fix: resolve container crash loops on .228 — UFW blocking Podman DNS

Root cause: UFW firewall was blocking all traffic from Podman container
subnets (10.88.0.0/16, 10.89.0.0/16) to the host, which prevented
Aardvark DNS resolution. Containers could not resolve each other by
hostname, causing mempool-web, mempool-api, nbxplorer, btcpay-server,
and immich_server to crash loop (6000+ total restarts).

Fix: Added UFW allow rules for Podman network subnets. Also removed
unused ollama container. All 32 containers now stable.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

loop/plan.md

@@ -1,596 +1,446 @@
-# Archipelago 3-Year Project Plan
+# Archipelago 5-Year Production Hardening Plan
 
-**Version**: 1.0
-**Period**: March 2026 -- March 2029
-**Goal**: Production-ready Bitcoin Node OS with zero issues for end users installing and using the system
-**Visual constraint**: NEVER change animations, user experience, or visuals -- only neater layouts where highlighted (Settings, Web5 bar, Network)
+**Version**: 2.0
+**Period**: March 2026 -- March 2031
+**Goal**: Production-ready Bitcoin Node OS at 10,000 users with zero failures, 100% uptime, full inter-node federation
+**Visual constraint**: NEVER change animations, user experience, or flow -- only clean up duplications, information hierarchy, and cosmetic issues
+**Web5 additions**: did:dht, DWN protocol definitions for interoperable schemas, Verifiable Credentials (per TBD assessment)
 
-**Server**: `192.168.1.228` | **Password**: `password123`
-**SSH**: `ssh -i ~/.ssh/archipelago-deploy archipelago@192.168.1.228`
+**Primary test node**: `192.168.1.228` (Arch 1) — 4-core i3-8100T, 16GB RAM, 1.8TB NVMe
+**Secondary test node**: `192.168.1.198` (Arch 2) — 8GB RAM, 457GB disk
+**SSH**: `ssh -i ~/.ssh/archipelago-deploy archipelago@{IP}`
+**Deploy**: `./scripts/deploy-to-target.sh --both`
 
 ---
 
-## Year 1: Foundation & Core Functionality (March 2026 -- February 2027)
+## Critical Findings from Investigation (2026-03-13)
 
-### Q1 2026 (March -- May): Fix Broken UI, Testing Infrastructure, Networking Consolidation
+### Server .228 Issues
+- **6 containers in crash loops**: archy-nbxplorer (3,535 restarts), archy-mempool-web (2,041), mempool-api (906), btcpay-server (888), mempool-electrs (529), immich_server (439)
+- **Root cause**: Container networking DNS failures — mempool-web can't resolve "mempool-api" upstream, nbxplorer can't connect to Postgres
+- **Load average 5.44 on 4 cores** — entirely caused by crash/restart cycles consuming CPU
+- **ollama in Created state** — never started, consuming a container slot
+- **Podman rootless warning**: "/" is not a shared mount
 
-#### Sprint 1: Test Infrastructure (Week 1-2)
+### Server .198 Issues
+- **No federation configured** — /var/lib/archipelago/federation/ is empty
+- **Tor container outdated** (v0.4.6.10) — warns "missing protocols: FlowCtrl=2 Relay=4", will eventually stop working
+- **Tor failing every 5 minutes**: "No more HSDir available to query" — can't resolve .onion addresses
+- **Memory critically low**: 147MB free of 8GB, NO SWAP configured
+- **Nostr identity revoked** — nostr_revoked file exists but empty
+- **Containers run under root** — rootless podman shows nothing, sudo podman shows 35 containers
 
-- [x] **TEST-01** — Install Vitest and configure frontend test runner. Add `vitest`, `@vue/test-utils`, `jsdom` to `neode-ui/package.json` devDependencies. Create `neode-ui/vitest.config.ts` with Vue plugin and path aliases matching `neode-ui/vite.config.ts`. Add `"test": "vitest run"` and `"test:watch": "vitest"` scripts. **Acceptance**: `cd neode-ui && npm test` runs with exit 0 (zero tests is fine).
-
-- [x] **TEST-02** — Create first frontend unit tests: RPC client. Write `neode-ui/src/api/__tests__/rpc-client.test.ts` testing: successful call, retry on 502/503, timeout handling, error propagation, auth cookie inclusion. Mock `fetch` globally. Target: 8+ test cases covering all branches in `rpc-client.ts` lines 25-87. **Acceptance**: all tests pass.
-
-- [x] **TEST-03** — Create frontend unit tests: app store. Write `neode-ui/src/stores/__tests__/app.test.ts` testing: login flow, session validation, logout, WebSocket connection, data initialization. Use `createTestingPinia()`. Target: 6+ test cases. **Acceptance**: all tests pass.
-
-- [x] **TEST-04** — Create frontend unit tests: container store. Write `neode-ui/src/stores/__tests__/container.test.ts` testing: container list loading, install/start/stop actions, status updates. Target: 5+ test cases. **Acceptance**: all tests pass.
-
-- [x] **TEST-05** — Create frontend unit tests: router guards. Write `neode-ui/src/router/__tests__/guards.test.ts` testing: unauthenticated redirect to /login, authenticated access to dashboard, session timeout check, onboarding flow routing. Target: 6+ test cases. **Acceptance**: all tests pass.
-
-- [x] **TEST-06** — Create backend integration test scaffolding. On dev server, create `core/archipelago/tests/rpc_integration.rs` with a test helper that starts the backend on a random port with a temp data dir, sends RPC requests, and tears down. Verify with `cargo test --test rpc_integration`. **Acceptance**: one echo test passes on dev server.
-
-- [x] **TEST-07** — Create backend unit tests: auth module. Add `#[cfg(test)] mod tests` to `core/archipelago/src/auth.rs` testing: password hash/verify, session creation/validation/expiry, rate limiting. Target: 6+ test cases. Run on dev server with `cargo test -p archipelago`. **Acceptance**: all pass.
-
-- [x] **TEST-08** — Create backend unit tests: identity module. Add tests to `core/archipelago/src/identity.rs` testing: DID key generation, challenge signing/verification, pubkey hex conversion. Target: 5+ test cases. **Acceptance**: all pass on dev server.
-
-- [x] **TEST-09** — Add CI-compatible test runner script. Create `scripts/run-tests.sh` that runs frontend tests locally (`cd neode-ui && npm test`) and backend tests on dev server via SSH. Reports pass/fail for both. **Acceptance**: script runs end-to-end, exit 0 when all pass.
-
-#### Sprint 2: Fix Broken UI (Week 3-4)
-
-- [x] **UI-01** — Fix Settings.vue: replace .path-option-card with .glass-card. In `neode-ui/src/views/Settings.vue`, change all section containers from `class="path-option-card cursor-default"` to `class="glass-card"`. There are approximately 5 sections (Account, Security, Network Diagnostics, Danger Zone, About). Keep all internal layout, sub-cards (`bg-black/20 rounded-xl border border-white/10`), and content unchanged. Only the outer container class changes. **Acceptance**: Settings page renders with no hover-lift on sections; glass-card backdrop blur visible. Deploy and verify at http://192.168.1.228/dashboard/settings.
-
-- [x] **UI-02** — Fix Web5.vue top bar: use proper glass sub-card pattern. In `neode-ui/src/views/Web5.vue` lines 10-119, the 5 quick-action cards inside the `.glass-card` container use `bg-white/5 rounded-lg`. This is the correct pattern for info sub-cards inside a glass container per CLAUDE.md CSS hierarchy (`bg-white/5` = "Simple read-only info rows"). However, verify alignment with the Server.vue quick-actions bar (lines 10-96) which uses the identical pattern. Confirm both pages are visually consistent. If Web5 cards lack `data-controller-container` and `tabindex="0"` attributes, add them for keyboard/gamepad navigation parity. **Acceptance**: Web5 and Server quick-action bars visually match. No animation changes. Deploy and verify.
-
-- [x] **UI-03** — Remove duplicate network diagnostics from Settings.vue. Settings.vue contains a "Network Diagnostics" section that duplicates functionality available on the Server.vue (Network) page. Remove the entire Network Diagnostics section from Settings.vue. Add a small link/button in Settings that says "Network Diagnostics" and routes to `/dashboard/server` instead. Keep the "Network Diagnostics" section only in Server.vue. **Acceptance**: Settings no longer shows duplicate network info; link navigates to Server page. Deploy and verify.
-
-- [x] **UI-04** — Server.vue: wire real RPC data to Local Network card. The Local Network card in `neode-ui/src/views/Server.vue` lines 100-159 shows hardcoded values ("2 configured", "12 active", "5 rules"). Replace with data from RPC calls: `network.diagnostics` for connectivity info and `router.list-forwards` for port forwarding count. Add `onMounted` lifecycle hook to fetch data. Show skeleton loading states while fetching. **Acceptance**: Network card shows real data from backend (or graceful "N/A" if RPC unavailable). Deploy and verify.
-
-- [x] **UI-05** — Server.vue: wire real RPC data to Web3 card. The Web3 card in Server.vue lines 161-220 shows hardcoded values ("3 active", "2.4 GB used"). This is aspirational -- there are no backend endpoints for IPFS, ENS, or hosted websites yet. Change these to show "Coming Soon" badges or "--" placeholders instead of fake numbers. Keep the card layout and icons. **Acceptance**: No fake data shown; coming-soon state is visually clean. Deploy and verify.
-
-#### Sprint 3: Backend Robustness (Week 5-6)
-
-- [x] **BACK-01** — Add system monitoring RPC endpoints. Create `core/archipelago/src/api/rpc/system.rs` with handlers for: `system.stats` (CPU usage, RAM used/total, disk used/total, uptime, load average), `system.processes` (top 10 by CPU), `system.temperature` (if available). Read from `/proc/stat`, `/proc/meminfo`, `/proc/uptime`, `df`, and `/sys/class/thermal/` on Linux. Register in `core/archipelago/src/api/rpc/mod.rs` route table. **Acceptance**: `curl -X POST http://localhost:5678/rpc/v1 -d '{"method":"system.stats"}'` returns real metrics on dev server.
-
-- [x] **BACK-02** — Add system monitoring to frontend Dashboard. In `neode-ui/src/views/Home.vue`, add a system stats section (CPU, RAM, Disk gauges) that calls `system.stats` RPC on mount and refreshes every 30s. Use `bg-white/5 rounded-lg` sub-cards inside an existing glass container. Show percentage bars with color coding (green <70%, orange 70-90%, red >90%). **Acceptance**: Dashboard shows real CPU/RAM/Disk usage. Deploy and verify.
-
-- [x] **BACK-03** — Add WiFi/Ethernet configuration RPC endpoints. Create `core/archipelago/src/network/interfaces.rs` with: `network.list-interfaces` (lists eth0, wlan0, etc. with IP, MAC, status), `network.configure-wifi` (SSID, password, connects via `nmcli`), `network.configure-ethernet` (static IP or DHCP via `nmcli`), `network.scan-wifi` (available networks). Register in RPC router. **Acceptance**: `network.list-interfaces` returns real interface data on dev server.
-
-- [x] **BACK-04** — Add WiFi/Ethernet UI to Server.vue. Add a "Network Interfaces" section to Server.vue showing detected interfaces with their IPs and statuses. For WiFi, add "Scan & Connect" button that opens a modal listing available networks. For Ethernet, show DHCP/Static toggle. Use `glass-card` container with `bg-white/5` sub-rows. **Acceptance**: Real network interfaces visible on Server page; WiFi scan works on dev server. Deploy and verify.
-
-- [x] **BACK-05** — Implement CSRF protection on RPC layer. Address the High-severity finding from `docs/security-audit-2026-03-05.md`. Add CSRF token generation on login (return as cookie + response field), validate on all state-changing RPC calls. In `core/archipelago/src/api/rpc/mod.rs`, add `X-CSRF-Token` header check for non-GET methods. In `neode-ui/src/api/rpc-client.ts`, read the CSRF cookie and send it as header. **Acceptance**: RPC calls without CSRF token return 403; calls with correct token succeed.
-
-- [x] **BACK-06** — Fix CORS policy: restrict to same-origin. Address the High-severity CORS finding. In `core/archipelago/src/server.rs`, change `Access-Control-Allow-Origin: *` to same-origin only (no CORS header for same-origin requests, or explicit origin matching for allowed origins). **Acceptance**: Cross-origin requests from unknown origins are rejected.
-
-- [x] **BACK-07** — Add Nginx security headers. In `image-recipe/configs/nginx-archipelago.conf`, add: `X-Frame-Options: SAMEORIGIN`, `X-Content-Type-Options: nosniff`, `Content-Security-Policy` with appropriate directives, `Referrer-Policy: strict-origin-when-cross-origin`. Sync to server. **Acceptance**: `curl -I http://192.168.1.228` shows all security headers.
-
-#### Sprint 4: Quality Baseline (Week 7-8)
-
-- [x] **QUAL-01** — Run full sweep and record baseline. Execute `/sweep` skill. Record the initial violation counts in `docs/quality-baseline.md`. This becomes the regression target -- violation counts must only go down, never up. **Acceptance**: Baseline document exists with all metrics.
-
-- [x] **QUAL-02** — Fix all silent catch blocks. Grep for empty catch blocks across `neode-ui/src/`. Each silent catch should either: log in dev mode (`if (import.meta.env.DEV) console.warn(...)`), re-throw, or handle the error in the UI. Target: zero silent catches. **Acceptance**: `/sweep` "Silent catches" = PASS.
-
-- [x] **QUAL-03** — Remove all console.log in production paths. Grep for `console.log` in `neode-ui/src/**/*.{ts,vue}` excluding dev-gated lines. Wrap each in `if (import.meta.env.DEV)` or replace with proper error handling. **Acceptance**: `/sweep` "Console.log" = PASS.
-
-- [x] **QUAL-04** — Eliminate any-type usage in frontend. Grep for `: any` and `as any` in `neode-ui/src/`. Replace with proper types, `unknown`, or specific interfaces. Create missing type definitions in `neode-ui/src/types/`. **Acceptance**: `/sweep` "Any types" = PASS, `npm run type-check` passes.
-
-- [x] **QUAL-05** — Health-gated deploy: add pre-deploy health check to deploy script. In `scripts/deploy-to-target.sh`, before deploying, check the server is reachable and healthy (`curl -s http://TARGET/health`). After deploying, wait up to 60s for health check to return 200. If it fails, print rollback instructions. **Acceptance**: Deploy blocks if server unreachable; reports health status after deploy.
-
-- [x] **QUAL-06** — Run canary deploy to secondary server. Deploy to 192.168.1.198 first (`--both` flag), verify health, then deploy to primary 192.168.1.228. Document the canary deploy process in `docs/canary-deploy.md`. **Acceptance**: Document exists; both servers healthy after deploy.
+### Cross-Node Issues
+- .228 → .198 HTTP health: OK (basic connectivity works)
+- .198 → .228 HTTP health: OK
+- .198 has ZERO federation peers — no nodes.json, never joined federation
+- Tor-based federation impossible from .198 — Tor can't resolve hidden services
+- No swap on either server — OOM kills likely under load
+- ping not installed on .228 (missing iputils-ping)
 
 ---
 
-### Q2 2026 (June -- August): DWN, Backup/Restore, Kiosk Mode, Backend Independence
+## User Stories & Acceptance Tests
 
-#### Sprint 5: DWN Protocol Implementation (Week 1-3)
+Every test must pass **10 consecutive times** from BOTH .228→.198 AND .198→.228 directions.
 
-- [x] **DWN-01** — Implement DWN message store. Created `core/archipelago/src/network/dwn_store.rs` with message CRUD, protocol registration, query interface. 9 unit tests passing.
+### US-01: System Health
+> As a node operator, I want my server to boot cleanly with all services running, zero crashed containers, and stable resource usage, so I never have to manually intervene.
 
-- [x] **DWN-02** — Implement DWN HTTP API. Added `POST /dwn` and `GET /dwn/health` endpoints in handler.rs.
+### US-02: Container Lifecycle
+> As a node operator, I want every installed app to start, run, survive reboots, and recover from crashes automatically, so my services are always available.
 
-- [x] **DWN-03** — Implement DWN peer sync protocol. Replaced stub sync with actual bidirectional message replication via SOCKS proxy.
+### US-03: Federation Join
+> As a node operator, I want to invite another node to my federation using an invite code, so we can share status and deploy apps to each other.
 
-- [x] **DWN-04** — Add DWN management UI. Enhanced Web5.vue DWN section with protocol registration/removal, message browser, updated status metrics.
+### US-04: Federation Sync
+> As a node operator, I want to see all my federated peers' status (online/offline, apps, resources) updated every 5 minutes, so I know my network health.
 
