  A/Enter: call `iframe.focus()` (works cross-origin) — keys (real or
+  virtual) now flow into the app.
+- A dedicated **exit chord** the daemon maps from the gamepad (e.g. Home
+  button → F12 or a rarely-used key): the shell listens with a *capturing*
+  window listener; on seeing it, `iframe.blur()` + return focus to the shell
+  nav. Keyboard users get the same via a documented chord (e.g. long
+  Escape / Ctrl+Escape — plain Escape stays with the app, players use it).
+- Same-origin frames (the `/app/...` proxied set) can additionally get the
+  full spatial-nav treatment by running the existing nav over
+  `iframe.contentDocument` — nice-to-have after the layers above land.
+
+### Optional layer 3 (per-app polish): postMessage contract
+
+For OUR app UIs only (AIUI, fedimint, launcher pages): a tiny
+`archipelago:input` postMessage contract for semantic actions (back, home,
+context-menu) where raw keys aren't expressive enough. Documented in the app
+packaging docs; never required for an app to be usable.
+
+## What NOT to do
+
+- ❌ CDP (`--remote-debugging-port` + Input.dispatchKeyEvent): works but adds
+  a privileged debug port to the kiosk and a daemon↔browser coupling; the
+  uinput route gets the same result at kernel level with no attack surface.
+- ❌ Per-app nav scripts injected into iframes: cross-origin makes this
+  impossible for most apps, and it's exactly the per-app hack the requirement
+  rules out.
+
+## Implementation order
+
+1. `archipelago-gamepad-keys` daemon (evdev→uinput, ~python3 stdlib or small
+   Rust bin) + unit + ISO splice + bootstrap self-heal. Test on Framework PT
+   with any USB/BT controller.
+2. `useControllerNav`: A-button → `iframe.focus()` on the focused app session;
+   exit-chord capture listener to reclaim focus.
+3. (Later) same-origin spatial nav inside `/app/...` frames; postMessage
+   contract for our own app UIs.

image-recipe/_archived/build-auto-installer-iso.sh

@@ -382,6 +382,11 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     xorg \
     xdotool \
     chromium \
+    pipewire \
+    pipewire-pulse \
+    pipewire-alsa \
+    wireplumber \
+    alsa-utils \
     unclutter \
     fonts-liberation \
     fonts-noto-color-emoji \
@@ -420,7 +425,10 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
 RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen
 
 # Create archipelago user with password "archipelago"
-RUN useradd -m -s /bin/bash -G sudo,dialout archipelago && \
+# audio group: PipeWire runs under the lingering user manager (no logind seat
+# session), so udev's seat ACLs on /dev/snd never apply — group access is the
+# only way the kiosk's audio can open the hardware.
+RUN useradd -m -s /bin/bash -G sudo,dialout,audio archipelago && \
     echo "archipelago:archipelago" | chpasswd && \
     echo "root:archipelago" | chpasswd && \
     echo "archipelago ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/archipelago
@@ -1157,6 +1165,20 @@ if [ "$BACKEND_CAPTURED" = "0" ] && [ "$BUILD_FROM_SOURCE" != "1" ]; then
     fi
 fi
 
+# Bundle the Reticulum RNode daemon alongside the backend. install-to-disk
+# copies everything in archipelago/bin/ to /usr/local/bin, and the mesh
+# listener spawns /usr/local/bin/archy-reticulum-daemon for RNode radios —
+# a node imaged without it can never connect a Reticulum stick
+# (framework-pt, 2026-07-22: silent connect failures until hand-copied).
+RETICULUM_DAEMON="${ARCHY_RETICULUM_DAEMON:-/usr/local/bin/archy-reticulum-daemon}"
+if [ -f "$RETICULUM_DAEMON" ]; then
+    cp "$RETICULUM_DAEMON" "$ARCH_DIR/bin/archy-reticulum-daemon"
+    chmod +x "$ARCH_DIR/bin/archy-reticulum-daemon"
+    echo "   ✅ Reticulum daemon bundled ($(du -h "$ARCH_DIR/bin/archy-reticulum-daemon" | cut -f1))"
+else
+    echo "   ⚠️  archy-reticulum-daemon not found at $RETICULUM_DAEMON — ISO nodes won't support RNode radios until it's sideloaded"
+fi
+
 if [ "$BACKEND_CAPTURED" = "0" ]; then
     if [ "$BUILD_FROM_SOURCE" != "1" ]; then
         echo "   ⚠️  Could not capture from live server, building from source..."
@@ -2862,6 +2884,62 @@ fi
     echo "KIOSKSVC"
 } >> "$ARCH_DIR/auto-install.sh"
 
