fix(wallet): translate Cashu NUT error codes into plain-language messages

Mint HTTP failures (swap/melt/mint-quote) were surfacing raw JSON bodies
like {"detail":"proofs already spent","code":11001} straight to the
user. Add a translator for the NUT-02/03/04/05 transaction-validation
error codes (10001-11017, 12001-12003; see
https://github.com/cashubtc/nuts/blob/main/error_codes.md) and layer it
onto the mint_client bail sites via anyhow context, so the top-level
message is actionable while the raw status/body stays available via
{:#} for logs. receive_token now surfaces the real reason (e.g. "This
ecash has already been redeemed") instead of a generic "Failed to
receive any proofs from token" when every mint in a token fails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/archy-mempool-web/manifest.yml

@@ -26,6 +26,8 @@ app:
     - host: 4080
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   environment:
     - FRONTEND_HTTP_PORT=8080

apps/archy-nbxplorer/manifest.yml

@@ -33,6 +33,8 @@ app:
     - host: 32838
       container: 32838
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind

apps/barkd/manifest.yml

@@ -51,6 +51,8 @@ app:
     - host: 3535
       container: 3535
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Holds the wallet DB, mnemonic and auth token. ARK funds are recoverable

apps/btcpay-server/manifest.yml

@@ -45,6 +45,8 @@ app:
     - host: 23000
       container: 49392
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/did-wallet/manifest.yml

@@ -30,6 +30,8 @@ app:
     - host: 8088
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/fedimint-clientd/manifest.yml

@@ -66,6 +66,8 @@ app:
     - host: 8178
       container: 8080
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     # Same dir the first-boot bundled path uses + where the wallet bridge reads

apps/fedimint/manifest.yml

@@ -58,6 +58,8 @@ app:
     - host: 8177
       container: 8175
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind

apps/filebrowser/manifest.yml

@@ -27,6 +27,8 @@ app:
     - host: 8083
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/gitea/manifest.yml

@@ -26,6 +26,8 @@ app:
     - host: 3001
       container: 3000
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
     - host: 2222
       container: 22
       protocol: tcp

apps/grafana/manifest.yml

@@ -31,6 +31,8 @@ app:
     - host: 3000
       container: 3000
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/home-assistant/manifest.yml

@@ -30,6 +30,8 @@ app:
     - host: 8123
       container: 8123
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/immich/manifest.yml

@@ -44,6 +44,8 @@ app:
     - host: 2283
       container: 2283
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/indeedhub/manifest.yml

@@ -38,6 +38,8 @@ app:
     - host: 7778
       container: 7777
       protocol: tcp  # Web UI. Port 7777 on the host is reserved for the Nostr relay.
+      bind: 127.0.0.1
+      auth: gated
 
   # Writable scratch the baked nginx needs; matches the legacy installer's
   # --tmpfs /run + /var/cache/nginx.

apps/jellyfin/manifest.yml

@@ -25,6 +25,8 @@ app:
     - host: 8096
       container: 8096
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/mempool-api/manifest.yml

@@ -42,6 +42,8 @@ app:
     - host: 8999
       container: 8999
       protocol: tcp
+      bind: 127.0.0.1
+      auth: local
 
   volumes:
     - type: bind

apps/mempool/manifest.yml

@@ -33,6 +33,8 @@ app:
     - host: 4080
       container: 8080  # mempool-frontend nginx listens on 8080 (FRONTEND_HTTP_PORT=8080)
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/morphos-server/manifest.yml

@@ -30,6 +30,8 @@ app:
     - host: 8089
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/nextcloud/manifest.yml

@@ -25,6 +25,8 @@ app:
     - host: 8085
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/nostr-rs-relay/manifest.yml

@@ -31,6 +31,8 @@ app:
     - host: 18081
       container: 8080
       protocol: tcp  # HTTP/WebSocket
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/photoprism/manifest.yml

@@ -24,6 +24,8 @@ app:
     - host: 2342
       container: 2342
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/portainer/manifest.yml

@@ -27,6 +27,8 @@ app:
     - host: 9000
       container: 9000
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/searxng/manifest.yml

@@ -29,6 +29,8 @@ app:
     - host: 8888
       container: 8080
       protocol: tcp  # Web UI
+      bind: 127.0.0.1
+      auth: gated
     
   volumes:
     - type: bind

apps/strfry/manifest.yml

@@ -29,6 +29,8 @@ app:
     - host: 8090
       container: 7777
       protocol: tcp  # HTTP/WebSocket (strfry listens on 7777)
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/uptime-kuma/manifest.yml

@@ -26,6 +26,8 @@ app:
     - host: 3002
       container: 3001
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

apps/vaultwarden/manifest.yml

@@ -25,6 +25,8 @@ app:
     - host: 8082
       container: 80
       protocol: tcp
+      bind: 127.0.0.1
+      auth: gated
 
   volumes:
     - type: bind

core/Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.120-alpha"
+version = "1.7.121-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/src/api/rpc/tor/mod.rs

@@ -222,6 +222,19 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
     lines.push("# ControlPort disabled for security".to_string());
     lines.push(String::new());
 
+    // Ports whose manifests declare `auth: gated` forward to the gate's own
+    // loopback (127.0.0.2, where the app-gate listener binds — see
+    // `appgate::listener::GATE_TOR_UPSTREAM`) instead of the app's 127.0.0.1.
+    // Tor carries no session cookie, so an onion pointed at the app is an
+    // unauthenticated bypass of the gate. Declared-gated ports only: an
+    // undeclared port keeps today's target, because absence of the field is
+    // not an instruction (the v1.7.121 incident rule).
+    let gated_ports: std::collections::HashSet<u16> = crate::appgate::identity::build_port_map()
+        .gated_ports()
+        .filter(|g| g.declared)
+        .map(|g| g.port)
+        .collect();
+
     for svc in &config.services {
         if !svc.enabled {
             continue;
@@ -240,7 +253,7 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
                 lines.push("HiddenServicePort 10009 127.0.0.1:10009".to_string());
             }
         } else {
-            lines.push(format!("HiddenServicePort 80 127.0.0.1:{}", svc.local_port));
+            lines.push(app_hidden_service_port_line(svc.local_port, &gated_ports));
         }
 
         lines.push(String::new());
@@ -248,6 +261,24 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
 
     let content = lines.join("\n");
     let staging = "/var/lib/archipelago/tor-config/torrc.staged";
+    write_staged_torrc(&content, staging).await
+}
+
+/// The `HiddenServicePort` line for an HTTP app onion. Gated ports forward to
+/// the gate's Tor upstream; everything else to the app itself.
+fn app_hidden_service_port_line(
+    local_port: u16,
+    gated_ports: &std::collections::HashSet<u16>,
+) -> String {
+    let upstream = if gated_ports.contains(&local_port) {
+        crate::appgate::listener::GATE_TOR_UPSTREAM.to_string()
+    } else {
+        "127.0.0.1".to_string()
+    };
+    format!("HiddenServicePort 80 {}:{}", upstream, local_port)
+}
+
+async fn write_staged_torrc(content: &str, staging: &str) -> Result<()> {
     let config_dir = Path::new(staging)
         .parent()
         .unwrap_or_else(|| Path::new("/var/lib/archipelago/tor-config"));
@@ -256,14 +287,37 @@ pub(in crate::api::rpc) async fn regenerate_torrc(config: &ServicesConfig) -> Re
         .await
         .context("Failed to write staged torrc")?;
 