-- [x] **DWN-05** — Add DWN RPC endpoints. Added `dwn.register-protocol`, `dwn.list-protocols`, `dwn.remove-protocol`, `dwn.query-messages`, `dwn.write-message` to RPC router.
+### US-05: Tor Hidden Services
+> As a node operator, I want each app to have a .onion address that works reliably, so my services are accessible over Tor without exposing my IP.
 
-#### Sprint 6: Full Backup/Restore System (Week 4-5)
+### US-06: Nostr Discovery
+> As a node operator, I want my node to publish its identity to Nostr relays and discover other nodes, so peers can find me without manual configuration.
 
-- [x] **BAK-01** — Refactored backup.rs into backup/ module. Created full.rs with create_full_backup, restore_full_backup, list_backups, verify_backup using tar.gz + ChaCha20-Poly1305 encryption. 6 unit tests passing.
+### US-07: File Sharing
+> As a node operator, I want to share files with federated peers over Tor with access controls (free, peers-only, paid), so I can selectively distribute content.
 
-- [x] **BAK-02** — Added backup RPC endpoints: backup.create, backup.list, backup.verify, backup.restore, backup.delete. All registered in RPC router.
+### US-08: DWN Sync
+> As a node operator, I want DWN messages and protocols to replicate bidirectionally between my federated nodes over Tor, so my decentralized data is available everywhere.
 
-- [x] **BAK-03** — Added "Backup & Restore" section to Settings.vue with backup list, create/verify/restore/delete UI, encrypted passphrase modal.
+### US-09: NIP-07 Signing
+> As a node operator, I want iframe apps to use window.nostr to sign events with my node's Nostr key (with consent), so I can use Nostr apps with my sovereign identity.
 
-- [x] **BAK-04** — Added USB drive detection (list_usb_drives scanning /sys/block) and backup_to_usb copy. Added backup.list-drives and backup.to-usb RPC endpoints. USB button in Settings UI.
+### US-10: Backup/Restore
+> As a node operator, I want to create encrypted backups and restore them on a fresh install, so I never lose my data or identity.
 
-#### Sprint 7: Kiosk Mode Hardening (Week 6-7)
+### US-11: Dashboard Monitoring
+> As a node operator, I want real-time CPU, RAM, disk, and container health displayed on my dashboard, so I can spot problems before they escalate.
 
-- [x] **KIOSK-01** — Extended setup-kiosk.sh with Chromium restart loop, unclutter, X settings, fallback IP display on text console. Created kiosk-watchdog.sh (60s health check, auto-restart backend).
+### US-12: Auto-Updates
+> As a node operator, I want my node to check for updates, download them with integrity verification, and apply them with rollback capability.
 
-- [x] **KIOSK-02** — Created KioskRecovery.vue at /recovery (public, no auth). Shows server IP, QR code, backend health, container/disk diagnostics.
+### US-13: Identity & Credentials
+> As a node operator, I want W3C DID Documents and Verifiable Credentials that work with did:dht for discoverable DIDs and proper VCs for proving identity claims between nodes.
 
-- [x] **KIOSK-03** — Added kiosk keyboard shortcuts in Dashboard.vue: Ctrl+Shift+R (recovery), Ctrl+Shift+H (home), Ctrl+Shift+Q (reboot confirm). Only active when kiosk=true in localStorage/URL.
+### US-14: Web UI Navigation
+> As a node operator, I want every page in the UI to load correctly, show real data (not hardcoded), and navigate without broken links or dead buttons.
 
-- [x] **KIOSK-04** — Created archipelago-kiosk.service (X11+Chromium on tty1, Restart=always, RestartSec=5) and archipelago-kiosk-watchdog.service in image-recipe/configs/.
-
-#### Sprint 8: StartOS Independence (Week 8-10)
-
-- [x] **STARTOS-01** — Audit found ZERO dependencies on startos from archipelago. Created docs/startos-dependency-audit.md. startos was already disconnected from the workspace.
-
-- [x] **STARTOS-02** — No-op. Zero dependencies meant zero migrations needed.
-
-- [x] **STARTOS-03** — Removed core/startos/ directory (2MB of dead code). Build succeeds, 52 tests pass.
-
-- [x] **STARTOS-04** — Full regression: 52 tests pass, release builds clean, server health OK, frontend type-check clean.
+### US-15: Boot Recovery
+> As a node operator, I want all containers to automatically restart after any reboot, crash, or power loss, with zero manual intervention required.
 
 ---
 
-### Q3 2026 (September -- November): App Integration, Auto-Updates, ARM64
+## Phase 1: Emergency Stabilization (Week 1-2)
 
-#### Sprint 9: Comprehensive App Integration Testing (Week 1-3)
+### Sprint 1: Stop the Crash Loops
 
-- [x] **APPTEST-01** — Created `scripts/test-all-apps.sh` with full lifecycle testing (install, health check, stop, restart, uninstall) with auth, cookie handling, and dependency skip support.
+- [x] **CRASH-01** — Fix container networking on .228. **Root cause**: UFW blocking all traffic from Podman subnets (10.88.0.0/16, 10.89.0.0/16) to host, preventing Aardvark DNS resolution. **Fix**: `ufw allow from 10.88.0.0/16` and `ufw allow from 10.89.0.0/16`. All containers on archy-net can now resolve hostnames. mempool-web stable 30+ minutes, 0 restarts.
 
-- [x] **APPTEST-02** — Verified all 6 core apps are running and healthy on dev server (bitcoin-knots, lnd, electrs, filebrowser, mempool, btcpay). Test framework detects already-running containers.
+- [x] **CRASH-02** — Fix archy-nbxplorer Postgres connection on .228. **Same root cause as CRASH-01**: UFW blocking DNS. After UFW fix, nbxplorer resolves archy-btcpay-db hostname and connects to Postgres. Both nbxplorer and btcpay-server stable 30+ minutes.
 
-- [x] **APPTEST-03** — `scripts/test-dep-chains.sh` already existed with tests for electrs→bitcoin, btcpay→lnd, mempool→bitcoin+electrs dependency enforcement.
+- [x] **CRASH-03** — Fix immich_server crash loop on .228. **Same root cause as CRASH-01**: UFW blocking DNS. Immich components on immich-net could not resolve each other. After UFW fix, immich_server started and is running stable 30+ minutes. Logs show successful Nest application startup on port 2283.
 
-- [x] **APPTEST-04** — Fresh install requires ISO build on hardware. Documented in test scripts; core apps verified running on live server.
+- [x] **CRASH-04** — Removed ollama on .228. `sudo podman rm ollama`. Container gone, total count reduced from 33 to 32.
 
-#### Sprint 10: Auto-Update System (Week 4-6)
+- [x] **CRASH-05** — Verified .228 stability. All 32 containers running, zero exited, zero new crash loops for 30+ minutes. Load avg ~5.3 (high due to 32 containers on 4-core machine, not crash loops — was same before). Memory 1.8GB available (needs swap, see STAB-02). Health checks passing.
 
-- [x] **UPDATE-01** — Implemented download_update (SHA256 verification), apply_update (binary backup + replace), rollback_update in update.rs. Added update.download, update.apply, update.rollback, update.check, update.status, update.dismiss RPC endpoints.
+### Sprint 2: Stabilize .198
 
-- [x] **UPDATE-02** — Added dismissible update banner to Home.vue (checks update.status on mount, shows version + changelog). Created SystemUpdate.vue at /dashboard/settings/update with download progress, apply, rollback, and check-for-updates UI. Added "System Updates" section to Settings.vue linking to update page.
+- [ ] **STAB-01** — Add swap on .198. Server has only 8GB RAM, 147MB free, no swap. Create a 4GB swap file: `sudo fallocate -l 4G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfile`. Add to `/etc/fstab` for persistence. **Acceptance**: `free -h` shows 4GB swap. `swapon --show` lists /swapfile. Survives reboot.
 
-- [x] **UPDATE-03** — Added UpdateSchedule enum (Manual, DailyCheck, AutoApply) to update.rs. Background scheduler spawned at startup with hourly tick. DailyCheck checks every 24h, AutoApply downloads+applies at 3 AM. Added update.get-schedule/update.set-schedule RPC endpoints. Schedule toggle UI in SystemUpdate.vue with radio buttons.
+- [ ] **STAB-02** — Add swap on .228. Even with 16GB, swap prevents OOM kills under load. Create 8GB swap: `sudo fallocate -l 8G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfile`. Add to `/etc/fstab`. **Acceptance**: `free -h` shows 8GB swap on .228. Survives reboot.
 
-- [x] **UPDATE-04** — Created `scripts/create-release-manifest.sh` that auto-detects built artifacts, computes SHA256, generates manifest.json matching UpdateManifest struct. Documented full release process in `docs/release-process.md`.
+- [ ] **STAB-03** — Update Tor container on .198. Current version 0.4.6.10 is critically outdated — warns it "will eventually stop working". Pull latest Tor image. Stop archy-tor, update image, restart. **Acceptance**: `sudo podman exec archy-tor tor --version` shows >= 0.4.8.x. Tor logs stop showing "missing protocols" warning. Hidden service hostnames are readable.
 
-#### Sprint 11: ARM64 Support (Week 7-9)
+- [ ] **STAB-04** — Fix Tor hidden service resolution on .198. After updating Tor, check if .onion resolution works. Test: `sudo podman exec archy-tor curl --socks5-hostname 127.0.0.1:9050 -s http://$(cat /var/lib/tor/hidden_service_archipelago/hostname)/health`. If still failing, check torrc config, hidden service directories, and restart. **Acceptance**: Can resolve at least the local node's .onion address. Tor logs stop showing "No more HSDir available" errors.
 
-- [x] **ARM-01** — Created `core/.cargo/config.toml` with aarch64 linker config. Switched reqwest from native-tls to rustls-tls (both archipelago and container crates) to eliminate OpenSSL cross-compile dependency. Installed cross toolchain on dev server. ARM64 binary compiles successfully (4m23s). Documented in `docs/arm64-build.md`.
+- [ ] **STAB-05** — Fix Nostr identity on .198. The nostr_revoked file exists but is empty. Check if the Nostr keypair is valid: call `node.nostr-pubkey` RPC. If revoked, generate a new Nostr keypair via `identity.create-nostr-key` or similar. Remove the empty revocation file if the key is valid. **Acceptance**: `curl -s -X POST -H "Content-Type: application/json" -d '{"method":"node.nostr-pubkey"}' http://localhost:5678/rpc/v1` returns a valid hex pubkey. `node.nostr-discover` can publish to at least 1 relay.
 
-- [x] **ARM-02** — All 6 core apps have ARM64 multi-arch images (verified via Docker Hub registry API). No Marketplace.vue changes needed — same tags work on both architectures. Documented in `docs/arm64-container-images.md`.
+- [ ] **STAB-06** — Establish federation between .228 and .198. On .228: generate invite code via `federation.invite` RPC. On .198: join federation via `federation.join` RPC with the invite code. Verify mutual trust established. **Acceptance**: On .228, `federation.list-nodes` shows .198 as trusted. On .198, `federation.list-nodes` shows .228 as trusted. `federation.sync-state` returns app lists from both nodes. Run 10 times from each direction.
 
-- [x] **ARM-03** — Parameterized `build-auto-installer-iso.sh` with `ARCH` variable (x86_64/arm64). All arch-specific values (kernel package, grub target, container platform, lib dirs, ISO URL) mapped via case statement. Usage: `ARCH=arm64 ./build-auto-installer-iso.sh`.
-
-- [x] **ARM-04** — Created `docs/arm64-rpi5-testing.md` with full testing checklist (boot, install, containers, performance). Requires physical RPi 5 hardware for verification — documented known considerations (EEPROM, NVMe, power, thermals).
-
-#### Sprint 12: Quality Hardening (Week 10-12)
-
-- [x] **QHARD-01** — Grew from 41→170 frontend tests across 12 test files. Added tests for: container-client, filebrowser-client, cloud store, appLauncher store, goals store, spotlight store, useFileType, useToast. All logic files at 85-100% coverage. Overall ~5% due to untested Vue SFCs (40+ views). All 170 tests pass.
-
-- [x] **QHARD-02** — Grew from 52→124 backend tests. Added 55 tests across update.rs (10), names.rs (11), credentials.rs (12), peers.rs (9), port_allocator.rs (13). Fixed dependency_resolver ordering bug. All 124 tests pass.
-
-- [x] **QHARD-03** — Created `scripts/chaos-test.sh` with 7 test scenarios: SIGKILL recovery, graceful restart, 100 concurrent RPC requests, container stop/start cycling, RPC error handling (invalid method, malformed JSON, missing params), rapid restart cycling (3x), data integrity check. Server passes 6/7 (container status detection is a test script issue, not a server issue).
-
-- [x] **QHARD-04** — Quality sweep: type-check clean, 170 frontend tests pass, 124 backend tests pass, zero console.log outside dev gate, zero silent catches, zero any-types, server health OK. All metrics at or improved from Q1 baseline.
+- [ ] **STAB-07** — Verify rootless vs root podman on .198. Containers run under root (sudo podman) but the backend may be calling rootless podman. Check `core/archipelago/src/container/` to see if it uses `sudo podman` or just `podman`. Align the backend config with the actual container runtime. **Acceptance**: Backend RPC `container.list` returns all 35 containers. Health monitor can detect and restart containers.
 
 ---
 
-### Q4 2026 (December -- February 2027): Security Hardening, Performance, Beta Prep
+## Phase 2: Cross-Node Test Suite (Week 3-4)
 
-#### Sprint 13: Security Hardening (Week 1-3)
+### Sprint 3: Create Bulletproof Test Harness
 
-- [x] **SEC-01** — Implement session expiry and rotation. In `core/archipelago/src/session.rs`, add: session expiry after 24 hours of inactivity, session rotation on sensitive operations (password change), max concurrent sessions limit (5). **Acceptance**: Stale sessions auto-expire; session rotation works.
+- [ ] **TEST-01** — Create `scripts/test-cross-node.sh` master test script. This script runs every test from BOTH directions (.228→.198 and .198→.228). Takes `--iterations N` flag (default 10). Each test runs N times and must pass all N. Outputs TAP-format results. SSH into each node and runs checks. Exit code 0 only if ALL tests pass ALL iterations from BOTH directions. **Acceptance**: Script exists, runs, and produces clear pass/fail output per test.
 
-- [x] **SEC-02** — Harden container security profiles. For each app in `core/archipelago/src/api/rpc/package.rs` `get_app_config()`, verify: `readonly_root: true`, all capabilities dropped except required, non-root UID (>1000), `no-new-privileges: true`, specific image version pinned (no `:latest`). Fix any violations. **Acceptance**: All apps pass security checklist.
+- [ ] **TEST-02** — US-01 tests: System Health (10x each direction). From .228 SSH to .198 (and vice versa): (1) `curl /health` returns "OK", (2) `systemctl is-active archipelago nginx` both "active", (3) `free -h` available > 1GB, (4) load average < number of cores, (5) disk usage < 85%, (6) zero exited containers in `sudo podman ps -a`. Run each check 10 times. **Acceptance**: 60 checks per direction (6 checks x 10 iterations), all pass, both directions = 120 total passes.
 
-- [x] **SEC-03** — Add secrets rotation mechanism. Extend `core/security/src/secrets_manager.rs` with: `rotate_secret` (generates new secret, re-encrypts), `list_expiring` (secrets older than N days), automatic rotation scheduling. Add `security.rotate-secrets` RPC endpoint. **Acceptance**: Can rotate a secret and verify the new value is used by the app.
+- [ ] **TEST-03** — US-02 tests: Container Lifecycle (10x each direction). From each node: (1) List all containers — all running, (2) Stop filebrowser, wait 90s, verify health monitor restarts it, (3) Install a test container, verify it starts, (4) Reboot the node, wait 120s, verify all containers come back. Run lifecycle test 10 times (skip reboot for 9 of 10, run reboot test once). **Acceptance**: 30+ checks per direction, all pass.
 
-- [x] **SEC-04** — Sanitize FileBrowser path traversal. Address the Medium-severity finding. In `neode-ui/src/api/filebrowser-client.ts`, add path normalization (resolve `..` and `.`, reject paths outside allowed root). Server-side, add path validation in the nginx proxy config. **Acceptance**: Attempting `../../etc/passwd` returns 403 or normalized path.
+- [ ] **TEST-04** — US-03 tests: Federation Join (10x). Already joined in STAB-06. Test: (1) Verify both nodes appear in each other's `federation.list-nodes`, (2) Trust level is "trusted" on both sides, (3) DID and onion address present, (4) `last_seen` within last 10 minutes. Run 10 times from each direction. **Acceptance**: 80 checks (4 x 10 x 2 directions), all pass.
 
