release(v1.7.33-alpha): onboarding/login UX fixes + PWA cache bust

- useOnboarding.ts: prefer the backend over localStorage when checking
  onboarding completion. The old order (localStorage first) meant any
  browser that had ever onboarded a node would treat every new fresh
  node as already-onboarded and skip the wizard, dumping the user
  straight at the inline set-password form. Backend is now authoritative;
  localStorage stays as the offline fallback.
- OnboardingWrapper.vue: skip the intro video on `/login` once
  `neode_onboarding_complete` is set. Returning logged-out users now
  get the static lock-screen background + glitch overlay instead of
  replaying the full intro on every logout.
- RootRedirect.vue: when the health check fails, only show the full
  BootScreen if the node was never onboarded. For already-onboarded
  nodes (i.e. an OTA-update blip), keep the spinner and poll the
  health endpoint every 2s for up to 60s before falling back to the
  boot screen. Fixes the "fake boot loader" / "server starting up"
  screens flashing on every successful update.
- loginTransition store: new `justCompletedOnboarding` flag distinct
  from `justLoggedIn`. Set true only by the inline setup-password
  flow (handleSetup). Dashboard.vue branches on it: full glitch+zoom
  reveal for the post-onboarding entry, quick zoom + welcome typing
  on every other login (no triple glitch flashes, ~1.2s vs 8s).
- vite.config.ts: bump assets cache from `assets-cache-v2` to
  `assets-cache-v3` so service workers running the previous bundle
  invalidate their cache and pick up the new UI cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.21-alpha"
+version = "1.7.33-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.21-alpha"
+version = "1.7.33-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/handler/mod.rs

@@ -120,8 +120,8 @@ impl ApiHandler {
     /// first 2xx response. 15s total timeout.
     async fn handle_app_catalog_proxy() -> Result<Response<hyper::Body>> {
         const UPSTREAMS: &[&str] = &[
-            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
             "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json",
+            "https://git.tx1138.com/lfg2025/app-catalog/raw/branch/main/catalog.json",
         ];
         let client = match reqwest::Client::builder()
             .timeout(std::time::Duration::from_secs(15))

core/archipelago/src/api/rpc/dispatcher.rs

@@ -220,6 +220,7 @@ impl RpcHandler {
             "registry.list" => self.handle_registry_list().await,
             "registry.add" => self.handle_registry_add(params).await,
             "registry.remove" => self.handle_registry_remove(params).await,
+            "registry.set-primary" => self.handle_registry_set_primary(params).await,
             "registry.test" => self.handle_registry_test(params).await,
 
             // Streaming ecash payments
@@ -431,6 +432,23 @@ impl RpcHandler {
             "update.dismiss" => self.handle_update_dismiss().await,
             "update.download" => self.handle_update_download().await,
             "update.cancel-download" => self.handle_update_cancel_download().await,
+            "update.list-mirrors" => self.handle_update_list_mirrors().await,
+            "update.add-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_add_mirror(&p).await
+            }
+            "update.remove-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_remove_mirror(&p).await
+            }
+            "update.set-primary-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_set_primary_mirror(&p).await
+            }
+            "update.test-mirror" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_update_test_mirror(&p).await
+            }
             "update.apply" => self.handle_update_apply().await,
             "update.git-apply" => self.handle_update_git_apply().await,
             "update.rollback" => self.handle_update_rollback().await,

core/archipelago/src/api/rpc/fips.rs

@@ -12,8 +12,7 @@ use anyhow::Result;
 
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
-        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
@@ -36,13 +35,19 @@ impl RpcHandler {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
         fips::config::install(&identity_dir).await?;
         fips::service::activate(fips::SERVICE_UNIT).await?;
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
+    /// Restart whichever fips unit is supervising the daemon on this host.
+    /// Nodes installed from the archipelago ISO use `archipelago-fips.service`;
+    /// nodes that had the upstream debian package set up first may only have
+    /// `fips.service`. We resolve the active one via `service::active_unit()`
+    /// so the UI button is never a no-op.
     pub(super) async fn handle_fips_restart(&self) -> Result<serde_json::Value> {
-        fips::service::restart(fips::SERVICE_UNIT).await?;
-        Ok(serde_json::json!({ "restarted": true }))
+        let unit = fips::service::active_unit().await;
+        fips::service::restart(unit).await?;
+        Ok(serde_json::json!({ "restarted": true, "unit": unit }))
     }
 
     /// Full reconnect: stop the daemon, bring it back, wait for the DHT
@@ -53,7 +58,7 @@ impl RpcHandler {
     /// Runtime: ~20s. Needs an RPC timeout ≥ 45s on the client.
     pub(super) async fn handle_fips_reconnect(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let before = fips::FipsStatus::query(&identity_dir).await;
+        let before = fips::FipsStatus::query(&self.config.data_dir).await;
 
         // Heal the pre-fix bech32-text fips_key.pub → 32-raw-bytes
         // mismatch. The daemon silently authenticates with a garbage
@@ -70,12 +75,26 @@ impl RpcHandler {
             let _ = fips::config::install(&identity_dir).await;
         }
 
-        // Clean stop+start rather than `restart`, so a daemon that
-        // fails to come back up surfaces as service_active=false
-        // instead of quietly sticking with the old process.
-        let _ = fips::service::stop(fips::SERVICE_UNIT).await;
+        // Operate on whichever fips unit is actually up — nodes that
+        // have the upstream `fips.service` rather than the
+        // archipelago-managed `archipelago-fips.service` used to see
+        // Reconnect silently fail because we stopped a unit that
+        // didn't exist. Clean stop+start rather than `restart` so a
+        // daemon that fails to come back up surfaces as
+        // service_active=false instead of quietly sticking with the
+        // old process.
+        let unit = fips::service::active_unit().await;
+        let _ = fips::service::stop(unit).await;
         tokio::time::sleep(std::time::Duration::from_millis(800)).await;
-        fips::service::activate(fips::SERVICE_UNIT).await?;
+        fips::service::activate(unit).await?;
+
+        // Re-push seed anchors after restart so freshly-bound daemons
+        // don't have to wait 5 min for the periodic apply loop.
+        if let Ok(list) = fips::anchors::load(&self.config.data_dir).await {
+            if !list.is_empty() {
+                let _ = fips::anchors::apply(&list).await;
+            }
+        }
 
         // Anchor bootstrap window: poll the status every ~3s for up to
         // 20s. Bail as soon as the anchor is connected.
@@ -83,7 +102,7 @@ impl RpcHandler {
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
         loop {
             tokio::time::sleep(std::time::Duration::from_secs(3)).await;
-            let s = fips::FipsStatus::query(&identity_dir).await;
+            let s = fips::FipsStatus::query(&self.config.data_dir).await;
             if s.anchor_connected {
                 last_status = Some(s);
                 break;
@@ -111,13 +130,13 @@ impl RpcHandler {
             "peers_but_no_anchor"
         };
         let hint = match likely_cause {
-            "connected" => "Anchor is reachable.",
-            "daemon_down" => "The FIPS daemon didn't come back up — check archipelago-fips.service.",
+            "connected" => "An anchor is reachable.",
+            "daemon_down" => "The FIPS daemon didn't come back up — check the FIPS service on this host.",
             "no_seed_key" => "No seed-derived FIPS key on disk. Re-run the onboarding unlock step.",
             "no_outbound_udp_or_anchor_down" =>
-                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or the anchor (fips.v0l.io) could be down.",
+                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or every configured anchor could be down. Add a reachable peer in Seed Anchors.",
             "peers_but_no_anchor" =>
-                "Mesh has peers but the anchor hasn't been seen yet. Give it a minute and re-check.",
+                "Mesh has peers but none of them are anchors we recognise. Add your cluster's anchor in Seed Anchors.",
             _ => "",
         };
 

core/archipelago/src/api/rpc/package/install.rs

@@ -635,31 +635,32 @@ impl RpcHandler {
         unreachable!()
     }
 
-    /// Single image pull attempt with progress streaming.
-    async fn do_pull_image(&self, package_id: &str, docker_image: &str) -> Result<()> {
-        debug!("Pulling image: {}", docker_image);
-        self.set_install_progress(package_id, 0, 0).await;
-
-        // Set TMPDIR to user-writable location — rootless podman's user namespace
-        // makes /var/tmp read-only, which causes `podman pull` to fail with
-        // "mkdir /var/tmp/container_images_storage...: read-only file system"
-        let user_tmp = format!(
-            "{}/.local/share/containers/tmp",
-            std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string())
-        );
-        let _ = std::fs::create_dir_all(&user_tmp);
-
+    /// Pull one image URL with live progress streamed through
+    /// `update_install_progress`. Returns Ok(true) on a successful pull,
+    /// Ok(false) on transient failure (so the caller can try the next
+    /// mirror), Err only for unrecoverable setup errors.
+    async fn pull_one_url_with_progress(
+        &self,
+        url: &str,
+        tls_verify: bool,
+        package_id: &str,
+        user_tmp: &str,
+    ) -> Result<bool> {
+        let mut pull_args = vec!["pull".to_string(), url.to_string()];
+        if !tls_verify {
+            pull_args.push("--tls-verify=false".to_string());
+        }
         let mut child = tokio::process::Command::new("podman")
-            .args(["pull", docker_image])
-            .env("TMPDIR", &user_tmp)
+            .args(&pull_args)
+            .env("TMPDIR", user_tmp)
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::piped())
             .spawn()
             .context("Failed to start image pull")?;
 
-        // Wrap the entire pull (stderr progress + wait) in a 10-minute timeout.
-        // Large image layers (Minio, Postgres, ffmpeg) can take several minutes
-        // to pull. 60s was too short and caused premature retries on slow registries.
+        // 10-minute per-URL budget — large layers (Minio, Postgres,
+        // ffmpeg) regularly take several minutes and we'd rather wait
+        // than bounce to the next mirror mid-download.
         let pull_result = tokio::time::timeout(std::time::Duration::from_secs(600), async {
             if let Some(stderr) = child.stderr.take() {
                 let reader = BufReader::new(stderr);
@@ -677,38 +678,115 @@ impl RpcHandler {
         })
         .await;
 
-        let primary_failed = match pull_result {
-            Ok(Ok(status)) => !status.success(),
+        match pull_result {
+            Ok(Ok(status)) => Ok(status.success()),
             Ok(Err(e)) => {
-                tracing::warn!("Image pull process error: {}", e);
-                true
+                tracing::warn!("Image pull process error on {}: {}", url, e);
+                Ok(false)
             }
             Err(_) => {
-                tracing::warn!("Image pull timed out after 60s: {}", docker_image);
+                tracing::warn!("Image pull timed out after 600s: {}", url);
                 let _ = child.kill().await;
                 let _ = child.wait().await; // reap zombie
-                true
+                Ok(false)
             }
-        };
-        if primary_failed {
-            // Try all configured fallback registries dynamically
-            match crate::container::registry::pull_from_registries(
-                &self.config.data_dir,
-                docker_image,
-                &user_tmp,
-            )
+        }
+    }
+
+    /// Pull a container image, trying each configured registry in
+    /// priority order and streaming progress during every attempt. The
+    /// primary is tried first; if it doesn't have the image (or 404's),
+    /// the next mirror is tried — with its own progress streaming, so
+    /// the UI doesn't freeze at 0% after a primary miss. On success the
+    /// image is tagged under `docker_image` so downstream commands
+    /// (images -q, run -d, etc.) can find it by its canonical name.
+    async fn do_pull_image(&self, package_id: &str, docker_image: &str) -> Result<()> {
+        debug!("Pulling image: {}", docker_image);
+        self.set_install_progress(package_id, 0, 0).await;
+
+        // Set TMPDIR to user-writable location — rootless podman's user namespace
+        // makes /var/tmp read-only, which causes `podman pull` to fail with
+        // "mkdir /var/tmp/container_images_storage...: read-only file system"
+        let user_tmp = format!(
+            "{}/.local/share/containers/tmp",
+            std::env::var("HOME").unwrap_or_else(|_| "/home/archipelago".to_string())
+        );
+        let _ = std::fs::create_dir_all(&user_tmp);
+
+        // Build the ordered candidate list: every enabled registry
+        // (highest priority first), each rewriting the image URL to its
+        // own origin. Deduplicate — two registries that happen to share
+        // a URL should only be tried once.
+        let config = crate::container::registry::load_registries(&self.config.data_dir)
             .await
+            .unwrap_or_default();
+        let mut tried: std::collections::HashSet<String> = std::collections::HashSet::new();
+        let mut candidates: Vec<(String, bool)> = Vec::new();
+        for reg in config.active_registries() {
+            let url = config.rewrite_image(docker_image, reg);
+            if tried.insert(url.clone()) {
+                candidates.push((url, reg.tls_verify));
+            }
+        }
+        // If no registries are configured, fall back to the literal URL.
+        if candidates.is_empty() {
+            candidates.push((docker_image.to_string(), true));
+        }
+
+        // Walk candidates, streaming progress for each attempt.
+        let mut pulled_url: Option<String> = None;
+        let attempts = candidates.len();
+        for (i, (url, tls_verify)) in candidates.iter().enumerate() {
+            if url != docker_image {
+                debug!("Attempt {}/{}: {}", i + 1, attempts, url);
+            } else {
+                debug!("Attempt {}/{}: {} (literal)", i + 1, attempts, url);
+            }
+            // Reset progress at the top of each attempt so the UI reflects
+            // the fresh pull instead of showing stale bytes from a prior
+            // partial attempt.
+            self.set_install_progress(package_id, 0, 0).await;
+            match self
+                .pull_one_url_with_progress(url, *tls_verify, package_id, &user_tmp)
+                .await?
             {
-                Ok(_) => {
-                    tracing::info!("Pulled {} via dynamic registry fallback", docker_image);
+                true => {
+                    tracing::info!("Pulled {} from {}", docker_image, url);
+                    pulled_url = Some(url.clone());
+                    break;
                 }
-                Err(e) => {
-                    return Err(anyhow::anyhow!("Image pull failed: {}", e));
+                false => {
+                    tracing::debug!(
+                        "Pull attempt {}/{} failed for {}, trying next mirror",
+                        i + 1,
+                        attempts,
+                        url
+                    );
+                    continue;
                 }
             }
         }
 
-        // Verify image exists locally after pull
+        let Some(pulled_url) = pulled_url else {
+            return Err(anyhow::anyhow!(
+                "Image pull failed from all {} configured registries for {}",
+                attempts,
+                docker_image
+            ));
+        };
+
+        // Tag under the original docker_image reference if the successful
+        // pull came from a rewritten URL — downstream code (images -q,
+        // run -d docker_image, etc.) needs to find it by its canonical
+        // name regardless of which mirror actually served the bytes.
+        if pulled_url != docker_image {
+            let _ = tokio::process::Command::new("podman")
+                .args(["tag", &pulled_url, docker_image])
+                .output()
+                .await;
+        }
+
+        // Verify image exists locally after pull.
         let verify = tokio::process::Command::new("podman")
             .args(["images", "-q", docker_image])
             .output()
@@ -1467,6 +1545,36 @@ server {
         Ok(serde_json::json!({ "registries": config.registries, "removed": url }))
     }
 
+    /// Promote a registry to primary by resetting priorities — the named
+    /// URL becomes priority 0, every other enabled registry is bumped up
+    /// by 10. Order is stable (ties broken by original priority).
+    pub(in crate::api::rpc) async fn handle_registry_set_primary(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing url"))?;
+
+        let mut config = crate::container::registry::load_registries(&self.config.data_dir).await?;
+        if !config.registries.iter().any(|r| r.url == url) {
+            return Err(anyhow::anyhow!("Registry '{}' not found", url));
+        }
+
+        // Reassign priorities: target = 0, everyone else = 10, 20, 30…
+        // in their existing priority order.
+        let target_url = url.to_string();
+        config.registries.sort_by_key(|r| (r.url != target_url, r.priority));
+        for (i, r) in config.registries.iter_mut().enumerate() {
+            r.priority = if r.url == target_url { 0 } else { (i as u32) * 10 };
+        }
+
+        crate::container::registry::save_registries(&self.config.data_dir, &config).await?;
+        Ok(serde_json::json!({ "registries": config.registries, "primary": url }))
+    }
+
     pub(in crate::api::rpc) async fn handle_registry_test(
         &self,
         params: Option<serde_json::Value>,
@@ -1481,10 +1589,16 @@ server {
             .and_then(|v| v.as_bool())
             .unwrap_or(true);
 