+# Audio router: same splice-from-configs/ pattern as the kiosk (single source
+# of truth, also embedded in the binary for bootstrap self-heal). Keeps HDMI
+# audio working: profile/default-sink routing + the ELD boot-race re-modeset.
+AUDIO_ROUTER_SRC="$SCRIPT_DIR/../configs/archipelago-audio-router.sh"
+AUDIO_SERVICE_SRC="$SCRIPT_DIR/../configs/archipelago-audio-router.service"
+for _audio_src in "$AUDIO_ROUTER_SRC" "$AUDIO_SERVICE_SRC"; do
+    if [ ! -f "$_audio_src" ]; then
+        echo "ERROR: audio config file missing: $_audio_src" >&2
+        exit 1
+    fi
+done
+if grep -qx 'AUDIOROUTER' "$AUDIO_ROUTER_SRC" || grep -qx 'AUDIOSVC' "$AUDIO_SERVICE_SRC"; then
+    echo "ERROR: audio config contains a reserved heredoc terminator line (AUDIOROUTER/AUDIOSVC)" >&2
+    exit 1
+fi
+{
+    echo ""
+    echo "# Audio router — HDMI profile/default-sink follow + ELD boot-race heal."
+    echo "# Payloads spliced at ISO-build time from image-recipe/configs/ (source of truth)."
+    echo "cat > /mnt/target/usr/local/bin/archipelago-audio-router <<'AUDIOROUTER'"
+    cat "$AUDIO_ROUTER_SRC"
+    echo "AUDIOROUTER"
+    echo "chmod +x /mnt/target/usr/local/bin/archipelago-audio-router"
+    echo ""
+    echo "cat > /mnt/target/etc/systemd/system/archipelago-audio-router.service <<'AUDIOSVC'"
+    cat "$AUDIO_SERVICE_SRC"
+    echo "AUDIOSVC"
+} >> "$ARCH_DIR/auto-install.sh"
+
+# Gamepad->keyboard bridge: same pattern (configs/ single source of truth,
+# also self-healed via the binary). TV input for every app iframe.
+GAMEPAD_SRC="$SCRIPT_DIR/../configs/archipelago-gamepad-keys.py"
+GAMEPAD_SERVICE_SRC="$SCRIPT_DIR/../configs/archipelago-gamepad-keys.service"
+for _pad_src in "$GAMEPAD_SRC" "$GAMEPAD_SERVICE_SRC"; do
+    if [ ! -f "$_pad_src" ]; then
+        echo "ERROR: gamepad config file missing: $_pad_src" >&2
+        exit 1
+    fi
+done
+if grep -qx 'GAMEPADPY' "$GAMEPAD_SRC" || grep -qx 'GAMEPADSVC' "$GAMEPAD_SERVICE_SRC"; then
+    echo "ERROR: gamepad config contains a reserved heredoc terminator line (GAMEPADPY/GAMEPADSVC)" >&2
+    exit 1
+fi
+{
+    echo ""
+    echo "# Gamepad->keyboard bridge — controller input inside every app iframe on the TV."
+    echo "cat > /mnt/target/usr/local/bin/archipelago-gamepad-keys <<'GAMEPADPY'"
+    cat "$GAMEPAD_SRC"
+    echo "GAMEPADPY"
+    echo "chmod +x /mnt/target/usr/local/bin/archipelago-gamepad-keys"
+    echo ""
+    echo "cat > /mnt/target/etc/systemd/system/archipelago-gamepad-keys.service <<'GAMEPADSVC'"
+    cat "$GAMEPAD_SERVICE_SRC"
+    echo "GAMEPADSVC"
+} >> "$ARCH_DIR/auto-install.sh"
+
 cat >> "$ARCH_DIR/auto-install.sh" <<'INSTALLER_SCRIPT'
 