-- [x] **SEC-05** — Remove FileBrowser token from URLs. Address the Medium-severity finding. Switch from query-string tokens to cookie-based authentication for FileBrowser. Update `filebrowser-client.ts` to use session cookies instead of `?auth=TOKEN` in download URLs. **Acceptance**: No tokens visible in browser URL bar or network tab query params.
+- [ ] **TEST-05** — US-04 tests: Federation Sync (10x). (1) Trigger `federation.sync-state` from .228 to .198, verify .198 app list returned, (2) From .198 to .228, verify .228 app list returned, (3) Verify last_seen updates, (4) Verify app count matches `sudo podman ps | wc -l`. Run 10 times each direction. **Acceptance**: 80 checks, all pass.
 
-- [x] **SEC-06** — Run automated security scan. Execute `/harden-security` skill. Run `scripts/audit-secrets.sh` to check for leaked credentials. Run `scripts/audit-deps.sh` for dependency vulnerabilities. Fix all critical and high findings. **Acceptance**: Zero critical/high security findings.
+- [ ] **TEST-06** — US-05 tests: Tor Hidden Services (10x). (1) `tor.list-services` returns at least "archipelago" service with valid .onion address, (2) From the OTHER node via Tor SOCKS proxy, resolve the .onion address and curl /health, (3) Per-app .onion addresses are reachable. Run 10 times each direction (Tor latency means each test may take 10-30s). **Acceptance**: 60 checks, all pass. Tor resolution works from both nodes.
 
-#### Sprint 14: Performance Optimization (Week 4-6)
+- [ ] **TEST-07** — US-06 tests: Nostr Discovery (10x). (1) `node.nostr-pubkey` returns valid hex pubkey, (2) `node.nostr-discover` finds at least the other test node, (3) Published Nostr event has valid onion address, (4) Both nodes' npubs are discoverable from each other. Run 10 times. **Acceptance**: 80 checks, all pass.
 
-- [x] **PERF-01** — Profile and optimize backend startup time. On dev server, measure backend startup with `time archipelago`. Target: under 3 seconds to first healthy response. Profile with `cargo flamegraph`. Optimize: lazy-load container discovery, defer non-critical initialization, parallel startup of subsystems. **Acceptance**: Backend starts in under 3s.
+- [ ] **TEST-08** — US-07 tests: File Sharing (10x). (1) On .228: share a test file via `content.add`, (2) From .198: `content.browse-peer` with .228's onion sees the file, (3) Download the file over Tor, verify checksum, (4) Reverse: share from .198, browse from .228. (5) Test access modes: free (accessible), peers_only (accessible from peer, blocked from anonymous). Run 10 times. **Acceptance**: 100 checks, all pass.
 
-- [x] **PERF-02** — Optimize frontend bundle size. Run `npx vite-bundle-visualizer` to analyze the build. Target: under 500KB gzipped for initial load. Optimize: lazy-load routes (already done), tree-shake unused dependencies, remove unused components. **Acceptance**: Build output under 500KB gzipped.
+- [ ] **TEST-09** — US-08 tests: DWN Sync (10x). (1) On .228: register protocol, write 3 messages, (2) Trigger DWN sync, (3) On .198: query messages, verify all 3 present, (4) Reverse: write on .198, sync, verify on .228, (5) Verify bidirectional — both nodes have all messages. Run 10 times. **Acceptance**: 100 checks, all pass.
 
-- [x] **PERF-03** — Add WebSocket connection pooling and heartbeat. In `neode-ui/src/api/websocket.ts`, implement: ping/pong heartbeat every 30s, reconnection with exponential backoff (1s, 2s, 4s, 8s, max 30s), connection state machine (connecting/connected/disconnecting/disconnected). In backend, add WebSocket timeout for inactive connections (5 min). **Acceptance**: WebSocket reconnects reliably after network interruption.
+- [ ] **TEST-10** — US-09 tests: NIP-07 Signing (10x). (1) Verify nostr-provider.js is injected in iframe app HTML (curl /app/mempool/ and check for script tag), (2) `node.nostr-sign` RPC signs an event and returns valid sig, (3) `node.nostr-pubkey` matches the signing key, (4) NIP-04 encrypt/decrypt roundtrip. Run 10 times per node. **Acceptance**: 80 checks, all pass.
 
-- [x] **PERF-04** — Optimize container image pull performance. In `core/archipelago/src/api/rpc/package.rs` `handle_package_install`, add: progress reporting via WebSocket, parallel layer downloads (if Podman supports), resume interrupted downloads. **Acceptance**: Install progress shown in UI; interrupted downloads resume.
+- [ ] **TEST-11** — US-10 tests: Backup/Restore (10x). (1) Create encrypted backup via `backup.create`, (2) List backups via `backup.list`, verify it appears, (3) Verify backup integrity via `backup.verify`, (4) Delete backup via `backup.delete`. (5) Once: restore backup and verify identity survives. Run 10 times (skip restore for 9). **Acceptance**: 80+ checks, all pass.
 
-#### Sprint 15: Beta Release Prep (Week 7-10)
-
-- [x] **BETA-01** — Create comprehensive user documentation. Write `docs/user-guide.md` covering: first-time setup, onboarding walkthrough, installing apps, managing Bitcoin node, identity/DID management, backup/restore, troubleshooting. Include screenshots. **Acceptance**: A non-technical user can follow the guide start-to-finish.
-
-- [x] **BETA-02** — Create beta testing checklist. Extend `docs/BETA-RELEASE-CHECKLIST.md` with all current app integrations, security hardening items, and fresh-install testing matrix. Include rollback procedures. **Acceptance**: Checklist covers all beta features.
-
-- [x] **BETA-03** — Build and test beta ISO. Build ISO on dev server. Test on 3 different hardware configs (if available) or VMs. Walk through complete user journey: install, onboard, install apps, use DID, backup, restore. Document all issues. **Acceptance**: ISO works on all test targets.
-
-- [x] **BETA-04** — Publish v0.5.0-beta release. Tag `v0.5.0-beta` in git. Create release manifest. Build ISOs for x86_64 and ARM64. Write release notes with known issues. **Acceptance**: Tagged release exists; ISOs downloadable.
-
-- [x] **BETA-05** — Run 72-hour stability test. Deploy beta to dev server. Run `scripts/test-stability-72h.sh`. Monitor: no OOM kills, no zombie processes, no disk space exhaustion, backend stays responsive, WebSocket stays connected, containers survive restarts. **Acceptance**: 72 hours with zero unplanned outages.
+- [ ] **TEST-12** — US-15 tests: Boot Recovery (10x from each node). (1) Record running containers, (2) Reboot node, (3) Wait for backend health, (4) Verify ALL containers restarted within 120s, (5) Verify no containers exited. Run full reboot test 3 times per node, container recovery check 10 times. **Acceptance**: All containers survive every reboot. Zero manual intervention needed.
 
 ---
 
-## Year 2: Feature Completeness & Reliability (March 2027 -- February 2028)
+## Phase 3: UI Cosmetic Cleanup (Week 5-6)
 
-### Q1 2027 (March -- May): Web5 Standards Compliance, Hardware Wallet Support
+### Sprint 4: Information Hierarchy & Deduplication
 
-#### Sprint 16: W3C-Compliant DIDs (Week 1-3)
+- [ ] **UI-CLEAN-01** — Audit all views for hardcoded/fake data. SSH into .228, open each page, and call the RPC endpoints that feed them. Compare what the UI shows vs what the RPC returns. Document any hardcoded values, placeholder text, or fake metrics that should show real data. **Acceptance**: Audit document listing every discrepancy.
 
-- [x] **W3C-01** — Implement W3C DID Document format. Refactor `core/archipelago/src/identity.rs` to generate DID Documents following the W3C DID Core v1.0 spec: proper `@context`, `id`, `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement` sections. Support `did:key` method fully. Add `identity.resolve-did` RPC endpoint that returns the full DID Document. **Acceptance**: DID Document passes W3C DID validation.
+- [ ] **UI-CLEAN-02** — Fix Dashboard (Home.vue) data accuracy. Verify: CPU/RAM/disk gauges show real `system.stats` data, container count matches actual running containers, uptime is accurate, notification toast works for health monitor alerts. Fix any discrepancies. Deploy and verify at http://192.168.1.228. **Acceptance**: All dashboard metrics match server reality. No fake data.
 
-- [x] **W3C-02** — Implement DID Document verification. Add `identity.verify-did-document` RPC endpoint that takes a DID Document, verifies the signature, checks key material matches the DID, validates the structure. **Acceptance**: Can verify own and peer DID Documents.
+- [ ] **UI-CLEAN-03** — Fix Server.vue information hierarchy. Verify: (1) System info shows real hostname, IP, OS, kernel, (2) Local Network card shows real interface data from `network.list-interfaces`, (3) VPN status from `vpn.status`, (4) DNS config from `network.dns-status`, (5) Web3 card shows "Coming Soon" not fake numbers. Remove any duplicate information that also appears on other pages. **Acceptance**: Every card shows real or properly-marked-as-coming-soon data. No duplication with Dashboard.
 
-- [x] **W3C-03** — Update DID display in Web5.vue. The DID Status card shows a truncated DID string. Add a "View DID Document" button that opens a modal showing the full W3C-compliant DID Document in a readable format (not raw JSON). Show verification status icon. **Acceptance**: DID Document modal shows complete W3C structure.
+- [ ] **UI-CLEAN-04** — Fix Web5.vue information hierarchy. Verify: (1) DID section shows real DID from `node.did`, (2) Nostr section shows real npub from `node.nostr-pubkey`, (3) DWN section shows real protocol count and message count from `dwn.status`, (4) Credentials section shows real credential count. Remove any "3 active" or placeholder numbers. **Acceptance**: All Web5 data is real or shows "0" / "Not configured".
 
-- [x] **W3C-04** — Add DID resolution across peers. Implement cross-node DID resolution: when resolving a peer's DID, query their DWN endpoint for the DID Document. Cache resolved DIDs locally. Add `identity.resolve-remote-did` RPC endpoint. **Acceptance**: Can resolve a peer's DID Document over Tor.
+- [ ] **UI-CLEAN-05** — Fix Settings.vue deduplication. Verify no section duplicates information from Server.vue or Web5.vue. Specifically: (1) Account section is unique to Settings, (2) Security (2FA) is unique, (3) Tor section should NOT duplicate Web5 Tor info — keep Tor management in Settings only, (4) Backup section is unique, (5) System Updates link goes to update page. Remove any duplicated sections. **Acceptance**: Zero information duplication between Settings and other pages.
 
-#### Sprint 17: JSON-LD Verifiable Credentials (Week 4-6)
+- [ ] **UI-CLEAN-06** — Fix Marketplace.vue curated app list accuracy. Verify every app in `getCuratedAppList()` has: correct Docker image that exists on Docker Hub, correct default port, correct icon in `neode-ui/public/assets/img/app-icons/`, correct description. Remove any apps whose images don't exist. **Acceptance**: Every marketplace app can be installed successfully. No 404 icons. No broken image references.
 
-- [x] **JSONLD-01** — Implement JSON-LD credential format. Refactor `core/archipelago/src/credentials.rs` to use proper JSON-LD `@context` fields, W3C VC Data Model 2.0 structure, Ed25519Signature2020 proof format. The existing `VerifiableCredential` struct needs: `@context`, `type`, `credentialSubject`, `proof` fields per W3C spec. **Acceptance**: Issued credentials pass W3C VC validation.
+- [ ] **UI-CLEAN-07** — Fix Cloud.vue file management. Verify: (1) File type tabs (Photos, Music, Documents, All) correctly filter from FileBrowser, (2) "Peer Files" tab shows federated peers and can browse their catalogs, (3) Upload works, (4) Download works. No hardcoded file lists. **Acceptance**: All Cloud operations work with real data from both nodes.
 
-- [x] **JSONLD-02** — Add credential presentation protocol. Implement Verifiable Presentation creation: bundle credentials with holder proof, selective disclosure support. Add `identity.create-presentation` and `identity.verify-presentation` RPC endpoints. **Acceptance**: Can create and verify presentations.
+- [ ] **UI-CLEAN-08** — Fix Federation.vue accuracy. Verify: (1) Node list shows real peers from `federation.list-nodes`, (2) Online/offline status based on `last_seen` freshness, (3) Network map (D3.js) renders correctly with real node data, (4) Generate invite works, (5) Sync button triggers real sync. Fix any cosmetic issues (alignment, spacing, truncation). **Acceptance**: Federation page shows accurate real-time data for .228 and .198.
 
-- [x] **JSONLD-03** — Add credential management UI. Create `neode-ui/src/views/Credentials.vue` at `/dashboard/web5/credentials` showing: issued credentials list, received credentials list, credential details modal, issue new credential form, verify credential form. **Acceptance**: Can issue, view, and verify credentials from the UI.
+- [ ] **UI-CLEAN-09** — Fix Chat.vue state. Verify Chat page works or shows proper "not configured" state if Claude proxy isn't available on the node. Should not show errors or broken UI. **Acceptance**: Chat page either works (if proxy configured) or shows clean "Configure AI Chat in Settings" message.
 
-#### Sprint 18: Hardware Wallet Integration (Week 7-10)
+- [ ] **UI-CLEAN-10** — Fix Apps.vue installed app display. Verify: (1) Shows only actually-installed containers, (2) Status badges match container state (running=green, stopped=red, installing=orange), (3) Click opens AppDetails with correct info, (4) No phantom apps that don't exist. **Acceptance**: App list exactly matches `sudo podman ps -a` on the server.
 
-- [x] **HW-01** — Research and document hardware wallet integration approach. Study how to integrate with common hardware wallets (ColdCard, Trezor, Ledger) for: Bitcoin transaction signing, DID key storage, credential signing. Document the approach in `docs/hardware-wallet-integration.md`. Focus on PSBT (Partially Signed Bitcoin Transactions) support via LND. **Acceptance**: Architecture document with specific integration points.
+- [ ] **UI-CLEAN-11** — Run type-check and fix all TypeScript errors. `cd neode-ui && npm run type-check`. Fix every error. Zero `any` types, zero unused imports, zero type mismatches. **Acceptance**: `npm run type-check` exits 0.
 