-    debug!(
-        "Staged torrc with {} enabled services",
-        config.services.iter().filter(|s| s.enabled).count()
-    );
+    debug!("Staged torrc ({} bytes)", content.len());
 
     Ok(())
 }
 
+#[cfg(test)]
+mod torrc_tests {
+    use super::app_hidden_service_port_line;
+    use std::collections::HashSet;
+
+    #[test]
+    fn gated_port_forwards_to_the_gate_not_the_app() {
+        let gated: HashSet<u16> = [8082u16].into_iter().collect();
+        assert_eq!(
+            app_hidden_service_port_line(8082, &gated),
+            "HiddenServicePort 80 127.0.0.2:8082"
+        );
+    }
+
+    #[test]
+    fn undeclared_port_keeps_the_app_loopback_target() {
+        // Absence of `auth: gated` is not an instruction — the onion keeps
+        // pointing at the app, exactly as before this change.
+        let gated: HashSet<u16> = [8082u16].into_iter().collect();
+        assert_eq!(
+            app_hidden_service_port_line(9100, &gated),
+            "HiddenServicePort 80 127.0.0.1:9100"
+        );
+    }
+}
+
 // ─── Hostname Sync ───────────────────────────────────────────────
 
 pub(in crate::api::rpc) async fn sync_single_hostname(name: &str, address: &str) {

core/archipelago/src/appgate/identity.rs

@@ -26,6 +26,15 @@ pub struct GatedPort {
     pub app_name: String,
     /// Manifest-declared icon path (`metadata.icon`), when present.
     pub icon: Option<String>,
+    /// True only when the manifest says `auth: gated` in so many words.
+    ///
+    /// The gated set deliberately also carries undeclared Session-default
+    /// ports (so the gate challenges them wherever it can already stand, and
+    /// the audit reports them). But everything that CHANGES where traffic
+    /// goes — the torrc repoint to 127.0.0.2, the FIPS relay stand-down, the
+    /// Tor-upstream bind — must key on this flag: acting on an undeclared
+    /// port is the v1.7.121 incident class, whatever the action.
+    pub declared: bool,
 }
 
 /// A port deliberately left unauthenticated, and the manifest's stated reason.
@@ -48,6 +57,7 @@ pub struct ExemptPort {
 pub struct PortMap {
     gated: HashMap<u16, GatedPort>,
     exempt: Vec<ExemptPort>,
+    local: std::collections::HashSet<u16>,
 }
 
 impl PortMap {
@@ -64,8 +74,21 @@ impl PortMap {
         &self.exempt
     }
 
+    /// Declared `auth: local` — host-local by intent, so NOTHING may make it
+    /// externally reachable.
+    ///
+    /// The gate honours this by keeping its hands off, but it is not the only
+    /// thing that can publish a port: the FIPS mesh relay bridges the fips0
+    /// ULA to `127.0.0.1` for a static port list, and it forwarded nbxplorer
+    /// 32838 — declared `local` and pinned to loopback — to the mesh
+    /// unauthenticated (archi-dev-box 2026-08-04). Anything that republishes
+    /// a loopback port must consult this set first.
+    pub fn is_declared_local(&self, port: u16) -> bool {
+        self.local.contains(&port)
+    }
+
     pub fn is_empty(&self) -> bool {
-        self.gated.is_empty() && self.exempt.is_empty()
+        self.gated.is_empty() && self.exempt.is_empty() && self.local.is_empty()
     }
 }
 
@@ -101,13 +124,35 @@ fn manifest_icon(manifest: &AppManifest) -> Option<String> {
 
 /// Classify every published port across all installed manifests.
 ///
-/// The first directory that yields a manifest for an app id wins, so a node's
-/// `/opt/archipelago/apps` copy shadows a repo checkout rather than merging
-/// with it — otherwise a stale checked-out manifest could re-open a port the
-/// installed one gates.
+/// The signed catalog's embedded manifests are consulted FIRST, because they
+/// are what the orchestrator actually publishes containers from
+/// (origin-wins; see `app_catalog::catalog_manifest_overlay`). Classifying
+/// from disk alone made the gate act on policy the node was no longer
+/// running: the catalog declared nbxplorer `auth: local` and pinned it to
+/// loopback, the stale disk manifest declared nothing, and the gate
+/// externally bound a deliberately host-local port (archi-dev-box
+/// 2026-08-04).
+///
+/// After the catalog, the first directory that yields a manifest for an app
+/// id wins, so a node's `/opt/archipelago/apps` copy shadows a repo checkout
+/// rather than merging with it — otherwise a stale checked-out manifest could
+/// re-open a port the installed one gates.
 pub fn build_port_map() -> PortMap {
     let mut map = PortMap::default();
-    let mut seen_apps: HashMap<String, PathBuf> = HashMap::new();
+    let mut seen_apps: std::collections::HashSet<String> = std::collections::HashSet::new();
+
+    for (app_id, value) in crate::container::app_catalog::catalog_manifest_values() {
+        let Some(manifest) =
+            crate::container::app_catalog::catalog_manifest_overlay(&app_id, value)
+        else {
+            // Unparseable/invalid/build-source → the orchestrator falls back
+            // to disk for this app, so classification must too.
+            continue;
+        };
+        if seen_apps.insert(app_id) {
+            classify_manifest(&manifest, &mut map);
+        }
+    }
 