+        // Registries are configured as `host[:port]/namespace` (for
+        // example `23.182.128.160:3000/lfg2025`), but the Docker V2
+        // registry API lives at `/v2/` on the ROOT of the host — NOT
+        // under the namespace. Strip the namespace before appending
+        // `/v2/` so the reachability probe hits the correct URL.
+        let host = url.split('/').next().unwrap_or(url);
         let test_url = if tls_verify {
-            format!("https://{}/v2/", url)
+            format!("https://{}/v2/", host)
         } else {
-            format!("http://{}/v2/", url)
+            format!("http://{}/v2/", host)
         };
 
         let client = reqwest::Client::builder()
@@ -1496,8 +1610,11 @@ server {
         match client.get(&test_url).send().await {
             Ok(resp) => {
                 let status = resp.status().as_u16();
-                // 200 = open registry, 401 = auth required (both mean it exists)
-                let reachable = status == 200 || status == 401;
+                // Accept any "the server responded to HTTP" code as
+                // reachable — 200 (open registry), 401 (auth required),
+                // or 405 (server rejects GET but the endpoint exists)
+                // all mean the registry daemon is alive on the host.
+                let reachable = status == 200 || status == 401 || status == 405;
                 Ok(serde_json::json!({
                     "url": url,
                     "reachable": reachable,

core/archipelago/src/api/rpc/package/progress.rs

@@ -28,6 +28,18 @@ impl RpcHandler {
         self.state_manager.update_data(data).await;
     }
 
+    /// Set the uninstall stage label so the UI can show what's happening
+    /// instead of a generic spinner. Each call broadcasts a state change
+    /// — call sparingly (one per pipeline phase, not per container).
+    pub(super) async fn set_uninstall_stage(&self, package_id: &str, stage: &str) {
+        let (mut data, _rev) = self.state_manager.get_snapshot().await;
+        if let Some(entry) = data.package_data.get_mut(package_id) {
+            entry.uninstall_stage = Some(stage.to_string());
+            entry.state = crate::data_model::PackageState::Removing;
+        }
+        self.state_manager.update_data(data).await;
+    }
+
     /// Update install progress (static method for use in async closures).
     pub(super) async fn update_install_progress(
         state_manager: &crate::state::StateManager,
@@ -81,6 +93,7 @@ fn create_installing_entry(package_id: &str) -> PackageDataEntry {
         },
         installed: None,
         install_progress: None,
+        uninstall_stage: None,
         available_update: None,
     }
 }

core/archipelago/src/api/rpc/package/runtime.rs

@@ -261,12 +261,28 @@ impl RpcHandler {
         if containers_to_remove.is_empty() {
             tracing::warn!("Uninstall {}: no containers found", package_id);
         }
+        let total = containers_to_remove.len();
 
         let mut stopped = 0u32;
         let mut removed = 0u32;
         let mut errors = Vec::new();
 
-        for name in &containers_to_remove {
+        self.set_uninstall_stage(
+            package_id,
+            &if total > 0 {
+                format!("Stopping containers (0/{})", total)
+            } else {
+                "Cleaning up".to_string()
+            },
+        )
+        .await;
+
+        for (i, name) in containers_to_remove.iter().enumerate() {
+            self.set_uninstall_stage(
+                package_id,
+                &format!("Stopping containers ({}/{})", i + 1, total),
+            )
+            .await;
             tracing::info!("Uninstall {}: stopping container {}", package_id, name);
             let stop_out = tokio::process::Command::new("podman")
                 .args(["stop", "-t", stop_timeout_secs(name), name])
@@ -326,6 +342,7 @@ impl RpcHandler {
             }
         }
 
+        self.set_uninstall_stage(package_id, "Cleaning up volumes").await;
         // Clean up dangling volumes associated with removed containers
         let _ = tokio::process::Command::new("podman")
             .args(["volume", "prune", "-f"])
@@ -354,6 +371,7 @@ impl RpcHandler {
 
         // Clean data directories unless preserve_data
         if !preserve_data {
+            self.set_uninstall_stage(package_id, "Removing app data").await;
             let data_dirs = get_data_dirs_for_app(package_id);
             for dir in &data_dirs {
                 tracing::info!("Uninstall {}: removing data {}", package_id, dir);

core/archipelago/src/api/rpc/package/stacks.rs

@@ -937,6 +937,31 @@ impl RpcHandler {
                 .with_context(|| format!("Failed to pull IndeedHub image: {}", img))?;
         }
 
+        // Remove any leftover containers from a previous partial install (or
+        // from the first-boot frontend stub that used to race the installer).
+        // Without this, `podman run --name indeedhub` fails on name conflict
+        // and the whole stack install errors out — leaving a half-broken node.
+        for name in [
+            "indeedhub",
+            "indeedhub-postgres",
+            "indeedhub-redis",
+            "indeedhub-minio",
+            "indeedhub-relay",
+            "indeedhub-api",
+            "indeedhub-ffmpeg",
+            "indeedhub-build_api_1",
+            "indeedhub-build_ffmpeg-worker_1",
+        ] {
+            let _ = tokio::process::Command::new("podman")
+                .args(["rm", "-f", name])
+                .status()
+                .await;
+        }
+        let _ = tokio::process::Command::new("podman")
+            .args(["network", "rm", "-f", "indeedhub-net"])
+            .status()
+            .await;
+
         // Create indeedhub-net
         let _ = tokio::process::Command::new("podman")
             .args(["network", "create", "indeedhub-net"])

core/archipelago/src/api/rpc/update.rs

@@ -40,6 +40,7 @@ impl RpcHandler {
             "last_check": state.last_check,
             "update_available": update_info.is_some(),
             "update": update_info,
+            "manifest_mirror": state.manifest_mirror,
         }))
     }
 
@@ -195,6 +196,7 @@ impl RpcHandler {
             "update_available": state.available_update.is_some(),
             "update_in_progress": state.update_in_progress,
             "rollback_available": state.rollback_available,
+            "manifest_mirror": state.manifest_mirror,
             "download_progress": if active || completed {
                 Some(serde_json::json!({
                     "bytes_downloaded": downloaded,
@@ -241,6 +243,89 @@ impl RpcHandler {
         Ok(serde_json::json!({ "rolled_back": true, "restart_required": true }))
     }
 
+    /// List configured update mirrors in priority order.
+    pub(super) async fn handle_update_list_mirrors(&self) -> Result<serde_json::Value> {
+        let list = update::load_mirrors(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Add a mirror to the end of the list. Params: `{ url, label? }`.
+    /// Duplicates (same URL) are replaced rather than added twice.
+    pub(super) async fn handle_update_add_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?
+            .trim()
+            .to_string();
+        if !url.starts_with("http://") && !url.starts_with("https://") {
+            anyhow::bail!("url must start with http:// or https://");
+        }
+        let label = params
+            .get("label")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .trim()
+            .to_string();
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        list.retain(|m| m.url != url);
+        list.push(update::UpdateMirror { url, label });
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Remove a mirror by URL. Params: `{ url }`.
+    pub(super) async fn handle_update_remove_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        list.retain(|m| m.url != url);
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
+    /// Ping a mirror's manifest URL. Returns reachability, wall-clock
+    /// latency, and HTTP status. Params: `{ url }`.
+    pub(super) async fn handle_update_test_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let result = update::test_mirror(url).await;
+        Ok(serde_json::to_value(result)?)
+    }
+
+    /// Move a mirror to the top of the list so it's tried first.
+    /// Params: `{ url }`.
+    pub(super) async fn handle_update_set_primary_mirror(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let url = params
+            .get("url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing url"))?;
+        let mut list = update::load_mirrors(&self.config.data_dir).await?;
+        let Some(idx) = list.iter().position(|m| m.url == url) else {
+            anyhow::bail!("mirror not in list");
+        };
+        let entry = list.remove(idx);
+        list.insert(0, entry);
+        update::save_mirrors(&self.config.data_dir, &list).await?;
+        Ok(serde_json::json!({ "mirrors": list }))
+    }
+
     /// Get the current update schedule.
     pub(super) async fn handle_update_get_schedule(&self) -> Result<serde_json::Value> {
         let schedule = update::get_schedule(&self.config.data_dir).await?;

core/archipelago/src/container/docker_packages.rs

@@ -247,6 +247,7 @@ impl DockerPackageScanner {
                     status: service_status,
                 }),
                 install_progress: None,
+                uninstall_stage: None,
             };
 
             packages.insert(app_id.clone(), package);

core/archipelago/src/container/registry.rs

@@ -44,19 +44,26 @@ impl Default for RegistryConfig {
         Self {
             registries: vec![
                 Registry {
-                    url: "git.tx1138.com/lfg2025".to_string(),
-                    name: "Archipelago Primary".to_string(),
-                    tls_verify: true,
+                    url: "23.182.128.160:3000/lfg2025".to_string(),
+                    name: "Server 1 (VPS)".to_string(),
+                    tls_verify: false,
                     enabled: true,
                     priority: 0,
                 },
                 Registry {
-                    url: "23.182.128.160:3000/lfg2025".to_string(),
-                    name: "Archipelago Fallback".to_string(),
-                    tls_verify: false,
+                    url: "git.tx1138.com/lfg2025".to_string(),
+                    name: "Server 2 (tx1138)".to_string(),
+                    tls_verify: true,
                     enabled: true,
                     priority: 10,
                 },
+                Registry {
+                    url: "146.59.87.168:3000/lfg2025".to_string(),
+                    name: "Server 3 (OVH)".to_string(),
+                    tls_verify: false,
+                    enabled: true,
+                    priority: 20,
+                },
             ],
         }
     }
@@ -80,20 +87,6 @@ impl RegistryConfig {
         format!("{}/{}", registry.url, image_name)
     }
 
-    /// Generate fallback image URLs to try (excludes the original since it already failed).
-    pub fn image_candidates(&self, image: &str) -> Vec<(String, bool)> {
-        let mut candidates = Vec::new();
-
-        // Rewrite for each active registry (skip if identical to original)
-        for reg in self.active_registries() {
-            let rewritten = self.rewrite_image(image, reg);
-            if rewritten != image {
-                candidates.push((rewritten, reg.tls_verify));
-            }
-        }
-
-        candidates
-    }
 }
 
 /// Extract the image name from a full image reference.
@@ -104,7 +97,12 @@ fn extract_image_name(image: &str) -> &str {
     image.rsplit('/').next().unwrap_or(image)
 }
 
-/// Load registry config from disk.
+/// Load registry config from disk, merging in any default registries
+/// that the operator hasn't explicitly removed. This lets us roll out
+/// new default mirrors (e.g. a new Server 3) to existing nodes without
+/// them having to edit their saved config. Explicit removals stick —
+/// if the URL is absent from disk AND absent from current defaults, it
+/// stays gone.
 pub async fn load_registries(data_dir: &Path) -> Result<RegistryConfig> {
     let path = data_dir.join(REGISTRY_FILE);
     if !path.exists() {
@@ -113,8 +111,34 @@ pub async fn load_registries(data_dir: &Path) -> Result<RegistryConfig> {
     let content = fs::read_to_string(&path)
         .await
         .context("Failed to read registry config")?;
-    let config: RegistryConfig =
+    let mut config: RegistryConfig =
         serde_json::from_str(&content).unwrap_or_else(|_| RegistryConfig::default());
+
+    // Migrate: any default registry URL that isn't already in the
+    // saved list gets appended at the end (so existing priority order
+    // is preserved for anything the operator already configured).
+    let defaults = RegistryConfig::default();
+    let known: std::collections::HashSet<String> =
+        config.registries.iter().map(|r| r.url.clone()).collect();
+    let max_priority = config
+        .registries
+        .iter()
+        .map(|r| r.priority)
+        .max()
+        .unwrap_or(0);
+    let mut added = false;
+    for (i, def) in defaults.registries.iter().enumerate() {
+        if !known.contains(&def.url) {
+            let mut cloned = def.clone();
+            cloned.priority = max_priority.saturating_add(10 + i as u32);
+            config.registries.push(cloned);
+            added = true;
+        }
+    }
+    if added {
+        // Persist so the next load doesn't have to re-merge.
+        let _ = save_registries(data_dir, &config).await;
+    }
     Ok(config)
 }
 
@@ -133,69 +157,6 @@ pub async fn save_registries(data_dir: &Path, config: &RegistryConfig) -> Result
     Ok(())
 }
 
-/// Try pulling an image from configured registries in priority order.
-/// Returns the image reference that succeeded.
-pub async fn pull_from_registries(data_dir: &Path, image: &str, tmpdir: &str) -> Result<String> {
-    let config = load_registries(data_dir).await?;
-    let candidates = config.image_candidates(image);
-
-    for (candidate, tls_verify) in &candidates {
-        debug!("Trying registry: {}", candidate);
-
-        let mut args = vec!["pull".to_string(), candidate.clone()];
-        if !tls_verify {
-            args.push("--tls-verify=false".to_string());
-        }
-
-        let mut child = tokio::process::Command::new("podman")
-            .args(&args)
-            .env("TMPDIR", tmpdir)
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .spawn()
-            .ok();
-
-        let status = if let Some(ref mut c) = child {
-            match tokio::time::timeout(std::time::Duration::from_secs(120), c.wait()).await {
-                Ok(Ok(s)) => Some(s.success()),
-                _ => {
-                    let _ = c.kill().await;
-                    let _ = c.wait().await;
-                    debug!("Fallback pull timed out: {}", candidate);
-                    None
-                }
-            }
-        } else {
-            None
-        };
-
-        if status == Some(true) {
-            // If we pulled from a non-original registry, tag it with the original name
-            if candidate != image {
-                let _ = tokio::process::Command::new("podman")
-                    .args(["tag", candidate, image])
-                    .status()
-                    .await;
-                info!(
-                    "Pulled {} from fallback registry, tagged as {}",
-                    candidate, image
-                );
-            } else {
-                info!("Pulled {} from primary registry", image);
-            }
-            return Ok(candidate.clone());
-        }
-
-        debug!("Failed to pull from {}", candidate);
-    }
-
-    Err(anyhow::anyhow!(
-        "Failed to pull {} from all {} configured registries",
-        image,
-        candidates.len()
-    ))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -217,34 +178,29 @@ mod tests {
     #[test]
     fn test_rewrite_image() {
         let config = RegistryConfig::default();
-        let fallback = &config.registries[1];
+        // Default primary is now VPS (index 0). A tx1138-hardcoded image
+        // rewrites to VPS when asked for the primary mirror.
+        let primary = &config.registries[0];
         assert_eq!(
-            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", fallback),
+            config.rewrite_image("git.tx1138.com/lfg2025/bitcoin-knots:latest", primary),
             "23.182.128.160:3000/lfg2025/bitcoin-knots:latest"
         );
     }
 
-    #[test]
-    fn test_image_candidates() {
-        let config = RegistryConfig::default();
-        let candidates = config.image_candidates("git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
-        assert!(candidates.len() >= 2);
-        assert_eq!(candidates[0].0, "git.tx1138.com/lfg2025/lnd:v0.18.4-beta");
-    }
-
     #[test]
     fn test_active_registries_sorted() {
         let config = RegistryConfig::default();
         let active = config.active_registries();
-        assert_eq!(active.len(), 2);
+        assert_eq!(active.len(), 3);
         assert!(active[0].priority <= active[1].priority);
+        assert!(active[1].priority <= active[2].priority);
     }
 
     #[tokio::test]
     async fn test_load_default() {
         let tmp = TempDir::new().unwrap();
         let config = load_registries(tmp.path()).await.unwrap();
-        assert_eq!(config.registries.len(), 2);
+        assert_eq!(config.registries.len(), 3);
     }
 
