fix(ecash): reduce Minibits relay churn/privacy leak and page past a 200-DM claim backlog

fetch_relay_dms connected to all three CLAIM_RELAY_URLS (the Minibits relay plus the two public fallbacks, relay.damus.io and nos.lol) on every 8s poll, even though the module's own docs already described RELAY_URL as the primary with the public relays meant only as a fallback. In practice this meant 3 fresh WebSocket connections every poll and broadcasting the wallet's derived Nostr pubkey's DM activity to two public relays it didn't need to touch. - Query RELAY_URL alone first; only add and query the public fallbacks when it's unreachable (via try_connect_relay). Happy path is now one connection per poll instead of three, and the public relays only see this pubkey's traffic when the primary is actually down. - Page through the DM filter instead of a single limit(200) fetch: a relay returns the newest `limit` events for a filter, so a backlog of more than 200 DMs since the last poll (e.g. a long-offline node) silently skipped the older ones forever, since `since` never advanced past them. Capped at 5 pages so a relay that never stops returning full pages can't hang the poll. - Moved the ensure_mint_accepted doc comment back above its own function — it had been glued onto fetch_relay_dms by an earlier edit. - Timestamp::as_u64() -> as_secs() to clear the deprecation warning. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZnFgeUBKY5UAfyJFsYccS
fix(ecash): guard Minibits claim polls against races and stop replayed claims retrying forever
2026-09-09 03:57:49 +00:00 · 2026-09-09 03:50:34 +00:00 · 2026-09-08 22:23:56 +00:00 · 2026-09-08 16:25:37 +00:00 · 2026-09-08 16:19:52 +00:00 · 2026-09-08 15:46:12 +00:00
111 changed files with 4567 additions and 5237 deletions
@@ -1,5 +1,47 @@
 # Changelog

+## v1.8.11-alpha (2026-09-07)
+
+- **Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.
+
+- **OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.
+
+- **Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links.
+
+## v1.8.10-alpha (2026-09-02)
+
+- **Lightning sends work again — v1.8.9's payment switch lost the fee budget.** Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as **zero allowed fees**: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered "No route to the recipient" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (`fee_limit=0 mSAT` on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.
+
+- **A channel that drops its peer link now heals itself — on every node.** Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails "no route to the recipient". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.
+
+- **The Lightning wallet states the node's real funding state instead of "you have no channel."** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the *receiving* copy. The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance.
+
+## v1.8.9-alpha (2026-09-01)
+
+- **Lightning sends work again after the LND 0.21.2 update.** LND 0.21 removed the old synchronous payment route the node's backend paid through (`/v1/channels/transactions`) — every Lightning send answered the literal "Not Found" and the wallet showed "Payment failed: Not Found". The backend now pays through the supported Router.SendPaymentV2 route, keeps the same settle-then-report behaviour (a slow multi-hop payment is still tracked to completion, never falsely declared failed), and translates LND's failure reasons into plain advice. A new gate test speaks the payment route directly against the running LND, so an image/backend skew like this can never ship silently again.
+
+- **The node no longer pins HSTS — HTTP access is a supported mode, and it stays working.** The HTTPS listener used to send `Strict-Transport-Security: max-age=31536000; includeSubDomains`; browsers that visited HTTPS once cached that and then silently upgraded the still-open HTTP dashboard's calls to HTTPS, which is a scheme change — cross-origin — so every request died as "CORS blocked / Failed to fetch" while the node was perfectly healthy. The HTTPS listener now actively clears the cached policy (`max-age=0`) and port 80 sends no HSTS at all, which is deliberate: the node's certificate is optional and self-signed, and devices that haven't installed the CA must keep plain-HTTP access (that's what Settings → Node certificate is for). If your browser already cached the old policy, visiting the dashboard over HTTPS once after this update clears it; a gate test now refuses any config that reintroduces the pin.
+
+- **App frames open over HTTPS again — including the ones that "did not connect."** The launcher asked the signed catalog for each app's port policy under the name you click ("Mempool Web", "Bitcoin Knots"), but the catalog declares those ports under the manifest that owns them (the Mempool web container, Bitcoin UI). The lookup missed, the launcher handed the iframe an `http://` address, and the browser blocked it as mixed content — the app tile went blank or spun forever. Port resolution now follows launch aliases (mempool-web, bitcoin-knots/bitcoin-core, lnd, electrs and friends), falls back to a port-wide catalog scan when the id is unknown, and the catalog is warmed as soon as the dashboard loads rather than only in the App Store, so the very first app you open already knows which ports serve TLS.
+
+- **Signing in to IndeeHub with Nostr works over HTTPS.** The NIP-07 bridge compared the app frame's origin for exact equality with the recorded `http://` app URL — a frame the browser upgraded to HTTPS (or any scheme change) was silently ignored, and replies addressed to the stale origin were refused outright, so Nostr sign-in quietly did nothing. The bridge now matches host and port (scheme intentionally ignored) and always replies to the frame's real origin.
+
+- **Nginx Proxy Manager starts again.** Converting it to a platform manifest dropped two things its image needs: the `/etc/letsencrypt` mount its boot script hard-requires, and the `NET_BIND_SERVICE` capability its internal nginx needs to bind ports 80/443/81 under the orchestrator's `--cap-drop=ALL`. The result was an endless start/die loop (a node watched it restart 3,176 times). Both are declared in its manifest now, its certs live on unchanged under the same persistent app directory, and the signed catalog carries the fix so installed nodes heal on the next update.
+
+- **Portainer's first-run token is in the app page, not buried in "server logs."** New Portainer versions mint a one-time setup token on a fresh install and print it only to the container logs — on an appliance that meant telling the user to go read a server log to get into their own app. The token now appears in the same launch interstitial as app login credentials (with a copy button), only while first-run setup is actually pending; once the admin account exists the card disappears on its own.
+
+- **The Lightning wallet states the node's real funding state instead of "you have no channel."** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had no channel at all (the outbound sum is legitimately zero in both states). The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of pointing at channel setup, and only a genuinely channel-less node is sent to open one.
+
+## v1.8.8-alpha (2026-09-01)
+
+- **SSH over the mesh is now a first-class setting.** Settings gains an "SSH over mesh" card: off by default, and when you allow it the node's mesh firewall opens port 22 — either to every mesh peer (behind an explicit "I understand" confirmation, because that's a real exposure) or only to the mesh addresses you list. The rule is owned by the node (the `90-ssh.nft` drop-in), so it survives upgrades and daemon reinstalls, and the card tells you up front whether sshd is running, whether it listens on IPv6 (the mesh is IPv6-only — this is what a broken attempt looks like before it happens), and whether password login is on (keys-only is the recommended pairing). From Termux on your phone, `fipssh <user>@<node-npub>` connects once the toggle is on — the npub is the durable address, and the command is shown with a copy button on the card.
+
+- **The App Store now lists apps — not parts of apps.** The signed catalog carries every manifest because the node's update layer needs their pins, and the store briefly listed them all: Mempool API, LND UI, Bitcoin UI, the Pine voice engines, the IndeeHub and Immich backends, the mesh router and friends. Components are hidden from the store listing (they still appear where they belong — the Services tab of My Apps, once installed), and four entries that never earned a tile are gone outright: MorphOS server (old), the Web5 DID wallet, Lightning Stack (an untracked upstream bundle — LND covers the need), and CryptPad (never tested).
+
+- **App icons now persist everywhere, in the proper container style.** Two fixes: installed apps render the icon from their own manifest — Cuprate no longer falls back to the generic A-mark on its Services tile — and the store grids (the Discover page) apply the same icon container treatment (backdrop, border, shadow) as My Apps, the detail pages, and Home. Manifest-declared UI apps also classify correctly again: Alby Hub installs into My Apps with a working tile, not into Services, because a probe miss no longer buries an app the manifest itself says has a frontend.
+
+- **Installing from the store keeps you on the store page.** The install progress lives on the tile itself and the app appears in My Apps when it lands — no more being yanked to My Apps mid-browse.
+
 ## v1.8.7-alpha (2026-08-31)

 - **What's New really does stop at v1.8.0 now.** The first correction removed old generated release blocks but missed six much older hand-written v1.2 sections at the bottom of the modal. Those sections are gone, and the release check now recognizes and rejects that legacy format too, so the history floor cannot falsely pass again.
@@ -13,20 +13,20 @@
    {
      "id": "adguardhome",
      "title": "AdGuard Home",
-      "version": "v0.107.55",
+      "version": "v0.107.79",
      "description": "Network-wide ad and tracker blocking: a DNS server that filters every device on your LAN, with a web console for rules and client management.",
      "icon": "",
      "author": "AdGuard",
      "category": "networking",
      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
      "repoUrl": "https://github.com/AdguardTeam/AdGuardHome"
    },
    {
      "id": "alby-hub",
      "title": "Alby Hub",
      "version": "1.23.0",
-      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect \u2014 one hub, every app pays through it.",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
      "icon": "/assets/img/app-icons/alby-hub.svg",
      "author": "Alby",
      "category": "money",
@@ -117,18 +117,6 @@
        "bitcoin-knots"
      ]
    },
-    {
-      "id": "cryptpad",
-      "title": "CryptPad",
-      "version": "2024.12.0",
-      "description": "End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.",
-      "icon": "/assets/icon/favico-black-v2.svg",
-      "author": "XWiki SAS",
-      "category": "data",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0",
-      "repoUrl": "https://github.com/cryptpad/cryptpad"
-    },
    {
      "id": "cuprate",
      "title": "Cuprate",
@@ -203,13 +191,13 @@
    {
      "id": "filebrowser",
      "title": "File Browser",
-      "version": "2.27.0",
+      "version": "2.63.23",
      "description": "Baseline Archipelago file manager service.",
      "icon": "/assets/img/app-icons/file-browser.webp",
      "author": "File Browser",
      "category": "data",
      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23",
      "repoUrl": "https://github.com/filebrowser/filebrowser",
      "containerConfig": {
        "ports": [
@@ -230,12 +218,12 @@
    {
      "id": "gitea",
      "title": "Gitea",
-      "version": "1.23",
+      "version": "1.27.3",
      "description": "Self-hosted Git service with built-in container registry, CI/CD, and package hosting.",
      "icon": "/assets/img/app-icons/gitea.svg",
      "author": "Gitea",
      "category": "development",
-      "dockerImage": "docker.io/gitea/gitea:1.23",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gitea:1.27.3",
      "repoUrl": "https://gitea.com",
      "containerConfig": {
        "ports": [
@@ -286,12 +274,12 @@
    {
      "id": "homeassistant",
      "title": "Home Assistant",
-      "version": "2026.7.3",
+      "version": "2026.8.3",
      "description": "Open source home automation platform. Control and monitor your smart home devices.",
      "icon": "/assets/img/app-icons/homeassistant.png",
      "author": "Home Assistant",
      "category": "home",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3",
      "repoUrl": "https://github.com/home-assistant/core",
      "containerConfig": {
        "ports": [
@@ -350,13 +338,13 @@
    {
      "id": "lnd",
      "title": "LND",
-      "version": "0.18.4",
+      "version": "0.21.2",
      "description": "Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.",
      "icon": "/assets/img/app-icons/lnd.png",
      "author": "Lightning Labs",
      "category": "money",
      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta",
      "repoUrl": "https://github.com/lightningnetwork/lnd",
      "requires": [
        "bitcoin-knots"
@@ -382,7 +370,7 @@
      "id": "netbird",
      "title": "NetBird",
      "version": "2.38.0",
-      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point \u2014 a TLS proxy in front of the dashboard + server.",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
      "icon": "/assets/img/app-icons/netbird.svg",
      "author": "NetBird",
      "category": "networking",
@@ -424,7 +412,7 @@
      "id": "nginx-proxy-manager",
      "title": "Nginx Proxy Manager",
      "version": "2.12.1",
-      "description": "Reverse proxy with SSL. Beautiful web interface for managing proxies. On a node, this manages its admin UI and upstream configuration \u2014 the proxy's own :80/:443 listeners are not published (the node's web server owns those ports).",
+      "description": "Reverse proxy with SSL. Beautiful web interface for managing proxies. On a node, this manages its admin UI and upstream configuration — the proxy's own :80/:443 listeners are not published (the node's web server owns those ports).",
      "icon": "/assets/img/app-icons/nginx.svg",
      "author": "Nginx Proxy Manager",
      "category": "networking",
@@ -460,7 +448,7 @@
      "id": "ollama",
      "title": "Ollama",
      "version": "0.5.4",
-      "description": "Run large language models locally. Download and run AI models like Llama, Mistral on your own hardware \u2014 served on the node's loopback for the AI assistant (Settings \u2192 Claude Auth \u2192 model backend), never exposed to the network.",
+      "description": "Run large language models locally. Download and run AI models like Llama, Mistral on your own hardware — served on the node's loopback for the AI assistant (Settings → Claude Auth → model backend), never exposed to the network.",
      "icon": "/assets/img/app-icons/ollama.png",
      "author": "Ollama",
      "category": "community",
@@ -472,7 +460,7 @@
      "id": "phoenixd",
      "title": "phoenixd",
      "version": "0.9.0",
-      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own \u2014 it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
      "icon": "/assets/img/app-icons/phoenixd.svg",
      "author": "ACINQ",
      "category": "money",
@@ -507,7 +495,7 @@
      "id": "pine",
      "title": "Pine",
      "version": "1.3.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node \u2014 block height, sync, peers, Lightning balance \u2014 and, when a Claude API key is set, anything else.",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
      "icon": "/assets/img/app-icons/pine.svg",
      "author": "Archipelago",
      "category": "home",
@@ -517,13 +505,13 @@
    {
      "id": "portainer",
      "title": "Portainer",
-      "version": "2.19.4",
+      "version": "2.45.0",
      "description": "Container management web UI for the local Podman socket.",
      "icon": "/assets/img/app-icons/portainer.webp",
      "author": "Portainer",
      "category": "development",
      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.45.0",
      "repoUrl": "https://github.com/portainer/portainer",
      "containerConfig": {
        "ports": [
@@ -615,13 +603,13 @@
    {
      "id": "vaultwarden",
      "title": "Vaultwarden",
-      "version": "1.30.0",
+      "version": "1.37.2",
      "description": "Self-hosted password vault with zero-knowledge encryption.",
      "icon": "/assets/img/app-icons/vaultwarden.webp",
      "author": "Vaultwarden",
      "category": "data",
      "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine",
      "repoUrl": "https://github.com/dani-garcia/vaultwarden",
      "containerConfig": {
        "ports": [
@@ -1,7 +1,7 @@
 app:
  id: adguardhome
  name: AdGuard Home
-  version: v0.107.55
+  version: v0.107.79
  upstream:
    kind: github
    repo: AdguardTeam/AdGuardHome
@@ -10,7 +10,7 @@ app:
    device on your LAN, with a web console for rules and client management.

  container:
-    image: source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55
+    image: source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79
    pull_policy: if-not-present
    network: pasta

@@ -28,10 +28,13 @@ app:
    network_policy: isolated

  ports:
-    - host: 3000
+    - host: 3030
      container: 3000
      protocol: tcp
      bind: 127.0.0.1
+      # 3030, not AdGuard Home's conventional 3000: Grafana owns :3000 on a
+      # node, and both being installable means the host ports must not
+      # collide (the orchestrator refuses/loads warn on overlap).
      # open: the setup wizard and admin console carry AdGuard Home's own
      # login; the gate fronts the port (TLS, header fixes) without a
      # second cookie challenge.
@@ -67,7 +70,7 @@ app:

  health_check:
    type: tcp
-    endpoint: localhost:3000
+    endpoint: localhost:3030
    interval: 30s
    timeout: 5s
    retries: 3
@@ -77,7 +80,7 @@ app:
      name: Admin console
      description: AdGuard Home web console
      type: ui
-      port: 3000
+      port: 3030
      protocol: http
      path: /

@@ -1,67 +0,0 @@
-app:
-  id: cryptpad
-  name: CryptPad
-  version: 2024.12.0
-  upstream:
-    kind: github
-    repo: cryptpad/cryptpad
-  description: End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.
-
-  container:
-    image: source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0
-    pull_policy: if-not-present
-    network: pasta
-
-  dependencies:
-    - storage: 5Gi
-
-  resources:
-    memory_limit: 1Gi
-    disk_limit: 5Gi
-
-  security:
-    capabilities: []
-    readonly_root: false
-    no_new_privileges: true
-    network_policy: isolated
-
-  ports:
-    - host: 3000
-      container: 3000
-      protocol: tcp
-      bind: 127.0.0.1
-      # gated: CryptPad is browser-only (its own per-user accounts sit on top
-      # of the node login, exactly like Vaultwarden), so the gate's session
-      # challenge costs nothing and keeps the pads behind the node login.
-      auth: gated
-
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/cryptpad
-      target: /cryptpad/data
-      options: [rw]
-
-  environment: []
-
-  health_check:
-    type: tcp
-    endpoint: localhost:3000
-    interval: 30s
-    timeout: 5s
-    retries: 3
-
-  interfaces:
-    main:
-      name: CryptPad
-      description: Encrypted collaboration suite
-      type: ui
-      port: 3000
-      protocol: http
-      path: /
-
-  metadata:
-    author: XWiki SAS
-    category: data
-    icon: /assets/icon/favico-black-v2.svg
-    repo: https://github.com/cryptpad/cryptpad
-    tier: optional
@@ -45,7 +45,12 @@ app:

  resources:
    cpu_limit: 0
-    memory_limit: 4Gi
+    # Raised from 4Gi alongside target_max_memory below (see files[] comment)
+    # — 2026-09-03 incident: a 4Gi/3GB-cache config starved
+    # cuprated's DB cache into constant eviction/flush, driving 45% sustained
+    # CPU and ~595GB/24h of block I/O on a fully-synced node. 10Gi leaves
+    # headroom above the 8GiB cache for the process itself.
+    memory_limit: 10Gi
    disk_limit: 300Gi

  security:
@@ -82,17 +87,21 @@ app:
    # bind without an explicit i_know_what_im_doing override.
    # Restricted RPC: Monero's own purpose-built safe-for-public subset —
    # what wallets use when connecting to a "remote node". Disabled by
-    # cuprated's own default; enabled via files[] below. A dashboard login
-    # would break wallet clients connecting programmatically, same
-    # reasoning as electrumx's port. The daemon still uses its canonical
-    # container port 18089, but Penpot already owns host port 18089, so this
-    # maps the public host port to the free 18090 instead.
+    # cuprated's own default; enabled via files[] below. `open`, not `gated`:
+    # the gate still takes the port over (loopback pin, external binds,
+    # fronts the Tor onion) but skips the dashboard login challenge, same
+    # reasoning as electrumx's port — wallet clients (Feather,
+    # monero-wallet-rpc, GUI) speak plain HTTP JSON-RPC programmatically and
+    # cannot complete a browser login or hold a session cookie. The daemon
+    # still uses its canonical container port 18089, but Penpot already owns
+    # host port 18089, so this maps the public host port to the free 18090
+    # instead.
    - host: 18090
      container: 18089
      protocol: tcp
-      auth: none
+      auth: open
      auth_rationale: >-
-        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.
+        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.

  volumes:
    - type: bind
@@ -103,11 +112,23 @@ app:
  # Settings that need to differ from cuprated's own documented defaults
  # (verified against `cuprated --generate-config` and `--dry-run` locally,
  # 2026-08-21):
+  #   - fast_sync: cuprated's own default is false, which performs full
+  #     cryptographic verification (ring signatures + RandomX PoW) on every
+  #     incoming block instead of trusting checkpointed history. Root-caused
+  #     2026-09-03 as the dominant cause of a sustained 45% CPU node,
+  #     vs. 2.8% on a reference node with fast_sync = true — same chain height, same
+  #     block rate. Set explicitly rather than relying on the binary
+  #     default so fresh deploys don't silently regress into full-verify.
  #   - target_max_memory: cuprated's own default auto-detects total *host*
  #     RAM via sysinfo, which inside a memory-limited container would let
  #     it size caches far past what resources.memory_limit above actually
  #     grants — same class of problem bitcoin-knots' -dbcache sizing
-  #     comment addresses. Set explicitly, comfortably under the 4Gi limit.
+  #     comment addresses. Set explicitly, comfortably under the 10Gi limit.
+  #     Previously 3000000000 (~2.8GiB); that starved the DB cache and
+  #     forced constant eviction/flush (595GB/24h block I/O on a node just
+  #     appending ~2MB blocks every 2 minutes) — raised to 8GiB, matching
+  #     the healthy reference node, and
+  #     resources.memory_limit above raised in step to keep headroom above it.
  #   - rpc.restricted.enable: cuprated ships this off by default; flip on
  #     so the auth:none host port above actually serves something instead
  #     of refusing every connection. port stays at its documented default
@@ -125,14 +146,34 @@ app:
  #     uses for its own RPC port (-rpcbind=0.0.0.0:8332 internally, gate
  #     restricts it externally) — not a new risk, the same one already
  #     reviewed and accepted for Bitcoin's RPC.
+  #   - tracing.stdout.level / tracing.file.{level,max_log_files}: an
+  #     operator reading Cuprated.toml on disk should be able to see and
+  #     tune the log level directly instead of the file silently omitting
+  #     the whole [tracing] table (verified live on the affected node
+  #     2026-09-01: the deployed file had no [tracing] section at all, and
+  #     the level was only discoverable by running `cuprated
+  #     --generate-config` and diffing). file.level is set to "info", NOT
+  #     cuprated's own raw default of "debug" — matches the reference dev
+  #     config this app was built and tested against (verified 2026-09-01),
+  #     which deliberately runs file logging quieter
+  #     than the binary default. max_log_files similarly follows that
+  #     reference (14, not the binary default of 7).
  files:
    - path: /var/lib/archipelago/cuprate/Cuprated.toml
      content: |
        network = "Mainnet"
-        target_max_memory = 3000000000
+        fast_sync = true
+        target_max_memory = 8589934592

        [rpc.restricted]
        enable = true
+
+        [tracing.stdout]
+        level = "info"
+
+        [tracing.file]
+        level = "info"
+        max_log_files = 14
      overwrite: false

  health_check:
@@ -1,6 +0,0 @@
-node_modules
-dist
-*.log
-.git
-.gitignore
-README.md
@@ -1,39 +0,0 @@
-FROM node:20-alpine AS builder
-
-WORKDIR /app
-
-# Copy package files
-COPY package*.json ./
-RUN npm ci
-
-# Copy source code
-COPY . .
-
-# Build the application
-RUN npm run build
-
-# Production stage
-FROM node:20-alpine
-
-WORKDIR /app
-
-# Copy built application
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/package.json ./
-COPY --from=builder /app/public ./public
-
-# Create non-root user
-RUN addgroup -g 1000 appuser && \
-    adduser -D -u 1000 -G appuser appuser && \
-    mkdir -p /app/wallet && \
-    chown -R appuser:appuser /app
-
-USER appuser
-
-EXPOSE 8080
-
-ENV WALLET_STORAGE=/app/wallet
-ENV DWN_ENDPOINT=http://web5-dwn:3000
-
-CMD ["node", "dist/index.js"]
@@ -1,35 +0,0 @@
-# DID Wallet
-
-Web5 wallet with Decentralized Identifier (DID) support.
-
-## Building
-
-```bash
-# From the apps directory
-./build.sh did-wallet
-
-# Or manually
-cd did-wallet
-docker build -t archipelago/did-wallet:latest .
-```
-
-## Development
-
-```bash
-cd did-wallet
-npm install
-npm run dev
-```
-
-## Ports
-
- **8083**: Web UI (dev: 18083)
-
-## Running Locally
-
-```bash
-docker run -p 8083:8080 \
-  -v /tmp/archipelago-dev/did-wallet:/app/wallet \
-  -e DWN_ENDPOINT=http://localhost:13000 \
-  archipelago/did-wallet:latest
-```
@@ -1,59 +0,0 @@
-app:
-  id: did-wallet
-  name: Web5 DID Wallet
-  version: 1.0.0
-  # Built by this project — there is no upstream release feed to watch.
-  upstream:
-    kind: internal
-  description: Web5 wallet with Decentralized Identifier (DID) support. Manage your digital identity and Web5 assets.
-  
-  container:
-    image: archipelago/did-wallet:1.0.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - storage: 2Gi
-    
-  resources:
-    cpu_limit: 1
-    memory_limit: 512Mi
-    disk_limit: 2Gi
-    
-  security:
-    capabilities: []
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: did-wallet
-    
-  ports:
-    - host: 8088
-      container: 8080
-      protocol: tcp  # Web UI
-      bind: 127.0.0.1
-      auth: gated
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/did-wallet
-      target: /app/wallet
-      options: [rw]
-      
-  environment:
-    - WALLET_STORAGE=/app/wallet
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /health
-    interval: 30s
-    timeout: 5s
-    retries: 3
-    
-  web5_integration:
-    did_support: true
-    wallet_functionality: true
-    bitcoin_integration: true
@@ -1,21 +0,0 @@
-{
-  "name": "did-wallet",
-  "version": "1.0.0",
-  "description": "Web5 DID Wallet for Archipelago",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts"
-  },
-  "dependencies": {
-    "express": "^4.18.2",
-    "@web5/api": "^0.9.0"
-  },
-  "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.10.0",
-    "typescript": "^5.3.3",
-    "ts-node": "^10.9.2"
-  }
-}
@@ -1,23 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>DID Wallet</title>
-    <style>
-        body {
-            font-family: system-ui, -apple-system, sans-serif;
-            max-width: 800px;
-            margin: 0 auto;
-            padding: 20px;
-        }
-    </style>
-</head>
-<body>
-    <h1>Web5 DID Wallet</h1>
-    <p>Decentralized Identity Wallet for Archipelago</p>
-    <div id="app">
-        <p>Wallet interface coming soon...</p>
-    </div>
-</body>
-</html>
@@ -1,37 +0,0 @@
-import express from 'express';
-
-const app = express();
-const port = 8080;
-
-// Middleware
-app.use(express.json());
-app.use(express.static('public'));
-
-// Health check endpoint
-app.get('/health', (req, res) => {
-  res.json({ status: 'ok', service: 'did-wallet' });
-});
-
-// Wallet API endpoints
-app.get('/api/wallet/info', (req, res) => {
-  res.json({
-    status: 'ok',
-    wallet: {
-      dids: [],
-      balance: 0
-    }
-  });
-});
-
-app.post('/api/wallet/did/create', async (req, res) => {
-  // Placeholder for DID creation
-  res.json({
-    status: 'ok',
-    did: 'did:key:placeholder'
-  });
-});
-
-// Start server
-app.listen(port, '0.0.0.0', () => {
-  console.log(`DID Wallet listening on port ${port}`);
-});
@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "lib": ["ES2020"],
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}
@@ -1,7 +1,7 @@
 app:
  id: filebrowser
  name: File Browser
-  version: 2.27.0
+  version: 2.63.23
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
  description: Baseline Archipelago file manager service.

  container:
-    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0
+    image: source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23
    pull_policy: if-not-present
    network: archy-net
    custom_args: ["--config", "/data/.filebrowser.json"]
@@ -1,7 +1,7 @@
 app:
  id: gitea
  name: Gitea
-  version: "1.23"
+  version: "1.27.3"
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -12,7 +12,7 @@ app:
  category: development

  container:
-    image: docker.io/gitea/gitea:1.23
+    image: source.archipelago-foundation.org/lfg2025/gitea:1.27.3
    pull_policy: if-not-present

  dependencies:
@@ -1,7 +1,7 @@
 app:
  id: homeassistant
  name: Home Assistant
-  version: 2026.7.3
+  version: 2026.8.3
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
  description: Open source home automation platform. Control and monitor your smart home devices.
  
  container:
-    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2
+    image: source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3
    pull_policy: if-not-present
    network: pasta
    
@@ -1,5 +0,0 @@
-# Lightning Stack - uses official image
-FROM lightninglabs/lightning-stack:v0.12.0
-
-# Default configuration is in the image
-# No additional setup needed
@@ -1,85 +0,0 @@
-app:
-  id: lightning-stack
-  name: Lightning Stack
-  version: 0.12.0
-  # No public listing exists for lightninglabs/lightning-stack (checked
-  # docker.io, ghcr.io and github.com) — nothing can be queried automatically,
-  # so this one is tracked by hand.
-  upstream:
-    kind: manual
-    url: no public listing for lightninglabs/lightning-stack — verify by hand
-  description: Complete Lightning Network implementation. Includes LND, CLN, and management tools.
-  
-  container:
-    image: lightninglabs/lightning-stack:v0.12.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - app_id: bitcoin-core
-      version: ">=24.0"
-    - storage: 50Gi
-    
-  resources:
-    cpu_limit: 4
-    memory_limit: 4Gi
-    disk_limit: 50Gi
-    
-  security:
-    capabilities: [NET_BIND_SERVICE]
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: lightning-stack
-    
-  ports:
-    - host: 9738
-      container: 9735
-      protocol: tcp  # P2P
-      auth: none
-      auth_rationale: >-
-        Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.
-    - host: 10010
-      container: 10009
-      protocol: tcp  # gRPC
-      auth: none
-      auth_rationale: >-
-        LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.
-    # Mirrors lnd's 18080 exemption — same LND REST API, same macaroon auth.
-    - host: 8091
-      container: 8080
-      protocol: tcp  # REST/Web UI
-      auth: none
-      auth_rationale: >-
-        LND REST, authenticated by macaroon over TLS. A browser login page would break
-        Zeus and every non-browser wallet client, exactly as for lnd's 18080.
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/lightning-stack
-      target: /root/.lightning
-      options: [rw]
-      
-  environment:
-    - BITCOIND_HOST=bitcoin-core
-    - BITCOIND_RPCUSER=${BITCOIN_RPC_USER}
-    - BITCOIND_RPCPASS=${BITCOIN_RPC_PASSWORD}
-    - NETWORK=mainnet
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /v1/getinfo
-    interval: 30s
-    timeout: 5s
-    retries: 3
-    
-  bitcoin_integration:
-    rpc_access: admin
-    sync_required: true
-    
-  lightning_integration:
-    channel_management: true
-    payment_routing: true
@@ -1,7 +1,7 @@
 app:
  id: lnd
  name: LND
-  version: 0.18.4
+  version: 0.21.2
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
  description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.

  container:
-    image: source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta
+    image: source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta
    pull_policy: if-not-present
    network: archy-net
    # BITCOIND_HOST must follow the node's actual Bitcoin container — Knots or
@@ -1,6 +0,0 @@
-node_modules
-dist
-*.log
-.git
-.gitignore
-README.md
@@ -1,37 +0,0 @@
-FROM node:20-alpine AS builder
-
-WORKDIR /app
-
-# Copy package files
-COPY package*.json ./
-RUN npm ci --only=production
-
-# Copy source code
-COPY . .
-
-# Build the application
-RUN npm run build
-
-# Production stage
-FROM node:20-alpine
-
-WORKDIR /app
-
-# Copy built application
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/package.json ./
-
-# Create non-root user
-RUN addgroup -g 1000 appuser && \
-    adduser -D -u 1000 -G appuser appuser && \
-    mkdir -p /app/data && \
-    chown -R appuser:appuser /app
-
-USER appuser
-
-EXPOSE 8080
-
-ENV MORPHOS_DATA_DIR=/app/data
-
-CMD ["node", "dist/index.js"]
@@ -1,55 +0,0 @@
-app:
-  id: morphos-server
-  name: MorphOS Server
-  version: 1.0.0
-  # Built by this project — there is no upstream release feed to watch.
-  upstream:
-    kind: internal
-  description: MorphOS server platform. Decentralized application server.
-  
-  container:
-    image: archipelago/morphos-server:1.0.0
-    image_signature: cosign://...
-    pull_policy: if-not-present
-    
-  dependencies:
-    - storage: 5Gi
-    
-  resources:
-    cpu_limit: 2
-    memory_limit: 2Gi
-    disk_limit: 5Gi
-    
-  security:
-    capabilities: []
-    readonly_root: true
-    no_new_privileges: true
-    user: 1000
-    seccomp_profile: default
-    network_policy: isolated
-    apparmor_profile: morphos-server
-    
-  ports:
-    - host: 8089
-      container: 8080
-      protocol: tcp  # Web UI
-      bind: 127.0.0.1
-      auth: gated
-    
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/morphos-server
-      target: /app/data
-      options: [rw]
-      
-  environment:
-    - MORPHOS_ENV=production
-    - MORPHOS_DATA_DIR=/app/data
-    
-  health_check:
-    type: http
-    endpoint: http://127.0.0.1:8080
-    path: /health
-    interval: 30s
-    timeout: 5s
-    retries: 3
@@ -1,20 +0,0 @@
-{
-  "name": "morphos-server",
-  "version": "1.0.0",
-  "description": "MorphOS server platform",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts"
-  },
-  "dependencies": {
-    "express": "^4.18.2"
-  },
-  "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.10.0",
-    "typescript": "^5.3.3",
-    "ts-node": "^10.9.2"
-  }
-}
@@ -1,27 +0,0 @@
-import express from 'express';
-
-const app = express();
-const port = 8080;
-
-// Middleware
-app.use(express.json());
-
-// Health check endpoint
-app.get('/health', (req, res) => {
-  res.json({ status: 'ok', service: 'morphos-server', version: '1.0.0' });
-});
-
-// API endpoints
-app.get('/api/info', (req, res) => {
-  res.json({
-    name: 'MorphOS Server',
-    version: '1.0.0',
-    status: 'running'
-  });
-});
-
-// Start server
-app.listen(port, '0.0.0.0', () => {
-  console.log(`MorphOS Server listening on port ${port}`);
-  console.log(`Data directory: ${process.env.MORPHOS_DATA_DIR || '/app/data'}`);
-});
@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "lib": ["ES2020"],
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}
@@ -24,7 +24,14 @@ app:
    disk_limit: 1Gi

  security:
-    capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE]
+    # NET_BIND_SERVICE is load-bearing, not decoration: NPM's internal nginx
+    # listens on 80, 443 AND 81, and the orchestrator runs --cap-drop=ALL —
+    # without this cap every start dies with "bind() to 0.0.0.0:80 failed
+    # (13: Permission denied)" and s6 restart-loops forever (shorty-s,
+    # 2026-09-01, restart counter 3176 within hours of the manifest
+    # conversion). The legacy podman-run path defaulted to the full cap set,
+    # which is why it never showed there.
+    capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE]
    readonly_root: false
    no_new_privileges: true
    network_policy: isolated
@@ -47,6 +54,13 @@ app:
      source: /var/lib/archipelago/nginx-proxy-manager
      target: /data
      options: [rw]
+    # Current NPM images refuse to start unless /etc/letsencrypt is a mount in
+    # its own right. Keeping the files below the same persistent app directory
+    # preserves existing certificates while satisfying that startup contract.
+    - type: bind
+      source: /var/lib/archipelago/nginx-proxy-manager/letsencrypt
+      target: /etc/letsencrypt
+      options: [rw]

  environment: []

@@ -20,7 +20,8 @@ app:
    - storage: 50Gi

  resources:
-    memory_limit: 0
+    # No memory limit: models are sized by the disk allowance below, and a
+    # RAM ceiling would just OOM-kill long inferences.
    disk_limit: 50Gi

  security:
@@ -5,7 +5,7 @@ app:
  # (--beam-size 1). Bumped past the image version so catalog-driven nodes
  # pick up the args change; the pre-release form "3.4.1-1" would compare
  # LOWER than 3.4.1 under semver and never roll out.
-  version: "3.4.2"
+  version: "3.6.0"
  # Tracks the rhasspy/wyoming-whisper image we pin (Docker Hub — the
  # project's GitHub tags are not the image tags). NOTE: this manifest
  # deliberately ships an args-tuned revision AHEAD of the image tag (see
@@ -24,7 +24,7 @@ app:
  container_name: pine-whisper

  container:
-    image: docker.io/rhasspy/wyoming-whisper:3.4.1
+    image: docker.io/rhasspy/wyoming-whisper:3.6.0
    pull_policy: if-not-present
    network: archy-net
    network_aliases: [pine-whisper]
@@ -1,7 +1,7 @@
 app:
  id: portainer
  name: Portainer
-  version: 2.19.4
+  version: 2.45.0
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -12,7 +12,7 @@ app:
  category: development

  container:
-    image: source.archipelago-foundation.org/lfg2025/portainer:2.39.6
+    image: source.archipelago-foundation.org/lfg2025/portainer:2.45.0
    pull_policy: if-not-present
    data_uid: "1000:1000"

@@ -1,7 +1,7 @@
 app:
  id: vaultwarden
  name: Vaultwarden
-  version: 1.30.0
+  version: 1.37.2
  # Where this app comes from, so scripts/check-upstream-releases.py can
  # tell us when the pin below has fallen behind. Without it nothing can:
  # container.image names our mirror, not the project it was mirrored from.
@@ -11,7 +11,7 @@ app:
  description: Self-hosted password vault with zero-knowledge encryption.

  container:
-    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine
+    image: source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine
    pull_policy: if-not-present
    network: pasta

@@ -104,7 +104,7 @@ dependencies = [

 [[package]]
 name = "archipelago"
-version = "1.8.7-alpha"
+version = "1.8.11-alpha"
 dependencies = [
 "anyhow",
 "archipelago-container",
@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.8.7-alpha"
+version = "1.8.11-alpha"
 edition = "2021"
 license.workspace = true
 description = "Archipelago Bitcoin Node OS - Native backend"
@@ -90,8 +90,9 @@ rustls-pemfile = "1.0"
 webpki = { package = "rustls-webpki", version = "0.101" }
 reqwest = { version = "0.11", default-features = false, features = ["json", "socks", "rustls-tls", "stream"] }

-# Nostr (node discovery + NIP-44 encrypted peer handshake)
-nostr-sdk = { version = "0.44", features = ["nip04", "nip44"] }
+# Nostr (node discovery + NIP-44 encrypted peer handshake).
+# nip06: NIP-06 key derivation for the Minibits @minibits.cash profile flow.
+nostr-sdk = { version = "0.44", features = ["nip04", "nip06", "nip44"] }

 # Backup encryption (DID identity export) + TOTP 2FA encryption
 argon2 = "0.5.3"
@@ -269,6 +269,8 @@ impl RpcHandler {
            "wallet.ecash-network" => self.handle_wallet_ecash_network().await,
            "wallet.ecash-set-network" => self.handle_wallet_ecash_set_network(params).await,
            "wallet.ecash-seed-status" => self.handle_wallet_ecash_seed_status().await,
+            "wallet.ecash-lnaddress" => self.handle_wallet_ecash_lnaddress().await,
+            "wallet.ecash-lnaddress-claim" => self.handle_wallet_ecash_lnaddress_claim().await,
            "wallet.ecash-seed-reveal" => self.handle_wallet_ecash_seed_reveal(params).await,
            "wallet.ecash-restore" => self.handle_wallet_ecash_restore(params).await,
            "wallet.ecash-seed-import" => self.handle_wallet_ecash_seed_import(params).await,
@@ -558,6 +560,11 @@ impl RpcHandler {
                self.handle_fips_remove_seed_anchor(&p).await
            }
            "fips.apply-seed-anchors" => self.handle_fips_apply_seed_anchors().await,
+            "fips.ssh-over-mesh.get" => self.handle_fips_ssh_over_mesh_get().await,
+            "fips.ssh-over-mesh.set" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_ssh_over_mesh_set(&p).await
+            }

            // System updates
            "update.check" => self.handle_update_check().await,
@@ -261,4 +261,51 @@ impl RpcHandler {
            }).collect::<Vec<_>>(),
        }))
    }
+
+    /// The SSH-over-mesh toggle state plus sshd preflights (the card explains
+    /// the rule instead of gating on it — see ssh_mesh.rs).
+    pub(super) async fn handle_fips_ssh_over_mesh_get(&self) -> Result<serde_json::Value> {
+        let state = fips::ssh_mesh::load(&self.config.data_dir).await;
+        let preflights = fips::ssh_mesh::preflights().await;
+        Ok(serde_json::json!({
+            "enabled": state.enabled,
+            "sources": state.sources,
+            "scope": if state.sources.is_empty() { "any" } else { "list" },
+            "preflights": preflights,
+        }))
+    }
+
+    /// Set the toggle. Params: `{ enabled: bool, sources?: string[] }` —
+    /// an empty/absent source list opens port 22 to every mesh peer (the UI
+    /// confirms that explicitly before calling with it).
+    pub(super) async fn handle_fips_ssh_over_mesh_set(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let enabled = params
+            .get("enabled")
+            .and_then(|v| v.as_bool())
+            .ok_or_else(|| anyhow::anyhow!("missing boolean 'enabled'"))?;
+        let sources: Vec<String> = params
+            .get("sources")
+            .and_then(|v| v.as_array())
+            .map(|a| {
+                a.iter()
+                    .filter_map(|s| s.as_str().map(str::to_string))
+                    .collect()
+            })
+            .unwrap_or_default();
+        let (state, outcome) =
+            fips::ssh_mesh::set(&self.config.data_dir, enabled, &sources).await?;
+        let preflights = fips::ssh_mesh::preflights().await;
+        Ok(serde_json::json!({
+            "enabled": state.enabled,
+            "sources": state.sources,
+            "scope": if state.sources.is_empty() { "any" } else { "list" },
+            "applied": outcome.applied,
+            "removed": outcome.removed,
+            "reloaded": outcome.reloaded,
+            "preflights": preflights,
+        }))
+    }
 }
@@ -4,6 +4,59 @@ use tracing::info;

 use super::LND_REST_BASE_URL;

+fn router_error_message(body: &serde_json::Value) -> Option<&str> {
+    body.get("error")
+        .and_then(|e| e.get("message"))
+        .and_then(|v| v.as_str())
+        .or_else(|| body.get("message").and_then(|v| v.as_str()))
+}
+
+fn payment_error(message: &str) -> anyhow::Error {
+    if message.to_ascii_lowercase().contains("invoice expired") {
+        anyhow::anyhow!(
+            "Payment failed: this invoice has expired ({}). Ask the recipient for a fresh invoice and try again.",
+            message.trim_start_matches("invoice expired. ")
+        )
+    } else {
+        anyhow::anyhow!("Payment failed: {message}")
+    }
+}
+
+fn payment_failure_reason(reason: &str) -> &'static str {
+    match reason {
+        "FAILURE_REASON_NO_ROUTE" => "No route to the recipient",
+        "FAILURE_REASON_INSUFFICIENT_BALANCE" => "Insufficient channel balance",
+        "FAILURE_REASON_TIMEOUT" => "Payment timed out in the network",
+        "FAILURE_REASON_INCORRECT_PAYMENT_DETAILS" => {
+            "Recipient rejected the payment (wrong details or expired invoice)"
+        }
+        _ => "Payment failed",
+    }
+}
+
+fn json_i64(value: &serde_json::Value, key: &str) -> Option<i64> {
+    value.get(key).and_then(|v| {
+        v.as_str()
+            .and_then(|s| s.parse().ok())
+            .or_else(|| v.as_i64())
+    })
+}
+
+/// Fee budget for a send, matching lncli's own default: the payment amount
+/// (100%). Zero-amount invoices take the payer-supplied amount; fixed invoices
+/// take the invoice's own amount. Falls back to a nominal 1,000 sats only when
+/// both are somehow absent — the limit must never be left at LND's zero
+/// default, which rejects every fee-carrying route as "no route".
+fn fee_limit_sats(amount_sats: Option<u64>, decoded_amt: i64) -> i64 {
+    if let Some(amt) = amount_sats {
+        return amt as i64;
+    }
+    if decoded_amt > 0 {
+        return decoded_amt;
+    }
+    1_000
+}
+
 impl RpcHandler {
    /// Pay a Lightning invoice.
    pub(in crate::api::rpc) async fn handle_lnd_payinvoice(
@@ -65,23 +118,30 @@ impl RpcHandler {

        let mut pay_body = serde_json::json!({
            "payment_request": payment_request,
+            // Suppress intermediate stream records: one terminal Payment is
+            // enough, and it makes grpc-gateway's response a single JSON value.
+            "no_inflight_updates": true,
+            "timeout_seconds": 120,
+            // Router.SendPaymentV2 treats an ABSENT fee limit as ZERO — every
+            // real route carries a routing fee, so the pathfinder rejects
+            // them all and the wallet gets "No route to the recipient" on
+            // every send (fleet-wide, 2026-09-01: the v1.8.9 switch to the v2
+            // route shipped without this, and a manual lncli test that set
+            // --fee_limit masked it). lncli's own default is the payment
+            // amount (100%), which is what we send here.
+            "fee_limit_sat": fee_limit_sats(amount_sats, decoded_amt),
        });
        if let Some(amt) = amount_sats {
            pay_body["amt"] = serde_json::json!(amt.to_string());
        }

-        // `/v1/channels/transactions` is SYNCHRONOUS: it blocks until the
-        // payment settles or definitively fails, and multi-hop routing with
-        // retries routinely takes longer than the shared client's 15s budget.
-        // That 15s abort used to surface as "Payment failed" while LND kept
-        // paying in the background — only LND may declare a payment failed,
-        // so a post-connect timeout is IN FLIGHT (status: pending), never
-        // failure. The window is deliberately SHORT: most payments settle in
-        // a couple of seconds and still get their answer in one round trip,
-        // while a slow multi-hop route flips the UI into its "settling…"
-        // polling state (lnd.paymentstatus every 3s) after ~8s instead of
-        // freezing the modal for two minutes with no feedback (a test node
-        // user report, 2026-07-29).
+        // LND 0.21 removed the deprecated Lightning.SendPaymentSync REST route
+        // (`/v1/channels/transactions`). Router.SendPaymentV2 is its supported
+        // replacement. The old route now returns literal 404 "Not Found" on
+        // every payment — the fleet failure seen immediately after the 0.21.2
+        // update. Keep the short browser-facing wait: after LND accepts a slow
+        // payment we return pending and the UI follows it through
+        // lnd.paymentstatus instead of declaring a transport timeout a failure.
        let pay_client = reqwest::Client::builder()
            .no_proxy()
            .connect_timeout(std::time::Duration::from_secs(10))
@@ -91,7 +151,7 @@ impl RpcHandler {
            .context("Failed to create HTTP client")?;

        let resp = match pay_client
-            .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))
+            .post(format!("{LND_REST_BASE_URL}/v2/router/send"))
            .header("Grpc-Metadata-macaroon", &macaroon_hex)
            .json(&pay_body)
            .send()
@@ -119,49 +179,42 @@ impl RpcHandler {
        let body: serde_json::Value = resp
            .json()
            .await
-            .context("Failed to parse payment response")?;
+            .context("Failed to parse Router.SendPaymentV2 response")?;

+        // grpc-gateway wraps server-streaming records as {"result": ...} and
+        // transport/RPC failures as {"error": {"message": ...}}. Do not look
+        // only for the old endpoint's top-level `message`: that turns useful
+        // LND errors into "Unknown error".
        if !status.is_success() {
-            let msg = body
-                .get("message")
-                .and_then(|v| v.as_str())
-                .unwrap_or("Unknown error");
-            // Invoices are short-lived; retrying the same one can never
-            // succeed, so tell the user the way out instead of just the fact.
-            if msg.contains("invoice expired") {
-                return Err(anyhow::anyhow!(
-                    "Payment failed: this invoice has expired ({}). Ask the recipient for a fresh invoice and try again.",
-                    msg.trim_start_matches("invoice expired. ")
-                ));
+            let msg = router_error_message(&body).unwrap_or("Unknown error");
+            return Err(payment_error(msg));
+        }
+        let payment = body.get("result").unwrap_or(&body);
+        match payment.get("status").and_then(|v| v.as_str()).unwrap_or("") {
+            "SUCCEEDED" => {}
+            "FAILED" => {
+                let reason = payment
+                    .get("failure_reason")
+                    .and_then(|v| v.as_str())
+                    .map(payment_failure_reason)
+                    .unwrap_or("Payment failed");
+                return Err(anyhow::anyhow!("Payment failed: {reason}"));
+            }
+            _ => {
+                return Ok(serde_json::json!({
+                    "status": "pending",
+                    "payment_hash": decoded_hash,
+                    "amount_sats": decoded_amt,
+                }));
            }
-            return Err(anyhow::anyhow!("Payment failed: {}", msg));
        }

-        let payment_error = body
-            .get("payment_error")
-            .and_then(|v| v.as_str())
-            .unwrap_or("");
-        if !payment_error.is_empty() {
-            return Err(anyhow::anyhow!("Payment failed: {}", payment_error));
-        }
-
-        let amount_sat = body
-            .get("payment_route")
-            .and_then(|r| r.get("total_amt"))
-            .and_then(|v| v.as_str())
-            .and_then(|s| s.parse::<i64>().ok())
-            .unwrap_or(decoded_amt);
-
-        let payment_hash = body
-            .get("payment_hash")
-            .and_then(|v| v.as_str())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string())
-            .unwrap_or(decoded_hash);
-
+        let amount_sat = json_i64(payment, "value_sat").unwrap_or(decoded_amt);
        Ok(serde_json::json!({
            "status": "succeeded",
-            "payment_hash": payment_hash,
+            // The decode endpoint returns the canonical hex hash used by our
+            // polling/list APIs. Router's bytes field is base64 in REST JSON.
+            "payment_hash": decoded_hash,
            "amount_sats": amount_sat,
        }))
    }
@@ -482,3 +535,53 @@ impl RpcHandler {
        Ok(serde_json::json!({ "transactions": transactions }))
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unwraps_grpc_gateway_router_success() {
+        let body = serde_json::json!({
+            "result": { "status": "SUCCEEDED", "value_sat": "1000" }
+        });
+        let payment = body.get("result").unwrap_or(&body);
+        assert_eq!(
+            payment.get("status").and_then(|v| v.as_str()),
+            Some("SUCCEEDED")
+        );
+        assert_eq!(json_i64(payment, "value_sat"), Some(1000));
+    }
+
+    #[test]
+    fn reads_nested_router_error() {
+        let body = serde_json::json!({
+            "error": { "code": 2, "message": "invoice expired. valid until yesterday" }
+        });
+        let msg = router_error_message(&body).unwrap();
+        assert!(payment_error(msg).to_string().contains("fresh invoice"));
+    }
+
+    #[test]
+    fn router_failure_reasons_are_actionable() {
+        assert_eq!(
+            payment_failure_reason("FAILURE_REASON_NO_ROUTE"),
+            "No route to the recipient"
+        );
+        assert_eq!(
+            payment_failure_reason("FAILURE_REASON_INSUFFICIENT_BALANCE"),
+            "Insufficient channel balance"
+        );
+    }
+
+    #[test]
+    fn fee_limit_never_falls_back_to_zero() {
+        // SendPaymentV2 defaults an ABSENT fee limit to zero — which rejects
+        // every fee-carrying route as "no route". The budget must always be
+        // positive: the payer-supplied amount for zero-amount invoices, the
+        // invoice's own amount otherwise.
+        assert_eq!(fee_limit_sats(Some(20_000), 0), 20_000);
+        assert_eq!(fee_limit_sats(None, 20_000), 20_000);
+        assert_eq!(fee_limit_sats(None, 0), 1_000);
+    }
+}
@@ -135,7 +135,7 @@ impl RpcHandler {
                // not /usr/bin/tollgate-module-basic-go — that's only the opkg/apk
                // *package* name, never an on-disk filename.
                let tollgate_installed = router
-                    .run("/usr/bin/opkg list-installed 2>/dev/null | grep -q '^tollgate-module-basic-go ' || \
+                    .run("opkg list-installed 2>/dev/null | grep -q '^tollgate-module-basic-go ' || \
                          test -f /usr/bin/tollgate-wrt 2>/dev/null")
                    .map(|(_, code)| code == 0)
                    .unwrap_or(false);
@@ -2040,10 +2040,59 @@ autopilot.active=false\n",
            }));
        }

+        // Portainer ≥2.21 no longer lets whoever loads the page first claim the
+        // admin account: on a fresh install it mints a one-time setup token and
+        // prints it to the SERVER LOGS, expecting the operator to go digging.
+        // On an appliance that is hostile UX — "check the Portainer server
+        // logs" is exactly the dead end users cannot follow. The token is the
+        // only thing standing between the user and their own app, so surface
+        // it in the same launch interstitial as the login credentials: extract
+        // it from the container logs and hand it over with a copy button.
+        // Once setup completes Portainer invalidates the token, and a container
+        // recreate (any update) drops the log line entirely — so absence of the
+        // line naturally makes the card disappear and no stale token lingers.
+        if app_id == "portainer" {
+            if let Some(token) = portainer_setup_token(self).await {
+                return Ok(serde_json::json!({
+                    "title": "Portainer first-run token",
+                    "description": "New Portainer versions protect the first launch with a one-time setup token instead of letting anyone on the network claim the admin account. Paste this token into Portainer's setup screen to create your administrator login. It is only valid until setup finishes — if you already created your admin account, ignore this.",
+                    "credentials": [
+                        { "label": "Setup token", "value": token, "sensitive": true }
+                    ]
+                }));
+            }
+        }
+
        Ok(serde_json::json!({ "credentials": [] }))
    }
 }

+/// Extract Portainer's first-run `setup_token=…` from the live container's
+/// recent logs. `None` when the line is absent (setup already done, or an
+/// older Portainer without the token flow).
+async fn portainer_setup_token(rpc: &RpcHandler) -> Option<String> {
+    let logs = rpc.get_container_logs_value("portainer", 300).await.ok()?;
+    let lines = logs.as_array()?;
+    let lines: Vec<&str> = lines.iter().filter_map(|l| l.as_str()).collect();
+    parse_setup_token(&lines)
+}
+
+/// Pure log-line scan: the token is 64 hex chars after `setup_token=`.
+/// Sear newest-first so the most recent mint wins.
+fn parse_setup_token(lines: &[&str]) -> Option<String> {
+    for line in lines.iter().rev() {
+        let Some(idx) = line.find("setup_token=") else {
+            continue;
+        };
+        let tail = &line[idx + "setup_token=".len()..];
+        let token: String = tail.chars().take_while(|c| c.is_ascii_hexdigit()).collect();
+        if token.len() == 64 {
+            return Some(token);
+        }
+    }
+    None
+}
+
 async fn cleanup_stale_package_ports(package_id: &str) {
    match package_id {
        "grafana" => cleanup_stale_pasta_port("3000").await,
@@ -2751,7 +2800,7 @@ fn is_unknown_app_id_error(err: &anyhow::Error) -> bool {
 #[cfg(test)]
 mod tests {
    use super::{
-        orchestrator_install_app_id, should_try_orchestrator_install,
+        orchestrator_install_app_id, parse_setup_token, should_try_orchestrator_install,
        uses_orchestrator_install_flow,
    };
    use crate::api::rpc::package::runtime::orchestrator_uninstall_app_ids;
@@ -2861,4 +2910,41 @@ mod tests {
            "Error: no container with name or ID \"bitcoin-knots\" found"
        ));
    }
+
+    #[test]
+    fn portainer_setup_token_is_extracted_from_log_lines() {
+        // Shape captured live from portainer:2.45.0 on 2026-09-01 — the
+        // token line is plain text inside the bordered s6 log block.
+        let logs = [
+            "2026/09/01 12:38PM INF github.com/portainer/portainer/api/database/boltdb/db.go:163 > loading PortainerDB | filename=portainer.db",
+            "==========================",
+            "setup_token=27637c02b6323972dff76bcad4caa456f957b521d3cfe3bc7fb95d2488dfd23a",
+            "Paste it into the setup screen, or send it in the X-Setup-Token header.",
+            "==========================",
+        ];
+        assert_eq!(
+            parse_setup_token(&logs).as_deref(),
+            Some("27637c02b6323972dff76bcad4caa456f957b521d3cfe3bc7fb95d2488dfd23a")
+        );
+    }
+
+    #[test]
+    fn portainer_setup_token_absent_when_setup_already_done() {
+        // An instance with an existing admin account never prints the line —
+        // the credentials card must not render a stale or empty token.
+        let logs = [
+            "2026/09/01 11:37AM INF api/datastore/migrator/migrate_ce.go:76 > db migrated to 2.45.0 |",
+            "2026/09/01 11:37:38 server: Listening on http://0.0.0.0:8000",
+        ];
+        assert_eq!(parse_setup_token(&logs), None);
+    }
+
+    #[test]
+    fn portainer_setup_token_rejects_short_or_non_hex_values() {
+        assert_eq!(parse_setup_token(&["setup_token=abc123"]), None);
+        assert_eq!(
+            parse_setup_token(&["setup_token=".to_string().as_str()]),
+            None
+        );
+    }
 }
@@ -421,6 +421,31 @@ impl RpcHandler {
        }))
    }

+    /// `wallet.ecash-lnaddress` — the node's Minibits Lightning address
+    /// (`<name>@minibits.cash`, LUD-16), derived from and authenticated by the
+    /// ecash wallet's own seed. Registers the profile on first use; safe to call
+    /// on every open of the Cashu receive screen (it is idempotent).
+    pub(super) async fn handle_wallet_ecash_lnaddress(&self) -> Result<serde_json::Value> {
+        crate::wallet::minibits::lnaddress(&self.config.data_dir).await
+    }
+
+    /// `wallet.ecash-lnaddress-claim` — redeem any Lightning payments that
+    /// arrived on the node's Minibits address as ecash. Returns the sats swept in
+    /// (0 when nothing was waiting), so the UI can refresh its balance.
+    /// `failed_count` is non-zero when a payment was fetched (and so already
+    /// consumed server-side) but couldn't be redeemed yet — it stays queued
+    /// and is retried automatically, but the UI should tell the operator
+    /// rather than let it be a silent, unbounded wait.
+    pub(super) async fn handle_wallet_ecash_lnaddress_claim(&self) -> Result<serde_json::Value> {
+        let outcome = crate::wallet::minibits::claim_and_redeem(&self.config.data_dir).await?;
+        Ok(serde_json::json!({
+            "claimed_count": outcome.claimed_count,
+            "received_sats": outcome.received_sats,
+            "failed_count": outcome.failed_count,
+            "dropped_count": outcome.dropped_count,
+        }))
+    }
+
    pub(super) async fn handle_wallet_networking_profits(&self) -> Result<serde_json::Value> {
        let summary = profits::get_networking_profits(&self.config.data_dir).await?;
        Ok(serde_json::json!({
@@ -141,6 +141,12 @@ impl DockerPackageScanner {

            // Get metadata for this app
            let metadata = get_app_metadata(&app_id);
+            // Manifest-owned metadata (icon) wins over the static table: the
+            // manifest is what the catalog signed and what the App Store shows,
+            // so it is also what an installed tile must render.
+            let manifest_icon = real_manifest_metadata(&app_id)
+                .and_then(|m| m.get("icon").and_then(|v| v.as_str()).map(str::to_string))
+                .filter(|s| !s.trim().is_empty());

            // Resolve UI address: separate UI containers > static map > dynamic ports
            let lan_address = if app_id == "netbird" {
@@ -191,7 +197,7 @@ impl DockerPackageScanner {
                static_files: StaticFiles {
                    license: "MIT".to_string(),
                    instructions: metadata.description.clone(),
-                    icon: metadata.icon.clone(),
+                    icon: manifest_icon.unwrap_or_else(|| metadata.icon.clone()),
                },
                manifest: Manifest {
                    id: app_id.clone(),
@@ -211,28 +217,34 @@ impl DockerPackageScanner {
                    author: Some("Archipelago".to_string()),
                    website: lan_address.clone(),
                    tier: Some(metadata.tier.to_string()),
-                    interfaces: if lan_address.is_some() || tor_address.is_some() {
+                    interfaces: {
                        // `ui` is no longer implied by a published port: a
                        // headless backend with an exposed port is a service,
                        // not a launchable app. ui_detection consults the
                        // manifest declaration first, then HTTP-probes the
-                        // port. Addresses stay present either way so the
-                        // Services tab can still show where a backend lives.
+                        // port. A DECLARED UI classifies the app as launchable
+                        // even when no reachable address was confirmed this
+                        // scan — the launch button falls back to the static
+                        // port map, and burying a manifest-declared UI app
+                        // (Alby Hub) in Services because a probe missed was
+                        // exactly the classification bug this fixes.
                        let has_ui = super::ui_detection::has_web_ui(
                            &app_id,
                            lan_address.as_deref(),
                            package_state == PackageState::Running,
                        )
                        .await;
-                        Some(Interfaces {
-                            main: Some(MainInterface {
-                                ui: has_ui.then(|| "true".to_string()),
-                                tor_config: tor_address.clone(),
-                                lan_config: None,
-                            }),
-                        })
-                    } else {
-                        None
+                        if lan_address.is_some() || tor_address.is_some() || has_ui {
+                            Some(Interfaces {
+                                main: Some(MainInterface {
+                                    ui: has_ui.then(|| "true".to_string()),
+                                    tor_config: tor_address.clone(),
+                                    lan_config: None,
+                                }),
+                            })
+                        } else {
+                            None
+                        }
                    },
                },
                available_update,
@@ -322,6 +334,47 @@ fn is_transient_podman_helper(app_id: &str, ports: &[String]) -> bool {
        && right.chars().all(|c| c.is_ascii_lowercase())
 }

+/// Raw `metadata` block of an installed app's real manifest — catalog overlay
+/// first (origin-wins), disk manifest as fallback. Kept as raw JSON because
+/// the typed `AppManifest` deliberately does not model `metadata`, yet its
+/// `icon` is what makes an installed app's tile render the right icon on
+/// every surface (My Apps, Services, launcher, companion) instead of the
+/// generic A-mark — the exact regression Cuprate exposed on install.
+fn real_manifest_metadata(app_id: &str) -> Option<serde_json::Value> {
+    for (id, value) in crate::container::app_catalog::catalog_manifest_values() {
+        if id == app_id {
+            return value.get("app").and_then(|a| a.get("metadata")).cloned();
+        }
+    }
+    let mut candidates = Vec::new();
+    if let Ok(dir) = std::env::var("ARCHIPELAGO_DATA_DIR") {
+        candidates.push(
+            std::path::PathBuf::from(dir)
+                .join("../apps")
+                .join(app_id)
+                .join("manifest.yml"),
+        );
+    }
+    candidates.push(
+        std::path::PathBuf::from("/opt/archipelago/apps")
+            .join(app_id)
+            .join("manifest.yml"),
+    );
+    for path in candidates {
+        let Ok(content) = std::fs::read_to_string(&path) else {
+            continue;
+        };
+        let Ok(value) = serde_yaml::from_str::<serde_json::Value>(&content) else {
+            continue;
+        };
+        let meta = value.get("app").and_then(|a| a.get("metadata")).cloned();
+        if meta.is_some() {
+            return meta;
+        }
+    }
+    None
+}
+
 fn get_app_metadata(app_id: &str) -> AppMetadata {
    let mut meta = match app_id {
        "bitcoin-core" => AppMetadata {
@@ -163,7 +163,6 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
        "vaultwarden" => Some("VAULTWARDEN_IMAGE"),
        "nextcloud" => Some("NEXTCLOUD_IMAGE"),
        "searxng" => Some("SEARXNG_IMAGE"),
-        "cryptpad" => Some("CRYPTPAD_IMAGE"),
        "filebrowser" => Some("FILEBROWSER_IMAGE"),
        "nginx-proxy-manager" => Some("NPM_IMAGE"),
        "portainer" => Some("PORTAINER_IMAGE"),
@@ -131,6 +131,10 @@ const LND_STATE_DIRS: &[&str] = &[
 /// container, not a Quadlet unit, so it is restarted via `podman`, not systemctl.
 const LND_CONTAINER: &str = "lnd";

+/// Canonical on-host admin macaroon — same path the RPC layer reads.
+const LND_ADMIN_MACAROON: &str =
+    "/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/admin.macaroon";
+
 /// Archipelago data dir (default; not overridden in prod). Holds the
 /// `user-stopped.json` that gates health-monitor auto-restart.
 const ARCHY_DATA_DIR: &str = "/var/lib/archipelago";
@@ -872,6 +876,188 @@ fn cert_sha256_thumbprint(pem: &str) -> Result<String> {
    Ok(hex::encode_upper(Sha256::digest(&der)))
 }

+// ── Channel-peer watchdog ──────────────────────────────────────────────────
+
+/// Every open channel's remote peer that is NOT currently connected.
+/// Pure over LND's REST JSON so the selection can be unit-tested.
+///
+/// `/v1/peers` uses `pub_key`; `/v1/channels` uses `remote_pubkey` — the
+/// asymmetry is LND's, not ours.
+fn select_reconnect_targets(
+    channels: &serde_json::Value,
+    peers: &serde_json::Value,
+) -> Vec<String> {
+    let connected: std::collections::HashSet<&str> = peers
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|p| p.get("pub_key").and_then(|v| v.as_str()))
+                .collect()
+        })
+        .unwrap_or_default();
+    let mut targets: Vec<String> = channels
+        .get("channels")
+        .and_then(|c| c.as_array())
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|c| c.get("remote_pubkey").and_then(|v| v.as_str()))
+                .filter(|pk| !connected.contains(pk))
+                .map(str::to_string)
+                .collect()
+        })
+        .unwrap_or_default();
+    targets.sort();
+    targets.dedup();
+    targets
+}
+
+/// Reconnect peers of open channels that LND has not re-established on its
+/// own. Returns the number of peers reconnected this pass.
+///
+/// LND normally reconnects channel peers after a restart — but not reliably:
+/// when the restart outages are long or repeated (an app update, a node
+/// reboot, reconciler churn), the peer link can stay down for hours while
+/// BOTH endpoints keep flagging the channel `disabled` in the routing
+/// graph. The node itself looks perfectly healthy and every payment in
+/// either direction fails "no route to the recipient" — observed live on
+/// framework-pt (2026-09-01): its only channel sat disabled on both policy
+/// sides for ~17h after the LND 0.21.2 update, while the wallet showed
+/// plenty of outbound. The channel graph is desired state; this keeps it.
+///
+/// Quietly returns Ok(0) when LND is not installed or its wallet is locked —
+/// that is every node without LND, on every pass.
+///
+/// `last_attempt` throttles retries per peer (`min_retry`) so an unreachable
+/// peer is not hammered every pass; the caller owns the map so the pass
+/// itself stays stateless and testable.
+pub(crate) async fn reconnect_disconnected_channel_peers(
+    last_attempt: &mut std::collections::HashMap<String, std::time::Instant>,
+    min_retry: std::time::Duration,
+) -> Result<usize> {
+    let Ok(macaroon) = read_file_as_root(LND_ADMIN_MACAROON).await else {
+        return Ok(0); // LND not installed (or not initialized yet)
+    };
+    let macaroon_hex = hex::encode(macaroon);
+    let client = reqwest::Client::builder()
+        .no_proxy()
+        .timeout(std::time::Duration::from_secs(8))
+        .danger_accept_invalid_certs(true)
+        .build()
+        .context("building LND REST client for the channel-peer watchdog")?;
+
+    let channels: serde_json::Value = client
+        .get(format!("{LND_REST_BASE_URL}/v1/channels"))
+        .header("Grpc-Metadata-macaroon", &macaroon_hex)
+        .send()
+        .await
+        .context("LND REST: listing channels for the peer watchdog")?
+        .json()
+        .await
+        .context("parsing LND channel list")?;
+    // A locked wallet answers 503 with an error body — it parses as JSON
+    // with no "channels" key, which selects nothing. That is a quiet pass.
+    let peers: serde_json::Value = client
+        .get(format!("{LND_REST_BASE_URL}/v1/peers"))
+        .header("Grpc-Metadata-macaroon", &macaroon_hex)
+        .send()
+        .await
+        .context("LND REST: listing peers for the peer watchdog")?
+        .json()
+        .await
+        .context("parsing LND peer list")?;
+
+    let mut reconnected = 0usize;
+    for pubkey in select_reconnect_targets(&channels, &peers) {
+        if last_attempt
+            .get(&pubkey)
+            .is_some_and(|t| t.elapsed() < min_retry)
+        {
+            continue;
+        }
+        last_attempt.insert(pubkey.clone(), std::time::Instant::now());
+
+        // Where does the peer live? Its advertised addresses in the public
+        // graph. A peer with none (fully private) cannot be dialed from here
+        // — LND itself may still find it; we only log the gap once per pass.
+        // Unknown to the public graph (or the graph query failed) — nothing
+        // to dial on.
+        let Ok(node) = client
+            .get(format!("{LND_REST_BASE_URL}/v1/graph/node/{pubkey}"))
+            .header("Grpc-Metadata-macaroon", &macaroon_hex)
+            .send()
+            .await
+            .and_then(|r| r.error_for_status())
+        else {
+            continue;
+        };
+        let Ok(node) = node.json::<serde_json::Value>().await else {
+            continue;
+        };
+        let addresses: Vec<String> = node
+            .get("node")
+            .and_then(|n| n.get("addresses"))
+            .and_then(|a| a.as_array())
+            .map(|arr| {
+                arr.iter()
+                    .filter_map(|a| a.get("addr").and_then(|v| v.as_str()))
+                    .map(str::to_string)
+                    .collect()
+            })
+            .unwrap_or_default();
+        if addresses.is_empty() {
+            tracing::warn!(
+                peer = %pubkey,
+                "LND channel peer is disconnected and advertises no address — cannot dial it; payments through this channel stay unroutable"
+            );
+            continue;
+        }
+
+        for addr in addresses {
+            let Some((host, port)) = addr.rsplit_once(':') else {
+                continue;
+            };
+            let Ok(port) = port.parse::<u32>() else {
+                continue;
+            };
+            let body = serde_json::json!({
+                "perm": false,
+                "timeout": "15s",
+                "addr": { "pubkey": pubkey, "host": host, "port": port },
+            });
+            match client
+                .post(format!("{LND_REST_BASE_URL}/v1/peers"))
+                .header("Grpc-Metadata-macaroon", &macaroon_hex)
+                .json(&body)
+                .send()
+                .await
+            {
+                Ok(resp) if resp.status().is_success() => {
+                    reconnected += 1;
+                    tracing::info!(
+                        peer = %pubkey,
+                        addr = %addr,
+                        "reconnected a disconnected channel peer (channel was unroutable)"
+                    );
+                    break;
+                }
+                Ok(resp) => {
+                    let msg = resp.text().await.unwrap_or_default();
+                    // Already connected between our list call and now — success.
+                    if msg.contains("already connected") {
+                        break;
+                    }
+                    tracing::debug!(peer = %pubkey, addr = %addr, %msg, "channel-peer connect attempt failed");
+                }
+                Err(e) => {
+                    tracing::debug!(peer = %pubkey, addr = %addr, error = %e, "channel-peer connect attempt failed");
+                }
+            }
+        }
+    }
+    Ok(reconnected)
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -985,4 +1171,35 @@ mod tests {
        let cands = unlock_password_candidates().await;
        assert!(cands.iter().any(|p| p == LEGACY_WALLET_PASSWORD));
    }
+
+    #[test]
+    fn reconnect_targets_pick_disconnected_channel_peers_only() {
+        // Shape captured from a live node: /v1/channels uses remote_pubkey,
+        // /v1/peers uses pub_key, and an offline channel's peer is simply
+        // absent from the peer list — that absence is the whole signal.
+        let channels = serde_json::json!({
+            "channels": [
+                { "remote_pubkey": "AAA", "active": true },
+                { "remote_pubkey": "BBB", "active": false },
+                { "remote_pubkey": "AAA" }
+            ]
+        });
+        let peers = serde_json::json!({ "peers": [ { "pub_key": "AAA" } ] });
+
+        let targets = select_reconnect_targets(&channels, &peers);
+        assert_eq!(targets, vec!["BBB".to_string()]);
+    }
+
+    #[test]
+    fn reconnect_targets_empty_without_channels_or_peers() {
+        // No LND wallet (503 error body), locked wallet, or an empty node:
+        // selects nothing, quietly.
+        let error_body = serde_json::json!({ "message": "locked" });
+        assert!(select_reconnect_targets(&error_body, &serde_json::json!({})).is_empty());
+        assert!(select_reconnect_targets(
+            &serde_json::json!({ "channels": [] }),
+            &serde_json::json!({ "peers": [] })
+        )
+        .is_empty());
+    }
 }
@@ -6,7 +6,7 @@
 //! no listener, so allowing them is inert.

 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088,
-    8089, 8090, 8096, 8123, 8175, 8176, 8187, 8240, 8334, 8336, 8888, 8999, 9000, 9100, 10380,
-    11434, 18081, 18083, 23000, 32838, 50002,
+    2283, 2342, 3000, 3001, 3002, 3030, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087,
+    8090, 8096, 8123, 8175, 8176, 8187, 8240, 8334, 8336, 8888, 8999, 9000, 9100, 10380, 11434,
+    18081, 18083, 23000, 32838, 50002,
 ];
@@ -305,6 +305,14 @@ pub async fn install(identity_dir: &Path) -> Result<()> {
        }
    }

+    // SSH-over-mesh rides every config install so the on-state survives
+    // upgrades, reconnects, and the startup self-heal (see ssh_mesh.rs —
+    // this module owns the 90-ssh.nft slot exclusively).
+    let ssh_data_dir = identity_dir.parent().unwrap_or(identity_dir);
+    if let Err(e) = super::ssh_mesh::reconcile(ssh_data_dir).await {
+        tracing::warn!("ssh-over-mesh reconcile after config install failed (non-fatal): {e:#}");
+    }
+
    sudo_install_file(&src_key, DAEMON_KEY_PATH, "0600").await?;
    // Heal a legacy fips_key.pub that was written as bech32 npub text
    // (pre-fix identity::write_fips_key_from_seed did this). Upstream
@@ -32,6 +32,7 @@ pub mod dial;
 pub mod endpoints;
 pub mod iface;
 pub mod service;
+pub mod ssh_mesh;
 pub mod telemetry;
 pub mod update;

@@ -0,0 +1,492 @@
+//! SSH over the FIPS mesh — a first-class settings toggle.
+//!
+//! `fips0` is default-deny inbound: the hardening baseline (`/etc/fips/
+//! fips.nft`) rejects un-allowlisted ports, and the daemon's own drop-ins
+//! (`80-web-ui.nft`, `85-app-ports.nft`) do not include 22. That is correct
+//! by default — but the user asked to be able to SSH their node from Termux
+//! over the phone's FIPS mesh instead of keeping a second VPN around for it,
+//! and the mesh path already works end-to-end (verified live: the connect
+//! reaches fips0 and gets a RST from the node).
+//!
+//! This module owns the whole lifecycle of the `90-ssh.nft` drop-in, exactly
+//! the way `config.rs` owns `80-web-ui.nft` — a hand-added rule and this
+//! feature can never fight over the same slot:
+//!
+//!   * toggle OFF  → drop-in removed, port 22 refused again
+//!   * toggle ON   → drop-in written on every toggle change AND on every
+//!                   daemon config install (upgrade, reconnect, self-heal),
+//!                   so the on-state survives reinstalls idempotently
+//!   * scope       → "any" (every mesh peer — a real exposure, gated in the
+//!                   UI behind an explicit confirmation) or an explicit list
+//!                   of mesh addresses
+//!
+//! Nothing else is touched: `80-web-ui.nft` / `85-app-ports.nft` belong to
+//! `config.rs`, and the sshd process itself is entirely the operator's.
+
+use std::net::Ipv6Addr;
+use std::path::Path;
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use tokio::process::Command;
+
+/// On-disk state under the archipelago data dir. Absent file = disabled,
+/// which is the safe default for every node that never touched the toggle.
+const STATE_FILE: &str = "fips-ssh-over-mesh.json";
+
+/// The drop-in slot this module owns. 90 sorts after the daemon's own
+/// drop-ins (80/85) so a human reading the directory sees the deliberate
+/// order; the include order does not change semantics for plain accepts.
+pub const DROPIN_PATH: &str = "/etc/fips/fips.d/90-ssh.nft";
+
+/// The hardening baseline this drop-in hangs off. Same file `config.rs`
+/// reloads after its own drop-ins.
+const FIPS_NFT: &str = "/etc/fips/fips.nft";
+
+/// Persisted toggle state.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct SshMeshState {
+    /// Whether port 22 is allowed through the fips0 baseline at all.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Mesh addresses (ULAs) the rule is restricted to. Empty = any mesh
+    /// peer. Kept as strings as-entered but validated as IPv6 on save.
+    #[serde(default)]
+    pub sources: Vec<String>,
+}
+
+fn state_path(data_dir: &Path) -> std::path::PathBuf {
+    data_dir.join(STATE_FILE)
+}
+
+/// Load the persisted state. Missing file = disabled, no sources — never an
+/// error, so a fresh node and a deleted file both mean "off".
+pub async fn load(data_dir: &Path) -> SshMeshState {
+    match tokio::fs::read_to_string(state_path(data_dir)).await {
+        Ok(content) => serde_json::from_str(&content).unwrap_or_default(),
+        Err(_) => SshMeshState::default(),
+    }
+}
+
+/// Validate and normalise an operator-supplied source list. Every entry must
+/// be a parseable IPv6 address (mesh addresses are full ULAs, not CIDRs) —
+/// anything else is refused with the offending entry named, so a typo can
+/// never silently narrow or widen the rule.
+pub fn validate_sources(raw: &[String]) -> Result<Vec<String>> {
+    let mut out = Vec::with_capacity(raw.len());
+    for entry in raw {
+        let trimmed = entry.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        let addr: Ipv6Addr = trimmed
+            .parse()
+            .with_context(|| format!("not a valid mesh (IPv6) address: {trimmed:?}"))?;
+        out.push(addr.to_string());
+    }
+    out.dedup();
+    Ok(out)
+}
+
+/// Render the nft drop-in for a state. The rule shape mirrors the interim
+/// manual unblock from the field notes (`ip6 saddr <ula> tcp dport 22
+/// accept`) — an unrestricted rule is the same statement without the saddr.
+pub fn render_dropin(state: &SshMeshState) -> String {
+    let mut out = String::from(
+        "# Written by archipelago — SSH over mesh (Settings → SSH over mesh).\n\
+         # Allows sshd (port 22) through the fips0 default-deny inbound\n\
+         # baseline. Remove = refused again; never edit 80/85-* by hand.\n",
+    );
+    if state.sources.is_empty() {
+        out.push_str("tcp dport 22 accept\n");
+    } else {
+        out.push_str(&format!(
+            "ip6 saddr {{ {} }} tcp dport 22 accept\n",
+            state.sources.join(", ")
+        ));
+    }
+    out
+}
+
+/// Write or remove the drop-in to match the persisted state, then reload the
+/// baseline so the change is live immediately. Returns whether a reload was
+/// attempted and succeeded — a node without the hardening baseline has
+/// nothing to reload (port 22 is governed by sshd and the host firewall
+/// there), which is reported rather than treated as failure.
+pub async fn reconcile(data_dir: &Path) -> Result<ReconcileOutcome> {
+    let state = load(data_dir).await;
+
+    if !state.enabled {
+        let removed = remove_dropin().await?;
+        let reloaded = reload_nft().await;
+        return Ok(ReconcileOutcome {
+            applied: false,
+            removed,
+            reloaded,
+        });
+    }
+
+    // Ensure /etc/fips/fips.d exists, exactly like config::install.
+    let out = Command::new("sudo")
+        .args(["install", "-d", "-m", "0755", "/etc/fips/fips.d"])
+        .output()
+        .await
+        .context("sudo install -d /etc/fips/fips.d")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "sudo install -d /etc/fips/fips.d failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+
+    let dropin = render_dropin(&state);
+    let stage = std::env::temp_dir().join(format!("fips-ssh-{}.nft", std::process::id()));
+    tokio::fs::write(&stage, &dropin)
+        .await
+        .context("stage ssh nft drop-in")?;
+    let install = Command::new("sudo")
+        .args(["install", "-m", "0644"])
+        .arg(&stage)
+        .arg(DROPIN_PATH)
+        .output()
+        .await;
+    let _ = tokio::fs::remove_file(&stage).await;
+    let install = install?;
+    if !install.status.success() {
+        anyhow::bail!(
+            "install {} failed: {}",
+            DROPIN_PATH,
+            String::from_utf8_lossy(&install.stderr).trim()
+        );
+    }
+
+    let reloaded = reload_nft().await;
+    Ok(ReconcileOutcome {
+        applied: true,
+        removed: false,
+        reloaded,
+    })
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ReconcileOutcome {
+    /// The allow rule is in place.
+    pub applied: bool,
+    /// A previously-written drop-in was removed this call.
+    pub removed: bool,
+    /// The hardening baseline existed and `nft -f` succeeded.
+    pub reloaded: bool,
+}
+
+async fn remove_dropin() -> Result<bool> {
+    match tokio::fs::try_exists(DROPIN_PATH).await {
+        Ok(true) => {}
+        _ => return Ok(false),
+    }
+    let out = Command::new("sudo")
+        .args(["rm", "-f", DROPIN_PATH])
+        .output()
+        .await
+        .context("sudo rm 90-ssh.nft")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "removing {} failed: {}",
+            DROPIN_PATH,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!("ssh-over-mesh: drop-in removed — port 22 refused over fips0 again");
+    Ok(true)
+}
+
+/// Reload the hardening baseline. Best-effort in the same spirit as
+/// `config.rs`: absent baseline (nothing to reload) → Ok(false); a failed
+/// reload is Ok(false) with a warn, never an error — the drop-in is on disk
+/// either way and the next daemon install reloads it.
+async fn reload_nft() -> bool {
+    match tokio::fs::try_exists(FIPS_NFT).await {
+        Ok(true) => {}
+        _ => return false,
+    }
+    match Command::new("sudo")
+        .args(["nft", "-f", FIPS_NFT])
+        .output()
+        .await
+    {
+        Ok(out) if out.status.success() => true,
+        Ok(out) => {
+            tracing::warn!(
+                "ssh-over-mesh: nft reload failed: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            );
+            false
+        }
+        Err(e) => {
+            tracing::warn!("ssh-over-mesh: nft reload failed: {e}");
+            false
+        }
+    }
+}
+
+/// Persist new state and reconcile immediately. Validation happens here so
+/// an invalid source list can never reach disk, and reconcile reads back
+/// exactly what was saved.
+pub async fn set(
+    data_dir: &Path,
+    enabled: bool,
+    sources: &[String],
+) -> Result<(SshMeshState, ReconcileOutcome)> {
+    let state = SshMeshState {
+        enabled,
+        sources: validate_sources(sources)?,
+    };
+    tokio::fs::create_dir_all(data_dir)
+        .await
+        .with_context(|| format!("mkdir -p {}", data_dir.display()))?;
+    tokio::fs::write(state_path(data_dir), serde_json::to_string_pretty(&state)?)
+        .await
+        .with_context(|| format!("write {}", state_path(data_dir).display()))?;
+    let outcome = reconcile(data_dir).await?;
+    Ok((state, outcome))
+}
+
+/// Preflights surfaced in the settings card. None of these gate the toggle —
+/// they explain it: writing the rule on a node whose sshd doesn't listen on
+/// IPv6 simply has no effect until sshd does, and the card says so instead of
+/// the user discovering it as a silent connection failure.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct SshPreflights {
+    /// ssh.service (or sshd.service) is active.
+    pub sshd_active: bool,
+    /// Something listens on :22 for IPv6 (`[::]:22` or a dual-stack `*:22`).
+    /// fips0 is IPv6-only, so a 0.0.0.0-bound sshd is unreachable over it.
+    pub sshd_ipv6_listen: bool,
+    /// sshd_config's PasswordAuthentication (last directive wins, includes
+    /// after the main file). None = not found / unreadable.
+    pub password_auth: Option<bool>,
+}
+
+pub async fn preflights() -> SshPreflights {
+    SshPreflights {
+        sshd_active: sshd_active().await,
+        sshd_ipv6_listen: sshd_ipv6_listen().await,
+        password_auth: password_auth_enabled().await,
+    }
+}
+
+async fn sshd_active() -> bool {
+    for unit in ["ssh", "sshd"] {
+        if let Ok(out) = Command::new("systemctl")
+            .args(["is-active", "--quiet", unit])
+            .output()
+            .await
+        {
+            if out.status.success() {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+async fn sshd_ipv6_listen() -> bool {
+    let Ok(out) = Command::new("ss").args(["-H", "-tln"]).output().await else {
+        return false;
+    };
+    let text = String::from_utf8_lossy(&out.stdout);
+    text.lines().any(|line| {
+        let mut cols = line.split_whitespace();
+        // -t -l: State Recv-Q Send-Q Local:Port Peer:Port → local is col 4.
+        let _state = cols.next();
+        let _recv = cols.next();
+        let _send = cols.next();
+        match cols.next() {
+            Some(local) => {
+                let port_ok = local.rsplit(':').next() == Some("22");
+                let v6 = local.starts_with("[::]") || local.starts_with('*');
+                port_ok && v6
+            }
+            None => false,
+        }
+    })
+}
+
+async fn password_auth_enabled() -> Option<bool> {
+    let mut directives: Vec<bool> = Vec::new();
+    if let Ok(main) = tokio::fs::read_to_string("/etc/ssh/sshd_config").await {
+        collect_password_auth(&main, &mut directives);
+    }
+    if let Ok(includes) = glob_sorted("/etc/ssh/sshd_config.d/*.conf").await {
+        for path in includes {
+            if let Ok(content) = tokio::fs::read_to_string(&path).await {
+                collect_password_auth(&content, &mut directives);
+            }
+        }
+    }
+    directives.pop()
+}
+
+fn collect_password_auth(content: &str, out: &mut Vec<bool>) {
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(rest) = trimmed.strip_prefix("PasswordAuthentication") {
+            let rest = rest.trim_start();
+            let value = rest.split_whitespace().next().unwrap_or("");
+            if value.eq_ignore_ascii_case("yes") {
+                out.push(true);
+            } else if value.eq_ignore_ascii_case("no") {
+                out.push(false);
+            }
+        }
+    }
+}
+
+async fn glob_sorted(pattern: &str) -> Result<Vec<std::path::PathBuf>> {
+    let dir = std::path::Path::new(pattern)
+        .parent()
+        .unwrap_or_else(|| Path::new("/"));
+    let prefix = std::path::Path::new(pattern)
+        .file_name()
+        .and_then(|n| n.to_str())
+        .and_then(|n| n.split('.').next())
+        .unwrap_or("")
+        .to_string();
+    let mut files: Vec<std::path::PathBuf> = Vec::new();
+    let mut entries = tokio::fs::read_dir(dir)
+        .await
+        .context("read sshd_config.d")?;
+    while let Ok(Some(entry)) = entries.next_entry().await {
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if name.starts_with(&prefix) && name.ends_with(".conf") {
+            files.push(entry.path());
+        }
+    }
+    files.sort();
+    Ok(files)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn disabled_is_the_default_and_missing_file_is_not_an_error() {
+        let dir = tempfile::tempdir().unwrap();
+        let state = tokio::runtime::Runtime::new()
+            .unwrap()
+            .block_on(load(dir.path()));
+        assert!(!state.enabled);
+        assert!(state.sources.is_empty());
+    }
+
+    #[test]
+    fn any_peer_dropin_is_an_unrestricted_accept() {
+        let state = SshMeshState {
+            enabled: true,
+            sources: vec![],
+        };
+        let out = render_dropin(&state);
+        assert!(out.contains("tcp dport 22 accept"));
+        assert!(!out.contains("ip6 saddr"), "no saddr restriction expected");
+    }
+
+    #[test]
+    fn source_list_dropin_restricts_to_those_addresses() {
+        let state = SshMeshState {
+            enabled: true,
+            sources: vec![
+                "fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586".to_string(),
+                "fd79:1aa:b9e9:4c9f:1f80:5376:9385:1824".to_string(),
+            ],
+        };
+        let out = render_dropin(&state);
+        assert!(out.contains("ip6 saddr { fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586, fd79:1aa:b9e9:4c9f:1f80:5376:9385:1824 } tcp dport 22 accept"));
+    }
+
+    #[test]
+    fn sources_must_be_ipv6_and_are_normalised() {
+        let bad = validate_sources(&["192.168.1.5".to_string()]).unwrap_err();
+        assert!(bad.to_string().contains("192.168.1.5"));
+
+        let bad = validate_sources(&["not-an-address".to_string()]).unwrap_err();
+        assert!(bad.to_string().contains("not-an-address"));
+
+        // Uppercase/whitespace entries normalise to canonical lowercase.
+        let ok = validate_sources(&[
+            " FD68:496D:FE34:A06D:0CF1:06E4:B6A4:3586 ".to_string(),
+            "fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586".to_string(),
+            String::new(),
+        ])
+        .unwrap();
+        assert_eq!(
+            ok,
+            vec!["fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586".to_string()]
+        );
+    }
+
+    #[test]
+    fn state_round_trips_through_disk() {
+        let dir = tempfile::tempdir().unwrap();
+        let state = SshMeshState {
+            enabled: true,
+            sources: vec!["fd00::1".to_string()],
+        };
+        std::fs::write(
+            dir.path().join(STATE_FILE),
+            serde_json::to_string(&state).unwrap(),
+        )
+        .unwrap();
+        let loaded = tokio::runtime::Runtime::new()
+            .unwrap()
+            .block_on(load(dir.path()));
+        assert_eq!(loaded, state);
+    }
+
+    #[test]
+    fn set_validates_before_persisting() {
+        let dir = tempfile::tempdir().unwrap();
+        let rt = tokio::runtime::Runtime::new().unwrap();
+        let err = rt
+            .block_on(set(dir.path(), true, &["bogus".to_string()]))
+            .unwrap_err();
+        assert!(err.to_string().contains("bogus"));
+        // Nothing was persisted.
+        let state = rt.block_on(load(dir.path()));
+        assert!(!state.enabled);
+    }
+
+    #[test]
+    fn preflight_parse_helpers_cover_the_directives() {
+        let mut directives = Vec::new();
+        collect_password_auth(
+            "# comment\nPasswordAuthentication yes\nMatch all\n  PasswordAuthentication no\n",
+            &mut directives,
+        );
+        assert_eq!(directives, vec![true, false]);
+    }
+
+    #[test]
+    fn sshd_ipv6_listen_recognises_dual_stack_and_v6_only() {
+        assert!(line_listens("[::]:22"));
+        assert!(line_listens("*:22"));
+        assert!(!line_listens("0.0.0.0:22"));
+        assert!(!line_listens("[::]:80"));
+    }
+
+    fn line_listens(local: &str) -> bool {
+        let line = format!("LISTEN 0 128 {local} 0.0.0.0:*");
+        let mut cols = line.split_whitespace();
+        cols.next();
+        cols.next();
+        cols.next();
+        match cols.next() {
+            Some(l) => {
+                let port_ok = l.rsplit(':').next() == Some("22");
+                let v6 = l.starts_with("[::]") || l.starts_with('*');
+                port_ok && v6
+            }
+            None => false,
+        }
+    }
+}
@@ -841,6 +841,37 @@ impl Server {
            });
        }

+        // LND channel-peer watchdog — every 2 minutes, reconnect the peers
+        // of open channels that LND has not re-established on its own. LND's
+        // reconnect logic gives up with a long backoff after repeated or
+        // extended downtime (an app update, a reboot, reconciler churn), and
+        // while the peer link is down BOTH endpoints keep the channel flagged
+        // `disabled` in the routing graph — payments fail "no route" in both
+        // directions while the node itself looks perfectly healthy. The
+        // channel graph is desired state; this keeps it (framework-pt,
+        // 2026-09-01: only channel unroutable ~17h after the 0.21.2 update).
+        // No-ops quietly on nodes without LND. Per-peer retries are throttled
+        // to 10 minutes so an unreachable peer is not hammered every pass.
+        {
+            tokio::spawn(async move {
+                let mut interval = tokio::time::interval(Duration::from_secs(120));
+                let mut last_attempt: HashMap<String, Instant> = HashMap::new();
+                loop {
+                    interval.tick().await;
+                    match crate::container::lnd::reconnect_disconnected_channel_peers(
+                        &mut last_attempt,
+                        Duration::from_secs(600),
+                    )
+                    .await
+                    {
+                        Ok(0) => {}
+                        Ok(n) => info!(n, "LND channel-peer watchdog reconnected channel peers"),
+                        Err(e) => debug!("LND channel-peer watchdog (non-fatal): {}", e),
+                    }
+                }
+            });
+        }
+
        // FIPS seed-anchor apply loop — every 5 minutes we re-push the
        // configured seed anchors into the running fips daemon via
        // `fipsctl connect`. This keeps the mesh bootstrap resilient:
@@ -207,7 +207,15 @@ impl CashuToken {
    }

    /// Decode a cashuA (V3 JSON) or cashuB (V4 CBOR) token string.
+    ///
+    /// Trims surrounding whitespace first: a token can arrive with stray
+    /// leading/trailing whitespace from a clipboard paste, or (confirmed
+    /// live, 2026-09-08) from Minibits' own NIP-04 claim-DM content, which
+    /// has a trailing space after the base64 — none of the base64 alphabets
+    /// in `decode_token_base64` tolerate that, so an otherwise-valid token
+    /// would hard-fail with "Invalid base64" instead of parsing.
    pub fn deserialize(token_str: &str) -> Result<Self> {
+        let token_str = token_str.trim();
        if let Some(payload) = token_str.strip_prefix(CASHU_B_PREFIX) {
            return Self::deserialize_v4(payload);
        }
@@ -508,6 +516,45 @@ mod tests {
        assert_eq!(decoded.memo, Some("test token".to_string()));
    }

+    /// Regression guard (2026-09-08): a real Minibits claim DM decrypted to
+    /// a cashuB token with a trailing space after the base64 payload, which
+    /// made every base64 alphabet in `decode_token_base64` reject it as
+    /// invalid — three real payments got stuck retrying forever with
+    /// "Invalid base64 in cashuB token" until `deserialize` started
+    /// trimming the whole string first. Whitespace can show up around a
+    /// token from more than one source (clipboard paste included), so this
+    /// covers cashuA too, and leading as well as trailing.
+    #[test]
+    fn deserialize_trims_stray_whitespace() {
+        let token = CashuToken {
+            token: vec![TokenEntry {
+                mint: "http://127.0.0.1:8175".to_string(),
+                proofs: vec![Proof {
+                    amount: 8,
+                    id: "009a1f293253e41e".to_string(),
+                    secret: "abcdef1234567890".to_string(),
+                    c: "02a9acc1e48c25eeeb9289b5031cc57da9fe72f3fe2861d94ec4da0e7f6c2b4e24"
+                        .to_string(),
+                }],
+            }],
+            memo: None,
+            unit: Some("sat".to_string()),
+        };
+        let encoded = token.serialize().unwrap();
+        assert!(encoded.starts_with("cashuA"));
+
+        for wrapped in [
+            format!("{encoded} "),
+            format!(" {encoded}"),
+            format!(" {encoded}\n"),
+            format!("{encoded}\t"),
+        ] {
+            let decoded = CashuToken::deserialize(&wrapped)
+                .unwrap_or_else(|e| panic!("failed on {wrapped:?}: {e}"));
+            assert_eq!(decoded.total_amount(), 8);
+        }
+    }
+
    #[test]
    fn test_total_amount_multi_proof() {
        let token = CashuToken {
@@ -71,10 +71,16 @@ pub struct MintResult {
 /// keyset codes shared by NUT-02/03/04/05 — the codes a swap/melt/mint call
 /// can actually hit. Returns `None` for anything else (e.g. Lightning/quote
 /// codes in the 20000s) so the caller falls back to the mint's own `detail`.
+/// Text of the NUT error-code-11001 translation, exposed so callers that
+/// received an `anyhow::Error` from a receive/redeem path (e.g. Minibits
+/// claim replay) can recognize an already-spent token as terminal rather than
+/// retrying it forever.
+pub const ALREADY_REDEEMED_MSG: &str = "This ecash has already been redeemed — it can't be claimed twice.";
+
 fn describe_mint_error_code(code: i64) -> Option<&'static str> {
    Some(match code {
        10001 => "The mint rejected these coins as invalid.",
-        11001 => "This ecash has already been redeemed — it can't be claimed twice.",
+        11001 => ALREADY_REDEEMED_MSG,
        11002 => "This ecash is already being redeemed elsewhere — try again in a moment.",
        11003 => "The mint already issued new coins for this exact request — there's nothing left to redeem.",
        11004 => "This request is still being processed by the mint — try again in a moment.",
@@ -6,6 +6,7 @@ pub mod bdhke;
 pub mod cashu;
 pub mod ecash;
 pub mod fedimint_client;
+pub mod minibits;
 pub mod mint_client;
 pub mod nut13;
 pub mod profits;
@@ -137,6 +137,18 @@ impl EcashSeed {
        self.mnemonic.words().map(|w| w.to_string()).collect()
    }

+    /// The phrase as a single string — the input to NUT-13 *and* to the NIP-06
+    /// Nostr derivation the Minibits profile flow needs (`crate::wallet::minibits`).
+    pub fn phrase(&self) -> String {
+        self.mnemonic.to_string()
+    }
+
+    /// The 64-byte BIP-39 seed. Same bytes Minibits hashes with SHA-256 to get
+    /// its `seedHash`, so the two wallets agree on wallet identity.
+    pub fn seed_bytes(&self) -> [u8; 64] {
+        self.seed
+    }
+
    pub fn source(&self) -> SeedSource {
        self.source
    }
@@ -15,25 +15,32 @@ pub enum PkgManager {
 impl Router {
    /// Detect which package manager is available.
    ///
-    /// - If `/usr/bin/opkg` exists → `PkgManager::Opkg` (nothing to do).
-    /// - If `/usr/bin/apk` exists → run `apk update` (switching repos to HTTP
+    /// Looks up `opkg`/`apk` via the router's `$PATH` (`command -v`) rather
+    /// than a hardcoded `/usr/bin/<tool>` — official OpenWrt images don't all
+    /// symlink `/bin` into `/usr/bin` (e.g. the `glinet_gl-mt3000` 24.10.2
+    /// build keeps them as separate real directories with `opkg` living in
+    /// `/bin`), so a fixed absolute path silently misses a perfectly normal
+    /// install and reports "no package management" (archy-x250-pa3, 2026-09-05).
+    ///
+    /// - If `opkg` is on PATH → `PkgManager::Opkg` (nothing to do).
+    /// - If `apk` is on PATH → run `apk update` (switching repos to HTTP
    ///   first to work around missing CA bundle on fresh images), then try
    ///   `apk add opkg`.  If opkg is in the repos → `Opkg`.  If not (OpenWrt
    ///   25.x) → `ApkNative`.
    /// - Neither found → error.
    pub fn opkg_check(&self) -> Result<PkgManager> {
-        let (_, code) = self.run("test -x /usr/bin/opkg")?;
+        let (_, code) = self.run("command -v opkg >/dev/null 2>&1")?;
        if code == 0 {
            return Ok(PkgManager::Opkg);
        }

-        let (_, apk_code) = self.run("test -x /usr/bin/apk")?;
+        let (_, apk_code) = self.run("command -v apk >/dev/null 2>&1")?;
        if apk_code == 0 {
            info!("[{}] opkg not found — using apk (OpenWrt 25.x+)", self.host);
            // Fresh images ship without a CA bundle; switch repos to HTTP so
            // apk's wget can reach the package index without TLS verification.
            self.run_ok("sed -i 's|https://|http://|g' /etc/apk/repositories 2>/dev/null || true")?;
-            let (update_out, update_code) = self.run("/usr/bin/apk update 2>&1")?;
+            let (update_out, update_code) = self.run("apk update 2>&1")?;
            if update_code != 0 {
                anyhow::bail!(
                    "apk update failed (exit {}) — router may have no internet access. \
@@ -43,7 +50,7 @@ impl Router {
                );
            }
            // Try to install opkg (only available on some 25.x builds).
-            let (add_out, add_code) = self.run("/usr/bin/apk add opkg 2>&1")?;
+            let (add_out, add_code) = self.run("apk add opkg 2>&1")?;
            if add_code == 0 {
                return Ok(PkgManager::Opkg);
            }
@@ -62,7 +69,7 @@ impl Router {
        }

        anyhow::bail!(
-            "opkg not found at /usr/bin/opkg — this router's firmware may not \
+            "Neither opkg nor apk found on this router's $PATH — its firmware may not \
             support package management (TollGate requires a standard OpenWrt build)"
        );
    }
@@ -70,31 +77,28 @@ impl Router {
    /// `opkg update` — refresh package lists.
    pub fn opkg_update(&self) -> Result<()> {
        info!("[{}] opkg update", self.host);
-        self.run_ok("/usr/bin/opkg update")?;
+        self.run_ok("opkg update")?;
        Ok(())
    }

    /// Install a package, skipping if already installed.
    pub fn opkg_install(&self, package: &str) -> Result<()> {
        // Check if already installed to avoid unnecessary network traffic.
-        let (_, code) = self.run(&format!(
-            "/usr/bin/opkg list-installed | grep -q '^{} '",
-            package
-        ))?;
+        let (_, code) = self.run(&format!("opkg list-installed | grep -q '^{} '", package))?;
        if code == 0 {
            info!("[{}] {} already installed", self.host, package);
            return Ok(());
        }

        info!("[{}] opkg install {}", self.host, package);
-        self.run_ok(&format!("/usr/bin/opkg install {}", package))?;
+        self.run_ok(&format!("opkg install {}", package))?;
        Ok(())
    }

    /// Remove a package.
    pub fn opkg_remove(&self, package: &str) -> Result<()> {
        info!("[{}] opkg remove {}", self.host, package);
-        self.run_ok(&format!("/usr/bin/opkg remove {}", package))?;
+        self.run_ok(&format!("opkg remove {}", package))?;
        Ok(())
    }

@@ -121,7 +125,7 @@ impl Router {
        }

        info!("[{}] apk add {}", self.host, package);
-        self.run_ok(&format!("/usr/bin/apk add {}", package))?;
+        self.run_ok(&format!("apk add {}", package))?;
        Ok(())
    }
 }
@@ -6,18 +6,53 @@ use crate::Router;
 /// The OpenWrt package name for the TollGate reference implementation.
 const TOLLGATE_PACKAGE: &str = "tollgate-module-basic-go";

-/// Direct-download fallback URLs by opkg architecture string.
+/// Pinned upstream release. Was stuck on v0.2.0 (Oct 2025) until 2026-09-05 —
+/// nine releases behind. v0.5.0's changelog covers exactly the failure modes
+/// hit live against archy-x250-pa3: a mint with an empty/broken keyset used
+/// to crash-loop the daemon forever ("graceful degradation when Cashu mints
+/// fail" in v0.5.0), and the bundled captive-portal build had no CBOR support
+/// at all, so it could only decode legacy `cashuA` tokens — rejecting the
+/// `cashuB` (NUT-00 V4) tokens modern wallets like Minibits generate by
+/// default ("portal improvements" in v0.5.0 include a JS bundle update that
+/// should carry a current cashu-ts with V4 support). Bump this string to move
+/// both this crate's URLs and the version baked into the source comments.
+const TOLLGATE_VERSION: &str = "v0.5.0";
+
+/// Direct-download fallback URLs by opkg architecture string, for the
+/// `.ipk` (ar-archive) package format.
 /// Used when the package is not in any configured feed.
-/// Source: https://github.com/OpenTollGate/tollgate-module-basic-go/releases/tag/v0.2.0
-fn ipk_url(arch: &str) -> Option<&'static str> {
-    match arch {
-        "mips_24kc"          => Some("https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/v0.2.0/mips_24kc.ipk"),
-        "mipsel_24kc"        => Some("https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/v0.2.0/mipsel_24kc.ipk"),
-        "aarch64_cortex-a53" => Some("https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/v0.2.0/aarch64_cortex-a53.ipk"),
-        "aarch64_cortex-a72" => Some("https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/v0.2.0/aarch64_cortex-a72.ipk"),
-        "arm_cortex-a7"      => Some("https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/v0.2.0/arm_cortex-a7.ipk"),
-        _ => None,
-    }
+/// Source: https://github.com/OpenTollGate/tollgate-module-basic-go/releases/tag/v0.5.0
+fn ipk_url(arch: &str) -> Option<String> {
+    let name = match arch {
+        "mips_24kc" => "mips_24kc",
+        "mipsel_24kc" => "mipsel_24kc",
+        "aarch64_cortex-a53" => "aarch64_cortex-a53",
+        "aarch64_cortex-a72" => "aarch64_cortex-a72",
+        "arm_cortex-a7" => "arm_cortex-a7",
+        "x86_64" => "x86_64",
+        _ => return None,
+    };
+    Some(format!(
+        "https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/{TOLLGATE_VERSION}/tollgate-wrt_{TOLLGATE_VERSION}_{name}.ipk"
+    ))
+}
+
+/// Direct-download URLs for the native Alpine-style `.apk` package format —
+/// only published for a subset of architectures as of v0.5.0. Where
+/// available this is strictly better than [`ipk_url`] on an apk-native
+/// (OpenWrt 25.x+) router: `apk add` installs it directly (dependency
+/// resolution, postinst, uci-defaults all handled by apk itself), instead of
+/// the manual `ar`/`tar` extraction dance `install_ipk` has to do to unpack
+/// an `.ipk` on a router with no `opkg`.
+fn apk_url(arch: &str) -> Option<String> {
+    let name = match arch {
+        "aarch64_cortex-a53" => "aarch64_cortex-a53",
+        "x86_64" => "x86_64",
+        _ => return None,
+    };
+    Some(format!(
+        "https://github.com/OpenTollGate/tollgate-module-basic-go/releases/download/{TOLLGATE_VERSION}/tollgate-wrt_{TOLLGATE_VERSION}_{name}.apk"
+    ))
 }

 /// Install tollgate-module-basic-go via opkg (OpenWrt ≤24.x).
@@ -34,8 +69,9 @@ pub fn install_tollgate(router: &Router) -> Result<()> {
    }

    // Package not in any feed — download the .ipk directly.
-    let arch = router
-        .run_ok("/usr/bin/opkg print-architecture | grep -v all | grep -v noarch | tail -1 | awk '{print $2}'")?;
+    let arch = router.run_ok(
+        "opkg print-architecture | grep -v all | grep -v noarch | tail -1 | awk '{print $2}'",
+    )?;
    let arch = arch.trim();

    let url = ipk_url(arch).ok_or_else(|| {
@@ -88,7 +124,7 @@ pub fn install_tollgate_apk_native(router: &Router) -> Result<()> {
        ". /etc/openwrt_release 2>/dev/null \
         && a=\"${DISTRIB_ARCH:-${OPENWRT_ARCH:-}}\" \
         && [ -n \"$a\" ] && echo \"$a\" \
-         || /usr/bin/apk --print-arch 2>/dev/null \
+         || apk --print-arch 2>/dev/null \
         || uname -m",
    )?;
    // Normalise: uname -m returns bare "mipsel"/"mips"; map to 24kc variant
@@ -103,6 +139,38 @@ pub fn install_tollgate_apk_native(router: &Router) -> Result<()> {
        anyhow::bail!("Could not determine router architecture");
    }

+    // Prefer a native .apk when the release publishes one for this arch —
+    // `apk add` handles the install itself (deps, postinst, uci-defaults),
+    // skipping the manual ar/tar extraction the .ipk fallback below needs.
+    if let Some(url) = apk_url(arch) {
+        info!(
+            "[{}] Downloading native TollGate .apk for {} from GitHub releases",
+            router.host, arch
+        );
+        let (dl_out, dl_code) = router.run(&format!(
+            "wget --no-check-certificate -O /tmp/tollgate.apk '{}' 2>&1",
+            url
+        ))?;
+        if dl_code != 0 {
+            anyhow::bail!("TollGate .apk download failed: {}", dl_out.trim());
+        }
+        let (size_out, _) = router.run("wc -c < /tmp/tollgate.apk 2>/dev/null")?;
+        let size: u64 = size_out.trim().parse().unwrap_or(0);
+        if size < 50_000 {
+            anyhow::bail!(
+                "Downloaded TollGate .apk is only {}B — wget likely captured an error page. \
+                 Check router internet access and that the release URL is reachable.",
+                size
+            );
+        }
+        let (add_out, add_code) = router.run("apk add --allow-untrusted /tmp/tollgate.apk 2>&1")?;
+        router.run_ok("rm -f /tmp/tollgate.apk")?;
+        if add_code != 0 {
+            anyhow::bail!("TollGate .apk install failed: {}", add_out.trim());
+        }
+        return Ok(());
+    }
+
    let url = ipk_url(arch).ok_or_else(|| {
        anyhow::anyhow!(
            "No pre-built TollGate package for architecture '{}'. \
@@ -10,6 +10,7 @@ disagree, the code wins and the doc is a bug.
 - [Talking to your node](COMMANDS.md) — the conversational command surface
 - [Seed Verification](SEED-VERIFICATION.md) — independently verify your 24-word backup
 - [Troubleshooting](troubleshooting.md) — common problems and how to resolve them
+- [OpenWrt Gateway Setup](openwrt-gateway-setup.md) — pairing an OpenWrt router and provisioning TollGate pay-as-you-go WiFi
 - [Gamepad / Controller Navigation](GAMEPAD-NAV.md) — driving the UI from a controller
 - [Pine voice commands](pine-voice-commands.md) — the voice-satellite phrase surface

@@ -0,0 +1,108 @@
+# Incident + follow-up tracker — 2026-09-01 (post-HTTPS-work, post-LND-0.21.2 breakage)
+
+Live incident spanning framework-pt and shorty-s after the HTTPS/launcher
+work and the LND 0.18.4→0.21.2 pin bump. Root causes found on real nodes;
+status updated as work lands. Each fix ships with a regression test so the
+same class cannot silently return.
+
+## A. Root causes (all verified live)
+
+| # | Symptom | Root cause |
+|---|---------|-----------|
+| A1 | LND sends fail "Payment failed: Not Found" | LND 0.21 **removed** the deprecated `/v1/channels/transactions` REST route; backend still called it. Receive was fine; the "Failed to fetch" on framework-pt was A3 masking it. |
+| A2 | Shorty NPM restart-loops (counter 3176) | Manifest conversion (fc68c5b6) dropped (a) the `/etc/letsencrypt` mount NPM's s6 boot demands, and (b) `NET_BIND_SERVICE` — its internal nginx binds 80/443/81 and the orchestrator runs `--cap-drop=ALL`. |
+| A3 | framework-pt: every `/rpc/v1` fetch CORS-blocked, "Failed to fetch", dashboard "not responding", mempool/indeehub frames broken | nginx sent `Strict-Transport-Security: max-age=31536000; includeSubDomains` on **HTTPS**; browsers cached it, then silently upgraded the still-open **http** dashboard's fetches/frames to https → scheme change = cross-origin → CORS block. HTTP is a supported mode on purpose (self-signed cert, /ca.crt flow). |
+| A4 | Mempool/IndeeHub/bitcoin-UI frames stay `http://` on HTTPS pages (mixed content, "does not connect") | `portAuth()` looked the launch port up under the launch alias (`mempool-web`, `lnd`, `bitcoin-knots`…); the signed catalog declares those ports under the manifest id that owns them (`archy-mempool-web`, `lnd-ui`, `bitcoin-ui`) → miss → launcher fell back to http. Cache also only warmed in Store/Discover views. |
+| A5 | IndeeHub nostr sign-in dead over HTTPS | NIP-07 bridge compared `event.origin` for strict equality with the stored (http) app URL and replied to the **stored** URL as postMessage targetOrigin — both break when the frame was scheme-upgraded. |
+| A6 | Portainer "disappeared" after restart/update, then demands a setup token "see server logs" | Update to 2.45.0 recreated the container; on a fresh DB Portainer ≥2.21 mints a one-time setup token printed ONLY in container logs — hostile appliance UX. The "disappearance" was the recreate + this unknown-token first screen. |
+
+## B. Fixes (code)
+
+| Fix | Files | Status |
+|-----|-------|--------|
+| B1 LND pay via `Router.SendPaymentV2` (`/v2/router/send`), pending-status + actionable failure reasons preserved | `core/archipelago/src/api/rpc/lnd/payments.rs` (+ unit tests) | ✅ code |
+| B2 Portainer setup token surfaced in the existing credentials interstitial (`package.credentials` → AppSidebar card with copy) | `core/archipelago/src/api/rpc/package/install.rs` (+ unit tests) | ✅ code |
+| B3 HSTS: none on :80, `max-age=0` on :443 (actively clears cached policy) | `image-recipe/configs/nginx-archipelago.conf` | ✅ code |
+| B4 NPM manifest: `/etc/letsencrypt` mount + `NET_BIND_SERVICE` | `apps/nginx-proxy-manager/manifest.yml` | ✅ code |
+| B5 `portAuth` alias resolution + unanimous port-wide fallback | `neode-ui/src/views/discover/curatedApps.ts` | ✅ code |
+| B6 Catalog cache warmed at dashboard bootstrap | `neode-ui/src/App.vue` | ✅ |
+| B7 NIP-07 bridge: host/port equality + reply to `event.origin` | `neode-ui/src/stores/appLauncher.ts` ✅ · `neode-ui/src/views/appSession/useNostrBridge.ts` ✅ | ✅ |
+| B8 Stale LND 0.18.4 refs in test expectations | `tests/lifecycle/remote-lifecycle.sh` | ✅ |
+
+## C. Regression tests ("never again")
+
+| Test | Guards | Status |
+|------|-------|--------|
+| C1 Rust: router v2 response shape, nested errors, failure reasons | B1 | ✅ |
+| C2 Rust: setup-token log extraction (live-captured 2.45.0 line shape) | B2 | ✅ |
+| C3 bats: `lnd-api-compat` — POST `/v2/router/send` on the running LND must answer (never 404) | B1 vs image skew at gate time | ✅ (route probe verified live on shorty: HTTP 500 ≠ 404) |
+| C4 bats: nginx must NOT send HSTS on :80; :443 must send `max-age=0` | B3 | ✅ |
+| C5 neode-ui unit: portAuth alias + unanimous-scan (incl. bitcoin-knots→8334 https) | B5/B4-mixed-content | ✅ (6 tests) |
+| C6 neode-ui unit: bridge origin equality ignores scheme | B7 | ✅ (2 tests) |
+
+Backend suites: 34 targeted Rust tests green (payments v2 shape, setup-token
+extraction, lnd wallet/info regressions); middleware/dispatcher suite green;
+full neode-ui suite green (62 tests in the touched areas); production bundle
+built and verified to embed the alias fix. `cargo fmt` applied.
+
+## D. Deploy & live verification
+
+| Step | Status |
+|------|--------|
+| D1 shorty NPM crash-loop stopped cleanly (user-stopped marker; public hosts keep serving via host nginx mirror) | ✅ 12:52Z |
+| D2 shorty live nginx HSTS patch + reload | ✅ verified: :80 and :443 both answer `max-age=0` |
+| D3 Regenerate catalog (releases/app-catalog.json + store copies) | ✅ semantic diff = exactly the two NPM fixes |
+| D4 **User runs `scripts/sign-catalog.sh`** (signer built at /tmp/archy-sign-bin) | ✅ catalog signed + committed + pushed |
+| D5 Commit + push (origin + gitea-vps2 OTA mirror) | ✅ 9 commits pushed |
+| D6 Release v1.8.9-alpha: `scripts/create-release.sh 1.8.9-alpha` (mnemonic) → `scripts/publish-release-assets.sh 1.8.9-alpha gitea-vps2` | ✅ PUBLISHED (tag v1.8.9-alpha, releases/manifest.json live, backend+frontend assets verified by the script) |
+| D7 OTA on shorty-s + framework-pt (Update button; shorty is on 1.8.8-alpha, daily check — hit Update now) | ⬜ user action |
+| D8 shorty: clear the NPM user-stopped marker + Start (or it starts via the fixed catalog) | ✅ NPM LIVE-HEALED via the signed catalog: unit regenerated with both fixes, container up, admin UI HTTP 200 on :8081 (verified 15:42Z) |
+| D9 framework-pt: Start Mempool — its containers are confirmed stopped (port 4080 refuses; gate answers on 7778/8334/50002/18083 so those apps will embed over https immediately) | ⬜ |
+| D10 Post-deploy live checks: LND send+receive; mempool/IndeeHub/bitcoin-UI frames over https; NPM healthy + admin :8081 ✅; portainer token card on fresh DB; zero CORS errors | ⬜ after nodes update |
+
+## E. Follow-ups discovered during the incident (ride the NEXT release, v1.8.10+)
+
+- **LND channel-peer watchdog** (this release's headline platform fix): every
+  2 minutes the daemon reconnects peers of open channels that LND has not
+  re-established on its own (per-peer retry throttled to 10 minutes), using
+  the peer's advertised addresses from the public graph. Kills the whole
+  class this incident exposed — a channel unroutable ~17h after an LND update
+  while both nodes looked healthy. Unit tests pin the selection logic over the
+  live REST shapes.
+- **Funding-modal honesty fix** (1464b1b2): the
+  Lightning "no channel" modal now states the node's real state — pending
+  channel confirming / balance on the far side / payment couldn't route /
+  genuinely no channels. Note the stale-direction defect it fixes: the
+  payment-failure mapper never set the direction, so a SEND failure showed
+  the RECEIVE-branch copy ("Receiving needs inbound liquidity…") — the exact
+  modal users saw while their node had a healthy 583k-outbound channel.
+  Both fixes have their v1.8.10 CHANGELOG + What's New entries staged so the
+  next `create-release.sh 1.8.10-alpha` runs clean first time.
+- Nodes poll for OTA updates on `daily_check` — after publishing, tell the
+  user to hit Update rather than wait for the next check.
+- `origin` remote had a stale pushurl with a dead token (pushes failed);
+  fixed to the canonical repo URL, stale `~/.git-credentials` entry with an
+  encoded port removed.
+
+## F. Post-v1.8.9 verification on shorty-s (2026-09-01 evening)
+
+- v1.8.9 applied; payment pipeline confirmed live: a 400,000 sat payment
+  SUCCEEDED through the v2 router route; the 404s are gone.
+- App gate serves TLS on 4080/8334/18083/50002 (401 gate pages over https) —
+  https app frames now answer. Mempool over https requires a hard refresh
+  (PWA precaches the old bundle).
+- **"No route to the recipient" on sends is real**: the invoices being tested
+  are from framework-pt, whose only channel (peer "Sandwich Farm",
+  0224c955…) is flagged `disabled` on BOTH policy sides in the routing graph
+  after today's node churn — the peer connection never re-established
+  (LND's reconnect backoff can stretch to hours). A disabled edge is
+  unroutable in both directions, so payments to/from framework-pt fail
+  regardless of shorty's 583k outbound. Fix: `lncli connect` the peer, wait
+  for the channel_update to re-enable the edge (~minutes), then re-test.
+- The 577k attempt earlier failed for a different, correct reason: it exceeded
+  the channel's spendable balance (583,542 − 9,850 reserve ≈ 573k max).
+
+framework-pt immediate workaround until its OTA lands: open the dashboard by
+IP (`http://192.168.x.x`) instead of `framework-pt.local`, and/or clear the
+cached policy once via `chrome://net-internals/#hsts` → Delete domain security
+policies → `framework-pt.local`.
@@ -0,0 +1,299 @@
+# OpenWrt Gateway Setup
+
+How to connect an OpenWrt router to an Archipelago node and, optionally, turn
+it into a pay-as-you-go WiFi gateway with **TollGate**. Written for a node
+operator following the UI; a developer-facing RPC/architecture reference is
+at the bottom.
+
+This feature manages a **separate physical (or virtual) router** running
+OpenWrt over SSH/UCI — it is not a containerized app. Archipelago itself does
+not flash or install OpenWrt; you bring a router that already runs it.
+
+## What you get
+
+- **Status dashboard**: hostname, uptime, firmware release, WiFi interfaces,
+  WAN state — polled live from the router.
+- **WAN/WISP wizard**: point the router's radio at an upstream WiFi network
+  (turns it into a wireless bridge/repeater) with DHCP + NAT configured for
+  you.
+- **TollGate provisioning** (optional): installs the
+  [TollGate](https://tollgate.me) captive-portal package
+  (`tollgate-module-basic-go`) and stands up an `archipelago` SSID that
+  sells timed internet access for sats, settled against this node's local
+  Cashu mint.
+
+## Prerequisites
+
+1. **A router already flashed with OpenWrt.** Check the
+   [OpenWrt Table of Hardware](https://openwrt.org/toh/start) for your model
+   and follow OpenWrt's own install/flashing instructions — that part is
+   outside Archipelago's scope. See below for a worked example (GL.iNet
+   AX3000).
+2. **SSH reachable.** Fresh OpenWrt images enable `dropbear` (SSH) on LAN by
+   default, listening as `root` with no password (or the password you set
+   during OpenWrt's first-boot wizard at `192.168.1.1`). Archipelago
+   connects with `ssh2` over a password (key-based auth is supported at the
+   library level but the UI only offers password so far).
+3. **Same LAN as the Archipelago node**, at least for setup — plug the
+   router's LAN port into the same switch/network segment the node is on.
+4. **For TollGate**: a running Cashu mint app (`nutshell`/`cashu-mint`) on
+   this node — provisioning defaults `mint_url` to
+   `http://<node-ip>:3338` and TollGate customers must be able to reach that
+   URL from outside the node's loopback.
+
+## Worked example: flashing a GL.iNet AX3000 to stock OpenWrt
+
+GL.iNet's "AX3000" travel router is the **Beryl AX (GL-MT3000)** —
+MediaTek MT7981B (Cortex-A53), OpenWrt target `mediatek/filogic`. It ships
+running a GL.iNet fork of OpenWrt with its own web UI and LuCI already
+enabled, but the steps below replace that with stock/vanilla OpenWrt so it
+matches the prebuilt TollGate `.ipk` architectures exactly
+(`aarch64_cortex-a53`).
+
+1. **Download the sysupgrade image** for the current stable release from
+   `https://downloads.openwrt.org/releases/<version>/targets/mediatek/filogic/`
+   — the file you want is
+   `openwrt-<version>-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin`.
+2. **Verify the checksum** against the `sha256sums` file in that same
+   directory before flashing anything.
+3. **Flash from the GL.iNet UI**: on the router's default address
+   (`192.168.8.1`), go to **More Settings → Upgrade → Local Upgrade**, or
+   open **Advanced → LuCI** and use **System → Backup / Flash Firmware →
+   Flash new firmware image**.
+4. Upload the `.bin` file. **Uncheck "Keep Settings"** — going from the
+   GL.iNet fork to stock OpenWrt needs a clean reset, not a config carry-over.
+5. Confirm and wait ~3–5 minutes without power-cycling the router.
+6. **After it reboots** you're on stock OpenWrt: LAN at `192.168.1.1`, DHCP
+   on, SSH (dropbear) open as `root` with **no password set yet** — set one
+   via LuCI at `192.168.1.1` or `passwd` over SSH before doing anything else.
+   From here, continue with the Prerequisites/Step 2 flow above to connect
+   it to the Archipelago node.
+
+   > The Archipelago UI's Connect form (Step 2) authenticates *with* a
+   > password — it has no flow for setting the initial one on a fresh,
+   > passwordless router. You have to set it out-of-band first. If you're
+   > working from the node's own local kiosk display rather than a normal
+   > desktop browser, there's no visible tab bar/address bar to open a new
+   > tab from — press **Ctrl+T** to open one anyway, navigate to
+   > `192.168.1.1`, and use LuCI's first-boot prompt to set the root
+   > password. Then switch back to the Archipelago tab and Connect with it.
+
+**If the flash fails / the router doesn't come back**: filogic devices
+don't use a reset-button recovery. Instead, connect to the router's LAN
+port and, during boot, press a key within the first ~2 seconds to enter
+U-Boot; per the OpenWrt wiki, typing `gl` then `httpd` at the U-Boot prompt
+brings up a recovery web UI at `192.168.1.2` that accepts a firmware image.
+
+## Step 1: Open the OpenWrt Gateway panel
+
+1. In the Archipelago UI, go to **Server**.
+2. Under the network status list, click **OpenWrt Gateway**
+   (`/dashboard/server/openwrt`).
+
+If no router has been connected before, you'll land on the connect form.
+
+## Step 2: Connect the router
+
+You have two options:
+
+- **Detect**: click **Detect** — this reads the node's own active wired
+  Ethernet interface, derives its subnet, and probes every host on it for
+  `TCP/22` + a valid `/etc/openwrt_release`. If it finds exactly one router
+  it fills in the host automatically; if it finds several you pick from the
+  list. A `/24` scan can take up to ~2 minutes (255 sequential probes at
+  500 ms each on hosts that don't respond).
+- **Manual**: type the router's LAN IP (commonly `192.168.1.1` on a router
+  freshly bridged in, or whatever address it has on your network) plus the
+  SSH username (default `root`) and password.
+
+Click **Connect**. On success the panel switches to the status dashboard and
+the connection (host + credentials) is persisted server-side — you won't
+need to re-enter them on future visits or from other views (e.g. the Home
+dashboard's network tile also polls this without prompting again).
+
+> Credentials are stored in `router_config.json` under the node's data
+> directory alongside other node config. There's no separate secrets
+> vault entry for this yet — treat the router's SSH password like any other
+> node-local config.
+
+## Step 3: (Optional) Configure WAN/WISP
+
+Use this to make the OpenWrt router pull its internet connection from an
+upstream WiFi network instead of a wired uplink — useful for a
+battery/off-grid TollGate node or extending coverage from an existing
+network.
+
+1. From the status dashboard, start the **WAN setup** wizard.
+2. **Scan** — the router's radio scans for visible networks (a few seconds
+   of SSH round-trips).
+3. **Select network** — pick the upstream SSID from the list.
+4. **Password** — enter the upstream network's WiFi password (encryption
+   defaults to `psk2`; leave blank only for open networks).
+5. **DHCP / NAT** — review the LAN DHCP pool (default `.100`–`.249`) and
+   whether to enable NAT/masquerade on the WAN zone (leave this on unless
+   you have a specific reason not to).
+6. **Connect** — this writes a `wwan` STA `wifi-iface` + `network` interface
+   over UCI, enables the radio if it was disabled (OpenWrt ships with
+   `radio0.disabled=1` on a fresh flash), and adds `wwan` to the WAN
+   firewall zone.
+
+The dashboard's WAN panel shows the resulting association state, assigned
+IP, and whether the router currently has internet reachability.
+
+## Step 4: (Optional) Install TollGate
+
+Once connected (and with a local Cashu mint app running), the dashboard
+shows a **TollGate: not installed** panel with a single **Install TollGate**
+button — there's no config form at this stage, it installs with defaults.
+The panel itself warns: *"Router needs internet access to install TollGate
+— configure WAN above first"* (Step 3), since the router has to reach the
+internet to download the package.
+
+1. Click **Install TollGate**. The button relabels to *"Installing… this
+   may take a few minutes"* while it works.
+2. Under the hood this installs `tollgate-module-basic-go` on the router
+   (via `opkg` on OpenWrt ≤24.x, or a manual `.ipk` extract on 25.x images
+   where `opkg` isn't available), writes `/etc/tollgate/config.json`, and
+   creates the `archipelago` SSID — all with default pricing (10 sats per
+   1-minute step, minimum 1 step, `mint_url` auto-filled to
+   `http://<node-ip>:3338`, enabled).
+3. On success you'll see *"TollGate provisioned successfully"* and the
+   panel switches to the installed view (Enabled/Disabled badge, current
+   price/step/mint).
+
+### Configuring price, step size, or mint (after install)
+
+The installed-state panel has an **Edit** button — this is the only place
+you set price/step/mint, and it only appears once TollGate is already
+installed:
+
+1. Click **Edit**.
+2. Set **Price** (sats), **Step size** (minutes — billed as `step_size_ms`
+   under the hood), **Minimum steps** a customer must buy at once, **Mint
+   URL** (leave as the auto-filled node URL unless pointing at an external
+   mint), and the **Enable TollGate** toggle.
+3. Click **Save**. Changes are pushed to `/etc/tollgate/config.json` and the
+   daemon is restarted to pick them up — it does not hot-reload.
+
+Anyone who joins the `archipelago` SSID sees TollGate's captive portal and
+pays sats (via the configured Cashu mint) for timed access.
+
+## Verifying a successful install
+
+A clean install (flash → Connect → WAN/WISP → Install TollGate, all through
+the UI as above) ends in this state — worth checking if you want to confirm
+everything actually landed correctly rather than trusting the UI's success
+toast alone:
+
+- `tollgate-wrt` is running (`/etc/init.d/tollgate-wrt status` → `running`).
+- nodogsplash's **rendered** config — not just the UCI source — has
+  `GatewayInterface br-tollgate`. Check the actual file the daemon was
+  started with (typically `/tmp/etc/nodogsplash_main.conf`), since that's
+  what's actually enforced, not `uci show nodogsplash`. This matters because
+  provisioning must stop nodogsplash and reconfigure it to gate the
+  `br-tollgate` bridge *before* starting it — installing the package by hand
+  (bypassing the UI/RPC flow) leaves nodogsplash on its default
+  `br-lan`-gating behavior instead, which locks out the router's own
+  admin/SSH access. If you ever see a router become unreachable right after
+  a TollGate install, this is the first thing to check.
+- The router's own LAN (the interface you manage it over — SSH, ping) is
+  still reachable and untouched by the portal.
+- TollGate's own log (`logread | grep tollgate-wrt`) shows successful mint
+  probes for each configured mint.
+
+A `dev build detected (branch=unknown), injecting test mint:
+https://nofee.testnut.cashu.space` line in that log means the installed
+build considers itself a dev build and silently adds a test mint alongside
+your configured one(s) — check the Edit panel's Mint URL afterward if you
+don't want that test mint accepted.
+
+### A note on network topology during setup
+
+If the Archipelago node reaches the router over the same wired interface the
+router uses as its LAN, expect the router to become the node's default
+route on that interface once it has its own working WAN/WISP uplink — this
+is normal and, once WAN is actually configured with internet access, works
+fine end-to-end (the node's traffic routes out through the router's
+uplink). It's only a problem *before* WAN is configured: a freshly flashed
+or freshly factory-reset router has no upstream internet yet, so if it wins
+the node's default-route race (lowest metric on its own interface) while
+still offline, it creates a dead-end route and the node loses its own
+connectivity (including anything tunneled, e.g. a VPN/mesh network the node
+relies on) until that route is removed or the router gets its uplink
+working. If you hit this, either wait until WAN/WISP is actually up before
+letting the router's interface win the route race, or temporarily lower the
+priority of that route until it is.
+
+## Reconfiguring or moving to a different router
+
+Use **Disconnect** on the status dashboard to return to the connect form —
+this only clears the panel's client-side state, it doesn't delete the
+persisted `router_config.json`, so reconnecting to the same router needs no
+re-entry. To point at a *different* router, disconnect and connect with a
+new host/credentials; the newly connected router becomes the persisted one.
+
+## Troubleshooting
+
+- **"No router configured"**: nothing has been connected yet, or the saved
+  config didn't include a host — go through Step 2 again.
+- **Connect hangs or times out**: the router isn't reachable on `TCP/22`
+  from the node's network, or SSH auth failed. Confirm you can `ssh
+  root@<router-ip>` manually from the node (or a machine on the same LAN)
+  with the same credentials.
+- **Router "moved networks" / stale saved host**: SSH/status calls are
+  bounded (5s TCP connect, 30s read/write) precisely so an unreachable
+  saved router can't stall other RPCs — but the dashboard will show a
+  connection error until you reconnect with the router's current address.
+- **TollGate provision fails with "No pre-built TollGate package for
+  architecture..."**: your router's SoC isn't one of the prebuilt
+  `.ipk` targets (`mips_24kc`, `mipsel_24kc`, `aarch64_cortex-a53`,
+  `aarch64_cortex-a72`, `arm_cortex-a7`). You'll need a custom opkg feed or
+  to build `tollgate-module-basic-go` from source for your architecture.
+- **TollGate download looks like it succeeded but provisioning still
+  fails**: the node sanity-checks the downloaded `.ipk` is at least 50 KB —
+  a smaller file usually means `wget` captured an HTML error page instead
+  (no internet access from the router, or a bad release URL).
+- **Install fails right after a reboot or a fresh WAN setup** with `apk
+  update failed ... router may have no internet access` even though WAN
+  looks configured: this is usually just timing, not a real problem — the
+  router's WiFi-uplink association (`wwan`/`hakodosh`-style STA interface)
+  can take a few seconds longer to reconnect than the dashboard takes to
+  let you click Install. Wait ~10–15 seconds after WAN shows `sta_state:
+  up` and retry; it should succeed on the next attempt.
+- **Install fails with `opkg not found at /usr/bin/opkg` (or similar) even
+  though the router clearly has `opkg`/`apk` installed**: fixed as of
+  2026-09-05 — the backend used to hardcode `/usr/bin/opkg`/`/usr/bin/apk`,
+  which some official OpenWrt builds don't symlink into `/bin`. If you're
+  running an Archipelago build from before that fix, update first.
+
+---
+
+## Developer reference
+
+Backend crate: `core/openwrt` (`archipelago-openwrt`) — SSH/UCI plumbing,
+WAN/WISP config, WiFi scanning, and TollGate install/config. See
+[`architecture.md`](architecture.md) for where it sits in the workspace.
+
+RPC methods (`core/archipelago/src/api/rpc/openwrt.rs`, dispatched in
+`core/archipelago/src/api/rpc/dispatcher.rs`):
+
+| Method | Purpose |
+|---|---|
+| `openwrt.scan` | Probe a subnet for OpenWrt routers (`subnet`, `prefix`, `ssh_user`, `ssh_password`) |
+| `openwrt.get-status` | Full status: release, WiFi interfaces, WAN, TollGate state. No params → uses saved `router_config.json`; params with `host` also persist the connection |
+| `openwrt.configure-wan` | Write WISP/WAN config (`ssid`, `password`, `encryption`, `dhcp_start`, `dhcp_limit`, `masq`) |
+| `openwrt.scan-wifi` | Radio scan for visible upstream networks |
+| `openwrt.provision-tollgate` | Install/reconfigure TollGate (`price_sats`, `step_size_ms`, `min_steps`, `mint_url`, `enabled`) |
+
+Note: these are distinct from the unrelated `router.*` methods
+(`router.discover`, `router.configure`, `router.list-forwards`, ...), which
+handle UPnP/NAT-PMP port forwarding on the node's own upstream home router —
+not the OpenWrt gateway feature described here.
+
+Frontend: `neode-ui/src/views/server/OpenWrtGateway.vue`, routed at
+`server/openwrt` (`neode-ui/src/router/index.ts`), linked from
+`neode-ui/src/views/Server.vue`.
+
+Persisted connection state: `router_config.json` in the node's data
+directory (`core/archipelago/src/network/router.rs`:
+`load_router_config`/`save_router_config`).
@@ -34,7 +34,14 @@ server {
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    # NO HSTS on this node, by design (see the HTTPS block below for the
+    # active clear). The dashboard is deliberately reachable over plain
+    # HTTP on LANs/mDNS names where users have not installed the node CA —
+    # setup-node-ca.sh keeps port 80 serving for exactly that reason. A
+    # long-cache HSTS policy upgrades an already-open HTTP page's fetches to
+    # HTTPS; that scheme change is cross-origin, so every /rpc/v1 call died
+    # with "No Access-Control-Allow-Origin header" while the node was
+    # perfectly healthy (framework-pt, 2026-09-01: "Failed to fetch" storm).
    add_header X-DNS-Prefetch-Control "off" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.basemaps.cartocdn.com https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:* https:; frame-src 'self' http://$host:* https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;

@@ -1009,7 +1016,14 @@ server {
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    # HSTS actively CLEARED (max-age=0), not set: this origin's certificate is
+    # optional/self-signed and plain-HTTP access is a supported mode. Earlier
+    # builds sent max-age=31536000 includeSubDomains, and browsers that had
+    # visited HTTPS once kept silently upgrading the HTTP dashboard's
+    # subresources afterwards — every fetch became cross-origin by scheme and
+    # was CORS-blocked. max-age=0 over HTTPS deletes that cached policy;
+    # never raise it on this origin unless HTTP access is retired first.
+    add_header Strict-Transport-Security "max-age=0" always;
    add_header X-DNS-Prefetch-Control "off" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.basemaps.cartocdn.com https://tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:* https:; frame-src 'self' http://$host:* https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;

@@ -1,12 +1,12 @@
 {
  "name": "neode-ui",
-  "version": "1.8.7-alpha",
+  "version": "1.8.11-alpha",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "neode-ui",
-      "version": "1.8.7-alpha",
+      "version": "1.8.11-alpha",
      "dependencies": {
        "@scure/bip39": "^2.2.0",
        "@types/dompurify": "^3.0.5",
@@ -1,7 +1,7 @@
 {
  "name": "neode-ui",
  "private": true,
-  "version": "1.8.7-alpha",
+  "version": "1.8.11-alpha",
  "type": "module",
  "scripts": {
    "start": "./start-dev.sh",
@@ -13,20 +13,20 @@
    {
      "id": "adguardhome",
      "title": "AdGuard Home",
-      "version": "v0.107.55",
+      "version": "v0.107.79",
      "description": "Network-wide ad and tracker blocking: a DNS server that filters every device on your LAN, with a web console for rules and client management.",
      "icon": "",
      "author": "AdGuard",
      "category": "networking",
      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
      "repoUrl": "https://github.com/AdguardTeam/AdGuardHome"
    },
    {
      "id": "alby-hub",
      "title": "Alby Hub",
      "version": "1.23.0",
-      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect \u2014 one hub, every app pays through it.",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
      "icon": "/assets/img/app-icons/alby-hub.svg",
      "author": "Alby",
      "category": "money",
@@ -117,18 +117,6 @@
        "bitcoin-knots"
      ]
    },
-    {
-      "id": "cryptpad",
-      "title": "CryptPad",
-      "version": "2024.12.0",
-      "description": "End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.",
-      "icon": "/assets/icon/favico-black-v2.svg",
-      "author": "XWiki SAS",
-      "category": "data",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0",
-      "repoUrl": "https://github.com/cryptpad/cryptpad"
-    },
    {
      "id": "cuprate",
      "title": "Cuprate",
@@ -203,13 +191,13 @@
    {
      "id": "filebrowser",
      "title": "File Browser",
-      "version": "2.27.0",
+      "version": "2.63.23",
      "description": "Baseline Archipelago file manager service.",
      "icon": "/assets/img/app-icons/file-browser.webp",
      "author": "File Browser",
      "category": "data",
      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23",
      "repoUrl": "https://github.com/filebrowser/filebrowser",
      "containerConfig": {
        "ports": [
@@ -230,12 +218,12 @@
    {
      "id": "gitea",
      "title": "Gitea",
-      "version": "1.23",
+      "version": "1.27.3",
      "description": "Self-hosted Git service with built-in container registry, CI/CD, and package hosting.",
      "icon": "/assets/img/app-icons/gitea.svg",
      "author": "Gitea",
      "category": "development",
-      "dockerImage": "docker.io/gitea/gitea:1.23",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gitea:1.27.3",
      "repoUrl": "https://gitea.com",
      "containerConfig": {
        "ports": [
@@ -286,12 +274,12 @@
    {
      "id": "homeassistant",
      "title": "Home Assistant",
-      "version": "2026.7.3",
+      "version": "2026.8.3",
      "description": "Open source home automation platform. Control and monitor your smart home devices.",
      "icon": "/assets/img/app-icons/homeassistant.png",
      "author": "Home Assistant",
      "category": "home",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3",
      "repoUrl": "https://github.com/home-assistant/core",
      "containerConfig": {
        "ports": [
@@ -350,13 +338,13 @@
    {
      "id": "lnd",
      "title": "LND",
-      "version": "0.18.4",
+      "version": "0.21.2",
      "description": "Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.",
      "icon": "/assets/img/app-icons/lnd.png",
      "author": "Lightning Labs",
      "category": "money",
      "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta",
      "repoUrl": "https://github.com/lightningnetwork/lnd",
      "requires": [
        "bitcoin-knots"
@@ -382,7 +370,7 @@
      "id": "netbird",
      "title": "NetBird",
      "version": "2.38.0",
-      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point \u2014 a TLS proxy in front of the dashboard + server.",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
      "icon": "/assets/img/app-icons/netbird.svg",
      "author": "NetBird",
      "category": "networking",
@@ -424,7 +412,7 @@
      "id": "nginx-proxy-manager",
      "title": "Nginx Proxy Manager",
      "version": "2.12.1",
-      "description": "Reverse proxy with SSL. Beautiful web interface for managing proxies. On a node, this manages its admin UI and upstream configuration \u2014 the proxy's own :80/:443 listeners are not published (the node's web server owns those ports).",
+      "description": "Reverse proxy with SSL. Beautiful web interface for managing proxies. On a node, this manages its admin UI and upstream configuration — the proxy's own :80/:443 listeners are not published (the node's web server owns those ports).",
      "icon": "/assets/img/app-icons/nginx.svg",
      "author": "Nginx Proxy Manager",
      "category": "networking",
@@ -460,7 +448,7 @@
      "id": "ollama",
      "title": "Ollama",
      "version": "0.5.4",
-      "description": "Run large language models locally. Download and run AI models like Llama, Mistral on your own hardware \u2014 served on the node's loopback for the AI assistant (Settings \u2192 Claude Auth \u2192 model backend), never exposed to the network.",
+      "description": "Run large language models locally. Download and run AI models like Llama, Mistral on your own hardware — served on the node's loopback for the AI assistant (Settings → Claude Auth → model backend), never exposed to the network.",
      "icon": "/assets/img/app-icons/ollama.png",
      "author": "Ollama",
      "category": "community",
@@ -472,7 +460,7 @@
      "id": "phoenixd",
      "title": "phoenixd",
      "version": "0.9.0",
-      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own \u2014 it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
      "icon": "/assets/img/app-icons/phoenixd.svg",
      "author": "ACINQ",
      "category": "money",
@@ -507,7 +495,7 @@
      "id": "pine",
      "title": "Pine",
      "version": "1.3.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node \u2014 block height, sync, peers, Lightning balance \u2014 and, when a Claude API key is set, anything else.",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
      "icon": "/assets/img/app-icons/pine.svg",
      "author": "Archipelago",
      "category": "home",
@@ -517,13 +505,13 @@
    {
      "id": "portainer",
      "title": "Portainer",
-      "version": "2.19.4",
+      "version": "2.45.0",
      "description": "Container management web UI for the local Podman socket.",
      "icon": "/assets/img/app-icons/portainer.webp",
      "author": "Portainer",
      "category": "development",
      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.45.0",
      "repoUrl": "https://github.com/portainer/portainer",
      "containerConfig": {
        "ports": [
@@ -615,13 +603,13 @@
    {
      "id": "vaultwarden",
      "title": "Vaultwarden",
-      "version": "1.30.0",
+      "version": "1.37.2",
      "description": "Self-hosted password vault with zero-knowledge encryption.",
      "icon": "/assets/img/app-icons/vaultwarden.webp",
      "author": "Vaultwarden",
      "category": "data",
      "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine",
      "repoUrl": "https://github.com/dani-garcia/vaultwarden",
      "containerConfig": {
        "ports": [
@@ -117,6 +117,7 @@ import { useSpotlightStore } from '@/stores/spotlight'
 import { useCLIStore } from '@/stores/cli'
 import { useMessageToast } from '@/composables/useMessageToast'
 import { useAppStore } from '@/stores/app'
+import { fetchAppCatalog } from './views/discover/curatedApps'
 import { useScreensaverStore } from '@/stores/screensaver'
 import { useUIModeStore } from '@/stores/uiMode'
 import { startRemoteRelay, stopRemoteRelay } from '@/api/remote-relay'
@@ -396,6 +397,13 @@ function onVisibilityChange() {

 onMounted(async () => {
  syncKioskSafeArea()
+  // Warm the signed-catalog cache before any app launch needs it: port auth
+  // (gate-fronted ⇒ TLS on the app port) decides whether an app frame opens
+  // over https on an HTTPS dashboard. The cache used to be filled only by
+  // the Store/Discover views, so a user who went straight to My Apps got an
+  // http:// frame URL — blocked as mixed content (mempool/indeehub "did not
+  // connect", 2026-09-01). fetchAppCatalog() memoizes with a 1h TTL.
+  void fetchAppCatalog()
  // Light app-wide mesh poll so a freshly plugged-in radio surfaces the
  // setup modal on any page (the Mesh view's own poll takes over there).
  useMeshStore().startGlobalDetection()
@@ -10,7 +10,32 @@
    z-index="z-[3600]"
    @close="onClose"
  >
-    <p v-if="lightning.status.value === 'no-funds'" class="text-sm text-white/70 leading-relaxed">
+    <p v-if="lightning.status.value === 'no-funds' && lightning.fundingReason.value === 'pending'" class="text-sm text-white/70 leading-relaxed">
+      Your new channel is <span class="text-white/90">waiting for its on-chain confirmations</span> —
+      that's why the network doesn't see it yet. It unlocks automatically once
+      confirmed (usually within about half an hour); nothing is needed from
+      you. This screen will work as soon as it lands.
+    </p>
+    <p v-else-if="lightning.status.value === 'no-funds' && lightning.fundingReason.value === 'far-side'" class="text-sm text-white/70 leading-relaxed">
+      <template v-if="lightning.fundingDirection.value === 'receive'">
+        You have channels, but <span class="text-white/90">all the balance is on your side</span> —
+        you can send, but there's nothing to be paid into right now. Receive a
+        payment by spending first, or open another channel to bring inbound
+        liquidity in.
+      </template>
+      <template v-else>
+        You have channels, but <span class="text-white/90">all the balance is on the far side</span> —
+        you can receive, but there's nothing to send right now. Someone has to
+        pay you first (or rebalance the channel), and sending unlocks on its own.
+      </template>
+    </p>
+    <p v-else-if="lightning.status.value === 'no-funds' && lightning.fundingReason.value === 'failed-payment'" class="text-sm text-white/70 leading-relaxed">
+      LND couldn't route this payment — most often there's
+      <span class="text-white/90">not enough outbound for this amount</span>, or no
+      route to the recipient at the fees offered. Smaller amounts sometimes
+      get through; check the channels screen to see what's actually spendable.
+    </p>
+    <p v-else-if="lightning.status.value === 'no-funds'" class="text-sm text-white/70 leading-relaxed">
      Your Lightning node is running, but it has no payment channel yet.
      <template v-if="lightning.fundingDirection.value === 'receive'">
        Receiving needs <span class="text-white/90">inbound liquidity</span> — a
@@ -101,14 +126,31 @@
        @click="openApps"
      >Open My Apps</button>
      <template v-else-if="lightning.status.value === 'no-funds'">
-        <button
-          class="flex-1 glass-button px-4 py-2 rounded-lg text-sm"
-          @click="openSetupGuide"
-        >Setup Guide</button>
-        <button
-          class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium"
-          @click="openLightningSetup"
-        >Open a channel</button>
+        <!-- A confirming channel needs no action at all — offering "open a
+             channel" here would send the user to fix a problem they don't
+             have (and possibly open a second one). -->
+        <template v-if="lightning.fundingReason.value === 'pending'">
+          <button
+            class="flex-1 glass-button px-4 py-2 rounded-lg text-sm"
+            @click="onClose"
+          >Got it — I'll wait</button>
+        </template>
+        <template v-else>
+          <button
+            class="flex-1 glass-button px-4 py-2 rounded-lg text-sm"
+            @click="openSetupGuide"
+          >Setup Guide</button>
+          <button
+            v-if="lightning.fundingReason.value !== 'failed-payment'"
+            class="flex-1 glass-button glass-button-warning px-4 py-2 rounded-lg text-sm font-medium"
+            @click="openLightningSetup"
+          >Open a channel</button>
+          <button
+            v-else
+            class="flex-1 glass-button px-4 py-2 rounded-lg text-sm"
+            @click="onClose"
+          >Close</button>
+        </template>
      </template>
    </div>
  </BaseModal>
@@ -155,7 +197,12 @@ const nodes: NodeChoice[] = [
 const router = useRouter()

 const modalTitle = computed(() => {
-  if (lightningStatusIs('no-funds')) return 'You need a Lightning channel'
+  if (lightningStatusIs('no-funds')) {
+    if (lightning.fundingReason.value === 'pending') return 'Channel confirming…'
+    if (lightning.fundingReason.value === 'far-side') return 'Balance is on the far side'
+    if (lightning.fundingReason.value === 'failed-payment') return 'Payment couldn\u2019t route'
+    return 'You need a Lightning channel'
+  }
  if (lightningStatusIs('stopped')) return 'Lightning node not running'
  return 'Lightning node required'
 })
@@ -106,6 +106,30 @@

        <!-- Ecash -->
        <div v-if="receiveMethod === 'ecash'">
+          <!-- Shareable @minibits.cash Lightning address (LUD-16): any Lightning
+               wallet can pay this node by address, and the sats land as ecash.
+               Fetched on tab open; claimed payments are polled in while open. -->
+          <div v-if="lnAddress" class="mb-4 p-3 bg-white/5 rounded-lg text-center">
+            <p class="text-white/60 text-sm mb-2">{{ t('receiveBitcoin.lnAddressTitle') }}</p>
+            <canvas ref="lnAddressQrCanvas" class="mx-auto mb-3 rounded-lg" style="image-rendering: pixelated;"></canvas>
+            <p class="text-white/50 text-xs mb-1">{{ t('receiveBitcoin.lnAddressLabel') }}</p>
+            <p class="text-base font-mono text-white/95 break-all mb-2">{{ lnAddress }}</p>
+            <CopyButton :value="lnAddress" :label="t('common.copy')" />
+            <p class="text-white/40 text-xs mt-3 leading-relaxed">{{ t('receiveBitcoin.lnAddressHint') }}</p>
+            <p v-if="lnClaimedSats > 0" class="text-green-400 text-sm mt-2">
+              {{ t('receiveBitcoin.lnAddressReceived', { amount: lnClaimedSats.toLocaleString() }) }}
+            </p>
+            <p v-if="lnPendingClaims > 0" class="text-orange-400 text-sm mt-2">
+              {{ t('receiveBitcoin.lnAddressPendingRetry', { count: lnPendingClaims }) }}
+            </p>
+          </div>
+          <div v-else-if="lnAddressLoading" class="mb-4 text-center text-white/50 text-sm py-4">
+            {{ t('receiveBitcoin.lnAddressLoading') }}
+          </div>
+          <div v-else-if="lnAddressError" class="mb-3 text-xs text-white/40">
+            {{ t('receiveBitcoin.lnAddressUnavailable') }}
+          </div>
+
          <div class="mb-3">
            <label class="text-white/60 text-sm block mb-1">{{ t('receiveBitcoin.pasteEcashToken') }}</label>
            <textarea v-model="ecashToken" rows="3" placeholder="cashuB… (Cashu) or Fedimint notes" class="w-full input-glass font-mono"></textarea>
@@ -175,6 +199,12 @@ watch(() => props.show, (open) => {
  arkAddress.value = ''
  ecashToken.value = ''
  ecashResult.value = ''
+  stopLnClaimPoll()
+  lnAddress.value = ''
+  lnAddressLoading.value = false
+  lnAddressError.value = false
+  lnClaimedSats.value = 0
+  lnPendingClaims.value = 0
  error.value = ''
  processing.value = false
  if (props.autoGenerate && receiveMethod.value === 'onchain') {
@@ -193,9 +223,93 @@ const ecashResult = ref('')
 const onchainQrCanvas = ref<HTMLCanvasElement | null>(null)
 const lightningQrCanvas = ref<HTMLCanvasElement | null>(null)
 const arkQrCanvas = ref<HTMLCanvasElement | null>(null)
+const lnAddressQrCanvas = ref<HTMLCanvasElement | null>(null)
 const processing = ref(false)
 const error = ref('')

+// ── Minibits Lightning address (ecash receive) ──────────────────────────────
+// The ecash tab doubles as "receive onto my @minibits.cash address": the node
+// derives/registers it from its own ecash seed (wallet.ecash-lnaddress) and
+// sweeps any Lightning payments that land there back into ecash while the tab is
+// open (wallet.ecash-lnaddress-claim). A registration failure is never fatal —
+// the paste-token path below always works.
+const lnAddress = ref('')
+const lnAddressLoading = ref(false)
+const lnAddressError = ref(false)
+const lnClaimedSats = ref(0)
+// A payment the backend fetched (and so already consumed at Minibits) but
+// couldn't redeem yet — it's queued for automatic retry, not lost, but the
+// operator should see it rather than have it be a silent, unbounded wait.
+const lnPendingClaims = ref(0)
+let lnClaimTimer: ReturnType<typeof setInterval> | null = null
+// A poll can outlast the 8s interval (backend auth + relay fetch + redeem
+// loop) — without this, the next tick fires on top of it and both calls hit
+// the backend's `minibits.json` at once.
+let lnPollInFlight = false
+
+async function loadLnAddress() {
+  if (lnAddress.value || lnAddressLoading.value) return
+  lnAddressLoading.value = true
+  lnAddressError.value = false
+  try {
+    const res = await rpcClient.call<{ address?: string }>({ method: 'wallet.ecash-lnaddress' })
+    lnAddress.value = res?.address || ''
+    if (lnAddress.value) {
+      await nextTick()
+      renderQr(lnAddress.value, lnAddressQrCanvas.value)
+      startLnClaimPoll()
+    } else {
+      lnAddressError.value = true
+    }
+  } catch {
+    lnAddressError.value = true
+  } finally {
+    lnAddressLoading.value = false
+  }
+}
+
+function stopLnClaimPoll() {
+  if (lnClaimTimer) {
+    clearInterval(lnClaimTimer)
+    lnClaimTimer = null
+  }
+}
+
+function startLnClaimPoll() {
+  stopLnClaimPoll()
+  lnClaimTimer = setInterval(() => void pollLnClaims(), 8000)
+}
+
+async function pollLnClaims() {
+  if (!props.show || !lnAddress.value) {
+    stopLnClaimPoll()
+    return
+  }
+  if (lnPollInFlight) return
+  lnPollInFlight = true
+  try {
+    const res = await rpcClient.call<{ received_sats?: number; failed_count?: number }>({
+      method: 'wallet.ecash-lnaddress-claim',
+    })
+    if (res?.received_sats && res.received_sats > 0) {
+      lnClaimedSats.value += res.received_sats
+      emit('received')
+    }
+    lnPendingClaims.value = res?.failed_count || 0
+  } catch {
+    // Transient poll failure (offline, mint busy) — keep polling.
+  } finally {
+    lnPollInFlight = false
+  }
+}
+
+onUnmounted(stopLnClaimPoll)
+
+// Fetch the address the first time the operator opens the ecash tab.
+watch(receiveMethod, (m) => {
+  if (m === 'ecash' && props.show) void loadLnAddress()
+})
+
 // ── On-chain payment detection ────────────────────────────────────────────
 // The generated address is FRESH (lnd.newaddress), so any incoming wallet
 // transaction paying it is this receive — no baseline bookkeeping needed.
@@ -309,12 +423,16 @@ async function renderQr(data: string, canvas: HTMLCanvasElement | null, prefix =

 function close() {
  stopWatchingPayment()
+  stopLnClaimPoll()
  paymentSeen.value = null
  invoiceResult.value = ''
  onchainAddress.value = ''
  arkAddress.value = ''
  ecashToken.value = ''
  ecashResult.value = ''
+  lnAddress.value = ''
+  lnClaimedSats.value = 0
+  lnPendingClaims.value = 0
  error.value = ''
  emit('close')
 }
@@ -0,0 +1,66 @@
+// Real vue-i18n instance (unlike ReceiveBitcoinModal.test.ts, which mocks
+// `t` to a no-op and so cannot catch a bad message string). Operator report
+// (2026-09-08): clicking the Ecash tab closed the whole Receive modal, in
+// both the browser and the Android companion's WebView. Root cause: vue-i18n
+// treats a bare `@` as the start of "linked message" syntax — `en.json`'s
+// `receiveBitcoin.lnAddressLabel` ("Your @minibits.cash address:") isn't
+// valid linked-message syntax, so *compiling* that message throws a
+// SyntaxError the instant it's first rendered (i.e. the moment the address
+// loads), and the uncaught render-function error blanks the whole teleported
+// modal. Fixed by escaping it as `{'@'}` (the same pattern already used for
+// `settings.domainNamePlaceholder`). This test uses the real compiler so a
+// future bad interpolation string in this component fails fast in `npm test`
+// instead of only in a live browser.
+import { flushPromises, mount } from '@vue/test-utils'
+import { describe, expect, it, vi } from 'vitest'
+import ReceiveBitcoinModal from '../ReceiveBitcoinModal.vue'
+import { rpcClient } from '@/api/rpc-client'
+import i18n from '@/i18n'
+
+vi.mock('@/api/rpc-client', () => ({
+  rpcClient: { call: vi.fn() },
+}))
+
+vi.mock('@/composables/useLightningRequired', () => ({
+  useLightningRequired: () => ({
+    requireLightningReady: vi.fn().mockResolvedValue(true),
+    handleLightningFailure: vi.fn().mockReturnValue(false),
+  }),
+}))
+
+describe('ReceiveBitcoinModal — ecash tab with the real vue-i18n compiler', () => {
+  it('renders the Minibits address label without an uncaught render error', async () => {
+    vi.mocked(rpcClient.call).mockImplementation(async ({ method }: { method: string }) => {
+      if (method === 'wallet.ecash-lnaddress') {
+        return { address: 'someone@minibits.cash' } as never
+      }
+      return { claimed_count: 0, received_sats: 0, failed_count: 0 } as never
+    })
+
+    const wrapper = mount(ReceiveBitcoinModal, {
+      props: { show: true },
+      attachTo: document.body,
+      global: { plugins: [i18n] },
+    })
+    let captured: unknown = null
+    wrapper.vm.$.appContext.app.config.errorHandler = (err) => { captured = err }
+    await flushPromises()
+
+    const ecashTab = Array.from(document.body.querySelectorAll('button')).find((b) =>
+      b.textContent?.toLowerCase().includes('ecash'),
+    )
+    expect(ecashTab).toBeTruthy()
+    ecashTab!.dispatchEvent(new Event('click', { bubbles: true }))
+    await flushPromises()
+    await flushPromises()
+
+    expect(captured).toBeNull()
+    expect(wrapper.emitted('close')).toBeFalsy()
+    const dialog = document.body.querySelector('[role="dialog"]')
+    expect(dialog).toBeTruthy()
+    expect(dialog?.textContent).toContain('minibits.cash')
+    expect(dialog?.textContent).toContain('someone@minibits.cash')
+
+    wrapper.unmount()
+  })
+})
@@ -0,0 +1,129 @@
+import { flushPromises, mount } from '@vue/test-utils'
+import { describe, expect, it, vi } from 'vitest'
+import ReceiveBitcoinModal from '../ReceiveBitcoinModal.vue'
+import { rpcClient } from '@/api/rpc-client'
+
+vi.mock('vue-router', () => ({
+  useRoute: () => ({ fullPath: '/dashboard' }),
+  useRouter: () => ({ push: vi.fn() }),
+}))
+
+vi.mock('vue-i18n', () => ({
+  useI18n: () => ({ t: (key: string, params?: Record<string, unknown>) => (params ? `${key}:${JSON.stringify(params)}` : key) }),
+}))
+
+vi.mock('@/api/rpc-client', () => ({
+  rpcClient: { call: vi.fn() },
+}))
+
+vi.mock('@/composables/useLightningRequired', () => ({
+  useLightningRequired: () => ({
+    requireLightningReady: vi.fn().mockResolvedValue(true),
+    handleLightningFailure: vi.fn().mockReturnValue(false),
+  }),
+}))
+
+// Guards an operator report (2026-09-08): clicking the Ecash tab appeared to
+// close the whole Receive modal. Not reproduced here — the tab switch alone
+// (success or failure of wallet.ecash-lnaddress) never emits `close` or
+// unmounts the dialog — but the RPC-eager tab switch is exactly the kind of
+// path a future change could regress, so it's worth pinning down.
+describe('ReceiveBitcoinModal — ecash tab click', () => {
+  it('does not close/emit when the ecash tab is clicked and the RPC succeeds', async () => {
+    vi.mocked(rpcClient.call).mockResolvedValue({ address: 'someone@minibits.cash' } as never)
+
+    const wrapper = mount(ReceiveBitcoinModal, {
+      props: { show: true },
+      attachTo: document.body,
+    })
+    await flushPromises()
+
+    const tabs = Array.from(document.body.querySelectorAll('button'))
+    const ecashTab = tabs.find((b) => b.textContent?.toLowerCase().includes('ecash'))
+    expect(ecashTab).toBeTruthy()
+
+    ecashTab!.dispatchEvent(new Event('click', { bubbles: true }))
+    await flushPromises()
+
+    expect(wrapper.emitted('close')).toBeFalsy()
+    expect(document.body.querySelector('[role="dialog"]')).toBeTruthy()
+    wrapper.unmount()
+  })
+
+  it('does not close/emit when the ecash tab is clicked and the RPC fails', async () => {
+    vi.mocked(rpcClient.call).mockRejectedValue(new Error('boom'))
+
+    const wrapper = mount(ReceiveBitcoinModal, {
+      props: { show: true },
+      attachTo: document.body,
+    })
+    await flushPromises()
+
+    const tabs = Array.from(document.body.querySelectorAll('button'))
+    const ecashTab = tabs.find((b) => b.textContent?.toLowerCase().includes('ecash'))
+    expect(ecashTab).toBeTruthy()
+
+    ecashTab!.dispatchEvent(new Event('click', { bubbles: true }))
+    await flushPromises()
+
+    expect(wrapper.emitted('close')).toBeFalsy()
+    expect(document.body.querySelector('[role="dialog"]')).toBeTruthy()
+    wrapper.unmount()
+  })
+})
+
+// Regression guard for the overlapping-claim race: a single
+// wallet.ecash-lnaddress-claim call can outlast the 8s poll interval (backend
+// auth + relay fetch + redeem loop), and a second call firing on top of it
+// raced on the backend's minibits.json (see minibits.rs STATE_LOCK).
+describe('ReceiveBitcoinModal — ecash claim poll', () => {
+  it('does not start a second claim poll while one is still in flight', async () => {
+    vi.useFakeTimers()
+    let resolveClaim: (v: unknown) => void = () => {}
+    vi.mocked(rpcClient.call).mockImplementation((args: unknown) => {
+      const method = (args as { method?: string })?.method
+      if (method === 'wallet.ecash-lnaddress') {
+        return Promise.resolve({ address: 'someone@minibits.cash' } as never)
+      }
+      if (method === 'wallet.ecash-lnaddress-claim') {
+        return new Promise((resolve) => {
+          resolveClaim = resolve
+        }) as never
+      }
+      return Promise.resolve({} as never)
+    })
+
+    const wrapper = mount(ReceiveBitcoinModal, {
+      props: { show: true },
+      attachTo: document.body,
+    })
+    await flushPromises()
+
+    const tabs = Array.from(document.body.querySelectorAll('button'))
+    const ecashTab = tabs.find((b) => b.textContent?.toLowerCase().includes('ecash'))
+    ecashTab!.dispatchEvent(new Event('click', { bubbles: true }))
+    await flushPromises()
+
+    const claimCalls = () =>
+      vi
+        .mocked(rpcClient.call)
+        .mock.calls.filter(([a]) => (a as { method?: string })?.method === 'wallet.ecash-lnaddress-claim').length
+
+    await vi.advanceTimersByTimeAsync(8000)
+    expect(claimCalls()).toBe(1)
+
+    // Second tick fires while the first claim call is still unresolved.
+    await vi.advanceTimersByTimeAsync(8000)
+    expect(claimCalls()).toBe(1)
+
+    resolveClaim({ received_sats: 0, failed_count: 0 })
+    await flushPromises()
+
+    // Once the in-flight call finishes, the next tick is free to poll again.
+    await vi.advanceTimersByTimeAsync(8000)
+    expect(claimCalls()).toBe(2)
+
+    wrapper.unmount()
+    vi.useRealTimers()
+  })
+})
@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 import { createPinia, setActivePinia } from 'pinia'
 import { useLightningRequired } from '../useLightningRequired'
+import { rpcClient } from '@/api/rpc-client'

 // The gate reads install state off the app store's package list. Stub the
 // store rather than the RPC layer so the test pins the decision, not the
@@ -14,6 +15,12 @@ vi.mock('@/stores/app', () => ({
  }),
 }))

+vi.mock('@/api/rpc-client', () => ({
+  rpcClient: {
+    call: vi.fn(),
+  },
+}))
+
 describe('useLightningRequired', () => {
  beforeEach(() => {
    setActivePinia(createPinia())
@@ -73,4 +80,82 @@ describe('useLightningRequired', () => {
    packages.value = {}
    expect(useLightningRequired().lightningStatus()).toBe('absent')
  })
+
+  describe('requireLightningReady states the node\u2019s real funding state', () => {
+    beforeEach(() => {
+      packages.value = { lnd: { state: 'running' } }
+      vi.mocked(rpcClient.call).mockReset()
+    })
+
+    it('says the channel is confirming, not \u201cno channel\u201d, while pending', async () => {
+      // The regression (framework-pt, 2026-09-01): a just-opened channel
+      // sits in LND's pending list; the outbound sum is legitimately 0, but
+      // the modal claimed the node had no channel at all.
+      vi.mocked(rpcClient.call).mockResolvedValue({
+        total_inbound: 0,
+        total_outbound: 0,
+        channels: [{ status: 'pending_open', local_balance: 900000, remote_balance: 0 }],
+      })
+      const lightning = useLightningRequired()
+
+      expect(await lightning.requireLightningReady('send')).toBe(false)
+      expect(lightning.show.value).toBe(true)
+      expect(lightning.status.value).toBe('no-funds')
+      expect(lightning.fundingReason.value).toBe('pending')
+    })
+
+    it('says the balance is on the far side when channels exist but outbound is 0', async () => {
+      vi.mocked(rpcClient.call).mockResolvedValue({
+        total_inbound: 985000,
+        total_outbound: 0,
+        channels: [{ status: 'active', local_balance: 0, remote_balance: 985000 }],
+      })
+      const lightning = useLightningRequired()
+
+      expect(await lightning.requireLightningReady('send')).toBe(false)
+      expect(lightning.fundingReason.value).toBe('far-side')
+      // The same node CAN receive — the gate must pass for the other way.
+      vi.mocked(rpcClient.call).mockResolvedValue({
+        total_inbound: 985000,
+        total_outbound: 0,
+        channels: [{ status: 'active', local_balance: 0, remote_balance: 985000 }],
+      })
+      expect(await lightning.requireLightningReady('receive')).toBe(true)
+    })
+
+    it('keeps the open-a-channel guidance only when there truly is no channel', async () => {
+      vi.mocked(rpcClient.call).mockResolvedValue({
+        total_inbound: 0,
+        total_outbound: 0,
+        channels: [],
+      })
+      const lightning = useLightningRequired()
+
+      expect(await lightning.requireLightningReady('send')).toBe(false)
+      expect(lightning.fundingReason.value).toBe('none')
+    })
+
+    it('fails OPEN on an RPC error \u2014 a transient blip must not block a working wallet', async () => {
+      vi.mocked(rpcClient.call).mockRejectedValue(new Error('Failed to fetch'))
+      const lightning = useLightningRequired()
+
+      expect(await lightning.requireLightningReady('send')).toBe(true)
+      expect(lightning.show.value).toBe(false)
+    })
+
+    it('maps a routing/liquidity payment failure onto the modal without claiming \u201cno channel\u201d', () => {
+      const lightning = useLightningRequired()
+
+      expect(lightning.handleLightningFailure(new Error('Payment failed: unable to find a path to destination'))).toBe(true)
+      expect(lightning.status.value).toBe('no-funds')
+      expect(lightning.fundingReason.value).toBe('failed-payment')
+    })
+
+    it('leaves non-funding payment errors to the caller', () => {
+      const lightning = useLightningRequired()
+
+      expect(lightning.handleLightningFailure(new Error('Payment failed: Not Found'))).toBe(false)
+      expect(lightning.show.value).toBe(false)
+    })
+  })
 })
@@ -34,12 +34,27 @@ export const LIGHTNING_NODE_APP_IDS = ['lnd'] as const
 *  `running` — good to go. */
 export type LightningStatus = 'absent' | 'stopped' | 'running' | 'no-funds'

+/** WHY the funding modal opened — the old copy always said "you have no
+ *  channel yet", which was a lie three ways: a just-opened channel sits in
+ *  LND's pending list (invisible to the outbound sum) until it has ~3
+ *  confirmations, channels can exist with all their balance on the far
+ *  side, and a payment failure can look like a funding problem. The user
+ *  sees "no channel" while looking at a wallet full of pending liquidity
+ *  (framework-pt, 2026-09-01: "LND thinks I do not have a channel").
+ *  `none` — genuinely no channels, the open-one flow is right.
+ *  `pending` — channel(s) exist but are still confirming on-chain.
+ *  `far-side` — open channel(s), but the needed direction has zero balance.
+ *  `failed-payment` — LND refused a payment; looks like routing/liquidity. */
+export type FundingReason = 'none' | 'pending' | 'far-side' | 'failed-payment'
+
 // Module-scope: one source of truth shared by every caller and the single
 // global modal mounted in App.vue.
 const show = ref(false)
 const status = ref<LightningStatus>('absent')
 /** Which direction raised the funding modal, so the copy can be specific. */
 const fundingDirection = ref<'send' | 'receive'>('receive')
+/** Why the funding modal opened, so the copy states the node's real state. */
+const fundingReason = ref<FundingReason>('none')

 export function useLightningRequired() {
  // The store is resolved lazily, inside the functions that need it, rather
@@ -86,8 +101,9 @@ export function useLightningRequired() {
   * rather than inventing a second one, and routes to the Lightning setup
   * goal where funding and channel-opening already live.
   */
-  function openLightningFunding() {
+  function openLightningFunding(reason: FundingReason = 'none') {
    status.value = 'no-funds'
+    fundingReason.value = reason
    show.value = true
  }

@@ -114,7 +130,9 @@ export function useLightningRequired() {
      'no path',
    ].some((needle) => msg.includes(needle))
    if (!fundingRelated) return false
-    openLightningFunding()
+    // LND refused the payment itself — not necessarily "no channels", so
+    // the modal must not claim it is. Most often this is routing/liquidity.
+    openLightningFunding('failed-payment')
    return true
  }

@@ -133,14 +151,28 @@ export function useLightningRequired() {
  async function requireLightningReady(direction: 'send' | 'receive'): Promise<boolean> {
    if (!requireLightningNode()) return false
    try {
-      const res = await rpcClient.call<{ total_inbound?: number; total_outbound?: number }>({
+      const res = await rpcClient.call<{
+        total_inbound?: number
+        total_outbound?: number
+        channels?: { status?: string; local_balance?: number; remote_balance?: number }[]
+      }>({
        method: 'lnd.listchannels',
        timeout: 15000,
      })
      const liquidity = direction === 'receive' ? res?.total_inbound ?? 0 : res?.total_outbound ?? 0
      if (liquidity > 0) return true
      fundingDirection.value = direction
-      openLightningFunding()
+      // Zero in the needed direction — say WHY, from the same response.
+      // The channel list carries pending entries (status 'pending_open');
+      // the totals deliberately exclude them (nothing is spendable through
+      // an unconfirmed channel), so "0 outbound + pending channels" is the
+      // just-opened-a-channel state, not "no channel".
+      const channels = res?.channels ?? []
+      const hasPending = channels.some(c => c.status === 'pending_open')
+      const hasOpen = channels.some(
+        c => c.status === 'active' || c.status === 'inactive' || (!c.status && (c.local_balance || c.remote_balance)),
+      )
+      openLightningFunding(hasPending ? 'pending' : hasOpen ? 'far-side' : 'none')
      return false
    } catch {
      return true
@@ -150,6 +182,7 @@ export function useLightningRequired() {
  return {
    show,
    fundingDirection,
+    fundingReason,
    status,
    lightningStatus,
    hasLightningNode,
@@ -0,0 +1,48 @@
+// Every message string must survive vue-i18n's message compiler. Found the
+// hard way (2026-09-08): a bare `@` in a message is parsed as the start of
+// "linked message" syntax (`@:key`), so a literal `@` (an email/handle-style
+// placeholder, e.g. "user@example.com") throws a SyntaxError the first time
+// it's *rendered*, not at build time — see [[vue-i18n-bare-at-sign-crash]]
+// in project memory for the full incident (it blanked a whole modal in both
+// the browser and the Android companion's WebView). A literal `@`, `{`, `}`
+// or other message-syntax character must be escaped as e.g. `{'@'}`.
+//
+// This walks every string in every locale file and asks the real compiler
+// to parse it — no rendering, no component needed, so it's fast and catches
+// the whole class of bug regardless of which component ever ends up using
+// the string.
+import { describe, it, expect } from 'vitest'
+import i18n from '@/i18n'
+import en from '../en.json'
+import es from '../es.json'
+
+function collectStrings(obj: unknown, path: string, out: Array<[string, string]>) {
+  if (typeof obj === 'string') {
+    out.push([path, obj])
+  } else if (obj && typeof obj === 'object') {
+    for (const [k, v] of Object.entries(obj as Record<string, unknown>)) {
+      collectStrings(v, path ? `${path}.${k}` : k, out)
+    }
+  }
+}
+
+describe('locale messages compile', () => {
+  it.each([
+    ['en', en],
+    ['es', es],
+  ])('every %s message string compiles under the real vue-i18n compiler', (_locale, messages) => {
+    const strings: Array<[string, string]> = []
+    collectStrings(messages, '', strings)
+    expect(strings.length).toBeGreaterThan(100)
+
+    const failures: string[] = []
+    for (const [path, msg] of strings) {
+      try {
+        i18n.global.t(path)
+      } catch (e) {
+        failures.push(`${path}: ${(e as Error).message.split('\n')[0]} (source: ${JSON.stringify(msg)})`)
+      }
+    }
+    expect(failures).toEqual([])
+  })
+})
@@ -315,7 +315,7 @@
    "passwordNeedUppercase": "Password must contain at least one uppercase letter",
    "passwordNeedLowercase": "Password must contain at least one lowercase letter",
    "passwordNeedDigit": "Password must contain at least one digit",
-    "passwordNeedSpecial": "Password must contain at least one special character (!@#$%^&* etc.)",
+    "passwordNeedSpecial": "Password must contain at least one special character (!{'@'}#$%^&* etc.)",
    "setupFailed": "Setup failed",
    "verificationFailed": "Verification failed",
    "disableFailed": "Failed to disable 2FA",
@@ -775,6 +775,13 @@
    "paymentConfirmed": "Payment confirmed",
    "transactionId": "Transaction ID",
    "pasteEcashToken": "Paste ecash token",
+    "lnAddressTitle": "Or share your Minibits Lightning address",
+    "lnAddressHint": "Anyone can pay you sats with any Lightning wallet by sending to this address — the sats arrive as ecash. Keep this screen open to receive them.",
+    "lnAddressLabel": "Your {'@'}minibits.cash address:",
+    "lnAddressLoading": "Setting up your Lightning address…",
+    "lnAddressUnavailable": "Lightning address unavailable — you can still paste a token below.",
+    "lnAddressReceived": "Received {amount} sats to your Lightning address!",
+    "lnAddressPendingRetry": "A payment arrived but couldn't be redeemed yet ({count}) — retrying automatically, keep this screen open.",
    "processing": "Processing...",
    "generateAddress": "Generate Address",
    "createInvoice": "Create Invoice",
@@ -315,7 +315,7 @@
    "passwordNeedUppercase": "La contrase\u00f1a debe contener al menos una letra may\u00fascula",
    "passwordNeedLowercase": "La contrase\u00f1a debe contener al menos una letra min\u00fascula",
    "passwordNeedDigit": "La contrase\u00f1a debe contener al menos un d\u00edgito",
-    "passwordNeedSpecial": "La contrase\u00f1a debe contener al menos un car\u00e1cter especial (!@#$%^&* etc.)",
+    "passwordNeedSpecial": "La contrase\u00f1a debe contener al menos un car\u00e1cter especial (!{'@'}#$%^&* etc.)",
    "setupFailed": "La configuraci\u00f3n fall\u00f3",
    "verificationFailed": "La verificaci\u00f3n fall\u00f3",
    "disableFailed": "Error al deshabilitar 2FA",
@@ -756,6 +756,13 @@
    "paymentConfirmed": "Pago confirmado",
    "transactionId": "ID de transacci\u00f3n",
    "pasteEcashToken": "Pegar token Ecash",
+    "lnAddressTitle": "O comparte tu direcci\u00f3n Lightning de Minibits",
+    "lnAddressHint": "Cualquier persona puede pagarte sats con cualquier billetera Lightning enviando a esta direcci\u00f3n \u2014 los sats llegan como ecash. Mant\u00e9n esta pantalla abierta para recibirlos.",
+    "lnAddressLabel": "Su direcci\u00f3n {'@'}minibits.cash:",
+    "lnAddressLoading": "Configurando su direcci\u00f3n Lightning\u2026",
+    "lnAddressUnavailable": "Direcci\u00f3n Lightning no disponible \u2014 a\u00fan puede pegar un token abajo.",
+    "lnAddressReceived": "\u00a1Recibi\u00f3 {amount} sats en su direcci\u00f3n Lightning!",
+    "lnAddressPendingRetry": "Lleg\u00f3 un pago pero a\u00fan no se pudo canjear ({count}) \u2014 reintentando autom\u00e1ticamente, mantenga esta pantalla abierta.",
    "processing": "Procesando...",
    "generateAddress": "Generar direcci\u00f3n",
    "createInvoice": "Crear factura",
@@ -29,7 +29,7 @@ vi.mock('@/router', () => ({

 vi.stubGlobal('open', mockWindowOpen)

-import { useAppLauncherStore } from '../appLauncher'
+import { useAppLauncherStore, senderMatchesApp } from '../appLauncher'

 describe('useAppLauncherStore', () => {
  beforeEach(() => {
@@ -448,4 +448,21 @@ describe('useAppLauncherStore', () => {
    vi.runAllTimers()
    vi.useRealTimers()
  })
+
+  describe('NIP-07 sender origin matching', () => {
+    it('accepts a scheme-upgraded frame (HSTS) as the opened app', () => {
+      // Regression (2026-09-01): the stored app URL was http:// but the
+      // browser loaded the frame as https:// — strict origin equality
+      // dropped every nostr sign-in from the upgraded frame.
+      expect(senderMatchesApp('http://framework-pt.local:7778', 'https://framework-pt.local:7778')).toBe(true)
+      expect(senderMatchesApp('https://framework-pt.local:7778', 'http://framework-pt.local:7778')).toBe(true)
+    })
+
+    it('still rejects a different host or port', () => {
+      expect(senderMatchesApp('http://framework-pt.local:7778', 'https://evil.example:7778')).toBe(false)
+      expect(senderMatchesApp('http://framework-pt.local:7778', 'https://framework-pt.local:7777')).toBe(false)
+      expect(senderMatchesApp('http://framework-pt.local:7778', 'null')).toBe(false)
+      expect(senderMatchesApp('', 'https://framework-pt.local:7778')).toBe(false)
+    })
+  })
 })
@@ -29,6 +29,24 @@ function openExternal(launchUrl: string) {
  window.open(launchUrl, '_blank', 'noopener,noreferrer')
 }

+/** Whether a postMessage sender's origin belongs to the app the launcher
+ *  actually opened. Same hostname and port are REQUIRED; the SCHEME is
+ *  deliberately not compared: a browser with cached HSTS (or any scheme
+ *  upgrade) loads a stored http:// app URL as https://, and strict equality
+ *  silently dropped every nostr request from the upgraded frame — nostr
+ *  sign-in on IndeeHub died exactly there over HTTPS (2026-09-01). */
+export function senderMatchesApp(appUrl: string, senderOrigin: string): boolean {
+  let expected: URL
+  let sender: URL
+  try {
+    expected = new URL(appUrl, 'http://localhost/')
+    sender = new URL(senderOrigin)
+  } catch {
+    return false
+  }
+  return sender.hostname === expected.hostname && sender.port === expected.port
+}
+
 /** Ports of apps that set X-Frame-Options (can't iframe, must open in new tab) */
 const NEW_TAB_PORTS = new Set([
  '23000', // BTCPay — X-Frame-Options: DENY
@@ -393,19 +411,11 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
    const source = event.source as Window | null
    if (!source) return

-    // Only the app we actually opened may drive this bridge. The sender's
-    // real origin must match the open app's URL origin — without this, any
-    // co-resident iframe could deanonymize the nostr identity or use the
-    // node as a decryption oracle while an app happened to be open.
-    let expectedOrigin: string
-    try {
-      expectedOrigin = new URL(url.value, window.location.href).origin
-    } catch {
-      return
-    }
-    if (event.origin !== expectedOrigin) return
+    // Only the app we actually opened may drive this bridge — see
+    // senderMatchesApp for why the scheme is deliberately not compared.
+    if (!senderMatchesApp(url.value, event.origin)) return

-    const origin = url.value || 'unknown'
+    const origin = event.origin

    // Check if app has a per-app identity stored (from identity picker)
    const IDENTITY_KEY = 'archipelago_app_identity_'
@@ -265,7 +265,7 @@ function closeRouteSession() {
 const iframeRef = computed(() => frameRef.value?.iframeRef ?? null)

 const identity = useAppIdentity(appId, iframeRef, showIdentityPicker)
-const nostrBridge = useNostrBridge(identity.getStoredIdentity, () => appUrl.value)
+const nostrBridge = useNostrBridge(identity.getStoredIdentity)

 // --- Display mode ---

@@ -515,8 +515,10 @@ async function installApp(app: MarketplaceApp) {
  }

  queueInstall(app)
-  toast.info("Installing " + (app.title ?? app.id) + " - check My Apps")
-  router.push('/dashboard/apps').catch(() => {})
+  // Stay on the store page: the tile itself shows install progress via the
+  // global watcher, and a forced jump to My Apps yanked the user out of the
+  // page they were deliberately browsing.
+  toast.info("Installing " + (app.title ?? app.id) + " — it will appear in My Apps")

  try {
    const installUrl = app.url || app.manifestUrl || app.s9pkUrl
@@ -540,8 +542,8 @@ async function installCommunityApp(app: MarketplaceApp) {
  }

  queueInstall(app)
-  toast.info("Installing " + (app.title ?? app.id) + " - check My Apps")
-  router.push('/dashboard/apps').catch(() => {})
+  // Stay on the store page (see installApp).
+  toast.info("Installing " + (app.title ?? app.id) + " — it will appear in My Apps")

  try {
    const installParams: Record<string, unknown> = { id: app.id, dockerImage: app.dockerImage, version: app.version }
@@ -64,10 +64,10 @@ describe('appSessionConfig', () => {
      configurable: true,
    })

-    // did-wallet's manifest publishes host port 8088 (apps/did-wallet/
+    // searxng's manifest publishes host port 8888 (apps/searxng/
    // manifest.yml) — assert against the manifest-generated value, which is
    // exactly what this test exists to protect.
-    expect(resolveAppUrl('did-wallet')).toBe('http://192.0.2.10:8088')
+    expect(resolveAppUrl('searxng')).toBe('http://192.0.2.10:8888')
  })

  it('does not treat service-only tcp ports as web launch surfaces', () => {
@@ -1,6 +1,7 @@
 /** Generated by scripts/generate-app-catalog.py. Do not edit manually. */

 export const GENERATED_APP_PORTS: Record<string, number> = {
+  "adguardhome": 3030,
  "aiui": 5180,
  "alby-hub": 8187,
  "archy-mempool-web": 4080,
@@ -8,7 +9,6 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
  "bitcoin-ui": 8334,
  "botfights": 9100,
  "btcpay-server": 23000,
-  "did-wallet": 8088,
  "electrs-ui": 50002,
  "electrumx": 50002,
  "fedimint": 8175,
@@ -23,9 +23,9 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
  "lnd-ui": 18083,
  "mempool": 4080,
  "mempool-api": 8999,
-  "morphos-server": 8089,
  "netbird": 8087,
  "nextcloud": 8085,
+  "nginx-proxy-manager": 8081,
  "nostr-rs-relay": 18081,
  "photoprism": 2342,
  "pine": 10380,
@@ -33,11 +33,13 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
  "router": 8084,
  "searxng": 8888,
  "strfry": 8090,
+  "tailscale": 8240,
  "uptime-kuma": 3002,
  "vaultwarden": 8082,
 }

 export const GENERATED_APP_TITLES: Record<string, string> = {
+  "adguardhome": "AdGuard Home",
  "aiui": "AI Assistant",
  "alby-hub": "Alby Hub",
  "archy-btcpay-db": "BTCPay Postgres",
@@ -52,7 +54,6 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
  "btcpay-server": "BTCPay Server",
  "core-lightning": "Core Lightning (CLN)",
  "cuprate": "Cuprate",
-  "did-wallet": "Web5 DID Wallet",
  "electrs-ui": "Electrs UI",
  "electrumx": "ElectrumX",
  "fedimint": "Fedimint Guardian",
@@ -74,17 +75,17 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
  "indeedhub-redis": "IndeedHub Redis",
  "indeedhub-relay": "IndeedHub Nostr Relay",
  "jellyfin": "Jellyfin",
-  "lightning-stack": "Lightning Stack",
  "lnd": "LND",
  "lnd-ui": "LND UI",
  "mempool": "Mempool Explorer",
  "mempool-api": "Mempool API",
-  "morphos-server": "MorphOS Server",
  "netbird": "NetBird",
  "netbird-dashboard": "NetBird Dashboard",
  "netbird-server": "NetBird Server",
  "nextcloud": "Nextcloud",
+  "nginx-proxy-manager": "Nginx Proxy Manager",
  "nostr-rs-relay": "Nostr Relay (Rust)",
+  "ollama": "Ollama",
  "phoenixd": "phoenixd",
  "photoprism": "PhotoPrism",
  "pine": "Pine",
@@ -95,6 +96,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
  "router": "Mesh Router",
  "searxng": "SearXNG",
  "strfry": "Strfry Nostr Relay",
+  "tailscale": "Tailscale",
  "uptime-kuma": "Uptime Kuma",
  "vaultwarden": "Vaultwarden",
 }
@@ -1,11 +1,15 @@
-/** Composable for NIP-07 Nostr signing bridge between parent and iframe */
+/** Composable for NIP-07 Nostr signing between parent and iframe apps.
+ *
+ *  Replies always target event.origin — the frame's REAL origin. The app's
+ *  recorded URL can carry a stale scheme (HSTS-upgraded http app on an HTTPS
+ *  dashboard); targeting it makes postMessage throw and the app never sees
+ *  its response. */

 import { rpcClient } from '@/api/rpc-client'
 import type { SelectedIdentity } from './useAppIdentity'

 export function useNostrBridge(
  getStoredIdentity: () => SelectedIdentity | null,
-  getAppUrl: () => string,
 ) {
  async function handleNostrRequest(event: MessageEvent) {
    const { id, method, params } = event.data
@@ -43,14 +47,15 @@ export function useNostrBridge(
      else if (method === 'nip44.encrypt') { result = (await rpcClient.call<{ ciphertext: string }>({ method: 'identity.nostr-encrypt-nip44', params: { id: identityId || undefined, pubkey: params.pubkey, plaintext: params.plaintext } })).ciphertext }
      else if (method === 'nip44.decrypt') { result = (await rpcClient.call<{ plaintext: string }>({ method: 'identity.nostr-decrypt-nip44', params: { id: identityId || undefined, pubkey: params.pubkey, ciphertext: params.ciphertext } })).plaintext }
      else { throw new Error(`Unsupported NIP-07 method: ${method}`) }
-      const url = getAppUrl()
-      const targetOrigin = url ? new URL(url).origin : '*'
-      source.postMessage({ type: 'nostr-response', id, result }, targetOrigin)
+      // Reply to the sender's REAL origin, never to the stored app URL:
+      // a scheme-upgraded frame (HSTS, or any future upgrade) makes the
+      // stored http:// URL a stale targetOrigin — postMessage then throws
+      // and the app never receives its response. nostr sign-in on IndeeHub
+      // over HTTPS died exactly there (2026-09-01).
+      source.postMessage({ type: 'nostr-response', id, result }, event.origin || '*')
    } catch (err) {
      if (import.meta.env.DEV) console.error(`[NIP-07] ${method} FAILED:`, err instanceof Error ? err.message : err)
-      const url = getAppUrl()
-      const targetOrigin = url ? new URL(url).origin : '*'
-      source.postMessage({ type: 'nostr-response', id, error: err instanceof Error ? err.message : 'Unknown error' }, targetOrigin)
+      source.postMessage({ type: 'nostr-response', id, error: err instanceof Error ? err.message : 'Unknown error' }, event.origin || '*')
    }
  }

@@ -44,10 +44,8 @@
            class="tier-badge"
            :class="tier === 'core' ? 'tier-badge-core' : 'tier-badge-recommended'"
          >{{ tier }}</span>
-          <span
-            v-if="pkg['available-update']"
-            class="inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-semibold bg-orange-500/20 text-orange-300 border border-orange-500/30"
-          >Update</span>
+          <!-- Update state is the bottom-left button only: a second pill up
+               here duplicated the signal and crowded the title. -->
        </div>
        <p class="text-sm text-white/50">{{ version ? $ver(version) : '' }}</p>
        <p v-if="author" class="text-xs text-white/40 mt-0.5">{{ author }}</p>
@@ -6,33 +6,17 @@ import { PackageState, type PackageDataEntry } from '@/types/api'
 import { matchPageScheme, resolveAppUrl } from '../appSession/appSessionConfig'
 import { portIsGateFronted } from '../discover/curatedApps'
 import { isAutoTabApp } from '@/utils/autoTabApps'
+import {
+  SERVICE_NAMES as SHARED_SERVICE_NAMES,
+  isServiceContainer as sharedIsServiceContainer,
+} from './serviceNames'

 export type AppsTab = 'apps' | 'websites' | 'services'

-// Service container name patterns (backend/infra, not user-facing)
-export const SERVICE_NAMES = new Set([
-  'dwn', 'archy-mempool-db', 'archy-btcpay-db', 'archy-nbxplorer', 'archy-tor',
-  // Headless backends with no user-facing UI: the Fedimint ecash client daemon,
-  // the Nostr relay, and the Meshtastic LoRa daemon (its chat UI lives in the
-  // built-in Mesh tab) belong in Services, not My Apps.
-  'fedimint-clientd', 'nostr-rs-relay', 'meshtastic',
-  'immich_postgres', 'immich_redis',
-  // immich is now a manifest-driven stack (app_id-named, hyphen). The server is
-  // the launcher app; postgres/redis are backends → Services.
-  'immich-postgres', 'immich-redis',
-  'mysql-mempool', 'mempool-api', 'archy-mempool-web',
-  'archy-bitcoin-ui', 'archy-lnd-ui', 'archy-electrs-ui',
-  'bitcoin-ui', 'lnd-ui', 'electrs-ui',
-  'indeedhub-postgres', 'indeedhub-redis', 'indeedhub-minio',
-  'indeedhub-api', 'indeedhub-ffmpeg',
-  'indeedhub-relay', 'indeedhub-build_api_1', 'indeedhub-build_ffmpeg-worker_1',
-  'indeedhub-build_postgres_1', 'indeedhub-build_redis_1', 'indeedhub-build_minio_1',
-  'indeedhub-build_minio-init_1', 'indeedhub-build_relay_1',
-  // Pine voice-assistant stack: the two Wyoming engines are backends (STT/TTS)
-  // reached by Home Assistant over host.containers.internal — the user-facing
-  // card is "pine" (the setup/status launcher), so the engines go to Services.
-  'pine-whisper', 'pine-piper', 'pine-openwakeword',
-])
+// Re-exported for every existing caller — the canon moved to serviceNames.ts
+// so the App Store's catalog merge can share it without a circular import.
+export const SERVICE_NAMES = SHARED_SERVICE_NAMES
+export const isServiceContainer = sharedIsServiceContainer

 const INTERNAL_TOOLING_NAMES = new Set([
  'buildx_buildkit_default',
@@ -43,16 +27,7 @@ export function isInternalToolingPackage(id: string, pkg?: PackageDataEntry): bo
  return INTERNAL_TOOLING_NAMES.has(id) || INTERNAL_TOOLING_NAMES.has(manifestId) || id.startsWith('buildx_buildkit') || manifestId.startsWith('buildx_buildkit')
 }

-export function isServiceContainer(id: string): boolean {
-  if (SERVICE_NAMES.has(id)) return true
-  if (id.startsWith('indeedhub-build_')) return true
-  if (id.startsWith('archy-')) return true
-  // Backend naming patterns that never carry a user-facing UI: databases and
-  // caches. Safe to classify by suffix (a database is never a launcher).
-  if (/-(db|postgres|postgresql|redis|valkey|mariadb|mysql|cache)$/.test(id)) return true
-  if (id.endsWith('_db')) return true
-  return false
-}
+// isServiceContainer now re-exports the shared canon (serviceNames.ts).

 export function isServicePackage(id: string, pkg?: PackageDataEntry): boolean {
  if (isServiceContainer(id)) return true
@@ -0,0 +1,62 @@
+/**
+ * Canonical internal/service app-id classification — the shared source for
+ * every surface that must decide "is this a user-facing app or a component
+ * of one": the My Apps/Services tabs (appsConfig) and the App Store listing
+ * (the signed-catalog merge in discover/curatedApps must not publish
+ * components as standalone store apps).
+ *
+ * Keep this module dependency-free: it is imported from both the apps view
+ * and the catalog module (which must not import view code that reads the
+ * store — circulars).
+ */
+
+// Service container ids (backend/infra, not user-facing). Mirrors the
+// SERVICE_NAMES set that used to live in appsConfig.ts verbatim.
+export const SERVICE_NAMES = new Set([
+  'dwn', 'archy-mempool-db', 'archy-btcpay-db', 'archy-nbxplorer', 'archy-tor',
+  // Headless backends with no user-facing UI: the Fedimint ecash client daemon,
+  // the Nostr relay, and the Meshtastic LoRa daemon (its chat UI lives in the
+  // built-in Mesh tab) belong in Services, not My Apps.
+  'fedimint-clientd', 'nostr-rs-relay', 'meshtastic',
+  'immich_postgres', 'immich_redis',
+  // immich is now a manifest-driven stack (app_id-named, hyphen). The server is
+  // the launcher app; postgres/redis are backends → Services.
+  'immich-postgres', 'immich-redis',
+  'mysql-mempool', 'mempool-api', 'archy-mempool-web',
+  'archy-bitcoin-ui', 'archy-lnd-ui', 'archy-electrs-ui',
+  'bitcoin-ui', 'lnd-ui', 'electrs-ui',
+  'indeedhub-postgres', 'indeedhub-redis', 'indeedhub-minio',
+  'indeedhub-api', 'indeedhub-ffmpeg',
+  'indeedhub-relay', 'indeedhub-build_api_1', 'indeedhub-build_ffmpeg-worker_1',
+  'indeedhub-build_postgres_1', 'indeedhub-build_redis_1', 'indeedhub-build_minio_1',
+  'indeedhub-build_minio-init_1', 'indeedhub-build_relay_1',
+  // Pine voice-assistant stack: the two Wyoming engines are backends (STT/TTS)
+  // reached by Home Assistant over host.containers.internal — the user-facing
+  // card is "pine" (the setup/status launcher), so the engines go to Services.
+  'pine-whisper', 'pine-piper', 'pine-openwakeword',
+])
+
+// Node-bundled internals that are real manifests (so they surface in the
+// signed catalog's manifest list) but are not store apps: the assistant and
+// the bundled relay/UIs ship with the node itself, the DWN is internal
+// plumbing, and the mesh router + CLN are components of other surfaces.
+export const NODE_INTERNAL_IDS = new Set([
+  'aiui', 'fips-ui', 'strfry', 'web5-dwn', 'router', 'core-lightning',
+])
+
+/** Is this id a component/backend rather than a standalone user app? */
+export function isServiceContainer(id: string): boolean {
+  if (SERVICE_NAMES.has(id)) return true
+  if (id.startsWith('indeedhub-build_')) return true
+  if (id.startsWith('archy-')) return true
+  // Backend naming patterns that never carry a user-facing UI: databases and
+  // caches. Safe to classify by suffix (a database is never a launcher).
+  if (/-(db|postgres|postgresql|redis|valkey|mariadb|mysql|cache)$/.test(id)) return true
+  if (id.endsWith('_db')) return true
+  return false
+}
+
+/** Should this app id appear in the App Store listing at all? */
+export function isStoreListedApp(id: string): boolean {
+  return !isServiceContainer(id) && !NODE_INTERNAL_IDS.has(id)
+}
@@ -40,7 +40,7 @@
            v-if="app.icon"
            :src="app.icon"
            :alt="app.title"
-            class="w-14 h-14 rounded-lg object-cover"
+            class="w-14 h-14 rounded-lg archy-app-icon"
            @error="handleImageError"
          />
          <div v-else class="w-14 h-14 rounded-lg bg-white/10 flex items-center justify-center">
@@ -24,7 +24,7 @@
            v-if="app.icon"
            :src="app.icon"
            :alt="app.title"
-            class="w-20 h-20 rounded-xl object-cover flex-shrink-0"
+            class="w-20 h-20 rounded-xl archy-app-icon flex-shrink-0"
            @error="handleImageError"
          />
          <div class="flex-1 min-w-0">
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { __setSignedCatalogForTests, portAuth, portIsGateFronted, type SignedAppCatalog } from '../curatedApps'
+
+/** Catalog fragments mirroring the live signed catalog's port declarations
+ *  (releases/app-catalog.json, 2026-09-01). */
+const catalog = (apps: SignedAppCatalog['apps']): SignedAppCatalog => ({ apps })
+
+const FULL = catalog({
+  'archy-mempool-web': {
+    version: '3.0.1',
+    manifest: { app: { id: 'archy-mempool-web', ports: [{ host: 4080, container: 8080, auth: 'gated' }] } },
+  },
+  'mempool': {
+    version: '3.0.0',
+    manifest: { app: { id: 'mempool', ports: [{ host: 4080, container: 8080, auth: 'gated' }] } },
+  },
+  'lnd-ui': {
+    version: '1.0.0',
+    manifest: { app: { id: 'lnd-ui', ports: [{ host: 18083, container: 18083, auth: 'gated' }] } },
+  },
+  'bitcoin-ui': {
+    version: '1.0.0',
+    manifest: { app: { id: 'bitcoin-ui', ports: [{ host: 8334, container: 8334, auth: 'gated' }] } },
+  },
+  'bitcoin-knots': {
+    version: '29.3',
+    manifest: { app: { id: 'bitcoin-knots', ports: [{ host: 8332, container: 8332, auth: 'none' }] } },
+  },
+  'electrs-ui': {
+    version: '1.0.0',
+    manifest: { app: { id: 'electrs-ui', ports: [{ host: 50002, container: 50002, auth: 'gated' }] } },
+  },
+})
+
+afterEach(() => __setSignedCatalogForTests(null))
+
+describe('portAuth', () => {
+  it('resolves the UI port through the launch alias, not just the app id', () => {
+    __setSignedCatalogForTests(FULL)
+    // 'mempool-web' has no catalog entry of its own; archy-mempool-web owns 4080.
+    expect(portIsGateFronted('mempool-web', 4080)).toBe(true)
+    // 'bitcoin-knots' declares 8332 (auth none) but its UI port 8334 is owned
+    // by bitcoin-ui — the alias must find it, or the new-tab button hands
+    // out an http:// URL on an HTTPS dashboard (2026-09-01 report).
+    expect(portIsGateFronted('bitcoin-knots', 8334)).toBe(true)
+    expect(portIsGateFronted('lnd', 18083)).toBe(true)
+    expect(portIsGateFronted('electrs', 50002)).toBe(true)
+  })
+
+  it('keeps a port the app itself publishes as plain HTTP off the gate', () => {
+    __setSignedCatalogForTests(FULL)
+    expect(portAuth('bitcoin-knots', 8332)).toBe('none')
+    expect(portIsGateFronted('bitcoin-knots', 8332)).toBe(false)
+  })
+
+  it('answers null for unknown apps and ports (never assume TLS)', () => {
+    __setSignedCatalogForTests(FULL)
+    expect(portAuth('never-installed-app', 1234)).toBeNull()
+    expect(portIsGateFronted('bitcoin-ui', 9999)).toBe(false)
+  })
+
+  it('falls back to a unanimous port-wide scan for unknown ids', () => {
+    __setSignedCatalogForTests(FULL)
+    // No alias for this id, but every declarer of 4080 says gated.
+    expect(portIsGateFronted('some-future-alias', 4080)).toBe(true)
+  })
+
+  it('refuses the port-wide scan when declarers disagree (no TLS guess)', () => {
+    __setSignedCatalogForTests(catalog({
+      'app-a': { version: '1', manifest: { app: { ports: [{ host: 7000, auth: 'gated' }] } } },
+      'app-b': { version: '1', manifest: { app: { ports: [{ host: 7000, auth: 'none' }] } } },
+    }))
+    expect(portAuth('unknown-app', 7000)).toBeNull()
+  })
+
+  it('returns null without a warmed catalog (cache miss, not a guess)', () => {
+    expect(portAuth('mempool-web', 4080)).toBeNull()
+  })
+})
@@ -1,4 +1,5 @@
 import type { MarketplaceApp } from './types'
+import { isStoreListedApp } from '../apps/serviceNames'

 const R = 'source.archipelago-foundation.org/lfg2025'

@@ -48,10 +49,15 @@ export interface SignedAppEntry {
 }

 /** Convert the signed catalog's keyed entries into store-listing apps.
- *  Pure — unit-tested against the live catalog's shape (Cuprate). */
+ *  Pure — unit-tested against the live catalog's shape (Cuprate).
+ *  Components and node internals never enter the listing: the signed catalog
+ *  carries every manifest (including backends like mempool-api and the
+ *  bundled UIs) because the node's update layer needs their pins, but the
+ *  App Store publishes apps, not parts of apps. */
 export function signedCatalogToApps(catalog: SignedAppCatalog): MarketplaceApp[] {
  const out: MarketplaceApp[] = []
  for (const [id, entry] of Object.entries(catalog.apps || {})) {
+    if (!isStoreListedApp(id)) continue
    const app = entry.manifest?.app
    out.push({
      id,
@@ -73,15 +79,60 @@ export function signedCatalogToApps(catalog: SignedAppCatalog): MarketplaceApp[]
 *  after fetchAppCatalog() has run. Test-hookable. */
 let signedCatalogCache: SignedAppCatalog | null = null

+/** Launch aliases → the catalog app id that OWNS the UI port.
+ *
+ *  The launcher knows apps by several historical names (`mempool-web`, `lnd`,
+ *  `electrs`…); the signed catalog knows them by manifest id. Without this
+ *  map the port-auth lookup below misses, `portIsGateFronted` answers false,
+ *  and an HTTPS dashboard hands the app session an http:// frame URL — which
+ *  the browser then blocks outright as mixed content. That is exactly how
+ *  Mempool and IndeeHub “did not connect” over HTTPS while working fine over
+ *  HTTP (2026-09-01). */
+const CATALOG_APP_ID_ALIASES: Record<string, string> = {
+  'mempool-web': 'archy-mempool-web',
+  'mempool-electrs': 'electrs-ui',
+  'electrs': 'electrs-ui',
+  'archy-electrs-ui': 'electrs-ui',
+  'lnd': 'lnd-ui',
+  'archy-lnd-ui': 'lnd-ui',
+  'bitcoin-knots': 'bitcoin-ui',
+  'bitcoin-core': 'bitcoin-ui',
+  'fedimintd': 'fedimint',
+  'immich_server': 'immich',
+}
+
 /** Port auth for an app's host port, from the signed catalog's embedded
 *  manifest. `gated`/`open` = the node's app gate owns the port and serves
 *  TLS on it; `none`/`local` = container-published plain HTTP; null = app
- *  unknown to the signed catalog (legacy curated installs). */
+ *  unknown to the signed catalog (legacy curated installs).
+ *
+ *  Resolution order: the app's own manifest, then its alias (the manifest
+ *  that actually owns the UI port), then — only for ports no known id
+ *  declares — a port-wide scan of the catalog. The scan must be UNANIMOUS:
+ *  a host port that any app publishes as plain HTTP (`none`) must never be
+ *  answered `gated`, or an https frame URL would point at a port that never
+ *  serves TLS. */
 export function portAuth(appId: string, hostPort: number | string): string | null {
-  const ports = signedCatalogCache?.apps?.[appId]?.manifest?.app?.ports
-  if (!Array.isArray(ports)) return null
-  const hit = ports.find(p => String(p.host) === String(hostPort))
-  return hit?.auth ?? null
+  const apps = signedCatalogCache?.apps
+  if (!apps) return null
+  const alias: string | undefined = CATALOG_APP_ID_ALIASES[appId]
+  const ids: string[] = alias === undefined || alias === appId ? [appId] : [appId, alias]
+  for (const id of ids) {
+    const ports = apps[id]?.manifest?.app?.ports
+    if (!Array.isArray(ports)) continue
+    const hit = ports.find(p => String(p.host) === String(hostPort))
+    if (hit?.auth) return hit.auth
+  }
+  let found: string | null = null
+  for (const entry of Object.values(apps)) {
+    const ports = entry?.manifest?.app?.ports
+    if (!Array.isArray(ports)) continue
+    const hit = ports.find(p => String(p.host) === String(hostPort))
+    if (!hit?.auth) continue
+    if (found === null) found = hit.auth
+    else if (found !== hit.auth) return null
+  }
+  return found
 }

 /** Whether an app's host port is fronted by the node's app gate (and so
@@ -200,7 +251,6 @@ export function getCuratedAppList(): MarketplaceApp[] {
    { id: 'grafana', title: 'Grafana', version: '10.2.0', description: 'Analytics and monitoring platform. Dashboards for your node metrics and system health.', icon: '/assets/img/app-icons/grafana.png', author: 'Grafana Labs', dockerImage: `${R}/grafana:10.2.0`, repoUrl: 'https://github.com/grafana/grafana' },
    { id: 'searxng', title: 'SearXNG', version: '2024.1.0', description: 'Privacy-respecting metasearch engine. Search the internet without being tracked or profiled.', icon: '/assets/img/app-icons/searxng.png', author: 'SearXNG', dockerImage: `${R}/searxng:latest`, repoUrl: 'https://github.com/searxng/searxng' },
    { id: 'ollama', title: 'Ollama', version: '0.5.4', description: 'Run AI models locally. Llama, Mistral, and more — on your hardware, completely private.', icon: '/assets/img/app-icons/ollama.png', author: 'Ollama', dockerImage: `${R}/ollama:latest`, repoUrl: 'https://github.com/ollama/ollama' },
-    { id: 'cryptpad', title: 'CryptPad', version: '2024.12.0', description: 'End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.', icon: '/assets/icon/favico-black-v2.svg', author: 'XWiki SAS', dockerImage: `${R}/cryptpad:2024.12.0`, repoUrl: 'https://github.com/cryptpad/cryptpad' },
    { id: 'nextcloud', title: 'Nextcloud', version: '29', description: 'Your own private cloud. File sync, calendars, contacts — all on your hardware.', icon: '/assets/img/app-icons/nextcloud.webp', author: 'Nextcloud', dockerImage: `${R}/nextcloud:29`, repoUrl: 'https://github.com/nextcloud/server' },
    { id: 'vaultwarden', title: 'Vaultwarden', version: '1.30.0', description: 'Self-hosted password vault. Bitwarden-compatible with zero-knowledge encryption.', icon: '/assets/img/app-icons/vaultwarden.webp', author: 'Vaultwarden', dockerImage: `${R}/vaultwarden:1.30.0-alpine`, repoUrl: 'https://github.com/dani-garcia/vaultwarden' },
    { id: 'jellyfin', title: 'Jellyfin', version: '10.8.13', description: 'Free media server. Stream your movies, music, and photos to any device.', icon: '/assets/img/app-icons/jellyfin.webp', author: 'Jellyfin', dockerImage: `${R}/jellyfin:10.8.13`, repoUrl: 'https://github.com/jellyfin/jellyfin' },
@@ -247,17 +247,6 @@ export function getCuratedAppList(): MarketplaceApp[] {
      manifestUrl: undefined,
      repoUrl: 'https://github.com/ollama/ollama'
    },
-    {
-      id: 'cryptpad',
-      title: 'CryptPad',
-      version: '2024.12.0',
-      description: 'End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.',
-      icon: '/assets/icon/favico-black-v2.svg',
-      author: 'XWiki SAS',
-      dockerImage: `${REGISTRY}/cryptpad:2024.12.0`,
-      manifestUrl: undefined,
-      repoUrl: 'https://github.com/cryptpad/cryptpad'
-    },
    {
      id: 'nextcloud',
      title: 'Nextcloud',
@@ -115,6 +115,24 @@ const showConnectForm = ref(false)
 const connecting = ref(false)
 const connectedParams = ref<Record<string, string> | null>(null)

+// Every action below (install/edit TollGate, WiFi scan, WAN configure) needs
+// host/ssh_user/ssh_password to reach the router. `connectedParams` only gets
+// set when the Connect form was actually submitted this session (WR-03 above)
+// — on a normal page load the router reconnects via the server-persisted
+// config instead, so `sshPassword`/`sshUser`/`host` (the Connect form's own
+// local refs) sit at their untouched defaults ('', 'root', ''). Falling back
+// to those refs here used to send an explicit-but-empty ssh_password, which
+// the backend treats as "the caller provided this" and never falls back to
+// the real saved password — a real router password then fails auth on every
+// action even though the status poll (which sends no params at all) keeps
+// working fine (archy-x250-pa3, 2026-09-05: dropbear logged one bad-password
+// attempt at the exact moment "Install TollGate" was clicked). Omitting the
+// fields entirely when there's no explicit connectedParams lets the backend's
+// own saved-config fallback do the right thing, same as the status poll.
+function authParams(): Record<string, string> {
+  return connectedParams.value ?? {}
+}
+
 const detecting = ref(false)
 const detectError = ref('')
 const detectedCandidates = ref<string[]>([])
@@ -271,11 +289,7 @@ async function provisionTollgate() {
  provisionError.value = ''
  provisionSuccess.value = false
  try {
-    const params: Record<string, unknown> = {
-      host: connectedParams.value?.host ?? status.value?.host,
-      ssh_user: connectedParams.value?.ssh_user ?? sshUser.value,
-      ssh_password: connectedParams.value?.ssh_password ?? sshPassword.value,
-    }
+    const params: Record<string, unknown> = { ...authParams() }
    await rpcClient.call({ method: 'openwrt.provision-tollgate', params, timeout: 300000 })
    provisionSuccess.value = true
    await load(connectedParams.value ?? undefined)
@@ -302,9 +316,7 @@ async function saveTollgateConfig() {
  updateTollgateError.value = ''
  try {
    const params: Record<string, unknown> = {
-      host: connectedParams.value?.host ?? status.value?.host,
-      ssh_user: connectedParams.value?.ssh_user ?? sshUser.value,
-      ssh_password: connectedParams.value?.ssh_password ?? sshPassword.value,
+      ...authParams(),
      price_sats: editPriceSats.value,
      step_size_ms: editStepSizeMin.value * 60_000,
      min_steps: editMinSteps.value,
@@ -336,11 +348,7 @@ async function scanWifi() {
  wanStep.value = 'scanning'
  wanError.value = ''
  try {
-    const params: Record<string, unknown> = {
-      host: connectedParams.value?.host ?? status.value?.host,
-      ssh_user: connectedParams.value?.ssh_user ?? sshUser.value,
-      ssh_password: connectedParams.value?.ssh_password ?? sshPassword.value,
-    }
+    const params: Record<string, unknown> = { ...authParams() }
    const result = await rpcClient.call<{ networks: ScannedNetwork[] }>({
      method: 'openwrt.scan-wifi',
      params,
@@ -367,9 +375,7 @@ async function configureWan() {
  wanError.value = ''
  try {
    const params: Record<string, unknown> = {
-      host: connectedParams.value?.host ?? status.value?.host,
-      ssh_user: connectedParams.value?.ssh_user ?? sshUser.value,
-      ssh_password: connectedParams.value?.ssh_password ?? sshPassword.value,
+      ...authParams(),
      ssid: selectedNetwork.value.ssid,
      password: wanPassword.value,
      encryption: selectedNetwork.value.encryption,
@@ -362,6 +362,59 @@ init()
              </button>
            </div>
            <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.8.11-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.11-alpha</span>
+                  <span class="text-xs text-white/40">September 7, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Cuprate now syncs without burning a core for days.</strong> The app's shipped config now enables Cuprate's checkpoint-backed fast_sync path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.</p>
+                  <p><strong>OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.</strong> The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds opkg/apk through the router's actual PATH instead of assuming /usr/bin, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to v0.5.0 with a native .apk install path where upstream provides one.</p>
+                  <p><strong>Release publishing now checks the public Gitea download links before a manifest goes live.</strong> The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea ROOT_URL or proxy setting cannot publish working files behind broken public HTTPS download links.</p>
+                </div>
+              </div>
+              <!-- v1.8.10-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.10-alpha</span>
+                  <span class="text-xs text-white/40">September 2, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Lightning sends work again — v1.8.9's payment switch lost the fee budget.</strong> Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as <strong>zero allowed fees</strong>: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered "No route to the recipient" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (fee_limit=0 mSAT on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.</p>
+                  <p><strong>A channel that drops its peer link now heals itself — on every node.</strong> Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails "no route to the recipient". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.</p>
+                  <p><strong>The Lightning wallet states the node's real funding state instead of "you have no channel."</strong> Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the <em>receiving</em> copy. The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance.</p>
+                </div>
+              </div>
+              <!-- v1.8.9-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.9-alpha</span>
+                  <span class="text-xs text-white/40">September 1, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Lightning sends work again after the LND 0.21.2 update.</strong> LND 0.21 removed the old synchronous payment route the node's backend paid through (/v1/channels/transactions) — every Lightning send answered the literal "Not Found" and the wallet showed "Payment failed: Not Found". The backend now pays through the supported Router.SendPaymentV2 route, keeps the same settle-then-report behaviour (a slow multi-hop payment is still tracked to completion, never falsely declared failed), and translates LND's failure reasons into plain advice. A new gate test speaks the payment route directly against the running LND, so an image/backend skew like this can never ship silently again.</p>
+                  <p><strong>The node no longer pins HSTS — HTTP access is a supported mode, and it stays working.</strong> The HTTPS listener used to send Strict-Transport-Security: max-age=31536000; includeSubDomains; browsers that visited HTTPS once cached that and then silently upgraded the still-open HTTP dashboard's calls to HTTPS, which is a scheme change — cross-origin — so every request died as "CORS blocked / Failed to fetch" while the node was perfectly healthy. The HTTPS listener now actively clears the cached policy (max-age=0) and port 80 sends no HSTS at all, which is deliberate: the node's certificate is optional and self-signed, and devices that haven't installed the CA must keep plain-HTTP access (that's what Settings → Node certificate is for). If your browser already cached the old policy, visiting the dashboard over HTTPS once after this update clears it; a gate test now refuses any config that reintroduces the pin.</p>
+                  <p><strong>App frames open over HTTPS again — including the ones that "did not connect."</strong> The launcher asked the signed catalog for each app's port policy under the name you click ("Mempool Web", "Bitcoin Knots"), but the catalog declares those ports under the manifest that owns them (the Mempool web container, Bitcoin UI). The lookup missed, the launcher handed the iframe an http:// address, and the browser blocked it as mixed content — the app tile went blank or spun forever. Port resolution now follows launch aliases (mempool-web, bitcoin-knots/bitcoin-core, lnd, electrs and friends), falls back to a port-wide catalog scan when the id is unknown, and the catalog is warmed as soon as the dashboard loads rather than only in the App Store, so the very first app you open already knows which ports serve TLS.</p>
+                  <p><strong>Signing in to IndeeHub with Nostr works over HTTPS.</strong> The NIP-07 bridge compared the app frame's origin for exact equality with the recorded http:// app URL — a frame the browser upgraded to HTTPS (or any scheme change) was silently ignored, and replies addressed to the stale origin were refused outright, so Nostr sign-in quietly did nothing. The bridge now matches host and port (scheme intentionally ignored) and always replies to the frame's real origin.</p>
+                  <p><strong>Nginx Proxy Manager starts again.</strong> Converting it to a platform manifest dropped two things its image needs: the /etc/letsencrypt mount its boot script hard-requires, and the NET_BIND_SERVICE capability its internal nginx needs to bind ports 80/443/81 under the orchestrator's --cap-drop=ALL. The result was an endless start/die loop (a node watched it restart 3,176 times). Both are declared in its manifest now, its certs live on unchanged under the same persistent app directory, and the signed catalog carries the fix so installed nodes heal on the next update.</p>
+                  <p><strong>Portainer's first-run token is in the app page, not buried in "server logs."</strong> New Portainer versions mint a one-time setup token on a fresh install and print it only to the container logs — on an appliance that meant telling the user to go read a server log to get into their own app. The token now appears in the same launch interstitial as app login credentials (with a copy button), only while first-run setup is actually pending; once the admin account exists the card disappears on its own.</p>
+                  <p><strong>The Lightning wallet states the node's real funding state instead of "you have no channel."</strong> Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had no channel at all (the outbound sum is legitimately zero in both states). The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of pointing at channel setup, and only a genuinely channel-less node is sent to open one.</p>
+                </div>
+              </div>
+              <!-- v1.8.8-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.8-alpha</span>
+                  <span class="text-xs text-white/40">September 1, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>SSH over the mesh is now a first-class setting.</strong> Settings gains an "SSH over mesh" card: off by default, and when you allow it the node's mesh firewall opens port 22 — either to every mesh peer (behind an explicit "I understand" confirmation, because that's a real exposure) or only to the mesh addresses you list. The rule is owned by the node (the 90-ssh.nft drop-in), so it survives upgrades and daemon reinstalls, and the card tells you up front whether sshd is running, whether it listens on IPv6 (the mesh is IPv6-only — this is what a broken attempt looks like before it happens), and whether password login is on (keys-only is the recommended pairing). From Termux on your phone, fipssh &lt;user&gt;@&lt;node-npub&gt; connects once the toggle is on — the npub is the durable address, and the command is shown with a copy button on the card.</p>
+                  <p><strong>The App Store now lists apps — not parts of apps.</strong> The signed catalog carries every manifest because the node's update layer needs their pins, and the store briefly listed them all: Mempool API, LND UI, Bitcoin UI, the Pine voice engines, the IndeeHub and Immich backends, the mesh router and friends. Components are hidden from the store listing (they still appear where they belong — the Services tab of My Apps, once installed), and four entries that never earned a tile are gone outright: MorphOS server (old), the Web5 DID wallet, Lightning Stack (an untracked upstream bundle — LND covers the need), and CryptPad (never tested).</p>
+                  <p><strong>App icons now persist everywhere, in the proper container style.</strong> Two fixes: installed apps render the icon from their own manifest — Cuprate no longer falls back to the generic A-mark on its Services tile — and the store grids (the Discover page) apply the same icon container treatment (backdrop, border, shadow) as My Apps, the detail pages, and Home. Manifest-declared UI apps also classify correctly again: Alby Hub installs into My Apps with a working tile, not into Services, because a probe miss no longer buries an app the manifest itself says has a frontend.</p>
+                  <p><strong>Installing from the store keeps you on the store page.</strong> The install progress lives on the tile itself and the app appears in My Apps when it lands — no more being yanked to My Apps mid-browse.</p>
+                </div>
+              </div>
              <!-- v1.8.7-alpha -->
              <div>
                <div class="flex items-center gap-2 mb-3">
@@ -0,0 +1,189 @@
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+import { useToast } from '@/composables/useToast'
+
+interface SshOverMeshStatus {
+  enabled: boolean
+  sources: string[]
+  scope: 'any' | 'list'
+  preflights?: {
+    sshd_active: boolean
+    sshd_ipv6_listen: boolean
+    password_auth: boolean | null
+  }
+  applied?: boolean
+  reloaded?: boolean
+}
+
+const toast = useToast()
+const status = ref<SshOverMeshStatus | null>(null)
+const loading = ref(true)
+const error = ref('')
+const saving = ref(false)
+const confirmAnyPeer = ref(false)
+const pendingEnableAny = ref(false)
+const sourcesText = ref('')
+const fipsNpub = ref<string | null>(null)
+
+async function refresh() {
+  loading.value = true
+  error.value = ''
+  try {
+    status.value = (await rpcClient.call({ method: 'fips.ssh-over-mesh.get' })) as SshOverMeshStatus
+    sourcesText.value = (status.value.sources || []).join('\n')
+    if (!fipsNpub.value) {
+      try {
+        const s = (await rpcClient.call<{ npub?: string }>({ method: 'fips.status', dedup: true, maxRetries: 1 }))
+        fipsNpub.value = s.npub ?? null
+      } catch { /* npub hint is optional */ }
+    }
+  } catch (e) {
+    error.value = e instanceof Error ? e.message : 'Failed to load SSH-over-mesh state'
+  } finally {
+    loading.value = false
+  }
+}
+
+/** The unrestricted scope opens port 22 to every mesh peer — demand an
+ *  explicit confirmation before applying it, like the other danger zones. */
+async function toggle(enabled: boolean) {
+  const sources = enabled && status.value?.scope === 'list'
+    ? sourcesText.value.split(/[\n,]+/).map(s => s.trim()).filter(Boolean)
+    : (status.value?.sources ?? [])
+  if (enabled && sources.length === 0) {
+    pendingEnableAny.value = true
+    confirmAnyPeer.value = true
+    return
+  }
+  await apply(enabled, sources)
+}
+
+async function apply(enabled: boolean, sources: string[]) {
+  saving.value = true
+  try {
+    status.value = (await rpcClient.call({
+      method: 'fips.ssh-over-mesh.set',
+      params: { enabled, sources },
+      timeout: 30_000,
+    })) as SshOverMeshStatus
+    sourcesText.value = (status.value.sources || []).join('\n')
+    toast.success(enabled ? 'SSH over mesh allowed' : 'SSH over mesh blocked')
+    if (enabled && status.value.reloaded === false) {
+      toast.error('Rule saved, but the firewall reload failed — reconnect or check logs')
+    }
+  } catch (e) {
+    toast.error(e instanceof Error ? e.message : 'Failed to apply')
+  } finally {
+    saving.value = false
+    pendingEnableAny.value = false
+    confirmAnyPeer.value = false
+  }
+}
+
+function copyFipssh() {
+  if (!fipsNpub.value) return
+  const cmd = `fipssh <user>@${fipsNpub.value}`
+  navigator.clipboard?.writeText(cmd).then(
+    () => toast.success('Copied: ' + cmd),
+    () => toast.error('Copy failed'),
+  )
+}
+
+onMounted(refresh)
+</script>
+
+<template>
+  <div class="glass-card px-6 py-6 mb-6">
+    <div class="flex items-start justify-between gap-4 mb-2">
+      <div>
+        <h2 class="text-xl font-semibold text-white/96">SSH over mesh</h2>
+        <p class="text-sm text-white/60 mt-1">
+          Let the phone's FIPS mesh reach this node's SSH (port 22). Off by default — the mesh
+          firewall refuses SSH until you allow it here.
+        </p>
+      </div>
+      <button
+        class="path-action-button path-action-button--continue px-4 py-2 text-sm shrink-0"
+        :disabled="saving || loading"
+        :class="{ '!bg-orange-500/30 !border-orange-400/50': status?.enabled }"
+        @click="toggle(!status?.enabled)"
+      >
+        {{ status?.enabled ? 'Allowed — block again' : 'Allow SSH over mesh' }}
+      </button>
+    </div>
+
+    <div v-if="loading" class="text-sm text-white/50 py-3">Loading…</div>
+    <div v-else-if="error" class="text-sm text-red-300 py-3">{{ error }}
+      <button class="ml-2 underline" @click="refresh">Retry</button>
+    </div>
+    <template v-else-if="status">
+      <!-- Preflights: explain the toggle rather than gating it -->
+      <div class="mt-3 space-y-1.5 text-sm">
+        <div class="flex items-center gap-2">
+          <span :class="status.preflights?.sshd_active ? 'text-green-400' : 'text-orange-300'">●</span>
+          <span class="text-white/80">sshd {{ status.preflights?.sshd_active ? 'is running' : 'is NOT running' }}</span>
+        </div>
+        <div class="flex items-center gap-2">
+          <span :class="status.preflights?.sshd_ipv6_listen ? 'text-green-400' : 'text-orange-300'">●</span>
+          <span class="text-white/80">
+            {{ status.preflights?.sshd_ipv6_listen ? 'listens on IPv6 (mesh-reachable)' : 'does not listen on IPv6 — the mesh cannot reach it' }}
+          </span>
+        </div>
+        <div class="flex items-center gap-2">
+          <span :class="status.preflights?.password_auth === false ? 'text-green-400' : 'text-orange-300'">●</span>
+          <span class="text-white/80">
+            {{ status.preflights?.password_auth == null
+              ? 'PasswordAuthentication unknown'
+              : status.preflights?.password_auth
+                ? 'password login allowed — keys-only is the safer pairing for the firewall rule'
+                : 'keys-only login (recommended)' }}
+          </span>
+        </div>
+      </div>
+
+      <!-- Source restriction -->
+      <div class="mt-4">
+        <p class="text-xs text-white/50 mb-1">Restrict to specific mesh addresses (one per line), or leave empty to allow any mesh peer.</p>
+        <textarea
+          v-model="sourcesText"
+          rows="2"
+          class="w-full bg-white/10 border border-white/20 rounded-lg p-2 text-sm text-white/90 font-mono placeholder-white/30"
+          placeholder="fd79:… phone mesh address"
+          :disabled="!status.enabled || saving"
+          @change="apply(true, sourcesText.split(/[\n,]+/).map(s => s.trim()).filter(Boolean))"
+        />
+      </div>
+
+      <!-- Phone-side hint: the npub is the durable address -->
+      <div v-if="status.enabled && fipsNpub" class="mt-3 flex items-center gap-2 text-sm">
+        <span class="text-white/60">From Termux:</span>
+        <code class="text-orange-200 truncate max-w-[55%]">fipssh &lt;user&gt;@{{ fipsNpub.slice(0, 12) }}…</code>
+        <button class="glass-button px-2 py-1 text-xs" @click="copyFipssh">Copy</button>
+      </div>
+    </template>
+
+    <!-- Danger-zone confirmation for the unrestricted scope -->
+    <Teleport to="body">
+      <div v-if="confirmAnyPeer" class="fixed inset-0 z-[3000] flex items-center justify-center p-4" @click.self="confirmAnyPeer = false">
+        <div class="absolute inset-0 bg-black/60 backdrop-blur-sm"></div>
+        <div class="glass-card p-6 max-w-md w-full relative z-10">
+          <h3 class="text-lg font-semibold text-white mb-3">Allow SSH from ANY mesh peer?</h3>
+          <p class="text-sm text-white/70 mb-4">
+            Anyone who can route to this node over the FIPS mesh will reach port 22. Restricting
+            to your phone's mesh address above is the safer pairing. Only continue if you
+            understand port 22 will face every mesh peer.
+          </p>
+          <div class="flex gap-3">
+            <button class="flex-1 glass-button px-4 py-2 text-sm" @click="confirmAnyPeer = false">Restrict instead</button>
+            <button
+              class="flex-1 px-4 py-2 rounded-lg text-sm border border-orange-400/50 bg-orange-500/20 text-orange-200 hover:bg-orange-500/30"
+              :disabled="saving || pendingEnableAny === false"
+              @click="apply(true, [])"
+            >I understand — allow any</button>
+          </div>
+        </div>
+      </div>
+    </Teleport>
+  </div>
+</template>
@@ -6,6 +6,7 @@ import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
 import RoutstrBudgetSection from '@/views/settings/RoutstrBudgetSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
 import TelemetrySection from '@/views/settings/TelemetrySection.vue'
+import SshOverMeshCard from '@/views/settings/SshOverMeshCard.vue'
 import NodeCertificateSection from '@/views/settings/NodeCertificateSection.vue'
 import LightningCredentialsSection from '@/views/settings/LightningCredentialsSection.vue'
 import BackupSection from '@/views/settings/BackupSection.vue'
@@ -20,6 +21,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
  <AIDataAccessSection />
  <WebhookSection />
  <TelemetrySection />
+  <SshOverMeshCard />
  <NodeCertificateSection />
  <LightningCredentialsSection />
  <BackupSection />
@@ -0,0 +1,92 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+
+const getSpy = vi.fn()
+const setSpy = vi.fn()
+const toast = { success: vi.fn(), error: vi.fn(), info: vi.fn() }
+
+vi.mock('@/api/rpc-client', () => ({
+  rpcClient: {
+    call: (req: { method: string; params?: unknown }) => {
+      if (req.method === 'fips.ssh-over-mesh.get') return getSpy(req)
+      if (req.method === 'fips.ssh-over-mesh.set') return setSpy(req)
+      if (req.method === 'fips.status') return Promise.resolve({ npub: 'npub1test' })
+      return Promise.resolve({})
+    },
+  },
+}))
+vi.mock('@/composables/useToast', () => ({ useToast: () => toast }))
+
+import SshOverMeshCard from '../SshOverMeshCard.vue'
+
+function statusBody(overrides: Record<string, unknown> = {}) {
+  return {
+    enabled: false,
+    sources: [],
+    scope: 'any',
+    preflights: { sshd_active: true, sshd_ipv6_listen: true, password_auth: false },
+    ...overrides,
+  }
+}
+
+describe('SshOverMeshCard', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    getSpy.mockResolvedValue(statusBody())
+    setSpy.mockResolvedValue(statusBody({ enabled: true }))
+  })
+
+  it('renders preflights from the RPC state', async () => {
+    getSpy.mockResolvedValue(statusBody())
+    const wrapper = mount(SshOverMeshCard)
+    await vi.dynamicImportSettled()
+    await new Promise(r => setTimeout(r, 0))
+    expect(getSpy).toHaveBeenCalledWith(expect.objectContaining({ method: 'fips.ssh-over-mesh.get' }))
+    expect(wrapper.text()).toContain('sshd is running')
+    expect(wrapper.text()).toContain('keys-only login')
+  })
+
+  it('flags the missing IPv6 listener honestly', async () => {
+    getSpy.mockResolvedValue(statusBody({
+      preflights: { sshd_active: true, sshd_ipv6_listen: false, password_auth: true },
+    }))
+    const wrapper = mount(SshOverMeshCard)
+    await new Promise(r => setTimeout(r, 0))
+    expect(wrapper.text()).toContain('does not listen on IPv6')
+    expect(wrapper.text()).toContain('keys-only is the safer pairing')
+  })
+
+  it('demands the danger-zone confirmation before an unrestricted enable', async () => {
+    const wrapper = mount(SshOverMeshCard)
+    await new Promise(r => setTimeout(r, 0))
+    await wrapper.find('button.path-action-button').trigger('click')
+    // The confirmation modal Teleports to <body>; nothing applied yet.
+    expect(document.body.textContent).toContain('Allow SSH from ANY mesh peer')
+    expect(setSpy).not.toHaveBeenCalled()
+    // Confirming applies the unrestricted rule.
+    const confirm = [...document.body.querySelectorAll('button')]
+      .find(b => (b.textContent ?? '').includes('I understand'))
+    expect(confirm).toBeDefined()
+    confirm!.dispatchEvent(new Event('click'))
+    await new Promise(r => setTimeout(r, 0))
+    await new Promise(r => setTimeout(r, 0))
+    expect(setSpy).toHaveBeenCalledWith(expect.objectContaining({
+      params: { enabled: true, sources: [] },
+    }))
+  })
+
+  it('applies a restricted enable without the any-peer confirmation', async () => {
+    // An existing restricted rule: turning it back on re-applies the list.
+    getSpy.mockResolvedValue(statusBody({ enabled: false, sources: ['fd00::1'], scope: 'list' }))
+    setSpy.mockResolvedValue(statusBody({ enabled: true, sources: ['fd00::1'], scope: 'list' }))
+    const wrapper = mount(SshOverMeshCard)
+    await new Promise(r => setTimeout(r, 0))
+    await wrapper.find('button.path-action-button').trigger('click')
+    expect(setSpy).toHaveBeenCalledWith(expect.objectContaining({
+      params: { enabled: true, sources: ['fd00::1'] },
+    }))
+    expect(wrapper.text()).not.toContain('Allow SSH from ANY mesh peer')
+  })
+})
@@ -1,29 +1,29 @@
 {
  "changelog": [
-    "**Companion 0.5.28 is included in the node download this time, with the work that missed v1.8.5.** The companion hub can back up and restore its node list, act as a NIP-46 remote signer, and shows each paired node's FIPS mesh address with tap-to-copy. For Termux users, the included `fipssh` helper turns a durable node npub into its mesh address, so `fipssh user@npub1…` can reach SSH once that node has explicitly allowed port 22. The node-side “SSH over mesh” firewall toggle is not claimed here—it still needs implementation and remains off by default.",
-    "**What's New now starts cleanly at v1.8.0 and is guaranteed to be newest-first.** Older alpha history no longer overwhelms the useful recent changes, the three stray v1.7 entries that appeared above current releases are gone, and the release check now fails if either the ordering or the v1.8.0 history floor drifts again.",
-    "**A release can no longer advertise itself before its files exist.** New releases are prepared behind a pending manifest; the publisher uploads the backend and frontend, downloads both back and verifies their size and hash, and only then promotes the signed manifest to the path nodes read. The manifest generator also includes every curated What's New item instead of silently stopping after the first ten physical changelog lines."
+    "**Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.",
+    "**OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.",
+    "**Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links."
  ],
  "components": [
    {
-      "current_version": "1.8.6-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.6-alpha/archipelago",
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago",
      "name": "archipelago",
-      "new_version": "1.8.6-alpha",
-      "sha256": "6171e1f46b0e2c2754a18e668f16810338a09b71a68dc365d65173ca1e4d400a",
-      "size_bytes": 63930112
+      "new_version": "1.8.11-alpha",
+      "sha256": "ae569054edd6b2491beb101815f6809bc00c95a7dbe86bd084bcb9a7c36e1853",
+      "size_bytes": 64179264
    },
    {
-      "current_version": "1.8.6-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.6-alpha/archipelago-frontend-1.8.6-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.6-alpha.tar.gz",
-      "new_version": "1.8.6-alpha",
-      "sha256": "1a5b54c516f91a4ea4491e08182f0f9521ee7e27935388814007f91695f06e0f",
-      "size_bytes": 97769923
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago-frontend-1.8.11-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.11-alpha.tar.gz",
+      "new_version": "1.8.11-alpha",
+      "sha256": "192fd0470b6ccf66e78c80b4a4c3af5468882b85d81959362a3bd11f88b9d71d",
+      "size_bytes": 97741740
    }
  ],
-  "release_date": "2026-08-31",
-  "signature": "c21dc5cb5a6caa3253c08835b65d0417a312bc8c51acdf92df990ad2110ae762b77287c479a523a8521827ec7b4695114ff9c39924cf1d30d0d622abb53b9208",
+  "release_date": "2026-09-07",
+  "signature": "6449ce6ef35a4ef4fa6d0923bb58a2bff52ea5430d5532496e8f0af9ed52eaec293f19d7bec272dc9bc1af5fb2cdfa0e46068c827a9a4dd9cbef92d1c5845301",
  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.6-alpha"
+  "version": "1.8.11-alpha"
 }
@@ -1,11 +1,11 @@
 {
  "apps": {
    "adguardhome": {
-      "image": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55",
+      "image": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
      "manifest": {
        "app": {
          "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.55",
+            "image": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
            "network": "pasta",
            "pull_policy": "if-not-present"
          },
@@ -17,7 +17,7 @@
          "description": "Network-wide ad and tracker blocking: a DNS server that filters every device on your LAN, with a web console for rules and client management.",
          "environment": [],
          "health_check": {
-            "endpoint": "localhost:3000",
+            "endpoint": "localhost:3030",
            "interval": "30s",
            "retries": 3,
            "timeout": "5s",
@@ -29,7 +29,7 @@
              "description": "AdGuard Home web console",
              "name": "Admin console",
              "path": "/",
-              "port": 3000,
+              "port": 3030,
              "protocol": "http",
              "type": "ui"
            }
@@ -47,7 +47,7 @@
              "auth_rationale": "AdGuard Home enforces its own admin login on the console, and the first-run wizard must answer before any account exists.",
              "bind": "127.0.0.1",
              "container": 3000,
-              "host": 3000,
+              "host": 3030,
              "protocol": "tcp"
            },
            {
@@ -81,7 +81,7 @@
            "kind": "github",
            "repo": "AdguardTeam/AdGuardHome"
          },
-          "version": "v0.107.55",
+          "version": "v0.107.79",
          "volumes": [
            {
              "options": [
@@ -94,7 +94,7 @@
          ]
        }
      },
-      "version": "v0.107.55"
+      "version": "v0.107.79"
    },
    "aiui": {
      "manifest": {
@@ -1297,86 +1297,6 @@
      },
      "version": "23.08.2"
    },
-    "cryptpad": {
-      "image": "source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0",
-      "manifest": {
-        "app": {
-          "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/cryptpad:2024.12.0",
-            "network": "pasta",
-            "pull_policy": "if-not-present"
-          },
-          "dependencies": [
-            {
-              "storage": "5Gi"
-            }
-          ],
-          "description": "End-to-end encrypted documents, spreadsheets, and presentations. Zero-knowledge collaboration.",
-          "environment": [],
-          "health_check": {
-            "endpoint": "localhost:3000",
-            "interval": "30s",
-            "retries": 3,
-            "timeout": "5s",
-            "type": "tcp"
-          },
-          "id": "cryptpad",
-          "interfaces": {
-            "main": {
-              "description": "Encrypted collaboration suite",
-              "name": "CryptPad",
-              "path": "/",
-              "port": 3000,
-              "protocol": "http",
-              "type": "ui"
-            }
-          },
-          "metadata": {
-            "author": "XWiki SAS",
-            "category": "data",
-            "icon": "/assets/icon/favico-black-v2.svg",
-            "repo": "https://github.com/cryptpad/cryptpad",
-            "tier": "optional"
-          },
-          "name": "CryptPad",
-          "ports": [
-            {
-              "auth": "gated",
-              "bind": "127.0.0.1",
-              "container": 3000,
-              "host": 3000,
-              "protocol": "tcp"
-            }
-          ],
-          "resources": {
-            "disk_limit": "5Gi",
-            "memory_limit": "1Gi"
-          },
-          "security": {
-            "capabilities": [],
-            "network_policy": "isolated",
-            "no_new_privileges": true,
-            "readonly_root": false
-          },
-          "upstream": {
-            "kind": "github",
-            "repo": "cryptpad/cryptpad"
-          },
-          "version": "2024.12.0",
-          "volumes": [
-            {
-              "options": [
-                "rw"
-              ],
-              "source": "/var/lib/archipelago/cryptpad",
-              "target": "/cryptpad/data",
-              "type": "bind"
-            }
-          ]
-        }
-      },
-      "version": "2024.12.0"
-    },
    "cuprate": {
      "manifest": {
        "app": {
@@ -1399,7 +1319,7 @@
          "description": "Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.",
          "files": [
            {
-              "content": "network = \"Mainnet\"\ntarget_max_memory = 3000000000\n\n[rpc.restricted]\nenable = true\n",
+              "content": "network = \"Mainnet\"\nfast_sync = true\ntarget_max_memory = 8589934592\n\n[rpc.restricted]\nenable = true\n\n[tracing.stdout]\nlevel = \"info\"\n\n[tracing.file]\nlevel = \"info\"\nmax_log_files = 14\n",
              "overwrite": false,
              "path": "/var/lib/archipelago/cuprate/Cuprated.toml"
            }
@@ -1430,8 +1350,8 @@
              "protocol": "tcp"
            },
            {
-              "auth": "none",
-              "auth_rationale": "Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.",
+              "auth": "open",
+              "auth_rationale": "Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.",
              "container": 18089,
              "host": 18090,
              "protocol": "tcp"
@@ -1440,7 +1360,7 @@
          "resources": {
            "cpu_limit": 0,
            "disk_limit": "300Gi",
-            "memory_limit": "4Gi"
+            "memory_limit": "10Gi"
          },
          "security": {
            "capabilities": [],
@@ -1467,79 +1387,6 @@
      },
      "version": "0.1.0-preview"
    },
-    "did-wallet": {
-      "manifest": {
-        "app": {
-          "container": {
-            "image": "archipelago/did-wallet:1.0.0",
-            "image_signature": "cosign://...",
-            "pull_policy": "if-not-present"
-          },
-          "dependencies": [
-            {
-              "storage": "2Gi"
-            }
-          ],
-          "description": "Web5 wallet with Decentralized Identifier (DID) support. Manage your digital identity and Web5 assets.",
-          "environment": [
-            "WALLET_STORAGE=/app/wallet"
-          ],
-          "health_check": {
-            "endpoint": "http://127.0.0.1:8080",
-            "interval": "30s",
-            "path": "/health",
-            "retries": 3,
-            "timeout": "5s",
-            "type": "http"
-          },
-          "id": "did-wallet",
-          "name": "Web5 DID Wallet",
-          "ports": [
-            {
-              "auth": "gated",
-              "bind": "127.0.0.1",
-              "container": 8080,
-              "host": 8088,
-              "protocol": "tcp"
-            }
-          ],
-          "resources": {
-            "cpu_limit": 1,
-            "disk_limit": "2Gi",
-            "memory_limit": "512Mi"
-          },
-          "security": {
-            "apparmor_profile": "did-wallet",
-            "capabilities": [],
-            "network_policy": "isolated",
-            "no_new_privileges": true,
-            "readonly_root": true,
-            "seccomp_profile": "default",
-            "user": 1000
-          },
-          "upstream": {
-            "kind": "internal"
-          },
-          "version": "1.0.0",
-          "volumes": [
-            {
-              "options": [
-                "rw"
-              ],
-              "source": "/var/lib/archipelago/did-wallet",
-              "target": "/app/wallet",
-              "type": "bind"
-            }
-          ],
-          "web5_integration": {
-            "bitcoin_integration": true,
-            "did_support": true,
-            "wallet_functionality": true
-          }
-        }
-      },
-      "version": "1.0.0"
-    },
    "electrs-ui": {
      "image": "source.archipelago-foundation.org/lfg2025/electrs-ui:1.7.123-alpha",
      "manifest": {
@@ -2033,7 +1880,7 @@
      "version": "v0.10.1"
    },
    "filebrowser": {
-      "image": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
+      "image": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23",
      "manifest": {
        "app": {
          "bitcoin_integration": {
@@ -2046,7 +1893,7 @@
              "/data/.filebrowser.json"
            ],
            "data_uid": "100000:100000",
-            "image": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
+            "image": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.63.23",
            "network": "archy-net",
            "pull_policy": "if-not-present"
          },
@@ -2096,7 +1943,7 @@
            "kind": "github",
            "repo": "filebrowser/filebrowser"
          },
-          "version": "2.27.0",
+          "version": "2.63.23",
          "volumes": [
            {
              "options": [
@@ -2117,7 +1964,7 @@
          ]
        }
      },
-      "version": "v2.27.0"
+      "version": "v2.63.23"
    },
    "fips-ui": {
      "manifest": {
@@ -2172,7 +2019,7 @@
        "app": {
          "category": "development",
          "container": {
-            "image": "docker.io/gitea/gitea:1.23",
+            "image": "source.archipelago-foundation.org/lfg2025/gitea:1.27.3",
            "pull_policy": "if-not-present"
          },
          "dependencies": [
@@ -2271,7 +2118,7 @@
            "kind": "github",
            "repo": "go-gitea/gitea"
          },
-          "version": "1.23",
+          "version": "1.27.3",
          "volumes": [
            {
              "options": [
@@ -2292,7 +2139,7 @@
          ]
        }
      },
-      "version": "1.23"
+      "version": "1.27.3"
    },
    "grafana": {
      "image": "source.archipelago-foundation.org/lfg2025/grafana:10.2.0",
@@ -2374,11 +2221,11 @@
      "version": "10.2.0"
    },
    "homeassistant": {
-      "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
+      "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3",
      "manifest": {
        "app": {
          "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
+            "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.3",
            "network": "pasta",
            "pull_policy": "if-not-present"
          },
@@ -2455,7 +2302,7 @@
            "kind": "github",
            "repo": "home-assistant/core"
          },
-          "version": "2026.7.3",
+          "version": "2026.8.3",
          "volumes": [
            {
              "options": [
@@ -2468,7 +2315,7 @@
          ]
        }
      },
-      "version": "2026.8.2"
+      "version": "2026.8.3"
    },
    "immich": {
      "image": "source.archipelago-foundation.org/lfg2025/immich-server:release",
@@ -3360,108 +3207,8 @@
      },
      "version": "10.11.11"
    },
-    "lightning-stack": {
-      "manifest": {
-        "app": {
-          "bitcoin_integration": {
-            "rpc_access": "admin",
-            "sync_required": true
-          },
-          "container": {
-            "image": "lightninglabs/lightning-stack:v0.12.0",
-            "image_signature": "cosign://...",
-            "pull_policy": "if-not-present"
-          },
-          "dependencies": [
-            {
-              "app_id": "bitcoin-core",
-              "version": ">=24.0"
-            },
-            {
-              "storage": "50Gi"
-            }
-          ],
-          "description": "Complete Lightning Network implementation. Includes LND, CLN, and management tools.",
-          "environment": [
-            "BITCOIND_HOST=bitcoin-core",
-            "BITCOIND_RPCUSER=${BITCOIN_RPC_USER}",
-            "BITCOIND_RPCPASS=${BITCOIN_RPC_PASSWORD}",
-            "NETWORK=mainnet"
-          ],
-          "health_check": {
-            "endpoint": "http://127.0.0.1:8080",
-            "interval": "30s",
-            "path": "/v1/getinfo",
-            "retries": 3,
-            "timeout": "5s",
-            "type": "http"
-          },
-          "id": "lightning-stack",
-          "lightning_integration": {
-            "channel_management": true,
-            "payment_routing": true
-          },
-          "name": "Lightning Stack",
-          "ports": [
-            {
-              "auth": "none",
-              "auth_rationale": "Lightning p2p. The BOLT-8 noise handshake authenticates and encrypts the channel itself.",
-              "container": 9735,
-              "host": 9738,
-              "protocol": "tcp"
-            },
-            {
-              "auth": "none",
-              "auth_rationale": "LND gRPC, authenticated by macaroon over TLS. Remote wallets depend on reaching this directly.",
-              "container": 10009,
-              "host": 10010,
-              "protocol": "tcp"
-            },
-            {
-              "auth": "none",
-              "auth_rationale": "LND REST, authenticated by macaroon over TLS. A browser login page would break Zeus and every non-browser wallet client, exactly as for lnd's 18080.",
-              "container": 8080,
-              "host": 8091,
-              "protocol": "tcp"
-            }
-          ],
-          "resources": {
-            "cpu_limit": 4,
-            "disk_limit": "50Gi",
-            "memory_limit": "4Gi"
-          },
-          "security": {
-            "apparmor_profile": "lightning-stack",
-            "capabilities": [
-              "NET_BIND_SERVICE"
-            ],
-            "network_policy": "isolated",
-            "no_new_privileges": true,
-            "readonly_root": true,
-            "seccomp_profile": "default",
-            "user": 1000
-          },
-          "upstream": {
-            "kind": "manual",
-            "url": "no public listing for lightninglabs/lightning-stack — verify by hand"
-          },
-          "version": "0.12.0",
-          "volumes": [
-            {
-              "options": [
-                "rw"
-              ],
-              "source": "/var/lib/archipelago/lightning-stack",
-              "target": "/root/.lightning",
-              "type": "bind"
-            }
-          ]
-        }
-      },
-      "version": "0.12.0"
-    },
    "lnd": {
-      "image": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
+      "image": "source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta",
      "manifest": {
        "app": {
          "bitcoin_integration": {
@@ -3476,7 +3223,7 @@
                "template": "{{BITCOIN_HOST}}"
              }
            ],
-            "image": "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta",
+            "image": "source.archipelago-foundation.org/lfg2025/lnd:v0.21.2-beta",
            "network": "archy-net",
            "pull_policy": "if-not-present",
            "secret_env": [
@@ -3554,7 +3301,7 @@
            "kind": "github",
            "repo": "lightningnetwork/lnd"
          },
-          "version": "0.18.4",
+          "version": "0.21.2",
          "volumes": [
            {
              "options": [
@@ -3567,7 +3314,7 @@
          ]
        }
      },
-      "version": "v0.18.4-beta"
+      "version": "v0.21.2-beta"
    },
    "lnd-ui": {
      "image": "source.archipelago-foundation.org/lfg2025/lnd-ui:1.7.123-alpha",
@@ -3815,75 +3562,6 @@
      },
      "version": "3.0.0"
    },
-    "morphos-server": {
-      "manifest": {
-        "app": {
-          "container": {
-            "image": "archipelago/morphos-server:1.0.0",
-            "image_signature": "cosign://...",
-            "pull_policy": "if-not-present"
-          },
-          "dependencies": [
-            {
-              "storage": "5Gi"
-            }
-          ],
-          "description": "MorphOS server platform. Decentralized application server.",
-          "environment": [
-            "MORPHOS_ENV=production",
-            "MORPHOS_DATA_DIR=/app/data"
-          ],
-          "health_check": {
-            "endpoint": "http://127.0.0.1:8080",
-            "interval": "30s",
-            "path": "/health",
-            "retries": 3,
-            "timeout": "5s",
-            "type": "http"
-          },
-          "id": "morphos-server",
-          "name": "MorphOS Server",
-          "ports": [
-            {
-              "auth": "gated",
-              "bind": "127.0.0.1",
-              "container": 8080,
-              "host": 8089,
-              "protocol": "tcp"
-            }
-          ],
-          "resources": {
-            "cpu_limit": 2,
-            "disk_limit": "5Gi",
-            "memory_limit": "2Gi"
-          },
-          "security": {
-            "apparmor_profile": "morphos-server",
-            "capabilities": [],
-            "network_policy": "isolated",
-            "no_new_privileges": true,
-            "readonly_root": true,
-            "seccomp_profile": "default",
-            "user": 1000
-          },
-          "upstream": {
-            "kind": "internal"
-          },
-          "version": "1.0.0",
-          "volumes": [
-            {
-              "options": [
-                "rw"
-              ],
-              "source": "/var/lib/archipelago/morphos-server",
-              "target": "/app/data",
-              "type": "bind"
-            }
-          ]
-        }
-      },
-      "version": "1.0.0"
-    },
    "netbird": {
      "manifest": {
        "app": {
@@ -4368,7 +4046,8 @@
              "CHOWN",
              "SETUID",
              "SETGID",
-              "DAC_OVERRIDE"
+              "DAC_OVERRIDE",
+              "NET_BIND_SERVICE"
            ],
            "network_policy": "isolated",
            "no_new_privileges": true,
@@ -4387,6 +4066,14 @@
              "source": "/var/lib/archipelago/nginx-proxy-manager",
              "target": "/data",
              "type": "bind"
+            },
+            {
+              "options": [
+                "rw"
+              ],
+              "source": "/var/lib/archipelago/nginx-proxy-manager/letsencrypt",
+              "target": "/etc/letsencrypt",
+              "type": "bind"
            }
          ]
        }
@@ -4514,8 +4201,7 @@
            }
          ],
          "resources": {
-            "disk_limit": "50Gi",
-            "memory_limit": 0
+            "disk_limit": "50Gi"
          },
          "security": {
            "capabilities": [],
@@ -5048,7 +4734,7 @@
              "--beam-size",
              "1"
            ],
-            "image": "docker.io/rhasspy/wyoming-whisper:3.4.1",
+            "image": "docker.io/rhasspy/wyoming-whisper:3.6.0",
            "network": "archy-net",
            "network_aliases": [
              "pine-whisper"
@@ -5108,7 +4794,7 @@
            "kind": "dockerhub",
            "repo": "rhasspy/wyoming-whisper"
          },
-          "version": "3.4.2",
+          "version": "3.6.0",
          "volumes": [
            {
              "options": [
@@ -5121,16 +4807,16 @@
          ]
        }
      },
-      "version": "3.4.2"
+      "version": "3.6.0"
    },
    "portainer": {
-      "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
+      "image": "source.archipelago-foundation.org/lfg2025/portainer:2.45.0",
      "manifest": {
        "app": {
          "category": "development",
          "container": {
            "data_uid": "1000:1000",
-            "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
+            "image": "source.archipelago-foundation.org/lfg2025/portainer:2.45.0",
            "pull_policy": "if-not-present"
          },
          "dependencies": [
@@ -5192,7 +4878,7 @@
            "kind": "github",
            "repo": "portainer/portainer"
          },
-          "version": "2.19.4",
+          "version": "2.45.0",
          "volumes": [
            {
              "options": [
@@ -5221,7 +4907,7 @@
          ]
        }
      },
-      "version": "2.39.6"
+      "version": "2.45.0"
    },
    "router": {
      "manifest": {
@@ -5655,11 +5341,11 @@
      "version": "1"
    },
    "vaultwarden": {
-      "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
+      "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine",
      "manifest": {
        "app": {
          "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
+            "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.2-alpine",
            "network": "pasta",
            "pull_policy": "if-not-present"
          },
@@ -5726,7 +5412,7 @@
            "kind": "github",
            "repo": "dani-garcia/vaultwarden"
          },
-          "version": "1.30.0",
+          "version": "1.37.2",
          "volumes": [
            {
              "options": [
@@ -5739,11 +5425,11 @@
          ]
        }
      },
-      "version": "1.37.1-alpine"
+      "version": "1.37.2-alpine"
    }
  },
  "schema": 1,
-  "signature": "3b30d9e1afd59d2de4e9e48e5556c8c4ff54d13ae1f25ac2b5897aead6aa8ae3a503dfe56232329e8b02226ea98d3415ff220b4fcdf40913cfe9300aa99fc807",
+  "signature": "3e87496a7197177ea295eba416cd1ed9a2c41ddca3328a160b1db2c65d39ce813c2b1e63df1313680a8e48e0113e2bbe6118df01df4a777bd33b189e7ef69206",
  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "updated": "2026-08-31"
+  "updated": "2026-09-03"
 }
--- a/Show More
+++ b/Show More