 # Toggle script: sudo archipelago-kiosk enable|disable|status
@@ -3241,6 +3319,8 @@ chroot /mnt/target systemctl enable archipelago-first-boot-secrets.service 2>/de
 chroot /mnt/target systemctl enable archipelago-setup-tor.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-first-boot-containers.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-kiosk.service 2>/dev/null || true
+chroot /mnt/target systemctl enable archipelago-audio-router.service 2>/dev/null || true
+chroot /mnt/target systemctl enable archipelago-gamepad-keys.service 2>/dev/null || true
 chroot /mnt/target systemctl enable nostr-vpn.service 2>/dev/null || true
 # Enable claude-api-proxy (create symlink manually — chroot systemctl can fail)
 chroot /mnt/target systemctl enable claude-api-proxy.service 2>/dev/null || \

image-recipe/configs/archipelago-audio-router.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Archipelago audio router (HDMI hot-plug follow + ELD boot-race heal)
+# Talks to the archipelago user's PipeWire (running under the lingering user
+# manager) and pokes the kiosk X server for the ELD re-modeset nudge; start
+# after both are plausibly up. Missing/inactive units here are harmless.
+After=user@1000.service archipelago-kiosk.service
+Wants=user@1000.service
+ConditionPathExists=/usr/local/bin/archipelago-audio-router
+
+[Service]
+Type=simple
+User=archipelago
+ExecStart=/usr/local/bin/archipelago-audio-router
+Restart=always
+RestartSec=10
+# Polls a few pactl calls every 5s — keep it invisible to the scheduler.
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