     #[tokio::test]
@@ -260,6 +216,6 @@ mod tests {
         });
         save_registries(tmp.path(), &config).await.unwrap();
         let loaded = load_registries(tmp.path()).await.unwrap();
-        assert_eq!(loaded.registries.len(), 3);
+        assert_eq!(loaded.registries.len(), 4);
     }
 }

core/archipelago/src/data_model.rs

@@ -138,6 +138,13 @@ pub struct PackageDataEntry {
     pub installed: Option<InstalledPackageDataEntry>,
     #[serde(rename = "install-progress")]
     pub install_progress: Option<InstallProgress>,
+    /// Live label describing the current uninstall step ("Stopping
+    /// containers (2/5)", "Removing data", …). Set by the uninstall
+    /// pipeline so the UI can show real progress instead of a generic
+    /// "Uninstalling…" spinner. Cleared after the package entry is
+    /// removed.
+    #[serde(rename = "uninstall-stage", skip_serializing_if = "Option::is_none", default)]
+    pub uninstall_stage: Option<String>,
     /// Pinned image version from image-versions.sh when it differs from running version
     #[serde(rename = "available-update", skip_serializing_if = "Option::is_none")]
     pub available_update: Option<String>,

core/archipelago/src/fips/config.rs

@@ -13,22 +13,27 @@ use anyhow::{Context, Result};
 use std::path::Path;
 use tokio::process::Command;
 
-use super::{DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_UDP_PORT};
+use super::{DAEMON_CONFIG_PATH, DAEMON_KEY_PATH, DAEMON_PUB_PATH, DEFAULT_TCP_PORT, DEFAULT_UDP_PORT};
 
 /// Write the FIPS daemon config based on the local npub and default
 /// transports. Overwrites any existing file — callers are expected to
 /// re-run this whenever the key or daemon version changes.
 ///
 /// Schema is intentionally minimal: node identity comes from the key
-/// file on disk (the daemon handles it), transports enable UDP + Tor,
-/// IPv6 TUN + DNS on defaults. Static peer list is empty — archipelago
-/// feeds peers dynamically via federation updates.
+/// file on disk (the daemon handles it), transports enable UDP + TCP
+/// (matching upstream factory default), IPv6 TUN + DNS on defaults.
+/// Static peer list is empty — archipelago feeds peers dynamically via
+/// the seed-anchors apply loop and federation-invite hooks.
 pub fn render_config_yaml() -> String {
     // Schema matches upstream jmcorgan/fips as of 2026-04. With
     // `node.identity.persistent: true` the daemon reuses the key file at
     // config-dir/fips.key (= DAEMON_KEY_PATH). Transports take `bind_addr`
-    // rather than `enabled: true / port: N`, and the upstream no longer
-    // has a `tor:` transport — archipelago's own Tor fallback handles that.
+    // rather than `enabled: true / port: N`. Both UDP and TCP are
+    // enabled by default because the public anchor (fips.v0l.io)
+    // currently answers on TCP/8443 only, and networks that block UDP
+    // outbound can still bootstrap via TCP. Upstream fips no longer
+    // has a `tor:` transport variant — archipelago's own Tor fallback
+    // handles that layer.
     format!(
         "# Generated by archipelago — do not edit by hand.\n\
          # Regenerated on every key change and daemon upgrade.\n\
@@ -44,9 +49,12 @@ pub fn render_config_yaml() -> String {
          bind_addr: \"127.0.0.1\"\n\
          transports:\n  \
          udp:\n    \
-         bind_addr: \"0.0.0.0:{port}\"\n\
+         bind_addr: \"0.0.0.0:{udp}\"\n  \
+         tcp:\n    \
+         bind_addr: \"0.0.0.0:{tcp}\"\n\
          peers: []\n",
-        port = DEFAULT_UDP_PORT,
+        udp = DEFAULT_UDP_PORT,
+        tcp = DEFAULT_TCP_PORT,
     )
 }
 
@@ -185,7 +193,9 @@ mod tests {
         let yaml = render_config_yaml();
         assert!(yaml.contains("persistent: true"));
         assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_UDP_PORT)));
+        assert!(yaml.contains(&format!("0.0.0.0:{}", DEFAULT_TCP_PORT)));
         assert!(yaml.contains("udp:"));
+        assert!(yaml.contains("tcp:"));
         assert!(yaml.contains("tun:"));
         assert!(yaml.contains("name: fips0"));
         // Upstream fips dropped the `tor:` transport variant; archipelago

core/archipelago/src/fips/mod.rs

@@ -53,6 +53,14 @@ pub const UPSTREAM_REPO: &str = "jmcorgan/fips";
 /// Default UDP port the daemon listens on.
 pub const DEFAULT_UDP_PORT: u16 = 8668;
 
+/// Default TCP port the daemon listens on. Used as a fallback when a
+/// peer can't be reached over UDP — common on networks that block UDP
+/// (corporate/guest wifi) and the path the public fips.v0l.io anchor
+/// currently accepts. Upstream factory default enables both transports
+/// and archipelago intentionally matches that baseline so fresh nodes
+/// can reach the broader FIPS mesh without operator config.
+pub const DEFAULT_TCP_PORT: u16 = 8443;
+
 /// Upstream systemd unit shipped by the `fips` debian package. Archipelago
 /// prefers its own supervision (`archipelago-fips.service`) but respects an
 /// already-running upstream unit so legacy/dev nodes — where no seed-derived
@@ -99,7 +107,13 @@ pub struct FipsStatus {
 
 impl FipsStatus {
     /// Snapshot the current state across package, key, and service.
-    pub async fn query(identity_dir: &Path) -> Self {
+    ///
+    /// `data_dir` is the archipelago data-dir (used to load the
+    /// operator-configured seed-anchor list so "anchor_connected" means
+    /// "at least one authenticated peer matches a public or configured
+    /// seed anchor", not just "fips.v0l.io specifically").
+    pub async fn query(data_dir: &Path) -> Self {
+        let identity_dir = identity_dir_from(data_dir);
         let installed = service::package_installed().await;
         let version = if installed {
             service::daemon_version().await.ok()
@@ -110,17 +124,24 @@ impl FipsStatus {
         let upstream_service_state = service::unit_state(UPSTREAM_SERVICE_UNIT).await;
         let service_active =
             service_state == "active" || upstream_service_state == "active";
-        let key_present = crate::identity::fips_key_exists(identity_dir);
+        let key_present = crate::identity::fips_key_exists(&identity_dir);
 
         // Prefer the seed-derived npub; otherwise read the daemon's own
         // key file at /etc/fips/fips.pub (world-readable per debian pkg).
-        let npub = match crate::identity::fips_npub(identity_dir).await {
+        let npub = match crate::identity::fips_npub(&identity_dir).await {
             Ok(Some(n)) => Some(n),
             _ => service::read_upstream_npub().await.ok().flatten(),
         };
 
         let (authenticated_peer_count, anchor_connected) = if service_active {
-            service::peer_connectivity_summary().await
+            // Build the anchor-candidate list: hardcoded public anchor
+            // plus every entry in the operator's seed-anchors.json.
+            // The card lights up if any of them is authenticated.
+            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
+            if let Ok(seed) = anchors::load(data_dir).await {
+                anchor_npubs.extend(seed.into_iter().map(|a| a.npub));
+            }
+            service::peer_connectivity_summary(&anchor_npubs).await
         } else {
             (0, false)
         };
@@ -153,10 +174,11 @@ mod tests {
     #[tokio::test]
     async fn test_status_reports_no_key_pre_onboarding() {
         let dir = tempfile::tempdir().unwrap();
-        let id_dir = dir.path().join("identity");
-        tokio::fs::create_dir_all(&id_dir).await.unwrap();
-
-        let status = FipsStatus::query(&id_dir).await;
+        // query() now takes a data_dir (parent) rather than identity_dir,
+        // since it also reads seed-anchors.json for the anchor check.
+        // No identity/ subdir → no key; no seed-anchors.json → public
+        // anchor is the only candidate.
+        let status = FipsStatus::query(dir.path()).await;
         assert!(!status.key_present, "no key before onboarding");
         assert!(status.npub.is_none());
         // `installed`, `service_state`, `version` depend on the host and are

core/archipelago/src/fips/service.rs

@@ -97,6 +97,27 @@ pub async fn restart(unit: &str) -> Result<()> {
     sudo_systemctl("restart", unit).await
 }
 
+/// Resolve which systemd unit is actually supervising the fips daemon
+/// on this host. Nodes installed from the archipelago ISO run
+/// `archipelago-fips.service`; nodes that were apt-installed (or had
+/// fips running before archipelago took over) may only have the
+/// upstream `fips.service`. Restart/Reconnect must operate on whichever
+/// one is running, otherwise the UI button is a silent no-op.
+///
+/// Returns the archipelago-managed unit name if it's active,
+/// else the upstream unit name if that's active,
+/// else the archipelago-managed name as a default (so activate() can
+/// bring it up).
+pub async fn active_unit() -> &'static str {
+    if unit_state(super::SERVICE_UNIT).await == "active" {
+        return super::SERVICE_UNIT;
+    }
+    if unit_state(super::UPSTREAM_SERVICE_UNIT).await == "active" {
+        return super::UPSTREAM_SERVICE_UNIT;
+    }
+    super::SERVICE_UNIT
+}
+
 pub async fn mask(unit: &str) -> Result<()> {
     let _ = sudo_systemctl("stop", unit).await;
     let _ = sudo_systemctl("disable", unit).await;
@@ -108,12 +129,19 @@ pub async fn mask(unit: &str) -> Result<()> {
 pub const PUBLIC_ANCHOR_NPUB: &str =
     "npub1zv58cn7v83mxvttl70w5fwjwuclfmntv9cnmv5wmz2nzz88u5urqvdx96n";
 
-/// Summarise peer connectivity from `fipsctl show peers` + `identity-cache`.
-/// Returns `(authenticated_peer_count, anchor_connected)`. Shells out rather
-/// than embedding a fips client because fipsctl is the daemon's own ground
-/// truth — the daemon can always rewrite its internal routing and we'd
-/// rather be consistent with `fipsctl` than snapshot it ourselves.
-pub async fn peer_connectivity_summary() -> (u32, bool) {
+/// Summarise peer connectivity from `fipsctl show peers`. Returns
+/// `(authenticated_peer_count, anchor_connected)`.
+///
+/// `anchor_candidates` is the operator-controlled list of npubs this
+/// node considers a valid mesh anchor — always includes the hard-coded
+/// public anchor, plus any entries from `seed-anchors.json`. A node is
+/// "anchor connected" when at least one currently-authenticated peer
+/// matches one of these npubs. We used to check the identity cache
+/// (which includes transient hearsay from other peers), but a cache
+/// hit on `fips.v0l.io` didn't mean we could actually route through
+/// it, and the card lied to users whose mesh was federated through
+/// their own seed anchors instead.
+pub async fn peer_connectivity_summary(anchor_candidates: &[String]) -> (u32, bool) {
     let peers_json = match Command::new("sudo")
         .args(["-n", "fipsctl", "show", "peers"])
         .output()
@@ -122,39 +150,26 @@ pub async fn peer_connectivity_summary() -> (u32, bool) {
         Ok(o) if o.status.success() => o.stdout,
         _ => return (0, false),
     };
-    let authenticated_peer_count =
-        match serde_json::from_slice::<serde_json::Value>(&peers_json) {
-            Ok(v) => v
-                .get("peers")
-                .and_then(|p| p.as_array())
-                .map(|a| a.len() as u32)
-                .unwrap_or(0),
-            Err(_) => 0,
+    let parsed: serde_json::Value =
+        match serde_json::from_slice(&peers_json) {
+            Ok(v) => v,
+            Err(_) => return (0, false),
         };
-
-    // Anchor check: look in identity-cache (known node pubkeys the daemon
-    // has heard about) rather than authenticated peers — the anchor may be
-    // in the cache but not currently at session depth.
-    let cache_json = match Command::new("sudo")
-        .args(["-n", "fipsctl", "show", "identity-cache"])
-        .output()
-        .await
-    {
-        Ok(o) if o.status.success() => o.stdout,
-        _ => return (authenticated_peer_count, false),
-    };
-    let anchor_connected = match serde_json::from_slice::<serde_json::Value>(&cache_json) {
-        Ok(v) => v
-            .get("entries")
-            .and_then(|e| e.as_array())
-            .map(|entries| {
-                entries
-                    .iter()
-                    .any(|e| e.get("npub").and_then(|n| n.as_str()) == Some(PUBLIC_ANCHOR_NPUB))
-            })
-            .unwrap_or(false),
-        Err(_) => false,
-    };
+    let peers = parsed
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let authenticated_peer_count = peers.len() as u32;
+    let anchor_connected = peers.iter().any(|p| {
+        let npub = p.get("npub").and_then(|n| n.as_str()).unwrap_or_default();
+        let connected = p
+            .get("connectivity")
+            .and_then(|c| c.as_str())
+            .map(|s| s == "connected")
+            .unwrap_or(true);
+        connected && anchor_candidates.iter().any(|a| a == npub)
+    });
     (authenticated_peer_count, anchor_connected)
 }
 

core/archipelago/src/main.rs

@@ -229,5 +229,14 @@ async fn main() -> Result<()> {
     crash_recovery::remove_pid_marker(&config.data_dir).await;
 
     info!("Archipelago shut down cleanly");
-    Ok(())
+
+    // Hard-exit after logging. All business state is persisted by now
+    // (connections drained, PID marker removed, disk flushes done via
+    // tokio::fs awaits). Letting tokio try to drop the runtime instead
+    // can stall for 15s+ on non-daemon OS threads we don't directly
+    // own (mdns_sd daemon, reqwest resolver pool, etc.) — long enough
+    // for systemd's TimeoutStopSec to SIGKILL us and mark the service
+    // Failed, which makes an otherwise-successful update look like a
+    // crash in `systemctl status`.
+    std::process::exit(0);
 }

core/archipelago/src/server.rs

@@ -510,10 +510,37 @@ impl Server {
                     tracing::warn!("FIPS key load/migrate failed: {}", e);
                     return;
                 }
+                // Check if the installed fips.yaml matches what we'd
+                // render now. If not, we need to restart the daemon after
+                // reinstalling so it picks up schema changes (e.g. the
+                // v1.7.25 re-addition of the TCP transport). Without this,
+                // OTA'd nodes would be stuck on the old UDP-only config
+                // until someone manually clicked Reconnect.
+                let expected = crate::fips::config::render_config_yaml();
+                let installed = tokio::fs::read_to_string("/etc/fips/fips.yaml")
+                    .await
+                    .ok();
+                let config_changed = installed.as_deref() != Some(expected.as_str());
+
                 if let Err(e) = crate::fips::config::install(&identity_dir).await {
                     tracing::warn!("FIPS config install failed on startup: {}", e);
                     return;
                 }
+                if config_changed {
+                    tracing::info!(
+                        "FIPS config schema changed on disk — restarting daemon to pick up new transports"
+                    );
+                    // Restart whichever unit is actually supervising
+                    // the daemon (archipelago-fips vs upstream fips).
+                    let unit = crate::fips::service::active_unit().await;
+                    if let Err(e) = crate::fips::service::restart(unit).await {
+                        tracing::warn!(
+                            "FIPS restart after config migration failed on {}: {} — user can retry via fips.reconnect",
+                            unit,
+                            e
+                        );
+                    }
+                }
                 if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await {
                     tracing::warn!(
                         "archipelago-fips activate failed on startup: {} — user can retry via fips.install RPC",

core/archipelago/src/transport/lan.rs

@@ -160,6 +160,18 @@ impl LanTransport {
     }
 }
 
+impl Drop for LanTransport {
+    // The mdns_sd daemon runs on its own OS thread and the browse
+    // listener task blocks on a sync channel. Without this call both
+    // keep the process alive past SIGTERM, long enough for systemd to
+    // SIGKILL us — which makes a normal update look like a crash.
+    fn drop(&mut self) {
+        if let Some(daemon) = self.daemon.take() {
+            let _ = daemon.shutdown();
+        }
+    }
+}
+
 impl NodeTransport for LanTransport {
     fn kind(&self) -> TransportKind {
         TransportKind::Lan