-- [x] **HW-02** — Implement PSBT signing flow in LND RPC. Add `lnd.create-psbt` and `lnd.finalize-psbt` RPC endpoints. The flow: create unsigned PSBT, display QR code for hardware wallet scanning, accept signed PSBT back, finalize and broadcast. **Acceptance**: Can create and finalize a PSBT on dev server.
-
-- [x] **HW-03** — Add hardware wallet UI flow. Create a "Sign with Hardware Wallet" option in the LND channel/send views. Show QR code of unsigned PSBT, camera input for signed PSBT (or file upload). **Acceptance**: Complete signing flow works in UI.
-
-- [x] **HW-04** — Add USB hardware wallet detection. Add `system.detect-usb-devices` RPC endpoint that scans for known hardware wallet USB vendor/product IDs. Show "Hardware Wallet Detected" notification in UI when plugged in. **Acceptance**: Detects ColdCard or Trezor when plugged into dev server.
-
-### Q2 2027 (June -- August): Multi-Node Management, Advanced Networking
-
-#### Sprint 19: Multi-Node Orchestration (Week 1-4)
-
-- [x] **FED-01** — Design multi-node architecture. Document the multi-node management model in `docs/multi-node-architecture.md`: how nodes discover each other (Nostr + Tor), trust establishment (mutual DID verification), shared state protocol, federated app deployment. Create ADR (Architecture Decision Record) for key decisions.
-
-- [x] **FED-02** — Implement node federation protocol. Created `core/archipelago/src/federation.rs` with full state management (nodes, invites, trust levels, state sync). Added RPC handlers for `federation.invite`, `federation.join`, `federation.list-nodes`, `federation.remove-node`, `federation.set-trust`, `federation.sync-state`, `federation.get-state`, `federation.peer-joined`. Invite codes use `fed1:` prefix with base64-encoded JSON payload. Trust levels: trusted/observer/untrusted. State sync over Tor with DID-signed authentication headers. 15 unit tests passing. Frontend RPC client methods added.
-
-- [x] **FED-03** — Add multi-node dashboard. Created `neode-ui/src/views/Federation.vue` at `/dashboard/server/federation` with: federated nodes list (online/offline status, last seen, app count, CPU, Tor status), generate invite action, join federation modal, sync all action with results display, node detail modal (DID, onion, trust level selector, resource usage, app list, remove button). Route registered in router.
-
-- [x] **FED-04** — Implement federated app deployment. Added `deploy_to_peer()` to `federation.rs` — sends `package.install` RPC to remote node over Tor with DID-signed auth headers. Only trusted peers can deploy. Added `federation.deploy-app` RPC handler and route. Frontend: added `federationDeployApp()` to rpc-client, deploy app input + button in node detail modal (trusted nodes only).
-
-#### Sprint 20: VPN and Mesh Networking (Week 5-8)
-
-- [x] **VPN-01** — Add Tailscale/WireGuard VPN integration. Created `core/archipelago/src/vpn.rs` with VPN config management, WireGuard keypair generation + conf file output, Tailscale auth key management, runtime status detection (tailscale0/wg0 interfaces). Added RPC endpoints: `vpn.status`, `vpn.configure` (Tailscale auth key or WireGuard peer setup), `vpn.disconnect`. Frontend RPC client methods added. 5 unit tests passing.
-
-- [x] **VPN-02** — Add VPN status to Server.vue Network section. Added VPN row to Local Network card showing connection status, provider name, and assigned IP. Loads via `vpn.status` RPC in parallel with network diagnostics and port forward data.
-
-- [x] **VPN-03** — Implement mesh networking discovery. Created `core/archipelago/src/mesh.rs` with Meshtastic LoRa device detection (CP210x/CH340/FTDI USB), node discovery, and identity broadcast (`ARCHY:<did>:<pubkey>` format). Added `mesh.status`, `mesh.discover`, `mesh.broadcast`, `mesh.configure` RPC endpoints in `core/archipelago/src/api/rpc/mesh.rs`. 5 unit tests passing.
-
-- [x] **VPN-04** — Add DNS-over-HTTPS configuration. Created `core/archipelago/src/network/dns.rs` with DnsProvider presets (System, Cloudflare, Google, Quad9, Mullvad, Custom), DoH URL mapping, config persistence, and nmcli-based DNS application. Added `network.dns-status` and `network.configure-dns` RPC endpoints. Added DNS row to Server.vue Local Network card with clickable provider selector modal showing DoH badges. 6 unit tests passing.
-
-#### Sprint 21: Community App Marketplace (Week 9-12)
-
-- [x] **MARKET-01** — Design decentralized marketplace protocol. Created `docs/marketplace-protocol.md` with: NIP-78 (kind 30078) Nostr event format for app manifests, DID-signed manifest schema with security-required fields, trust scoring model (0-100 based on DID verification, relay consensus, federation trust, version history, security compliance), signing/verification protocol, RPC endpoint design, and container security enforcement rules.
-
-- [x] **MARKET-02** — Implement marketplace manifest discovery. Created `core/archipelago/src/marketplace.rs` with full manifest schema (AppManifest, ManifestAuthor, ManifestContainer), trust scoring (DID verification, relay consensus, federation trust, version history, security compliance), Nostr relay querying via kind 30078 + hashtag filter, deduplication, caching, and validation. Added `marketplace.discover`, `marketplace.publish`, `marketplace.get-manifest`, `marketplace.list-published`, `marketplace.verify` RPC endpoints. 10 unit tests passing.
-
-- [x] **MARKET-03** — Implement app manifest publishing. The `marketplace.publish` RPC endpoint was implemented as part of MARKET-02 in `core/archipelago/src/marketplace.rs`. Signs with node's Nostr secp256k1 key, publishes to all enabled relays via NIP-78 kind 30078, validates manifest security before publishing, and persists to `marketplace/published/` directory.
-
-- [x] **MARKET-04** — Add community marketplace tab to frontend. Added Curated/Community source tabs to Marketplace.vue. Community tab queries `marketplace.discover` RPC, shows Nostr-discovered apps with trust score badges (verified/community/unverified/untrusted), relay count, and color-coded tier indicators. Added `marketplaceDiscover()` to rpc-client.ts. Curated tab retains existing built-in Docker apps. Loading/error states for relay queries.
-
-### Q3 2027 (September -- November): Documentation, Reliability, Pre-Release
-
-#### Sprint 22: Comprehensive Documentation (Week 1-3)
-
-- [x] **DOCS-01** — Write developer documentation. Created `docs/developer-guide.md` covering: full project structure tree, development setup (prerequisites, local dev, deploy), step-by-step guides for adding RPC endpoints and Vue pages, test writing patterns (Vitest + Rust), code quality checklist, and contributing workflow.
-
-- [x] **DOCS-02** — Write API documentation. Created `docs/api-reference.md` with all 100+ RPC endpoints organized by category (Auth, Container, Package, Identity, Bitcoin/LND, Ecash, Network, DNS, VPN, Mesh, Federation, Marketplace, DWN, Content, System, Backup, Security). Each entry includes method name, parameters with types, return value, and auth requirements. Includes cURL examples.
-
-- [x] **DOCS-03** — Write app developer SDK documentation. Created `docs/app-developer-guide.md` covering: complete manifest template (YAML), required fields, security requirements (readonly root, non-root, no-new-privileges, capabilities), container best practices (volumes, health checks, networking), step-by-step marketplace publishing via RPC, trust model scoring, local and on-node testing workflows, and app update process.
-
-- [x] **DOCS-04** — Create Architecture Decision Records. Created `docs/adr/` directory with 5 ADRs: 001-podman-over-docker (rootless, daemonless, OCI), 002-did-key-method (self-contained, offline, Ed25519), 003-nostr-for-discovery (decentralized relays, NIP-78), 004-tor-for-peer-communication (NAT traversal, IP privacy, .onion), 005-chacha20-backup-encryption (AEAD, Argon2id KDF, ARM performance). Each follows context/decision/consequences template.
-
-#### Sprint 23: Reliability Engineering (Week 4-8)
-
-- [x] **REL-01** — Implement graceful shutdown. Added `serve_with_shutdown()` to `server.rs` with tokio::select! between accept loop and shutdown signal. Uses semaphore to track active connections and drains in-flight requests with 5s timeout. In `main.rs`, registers SIGTERM and SIGINT handlers via `tokio::signal`, logs shutdown source, and exits cleanly.
-
-- [x] **REL-02** — Add crash recovery. Created `core/archipelago/src/crash_recovery.rs` with PID-file crash detection and container snapshot persistence. On startup, checks for stale PID marker (indicates crash), loads `running-containers.json` snapshot, restarts all containers that were running. Every 60s, saves a snapshot of running containers via `sudo podman ps --format json`. On clean shutdown, removes PID marker. Integrated into `main.rs`: crash check before server start, PID write on startup, snapshot task spawned, marker removed on graceful exit. 7 unit tests covering crash detection, snapshot parsing, PID lifecycle, and corrupt data handling.
-
-- [x] **REL-03** — Implement disk space management. Added `system.disk-status` and `system.disk-cleanup` RPC endpoints in `core/archipelago/src/api/rpc/system.rs`. Disk status returns usage with ok/warning/critical levels (85%/90% thresholds). Cleanup prunes dangling container images, old logs (>30 days), stale temp files, and unused volumes. Created `core/archipelago/src/disk_monitor.rs` — background task checks every 5 minutes, auto-cleans at 90%, writes warning JSON for frontend. UI: Server.vue shows warning/critical banner with "Clean Up" button when disk exceeds 85%. Added `diskStatus()` and `diskCleanup()` to rpc-client.ts.
-
-- [x] **REL-04** — Add container health monitoring and auto-recovery. Created `core/archipelago/src/health_monitor.rs` — background task checks container health every 60s via `podman ps -a`, auto-restarts exited/stopped containers (max 3 attempts per container with RestartTracker), pushes `Notification` to DataModel on failure which broadcasts to all WebSocket clients. Added `Notification` and `NotificationLevel` types to `data_model.rs` with `notifications` field on DataModel. Dashboard.vue shows toast notifications in top-right corner with dismiss button. Spawned from `server.rs` with access to StateManager.
-
-- [x] **REL-05** — Run 1-week continuous uptime test. Created `scripts/uptime-monitor.sh` — runs every 5 minutes via cron.d, records metrics to CSV: HTTP status, response time, CPU, memory, disk, container count, uptime, restart count. Generates `summary.json` with uptime percentage. Installed on server at `/opt/archipelago/scripts/uptime-monitor.sh` with `/etc/cron.d/uptime-monitor` cron job. Metrics stored at `/var/lib/archipelago/uptime-monitor/`. Initial check: HTTP 200, 32 containers, 51ms response. Monitor running continuously — check `summary.json` after 7 days for final uptime percentage.
-
-#### Sprint 24: Pre-Release Quality (Week 9-12)
-
-- [x] **PREREL-01** — Expand frontend test coverage. Added 59 new tests across 6 new test files: `rpc-marketplace.test.ts` (7 tests for marketplace discover, disk status, disk cleanup), `onboarding.test.ts` (14 tests for onboarding routing flow), `settings.test.ts` (20 tests for Settings view rendering), `uiMode.test.ts` (10 tests for UI mode store), `web5Badge.test.ts` (6 tests for Web5 badge store). Fixed 2 failing filebrowser-client tests. Total: 236 passing tests across 17 test files, 0 failures. Statement coverage: 10.66% (dominated by large untested Vue SFC template code in Web5.vue/Dashboard.vue/Marketplace.vue). Function coverage: 54%. Branch coverage: 87%.
-
-- [x] **PREREL-02** — Achieve 70% backend test coverage. Write tests for all RPC handlers, network modules, wallet operations. **Acceptance**: tarpaulin >= 70% on core/archipelago.
-
-- [x] **PREREL-03** — Run full regression screenshot comparison. Fixed Playwright visual regression test suite: splash screen was blocking login (set `neode_intro_seen` in localStorage), full page reloads bypassed SPA routing (switched to in-page `pushState` navigation with page-specific content waits). All 12 pages captured successfully: login, home, apps, marketplace, cloud, server/network, web5, settings, chat, federation, credentials, system update. Baseline screenshots stored in `neode-ui/e2e/screenshots/`. No unintended visual regressions — all pages render correctly with proper content.
-
-- [x] **PREREL-04** — Publish v0.8.0-rc1 release candidate. Tagged `v0.8.0-rc1` with annotated tag listing all major features. Wrote comprehensive changelog in CHANGELOG.md covering: W3C identity, DWN, federation, marketplace, VPN/mesh, hardware wallets, system monitoring, auto-updates, crash recovery, backup/restore, ARM64, kiosk mode, testing (236+124 tests), security hardening. ISO builds require running `sudo ./build-auto-installer-iso.sh` on the dev server after pushing code.
-
-### Q4 2027 (December -- February 2028): Polish, Scale, Community
-
-#### Sprint 25: User Experience Polish (Week 1-4)
-
-- [x] **UXP-01** — Run complete UX audit. Reviewed all 12 pages via Playwright screenshots + source code analysis. Found 30 issues: 3 P0 (Apps empty state hardcoded off, Credentials parse error, persistent unhealthy banners), 13 P1 (dead links, no-op buttons, fake data, silent failures, missing error feedback), 14 P2 (inconsistent patterns, native dialogs, loading states). Full report in `docs/ux-audit-2026-03.md`.
-
-- [x] **UXP-02** — Fix all UX audit findings. Address every issue identified. Focus on: mobile responsiveness, keyboard navigation, loading states, error messages, empty states. No visual/animation changes. **Acceptance**: All audit items resolved.
-
-- [x] **UXP-03** — Polish error handling across entire frontend. Run `/polish-errors` on every view and store. Ensure: every async operation has loading/error/success states, user-friendly error messages, retry buttons where appropriate. **Acceptance**: No unhandled promise rejections; all errors shown to user.
-
-- [x] **UXP-04** — Polish all forms. Run `/polish-forms` on: login, onboarding, WiFi config, backup passphrase, channel opening. Ensure: validation feedback, disabled submit during processing, success confirmation. **Acceptance**: All forms have complete validation and feedback.
-
-#### Sprint 26: Community Infrastructure (Week 5-8)
-
-- [x] **COMM-01** — Set up update server infrastructure. Create a simple update manifest server that hosts release manifests and binary artifacts. Can be a static file server or GitHub Releases. Update `UPDATE_MANIFEST_URL` in `core/archipelago/src/update.rs`. **Acceptance**: Update checker finds real releases.
-
-- [x] **COMM-02** — Create community contribution guidelines. Write `CONTRIBUTING.md` covering: code style, PR process, testing requirements, security disclosure, app submission process. **Acceptance**: Document exists and is comprehensive.
-
-- [x] **COMM-03** — Set up issue tracker and roadmap. Configure GitHub Issues with labels, templates, and project board. Create issue templates for: bug reports, feature requests, app submissions. **Acceptance**: Issue tracker ready for community use.
-
-- [x] **COMM-04** — (SUPERSEDED by v1.0.0 release — v0.9.0 milestone skipped) Publish v0.9.0 release. Final pre-1.0 release. Full ISO builds, comprehensive release notes, migration guide from 0.8. **Acceptance**: Published release, tested on 3+ hardware configs.
+- [ ] **UI-CLEAN-12** — Run frontend build and verify zero warnings. `cd neode-ui && npm run build`. Fix any warnings (unused variables, missing imports, deprecated APIs). **Acceptance**: `npm run build` exits 0 with zero warnings.
 
 ---
 
-## Year 3: Production Polish & Scale (March 2028 -- March 2029)
+## Phase 4: Backend Hardening (Week 7-10)
 
-### Q1 2028 (March -- May): Enterprise Features, Monitoring Dashboard
+### Sprint 5: Container Management Reliability
 
-#### Sprint 27: Advanced Monitoring (Week 1-4)
+- [ ] **CONT-01** — Audit container network topology on both nodes. Document every podman network, which containers are on each network, and which containers need to communicate. Create a network diagram. Fix any containers that should be on the same network but aren't (root cause of CRASH-01 and CRASH-02). **Acceptance**: Network diagram exists. All dependent containers share a network. No DNS resolution failures.
 
-- [x] **MON-01** — Implement real-time metrics collection. Add `core/archipelago/src/monitoring/collector.rs` that collects: per-container CPU/RAM/network/disk, system-wide metrics, RPC request latency, WebSocket connection count. Store in ring buffer (last 24h at 1-min resolution, last 7d at 15-min resolution). **Acceptance**: Metrics collected and queryable via RPC.
+- [ ] **CONT-02** — Add container dependency ordering to startup. In `crash_recovery.rs` `start_stopped_containers()`, implement proper startup ordering: (1) Databases first (postgres, redis, mariadb), (2) Core services second (bitcoin-knots, lnd), (3) Dependent services third (electrs, mempool-api, btcpay-server, nbxplorer), (4) UI containers last (mempool-web, bitcoin-ui, lnd-ui). Wait for each tier's health before starting the next. **Acceptance**: After reboot, containers start in dependency order. Zero crash-restart cycles. Run 10 reboot tests — all containers healthy within 120s every time.
 
-- [x] **MON-02** — Add monitoring dashboard page. Created `neode-ui/src/views/Monitoring.vue` at `/dashboard/monitoring` with: 4 real-time canvas-based line charts (CPU, Memory, Network I/O, RPC Latency), summary stat cards, per-container resource breakdown with CPU bars, system health timeline with color-coded segments. Custom `LineChart.vue` component renders on canvas with DPR scaling, grid lines, area fills. Polls every 5s via `monitoring.current` and `monitoring.history` RPC endpoints. Route registered in router. All CSS classes defined in style.css.
+- [ ] **CONT-03** — Add container health check definitions for all apps. In `get_app_config()`, add `--health-cmd`, `--health-interval`, `--health-retries` to every container that doesn't have one. Currently only filebrowser, jellyfin, vaultwarden, and uptime-kuma have health checks. Add for: bitcoin-knots (`bitcoin-cli getblockchaininfo`), lnd (`lncli getinfo`), mempool-api (HTTP check), btcpay-server (HTTP check), nextcloud, etc. **Acceptance**: `sudo podman ps` shows "(healthy)" for every running container.
 
-- [x] **MON-03** — Implemented alerting system. Added AlertRule and FiredAlert types to monitoring/mod.rs with 5 configurable rules (disk >90%, RAM >90%, container crash, RPC latency spike, SSL cert expiry <30 days). Metrics collector evaluates rules every 60s, fires alerts as Notifications via WebSocket. Added RPC endpoints: monitoring.alerts, monitoring.alert-rules, monitoring.configure-alert, monitoring.acknowledge-alert. Frontend: Monitoring.vue has alert history section with configurable thresholds, enable/disable toggles, dismiss buttons. CSS toggle/input styles in style.css.
+- [ ] **CONT-04** — Cap health monitor restart attempts with exponential backoff. Currently max 3 restarts with no delay. Change to: restart 1 at 10s, restart 2 at 30s, restart 3 at 90s. After 3 failures, mark container as "failed" and notify (don't keep trying). Reset counter after 1 hour of stability. **Acceptance**: A permanently broken container stops restarting after 3 attempts. No infinite crash loops consuming CPU.
 
-- [x] **MON-04** — Added historical data export. `monitoring.export` RPC endpoint returns metrics as CSV (with headers) or JSON for configurable count/resolution. Frontend: Export CSV and Export JSON buttons in Monitoring.vue header. Creates downloadable blob file with date-stamped filename.
+- [ ] **CONT-05** — Add memory limits to all containers. Review `get_app_config()` memory limits. Set appropriate `--memory` flags: bitcoin-knots (2GB), lnd (512MB), electrs (1GB), mempool-api (512MB), mempool-web (256MB), nextcloud (1GB), immich_server (1GB), onlyoffice (2GB), etc. Prevent any single container from OOM-killing others. **Acceptance**: `sudo podman stats` shows all containers have MEM LIMIT set. No container exceeds its limit.
 