image-recipe/configs/archipelago-audio-router.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+# Archipelago audio router — keep audio flowing out of the display the user is
+# actually looking at.
+#
+# The kiosk's Chromium plays through PipeWire-Pulse, but WirePlumber's stock
+# profile priorities rank the laptop's analog output above HDMI, so a node
+# driving a TV plays video sound out of its own tiny speakers (or nowhere).
+# ALSA jack detection (ELD) tells us when an HDMI/DP sink has a listening
+# monitor; this daemon polls that via the card's profile availability and:
+#
+#   - switches the card to the best *available* HDMI stereo profile (the
+#     "+input:analog-stereo" combined variant when offered, so the mic keeps
+#     working), and back to analog when HDMI is unplugged;
+#   - keeps the default sink pointed at the routed output and migrates any
+#     live streams so playback follows a hot-plug without a page reload;
+#   - unmutes the routed sink (HDMI additionally forced to 100% — the TV owns
+#     the real volume control; analog volume is left where the user set it).
+#
+# Runs as the archipelago user (systemd system unit with User=archipelago),
+# talks only to the user-session PipeWire; polling is a few pactl calls every
+# 5s — negligible. Surround profiles are deliberately ignored: stereo is the
+# lowest-common-denominator every TV decodes.
+
+#   - re-modesets an external output once when it is connected but no ELD
+#     reports a monitor: the kiosk's boot-time Xorg modeset can beat the
+#     i915→HDA audio-component bind, the ELD notify is lost, and every HDMI
+#     profile stays "available: no" forever (no sound, no error). One
+#     off/on cycle re-delivers the ELD (verified on Framework PT / LG TV).
+
+RUNTIME_DIR="/run/user/$(id -u)"
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-$RUNTIME_DIR}"
+export DISPLAY="${DISPLAY:-:0}"
+
+# The user manager socket-activates pipewire, but after a live package install
+# (bootstrap self-heal) nothing has poked it yet — start best-effort.
+systemctl --user start pipewire.socket pipewire-pulse.socket 2>/dev/null || true
+systemctl --user start wireplumber.service 2>/dev/null || true
+
+LAST_SINK=""
+NUDGED_OUTPUTS=""
+
+# Re-deliver a lost ELD by cycling the connected external output once. Guarded:
+# only when X answers, only when NO ELD anywhere reports a monitor, and only
+# once per connector while it stays connected (a display with no audio support
+# never produces an ELD — without the flag we would blank it every pass).
+eld_nudge_once() {
+    # Any ELD already valid → audio path is live; reset the nudge memory.
+    if grep -q "monitor_present[[:space:]]*1" /proc/asound/card*/eld* 2>/dev/null; then
+        NUDGED_OUTPUTS=""
+        return 0
+    fi
+
+    local xrandr_out conn name output mode
+    xrandr_out=$(xrandr --query 2>/dev/null) || return 0
+
+    for conn in /sys/class/drm/card*-*/status; do
+        [ -e "$conn" ] || continue
+        [ "$(cat "$conn" 2>/dev/null)" = "connected" ] || continue
+        name=${conn%/status}; name=${name##*/card?-}
+        case "$name" in eDP*|LVDS*) continue ;; esac
+        case " $NUDGED_OUTPUTS " in *" $name "*) continue ;; esac
+
+        # DRM connector names match the modesetting driver's output names.
+        output=$(printf '%s\n' "$xrandr_out" | awk -v n="$name" '$1 == n && $2 == "connected" {print $1; exit}')
+        [ -n "$output" ] || continue
+
+        # Keep the mode the kiosk chose (it may have capped a 4K panel);
+        # --auto only as a fallback.
+        mode=$(printf '%s\n' "$xrandr_out" | awk -v out="$output" '
+            $1 == out { active = 1; next }
+            active && /^[[:space:]]+[0-9]+x[0-9]+/ { if ($0 ~ /\*/) { print $1; exit } }
+            active && /^[^[:space:]]/ { active = 0 }')
+
+        NUDGED_OUTPUTS="$NUDGED_OUTPUTS $name"
+        xrandr --output "$output" --off 2>/dev/null || true
+        sleep 1
+        if [ -n "$mode" ]; then
+            xrandr --output "$output" --mode "$mode" 2>/dev/null \
+                || xrandr --output "$output" --auto 2>/dev/null || true
+        else
+            xrandr --output "$output" --auto 2>/dev/null || true
+        fi
+        sleep 2
+    done
+}
+
+route_once() {
+    local cards_dump card active want sink default_sink
+    cards_dump=$(pactl list cards 2>/dev/null) || return 0
+    [ -n "$cards_dump" ] || return 0
+
+    # One line per card: "<card>\t<active>\t<wanted-profile>"
+    # wanted = highest-priority available output:hdmi-stereo* profile, else
+    # highest-priority available output:analog* profile.
+    while IFS=$'\t' read -r card active want; do
+        [ -n "$card" ] && [ -n "$want" ] || continue
+        if [ "$active" != "$want" ]; then
+            pactl set-card-profile "$card" "$want" 2>/dev/null || true
+        fi
+    done < <(printf '%s\n' "$cards_dump" | awk '
+        function flush() {
+            if (card != "") print card "\t" active "\t" (hdmi != "" ? hdmi : analog)
+            card=""; active=""; hdmi=""; analog=""; hdmi_p=-1; analog_p=-1
+        }
+        /^Card #/ { flush() }
+        /^\tName: / { card=$2 }
+        /^\t\toutput:/ {
+            line=$0; sub(/^\t\t/, "", line)
+            prof=line; sub(/: .*/, "", prof)
+            prio=0
+            if (match(line, /priority: [0-9]+/)) prio=substr(line, RSTART+10, RLENGTH-10)+0
+            avail = (line ~ /available: yes/ || line ~ /availability unknown/)
+            if (!avail) next
+            if (prof ~ /^output:hdmi-stereo/) { if (prio > hdmi_p) { hdmi=prof; hdmi_p=prio } }
+            else if (prof ~ /^output:analog/)  { if (prio > analog_p) { analog=prof; analog_p=prio } }
+        }
+        /^\tActive Profile: / { active=$3 }
+        END { flush() }
+    ')
+
+    # Point the default sink at HDMI when one exists, else the first sink.
+    sink=$(pactl list short sinks 2>/dev/null | awk '/hdmi/{print $2; exit}')
+    [ -n "$sink" ] || sink=$(pactl list short sinks 2>/dev/null | awk 'NR==1{print $2}')
+    [ -n "$sink" ] || return 0
+
+    default_sink=$(pactl get-default-sink 2>/dev/null)
+    if [ "$sink" != "$default_sink" ] || [ "$sink" != "$LAST_SINK" ]; then
+        pactl set-default-sink "$sink" 2>/dev/null || true
+        pactl set-sink-mute "$sink" 0 2>/dev/null || true
+        case "$sink" in
+            *hdmi*) pactl set-sink-volume "$sink" 100% 2>/dev/null || true ;;
+        esac
+        # Migrate live streams so playing audio follows the hot-plug.
+        pactl list short sink-inputs 2>/dev/null | while read -r id _; do
+            pactl move-sink-input "$id" "$sink" 2>/dev/null || true
+        done
+        LAST_SINK="$sink"
+    fi
+}
+
+while true; do
+    eld_nudge_once
+    route_once
+    sleep 5
+done