core/archipelago/src/update.rs

@@ -63,8 +63,148 @@ fn is_newer(candidate: &str, current: &str) -> bool {
 
 const DEFAULT_UPDATE_MANIFEST_URL: &str =
     "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json";
+/// Secondary mirror: same manifest, served from the VPS. Added as a
+/// default mirror so nodes automatically fall through when the primary
+/// is slow or unreachable.
+const DEFAULT_SECONDARY_MIRROR_URL: &str =
+    "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
+/// Tertiary mirror on a separate OVH VPS — independent network path so
+/// a single-provider outage doesn't knock out all three mirrors.
+const DEFAULT_TERTIARY_MIRROR_URL: &str =
+    "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
+const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct UpdateMirror {
+    /// Full URL to `manifest.json`. Download URLs in the fetched
+    /// manifest are origin-rewritten to match this URL's scheme+host+
+    /// port, so hitting a mirror pulls its components from the same
+    /// mirror rather than whatever absolute host the publisher baked in.
+    pub url: String,
+    /// Human-readable label for the UI ("Server 1", "Home VPS", …).
+    #[serde(default)]
+    pub label: String,
+}
+
+fn mirrors_path(data_dir: &Path) -> std::path::PathBuf {
+    data_dir.join(UPDATE_MIRRORS_FILE)
+}
+
+fn default_mirrors() -> Vec<UpdateMirror> {
+    vec![
+        UpdateMirror {
+            url: DEFAULT_SECONDARY_MIRROR_URL.to_string(),
+            label: "Server 1 (VPS)".to_string(),
+        },
+        UpdateMirror {
+            url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
+            label: "Server 2 (tx1138)".to_string(),
+        },
+        UpdateMirror {
+            url: DEFAULT_TERTIARY_MIRROR_URL.to_string(),
+            label: "Server 3 (OVH)".to_string(),
+        },
+    ]
+}
+
+/// Load the operator-configured mirror list. Returns defaults if the
+/// file doesn't exist yet, so a node OTA'd from a pre-mirrors release
+/// starts with the current default mirrors available without any
+/// manual config.
+///
+/// Migration: any default mirror URL that isn't already in the saved
+/// list gets appended at the end. This lets us add new default mirrors
+/// (e.g. a new Server 3) and have them appear on existing nodes after
+/// an update, without requiring manual config edits. Explicit removals
+/// stick — once an operator removes a URL it stays gone unless it's
+/// later re-added to defaults.
+pub async fn load_mirrors(data_dir: &Path) -> Result<Vec<UpdateMirror>> {
+    let path = mirrors_path(data_dir);
+    if !path.exists() {
+        return Ok(default_mirrors());
+    }
+    let bytes = fs::read(&path)
+        .await
+        .with_context(|| format!("read {}", path.display()))?;
+    let mut list: Vec<UpdateMirror> =
+        serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
+    if list.is_empty() {
+        return Ok(default_mirrors());
+    }
+
+    // Merge in any default URLs the saved config is missing.
+    let known: std::collections::HashSet<String> =
+        list.iter().map(|m| m.url.clone()).collect();
+    let defaults = default_mirrors();
+    let mut added = false;
+    for def in &defaults {
+        if !known.contains(&def.url) {
+            list.push(def.clone());
+            added = true;
+        }
+    }
+    if added {
+        let _ = save_mirrors(data_dir, &list).await;
+    }
+    Ok(list)
+}
+
+pub async fn save_mirrors(data_dir: &Path, mirrors: &[UpdateMirror]) -> Result<()> {
+    fs::create_dir_all(data_dir)
+        .await
+        .with_context(|| format!("mkdir {}", data_dir.display()))?;
+    let path = mirrors_path(data_dir);
+    let tmp = path.with_extension("json.tmp");
+    let json = serde_json::to_vec_pretty(mirrors).context("serialize mirrors")?;
+    fs::write(&tmp, json)
+        .await
+        .with_context(|| format!("write {}", tmp.display()))?;
+    fs::rename(&tmp, &path)
+        .await
+        .with_context(|| format!("rename {} -> {}", tmp.display(), path.display()))?;
+    Ok(())
+}
+
+/// Parse a manifest URL and return its `scheme://host[:port]` prefix.
+/// Used by `rewrite_manifest_origins` so a manifest fetched from a
+/// mirror points component downloads back at the same mirror rather
+/// than whatever absolute URL the publisher baked in.
+fn manifest_origin(manifest_url: &str) -> Option<String> {
+    let rest = manifest_url.strip_prefix("https://")
+        .map(|r| ("https", r))
+        .or_else(|| manifest_url.strip_prefix("http://").map(|r| ("http", r)))?;
+    let (scheme, after_scheme) = rest;
+    let host_and_port = after_scheme.split('/').next()?;
+    if host_and_port.is_empty() {
+        return None;
+    }
+    Some(format!("{}://{}", scheme, host_and_port))
+}
+
+/// Rewrite every component `download_url` so its origin matches the
+/// manifest URL we just fetched. Preserves the path portion (which is
+/// consistent across mirrors — every gitea serves `/lfg2025/archy/raw/…`).
+/// Leaves URLs with a different path shape untouched (some operator
+/// might mirror with a custom layout; in that case we don't guess).
+fn rewrite_manifest_origins(manifest: &mut UpdateManifest, manifest_url: &str) {
+    let Some(new_origin) = manifest_origin(manifest_url) else {
+        return;
+    };
+    for c in manifest.components.iter_mut() {
+        if let Some(orig_origin) = manifest_origin(&c.download_url) {
+            if orig_origin != new_origin {
+                let path = c.download_url.trim_start_matches(&orig_origin).to_string();
+                c.download_url = format!("{}{}", new_origin, path);
+            }
+        }
+    }
+}
+
+/// Which manifest URL to try FIRST — operator override via env wins,
+/// otherwise the first entry in the mirrors list, otherwise the hard
+/// default. Callers that need the full mirror walk should use
+/// `load_mirrors` directly.
 fn update_manifest_url() -> String {
     std::env::var("ARCHIPELAGO_UPDATE_URL")
         .unwrap_or_else(|_| DEFAULT_UPDATE_MANIFEST_URL.to_string())
@@ -107,6 +247,11 @@ pub struct UpdateState {
     pub rollback_available: bool,
     #[serde(default)]
     pub schedule: UpdateSchedule,
+    /// URL of the mirror whose manifest populated `available_update`.
+    /// Surfaces in the UI so operators can tell at a glance which mirror
+    /// their node actually hit (vs. just which is configured primary).
+    #[serde(default)]
+    pub manifest_mirror: Option<String>,
 }
 
 impl Default for UpdateState {
@@ -118,6 +263,7 @@ impl Default for UpdateState {
             update_in_progress: false,
             rollback_available: false,
             schedule: UpdateSchedule::DailyCheck,
+            manifest_mirror: None,
         }
     }
 }
@@ -149,6 +295,7 @@ pub async fn load_state(data_dir: &Path) -> Result<UpdateState> {
         // it unconditionally; the next check_for_updates will repopulate
         // if there's genuinely something newer.
         state.available_update = None;
+        state.manifest_mirror = None;
         save_state(data_dir, &state).await?;
     }
     Ok(state)
@@ -160,71 +307,104 @@ pub async fn save_state(data_dir: &Path, state: &UpdateState) -> Result<()> {
     fs::write(&path, data).await.context("Writing update state")
 }
 
-/// Check for available updates by fetching the release manifest.
+/// Check for available updates by walking the mirror list. The first
+/// mirror that returns a parseable manifest with a strictly-newer
+/// version wins; if no mirror offers a newer version, the node is
+/// reported as up-to-date. Per-mirror we retry up to 3 times on
+/// transient failures.
+///
+/// Manifest `download_url`s are origin-rewritten to match the mirror
+/// we fetched from, so switching mirrors in the UI also switches where
+/// component downloads come from — even if the publisher baked an
+/// absolute URL pointing at a different server into the manifest.
 pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
     let mut state = load_state(data_dir).await?;
 
     info!("Checking for updates...");
-    // 45s total budget, and we retry up to 3 times so a momentary
-    // gitea hiccup doesn't make the node report "up to date" when an
-    // update actually exists. Short per-attempt timeout keeps the RPC
-    // responsive in the common case.
     let client = reqwest::Client::builder()
+        // Short per-attempt HTTP timeout so a wedged mirror doesn't
+        // delay the whole check — we'd rather move on to the next
+        // mirror quickly than sit waiting on a slow one. 15s covers
+        // slow but alive mirrors.
         .timeout(std::time::Duration::from_secs(15))
         .connect_timeout(std::time::Duration::from_secs(10))
         .build()
         .context("Failed to create HTTP client")?;
 
-    let manifest_url = update_manifest_url();
+    // Env override (ARCHIPELAGO_UPDATE_URL) short-circuits the mirror
+    // list — used on dev boxes that point at a local gitea. Otherwise
+    // walk the operator-configured list and fall through on failure.
+    let mirrors: Vec<String> = if std::env::var("ARCHIPELAGO_UPDATE_URL").is_ok() {
+        vec![update_manifest_url()]
+    } else {
+        load_mirrors(data_dir)
+            .await
+            .unwrap_or_else(|_| default_mirrors())
+            .into_iter()
+            .map(|m| m.url)
+            .collect()
+    };
+
     let mut last_err: Option<String> = None;
     let mut handled = false;
-    for attempt in 1..=3u8 {
-        if attempt > 1 {
-            tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-        }
-        match client.get(&manifest_url).send().await {
-            Ok(resp) if resp.status().is_success() => {
-                match resp.json::<UpdateManifest>().await {
-                    Ok(manifest) => {
+    'mirrors: for manifest_url in mirrors.iter() {
+        for attempt in 1..=3u8 {
+            if attempt > 1 {
+                tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+            }
+            match client.get(manifest_url).send().await {
+                Ok(resp) if resp.status().is_success() => match resp.json::<UpdateManifest>().await {
+                    Ok(mut manifest) => {
+                        rewrite_manifest_origins(&mut manifest, manifest_url);
                         if is_newer(&manifest.version, &state.current_version) {
                             info!(
                                 current = %state.current_version,
                                 available = %manifest.version,
+                                mirror = %manifest_url,
                                 "Update available"
                             );
                             state.available_update = Some(manifest);
+                            state.manifest_mirror = Some(manifest_url.clone());
                         } else {
                             // Manifest version matches us or is behind
-                            // us — either we're current, or the remote
-                            // manifest is stale. Either way don't offer
-                            // it as an "update" (that would be a
-                            // downgrade prompt).
+                            // us — either we're current, or this mirror
+                            // is stale. Try the next mirror; if all are
+                            // stale or at our version we'll fall through
+                            // to "up to date".
                             debug!(
                                 current = %state.current_version,
                                 manifest = %manifest.version,
+                                mirror = %manifest_url,
                                 "No newer version in manifest"
                             );
+                            if state.available_update.is_some() {
+                                // A later mirror might still have a
+                                // newer version — don't clobber what an
+                                // earlier mirror told us. But also don't
+                                // break: another mirror could be ahead.
+                                continue 'mirrors;
+                            }
+                            state.manifest_mirror = None;
                             state.available_update = None;
                         }
                         handled = true;
-                        break;
-                    }
-                    Err(e) => {
-                        last_err = Some(format!("parse: {}", e));
+                        break 'mirrors;
                     }
+                    Err(e) => last_err = Some(format!("{}: parse: {}", manifest_url, e)),
+                },
+                Ok(resp) => {
+                    last_err = Some(format!("{}: HTTP {}", manifest_url, resp.status()));
+                }
+                Err(e) => {
+                    last_err = Some(format!("{}: {}", manifest_url, e));
                 }
             }
-            Ok(resp) => {
-                last_err = Some(format!("HTTP {}", resp.status()));
-            }
-            Err(e) => {
-                last_err = Some(e.to_string());
-            }
         }
+        tracing::debug!(mirror = %manifest_url, "Mirror exhausted, trying next");
     }
     if !handled {
         if let Some(e) = last_err {
-            debug!("Update check failed after retries: {}", e);
+            debug!("Update check failed across all mirrors: {}", e);
         }
     }
 
@@ -233,6 +413,66 @@ pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
     Ok(state)
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MirrorTestResult {
+    pub reachable: bool,
+    pub latency_ms: u64,
+    pub http_status: Option<u16>,
+    pub error: Option<String>,
+}
+
+/// Ping a mirror's manifest URL and return reachability + wall-clock
+/// latency. Used by the "Test mirror" button so operators can sanity-
+/// check a newly added mirror without running a full update check.
+pub async fn test_mirror(url: &str) -> MirrorTestResult {
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(10))
+        .connect_timeout(std::time::Duration::from_secs(5))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            return MirrorTestResult {
+                reachable: false,
+                latency_ms: 0,
+                http_status: None,
+                error: Some(format!("client build failed: {}", e)),
+            }
+        }
+    };
+    let start = std::time::Instant::now();
+    match client.get(url).send().await {
+        Ok(resp) => {
+            let latency_ms = start.elapsed().as_millis() as u64;
+            let status = resp.status();
+            if status.is_success() {
+                MirrorTestResult {
+                    reachable: true,
+                    latency_ms,
+                    http_status: Some(status.as_u16()),
+                    error: None,
+                }
+            } else {
+                MirrorTestResult {
+                    reachable: false,
+                    latency_ms,
+                    http_status: Some(status.as_u16()),
+                    error: Some(format!("HTTP {}", status.as_u16())),
+                }
+            }
+        }
+        Err(e) => {
+            let latency_ms = start.elapsed().as_millis() as u64;
+            MirrorTestResult {
+                reachable: false,
+                latency_ms,
+                http_status: None,
+                error: Some(e.to_string()),
+            }
+        }
+    }
+}
+
 /// Get current update status without checking remote.
 pub async fn get_status(data_dir: &Path) -> Result<UpdateState> {
     load_state(data_dir).await
@@ -914,6 +1154,86 @@ mod tests {
         assert_eq!(schedule, UpdateSchedule::DailyCheck);
     }
 
+    #[test]
+    fn test_manifest_origin_parses_https() {
+        assert_eq!(
+            manifest_origin("https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"),
+            Some("https://git.tx1138.com".to_string())
+        );
+    }
+
+    #[test]
+    fn test_manifest_origin_parses_http_with_port() {
+        assert_eq!(
+            manifest_origin("http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"),
+            Some("http://23.182.128.160:3000".to_string())
+        );
+    }
+
+    #[test]
+    fn test_manifest_origin_rejects_garbage() {
+        assert_eq!(manifest_origin("not a url"), None);
+        assert_eq!(manifest_origin("ftp://git.tx1138.com/x"), None);
+    }
+
+    #[test]
+    fn test_rewrite_manifest_origins_swaps_all_components() {
+        let mut manifest = UpdateManifest {
+            version: "1.7.26-alpha".into(),
+            release_date: "2026-04-21".into(),
+            changelog: vec![],
+            components: vec![
+                ComponentUpdate {
+                    name: "archipelago".into(),
+                    current_version: "1.7.25-alpha".into(),
+                    new_version: "1.7.26-alpha".into(),
+                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago".into(),
+                    sha256: "x".into(),
+                    size_bytes: 1,
+                },
+                ComponentUpdate {
+                    name: "frontend".into(),
+                    current_version: "1.7.25-alpha".into(),
+                    new_version: "1.7.26-alpha".into(),
+                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz".into(),
+                    sha256: "y".into(),
+                    size_bytes: 2,
+                },
+            ],
+        };
+        rewrite_manifest_origins(&mut manifest, "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/manifest.json");
+        assert_eq!(
+            manifest.components[0].download_url,
+            "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago"
+        );
+        assert_eq!(
+            manifest.components[1].download_url,
+            "http://23.182.128.160:3000/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_load_mirrors_returns_defaults_when_absent() {
+        let dir = tempfile::tempdir().unwrap();
+        let list = load_mirrors(dir.path()).await.unwrap();
+        assert_eq!(list.len(), 3);
+        assert!(list[0].url.contains("23.182.128.160"));
+        assert!(list[1].url.contains("git.tx1138.com"));
+        assert!(list[2].url.contains("146.59.87.168"));
+    }
+
+    #[tokio::test]
+    async fn test_save_and_load_mirrors_roundtrip() {
+        let dir = tempfile::tempdir().unwrap();
+        let list = vec![UpdateMirror {
+            url: "https://example.com/m.json".into(),
+            label: "Example".into(),
+        }];
+        save_mirrors(dir.path(), &list).await.unwrap();
+        let back = load_mirrors(dir.path()).await.unwrap();
+        assert_eq!(back, list);
+    }
+
     #[test]
     fn test_update_state_default_values() {
         let state = UpdateState::default();
@@ -934,6 +1254,7 @@ mod tests {
             update_in_progress: false,
             rollback_available: true,
             schedule: UpdateSchedule::AutoApply,
+            manifest_mirror: None,
         };
         let json = serde_json::to_string(&state).unwrap();
         let deserialized: UpdateState = serde_json::from_str(&json).unwrap();
@@ -1044,6 +1365,10 @@ mod tests {
             update_in_progress: true,
             rollback_available: false,
             schedule: UpdateSchedule::Manual,
+            manifest_mirror: Some(
+                "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
+                    .to_string(),
+            ),
         };
         save_state(dir.path(), &state).await.unwrap();
         let loaded = load_state(dir.path()).await.unwrap();

neode-ui/src/components/Screensaver.vue

@@ -13,15 +13,7 @@
         </div>
         <!-- Normal logo with audio viz ring -->
         <div v-else class="screensaver-content">
-          <!-- Radial audio visualization - bars around the logo -->
-          <div class="screensaver-viz-ring">
-            <div
-              v-for="(_, i) in segmentCount"
-              :key="i"
-              class="screensaver-viz-segment"
-              :style="getSegmentStyle(i)"
-            />
-          </div>
+          <ScreensaverRing />
           <!-- Logo in center -->
           <div class="screensaver-logo-wrapper">
             <ScreensaverLogo />
@@ -35,21 +27,12 @@
 <script setup lang="ts">
 import { onMounted, onBeforeUnmount } from 'vue'
 import ScreensaverLogo from '@/components/ScreensaverLogo.vue'
+import ScreensaverRing from '@/components/ScreensaverRing.vue'
 import BitcoinFaceAscii from '@/views/discover/BitcoinFaceAscii.vue'
 import { useScreensaverStore } from '@/stores/screensaver'
 
 const store = useScreensaverStore()
 
-const segmentCount = 48
-
-function getSegmentStyle(i: number) {
-  const deg = (i / segmentCount) * 360
-  return {
-    '--segment-index': i,
-    '--segment-deg': `${deg}deg`,
-  }
-}
-
 // Dismiss on any key (except when typing)
 function onKeyDown(e: KeyboardEvent) {
   if (store.isActive) {
@@ -86,102 +69,15 @@ onBeforeUnmount(() => {
 
 .screensaver-content {
   position: relative;
-  width: 280px;
-  height: 280px;
-  flex-shrink: 0;
-}
-
-@media (min-width: 640px) {
-  .screensaver-content {
-    width: 360px;
-    height: 360px;
-  }
-}
-
-@media (min-width: 768px) {
-  .screensaver-content {
-    width: 400px;
-    height: 400px;
-  }
-}
-
-/* Ring of segments around the logo - audio viz style (behind logo) */
-.screensaver-viz-ring {
-  position: absolute;
-  inset: 0;
-  width: 100%;
-  height: 100%;
-  z-index: 0;
-  pointer-events: none;
-  --viz-radius: 140px;
-}
-
-@media (min-width: 640px) {
-  .screensaver-viz-ring {
-    --viz-radius: 180px;
-  }
-}
-
-@media (min-width: 768px) {
-  .screensaver-viz-ring {
-    --viz-radius: 200px;
-  }
-}
-
-.screensaver-viz-segment {
-  position: absolute;
-  left: 50%;
-  top: 50%;
-  width: 4px;
-  height: 24px;
-  margin-left: -2px;
-  margin-top: -12px;
-  background: linear-gradient(to bottom, rgba(255, 255, 255, 0.4), rgba(255, 255, 255, 0.1));
-  border-radius: 2px;
-  /* Origin at segment center = ring center (segment is centered via left/top 50%) */
-  transform-origin: center center;
-  transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius)));
-  animation: segment-pulse 14s ease-in-out infinite;
-  animation-delay: calc(var(--segment-index) * 0.02s);
-}
-
-@media (min-width: 768px) {
-  .screensaver-viz-segment {
-    height: 28px;
-    margin-top: -14px;
-  }
-}
-
-/* 5 normal loops (10s) then stronger longer expression (4s) - total 14s */
-@keyframes segment-pulse {
-  /* Loop 1 */
-  0% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  7.1% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  14.3% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 2 */
-  21.4% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  28.6% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 3 */
-  35.7% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  42.9% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 4 */
-  50% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  57.1% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Loop 5 */
-  64.3% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
-  71.4% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  /* Strong expression: ramp up (1.5s), hold (2s), ease back (0.5s) */
-  78.6% { opacity: 1; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
-  85.7% { opacity: 1; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
-  92.9% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
-  100% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  display: grid;
+  place-items: center;
 }
 
 .screensaver-logo-wrapper {
   position: absolute;
-  left: 50%;
-  top: 50%;
-  transform: translate(-50%, -50%);
+  inset: 0;
+  display: grid;
+  place-items: center;
   z-index: 10;
   filter: drop-shadow(0 0 40px rgba(255, 255, 255, 0.15));
 }

neode-ui/src/components/ScreensaverRing.vue

@@ -0,0 +1,114 @@
+<template>
+  <div class="viz-ring" :class="sizeClass">
+    <div
+      v-for="(_, i) in segmentCount"
+      :key="i"
+      class="viz-segment"
+      :style="getSegmentStyle(i)"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+
+const props = withDefaults(defineProps<{
+  /** Visual size: 'default' matches the screensaver; 'compact' drops the
+   *  min-width breakpoints (useful inside overlays on narrower canvases). */
+  size?: 'default' | 'compact'
+  /** Override segment count. Defaults to 48 (screensaver standard). */
+  segmentCount?: number
+}>(), { size: 'default', segmentCount: 48 })
+
+const sizeClass = computed(() => props.size === 'compact' ? 'viz-ring-compact' : 'viz-ring-default')
+
+function getSegmentStyle(i: number) {
+  const deg = (i / props.segmentCount) * 360
+  return {
+    '--segment-index': i,
+    '--segment-deg': `${deg}deg`,
+  }
+}
+</script>
+
+<style scoped>
+.viz-ring {
+  position: relative;
+  pointer-events: none;
+}
+
+.viz-ring-default {
+  width: 280px;
+  height: 280px;
+  --viz-radius: 140px;
+}
+@media (min-width: 640px) {
+  .viz-ring-default {
+    width: 360px;
+    height: 360px;
+    --viz-radius: 180px;
+  }
+}
+@media (min-width: 768px) {
+  .viz-ring-default {
+    width: 400px;
+    height: 400px;
+    --viz-radius: 200px;
+  }
+}
+
+.viz-ring-compact {
+  width: 240px;
+  height: 240px;
+  --viz-radius: 120px;
+}
+@media (min-width: 768px) {
+  .viz-ring-compact {
+    width: 320px;
+    height: 320px;
+    --viz-radius: 160px;
+  }
+}
+
+.viz-segment {
+  position: absolute;
+  left: 50%;
+  top: 50%;
+  width: 4px;
+  height: 24px;
+  margin-left: -2px;
+  margin-top: -12px;
+  background: linear-gradient(to bottom, rgba(255, 255, 255, 0.4), rgba(255, 255, 255, 0.1));
+  border-radius: 2px;
+  transform-origin: center center;
+  transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius)));
+  animation: segment-pulse 14s ease-in-out infinite;
+  animation-delay: calc(var(--segment-index) * 0.02s);
+}
+
+@media (min-width: 768px) {
+  .viz-segment {
+    height: 28px;
+    margin-top: -14px;
+  }
+}
+
+/* 5 normal loops (10s) then stronger longer expression (4s) — total 14s */
+@keyframes segment-pulse {
+  0%   { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  7.1% { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  14.3%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  21.4%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  28.6%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  35.7%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  42.9%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  50%  { opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  57.1%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  64.3%{ opacity: 0.9; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1); }
+  71.4%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  78.6%{ opacity: 1;   transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
+  85.7%{ opacity: 1;   transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(1.5); }
+  92.9%{ opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+  100% { opacity: 0.3; transform: rotate(var(--segment-deg)) translateY(calc(-1 * var(--viz-radius))) scaleY(0.4); }
+}
+</style>

neode-ui/src/composables/useOnboarding.ts

@@ -19,11 +19,13 @@ async function callWithRetry<T>(fn: () => Promise<T>, maxRetries = 3): Promise<T
 }
 
 export async function isOnboardingComplete(): Promise<boolean> {
-  // localStorage is set on completion and survives backend restarts/resets
-  if (localStorage.getItem('neode_onboarding_complete') === '1') return true
+  // Prefer the backend — localStorage gets stale across nodes (a
+  // browser that onboarded node A would otherwise treat fresh node B
+  // as already-onboarded and skip the wizard entirely). Only fall
+  // back to localStorage if the backend is unreachable.
   const result = await callWithRetry(() => rpcClient.isOnboardingComplete(), 2)
   if (result !== null) return result
-  return false
+  return localStorage.getItem('neode_onboarding_complete') === '1'
 }
 
 export async function completeOnboarding(): Promise<void> {

neode-ui/src/router/index.ts

@@ -193,6 +193,11 @@ const router = createRouter({
           name: 'system-update',
           component: () => import('../views/SystemUpdate.vue'),
         },
+        {
+          path: 'settings/registries',
+          name: 'app-registries',
+          component: () => import('../views/AppRegistries.vue'),
+        },
         {
           path: 'goals/:goalId',
           name: 'goal-detail',

neode-ui/src/stores/__tests__/loginTransition.test.ts

@@ -10,10 +10,19 @@ describe('useLoginTransitionStore', () => {
   it('starts with all flags false', () => {
     const store = useLoginTransitionStore()
     expect(store.justLoggedIn).toBe(false)
+    expect(store.justCompletedOnboarding).toBe(false)
     expect(store.pendingWelcomeTyping).toBe(false)
     expect(store.startWelcomeTyping).toBe(false)
   })
 
+  it('setJustCompletedOnboarding updates justCompletedOnboarding', () => {
+    const store = useLoginTransitionStore()
+    store.setJustCompletedOnboarding(true)
+    expect(store.justCompletedOnboarding).toBe(true)
+    store.setJustCompletedOnboarding(false)
+    expect(store.justCompletedOnboarding).toBe(false)
+  })
+
   it('setJustLoggedIn updates justLoggedIn', () => {
     const store = useLoginTransitionStore()
     store.setJustLoggedIn(true)

neode-ui/src/stores/loginTransition.ts

@@ -4,6 +4,13 @@ import { ref } from 'vue'
 /** Signals that we just logged in - Dashboard uses this for zoom + oomph */
 export const useLoginTransitionStore = defineStore('loginTransition', () => {
   const justLoggedIn = ref(false)
+  /**
+   * True only when the user just finished the onboarding wizard
+   * (first password setup), as distinct from a regular re-login.
+   * Dashboard uses this to decide whether to play the full glitchy
+   * reveal vs just a quick interface-draw.
+   */
+  const justCompletedOnboarding = ref(false)
   /** Show empty welcome block until typing starts (hide static text) */
   const pendingWelcomeTyping = ref(false)
   /** Trigger welcome typing on Home - set true after dashboard animation finishes */
@@ -13,6 +20,10 @@ export const useLoginTransitionStore = defineStore('loginTransition', () => {
     justLoggedIn.value = value
   }
 
+  function setJustCompletedOnboarding(value: boolean) {
+    justCompletedOnboarding.value = value
+  }
+
   function setPendingWelcomeTyping(value: boolean) {
     pendingWelcomeTyping.value = value
   }
@@ -24,6 +35,8 @@ export const useLoginTransitionStore = defineStore('loginTransition', () => {
   return {
     justLoggedIn,
     setJustLoggedIn,
+    justCompletedOnboarding,
+    setJustCompletedOnboarding,
     pendingWelcomeTyping,
     setPendingWelcomeTyping,
     startWelcomeTyping,

neode-ui/src/types/api.ts

@@ -91,6 +91,8 @@ export interface PackageDataEntry {
   manifest: Manifest
   installed?: InstalledPackageDataEntry
   'install-progress'?: InstallProgress
+  /** Live label for the current uninstall step ("Stopping containers (2/5)", …). */
+  'uninstall-stage'?: string | null
   'available-update'?: string | null
 }
 

neode-ui/src/views/AppRegistries.vue

@@ -0,0 +1,330 @@
+<template>
+  <div class="pb-6">
+    <div class="mb-6">
+      <h1 class="text-3xl font-bold text-white mb-2">App registries</h1>
+      <p class="text-white/70">
+        Container registries this node pulls app images from. The primary is tried first; if it's
+        slow or unreachable, the next one in the list is tried automatically.
+      </p>
+    </div>
+
+    <!-- Status message -->
+    <div
+      v-if="statusMessage"
+      class="mb-4 p-3 rounded-lg text-sm"
+      :class="statusIsError ? 'bg-red-500/20 text-red-300' : 'bg-green-500/20 text-green-300'"
+    >
+      {{ statusMessage }}
+    </div>
+
+    <!-- Registry list -->
+    <div class="glass-card p-6 mb-6">
+      <div class="flex items-start justify-between gap-4 mb-2">
+        <h2 class="text-lg font-semibold text-white">Registries</h2>
+        <button
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors"
+          @click="openAddRegistry"
+        >+ Add registry</button>
+      </div>
+      <p class="text-sm text-white/60 mb-4">
+        Registries are tried in priority order on every app install. Changing the primary takes
+        effect on the next install — existing containers keep running on whatever image they
+        already pulled.
+      </p>
+      <ul v-if="registries.length" class="space-y-2">
+        <li
+          v-for="r in sortedRegistries"
+          :key="r.url"
+          class="p-3 bg-white/5 rounded-lg"
+        >
+          <div class="flex items-start gap-3">
+            <div class="flex-1 min-w-0">
+              <div class="flex items-center gap-2 mb-0.5 flex-wrap">
+                <p class="text-sm font-medium text-white truncate">{{ r.name || r.url }}</p>
+                <span
+                  v-if="r.priority === 0"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-green-500/20 text-green-300"
+                >PRIMARY</span>
+                <span
+                  v-if="!r.tls_verify"
+                  class="text-[10px] font-mono px-2 py-0.5 rounded bg-amber-500/20 text-amber-300"
+                  title="TLS verification disabled — HTTP or self-signed registry"
+                >HTTP</span>
+              </div>
+              <p class="text-xs text-white/50 font-mono break-all">{{ r.url }}</p>
+            </div>
+            <div class="shrink-0 flex items-center gap-1">
+              <button
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-white hover:bg-white/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="registryTests[r.url]?.testing"
+                title="Test reachability"
+                @click="testRegistry(r)"
+              >
+                <svg v-if="registryTests[r.url]?.testing" class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" stroke-opacity="0.25"></circle>
+                  <path fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
+                </svg>
+                <svg v-else class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                </svg>
+              </button>
+              <button
+                v-if="r.priority !== 0"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-yellow-300 hover:bg-white/10 transition-colors"
+                title="Make primary"
+                @click="setPrimary(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z" />
+                </svg>
+              </button>
+              <button
+                v-if="registries.length > 1"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-red-300 hover:bg-red-400/10 transition-colors"
+                title="Remove registry"
+                @click="removeRegistry(r.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div
+            v-if="registryTests[r.url] && !registryTests[r.url]?.testing"
+            class="mt-2 pt-2 border-t border-white/5 text-xs"
+          >
+            <span v-if="registryTests[r.url]?.reachable" class="inline-flex items-center gap-1.5 text-green-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M5 13l4 4L19 7" />
+              </svg>
+              Reachable (HTTP {{ registryTests[r.url]?.status }})
+            </span>
+            <span v-else class="inline-flex items-center gap-1.5 text-red-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+              <span class="truncate">{{ registryTests[r.url]?.error || 'Unreachable' }}</span>
+            </span>
+          </div>
+        </li>
+      </ul>
+    </div>
+
+    <!-- Back link -->
+    <RouterLink
+      to="/dashboard/settings"
+      class="glass-button rounded-lg px-5 py-2 text-sm font-medium inline-flex items-center gap-2"
+    >
+      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
+      </svg>
+      Back to Settings
+    </RouterLink>
+
+    <!-- Add-registry modal -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="addingRegistry"
+          class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md"
+          @click.self="cancelAddRegistry"
+        >
+          <div class="glass-card p-6 max-w-md w-full mx-4">
+            <h3 class="text-lg font-semibold text-white mb-1">Add app registry</h3>
+            <p class="text-sm text-white/60 mb-5">
+              The URL should be of the form <span class="font-mono text-white/80">host[:port]/namespace</span>
+              — for example <span class="font-mono text-white/80">ghcr.io/myorg</span> or
+              <span class="font-mono text-white/80">192.168.1.50:3000/apps</span>. Registries are
+              added to the end of the list; use "Make primary" to reorder.
+            </p>
+            <form class="space-y-3" @submit.prevent="submitRegistry">
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Name</label>
+                <input
+                  v-model="registryDraft.name"
+                  type="text"
+                  placeholder="My private registry"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none"
+                />
+              </div>
+              <div>
+                <label class="block text-xs text-white/60 mb-1">Registry URL</label>
+                <input
+                  v-model="registryDraft.url"
+                  type="text"
+                  autofocus
+                  placeholder="host:port/namespace"
+                  class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none font-mono"
+                />
+              </div>
+              <label class="flex items-center gap-2 cursor-pointer text-sm text-white/80">
+                <input
+                  v-model="registryDraft.tls_verify"
+                  type="checkbox"
+                  class="accent-orange-400"
+                />
+                Verify TLS certificate (uncheck for HTTP or self-signed)
+              </label>
+              <div class="flex gap-3 justify-end pt-2">
+                <button
+                  type="button"
+                  @click="cancelAddRegistry"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
+                >Cancel</button>
+                <button
+                  type="submit"
+                  class="glass-button rounded-lg px-4 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                  :disabled="registrySaving || !registryDraft.url.trim()"
+                >{{ registrySaving ? 'Adding…' : 'Add registry' }}</button>
+              </div>
+            </form>
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted, reactive } from 'vue'
+import { RouterLink } from 'vue-router'
+import { rpcClient } from '@/api/rpc-client'
+
+interface Registry {
+  url: string
+  name: string
+  tls_verify: boolean
+  enabled: boolean
+  priority: number
+}
+
+interface RegistryTestState {
+  testing?: boolean
+  reachable?: boolean
+  status?: number | null
+  error?: string | null
+}
+
+const registries = ref<Registry[]>([])
+const sortedRegistries = computed(() =>
+  [...registries.value].sort((a, b) => a.priority - b.priority)
+)
+const registryTests = ref<Record<string, RegistryTestState>>({})
+const statusMessage = ref('')
+const statusIsError = ref(false)
+
+const addingRegistry = ref(false)
+const registrySaving = ref(false)
+const registryDraft = reactive({ url: '', name: '', tls_verify: true })
+
+function showStatus(msg: string, isError = false) {
+  statusMessage.value = msg
+  statusIsError.value = isError
+  setTimeout(() => { statusMessage.value = '' }, 8000)
+}
+
+async function loadRegistries() {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({ method: 'registry.list' })
+    registries.value = res.registries
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('registry.list failed', e)
+  }
+}
+
+function openAddRegistry() {
+  registryDraft.url = ''
+  registryDraft.name = ''
+  registryDraft.tls_verify = true
+  addingRegistry.value = true
+}
+function cancelAddRegistry() {
+  addingRegistry.value = false
+}
+
+async function submitRegistry() {
+  const url = registryDraft.url.trim()
+  if (!url) return
+  registrySaving.value = true
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.add',
+      params: {
+        url,
+        name: registryDraft.name.trim() || url,
+        tls_verify: registryDraft.tls_verify,
+      },
+    })
+    registries.value = res.registries
+    addingRegistry.value = false
+    showStatus('Registry added.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Add registry failed: ${msg}`, true)
+  } finally {
+    registrySaving.value = false
+  }
+}
+
+async function removeRegistry(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.remove',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Registry removed.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function setPrimary(url: string) {
+  try {
+    const res = await rpcClient.call<{ registries: Registry[] }>({
+      method: 'registry.set-primary',
+      params: { url },
+    })
+    registries.value = res.registries
+    showStatus('Primary registry updated. Next install will try it first.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Set primary failed: ${msg}`, true)
+  }
+}
+
+async function testRegistry(r: Registry) {
+  registryTests.value = { ...registryTests.value, [r.url]: { testing: true } }
+  try {
+    const res = await rpcClient.call<{
+      url: string
+      reachable: boolean
+      status: number | null
+      error?: string | null
+    }>({ method: 'registry.test', params: { url: r.url, tls_verify: r.tls_verify } })
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: {
+        testing: false,
+        reachable: res.reachable,
+        status: res.status,
+        error: res.error ?? null,
+      },
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    registryTests.value = {
+      ...registryTests.value,
+      [r.url]: { testing: false, reachable: false, error: msg },
+    }
+  }
+}
+
+onMounted(() => { void loadRegistries() })
+</script>

neode-ui/src/views/Apps.vue

@@ -282,6 +282,9 @@ function closeUninstallModal() {
 
 async function onConfirmUninstall() {
   const { appId } = uninstallModal.value
+  // Close the modal immediately so the user can fire off concurrent
+  // uninstalls. Each AppCard surfaces its own live stage label while
+  // its uninstall is in flight.
   uninstallModal.value.show = false
   await actions.confirmUninstall(appId)
 }

neode-ui/src/views/Dashboard.vue

@@ -264,10 +264,13 @@ watch(() => route.path, (newPath) => {
 onMounted(() => {
   previousRoutePath = route.path
   document.body.classList.add('dashboard-active')
-  if (loginTransition.justLoggedIn) {
+  if (loginTransition.justCompletedOnboarding) {
+    // Full glitchy reveal — only on the very first dashboard entry
+    // right after onboarding (one-time event, persists in feel).
     playDashboardLoadOomph()
     showZoomIn.value = true
     loginTransition.setPendingWelcomeTyping(true)
+    loginTransition.setJustCompletedOnboarding(false)
     loginTransition.setJustLoggedIn(false)
     const triggerRevealGlitch = () => {
       isGlitching.value = true
@@ -281,6 +284,18 @@ onMounted(() => {
       loginTransition.setStartWelcomeTyping(true)
       loginTransition.setPendingWelcomeTyping(false)
     }, 4000)
+  } else if (loginTransition.justLoggedIn) {
+    // Regular re-login — quick interface draw, no triple glitch flashes.
+    // Just the zoom-in for a short beat, then welcome typing fires fast.
+    playDashboardLoadOomph()
+    showZoomIn.value = true
+    loginTransition.setPendingWelcomeTyping(true)
+    loginTransition.setJustLoggedIn(false)
+    scheduledTimeout(() => { showZoomIn.value = false }, 1200)
+    scheduledTimeout(() => {
+      loginTransition.setStartWelcomeTyping(true)
+      loginTransition.setPendingWelcomeTyping(false)
+    }, 600)
   }
 
   window.addEventListener('keydown', handleKioskShortcuts)

neode-ui/src/views/Login.vue

@@ -408,6 +408,7 @@ async function handleSetup() {
     stopSynthwave()
     whooshAway.value = true
     playLoginSuccessWhoosh()
+    loginTransition.setJustCompletedOnboarding(true)
     loginTransition.setJustLoggedIn(true)
     await new Promise(r => setTimeout(r, 520))
     await router.replace(loginRedirectTo.value).catch(() => {

neode-ui/src/views/OnboardingWrapper.vue

@@ -86,9 +86,23 @@ const videoBackgroundRoutes = ['/onboarding/intro', '/login']
 // Login uses video when coming from splash, or static + glitch when direct
 const isLoginRoute = computed(() => route.path === '/login')
 
+// True once onboarding is complete. Used to skip the intro video on
+// the /login route so that returning (logged-out) users go straight
+// to the screensaver-style static + glitch background instead of
+// replaying the full intro every time.
+const onboardingDone = computed(() => {
+  try {
+    return localStorage.getItem('neode_onboarding_complete') === '1'
+  } catch {
+    return false
+  }
+})
+
 // Check if current route should use video background
 const useVideoBackground = computed(() => {
-  return videoBackgroundRoutes.includes(route.path)
+  if (!videoBackgroundRoutes.includes(route.path)) return false
+  if (route.path === '/login' && onboardingDone.value) return false
+  return true
 })
 
 // Map each route to a specific background image

neode-ui/src/views/RootRedirect.vue

@@ -129,7 +129,31 @@ onMounted(async () => {
     return
   }
 
-  // Server not ready — show boot screen (waiting for backend)
+  // Server not ready. The full BootScreen is meant for a genuine
+  // cold-start (fresh install), not for the brief blip during an
+  // OTA update where the backend restarts. If onboarding has already
+  // completed we just keep the spinner and retry until the server
+  // responds again.
+  const wasOnboardedBefore = localStorage.getItem('neode_onboarding_complete') === '1'
+  if (wasOnboardedBefore) {
+    log('server down + onboarded → polling without boot screen')
+    let retries = 0
+    const maxRetries = 30 // 30 * 2s = 60s before giving up and showing boot screen
+    const poll = setInterval(async () => {
+      retries++
+      if (await quickHealthCheck()) {
+        clearInterval(poll)
+        proceedToApp()
+        return
+      }
+      if (retries >= maxRetries) {
+        clearInterval(poll)
+        log('server still down after retries → falling back to boot screen')
+        showBootScreen.value = true
+      }
+    }, 2000)
+    return
+  }
   showBootScreen.value = true
 })
 </script>

neode-ui/src/views/SystemUpdate.vue

@@ -42,6 +42,12 @@
         <div>
           <h2 class="text-lg font-semibold text-white">{{ t('systemUpdate.updateAvailable') }}</h2>
           <p class="text-sm text-white/60">Version {{ updateInfo.version }} &mdash; {{ updateInfo.release_date }}</p>
+          <p v-if="manifestMirrorLabel" class="text-xs text-white/40 mt-1 flex items-center gap-1.5">
+            <svg class="w-3 h-3 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 12h14M12 5l7 7-7 7" />
+            </svg>
+            <span>Served by <span class="text-white/70">{{ manifestMirrorLabel }}</span></span>
+          </p>
         </div>
         <span class="px-3 py-1 bg-orange-500/20 text-orange-400 text-xs font-medium rounded-full">{{ t('systemUpdate.new') }}</span>
       </div>
@@ -172,6 +178,87 @@
       </div>
     </div>
 
+    <!-- Mirrors -->
+    <div class="glass-card p-6 mb-6">
+      <div class="flex items-start justify-between gap-4 mb-2">
+        <h2 class="text-lg font-semibold text-white">Update mirrors</h2>
+        <button
+          type="button"
+          class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors"
+          @click="openAddMirror"
+        >+ Add mirror</button>
+      </div>
+      <p class="text-sm text-white/60 mb-4">
+        Servers this node checks for updates. The primary is tried first; if it's slow or unreachable, the next one in the list is tried automatically. Downloads always come from the mirror that served the manifest — switching primary switches where files come from.
+      </p>
+      <ul v-if="mirrors.length" class="space-y-2">
+        <li v-for="(m, i) in mirrors" :key="m.url" class="p-3 bg-white/5 rounded-lg">
+          <div class="flex items-start gap-3">
+            <div class="flex-1 min-w-0">
+              <div class="flex items-center gap-2 mb-0.5 flex-wrap">
+                <p class="text-sm font-medium text-white truncate">{{ m.label || `Mirror ${i + 1}` }}</p>
+                <span v-if="i === 0" class="text-[10px] font-mono px-2 py-0.5 rounded bg-green-500/20 text-green-300">PRIMARY</span>
+              </div>
+              <p class="text-xs text-white/50 font-mono break-all">{{ m.url }}</p>
+            </div>
+            <div class="shrink-0 flex items-center gap-1">
+              <button
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-white hover:bg-white/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="mirrorTests[m.url]?.testing"
+                title="Test reachability"
+                @click="testMirror(m.url)"
+              >
+                <svg v-if="mirrorTests[m.url]?.testing" class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="3" stroke-opacity="0.25"></circle>
+                  <path fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path>
+                </svg>
+                <svg v-else class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                </svg>
+              </button>
+              <button
+                v-if="i !== 0"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-yellow-300 hover:bg-white/10 transition-colors"
+                title="Make primary"
+                @click="setPrimaryMirror(m.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z" />
+                </svg>
+              </button>
+              <button
+                v-if="mirrors.length > 1"
+                type="button"
+                class="w-8 h-8 flex items-center justify-center rounded-md text-white/60 hover:text-red-300 hover:bg-red-400/10 transition-colors"
+                title="Remove mirror"
+                @click="removeMirror(m.url)"
+              >
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div v-if="mirrorTests[m.url] && !mirrorTests[m.url]?.testing" class="mt-2 pt-2 border-t border-white/5 text-xs">
+            <span v-if="mirrorTests[m.url]?.reachable" class="inline-flex items-center gap-1.5 text-green-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M5 13l4 4L19 7" />
+              </svg>
+              Reachable &middot; {{ mirrorTests[m.url]?.latency_ms }}ms
+            </span>
+            <span v-else class="inline-flex items-center gap-1.5 text-red-300">
+              <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="3" d="M6 18L18 6M6 6l12 12" />
+              </svg>
+              <span class="truncate">{{ mirrorTests[m.url]?.error || 'Unreachable' }}</span>
+            </span>
+          </div>
+        </li>
+      </ul>
+    </div>
+
     <!-- Actions row -->
     <div class="glass-card p-6">
       <h2 class="text-lg font-semibold text-white mb-4">{{ t('systemUpdate.actions') }}</h2>
@@ -257,6 +344,51 @@
       </Transition>
     </Teleport>
 
+    <!-- Add-mirror modal -->
+    <Transition name="fade">
+      <div v-if="addingMirror" class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md" @click.self="cancelAddMirror">
+        <div class="glass-card p-6 max-w-md w-full mx-4">
+          <h3 class="text-lg font-semibold text-white mb-1">Add update mirror</h3>
+          <p class="text-sm text-white/60 mb-5">
+            The URL should point directly at a <span class="font-mono text-white/80">manifest.json</span> served by a Gitea mirror or equivalent. It's added to the end of the list; use "Make primary" to change order.
+          </p>
+          <form class="space-y-3" @submit.prevent="submitMirror">
+            <div>
+              <label class="block text-xs text-white/60 mb-1">Manifest URL</label>
+              <input
+                v-model="mirrorDraft.url"
+                type="text"
+                autofocus
+                placeholder="https://host/.../manifest.json"
+                class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none font-mono"
+              />
+            </div>
+            <div>
+              <label class="block text-xs text-white/60 mb-1">Label (optional)</label>
+              <input
+                v-model="mirrorDraft.label"
+                type="text"
+                placeholder="Home VPS"
+                class="w-full px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none"
+              />
+            </div>
+            <div class="flex gap-3 justify-end pt-2">
+              <button
+                type="button"
+                @click="cancelAddMirror"
+                class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
+              >{{ t('common.cancel') }}</button>
+              <button
+                type="submit"
+                class="glass-button rounded-lg px-4 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                :disabled="mirrorSaving || !mirrorDraft.url.trim()"
+              >{{ mirrorSaving ? 'Adding…' : 'Add mirror' }}</button>
+            </div>
+          </form>
+        </div>
+      </div>
+    </Transition>
+
     <!-- Confirmation modal -->
     <Transition name="fade">
       <div v-if="confirmAction" class="fixed inset-0 z-50 flex items-center justify-center bg-black/10 backdrop-blur-md" @click.self="cancelConfirm">
@@ -304,7 +436,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, onMounted } from 'vue'
+import { ref, computed, onMounted, reactive } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { RouterLink } from 'vue-router'
 import { rpcClient } from '@/api/rpc-client'
@@ -346,6 +478,133 @@ const statusIsError = ref(false)
 const downloadPercent = ref(0)
 const downloadPercentFormatted = computed(() => downloadPercent.value.toFixed(2))
 
+// Mirrors — servers this node tries for the manifest, in priority
+// order. First entry is the primary. Add/remove/set-primary are wired
+// to update.*-mirror RPCs; downloads automatically go to the mirror
+// that served the manifest.
+interface UpdateMirror { url: string; label: string }
+const mirrors = ref<UpdateMirror[]>([])
+const addingMirror = ref(false)
+const mirrorSaving = ref(false)
+const mirrorDraft = reactive({ url: '', label: '' })
+
+// URL of the mirror that served the currently-available-update manifest.
+// Backend reports it in update.status and update.check responses; the UI
+// resolves it to a friendly label by matching against the mirrors list.
+const manifestMirror = ref<string | null>(null)
+const manifestMirrorLabel = computed(() => {
+  const url = manifestMirror.value
+  if (!url) return null
+  const match = mirrors.value.find(m => m.url === url)
+  if (match && match.label) return match.label
+  try {
+    const u = new URL(url)
+    return u.host
+  } catch {
+    return url
+  }
+})
+
+// Per-mirror test state. Populated by testMirror(); each entry is either
+// { testing: true } while in flight or the backend response shape on
+// completion. Rendered inline under each mirror row.
+interface MirrorTestState {
+  testing?: boolean
+  reachable?: boolean
+  latency_ms?: number
+  http_status?: number | null
+  error?: string | null
+}
+const mirrorTests = ref<Record<string, MirrorTestState>>({})
+
+async function testMirror(url: string) {
+  mirrorTests.value = { ...mirrorTests.value, [url]: { testing: true } }
+  try {
+    const res = await rpcClient.call<{
+      reachable: boolean
+      latency_ms: number
+      http_status: number | null
+      error: string | null
+    }>({ method: 'update.test-mirror', params: { url } })
+    mirrorTests.value = { ...mirrorTests.value, [url]: { ...res, testing: false } }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    mirrorTests.value = { ...mirrorTests.value, [url]: { testing: false, reachable: false, error: msg } }
+  }
+}
+
+function openAddMirror() {
+  mirrorDraft.url = ''
+  mirrorDraft.label = ''
+  addingMirror.value = true
+}
+function cancelAddMirror() {
+  addingMirror.value = false
+}
+
+async function loadMirrors() {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({ method: 'update.list-mirrors' })
+    mirrors.value = res.mirrors
+  } catch (e) {
+    if (import.meta.env.DEV) console.warn('update.list-mirrors failed', e)
+  }
+}
+
+async function submitMirror() {
+  const url = mirrorDraft.url.trim()
+  if (!url) return
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {
+    showStatus('Mirror URL must start with http:// or https://', true)
+    return
+  }
+  mirrorSaving.value = true
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.add-mirror',
+      params: { url, label: mirrorDraft.label.trim() },
+    })
+    mirrors.value = res.mirrors
+    mirrorDraft.url = ''
+    mirrorDraft.label = ''
+    addingMirror.value = false
+    showStatus('Mirror added.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Add mirror failed: ${msg}`, true)
+  } finally {
+    mirrorSaving.value = false
+  }
+}
+
+async function removeMirror(url: string) {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.remove-mirror',
+      params: { url },
+    })
+    mirrors.value = res.mirrors
+    showStatus('Mirror removed.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function setPrimaryMirror(url: string) {
+  try {
+    const res = await rpcClient.call<{ mirrors: UpdateMirror[] }>({
+      method: 'update.set-primary-mirror',
+      params: { url },
+    })
+    mirrors.value = res.mirrors
+    showStatus('Primary mirror updated. Next update check will try it first.')
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    showStatus(`Set primary failed: ${msg}`, true)
+  }
+}
+
 // Poll the backend for the real bytes_downloaded / total_bytes so the
 // progress bar tracks actual download state (and survives route
 // changes). Returns true if a download is currently in progress.
@@ -488,11 +747,13 @@ async function loadStatus() {
       update_available: boolean
       update_in_progress: boolean
       rollback_available: boolean
+      manifest_mirror: string | null
     }>({ method: 'update.status' })
     currentVersion.value = res.current_version
     lastCheck.value = res.last_check
     updateInProgress.value = res.update_in_progress
     rollbackAvailable.value = res.rollback_available
+    manifestMirror.value = res.manifest_mirror ?? null
 
     if (res.update_in_progress) {
       downloaded.value = true
@@ -512,11 +773,13 @@ async function checkForUpdates() {
       update_available: boolean
       update: UpdateDetail | null
       update_method?: string
+      manifest_mirror?: string | null
     }>({ method: 'update.check' })
     currentVersion.value = res.current_version
     lastCheck.value = res.last_check
     updateInfo.value = res.update
     updateMethod.value = res.update_method === 'git' ? 'git' : 'manifest'
+    manifestMirror.value = res.manifest_mirror ?? null
     if (!res.update_available) {
       showStatus(t('systemUpdate.upToDateMessage'))
     }
@@ -685,7 +948,7 @@ async function setSchedule(value: ScheduleValue) {
 }
 
 onMounted(async () => {
-  await Promise.all([loadStatus(), loadSchedule(), checkForUpdates()])
+  await Promise.all([loadStatus(), loadSchedule(), loadMirrors(), checkForUpdates()])
   // If a download was already running when the user navigated here
   // (or refreshed), pick up the progress bar where it is and keep
   // polling until the backend reports done. No RPC call to start the

neode-ui/src/views/apps/AppCard.vue

@@ -99,14 +99,14 @@
       </div>
     </div>
 
-    <!-- Uninstalling progress — replaces action buttons -->
+    <!-- Uninstalling progress — live stage label from backend -->
     <div v-else-if="isUninstalling" class="mt-4">
       <div class="flex items-center gap-1.5">
         <svg class="animate-spin h-3 w-3 text-red-400" fill="none" viewBox="0 0 24 24">
           <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
           <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
         </svg>
-        <span class="text-xs text-red-300">{{ t('common.uninstalling') }}...</span>
+        <span class="text-xs text-red-300 truncate">{{ uninstallStageLabel }}</span>
       </div>
       <div class="mt-1.5 w-full h-1.5 bg-white/10 rounded-full overflow-hidden">
         <div class="h-full bg-red-400/60 rounded-full animate-pulse w-full"></div>
@@ -251,6 +251,13 @@ const tier = computed(() => {
   return 'optional'
 })
 
+// Live uninstall stage from backend, with a sensible fallback so the
+// label is never blank between WS pushes.
+const uninstallStageLabel = computed(() => {
+  const raw = props.pkg['uninstall-stage']
+  return raw ? raw : `${t('common.uninstalling')}…`
+})
+
 const isTransitioning = computed(() => {
   const s = props.pkg.state
   const h = props.pkg.health

neode-ui/src/views/marketplace/MarketplaceAppCard.vue

@@ -96,20 +96,32 @@
           Checking...
         </span>
       </span>
-      <!-- Installing — simple button-style indicator -->
-      <button
+      <!-- Installing — live progress with bar + message matching the
+           update download bar's accuracy. Falls back to a simple
+           spinner if no install_progress data is available yet. -->
+      <div
         v-else-if="!installed && installing"
-        disabled
-        class="flex-1 px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium opacity-80 cursor-wait"
+        class="flex-1 flex flex-col gap-1.5"
       >
-        <span class="flex items-center justify-center gap-2">
-          <svg class="animate-spin h-3.5 w-3.5" fill="none" viewBox="0 0 24 24">
+        <div
+          class="px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium opacity-90 cursor-wait flex items-center justify-center gap-2 text-center"
+        >
+          <svg class="animate-spin h-3.5 w-3.5 shrink-0" fill="none" viewBox="0 0 24 24">
             <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
             <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
           </svg>
-          Installing
-        </span>
-      </button>
+          <span class="truncate">{{ installProgressMessage }}</span>
+        </div>
+        <div
+          v-if="(installProgress?.progress ?? 0) > 0"
+          class="w-full h-1 bg-white/10 rounded-full overflow-hidden"
+        >
+          <div
+            class="h-full bg-orange-400 transition-all duration-300"
+            :style="{ width: (installProgress?.progress ?? 0) + '%' }"
+          ></div>
+        </div>
+      </div>
       <button
         v-else-if="!installed && (app.source === 'local' || app.dockerImage)"
         data-controller-install-btn
@@ -130,6 +142,7 @@
 </template>
 
 <script setup lang="ts">
+import { computed } from 'vue'
 import { useI18n } from 'vue-i18n'
 import type { MarketplaceApp, InstallProgress } from './marketplaceData'
 
@@ -154,6 +167,14 @@ defineEmits<{
   launch: [app: MarketplaceApp]
 }>()
 
+const installProgressMessage = computed(() => {
+  const p = props.installProgress
+  if (!p) return 'Installing'
+  // The store already formats messages like "Downloading: 50.5 / 200.0 MB (25%)"
+  // so we just surface them directly.
+  return p.message || 'Installing'
+})
+
 function handleImageError(event: Event) {
   const img = event.target as HTMLImageElement
   img.src = '/assets/img/logo-archipelago.svg'

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -9,15 +9,53 @@
       <div class="flex-1">
         <div class="flex items-start justify-between gap-4 mb-2">
           <h2 class="text-xl font-semibold text-white">FIPS Mesh</h2>
-          <div class="flex items-center gap-2" :title="statusLabel">
-            <span class="w-2 h-2 rounded-full" :class="statusDotColor"></span>
-            <span class="text-sm font-medium" :class="statusTextColor">{{ statusLabel }}</span>
+          <div class="flex items-center gap-3">
+            <div class="flex items-center gap-2" :title="statusLabel">
+              <span class="w-2 h-2 rounded-full" :class="statusDotColor"></span>
+              <span class="text-sm font-medium" :class="statusTextColor">{{ statusLabel }}</span>
+            </div>
+            <button
+              type="button"
+              class="p-1.5 rounded-md text-white/50 hover:text-white hover:bg-white/10 transition-colors"
+              title="Seed anchors"
+              aria-label="Open FIPS seed anchors settings"
+              @click="showAnchorsModal = true"
+            >
+              <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z" />
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+              </svg>
+            </button>
           </div>
         </div>
         <p class="text-white/70 text-sm mb-4">Fast Nostr-keyed mesh routing</p>
       </div>
     </div>
 
+    <!-- Seed anchors modal — operator-editable list of peers this node
+         dials to bootstrap the mesh. Tucked behind the gear so it
+         doesn't crowd the card but is still one click away. Close
+         button and layout mirror the What's New modal (and the rest
+         of the app) so it feels like a first-class modal. -->
+    <Teleport to="body">
+      <Transition name="fade">
+        <div
+          v-if="showAnchorsModal"
+          class="fixed inset-0 z-[3000] flex items-center justify-center p-4"
+          @click="showAnchorsModal = false"
+        >
+          <div class="absolute inset-0 bg-black/60 backdrop-blur-sm"></div>
+          <div
+            class="relative z-10 max-w-xl w-full"
+            style="max-height: 90vh; overflow-y: auto"
+            @click.stop
+          >
+            <FipsSeedAnchorsCard closable @close="showAnchorsModal = false" />
+          </div>
+        </div>
+      </Transition>
+    </Teleport>
+
     <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3 shrink-0">
       <div class="p-3 bg-white/5 rounded-lg">
         <p class="text-xs text-white/60 mb-1">Daemon version</p>
@@ -50,7 +88,7 @@
       <div class="flex items-center justify-between gap-3 flex-wrap">
         <div class="flex items-center gap-2 text-xs">
           <span class="w-2 h-2 rounded-full" :class="status.anchor_connected ? 'bg-cyan-400' : 'bg-orange-400'"></span>
-          <span class="text-white/70">Anchor (fips.v0l.io):</span>
+          <span class="text-white/70">Anchor:</span>
           <span :class="status.anchor_connected ? 'text-cyan-300' : 'text-orange-300'">
             {{ status.anchor_connected ? 'connected' : 'not reached' }}
           </span>
@@ -68,7 +106,7 @@
         </button>
       </div>
       <p v-if="!status.anchor_connected" class="mt-2 text-[11px] text-white/40 leading-snug">
-        Without the anchor, DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until it reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache.
+        No known anchor is currently an authenticated peer. DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until one reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache. Add a cluster-local anchor in Seed Anchors if the public one is unreachable.
       </p>
     </div>
 
@@ -84,6 +122,7 @@
 import { computed, onMounted, ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
 import { safeClipboardWrite } from '@/views/web5/utils'
+import FipsSeedAnchorsCard from './FipsSeedAnchorsCard.vue'
 
 interface FipsStatus {
   installed: boolean
@@ -113,6 +152,7 @@ const reconnecting = ref(false)
 const statusMessage = ref('')
 const statusIsError = ref(false)
 const copied = ref(false)
+const showAnchorsModal = ref(false)
 
 async function copyNpub() {
   if (!status.value.npub) return

neode-ui/src/views/server/FipsSeedAnchorsCard.vue

@@ -1,9 +1,23 @@
 <template>
-  <div data-controller-container tabindex="0" class="glass-card p-6 flex flex-col transition-all hover:-translate-y-1">
-    <div class="flex items-start gap-4 mb-4 shrink-0">
+  <div data-controller-container tabindex="0" class="glass-card p-6 flex flex-col transition-all hover:-translate-y-1 relative">
+    <button
+      v-if="closable"
+      type="button"
+      class="absolute top-4 right-4 p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors z-10"
+      aria-label="Close"
+      @click="$emit('close')"
+    >
+      <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+      </svg>
+    </button>
+    <div class="flex items-start gap-4 mb-4 shrink-0" :class="{ 'pr-10': closable }">
       <div class="flex-shrink-0 w-12 h-12 rounded-lg bg-white/10 flex items-center justify-center">
+        <!-- Radio/broadcast icon — three concentric arcs radiating from a
+             dot. Reads as mesh, signal, anchor-reaching-peers. -->
         <svg class="w-6 h-6 text-white/80" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 11c0 3.517-1.009 6.799-2.753 9.571m-3.44-2.04.054-.09A13.916 13.916 0 0 0 8 11a4 4 0 1 1 8 0c0 1.017-.07 2.019-.203 3M9.497 10.997 14 18m-9.41-3.41L4 18.5" />
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8.288 15.038a5.25 5.25 0 017.424 0M5.106 11.856c3.807-3.808 9.98-3.808 13.788 0M1.924 8.674c5.565-5.565 14.587-5.565 20.152 0" />
+          <circle cx="12" cy="18" r="1.25" fill="currentColor" stroke="none" />
         </svg>
       </div>
       <div class="flex-1">
@@ -70,6 +84,9 @@
 import { onMounted, reactive, ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
 
+defineProps<{ closable?: boolean }>()
+defineEmits<{ (e: 'close'): void }>()
+
 interface SeedAnchor {
   npub: string
   address: string

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -180,6 +180,114 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.30-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.30-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>App installs now show a real download progress bar — same accuracy as the system update bar. You'll see "Downloading: 50.5 / 200.0 MB (25%)" with a live percentage instead of a generic spinner. The bar keeps streaming even when the install falls back from one registry to another, so you'll never see a "stuck at 0%" again.</p>
+                  <p>Uninstalls now show what's actually happening: "Stopping containers (2/5)", "Cleaning up volumes", "Removing app data" — labelled per app so you can fire off multiple uninstalls in parallel and watch each one's stage on its own card.</p>
+                  <p>OVH (146.59.87.168) is now baked in as Server 3 by default for both updates and the app registry — extra mirror, completely independent network path so a single-provider outage can't take everything down.</p>
+                </div>
+              </div>
+              <!-- v1.7.29-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.29-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>New App registries page in Settings — same experience as Update mirrors, but for the container registries your node pulls app images from. Add a mirror, test reachability with one click, pick the primary.</p>
+                  <p>New nodes default to the VPS registry as the primary for both app installs and the app catalog, with tx1138 as the automatic fallback if the VPS is slow or unreachable. Existing nodes keep whatever registry order they've already set.</p>
+                  <p>App installs now genuinely honor the primary registry: the first pull attempt rewrites the image URL to use your primary, and only falls through to the secondary if that fails. Before, installs always hit whichever registry the image was hardcoded to.</p>
+                  <p>Reboot screen now shows the animated "a" logo in the center of the ring — matching the screensaver's look so you get something nice to watch while the node comes back up.</p>
+                </div>
+              </div>
+              <!-- v1.7.28-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.28-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Reboot now shows a proper progress screen. Click Reboot and you'll see a full-screen overlay with the familiar pulsing ring animation, a rebooting / reconnecting / back-online status, and an elapsed counter — no more black screen of mystery while you wait.</p>
+                  <p>The overlay auto-reloads the page the moment your node is back up; if it takes longer than three minutes it surfaces a manual Reload button.</p>
+                  <p>New nodes now default to the VPS mirror as Server 1 (primary) and tx1138 as Server 2 (fallback). Existing nodes keep whatever mirror order they've already set — use Set Primary on the System Update page to change it.</p>
+                </div>
+              </div>
+              <!-- v1.7.27-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.27-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>The Update page now shows which mirror delivered your update — a small "Served by" line under the new version tells you whether Server 1, Server 2, or a custom mirror was the one your node actually reached. Great for spot-checking that mirror fallback is doing its job.</p>
+                  <p>Every mirror row has a new lightning-bolt button that pings the mirror and shows whether it's reachable, plus the round-trip latency in milliseconds. No more guessing if a mirror you just added is responding.</p>
+                  <p>The Update mirrors section got a visual refresh: Set Primary, Remove, and the new Test action are compact icon buttons instead of crowded text, and adding a mirror now happens in a dedicated dialog that matches the rest of the UI.</p>
+                </div>
+              </div>
+              <!-- v1.7.26-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.26-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Update downloads now have a mirror list. If the primary update server is slow or unreachable, your node automatically tries the next mirror and downloads the files from there — no more waiting on a stalled server with no recourse.</p>
+                  <p>A new 'Update mirrors' section on the System Update page lets you see the list, add your own mirror URL, reorder which is tried first (Set primary), or remove one. The primary is tagged with a green PRIMARY pill.</p>
+                  <p>Downloads automatically follow the mirror that served the manifest. Previously every mirror served the same manifest, and the manifest's download URLs were hardcoded to a single server — so even picking a faster mirror couldn't speed up the actual download. Now the backend rewrites download URLs to match whichever mirror succeeded.</p>
+                  <p>Ships with two defaults: Server 1 (tx1138) and Server 2 (VPS). Add the URL format <code>https://host/.../releases/manifest.json</code> for custom mirrors.</p>
+                </div>
+              </div>
+              <!-- v1.7.25-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.25-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Your node can now reach the broader FIPS public mesh, not just your own federated cluster. The FIPS daemon now binds both UDP (fast mesh forwarding) and TCP (NAT-friendly bootstrap) transports — matching the upstream factory default. The public anchor currently answers on TCP, so UDP-only nodes couldn't reach it; this fixes that without any action needed on your end.</p>
+                  <p>Upgrading the config happens automatically. On next startup, if the installed FIPS yaml doesn't match the new two-transport schema, the node reinstalls and restarts the daemon so the TCP transport comes online. No manual Reconnect required.</p>
+                  <p>Side benefit: TCP also helps on networks that block outbound UDP (corporate, some guest wifi) — your node falls back to TCP/8443 automatically and still joins the mesh.</p>
+                </div>
+              </div>
+              <!-- v1.7.24-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.24-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Frontend updates now actually ship. Since roughly v1.7.17 the release pipeline had been rebuilding the backend every version but silently skipping the frontend bundle — a permissions issue on the build server meant vue-tsc failed before vite ever ran, and nobody noticed because the published tarballs still extracted cleanly. The result was the backend moving forward while the UI stayed frozen at its v1.7.9-era state, which is why the FIPS gear icon and the What's New entries for every release since then had been missing on your node.</p>
+                  <p>Once this update applies, your node gets the real v1.7.24 frontend: the FIPS Seed Anchors modal (gear icon on the FIPS Mesh card), the current What's New history, the cancel-download button, and every other UI touch from the releases in between.</p>
+                </div>
+              </div>
+              <!-- v1.7.23-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.23-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>FIPS Seed Anchors are now one click away. A small gear icon sits next to the status pill on the FIPS Mesh card — click it to open a modal where you can add, remove, and re-apply anchors. No more needing to go digging for the card or editing JSON by hand.</p>
+                  <p>The modal lists each anchor with its label, truncated npub, address, and transport, plus an Apply button to force-redial the full list and a Remove button per entry. The add form right below validates that the address is host:port and the npub is bech32 before saving.</p>
+                </div>
+              </div>
+              <!-- v1.7.22-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.22-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>The FIPS Reconnect and Restart buttons now work on every node, regardless of which systemd unit is actually supervising the daemon. Previously they targeted only the archipelago-managed unit — nodes that were running the upstream unit instead saw the buttons silently do nothing. Both paths now auto-detect which unit is up and act on that one.</p>
+                  <p>The FIPS anchor status no longer shows red just because one specific public anchor is unreachable. It now lights green whenever any authenticated peer is a recognised anchor — that's either the public anchor or something you added under Seed Anchors. A federated cluster that routes through its own seed anchor finally reports the truth.</p>
+                  <p>Reconnect also re-pushes your seed anchors after the restart, so you don't have to wait five minutes for the background apply loop to re-dial them.</p>
+                </div>
+              </div>
               <!-- v1.7.21-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">

neode-ui/src/views/settings/AppRegistriesSection.vue

@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { RouterLink } from 'vue-router'
+</script>
+
+<template>
+  <!-- App Registries Section -->
+  <div class="glass-card px-6 py-6 mb-6">
+    <div class="flex items-center justify-between">
+      <div>
+        <h2 class="text-xl font-semibold text-white/96">App registries</h2>
+        <p class="text-sm text-white/60 mt-1">
+          Choose the primary registry for app installs and add mirrors for fallback.
+        </p>
+      </div>
+      <RouterLink
+        to="/dashboard/settings/registries"
+        class="glass-button px-4 py-2 rounded-lg text-sm flex items-center gap-2"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+            d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1M12 12V3m0 0l-4 4m4-4l4 4" />
+        </svg>
+        Manage registries
+      </RouterLink>
+    </div>
+  </div>
+</template>

neode-ui/src/views/settings/SystemDangerZone.vue

@@ -1,8 +1,10 @@
 <script setup lang="ts">
-import { ref } from 'vue'
+import { ref, computed, onBeforeUnmount } from 'vue'
 import { useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
 import { rpcClient } from '@/api/rpc-client'
+import ScreensaverRing from '@/components/ScreensaverRing.vue'
+import ScreensaverLogo from '@/components/ScreensaverLogo.vue'
 
 const router = useRouter()
 const { t } = useI18n()
@@ -13,6 +15,59 @@ const rebooting = ref(false)
 const rebootPassword = ref('')
 const rebootError = ref('')
 
+// Reboot overlay — full-screen progress shown once the reboot is committed.
+// Mirrors the update overlay pattern in SystemUpdate.vue: poll /health,
+// auto-reload when the backend returns, stall fallback at 3 min.
+type RebootStage = 'rebooting' | 'reconnecting' | 'ready' | 'stalled'
+const rebootOverlay = ref(false)
+const rebootStage = ref<RebootStage>('rebooting')
+const rebootStartedAt = ref(0)
+const rebootElapsedSec = ref(0)
+let rebootPollTimer: ReturnType<typeof setInterval> | null = null
+let rebootElapsedTimer: ReturnType<typeof setInterval> | null = null
+const rebootElapsedLabel = computed(() => {
+  const s = rebootElapsedSec.value
+  if (s < 60) return `Elapsed: ${s}s`
+  return `Elapsed: ${Math.floor(s / 60)}m${s % 60 < 10 ? '0' : ''}${s % 60}s`
+})
+
+function startRebootOverlay() {
+  rebootOverlay.value = true
+  rebootStage.value = 'rebooting'
+  rebootStartedAt.value = Date.now()
+  rebootElapsedSec.value = 0
+  rebootElapsedTimer = setInterval(() => {
+    rebootElapsedSec.value = Math.floor((Date.now() - rebootStartedAt.value) / 1000)
+    if (rebootElapsedSec.value >= 180 && rebootStage.value !== 'ready') {
+      rebootStage.value = 'stalled'
+    }
+  }, 1000)
+  // Start health polling after 2.5s — the kernel has to go down before
+  // /health can disappear, and we don't want to see the pre-reboot health
+  // reply and mis-report "ready".
+  setTimeout(() => {
+    rebootStage.value = 'reconnecting'
+    rebootPollTimer = setInterval(pollRebootHealth, 1500)
+  }, 2500)
+}
+async function pollRebootHealth() {
+  if (rebootStage.value === 'ready' || rebootStage.value === 'stalled') return
+  try {
+    const res = await fetch('/health', { signal: AbortSignal.timeout(2000) })
+    if (!res.ok) throw new Error(`health ${res.status}`)
+    rebootStage.value = 'ready'
+    if (rebootPollTimer) { clearInterval(rebootPollTimer); rebootPollTimer = null }
+    setTimeout(() => { window.location.reload() }, 1200)
+  } catch {
+    // Fetch failing is the normal state while the host is down.
+  }
+}
+function rebootReloadNow() { window.location.reload() }
+onBeforeUnmount(() => {
+  if (rebootPollTimer) clearInterval(rebootPollTimer)
+  if (rebootElapsedTimer) clearInterval(rebootElapsedTimer)
+})
+
 async function performReboot() {
   if (!rebootPassword.value) return
   rebooting.value = true
@@ -21,6 +76,7 @@ async function performReboot() {
     await rpcClient.call({ method: 'system.reboot', params: { password: rebootPassword.value } })
     showRebootConfirm.value = false
     rebootPassword.value = ''
+    startRebootOverlay()
   } catch (e) {
     rebootError.value = e instanceof Error ? e.message : 'Reboot failed'
     rebooting.value = false
@@ -108,6 +164,55 @@ async function performFactoryReset() {
     </div>
   </Teleport>
 
+  <!-- Reboot Progress Overlay -->
+  <Teleport to="body">
+    <Transition name="fade">
+      <div
+        v-if="rebootOverlay"
+        class="fixed inset-0 z-[3000] bg-black flex flex-col items-center justify-center overflow-hidden"
+      >
+        <!-- Centered animated ring + logo — same composition as the screensaver -->
+        <div class="reboot-ring-content">
+          <ScreensaverRing />
+          <div class="reboot-logo-wrapper">
+            <ScreensaverLogo />
+          </div>
+        </div>
+
+        <!-- Stage text + progress bar underneath -->
+        <div class="mt-8 w-[min(520px,80vw)] text-center">
+          <h2 class="text-xl font-semibold text-white mb-1">
+            {{ rebootStage === 'rebooting' ? 'Rebooting…'
+             : rebootStage === 'reconnecting' ? 'Reconnecting to your node…'
+             : rebootStage === 'ready' ? 'Back online'
+             : 'Reboot is taking longer than expected' }}
+          </h2>
+          <p class="text-sm text-white/60 mb-4">
+            Your node is restarting. This page will refresh automatically once it's back.
+          </p>
+
+          <!-- Animated progress bar: indeterminate stripe while working,
+               solid green when ready, paused at half while stalled. -->
+          <div class="w-full h-2 bg-white/10 rounded-full overflow-hidden mb-3 relative">
+            <div v-if="rebootStage === 'ready'" class="absolute inset-0 bg-green-400"></div>
+            <div v-else-if="rebootStage === 'stalled'" class="absolute inset-y-0 left-0 w-1/2 bg-orange-400/60"></div>
+            <div v-else class="absolute inset-y-0 w-1/3 bg-orange-400 rounded-full reboot-overlay-bar-anim"></div>
+          </div>
+
+          <p class="text-xs text-white/40">{{ rebootElapsedLabel }}</p>
+
+          <button
+            v-if="rebootStage === 'stalled'"
+            @click="rebootReloadNow"
+            class="mt-5 glass-button rounded-lg px-5 py-2 text-sm font-medium bg-orange-500/20 border-orange-400/30"
+          >
+            Reload now
+          </button>
+        </div>
+      </div>
+    </Transition>
+  </Teleport>
+
   <!-- Factory Reset Section -->
   <div class="glass-card px-6 py-6 mb-6 border border-red-500/30">
     <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-3">
@@ -148,3 +253,37 @@ async function performFactoryReset() {
     </div>
   </Teleport>
 </template>
+
+<style scoped>
+.fade-enter-active,
+.fade-leave-active {
+  transition: opacity 0.3s ease;
+}
+.fade-enter-from,
+.fade-leave-to {
+  opacity: 0;
+}
+
+.reboot-ring-content {
+  position: relative;
+  display: grid;
+  place-items: center;
+}
+.reboot-logo-wrapper {
+  position: absolute;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  z-index: 10;
+  filter: drop-shadow(0 0 40px rgba(255, 255, 255, 0.15));
+}
+
+.reboot-overlay-bar-anim {
+  animation: rebootBarSlide 1.8s ease-in-out infinite;
+}
+@keyframes rebootBarSlide {
+  0%   { transform: translateX(-100%); }
+  50%  { transform: translateX(120%); }
+  100% { transform: translateX(300%); }
+}
+</style>

neode-ui/src/views/settings/SystemSection.vue

@@ -3,6 +3,7 @@ import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import SystemUpdatesSection from '@/views/settings/SystemUpdatesSection.vue'
+import AppRegistriesSection from '@/views/settings/AppRegistriesSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
 import TelemetrySection from '@/views/settings/TelemetrySection.vue'
 import BackupSection from '@/views/settings/BackupSection.vue'
@@ -14,6 +15,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
   <ClaudeAuthSection />
   <AIDataAccessSection />
   <SystemUpdatesSection />
+  <AppRegistriesSection />
   <WebhookSection />
   <TelemetrySection />
   <BackupSection />

neode-ui/vite.config.ts

@@ -94,7 +94,7 @@ export default defineConfig({
             urlPattern: /\/assets\/.*/i,
             handler: 'CacheFirst',
             options: {
-              cacheName: 'assets-cache-v2',
+              cacheName: 'assets-cache-v3',
               expiration: {
                 maxEntries: 100,
                 maxAgeSeconds: 60 * 60 * 24 * 30 // 30 days

scripts/first-boot-containers.sh

@@ -1216,44 +1216,6 @@ if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'str
   fi
 fi
 
-# 8b. Indeehub (pull from registry, or use local build)
-if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q indeedhub; then
-  # Use image-versions.sh variable if sourced, otherwise detect
-  if [ -z "${INDEEDHUB_IMAGE:-}" ]; then
-    INDEEDHUB_IMAGE=""
-    # Try local image first (pre-built or loaded from ISO)
-    if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'localhost/indeedhub'; then
-      INDEEDHUB_IMAGE="localhost/indeedhub:local"
-    # Try pinned registry image
-    elif $DOCKER pull "$ARCHY_REGISTRY/indeedhub:1.0.0" --tls-verify=false 2>>"$LOG"; then
-      INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"
-    fi
-  fi
-  if [ -n "$INDEEDHUB_IMAGE" ]; then
-    log "Creating Indeehub from $INDEEDHUB_IMAGE..."
-    $DOCKER run -d --name indeedhub --restart unless-stopped \
-      --network archy-net --network-alias indeedhub \
-      --health-cmd="curl -sf http://localhost:7777/health || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
-      --memory=$(mem_limit indeedhub) \
-      --cap-drop ALL --security-opt no-new-privileges:true \
-      --tmpfs /tmp:rw,noexec,nosuid,size=64m \
-      -p 7778:7777 \
-      "$INDEEDHUB_IMAGE" 2>>"$LOG" || true
-    # Fix IndeedHub for iframe: remove X-Frame-Options so it loads in Archipelago panel
-    sleep 2
-    if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q "^indeedhub$"; then
-      $DOCKER exec indeedhub sed -i "/X-Frame-Options/d" /etc/nginx/conf.d/default.conf 2>/dev/null || true
-      # Fix Host header for NIP-98 auth — $host strips port, $http_host preserves it
-      $DOCKER exec indeedhub sed -i 's|proxy_set_header Host $host;|proxy_set_header Host $http_host;|g' /etc/nginx/conf.d/default.conf 2>/dev/null || true
-      if [ -f /opt/archipelago/web-ui/nostr-provider.js ]; then
-        $DOCKER cp /opt/archipelago/web-ui/nostr-provider.js indeedhub:/usr/share/nginx/html/nostr-provider.js 2>/dev/null || true
-      fi
-      $DOCKER exec indeedhub nginx -s reload 2>/dev/null || true
-      log "Applied IndeedHub iframe fix (X-Frame-Options, Host header, nostr-provider)"
-    fi
-  fi
-fi
-
 # 9. Custom UI containers (bitcoin-ui, lnd-ui)
 # These are built from Dockerfiles in /opt/archipelago/docker/ or loaded from pre-built images.