-#### Sprint 28: Remote Management (Week 5-8)
+- [ ] **CONT-06** — Fix rootless podman mount warning on .228. The warning "/ is not a shared mount" appears on every podman command. Fix by making the mount shared: add `mount --make-rshared /` to systemd startup, or configure in `/etc/containers/storage.conf`. **Acceptance**: `sudo podman ps` produces no warnings.
 
-- [x] **REMOTE-01** — Implemented Tailscale-based remote access. Added `remote.setup` RPC endpoint that accepts a Tailscale auth key, configures tailscaled via podman exec, and restricts Tailscale interface to ports 80/443 via iptables rules (drops all other inbound traffic on tailscale0). Returns Tailscale IP, hostname, and remote URL for UI display.
+### Sprint 6: Backend Security & Reliability
 
-- [x] **REMOTE-02** — Mobile-optimized remote management verified. Dashboard has proper mobile bottom nav (md:hidden), sidebar hidden on mobile. Fixed: Settings.vue backup list rows now stack vertically on mobile (flex-col sm:flex-row), backup action buttons got larger touch targets (px-3 py-1.5, flex-wrap). AppDetails.vue uninstall button enlarged (w-10 h-10). All critical operations (install/start/stop, backup, health) accessible via mobile nav.
+- [ ] **SEC-01** — Audit all RPC endpoints for input validation. In `core/archipelago/src/api/rpc/mod.rs`, list every registered route. For each endpoint, verify: input params are validated (length limits, format checks, no path traversal), auth is required (except health/public endpoints), error messages don't leak internals. **Acceptance**: Audit document with pass/fail per endpoint. All critical endpoints pass.
 
-- [x] **REMOTE-03** — Implement remote notification system. Add push notification support: register a webhook URL in settings, send notifications for: container crashes, update available, disk space warning, backup completion. **Acceptance**: Webhook fires for configured events.
+- [ ] **SEC-02** — Add rate limiting to federation endpoints. Federation endpoints (`federation.join`, `federation.invite`) should be rate-limited to prevent invite-code brute force. Max 5 join attempts per minute per source IP. **Acceptance**: 6th join attempt within 60s returns 429.
 
-#### Sprint 29: Accessibility and Internationalization (Week 9-12)
+- [ ] **SEC-03** — Verify CSRF on all state-changing endpoints. Call every POST RPC endpoint without X-CSRF-Token header — should get 403. Verify the CSRF token is properly generated on login and validated on every mutation. **Acceptance**: 100% of state-changing endpoints reject requests without valid CSRF token.
 
-- [x] **A11Y-01** — Add ARIA labels and roles. Audit all interactive elements for accessibility. Add: `aria-label` on icon-only buttons, `role` attributes on custom widgets, `aria-live` regions for dynamic content, proper heading hierarchy. **Acceptance**: Lighthouse accessibility score > 90.
+- [ ] **SEC-04** — Audit container security profiles. For every container in `get_app_config()`, verify: `--cap-drop=ALL`, only required capabilities added back, `--security-opt=no-new-privileges:true`, `--read-only` where possible, non-root UID, specific image version pinned (not :latest). Fix any violations. **Acceptance**: All containers pass security checklist. `sudo podman inspect {name} --format "{{.HostConfig.CapDrop}}"` shows ALL for every container.
 
-- [x] **A11Y-02** — Add keyboard navigation testing. Verify all features are usable with keyboard only: tab order, focus management, escape to close modals, enter to submit forms. Fix any gaps. **Acceptance**: Complete user journey possible with keyboard only.
+- [ ] **SEC-05** — Implement proper log rotation. Check `/var/lib/archipelago/logs/` and `/var/log/` for log file sizes. Add logrotate config for: archipelago backend logs, container logs, nginx logs. Rotate daily, keep 7 days, compress. **Acceptance**: `du -sh /var/log/` < 500MB. Logrotate config exists and runs daily.
 
-- [x] **A11Y-03** — Set up i18n infrastructure. Install `vue-i18n`. Extract all user-facing strings from views into locale files (`neode-ui/src/locales/en.json`). Initial language: English only, but infrastructure ready for community translations. **Acceptance**: All strings externalized; switching locale changes UI text.
+- [ ] **SEC-06** — Verify nginx security headers on both nodes. `curl -I http://192.168.1.228` and `curl -I http://192.168.1.198`. Must include: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy. Fix any missing. **Acceptance**: All 4 security headers present on both nodes.
 
-### Q2 2028 (June -- August): Penetration Testing, Final QA
+---
 
-#### Sprint 30: Security Penetration Testing (Week 1-4)
+## Phase 5: Reboot & Uptime Hardening (Week 11-14)
 
-- [x] **PENTEST-01** — Run automated penetration test suite. Execute `scripts/verify-pentest-fixes.sh` and `scripts/test-security.sh`. Add new tests: SQL injection (even though no SQL -- test RPC params), command injection (test all params that touch shell), auth bypass attempts, session fixation, privilege escalation via container escape. **Acceptance**: All pen tests pass.
+### Sprint 7: Zero-Downtime Reboot Testing
 
-- [x] **PENTEST-02** — Conduct manual security review of all RPC endpoints. Review each of the 80+ RPC endpoints in `core/archipelago/src/api/rpc/mod.rs` for: input validation, authorization checks, information disclosure, timing attacks on auth endpoints. Document findings. **Acceptance**: All endpoints reviewed; critical issues fixed.
+- [ ] **REBOOT-01** — Create reboot survival test script. `scripts/test-reboot-survival.sh` that: (1) Records all container names and states, (2) Reboots the node via `sudo reboot`, (3) Waits for SSH to come back (poll every 10s, max 180s), (4) Verifies ALL containers are running, (5) Verifies health endpoint returns OK, (6) Verifies no containers have restart counts > 0 since boot. Run on .228. **Acceptance**: Script passes. All containers survive reboot.
 
-- [x] **PENTEST-03** — Harden Podman container isolation. Review all container configurations for: no host network access, no privileged mode, minimal capabilities, seccomp profiles, AppArmor profiles applied. Generate and apply AppArmor profiles for each app. **Acceptance**: All containers run with minimal privileges.
+- [ ] **REBOOT-02** — Run reboot survival test 10 times on .228. Execute test-reboot-survival.sh 10 times with 5-minute rest between reboots. Track: time to full recovery, any containers that fail to start, any services that don't come back. **Acceptance**: 10/10 reboots recover fully within 120s. Zero failed containers.
 
-- [x] **PENTEST-04** — Add rate limiting to all sensitive endpoints. Extend rate limiting beyond login: add rate limits to `identity.create`, `wallet.*`, `backup.create`, `update.apply`, `container-install`. Configurable per-endpoint. **Acceptance**: Rate-limited endpoints return 429 when exceeded.
+- [ ] **REBOOT-03** — Run reboot survival test 10 times on .198. Same as REBOOT-02 but on .198. **Acceptance**: 10/10 reboots recover fully. Zero failed containers.
 
-#### Sprint 31: End-to-End Quality Assurance (Week 5-8)
+- [ ] **REBOOT-04** — Test simultaneous reboot of both nodes. Reboot .228 and .198 at the same time. After both recover, verify: federation re-establishes, DWN sync works, file sharing works. **Acceptance**: Both nodes fully recover. Federation sync succeeds within 10 minutes of both being back.
 
-- [x] **E2E-01** — Create golden path test suite. Build `scripts/golden-path-test.sh` that automates the complete user journey: boot, install, onboard (set password, create DID, backup), install Bitcoin + LND + BTCPay, open lightning channel, receive payment, backup, restore on fresh install, verify all data intact. **Acceptance**: Golden path passes on fresh install.
+- [ ] **REBOOT-05** — Test power-cut simulation (SIGKILL). On each node: `sudo kill -9 $(pgrep archipelago)`. Verify systemd restarts the backend, health monitor restarts containers, and everything recovers. Run 10 times per node. **Acceptance**: Full recovery within 90s, 10/10 times.
 
-- [x] **E2E-02** — (PARTIAL: x86_64 validated on dev server, ARM64/NUC require physical hardware) Run regression test across all supported hardware. Test on: generic x86_64 PC, Intel NUC, Raspberry Pi 5, any other target hardware. Document hardware-specific issues and fixes. **Acceptance**: All supported hardware passes golden path.
+### Sprint 8: Memory & Storage Monitoring
 
-- [x] **E2E-03** — Achieve 80% test coverage (frontend + backend). Write final tests to reach 80% coverage on both frontend and backend. Focus on edge cases: network failures, corrupt data, concurrent operations. **Acceptance**: >= 80% coverage on both.
+- [ ] **MEM-01** — Add OOM-kill detection. In health_monitor.rs, check `dmesg | grep -i oom` and `/var/log/kern.log` for OOM kills. If detected, report via WebSocket notification with which process was killed. **Acceptance**: Trigger an intentional OOM (cgroup limit), verify notification fires.
 
-- [x] **E2E-04** — (STARTED: soak test running since 2026-03-11, ends 2026-04-10. Uptime monitor + systemd timer active.) Run 30-day soak test. Deploy to dev server. Monitor continuously for 30 days. Track: uptime, memory leaks (RSS should stay stable), disk growth rate, error rate trend. Target: 99.95% uptime, no memory leaks. **Acceptance**: 30 days stable.
+- [ ] **MEM-02** — Add container memory leak detection. Track per-container RSS over time in the monitoring collector. If a container's memory grows by >50% in 24h without corresponding workload increase, flag as potential leak. **Acceptance**: Monitoring page shows memory trend per container. Alert fires for simulated leak (container with growing allocation).
 
-#### Sprint 32: Documentation and Community (Week 9-12)
+- [ ] **MEM-03** — Add disk growth alerting. Track disk usage trend. If disk is growing > 1GB/day, alert. If disk > 85%, auto-trigger `system.disk-cleanup`. If > 90%, send critical notification. **Acceptance**: Alert fires when disk threshold crossed. Auto-cleanup runs at 90%.
 
-- [x] **FINALDOC-01** — Write comprehensive troubleshooting guide. Create `docs/troubleshooting.md` covering the top 20 most likely issues: can't connect to UI, app won't start, Bitcoin not syncing, backup failed, update failed, kiosk mode problems. Include diagnostic commands and solutions.
+- [ ] **MEM-04** — Add systemd watchdog to archipelago service. In `archipelago.service`, add `WatchdogSec=60`. In the backend, implement `sd_notify(WATCHDOG=1)` every 30s via the `sd-notify` crate. If backend hangs (stops sending watchdog), systemd auto-restarts it. **Acceptance**: Kill the backend's main loop (not the process), verify systemd detects the hang and restarts within 90s.
 
-- [x] **FINALDOC-02** — Create video/screenshot walkthrough documentation. Document (as markdown with screenshot descriptions) the complete user flow: unboxing, flashing USB, installing, first setup, daily use. These become the basis for future video tutorials.
+- [ ] **MEM-05** — Run 7-day continuous monitoring on both nodes. Deploy uptime-monitor.sh on both nodes. Cron every 5 minutes. Track: HTTP status, response time, CPU, memory, disk, container count, restart count. After 7 days, generate summary. **Acceptance**: Both nodes maintain > 99.9% uptime (< 10 minutes total downtime including intentional tests). Zero OOM kills. Zero unexpected restarts.
 
-- [x] **FINALDOC-03** — Finalize all Architecture Decision Records. Review and complete all ADRs. Add new ones for Year 3 decisions. Ensure every significant technical decision is documented.
+---
 
-- [x] **FINALDOC-04** — (SUPERSEDED by v1.0.0 release — v0.95.0-rc2 milestone skipped) Publish v0.95.0-rc2 release candidate. Tag, build ISOs, distribute for wider testing. **Acceptance**: RC2 published and distributed.
+## Phase 6: did:dht & Interoperable Schemas (Week 15-20)
 
-### Q3 2028 (September -- November): v1.0 Release Preparation
+### Sprint 9: did:dht Implementation
 
-#### Sprint 33: Final Polish (Week 1-4)
+- [ ] **DHT-01** — Research and document did:dht integration approach. Study the did:dht spec (uses BitTorrent DHT — Mainline DHT). Document: how to publish DIDs to the DHT, how to resolve them, what library/crate to use (or implement), how it fits alongside existing did:key. Write to `docs/did-dht-integration.md`. **Acceptance**: Architecture document with specific implementation plan.
 
-- [x] **FINAL-01** — Run final UX audit on every page. Complete UX review of all 20+ pages/views. Fix any remaining inconsistencies. Ensure loading states, error states, and empty states are all polished. **Acceptance**: UX audit passes with no critical issues.
+- [ ] **DHT-02** — Implement did:dht creation in identity_manager.rs. Add `create_dht_did()` method that: (1) generates Ed25519 keypair, (2) creates a DNS packet encoding per did:dht spec, (3) publishes to Mainline DHT using a Rust BitTorrent DHT library (e.g., `mainline` crate). The node should have BOTH did:key (local, offline) and did:dht (discoverable, no server needed). Add `identity.create-dht-did` RPC endpoint. **Acceptance**: Can create a did:dht and resolve it from another machine using the DHT.
 
-- [x] **FINAL-02** — Run final security audit. Complete security review of: all 80+ RPC endpoints, nginx configuration, container isolation, secrets management, session handling. Fix any findings. **Acceptance**: Zero critical/high findings.
+- [ ] **DHT-03** — Implement did:dht resolution. Add `identity.resolve-dht-did` RPC endpoint that takes a did:dht identifier, queries the Mainline DHT, retrieves and parses the DNS packet, returns the DID Document. Cache resolved DIDs for 1 hour. **Acceptance**: Can resolve a did:dht created on .228 from .198 without Tor, without Nostr relays, using only the BitTorrent DHT.
 
-- [x] **FINAL-03** — Run final sweep. Execute `/sweep`. All metrics must be at zero violations or documented exceptions. **Acceptance**: Sweep report clean.
+- [ ] **DHT-04** — Update Web5 UI for did:dht. Show both did:key and did:dht in the identity section. Add "Publish to DHT" button. Show DHT resolution status. **Acceptance**: Web5 page shows both DID types. DHT publish and resolve work from the UI.
 
-- [x] **FINAL-04** — Performance benchmark and optimize. Benchmark: page load time (<2s on LAN), RPC response time (<100ms for reads, <500ms for writes), container install time (<60s for cached images). Optimize any failures. **Acceptance**: All benchmarks met.
+### Sprint 10: DWN Protocol Definitions for Interoperable Schemas
 
-#### Sprint 34: Release Engineering (Week 5-8)
+- [ ] **SCHEMA-01** — Define Archipelago DWN protocol schemas. Create protocol definitions for the data types Archipelago shares between nodes: (1) Node identity announcements, (2) File sharing catalogs, (3) Federation state, (4) App deployment requests. Use the DWN protocol definition format so other apps implementing DWN could read Archipelago data. Document in `docs/dwn-protocols.md`. **Acceptance**: 4 protocol definitions documented with JSON schemas.
 
-- [x] **RELEASE-01** — Create release automation. Build `scripts/create-release.sh` that: bumps version in Cargo.toml and package.json, builds ISOs for both architectures, generates changelog from git log, creates release manifest, creates git tag. **Acceptance**: One command produces complete release artifacts.
+- [ ] **SCHEMA-02** — Register Archipelago protocols in DWN on both nodes. On startup, the backend should auto-register all 4 Archipelago protocols via `dwn.register-protocol`. Verify protocols are registered on both .228 and .198. **Acceptance**: `dwn.list-protocols` on both nodes shows all 4 Archipelago protocols.
 
-- [x] **RELEASE-02** — Set up download/update infrastructure. Prepare the distribution mechanism: release manifest hosted at a stable URL, ISOs downloadable, update mechanism pointing to production URL. **Acceptance**: Fresh install can check for updates against production server.
+- [ ] **SCHEMA-03** — Migrate file sharing catalog to DWN protocol format. Instead of (or in addition to) the custom `content.add/browse-peer` flow, store file sharing catalog entries as DWN messages using the file catalog protocol. This makes the catalog queryable by any DWN-compatible app. **Acceptance**: File sharing still works between .228 and .198. Catalog entries are also available via `dwn.query-messages` with the file catalog protocol filter.
 
-- [x] **RELEASE-03** — Write release notes for v1.0. Comprehensive release notes covering: what Archipelago is, key features, supported hardware, known limitations, upgrade path from beta, security model, contributing.
+- [ ] **SCHEMA-04** — Migrate federation state to DWN protocol format. Store federation node announcements as DWN messages. This allows nodes to discover federation peers through DWN sync in addition to Nostr. **Acceptance**: Federation still works. Node announcements are also available as DWN messages.
 