image-recipe/configs/archipelago-gamepad-keys.py

@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""Archipelago gamepad→keyboard bridge (kiosk nodes).
+
+Reads every attached game controller via evdev and mirrors it as a virtual
+uinput KEYBOARD, so gamepad input works in every app — including cross-origin
+iframes (IndeeHub, Jellyfin, …) where the web shell can never inject events.
+The browser just sees arrow/Enter/Escape keys from a real-looking keyboard;
+X autorepeat handles held directions. Design: docs/tv-input-iframe-apps.md.
+
+Mapping (standard pad):
+  D-pad / left stick  -> arrow keys
+  A (BTN_SOUTH)       -> Enter        B (BTN_EAST)  -> Escape
+  X (BTN_NORTH/WEST*) -> Space        Y             -> f (player fullscreen)
+  LB (BTN_TL)         -> Shift+Tab    RB (BTN_TR)   -> Tab
+  Start               -> Enter        Select        -> Escape
+
+*Controllers disagree on NORTH/WEST for X/Y; both map to Space/f — either way
+ one is play/pause and one is fullscreen, which is fine for a TV.
+
+Pure stdlib (struct/fcntl/select) — no python3-evdev dependency on the node.
+Runs as root (uinput + /dev/input need it); hotplug via 5s rescans.
+"""
+
+import fcntl
+import os
+import select
+import struct
+import time
+
+# ---- kernel constants ------------------------------------------------------
+EV_SYN, EV_KEY, EV_ABS = 0x00, 0x01, 0x03
+SYN_REPORT = 0
+
+KEY_ESC, KEY_TAB, KEY_ENTER, KEY_SPACE = 1, 15, 28, 57
+KEY_LEFTSHIFT, KEY_F = 42, 33
+KEY_UP, KEY_LEFT, KEY_RIGHT, KEY_DOWN = 103, 105, 106, 108
+
+BTN_SOUTH, BTN_EAST, BTN_NORTH, BTN_WEST = 0x130, 0x131, 0x133, 0x134
+BTN_TL, BTN_TR, BTN_SELECT, BTN_START = 0x136, 0x137, 0x13A, 0x13B
+BTN_DPAD_UP, BTN_DPAD_DOWN, BTN_DPAD_LEFT, BTN_DPAD_RIGHT = 0x220, 0x221, 0x222, 0x223
+
+ABS_X, ABS_Y, ABS_HAT0X, ABS_HAT0Y = 0x00, 0x01, 0x10, 0x11
+
+EVIOCGBIT_EV_KEY = 0x80604521  # EVIOCGBIT(EV_KEY, 96) — enough for BTN range
+UI_SET_EVBIT, UI_SET_KEYBIT = 0x40045564, 0x40045565
+UI_DEV_CREATE, UI_DEV_DESTROY = 0x5501, 0x5502
+
+INPUT_EVENT = struct.Struct("llHHi")  # timeval sec/usec, type, code, value
+
+BUTTON_MAP = {
+    BTN_SOUTH: (KEY_ENTER,),
+    BTN_EAST: (KEY_ESC,),
+    BTN_NORTH: (KEY_SPACE,),
+    BTN_WEST: (KEY_F,),
+    BTN_TL: (KEY_LEFTSHIFT, KEY_TAB),
+    BTN_TR: (KEY_TAB,),
+    BTN_START: (KEY_ENTER,),
+    BTN_SELECT: (KEY_ESC,),
+    BTN_DPAD_UP: (KEY_UP,),
+    BTN_DPAD_DOWN: (KEY_DOWN,),
+    BTN_DPAD_LEFT: (KEY_LEFT,),
+    BTN_DPAD_RIGHT: (KEY_RIGHT,),
+}
+EMITTED_KEYS = sorted({k for keys in BUTTON_MAP.values() for k in keys}
+                      | {KEY_UP, KEY_DOWN, KEY_LEFT, KEY_RIGHT})
+
+STICK_THRESHOLD = 0.55  # fraction of full deflection before a stick "presses"
+
+
+def is_gamepad(fd) -> bool:
+    buf = bytearray(96)
+    try:
+        fcntl.ioctl(fd, EVIOCGBIT_EV_KEY, buf)
+    except OSError:
+        return False
+    def has(code):
+        return bool(buf[code // 8] & (1 << (code % 8)))
+    return has(BTN_SOUTH) or has(BTN_START)
+
+
+class VirtualKeyboard:
+    def __init__(self):
+        self.fd = os.open("/dev/uinput", os.O_WRONLY | os.O_NONBLOCK)
+        fcntl.ioctl(self.fd, UI_SET_EVBIT, EV_KEY)
+        for key in EMITTED_KEYS:
+            fcntl.ioctl(self.fd, UI_SET_KEYBIT, key)
+        # Legacy uinput_user_dev setup struct: name[80] + input_id + ff_effects
+        # + absmax/absmin/absfuzz/absflat (64 ints each) — works on every kernel.
+        name = b"Archipelago Gamepad Keys"
+        setup = name.ljust(80, b"\0") + struct.pack("HHHHi", 0x06, 0x1, 0x1, 1, 0)
+        setup += b"\0" * (64 * 4 * 4)
+        os.write(self.fd, setup)
+        fcntl.ioctl(self.fd, UI_DEV_CREATE)
+
+    def _emit(self, etype, code, value):
+        os.write(self.fd, INPUT_EVENT.pack(0, 0, etype, code, value))
+
+    def set_key(self, key, pressed):
+        self._emit(EV_KEY, key, 1 if pressed else 0)
+        self._emit(EV_SYN, SYN_REPORT, 0)
+
+    def chord(self, keys, pressed):
+        seq = keys if pressed else tuple(reversed(keys))
+        for k in seq:
+            self._emit(EV_KEY, k, 1 if pressed else 0)
+        self._emit(EV_SYN, SYN_REPORT, 0)
+
+
+class PadState:
