fips/ssh_mesh.rs owns the 90-ssh.nft drop-in lifecycle: off by default, any-peer scope behind the UI's danger confirmation or an explicit mesh address list, reconciled on every daemon config install. The scanner now takes installed apps' icons from their real manifest metadata (Cuprate's Services tile) and classifies manifest-declared UI apps as launchable even when the address probe misses (Alby Hub).