-- [x] **RELEASE-04** — Build v1.0.0 release ISOs. Build final ISOs for x86_64 and ARM64. Test on all supported hardware. Sign with release key. **Acceptance**: ISOs boot and complete golden path on all targets.
+### Sprint 11: Verifiable Credentials Between Nodes
 
-#### Sprint 35: Launch (Week 9-12)
+- [ ] **VC-01** — Implement proper VC issuance with did:dht. Update `credentials.rs` to support did:dht as issuer/subject (currently only did:key). When issuing a VC to a peer, use their did:dht if available (more discoverable). **Acceptance**: Can issue a VC with did:dht issuer, verify it, and present it.
 
-- [x] **LAUNCH-01** — Tag and publish v1.0.0. Git tag `v1.0.0`. Publish ISOs, release notes, documentation. Update project README with v1.0 information.
+- [ ] **VC-02** — Add inter-node identity verification VCs. When two nodes federate, they should exchange VCs proving each node controls its claimed DID. The VC attests: "did:dht:X is a trusted peer of did:dht:Y, established on DATE". Store these VCs in the DWN. **Acceptance**: After federation join, both nodes have a VC from the other proving the federation relationship.
 
-- [x] **LAUNCH-02** — Run 7-day post-release monitoring. Monitor any deployed v1.0 instances for stability issues. Prepare hotfix process. **Acceptance**: No critical bugs in first 7 days.
+- [ ] **VC-03** — Add VC presentation in federation handshake. Update `federation.join` and `federation.get-state` to include VC presentations. Peers can verify the VC chain before trusting a node. **Acceptance**: Federation join includes VC exchange. `federation.list-nodes` includes VC verification status per peer.
 
-- [x] **LAUNCH-03** — Create v1.1 roadmap. Based on community feedback and post-release monitoring, plan the v1.1 release with: bug fixes, community-requested features, marketplace ecosystem expansion.
+- [ ] **VC-04** — Test VC flow between .228 and .198 (10x). (1) Issue VC on .228 to .198's DID, (2) Verify VC on .198, (3) Create presentation on .198 including the VC, (4) Verify presentation on .228. Run 10 times each direction. **Acceptance**: 80 checks, all pass.
 
-### Q4 2028 (December -- February 2029): Maintenance and Ecosystem
+---
 
-#### Sprint 36-39: Ongoing Maintenance
+## Phase 7: Deploy Pipeline & ISO Hardening (Week 21-26)
 
-- [x] **MAINT-01** — Monthly dependency update cycle. Each month: run `cargo update` and `npm update`, review changelogs for security fixes, run full test suite, deploy. Track in `docs/dependency-audit-log.md`.
+### Sprint 12: Deploy Script Hardening
 
-- [x] **MAINT-02** — Monthly security scan. Each month: run `/harden-security`, check for new CVEs affecting dependencies, review Podman/Debian security advisories. Patch any critical issues within 48 hours.
+- [ ] **DEPLOY-01** — Audit deploy-to-target.sh for reliability. Read the entire script. Check: error handling (set -e?), rollback on failure, health check after deploy, idempotency, atomic swaps for binary and frontend. Fix any issues. **Acceptance**: Deploy script has proper error handling, health verification, and rollback capability.
 
-- [x] **MAINT-03** — Quarterly quality sweep. Each quarter: run full `/sweep`, compare to baseline, fix any regressions. Run 72-hour stability test.
+- [ ] **DEPLOY-02** — Add canary deploy mode. Deploy to .198 first, run health checks, then deploy to .228. If .198 health fails, abort before touching .228. Add `--canary` flag to deploy script. **Acceptance**: `./scripts/deploy-to-target.sh --canary` deploys to .198, verifies, then .228.
 
-- [x] **MAINT-04** — Community app reviews. Review and test community-submitted app manifests for the marketplace. Verify security requirements, test on dev server, approve or provide feedback.
+- [ ] **DEPLOY-03** — Add deploy rollback capability. Before deploying, backup the current binary and frontend. If post-deploy health check fails after 60s, automatically rollback to previous version. Store rollback artifacts in `/opt/archipelago/rollback/`. **Acceptance**: Intentionally deploy a broken binary. Verify auto-rollback restores the previous working version within 90s.
 
-- [x] **MAINT-05** — Plan v2.0 features. Based on a full year of v1.0 feedback: multi-chain support, advanced mesh networking, enterprise clustering, mobile companion app, AI-assisted node management.
+- [ ] **DEPLOY-04** — Add `--dry-run` flag to deploy script. Show exactly what would be deployed (files, binary, configs) without actually deploying. **Acceptance**: `./scripts/deploy-to-target.sh --dry-run --live` shows the plan without executing.
+
+### Sprint 13: ISO Build Hardening
+
+- [ ] **ISO-01** — Audit ISO build script for all current apps. Verify `CAPTURE_PATTERNS` and `CONTAINER_IMAGES` in `build-auto-installer-iso.sh` include ALL apps currently running on .228 (33+ containers). Any missing container means a fresh install won't have that app. **Acceptance**: ISO capture list matches the full container inventory on .228.
+
+- [ ] **ISO-02** — Add swap file creation to first-boot. In the first-boot script, auto-create a swap file sized at 50% of RAM (min 2GB, max 8GB). Add to fstab. **Acceptance**: Fresh install from ISO has swap configured automatically.
+
+- [ ] **ISO-03** — Add container dependency ordering to first-boot. Same startup ordering as CONT-02 but for the first-boot-containers.sh script. **Acceptance**: Fresh install starts containers in dependency order with zero crash loops.
+
+- [ ] **ISO-04** — Test fresh install from ISO on physical hardware. Build ISO, flash to USB, install on test machine, verify: all containers start, health OK, can federate with .228, can browse files, DWN sync works. **Acceptance**: Fresh install works end-to-end without manual intervention.
+
+---
+
+## Phase 8: Scale Testing for 10K Users (Week 27-36)
+
+### Sprint 14: Resource Budget for 10K Users
+
+- [ ] **SCALE-01** — Create resource budget document. Based on current .228 metrics (33 containers, 6.5GB RAM, 1.2TB disk, load 5.44), calculate per-node resource requirements. Estimate: RAM per container (avg), disk per container, CPU per container. Project for 10K users across different hardware tiers. Document in `docs/scale-budget.md`. **Acceptance**: Document with clear resource requirements per hardware tier.
+
+- [ ] **SCALE-02** — Identify resource bottlenecks. Profile the top CPU and memory consumers. Current: immich_server (82% CPU spike), onlyoffice (759MB RAM), bitcoin-knots (750MB RAM), fedimint (369MB), lnd (250MB), homeassistant (234MB). Determine which apps should be optional vs core for a minimal install. **Acceptance**: Tiered app list: Core (must-have), Recommended, Optional. Core tier uses < 4GB RAM.
+
+- [ ] **SCALE-03** — Implement app tier system in backend. Add a `tier` field to app metadata: `core`, `recommended`, `optional`. First-install only installs core tier. Marketplace shows tier badges. Users choose additional tiers. **Acceptance**: Fresh install only starts core apps. Total RAM < 4GB for core tier.
+
+- [ ] **SCALE-04** — Add resource monitoring alerts for scale limits. Alert when: total container memory > 80% of system RAM, CPU load > 2x core count sustained for 5 min, disk > 80%. These proactive alerts prevent scale-related failures. **Acceptance**: Alerts fire at correct thresholds. Tested on both nodes.
+
+### Sprint 15: Automated Fleet Testing
+
+- [ ] **FLEET-01** — Create automated test-all-features script. `scripts/test-all-features.sh` that runs every feature test in sequence: system health, container lifecycle, federation, Tor, Nostr, file sharing, DWN sync, NIP-07, backup, monitoring, identity/VCs. Takes a target IP and runs all checks 10 times. **Acceptance**: One command validates an entire node. Exit 0 = production ready.
+
+- [ ] **FLEET-02** — Run test-all-features on .228. Execute the full test suite 10 iterations. Document any failures, fix them, rerun until 10/10 clean. **Acceptance**: 10 consecutive clean runs on .228.
+
+- [ ] **FLEET-03** — Run test-all-features on .198. Same as FLEET-02 but on .198. **Acceptance**: 10 consecutive clean runs on .198.
+
+- [ ] **FLEET-04** — Run cross-node test suite 10 times. Execute `test-cross-node.sh --iterations 10` covering all bidirectional tests. **Acceptance**: All cross-node tests pass 10/10 from both directions.
+
+### Sprint 16: Long-Duration Soak Test
+
+- [ ] **SOAK-01** — Run 30-day soak test on both nodes. Deploy monitoring, leave both nodes running for 30 days. Monitor: uptime, memory trend (leak detection), disk growth, container restart counts, federation sync success rate, Tor uptime. **Acceptance**: Both nodes > 99.95% uptime. No memory leaks (RSS stable ±10% over 30 days). Zero unexpected restarts.
+
+- [ ] **SOAK-02** — Run hourly federation sync verification for 30 days. Cron job every hour: trigger federation sync, verify success, log result. After 30 days, calculate sync success rate. **Acceptance**: > 99% sync success rate over 30 days.
+
+- [ ] **SOAK-03** — Run daily reboot test for 30 days. Automated daily reboot at 4 AM, verify full recovery by 4:05 AM. Log recovery time each day. **Acceptance**: 30/30 successful recoveries. Average recovery < 120s.
+
+- [ ] **SOAK-04** — Compile final stability report. After 30-day soak, generate report: uptime %, memory trend, disk trend, federation reliability, container health, incident log. This becomes the go/no-go for declaring production ready. **Acceptance**: Report shows all metrics meeting production targets.
+
+---
+
+## Phase 9: Production Polish (Week 37-44)
+
+### Sprint 17: Performance Optimization
+
+- [ ] **PERF-01** — Optimize backend startup time. Target: < 3 seconds from process start to healthy response. Profile with tracing. Defer non-critical initialization (DWN sync, Nostr discovery, monitoring) to background tasks. **Acceptance**: `time curl http://localhost:5678/health` after restart < 3s.
+
+- [ ] **PERF-02** — Optimize frontend bundle size. Target: < 500KB gzipped initial load. Analyze with vite-bundle-visualizer. Lazy-load heavy components (D3.js network map, monitoring charts). **Acceptance**: `ls -la web/dist/neode-ui/assets/*.js | awk '{sum+=$5}END{print sum}'` < 500KB gzipped.
+
+- [ ] **PERF-03** — Optimize container image sizes. Pull all container images and check sizes. Replace any > 1GB images with smaller alternatives (alpine-based). Remove any cached layers for old versions. **Acceptance**: Total container image disk usage reduced by > 20%.
+
+- [ ] **PERF-04** — Add caching for RPC responses. Frequently-called read endpoints (`system.stats`, `container.list`, `federation.list-nodes`) should cache results for 5-10 seconds to reduce CPU. **Acceptance**: 100 concurrent `system.stats` calls complete in < 500ms total.
+
+### Sprint 18: Documentation Update
+
+- [ ] **DOC-01** — Update CHANGELOG.md for v1.2.0. Document all changes from this hardening cycle: crash loop fixes, cross-node testing, did:dht, DWN protocols, VCs, reboot hardening, memory/swap fixes. **Acceptance**: CHANGELOG updated with all changes.
+
+- [ ] **DOC-02** — Update architecture.md for current state. The current doc references StartOS, Docker, macOS. Update to reflect: Debian 12, Podman, multi-node federation, did:dht, DWN protocols. **Acceptance**: Architecture doc matches actual system.
+
+- [ ] **DOC-03** — Update current-state.md. Remove references to StartOS dependencies (already removed). Document actual current state: pure Archipelago backend, Podman, 33+ containers, 2-node federation. **Acceptance**: current-state.md reflects reality.
+
+- [ ] **DOC-04** — Create operations runbook. `docs/operations-runbook.md` covering: how to check node health, how to fix crashed containers, how to add/remove federation peers, how to rotate Tor address, how to create/restore backups, how to update, how to diagnose high CPU/memory. **Acceptance**: Runbook covers top 20 operational scenarios.
+
+---
+
+## Phase 10: Year 2-5 Roadmap (Month 13-60)
+
+### Year 2 (2027): Multi-Hardware & Community
+
+- [ ] **Y2-01** — Test and certify on 5 hardware platforms: generic x86_64 PC, Intel NUC, Raspberry Pi 5, mini-PC (N100), used ThinkCentre. Document per-platform quirks. **Acceptance**: ISO boots and works on all 5 platforms.
+
+- [ ] **Y2-02** — Community app submission pipeline. Automated review of community-submitted app manifests: security scan, resource check, dependency validation, sandbox test. **Acceptance**: Community can submit apps via PR, automated checks run, maintainer approves.
+
+- [ ] **Y2-03** — Multi-language support. Translate UI to 5 languages (Spanish, Portuguese, German, French, Japanese) using the i18n infrastructure already in place. **Acceptance**: Language selector in Settings, all strings translated.
+
+- [ ] **Y2-04** — Mobile companion app (read-only). Progressive Web App or native app that connects to node over Tailscale/Tor and shows: dashboard, container status, notifications. No mutations — read-only for safety. **Acceptance**: Can view node status from phone.
+
+### Year 3 (2028): Enterprise & Scale
+
+- [ ] **Y3-01** — Multi-user support. Add user roles (admin, viewer, app-user). Admin can manage everything. Viewer sees dashboard only. App-user accesses specific apps. **Acceptance**: 3 user roles with proper permission separation.
+
+- [ ] **Y3-02** — Automated backup to S3-compatible storage. In addition to USB backup, support backup to any S3 endpoint (Backblaze B2, Wasabi, self-hosted MinIO). Encrypted before upload. **Acceptance**: Backup to S3 works, restore from S3 works.
+
+- [ ] **Y3-03** — Cluster mode for high availability. 3+ nodes form a cluster where apps have replicas. If one node goes down, apps failover to another. Uses Raft or similar consensus. **Acceptance**: Stop one node in a 3-node cluster — apps continue serving from remaining nodes.
+
+- [ ] **Y3-04** — Hardware attestation with TPM 2.0. Nodes with TPM chips can cryptographically prove their hardware identity. Adds trust layer to federation. **Acceptance**: TPM-equipped node includes hardware attestation in its DID Document.
+
+### Year 4 (2029): Ecosystem & Market
+
+- [ ] **Y4-01** — App developer SDK. Command-line tool for app developers: `archy-dev create`, `archy-dev test`, `archy-dev publish`. Scaffolds manifest, runs security checks, publishes to marketplace. **Acceptance**: Developer can publish a new app in under 30 minutes using the SDK.
+
+- [ ] **Y4-02** — Paid app marketplace. Apps can have pricing (one-time or subscription, paid in sats via Lightning). Revenue split between developer and node operator. Uses Cashu or Lightning invoices. **Acceptance**: End-to-end payment flow works.
+
+- [ ] **Y4-03** — Node analytics dashboard (opt-in). Anonymous telemetry: app install counts, uptime statistics, hardware distribution. Helps prioritize development. Strictly opt-in. **Acceptance**: Analytics dashboard shows aggregate data from consenting nodes.
+
+- [ ] **Y4-04** — Cross-chain support (Monero, Liquid). Add support for Monero full node and Liquid sidechain containers. Federation supports multi-chain status reporting. **Acceptance**: Can run Bitcoin + Monero + Liquid on same node.
+
+### Year 5 (2030-2031): Production at Scale
+
+- [ ] **Y5-01** — Achieve 10,000 active nodes. Track via opt-in analytics. Support infrastructure: documentation, community forum, bug tracker, release automation. **Acceptance**: 10K+ nodes running Archipelago, measured via marketplace relay or opt-in telemetry.
+
+- [ ] **Y5-02** — Zero-downtime updates. Update mechanism that migrates containers one-by-one with health checks between each. No service interruption during update. **Acceptance**: Update from v2.x to v2.y with zero downtime measured by external monitor.
+
+- [ ] **Y5-03** — Formal security audit by third party. Engage professional security firm to audit: backend code, container isolation, authentication, cryptography, network security. Fix all findings. **Acceptance**: Clean audit report with no critical/high findings.
+
+- [ ] **Y5-04** — v3.0 release with all Year 5 features. Stable, audited, scale-tested release for mass adoption. **Acceptance**: Tagged v3.0.0 release with full documentation and ISO downloads.
+
+---
+
+## Test Matrix Summary
+
+| Test Category | # Checks | Per-Direction | Iterations | Total Passes Required |
+|---|---|---|---|---|
+| System Health (US-01) | 6 | x2 | x10 | 120 |
+| Container Lifecycle (US-02) | 4 | x2 | x10 | 80 |
+| Federation Join (US-03) | 4 | x2 | x10 | 80 |
+| Federation Sync (US-04) | 4 | x2 | x10 | 80 |
+| Tor Hidden Services (US-05) | 3 | x2 | x10 | 60 |
+| Nostr Discovery (US-06) | 4 | x2 | x10 | 80 |
+| File Sharing (US-07) | 5 | x2 | x10 | 100 |
+| DWN Sync (US-08) | 5 | x2 | x10 | 100 |
+| NIP-07 Signing (US-09) | 4 | x2 | x10 | 80 |
+| Backup/Restore (US-10) | 4 | x2 | x10 | 80 |
+| Boot Recovery (US-15) | 5 | x2 | x3 | 30 |
+| **TOTAL** | **48** | | | **890** |
+
+Every single one of these 890 test passes must succeed before declaring production-ready.
 
 ---
 
 ## Milestone Summary
 
 | Date | Milestone | Key Deliverables |
-|------|-----------|-----------------|
-| May 2026 | Q1 Complete | Test infrastructure, UI fixes, security hardening, quality baseline |
-| Aug 2026 | Q2 Complete | DWN protocol, backup/restore, kiosk mode, StartOS independence |
-| Nov 2026 | Q3 Complete | App integration testing, auto-updates, ARM64 support |
-| Feb 2027 | **v0.5.0-beta** | First public beta release |
-| May 2027 | Q5 Complete | W3C DIDs, JSON-LD credentials, hardware wallet support |
-| Aug 2027 | Q6 Complete | Multi-node federation, VPN, community marketplace |
-| Nov 2027 | Q7 Complete | Documentation complete, 70% test coverage, v0.8.0-rc1 |
-| Feb 2028 | **v0.9.0** | Pre-release candidate, community infrastructure |
-| May 2028 | Q9 Complete | Monitoring dashboard, remote management, accessibility |
-| Aug 2028 | Q10 Complete | Penetration testing, 80% coverage, 30-day soak test |
-| Nov 2028 | **v1.0.0** | Production release |
-| Feb 2029 | Q12 Complete | Maintenance cycle established, v2.0 planned |
-
----
-
-## Post-v1.0 Feature Release: Multi-Node, Identity & Tor (April -- September 2026)
-
-**Goal**: Ship 8 features to production — real Nostr identity, NIP-07 signing, multi-node federation across 7 servers, file sharing, DWN + node map, webhook fix, Tor rotation. Each feature must work on first install with 100% uptime.
-
-**Servers**: 192.168.1.228 (primary), 192.168.1.198 (secondary), archipelago-2.tail2b6225.ts.net, archipelago-3.tail2b6225.ts.net, + 3 more TBD
-**Deploy**: `./scripts/deploy-to-target.sh --live` | SSH: `ssh -i ~/.ssh/archipelago-deploy archipelago@192.168.1.228`
-
----
-
-### Sprint 40: Critical Fix & Identity Completion (April 2026 Week 1-2)
-
-- [x] **WHFIX-01** — Decouple health monitor from webhook config. In `core/archipelago/src/health_monitor.rs` lines 150-156, the health check loop skips ALL monitoring (restarts + WebSocket notifications) when webhooks are disabled or ContainerCrash isn't subscribed. This means fresh installs (webhooks disabled by default) get NO auto-restart and NO UI notifications. Fix: remove the webhook config gate from the main loop. Health checks, auto-restarts, and WebSocket `Notification` pushes must run unconditionally. Move the webhook gate into a separate block that only controls external HTTP webhook delivery — call `webhooks::send_webhook()` only when enabled AND the event is subscribed. Keep the existing `send_webhook()` function which already checks `config.enabled` and `config.events.contains()` internally. **Acceptance**: With webhooks disabled (default), crash a container (`sudo podman stop archy-filebrowser`), confirm health monitor detects it within 60s, auto-restarts it, and pushes a Notification visible in the Dashboard toast. With webhooks enabled + URL configured, confirm HTTP POST is also sent. Deploy and verify on 192.168.1.228.
-
-- [x] **WHFIX-02** — Add monitoring.rs webhook integration. In `core/archipelago/src/monitoring/mod.rs`, the alert system pushes `Notification` to DataModel but never calls `webhooks::send_webhook()`. Add webhook delivery for fired alerts: when a `DiskWarning` alert fires, send `WebhookEvent::DiskWarning`; when `ContainerCrash` fires, send `WebhookEvent::ContainerCrash`. Map alert types to webhook events. The webhook call should be fire-and-forget (already is in `send_webhook`). **Acceptance**: Configure a webhook URL, trigger a disk warning (lower threshold temporarily to 1%), confirm HTTP POST received. Deploy and verify.
-
-- [x] **IDENT-01** — Auto-generate Nostr keypair during identity creation. In `core/archipelago/src/identity_manager.rs` `create()` method, after generating the Ed25519 keypair, immediately call `create_nostr_key()` on the same identity so every identity gets both Ed25519 (DID) and secp256k1 (Nostr) keys from creation. Update the `IdentityInfo` struct returned by `identity.create` and `identity.list` RPC to always include `nostr_pubkey` (hex) and `nostr_npub` (bech32) fields when present. **Acceptance**: Call `identity.create`, then `identity.get` — response includes both `did` and `nostr_npub`. Deploy and verify.
-
-- [x] **IDENT-02** — Update onboarding to show DID + npub. In `neode-ui/src/views/OnboardingDid.vue`, after fetching the node DID, also fetch `node.nostr-pubkey` (already exists as RPC endpoint). Display both: "Your DID: did:key:z..." and "Your Nostr ID: npub1..." with copy buttons for each. Add a brief explanation: DID for Web5/federation, npub for Nostr apps. Store `nostr_npub` in localStorage alongside `neode_did`. **Acceptance**: Fresh onboarding flow shows both DID and npub on the identity screen. Deploy and verify at http://192.168.1.228.
-
-- [x] **IDENT-03** — Wire real signature verification in onboarding. In `neode-ui/src/views/OnboardingVerify.vue`, replace `generateMockSignature()` with a real call to `rpcClient.signChallenge(challenge)`. Generate a random challenge string, send it to the backend, display the real Ed25519 signature. Add a "Verify" button that calls `identity.verify` with the DID, challenge, and signature to prove the node controls its keys. Show green checkmark on success. **Acceptance**: Onboarding verify step shows real cryptographic signature and verification succeeds. Deploy and verify.
-
-- [x] **IDENT-04** — Wire real encrypted backup in onboarding. In `neode-ui/src/views/OnboardingBackup.vue`, replace the mock JSON display with a real call to `rpcClient.createBackup(passphrase)`. Add a passphrase input field (with confirmation). Call `backup.create` RPC, then offer the encrypted backup blob as a downloadable file. Show the backup metadata (DID, timestamp, encrypted: true). **Acceptance**: Onboarding backup step creates real encrypted backup file that can be downloaded. Deploy and verify.
-
-### Sprint 41: NIP-07 Iframe Signing (April 2026 Week 3-4)
-
-- [x] **NIP07-01** — Configure nginx to inject nostr-provider.js into iframe apps. In `image-recipe/configs/nginx-archipelago.conf`, for every `/app/*` proxy location block, add `sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';` and `sub_filter_once on;`. Ensure `proxy_set_header Accept-Encoding "";` is set (required for sub_filter to work on compressed responses). Copy `neode-ui/public/nostr-provider.js` to `/opt/archipelago/web-ui/nostr-provider.js` in the deploy script. Also add this to the HTTPS snippets conf at `image-recipe/configs/snippets/archipelago-https-app-proxies.conf`. **Acceptance**: Open any iframe app (e.g., Mempool at `/app/mempool/`), open browser DevTools console, type `window.nostr` — should return the provider object with `getPublicKey` and `signEvent` methods. Deploy and verify.
-
-- [x] **NIP07-02** — Add signing consent modal. In `neode-ui/src/components/`, create `NostrSignConsent.vue` — a modal that shows when an iframe app requests a Nostr signature. Display: requesting app name/origin, event kind number, event content preview (truncated to 200 chars), and Approve/Deny buttons. In `neode-ui/src/stores/appLauncher.ts` `handleNostrRequest()`, instead of immediately signing, emit an event that triggers this modal. Only call the backend RPC after user approves. Add a "Remember for this app" checkbox that stores approved origins in localStorage. **Acceptance**: Open a Nostr app in iframe, trigger a sign request — consent modal appears. Approve → signature returned. Deny → error returned to iframe. Deploy and verify.
-
-- [x] **NIP07-03** — Test NIP-07 with a real Nostr web app. Install `nostr-rs-relay` container if not already running (it's in the app catalog). Deploy a Nostr web client that supports NIP-07 — add Nostrudel (https://nostrudel.ninja) as a web-only app entry in `Marketplace.vue` `getCuratedAppList()` (category: "Social", opens in iframe). Open Nostrudel, verify it detects `window.nostr`, can fetch the pubkey, and can sign events (post a note). **Acceptance**: Can post a signed Nostr note from within the Archipelago iframe using the node's Nostr identity. Verify the note appears on a public Nostr client.
-
-- [x] **NIP07-04** — Support NIP-04 and NIP-44 encryption in iframe provider. The `nostr-provider.js` already has stubs for `nip04.encrypt`, `nip04.decrypt`, `nip44.encrypt`, `nip44.decrypt`. Add backend RPC endpoints: `identity.nostr-encrypt-nip04`, `identity.nostr-decrypt-nip04`, `identity.nostr-encrypt-nip44`, `identity.nostr-decrypt-nip44`. Each takes the identity ID, peer pubkey, and plaintext/ciphertext. Use `nostr_sdk` for the actual crypto. Register in RPC router. Wire the appLauncher `handleNostrRequest` to route `nip04.*` and `nip44.*` calls to these endpoints. **Acceptance**: From an iframe app, call `window.nostr.nip44.encrypt(peerPubkey, "hello")` — returns ciphertext. Call `nip44.decrypt` with same ciphertext — returns "hello". Deploy and verify.
-
-### Sprint 42: Tor Address Rotation & Per-App Toggle (May 2026 Week 1-2)
-
-- [x] **TOR-01** — Implement Tor address rotation RPC. In `core/archipelago/src/api/rpc/tor.rs`, add `tor.rotate-service` handler. Flow: (1) Read current service from `services.json`, (2) Rename the hidden service directory from `hidden_service_{name}` to `hidden_service_{name}_old`, (3) Create a new hidden service directory (Tor will auto-generate new keys on restart), (4) Regenerate torrc from updated services.json, (5) Restart `archy-tor` container, (6) Wait up to 60s for new hostname file to appear, (7) Return both old and new .onion addresses. Keep the old directory for a configurable transition period (default 24h) then delete via a cleanup task. Add `tor.cleanup-rotated` RPC that deletes expired old service directories. **Acceptance**: Call `tor.rotate-service("archipelago")`, verify new .onion address is different from old one. Both addresses resolve during transition period. After cleanup, old address stops working. Deploy and verify.
-
-- [x] **TOR-02** — Propagate Tor address change to federation peers. After a successful rotation in `tor.rotate-service`, automatically: (1) Update the node's Nostr discovery event with the new onion address by calling `publish_node_identity()` from `nostr_discovery.rs`, (2) For each federated peer in `federation.rs`, send a `federation.peer-address-changed` notification over Tor (using the OLD address which still works during transition) containing the new onion address signed with the node's DID key, (3) Peers receiving this notification update their `FederatedNode.onion` field and re-save `federation/nodes.json`. Add `federation.peer-address-changed` as a new inter-node RPC handler. **Acceptance**: Rotate address on node A, verify node B's federation list updates to show the new address within 5 minutes. Verify Nostr relay shows new address.
-
-- [x] **TOR-03** — Add per-app Tor toggle. In `core/archipelago/src/api/rpc/tor.rs`, add `tor.toggle-app` handler that takes `app_id` and `enabled` (bool). When disabling: remove the app's `HiddenServiceDir`/`HiddenServicePort` lines from the generated torrc, restart archy-tor, delete the hidden service directory. When enabling: add the service entry to `services.json`, regenerate torrc, restart archy-tor, wait for hostname. Update `TorServiceEntry` struct to include an `enabled` field (default true). The `tor.list-services` response should include the `enabled` state per service. **Acceptance**: Disable Tor for filebrowser, verify its .onion address no longer resolves. Re-enable, verify a new .onion address is generated and works. Deploy and verify.
-
-- [x] **TOR-04** — Add Tor management UI. In `neode-ui/src/views/AppDetails.vue`, add a "Tor Access" section (only shown when the app has a Tor service). Show: current .onion address with copy button, enabled/disabled toggle switch, "Rotate Address" button with confirmation modal ("This will generate a new .onion address. The old address will work for 24 hours during transition. Federated peers will be notified automatically."). In `neode-ui/src/views/Settings.vue` or `Web5.vue`, add a "Tor Services" management section showing all services with their toggle states and a global "Rotate Node Address" button. Wire to `tor.toggle-app`, `tor.rotate-service`, `tor.list-services` RPC calls. **Acceptance**: Can toggle Tor access per app from AppDetails, can rotate the node's main Tor address from Settings. All state changes reflected in UI immediately. Deploy and verify.
-
-### Sprint 43: Multi-Node Federation Deployment (May 2026 Week 3-4)
-
-- [x] **FED-DEPLOY-01** — Deployed to 3/4 servers (192.168.1.198 offline). Primary (192.168.1.228): full deploy via deploy script. Archipelago-2: full deploy via deploy script. Archipelago-3: SCP binary from archipelago-2, frontend tarball extracted, service restarted. All 3 servers return health OK (200), frontend loads.
-
-- [x] **FED-DEPLOY-02** — Federated 3 servers (192.168.1.198 offline). Fixed: Tor hostname reading (tor-hostnames dir for system Tor), AppArmor profiles, inter-node RPC auth exemption (federation.peer-joined/get-state/peer-address-changed). Primary has 2 peers (archipelago-2 and archipelago-3), each peer has primary as trusted. Sync works: archipelago-2 has 24 apps, archipelago-3 has 10 apps.
-
-- [x] **FED-DEPLOY-03** — Validated Nostr discovery across all 3 nodes. Removed revocation files, cleaned SSRF attempt relay, published to Nostr relays (1/2 success per node). All 3 servers discover all 4 nodes (3 current + 1 legacy) via `node-nostr-discover`. Discovery confirmed from every server.
-
-- [x] **FED-DEPLOY-04** — Tested 4/5 resilience scenarios. (1) Backend stop: sync detects "502 Bad Gateway" immediately. (2) Backend restart: sync resumes within 5s. (3) Tor stop: sync detects "Failed to reach peer". Fixed AppArmor profiles (added read rules for archipelago/tor dirs) to allow Tor restart in enforce mode. (4) Full reboot: backend and Tor auto-start, services healthy within ~2min. Hidden service takes a few extra minutes to become reachable. (5) iptables test skipped — resilience adequately demonstrated by scenarios 1-4.
-
-### Sprint 44: File Sharing Across Nodes (June 2026 Week 1-2)
-
-- [x] **SHARE-01** — Test content sharing between two federated nodes. On node A (192.168.1.228): upload a test file to FileBrowser, then call `content.add` with the filename to share it. Call `content.set-pricing` with `access: "free"`. Call `content.set-availability` with `availability: "all_peers"`. On node B (192.168.1.198): call `content.browse-peer` with node A's onion address. Verify the shared file appears in the catalog with correct metadata (name, size, mime_type). Download the file via the content server's HTTP endpoint over Tor. Compare checksums. **Acceptance**: File shared on node A is browseable and downloadable from node B with matching content. If `browse-peer` fails, debug: check Tor SOCKS proxy, check content server HTTP handler is listening, check the file path mapping between FileBrowser storage and content catalog.
-
-- [x] **SHARE-02** — Test access control modes. On node A, share 3 files: one `free`, one `peers_only`, one `paid` (price: 100 sats). From node B (federated peer): verify `free` file is accessible, `peers_only` file is accessible (peer is authenticated via DID), `paid` file returns payment-required response with price. From an unfederated client (curl via Tor): verify `free` file is accessible, `peers_only` returns 403, `paid` returns payment-required. Test `availability: "specific"` with node B's onion in the allowed list — verify only node B can access. **Acceptance**: All 3 access modes enforce correctly for both federated peers and anonymous Tor clients.
-
-- [x] **SHARE-03** — Test file sharing at scale. Share 10 files of varying sizes (1KB text, 100KB image, 1MB PDF, 10MB video) from node A. Browse the catalog from nodes B, C, and D simultaneously. Download the 10MB file from all 3 nodes at once. Measure: catalog browse latency (<5s over Tor), download speed for 10MB file (any speed is acceptable over Tor, just verify it completes). Verify no corrupted transfers (checksum all downloads). **Acceptance**: All files transfer correctly to all 3 peers. No timeouts, no corruption. Document transfer speeds.
-
-- [x] **SHARE-04** — Add peer content browsing to Cloud UI. In `neode-ui/src/views/Cloud.vue`, add a "Peer Files" tab alongside Photos/Music/Documents/All Files. This tab shows a list of federated peers (from `federation.list-nodes`). Clicking a peer calls `content.browse-peer` with their onion address and displays their shared catalog in the same FileGrid component. Add a download button on each file that fetches the content over Tor and saves locally. Show loading state while Tor connection establishes (can take 5-10s). **Acceptance**: Can browse and download peer-shared files from the Cloud page. Deploy and verify.
-
-### Sprint 45: DWN Multi-Node Sync (June 2026 Week 3-4)
-
-- [x] **DWN-SYNC-01** — Test DWN sync between federated nodes. On node A: register a protocol via `dwn.register-protocol` (e.g., `https://archipelago.dev/protocols/notes`), write 5 messages via `dwn.write-message`. On node B: add node A as a sync target (the DWN sync module uses the federation peer list), trigger `dwn.sync`. Verify all 5 messages appear on node B via `dwn.query-messages`. Write 3 messages on node B, trigger sync from node A — verify bidirectional replication. **Acceptance**: Messages replicate both ways between 2 nodes. Protocol definitions sync as well.
-
-- [x] **DWN-SYNC-02** — Test DWN sync across all 4 nodes. Register the same protocol on all 4 nodes. Write unique messages on each node (node A writes 5, B writes 3, C writes 2, D writes 4 = 14 total). Trigger sync from each node. After sync completes, query all messages on each node — every node should have all 14 messages. If sync is missing messages: check the bidirectional replication logic in `dwn_sync.rs`, ensure Tor SOCKS proxy is used correctly, check for deduplication issues. **Acceptance**: All 4 nodes have all 14 messages after sync. Message content and metadata intact.
-
-- [x] **DWN-SYNC-03** — Add DWN sync status to Federation dashboard. In `neode-ui/src/views/Federation.vue`, in the node detail modal, add a "DWN Sync" section showing: last sync time, messages synced count, sync status (idle/syncing/error), and a "Sync Now" button. Wire to `dwn.sync` RPC. In the node list, add a small DWN icon/badge showing sync state (green dot = synced recently, amber = stale, red = error). Fetch DWN status alongside federation state. **Acceptance**: Federation dashboard shows DWN sync state per node. Manual sync trigger works from the modal. Deploy and verify.
-
-### Sprint 46: Node Visualization Map (July 2026 Week 1-2)
-
-- [x] **MAP-01** — Install D3.js and create network topology component. Run `cd neode-ui && npm install d3@^7 && npm install -D @types/d3@^7`. Create `neode-ui/src/components/federation/NetworkMap.vue` — a force-directed graph component using `d3-force`. Nodes are circles: size proportional to app count, color by trust level (green=trusted `#4ade80`, amber=observer `#fb923c`, red=untrusted `#ef4444`), opacity by online/offline (1.0=online, 0.4=offline). Edges are lines between federated nodes: solid green when both online, dashed gray when one offline. Add labels showing node name (truncated DID or custom alias). Use `bg-black/60 backdrop-blur-glass rounded-xl border border-white/10` container to match glassmorphism design. SVG fills the container, responsive to window resize. Add CSS classes to `neode-ui/src/style.css`. **Acceptance**: Component renders a graph with 4 test nodes (mock data). Nodes repel/attract via force simulation. Looks consistent with Archipelago glass aesthetic.
-
-- [x] **MAP-02** — Wire network map to real federation data. In `NetworkMap.vue`, accept a `nodes` prop of type `FederatedNode[]` (from `federation.list-nodes` response). Add the current node as the center node (use `node.did` RPC to get own identity). Map each node to a D3 node: id=DID, label=name or truncated DID, trust_level, online=(last_seen within 10 minutes), cpu_usage, memory_percent, app_count from `last_state`. Edges connect each peer to the local node (star topology for now). Add node tooltips on hover showing: full DID, onion address (truncated), CPU/memory/disk percentages, app count, last seen time. Click a node to open the existing node detail modal. Poll `federation.list-nodes` every 30 seconds and update the graph with smooth transitions (D3 enter/update/exit). **Acceptance**: Network map shows all real federated nodes with live data. Online/offline status updates when a server goes down. Tooltips show real metrics. Deploy and verify.
-
-- [x] **MAP-03** — Add network map as tab in Federation page. In `neode-ui/src/views/Federation.vue`, add a tab switcher at the top: "List View" (current) and "Network Map". List view shows the existing node cards. Network Map tab shows `NetworkMap.vue` taking full width of the content area. Remember selected tab in localStorage. Default to Map view when 3+ nodes are federated, List view otherwise. Add the tab styling as global classes in `style.css` following the existing tab patterns (if any) or using `.glass-tab` / `.glass-tab-active` classes with `bg-white/5` inactive and `bg-white/10 border-b-2 border-orange-400` active. **Acceptance**: Can switch between list and map views. Map shows live federation data. Tab selection persists across page navigations. Deploy and verify.
-
-- [x] **MAP-04** — Add DWN management section to Web5 page. In `neode-ui/src/views/Web5.vue`, enhance the existing DWN section with: (1) A "Manage Protocols" subsection showing registered protocols in a list with delete buttons, plus an "Add Protocol" form (URL input), (2) A "Message Store" subsection showing total message count, storage size in bytes (human-readable), and a "Browse Messages" button that opens a modal with a paginated message list (fetch via `dwn.query-messages` with limit/offset), (3) A "Sync Targets" subsection showing which peers are configured for DWN sync and their last sync status. Wire to existing `dwn.*` RPC endpoints. **Acceptance**: Can add/remove protocols, browse stored messages, and see sync status from the Web5 page. Deploy and verify.
-
-### Sprint 47: Integration Testing — First Install Flow (July 2026 Week 3 — August 2026 Week 1)
-
-- [x] **INSTALL-01** — Create comprehensive first-install test script. Create `scripts/test-first-install.sh` that automates the post-install verification flow. It should: (1) Call `node.did` and verify DID format (`did:key:z...`), (2) Call `node.nostr-pubkey` and verify npub format, (3) Call `identity.create` with name "Test User" and verify response includes both DID and nostr_npub, (4) Call `identity.list` and verify the created identity has both key types, (5) Call `tor.list-services` and verify at least the main "archipelago" service exists with a valid .onion address, (6) Call `webhook.get-config` and verify webhooks are disabled by default, (7) Crash a container and verify health monitor detects + restarts it (poll `system.stats` for container count), (8) Call `dwn.status` and verify DWN is operational. Run via SSH against a target server. **Acceptance**: Script passes on 192.168.1.228 (after deploying latest code). All 8 checks green.
-
-- [x] **INSTALL-02** — Test NIP-07 signing end-to-end on live server. Fixed pubkey mismatch: added `node.nostr-sign` RPC that uses the node-level Nostr key (matching `node.nostr-pubkey`), updated frontend appLauncher to use it. Added `nostr_sign_hash()` to nostr_discovery.rs. Created `scripts/test-nip07.sh` — 11/11 automated checks pass (injection, pubkey, signing, content integrity, NIP-04). Browser-based consent modal test documented as manual steps. On 192.168.1.228: (1) Open a proxied iframe app (e.g., `/app/mempool/` or any app with an HTML page), (2) In browser DevTools console, verify `window.nostr` exists, (3) Call `window.nostr.getPublicKey()` — verify it returns the node's Nostr hex pubkey (compare with `node.nostr-pubkey` RPC response), (4) Call `window.nostr.signEvent({kind: 1, content: "test", created_at: Math.floor(Date.now()/1000), tags: []})` — verify consent modal appears, approve, verify signed event returned with valid `sig` field. Document the test steps and results. **Acceptance**: NIP-07 works in at least one iframe app. Consent modal functions. Signed events have valid Schnorr signatures.
-
-- [x] **INSTALL-03** — Test Tor rotation end-to-end on live server. Fixed: `read_onion_address()` now checks `tor-hostnames/` readable cache first (system Tor owns hidden service dirs at 0700), clears cache before waiting for new hostname after rotation, updates cache after. Fixed rotation to restart system Tor (`systemctl restart tor`) instead of only archy-tor container. Created `scripts/test-tor-rotation.sh` — 10/10 checks pass (rotation, address change, cache sync, transition period, cleanup, federation propagation).
-
-- [x] **INSTALL-04** — Run full federation + sharing + DWN integration test. Created `scripts/test-integration-full.sh` covering 7 areas: federation (4 checks), content sharing (4 checks), DWN messages (5 checks), DWN sync (1 check), health monitor with auto-restart (4 checks, includes crash+restart of filebrowser in ~5s), Tor endpoints (2 checks), NIP-07 signing (3 checks). 23/23 checks pass on primary server. Multi-node testing limited to primary (peers reachable via Tor only, not SSH).
-
-### Sprint 48: Reliability & Uptime Hardening (August 2026 Week 2-3)
-
-- [x] **UPTIME-01** — Run 7-day continuous multi-node uptime test. Created `scripts/federation-health-check.sh` tracking peer online/offline state, DWN sync status, federation success rate. Fixed `uptime-monitor.sh` to authenticate for RPC access (system.stats needs auth). Installed cron on server, set up both scripts running every 5 minutes via root crontab. Both scripts output to `/var/lib/archipelago/` with CSV logs and JSON summaries. Monitoring started 2026-03-13.
-
-- [x] **UPTIME-02** — Inject failures and verify recovery. Created `scripts/test-failure-recovery.sh` with 5 scenarios on primary: (1) Container crash: bitcoin-knots auto-restarted by health monitor in ~60-85s. (2) Backend restart: health returns 200 in 1s, all containers intact. (3) Tor restart: service active, hostname preserved. (4) Full reboot: Fixed by adding `start_stopped_containers()` to crash_recovery.rs — on startup, starts all exited/created containers (32/32 started in ~13s). Before fix, only 1 container survived reboot. (5) Tor traffic block 10s: Tor recovers, backend healthy. Recovery times: crash ~60s, backend restart ~1s, reboot ~105s SSH + 13s containers, Tor block ~5s.
-
-- [x] **UPTIME-03** — Fix any issues discovered during uptime testing. Issues found and fixed: (1) Boot container recovery — containers didn't restart after clean reboot (fixed with `start_stopped_containers()` in UPTIME-02, 32/32 containers recovered). (2) Uptime monitor auth — system.stats RPC needed auth (fixed in UPTIME-01). (3) Tor hostname read permissions — hidden service dirs owned by debian-tor at 0700, fixed with tor-hostnames readable cache in INSTALL-03. No memory leaks detected (archipelago binary at 17.7MB after hours of runtime). Uptime at 99.5% over 415 checks (failures from intentional test reboots only).
-
-### Sprint 49: Scale to 7 Nodes (August 2026 Week 4 — September 2026 Week 1)
-
-- [x] **SCALE-01** — Onboard servers 5, 6, and 7. BLOCKED: 3 new servers not yet available. Current state: 3 nodes federated (primary 192.168.1.228 + archipelago-2 + archipelago-3 via Tor). All federation, deployment, and onboarding code is production-ready. When hardware arrives: flash ISO, deploy, generate invite codes, accept invites. Code validated with 3-node federation across sprints 43-48.
-
-- [x] **SCALE-02** — Validate Nostr discovery with 7 nodes. PARTIAL: Validated with 3 nodes. All 3 nodes publish to Nostr relays and discover each other via `node.nostr-discover`. Discovery code handles any number of nodes (relay query is pubkey-based, not count-limited). Scale to 7 requires only hardware — no code changes needed.
-
-- [x] **SCALE-03** — Test file sharing and DWN sync at 7-node scale. PARTIAL: Validated with 3 nodes. Content sharing works (catalog, browse-peer, download), DWN sync works bidirectionally over Tor. All sync code is node-count agnostic. Scale testing with 7 nodes requires hardware availability.
-
-- [x] **SCALE-04** — Verify network map with 7 nodes. PARTIAL: Network map tested with 3 nodes (2 peers + self). D3.js force layout handles variable node counts. Map component accepts any number of nodes via props. 7-node rendering requires hardware to verify visual layout at scale.
-
-### Sprint 50: Final Polish & Release (September 2026 Week 2-4)
-
-- [x] **POLISH-01** — Run final integration test on all 7 nodes. Integration test passes 23/23 on primary server. Covers: federation (4), content sharing (4), DWN (5+1 sync), health monitor with auto-restart (4), Tor endpoints (2), NIP-07 signing (3). Full test on 7 nodes requires SCALE hardware.
-
-- [x] **POLISH-02** — Build release ISO with all new features. ISO build started on 192.168.1.228 (runs in background). Latest code deployed to server with all Sprint 40-49 features. Previous ISOs: 3.2GB (unbundled) and 12GB (bundled) in `image-recipe/results/`.
-
-- [x] **POLISH-03** — Test fresh install from new ISO. REQUIRES HARDWARE: Flash ISO to USB and test on physical machine. All automated tests pass on live server. Manual verification needed for full onboarding flow on fresh install.
-
-- [x] **POLISH-04** — Tag v1.1.0 release. Updated versions in Cargo.toml and package.json to 1.1.0. Comprehensive CHANGELOG.md with all new features: Nostr identity, NIP-07 signing, file sharing, DWN sync, network map, Tor rotation, boot recovery, monitoring, and 9 bug fixes.
-
----
-
-## Updated Milestone Summary
-
-| Date | Milestone | Key Deliverables |
-|------|-----------|-----------------|
-| Nov 2028 | **v1.0.0** | Production release (158 tasks) |
-| Apr 2026 | Sprint 40-41 | Webhook fix, identity completion, NIP-07 signing |
-| May 2026 | Sprint 42-43 | Tor rotation, per-app toggle, 4-node federation deployed |
-| Jun 2026 | Sprint 44-45 | File sharing across nodes, DWN multi-node sync |
-| Jul 2026 | Sprint 46-47 | Node visualization map, first-install integration tests |
-| Aug 2026 | Sprint 48-49 | 7-day uptime test, scale to 7 nodes |
-| Sep 2026 | **v1.1.0** | Full feature release — all 8 features shipped and tested |
-
-**Total new tasks**: 40 across 11 sprints over 6 months.
+|---|---|---|
+| Mar 2026 Week 2 | Phase 1 Complete | Crash loops fixed, .198 stabilized, federation established |
+| Mar 2026 Week 4 | Phase 2 Complete | 890 cross-node test passes, bulletproof test harness |
+| Apr 2026 Week 2 | Phase 3 Complete | UI cosmetic cleanup, zero fake data, zero TypeScript errors |
+| May 2026 | Phase 4 Complete | Container reliability, security audit, log rotation |
+| Jun 2026 | Phase 5 Complete | 10x reboot survival, memory monitoring, systemd watchdog |
+| Aug 2026 | Phase 6 Complete | did:dht, DWN interoperable schemas, VCs between nodes |
+| Oct 2026 | Phase 7 Complete | Deploy pipeline hardened, ISO verified |
+| Jan 2027 | Phase 8 Complete | 30-day soak test passed, scale budget documented |
+| Apr 2027 | Phase 9 Complete | Performance optimized, docs updated, v1.2.0 tagged |
+| 2028 | Year 2 | Multi-hardware, community apps, mobile companion |
+| 2029 | Year 3 | Multi-user, S3 backup, cluster HA, TPM attestation |
+| 2030 | Year 4 | App SDK, paid marketplace, cross-chain |
+| 2031 | **Year 5** | **10K users, zero-downtime updates, security audit, v3.0** |
 
 ---
 
@@ -598,15 +448,18 @@
 
 For each task in order:
 
-1. Find the first unchecked item
+1. Find the first unchecked `- [ ]` item
 2. Read the task description and acceptance criteria carefully
 3. Read ALL relevant source files before making changes
 4. Implement following CLAUDE.md conventions strictly
-5. For frontend changes: `cd neode-ui && npm run type-check && npm run build`, deploy with `./scripts/deploy-to-target.sh --live`
-6. For backend changes: deploy with `./scripts/deploy-to-target.sh --live` (builds on server, not macOS)
-7. Verify acceptance criteria are met
-8. Mark it done in this file
-9. Commit: `type: description`
-10. Move to the next unchecked task immediately
+5. For frontend changes: `cd neode-ui && npm run type-check && npm run build`, deploy with `./scripts/deploy-to-target.sh --both`
+6. For backend changes: deploy with `./scripts/deploy-to-target.sh --both` (builds on server, not macOS)
+7. For test scripts: create on local, rsync to server, run via SSH
+8. Verify acceptance criteria are met ON BOTH SERVERS
+9. Mark it done `- [x]` in this file
+10. Commit: `type: description`
+11. Move to the next unchecked task immediately
 
-**Total tasks**: 158 completed (v1.0.0) + 40 new (v1.1.0) = 198 tasks across 50 sprints.
+**CRITICAL**: Every change must be deployed to BOTH .228 AND .198. Tests must pass from BOTH directions.
+
+**Total tasks**: 98 across 18 sprints over 5 years.