+    """Per-device axis state → synthetic arrow presses."""
+
+    def __init__(self):
+        self.axis_keys = {}  # axis -> currently-pressed arrow key (or None)
+        self.abs_range = {}  # axis -> (min, max) for sticks
+
+    def arrow_for(self, axis, value):
+        if axis in (ABS_HAT0X, ABS_HAT0Y):
+            if value < 0:
+                return KEY_LEFT if axis == ABS_HAT0X else KEY_UP
+            if value > 0:
+                return KEY_RIGHT if axis == ABS_HAT0X else KEY_DOWN
+            return None
+        lo, hi = self.abs_range.get(axis, (-32768, 32767))
+        span = (hi - lo) or 1
+        norm = (2 * (value - lo) / span) - 1
+        if norm <= -STICK_THRESHOLD:
+            return KEY_LEFT if axis == ABS_X else KEY_UP
+        if norm >= STICK_THRESHOLD:
+            return KEY_RIGHT if axis == ABS_X else KEY_DOWN
+        return None
+
+
+def stick_range(fd, axis):
+    # EVIOCGABS(axis): struct input_absinfo { value, min, max, fuzz, flat, res }
+    buf = bytearray(24)
+    try:
+        fcntl.ioctl(fd, 0x80184540 + axis, buf)
+        _, lo, hi = struct.unpack("iii", bytes(buf[:12]))
+        if hi > lo:
+            return (lo, hi)
+    except OSError:
+        pass
+    return (-32768, 32767)
+
+
+def main():
+    os.system("modprobe uinput 2>/dev/null")
+    kbd = VirtualKeyboard()
+    pads = {}  # path -> (fd, PadState)
+    last_scan = 0.0
+
+    while True:
+        now = time.monotonic()
+        if now - last_scan > 5:
+            last_scan = now
+            try:
+                names = sorted(os.listdir("/dev/input"))
+            except FileNotFoundError:
+                names = []
+            for name in names:
+                if not name.startswith("event"):
+                    continue
+                path = "/dev/input/" + name
+                if path in pads:
+                    continue
+                try:
+                    fd = os.open(path, os.O_RDONLY | os.O_NONBLOCK)
+                except OSError:
+                    continue
+                if is_gamepad(fd):
+                    state = PadState()
+                    for axis in (ABS_X, ABS_Y):
+                        state.abs_range[axis] = stick_range(fd, axis)
+                    pads[path] = (fd, state)
+                    print(f"gamepad attached: {path}", flush=True)
+                else:
+                    os.close(fd)
+
+        if not pads:
+            time.sleep(2)
+            continue
+
+        readable, _, _ = select.select([fd for fd, _ in pads.values()], [], [], 2.0)
+        gone = []
+        for path, (fd, state) in list(pads.items()):
+            if fd not in readable:
+                continue
+            try:
+                data = os.read(fd, INPUT_EVENT.size * 64)
+            except OSError:
+                gone.append(path)
+                continue
+            for off in range(0, len(data) - INPUT_EVENT.size + 1, INPUT_EVENT.size):
+                _, _, etype, code, value = INPUT_EVENT.unpack_from(data, off)
+                if etype == EV_KEY and code in BUTTON_MAP and value in (0, 1):
+                    keys = BUTTON_MAP[code]
+                    if len(keys) == 1:
+                        kbd.set_key(keys[0], value == 1)
+                    else:
+                        kbd.chord(keys, value == 1)
+                elif etype == EV_ABS and code in (ABS_X, ABS_Y, ABS_HAT0X, ABS_HAT0Y):
+                    want = state.arrow_for(code, value)
+                    held = state.axis_keys.get(code)
+                    if want != held:
+                        if held is not None:
+                            kbd.set_key(held, False)
+                        if want is not None:
+                            kbd.set_key(want, True)
+                        state.axis_keys[code] = want
+        for path in gone:
+            fd, state = pads.pop(path)
+            for held in state.axis_keys.values():
+                if held is not None:
+                    kbd.set_key(held, False)
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+            print(f"gamepad detached: {path}", flush=True)
+
+
+if __name__ == "__main__":
+    main()