     for dir in apps_dirs() {
         let Ok(entries) = std::fs::read_dir(&dir) else {
@@ -124,100 +169,8 @@ pub fn build_port_map() -> PortMap {
                 // would have published.
                 continue;
             };
-            let app_id = manifest.app.id.clone();
-            if seen_apps.contains_key(&app_id) {
-                continue;
-            }
-            seen_apps.insert(app_id.clone(), path);
-
-            let icon = manifest_icon(&manifest);
-            let app_name = if manifest.app.name.trim().is_empty() {
-                app_id.clone()
-            } else {
-                manifest.app.name.clone()
-            };
-
-            for port in &manifest.app.ports {
-                let protocol = if port.protocol.is_empty() {
-                    "tcp"
-                } else {
-                    port.protocol.as_str()
-                };
-                match port.auth_policy() {
-                    PortAuth::None => map.exempt.push(ExemptPort {
-                        port: port.host,
-                        app_id: app_id.clone(),
-                        rationale: port
-                            .auth_rationale
-                            .clone()
-                            .unwrap_or_else(|| "(no rationale recorded)".to_string()),
-                        protocol: protocol.to_string(),
-                    }),
-                    // Declared host-local. Not gated and not reported as
-                    // exposed, because it is neither — see PortAuth::Local
-                    // for why this cannot be inferred from `bind`.
-                    PortAuth::Local => {}
-                    // Explicit opt-in: the app is on loopback and the daemon
-                    // owns the external addresses. This is the ONLY way a
-                    // port gets bound by the gate, regardless of `bind`.
-                    PortAuth::Gated => {
-                        map.gated.insert(
-                            port.host,
-                            GatedPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                app_name: app_name.clone(),
-                                icon: icon.clone(),
-                            },
-                        );
-                    }
-                    PortAuth::Session => {
-                        // UDP cannot carry an HTTP challenge. Such a port has
-                        // no business defaulting into the gated set where it
-                        // would look protected without being protectable —
-                        // surface it as an unrationalised exemption instead,
-                        // which is honest and shows up in the audit list.
-                        if protocol != "tcp" {
-                            map.exempt.push(ExemptPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                rationale: format!(
-                                    "{protocol} cannot carry an HTTP challenge; declare auth: none \
-                                     with a rationale to record why this is safe"
-                                ),
-                                protocol: protocol.to_string(),
-                            });
-                            continue;
-                        }
-                        // A loopback publish is skipped, and this is the
-                        // safety property of the whole module: the gate must
-                        // never be the reason a port becomes reachable
-                        // somewhere it was not. `session` is the DEFAULT, so
-                        // it is what every un-migrated manifest carries —
-                        // and a node's installed manifests always lag the
-                        // repo. Binding those externally published Bitcoin
-                        // RPC across the LAN within seconds of deploy
-                        // (archi-dev-box 2026-08-03). Taking over a port is
-                        // opt-in only: `auth: gated`, shipped in the same
-                        // manifest edit as the loopback pin.
-                        if port
-                            .bind
-                            .parse::<std::net::IpAddr>()
-                            .is_ok_and(|ip| ip.is_loopback())
-                        {
-                            continue;
-                        }
-                        map.gated.insert(
-                            port.host,
-                            GatedPort {
-                                port: port.host,
-                                app_id: app_id.clone(),
-                                app_name: app_name.clone(),
-                                icon: icon.clone(),
-                            },
-                        );
-                    }
-                }
+            if seen_apps.insert(manifest.app.id.clone()) {
+                classify_manifest(&manifest, &mut map);
             }
         }
     }
@@ -226,6 +179,107 @@ pub fn build_port_map() -> PortMap {
     map
 }
 
+/// Classify one manifest's ports into the map. Split from [`build_port_map`]
+/// so the catalog-overlay pass and the disk pass cannot diverge.
+fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
+    let app_id = manifest.app.id.clone();
+    let icon = manifest_icon(manifest);
+    let app_name = if manifest.app.name.trim().is_empty() {
+        app_id.clone()
+    } else {
+        manifest.app.name.clone()
+    };
+
+    for port in &manifest.app.ports {
+        let protocol = if port.protocol.is_empty() {
+            "tcp"
+        } else {
+            port.protocol.as_str()
+        };
+        match port.auth_policy() {
+            PortAuth::None => map.exempt.push(ExemptPort {
+                port: port.host,
+                app_id: app_id.clone(),
+                rationale: port
+                    .auth_rationale
+                    .clone()
+                    .unwrap_or_else(|| "(no rationale recorded)".to_string()),
+                protocol: protocol.to_string(),
+            }),
+            // Declared host-local. Not gated and not reported as
+            // exposed, because it is neither — see PortAuth::Local
+            // for why this cannot be inferred from `bind`. Recorded so
+            // the mesh relay (and any future republisher) can refuse to
+            // expose it.
+            PortAuth::Local => {
+                map.local.insert(port.host);
+            }
+            // Explicit opt-in: the app is on loopback and the daemon
+            // owns the external addresses. This is the ONLY way a
+            // port gets bound by the gate, regardless of `bind`.
+            PortAuth::Gated => {
+                map.gated.insert(
+                    port.host,
+                    GatedPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        app_name: app_name.clone(),
+                        icon: icon.clone(),
+                        declared: true,
+                    },
+                );
+            }
+            PortAuth::Session => {
+                // UDP cannot carry an HTTP challenge. Such a port has
+                // no business defaulting into the gated set where it
+                // would look protected without being protectable —
+                // surface it as an unrationalised exemption instead,
+                // which is honest and shows up in the audit list.
+                if protocol != "tcp" {
+                    map.exempt.push(ExemptPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        rationale: format!(
+                            "{protocol} cannot carry an HTTP challenge; declare auth: none \
+                             with a rationale to record why this is safe"
+                        ),
+                        protocol: protocol.to_string(),
+                    });
+                    continue;
+                }
+                // A loopback publish is skipped, and this is the
+                // safety property of the whole module: the gate must
+                // never be the reason a port becomes reachable
+                // somewhere it was not. `session` is the DEFAULT, so
+                // it is what every un-migrated manifest carries —
+                // and a node's installed manifests always lag the
+                // repo. Binding those externally published Bitcoin
+                // RPC across the LAN within seconds of deploy
+                // (archi-dev-box 2026-08-03). Taking over a port is
+                // opt-in only: `auth: gated`, shipped in the same
+                // manifest edit as the loopback pin.
+                if port
+                    .bind
+                    .parse::<std::net::IpAddr>()
+                    .is_ok_and(|ip| ip.is_loopback())
+                {
+                    continue;
+                }
+                map.gated.insert(
+                    port.host,
+                    GatedPort {
+                        port: port.host,
+                        app_id: app_id.clone(),
+                        app_name: app_name.clone(),
+                        icon: icon.clone(),
+                        declared: false,
+                    },
+                );
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -257,6 +311,90 @@ mod tests {
         }
     }
 
+    fn manifest(yaml: &str) -> AppManifest {
+        AppManifest::parse(yaml).expect("test manifest must parse")
+    }
+
+    const BASE: &str = r#"
+app:
+  id: testapp
+  name: Test App
+  version: "1.0"
+  container:
+    image: example.org/testapp:1.0
+"#;
+
+    /// `auth: gated` is the only classification allowed to redirect traffic —
+    /// torrc repoints, relay stand-down, and the 127.0.0.2 bind all key on
+    /// `declared`. An undeclared Session port is challenged and audited but
+    /// must never be `declared`.
+    #[test]
+    fn declared_tracks_the_manifest_not_the_default() {
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 8090\n      container: 7777\n      protocol: tcp\n      bind: 127.0.0.1\n      auth: gated\n"
+            )),
+            &mut map,
+        );
+        assert!(map.gated(8090).expect("gated").declared);
+
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 9100\n      container: 9100\n      protocol: tcp\n"
+            )),
+            &mut map,
+        );
+        let undeclared = map.gated(9100).expect("session default is challenged");
+        assert!(
+            !undeclared.declared,
+            "an absent auth field must never read as an instruction"
+        );
+    }
+
+    /// `auth: local` keeps the gate's hands off entirely — the port is
+    /// neither gated nor exempt-reported — but it IS recorded, so the mesh
+    /// relay can refuse to republish a deliberately host-local port.
+    #[test]
+    fn local_ports_are_untouched_but_recorded() {
+        let mut map = PortMap::default();
+        classify_manifest(
+            &manifest(&format!(
+                "{BASE}  ports:\n    - host: 32838\n      container: 32838\n      protocol: tcp\n      bind: 127.0.0.1\n      auth: local\n"
+            )),
+            &mut map,
+        );
+        assert!(map.gated(32838).is_none());
+        assert!(map.exempt_ports().is_empty());
+        assert!(
+            map.is_declared_local(32838),
+            "the mesh relay needs this to refuse bridging a host-local port"
+        );
+        assert!(!map.is_declared_local(3000));
+    }
+
+    /// The real corpus: every port the FIPS relay can bridge must be safe to
+    /// bridge. A port that is declared `local` (host-local by intent) or
+    /// declared `gated` (the app gate owns its external addresses) must be
+    /// withheld by the relay — this asserts the two sets the relay consults
+    /// actually classify the live manifests, so a future manifest edit that
+    /// re-opens one is caught here rather than on a node.
+    #[test]
+    fn relay_port_list_respects_local_and_gated_declarations() {
+        let map = build_port_map();
+        let relay_would_expose: Vec<u16> = crate::fips::app_ports::APP_LAUNCH_PORTS
+            .iter()
+            .copied()
+            .filter(|p| map.is_declared_local(*p))
+            .collect();
+        assert!(
+            !relay_would_expose.is_empty(),
+            "expected the corpus to contain at least one local port in the relay list \
+             (32838/8999) — if this fails the guard is untested, not unnecessary"
+        );
+    }
+
     /// Protocol ports that wallets dial directly must never end up gated —
     /// this is the constraint that decided the design (Zeus and electrum
     /// clients keep working untouched).

core/archipelago/src/appgate/listener.rs

@@ -44,6 +44,15 @@ use tracing::{debug, info, warn};
 /// apps are installed while the daemon runs.
 const SWEEP_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
 
+/// The gate's own loopback address, distinct from the app's `127.0.0.1`.
+///
+/// Tor cannot present a session cookie, so `HiddenServicePort → 127.0.0.1`
+/// reaches the app around the gate. Instead torrc forwards gated ports to
+/// this address (`api/rpc/tor`), where the gate — not the app — listens. A
+/// second loopback address rather than a second port number, so no app needs
+/// a port it did not declare.
+pub const GATE_TOR_UPSTREAM: IpAddr = IpAddr::V4(std::net::Ipv4Addr::new(127, 0, 0, 2));
+
 /// A port the gate should own but could not claim, and why.
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct UnprotectedPort {
@@ -142,8 +151,12 @@ pub async fn run(
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
 ) {
     // (port, addr) pairs already served, so a sweep does not rebind what it
-    // already holds.
-    let mut held: HashMap<(u16, IpAddr), ()> = HashMap::new();
+    // already holds. The accept-loop handle is kept so a claim can be
+    // RELEASED when its port leaves the gated set — a catalog refresh
+    // declaring a port `local`/`none` must make the gate let go without a
+    // daemon restart, or the stale bind keeps republishing a port the
+    // catalog just withdrew (nbxplorer 32838, archi-dev-box 2026-08-04).
+    let mut held: HashMap<(u16, IpAddr), tokio::task::JoinHandle<()>> = HashMap::new();
     let mut interval = tokio::time::interval(SWEEP_INTERVAL);
     interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
 
@@ -160,7 +173,7 @@ pub async fn run(
 async fn sweep(
     gate: &Arc<AppGate>,
     status: &Arc<RwLock<GateStatus>>,
-    held: &mut HashMap<(u16, IpAddr), ()>,
+    held: &mut HashMap<(u16, IpAddr), tokio::task::JoinHandle<()>>,
     shutdown_rx: &tokio::sync::watch::Receiver<bool>,
 ) {
     // Re-read the manifests every sweep rather than trusting the map built
@@ -170,6 +183,23 @@ async fn sweep(
     // enforced while serving a brand-new app to anyone who asked.
     gate.refresh().await;
     let port_map = gate.port_map().await;
+
+    // Release claims whose port left the gated set (or whose Tor-upstream
+    // claim lost its declaration). Aborting the accept loop drops the
+    // listener, freeing the address for whoever now legitimately owns it —
+    // the app itself, or nobody.
+    held.retain(|(port, addr), handle| {
+        let keep = match port_map.gated(*port) {
+            None => false,
+            Some(app) => *addr != GATE_TOR_UPSTREAM || app.declared,
+        };
+        if !keep {
+            handle.abort();
+            info!(port, %addr, "app gate released a claim: port is no longer gated here");
+        }
+        keep
+    });
+
     let addresses = host_addresses().await;
     if addresses.is_empty() {
         debug!("app gate: no external addresses yet");
@@ -192,6 +222,10 @@ async fn sweep(
 
         let mut claimed_any = false;
         let mut blocked = false;
+        // External addresses first, then the gate's Tor upstream. 127.0.0.2
+        // deliberately does NOT count toward `claimed_any`: the warning below
+        // is about external exposure, and a port whose only claim is the Tor
+        // loopback is still wide open on the LAN.
         for &addr in &addresses {
             let key = (app.port, addr);
             if held.contains_key(&key) {
@@ -201,19 +235,48 @@ async fn sweep(
             }
             match TcpListener::bind(SocketAddr::new(addr, app.port)).await {
                 Ok(listener) => {
-                    held.insert(key, ());
+                    let handle =
+                        spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
+                    held.insert(key, handle);
                     claimed.push((app.port, addr.to_string()));
                     claimed_any = true;
                     info!(
                         port = app.port, %addr, app = %app.app_id,
                         "app gate claimed an app port"
                     );
-                    spawn_accept_loop(listener, gate.clone(), app.clone(), shutdown_rx.clone());
                 }
                 // Almost always the app itself holding 0.0.0.0:<port>.
                 Err(_) => blocked = true,
             }
         }
+        // The Tor upstream is bound for DECLARED gated ports only: torrc only
+        // repoints an onion at 127.0.0.2 for a declared port, and standing a
+        // challenge on an undeclared port's would-be upstream would change
+        // where its traffic goes on nothing but a default.
+        if app.declared {
+            let tor_key = (app.port, GATE_TOR_UPSTREAM);
+            if held.contains_key(&tor_key) {
+                claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+            } else {
+                match TcpListener::bind(SocketAddr::new(GATE_TOR_UPSTREAM, app.port)).await {
+                    Ok(listener) => {
+                        let handle = spawn_accept_loop(
+                            listener,
+                            gate.clone(),
+                            app.clone(),
+                            shutdown_rx.clone(),
+                        );
+                        held.insert(tor_key, handle);
+                        claimed.push((app.port, GATE_TOR_UPSTREAM.to_string()));
+                        info!(
+                            port = app.port, app = %app.app_id,
+                            "app gate claimed the Tor upstream (127.0.0.2)"
+                        );
+                    }
+                    Err(_) => blocked = true,
+                }
+            }
+        }
 
         if blocked && !claimed_any {
             warn!(
@@ -251,12 +314,15 @@ async fn app_is_listening(port: u16) -> bool {
     .is_some()
 }
 
+/// Returns the accept-loop task handle so the sweep can release the claim
+/// (abort → listener drops → address freed) when the port leaves the gated
+/// set. In-flight connections finish on their own tasks.
 fn spawn_accept_loop(
     listener: TcpListener,
     gate: Arc<AppGate>,
     app: GatedPort,
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
-) {
+) -> tokio::task::JoinHandle<()> {
     tokio::spawn(async move {
         loop {
             tokio::select! {
@@ -287,7 +353,7 @@ fn spawn_accept_loop(
                 _ = shutdown_rx.changed() => break,
             }
         }
-    });
+    })
 }
 
 #[cfg(test)]

core/archipelago/src/appgate/mod.rs

@@ -578,6 +578,7 @@ mod tests {
             app_id: "strfry".to_string(),
             app_name: "Strfry Relay".to_string(),
             icon: None,
+            declared: true,
         }
     }
 

core/archipelago/src/container/app_catalog.rs

@@ -216,6 +216,46 @@ pub fn catalog_manifest_values() -> Vec<(String, serde_json::Value)> {
         .collect()
 }
 
+/// A catalog-embedded manifest as the node actually applies it: parsed,
+/// id-checked, validated, and image-only (build-source manifests defer to
+/// disk). `None` = the caller must fall back to the disk manifest.
+///
+/// Shared between the orchestrator's load overlay and the app gate's port
+/// classification so both answer "which manifest governs this app?" from the
+/// same origin. They diverged once — the orchestrator published containers
+/// from the catalog while the gate classified from stale disk manifests, and
+/// the gate externally bound a port the catalog had declared `auth: local`
+/// (nbxplorer 32838, archi-dev-box 2026-08-04).
+pub fn catalog_manifest_overlay(
+    app_id: &str,
+    value: serde_json::Value,
+) -> Option<archipelago_container::manifest::AppManifest> {
+    let m: archipelago_container::manifest::AppManifest = match serde_json::from_value(value) {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(app = %app_id, error = %e,
+                "skipping unparseable catalog manifest; using disk fallback");
+            return None;
+        }
+    };
+    if m.app.id != app_id {
+        tracing::warn!(catalog_id = %app_id, manifest_id = %m.app.id,
+            "skipping catalog manifest: embedded app id mismatches catalog key");
+        return None;
+    }
+    if let Err(e) = m.validate() {
+        tracing::warn!(app = %app_id, error = %e,
+            "skipping invalid catalog manifest; using disk fallback");
+        return None;
+    }
+    if m.app.container.build.is_some() {
+        tracing::debug!(app = %app_id,
+            "catalog manifest has a build source; deferring to disk (phase 1 = image-only)");
+        return None;
+    }
+    Some(m)
+}
+
 /// The catalog's default/latest version string for an app (the top-level
 /// `version` field), if covered. Used to decide whether an install-time
 /// selection should pin (older) or track-latest (default).

core/archipelago/src/container/prod_orchestrator.rs

@@ -595,10 +595,20 @@ async fn wait_for_manifest_host_ports(
 /// `podman inspect --format '{{json .HostConfig.PortBindings}}'` emits, e.g.
 /// `{"8080/tcp":[{"HostIp":"","HostPort":"18080"}]}`. Returns true only when a
 /// manifest container-port is positively published to a *different* host port
-/// than the manifest now asks for. Absence of a binding is deliberately NOT
-/// treated as drift here — that case is handled by the host-port repair/restart
-/// path and by host-networked apps that publish nothing — so we never trigger a
-/// destructive recreate on a false positive.
+/// than the manifest now asks for — or, when the manifest DECLARES a bind
+/// address, to a different host address. Absence of a binding is deliberately
+/// NOT treated as drift here — that case is handled by the host-port
+/// repair/restart path and by host-networked apps that publish nothing — so we
+/// never trigger a destructive recreate on a false positive.
+///
+/// The bind comparison is what lets a node self-heal after a catalog refresh
+/// pins an app to loopback for the app gate: a legacy (pre-quadlet) container
+/// still publishing `0.0.0.0:P` against a manifest that now declares
+/// `bind: 127.0.0.1` is recreated to the declared state, exactly as
+/// `package.update` would. An EMPTY manifest bind means "no instruction" and
+/// never fires this — recreating a loopback-published container to wildcard on
+/// silence is precisely the v1.7.121 incident class (Bitcoin RPC republished
+/// on the LAN).
 fn host_port_bindings_drifted(
     port_bindings_json: &str,
     manifest_ports: &[archipelago_container::manifest::PortMapping],
@@ -626,10 +636,26 @@ fn host_port_bindings_drifted(
         }
         let expected = port.host.to_string();
         let matches_expected = bindings.iter().any(|b| {
-            b.get("HostPort")
+            let host_port_ok = b
+                .get("HostPort")
                 .and_then(|h| h.as_str())
                 .map(|h| h == expected)
-                .unwrap_or(false)
+                .unwrap_or(false);
+            if !host_port_ok {
+                return false;
+            }
+            // Only a DECLARED bind participates; podman reports a wildcard
+            // publish as "" or "0.0.0.0".
+            if port.bind.is_empty() {
+                return true;
+            }
+            let actual_ip = b.get("HostIp").and_then(|h| h.as_str()).unwrap_or("");
+            let actual = if actual_ip.is_empty() {
+                "0.0.0.0"
+            } else {
+                actual_ip
+            };
+            actual == port.bind
         });
         if !matches_expected {
             return true;
@@ -1157,30 +1183,7 @@ struct LoadedManifest {
 /// source (build contexts aren't registry-distributed yet — phase 1 is
 /// image-only). See `docs/registry-manifest-design.md`.
 fn catalog_manifest_to_overlay(app_id: &str, value: serde_json::Value) -> Option<AppManifest> {
-    let m: AppManifest = match serde_json::from_value(value) {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(app = %app_id, error = %e,
-                "skipping unparseable catalog manifest; using disk fallback");
-            return None;
-        }
-    };
-    if m.app.id != app_id {
-        tracing::warn!(catalog_id = %app_id, manifest_id = %m.app.id,
-            "skipping catalog manifest: embedded app id mismatches catalog key");
-        return None;
-    }
-    if let Err(e) = m.validate() {
-        tracing::warn!(app = %app_id, error = %e,
-            "skipping invalid catalog manifest; using disk fallback");
-        return None;
-    }
-    if m.app.container.build.is_some() {
-        tracing::debug!(app = %app_id,
-            "catalog manifest has a build source; deferring to disk (phase 1 = image-only)");
-        return None;
-    }
-    Some(m)
+    crate::container::app_catalog::catalog_manifest_overlay(app_id, value)
 }
 
 struct OrchestratorState {
@@ -4569,6 +4572,76 @@ mod tests {
         ));
     }
 
+    fn bound_port(
+        host: u16,
+        container: u16,
+        bind: &str,
+    ) -> archipelago_container::manifest::PortMapping {
+        archipelago_container::manifest::PortMapping {
+            bind: bind.to_string(),
+            ..port(host, container)
+        }
+    }
+
+    #[test]
+    fn bind_drift_detected_when_declared_loopback_but_published_wildcard() {
+        // The legacy-container case: a pre-quadlet container still publishes
+        // 0.0.0.0 while the catalog-delivered manifest pins the app to
+        // loopback for the app gate. Must recreate, or the port stays open on
+        // every interface and the gate can never claim it.
+        for wildcard in [r#""""#, r#""0.0.0.0""#] {
+            let bindings = format!(r#"{{"80/tcp":[{{"HostIp":{wildcard},"HostPort":"8082"}}]}}"#);
+            assert!(host_port_bindings_drifted(
+                &bindings,
+                &[bound_port(8082, 80, "127.0.0.1")]
+            ));
+        }
+    }
+
+    #[test]
+    fn no_bind_drift_when_declared_loopback_and_published_loopback() {
+        let bindings = r#"{"80/tcp":[{"HostIp":"127.0.0.1","HostPort":"8082"}]}"#;
+        assert!(!host_port_bindings_drifted(
+            bindings,
+            &[bound_port(8082, 80, "127.0.0.1")]
+        ));
+    }
+
+    #[test]
+    fn no_bind_drift_on_undeclared_bind() {
+        // Silence is not consent (v1.7.121 incident class): an EMPTY manifest
+        // bind must never recreate a loopback-published container to
+        // wildcard — that is how Bitcoin's RPC got republished on the LAN.
+        let bindings = r#"{"8332/tcp":[{"HostIp":"127.0.0.1","HostPort":"8332"}]}"#;
+        assert!(!host_port_bindings_drifted(bindings, &[port(8332, 8332)]));
+    }
+
+    #[test]
+    fn multi_bind_publish_satisfies_each_declared_entry() {
+        // Same host/container pair listed twice (loopback + archy-net
+        // gateway): both declared binds are present in the actual publish.
+        let bindings = r#"{"8332/tcp":[
+            {"HostIp":"127.0.0.1","HostPort":"8332"},
+            {"HostIp":"10.89.0.1","HostPort":"8332"}
+        ]}"#;
+        assert!(!host_port_bindings_drifted(
+            bindings,
+            &[
+                bound_port(8332, 8332, "127.0.0.1"),
+                bound_port(8332, 8332, "10.89.0.1")
+            ]
+        ));
+        // And a wildcard-only publish drifts BOTH declared entries.
+        let wildcard = r#"{"8332/tcp":[{"HostIp":"","HostPort":"8332"}]}"#;
+        assert!(host_port_bindings_drifted(
+            wildcard,
+            &[
+                bound_port(8332, 8332, "127.0.0.1"),
+                bound_port(8332, 8332, "10.89.0.1")
+            ]
+        ));
+    }
+
     #[test]
     fn missing_secret_error_names_the_secret() {
         use archipelago_container::manifest::SecretsProvider;

core/archipelago/src/server.rs

@@ -1145,16 +1145,52 @@ fn fips_app_relay_addr(ip: std::net::Ipv6Addr, port: u16) -> SocketAddr {
 /// without a daemon restart. Each relay binds to the fips0 ULA only and
 /// forwards raw TCP to the same port on IPv4 loopback.
 async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bool>) {
-    use std::collections::HashSet;
-    let mut bridged: HashSet<u16> = HashSet::new();
+    use std::collections::HashMap;
+    let mut bridged: HashMap<u16, tokio::task::JoinHandle<()>> = HashMap::new();
     let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
     interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
     loop {
         tokio::select! {
             _ = interval.tick() => {
                 let Some(fips_ip) = crate::fips::iface::fips0_ula() else { continue };
+                // This relay is a raw unauthenticated forward from the mesh to
+                // the app's loopback, so it must refuse two classes of port:
+                //
+                // * `auth: gated` — the app gate owns the fips0 ULA for these,
+                //   and bridging one would bypass the login page. Which of the
+                //   two won the bind used to be a race.
+                // * `auth: local` — host-local BY INTENT. Bridging one makes a
+                //   port reachable from the whole mesh that was deliberately
+                //   never externally reachable: nbxplorer 32838 answered HTTP
+                //   200 over the mesh with no credential (archi-dev-box
+                //   2026-08-04) purely because it appeared in the static port
+                //   list below.
+                //
+                // Undeclared ports keep today's behaviour — silence is not an
+                // instruction in either direction, and this relay predates the
+                // declarations.
+                let port_map = crate::appgate::identity::build_port_map();
+                let gate_owned: std::collections::HashSet<u16> = port_map
+                    .gated_ports()
+                    .filter(|g| g.declared)
+                    .map(|g| g.port)
+                    .collect();
                 for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {
-                    if bridged.contains(&port) {
+                    let withhold = if gate_owned.contains(&port) {
+                        Some("port is now gate-owned")
+                    } else if port_map.is_declared_local(port) {
+                        Some("port is declared auth: local (host-local by intent)")
+                    } else {
+                        None
+                    };
+                    if let Some(reason) = withhold {
+                        if let Some(handle) = bridged.remove(&port) {
+                            handle.abort();
+                            info!(port, reason, "v6 relay released a bridge");
+                        }
+                        continue;
+                    }
+                    if bridged.contains_key(&port) {
                         continue;
                     }
                     // ONLY bridge a port that a running app already answers on
@@ -1181,10 +1217,9 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
                     // EADDRINUSE = fipsd or another process already answers
                     // on this mesh address/port, so stay out of the way.
                     let Ok(listener) = bind_v6_only(addr) else { continue };
-                    bridged.insert(port);
                     debug!("v6 relay bridging [{fips_ip}]:{port} -> 127.0.0.1:{port}");
                     let mut rx = shutdown_rx.clone();
-                    tokio::spawn(async move {
+                    let handle = tokio::spawn(async move {
                         loop {
                             tokio::select! {
                                 accepted = listener.accept() => {
@@ -1205,6 +1240,7 @@ async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bo
                             }
                         }
                     });
+                    bridged.insert(port, handle);
                 }
             }
             _ = shutdown_rx.changed() => return,

core/archipelago/src/wallet/ecash.rs

@@ -1040,6 +1040,12 @@ pub async fn receive_token(data_dir: &Path, token_str: &str) -> Result<u64> {
 
     let mut wallet = load_wallet(data_dir).await?;
     let mut received_total = 0u64;
+    // MintClient translates the mint's NUT error code into plain language and
+    // puts it at the top of the error chain (see `mint_error` in
+    // mint_client.rs); `{}` surfaces that, `{:#}` keeps the raw status/body
+    // for the log. Remember the last one so a total failure can tell the user
+    // *why* instead of just "nothing was received".
+    let mut last_reason: Option<String> = None;
 
     // Swap proofs at each mint
     for entry in &token.token {
@@ -1051,14 +1057,18 @@ pub async fn receive_token(data_dir: &Path, token_str: &str) -> Result<u64> {
                 received_total += amount;
             }
             Err(e) => {
-                warn!("Failed to swap proofs from mint {}: {}", entry.mint, e);
+                warn!("Failed to swap proofs from mint {}: {:#}", entry.mint, e);
+                last_reason = Some(e.to_string());
                 // Continue with other mints if any
             }
         }
     }
 
     if received_total == 0 {
-        anyhow::bail!("Failed to receive any proofs from token");
+        match last_reason {
+            Some(reason) => anyhow::bail!("Could not receive this ecash: {}", reason),
+            None => anyhow::bail!("Failed to receive any proofs from token"),
+        }
     }
 
     wallet.record_tx(

core/archipelago/src/wallet/mint_client.rs

@@ -59,6 +59,72 @@ pub struct MintResult {
     pub proofs: Vec<Proof>,
 }
 
+/// Translate a Cashu NUT "transaction validation" error code into plain
+/// language a wallet user can act on. Mints respond to a rejected request
+/// with `{"code": N, "detail": "..."}`; `detail` is implementation-defined
+/// free text, but `code` is the stable identifier from the spec
+/// (https://github.com/cashubtc/nuts/blob/main/error_codes.md). Covers the
+/// 10001-11017 "proof/transaction validation" range plus the 12001-12003
+/// keyset codes shared by NUT-02/03/04/05 — the codes a swap/melt/mint call
+/// can actually hit. Returns `None` for anything else (e.g. Lightning/quote
+/// codes in the 20000s) so the caller falls back to the mint's own `detail`.
+fn describe_mint_error_code(code: i64) -> Option<&'static str> {
+    Some(match code {
+        10001 => "The mint rejected these coins as invalid.",
+        11001 => "This ecash has already been redeemed — it can't be claimed twice.",
+        11002 => "This ecash is already being redeemed elsewhere — try again in a moment.",
+        11003 => "The mint already issued new coins for this exact request — there's nothing left to redeem.",
+        11004 => "This request is still being processed by the mint — try again in a moment.",
+        11005 => "The token's amounts don't add up (inputs don't match outputs) — it may be corrupt.",
+        11006 => "That amount is outside the range this mint allows.",
+        11007 => "This token contains duplicate coins — it may be corrupt or already used.",
+        11008 => "The mint rejected this as a duplicate request.",
+        11009 | 11010 => "This token mixes incompatible currency units — the mint rejected it.",
+        11011 => "That Lightning invoice has no amount, which isn't supported here.",
+        11012 => "The amount requested doesn't match the Lightning invoice.",
+        11013 => "The mint doesn't support this currency unit.",
+        11014 | 11015 => "This token has too many coins for the mint to process in one request.",
+        11016 => "Duplicate quote IDs were sent in this request.",
+        11017 => "Too many items were sent in a single request.",
+        12001 => "The mint no longer recognizes the keyset that signed this token.",
+        12002 => "The mint's signing key for this token is inactive.",
+        12003 => "The mint's signing key for this token has expired.",
+        _ => return None,
+    })
+}
+
+/// Parse a mint's error body (`{"code": N, "detail": "..."}`) and pick the
+/// best user-facing message: the plain-language translation when we know the
+/// code, otherwise the mint's own `detail` text, otherwise the raw body.
+fn describe_mint_error_body(status: reqwest::StatusCode, body: &str) -> String {
+    let parsed: Option<serde_json::Value> = serde_json::from_str(body).ok();
+    let code = parsed
+        .as_ref()
+        .and_then(|v| v.get("code"))
+        .and_then(|c| c.as_i64());
+    let detail = parsed
+        .as_ref()
+        .and_then(|v| v.get("detail"))
+        .and_then(|d| d.as_str());
+
+    if let Some(friendly) = code.and_then(describe_mint_error_code) {
+        return friendly.to_string();
+    }
+    match detail {
+        Some(d) if !d.is_empty() => d.to_string(),
+        _ => format!("mint returned {} with no further detail", status),
+    }
+}
+
+/// Build the error for a failed mint HTTP call: `op` + status + raw body as
+/// the technical cause (visible via `{:#}` in logs), with the plain-language
+/// translation layered on top via `.context()` so `{}` — what reaches the
+/// wallet user — shows something actionable instead of raw mint JSON.
+fn mint_error(op: &str, status: reqwest::StatusCode, body: &str) -> anyhow::Error {
+    let friendly = describe_mint_error_body(status, body);
+    anyhow::anyhow!("{} failed ({}): {}", op, status, body).context(friendly)
+}
+
 /// HTTP client for a single Cashu mint.
 pub struct MintClient {
     url: String,
@@ -146,7 +212,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Mint quote failed ({}): {}", status, body);
+            return Err(mint_error("Mint quote", status, &body));
         }
 
         res.json().await.context("Failed to parse mint quote")
@@ -212,7 +278,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Mint tokens failed ({}): {}", status, body);
+            return Err(mint_error("Minting tokens", status, &body));
         }
 
         let body: serde_json::Value = res.json().await.context("Failed to parse mint response")?;
@@ -266,7 +332,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Melt quote failed ({}): {}", status, body);
+            return Err(mint_error("Melt quote", status, &body));
         }
 
         res.json().await.context("Failed to parse melt quote")
@@ -293,7 +359,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Melt failed ({}): {}", status, body);
+            return Err(mint_error("Melt", status, &body));
         }
 
         res.json().await.context("Failed to parse melt response")
@@ -337,7 +403,7 @@ impl MintClient {
         if !res.status().is_success() {
             let status = res.status();
             let body = res.text().await.unwrap_or_default();
-            anyhow::bail!("Swap failed ({}): {}", status, body);
+            return Err(mint_error("Swap", status, &body));
         }
 
         let body: serde_json::Value = res.json().await.context("Failed to parse swap response")?;

releases/app-catalog.json

@@ -25,6 +25,7 @@
           "name": "AI Assistant",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 80,
               "host": 5180,
@@ -228,6 +229,8 @@
           "name": "Mempool Web",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 4080,
               "protocol": "tcp"
@@ -302,6 +305,8 @@
           "name": "NBXplorer",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 32838,
               "host": 32838,
               "protocol": "tcp"
@@ -374,6 +379,8 @@
           "name": "Ark Wallet",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 3535,
               "host": 3535,
               "protocol": "tcp"
@@ -462,12 +469,15 @@
           "name": "Bitcoin Core",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 8332,
               "host": 8332,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
               "container": 8333,
               "host": 8333,
               "protocol": "tcp"
@@ -605,12 +615,15 @@
           "name": "Bitcoin Knots",
           "ports": [
             {
+              "auth": "local",
               "bind": "127.0.0.1",
               "container": 8332,
               "host": 8332,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Bitcoin p2p gossip. Peers are anonymous by design and speak the Bitcoin wire protocol, not HTTP.",
               "container": 8333,
               "host": 8333,
               "protocol": "tcp"
@@ -671,7 +684,7 @@
       ]
     },
     "bitcoin-ui": {
-      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.84-alpha",
+      "image": "146.59.87.168:3000/lfg2025/bitcoin-ui:1.7.119-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -719,7 +732,7 @@
           ]
         }
       },
-      "version": "1.7.84-alpha"
+      "version": "1.7.119-alpha"
     },
     "botfights": {
       "manifest": {
@@ -931,6 +944,8 @@
           "name": "BTCPay Server",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 49392,
               "host": 23000,
               "protocol": "tcp"
@@ -1001,11 +1016,15 @@
           "name": "Core Lightning (CLN)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9736,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Core Lightning gRPC, authenticated by mutual TLS client certificates.",
               "container": 9835,
               "host": 9835,
               "protocol": "tcp"
@@ -1075,6 +1094,8 @@
           "name": "Web5 DID Wallet",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8088,
               "protocol": "tcp"
@@ -1219,6 +1240,8 @@
           "name": "ElectrumX",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Electrum wire protocol over TCP. Electrum wallets speak it directly and cannot hold a session cookie.",
               "container": 50001,
               "host": 50001,
               "protocol": "tcp"
@@ -1342,6 +1365,8 @@
               "protocol": "tcp"
             },
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8175,
               "host": 8177,
               "protocol": "tcp"
@@ -1416,6 +1441,8 @@
           "name": "Fedimint Client",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8178,
               "protocol": "tcp"
@@ -1601,6 +1628,8 @@
           "name": "File Browser",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8083,
               "protocol": "tcp"
@@ -1753,11 +1782,15 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3000,
               "host": 3001,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "Git over SSH, authenticated by the user's own SSH keypair. Not HTTP, so the gate cannot serve a login page here.",
               "container": 22,
               "host": 2222,
               "protocol": "tcp"
@@ -1842,6 +1875,8 @@
           "name": "Grafana",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3000,
               "host": 3000,
               "protocol": "tcp"
@@ -1925,6 +1960,8 @@
           "name": "Home Assistant",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8123,
               "host": 8123,
               "protocol": "tcp"
@@ -2034,6 +2071,8 @@
           "name": "Immich",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 2283,
               "host": 2283,
               "protocol": "tcp"
@@ -2273,6 +2312,8 @@
           "name": "IndeeHub",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 7777,
               "host": 7778,
               "protocol": "tcp"
@@ -2765,6 +2806,8 @@
           "name": "Jellyfin",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8096,
               "host": 8096,
               "protocol": "tcp"
@@ -2852,11 +2895,15 @@
           "name": "Lightning Stack",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9738,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.",
               "container": 10009,
               "host": 10010,
               "protocol": "tcp"
@@ -2950,16 +2997,22 @@
           "name": "LND",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
               "container": 9735,
               "host": 9735,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Zeus and other remote wallets depend on reaching this directly.",
               "container": 10009,
               "host": 10009,
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client.",
               "container": 8080,
               "host": 18080,
               "protocol": "tcp"
@@ -2998,7 +3051,7 @@
       "version": "v0.18.4-beta"
     },
     "lnd-ui": {
-      "image": "146.59.87.168:3000/lfg2025/lnd-ui:latest",
+      "image": "146.59.87.168:3000/lfg2025/lnd-ui:1.7.119-alpha",
       "manifest": {
         "app": {
           "container": {
@@ -3025,25 +3078,19 @@
           },
           "id": "lnd-ui",
           "name": "LND UI",
-          "ports": [
-            {
-              "container": 80,
-              "host": 18083,
-              "protocol": "tcp"
-            }
-          ],
+          "ports": [],
           "resources": {
             "memory_limit": "64Mi"
           },
           "security": {
-            "network_policy": "bridge",
+            "network_policy": "host",
             "readonly_root": false
           },
           "version": "1.0.0",
           "volumes": []
         }
       },
-      "version": "latest"
+      "version": "1.7.119-alpha"
     },
     "mempool": {
       "image": "146.59.87.168:3000/lfg2025/mempool-frontend:v3.0.1",
@@ -3093,6 +3140,8 @@
           "name": "Mempool Explorer",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 4080,
               "protocol": "tcp"
@@ -3196,6 +3245,8 @@
           "name": "Mempool API",
           "ports": [
             {
+              "auth": "local",
+              "bind": "127.0.0.1",
               "container": 8999,
               "host": 8999,
               "protocol": "tcp"
@@ -3255,6 +3306,8 @@
           "name": "MorphOS Server",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8089,
               "protocol": "tcp"
@@ -3569,6 +3622,8 @@
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "STUN over UDP for NAT traversal; it must answer unauthenticated probes to do its job at all.",
               "container": 3478,
               "host": 3478,
               "protocol": "udp"
@@ -3653,6 +3708,8 @@
           "name": "Nextcloud",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8085,
               "protocol": "tcp"
@@ -3731,6 +3788,8 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 18081,
               "protocol": "tcp"
@@ -3832,6 +3891,8 @@
           "name": "PhotoPrism",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 2342,
               "host": 2342,
               "protocol": "tcp"
@@ -4066,6 +4127,8 @@
           "name": "Pine Wake Word (openWakeWord)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10400,
               "host": 10400,
               "protocol": "tcp"
@@ -4144,6 +4207,8 @@
           "name": "Pine Piper (TTS)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10200,
               "host": 10200,
               "protocol": "tcp"
@@ -4226,6 +4291,8 @@
           "name": "Pine Whisper (STT)",
           "ports": [
             {
+              "auth": "none",
+              "auth_rationale": "Wyoming voice protocol, a binary local-only stream consumed by Home Assistant; not HTTP and not browser-reachable.",
               "container": 10300,
               "host": 10300,
               "protocol": "tcp"
@@ -4298,6 +4365,8 @@
           "name": "Portainer",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 9000,
               "host": 9000,
               "protocol": "tcp"
@@ -4394,11 +4463,15 @@
               "protocol": "tcp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "mDNS is UDP multicast service discovery; gating it would break .local name resolution for every device on the LAN.",
               "container": 5353,
               "host": 5353,
               "protocol": "udp"
             },
             {
+              "auth": "none",
+              "auth_rationale": "SSDP/UPnP discovery is UDP multicast — there is no HTTP request to gate and no client that could hold a session.",
               "container": 1900,
               "host": 1900,
               "protocol": "udp"
@@ -4478,6 +4551,8 @@
           "name": "SearXNG",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 8080,
               "host": 8888,
               "protocol": "tcp"
@@ -4549,6 +4624,8 @@
           },
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 7777,
               "host": 8090,
               "protocol": "tcp"
@@ -4639,6 +4716,8 @@
           "name": "Uptime Kuma",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 3001,
               "host": 3002,
               "protocol": "tcp"
@@ -4720,6 +4799,8 @@
           "name": "Vaultwarden",
           "ports": [
             {
+              "auth": "gated",
+              "bind": "127.0.0.1",
               "container": 80,
               "host": 8082,
               "protocol": "tcp"
@@ -4756,7 +4837,7 @@
     }
   },
   "schema": 1,
-  "signature": "1fe1b962317212c15b83c9ae8b0b2957f9663bb7dda3f4d117123aab496ddd4f94fa48f7d4abfd4be5b771510aed51f8ede870e55cb3fd21ce2453bea1d3510e",
+  "signature": "cc83d0be50ce6144e2b5693a7175d7743d4a19141f4ef9a46a3c88d2dadd848acda9c25063e7a8b5643cecb2ccde279762a00a9715a5d26c99a95b492bc82a05",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
-  "updated": "2026-07-31"
+  "updated": "2026-08-04"
 }

scripts/publish-release-assets.sh

@@ -39,18 +39,25 @@ if [ -x "$PROJECT_ROOT/core/target/release/archipelago" ]; then
 fi
 
 remote_url=$(git -C "$PROJECT_ROOT" remote get-url "$REMOTE")
+# https is accepted as well as http. Requiring http:// meant the only remote
+# whose credential actually works for git push (the https one) was rejected,
+# while the http remote it forced you to use had a dead token — so publishing
+# failed on auth after the manifest had already passed every check
+# (v1.7.121-alpha, 2026-08-04). The scheme is carried through to the API URL
+# rather than assumed.
 case "$remote_url" in
-    http://*@*) ;;
-    *) fail "$REMOTE must be an authenticated http:// Gitea remote URL for API uploads" ;;
+    http://*@*|https://*@*) ;;
+    *) fail "$REMOTE must be an authenticated http(s):// Gitea remote URL for API uploads" ;;
 esac
 
-auth=${remote_url#http://}
-auth=${auth%@*}
-host_path=${remote_url#http://$auth@}
+scheme=${remote_url%%://*}
+rest=${remote_url#*://}
+auth=${rest%%@*}
+host_path=${rest#*@}
 host=${host_path%%/*}
 repo_path=${host_path#*/}
 repo_path=${repo_path%.git}
-api="http://$host/api/v1/repos/$repo_path"
+api="$scheme://$host/api/v1/repos/$repo_path"
 release_url="$api/releases/tags/v${VERSION}"
 
 echo "Pushing main and v${VERSION} to $REMOTE..."