image-recipe/configs/archipelago-gamepad-keys.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Archipelago gamepad->keyboard bridge (TV/kiosk input in every app iframe)
+# Only meaningful where a display UI runs; the kiosk unit is the marker.
+ConditionPathExists=/etc/systemd/system/archipelago-kiosk.service
+ConditionPathExists=/usr/local/bin/archipelago-gamepad-keys
+
+[Service]
+Type=simple
+# Root: /dev/uinput device creation + raw /dev/input readers.
+ExecStart=/usr/bin/python3 /usr/local/bin/archipelago-gamepad-keys
+Restart=always
+RestartSec=10
+Nice=5
+
+[Install]
+WantedBy=multi-user.target

image-recipe/configs/archipelago-kiosk-launcher.sh

@@ -174,6 +174,9 @@ while true; do
     # backend can't find PipeWire-Pulse's socket at /run/user/<uid>/pulse/native,
     # falls back to raw ALSA "default", fails to connect, and produces no audio
     # at all with no visible error (--noerrdialogs suppresses it).
+    # OverlayScrollbar: thin auto-hiding scrollbars (the Chrome-on-a-remote-
+    # device look) instead of classic X11 scrollbar chrome — a kiosk TV showed
+    # a permanent fat scrollbar on scrollable views (Peers).
     # Force a DARK color-scheme preference. The main UI hardcodes its dark
     # theme, but the bundled AIUI app themes via `@media (prefers-color-scheme)`
     # and defaults to its LIGHT variant (white panels) when the browser reports
@@ -191,6 +194,7 @@ while true; do
       --no-first-run \
       --check-for-update-interval=31536000 \
       --disable-features=TranslateUI,MetricsReporting,AutofillServerCommunication,PasswordManagerEnabled,GpuRasterization \
+      --enable-features=OverlayScrollbar \
       --disable-session-crashed-bubble \
       --disable-save-password-bubble \
       --disable-suggestions-service \

image-recipe/configs/nginx-archipelago.conf

@@ -9,6 +9,10 @@ resolver_timeout 5s;
 
 server {
     listen 80 default_server;
+    # IPv6 listener is REQUIRED: companion phones reach this node over the
+    # FIPS mesh at its fips0 ULA (http://[fdxx:…]) — without [::]:80 that
+    # address can never connect (found live 2026-07-23, framework-pt).
+    listen [::]:80 default_server;
     server_name _;
 
     root /opt/archipelago/web-ui;
@@ -901,6 +905,7 @@ server {
 # HTTPS - required for PWA install (Add to Home Screen) from dev servers
 server {
     listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
     server_name _;
 
     ssl_certificate /etc/archipelago/ssl/archipelago.crt;

neode-ui/index.html

@@ -14,6 +14,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover, interactive-widget=resizes-content" />
     <meta name="description" content="Archipelago - Your sovereign personal server" />
     <meta name="theme-color" content="#000000" />
+    <!-- Dark-only app: pin native controls dark before CSS loads. -->
+    <meta name="color-scheme" content="dark" />
     <meta name="mobile-web-app-capable" content="yes" />
     <meta name="apple-mobile-web-app-capable" content="yes" />
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />