Archipelago — open-source initial import

.gitea/workflows/build-iso.yml

@@ -1,62 +0,0 @@
-name: Build Archipelago release ISO (gated)
-
-# Resurrected from image-recipe/_archived/.gitea-workflows/build-iso-dev.yml.
-# Dispatch-only on purpose: the ISO is cut per release, not per push, and
-# the iso-builder runner is a live node — builds are deliberate events.
-on:
-  workflow_dispatch:
-
-jobs:
-  build-iso:
-    runs-on: iso-builder
-    timeout-minutes: 180
-    steps:
-      - name: Sync source to workspace
-        run: |
-          # Direct fetch + sync (actions/checkout token is broken on this Gitea)
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR" && git fetch origin main && git reset --hard origin/main
-          echo "=== Source at commit: $(git log --oneline -1) ==="
-
-      - name: Install ISO build dependencies
-        run: |
-          if dpkg -s debootstrap squashfs-tools xorriso isolinux syslinux-common mtools \
-               grub-efi-amd64-bin grub-pc-bin grub-common >/dev/null 2>&1; then
-            echo "ISO build deps already installed, skipping apt"
-          else
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq \
-              debootstrap squashfs-tools xorriso \
-              isolinux syslinux-common mtools \
-              grub-efi-amd64-bin grub-pc-bin grub-common
-          fi
-
-      - name: Build backend + frontend if stale
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR"
-          . "$HOME/.cargo/env" 2>/dev/null || true
-          VERSION=$(grep -m1 '^version' core/archipelago/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
-          if ! strings core/target/release/archipelago 2>/dev/null | grep -qF "$VERSION"; then
-            cargo build --release --manifest-path core/Cargo.toml -p archipelago
-          fi
-          if ! grep -rqoF "$VERSION" web/dist/neode-ui/assets/*.js 2>/dev/null; then
-            (cd neode-ui && npm ci && npm run build)
-          fi
-
-      - name: Gated ISO build (gates + build + smoke + qemu)
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR"
-          . "$HOME/.cargo/env" 2>/dev/null || true
-          bash scripts/build-iso-release.sh
-
-      - name: Report artifacts
-        if: always()
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          ls -lh "$REPO_DIR"/image-recipe/results/*.iso 2>/dev/null | tail -3 || echo "no ISO produced"

.github/pull_request_template.md

@@ -1,16 +1,16 @@
 ## Summary
 
-<!-- What changed and why? -->
+<!-- Brief description of what this PR does -->
 
-## Verification
+## Changes
 
-<!-- Commands run, devices tested, screenshots, or reason testing was not run. -->
+-
 
 ## Checklist
 
-- [ ] Rust formatting/clippy/tests pass when backend code changed.
-- [ ] Frontend type-check/build/tests pass when frontend code changed.
-- [ ] App manifests validate when app packaging changed.
-- [ ] Generated catalogs are updated when manifest-owned catalog fields changed.
-- [ ] Docs are updated for user-facing or developer-facing behavior changes.
-- [ ] No secrets, generated build outputs, local screenshots, or private host details are included.
+- [ ] TypeScript type-check passes (`npm run type-check`)
+- [ ] Frontend builds (`npm run build`)
+- [ ] Tests pass (`npm test`)
+- [ ] Rust clippy clean (if backend changes)
+- [ ] No new compiler warnings
+- [ ] Tested on live server

.github/workflows/ci.yml

@@ -8,11 +8,11 @@ on:
 
 env:
   RUST_VERSION: stable
-  NODE_VERSION: 20
+  NODE_VERSION: 18
 
 jobs:
   rust:
-    name: Rust
+    name: Rust (fmt + clippy + test)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -28,17 +28,17 @@ jobs:
           toolchain: ${{ env.RUST_VERSION }}
           components: rustfmt, clippy
 
-      - name: Format
+      - name: Check formatting
         run: cargo fmt --all -- --check
 
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Test
+      - name: Tests
         run: cargo test --all-features
 
   frontend:
-    name: Frontend
+    name: Frontend (type-check + lint)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -52,31 +52,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: npm
+          cache: 'npm'
           cache-dependency-path: neode-ui/package-lock.json
 
-      - name: Install
+      - name: Install dependencies
         run: npm ci
 
       - name: Type check
         run: npm run type-check
 
-      - name: Test
-        run: npm test
-
       - name: Build
         run: npm run build
-
-  manifests:
-    name: App Manifests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Validate manifests
-        run: |
-          for manifest in apps/*/manifest.yml; do
-            ./scripts/validate-app-manifest.sh --repo-audit "$manifest"
-          done

.gitignore

@@ -1,9 +1,10 @@
-# SSH keys and sandbox copies
+# SSH keys (sandbox copies)
 .ssh/
 
 # Rust build output
 target/
 **/target/
+Cargo.lock
 
 # Node.js
 node_modules/
@@ -11,6 +12,7 @@ node_modules/
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+package-lock.json
 pnpm-debug.log*
 
 # Build outputs
@@ -26,46 +28,49 @@ build/
 *.swo
 *~
 .DS_Store
-._*
-Thumbs.db
 
 # Environment and local overrides
 .env
 .env.local
 .env.*.local
-.env.production
-core/.env.production
 scripts/deploy-config.sh
 
 # Logs
 logs/
 *.log
 
+# OS
+.DS_Store
+Thumbs.db
+
 # Testing
 coverage/
 .nyc_output/
 
-# Image / release artifacts
+# Temporary files
+*.tmp
+*.temp
+
+# Build artifacts
 *.iso
 *.img
 *.dmg
 *.app
-*.apk
-*.keystore
-*.s9pk
-*.tar.gz
 
-# Release artifacts live in release attachments, not Git history.
+# Release artifacts live in Gitea Release attachments, not Git history.
 releases/**
 !releases/
 !releases/manifest.json
 
+# macOS build output
+build/macos/
+
 # Image recipe output
 image-recipe/output/
 image-recipe/*.iso
 image-recipe/*.img
 
-# Loop tool artifacts
+# Loop tool artifacts (created in every subdirectory)
 */loop/
 loop/loop/
 loop/loop.log.bak
@@ -73,17 +78,19 @@ loop/loop.log.bak
 # Separate repos nested in tree
 web/
 
-# Resilience harness reports contain session cookies.
+._*
+
+# Resilience harness reports (generated, contains session cookies)
 scripts/resilience/reports/
 
 # Codex / pnpm / python caches / editor backups
 .codex
 .codex-target-*/
 .codex-tmp/
-.claude/
 .pnpm-store/
 **/__pycache__/
 *.bak
+.claude/scheduled_tasks.lock
 
 # Local evidence screenshots; intentional UI screenshots should live under an
 # app/docs asset path with a descriptive filename.

Android/COMPANION_RELEASE.md

@@ -23,10 +23,6 @@ used by the `.githooks/pre-push` hook), which:
    **aborts** if any is missing.
 5. Stages the signed APK at `neode-ui/public/packages/archipelago-companion.apk`,
    commits, and pushes with `SHIP_COMPANION=1` (the sanctioned pre-push bypass).
-6. The first-launch companion modal and Android "Share this app" QR point at
-   `http://146.59.87.168:2100/packages/archipelago-companion.apk`. After the
-   repo artifact is built, mirror that exact APK to the VPS2-served path before
-   calling the release done.
 
 **Never** hand-roll `gradlew assembleDebug` + `cp` to the served path. That path
 skips the clean build and the signature enforcement and is exactly how a broken
@@ -86,16 +82,13 @@ home-screen app layouts wiped by an over-broad action.
 
 ## Verify the published download after shipping
 
-The checked-in artifact is Gitea raw-on-main. The QR/App Store download served
-to users is the VPS2 `:2100` URL. Confirm both live byte streams match what you
-built and signed:
+The download served to nodes is Gitea raw-on-main. Confirm the live bytes match
+what you built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-GITEA_URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
-QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
-curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
-curl -sS -o /tmp/live-qr.apk "$QR_URL"
-shasum -a 256 "$SERVED" /tmp/live-gitea.apk /tmp/live-qr.apk  # all must match
-apksigner verify -v --min-sdk-version 21 /tmp/live-qr.apk | grep -i "scheme"  # v1/v2/v3 = true
+URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
+curl -sS -o /tmp/live.apk "$URL"
+shasum -a 256 "$SERVED" /tmp/live.apk          # must match
+apksigner verify -v --min-sdk-version 21 /tmp/live.apk | grep -i "scheme"  # v1/v2/v3 = true
 ```

Android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 45
-        versionName = "0.5.25"
+        versionCode = 20
+        versionName = "0.5.0"
 
         vectorDrawables {
             useSupportLibrary = true

Android/app/src/main/AndroidManifest.xml

@@ -23,18 +23,6 @@
         android:usesCleartextTraffic="true"
         tools:targetApi="35">
 
-        <!-- Party-screen "Share this app": exposes the copied APK from
-             cache/share/ to the system share sheet, nothing else. -->
-        <provider
-            android:name="androidx.core.content.FileProvider"
-            android:authorities="${applicationId}.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-                android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/file_paths" />
-        </provider>
-
         <activity
             android:name=".MainActivity"
             android:exported="true"

Android/app/src/main/java/com/archipelago/app/data/ServerPreferences.kt

@@ -21,10 +21,6 @@ data class ServerEntry(
     val name: String = "",
     /** Node's FIPS mesh ULA (IPv6) — reachable from anywhere once meshed. */
     val meshIp: String = "",
-    /** Node's FIPS npub — the durable identity. When present it, not the
-     *  address, is what identifies the entry: FIPS peers on npubs, IPs are
-     *  only dial hints (docs/companion-pairing-qr.md, npub-first contract). */
-    val npub: String = "",
 ) {
     /** Label to show in lists — the user-given name, or the address if unnamed. */
     fun displayName(): String = name.ifBlank { address }
@@ -49,15 +45,9 @@ data class ServerEntry(
     fun toMeshUrl(): String? =
         meshIp.takeIf { it.isNotBlank() }?.let { "http://${urlHost(it)}" }
 
-    // name/meshIp/npub are trailing fields so entries saved before they
-    // existed (4/5/6 fields) still deserialize, defaulting to "".
-    fun serialize(): String = "$address|$useHttps|$port|$password|$name|$meshIp|$npub"
-
-    /** Same node as [other]? npub identity wins; address/port/scheme is the
-     *  fallback for LAN-only entries that never advertised FIPS. */
-    fun sameNode(other: ServerEntry): Boolean =
-        (npub.isNotBlank() && npub == other.npub) ||
-            (address == other.address && port == other.port && useHttps == other.useHttps)
+    // name/meshIp are trailing fields so entries saved before they existed
+    // (4/5 fields) still deserialize, defaulting to "".
+    fun serialize(): String = "$address|$useHttps|$port|$password|$name|$meshIp"
 
     companion object {
         fun deserialize(raw: String): ServerEntry? {
@@ -70,7 +60,6 @@ data class ServerEntry(
                 password = parts.getOrElse(3) { "" },
                 name = parts.getOrElse(4) { "" },
                 meshIp = parts.getOrElse(5) { "" },
-                npub = parts.getOrElse(6) { "" },
             )
         }
     }
@@ -84,7 +73,6 @@ class ServerPreferences(private val context: Context) {
     private val activePasswordKey = stringPreferencesKey("active_password")
     private val activeNameKey = stringPreferencesKey("active_name")
     private val activeMeshIpKey = stringPreferencesKey("active_mesh_ip")
-    private val activeNpubKey = stringPreferencesKey("active_npub")
     private val savedServersKey = stringSetPreferencesKey("saved_servers")
     private val introSeenKey = booleanPreferencesKey("intro_seen")
     private val gestureHintSeenKey = booleanPreferencesKey("gesture_hint_seen")
@@ -98,7 +86,6 @@ class ServerPreferences(private val context: Context) {
             password = prefs[activePasswordKey] ?: "",
             name = prefs[activeNameKey] ?: "",
             meshIp = prefs[activeMeshIpKey] ?: "",
-            npub = prefs[activeNpubKey] ?: "",
         )
     }
 
@@ -124,7 +111,6 @@ class ServerPreferences(private val context: Context) {
             prefs[activePasswordKey] = server.password
             prefs[activeNameKey] = server.name
             prefs[activeMeshIpKey] = server.meshIp
-            prefs[activeNpubKey] = server.npub
         }
         addSavedServer(server)
     }
@@ -137,7 +123,6 @@ class ServerPreferences(private val context: Context) {
             prefs.remove(activePasswordKey)
             prefs.remove(activeNameKey)
             prefs.remove(activeMeshIpKey)
-            prefs.remove(activeNpubKey)
         }
     }
 
@@ -149,66 +134,65 @@ class ServerPreferences(private val context: Context) {
     }
 
     /**
-     * Replace a saved server in place. Matches the existing entry by node
-     * identity — npub first, address/port/scheme as the LAN-only fallback
-     * (ServerEntry.sameNode) — so edits that change the name, password or even
-     * every address still update the right record. An edit form that doesn't
-     * carry the npub keeps the stored one. If the edited server is also the
-     * active one, the active record is kept in sync.
+     * Replace a saved server in place. Matches the existing entry by connection
+     * identity (address/port/scheme) so edits that change the name or password —
+     * or that touch a legacy 4-field entry — still update the right record. If the
+     * edited server is also the active one, the active record is kept in sync.
      */
     suspend fun updateSavedServer(original: ServerEntry, updated: ServerEntry) {
-        val toStore = updated.copy(npub = updated.npub.ifBlank { original.npub })
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
             val filtered = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(original) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == original.address &&
+                    e.port == original.port &&
+                    e.useHttps == original.useHttps
             }.toSet()
-            prefs[savedServersKey] = filtered + toStore.serialize()
+            prefs[savedServersKey] = filtered + updated.serialize()
 
-            val activeNpub = prefs[activeNpubKey] ?: ""
-            val isActive = (activeNpub.isNotBlank() && activeNpub == original.npub) ||
-                (
-                    prefs[activeAddressKey] == original.address &&
-                        (prefs[activePortKey] ?: "") == original.port &&
-                        (prefs[activeHttpsKey] ?: false) == original.useHttps
-                    )
+            val isActive = prefs[activeAddressKey] == original.address &&
+                (prefs[activePortKey] ?: "") == original.port &&
+                (prefs[activeHttpsKey] ?: false) == original.useHttps
             if (isActive) {
-                prefs[activeAddressKey] = toStore.address
-                prefs[activeHttpsKey] = toStore.useHttps
-                prefs[activePortKey] = toStore.port
-                prefs[activePasswordKey] = toStore.password
-                prefs[activeNameKey] = toStore.name
-                prefs[activeMeshIpKey] = toStore.meshIp
-                prefs[activeNpubKey] = toStore.npub
+                prefs[activeAddressKey] = updated.address
+                prefs[activeHttpsKey] = updated.useHttps
+                prefs[activePortKey] = updated.port
+                prefs[activePasswordKey] = updated.password
+                prefs[activeNameKey] = updated.name
+                prefs[activeMeshIpKey] = updated.meshIp
             }
         }
     }
 
     /**
-     * Add a server, or update the entry for the same node — npub first,
-     * address/port/scheme as the LAN-only fallback (ServerEntry.sameNode) —
-     * used by QR pairing so re-scanning a node never duplicates it, even after
-     * the LAN renumbered and every address changed (npub-first contract in
-     * docs/companion-pairing-qr.md). A blank incoming password/name keeps the
-     * stored value (a real node's QR never carries the password). Returns the
-     * merged entry.
+     * Add a server, or update the entry with the same connection identity
+     * (address/port/scheme) — used by QR pairing so re-scanning a node never
+     * duplicates it. A blank incoming password/name keeps the stored value
+     * (a real node's QR never carries the password). Returns the merged entry.
      */
     suspend fun upsertServer(server: ServerEntry): ServerEntry {
         var merged = server
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            val existing = current.mapNotNull { ServerEntry.deserialize(it) }
-                .firstOrNull { it.sameNode(server) }
+            val existing = current.mapNotNull { ServerEntry.deserialize(it) }.firstOrNull {
+                it.address == server.address &&
+                    it.port == server.port &&
+                    it.useHttps == server.useHttps
+            }
             if (existing != null) {
                 merged = server.copy(
                     password = server.password.ifBlank { existing.password },
                     name = server.name.ifBlank { existing.name },
                     meshIp = server.meshIp.ifBlank { existing.meshIp },
-                    npub = server.npub.ifBlank { existing.npub },
                 )
             }
             val filtered = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(merged) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == server.address &&
+                    e.port == server.port &&
+                    e.useHttps == server.useHttps
             }.toSet()
             prefs[savedServersKey] = filtered + merged.serialize()
         }
@@ -218,11 +202,15 @@ class ServerPreferences(private val context: Context) {
     suspend fun removeSavedServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            // Match by node identity (npub, else address/port/scheme) rather
-            // than the exact serialized string, so a rename — or a legacy
-            // short-format entry — still removes the right record.
+            // Match by connection identity (address/port/scheme) rather than the
+            // exact serialized string, so a rename — or the legacy 4-field format
+            // saved before names existed — still removes the right entry.
             prefs[savedServersKey] = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(server) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == server.address &&
+                    e.port == server.port &&
+                    e.useHttps == server.useHttps
             }.toSet()
         }
     }

Android/app/src/main/java/com/archipelago/app/data/ServerQrParser.kt

@@ -78,9 +78,6 @@ object ServerQrParser {
                 password = credential,
                 name = uri.getQueryParameter("name") ?: "",
                 meshIp = fips?.ula ?: "",
-                // npub is the durable identity — saved-server upserts match on
-                // it, so re-scanning after a LAN renumber updates in place.
-                npub = fips?.npub ?: "",
             ),
             fips = fips,
         )
@@ -88,18 +85,8 @@ object ServerQrParser {
 
     private fun parseFips(uri: Uri): FipsPairInfo? {
         val npub = uri.getQueryParameter("fnpub")?.trim()
-        var host = uri.getQueryParameter("fhost")?.trim()
+        val host = uri.getQueryParameter("fhost")?.trim()
         if (npub.isNullOrBlank() || host.isNullOrBlank()) return null
-        // A .fips fhost is a dead dial hint: Android's system DNS can't
-        // resolve .fips, so every handshake send fails and first connect
-        // falls back to slow anchor discovery. If the QR's `url` host is a
-        // real address, dial that instead (QRs minted while the node UI was
-        // browsed over the mesh carry npub….fips here).
-        if (host.endsWith(".fips")) {
-            val urlHost = uri.getQueryParameter("url")
-                ?.let { runCatching { Uri.parse(it).host }.getOrNull() }
-            if (!urlHost.isNullOrBlank() && !urlHost.endsWith(".fips")) host = urlHost
-        }
         return FipsPairInfo(
             npub = npub,
             ula = uri.getQueryParameter("fip")?.trim().orEmpty(),

Android/app/src/main/java/com/archipelago/app/fips/ArchyVpnService.kt

@@ -5,24 +5,15 @@ import android.app.NotificationChannel
 import android.app.NotificationManager
 import android.app.PendingIntent
 import android.content.Intent
-import android.net.ConnectivityManager
-import android.net.Network
-import android.net.NetworkCapabilities
-import android.net.NetworkRequest
 import android.net.VpnService
 import android.os.Build
 import android.util.Log
 import com.archipelago.app.MainActivity
 import com.archipelago.app.R
-import com.archipelago.app.data.ServerPreferences
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
 
 /**
@@ -36,21 +27,6 @@ import kotlinx.coroutines.launch
 class ArchyVpnService : VpnService() {
 
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-    private var warmerJob: Job? = null
-
-    // Seamless transport handoff (Wi-Fi ⇄ 5G ⇄ future BLE). Without this the
-    // tunnel's underlying network stays pinned to the interface that was
-    // default when the VPN came up; when the phone leaves Wi-Fi for 5G the
-    // mesh sockets ride a dead network and sessions never recover until the
-    // app is restarted (user-reported 2026-07-27). The callback (a) re-pins
-    // the tunnel to the new default network via setUnderlyingNetworks and
-    // (b) forces an immediate mesh re-home so discovery + sessions rebuild
-    // on the new path within seconds instead of waiting out dead-link
-    // timeouts.
-    private var connectivityManager: ConnectivityManager? = null
-    private var networkCallback: ConnectivityManager.NetworkCallback? = null
-    @Volatile
-    private var currentUnderlying: Network? = null
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
         if (intent?.action == ACTION_STOP) {
@@ -69,27 +45,13 @@ class ArchyVpnService : VpnService() {
         }
         val prefs = FipsPreferences(this)
         val identity = FipsManager.ensureIdentity(prefs)
-        val peersJson = prefs.combinedPeersJson()
+        val peersJson = prefs.peersJson()
         if (identity == null || peersJson == "[]") {
             Log.w(TAG, "mesh not configured — stopping")
             shutdown()
             return
         }
-        // Party mode: fixed inbound UDP bind so a nearby phone can dial us
-        // directly over a shared LAN/hotspot (no internet required).
-        val listenPort = if (prefs.partyListen()) PartyQr.PARTY_UDP_PORT else 0
 
-        // A fresh app open re-triggers the service. Tearing a HEALTHY mesh
-        // down to rebuild it costs ~8s of anchor+session bring-up on every
-        // launch (observed live: stop 00:34:38 → session back 00:34:49) and
-        // is what made "freshly loading the app" slow. Keep a running node;
-        // restart only when it's dead or a pairing changed the peer set.
-        if (FipsNative.isRunning() && !FipsManager.peersDirty) {
-            Log.i(TAG, "mesh already running — keeping warm sessions")
-            startSessionWarmer()
-            return
-        }
-        FipsManager.peersDirty = false
         // Re-establishing while running would strand the old fd; restart clean.
         if (FipsNative.isRunning()) FipsNative.stop()
 
@@ -99,21 +61,6 @@ class ArchyVpnService : VpnService() {
                 .setMtu(1280)
                 .addAddress(identity.address, 128)
                 .addRoute("fd00::", 8)
-                // The TUN is IPv6-only. Android blocks every address family
-                // the VPN has no address for — without this, bringing the
-                // mesh up cut ALL of the phone's IPv4 internet.
-                .allowFamily(android.system.OsConstants.AF_INET)
-                // And let apps that bind their own network skip the TUN
-                // entirely — this is mesh reachability, not a privacy VPN.
-                .allowBypass()
-                .apply {
-                    // Android 10+ treats VPN networks as METERED by default,
-                    // which flips the whole phone into data-saver behaviour
-                    // (background sync off, "metered" warnings) while the
-                    // mesh is up. It inherits the underlying network's real
-                    // metered state instead.
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) setMetered(false)
-                }
                 .establish()
         } catch (e: Exception) {
             Log.e(TAG, "VPN establish failed", e)
@@ -125,160 +72,18 @@ class ArchyVpnService : VpnService() {
         }
 
         val fd = pfd.detachFd()
-        val result = FipsNative.start(identity.secret, peersJson, fd, listenPort)
-        Log.i(TAG, "mesh start: $result (listen=$listenPort)")
-        if (result.contains("\"error\"")) {
-            shutdown()
-        } else {
-            startSessionWarmer()
-            registerNetworkHandoff()
-            // Phone-to-phone chat/beam + the phone's own mesh-served page.
-            FlareServer.start(this, identity.address, identity.npub, prefs.partyName())
-            // Mutual pairing: when a phone that scanned OUR QR announces
-            // itself, store it as a party peer and re-run the mesh config so
-            // this side gets the peer + chat entry without scanning back.
-            FlareServer.onHello = { peer ->
-                scope.launch {
-                    prefs.upsertPartyPeer(peer)
-                    FipsManager.requestMeshRestart(this@ArchyVpnService)
-                }
-            }
-        }
-    }
-
-    /**
-     * Pre-warm + keep-warm mesh sessions to every known node ULA.
-     *
-     * Discovery + first session through the public tree can take 15s+
-     * (HANDOFF-2026-07-23 node diagnosis) — paying that cost here, the
-     * moment the tunnel is up, means the connect probe and WebView hit an
-     * established session instead of timing out on a cold one. The periodic
-     * touch afterwards keeps the session from idling out. Failed connects
-     * are expected and cheap; the attempt itself is what drives discovery.
-     */
-    private fun startSessionWarmer() {
-        warmerJob?.cancel()
-        warmerJob = scope.launch {
-            val prefs = ServerPreferences(this@ArchyVpnService)
-            val fipsPrefs = FipsPreferences(this@ArchyVpnService)
-            var round = 0
-            while (isActive && FipsNative.isRunning()) {
-                val targets = try {
-                    prefs.savedServers.first()
-                        .mapNotNull { it.meshIp.ifBlank { null } }
-                        .map { it to 80 } +
-                        // Party phones answer on the flare port, not :80.
-                        fipsPrefs.partyPeers().map { it.ula to PartyQr.FLARE_PORT }
-                } catch (_: Exception) {
-                    emptyList()
-                }.distinct()
-                if (round == 0) Log.i(TAG, "session warmer: ${targets.map { it.first }}")
-                // Probe all targets CONCURRENTLY with a short timeout — the
-                // old sequential 20s-per-target loop let one cold node starve
-                // every other target for the whole aggressive window.
-                targets.map { (ula, port) ->
-                    launch {
-                        try {
-                            java.net.Socket().use { s ->
-                                s.connect(
-                                    java.net.InetSocketAddress(
-                                        java.net.InetAddress.getByName(ula),
-                                        port,
-                                    ),
-                                    5_000,
-                                )
-                            }
-                        } catch (_: Exception) {
-                            // Cold path / node away — the attempt still drove
-                            // session establishment; try again next round.
-                        }
-                    }
-                }.forEach { it.join() }
-                round++
-                // Aggressive for the first ~minute (session bring-up), then a
-                // slow keep-warm tick that costs nearly nothing.
-                delay(if (round < 12) 5_000 else 60_000)
-            }
-        }
-    }
-
-    /**
-     * Track the phone's default network and hand the mesh over to it as the
-     * phone roams (Wi-Fi ⇄ 5G, and later BLE). Two actions per change:
-     *  1. setUnderlyingNetworks(new) — the tunnel's packets follow the live
-     *     network instead of dying on the one it launched with.
-     *  2. re-home the mesh — kick the session warmer so discovery + sessions
-     *     rebuild on the new path immediately; the node's own fast-reconnect
-     *     (1s) redials peers over the new route.
-     * onAvailable also fires for the FIRST network, which is how the initial
-     * underlying network gets set.
-     */
-    private fun registerNetworkHandoff() {
-        if (networkCallback != null) return
-        val cm = getSystemService(ConnectivityManager::class.java) ?: return
-        connectivityManager = cm
-        val request = NetworkRequest.Builder()
-            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-            .build()
-        val cb = object : ConnectivityManager.NetworkCallback() {
-            override fun onAvailable(network: Network) {
-                handoffTo(network)
-            }
-
-            override fun onLost(network: Network) {
-                // The lost network was our underlying one — clear the pin so
-                // the system falls back to whatever default remains; the next
-                // onAvailable re-pins explicitly.
-                if (network == currentUnderlying) {
-                    currentUnderlying = null
-                    runCatching { setUnderlyingNetworks(null) }
-                }
-            }
-        }
-        networkCallback = cb
-        // requestNetwork tracks the BEST network of the request; when the
-        // phone moves Wi-Fi→5G the callback re-fires onAvailable with the new
-        // one. (registerDefaultNetworkCallback would also work; requestNetwork
-        // lets us extend to BLE-capable transports later.)
-        runCatching { cm.requestNetwork(request, cb) }
-    }
-
-    private fun handoffTo(network: Network) {
-        val changed = network != currentUnderlying
-        currentUnderlying = network
-        // Always re-assert; cheap and covers capability changes on the same
-        // Network object.
-        runCatching { setUnderlyingNetworks(arrayOf(network)) }
-        if (changed && FipsNative.isRunning()) {
-            Log.i(TAG, "network handoff → re-homing mesh on new default network")
-            // Fresh warmer pass drives immediate rediscovery/session rebuild
-            // on the new path instead of waiting out dead-link timeouts.
-            startSessionWarmer()
-        }
-    }
-
-    private fun unregisterNetworkHandoff() {
-        val cm = connectivityManager
-        val cb = networkCallback
-        if (cm != null && cb != null) {
-            runCatching { cm.unregisterNetworkCallback(cb) }
-        }
-        networkCallback = null
-        connectivityManager = null
-        currentUnderlying = null
+        val result = FipsNative.start(identity.secret, peersJson, fd)
+        Log.i(TAG, "mesh start: $result")
+        if (result.contains("\"error\"")) shutdown()
     }
 
     private fun shutdown() {
-        warmerJob?.cancel()
-        unregisterNetworkHandoff()
-        FlareServer.stop()
         FipsNative.stop()
         stopForeground(STOP_FOREGROUND_REMOVE)
         stopSelf()
     }
 
     override fun onDestroy() {
-        unregisterNetworkHandoff()
         FipsNative.stop()
         scope.cancel()
         super.onDestroy()

Android/app/src/main/java/com/archipelago/app/fips/FipsManager.kt

@@ -21,12 +21,6 @@ object FipsManager {
     private val _consentNeeded = MutableStateFlow(false)
     val consentNeeded: StateFlow<Boolean> = _consentNeeded
 
-    /** True after a pairing changed the peer set while the node was running —
-     *  tells the service a restart is genuinely needed (the ONLY case; a
-     *  routine app open must keep the warm mesh, not rebuild it). */
-    @Volatile
-    var peersDirty: Boolean = false
-
     fun consentHandled() {
         _consentNeeded.value = false
     }
@@ -40,16 +34,7 @@ object FipsManager {
         val prefs = FipsPreferences(context)
         ensureIdentity(prefs)
         prefs.upsertNodePeer(info, alias)
-        peersDirty = true
-        // Restart the mesh with the new peer RIGHT NOW when consent already
-        // exists — relying on the consentNeeded collector left a running
-        // mesh on the OLD peer list whenever the collector wasn't active
-        // (fresh pairings looked dead until a full app restart).
-        if (VpnService.prepare(context) == null) {
-            startService(context)
-        } else {
-            _consentNeeded.value = true
-        }
+        _consentNeeded.value = true
     }
 
     /** Generate-once mesh identity. Returns null only if the RNG/native fails. */
@@ -79,22 +64,6 @@ object FipsManager {
         context.startForegroundService(intent)
     }
 
-    /**
-     * Re-run the mesh with current prefs (party listen toggled, peer added).
-     * Marks the peer set dirty so startMesh genuinely restarts the node —
-     * otherwise the keep-warm fast path would skip the new config.
-     * First-timers go through the consent flow.
-     */
-    fun requestMeshRestart(context: Context) {
-        if (!FipsNative.available) return
-        peersDirty = true
-        if (VpnService.prepare(context) == null) {
-            startService(context)
-        } else {
-            _consentNeeded.value = true
-        }
-    }
-
     fun stopService(context: Context) {
         val intent = Intent(context, ArchyVpnService::class.java)
             .setAction(ArchyVpnService.ACTION_STOP)

Android/app/src/main/java/com/archipelago/app/fips/FipsNative.kt

@@ -21,13 +21,7 @@ object FipsNative {
 
     external fun generateIdentity(): String
     external fun deriveIdentity(secret: String): String
-
-    /**
-     * [listenPort] 0 = outbound-only (default posture). Non-zero binds UDP on
-     * that port so a nearby phone can dial us directly (party mode); the node
-     * stays leaf-only either way.
-     */
-    external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String
+    external fun start(secret: String, peersJson: String, tunFd: Int): String
     external fun stop()
     external fun isRunning(): Boolean
     external fun statusJson(): String

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -3,48 +3,15 @@ package com.archipelago.app.fips
 import android.content.Context
 import androidx.datastore.core.DataStore
 import androidx.datastore.preferences.core.Preferences
-import androidx.datastore.preferences.core.booleanPreferencesKey
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
-import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
 import org.json.JSONArray
 import org.json.JSONObject
 import androidx.datastore.preferences.preferencesDataStore
 
 private val Context.fipsDataStore: DataStore<Preferences> by preferencesDataStore(name = "fips_prefs")
 
-// Archipelago-operated public anchor (vps2). Baked in so EVERY pairing yields
-// both paths — direct LAN p2p to the node AND a public rendezvous for
-// away-from-home — even when the scanned node is old enough that its QR
-// carries no fanchors. Keep in lockstep with
-// core/archipelago/src/fips/anchors.rs (ARCHY_ANCHOR_*).
-internal const val ARCHY_ANCHOR_NPUB =
-    "npub1dptaktwxv0mm245g2lqjykwm5ll0jpc6m3r4242ydfa9z7qe6urs3jvrak"
-internal const val ARCHY_ANCHOR_ADDR = "146.59.87.168:8444"
-internal const val ARCHY_ANCHOR_TRANSPORT = "tcp"
-
-/**
- * Public FIPS network anchors (join.fips.network — the dual-transport TCP
- * pair; keep in lockstep with core/archipelago/src/fips/anchors.rs
- * fips_network_anchors()). Baked into every pairing at trailing priority so
- * a degraded/unreachable vps2 anchor can never strand the phone: the mesh
- * still joins the public tree and routes to the node through it.
- */
-internal val PUBLIC_FIPS_ANCHORS = listOf(
-    Triple(
-        "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u",
-        "23.182.128.74:443",
-        "tcp",
-    ),
-    Triple(
-        "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98",
-        "217.77.8.91:443",
-        "tcp",
-    ),
-)
-
 /**
  * Mesh identity + known node peers. Follows the same plaintext-DataStore
  * storage model as ServerPreferences (the server password lives there the
@@ -57,12 +24,6 @@ class FipsPreferences(private val context: Context) {
     private val addressKey = stringPreferencesKey("fips_address")
     /** JSON array of node peers in fips PeerConfig shape (see NodePeer). */
     private val peersKey = stringPreferencesKey("fips_node_peers")
-    /** JSON array of phone party peers (PartyPeer shape, NOT PeerConfig). */
-    private val partyPeersKey = stringPreferencesKey("fips_party_peers")
-    /** Party mode: accept a direct inbound mesh link (UDP 2121). */
-    private val partyListenKey = booleanPreferencesKey("fips_party_listen")
-    /** Name shown in this phone's party QR and outgoing flares. */
-    private val partyNameKey = stringPreferencesKey("fips_party_name")
 
     suspend fun identity(): FipsNative.Identity? {
         val prefs = context.fipsDataStore.data.first()
@@ -89,157 +50,6 @@ class FipsPreferences(private val context: Context) {
 
     suspend fun hasPeers(): Boolean = JSONArray(peersJson()).length() > 0
 
-    // ── Mesh Party (phone↔phone) ────────────────────────────────────────────
-
-    suspend fun partyListen(): Boolean =
-        context.fipsDataStore.data.first()[partyListenKey] ?: false
-
-    val partyListenFlow: Flow<Boolean>
-        get() = context.fipsDataStore.data.map { it[partyListenKey] ?: false }
-
-    suspend fun setPartyListen(enabled: Boolean) {
-        context.fipsDataStore.edit { it[partyListenKey] = enabled }
-    }
-
-    suspend fun partyName(): String =
-        context.fipsDataStore.data.first()[partyNameKey]
-            ?: android.os.Build.MODEL.orEmpty().ifBlank { "Phone" }
-
-    suspend fun setPartyName(name: String) {
-        context.fipsDataStore.edit { it[partyNameKey] = name.trim() }
-    }
-
-    val partyPeersFlow: Flow<List<PartyPeer>>
-        get() = context.fipsDataStore.data.map { parsePartyPeers(it[partyPeersKey] ?: "[]") }
-
-    suspend fun partyPeers(): List<PartyPeer> =
-        parsePartyPeers(context.fipsDataStore.data.first()[partyPeersKey] ?: "[]")
-
-    /** Matched by npub, so re-scanning updates the direct-dial address in place. */
-    suspend fun upsertPartyPeer(peer: PartyPeer) {
-        context.fipsDataStore.edit { prefs ->
-            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != peer.npub }
-            prefs[partyPeersKey] = toJson(kept + peer)
-        }
-    }
-
-    suspend fun removePartyPeer(npub: String) {
-        context.fipsDataStore.edit { prefs ->
-            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != npub }
-            prefs[partyPeersKey] = toJson(kept)
-        }
-    }
-
-    /**
-     * Node peers + direct-dial party peers, in the fips PeerConfig JSON the
-     * Rust node deserializes. Party peers get the best priority: on a shared
-     * LAN/hotspot the direct link beats every anchor path, and while off-LAN
-     * the failed dial is cheap (auto-reconnect keeps retrying, which is
-     * exactly what makes the link snap up the moment both phones share WiFi).
-     * Party peers without an underlay address are mesh-routed and need no
-     * entry here at all.
-     */
-    suspend fun combinedPeersJson(): String {
-        val merged = JSONArray(peersJson())
-        val party = partyPeers()
-        for (peer in party) {
-            if (peer.ip.isBlank() || peer.port <= 0) continue
-            merged.put(JSONObject().apply {
-                put("npub", peer.npub)
-                put("alias", hostSafeAlias(peer.name.ifBlank { "party-phone" }))
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", "udp")
-                    put("addr", "${peer.ip}:${peer.port}")
-                    put("priority", 5)
-                }))
-            })
-        }
-        // A party-only phone (never paired with a node) still needs a public
-        // rendezvous to reach its peers ACROSS the internet — without it, two
-        // bare phones would be hotspot/LAN-only. Node pairing normally bakes
-        // this anchor in; do the same when there are party peers.
-        if (party.isNotEmpty() &&
-            (0 until merged.length()).none {
-                merged.optJSONObject(it)?.optString("npub") == ARCHY_ANCHOR_NPUB
-            }
-        ) {
-            merged.put(JSONObject().apply {
-                put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "archipelago-anchor")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", ARCHY_ANCHOR_TRANSPORT)
-                    put("addr", ARCHY_ANCHOR_ADDR)
-                    put("priority", 40)
-                }))
-            })
-        }
-        // Backfill anchor peers for entries paired before newer QR/app
-        // releases added them. `upsertNodePeer` persists these on re-scan, but
-        // startup must also self-heal old DataStore state so updating the APK is
-        // enough to get off-LAN redundancy.
-        if (merged.length() > 0) {
-            addAnchorIfMissing(merged, ARCHY_ANCHOR_NPUB, "archipelago-anchor", ARCHY_ANCHOR_ADDR, ARCHY_ANCHOR_TRANSPORT, 40)
-            for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
-                val (npub, addr, transport) = anchor
-                addAnchorIfMissing(merged, npub, "fips-network-anchor-${i + 1}", addr, transport, 50 + i * 10)
-            }
-        }
-        return merged.toString()
-    }
-
-    private fun addAnchorIfMissing(
-        peers: JSONArray,
-        npub: String,
-        alias: String,
-        addr: String,
-        transport: String,
-        priority: Int,
-    ) {
-        if ((0 until peers.length()).any { peers.optJSONObject(it)?.optString("npub") == npub }) return
-        peers.put(JSONObject().apply {
-            put("npub", npub)
-            put("alias", alias)
-            put("addresses", JSONArray().put(JSONObject().apply {
-                put("transport", transport)
-                put("addr", addr)
-                put("priority", priority)
-            }))
-        })
-    }
-
-    private fun parsePartyPeers(json: String): List<PartyPeer> = try {
-        val arr = JSONArray(json)
-        (0 until arr.length()).mapNotNull { i ->
-            val o = arr.optJSONObject(i) ?: return@mapNotNull null
-            val npub = o.optString("npub")
-            val ula = o.optString("ula")
-            if (npub.isBlank() || ula.isBlank()) return@mapNotNull null
-            PartyPeer(
-                npub = npub,
-                ula = ula,
-                name = o.optString("name").ifBlank { "Phone" },
-                ip = o.optString("ip"),
-                port = o.optInt("port"),
-            )
-        }
-    } catch (_: Exception) {
-        emptyList()
-    }
-
-    private fun toJson(peers: List<PartyPeer>): String {
-        val arr = JSONArray()
-        for (p in peers) {
-            arr.put(JSONObject().apply {
-                put("npub", p.npub)
-                put("ula", p.ula)
-                put("name", p.name)
-                put("ip", p.ip)
-                put("port", p.port)
-            })
-        }
-        return arr.toString()
-    }
-
     /**
      * Add or update the node peer plus its rendezvous anchors (each matched
      * by npub, so re-pairing updates addresses instead of duplicating).
@@ -251,19 +61,16 @@ class FipsPreferences(private val context: Context) {
         val incoming = mutableListOf<JSONObject>()
         incoming += JSONObject().apply {
             put("npub", info.npub)
-            put("alias", hostSafeAlias(alias.ifBlank { "Archipelago" }))
+            put("alias", alias.ifBlank { "Archipelago" })
             val addresses = JSONArray()
-            // .fips hosts are unresolvable on Android (no system .fips DNS):
-            // storing one gives the mesh a dial target that fails every
-            // handshake and stalls first connect on anchor discovery.
-            if (info.udpPort > 0 && !info.host.endsWith(".fips")) {
+            if (info.udpPort > 0) {
                 addresses.put(JSONObject().apply {
                     put("transport", "udp")
                     put("addr", "${info.host}:${info.udpPort}")
                     put("priority", 10)
                 })
             }
-            if (info.tcpPort > 0 && !info.host.endsWith(".fips")) {
+            if (info.tcpPort > 0) {
                 addresses.put(JSONObject().apply {
                     put("transport", "tcp")
                     put("addr", "${info.host}:${info.tcpPort}")
@@ -274,10 +81,9 @@ class FipsPreferences(private val context: Context) {
         }
         for (anchor in info.anchors) {
             if (anchor.npub == info.npub) continue
-            if (anchor.addr.substringBeforeLast(":").endsWith(".fips")) continue
             incoming += JSONObject().apply {
                 put("npub", anchor.npub)
-                put("alias", "mesh-anchor")
+                put("alias", "Mesh anchor")
                 put("addresses", JSONArray().put(JSONObject().apply {
                     put("transport", anchor.transport)
                     put("addr", anchor.addr)
@@ -285,36 +91,6 @@ class FipsPreferences(private val context: Context) {
                 }))
             }
         }
-        // Guarantee the public anchor: without it, a QR from an older node
-        // leaves the phone LAN-only and pairing/connecting dies off-LAN.
-        if (info.npub != ARCHY_ANCHOR_NPUB &&
-            incoming.none { it.optString("npub") == ARCHY_ANCHOR_NPUB }
-        ) {
-            incoming += JSONObject().apply {
-                put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "archipelago-anchor")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", ARCHY_ANCHOR_TRANSPORT)
-                    put("addr", ARCHY_ANCHOR_ADDR)
-                    put("priority", 40)
-                }))
-            }
-        }
-        // And the public FIPS network anchors at trailing priority, so one
-        // degraded rendezvous (vps2, 2026-07-24) can never strand the phone.
-        for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
-            val (npub, addr, transport) = anchor
-            if (info.npub == npub || incoming.any { it.optString("npub") == npub }) continue
-            incoming += JSONObject().apply {
-                put("npub", npub)
-                put("alias", "fips-network-anchor-${i + 1}")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", transport)
-                    put("addr", addr)
-                    put("priority", 50 + i * 10)
-                }))
-            }
-        }
         val incomingNpubs = incoming.map { it.optString("npub") }.toSet()
         context.fipsDataStore.edit { prefs ->
             val current = JSONArray(prefs[peersKey] ?: "[]")
@@ -328,14 +104,3 @@ class FipsPreferences(private val context: Context) {
         }
     }
 }
-
-/**
- * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
- * that isn't a valid DNS label ("Framework PT" — the space) gets rejected and
- * silently drops the peer from name resolution. Slug it instead of losing it.
- */
-internal fun hostSafeAlias(alias: String): String =
-    alias.lowercase()
-        .replace(Regex("[^a-z0-9.-]+"), "-")
-        .trim('-', '.')
-        .ifBlank { "archipelago" }

Android/app/src/main/java/com/archipelago/app/fips/FlareServer.kt

@@ -1,398 +0,0 @@
-package com.archipelago.app.fips
-
-import android.content.Context
-import android.util.Log
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.RequestBody.Companion.toRequestBody
-import org.json.JSONObject
-import java.io.BufferedInputStream
-import java.io.File
-import java.io.InputStream
-import java.net.InetAddress
-import java.net.InetSocketAddress
-import java.net.ServerSocket
-import java.net.Socket
-import java.util.UUID
-import java.util.concurrent.ExecutorService
-import java.util.concurrent.Executors
-import java.util.concurrent.TimeUnit
-
-/** One chat/photo message in a party conversation, keyed by the peer's npub. */
-data class FlareMessage(
-    val id: String,
-    val peerNpub: String,
-    val fromMe: Boolean,
-    val name: String,
-    val text: String = "",
-    val photoPath: String = "",
-    val ts: Long,
-    val status: Status = Status.RECEIVED,
-) {
-    enum class Status { SENDING, SENT, FAILED, RECEIVED }
-}
-
-/** In-memory conversation store (demo scope — nothing persists across restarts). */
-object FlareStore {
-    private val _messages = MutableStateFlow<List<FlareMessage>>(emptyList())
-    val messages: StateFlow<List<FlareMessage>> = _messages
-
-    fun add(message: FlareMessage) {
-        _messages.value = _messages.value + message
-    }
-
-    fun setStatus(id: String, status: FlareMessage.Status) {
-        _messages.value = _messages.value.map { if (it.id == id) it.copy(status = status) else it }
-    }
-}
-
-/**
- * Minimal HTTP listener bound ONLY on this phone's mesh ULA — plain HTTP is
- * fine there because FIPS is the encryption + peer-identity layer (same
- * stance as the node's ULA-only peer listener). This is what makes the phone
- * a *server* on the mesh: another phone (or `curl -6` from any mesh node)
- * reaches it by npub-derived address with no port forwarding, DNS, or CA.
- *
- * FIPS authenticates the node, not the request (project doctrine), so inputs
- * are still validated at this boundary: size caps, JSON shape, no
- * client-controlled paths.
- */
-object FlareServer {
-    private const val TAG = "FlareServer"
-    private const val MAX_PHOTO_BYTES = 8 * 1024 * 1024
-    private const val MAX_TEXT_CHARS = 4_000
-    private const val MAX_HEADER_BYTES = 16 * 1024
-
-    private var socket: ServerSocket? = null
-    private var pool: ExecutorService? = null
-    @Volatile private var identityName = "Phone"
-    @Volatile private var identityNpub = ""
-    @Volatile private var photoDir: File? = null
-
-    /** Invoked when a peer announces itself (POST /hello) — pairing used to
-     *  be one-way: only the SCANNING phone learned the other side, so the
-     *  scanned phone had no peer, no chat entry, no way in. The VPN service
-     *  wires this to upsert the peer + restart the mesh config. */
-    @Volatile var onHello: ((PartyPeer) -> Unit)? = null
-
-    @Synchronized
-    fun start(context: Context, ula: String, myNpub: String, myName: String) {
-        stop()
-        identityNpub = myNpub
-        identityName = myName
-        photoDir = File(context.cacheDir, "flare").apply { mkdirs() }
-        val pool = Executors.newCachedThreadPool().also { this.pool = it }
-        pool.execute {
-            try {
-                val server = ServerSocket().apply {
-                    reuseAddress = true
-                    bind(InetSocketAddress(InetAddress.getByName(ula), PartyQr.FLARE_PORT))
-                }
-                socket = server
-                Log.i(TAG, "flare listening on [$ula]:${PartyQr.FLARE_PORT}")
-                while (!server.isClosed) {
-                    val client = try {
-                        server.accept()
-                    } catch (_: Exception) {
-                        break
-                    }
-                    pool.execute { handle(client) }
-                }
-            } catch (e: Exception) {
-                Log.e(TAG, "flare server died: $e")
-            }
-        }
-    }
-
-    @Synchronized
-    fun stop() {
-        try {
-            socket?.close()
-        } catch (_: Exception) {
-        }
-        socket = null
-        pool?.shutdownNow()
-        pool = null
-    }
-
-    private fun handle(client: Socket) {
-        client.use { sock ->
-            sock.soTimeout = 30_000
-            try {
-                val input = BufferedInputStream(sock.getInputStream())
-                val requestLine = readLine(input) ?: return
-                val parts = requestLine.trim().split(" ")
-                if (parts.size < 2) return respond(sock, 400, json("bad_request"))
-                val (method, path) = parts[0] to parts[1]
-
-                var contentLength = 0
-                var from = ""
-                var fromName = ""
-                var headerBytes = requestLine.length
-                while (true) {
-                    val line = readLine(input) ?: return
-                    if (line.isEmpty()) break
-                    headerBytes += line.length
-                    if (headerBytes > MAX_HEADER_BYTES) return respond(sock, 431, json("headers_too_large"))
-                    val idx = line.indexOf(':')
-                    if (idx <= 0) continue
-                    val key = line.substring(0, idx).trim().lowercase()
-                    val value = line.substring(idx + 1).trim()
-                    when (key) {
-                        "content-length" -> contentLength = value.toIntOrNull() ?: 0
-                        "x-from" -> from = value.take(80)
-                        "x-name" -> fromName = value.take(80)
-                    }
-                }
-
-                when {
-                    method == "GET" && (path == "/" || path.startsWith("/?")) ->
-                        respondHtml(sock, profilePage())
-                    method == "POST" && path == "/hello" -> {
-                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receiveHello(String(body, Charsets.UTF_8))
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    method == "POST" && path == "/flare" -> {
-                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receiveFlare(String(body, Charsets.UTF_8))
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    method == "POST" && path == "/photo" -> {
-                        if (contentLength !in 1..MAX_PHOTO_BYTES) return respond(sock, 413, json("too_large"))
-                        if (!from.startsWith("npub1")) return respond(sock, 400, json("bad_request"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receivePhoto(from, fromName, body)
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    else -> respond(sock, 404, json("not_found"))
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "request failed: $e")
-            }
-        }
-    }
-
-    /** A peer that scanned OUR QR announces itself — mutual pairing. */
-    private fun receiveHello(body: String) {
-        val o = try {
-            JSONObject(body)
-        } catch (_: Exception) {
-            return
-        }
-        val from = o.optString("from")
-        val ula = o.optString("ula")
-        if (!from.startsWith("npub1") || !ula.startsWith("fd")) return
-        if (from == identityNpub) return
-        val peer = PartyPeer(
-            npub = from.take(80),
-            ula = ula.take(64),
-            name = o.optString("name").take(24).ifBlank { "Phone" },
-            ip = o.optString("ip").take(40),
-            port = o.optInt("port", 0),
-        )
-        onHello?.invoke(peer)
-        // Seed the conversation so the chat has a visible entry on this side.
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = peer.npub,
-                fromMe = false,
-                name = peer.name,
-                text = "👋 ${peer.name} joined the party",
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun receiveFlare(body: String) {
-        val o = try {
-            JSONObject(body)
-        } catch (_: Exception) {
-            return
-        }
-        val from = o.optString("from")
-        if (!from.startsWith("npub1")) return
-        val text = o.optString("text").take(MAX_TEXT_CHARS)
-        if (text.isBlank()) return
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = from,
-                fromMe = false,
-                name = o.optString("name").take(80).ifBlank { "Phone" },
-                text = text,
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun receivePhoto(from: String, fromName: String, bytes: ByteArray) {
-        // Server-generated filename — the sender never controls the path.
-        val dir = photoDir ?: return
-        val file = File(dir, "${UUID.randomUUID()}.jpg")
-        file.writeBytes(bytes)
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = from,
-                fromMe = false,
-                name = fromName.ifBlank { "Phone" },
-                photoPath = file.absolutePath,
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun profilePage(): String {
-        val npub = identityNpub
-        val name = identityName
-        return """
-            <!doctype html><html><head><meta charset="utf-8">
-            <meta name="viewport" content="width=device-width,initial-scale=1">
-            <title>$name — on the mesh</title>
-            <style>
-              body{background:#0a0a0a;color:#eee;font-family:monospace;
-                   display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
-              .card{border:1px solid rgba(255,255,255,.12);border-radius:20px;padding:32px;
-                    max-width:560px;background:rgba(255,255,255,.04)}
-              h1{color:#f7931a;margin:0 0 8px;font-size:22px}
-              .npub{word-break:break-all;color:#888;font-size:12px;margin:12px 0}
-              p{line-height:1.5}
-            </style></head><body><div class="card">
-            <h1>⚡ $name</h1>
-            <div class="npub">$npub</div>
-            <p>This page is being served <b>by a phone</b>, addressed by its
-            cryptographic identity over the FIPS mesh.</p>
-            <p>No port forwarding. No DNS. No certificate authority. No cloud.
-            The key <i>is</i> the address — and the transport underneath can be
-            5G, WiFi, or a hotspot with no internet at all.</p>
-            </div></body></html>
-        """.trimIndent()
-    }
-
-    // ── tiny HTTP plumbing ──────────────────────────────────────────────────
-
-    /** Read one CRLF-terminated header line as ISO-8859-1; null on EOF. */
-    private fun readLine(input: InputStream): String? {
-        val sb = StringBuilder()
-        while (true) {
-            val b = input.read()
-            if (b == -1) return if (sb.isEmpty()) null else sb.toString()
-            if (b == '\n'.code) return sb.toString().trimEnd('\r')
-            sb.append(b.toChar())
-            if (sb.length > MAX_HEADER_BYTES) return null
-        }
-    }
-
-    private fun readExactly(input: InputStream, length: Int): ByteArray? {
-        val buf = ByteArray(length)
-        var off = 0
-        while (off < length) {
-            val n = input.read(buf, off, length - off)
-            if (n == -1) return null
-            off += n
-        }
-        return buf
-    }
-
-    private fun json(code: String) = """{"error":{"code":"$code","message":"request rejected"}}"""
-
-    private fun respond(sock: Socket, status: Int, body: String) =
-        writeResponse(sock, status, "application/json", body.toByteArray(Charsets.UTF_8))
-
-    private fun respondHtml(sock: Socket, body: String) =
-        writeResponse(sock, 200, "text/html; charset=utf-8", body.toByteArray(Charsets.UTF_8))
-
-    private fun writeResponse(sock: Socket, status: Int, contentType: String, body: ByteArray) {
-        val reason = when (status) {
-            200 -> "OK"; 400 -> "Bad Request"; 404 -> "Not Found"
-            413 -> "Payload Too Large"; 431 -> "Headers Too Large"
-            else -> "Error"
-        }
-        val head = "HTTP/1.1 $status $reason\r\n" +
-            "Content-Type: $contentType\r\n" +
-            "Content-Length: ${body.size}\r\n" +
-            "Connection: close\r\n\r\n"
-        sock.getOutputStream().apply {
-            write(head.toByteArray(Charsets.ISO_8859_1))
-            write(body)
-            flush()
-        }
-    }
-}
-
-/** Outbound flares: plain HTTP to the peer's ULA — FIPS encrypts underneath. */
-object FlareClient {
-    // Connect timeout must outlive cold mesh-session establishment (~15s via
-    // the public tree per HANDOFF-2026-07-23); the attempt itself drives
-    // session setup, same trick as the VPN service's session warmer.
-    private val http = OkHttpClient.Builder()
-        .connectTimeout(25, TimeUnit.SECONDS)
-        .readTimeout(15, TimeUnit.SECONDS)
-        .writeTimeout(60, TimeUnit.SECONDS)
-        .build()
-
-    private fun base(peer: PartyPeer) = "http://[${peer.ula}]:${PartyQr.FLARE_PORT}"
-
-    /** Announce myself to a freshly scanned peer so pairing becomes MUTUAL —
-     *  their phone gets me as a peer + a chat entry without scanning back.
-     *  Blocking — call from Dispatchers.IO. */
-    fun sendHello(
-        peer: PartyPeer,
-        myNpub: String,
-        myName: String,
-        myUla: String,
-        myIp: String?,
-        myPort: Int,
-    ): Boolean = try {
-        val body = JSONObject()
-            .put("from", myNpub)
-            .put("name", myName)
-            .put("ula", myUla)
-            .put("ip", myIp ?: "")
-            .put("port", if (myIp != null) myPort else 0)
-            .toString()
-            .toRequestBody("application/json".toMediaType())
-        http.newCall(
-            Request.Builder().url("${base(peer)}/hello").post(body).build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-
-    /** Blocking — call from Dispatchers.IO. */
-    fun sendText(peer: PartyPeer, myNpub: String, myName: String, text: String): Boolean = try {
-        val body = JSONObject()
-            .put("from", myNpub)
-            .put("name", myName)
-            .put("text", text)
-            .put("ts", System.currentTimeMillis())
-            .toString()
-            .toRequestBody("application/json".toMediaType())
-        http.newCall(
-            Request.Builder().url("${base(peer)}/flare").post(body).build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-
-    /** Blocking — call from Dispatchers.IO. */
-    fun sendPhoto(peer: PartyPeer, myNpub: String, myName: String, jpeg: ByteArray): Boolean = try {
-        http.newCall(
-            Request.Builder()
-                .url("${base(peer)}/photo")
-                .header("X-From", myNpub)
-                .header("X-Name", myName)
-                .post(jpeg.toRequestBody("image/jpeg".toMediaType()))
-                .build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-}

Android/app/src/main/java/com/archipelago/app/fips/PartyQr.kt

@@ -1,102 +0,0 @@
-package com.archipelago.app.fips
-
-import android.net.Uri
-import java.net.Inet4Address
-import java.net.NetworkInterface
-
-/**
- * Phone↔phone mesh pairing ("Mesh Party") QR contract:
- *
- *   archipelago://party?v=1&npub=<npub>&ula=<fd..>&name=<name>[&ip=<v4>&port=<udp>]
- *
- * npub + ula alone are enough to chat *through* the mesh (anchors route by
- * node address, no underlay info needed). ip/port are present only while the
- * showing phone has its inbound UDP listener up (party mode) — the scanner
- * then also gets a direct-dial link that works on a shared LAN/hotspot with
- * no internet at all. Same versioning stance as the node pairing QR
- * (docs/companion-pairing-qr.md): unknown params tolerated under v=1.
- */
-data class PartyPeer(
-    val npub: String,
-    val ula: String,
-    val name: String,
-    /** Direct-dial underlay endpoint; empty when the peer wasn't listening. */
-    val ip: String = "",
-    val port: Int = 0,
-)
-
-object PartyQr {
-    const val SCHEME_HOST = "party"
-    private const val SUPPORTED_MAJOR = 1
-
-    /** UDP port a party-mode phone listens on (matches the node's mesh port). */
-    const val PARTY_UDP_PORT = 2121
-
-    /** Application-layer chat/beam port, bound only on the mesh ULA. */
-    const val FLARE_PORT = 5680
-
-    fun build(npub: String, ula: String, name: String, ip: String?, port: Int): String {
-        val b = Uri.Builder()
-            .scheme("archipelago")
-            .authority(SCHEME_HOST)
-            .appendQueryParameter("v", "1")
-            .appendQueryParameter("npub", npub)
-            .appendQueryParameter("ula", ula)
-            .appendQueryParameter("name", name)
-        if (!ip.isNullOrBlank() && port > 0) {
-            b.appendQueryParameter("ip", ip)
-            b.appendQueryParameter("port", port.toString())
-        }
-        return b.build().toString()
-    }
-
-    /** Null when [raw] is not a valid party QR (foreign codes just keep scanning). */
-    fun parse(raw: String): PartyPeer? {
-        val uri = try {
-            Uri.parse(raw.trim())
-        } catch (_: Exception) {
-            return null
-        }
-        if (!"archipelago".equals(uri.scheme, ignoreCase = true)) return null
-        if (uri.isOpaque || !SCHEME_HOST.equals(uri.host, ignoreCase = true)) return null
-        val major = uri.getQueryParameter("v")?.takeWhile { it.isDigit() }?.toIntOrNull() ?: return null
-        if (major != SUPPORTED_MAJOR) return null
-
-        val npub = uri.getQueryParameter("npub")?.trim().orEmpty()
-        val ula = uri.getQueryParameter("ula")?.trim().orEmpty()
-        if (!npub.startsWith("npub1") || !ula.startsWith("fd")) return null
-        return PartyPeer(
-            npub = npub,
-            ula = ula,
-            name = uri.getQueryParameter("name")?.trim().orEmpty().ifBlank { "Phone" },
-            ip = uri.getQueryParameter("ip")?.trim().orEmpty(),
-            port = uri.getQueryParameter("port")?.toIntOrNull() ?: 0,
-        )
-    }
-
-    /**
-     * This phone's private IPv4 on WiFi or its own hotspot, for the QR's
-     * direct-dial hint. Hotspot interfaces (ap/swlan/softap) win over wlan so
-     * the hotspot-host phone advertises the address its guests can reach.
-     */
-    fun localWifiIpv4(): String? {
-        val candidates = mutableListOf<Pair<String, String>>() // ifname → addr
-        try {
-            for (nif in NetworkInterface.getNetworkInterfaces()) {
-                if (!nif.isUp || nif.isLoopback) continue
-                for (addr in nif.inetAddresses) {
-                    if (addr is Inet4Address && addr.isSiteLocalAddress) {
-                        candidates += nif.name to addr.hostAddress.orEmpty()
-                    }
-                }
-            }
-        } catch (_: Exception) {
-            return null
-        }
-        val hotspot = candidates.firstOrNull {
-            it.first.startsWith("ap") || it.first.startsWith("swlan") || it.first.startsWith("softap")
-        }
-        return (hotspot ?: candidates.firstOrNull { it.first.startsWith("wlan") } ?: candidates.firstOrNull())
-            ?.second
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/components/MeshLoadingScreen.kt

@@ -1,77 +0,0 @@
-package com.archipelago.app.ui.components
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.size
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.ui.screens.PixelArtLogo
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceBlack
-import com.archipelago.app.ui.theme.TextMuted
-
-/**
- * The branded "F*CK IPs" full-screen loader — shown whenever the app is
- * dialing the node over the mesh (relaunch race, post-scan first connect),
- * instead of an anonymous spinner. The point of the brand: what's loading
- * is a connection to a cryptographic identity, not an IP.
- */
-@Composable
-fun MeshLoadingScreen(message: String = "Dialing your node by its key — no IPs harmed") {
-    Box(
-        Modifier
-            .fillMaxSize()
-            .background(SurfaceBlack),
-        contentAlignment = Alignment.Center,
-    ) {
-        Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            // The brand's circle-container logo (as on the connect screen /
-            // web login): pixel-art "a" centered in a black disc.
-            Box(
-                Modifier
-                    .size(120.dp)
-                    .clip(androidx.compose.foundation.shape.CircleShape)
-                    .background(Color.Black)
-                    .border(
-                        1.dp,
-                        Color.White.copy(alpha = 0.14f),
-                        androidx.compose.foundation.shape.CircleShape,
-                    ),
-                contentAlignment = Alignment.Center,
-            ) {
-                PixelArtLogo(Modifier.size(64.dp))
-            }
-            Spacer(Modifier.height(20.dp))
-            Text(
-                text = "F*CK IPs MESH",
-                color = BitcoinOrange,
-                fontSize = 18.sp,
-                fontWeight = FontWeight.Bold,
-                letterSpacing = 4.sp,
-            )
-            Spacer(Modifier.height(8.dp))
-            Text(
-                text = message,
-                color = TextMuted,
-                fontSize = 13.sp,
-                textAlign = TextAlign.Center,
-            )
-            Spacer(Modifier.height(24.dp))
-            CircularProgressIndicator(color = BitcoinOrange)
-        }
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/components/NESController.kt

@@ -23,7 +23,6 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Palette
 import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material3.Icon
 import androidx.compose.material3.Text
@@ -109,7 +108,6 @@ fun NESController(
     onKey: (String) -> Unit,
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
-    onToggleStyle: (() -> Unit)? = null,
     modifier: Modifier = Modifier,
 ) {
     val c = paletteFor(style)
@@ -207,7 +205,6 @@ fun NESController(
                 ) {
                     PlayerPill(c, playerId, onPlayerToggle)
                     SettingsBtn(c, Modifier, onMenu)
-                    onToggleStyle?.let { StyleBtn(c, Modifier, it) }
                 }
             }
         }
@@ -434,23 +431,6 @@ fun SettingsBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Uni
     }
 }
 
-/** Dark/Classic style toggle — lives next to the settings gear (the menu hub
- *  no longer carries it). */
-@Composable
-fun StyleBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Unit) {
-    var p by remember { mutableStateOf(false) }
-    Box(
-        modifier = modifier
-            .size(48.dp)
-            .clip(CircleShape)
-            .background(if (p) c.capsulePress else c.capsule)
-            .pointerInput(Unit) { detectTapGestures(onPress = { p = true; onClick(); tryAwaitRelease(); p = false }) },
-        contentAlignment = Alignment.Center,
-    ) {
-        Icon(Icons.Default.Palette, "Controller style", Modifier.size(26.dp), tint = c.labelMuted)
-    }
-}
-
 /** Player ID toggle pill (P1/P2/ALL) */
 @Composable
 fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {

Android/app/src/main/java/com/archipelago/app/ui/components/NESMenu.kt

@@ -21,40 +21,20 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material.icons.automirrored.filled.ArrowBack
-import androidx.compose.material.icons.filled.Bolt
-import androidx.compose.material.icons.filled.Dashboard
-import androidx.compose.material.icons.filled.Dns
-import androidx.compose.material.icons.filled.Groups
-import androidx.compose.material.icons.filled.Keyboard
-import androidx.compose.material.icons.filled.SportsEsports
-import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.QrCodeScanner
 import androidx.compose.material3.Icon
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.OutlinedTextFieldDefaults
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
-import androidx.compose.ui.platform.LocalClipboardManager
-import androidx.compose.ui.platform.LocalConfiguration
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.AnnotatedString
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
@@ -71,6 +51,7 @@ import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.ControllerStyle
 import com.archipelago.app.ui.theme.SurfaceDark
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
@@ -94,29 +75,26 @@ fun NESMenu(
     visible: Boolean,
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
+    isGamepadMode: Boolean,
+    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)? = null,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onRemote: () -> Unit,
-    onKeyboard: () -> Unit,
+    onToggleMode: () -> Unit,
+    onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)? = null,
-    onMeshParty: (() -> Unit)? = null,
 ) {
     AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
-        // Contained hub overlay: a centred glass panel (not full-screen) that
-        // holds the card page and its sub-pages (Nodes, FIPS) and scrolls
-        // inside its own bounds when content is tall. Tapping the dimmed
-        // backdrop dismisses.
         Box(
             Modifier.fillMaxSize().background(Color.Black.copy(alpha = 0.7f))
                 .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) { onDismiss() },
             contentAlignment = Alignment.Center,
         ) {
             AnimatedVisibility(visible = visible, enter = fadeIn() + scaleIn(initialScale = 0.95f), exit = fadeOut() + scaleOut(targetScale = 0.95f)) {
-                MenuPanel(servers, activeServer, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onRemote, onKeyboard, onBackToWebView, onMeshParty)
+                MenuPanel(servers, activeServer, isGamepadMode, controllerStyle, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onToggleMode, onToggleStyle, onBackToWebView)
             }
         }
     }
@@ -126,16 +104,17 @@ fun NESMenu(
 private fun MenuPanel(
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
+    isGamepadMode: Boolean,
+    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)?,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onRemote: () -> Unit,
-    onKeyboard: () -> Unit,
+    onToggleMode: () -> Unit,
+    onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)?,
-    onMeshParty: (() -> Unit)?,
 ) {
     var showAdd by remember { mutableStateOf(false) }
     // The saved server being edited, or null when adding a new one.
@@ -143,15 +122,14 @@ private fun MenuPanel(
     var nm by remember { mutableStateOf("") }
     var addr by remember { mutableStateOf("") }
     var pwd by remember { mutableStateOf("") }
-    var https by remember { mutableStateOf(false) }
 
     fun resetForm() {
-        nm = ""; addr = ""; pwd = ""; https = false; showAdd = false; editing = null
+        nm = ""; addr = ""; pwd = ""; showAdd = false; editing = null
     }
 
     fun startEdit(server: ServerEntry) {
         editing = server
-        nm = server.name; addr = server.address; pwd = server.password; https = server.useHttps
+        nm = server.name; addr = server.address; pwd = server.password
         showAdd = false
     }
 
@@ -159,381 +137,156 @@ private fun MenuPanel(
         if (addr.isBlank()) return
         val orig = editing
         if (orig != null) {
-            // Preserve port (compact form doesn't expose it); scheme is now editable.
-            onEditServer(orig, orig.copy(address = addr, useHttps = https, password = pwd, name = nm))
+            // Preserve fields the compact form doesn't expose (scheme, port).
+            onEditServer(orig, orig.copy(address = addr, password = pwd, name = nm))
         } else {
-            onAddServer(ServerEntry(addr, https, password = pwd, name = nm))
+            onAddServer(ServerEntry(addr, false, password = pwd, name = nm))
         }
         resetForm()
     }
 
-    var page by remember { mutableStateOf(HubPage.HUB) }
-
     Column(
         modifier = Modifier
             .widthIn(max = 420.dp)
-            .fillMaxWidth()
             .padding(horizontal = 20.dp)
-            // Cap height just short of the full screen; the panel wraps short
-            // content and only scrolls in the rare case it outgrows this.
-            .heightIn(max = (LocalConfiguration.current.screenHeightDp * 0.92f).dp)
             .clip(RoundedCornerShape(PANEL_R))
-            .background(PanelBg.copy(alpha = 0.86f))
+            .background(PanelBg)
             .border(1.dp, PanelBorder, RoundedCornerShape(PANEL_R))
             .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) {}
-            .verticalScroll(rememberScrollState())
-            .padding(20.dp),
-        verticalArrangement = Arrangement.spacedBy(12.dp),
+            .padding(22.dp),
+        verticalArrangement = Arrangement.spacedBy(10.dp),
     ) {
-        // Header: back (on sub-pages) or title, and a close on the hub.
-        Row(
-            Modifier.fillMaxWidth(),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.SpaceBetween,
-        ) {
-            if (page == HubPage.HUB) {
-                Text("Menu", color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 2.sp)
-                IconRound(Icons.Default.Close, "Close") { onDismiss() }
-            } else {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    IconRound(Icons.AutoMirrored.Filled.ArrowBack, "Back") { resetForm(); page = HubPage.HUB }
-                    Spacer(Modifier.width(12.dp))
-                    Text(
-                        if (page == HubPage.NODES) "Nodes" else "FIPS Mesh",
-                        color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 1.sp,
-                    )
-                }
-                IconRound(Icons.Default.Close, "Close") { onDismiss() }
-            }
-        }
-        Spacer(Modifier.height(4.dp))
+        // Title
+        Text(
+            "Menu",
+            color = TextPrimary,
+            fontSize = 18.sp,
+            fontWeight = FontWeight.SemiBold,
+            letterSpacing = 2.sp,
+            modifier = Modifier.fillMaxWidth(),
+            textAlign = TextAlign.Center,
+        )
+        Spacer(Modifier.height(2.dp))
 
-        when (page) {
-            HubPage.HUB -> {
-                // Card page — one card per destination. Dashboard first: it's a
-                // peer of the others so three-finger → hub → Dashboard returns
-                // to the node UI, same shape as every other option.
-                if (onBackToWebView != null) {
-                    HubCard(Icons.Default.Dashboard, "Dashboard", "The node's web interface") { onBackToWebView() }
-                }
-                HubCard(Icons.Default.SportsEsports, "Remote", "Game controller for the node") { onRemote() }
-                HubCard(Icons.Default.Keyboard, "Keyboard", "Type into the node") { onKeyboard() }
-                HubCard(Icons.Default.Dns, "Nodes", activeServer?.displayName() ?: "Add or switch servers") {
-                    page = HubPage.NODES
-                }
-                if (FipsNative.available) {
-                    HubCard(Icons.Default.Bolt, "FIPS Mesh", "Mesh identity & status") { page = HubPage.FIPS }
-                }
-                if (onMeshParty != null) {
-                    HubCard(Icons.Default.Groups, "Mesh Party", "Phone-to-phone chat & beam") { onMeshParty() }
-                }
-                // Dark/Classic style lives on the remote/keyboard screen next to
-                // the settings button — not here.
-            }
-
-            HubPage.NODES -> {
-                servers.forEach { server ->
-                    val active = server.serialize() == activeServer?.serialize()
-                    MenuItem(
-                        label = server.displayName(),
-                        selected = active,
-                        onClick = { onSelectServer(server) },
-                        onEdit = { startEdit(server) },
-                        onRemove = { onRemoveServer(server) },
-                    )
-                }
-                if (servers.isEmpty()) {
-                    Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
-                }
-
-                if (showAdd || editing != null) {
-                    Column(
-                        Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(ROW_R))
-                            .background(FieldBg)
-                            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                            .padding(12.dp),
-                        verticalArrangement = Arrangement.spacedBy(8.dp),
-                    ) {
-                        Row(
-                            Modifier.fillMaxWidth(),
-                            verticalAlignment = Alignment.CenterVertically,
-                            horizontalArrangement = Arrangement.SpaceBetween,
-                        ) {
-                            Text(
-                                if (editing != null) "Edit Server" else "Add Server",
-                                color = TextMuted, fontSize = 13.sp, letterSpacing = 1.sp, fontWeight = FontWeight.Medium,
-                            )
-                            Text(
-                                "Cancel", color = TextMuted, fontSize = 13.sp,
-                                modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
-                            )
-                        }
-                        GlassField(
-                            value = nm, onValueChange = { nm = it },
-                            placeholder = "Name (optional)",
-                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
-                        )
-                        GlassField(
-                            value = addr, onValueChange = { addr = it.trim() },
-                            placeholder = "192.168.1.100",
-                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
-                        )
-                        Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
-                            GlassField(
-                                value = pwd, onValueChange = { pwd = it },
-                                placeholder = "Password",
-                                modifier = Modifier.weight(1f),
-                                visualTransformation = PasswordVisualTransformation(),
-                                keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
-                                keyboardActions = KeyboardActions(onGo = { submit() }),
-                            )
-                            Box(
-                                Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
-                                    .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
-                                    .clickable { submit() },
-                                contentAlignment = Alignment.Center,
-                            ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
-                        }
-                        // HTTPS scheme toggle (available on both add and edit).
-                        Row(
-                            Modifier
-                                .fillMaxWidth()
-                                .clip(RoundedCornerShape(ROW_R))
-                                .clickable { https = !https }
-                                .padding(vertical = 2.dp),
-                            verticalAlignment = Alignment.CenterVertically,
-                            horizontalArrangement = Arrangement.SpaceBetween,
-                        ) {
-                            Text("Use HTTPS", color = TextMuted, fontSize = 13.sp)
-                            Box(
-                                Modifier
-                                    .width(46.dp).height(26.dp)
-                                    .clip(RoundedCornerShape(13.dp))
-                                    .background(if (https) BitcoinOrange.copy(alpha = 0.9f) else RowBg)
-                                    .border(1.dp, if (https) BitcoinOrange else RowBorder, RoundedCornerShape(13.dp)),
-                                contentAlignment = if (https) Alignment.CenterEnd else Alignment.CenterStart,
-                            ) {
-                                Box(
-                                    Modifier
-                                        .padding(horizontal = 3.dp)
-                                        .size(20.dp)
-                                        .clip(RoundedCornerShape(10.dp))
-                                        .background(if (https) Color.White else TextMuted),
-                                )
-                            }
-                        }
-                    }
-                } else {
-                    Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
-                        Box(Modifier.weight(1f)) {
-                            MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
-                        }
-                        if (onScanQr != null) {
-                            Box(
-                                Modifier
-                                    .size(ROW_H)
-                                    .clip(RoundedCornerShape(ROW_R))
-                                    .background(RowBg)
-                                    .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                                    .clickable { onScanQr() },
-                                contentAlignment = Alignment.Center,
-                            ) {
-                                Icon(
-                                    Icons.Default.QrCodeScanner,
-                                    contentDescription = stringResource(R.string.add_server_qr),
-                                    tint = BitcoinOrange,
-                                    modifier = Modifier.size(24.dp),
-                                )
-                            }
-                        }
-                    }
-                }
-            }
-
-            HubPage.FIPS -> {
-                FipsSection(embedded = true)
-            }
-        }
-    }
-}
-
-private enum class HubPage { HUB, NODES, FIPS }
-
-/** Big tappable destination card for the hub page: icon + title + subtitle. */
-@Composable
-private fun HubCard(
-    icon: androidx.compose.ui.graphics.vector.ImageVector,
-    title: String,
-    subtitle: String,
-    onClick: () -> Unit,
-) {
-    Row(
-        Modifier
-            .fillMaxWidth()
-            .clip(RoundedCornerShape(ROW_R))
-            .background(RowBg)
-            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-            .clickable { onClick() }
-            .padding(16.dp),
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.spacedBy(14.dp),
-    ) {
-        Box(
-            Modifier.size(40.dp).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.14f)),
-            contentAlignment = Alignment.Center,
-        ) {
-            Icon(icon, contentDescription = title, tint = BitcoinOrange, modifier = Modifier.size(22.dp))
-        }
-        Column(Modifier.weight(1f)) {
-            Text(title, color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold)
-            Text(subtitle, color = TextMuted, fontSize = 12.sp, maxLines = 1)
-        }
-    }
-}
-
-/** Small circular icon button used in the hub header. */
-@Composable
-private fun IconRound(
-    icon: androidx.compose.ui.graphics.vector.ImageVector,
-    desc: String,
-    onClick: () -> Unit,
-) {
-    Box(
-        Modifier
-            .size(40.dp)
-            .clip(RoundedCornerShape(20.dp))
-            .background(RowBg)
-            .border(1.dp, RowBorder, RoundedCornerShape(20.dp))
-            .clickable { onClick() },
-        contentAlignment = Alignment.Center,
-    ) {
-        Icon(icon, contentDescription = desc, tint = TextPrimary, modifier = Modifier.size(20.dp))
-    }
-}
-
-/** Snapshot of the phone's mesh identity + state for the FIPS menu section. */
-private data class FipsInfo(
-    val available: Boolean,
-    val running: Boolean,
-    val npub: String,
-    val meshAddress: String,
-    val peerCount: Int,
-)
-
-/**
- * FIPS mesh oversight: shows what the phone's embedded mesh node is doing —
- * running state, its mesh identity (npub), its mesh address (fd…ULA), how
- * many peers/anchors it's configured with — and a one-tap Reconnect that
- * re-homes the mesh (also the manual fix if a network handoff ever misses).
- * Collapsed by default so the menu stays compact.
- */
-@Composable
-private fun FipsSection(embedded: Boolean = false) {
-    if (!FipsNative.available) return
-    val context = LocalContext.current
-    val clipboard = LocalClipboardManager.current
-    var expanded by remember { mutableStateOf(embedded) }
-    var info by remember { mutableStateOf<FipsInfo?>(null) }
-
-    // Load identity/state when the section opens (cheap DataStore + JSON read).
-    LaunchedEffect(expanded) {
-        if (expanded && info == null) {
-            val prefs = FipsPreferences(context)
-            val id = prefs.identity()
-            val peers = runCatching {
-                org.json.JSONArray(prefs.peersJson()).length()
-            }.getOrDefault(0)
-            info = FipsInfo(
-                available = true,
-                running = FipsNative.isRunning(),
-                npub = id?.npub.orEmpty(),
-                meshAddress = id?.address.orEmpty(),
-                peerCount = peers,
+        // Servers
+        servers.forEach { server ->
+            val active = server.serialize() == activeServer?.serialize()
+            MenuItem(
+                label = server.displayName(),
+                selected = active,
+                onClick = { onSelectServer(server) },
+                onEdit = { startEdit(server) },
+                onRemove = { onRemoveServer(server) },
             )
         }
-    }
 
-    Column(Modifier.fillMaxWidth()) {
-        // Embedded in the hub's FIPS sub-page the header row would duplicate
-        // the page title, so only the standalone (collapsible) form shows it.
-        if (!embedded) MenuItem(
-            label = "FIPS Mesh",
-            labelColor = BitcoinOrange,
-            onClick = { expanded = !expanded },
-        )
-        if (expanded) {
-            val i = info
+        if (servers.isEmpty()) {
+            Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
+        }
+
+        // Add / edit server
+        if (showAdd || editing != null) {
             Column(
                 Modifier
                     .fillMaxWidth()
-                    .padding(top = 6.dp)
                     .clip(RoundedCornerShape(ROW_R))
                     .background(FieldBg)
                     .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                    .padding(14.dp),
-                verticalArrangement = Arrangement.spacedBy(10.dp),
+                    .padding(12.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp),
             ) {
-                if (i == null) {
-                    Text("Loading…", color = TextMuted, fontSize = 13.sp)
-                } else {
-                    FipsRow("Status", if (i.running) "Connected" else "Stopped",
-                        valueColor = if (i.running) BitcoinOrange else TextMuted)
-                    if (i.meshAddress.isNotBlank()) {
-                        FipsRow("Mesh address", i.meshAddress, mono = true,
-                            onCopy = { clipboard.setText(AnnotatedString(i.meshAddress)) })
-                    }
-                    if (i.npub.isNotBlank()) {
-                        FipsRow("Identity (npub)", i.npub, mono = true,
-                            onCopy = { clipboard.setText(AnnotatedString(i.npub)) })
-                    }
-                    FipsRow("Peers & anchors", i.peerCount.toString())
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
                     Text(
-                        "Your node reaches this phone over the mesh by its npub — no ports opened to the internet.",
-                        color = TextMuted, fontSize = 11.sp,
+                        if (editing != null) "Edit Server" else "Add Server",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        letterSpacing = 1.sp,
+                        fontWeight = FontWeight.Medium,
                     )
-                    MenuItem(
-                        label = "Reconnect mesh",
-                        labelColor = BitcoinOrange,
-                        onClick = {
-                            FipsManager.requestMeshRestart(context)
-                            info = null
-                            if (!embedded) expanded = false
-                        },
+                    Text(
+                        "Cancel",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
                     )
                 }
+                GlassField(
+                    value = nm, onValueChange = { nm = it },
+                    placeholder = "Name (optional)",
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
+                )
+                GlassField(
+                    value = addr, onValueChange = { addr = it.trim() },
+                    placeholder = "192.168.1.100",
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
+                )
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
+                    GlassField(
+                        value = pwd, onValueChange = { pwd = it },
+                        placeholder = "Password",
+                        modifier = Modifier.weight(1f),
+                        visualTransformation = PasswordVisualTransformation(),
+                        keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
+                        keyboardActions = KeyboardActions(onGo = { submit() }),
+                    )
+                    Box(
+                        Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
+                            .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+                            .clickable { submit() },
+                        contentAlignment = Alignment.Center,
+                    ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
+                }
+            }
+        } else {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
+                Box(Modifier.weight(1f)) {
+                    MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
+                }
+                if (onScanQr != null) {
+                    // Add server by scanning the node's pairing QR
+                    Box(
+                        Modifier
+                            .size(ROW_H)
+                            .clip(RoundedCornerShape(ROW_R))
+                            .background(RowBg)
+                            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
+                            .clickable { onScanQr() },
+                        contentAlignment = Alignment.Center,
+                    ) {
+                        Icon(
+                            Icons.Default.QrCodeScanner,
+                            contentDescription = stringResource(R.string.add_server_qr),
+                            tint = BitcoinOrange,
+                            modifier = Modifier.size(24.dp),
+                        )
+                    }
+                }
             }
         }
-    }
-}
 
-@Composable
-private fun FipsRow(
-    label: String,
-    value: String,
-    valueColor: Color = TextPrimary,
-    mono: Boolean = false,
-    onCopy: (() -> Unit)? = null,
-) {
-    Row(
-        Modifier
-            .fillMaxWidth()
-            .then(if (onCopy != null) Modifier.clickable { onCopy() } else Modifier),
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.SpaceBetween,
-    ) {
-        Text(label, color = TextMuted, fontSize = 12.sp, modifier = Modifier.width(120.dp))
-        Text(
-            value,
-            color = valueColor,
-            fontSize = if (mono) 11.sp else 13.sp,
-            fontWeight = FontWeight.Medium,
-            modifier = Modifier.weight(1f),
-            textAlign = TextAlign.End,
+        Spacer(Modifier.height(2.dp))
+        Box(Modifier.fillMaxWidth().height(1.dp).background(PanelBorder))
+        Spacer(Modifier.height(2.dp))
+
+        // Mode toggle
+        MenuItem(
+            label = if (isGamepadMode) "Switch to Keyboard" else "Switch to Gamepad",
+            onClick = onToggleMode,
         )
-        if (onCopy != null) {
-            Text("⧉", color = TextMuted, fontSize = 13.sp, modifier = Modifier.padding(start = 8.dp))
+
+        // Style toggle
+        MenuItem(
+            label = if (controllerStyle == ControllerStyle.CLASSIC) "Style: Classic" else "Style: Dark",
+            onClick = onToggleStyle,
+        )
+
+        // Back to dashboard
+        if (onBackToWebView != null) {
+            MenuItem(label = "Back to Dashboard", onClick = onBackToWebView)
         }
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESPortraitController.kt

@@ -43,7 +43,6 @@ fun NESPortraitController(
     onMouseScroll: (Int) -> Unit = { _ -> },
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
-    onToggleStyle: (() -> Unit)? = null,
 ) {
     val c = paletteFor(style)
     val isClassic = style == ControllerStyle.CLASSIC
@@ -152,10 +151,6 @@ fun NESPortraitController(
                     PlayerPill(c, playerId, onPlayerToggle)
                     Spacer(Modifier.width(10.dp))
                     SettingsBtn(c, Modifier, onMenu)
-                    onToggleStyle?.let {
-                        Spacer(Modifier.width(10.dp))
-                        StyleBtn(c, Modifier, it)
-                    }
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/components/QrScannerOverlay.kt

@@ -238,7 +238,6 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
         val mainExecutor = ContextCompat.getMainExecutor(context)
         val providerFuture = ProcessCameraProvider.getInstance(context)
         var provider: ProcessCameraProvider? = null
-        val focusScheduler = Executors.newSingleThreadScheduledExecutor()
 
         providerFuture.addListener({
             val p = providerFuture.get()
@@ -246,15 +245,12 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
             val preview = Preview.Builder().build().also {
                 it.setSurfaceProvider(previewView.surfaceProvider)
             }
-            // Dense Lightning-invoice QRs need BOTH enough pixels per module and
-            // sharp focus. 1280x720 + a far-focused camera (e.g. Pixel 9a's main
-            // lens, which won't focus close) left dense invoices undecodable
-            // while sparse address QRs still read — the "scanner doesn't pick up
-            // invoices" report. 1920x1080 roughly doubles module resolution so a
-            // QR held at the camera's actual focus distance still resolves.
+            // CameraX's analysis default is 640x480 — too few pixels per module
+            // to decode a modal-sized QR at arm's length. 1280x720 more than
+            // doubles the pixel density at negligible analysis cost.
             @Suppress("DEPRECATION")
             val analysis = ImageAnalysis.Builder()
-                .setTargetResolution(android.util.Size(1920, 1080))
+                .setTargetResolution(android.util.Size(1280, 720))
                 .setBackpressureStrategy(ImageAnalysis.STRATEGY_KEEP_ONLY_LATEST)
                 .build()
                 .also {
@@ -265,27 +261,13 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
                 }
             try {
                 p.unbindAll()
-                val cam = p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
-                // Force a centre autofocus on a repeating tick. A hand-held QR is
-                // a static scene, so continuous-AF often never retriggers and the
-                // lens sits at its resting (far) focus — fatal for dense codes.
-                // A normalized centre point works before the view is measured.
-                val point = androidx.camera.core.SurfaceOrientedMeteringPointFactory(1f, 1f)
-                    .createPoint(0.5f, 0.5f)
-                val focusAction = androidx.camera.core.FocusMeteringAction.Builder(
-                    point,
-                    androidx.camera.core.FocusMeteringAction.FLAG_AF,
-                ).disableAutoCancel().build()
-                focusScheduler.scheduleWithFixedDelay({
-                    runCatching { cam.cameraControl.startFocusAndMetering(focusAction) }
-                }, 0, 2, java.util.concurrent.TimeUnit.SECONDS)
+                p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
             } catch (_: Exception) {
                 // Camera unavailable — the user can dismiss and enter details manually.
             }
         }, mainExecutor)
 
         onDispose {
-            focusScheduler.shutdownNow()
             provider?.unbindAll()
             analysisExecutor.shutdown()
         }

Android/app/src/main/java/com/archipelago/app/ui/navigation/NavGraph.kt

@@ -12,19 +12,15 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.platform.LocalContext
-import androidx.navigation.NavType
 import androidx.navigation.compose.NavHost
 import androidx.navigation.compose.composable
 import androidx.navigation.compose.rememberNavController
-import androidx.navigation.navArgument
 import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.data.ServerQrParser
 import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.ui.screens.FlareScreen
 import com.archipelago.app.ui.screens.IntroScreen
-import com.archipelago.app.ui.screens.PartyScreen
 import com.archipelago.app.ui.screens.RemoteInputScreen
 import com.archipelago.app.ui.screens.ServerConnectScreen
 import com.archipelago.app.ui.screens.WebViewScreen
@@ -35,8 +31,6 @@ object Routes {
     const val SERVER_CONNECT = "server_connect"
     const val WEB_VIEW = "web_view"
     const val REMOTE_INPUT = "remote_input"
-    const val MESH_PARTY = "mesh_party"
-    const val FLARE = "flare"
 }
 
 @Composable
@@ -128,9 +122,6 @@ fun AppNavHost(
     ) {
         composable(Routes.INTRO) {
             IntroScreen(
-                onMeshParty = {
-                    navController.navigate(Routes.MESH_PARTY)
-                },
                 onContinue = {
                     scope.launch {
                         prefs.markIntroSeen()
@@ -179,46 +170,15 @@ fun AppNavHost(
                     onRemoteInput = {
                         navController.navigate(Routes.REMOTE_INPUT)
                     },
-                    onRemoteKeyboard = {
-                        navController.navigate("${Routes.REMOTE_INPUT}?keyboard=true")
-                    },
-                    onMeshParty = {
-                        navController.navigate(Routes.MESH_PARTY)
-                    },
                 )
             }
         }
 
-        composable(
-            "${Routes.REMOTE_INPUT}?keyboard={keyboard}",
-            arguments = listOf(
-                navArgument("keyboard") {
-                    type = NavType.BoolType
-                    defaultValue = false
-                },
-            ),
-        ) { entry ->
+        composable(Routes.REMOTE_INPUT) {
             RemoteInputScreen(
                 onBack = {
                     navController.popBackStack()
                 },
-                onMeshParty = {
-                    navController.navigate(Routes.MESH_PARTY)
-                },
-                startInKeyboard = entry.arguments?.getBoolean("keyboard") == true,
-            )
-        }
-
-        composable(Routes.MESH_PARTY) {
-            PartyScreen(
-                onBack = { navController.popBackStack() },
-                onOpenChat = { navController.navigate(Routes.FLARE) },
-            )
-        }
-
-        composable(Routes.FLARE) {
-            FlareScreen(
-                onBack = { navController.popBackStack() },
             )
         }
     }

Android/app/src/main/java/com/archipelago/app/ui/screens/FlareScreen.kt

@@ -1,359 +0,0 @@
-package com.archipelago.app.ui.screens
-
-import android.graphics.Bitmap
-import android.graphics.BitmapFactory
-import android.net.Uri
-import androidx.activity.compose.BackHandler
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.navigationBarsPadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.lazy.rememberLazyListState
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Image
-import androidx.compose.material3.Icon
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.OutlinedTextFieldDefaults
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.collectAsState
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.asImageBitmap
-import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
-import com.archipelago.app.fips.FlareClient
-import com.archipelago.app.fips.FlareMessage
-import com.archipelago.app.fips.FlareStore
-import com.archipelago.app.fips.PartyPeer
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceDark
-import com.archipelago.app.ui.theme.TextMuted
-import com.archipelago.app.ui.theme.TextPrimary
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-import java.io.ByteArrayOutputStream
-import java.io.File
-import java.util.UUID
-
-private val BubbleTheirs = Color.White.copy(alpha = 0.07f)
-private val BubbleBorder = Color.White.copy(alpha = 0.08f)
-
-/**
- * Flare — phone↔phone chat and photo beam over the FIPS mesh. Every byte is
- * E2E encrypted by the mesh layer and addressed by npub; whether it travels
- * via a public anchor (5G) or a direct hotspot link is invisible up here —
- * which is the entire point.
- */
-@Composable
-fun FlareScreen(onBack: () -> Unit) {
-    val context = LocalContext.current
-    val prefs = remember { FipsPreferences(context) }
-    val scope = rememberCoroutineScope()
-
-    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
-    var myName by remember { mutableStateOf("Phone") }
-    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
-    var selectedNpub by remember { mutableStateOf<String?>(null) }
-    val allMessages by FlareStore.messages.collectAsState()
-    var draft by remember { mutableStateOf("") }
-
-    LaunchedEffect(Unit) {
-        identity = FipsManager.ensureIdentity(prefs)
-        myName = prefs.partyName()
-    }
-    LaunchedEffect(peers) {
-        if (selectedNpub == null || peers.none { it.npub == selectedNpub }) {
-            selectedNpub = peers.firstOrNull()?.npub
-        }
-    }
-
-    val peer = peers.firstOrNull { it.npub == selectedNpub }
-    val messages = allMessages.filter { it.peerNpub == selectedNpub }
-    val listState = rememberLazyListState()
-    LaunchedEffect(messages.size) {
-        if (messages.isNotEmpty()) listState.animateScrollToItem(messages.size - 1)
-    }
-
-    fun sendText() {
-        val target = peer ?: return
-        val me = identity ?: return
-        val text = draft.trim()
-        if (text.isEmpty()) return
-        draft = ""
-        val msg = FlareMessage(
-            id = UUID.randomUUID().toString(),
-            peerNpub = target.npub,
-            fromMe = true,
-            name = myName,
-            text = text,
-            ts = System.currentTimeMillis(),
-            status = FlareMessage.Status.SENDING,
-        )
-        FlareStore.add(msg)
-        scope.launch(Dispatchers.IO) {
-            val ok = FlareClient.sendText(target, me.npub, myName, text)
-            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
-        }
-    }
-
-    fun sendPhoto(uri: Uri) {
-        val target = peer ?: return
-        val me = identity ?: return
-        scope.launch(Dispatchers.IO) {
-            val jpeg = compressPhoto(context, uri) ?: return@launch
-            // Local copy so our own bubble renders the sent photo.
-            val dir = File(context.cacheDir, "flare").apply { mkdirs() }
-            val local = File(dir, "${UUID.randomUUID()}.jpg").apply { writeBytes(jpeg) }
-            val msg = FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = target.npub,
-                fromMe = true,
-                name = myName,
-                photoPath = local.absolutePath,
-                ts = System.currentTimeMillis(),
-                status = FlareMessage.Status.SENDING,
-            )
-            FlareStore.add(msg)
-            val ok = FlareClient.sendPhoto(target, me.npub, myName, jpeg)
-            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
-        }
-    }
-
-    val photoPicker = rememberLauncherForActivityResult(
-        ActivityResultContracts.GetContent()
-    ) { uri -> uri?.let { sendPhoto(it) } }
-
-    BackHandler { onBack() }
-
-    Column(
-        Modifier
-            .fillMaxSize()
-            .background(SurfaceDark)
-            .statusBarsPadding()
-            .navigationBarsPadding()
-            .imePadding(),
-    ) {
-        // Header
-        Row(
-            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.SpaceBetween,
-        ) {
-            Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(6.dp))
-            Column(horizontalAlignment = Alignment.CenterHorizontally) {
-                Text("FLARE", color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
-                peer?.let {
-                    Text(
-                        it.name + if (it.ip.isNotBlank()) "  ·  direct+mesh" else "  ·  mesh",
-                        color = BitcoinOrange,
-                        fontSize = 11.sp,
-                    )
-                }
-            }
-            Spacer(Modifier.size(48.dp))
-        }
-
-        // Peer tabs when chatting with more than one phone
-        if (peers.size > 1) {
-            Row(
-                Modifier.fillMaxWidth().padding(horizontal = 16.dp),
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                peers.forEach { p ->
-                    val active = p.npub == selectedNpub
-                    Text(
-                        p.name,
-                        color = if (active) BitcoinOrange else TextMuted,
-                        fontSize = 13.sp,
-                        modifier = Modifier
-                            .clip(RoundedCornerShape(10.dp))
-                            .background(if (active) BitcoinOrange.copy(alpha = 0.12f) else Color.Transparent)
-                            .border(
-                                1.dp,
-                                if (active) BitcoinOrange.copy(alpha = 0.4f) else BubbleBorder,
-                                RoundedCornerShape(10.dp),
-                            )
-                            .clickable { selectedNpub = p.npub }
-                            .padding(horizontal = 12.dp, vertical = 6.dp),
-                    )
-                }
-            }
-        }
-
-        if (peer == null) {
-            Box(Modifier.weight(1f).fillMaxWidth(), contentAlignment = Alignment.Center) {
-                Text("No party peers yet — scan a phone first", color = TextMuted, fontSize = 14.sp)
-            }
-        } else {
-            LazyColumn(
-                state = listState,
-                modifier = Modifier.weight(1f).fillMaxWidth(),
-                contentPadding = androidx.compose.foundation.layout.PaddingValues(16.dp),
-                verticalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                items(messages, key = { it.id }) { msg ->
-                    MessageBubble(msg)
-                }
-            }
-
-            // Composer
-            Row(
-                Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp),
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                Box(
-                    Modifier
-                        .size(48.dp)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(BubbleTheirs)
-                        .border(1.dp, BubbleBorder, RoundedCornerShape(12.dp))
-                        .clickable { photoPicker.launch("image/*") },
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Icon(Icons.Default.Image, "Beam a photo", tint = BitcoinOrange, modifier = Modifier.size(22.dp))
-                }
-                OutlinedTextField(
-                    value = draft,
-                    onValueChange = { draft = it },
-                    placeholder = { Text("Send a flare…", color = TextMuted, fontSize = 14.sp) },
-                    modifier = Modifier.weight(1f),
-                    singleLine = true,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Send),
-                    keyboardActions = KeyboardActions(onSend = { sendText() }),
-                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp),
-                    colors = OutlinedTextFieldDefaults.colors(
-                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
-                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
-                        cursorColor = BitcoinOrange,
-                        focusedTextColor = TextPrimary,
-                        unfocusedTextColor = TextPrimary,
-                    ),
-                    shape = RoundedCornerShape(12.dp),
-                )
-                Box(
-                    Modifier
-                        .size(48.dp)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(BitcoinOrange.copy(alpha = 0.15f))
-                        .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
-                        .clickable { sendText() },
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Text("➤", color = BitcoinOrange, fontSize = 18.sp)
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun MessageBubble(msg: FlareMessage) {
-    Row(
-        Modifier.fillMaxWidth(),
-        horizontalArrangement = if (msg.fromMe) Arrangement.End else Arrangement.Start,
-    ) {
-        Column(
-            Modifier
-                .widthIn(max = 300.dp)
-                .clip(RoundedCornerShape(16.dp))
-                .background(if (msg.fromMe) BitcoinOrange.copy(alpha = 0.14f) else BubbleTheirs)
-                .border(
-                    1.dp,
-                    if (msg.fromMe) BitcoinOrange.copy(alpha = 0.35f) else BubbleBorder,
-                    RoundedCornerShape(16.dp),
-                )
-                .padding(horizontal = 12.dp, vertical = 8.dp),
-        ) {
-            if (msg.photoPath.isNotBlank()) {
-                val bmp = remember(msg.photoPath) { BitmapFactory.decodeFile(msg.photoPath) }
-                bmp?.let {
-                    Image(
-                        bitmap = it.asImageBitmap(),
-                        contentDescription = "Beamed photo",
-                        modifier = Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(10.dp)),
-                        contentScale = ContentScale.FillWidth,
-                    )
-                }
-            }
-            if (msg.text.isNotBlank()) {
-                Text(msg.text, color = TextPrimary, fontSize = 15.sp)
-            }
-            Text(
-                when (msg.status) {
-                    FlareMessage.Status.SENDING -> "sending…"
-                    FlareMessage.Status.SENT -> "sent · E2E via mesh"
-                    FlareMessage.Status.FAILED -> "failed — tap to retry later"
-                    FlareMessage.Status.RECEIVED -> msg.name
-                },
-                color = if (msg.status == FlareMessage.Status.FAILED) BitcoinOrange else TextMuted,
-                fontSize = 10.sp,
-                modifier = Modifier.padding(top = 2.dp),
-            )
-        }
-    }
-}
-
-/** Decode, downscale (≤1600px) and JPEG-compress a picked photo off-main. */
-private suspend fun compressPhoto(context: android.content.Context, uri: Uri): ByteArray? =
-    withContext(Dispatchers.IO) {
-        try {
-            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
-            context.contentResolver.openInputStream(uri)?.use {
-                BitmapFactory.decodeStream(it, null, bounds)
-            }
-            var sample = 1
-            while (maxOf(bounds.outWidth, bounds.outHeight) / sample > 1600) sample *= 2
-            val opts = BitmapFactory.Options().apply { inSampleSize = sample }
-            val bitmap = context.contentResolver.openInputStream(uri)?.use {
-                BitmapFactory.decodeStream(it, null, opts)
-            } ?: return@withContext null
-            val out = ByteArrayOutputStream()
-            bitmap.compress(Bitmap.CompressFormat.JPEG, 80, out)
-            bitmap.recycle()
-            out.toByteArray()
-        } catch (_: Exception) {
-            null
-        }
-    }

Android/app/src/main/java/com/archipelago/app/ui/screens/IntroScreen.kt

@@ -55,12 +55,7 @@ import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.delay
 
 @Composable
-fun IntroScreen(
-    onContinue: () -> Unit,
-    // Mesh Party works with no node at all (phone↔phone) — offered right on
-    // the first screen so a friend who just got the app can join a party.
-    onMeshParty: () -> Unit = {},
-) {
+fun IntroScreen(onContinue: () -> Unit) {
     val logoAlpha = remember { Animatable(0f) }
     var showContent by remember { mutableStateOf(false) }
 
@@ -148,14 +143,6 @@ fun IntroScreen(
                         onClick = onContinue,
                         modifier = Modifier.fillMaxWidth().height(56.dp),
                     )
-
-                    Spacer(modifier = Modifier.height(12.dp))
-
-                    GlassButton(
-                        text = stringResource(R.string.mesh_party),
-                        onClick = onMeshParty,
-                        modifier = Modifier.fillMaxWidth().height(48.dp),
-                    )
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/screens/PartyScreen.kt

@@ -1,519 +0,0 @@
-package com.archipelago.app.ui.screens
-
-import android.graphics.Bitmap
-import androidx.activity.compose.BackHandler
-import androidx.compose.animation.AnimatedVisibility
-import androidx.compose.animation.fadeIn
-import androidx.compose.animation.fadeOut
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.OutlinedTextFieldDefaults
-import androidx.compose.material3.Switch
-import androidx.compose.material3.SwitchDefaults
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.collectAsState
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.asImageBitmap
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
-import com.archipelago.app.fips.FlareClient
-import com.archipelago.app.fips.PartyPeer
-import com.archipelago.app.fips.PartyQr
-import com.archipelago.app.ui.components.CameraQrPreview
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceDark
-import com.archipelago.app.ui.theme.TextMuted
-import com.archipelago.app.ui.theme.TextPrimary
-import com.google.zxing.BarcodeFormat
-import com.google.zxing.EncodeHintType
-import com.google.zxing.qrcode.QRCodeWriter
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-private val CardBg = Color.White.copy(alpha = 0.05f)
-private val CardBorder = Color.White.copy(alpha = 0.08f)
-
-/** Public companion download (vps2 demo host — serves the same APK as the
- *  nodes' QR link). Rendered as the "Share this app" QR. */
-private const val APP_DOWNLOAD_URL =
-    "http://146.59.87.168:2100/packages/archipelago-companion.apk"
-
-/**
- * Mesh Party — phone↔phone FIPS pairing. Show your QR, scan theirs, and the
- * two embedded mesh nodes link up: through anchors when there's internet,
- * directly over any shared WiFi/hotspot when there isn't.
- */
-@Composable
-fun PartyScreen(
-    onBack: () -> Unit,
-    onOpenChat: () -> Unit,
-) {
-    val context = LocalContext.current
-    val prefs = remember { FipsPreferences(context) }
-    val scope = rememberCoroutineScope()
-
-    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
-    var name by remember { mutableStateOf("") }
-    var localIp by remember { mutableStateOf<String?>(null) }
-    var showScanner by remember { mutableStateOf(false) }
-    var showShareQr by remember { mutableStateOf(false) }
-    var scanHint by remember { mutableStateOf<String?>(null) }
-
-    // Camera permission — fresh installs (and reinstalls: uninstall wipes
-    // grants) land here with no CAMERA grant, and the raw preview just showed
-    // black. Ask the moment the scanner opens.
-    var hasCamera by remember {
-        mutableStateOf(
-            androidx.core.content.ContextCompat.checkSelfPermission(
-                context, android.Manifest.permission.CAMERA,
-            ) == android.content.pm.PackageManager.PERMISSION_GRANTED
-        )
-    }
-    val cameraPermLauncher = androidx.activity.compose.rememberLauncherForActivityResult(
-        androidx.activity.result.contract.ActivityResultContracts.RequestPermission()
-    ) { hasCamera = it }
-    LaunchedEffect(showScanner) {
-        if (showScanner && !hasCamera) {
-            cameraPermLauncher.launch(android.Manifest.permission.CAMERA)
-        }
-    }
-    val listenOn by prefs.partyListenFlow.collectAsState(initial = false)
-    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
-
-    LaunchedEffect(Unit) {
-        identity = FipsManager.ensureIdentity(prefs)
-        name = prefs.partyName()
-        // The hotspot/WiFi address can change while this screen is open
-        // (e.g. the user flips the hotspot on mid-demo) — keep it fresh.
-        while (true) {
-            localIp = withContext(Dispatchers.IO) { PartyQr.localWifiIpv4() }
-            delay(3_000)
-        }
-    }
-
-    val qrPayload = identity?.let { id ->
-        PartyQr.build(
-            npub = id.npub,
-            ula = id.address,
-            name = name.ifBlank { "Phone" },
-            ip = if (listenOn) localIp else null,
-            port = PartyQr.PARTY_UDP_PORT,
-        )
-    }
-    val qrBitmap = remember(qrPayload) { qrPayload?.let { renderQr(it) } }
-
-    BackHandler {
-        when {
-            showScanner -> showScanner = false
-            showShareQr -> showShareQr = false
-            else -> onBack()
-        }
-    }
-
-    Box(Modifier.fillMaxSize().background(SurfaceDark)) {
-        Column(
-            Modifier
-                .fillMaxSize()
-                .statusBarsPadding()
-                .verticalScroll(rememberScrollState())
-                .padding(horizontal = 24.dp, vertical = 16.dp),
-            verticalArrangement = Arrangement.spacedBy(14.dp),
-        ) {
-            Row(
-                Modifier.fillMaxWidth(),
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.SpaceBetween,
-            ) {
-                Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(8.dp))
-                Text("MESH PARTY", color = TextPrimary, fontSize = 17.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
-                Spacer(Modifier.size(56.dp))
-            }
-
-            // My QR card
-            Column(
-                Modifier
-                    .fillMaxWidth()
-                    .clip(RoundedCornerShape(20.dp))
-                    .background(CardBg)
-                    .border(1.dp, CardBorder, RoundedCornerShape(20.dp))
-                    .padding(18.dp),
-                horizontalAlignment = Alignment.CenterHorizontally,
-                verticalArrangement = Arrangement.spacedBy(12.dp),
-            ) {
-                qrBitmap?.let { bmp ->
-                    Box(
-                        Modifier
-                            .clip(RoundedCornerShape(16.dp))
-                            .background(Color.White)
-                            .padding(12.dp),
-                    ) {
-                        Image(
-                            bitmap = bmp.asImageBitmap(),
-                            contentDescription = "My mesh party QR",
-                            modifier = Modifier.size(220.dp),
-                        )
-                    }
-                } ?: Text("Mesh identity unavailable on this device", color = TextMuted, fontSize = 14.sp)
-
-                identity?.let {
-                    Text(
-                        it.npub.take(16) + "…" + it.npub.takeLast(6),
-                        color = TextMuted,
-                        fontSize = 12.sp,
-                        textAlign = TextAlign.Center,
-                    )
-                }
-
-                OutlinedTextField(
-                    value = name,
-                    onValueChange = {
-                        name = it.take(24)
-                        scope.launch { prefs.setPartyName(name) }
-                    },
-                    placeholder = { Text("Your name", color = TextMuted, textAlign = TextAlign.Center, modifier = Modifier.fillMaxWidth()) },
-                    modifier = Modifier.fillMaxWidth().height(56.dp),
-                    singleLine = true,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp, textAlign = TextAlign.Center),
-                    colors = OutlinedTextFieldDefaults.colors(
-                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
-                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
-                        cursorColor = BitcoinOrange,
-                        focusedTextColor = TextPrimary,
-                        unfocusedTextColor = TextPrimary,
-                    ),
-                    shape = RoundedCornerShape(12.dp),
-                )
-
-                // Direct-link toggle (hotspot mode)
-                Row(
-                    Modifier.fillMaxWidth(),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
-                    Column(Modifier.padding(end = 12.dp)) {
-                        Text("Accept direct links", color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
-                        Text(
-                            when {
-                                listenOn && localIp != null -> "Dialable at $localIp:${PartyQr.PARTY_UDP_PORT} — no internet needed"
-                                listenOn -> "Waiting for a WiFi/hotspot address…"
-                                else -> "Off — mesh routes via anchors only"
-                            },
-                            color = if (listenOn) BitcoinOrange else TextMuted,
-                            fontSize = 12.sp,
-                        )
-                    }
-                    Switch(
-                        checked = listenOn,
-                        onCheckedChange = { on ->
-                            scope.launch {
-                                prefs.setPartyListen(on)
-                                FipsManager.requestMeshRestart(context)
-                            }
-                        },
-                        colors = SwitchDefaults.colors(
-                            checkedTrackColor = BitcoinOrange,
-                            checkedThumbColor = Color.White,
-                        ),
-                    )
-                }
-            }
-
-            GlassButton(
-                text = "Scan a Phone",
-                onClick = { showScanner = true },
-                modifier = Modifier.fillMaxWidth().height(56.dp),
-            )
-
-            if (peers.isNotEmpty()) {
-                Text("PARTY PEERS", color = TextMuted, fontSize = 12.sp, letterSpacing = 2.sp)
-                peers.forEach { peer ->
-                    Row(
-                        Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(14.dp))
-                            .background(CardBg)
-                            .border(1.dp, CardBorder, RoundedCornerShape(14.dp))
-                            .clickable { onOpenChat() }
-                            .padding(horizontal = 16.dp, vertical = 12.dp),
-                        verticalAlignment = Alignment.CenterVertically,
-                        horizontalArrangement = Arrangement.SpaceBetween,
-                    ) {
-                        Column(Modifier.padding(end = 8.dp)) {
-                            Text(peer.name, color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
-                            Text(
-                                peer.npub.take(14) + "…" + if (peer.ip.isNotBlank()) "  ·  direct ${peer.ip}" else "  ·  via mesh",
-                                color = TextMuted,
-                                fontSize = 11.sp,
-                            )
-                        }
-                        Text(
-                            "✕",
-                            color = TextMuted,
-                            fontSize = 16.sp,
-                            modifier = Modifier.clickable {
-                                scope.launch {
-                                    prefs.removePartyPeer(peer.npub)
-                                    FipsManager.requestMeshRestart(context)
-                                }
-                            }.padding(8.dp),
-                        )
-                    }
-                }
-                GlassButton(
-                    text = "Open Flare Chat",
-                    onClick = onOpenChat,
-                    modifier = Modifier.fillMaxWidth().height(56.dp),
-                )
-            } else {
-                Text(
-                    "Scan another phone's party QR (or let them scan yours) to link your mesh nodes — works over 5G via anchors, or over any shared WiFi/hotspot with zero internet.",
-                    color = TextMuted,
-                    fontSize = 13.sp,
-                    textAlign = TextAlign.Center,
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 8.dp),
-                )
-            }
-            Spacer(Modifier.height(12.dp))
-            // Hand the app itself to a friend: shares this install's own APK
-            // through the system sheet (Quick Share/Bluetooth), so a nearby
-            // phone gets the companion with zero internet — the whole party
-            // premise.
-            GlassButton(
-                text = "Share this app",
-                onClick = { showShareQr = true },
-                modifier = Modifier.fillMaxWidth().height(48.dp),
-            )
-            Spacer(Modifier.height(12.dp))
-        }
-
-        // "Share this app" — a QR of the public download link, so the other
-        // phone scans it with its normal camera and installs over any
-        // internet. (The vps2 demo host serves the same APK the nodes do.)
-        AnimatedVisibility(visible = showShareQr, enter = fadeIn(), exit = fadeOut()) {
-            Box(
-                Modifier
-                    .fillMaxSize()
-                    .background(Color.Black.copy(alpha = 0.94f))
-                    .clickable { showShareQr = false },
-                contentAlignment = Alignment.Center,
-            ) {
-                Column(horizontalAlignment = Alignment.CenterHorizontally) {
-                    val dlQr = remember { renderQr(APP_DOWNLOAD_URL) }
-                    dlQr?.let { bmp ->
-                        Box(
-                            Modifier
-                                .clip(RoundedCornerShape(16.dp))
-                                .background(Color.White)
-                                .padding(14.dp),
-                        ) {
-                            Image(
-                                bitmap = bmp.asImageBitmap(),
-                                contentDescription = "Companion download QR",
-                                modifier = Modifier.size(240.dp),
-                            )
-                        }
-                    }
-                    Spacer(Modifier.height(18.dp))
-                    Text(
-                        "Scan with any camera to download\nthe Archipelago Companion",
-                        color = TextPrimary,
-                        fontSize = 15.sp,
-                        textAlign = TextAlign.Center,
-                    )
-                    Spacer(Modifier.height(10.dp))
-                    Text(
-                        "…or send the APK file directly",
-                        color = BitcoinOrange,
-                        fontSize = 13.sp,
-                        modifier = Modifier.clickable { shareCompanionApk(context) }.padding(8.dp),
-                    )
-                    Spacer(Modifier.height(6.dp))
-                    Text("Close", color = TextMuted, fontSize = 14.sp, modifier = Modifier.clickable { showShareQr = false }.padding(8.dp))
-                }
-            }
-        }
-
-        // Party QR scanner overlay
-        AnimatedVisibility(visible = showScanner, enter = fadeIn(), exit = fadeOut()) {
-            Box(Modifier.fillMaxSize().background(Color.Black)) {
-                if (!hasCamera) {
-                    Column(
-                        Modifier.align(Alignment.Center).padding(horizontal = 32.dp),
-                        horizontalAlignment = Alignment.CenterHorizontally,
-                        verticalArrangement = Arrangement.spacedBy(14.dp),
-                    ) {
-                        Text(
-                            "Camera access is needed to scan a party QR.",
-                            color = TextPrimary,
-                            fontSize = 15.sp,
-                            textAlign = TextAlign.Center,
-                        )
-                        GlassButton(
-                            text = "Grant camera access",
-                            onClick = { cameraPermLauncher.launch(android.Manifest.permission.CAMERA) },
-                            modifier = Modifier.fillMaxWidth().height(48.dp),
-                        )
-                    }
-                } else CameraQrPreview(onDecoded = { text ->
-                    val peer = PartyQr.parse(text)
-                    when {
-                        peer == null -> scanHint = "Not a mesh party QR"
-                        peer.npub == identity?.npub -> scanHint = "That's your own QR"
-                        else -> {
-                            showScanner = false
-                            scanHint = null
-                            scope.launch {
-                                prefs.upsertPartyPeer(peer)
-                                // Pick up the direct-dial PeerConfig (and the
-                                // listener, if ours is on) immediately.
-                                FipsManager.requestMeshRestart(context)
-                                // Pairing must be MUTUAL: announce ourselves so
-                                // the scanned phone gets us as a peer + a chat
-                                // entry without scanning back. Retried while
-                                // the fresh link/session comes up.
-                                val me = identity
-                                if (me != null) {
-                                    launch(Dispatchers.IO) {
-                                        for (attempt in 0 until 6) {
-                                            val ok = FlareClient.sendHello(
-                                                peer = peer,
-                                                myNpub = me.npub,
-                                                myName = name.ifBlank { "Phone" },
-                                                myUla = me.address,
-                                                myIp = if (listenOn) localIp else null,
-                                                myPort = PartyQr.PARTY_UDP_PORT,
-                                            )
-                                            if (ok) break
-                                            delay(3_000)
-                                        }
-                                    }
-                                }
-                                onOpenChat()
-                            }
-                        }
-                    }
-                })
-                Box(
-                    Modifier
-                        .align(Alignment.Center)
-                        .size(260.dp)
-                        .border(2.dp, BitcoinOrange.copy(alpha = 0.85f), RoundedCornerShape(20.dp)),
-                )
-                Text(
-                    "Close",
-                    color = TextPrimary,
-                    fontSize = 16.sp,
-                    modifier = Modifier
-                        .align(Alignment.TopEnd)
-                        .statusBarsPadding()
-                        .clickable { showScanner = false }
-                        .padding(20.dp),
-                )
-                scanHint?.let {
-                    Text(
-                        it,
-                        color = BitcoinOrange,
-                        fontSize = 14.sp,
-                        textAlign = TextAlign.Center,
-                        modifier = Modifier
-                            .align(Alignment.BottomCenter)
-                            .padding(bottom = 48.dp)
-                            .fillMaxWidth(),
-                    )
-                }
-            }
-        }
-    }
-
-    // Scan hints fade so the camera feels live again.
-    LaunchedEffect(scanHint) {
-        if (scanHint != null) {
-            delay(2500)
-            scanHint = null
-        }
-    }
-}
-
-/** Render a QR payload as a bitmap (dark modules on white). */
-private fun renderQr(payload: String, size: Int = 640): Bitmap? = try {
-    val matrix = QRCodeWriter().encode(
-        payload,
-        BarcodeFormat.QR_CODE,
-        size,
-        size,
-        mapOf(EncodeHintType.MARGIN to 1),
-    )
-    val pixels = IntArray(size * size)
-    for (y in 0 until size) {
-        for (x in 0 until size) {
-            pixels[y * size + x] = if (matrix[x, y]) 0xFF0A0A0A.toInt() else 0xFFFFFFFF.toInt()
-        }
-    }
-    Bitmap.createBitmap(pixels, size, size, Bitmap.Config.ARGB_8888)
-} catch (_: Exception) {
-    null
-}
-
-/** Share this install's own APK via the system share sheet — a nearby friend
- *  gets the companion with no internet at all (Quick Share / Bluetooth). */
-private fun shareCompanionApk(context: android.content.Context) {
-    try {
-        val src = java.io.File(context.applicationInfo.sourceDir)
-        val dir = java.io.File(context.cacheDir, "share").apply { mkdirs() }
-        val out = java.io.File(dir, "archipelago-companion.apk")
-        src.copyTo(out, overwrite = true)
-        val uri = androidx.core.content.FileProvider.getUriForFile(
-            context, "${context.packageName}.fileprovider", out,
-        )
-        val send = android.content.Intent(android.content.Intent.ACTION_SEND).apply {
-            type = "application/vnd.android.package-archive"
-            putExtra(android.content.Intent.EXTRA_STREAM, uri)
-            addFlags(android.content.Intent.FLAG_GRANT_READ_URI_PERMISSION)
-        }
-        context.startActivity(
-            android.content.Intent.createChooser(send, "Share Archipelago Companion")
-                .addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK),
-        )
-    } catch (_: Exception) {
-        // No share targets / copy failed — nothing sensible to do here.
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/screens/RemoteInputScreen.kt

@@ -4,10 +4,8 @@ import android.content.res.Configuration
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
-import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.WindowInsets
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -56,12 +54,7 @@ import com.archipelago.app.ui.theme.TextMuted
 import kotlinx.coroutines.launch
 
 @Composable
-fun RemoteInputScreen(
-    onBack: () -> Unit,
-    onMeshParty: (() -> Unit)? = null,
-    // Land on the keyboard instead of the gamepad (hub menu's Keyboard card).
-    startInKeyboard: Boolean = false,
-) {
+fun RemoteInputScreen(onBack: () -> Unit) {
     val context = LocalContext.current
     val prefs = remember { ServerPreferences(context) }
     val scope = rememberCoroutineScope()
@@ -70,7 +63,7 @@ fun RemoteInputScreen(
     val savedServers by prefs.savedServers.collectAsState(initial = emptyList())
     val activeServer by prefs.activeServer.collectAsState(initial = null)
 
-    var isGamepadMode by remember { mutableStateOf(!startInKeyboard) }
+    var isGamepadMode by remember { mutableStateOf(true) }
     var showModal by remember { mutableStateOf(false) }
     var showQrScanner by remember { mutableStateOf(false) }
     var controllerStyle by remember { mutableStateOf(ControllerStyle.DARK) }
@@ -97,9 +90,6 @@ fun RemoteInputScreen(
         playerId = when (playerId) { 0 -> 1; 1 -> 2; else -> 0 }
         ws.playerId = playerId
     }
-    fun toggleStyle() {
-        controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
-    }
     val connectionState by ws.state.collectAsState()
     val lifecycleOwner = LocalLifecycleOwner.current
 
@@ -163,7 +153,6 @@ fun RemoteInputScreen(
                 onKey = { ws.sendKey(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
-                onToggleStyle = ::toggleStyle,
             )
             isGamepadMode && !isLandscape -> NESPortraitController(
                 style = controllerStyle,
@@ -174,7 +163,6 @@ fun RemoteInputScreen(
                 onMouseScroll = { ws.sendScroll(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
-                onToggleStyle = ::toggleStyle,
             )
             else -> {
                 // Keyboard mode: trackpad fills top, keyboard pinned bottom
@@ -194,20 +182,12 @@ fun RemoteInputScreen(
                             modifier = Modifier.fillMaxWidth(),
                         )
                     }
-                    // Settings + style icons top-right in keyboard mode
-                    Row(
-                        Modifier.align(Alignment.TopEnd).padding(8.dp),
-                        horizontalArrangement = Arrangement.spacedBy(8.dp),
-                    ) {
-                        com.archipelago.app.ui.components.SettingsBtn(
-                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
-                            onClick = { showModal = true },
-                        )
-                        com.archipelago.app.ui.components.StyleBtn(
-                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
-                            onClick = ::toggleStyle,
-                        )
-                    }
+                    // Settings icon top-right in keyboard mode
+                    com.archipelago.app.ui.components.SettingsBtn(
+                        c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
+                        modifier = Modifier.align(Alignment.TopEnd).padding(8.dp),
+                        onClick = { showModal = true },
+                    )
                 }
             }
         }
@@ -230,6 +210,8 @@ fun RemoteInputScreen(
             visible = showModal,
             servers = savedServers,
             activeServer = activeServer,
+            isGamepadMode = isGamepadMode,
+            controllerStyle = controllerStyle,
             onDismiss = { showModal = false },
             onSelectServer = { server ->
                 scope.launch { ws.disconnect(); prefs.setActiveServer(server) }; showModal = false
@@ -263,10 +245,11 @@ fun RemoteInputScreen(
                     }
                 }
             },
-            onRemote = { isGamepadMode = true; showModal = false },
-            onKeyboard = { isGamepadMode = false; showModal = false },
+            onToggleMode = { isGamepadMode = !isGamepadMode; showModal = false },
+            onToggleStyle = {
+                controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
+            },
             onBackToWebView = { showModal = false; onBack() },
-            onMeshParty = onMeshParty?.let { open -> { showModal = false; open() } },
         )
 
         // Pairing-QR scan launched from the menu's Add Server row. The menu stays

Android/app/src/main/java/com/archipelago/app/ui/screens/ServerConnectScreen.kt

@@ -75,7 +75,6 @@ import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.ui.components.MeshLoadingScreen
 import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.theme.BitcoinOrange
 import com.archipelago.app.ui.theme.ErrorRed
@@ -86,7 +85,6 @@ import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import com.archipelago.app.ui.theme.TextSecondary
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import java.net.HttpURLConnection
@@ -173,35 +171,10 @@ fun ServerConnectScreen(
         errorMessage = null
 
         scope.launch {
-            var reachable = testConnection(server)
-
-            // LAN address didn't answer — phone off-LAN (5G) or DHCP moved the
-            // node. The scanned IP was only ever a dial hint; the node's real
-            // identity is its npub and its ULA is reachable from anywhere over
-            // the mesh. Bring the tunnel up and probe the ULA before failing.
-            if (!reachable && server.meshIp.isNotBlank()) {
-                FipsManager.autoStartIfReady(context)
-                val meshServer = server.copy(
-                    address = server.meshIp,
-                    useHttps = false,
-                    port = "",
-                )
-                // Mesh discovery + first session can take 15s+ through the
-                // public tree (HANDOFF-2026-07-23 node diagnosis), and on a
-                // first-ever pairing the VPN consent dialog is on screen at
-                // the same time — so probe patiently inside a 60s budget with
-                // per-attempt timeouts wide enough to ride out TCP
-                // retransmit backoff. The VPN service pre-warms the session
-                // in parallel (ArchyVpnService.startSessionWarmer).
-                val deadline = System.currentTimeMillis() + 60_000
-                while (!reachable && System.currentTimeMillis() < deadline) {
-                    reachable = testConnection(meshServer, timeoutMs = 15_000)
-                    if (!reachable) delay(3000)
-                }
-            }
+            val result = testConnection(server)
             isConnecting = false
 
-            if (reachable) {
+            if (result) {
                 prefs.setActiveServer(server)
                 onConnected(server.toUrl())
             } else {
@@ -611,14 +584,6 @@ fun ServerConnectScreen(
             onDismiss = { showScanner = false },
             onServerScanned = { onQrScanned(it) },
         )
-
-        // Full-screen branded loader while the first connect runs — most
-        // visibly right after a pairing-QR scan, when the mesh may still be
-        // establishing (LAN probe → tunnel up → ULA probe can take a while).
-        // The small inline spinner stays for context; this owns the screen.
-        if (isConnecting) {
-            MeshLoadingScreen()
-        }
     }
 }
 
@@ -686,10 +651,8 @@ private fun sanitizeAddress(input: String): String {
         .trimEnd('/')
 }
 
-/** Test RPC connectivity. Accepts self-signed certs for local LAN servers.
- *  [timeoutMs] is per-phase (connect / read) — mesh probes need far more
- *  patience than LAN ones (first session through the tree can take 15s+). */
-private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000): Boolean {
+/** Test RPC connectivity. Accepts self-signed certs for local LAN servers. */
+private suspend fun testConnection(server: ServerEntry): Boolean {
     return withContext(Dispatchers.IO) {
         try {
             val url = URL("${server.toUrl()}/rpc/v1")
@@ -709,8 +672,8 @@ private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000):
             }
 
             connection.requestMethod = "POST"
-            connection.connectTimeout = timeoutMs
-            connection.readTimeout = timeoutMs
+            connection.connectTimeout = 5000
+            connection.readTimeout = 5000
             connection.setRequestProperty("Content-Type", "application/json")
             connection.doOutput = true
             val body = """{"method":"server.echo","params":{"message":"ping"}}"""

Android/app/src/main/java/com/archipelago/app/ui/screens/WebViewScreen.kt

@@ -23,28 +23,20 @@ import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.WindowInsets
-import androidx.compose.foundation.layout.WindowInsetsSides
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.navigationBars
-import androidx.compose.foundation.layout.only
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.safeDrawing
 import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBars
 import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.layout.windowInsetsBottomHeight
 import androidx.compose.foundation.layout.windowInsetsPadding
-import androidx.compose.foundation.layout.windowInsetsTopHeight
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
@@ -72,30 +64,19 @@ import androidx.compose.runtime.snapshotFlow
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.SpanStyle
-import androidx.compose.ui.text.buildAnnotatedString
-import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.text.withStyle
 import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
 import androidx.compose.ui.viewinterop.AndroidView
 import android.webkit.ValueCallback
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerPreferences
-import com.archipelago.app.fips.FipsManager
 import com.archipelago.app.ui.components.GestureHintOverlay
-import com.archipelago.app.ui.components.MeshLoadingScreen
-import com.archipelago.app.ui.components.NESMenu
-import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.components.WalletQrScannerModal
 import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.ErrorRed
 import com.archipelago.app.ui.theme.SurfaceBlack
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
@@ -134,158 +115,6 @@ private fun isSameHost(url: String, base: String): Boolean {
     }
 }
 
-/** Kiosk WebView retained across navigation (remote ⇄ dashboard) so leaving
- *  the kiosk and coming back reattaches the LIVE page — no reload, no
- *  re-login, no reconnect. Dropped on retry/disconnect/server change. */
-private object KioskWebView {
-    var instance: WebView? = null
-    var url: String? = null
-
-    // Live-composition delegates for the JS bridges (see the factory) — the
-    // registered interface objects call through these, so reattaching the
-    // retained view re-points them instead of leaving stale closures.
-    var onRouteOutbound: (String) -> Unit = {}
-    var onOpenInApp: (String) -> Unit = {}
-    var onQrOpen: () -> Unit = {}
-    var onQrStatus: (String, Boolean) -> Unit = { _, _ -> }
-    var onQrClose: () -> Unit = {}
-
-    fun drop() {
-        instance?.let {
-            (it.parent as? ViewGroup)?.removeView(it)
-            it.destroy()
-        }
-        instance = null
-        url = null
-    }
-}
-
-/** Inject the safe-area CSS vars from the CURRENT window insets. Android
- *  WebView doesn't populate env(safe-area-inset-*); worse, on a cold start
- *  onPageFinished can run before the view is attached — rootWindowInsets is
- *  null then, and injecting 0px collapsed the UI's top/bottom margins (and
- *  put the tab bar inside the gesture zone, killing its taps). Called from
- *  onPageFinished, from the window-insets listener (fires when real insets
- *  arrive), and on reattach. */
-private fun injectSafeAreaVars(view: WebView) {
-    val insets = view.rootWindowInsets ?: return // listener re-fires when real
-    val density = view.resources.displayMetrics.density
-    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
-    val sab = (insets.getInsets(android.view.WindowInsets.Type.navigationBars()).bottom / density).toInt()
-    view.evaluateJavascript(
-        """
-        (function() {
-            var style = document.getElementById('archipelago-android-insets');
-            if (!style) {
-                style = document.createElement('style');
-                style.id = 'archipelago-android-insets';
-                document.head.appendChild(style);
-            }
-            style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
-            // Vue components sample the var into reactive state; tell them it
-            // changed (an authenticated session can mount before we run).
-            window.dispatchEvent(new CustomEvent('archy-insets', { detail: { top: ${sat}, bottom: ${sab} } }));
-        })();
-        """.trimIndent(),
-        null,
-    )
-}
-
-/** In-app browser pages (node apps + same-node links) don't consume the
- *  neode-ui `--safe-area-top` var, so with the WebView drawing edge-to-edge
- *  their content ran up under the status bar. Pad the document body down by
- *  the status-bar height: the padded strip shows the page's OWN background
- *  (padding is inside the element), so the bar keeps the page colour while
- *  content starts below it — the pre-edge-to-edge look, without the black bar.
- *
- *  Body padding only moves normal-flow content. fixed/sticky elements anchored
- *  at the viewport top (IndeeHub's floating header) stayed glued under the
- *  status bar, so we also push each of those down by the inset — once, marked
- *  via data attribute — and keep a throttled MutationObserver running so
- *  headers an SPA mounts after load get the same treatment.
- *  Idempotent; runs on start (early) and finish (after the app rewrites head). */
-private fun injectTopInset(view: WebView) {
-    val insets = view.rootWindowInsets ?: return
-    val density = view.resources.displayMetrics.density
-    val sat = (insets.getInsets(android.view.WindowInsets.Type.statusBars()).top / density).toInt()
-    if (sat <= 0) return
-    view.evaluateJavascript(
-        """
-        (function() {
-            var SAT = $sat;
-            var s = document.getElementById('archy-top-inset');
-            if (!s) {
-                s = document.createElement('style');
-                s.id = 'archy-top-inset';
-                (document.head || document.documentElement).appendChild(s);
-            }
-            s.textContent =
-                'body{padding-top:' + SAT + 'px!important;box-sizing:border-box!important;}';
-            function push(el) {
-                if (el.dataset.archyInset) return;
-                var cs = getComputedStyle(el);
-                if (cs.position !== 'fixed' && cs.position !== 'sticky') return;
-                var top = parseFloat(cs.top); // 'auto' -> NaN skips bottom bars
-                if (isNaN(top) || top >= SAT) return;
-                el.style.setProperty('top', (top + SAT) + 'px', 'important');
-                el.dataset.archyInset = '1';
-            }
-            function sweep() {
-                if (!document.body) return;
-                // Fixed/sticky bars live shallow in the tree (portals mount on
-                // body); depth cap keeps the computed-style pass off big lists.
-                var els = document.body.querySelectorAll(
-                    'body > *, body > * > *, body > * > * > *, body > * > * > * > *');
-                for (var i = 0; i < els.length; i++) push(els[i]);
-            }
-            sweep();
-            if (!window.__archyInsetObserver) {
-                var queued = false, last = 0;
-                window.__archyInsetObserver = new MutationObserver(function() {
-                    if (queued) return;
-                    queued = true;
-                    var wait = Math.max(0, 250 - (Date.now() - last));
-                    setTimeout(function() {
-                        queued = false;
-                        last = Date.now();
-                        sweep();
-                    }, wait);
-                });
-                window.__archyInsetObserver.observe(document.documentElement,
-                    { childList: true, subtree: true });
-            }
-        })();
-        """.trimIndent(),
-        null,
-    )
-}
-
-/** True when a TCP listener answers at [base]'s host:port within [timeoutMs]. */
-private fun tcpAnswers(base: String, timeoutMs: Int): Boolean = try {
-    val u = android.net.Uri.parse(base)
-    val port = if (u.port != -1) u.port else if (u.scheme == "https") 443 else 80
-    java.net.Socket().use {
-        it.connect(java.net.InetSocketAddress(u.host, port), timeoutMs)
-        true
-    }
-} catch (_: Exception) {
-    false
-}
-
-/** Fastest answering origin: LAN inside a short window, else the mesh ULA
- *  (patient — a cold session may still be establishing). If NEITHER answers,
- *  fall back to the mesh URL when we have one — off-LAN the LAN IP is
- *  unreachable, and loading it just produced a confusing "can't reach
- *  192.168.x.x" error page (user-reported 2026-07-27). Targeting the mesh URL
- *  instead means the load retries against the path that's actually coming up,
- *  and any error shows the mesh address rather than a dead LAN IP. */
-private suspend fun pickStartUrl(lanUrl: String, meshUrl: String?): String =
-    withContext(Dispatchers.IO) {
-        if (tcpAnswers(lanUrl, 2500)) return@withContext lanUrl
-        if (meshUrl != null && tcpAnswers(meshUrl, 12_000)) return@withContext meshUrl
-        meshUrl ?: lanUrl
-    }
-
 /** Apply the WebView settings shared by the kiosk view and the in-app browser.
  *  These are tuned for SPA performance and parity with the mobile browser;
  *  none of them alter how a page renders visually. */
@@ -324,10 +153,6 @@ fun WebViewScreen(
     serverUrl: String,
     onDisconnect: () -> Unit,
     onRemoteInput: () -> Unit = {},
-    // Like onRemoteInput but landing on the keyboard (the hub menu's Keyboard card).
-    onRemoteKeyboard: () -> Unit = {},
-    // Opens the phone-to-phone Mesh Party screen; null hides its hub card.
-    onMeshParty: (() -> Unit)? = null,
     // Stored password for this server (from QR pairing or manual entry). When
     // non-blank, the login page is auto-filled and submitted — the one-step
     // demo flow from docs/companion-pairing-qr.md.
@@ -338,39 +163,11 @@ fun WebViewScreen(
     meshFallbackUrl: String? = null,
 ) {
     var isLoading by remember { mutableStateOf(true) }
-    // First kiosk load (often over the FIPS mesh) gets the full branded
-    // loader; later navigations keep just the slim top progress bar.
-    var firstLoadDone by remember { mutableStateOf(false) }
-    LaunchedEffect(Unit) {
-        snapshotFlow { isLoading }.first { !it }
-        firstLoadDone = true
-    }
     var loadProgress by remember { mutableIntStateOf(0) }
     var triedMeshFallback by remember { mutableStateOf(false) }
     var hasError by remember { mutableStateOf(false) }
     var webView by remember { mutableStateOf<WebView?>(null) }
 
-    // Race LAN vs mesh BEFORE the WebView exists: Chromium pointed at an
-    // unreachable LAN IP burns a minute+ in connect retries before
-    // onReceivedError fires the mesh fallback — the "stuck connecting"
-    // stall. A raw TCP probe answers in milliseconds at home and fails in
-    // ~2.5s off-LAN, so startup lands on the right origin in seconds.
-    var startUrl by remember(serverUrl) { mutableStateOf<String?>(null) }
-    var raceNonce by remember { mutableIntStateOf(0) }
-    LaunchedEffect(serverUrl, meshFallbackUrl, raceNonce) {
-        // A retained live session exists — reattach instantly: no race, no
-        // reload, no re-login (remote ⇄ dashboard round trip).
-        if (KioskWebView.instance != null && KioskWebView.url == serverUrl) {
-            isLoading = false
-            startUrl = serverUrl
-            return@LaunchedEffect
-        }
-        val picked = pickStartUrl(serverUrl, meshFallbackUrl)
-        // Starting on the mesh: don't bounce back to it on error (it IS it).
-        if (picked != serverUrl) triedMeshFallback = true
-        startUrl = picked
-    }
-
     // Web-page camera access (wallet QR scanner). The WebView's default
     // WebChromeClient silently denies getUserMedia, so grant video capture —
     // asking for the app-level CAMERA permission first when needed.
@@ -390,14 +187,6 @@ fun WebViewScreen(
     // while this is shown, so closing it returns instantly with no reload.
     var inAppUrl by remember { mutableStateOf<String?>(null) }
 
-    // Same node = EITHER of its addresses. Over the mesh the kiosk's host is
-    // the ULA while app links may carry the LAN IP (and vice versa) —
-    // comparing against one host bounced same-node apps (Pine, Home
-    // Assistant, BTCPay) out to the phone's external browser.
-    fun isSameNode(url: String): Boolean =
-        isSameHost(url, serverUrl) ||
-            (meshFallbackUrl != null && isSameHost(url, meshFallbackUrl))
-
     // Native wallet QR scanner, opened by the web UI via the ArchipelagoQr
     // bridge; status lines stream back from the page while it's up.
     var walletScannerVisible by remember { mutableStateOf(false) }
@@ -406,14 +195,6 @@ fun WebViewScreen(
     // One-time three-finger-hold teaching overlay (initial=true: never flash
     // it while DataStore is still loading).
     val prefs = remember { ServerPreferences(webViewContext) }
-
-    // Hub menu overlay state — the three-finger hold opens the menu right here
-    // over the dashboard (it used to jump to the remote screen).
-    val savedServers by prefs.savedServers.collectAsState(initial = emptyList())
-    val activeServer by prefs.activeServer.collectAsState(initial = null)
-    var showHubMenu by remember { mutableStateOf(false) }
-    var showPairScanner by remember { mutableStateOf(false) }
-
     val gestureHintSeen by prefs.gestureHintSeen.collectAsState(initial = true)
     var gestureHintDismissed by remember { mutableStateOf(false) }
     // Don't teach the gesture on top of the login/splash — arm the overlay
@@ -487,16 +268,9 @@ fun WebViewScreen(
                 GlassButton(
                     text = stringResource(R.string.retry),
                     onClick = {
-                        // Re-race LAN vs mesh — the network we're on may have
-                        // changed since the last pick. Drop the retained view:
-                        // an errored session must genuinely reload.
-                        KioskWebView.drop()
-                        webView = null
                         hasError = false
                         isLoading = true
-                        triedMeshFallback = false
-                        startUrl = null
-                        raceNonce++
+                        webView?.loadUrl(serverUrl)
                     },
                     modifier = Modifier.fillMaxWidth().height(56.dp),
                 )
@@ -505,33 +279,17 @@ fun WebViewScreen(
 
                 GlassButton(
                     text = stringResource(R.string.disconnect),
-                    onClick = {
-                        KioskWebView.drop()
-                        onDisconnect()
-                    },
+                    onClick = onDisconnect,
                     modifier = Modifier.fillMaxWidth().height(48.dp),
                 )
             }
-        } else if (startUrl == null) {
-            // Racing LAN vs mesh (≤2.5s at home, a few seconds off-LAN) —
-            // far cheaper than letting Chromium retry a dead LAN IP.
-            MeshLoadingScreen()
         } else {
             // Edge-to-edge WebView — background bleeds behind status bar.
             // Safe area values injected as CSS env() polyfill on each page load.
-            val initialUrl = startUrl ?: serverUrl
             AndroidView(
                 modifier = Modifier.fillMaxSize(),
                 factory = { context ->
-                    // Reattach the retained kiosk WebView (remote ⇄ dashboard
-                    // must not reload the node UI). Everything configured
-                    // below is idempotent, and re-running it rebinds clients,
-                    // bridges and listeners to THIS composition's state —
-                    // stale closures from the previous visit are replaced.
-                    if (KioskWebView.url != serverUrl) KioskWebView.drop()
-                    val reused = KioskWebView.instance
-                    (reused ?: WebView(context)).apply {
-                        (parent as? ViewGroup)?.removeView(this)
+                    WebView(context).apply {
                         layoutParams = ViewGroup.LayoutParams(
                             ViewGroup.LayoutParams.MATCH_PARENT,
                             ViewGroup.LayoutParams.MATCH_PARENT,
@@ -555,59 +313,33 @@ fun WebViewScreen(
 
                         val webViewRef = this
 
-                        // Re-inject the safe-area vars whenever REAL insets
-                        // arrive — on cold start onPageFinished often beats
-                        // window attachment and would otherwise bake in 0px.
-                        setOnApplyWindowInsetsListener { v, insets ->
-                            (v as? WebView)?.let { injectSafeAreaVars(it) }
-                            v.onApplyWindowInsets(insets)
-                        }
-
                         // Decide where an outbound URL goes:
                         //  - same host as the node  → in-app WebView overlay
                         //    (this is the "open in browser" target for apps the
                         //    kiosk couldn't iframe — keep the user inside the app)
                         //  - different host         → the phone's real browser
                         fun routeOutbound(url: String) {
-                            if (isSameNode(url)) {
+                            if (isSameHost(url, serverUrl)) {
                                 inAppUrl = url
                             } else {
                                 openExternalUrl(context, url)
                             }
                         }
 
-                        // Bridge callbacks are DELEGATED through the holder:
-                        // the interface objects registered on a retained
-                        // WebView survive recomposition, and re-registering
-                        // them doesn't reliably swap the JS-visible object
-                        // without a reload — with direct closures, a
-                        // remote ⇄ dashboard round trip left the bridges
-                        // writing to a dead composition's state ("apps don't
-                        // launch"). These assignments re-point the live
-                        // interface objects at THIS composition every attach.
-                        KioskWebView.onRouteOutbound = { url -> routeOutbound(url) }
-                        KioskWebView.onOpenInApp = { url -> inAppUrl = url }
-                        KioskWebView.onQrOpen = {
-                            walletScannerStatus = null
-                            walletScannerVisible = true
-                        }
-                        KioskWebView.onQrStatus = { msg, err -> walletScannerStatus = msg to err }
-                        KioskWebView.onQrClose = { walletScannerVisible = false }
-
                         // JS bridge. The web UI calls:
                         //   window.ArchipelagoNative.openExternal(url) — host-routed
                         //   window.ArchipelagoNative.openInApp(url)    — force in-app
                         // Falls back to window.open in a plain mobile browser.
-                        if (reused == null) addJavascriptInterface(
+                        addJavascriptInterface(
                             object {
                                 @android.webkit.JavascriptInterface
                                 fun openExternal(url: String) {
-                                    webViewRef.post { KioskWebView.onRouteOutbound(url) }
+                                    webViewRef.post { routeOutbound(url) }
                                 }
 
                                 @android.webkit.JavascriptInterface
                                 fun openInApp(url: String) {
-                                    webViewRef.post { KioskWebView.onOpenInApp(url) }
+                                    webViewRef.post { inAppUrl = url }
                                 }
                             },
                             "ArchipelagoNative",
@@ -619,21 +351,24 @@ fun WebViewScreen(
                         //   window.ArchipelagoQr.close()            — code accepted, tear down
                         // Decodes flow back through window.__archyQrResult(text);
                         // a user cancel calls window.__archyQrCancelled().
-                        if (reused == null) addJavascriptInterface(
+                        addJavascriptInterface(
                             object {
                                 @android.webkit.JavascriptInterface
                                 fun open() {
-                                    webViewRef.post { KioskWebView.onQrOpen() }
+                                    webViewRef.post {
+                                        walletScannerStatus = null
+                                        walletScannerVisible = true
+                                    }
                                 }
 
                                 @android.webkit.JavascriptInterface
                                 fun setStatus(message: String, isError: Boolean) {
-                                    webViewRef.post { KioskWebView.onQrStatus(message, isError) }
+                                    webViewRef.post { walletScannerStatus = message to isError }
                                 }
 
                                 @android.webkit.JavascriptInterface
                                 fun close() {
-                                    webViewRef.post { KioskWebView.onQrClose() }
+                                    webViewRef.post { walletScannerVisible = false }
                                 }
                             },
                             "ArchipelagoQr",
@@ -649,7 +384,34 @@ fun WebViewScreen(
                                 isLoading = false
                                 if (view == null) return
 
-                                injectSafeAreaVars(view)
+                                // Convert physical pixels → CSS pixels
+                                val density = view.resources.displayMetrics.density
+                                val satPx = view.rootWindowInsets
+                                    ?.getInsets(android.view.WindowInsets.Type.statusBars())
+                                    ?.top ?: 0
+                                val sabPx = view.rootWindowInsets
+                                    ?.getInsets(android.view.WindowInsets.Type.navigationBars())
+                                    ?.bottom ?: 0
+                                val sat = (satPx / density).toInt()
+                                val sab = (sabPx / density).toInt()
+
+                                // Android WebView doesn't populate env(safe-area-inset-*).
+                                // Set CSS custom properties the web UI can use as fallback:
+                                //   var(--safe-area-top, env(safe-area-inset-top, 0px))
+                                view.evaluateJavascript(
+                                    """
+                                    (function() {
+                                        var style = document.getElementById('archipelago-android-insets');
+                                        if (!style) {
+                                            style = document.createElement('style');
+                                            style.id = 'archipelago-android-insets';
+                                            document.head.appendChild(style);
+                                        }
+                                        style.textContent = ':root { --safe-area-top: ${sat}px; --safe-area-bottom: ${sab}px; }';
+                                    })();
+                                    """.trimIndent(),
+                                    null,
+                                )
 
                                 // Auto-login with the stored password (QR pairing /
                                 // saved server) — only on our own server's pages
@@ -696,7 +458,7 @@ fun WebViewScreen(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameNode(u)) {
+                                if (u != null && isSameHost(u, serverUrl)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -799,8 +561,7 @@ fun WebViewScreen(
                             }
                         }
 
-                        // Three-finger hold (500ms) → open the hub menu overlay
-                        // in place (Remote/Keyboard cards do the navigating).
+                        // Three-finger hold (500ms) → navigate to remote input.
                         // Three fingers, not two: two-finger scroll/pinch on the
                         // page collided with the old two-finger hold.
                         var threeFingerStart = 0L
@@ -818,7 +579,7 @@ fun WebViewScreen(
                                     if (pointerCount >= 3 && !threeFingerFired && threeFingerStart > 0) {
                                         if (System.currentTimeMillis() - threeFingerStart > 500) {
                                             threeFingerFired = true
-                                            showHubMenu = true
+                                            onRemoteInput()
                                         }
                                     }
                                 }
@@ -834,21 +595,7 @@ fun WebViewScreen(
                         }
 
                         webView = this
-                        if (reused == null) {
-                            KioskWebView.instance = this
-                            KioskWebView.url = serverUrl
-                            loadUrl(initialUrl)
-                        } else {
-                            // Reattached views keep stale measurements until an
-                            // input event — that was the top/bottom UI being
-                            // wrong until a tap. Force a fresh pass, and re-sync
-                            // the page's safe-area vars while we're at it.
-                            post {
-                                requestLayout()
-                                invalidate()
-                                injectSafeAreaVars(this)
-                            }
-                        }
+                        loadUrl(serverUrl)
                     }
                 },
             )
@@ -867,46 +614,12 @@ fun WebViewScreen(
                 )
             }
 
-            // Branded first-load screen while the mesh session comes up.
-            AnimatedVisibility(
-                visible = isLoading && !firstLoadDone,
-                enter = fadeIn(),
-                exit = fadeOut(),
-            ) {
-                Column(
-                    Modifier.fillMaxSize().background(SurfaceBlack),
-                    horizontalAlignment = Alignment.CenterHorizontally,
-                    verticalArrangement = Arrangement.Center,
-                ) {
-                    Text(
-                        buildAnnotatedString {
-                            withStyle(SpanStyle(color = ErrorRed)) { append("F*CK") }
-                            withStyle(SpanStyle(color = TextPrimary)) { append(" IPS") }
-                        },
-                        fontSize = 40.sp,
-                        fontWeight = FontWeight.Black,
-                        letterSpacing = 4.sp,
-                        textAlign = TextAlign.Center,
-                    )
-                    Spacer(Modifier.height(10.dp))
-                    Text(
-                        "connecting to your archipelago",
-                        color = TextMuted,
-                        fontSize = 13.sp,
-                        letterSpacing = 1.sp,
-                    )
-                    Spacer(Modifier.height(28.dp))
-                    CircularProgressIndicator(color = BitcoinOrange)
-                }
-            }
-
             // In-app browser overlay for non-iframeable node apps. Rendered last
             // so it sits above the kiosk WebView, which stays alive underneath.
             inAppUrl?.let { target ->
                 InAppBrowser(
                     url = target,
                     serverUrl = serverUrl,
-                    meshUrl = meshFallbackUrl,
                     onClose = { inAppUrl = null },
                 )
             }
@@ -943,68 +656,6 @@ fun WebViewScreen(
                 )
             }
         }
-
-        // Hub menu overlay — opened by the three-finger hold, drawn above
-        // everything (also reachable from the error screen, where switching
-        // servers is exactly what's needed).
-        NESMenu(
-            visible = showHubMenu,
-            servers = savedServers,
-            activeServer = activeServer,
-            onDismiss = { showHubMenu = false },
-            onSelectServer = { server ->
-                showHubMenu = false
-                scope.launch { prefs.setActiveServer(server) }
-            },
-            onAddServer = { server ->
-                scope.launch {
-                    prefs.addSavedServer(server)
-                    if (activeServer == null) prefs.setActiveServer(server)
-                }
-            },
-            onScanQr = { showPairScanner = true },
-            onEditServer = { original, updated ->
-                scope.launch {
-                    prefs.updateSavedServer(original, updated)
-                    // Editing the live server reloads the kiosk with the new
-                    // address/credentials via the activeServer recomposition.
-                    if (original.serialize() == activeServer?.serialize()) {
-                        prefs.setActiveServer(updated)
-                    }
-                }
-            },
-            onRemoveServer = { server ->
-                scope.launch {
-                    prefs.removeSavedServer(server)
-                    // Nothing left to show — back to the Connect screen.
-                    val remaining = savedServers.count { it.serialize() != server.serialize() }
-                    if (remaining == 0) {
-                        prefs.clearActiveServer()
-                        showHubMenu = false
-                        onDisconnect()
-                    }
-                }
-            },
-            onRemote = { showHubMenu = false; onRemoteInput() },
-            onKeyboard = { showHubMenu = false; onRemoteKeyboard() },
-            onBackToWebView = { showHubMenu = false },
-            onMeshParty = onMeshParty?.let { open -> { showHubMenu = false; open() } },
-        )
-
-        // Pairing-QR scan launched from the menu's Nodes page; the menu stays
-        // open behind it so the new entry appears as soon as it closes.
-        QrScannerOverlay(
-            visible = showPairScanner,
-            onDismiss = { showPairScanner = false },
-            onServerScanned = { scan ->
-                showPairScanner = false
-                scope.launch {
-                    val merged = prefs.upsertServer(scan.server)
-                    FipsManager.registerNode(webViewContext, scan.fips, merged.displayName())
-                    if (activeServer == null) prefs.setActiveServer(merged)
-                }
-            },
-        )
     }
 }
 
@@ -1042,26 +693,11 @@ private fun fetchFavicon(pageUrl: String): Bitmap? {
 private fun InAppBrowser(
     url: String,
     serverUrl: String,
-    meshUrl: String? = null,
     onClose: () -> Unit,
 ) {
     val context = LocalContext.current
-    // Same-node check across BOTH node addresses (LAN + mesh ULA) — see the
-    // kiosk's isSameNode; a mismatch here bounced app links to the browser.
-    fun isSameNode(u: String): Boolean =
-        isSameHost(u, serverUrl) || (meshUrl != null && isSameHost(u, meshUrl))
     var browser by remember { mutableStateOf<WebView?>(null) }
-    // Loader title: never show a raw IP host — a mesh ULA like
-    // [fd79:1aa:…] is technically the host but reads as garbage on the
-    // loading screen. Show a neutral name until the page reports its
-    // real <title> (onReceivedTitle upgrades it).
-    var title by remember {
-        mutableStateOf(
-            android.net.Uri.parse(url).host
-                ?.takeUnless { it.contains(':') || it.matches(Regex("^\\d+(\\.\\d+){3}$")) }
-                ?: "Archipelago",
-        )
-    }
+    var title by remember { mutableStateOf(android.net.Uri.parse(url).host ?: url) }
     var favicon by remember { mutableStateOf<Bitmap?>(null) }
     var progress by remember { mutableIntStateOf(0) }
     var loading by remember { mutableStateOf(true) }
@@ -1099,22 +735,7 @@ private fun InAppBrowser(
         modifier = Modifier
             .fillMaxSize()
             .background(SurfaceBlack)
-            // Whole-overlay touch shield: every touch not handled by a child
-            // (control-bar gaps, inset strips) dies here instead of falling
-            // through to the kiosk's tab bar behind (a near-miss on Close
-            // was opening the AIUI tab underneath).
-            .clickable(
-                interactionSource = remember { MutableInteractionSource() },
-                indication = null,
-                onClick = {},
-            )
-            // Bottom inset handled by the touch-shield strip below the bar.
-            // No TOP inset padding: the WebView draws edge-to-edge behind the
-            // status bar so the app's own background fills it — the padded
-            // version painted an opaque black bar there (user-rejected look).
-            .windowInsetsPadding(
-                WindowInsets.safeDrawing.only(WindowInsetsSides.Horizontal)
-            ),
+            .windowInsetsPadding(WindowInsets.safeDrawing),
     ) {
         // WebView + loading overlay fill the area above the bottom control bar.
         Box(modifier = Modifier.weight(1f).fillMaxWidth()) {
@@ -1165,14 +786,12 @@ private fun InAppBrowser(
                         webViewClient = object : WebViewClient() {
                             override fun onPageStarted(view: WebView?, u: String?, favicon: Bitmap?) {
                                 loading = true
-                                view?.let { injectTopInset(it) }
                             }
 
                             override fun onPageFinished(view: WebView?, u: String?) {
                                 loading = false
                                 canGoBack = view?.canGoBack() == true
                                 canGoForward = view?.canGoForward() == true
-                                view?.let { injectTopInset(it) }
                             }
 
                             override fun doUpdateVisitedHistory(view: WebView?, u: String?, isReload: Boolean) {
@@ -1190,7 +809,7 @@ private fun InAppBrowser(
                                 error: android.net.http.SslError?,
                             ) {
                                 val u = error?.url
-                                if (u != null && isSameNode(u)) {
+                                if (u != null && isSameHost(u, serverUrl)) {
                                     handler?.proceed()
                                 } else {
                                     handler?.cancel()
@@ -1204,7 +823,7 @@ private fun InAppBrowser(
                                 val u = request?.url?.toString() ?: return false
                                 // Stay in the overlay for same-node navigation;
                                 // hand genuinely external links to the real browser.
-                                if (isSameNode(u)) return false
+                                if (isSameHost(u, serverUrl)) return false
                                 openExternalUrl(ctx, u)
                                 return true
                             }
@@ -1305,21 +924,6 @@ private fun InAppBrowser(
                 )
             }
         }
-
-        // Touch-shield over the gesture-nav strip: solid black AND consumes
-        // taps — stray touches below the control bar landed on the kiosk's
-        // tab bar behind this overlay (opening the AIUI chat by accident).
-        Box(
-            Modifier
-                .fillMaxWidth()
-                .windowInsetsBottomHeight(WindowInsets.navigationBars)
-                .background(Color.Black)
-                .clickable(
-                    interactionSource = remember { MutableInteractionSource() },
-                    indication = null,
-                    onClick = {},
-                ),
-        )
     }
 }
 

Android/app/src/main/res/values/strings.xml

@@ -11,7 +11,6 @@
     <string name="welcome_title">Your Sovereign\nPersonal Server</string>
     <string name="welcome_subtitle">Bitcoin node, app platform, and private cloud — all in one box you control.</string>
     <string name="get_started">Get Started</string>
-    <string name="mesh_party">Mesh Party</string>
     <string name="use_https">Use HTTPS</string>
     <string name="port_label">Port (optional)</string>
     <string name="saved_servers">Saved Servers</string>

Android/app/src/main/res/xml/file_paths.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- FileProvider scope for the party-screen "Share this app" APK handoff. -->
-<paths>
-    <cache-path name="share" path="share/" />
-</paths>

Android/rust/archy-fips-core/Cargo.lock

@@ -86,7 +86,6 @@ dependencies = [
  "getrandom 0.2.17",
  "hex",
  "jni",
- "libc",
  "paranoid-android",
  "serde_json",
  "tokio",
@@ -464,7 +463,7 @@ checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "fips"
 version = "0.3.0-dev"
-source = "git+https://github.com/Zazawowow/fips-native?rev=07d21d4482be56b14295d2525e41f8386d1bfe6f#07d21d4482be56b14295d2525e41f8386d1bfe6f"
+source = "git+https://github.com/9qeklajc/fips-native?rev=46494a74fc85b878305d275d42ab719082b06ba6#46494a74fc85b878305d275d42ab719082b06ba6"
 dependencies = [
  "bech32",
  "chacha20poly1305",

Android/rust/archy-fips-core/Cargo.toml

@@ -23,10 +23,7 @@ crate-type = ["lib", "cdylib"]
 
 [dependencies]
 # default-features drops the ratatui TUI; tun-support enables Node::start_with_tun_fd.
-# Zazawowow/fips-native `fast-join-pinned` = upstream pinned rev 46494a74 +
-# discovery re-fire on topology change (fresh 5G join: first route no longer
-# waits out doomed pre-join lookups). Upstream 9qeklajc denies pushes.
-fips = { git = "https://github.com/Zazawowow/fips-native", rev = "07d21d4482be56b14295d2525e41f8386d1bfe6f", default-features = false, features = ["tun-support"] }
+fips = { git = "https://github.com/9qeklajc/fips-native", rev = "46494a74fc85b878305d275d42ab719082b06ba6", default-features = false, features = ["tun-support"] }
 anyhow = "1.0"
 serde_json = "1.0"
 hex = "0.4"
@@ -34,8 +31,6 @@ hex = "0.4"
 getrandom = "0.2"
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros"] }
 tracing = "0.1"
-# fcntl: force the VpnService TUN fd into blocking mode (see mesh::start).
-libc = "0.2"
 
 # The JNI surface only exists on Android; host builds skip it and drive the
 # mesh module directly (tests).

Android/rust/archy-fips-core/src/jni_glue.rs

@@ -76,9 +76,8 @@ pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_deriveIdentity(
     out(&env, json)
 }
 
-/// Kotlin: `external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String`
+/// Kotlin: `external fun start(secret: String, peersJson: String, tunFd: Int): String`
 /// Returns `{"npub": "...", "address": "..."}` or `{"error": "..."}`.
-/// `listenPort` 0 = outbound-only; non-zero = fixed UDP bind (party mode).
 #[no_mangle]
 pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_start(
     mut env: JNIEnv,
@@ -86,13 +85,11 @@ pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_start(
     secret: JString,
     peers_json: JString,
     tun_fd: jint,
-    listen_port: jint,
 ) -> jstring {
     init_logging();
     let secret = jstr(&mut env, &secret);
     let peers = jstr(&mut env, &peers_json);
-    let listen_port = u16::try_from(listen_port).unwrap_or(0);
-    let json = match mesh::start(&secret, &peers, tun_fd, listen_port) {
+    let json = match mesh::start(&secret, &peers, tun_fd) {
         Ok((npub, address)) => {
             serde_json::json!({ "npub": npub, "address": address }).to_string()
         }

Android/rust/archy-fips-core/src/mesh.rs

@@ -64,14 +64,9 @@ pub fn derive_identity(secret: &str) -> Result<IdentityInfo> {
 }
 
 /// Build the phone-side node config: leaf-only (never routes third-party
-/// traffic — battery), no DNS responder, TUN enabled but attached to the
-/// VpnService fd rather than created.
-///
-/// `listen_port` 0 = ephemeral UDP (outbound-only, the default posture).
-/// Non-zero = fixed UDP bind so a nearby phone can dial us directly over a
-/// local link (party mode); leaf_only still guarantees we never carry
-/// third-party transit even while accepting an inbound link.
-pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> Config {
+/// traffic — battery), ephemeral outbound-only transports, no DNS responder,
+/// TUN enabled but attached to the VpnService fd rather than created.
+pub fn build_config(secret: &str, peers: Vec<PeerConfig>) -> Config {
     let mut cfg = Config::default();
     cfg.node.identity.nsec = Some(secret.to_string());
     cfg.node.identity.persistent = false;
@@ -79,33 +74,13 @@ pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> C
     cfg.tun.enabled = true;
     cfg.tun.mtu = Some(1280);
     cfg.dns.enabled = false;
+    // Ephemeral UDP port: outbound dialing works, nothing predictable listens.
     cfg.transports.udp = TransportInstances::Single(UdpConfig {
-        bind_addr: Some(format!("0.0.0.0:{listen_port}")),
+        bind_addr: Some("0.0.0.0:0".to_string()),
         ..Default::default()
     });
     // TCP with no bind_addr = outbound-only (fallback when UDP is blocked).
     cfg.transports.tcp = TransportInstances::Single(Default::default());
-    // Fast-connect profile — a phone opens the app and expects the node NOW.
-    // Stock pacing is tuned for always-on routers: a failed discovery backs
-    // off 30s, session resends gap out to 8-16s, dead links redial at
-    // 5s→300s. Over 5G that stacked into a ~40s first connect (observed
-    // 2026-07-24: anchor +10s, session +40s). Retries only fire while a
-    // link/session is down, so steady-state traffic is unchanged.
-    cfg.node.retry.base_interval_secs = 1; // dead-link redial 1s,2s,4s…
-    cfg.node.retry.max_backoff_secs = 30; // …capped at 30s, not 5 min
-    cfg.node.retry.max_retries = 30;
-    cfg.node.rate_limit.handshake_resend_interval_ms = 400;
-    cfg.node.rate_limit.handshake_resend_backoff = 1.5;
-    cfg.node.rate_limit.handshake_max_resends = 10;
-    cfg.node.discovery.backoff_base_secs = 1; // failed lookup retries fast
-    cfg.node.discovery.backoff_max_secs = 30;
-    cfg.node.discovery.retry_interval_secs = 2;
-    cfg.node.discovery.max_attempts = 3;
-    // Lookups launched before the tree position settles are doomed; a 10s
-    // completion timeout made each one cost 10s before the 1s retry could
-    // fire (observed: 19s to a route on a fresh join). Fail fast instead —
-    // the resend-within-window above still gives each attempt two shots.
-    cfg.node.discovery.timeout_secs = 5;
     cfg.peers = peers;
     cfg
 }
@@ -119,24 +94,11 @@ pub fn parse_peers(peers_json: &str) -> Result<Vec<PeerConfig>> {
 /// Start the mesh node on the given TUN fd (from `VpnService.establish()`,
 /// detached — the node owns it from here). Returns (npub, ula) on success.
 /// Any previously running node is stopped first.
-pub fn start(secret: &str, peers_json: &str, tun_fd: i32, listen_port: u16) -> Result<(String, String)> {
+pub fn start(secret: &str, peers_json: &str, tun_fd: i32) -> Result<(String, String)> {
     stop();
 
-    // Android hands the VpnService TUN fd over in non-blocking mode on some
-    // OS builds. The fips TUN reader is a dedicated blocking-read thread that
-    // treats EAGAIN as fatal — the loop died at startup ("TUN read error …
-    // Try again (os error 11)" on-device), so sessions came up but no packet
-    // ever entered the mesh. Force the fd into the blocking mode the reader
-    // is designed for.
-    unsafe {
-        let flags = libc::fcntl(tun_fd, libc::F_GETFL);
-        if flags >= 0 && (flags & libc::O_NONBLOCK) != 0 {
-            libc::fcntl(tun_fd, libc::F_SETFL, flags & !libc::O_NONBLOCK);
-        }
-    }
-
     let peers = parse_peers(peers_json)?;
-    let config = build_config(secret, peers, listen_port);
+    let config = build_config(secret, peers);
     let mut node = Node::new(config).map_err(|e| anyhow!("node init: {e}"))?;
     let npub = node.npub();
     let address = node.identity().address().to_ipv6().to_string();
@@ -272,7 +234,7 @@ mod tests {
     #[test]
     fn config_is_leaf_only_with_tun() {
         let id = generate_identity().unwrap();
-        let cfg = build_config(&id.secret_hex, vec![], 0);
+        let cfg = build_config(&id.secret_hex, vec![]);
         assert!(cfg.node.leaf_only);
         assert!(cfg.tun.enabled);
         assert_eq!(cfg.tun.mtu(), 1280);
@@ -280,16 +242,4 @@ mod tests {
         assert!(!cfg.transports.udp.is_empty());
         assert!(!cfg.transports.tcp.is_empty());
     }
-
-    #[test]
-    fn listen_port_sets_fixed_udp_bind() {
-        let id = generate_identity().unwrap();
-        let cfg = build_config(&id.secret_hex, vec![], 2121);
-        // Party mode keeps leaf_only — accepting a link is not routing transit.
-        assert!(cfg.node.leaf_only);
-        let TransportInstances::Single(udp) = &cfg.transports.udp else {
-            panic!("expected single UDP transport");
-        };
-        assert_eq!(udp.bind_addr.as_deref(), Some("0.0.0.0:2121"));
-    }
 }

CHANGELOG.md

@@ -1,57 +1,7 @@
 # Changelog
 
-## v1.7.117-alpha (2026-07-27)
+## v1.7.112-alpha (2026-07-22)
 
-- FIPS startup is more reliable on nodes that have the packaged `fips.service` instead of Archipelago's `archipelago-fips.service`. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.
-- App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.
-- Companion WebView safe-area handling now also moves fixed and sticky top bars below the phone status bar, including headers mounted after page load by single-page apps.
-- Public-source preparation now includes a Nostr Git hosting plan using `ngit`, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.
-- Node OS release notes for v1.7.117 are still open; add any installer, service, kernel, firewall, or package changes here before cutting the release.
-
-## v1.7.116-alpha (2026-07-27)
-
-- Nodes no longer get stuck on "server starting up" after an update or reboot. On a node running many apps, the backend used to spend minutes recovering containers before it told the system it was ready, and anything that touched it during that window could leave it down for good. It now reports ready immediately and recovers in the background, and it always restarts itself if it ever does go down.
-- Installing apps no longer crashes the node. A change that made app screens reachable over the mesh was accidentally holding onto every app's network port in advance — so installing an app like Grafana, Photoprism, Uptime Kuma, or Jellyfin collided with it and the port-cleanup step took the whole backend down, rolling the install back. Installs are now clean and the backend can never be caught by that cleanup.
-- Rolls up everything from v1.7.115: app screens and the dashboard load over the mesh out of the box (firewall openings shipped automatically, IPv6 support end to end), and nodes rejoin the mesh in seconds after their rendezvous point restarts.
-
-## v1.7.115-alpha (2026-07-26)
-
-- The companion app can reach your node's screen from anywhere again. The recent security hardening locked down the node's mesh interface so tightly that the dashboard itself was blocked — the phone would pair and connect, then sit on a blank screen. The node now explicitly opens its own web interface (and only that) through the mesh firewall on every install and upgrade, so the phone's view of your node works out of the box, on any network, and can't silently break in a future update.
-- The node's web interface also answers on IPv6 everywhere it answers on IPv4 — the mesh runs entirely on IPv6, and one v4-only listener was enough to make a working connection show nothing.
-- Nodes now come back onto the mesh in seconds instead of minutes after their rendezvous anchor restarts: the fast-reconnect tuning proven on the phone this week is now baked into every node's mesh configuration, and it survives upgrades.
-
-## v1.7.114-alpha (2026-07-26)
-
-- Plugging in a mesh radio no longer traps it in an endless reboot loop. The device detector itself was causing it: every scan pulsed the radio's reset line, the same board was probed twice under two names, and retries came so fast the radio never finished booting before the next reset hit. Detection now gives the board real time to boot, probes it once, backs off properly between attempts, and no longer fights the "device detected" popup for the port. Radios that could never connect now come up within a minute of being plugged in.
-- The Lightning channels screen now has All / Active / Pending / Closed tabs. Pending gathers everything in motion (opening, closing, force-closing — each with its own status dot and a link to the closing transaction), and Closed is a real history: how each channel ended, what settled back to you, and the closing transaction for each.
-- Sending bitcoin on-chain now puts you in charge of the network fee: pick Fast, Standard, or Slow (Standard is the default), or set your own target blocks or sats-per-vByte. The confirmation step shows the estimated fee for your chosen speed before any money moves.
-- Type on-chain amounts in whichever unit you think in — a sats/BTC switch on the amount field converts as you type.
-- Back up your seed by scanning it. Every recovery-phrase screen (onboarding, Settings, and the Lightning wallet seed) now has Words and QR code tabs — words always shown first. The QR for your node's recovery phrase uses the SeedQR standard, so hardware wallets like Passport Prime, SeedSigner, and Keystone can import it with a single scan (a plain-text option remains for wallets that read the phrase as text). The Lightning seed's QR is plain text with an honest note: it's an LND-format seed that restores into Lightning wallets like Zeus or Blixt, not into hardware wallets.
-
-## v1.7.113-alpha (2026-07-25)
-
-- Fixed a money bug in Cashu ecash sends: the token you handed a recipient could carry your own change proofs along with it, letting the same sats be credited twice. Change now stays in your wallet — only the amount you meant to send leaves it.
-- Closing a Lightning channel is no longer a leap of faith. The close used to hang (or time out with an error) even though it had actually gone through; it now comes back within seconds with the closing transaction ID. Channels mid-close appear in the channel list as Closing or Force-closing with their transaction attached, and a new closed-channels history keeps past closes visible instead of letting them vanish from the list.
-- The wallet card now leads with your total bitcoin across everything, and the on-chain balance gets its own chain icon so the rows read at a glance.
-- The companion phone app (0.5.15) connects dramatically faster away from home: a cold connect over 5G dropped from 40+ seconds to about 5. First connects no longer stall on unreachable mesh dial hints, fresh joins fail fast and retry instead of waiting out long timeouts, and the phone re-announces itself the moment the network around it changes. The node side's mesh-join handling was hardened to match.
-
-## v1.7.112-alpha (2026-07-23)
-
-- Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.
-- Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.
-- The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.
-- Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.
-- Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.
-- The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.
-- Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.
-- Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.
-- Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.
-- Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.
-- Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.
-- A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.
-- Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.
-- If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.
-- Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.
 - Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.
 - Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.
 - Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.

CODE_OF_CONDUCT.md

@@ -1,19 +0,0 @@
-# Code of Conduct
-
-## Our standard
-
-Be direct, respectful, and focused on the work. Healthy disagreement is welcome;
-harassment, personal attacks, and discriminatory language are not.
-
-## Scope
-
-This code of conduct applies to project repositories, issue trackers, pull
-requests, documentation, chat, and community spaces connected to Archipelago.
-
-## Enforcement
-
-Maintainers may edit, hide, or remove comments and may restrict participation
-for behavior that makes collaboration unsafe or unproductive.
-
-Report conduct concerns privately through the repository owner account or the
-private contact channel listed on the project homepage.

CONTRIBUTING.md

@@ -1,100 +1,161 @@
 # Contributing to Archipelago
 
-This project is preparing for public developer contribution. The highest-value
-contributions are focused fixes, tests, app manifests, documentation
-improvements, and clear bug reports with reproducible evidence.
+Thank you for your interest in contributing to Archipelago! This document covers the process for contributing code, reporting bugs, and submitting apps.
 
-## Development setup
+## Code of Conduct
 
-### Frontend
+Be respectful. We follow the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+## Getting Started
+
+1. Fork the repository on the project's Gitea instance
+2. Clone your fork: `git clone <your-fork-url>/archy.git`
+3. Set up the dev environment (see `docs/developer-guide.md`)
+4. Create a feature branch: `git checkout -b feature/your-feature`
+
+## Development Setup
+
+### Frontend (Vue.js)
 
 ```bash
 cd neode-ui
 npm install
-npm start
-npm run type-check
-npm test
+npm start          # Dev server on :8100
+npm run type-check # TypeScript validation
+npm run build      # Production build
+npm test           # Run tests
 ```
 
-### Backend
+### Backend (Rust)
+
+Build on a Linux server (Debian 13), **not** macOS:
 
 ```bash
-cd core
-cargo fmt --all -- --check
-cargo clippy --all-targets --all-features -- -D warnings
+cargo clippy --all-targets --all-features
+cargo fmt --all
 cargo test --all-features
 ```
 
-Linux is required for host integration work involving Podman, systemd,
-networking, or image builds. Frontend development works locally with the mock
-backend.
-
-## App manifests
-
-App packages live under `apps/<app-id>/manifest.yml` and use the schema
-documented in [docs/app-manifest-spec.md](docs/app-manifest-spec.md). Validate
-before submitting:
+### Deploy to dev server
 
 ```bash
-./scripts/validate-app-manifest.sh apps/<app-id>/manifest.yml
-python3 scripts/generate-app-catalog.py
-python3 scripts/check-app-catalog-drift.py --release --strict
+./scripts/deploy-to-target.sh --live
 ```
 
-App submissions must:
+## Code Style
 
-- pin container image versions;
-- avoid hardcoded secrets;
-- use `security.no_new_privileges: true`;
-- use `security.readonly_root: true` unless the manifest explains why writable
-  root is required;
-- request only necessary Linux capabilities;
-- store durable data under `/var/lib/archipelago/<app-id>/`;
-- define truthful health checks and launch interfaces for user-facing UIs.
+### Frontend (TypeScript + Vue)
 
-## Code style
+- `<script setup lang="ts">` — always Composition API
+- TypeScript strict mode — no `any`, use `unknown` or proper types
+- Global CSS classes in `src/style.css` — never inline Tailwind in components
+- Pinia for state management — focused single-purpose stores
+- Use `@/api/rpc-client.ts` for RPC calls
 
-- Rust: prefer `?` over `unwrap()`/`expect()` in production paths.
-- Rust: use `tracing` for structured logs.
-- TypeScript: avoid `any`; use explicit types or `unknown`.
-- Vue: prefer `<script setup lang="ts">`.
-- Keep changes scoped; do not mix drive-by refactors with behavioral changes.
-- Remove dead code rather than commenting it out.
-- Add tests for new behavior and regression tests for bug fixes.
+### Backend (Rust)
 
-## Pull requests
+- No `unwrap()` or `expect()` in production code — use `?` operator
+- `thiserror` for library errors, `anyhow` for application errors
+- `tracing` for structured logging — never `println!`
+- Run `cargo clippy` and `cargo fmt` before commits
 
-1. Open one focused PR per behavior or documentation change.
-2. Explain what changed, why it changed, and how it was verified.
-3. Include screenshots for UI changes.
-4. Link relevant issues or docs.
-5. Keep generated catalog changes in sync with manifest changes.
+### General
 
-Suggested commit format:
+- Functions under 50 lines, single responsibility
+- Comment WHY not WHAT
+- Remove dead code — never comment it out
+- No `TODO`/`FIXME` in commits
 
-```text
-feat: add backup scheduling
-fix: reject unsafe manifest volume
-docs: clarify app deployment flow
-test: cover catalog drift check
+## Commit Format
+
+```
+type: description
 ```
 
-## Reporting bugs
+**Types**: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`, `perf:`
 
-Include:
+Examples:
+- `feat: add backup scheduling to settings page`
+- `fix: handle WiFi connection timeout gracefully`
+- `test: add unit tests for RPC client retry logic`
 
-- exact version or commit;
-- host platform and architecture;
-- steps to reproduce;
-- expected and actual behavior;
-- logs from the relevant component;
-- screenshots for UI issues.
+## Pull Request Process
 
-## Security
+1. Ensure your branch is up to date with `main`
+2. All checks must pass: TypeScript, build, tests, clippy
+3. Include a clear description of what changed and why
+4. Link any related issues
+5. Request review from a maintainer
 
-Do not report vulnerabilities in public issues. Follow [SECURITY.md](SECURITY.md).
+### PR Checklist
+
+- [ ] TypeScript type-check passes (`npm run type-check`)
+- [ ] Frontend builds (`npm run build`)
+- [ ] Tests pass (`npm test`)
+- [ ] Rust clippy clean (`cargo clippy --all-targets --all-features`)
+- [ ] No new compiler warnings
+- [ ] Follows code style guidelines above
+
+## Testing Requirements
+
+- New features need tests
+- Bug fixes need a regression test
+- Frontend: Vitest + Vue Test Utils
+- Backend: `#[test]` and `#[tokio::test]`
+- Target: maintain or improve existing coverage
+
+## Reporting Bugs
+
+Use the **Bug Report** issue template. Include:
+
+1. Steps to reproduce
+2. Expected behavior
+3. Actual behavior
+4. System info (hardware, OS version, Archipelago version)
+5. Screenshots if applicable
+6. Relevant logs (`journalctl -u archipelago`)
+
+## Feature Requests
+
+Use the **Feature Request** issue template. Include:
+
+1. Problem description
+2. Proposed solution
+3. Alternatives considered
+4. Impact on existing users
+
+## App Submissions
+
+To submit an app for the Archipelago marketplace:
+
+1. Create a manifest following `docs/app-manifest-spec.md`
+2. Ensure the container image is published to a public registry
+3. Test on Archipelago hardware (x86_64 and ARM64 if possible)
+4. Open a PR adding the app to the curated list
+5. Include: app description, icon, resource requirements, dependencies
+
+### App Requirements
+
+- Container must run as non-root (UID > 1000)
+- `readonly_root: true` unless explicitly justified
+- Drop all capabilities except those required
+- `no-new-privileges: true`
+- Pin specific image versions (no `latest` tag)
+- No hardcoded secrets
+
+## Security Disclosure
+
+**Do NOT open public issues for security vulnerabilities.**
+
+Email security concerns to the maintainers directly. Include:
+
+1. Description of the vulnerability
+2. Steps to reproduce
+3. Potential impact
+4. Suggested fix (if any)
+
+We will acknowledge receipt within 48 hours and provide a timeline for a fix.
 
 ## License
 
-By contributing, you agree that your contribution is licensed under the
-project's MIT License.
+By contributing, you agree that your contributions will be licensed under the same license as the project.

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Dorian and the Archipelago Project contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

NOTICE

@@ -1,73 +0,0 @@
-# Archipelago — Third-Party Notices
-
-Archipelago is licensed under the MIT License (see LICENSE).
-This file lists third-party components included in this repository and its
-release artifacts, with their licenses and required attributions.
-
-## Embedded / vendored components
-
-- **FIPS mesh networking** — https://github.com/jmcorgan/fips
-  Copyright (c) 2026 Johnathan Corgan. MIT License.
-  Used as the embedded mesh VPN in the OS (`fips` daemon, pinned v0.4.1) and
-  compiled into the Android companion app (`Android/rust/archy-fips-core`).
-
-- **QR Code Generator for JavaScript** — http://www.d-project.com/
-  Copyright (c) 2009 Kazuhiko Arase. MIT License.
-  Vendored at `docker/lnd-ui/qrcode.js` and `docker/electrs-ui/qrcode.js`
-  (original headers preserved).
-
-- **nostr-rs-relay** — https://github.com/scsibug/nostr-rs-relay — MIT License.
-  Binary extracted into the OS image at `/opt/archipelago/bin/`.
-
-- **Reticulum (RNS) and LXMF** — https://github.com/markqvist/Reticulum
-  Copyright Mark Qvist. Distributed under the Reticulum License (an MIT-style
-  license with field-of-use restrictions: no use in systems designed to harm
-  human beings, and no use in AI/ML training datasets). The optional
-  `archy-reticulum-daemon` binary bundles RNS 1.3.5 and LXMF 1.0.1. The
-  Reticulum License is NOT an OSI-approved open-source license; it applies
-  only to that optional component, not to Archipelago itself.
-
-## Fonts
-
-- **Montserrat** — SIL Open Font License 1.1
-  (`neode-ui/public/assets/fonts/Montserrat/OFL.txt`).
-- **Open Sans** — Apache License 2.0
-  (`neode-ui/public/assets/fonts/Open_Sans/LICENSE.txt`).
-
-## Artwork and icons
-
-- **Mesh device artwork** (`neode-ui/public/assets/img/mesh-devices/`):
-  device illustrations from the Meshtastic project — https://meshtastic.org
-  © Meshtastic contributors, GPL-3.0. Meshtastic® is a registered trademark
-  of Meshtastic LLC. See the ATTRIBUTION.md in that directory.
-- Some UI icons are derived from **game-icons.net** (CC BY 3.0 — see
-  ATTRIBUTION.md in `neode-ui/public/assets/icon/`) and **pixelarticons**
-  (MIT, https://github.com/halfmage/pixelarticons).
-- Third-party application logos under `neode-ui/public/assets/img/app-icons/`
-  and `service-icons/` are trademarks of their respective owners, used solely
-  to identify the corresponding applications. No endorsement is implied.
-
-## Original media
-
-All demo content (music, photos, posters in `demo/`), UI sound effects,
-background images, and intro video in `neode-ui/public/assets/` are original
-works created and owned by the Archipelago project author, released with the
-project. The welcome voice line (`welcome-noderunner.mp3`) was generated with
-ElevenLabs TTS under a commercial-use plan.
-
-## Redistributed software (ISO and container registry)
-
-The Archipelago OS image is based on Debian and redistributes Debian packages
-(including the Linux kernel, GRUB, and non-free firmware/microcode blobs
-required for hardware support); per-package license texts are preserved at
-`/usr/share/doc/*/copyright` in the installed system, and corresponding source
-is available via Debian (https://snapshot.debian.org) as referenced in each
-release's notes. Container images offered through the app catalog and mirror
-registry remain under their upstream licenses (including GPL/AGPL software
-such as mempool, Nextcloud, Vaultwarden, SearXNG, PhotoPrism, Immich,
-Jellyfin, MariaDB, AdGuard Home, and strfry); source links are provided in
-the app catalog. The modified mempool-frontend image is built from
-`docker/mempool-frontend/` in this repository (AGPL-3.0 corresponding source).
-
-Full per-crate and per-package license inventories for release binaries are
-generated at build time (see THIRD-PARTY-LICENSES files in release artifacts).

README.md

@@ -1,11 +1,8 @@
 # Archipelago
 
-> Self-sovereign Bitcoin node OS and manifest-driven app platform.
+> Self-Sovereign Bitcoin Node OS
 
-Archipelago is a bootable personal server OS for Bitcoin infrastructure,
-self-hosted apps, mesh communication, decentralized identity, and federation.
-Apps are packaged as declarative `manifest.yml` files and run as rootless
-Podman containers managed by the Rust backend.
+**Archipelago** is a bootable personal server OS. Flash it to a USB drive, install on any x86_64 or ARM64 machine, and manage Bitcoin infrastructure, self-hosted apps, mesh communication, and decentralized identity through a glassmorphism web UI.
 
 [![Debian 13](https://img.shields.io/badge/Debian-13%20Trixie-a80030)](https://www.debian.org/)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
@@ -13,101 +10,193 @@ Podman containers managed by the Rust backend.
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
 [![Version](https://img.shields.io/badge/version-1.8.0--alpha-blue)]()
 
-## What is here
+## Philosophy
 
-- `core/` - Rust workspace: backend API, container runtime, security, OpenWrt
-  helpers, and performance/resource management.
-- `neode-ui/` - Vue 3 + TypeScript frontend.
-- `apps/` - app manifests and custom app container sources.
-- `docker/` - supporting container build contexts for UI companion surfaces.
-- `image-recipe/` - bootable image/ISO build inputs.
-- `Android/` - Android companion app.
-- `scripts/` - development, release, deployment, and validation tooling.
-- `docs/` - architecture, app packaging, operations, API, and roadmap docs.
+Archipelago is being built as a **developer-ready app platform**, not a fixed appliance:
 
-## Platform model
+- **Manifest-driven apps.** Every app is declared in a single `manifest.yml` — image, ports, volumes, secrets, health checks, security policy. The orchestrator owns the entire lifecycle; there is no per-app installer code and no host-level provisioning.
+- **Signed distribution.** App manifests ship inside an Ed25519-signed catalog verified against a pinned release-root key, not as loose files on disk. OTA release manifests are signed the same way.
+- **Decentralized marketplace.** Third-party developers publish apps via Nostr-based discovery (NIP-78) with DID-signed manifests and federation-weighted trust scoring — no gatekept central store.
+- **Rootless and secure by default.** Rootless Podman only. Read-only root, no-new-privileges, capability allow-list, secrets materialised 0600 and never logged. Never rootful, never a Docker socket mount.
+- **100%-uptime-capable.** Every container is a systemd Quadlet unit under `user.slice` that survives backend restarts; a level-triggered reconciler self-heals drift every 30 seconds; migrations never destroy data.
 
-Archipelago is built as a developer-ready app platform, not a fixed appliance:
+## Features
 
-- Apps are declared in `apps/<app-id>/manifest.yml`.
-- The Rust parser in `core/container/src/manifest.rs` is the canonical schema.
-- The orchestrator compiles manifests to rootless Podman/Quadlet runtime state.
-- App data lives under `/var/lib/archipelago/<app-id>/`.
-- Secrets are generated or read from `/var/lib/archipelago/secrets/` and
-  injected through Podman secrets rather than static environment values.
-- Release and app catalogs are signed and verified against a pinned trust
-  anchor.
+### Bitcoin Infrastructure
+- **Bitcoin Core and Bitcoin Knots** full nodes with per-app version pinning and bulletproof version switching, automatic prune/full mode based on disk size
+- **LND** and **Core Lightning** with channel management
+- **ElectrumX** Electrum server for wallet connectivity
+- **BTCPay Server** for accepting Bitcoin payments
+- **Mempool** block explorer and fee estimator
+- **Fedimint** federation guardian, gateway, and client — plus Cashu ecash wallet support
 
-Start with:
+### Self-Hosted Apps (50+)
+Storage (FileBrowser, Immich, Nextcloud), Productivity (Vaultwarden), Media (Jellyfin, PhotoPrism, IndeeHub), Search (SearXNG), Network (NetBird, Tailscale), Home (Home Assistant), Nostr (nostr-rs-relay, strfry), Dev/Ops (Gitea, Grafana, Portainer, Uptime Kuma), and more — 27 curated in the store UI, 50+ packaged as manifests.
 
-- [Architecture](docs/architecture.md)
-- [Developer Guide](docs/developer-guide.md)
-- [App Developer Guide](docs/app-developer-guide.md)
-- [App Manifest Spec](docs/app-manifest-spec.md)
-- [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md)
-- [Operations Runbook](docs/operations-runbook.md)
-- [Troubleshooting](docs/troubleshooting.md)
+### Mesh Networking (tri-protocol)
+- **Meshtastic**, **MeshCore**, and **Reticulum (RNS/LXMF)** LoRa transports behind one mesh chat UI
+- End-to-end encryption with X3DH key agreement + double-ratchet
+- RNode radio support with an OS-level `archy-rnodeconf` tool; interop verified against Sideband
+- Image/voice attachments, mesh AI assistant (`!ai`), Bitcoin balance relay over mesh
 
-## Quick start
+### Decentralized Identity
+- Ed25519 node identity with DID Documents (did:key)
+- Multi-identity management (Personal/Business/Anonymous)
+- W3C Verifiable Credentials issuance and verification
+- Nostr integration: NIP-33 node discovery, NIP-44/NIP-04 encryption, NIP-07 signer bridge for iframe apps, relay hosting
+- Decentralized Web Node (DWN) record sync between federated nodes over Tor
 
-### Frontend
+### Multi-Node Federation
+- Invite-based node joining over Tor hidden services
+- Trust levels (Trusted/Verified/Untrusted) with DID-based auth
+- State sync and app deployment across federated nodes
+- File sharing with access controls (free/peers-only/paid via Lightning, on-chain, or ecash)
+
+### System Updates
+- OTA updates from a self-hosted Gitea release server, Ed25519-signature-verified against a pinned release-root key
+- Resumable downloads, automatic pre-update backup, rollback with a post-update self-verify window
+- Manual, scheduled-check, and auto-apply modes (auto-apply refuses unsigned manifests)
+
+### Security
+- Argon2id password hashing (transparent upgrade from legacy hashes), ChaCha20-Poly1305 encrypted secrets at rest
+- Rootless Podman: read-only root, cap-drop ALL with a reviewed allow-list, no-new-privileges
+- Signed release manifests and signed app catalog (Ed25519, pinned trust anchor)
+- TOTP two-factor authentication, per-endpoint rate limiting, CSRF protection
+- AppArmor profiles for container confinement; Tor hidden services for inter-node traffic
+- Independent security audit of an early version archived in [`docs/archive/`](docs/archive/security-code-audit-2026-03.md); top findings since remediated
+
+## Roadmap
+
+**Done**
+- Single-node production gate **green** — install / stop / start / restart / reinstall / reboot-survive / uninstall, 5 consecutive full runs with zero failures on real hardware
+- Quadlet migration validated (all backends as `user.slice` services on the canary node)
+- Release signing ceremony completed — release-root key pinned, catalog and OTA manifests signed
+- Reticulum third mesh transport (real-RF LoRa gates passed), Bitcoin Core/Knots multi-version switching, decentralized marketplace backend, public demo
+
+**In progress**
+- Multinode pass: the same production gate across the whole test fleet ([`docs/multinode-testing-plan.md`](docs/multinode-testing-plan.md))
+- Quadlet default flip fleet-wide + container-flapping elimination
+- 1.8.0 release hardening tail ([`docs/1.8.0-RELEASE-HARDENING-PLAN.md`](docs/1.8.0-RELEASE-HARDENING-PLAN.md)): OTA upgrade soak on real hardware, ISO/image hardening (per-device keys, no default creds, signed ISO)
+
+**Planned**
+- Developer CLI (`archy app validate/render/install/test`) to open third-party app publishing
+- External marketplace trust UX + publishing tooling ([`docs/marketplace-protocol.md`](docs/marketplace-protocol.md))
+- DHT/P2P distribution of releases and app images ([`docs/dht-distribution-design.md`](docs/dht-distribution-design.md))
+- P2P encrypted voice/video over Tor, dual-ecash (Fedimint + Cashu) phases, paid streaming, hardware signer support
+
+The live, priority-ordered task list is [`docs/UNIFIED-TASK-TRACKER.md`](docs/UNIFIED-TASK-TRACKER.md); the full narrative plan is [`docs/PRODUCTION-MASTER-PLAN.md`](docs/PRODUCTION-MASTER-PLAN.md).
+
+## Quick Start
+
+### Install from ISO
+
+1. Build or download the ISO for your architecture (x86_64 or ARM64) — see [`image-recipe/`](image-recipe/)
+2. Flash to USB drive with Balena Etcher or `dd`
+3. Boot from USB on target hardware and follow the automated installer
+4. Access the web UI at `http://<device-ip>`
+5. Set your password and complete the onboarding wizard (seed backup, DID identity)
+
+### Supported Hardware
+
+| Platform | Examples | Minimum |
+|----------|----------|---------|
+| **x86_64** | Intel NUC, mini PCs, any 64-bit PC | 4GB RAM, 32GB storage |
+| **ARM64** | Raspberry Pi 5, ARM64 SBCs | 4GB RAM, 32GB storage |
+
+**Recommended**: 8GB+ RAM, 1TB+ NVMe SSD (for a full Bitcoin node). Optional: an RNode-compatible LoRa radio for mesh networking.
+
+## Development
+
+### Prerequisites
+- macOS or Linux for frontend development
+- Linux dev server (Debian 13) for backend builds — **never build Rust on macOS for Linux**
+- Node.js 20+, Rust stable toolchain
+
+### Frontend Development
 
 ```bash
 cd neode-ui
 npm install
-npm start
+npm start          # Dev server on http://localhost:8100 (mock backend on :5959)
+npm run type-check # TypeScript validation
+npm run build      # Production build → web/dist/neode-ui/
 ```
 
-The dev UI runs at `http://localhost:8100` with a mock backend on `:5959`.
-
-### Backend
+### Backend Development
 
 ```bash
-cd core
+cd core            # Rust workspace root (no Cargo.toml at repo root)
 cargo build
-cargo test --all-features
+cargo test
 ```
 
-Linux is the supported backend runtime and release-build target. macOS is fine
-for frontend work and many Rust compile/test loops, but host integration tests
-that touch Podman, systemd, networking, or image build paths require Linux.
-
-### App manifests
+### Deploy to a Test Node
 
 ```bash
-./scripts/validate-app-manifest.sh apps/filebrowser/manifest.yml
-python3 scripts/generate-app-catalog.py
-python3 scripts/check-app-catalog-drift.py --release --strict
+./scripts/deploy-to-target.sh --live   # Deploy to primary dev server
+./scripts/deploy-to-target.sh --both   # Deploy to both LAN servers
 ```
 
-`scripts/generate-app-catalog.py` requires Python with PyYAML installed.
+### Release (tarball-only)
 
-## Documentation map
+Releases ship as a backend binary and a frontend tarball referenced by
+`releases/manifest.json`, published to the self-hosted Gitea release server.
+
+```bash
+./scripts/create-release.sh 1.2.3
+git push origin main --tags
+```
+
+## Architecture
+
+```
+Debian 13 (Trixie)
+  ├── Rootless Podman — every app a systemd Quadlet unit under user.slice
+  ├── Nginx (reverse proxy, security headers, rate limiting)
+  ├── Rust Backend (JSON-RPC API on 127.0.0.1:5678, ~380 RPC methods)
+  │     ├── core/archipelago/  — API, orchestrator + reconciler, mesh, identity,
+  │     │                        federation, wallet, updates, marketplace
+  │     ├── core/container/    — Podman client, manifest schema, Quadlet compiler,
+  │     │                        health monitor, signed app catalog
+  │     ├── core/security/     — AppArmor/seccomp policy, secrets manager
+  │     ├── core/openwrt/      — TollGate gateway provisioning (SSH/UCI)
+  │     └── core/performance/  — resource limits
+  ├── Vue 3 Frontend (Composition API + TypeScript strict + Pinia + Tailwind, PWA)
+  │     └── Three UI modes (Pro/Easy/Chat) + gamepad navigation + i18n
+  ├── Reticulum daemon (supervised Python/PyInstaller, one per LoRa radio)
+  └── System Tor (hidden services, SOCKS5 proxy)
+```
+
+~117,000 lines of Rust | ~69,000 lines of TypeScript/Vue | 51 packaged apps | Android companion app
+
+## Documentation
 
 | Doc | Purpose |
 |-----|---------|
-| [Architecture](docs/architecture.md) | System layers, crates, data paths, security model |
-| [Developer Guide](docs/developer-guide.md) | Local setup, code workflow, testing |
-| [API Reference](docs/api-reference.md) | JSON-RPC API overview |
-| [App Developer Guide](docs/app-developer-guide.md) | How to package and test apps |
-| [App Manifest Spec](docs/app-manifest-spec.md) | Manifest schema and validation rules |
-| [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md) | ngit/NIP-34 contribution workflow and maintainer model |
-| [Apps README](apps/README.md) | Packaged app catalog overview |
-| [Image Recipe](image-recipe/README.md) | Bootable image build flow |
-| [Operations Runbook](docs/operations-runbook.md) | Production operations and recovery |
-| [Open Source Readiness](docs/OPEN_SOURCE_READINESS.md) | Public-release cleanup checklist |
-| [Roadmap](docs/ROADMAP.md) | Shipped, in-progress, and planned work |
-| [Unified Task Tracker](docs/UNIFIED-TASK-TRACKER.md) | Launch hardening task list |
-| [Archive](docs/archive/) | Historical plans, audits, and handoffs |
+| [Architecture](docs/architecture.md) | System design, crate map, data paths |
+| [Developer Guide](docs/developer-guide.md) | Dev setup, workflow, code conventions |
+| [API Reference](docs/api-reference.md) | RPC endpoint reference |
+| [App Developer Guide](docs/app-developer-guide.md) | Building and publishing apps |
+| [App Manifest Spec](docs/app-manifest-spec.md) | The `manifest.yml` schema |
+| [User Walkthrough](docs/user-walkthrough.md) | End-user installation and usage guide |
+| [Troubleshooting](docs/troubleshooting.md) | Diagnostic scenarios and solutions |
+| [Operations Runbook](docs/operations-runbook.md) | Ops commands and emergency recovery |
+| [Production Master Plan](docs/PRODUCTION-MASTER-PLAN.md) | North star and workstream narrative |
+| [Unified Task Tracker](docs/UNIFIED-TASK-TRACKER.md) | Live, priority-ordered open items |
+| [Test Gate](tests/lifecycle/TESTING.md) | Production lifecycle test gate (definition of done) |
+| [Archive](docs/archive/) | Historical audits, session logs, shipped designs |
 
 ## Contributing
 
-Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. For
-security issues, follow [SECURITY.md](SECURITY.md) and do not open a public
-issue.
+1. Fork the repository
+2. Create a feature branch (`feature/description`)
+3. Follow the coding standards in [CONTRIBUTING.md](CONTRIBUTING.md) and [CLAUDE.md](CLAUDE.md)
+4. Submit a pull request
 
 ## License
 
-Archipelago is licensed under the [MIT License](LICENSE). Third-party notices
-are listed in [NOTICE](NOTICE) and generated license inventories in component
-release artifacts.
+[MIT License](LICENSE)
+
+## Acknowledgments
+
+Built with: [Rust](https://www.rust-lang.org/), [Vue.js](https://vuejs.org/), [Podman](https://podman.io/), [Bitcoin Core](https://bitcoin.org/), [LND](https://lightning.engineering/), [Reticulum](https://reticulum.network/), [Debian](https://www.debian.org/)

SECURITY.md

@@ -1,38 +0,0 @@
-# Security Policy
-
-## Reporting vulnerabilities
-
-Please do not open a public issue for a security vulnerability.
-
-Until a dedicated security intake address is published, report privately to the
-project maintainer through the repository owner account or the private contact
-channel listed on the project homepage.
-
-Include:
-
-- affected commit, version, or release;
-- affected component;
-- reproduction steps;
-- expected impact;
-- logs, proof of concept, or packet captures when relevant;
-- whether the issue is already public.
-
-We aim to acknowledge credible reports within 48 hours and coordinate fixes
-before public disclosure.
-
-## Scope
-
-Security-sensitive areas include:
-
-- authentication, session handling, CSRF, and rate limiting;
-- release and app-catalog signature verification;
-- container manifest validation and runtime compilation;
-- Podman/Quadlet isolation, capabilities, volumes, and secret injection;
-- backup encryption and key derivation;
-- federation, Tor, Nostr, mesh, DID, and credential flows;
-- Android companion pairing and device-token handling.
-
-## Supported versions
-
-Archipelago is currently pre-1.0 alpha software. Security fixes target the
-current `main` branch and the latest published alpha release.

apps/DEVELOPMENT.md

@@ -76,17 +76,7 @@ podman run -p 18084:8080 \
 
 ## Integration Checklist
 
-Adding a new app requires updates in multiple places:
-
-- add `apps/<app-id>/manifest.yml`;
-- add a Dockerfile and source directory only when the app is built locally;
-- choose non-conflicting ports from [PORTS.md](./PORTS.md);
-- declare `interfaces.main` for user-facing web UIs;
-- declare generated secrets instead of hardcoding credentials;
-- run `./scripts/validate-app-manifest.sh apps/<app-id>/manifest.yml`;
-- regenerate catalogs with `python3 scripts/generate-app-catalog.py`;
-- verify drift with `python3 scripts/check-app-catalog-drift.py --release --strict`;
-- test install, launch, stop, start, restart, uninstall, and reinstall.
+Adding a new app requires updates in multiple places. See the full checklist in [CLAUDE.md](../CLAUDE.md) under "App Integration Checklist".
 
 ## Port Assignments
 

core/.env.production

@@ -0,0 +1,33 @@
+# Archipelago Production Configuration
+# This file is bundled with the macOS app
+
+# Server Configuration
+ARCHIPELAGO_HOST=127.0.0.1
+ARCHIPELAGO_PORT=8100
+ARCHIPELAGO_BACKEND_PORT=3030
+
+# Data Directories (relative to ~/Library/Application Support/Archipelago)
+ARCHIPELAGO_DATA_DIR=data
+ARCHIPELAGO_LOG_DIR=logs
+
+# Frontend Configuration
+ARCHIPELAGO_FRONTEND_DIR=frontend
+
+# Docker UI Configuration
+ARCHIPELAGO_DOCKER_UI_DIR=docker-ui
+
+# Security
+ARCHIPELAGO_SESSION_SECRET=CHANGE_ME_ON_FIRST_RUN
+
+# Logging
+RUST_LOG=info
+
+# Production Mode
+NODE_ENV=production
+ARCHIPELAGO_MODE=production
+
+# Docker Configuration
+DOCKER_HOST=unix:///var/run/docker.sock
+
+# Disable External API Calls in Production
+ARCHIPELAGO_DISABLE_EXTERNAL_APIS=true

core/Cargo.lock

@@ -84,15 +84,6 @@ version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arc-swap"
 version = "1.9.1"
@@ -104,7 +95,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.116-alpha"
+version = "1.7.111-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",
@@ -154,7 +145,6 @@ dependencies = [
  "serde_yaml",
  "serial2-tokio",
  "sha2 0.10.9",
- "socket2 0.5.10",
  "tar",
  "tempfile",
  "thiserror 1.0.69",
@@ -170,7 +160,6 @@ dependencies = [
  "uuid",
  "zbase32",
  "zeroize",
- "zip",
 ]
 
 [[package]]
@@ -1185,17 +1174,6 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "derive_builder"
 version = "0.20.2"
@@ -6916,37 +6894,8 @@ dependencies = [
  "syn 2.0.114",
 ]
 
-[[package]]
-name = "zip"
-version = "2.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "crossbeam-utils",
- "displaydoc",
- "flate2",
- "indexmap",
- "memchr",
- "thiserror 2.0.18",
- "zopfli",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfcd145825aace48cff44a8844de64bf75feec3080e0aa5cdbde72961ae51a65"
-
-[[package]]
-name = "zopfli"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]

core/THIRD-PARTY-LICENSES.md

@@ -1,656 +0,0 @@
-# Third-Party Rust Crate Licenses — Archipelago core
-
-Generated from `cargo metadata` (all features) on 2026-07-23. 649 external crates.
-Full license texts ship with release artifacts (cargo-about; see docs/LICENSE-COMPLIANCE-AUDIT.md).
-
-| Crate | Version | License | Source |
-|---|---|---|---|
-| adler2 | 2.0.1 | 0BSD OR MIT OR Apache-2.0 | https://github.com/oyvindln/adler2 |
-| aead | 0.5.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| aes | 0.8.4 | MIT OR Apache-2.0 | https://github.com/RustCrypto/block-ciphers |
-| aes-gcm | 0.10.3 | Apache-2.0 OR MIT | https://github.com/RustCrypto/AEADs |
-| ahash | 0.7.8 | MIT OR Apache-2.0 | https://github.com/tkaitchuck/ahash |
-| aho-corasick | 1.1.4 | Unlicense OR MIT | https://github.com/BurntSushi/aho-corasick |
-| allocator-api2 | 0.2.21 | MIT OR Apache-2.0 | https://github.com/zakarumych/allocator-api2 |
-| android_system_properties | 0.1.5 | MIT/Apache-2.0 | https://github.com/nical/android_system_properties |
-| anyhow | 1.0.100 | MIT OR Apache-2.0 | https://github.com/dtolnay/anyhow |
-| arc-swap | 1.9.1 | MIT OR Apache-2.0 | https://github.com/vorner/arc-swap |
-| argon2 | 0.5.3 | MIT OR Apache-2.0 | https://github.com/RustCrypto/password-hashes/tree/master/argon2 |
-| arrayref | 0.3.9 | BSD-2-Clause | https://github.com/droundy/arrayref |
-| arrayvec | 0.7.6 | MIT OR Apache-2.0 | https://github.com/bluss/arrayvec |
-| asn1-rs | 0.7.2 | MIT OR Apache-2.0 | https://github.com/rusticata/asn1-rs.git |
-| asn1-rs-derive | 0.6.0 | MIT OR Apache-2.0 | https://github.com/rusticata/asn1-rs.git |
-| asn1-rs-impl | 0.2.0 | MIT/Apache-2.0 | https://github.com/rusticata/asn1-rs.git |
-| async-trait | 0.1.89 | MIT OR Apache-2.0 | https://github.com/dtolnay/async-trait |
-| async-utility | 0.3.1 | MIT | https://github.com/yukibtc/async-utility.git |
-| async-wsocket | 0.13.1 | MIT | https://github.com/yukibtc/async-wsocket.git |
-| async_io_stream | 0.3.3 | Unlicense | https://github.com/najamelan/async_io_stream |
-| atomic-destructor | 0.3.0 | MIT | https://github.com/yukibtc/atomic-destructor.git |
-| atomic-polyfill | 1.0.3 | MIT OR Apache-2.0 | https://github.com/embassy-rs/atomic-polyfill |
-| atomic-waker | 1.1.2 | Apache-2.0 OR MIT | https://github.com/smol-rs/atomic-waker |
-| attohttpc | 0.30.1 | MPL-2.0 | https://github.com/sbstp/attohttpc |
-| autocfg | 1.5.0 | Apache-2.0 OR MIT | https://github.com/cuviper/autocfg |
-| backon | 1.6.0 | Apache-2.0 | https://github.com/Xuanwo/backon |
-| bao-tree | 0.16.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/bao-tree |
-| base16ct | 1.0.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| base32 | 0.5.1 | MIT OR Apache-2.0 | https://github.com/andreasots/base32 |
-| base58ck | 0.1.0 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin/ |
-| base64 | 0.21.7 | MIT OR Apache-2.0 | https://github.com/marshallpierce/rust-base64 |
-| base64 | 0.22.1 | MIT OR Apache-2.0 | https://github.com/marshallpierce/rust-base64 |
-| base64ct | 1.8.3 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| bcrypt | 0.15.1 | MIT | https://github.com/Keats/rust-bcrypt |
-| bech32 | 0.11.1 | MIT | https://github.com/rust-bitcoin/rust-bech32 |
-| binary-merge | 0.1.2 | MIT OR Apache-2.0 | https://github.com/rklaehn/binary-merge |
-| bip39 | 2.1.0 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bip39/ |
-| bit-vec | 0.9.1 | Apache-2.0 OR MIT | https://github.com/contain-rs/bit-vec |
-| bitcoin | 0.32.5 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin/ |
-| bitcoin-internals | 0.2.0 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin/ |
-| bitcoin-internals | 0.3.0 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin/ |
-| bitcoin-io | 0.1.4 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin |
-| bitcoin-units | 0.1.2 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin/ |
-| bitcoin_hashes | 0.13.0 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin |
-| bitcoin_hashes | 0.14.1 | CC0-1.0 | https://github.com/rust-bitcoin/rust-bitcoin |
-| bitflags | 1.3.2 | MIT/Apache-2.0 | https://github.com/bitflags/bitflags |
-| bitflags | 2.13.0 | MIT OR Apache-2.0 | https://github.com/bitflags/bitflags |
-| blake2 | 0.10.6 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hashes |
-| blake3 | 1.8.5 | CC0-1.0 OR Apache-2.0 OR Apache-2.0 WITH LLVM-exception | https://github.com/BLAKE3-team/BLAKE3 |
-| block-buffer | 0.10.4 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| block-buffer | 0.12.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| block-padding | 0.3.3 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| block2 | 0.6.2 | MIT | https://github.com/madsmtm/objc2 |
-| blowfish | 0.9.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/block-ciphers |
-| bs58 | 0.5.1 | MIT/Apache-2.0 | https://github.com/Nullus157/bs58-rs |
-| bumpalo | 3.19.1 | MIT OR Apache-2.0 | https://github.com/fitzgen/bumpalo |
-| bytemuck | 1.25.0 | Zlib OR Apache-2.0 OR MIT | https://github.com/Lokathor/bytemuck |
-| byteorder | 1.5.0 | Unlicense OR MIT | https://github.com/BurntSushi/byteorder |
-| byteorder-lite | 0.1.0 | Unlicense OR MIT | https://github.com/image-rs/byteorder-lite |
-| bytes | 1.11.0 | MIT | https://github.com/tokio-rs/bytes |
-| cbc | 0.1.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/block-modes |
-| cc | 1.2.54 | MIT OR Apache-2.0 | https://github.com/rust-lang/cc-rs |
-| cesu8 | 1.1.0 | Apache-2.0/MIT | https://github.com/emk/cesu8-rs |
-| cfg-if | 1.0.4 | MIT OR Apache-2.0 | https://github.com/rust-lang/cfg-if |
-| cfg_aliases | 0.2.1 | MIT | https://github.com/katharostech/cfg_aliases |
-| chacha20 | 0.10.0 | MIT OR Apache-2.0 | https://github.com/RustCrypto/stream-ciphers |
-| chacha20 | 0.9.1 | Apache-2.0 OR MIT | https://github.com/RustCrypto/stream-ciphers |
-| chacha20poly1305 | 0.10.1 | Apache-2.0 OR MIT | https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305 |
-| chrono | 0.4.43 | MIT OR Apache-2.0 | https://github.com/chronotope/chrono |
-| ciborium | 0.2.2 | Apache-2.0 | https://github.com/enarx/ciborium |
-| ciborium-io | 0.2.2 | Apache-2.0 | https://github.com/enarx/ciborium |
-| ciborium-ll | 0.2.2 | Apache-2.0 | https://github.com/enarx/ciborium |
-| cipher | 0.4.4 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| cmov | 0.5.4 | Apache-2.0 OR MIT | https://github.com/RustCrypto/utils |
-| cobs | 0.3.0 | MIT OR Apache-2.0 | https://github.com/jamesmunns/cobs.rs |
-| combine | 4.6.7 | MIT | https://github.com/Marwes/combine |
-| const-oid | 0.10.2 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| const-oid | 0.9.6 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats/tree/master/const-oid |
-| constant_time_eq | 0.3.1 | CC0-1.0 OR MIT-0 OR Apache-2.0 | https://github.com/cesarb/constant_time_eq |
-| constant_time_eq | 0.4.2 | CC0-1.0 OR MIT-0 OR Apache-2.0 | https://github.com/cesarb/constant_time_eq |
-| convert_case | 0.10.0 | MIT | https://github.com/rutrum/convert-case |
-| cordyceps | 0.3.4 | MIT | https://github.com/hawkw/mycelium |
-| core-foundation | 0.10.1 | MIT OR Apache-2.0 | https://github.com/servo/core-foundation-rs |
-| core-foundation | 0.9.4 | MIT OR Apache-2.0 | https://github.com/servo/core-foundation-rs |
-| core-foundation-sys | 0.8.7 | MIT OR Apache-2.0 | https://github.com/servo/core-foundation-rs |
-| cpufeatures | 0.2.17 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| cpufeatures | 0.3.0 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| crc | 3.4.0 | MIT OR Apache-2.0 | https://github.com/mrhooray/crc-rs.git |
-| crc-catalog | 2.4.0 | MIT OR Apache-2.0 | https://github.com/akhilles/crc-catalog.git |
-| crc32fast | 1.5.0 | MIT OR Apache-2.0 | https://github.com/srijs/rust-crc32fast |
-| critical-section | 1.2.0 | MIT OR Apache-2.0 | https://github.com/rust-embedded/critical-section |
-| crossbeam-channel | 0.5.15 | MIT OR Apache-2.0 | https://github.com/crossbeam-rs/crossbeam |
-| crossbeam-epoch | 0.9.18 | MIT OR Apache-2.0 | https://github.com/crossbeam-rs/crossbeam |
-| crossbeam-utils | 0.8.21 | MIT OR Apache-2.0 | https://github.com/crossbeam-rs/crossbeam |
-| crunchy | 0.2.4 | MIT | https://github.com/eira-fransham/crunchy |
-| crypto-common | 0.1.7 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| crypto-common | 0.2.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| ctr | 0.9.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/block-modes |
-| ctutils | 0.4.2 | Apache-2.0 OR MIT | https://github.com/RustCrypto/utils |
-| curve25519-dalek | 4.1.3 | BSD-3-Clause | https://github.com/dalek-cryptography/curve25519-dalek/tree/main/curve25519-dalek |
-| curve25519-dalek | 5.0.0-rc.0 | BSD-3-Clause | https://github.com/dalek-cryptography/curve25519-dalek/tree/main/curve25519-dalek |
-| curve25519-dalek-derive | 0.1.1 | MIT/Apache-2.0 | https://github.com/dalek-cryptography/curve25519-dalek |
-| darling | 0.20.11 | MIT | https://github.com/TedDriggs/darling |
-| darling_core | 0.20.11 | MIT | https://github.com/TedDriggs/darling |
-| darling_macro | 0.20.11 | MIT | https://github.com/TedDriggs/darling |
-| data-encoding | 2.11.0 | MIT | https://github.com/ia0/data-encoding |
-| data-encoding-macro | 0.1.20 | MIT | https://github.com/ia0/data-encoding |
-| data-encoding-macro-internal | 0.1.18 | MIT | https://github.com/ia0/data-encoding |
-| der | 0.7.10 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats/tree/master/der |
-| der | 0.8.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| der-parser | 10.0.0 | MIT OR Apache-2.0 | https://github.com/rusticata/der-parser.git |
-| deranged | 0.5.8 | MIT OR Apache-2.0 | https://github.com/jhpratt/deranged |
-| derive_builder | 0.20.2 | MIT OR Apache-2.0 | https://github.com/colin-kiegel/rust-derive-builder |
-| derive_builder_core | 0.20.2 | MIT OR Apache-2.0 | https://github.com/colin-kiegel/rust-derive-builder |
-| derive_builder_macro | 0.20.2 | MIT OR Apache-2.0 | https://github.com/colin-kiegel/rust-derive-builder |
-| derive_more | 2.1.1 | MIT | https://github.com/JelteF/derive_more |
-| derive_more-impl | 2.1.1 | MIT | https://github.com/JelteF/derive_more |
-| diatomic-waker | 0.2.3 | MIT OR Apache-2.0 | https://github.com/asynchronics/diatomic-waker |
-| digest | 0.10.7 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| digest | 0.11.3 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| dispatch2 | 0.3.1 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| displaydoc | 0.2.5 | MIT OR Apache-2.0 | https://github.com/yaahc/displaydoc |
-| dlopen2 | 0.8.2 | MIT | https://github.com/OpenByteDev/dlopen2 |
-| ed25519 | 2.2.3 | Apache-2.0 OR MIT | https://github.com/RustCrypto/signatures/tree/master/ed25519 |
-| ed25519 | 3.0.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/signatures |
-| ed25519-dalek | 2.2.0 | BSD-3-Clause | https://github.com/dalek-cryptography/curve25519-dalek/tree/main/ed25519-dalek |
-| ed25519-dalek | 3.0.0-rc.0 | BSD-3-Clause | https://github.com/dalek-cryptography/curve25519-dalek/tree/main/ed25519-dalek |
-| either | 1.15.0 | MIT OR Apache-2.0 | https://github.com/rayon-rs/either |
-| embedded-io | 0.4.0 | MIT OR Apache-2.0 | https://github.com/embassy-rs/embedded-io |
-| embedded-io | 0.6.1 | MIT OR Apache-2.0 | https://github.com/rust-embedded/embedded-hal |
-| encoding_rs | 0.8.35 | (Apache-2.0 OR MIT) AND BSD-3-Clause | https://github.com/hsivonen/encoding_rs |
-| enum-assoc | 1.3.0 | MIT OR Apache-2.0 | https://github.com/Eolu/enum-assoc |
-| env_logger | 0.10.2 | MIT OR Apache-2.0 | https://github.com/rust-cli/env_logger |
-| equivalent | 1.0.2 | Apache-2.0 OR MIT | https://github.com/indexmap-rs/equivalent |
-| errno | 0.3.14 | MIT OR Apache-2.0 | https://github.com/lambda-fairy/rust-errno |
-| fastbloom | 0.17.0 | MIT OR Apache-2.0 | https://github.com/tomtomwombat/fastbloom/ |
-| fastrand | 2.3.0 | Apache-2.0 OR MIT | https://github.com/smol-rs/fastrand |
-| fiat-crypto | 0.2.9 | MIT OR Apache-2.0 OR BSD-1-Clause | https://github.com/mit-plv/fiat-crypto |
-| fiat-crypto | 0.3.0 | MIT OR Apache-2.0 OR BSD-1-Clause | https://github.com/mit-plv/fiat-crypto |
-| filetime | 0.2.27 | MIT/Apache-2.0 | https://github.com/alexcrichton/filetime |
-| find-msvc-tools | 0.1.8 | MIT OR Apache-2.0 | https://github.com/rust-lang/cc-rs |
-| flate2 | 1.1.9 | MIT OR Apache-2.0 | https://github.com/rust-lang/flate2-rs |
-| flume | 0.11.1 | Apache-2.0/MIT | https://github.com/zesterer/flume |
-| fnv | 1.0.7 | Apache-2.0 / MIT | https://github.com/servo/rust-fnv |
-| foldhash | 0.1.5 | Zlib | https://github.com/orlp/foldhash |
-| foldhash | 0.2.0 | Zlib | https://github.com/orlp/foldhash |
-| form_urlencoded | 1.2.2 | MIT OR Apache-2.0 | https://github.com/servo/rust-url |
-| futures | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-buffered | 0.2.13 | MIT | https://github.com/conradludgate/futures-buffered |
-| futures-channel | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-core | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-executor | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-io | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-lite | 2.6.1 | Apache-2.0 OR MIT | https://github.com/smol-rs/futures-lite |
-| futures-macro | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-sink | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-task | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| futures-util | 0.3.31 | MIT OR Apache-2.0 | https://github.com/rust-lang/futures-rs |
-| genawaiter | 0.99.1 | MIT | https://github.com/whatisaphone/genawaiter |
-| genawaiter-macro | 0.99.1 | MIT/Apache-2.0 | https://github.com/whatisaphone/genawaiter |
-| genawaiter-proc-macro | 0.99.1 | MIT/Apache-2.0 | https://github.com/whatisaphone/genawaiter |
-| generator | 0.8.9 | MIT/Apache-2.0 | https://github.com/Xudong-Huang/generator-rs.git |
-| generic-array | 0.14.7 | MIT | https://github.com/fizyk20/generic-array.git |
-| getrandom | 0.2.17 | MIT OR Apache-2.0 | https://github.com/rust-random/getrandom |
-| getrandom | 0.3.4 | MIT OR Apache-2.0 | https://github.com/rust-random/getrandom |
-| getrandom | 0.4.2 | MIT OR Apache-2.0 | https://github.com/rust-random/getrandom |
-| ghash | 0.5.1 | Apache-2.0 OR MIT | https://github.com/RustCrypto/universal-hashes |
-| gloo-timers | 0.3.0 | MIT OR Apache-2.0 | https://github.com/rustwasm/gloo/tree/master/crates/timers |
-| h2 | 0.3.27 | MIT | https://github.com/hyperium/h2 |
-| h2 | 0.4.13 | MIT | https://github.com/hyperium/h2 |
-| half | 2.7.1 | MIT OR Apache-2.0 | https://github.com/VoidStarKat/half-rs |
-| hash32 | 0.2.1 | MIT OR Apache-2.0 | https://github.com/japaric/hash32 |
-| hashbrown | 0.12.3 | MIT OR Apache-2.0 | https://github.com/rust-lang/hashbrown |
-| hashbrown | 0.15.5 | MIT OR Apache-2.0 | https://github.com/rust-lang/hashbrown |
-| hashbrown | 0.16.1 | MIT OR Apache-2.0 | https://github.com/rust-lang/hashbrown |
-| hashbrown | 0.17.1 | MIT OR Apache-2.0 | https://github.com/rust-lang/hashbrown |
-| heapless | 0.7.17 | MIT OR Apache-2.0 | https://github.com/japaric/heapless |
-| heck | 0.5.0 | MIT OR Apache-2.0 | https://github.com/withoutboats/heck |
-| hermit-abi | 0.5.2 | MIT OR Apache-2.0 | https://github.com/hermit-os/hermit-rs |
-| hex | 0.4.3 | MIT OR Apache-2.0 | https://github.com/KokaKiwi/rust-hex |
-| hex-conservative | 0.1.2 | CC0-1.0 | https://github.com/rust-bitcoin/hex-conservative |
-| hex-conservative | 0.2.2 | CC0-1.0 | https://github.com/rust-bitcoin/hex-conservative |
-| hex_lit | 0.1.1 | MITNFA | https://github.com/Kixunil/hex_lit |
-| hickory-net | 0.26.1 | MIT OR Apache-2.0 | https://github.com/hickory-dns/hickory-dns |
-| hickory-proto | 0.26.1 | MIT OR Apache-2.0 | https://github.com/hickory-dns/hickory-dns |
-| hickory-resolver | 0.26.1 | MIT OR Apache-2.0 | https://github.com/hickory-dns/hickory-dns |
-| hkdf | 0.12.4 | MIT OR Apache-2.0 | https://github.com/RustCrypto/KDFs/ |
-| hmac | 0.12.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/MACs |
-| http | 0.2.12 | MIT OR Apache-2.0 | https://github.com/hyperium/http |
-| http | 1.4.0 | MIT OR Apache-2.0 | https://github.com/hyperium/http |
-| http-body | 0.4.6 | MIT | https://github.com/hyperium/http-body |
-| http-body | 1.0.1 | MIT | https://github.com/hyperium/http-body |
-| http-body-util | 0.1.3 | MIT | https://github.com/hyperium/http-body |
-| httparse | 1.10.1 | MIT OR Apache-2.0 | https://github.com/seanmonstar/httparse |
-| httpdate | 1.0.3 | MIT OR Apache-2.0 | https://github.com/pyfisch/httpdate |
-| humantime | 2.3.0 | MIT OR Apache-2.0 | https://github.com/chronotope/humantime |
-| hybrid-array | 0.4.12 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hybrid-array |
-| hyper | 0.14.32 | MIT | https://github.com/hyperium/hyper |
-| hyper | 1.8.1 | MIT | https://github.com/hyperium/hyper |
-| hyper-rustls | 0.24.2 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/hyper-rustls |
-| hyper-rustls | 0.27.9 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/hyper-rustls |
-| hyper-util | 0.1.19 | MIT | https://github.com/hyperium/hyper-util |
-| hyper-ws-listener | 0.3.0 | MIT |  |
-| iana-time-zone | 0.1.64 | MIT OR Apache-2.0 | https://github.com/strawlab/iana-time-zone |
-| iana-time-zone-haiku | 0.1.2 | MIT OR Apache-2.0 | https://github.com/strawlab/iana-time-zone |
-| icu_collections | 2.1.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_locale_core | 2.1.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_normalizer | 2.1.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_normalizer_data | 2.1.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_properties | 2.1.2 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_properties_data | 2.1.2 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| icu_provider | 2.1.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| id-arena | 2.3.0 | MIT/Apache-2.0 | https://github.com/fitzgen/id-arena |
-| ident_case | 1.0.1 | MIT/Apache-2.0 | https://github.com/TedDriggs/ident_case |
-| identity-hash | 0.1.0 | Apache-2.0 OR MIT | https://github.com/offsetting/identity-hash |
-| idna | 1.1.0 | MIT OR Apache-2.0 | https://github.com/servo/rust-url/ |
-| idna_adapter | 1.2.1 | Apache-2.0 OR MIT | https://github.com/hsivonen/idna_adapter |
-| if-addrs | 0.15.0 | MIT OR BSD-3-Clause | https://github.com/messense/if-addrs |
-| igd-next | 0.17.1 | MIT | https://github.com/dariusc93/rust-igd |
-| image | 0.25.9 | MIT OR Apache-2.0 | https://github.com/image-rs/image |
-| indexmap | 2.13.0 | Apache-2.0 OR MIT | https://github.com/indexmap-rs/indexmap |
-| inout | 0.1.4 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| inplace-vec-builder | 0.1.1 | MIT OR Apache-2.0 | https://github.com/rklaehn/inplace-vec-builder |
-| instant | 0.1.13 | BSD-3-Clause | https://github.com/sebcrozet/instant |
-| ipconfig | 0.3.4 | MIT/Apache-2.0 | https://github.com/liranringel/ipconfig |
-| ipnet | 2.12.0 | MIT OR Apache-2.0 | https://github.com/krisprice/ipnet |
-| iri-string | 0.7.12 | MIT OR Apache-2.0 | https://github.com/lo48576/iri-string |
-| iroh | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh |
-| iroh-base | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh |
-| iroh-blobs | 0.103.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh-blobs |
-| iroh-dns | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh |
-| iroh-io | 0.6.2 | Apache-2.0 OR MIT | https://github.com/n0-computer/iroh |
-| iroh-metrics | 1.0.1 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh-metrics |
-| iroh-metrics-derive | 1.0.1 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh-metrics |
-| iroh-relay | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh |
-| iroh-tickets | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh-tickets |
-| iroh-util | 0.6.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh-util |
-| irpc | 0.17.0 | Apache-2.0/MIT | https://github.com/n0-computer/irpc |
-| irpc-derive | 0.17.0 | Apache-2.0/MIT | https://github.com/n0-computer/irpc |
-| is-terminal | 0.4.17 | MIT | https://github.com/sunfishcode/is-terminal |
-| itoa | 1.0.17 | MIT OR Apache-2.0 | https://github.com/dtolnay/itoa |
-| jni | 0.21.1 | MIT/Apache-2.0 | https://github.com/jni-rs/jni-rs |
-| jni | 0.22.4 | MIT OR Apache-2.0 | https://github.com/jni-rs/jni-rs |
-| jni-macros | 0.22.4 | MIT OR Apache-2.0 | https://github.com/jni-rs/jni-rs |
-| jni-sys | 0.3.1 | MIT OR Apache-2.0 | https://github.com/jni-rs/jni-sys |
-| jni-sys | 0.4.1 | MIT OR Apache-2.0 | https://github.com/jni-rs/jni-sys |
-| jni-sys-macros | 0.4.1 | MIT OR Apache-2.0 | https://github.com/jni-rs/jni-sys |
-| js-sys | 0.3.85 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/js-sys |
-| lazy_static | 1.5.0 | MIT OR Apache-2.0 | https://github.com/rust-lang-nursery/lazy-static.rs |
-| leb128fmt | 0.1.0 | MIT OR Apache-2.0 | https://github.com/bluk/leb128fmt |
-| libc | 0.2.180 | MIT OR Apache-2.0 | https://github.com/rust-lang/libc |
-| libm | 0.2.16 | MIT | https://github.com/rust-lang/compiler-builtins |
-| libredox | 0.1.14 | MIT | https://gitlab.redox-os.org/redox-os/libredox.git |
-| libssh2-sys | 0.3.1 | MIT OR Apache-2.0 | https://github.com/alexcrichton/ssh2-rs |
-| libz-sys | 1.1.29 | MIT OR Apache-2.0 | https://github.com/rust-lang/libz-sys |
-| linux-raw-sys | 0.11.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/sunfishcode/linux-raw-sys |
-| litemap | 0.8.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| lock_api | 0.4.14 | MIT OR Apache-2.0 | https://github.com/Amanieu/parking_lot |
-| log | 0.4.29 | MIT OR Apache-2.0 | https://github.com/rust-lang/log |
-| loom | 0.7.2 | MIT | https://github.com/tokio-rs/loom |
-| lru | 0.12.5 | MIT | https://github.com/jeromefroe/lru-rs.git |
-| lru | 0.16.3 | MIT | https://github.com/jeromefroe/lru-rs.git |
-| lru | 0.18.0 | MIT | https://github.com/jeromefroe/lru-rs.git |
-| lru | 0.7.8 | MIT | https://github.com/jeromefroe/lru-rs.git |
-| lru-slab | 0.1.2 | MIT OR Apache-2.0 OR Zlib | https://github.com/Ralith/lru-slab |
-| mac-addr | 0.3.0 | MIT | https://github.com/shellrow/mac-addr |
-| mainline | 2.0.1 | MIT | https://github.com/nuhvi/mainline |
-| matchers | 0.2.0 | MIT | https://github.com/hawkw/matchers |
-| mdns-sd | 0.18.2 | Apache-2.0 OR MIT | https://github.com/keepsimple1/mdns-sd |
-| memchr | 2.7.6 | Unlicense OR MIT | https://github.com/BurntSushi/memchr |
-| mime | 0.3.17 | MIT OR Apache-2.0 | https://github.com/hyperium/mime |
-| minimal-lexical | 0.2.1 | MIT/Apache-2.0 | https://github.com/Alexhuszagh/minimal-lexical |
-| miniz_oxide | 0.8.9 | MIT OR Zlib OR Apache-2.0 | https://github.com/Frommi/miniz_oxide/tree/master/miniz_oxide |
-| mio | 1.1.1 | MIT | https://github.com/tokio-rs/mio |
-| moka | 0.12.15 | (MIT OR Apache-2.0) AND Apache-2.0 | https://github.com/moka-rs/moka |
-| moxcms | 0.7.11 | BSD-3-Clause OR Apache-2.0 | https://github.com/awxkee/moxcms.git |
-| n0-error | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/n0-error |
-| n0-error-macros | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/n0-error |
-| n0-future | 0.3.2 | MIT OR Apache-2.0 | https://github.com/n0-computer/n0-future |
-| n0-watcher | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/n0-watcher |
-| ndk-context | 0.1.1 | MIT OR Apache-2.0 | https://github.com/rust-windowing/android-ndk-rs |
-| negentropy | 0.5.0 | MIT | https://github.com/rust-nostr/negentropy.git |
-| nested_enum_utils | 0.2.3 | MIT OR Apache-2.0 | https://github.com/n0-computer/nested-enum-utils |
-| netdev | 0.44.0 | MIT | https://github.com/shellrow/netdev |
-| netlink-packet-core | 0.8.1 | MIT | https://github.com/rust-netlink/netlink-packet-core |
-| netlink-packet-route | 0.29.0 | MIT | https://github.com/rust-netlink/netlink-packet-route |
-| netlink-packet-route | 0.31.0 | MIT | https://github.com/rust-netlink/netlink-packet-route |
-| netlink-proto | 0.12.0 | MIT | https://github.com/rust-netlink/netlink-proto |
-| netlink-sys | 0.8.8 | MIT | https://github.com/rust-netlink/netlink-sys |
-| netwatch | 0.19.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/net-tools |
-| nom | 7.1.3 | MIT | https://github.com/Geal/nom |
-| noq | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/noq |
-| noq-proto | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/noq |
-| noq-udp | 1.0.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/noq |
-| nostr | 0.44.2 | MIT | https://github.com/rust-nostr/nostr.git |
-| nostr-database | 0.44.0 | MIT | https://github.com/rust-nostr/nostr.git |
-| nostr-gossip | 0.44.0 | MIT | https://github.com/rust-nostr/nostr.git |
-| nostr-relay-pool | 0.44.0 | MIT | https://github.com/rust-nostr/nostr.git |
-| nostr-sdk | 0.44.1 | MIT | https://github.com/rust-nostr/nostr.git |
-| nu-ansi-term | 0.50.3 | MIT | https://github.com/nushell/nu-ansi-term |
-| num-bigint | 0.4.6 | MIT OR Apache-2.0 | https://github.com/rust-num/num-bigint |
-| num-conv | 0.2.2 | MIT OR Apache-2.0 | https://github.com/jhpratt/num-conv |
-| num-integer | 0.1.46 | MIT OR Apache-2.0 | https://github.com/rust-num/num-integer |
-| num-traits | 0.2.19 | MIT OR Apache-2.0 | https://github.com/rust-num/num-traits |
-| num_enum | 0.7.6 | BSD-3-Clause OR MIT OR Apache-2.0 | https://github.com/illicitonion/num_enum |
-| num_enum_derive | 0.7.6 | BSD-3-Clause OR MIT OR Apache-2.0 | https://github.com/illicitonion/num_enum |
-| num_threads | 0.1.7 | MIT OR Apache-2.0 | https://github.com/jhpratt/num_threads |
-| objc2 | 0.6.4 | MIT | https://github.com/madsmtm/objc2 |
-| objc2-core-foundation | 0.3.2 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| objc2-core-wlan | 0.3.2 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| objc2-encode | 4.1.0 | MIT | https://github.com/madsmtm/objc2 |
-| objc2-foundation | 0.3.2 | MIT | https://github.com/madsmtm/objc2 |
-| objc2-security | 0.3.2 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| objc2-security-foundation | 0.3.2 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| objc2-system-configuration | 0.3.2 | Zlib OR Apache-2.0 OR MIT | https://github.com/madsmtm/objc2 |
-| oid-registry | 0.8.1 | MIT OR Apache-2.0 | https://github.com/rusticata/oid-registry.git |
-| once_cell | 1.21.3 | MIT OR Apache-2.0 | https://github.com/matklad/once_cell |
-| opaque-debug | 0.3.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/utils |
-| openssl-probe | 0.2.1 | MIT OR Apache-2.0 | https://github.com/rustls/openssl-probe |
-| openssl-sys | 0.9.117 | MIT | https://github.com/rust-openssl/rust-openssl |
-| papaya | 0.2.4 | MIT | https://github.com/ibraheemdev/papaya |
-| parking | 2.2.1 | Apache-2.0 OR MIT | https://github.com/smol-rs/parking |
-| parking_lot | 0.11.2 | Apache-2.0/MIT | https://github.com/Amanieu/parking_lot |
-| parking_lot | 0.12.5 | MIT OR Apache-2.0 | https://github.com/Amanieu/parking_lot |
-| parking_lot_core | 0.8.6 | Apache-2.0/MIT | https://github.com/Amanieu/parking_lot |
-| parking_lot_core | 0.9.12 | MIT OR Apache-2.0 | https://github.com/Amanieu/parking_lot |
-| password-hash | 0.5.0 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits/tree/master/password-hash |
-| paste | 1.0.15 | MIT OR Apache-2.0 | https://github.com/dtolnay/paste |
-| pbkdf2 | 0.12.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/password-hashes/tree/master/pbkdf2 |
-| pem | 3.0.6 | MIT | https://github.com/jcreekmore/pem-rs.git |
-| pem-rfc7468 | 1.0.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| percent-encoding | 2.3.2 | MIT OR Apache-2.0 | https://github.com/servo/rust-url/ |
-| pharos | 0.5.3 | Unlicense | https://github.com/najamelan/pharos |
-| pin-project | 1.1.13 | Apache-2.0 OR MIT | https://github.com/taiki-e/pin-project |
-| pin-project-internal | 1.1.13 | Apache-2.0 OR MIT | https://github.com/taiki-e/pin-project |
-| pin-project-lite | 0.2.16 | Apache-2.0 OR MIT | https://github.com/taiki-e/pin-project-lite |
-| pin-utils | 0.1.0 | MIT OR Apache-2.0 | https://github.com/rust-lang-nursery/pin-utils |
-| pkcs8 | 0.10.2 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats/tree/master/pkcs8 |
-| pkcs8 | 0.11.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| pkg-config | 0.3.33 | MIT OR Apache-2.0 | https://github.com/rust-lang/pkg-config-rs |
-| plain | 0.2.3 | MIT/Apache-2.0 | https://github.com/randomites/plain |
-| plist | 1.9.0 | MIT | https://github.com/ebarnard/rust-plist/ |
-| poly1305 | 0.8.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/universal-hashes |
-| polyval | 0.6.2 | Apache-2.0 OR MIT | https://github.com/RustCrypto/universal-hashes |
-| portable-atomic | 1.13.1 | Apache-2.0 OR MIT | https://github.com/taiki-e/portable-atomic |
-| portmapper | 0.19.0 | MIT OR Apache-2.0 | https://github.com/n0-computer/net-tools |
-| positioned-io | 0.3.5 | MIT | https://github.com/vasi/positioned-io |
-| postcard | 1.1.3 | MIT OR Apache-2.0 | https://github.com/jamesmunns/postcard |
-| postcard-derive | 0.2.2 | MIT OR Apache-2.0 | https://github.com/jamesmunns/postcard |
-| potential_utf | 0.1.4 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| powerfmt | 0.2.0 | MIT OR Apache-2.0 | https://github.com/jhpratt/powerfmt |
-| ppv-lite86 | 0.2.21 | MIT OR Apache-2.0 | https://github.com/cryptocorrosion/cryptocorrosion |
-| prefix-trie | 0.8.4 | MIT OR Apache-2.0 | https://github.com/tiborschneider/prefix-trie |
-| prettyplease | 0.2.37 | MIT OR Apache-2.0 | https://github.com/dtolnay/prettyplease |
-| proc-macro-crate | 3.5.0 | MIT OR Apache-2.0 | https://github.com/bkchr/proc-macro-crate |
-| proc-macro-error | 0.4.12 | MIT OR Apache-2.0 | https://gitlab.com/CreepySkeleton/proc-macro-error |
-| proc-macro-error-attr | 0.4.12 | MIT OR Apache-2.0 | https://gitlab.com/CreepySkeleton/proc-macro-error |
-| proc-macro-hack | 0.5.20+deprecated | MIT OR Apache-2.0 | https://github.com/dtolnay/proc-macro-hack |
-| proc-macro2 | 1.0.106 | MIT OR Apache-2.0 | https://github.com/dtolnay/proc-macro2 |
-| pxfm | 0.1.28 | BSD-3-Clause OR Apache-2.0 | https://github.com/awxkee/pxfm |
-| qrcode | 0.14.1 | MIT OR Apache-2.0 | https://github.com/kennytm/qrcode-rust |
-| quick-xml | 0.39.4 | MIT | https://github.com/tafia/quick-xml |
-| quote | 1.0.44 | MIT OR Apache-2.0 | https://github.com/dtolnay/quote |
-| r-efi | 5.3.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later | https://github.com/r-efi/r-efi |
-| r-efi | 6.0.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later | https://github.com/r-efi/r-efi |
-| rand | 0.10.1 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand | 0.8.5 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand | 0.9.2 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand_chacha | 0.3.1 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand_chacha | 0.9.0 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand_core | 0.10.1 | MIT OR Apache-2.0 | https://github.com/rust-random/rand_core |
-| rand_core | 0.6.4 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand_core | 0.9.5 | MIT OR Apache-2.0 | https://github.com/rust-random/rand |
-| rand_pcg | 0.10.2 | MIT OR Apache-2.0 | https://github.com/rust-random/rngs |
-| range-collections | 0.4.6 | MIT OR Apache-2.0 | https://github.com/rklaehn/range-collections |
-| rcgen | 0.14.8 | MIT OR Apache-2.0 | https://github.com/rustls/rcgen |
-| redb | 4.1.0 | MIT OR Apache-2.0 | https://github.com/cberner/redb |
-| redox_syscall | 0.2.16 | MIT | https://gitlab.redox-os.org/redox-os/syscall |
-| redox_syscall | 0.5.18 | MIT | https://gitlab.redox-os.org/redox-os/syscall |
-| redox_syscall | 0.7.3 | MIT | https://gitlab.redox-os.org/redox-os/syscall |
-| reed-solomon-erasure | 6.0.0 | MIT | https://github.com/darrenldl/reed-solomon-erasure |
-| ref-cast | 1.0.25 | MIT OR Apache-2.0 | https://github.com/dtolnay/ref-cast |
-| ref-cast-impl | 1.0.25 | MIT OR Apache-2.0 | https://github.com/dtolnay/ref-cast |
-| reflink-copy | 0.1.29 | MIT/Apache-2.0 | https://github.com/cargo-bins/reflink-copy |
-| regex | 1.12.2 | MIT OR Apache-2.0 | https://github.com/rust-lang/regex |
-| regex-automata | 0.4.13 | MIT OR Apache-2.0 | https://github.com/rust-lang/regex |
-| regex-syntax | 0.8.8 | MIT OR Apache-2.0 | https://github.com/rust-lang/regex |
-| reqwest | 0.11.27 | MIT OR Apache-2.0 | https://github.com/seanmonstar/reqwest |
-| reqwest | 0.13.4 | MIT OR Apache-2.0 | https://github.com/seanmonstar/reqwest |
-| resolv-conf | 0.7.6 | MIT OR Apache-2.0 | https://github.com/hickory-dns/resolv-conf |
-| ring | 0.17.14 | Apache-2.0 AND ISC | https://github.com/briansmith/ring |
-| rustc-hash | 2.1.2 | Apache-2.0 OR MIT | https://github.com/rust-lang/rustc-hash |
-| rustc_version | 0.4.1 | MIT OR Apache-2.0 | https://github.com/djc/rustc-version-rs |
-| rusticata-macros | 4.1.0 | MIT/Apache-2.0 | https://github.com/rusticata/rusticata-macros.git |
-| rustix | 1.1.3 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/rustix |
-| rustls | 0.21.12 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/rustls |
-| rustls | 0.23.36 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/rustls |
-| rustls-native-certs | 0.8.4 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/rustls-native-certs |
-| rustls-pemfile | 1.0.4 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/pemfile |
-| rustls-pki-types | 1.14.0 | MIT OR Apache-2.0 | https://github.com/rustls/pki-types |
-| rustls-platform-verifier | 0.7.0 | MIT OR Apache-2.0 | https://github.com/rustls/rustls-platform-verifier |
-| rustls-platform-verifier-android | 0.1.1 | MIT OR Apache-2.0 | https://github.com/rustls/rustls-platform-verifier |
-| rustls-webpki | 0.101.7 | ISC | https://github.com/rustls/webpki |
-| rustls-webpki | 0.103.9 | ISC | https://github.com/rustls/webpki |
-| rustversion | 1.0.22 | MIT OR Apache-2.0 | https://github.com/dtolnay/rustversion |
-| ryu | 1.0.22 | Apache-2.0 OR BSL-1.0 | https://github.com/dtolnay/ryu |
-| salsa20 | 0.10.2 | MIT OR Apache-2.0 | https://github.com/RustCrypto/stream-ciphers |
-| same-file | 1.0.6 | Unlicense/MIT | https://github.com/BurntSushi/same-file |
-| schannel | 0.1.29 | MIT | https://github.com/steffengy/schannel-rs |
-| scoped-tls | 1.0.1 | MIT/Apache-2.0 | https://github.com/alexcrichton/scoped-tls |
-| scopeguard | 1.2.0 | MIT OR Apache-2.0 | https://github.com/bluss/scopeguard |
-| scrypt | 0.11.0 | MIT OR Apache-2.0 | https://github.com/RustCrypto/password-hashes/tree/master/scrypt |
-| sct | 0.7.1 | Apache-2.0 OR ISC OR MIT | https://github.com/rustls/sct.rs |
-| sd-notify | 0.4.5 | MIT OR Apache-2.0 | https://github.com/lnicola/sd-notify |
-| secp256k1 | 0.29.1 | CC0-1.0 | https://github.com/rust-bitcoin/rust-secp256k1/ |
-| secp256k1-sys | 0.10.1 | CC0-1.0 | https://github.com/rust-bitcoin/rust-secp256k1/ |
-| security-framework | 3.7.0 | MIT OR Apache-2.0 | https://github.com/kornelski/rust-security-framework |
-| security-framework-sys | 2.17.0 | MIT OR Apache-2.0 | https://github.com/kornelski/rust-security-framework |
-| seize | 0.5.1 | MIT | https://github.com/ibraheemdev/seize |
-| self_cell | 1.2.2 | Apache-2.0 OR GPL-2.0-only | https://github.com/Voultapher/self_cell |
-| semver | 1.0.27 | MIT OR Apache-2.0 | https://github.com/dtolnay/semver |
-| send_wrapper | 0.6.0 | MIT/Apache-2.0 | https://github.com/thk1/send_wrapper |
-| serde | 1.0.228 | MIT OR Apache-2.0 | https://github.com/serde-rs/serde |
-| serde_bencode | 0.2.4 | MIT | https://github.com/toby/serde-bencode |
-| serde_bytes | 0.11.19 | MIT OR Apache-2.0 | https://github.com/serde-rs/bytes |
-| serde_core | 1.0.228 | MIT OR Apache-2.0 | https://github.com/serde-rs/serde |
-| serde_derive | 1.0.228 | MIT OR Apache-2.0 | https://github.com/serde-rs/serde |
-| serde_json | 1.0.149 | MIT OR Apache-2.0 | https://github.com/serde-rs/json |
-| serde_spanned | 0.6.9 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| serde_urlencoded | 0.7.1 | MIT/Apache-2.0 | https://github.com/nox/serde_urlencoded |
-| serde_yaml | 0.9.34+deprecated | MIT OR Apache-2.0 | https://github.com/dtolnay/serde-yaml |
-| serdect | 0.4.3 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| serial2 | 0.2.34 | BSD-2-Clause OR Apache-2.0 | https://github.com/de-vri-es/serial2-rs |
-| serial2-tokio | 0.1.21 | BSD-2-Clause OR Apache-2.0 | https://github.com/de-vri-es/serial2-tokio-rs |
-| sha-1 | 0.10.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hashes |
-| sha1 | 0.10.6 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hashes |
-| sha1_smol | 1.0.1 | BSD-3-Clause | https://github.com/mitsuhiko/sha1-smol |
-| sha2 | 0.10.9 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hashes |
-| sha2 | 0.11.0 | MIT OR Apache-2.0 | https://github.com/RustCrypto/hashes |
-| sharded-slab | 0.1.7 | MIT | https://github.com/hawkw/sharded-slab |
-| shlex | 1.3.0 | MIT OR Apache-2.0 | https://github.com/comex/rust-shlex |
-| signal-hook-registry | 1.4.8 | MIT OR Apache-2.0 | https://github.com/vorner/signal-hook |
-| signature | 2.2.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/traits/tree/master/signature |
-| signature | 3.0.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/traits |
-| simd-adler32 | 0.3.8 | MIT | https://github.com/mcountryman/simd-adler32 |
-| simd_cesu8 | 1.1.1 | Apache-2.0 OR MIT | https://github.com/seancroach/simd_cesu8 |
-| simdutf8 | 0.1.5 | MIT OR Apache-2.0 | https://github.com/rusticstuff/simdutf8 |
-| simple-dns | 0.11.3 | MIT | https://github.com/balliegojr/simple-dns |
-| siphasher | 1.0.3 | MIT/Apache-2.0 | https://github.com/jedisct1/rust-siphash |
-| slab | 0.4.11 | MIT | https://github.com/tokio-rs/slab |
-| smallvec | 1.15.1 | MIT OR Apache-2.0 | https://github.com/servo/rust-smallvec |
-| socket-pktinfo | 0.3.2 | MIT | https://github.com/pixsper/socket-pktinfo |
-| socket2 | 0.5.10 | MIT OR Apache-2.0 | https://github.com/rust-lang/socket2 |
-| socket2 | 0.6.2 | MIT OR Apache-2.0 | https://github.com/rust-lang/socket2 |
-| sorted-index-buffer | 0.2.1 | MIT OR Apache-2.0 | https://github.com/n0-computer/iroh |
-| spez | 0.1.2 | BSD-2-Clause | https://github.com/m-ou-se/spez |
-| spin | 0.10.0 | MIT | https://github.com/mvdnes/spin-rs.git |
-| spin | 0.9.8 | MIT | https://github.com/mvdnes/spin-rs.git |
-| spki | 0.7.3 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats/tree/master/spki |
-| spki | 0.8.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/formats |
-| ssh2 | 0.9.5 | MIT OR Apache-2.0 | https://github.com/alexcrichton/ssh2-rs |
-| stable_deref_trait | 1.2.1 | MIT OR Apache-2.0 | https://github.com/storyyeller/stable_deref_trait |
-| strsim | 0.11.1 | MIT | https://github.com/rapidfuzz/strsim-rs |
-| strum | 0.28.0 | MIT | https://github.com/Peternator7/strum |
-| strum_macros | 0.28.0 | MIT | https://github.com/Peternator7/strum |
-| subtle | 2.6.1 | BSD-3-Clause | https://github.com/dalek-cryptography/subtle |
-| syn | 1.0.109 | MIT OR Apache-2.0 | https://github.com/dtolnay/syn |
-| syn | 2.0.114 | MIT OR Apache-2.0 | https://github.com/dtolnay/syn |
-| syn-mid | 0.5.4 | Apache-2.0 OR MIT | https://github.com/taiki-e/syn-mid |
-| sync_wrapper | 0.1.2 | Apache-2.0 | https://github.com/Actyx/sync_wrapper |
-| sync_wrapper | 1.0.2 | Apache-2.0 | https://github.com/Actyx/sync_wrapper |
-| synstructure | 0.13.2 | MIT | https://github.com/mystor/synstructure |
-| system-configuration | 0.5.1 | MIT OR Apache-2.0 | https://github.com/mullvad/system-configuration-rs |
-| system-configuration | 0.6.1 | MIT OR Apache-2.0 | https://github.com/mullvad/system-configuration-rs |
-| system-configuration | 0.7.0 | MIT OR Apache-2.0 | https://github.com/mullvad/system-configuration-rs |
-| system-configuration-sys | 0.5.0 | MIT OR Apache-2.0 | https://github.com/mullvad/system-configuration-rs |
-| system-configuration-sys | 0.6.0 | MIT OR Apache-2.0 | https://github.com/mullvad/system-configuration-rs |
-| tagptr | 0.2.0 | MIT/Apache-2.0 | https://github.com/oliver-giersch/tagptr.git |
-| tar | 0.4.44 | MIT OR Apache-2.0 | https://github.com/alexcrichton/tar-rs |
-| tempfile | 3.24.0 | MIT OR Apache-2.0 | https://github.com/Stebalien/tempfile |
-| termcolor | 1.4.1 | Unlicense OR MIT | https://github.com/BurntSushi/termcolor |
-| thiserror | 1.0.69 | MIT OR Apache-2.0 | https://github.com/dtolnay/thiserror |
-| thiserror | 2.0.18 | MIT OR Apache-2.0 | https://github.com/dtolnay/thiserror |
-| thiserror-impl | 1.0.69 | MIT OR Apache-2.0 | https://github.com/dtolnay/thiserror |
-| thiserror-impl | 2.0.18 | MIT OR Apache-2.0 | https://github.com/dtolnay/thiserror |
-| thread_local | 1.1.9 | MIT OR Apache-2.0 | https://github.com/Amanieu/thread_local-rs |
-| time | 0.3.49 | MIT OR Apache-2.0 | https://github.com/time-rs/time |
-| time-core | 0.1.9 | MIT OR Apache-2.0 | https://github.com/time-rs/time |
-| time-macros | 0.2.29 | MIT OR Apache-2.0 | https://github.com/time-rs/time |
-| tinystr | 0.8.2 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| tinyvec | 1.10.0 | Zlib OR Apache-2.0 OR MIT | https://github.com/Lokathor/tinyvec |
-| tinyvec_macros | 0.1.1 | MIT OR Apache-2.0 OR Zlib | https://github.com/Soveu/tinyvec_macros |
-| tokio | 1.49.0 | MIT | https://github.com/tokio-rs/tokio |
-| tokio-macros | 2.6.0 | MIT | https://github.com/tokio-rs/tokio |
-| tokio-rustls | 0.24.1 | MIT/Apache-2.0 | https://github.com/rustls/tokio-rustls |
-| tokio-rustls | 0.26.4 | MIT OR Apache-2.0 | https://github.com/rustls/tokio-rustls |
-| tokio-socks | 0.5.2 | MIT | https://github.com/sticnarf/tokio-socks |
-| tokio-stream | 0.1.18 | MIT | https://github.com/tokio-rs/tokio |
-| tokio-test | 0.4.5 | MIT | https://github.com/tokio-rs/tokio |
-| tokio-tungstenite | 0.20.1 | MIT | https://github.com/snapview/tokio-tungstenite |
-| tokio-tungstenite | 0.26.2 | MIT | https://github.com/snapview/tokio-tungstenite |
-| tokio-util | 0.7.18 | MIT | https://github.com/tokio-rs/tokio |
-| tokio-websockets | 0.13.2 | MIT | https://github.com/Gelbpunkt/tokio-websockets/ |
-| toml | 0.8.23 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_datetime | 0.6.11 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_datetime | 1.1.1+spec-1.1.0 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_edit | 0.22.27 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_edit | 0.25.12+spec-1.1.0 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_parser | 1.1.2+spec-1.1.0 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| toml_write | 0.1.2 | MIT OR Apache-2.0 | https://github.com/toml-rs/toml |
-| totp-rs | 5.7.0 | MIT | https://github.com/constantoine/totp-rs |
-| tower | 0.5.3 | MIT | https://github.com/tower-rs/tower |
-| tower-http | 0.6.8 | MIT | https://github.com/tower-rs/tower-http |
-| tower-layer | 0.3.3 | MIT | https://github.com/tower-rs/tower |
-| tower-service | 0.3.3 | MIT | https://github.com/tower-rs/tower |
-| tracing | 0.1.44 | MIT | https://github.com/tokio-rs/tracing |
-| tracing-attributes | 0.1.31 | MIT | https://github.com/tokio-rs/tracing |
-| tracing-core | 0.1.36 | MIT | https://github.com/tokio-rs/tracing |
-| tracing-log | 0.2.0 | MIT | https://github.com/tokio-rs/tracing |
-| tracing-subscriber | 0.3.22 | MIT | https://github.com/tokio-rs/tracing |
-| try-lock | 0.2.5 | MIT | https://github.com/seanmonstar/try-lock |
-| tungstenite | 0.20.1 | MIT OR Apache-2.0 | https://github.com/snapview/tungstenite-rs |
-| tungstenite | 0.26.2 | MIT OR Apache-2.0 | https://github.com/snapview/tungstenite-rs |
-| typenum | 1.20.1 | MIT OR Apache-2.0 | https://github.com/paholg/typenum |
-| unicode-ident | 1.0.22 | (MIT OR Apache-2.0) AND Unicode-3.0 | https://github.com/dtolnay/unicode-ident |
-| unicode-normalization | 0.1.22 | MIT/Apache-2.0 | https://github.com/unicode-rs/unicode-normalization |
-| unicode-segmentation | 1.13.3 | MIT OR Apache-2.0 | https://github.com/unicode-rs/unicode-segmentation |
-| unicode-xid | 0.2.6 | MIT OR Apache-2.0 | https://github.com/unicode-rs/unicode-xid |
-| universal-hash | 0.5.1 | MIT OR Apache-2.0 | https://github.com/RustCrypto/traits |
-| unsafe-libyaml | 0.2.11 | MIT | https://github.com/dtolnay/unsafe-libyaml |
-| untrusted | 0.9.0 | ISC | https://github.com/briansmith/untrusted |
-| url | 2.5.8 | MIT OR Apache-2.0 | https://github.com/servo/rust-url |
-| urlencoding | 2.1.3 | MIT | https://github.com/kornelski/rust_urlencoding |
-| utf-8 | 0.7.6 | MIT OR Apache-2.0 | https://github.com/SimonSapin/rust-utf8 |
-| utf8_iter | 1.0.4 | Apache-2.0 OR MIT | https://github.com/hsivonen/utf8_iter |
-| uuid | 1.19.0 | Apache-2.0 OR MIT | https://github.com/uuid-rs/uuid |
-| valuable | 0.1.1 | MIT | https://github.com/tokio-rs/valuable |
-| vcpkg | 0.2.15 | MIT/Apache-2.0 | https://github.com/mcgoo/vcpkg-rs |
-| vergen | 9.1.0 | MIT OR Apache-2.0 | https://github.com/rustyhorde/vergen |
-| vergen-gitcl | 9.1.0 | MIT OR Apache-2.0 | https://github.com/rustyhorde/vergen |
-| vergen-lib | 9.1.0 | MIT OR Apache-2.0 | https://github.com/rustyhorde/vergen |
-| version_check | 0.9.5 | MIT/Apache-2.0 | https://github.com/SergioBenitez/version_check |
-| walkdir | 2.5.0 | Unlicense/MIT | https://github.com/BurntSushi/walkdir |
-| want | 0.3.1 | MIT | https://github.com/seanmonstar/want |
-| wasi | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasi |
-| wasip2 | 1.0.2+wasi-0.2.9 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasi-rs |
-| wasip3 | 0.4.0+wasi-0.3.0-rc-2026-01-06 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasi-rs |
-| wasm-bindgen | 0.2.108 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen |
-| wasm-bindgen-futures | 0.4.58 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/futures |
-| wasm-bindgen-macro | 0.2.108 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro |
-| wasm-bindgen-macro-support | 0.2.108 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro-support |
-| wasm-bindgen-shared | 0.2.108 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/shared |
-| wasm-encoder | 0.244.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-encoder |
-| wasm-metadata | 0.244.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-metadata |
-| wasm-streams | 0.4.2 | MIT OR Apache-2.0 | https://github.com/MattiasBuelens/wasm-streams/ |
-| wasm-streams | 0.5.0 | MIT OR Apache-2.0 | https://github.com/MattiasBuelens/wasm-streams/ |
-| wasmparser | 0.244.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasmparser |
-| web-sys | 0.3.85 | MIT OR Apache-2.0 | https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/web-sys |
-| web-time | 1.1.0 | MIT OR Apache-2.0 | https://github.com/daxpedda/web-time |
-| webpki-root-certs | 1.0.7 | CDLA-Permissive-2.0 | https://github.com/rustls/webpki-roots |
-| webpki-roots | 0.25.4 | MPL-2.0 | https://github.com/rustls/webpki-roots |
-| webpki-roots | 0.26.11 | CDLA-Permissive-2.0 | https://github.com/rustls/webpki-roots |
-| webpki-roots | 1.0.6 | CDLA-Permissive-2.0 | https://github.com/rustls/webpki-roots |
-| widestring | 1.2.1 | MIT OR Apache-2.0 | https://github.com/VoidStarKat/widestring-rs |
-| winapi | 0.3.9 | MIT/Apache-2.0 | https://github.com/retep998/winapi-rs |
-| winapi-i686-pc-windows-gnu | 0.4.0 | MIT/Apache-2.0 | https://github.com/retep998/winapi-rs |
-| winapi-util | 0.1.11 | Unlicense OR MIT | https://github.com/BurntSushi/winapi-util |
-| winapi-x86_64-pc-windows-gnu | 0.4.0 | MIT/Apache-2.0 | https://github.com/retep998/winapi-rs |
-| windows | 0.62.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-collections | 0.3.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-core | 0.62.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-future | 0.3.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-implement | 0.60.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-interface | 0.59.3 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-link | 0.2.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-numerics | 0.3.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-registry | 0.6.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-result | 0.4.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-strings | 0.5.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-sys | 0.45.0 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-sys | 0.48.0 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-sys | 0.52.0 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-sys | 0.60.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-sys | 0.61.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-targets | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-targets | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-targets | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-targets | 0.53.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows-threading | 0.2.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_gnullvm | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_gnullvm | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_gnullvm | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_gnullvm | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_msvc | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_msvc | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_msvc | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_aarch64_msvc | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnu | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnu | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnu | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnu | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnullvm | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_gnullvm | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_msvc | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_msvc | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_msvc | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_i686_msvc | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnu | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnu | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnu | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnu | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnullvm | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnullvm | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnullvm | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_gnullvm | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_msvc | 0.42.2 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_msvc | 0.48.5 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_msvc | 0.52.6 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| windows_x86_64_msvc | 0.53.1 | MIT OR Apache-2.0 | https://github.com/microsoft/windows-rs |
-| winnow | 0.7.14 | MIT | https://github.com/winnow-rs/winnow |
-| winnow | 1.0.3 | MIT | https://github.com/winnow-rs/winnow |
-| winreg | 0.50.0 | MIT | https://github.com/gentoo90/winreg-rs |
-| wit-bindgen | 0.51.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wit-bindgen |
-| wit-bindgen-core | 0.51.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wit-bindgen |
-| wit-bindgen-rust | 0.51.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wit-bindgen |
-| wit-bindgen-rust-macro | 0.51.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wit-bindgen |
-| wit-component | 0.244.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wit-component |
-| wit-parser | 0.244.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wit-parser |
-| wmi | 0.18.4 | MIT OR Apache-2.0 | https://github.com/ohadravid/wmi-rs |
-| writeable | 0.6.2 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| ws_stream_wasm | 0.7.5 | Unlicense | https://github.com/najamelan/ws_stream_wasm |
-| x509-parser | 0.18.1 | MIT OR Apache-2.0 | https://github.com/rusticata/x509-parser.git |
-| xattr | 1.6.1 | MIT OR Apache-2.0 | https://github.com/Stebalien/xattr |
-| xml-rs | 0.8.28 | MIT | https://github.com/kornelski/xml-rs |
-| xmltree | 0.10.3 | MIT | https://github.com/eminence/xmltree-rs |
-| yasna | 0.6.0 | MIT OR Apache-2.0 | https://github.com/qnighy/yasna.rs |
-| yoke | 0.8.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| yoke-derive | 0.8.1 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zbase32 | 0.1.2 | LGPL-3.0+ | https://gitlab.com/pgerber/zbase32-rust |
-| zerocopy | 0.8.33 | BSD-2-Clause OR Apache-2.0 OR MIT | https://github.com/google/zerocopy |
-| zerocopy-derive | 0.8.33 | BSD-2-Clause OR Apache-2.0 OR MIT | https://github.com/google/zerocopy |
-| zerofrom | 0.1.6 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zerofrom-derive | 0.1.6 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zeroize | 1.9.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/utils |
-| zeroize_derive | 1.5.0 | Apache-2.0 OR MIT | https://github.com/RustCrypto/utils |
-| zerotrie | 0.2.3 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zerovec | 0.11.5 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zerovec-derive | 0.11.2 | Unicode-3.0 | https://github.com/unicode-org/icu4x |
-| zmij | 1.0.16 | MIT | https://github.com/dtolnay/zmij |

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.116-alpha"
+version = "1.7.111-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]
@@ -22,9 +22,6 @@ iroh-swarm = ["dep:iroh", "dep:iroh-blobs"]
 [dependencies]
 # Core dependencies
 tokio = { version = "1", features = ["full"] }
-# Mesh port mirror: needs IPV6_V6ONLY on [::] listeners so they coexist with
-# the containers' own 0.0.0.0 binds (std/tokio don't expose the sockopt).
-socket2 = "0.5"
 libc = "0.2"   # process-group signalling for the supervised reticulum daemon
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
@@ -108,10 +105,6 @@ bytes = "1"
 # Mesh networking (Meshcore serial protocol over USB LoRa radios)
 serial2-tokio = "0.1"
 
-# LoRa radio firmware flashing: Meshtastic ships per-board images inside a
-# per-platform release zip (see mesh/flash.rs).
-zip = { version = "2", default-features = false, features = ["deflate"] }
-
 # Double Ratchet key derivation (Phase 3: encrypted mesh messaging)
 hkdf = "0.12.4"
 

core/archipelago/src/api/handler/content.rs

@@ -202,9 +202,7 @@ impl ApiHandler {
             return Ok(build_response(
                 StatusCode::BAD_REQUEST,
                 "application/json",
-                hyper::Body::from(
-                    r#"{"error":"The seller does not accept Lightning for this item"}"#,
-                ),
+                hyper::Body::from(r#"{"error":"The seller does not accept Lightning for this item"}"#),
             ));
         }
 

core/archipelago/src/api/rpc/auth.rs

@@ -106,7 +106,7 @@ impl RpcHandler {
         &self,
         params: Option<serde_json::Value>,
     ) -> Result<serde_json::Value> {
-        let mut name = params
+        let name = params
             .as_ref()
             .and_then(|p| p.get("name"))
             .and_then(|v| v.as_str())
@@ -116,14 +116,6 @@ impl RpcHandler {
         if name.is_empty() || name.len() > 64 {
             return Err(anyhow::anyhow!("Device name must be 1-64 characters"));
         }
-        // The default name was a single shared slot: every pairing popup
-        // replaced the previous phone's token, silently logging out the
-        // first phone the moment a second one paired. Default-named mints
-        // get a unique suffix so each device keeps its own credential;
-        // explicitly named devices keep replace-in-place semantics.
-        if name == "companion" {
-            name = format!("companion-{}", hex::encode(rand::random::<[u8; 2]>()));
-        }
         let token = crate::device_tokens::create(&self.config.data_dir, &name).await?;
         Ok(serde_json::json!({ "name": name, "token": token }))
     }

core/archipelago/src/api/rpc/bitcoin_relay.rs

@@ -465,7 +465,6 @@ impl RpcHandler {
             signing_key.as_ref().map(|i| i.signing_key()),
             Some(&peer.pubkey),
             data.server_info.name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await
     }

core/archipelago/src/api/rpc/content.rs

@@ -279,7 +279,6 @@ impl RpcHandler {
                 .service(crate::settings::transport::PeerService::PeerFiles)
                 .header("X-Federation-DID", local_did)
                 .timeout(std::time::Duration::from_secs(120))
-                .fips_timeout(std::time::Duration::from_secs(8))
                 .send_get()
                 .await
                 .context("Failed to connect to peer")?;
@@ -365,11 +364,6 @@ impl RpcHandler {
             crate::fips::dial::PeerRequest::new(fips_npub.as_deref(), onion, "/content")
                 .service(crate::settings::transport::PeerService::PeerFiles)
                 .timeout(std::time::Duration::from_secs(30))
-                // The Cloud page's hottest call: without a fast-fail cap a
-                // cold FIPS path burned ~16.6s before Tor even started,
-                // against the UI's 30s deadline — users saw errors, not
-                // fallback.
-                .fips_timeout(std::time::Duration::from_secs(6))
                 .send_get()
                 .await
                 .context("Failed to connect to peer")?;
@@ -449,7 +443,8 @@ impl RpcHandler {
                     && (o.content_id == content_id
                         || filename.is_some_and(|f| {
                             !f.is_empty()
-                                && o.filename.trim_start_matches('/') == f.trim_start_matches('/')
+                                && o.filename.trim_start_matches('/')
+                                    == f.trim_start_matches('/')
                         }))
             });
             if let Some(o) = already {
@@ -459,9 +454,12 @@ impl RpcHandler {
                     owned_as = %o.content_id,
                     "paid download: already owned — serving cached copy, NOT paying again"
                 );
-                if let Some((mime, bytes)) =
-                    crate::content_owned::read_owned(&self.config.data_dir, &o.onion, &o.content_id)
-                        .await
+                if let Some((mime, bytes)) = crate::content_owned::read_owned(
+                    &self.config.data_dir,
+                    &o.onion,
+                    &o.content_id,
+                )
+                .await
                 {
                     use base64::Engine;
                     return Ok(serde_json::json!({
@@ -694,7 +692,10 @@ impl RpcHandler {
                     n += 1;
                 }
                 match tokio::fs::write(&target, &bytes).await {
-                    Ok(()) => tracing::info!("paid download: filed into {}", target.display()),
+                    Ok(()) => tracing::info!(
+                        "paid download: filed into {}",
+                        target.display()
+                    ),
                     Err(e) => tracing::warn!(
                         "paid download: filing into {} failed (non-fatal): {e}",
                         target.display()
@@ -1143,7 +1144,6 @@ impl RpcHandler {
             crate::fips::dial::PeerRequest::new(fips_npub.as_deref(), onion, &path)
                 .service(crate::settings::transport::PeerService::PeerFiles)
                 .timeout(std::time::Duration::from_secs(30))
-                .fips_timeout(std::time::Duration::from_secs(6))
                 .send_get()
                 .await
                 .context("Failed to connect to peer for preview")?;

core/archipelago/src/api/rpc/dispatcher.rs

@@ -124,15 +124,12 @@ impl RpcHandler {
             }
             "lnd.getinfo" => self.handle_lnd_getinfo().await,
             "lnd.listchannels" => self.handle_lnd_listchannels().await,
-            "lnd.closedchannels" => self.handle_lnd_closedchannels().await,
             "lnd.openchannel" => self.handle_lnd_openchannel(params).await,
             "lnd.closechannel" => self.handle_lnd_closechannel(params).await,
             "lnd.newaddress" => self.handle_lnd_newaddress().await,
             "lnd.sendcoins" => self.handle_lnd_sendcoins(params).await,
-            "lnd.estimatefee" => self.handle_lnd_estimatefee(params).await,
             "lnd.createinvoice" => self.handle_lnd_createinvoice(params).await,
             "lnd.payinvoice" => self.handle_lnd_payinvoice(params).await,
-            "lnd.paymentstatus" => self.handle_lnd_paymentstatus(params).await,
             "lnd.create-psbt" => self.handle_lnd_create_psbt(params).await,
             "lnd.finalize-psbt" => self.handle_lnd_finalize_psbt(params).await,
             "lnd.create-raw-tx" => self.handle_lnd_create_raw_tx(params).await,
@@ -391,12 +388,7 @@ impl RpcHandler {
             // Mesh networking (Meshcore LoRa)
             "mesh.status" => self.handle_mesh_status().await,
             "mesh.probe-device" => self.handle_mesh_probe_device(params).await,
-            "mesh.flash-list-firmware" => self.handle_mesh_flash_list_firmware(params).await,
-            "mesh.flash-device" => self.handle_mesh_flash_device(params).await,
-            "mesh.flash-status" => self.handle_mesh_flash_status().await,
-            "mesh.flash-cancel" => self.handle_mesh_flash_cancel().await,
             "mesh.peers" => self.handle_mesh_peers().await,
-            "mesh.refresh" => self.handle_mesh_refresh().await,
             "mesh.messages" => self.handle_mesh_messages(params).await,
             "mesh.debug-dump" => self.handle_mesh_debug_dump().await,
             "mesh.send" => self.handle_mesh_send(params).await,

core/archipelago/src/api/rpc/federation/handlers.rs

@@ -865,9 +865,7 @@ impl RpcHandler {
                 "/rpc/v1",
             )
             .service(crate::settings::transport::PeerService::Peers)
-            .timeout(std::time::Duration::from_secs(30))
-            .fips_timeout(std::time::Duration::from_secs(6))
-            .record_transport(&self.config.data_dir);
+            .timeout(std::time::Duration::from_secs(30));
 
             match req.send_json(&body).await {
                 Ok((resp, transport)) if resp.status().is_success() => {

core/archipelago/src/api/rpc/fips.rs

@@ -13,14 +13,7 @@ use anyhow::Result;
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
         let status = fips::FipsStatus::query(&self.config.data_dir).await;
-        let mut v = serde_json::to_value(status)?;
-        // Dial outcome counters (process-lifetime): how often peer dials
-        // used FIPS vs fell back to Tor, broken down by reason. This is
-        // the observability that makes "FIPS uptime" measurable.
-        if let Some(obj) = v.as_object_mut() {
-            obj.insert("dial_stats".to_string(), fips::telemetry::snapshot());
-        }
-        Ok(v)
+        Ok(serde_json::to_value(status)?)
     }
 
     /// Everything the companion app needs to join this node's mesh, embedded
@@ -30,11 +23,9 @@ impl RpcHandler {
     /// host/IP itself — it knows which origin the browser reached the node on.
     pub(super) async fn handle_fips_pair_info(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let npub = crate::identity::fips_npub(&identity_dir)
-            .await?
-            .ok_or_else(|| {
-                anyhow::anyhow!("FIPS identity not provisioned yet — complete onboarding first")
-            })?;
+        let npub = crate::identity::fips_npub(&identity_dir).await?.ok_or_else(|| {
+            anyhow::anyhow!("FIPS identity not provisioned yet — complete onboarding first")
+        })?;
         let ula = fips::iface::fips0_ula().map(|ip| ip.to_string());
         // The node's seed anchors ride along so the phone can rendezvous
         // through the same public mesh points when the node's LAN endpoint
@@ -90,8 +81,7 @@ impl RpcHandler {
     pub(super) async fn handle_fips_install(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
         fips::config::install(&identity_dir).await?;
-        let unit = fips::service::activation_unit().await;
-        fips::service::activate(unit).await?;
+        fips::service::activate(fips::SERVICE_UNIT).await?;
         let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }

core/archipelago/src/api/rpc/lnd/channels.rs

@@ -30,8 +30,6 @@ struct ChannelInfo {
     active: bool,
     status: String,
     channel_point: String,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    closing_txid: String,
 }
 
 #[derive(Debug, Serialize)]
@@ -60,10 +58,6 @@ struct LndChannel {
 #[derive(Debug, Deserialize, Default)]
 struct LndPendingChannelsResponse {
     pending_open_channels: Option<Vec<LndPendingOpenChannel>>,
-    // Cooperative closes waiting for their closing tx to confirm
-    waiting_close_channels: Option<Vec<LndWaitingCloseChannel>>,
-    // Force closes serving out their timelock
-    pending_force_closing_channels: Option<Vec<LndForceClosingChannel>>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -71,18 +65,6 @@ struct LndPendingOpenChannel {
     channel: Option<LndPendingChannel>,
 }
 
-#[derive(Debug, Deserialize)]
-struct LndWaitingCloseChannel {
-    channel: Option<LndPendingChannel>,
-    closing_txid: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-struct LndForceClosingChannel {
-    channel: Option<LndPendingChannel>,
-    closing_txid: Option<String>,
-}
-
 #[derive(Debug, Deserialize)]
 struct LndPendingChannel {
     remote_node_pub: Option<String>,
@@ -92,52 +74,6 @@ struct LndPendingChannel {
     channel_point: Option<String>,
 }
 
-impl LndPendingChannel {
-    fn into_channel_info(self, status: &str, closing_txid: Option<String>) -> ChannelInfo {
-        let parse = |s: &Option<String>| s.as_deref().and_then(|v| v.parse().ok()).unwrap_or(0);
-        ChannelInfo {
-            chan_id: String::new(),
-            remote_pubkey: self.remote_node_pub.clone().unwrap_or_default(),
-            capacity: parse(&self.capacity),
-            local_balance: parse(&self.local_balance),
-            remote_balance: parse(&self.remote_balance),
-            active: false,
-            status: status.into(),
-            channel_point: self.channel_point.unwrap_or_default(),
-            closing_txid: closing_txid.unwrap_or_default(),
-        }
-    }
-}
-
-#[derive(Debug, Deserialize, Default)]
-struct LndClosedChannelsResponse {
-    channels: Option<Vec<LndClosedChannel>>,
-}
-
-#[derive(Debug, Deserialize)]
-struct LndClosedChannel {
-    chan_id: Option<String>,
-    remote_pubkey: Option<String>,
-    capacity: Option<String>,
-    settled_balance: Option<String>,
-    close_type: Option<String>,
-    closing_tx_hash: Option<String>,
-    channel_point: Option<String>,
-    close_height: Option<i64>,
-}
-
-#[derive(Debug, Serialize)]
-struct ClosedChannelInfo {
-    chan_id: String,
-    remote_pubkey: String,
-    capacity: i64,
-    settled_balance: i64,
-    close_type: String,
-    closing_tx_hash: String,
-    channel_point: String,
-    close_height: i64,
-}
-
 impl RpcHandler {
     pub(in crate::api::rpc) async fn handle_lnd_listchannels(&self) -> Result<serde_json::Value> {
         let (client, macaroon_hex) = self.lnd_client().await?;
@@ -195,7 +131,6 @@ impl RpcHandler {
                         "inactive".into()
                     },
                     channel_point: ch.channel_point.unwrap_or_default(),
-                    closing_txid: String::new(),
                 }
             })
             .collect();
@@ -203,20 +138,31 @@ impl RpcHandler {
         let mut pending_channels: Vec<ChannelInfo> = Vec::new();
         for pch in pending_resp.pending_open_channels.unwrap_or_default() {
             if let Some(ch) = pch.channel {
-                pending_channels.push(ch.into_channel_info("pending_open", None));
-            }
-        }
-        for wch in pending_resp.waiting_close_channels.unwrap_or_default() {
-            if let Some(ch) = wch.channel {
-                pending_channels.push(ch.into_channel_info("closing", wch.closing_txid));
-            }
-        }
-        for fch in pending_resp
-            .pending_force_closing_channels
-            .unwrap_or_default()
-        {
-            if let Some(ch) = fch.channel {
-                pending_channels.push(ch.into_channel_info("force_closing", fch.closing_txid));
+                let capacity: i64 = ch
+                    .capacity
+                    .as_deref()
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(0);
+                let local: i64 = ch
+                    .local_balance
+                    .as_deref()
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(0);
+                let remote: i64 = ch
+                    .remote_balance
+                    .as_deref()
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(0);
+                pending_channels.push(ChannelInfo {
+                    chan_id: String::new(),
+                    remote_pubkey: ch.remote_node_pub.unwrap_or_default(),
+                    capacity,
+                    local_balance: local,
+                    remote_balance: remote,
+                    active: false,
+                    status: "pending_open".into(),
+                    channel_point: ch.channel_point.unwrap_or_default(),
+                });
             }
         }
 
@@ -403,46 +349,6 @@ impl RpcHandler {
         Ok(body)
     }
 
-    pub(in crate::api::rpc) async fn handle_lnd_closedchannels(&self) -> Result<serde_json::Value> {
-        let (client, macaroon_hex) = self.lnd_client().await?;
-
-        let resp: LndClosedChannelsResponse = client
-            .get(format!("{LND_REST_BASE_URL}/v1/channels/closed"))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-            .context("LND REST connection failed")?
-            .json()
-            .await
-            .context("Failed to parse LND closed channels response")?;
-
-        let channels: Vec<ClosedChannelInfo> = resp
-            .channels
-            .unwrap_or_default()
-            .into_iter()
-            .map(|ch| ClosedChannelInfo {
-                chan_id: ch.chan_id.unwrap_or_default(),
-                remote_pubkey: ch.remote_pubkey.unwrap_or_default(),
-                capacity: ch
-                    .capacity
-                    .as_deref()
-                    .and_then(|s| s.parse().ok())
-                    .unwrap_or(0),
-                settled_balance: ch
-                    .settled_balance
-                    .as_deref()
-                    .and_then(|s| s.parse().ok())
-                    .unwrap_or(0),
-                close_type: ch.close_type.unwrap_or_default(),
-                closing_tx_hash: ch.closing_tx_hash.unwrap_or_default(),
-                channel_point: ch.channel_point.unwrap_or_default(),
-                close_height: ch.close_height.unwrap_or(0),
-            })
-            .collect();
-
-        Ok(serde_json::json!({ "channels": channels }))
-    }
-
     pub(in crate::api::rpc) async fn handle_lnd_closechannel(
         &self,
         params: Option<serde_json::Value>,
@@ -483,35 +389,27 @@ impl RpcHandler {
             "Closing Lightning channel"
         );
 
-        let (_, macaroon_hex) = self.lnd_client().await?;
-
-        // The close endpoint is server-streaming: LND holds the connection
-        // open and emits updates until the closing tx CONFIRMS on-chain
-        // (potentially hours). Reading the whole body hangs the RPC even
-        // though the close already went through, and the shared lnd_client's
-        // 15s total timeout would abort the stream mid-read. Use a dedicated
-        // client and return as soon as the first streamed update arrives.
-        let client = reqwest::Client::builder()
-            .no_proxy()
-            .connect_timeout(std::time::Duration::from_secs(10))
-            .danger_accept_invalid_certs(true)
-            .build()
-            .context("Failed to create streaming HTTP client")?;
+        let (client, macaroon_hex) = self.lnd_client().await?;
 
         let url = format!(
             "{LND_REST_BASE_URL}/v1/channels/{}/{}?force={}",
             parts[0], parts[1], force
         );
 
-        let mut resp = client
+        let resp = client
             .delete(&url)
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .send()
             .await
             .context("Failed to close channel")?;
 
-        if !resp.status().is_success() {
-            let body: serde_json::Value = resp.json().await.unwrap_or_default();
+        let status = resp.status();
+        let body: serde_json::Value = resp
+            .json()
+            .await
+            .context("Failed to parse close channel response")?;
+
+        if !status.is_success() {
             let msg = body
                 .get("message")
                 .and_then(|v| v.as_str())
@@ -519,56 +417,6 @@ impl RpcHandler {
             return Err(anyhow::anyhow!("Failed to close channel: {}", msg));
         }
 
-        // First streamed line is {"result":{"close_pending":…}} on success or
-        // {"error":…} — the stream reports errors in-band after a 200.
-        let mut buf: Vec<u8> = Vec::new();
-        let first_update = tokio::time::timeout(std::time::Duration::from_secs(25), async {
-            while let Some(chunk) = resp.chunk().await? {
-                buf.extend_from_slice(&chunk);
-                let line = match buf.iter().position(|&b| b == b'\n') {
-                    Some(pos) => &buf[..pos],
-                    None => &buf[..],
-                };
-                if let Ok(v) = serde_json::from_slice::<serde_json::Value>(line) {
-                    return Ok::<_, anyhow::Error>(Some(v));
-                }
-            }
-            Ok(None)
-        })
-        .await;
-
-        match first_update {
-            Ok(Ok(Some(update))) => {
-                if let Some(err) = update.get("error") {
-                    let msg = err
-                        .get("message")
-                        .and_then(|v| v.as_str())
-                        .unwrap_or("Unknown error");
-                    return Err(anyhow::anyhow!("Failed to close channel: {}", msg));
-                }
-                // txid arrives base64-encoded in internal byte order; flip it
-                // into the display order explorers use.
-                use base64::Engine as _;
-                let closing_txid = update
-                    .pointer("/result/close_pending/txid")
-                    .and_then(|v| v.as_str())
-                    .and_then(|b64| base64::engine::general_purpose::STANDARD.decode(b64).ok())
-                    .map(|mut bytes| {
-                        bytes.reverse();
-                        hex::encode(bytes)
-                    })
-                    .unwrap_or_default();
-                info!(channel_point, closing_txid, "Channel close initiated");
-                Ok(serde_json::json!({ "success": true, "closing_txid": closing_txid }))
-            }
-            Ok(Ok(None)) => Err(anyhow::anyhow!(
-                "LND ended the close stream without an update — check the channel list"
-            )),
-            Ok(Err(e)) => Err(e).context("Failed reading close channel response"),
-            // No update inside the window: the close is almost certainly still
-            // negotiating with the peer — report initiated, the channel list
-            // will show it under Closing.
-            Err(_) => Ok(serde_json::json!({ "success": true, "closing_txid": "" })),
-        }
+        Ok(serde_json::json!({ "success": true }))
     }
 }

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -36,33 +36,6 @@ impl RpcHandler {
 
         let (client, macaroon_hex) = self.lnd_client().await?;
 
-        // Decode the invoice up front (fast, local) so we know its payment
-        // hash BEFORE handing it to LND. If the payment outlives our wait
-        // below, the hash is what lets the UI keep tracking it instead of
-        // declaring a false failure. Best-effort: a decode hiccup must not
-        // block the payment itself.
-        let (decoded_hash, decoded_amt) = match client
-            .get(format!("{LND_REST_BASE_URL}/v1/payreq/{payment_request}"))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-        {
-            Ok(r) => match r.json::<serde_json::Value>().await {
-                Ok(d) => (
-                    d.get("payment_hash")
-                        .and_then(|v| v.as_str())
-                        .unwrap_or("")
-                        .to_string(),
-                    d.get("num_satoshis")
-                        .and_then(|v| v.as_str())
-                        .and_then(|s| s.parse::<i64>().ok())
-                        .unwrap_or(0),
-                ),
-                Err(_) => (String::new(), 0),
-            },
-            Err(_) => (String::new(), 0),
-        };
-
         let mut pay_body = serde_json::json!({
             "payment_request": payment_request,
         });
@@ -70,46 +43,13 @@ impl RpcHandler {
             pay_body["amt"] = serde_json::json!(amt.to_string());
         }
 
-        // `/v1/channels/transactions` is SYNCHRONOUS: it blocks until the
-        // payment settles or definitively fails, and multi-hop routing with
-        // retries routinely takes longer than the shared client's 15s budget.
-        // That 15s abort used to surface as "Payment failed" while LND kept
-        // paying in the background — the payment then succeeded and appeared
-        // in history a minute later. Wait up to 120s on a dedicated client,
-        // and treat a post-connect timeout as IN FLIGHT (status: pending),
-        // never as failure — only LND may declare a payment failed.
-        let pay_client = reqwest::Client::builder()
-            .no_proxy()
-            .connect_timeout(std::time::Duration::from_secs(10))
-            .timeout(std::time::Duration::from_secs(120))
-            .danger_accept_invalid_certs(true)
-            .build()
-            .context("Failed to create HTTP client")?;
-
-        let resp = match pay_client
+        let resp = client
             .post(format!("{LND_REST_BASE_URL}/v1/channels/transactions"))
             .header("Grpc-Metadata-macaroon", &macaroon_hex)
             .json(&pay_body)
             .send()
             .await
-        {
-            Ok(r) => r,
-            Err(e) if e.is_connect() => {
-                // Never reached LND — nothing was sent; this IS a hard error.
-                return Err(anyhow::anyhow!("Could not reach LND to pay: {e}"));
-            }
-            Err(_) => {
-                // Timed out (or lost the connection) AFTER the payment was
-                // handed to LND — it may well still succeed. Report pending
-                // with the hash so the caller can poll lnd.paymentstatus.
-                info!("payinvoice wait elapsed; payment still in flight");
-                return Ok(serde_json::json!({
-                    "status": "pending",
-                    "payment_hash": decoded_hash,
-                    "amount_sats": decoded_amt,
-                }));
-            }
-        };
+            .context("Failed to pay invoice")?;
 
         let status = resp.status();
         let body: serde_json::Value = resp
@@ -146,105 +86,20 @@ impl RpcHandler {
             .and_then(|r| r.get("total_amt"))
             .and_then(|v| v.as_str())
             .and_then(|s| s.parse::<i64>().ok())
-            .unwrap_or(decoded_amt);
+            .unwrap_or(0);
 
         let payment_hash = body
             .get("payment_hash")
             .and_then(|v| v.as_str())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string())
-            .unwrap_or(decoded_hash);
+            .unwrap_or("")
+            .to_string();
 
         Ok(serde_json::json!({
-            "status": "succeeded",
             "payment_hash": payment_hash,
             "amount_sats": amount_sat,
         }))
     }
 
-    /// Status of an outgoing Lightning payment by hex payment hash. Lets the
-    /// UI resolve a payinvoice that outlived its synchronous wait (`status:
-    /// "pending"`) to a real terminal state instead of guessing.
-    pub(in crate::api::rpc) async fn handle_lnd_paymentstatus(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let params = params.unwrap_or_default();
-        let payment_hash = params
-            .get("payment_hash")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing 'payment_hash' parameter"))?;
-        if payment_hash.len() != 64 || !payment_hash.chars().all(|c| c.is_ascii_hexdigit()) {
-            return Err(anyhow::anyhow!("Invalid payment hash"));
-        }
-
-        let (client, macaroon_hex) = self.lnd_client().await?;
-        let resp = client
-            .get(format!(
-                "{LND_REST_BASE_URL}/v1/payments?include_incomplete=true&max_payments=100&reversed=true"
-            ))
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-            .context("LND REST connection failed")?;
-        let body: serde_json::Value = resp
-            .json()
-            .await
-            .context("Failed to parse payments response")?;
-
-        let hash_lower = payment_hash.to_lowercase();
-        let found = body
-            .get("payments")
-            .and_then(|v| v.as_array())
-            .and_then(|arr| {
-                arr.iter().find(|p| {
-                    p.get("payment_hash").and_then(|v| v.as_str())
-                        == Some(hash_lower.as_str())
-                })
-            });
-
-        let Some(p) = found else {
-            // Not in the latest window — either very old or LND never saw it.
-            return Ok(serde_json::json!({ "status": "unknown" }));
-        };
-
-        let lnd_status = p.get("status").and_then(|v| v.as_str()).unwrap_or("");
-        let status = match lnd_status {
-            "SUCCEEDED" => "succeeded",
-            "FAILED" => "failed",
-            _ => "in_flight",
-        };
-        let failure_reason = match p
-            .get("failure_reason")
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-        {
-            "FAILURE_REASON_NO_ROUTE" => "No route to the recipient",
-            "FAILURE_REASON_INSUFFICIENT_BALANCE" => "Insufficient channel balance",
-            "FAILURE_REASON_TIMEOUT" => "Payment timed out in the network",
-            "FAILURE_REASON_INCORRECT_PAYMENT_DETAILS" => {
-                "Recipient rejected the payment (wrong details or expired invoice)"
-            }
-            "FAILURE_REASON_ERROR" => "Payment failed",
-            _ => "",
-        };
-
-        fn amt(p: &serde_json::Value, key: &str) -> i64 {
-            p.get(key)
-                .and_then(|f| f.as_str())
-                .and_then(|s| s.parse().ok())
-                .or_else(|| p.get(key).and_then(|f| f.as_i64()))
-                .unwrap_or(0)
-        }
-
-        Ok(serde_json::json!({
-            "status": status,
-            "failure_reason": failure_reason,
-            "amount_sats": amt(p, "value_sat"),
-            "fee_sats": amt(p, "fee_sat"),
-        }))
-    }
-
     /// List on-chain transactions from LND.
     /// Returns all transactions, with incoming (amount > 0) flagged.
     pub(in crate::api::rpc) async fn handle_lnd_gettransactions(

core/archipelago/src/api/rpc/lnd/wallet.rs

@@ -124,41 +124,16 @@ impl RpcHandler {
             return Err(anyhow::anyhow!("Invalid Bitcoin address format"));
         }
 
-        // Fee control: either a confirmation target or an explicit fee rate
-        let target_conf = params.get("target_conf").and_then(|v| v.as_i64());
-        let sat_per_vbyte = params.get("sat_per_vbyte").and_then(|v| v.as_i64());
-        if target_conf.is_some() && sat_per_vbyte.is_some() {
-            return Err(anyhow::anyhow!(
-                "Invalid fee parameters: specify either target_conf or sat_per_vbyte, not both"
-            ));
-        }
-        if let Some(tc) = target_conf {
-            if !(1..=1008).contains(&tc) {
-                return Err(anyhow::anyhow!(
-                    "Invalid target_conf: must be between 1 and 1008 blocks"
-                ));
-            }
-        }
-        if let Some(rate) = sat_per_vbyte {
-            if !(1..=5000).contains(&rate) {
-                return Err(anyhow::anyhow!(
-                    "Invalid sat_per_vbyte: must be between 1 and 5000"
-                ));
-            }
-        }
-
         info!(
             addr = addr,
             amount = amount,
             send_all = send_all,
-            target_conf = target_conf,
-            sat_per_vbyte = sat_per_vbyte,
             "Sending on-chain Bitcoin"
         );
 
         let (client, macaroon_hex) = self.lnd_client().await?;
 
-        let mut send_body = match amount {
+        let send_body = match amount {
             Some(amount) => serde_json::json!({
                 "addr": addr,
                 "amount": amount.to_string(),
@@ -168,13 +143,6 @@ impl RpcHandler {
                 "send_all": true,
             }),
         };
-        if let Some(tc) = target_conf {
-            send_body["target_conf"] = serde_json::json!(tc);
-        }
-        if let Some(rate) = sat_per_vbyte {
-            // LND REST encodes uint64 as a JSON string
-            send_body["sat_per_vbyte"] = serde_json::json!(rate.to_string());
-        }
 
         let resp = client
             .post(format!("{LND_REST_BASE_URL}/v1/transactions"))
@@ -203,82 +171,6 @@ impl RpcHandler {
         Ok(serde_json::json!({ "txid": txid }))
     }
 
-    /// Estimate the on-chain fee for sending `amount` sats to `addr` at a
-    /// confirmation target. Returns `{ fee_sat, sat_per_vbyte }` so the send
-    /// UI can show the cost of each preset before the user confirms.
-    pub(in crate::api::rpc) async fn handle_lnd_estimatefee(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let params = params.unwrap_or_default();
-        let addr = params
-            .get("addr")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing 'addr' parameter"))?;
-        if addr.len() < 14 || addr.len() > 90 || !addr.chars().all(|c| c.is_ascii_alphanumeric()) {
-            return Err(anyhow::anyhow!("Invalid Bitcoin address format"));
-        }
-        let amount = params
-            .get("amount")
-            .and_then(|v| v.as_i64())
-            .ok_or_else(|| anyhow::anyhow!("Missing 'amount' parameter (sats)"))?;
-        if !(546..=21_000_000 * 100_000_000).contains(&amount) {
-            return Err(anyhow::anyhow!("Invalid amount"));
-        }
-        let target_conf = params
-            .get("target_conf")
-            .and_then(|v| v.as_i64())
-            .unwrap_or(6);
-        if !(1..=1008).contains(&target_conf) {
-            return Err(anyhow::anyhow!(
-                "Invalid target_conf: must be between 1 and 1008 blocks"
-            ));
-        }
-
-        let (client, macaroon_hex) = self.lnd_client().await?;
-
-        let resp = client
-            .get(format!("{LND_REST_BASE_URL}/v1/transactions/fee"))
-            .query(&[
-                (format!("AddrToAmount[{addr}]"), amount.to_string()),
-                ("target_conf".to_string(), target_conf.to_string()),
-            ])
-            .header("Grpc-Metadata-macaroon", &macaroon_hex)
-            .send()
-            .await
-            .context("Failed to estimate fee")?;
-
-        let status = resp.status();
-        let body: serde_json::Value = resp
-            .json()
-            .await
-            .context("Failed to parse fee estimate response")?;
-
-        if !status.is_success() {
-            let msg = body
-                .get("message")
-                .and_then(|v| v.as_str())
-                .unwrap_or("Unknown error");
-            return Err(anyhow::anyhow!("Failed to estimate fee: {}", msg));
-        }
-
-        // LND REST encodes int64 as JSON strings
-        let fee_sat = body
-            .get("fee_sat")
-            .and_then(|v| v.as_str())
-            .and_then(|s| s.parse::<i64>().ok())
-            .unwrap_or(0);
-        let sat_per_vbyte = body
-            .get("sat_per_vbyte")
-            .and_then(|v| v.as_str())
-            .and_then(|s| s.parse::<i64>().ok())
-            .unwrap_or(0);
-        Ok(serde_json::json!({
-            "fee_sat": fee_sat,
-            "sat_per_vbyte": sat_per_vbyte,
-        }))
-    }
-
     /// Create a Lightning invoice.
     /// Create a Lightning invoice and return `(bolt11, payment_hash_hex)`.
     ///

core/archipelago/src/api/rpc/mesh/flash.rs

@@ -1,132 +0,0 @@
-use super::super::RpcHandler;
-use crate::mesh;
-use crate::mesh::flash::{self, FlashBoard, FlashJobStatus};
-use crate::mesh::types::DeviceType;
-use anyhow::Result;
-
-fn parse_family(s: &str) -> Result<DeviceType> {
-    match s.trim().to_lowercase().as_str() {
-        "meshcore" => Ok(DeviceType::Meshcore),
-        "meshtastic" => Ok(DeviceType::Meshtastic),
-        "reticulum" | "rnode" => Ok(DeviceType::Reticulum),
-        other => anyhow::bail!("Unknown firmware family: {other} (expected meshcore|meshtastic|reticulum)"),
-    }
-}
-
-fn parse_board(s: &str) -> Result<FlashBoard> {
-    match s.trim().to_lowercase().as_str() {
-        "heltec-v3" | "heltec_v3" | "heltecv3" => Ok(FlashBoard::HeltecV3),
-        "heltec-v4" | "heltec_v4" | "heltecv4" => Ok(FlashBoard::HeltecV4),
-        other => anyhow::bail!("Unknown board: {other} (expected heltec-v3|heltec-v4)"),
-    }
-}
-
-impl RpcHandler {
-    /// mesh.flash-list-firmware — resolve the available firmware version(s)
-    /// for a given family. v1 only ever surfaces "latest".
-    pub(in crate::api::rpc) async fn handle_mesh_flash_list_firmware(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let family = params
-            .as_ref()
-            .and_then(|p| p.get("family"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing family"))?;
-        let family = parse_family(family)?;
-        let versions = flash::list_firmware(family).await?;
-        Ok(serde_json::json!({ "versions": versions }))
-    }
-
-    /// mesh.flash-device — erase and reflash a detected LoRa radio with the
-    /// latest firmware for the given family, defaulting to a full chip
-    /// erase before write. `board` is optional: if the port's USB vid:pid
-    /// unambiguously resolves to a known board, that's used; otherwise the
-    /// caller must supply it explicitly (see `flash::resolve_flash_board`'s
-    /// doc comment on why we refuse to guess).
-    pub(in crate::api::rpc) async fn handle_mesh_flash_device(
-        &self,
-        params: Option<serde_json::Value>,
-    ) -> Result<serde_json::Value> {
-        let path = params
-            .as_ref()
-            .and_then(|p| p.get("path"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing path"))?
-            .to_string();
-        let family = params
-            .as_ref()
-            .and_then(|p| p.get("family"))
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("Missing family"))?;
-        let family = parse_family(family)?;
-
-        let detected = mesh::detect_devices().await;
-        anyhow::ensure!(
-            detected.iter().any(|d| d == &path),
-            "{path} is not a detected mesh-radio candidate port"
-        );
-
-        let board = match params
-            .as_ref()
-            .and_then(|p| p.get("board"))
-            .and_then(|v| v.as_str())
-        {
-            Some(explicit) => parse_board(explicit)?,
-            None => {
-                let info = mesh::detect_devices_info()
-                    .await
-                    .into_iter()
-                    .find(|d| d.path == path);
-                info.as_ref()
-                    .and_then(flash::resolve_flash_board)
-                    .ok_or_else(|| {
-                        anyhow::anyhow!(
-                            "Could not auto-detect the board on {path} — specify board explicitly"
-                        )
-                    })?
-            }
-        };
-
-        flash::start_flash_job(
-            &self.flash_job,
-            &self.mesh_service_arc(),
-            self.config.data_dir.clone(),
-            path,
-            board,
-            family,
-        )
-        .await?;
-
-        Ok(serde_json::json!({ "started": true }))
-    }
-
-    /// mesh.flash-status — poll the current (or most recent) flash job.
-    pub(in crate::api::rpc) async fn handle_mesh_flash_status(&self) -> Result<serde_json::Value> {
-        let job = self.flash_job.read().await;
-        match job.as_ref() {
-            Some(j) => {
-                let status: FlashJobStatus = j.snapshot().await;
-                let mut value = serde_json::to_value(&status)?;
-                if let Some(obj) = value.as_object_mut() {
-                    obj.insert("active".into(), (!status.done).into());
-                }
-                Ok(value)
-            }
-            None => Ok(serde_json::json!({ "active": false })),
-        }
-    }
-
-    /// mesh.flash-cancel — best-effort; only honored before erase/write has
-    /// started (see `FlashJob::cancel`'s doc comment).
-    pub(in crate::api::rpc) async fn handle_mesh_flash_cancel(&self) -> Result<serde_json::Value> {
-        let job = self.flash_job.read().await;
-        match job.as_ref() {
-            Some(j) => {
-                j.cancel().await?;
-                Ok(serde_json::json!({ "cancelled": true }))
-            }
-            None => anyhow::bail!("No flash job in progress"),
-        }
-    }
-}

core/archipelago/src/api/rpc/mesh/messaging.rs

@@ -1,7 +1,6 @@
 use super::super::RpcHandler;
 use crate::mesh;
 use anyhow::Result;
-use std::sync::Arc;
 use tracing::info;
 
 impl RpcHandler {
@@ -132,14 +131,7 @@ impl RpcHandler {
             config.broadcast_identity = broadcast;
         }
         if let Some(name) = params.get("advert_name").and_then(|v| v.as_str()) {
-            // Empty clears the custom mesh name (falls back to the server
-            // name) — without this, a name could be set but never unset.
-            let trimmed = name.trim();
-            config.advert_name = if trimmed.is_empty() {
-                None
-            } else {
-                Some(trimmed.to_string())
-            };
+            config.advert_name = Some(name.to_string());
         }
         if let Some(announce) = params
             .get("announce_block_headers")
@@ -210,24 +202,10 @@ impl RpcHandler {
 
         mesh::save_config(&self.config.data_dir, &config).await?;
 
-        // Apply to the running service in the background: configure() may
-        // stop+start the listener (config changes now restart the session so
-        // they actually take effect), and that can take seconds when the old
-        // session is mid-probe. Holding the service write-lock for that long
-        // inside this handler stalled every concurrent mesh.status/mesh.peers
-        // poll behind it — the UI froze and nginx surfaced 502s. The config is
-        // already persisted above; the UI observes progress via mesh.status.
-        {
-            let service_arc = Arc::clone(&self.mesh_service);
-            let config_for_apply = config.clone();
-            tokio::spawn(async move {
-                let mut service = service_arc.write().await;
-                if let Some(svc) = service.as_mut() {
-                    if let Err(e) = svc.configure(config_for_apply).await {
-                        tracing::error!("Applying mesh config to running service failed: {e:#}");
-                    }
-                }
-            });
+        // If we have a running service, update its config
+        let mut service = self.mesh_service.write().await;
+        if let Some(svc) = service.as_mut() {
+            svc.configure(config.clone()).await?;
         }
 
         info!("Mesh config updated");

core/archipelago/src/api/rpc/mesh/mod.rs

@@ -1,6 +1,5 @@
 mod assistant;
 mod bitcoin_ops;
-mod flash;
 mod messaging;
 mod safety;
 mod status;

core/archipelago/src/api/rpc/mesh/status.rs

@@ -101,59 +101,13 @@ impl RpcHandler {
             detected.iter().any(|d| d == &path),
             "{path} is not a detected mesh-radio candidate port"
         );
-        // Refuse to probe while a firmware flash is in flight. Confirmed
-        // live 2026-07-23: esptool ("multiple access on port?") and
-        // rnodeconf (OSError Errno 71 Protocol error on an RTS ioctl) both
-        // failed with symptoms consistent with a second process holding the
-        // same serial fd — the flash subprocess runs for minutes outside
-        // our own async runtime, so nothing previously stopped a concurrent
-        // `mesh.probe-device` call (e.g. the hot-swap modal's own re-probe)
-        // from opening the identical port at the same time and corrupting
-        // both operations' handshakes.
-        if let Some(job) = self.flash_job.read().await.as_ref() {
-            anyhow::ensure!(
-                job.snapshot().await.done,
-                "A firmware flash is in progress — refusing to probe the serial port until it finishes"
-            );
-        }
-        // Only hold the mesh_service lock long enough for the quick
-        // active-path guard check — NEVER across the actual probe, which
-        // can take 15-60s across its internal collision retries. Confirmed
-        // live 2026-07-23: holding this read lock for the full probe starved
-        // a concurrent firmware-flash job's MeshService::stop() (which needs
-        // the write lock) well past its own bounded timeout, surfacing as
-        // "Mesh listener did not release the serial port" even though
-        // stop() itself was fast.
-        {
-            let service = self.mesh_service.read().await;
-            if let Some(svc) = service.as_ref() {
-                svc.ensure_probe_allowed(&path).await?;
-            }
-        }
-        let probe = mesh::listener::probe_device(&path).await?;
-        Ok(serde_json::to_value(probe)?)
-    }
-
-    /// mesh.refresh — Actively refresh discovery state: re-query the radio's
-    /// contact table and re-announce ourselves so quiet-but-alive neighbours
-    /// answer. This is what the UI's Refresh button calls — before it existed
-    /// the button only re-read server caches and never touched the radio.
-    pub(in crate::api::rpc) async fn handle_mesh_refresh(&self) -> Result<serde_json::Value> {
         let service = self.mesh_service.read().await;
-        let Some(svc) = service.as_ref() else {
-            return Ok(serde_json::json!({ "refreshed": false, "device_connected": false }));
+        let probe = match service.as_ref() {
+            Some(svc) => svc.probe_device(&path).await?,
+            // No mesh service yet (radio never enabled) — probe directly.
+            None => mesh::listener::probe_device(&path).await?,
         };
-        let status = svc.status().await;
-        if status.device_connected {
-            let state = svc.shared_state();
-            let _ = state
-                .send_cmd(crate::mesh::listener::MeshCommand::RefreshContacts)
-                .await;
-        }
-        Ok(serde_json::json!({
-            "refreshed": status.device_connected,
-            "device_connected": status.device_connected,
-        }))
+        Ok(serde_json::to_value(probe)?)
     }
 
     /// mesh.peers — List discovered mesh peers.

core/archipelago/src/api/rpc/mesh/typed_messages.rs

@@ -820,8 +820,6 @@ impl RpcHandler {
             crate::fips::dial::PeerRequest::new(fips_npub.as_deref(), &onion_bare, &path)
                 .service(crate::settings::transport::PeerService::MeshFileSharing)
                 .timeout(std::time::Duration::from_secs(120))
-                .fips_timeout(std::time::Duration::from_secs(8))
-                .record_transport(&self.config.data_dir)
                 .send_get()
                 .await
                 .map_err(|e| anyhow::anyhow!("Fetch failed: {}", e))?;

core/archipelago/src/api/rpc/mod.rs

@@ -89,9 +89,6 @@ pub struct RpcHandler {
     endpoint_rate_limiter: EndpointRateLimiter,
     response_cache: ResponseCache,
     mesh_service: Arc<tokio::sync::RwLock<Option<crate::mesh::MeshService>>>,
-    /// LoRa radio firmware-flash job state, sibling to `mesh_service` — one
-    /// job at a time, since flashing needs exclusive access to the port.
-    flash_job: crate::mesh::flash::FlashJobHandle,
     transport_router: Arc<tokio::sync::RwLock<Option<Arc<crate::transport::TransportRouter>>>>,
     /// Shared content-addressed blob store. Set by ApiHandler after construction
     /// so mesh.send-content / mesh.fetch-content RPCs can reach it without a
@@ -163,7 +160,6 @@ impl RpcHandler {
             endpoint_rate_limiter,
             response_cache: ResponseCache::new(5),
             mesh_service: Arc::new(tokio::sync::RwLock::new(None)),
-            flash_job: crate::mesh::flash::new_job_handle(),
             transport_router: Arc::new(tokio::sync::RwLock::new(None)),
             blob_store: Arc::new(tokio::sync::RwLock::new(None)),
             self_pubkey_hex: Arc::new(tokio::sync::RwLock::new(None)),
@@ -560,8 +556,8 @@ impl RpcHandler {
                         .is_some(),
                     None => false,
                 };
-            let totp_enabled =
-                !is_token_login && self.auth_manager.is_totp_enabled().await.unwrap_or(false);
+            let totp_enabled = !is_token_login
+                && self.auth_manager.is_totp_enabled().await.unwrap_or(false);
             if totp_enabled {
                 let password = login_params
                     .as_ref()

core/archipelago/src/api/rpc/network.rs

@@ -137,7 +137,6 @@ impl RpcHandler {
             None,
             None,
             None,
-            Some(&self.config.data_dir),
         )
         .await?;
 
@@ -226,7 +225,6 @@ impl RpcHandler {
             signing_key.as_ref().map(|i| i.signing_key()),
             Some(&req.from_pubkey),
             data.server_info.name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await
         {

core/archipelago/src/api/rpc/package/install.rs

@@ -2324,28 +2324,17 @@ async fn cleanup_start_conflict(package_id: &str, stderr: &str) -> bool {
 }
 
 async fn cleanup_stale_pasta_port(port: &str) {
-    // NEVER kill our own process. The daemon holds catalog app ports over
-    // IPv6 (the mesh app-port relay), so a blunt `fuser -k <port>/tcp` would
-    // terminate archipelago itself mid-install — installs failed and apps
-    // vanished on framework-pt 2026-07-27. Kill every listener on the port
-    // EXCEPT our PID (and our process group), leaving the relay/daemon alive.
-    let self_pid = std::process::id();
     let kill_listener = format!(
-        "ss -ltnp 'sport = :{port}' 2>/dev/null | sed -n 's/.*pid=\\([0-9]*\\).*/\\1/p' | \
-         while read p; do [ \"$p\" = \"{self_pid}\" ] || kill \"$p\" 2>/dev/null; done || true",
+        "ss -ltnp 'sport = :{}' 2>/dev/null | sed -n 's/.*pid=\\([0-9]*\\).*/\\1/p' | xargs -r kill 2>/dev/null || true",
+        port
     );
     let _ = tokio::process::Command::new("sh")
         .args(["-c", &kill_listener])
         .output()
         .await;
 
-    // sudo fuser -k, but exclude our own PID: fuser prints the PIDs holding
-    // the port; kill each except self. (`fuser -k` has no exclusion flag.)
-    let fuser_kill = format!(
-        "for p in $(sudo fuser {port}/tcp 2>/dev/null); do [ \"$p\" = \"{self_pid}\" ] || sudo kill \"$p\" 2>/dev/null; done || true",
-    );
-    let _ = tokio::process::Command::new("sh")
-        .args(["-c", &fuser_kill])
+    let _ = tokio::process::Command::new("sudo")
+        .args(["fuser", "-k", &format!("{}/tcp", port)])
         .output()
         .await;
 

core/archipelago/src/api/rpc/package/pine_ha.rs

@@ -766,11 +766,7 @@ async fn find_satellite(port: u16) -> Option<String> {
             if self_ips.contains(&ip) {
                 continue;
             }
-            set.spawn(async move {
-                tcp_alive(&ip.to_string(), port, 500)
-                    .await
-                    .then(|| ip.to_string())
-            });
+            set.spawn(async move { tcp_alive(&ip.to_string(), port, 500).await.then(|| ip.to_string()) });
         }
         while let Some(res) = set.join_next().await {
             if let Ok(Some(ip)) = res {

core/archipelago/src/api/rpc/peers.rs

@@ -133,7 +133,6 @@ impl RpcHandler {
             Some(node_id.signing_key()),
             recipient_pubkey.as_deref(),
             node_name.as_deref(),
-            Some(&self.config.data_dir),
         )
         .await?;
         Ok(serde_json::json!({ "ok": true, "sent_to": onion }))

core/archipelago/src/api/rpc/seed_rpc.rs

@@ -56,12 +56,12 @@ pub(in crate::api::rpc) async fn save_pending_seed_encrypted(
     Ok(true)
 }
 
-/// Best-effort: install fips.yaml + start the available FIPS systemd unit after
-/// seed onboarding has written the fips_key to disk. Runs in a detached task so
-/// the user-facing RPC returns immediately — the systemctl calls can take a few
-/// seconds the first time on slow hardware. Any failure is logged but does not
-/// break onboarding; the user can still hit fips.install manually from the
-/// dashboard as an escape hatch.
+/// Best-effort: install fips.yaml + start archipelago-fips.service after the
+/// seed onboarding has written the fips_key to disk. Runs in a detached task
+/// so the user-facing RPC returns immediately — the systemctl calls can take
+/// a few seconds the first time on slow hardware. Any failure is logged but
+/// does not break onboarding; the user can still hit fips.install manually
+/// from the dashboard as an escape hatch.
 fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) {
     tokio::spawn(async move {
         let identity_dir = data_dir.join("identity");
@@ -78,12 +78,11 @@ fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) {
             tracing::warn!("post-onboarding fips config install failed: {}", e);
             return;
         }
-        let unit = crate::fips::service::activation_unit().await;
-        if let Err(e) = crate::fips::service::activate(unit).await {
-            tracing::warn!("post-onboarding FIPS activate failed via {}: {}", unit, e);
+        if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await {
+            tracing::warn!("post-onboarding archipelago-fips activate failed: {}", e);
             return;
         }
-        tracing::info!("FIPS auto-activated post-onboarding via {}", unit);
+        tracing::info!("archipelago-fips auto-activated post-onboarding");
     });
 }
 
@@ -139,8 +138,8 @@ impl RpcHandler {
         // Initialize identity index at 0.
         crate::seed::save_identity_index(&self.config.data_dir, 0).await?;
 
-        // fips_key is now on disk — auto-activate FIPS so the user doesn't
-        // have to hit a manual Start button. Detached task;
+        // fips_key is now on disk — auto-activate archipelago-fips so the
+        // user doesn't have to hit an "Activate" button. Detached task;
         // the onboarding RPC returns immediately.
         spawn_post_onboarding_fips_activate(self.config.data_dir.clone());
 

core/archipelago/src/api/rpc/system/handlers.rs

@@ -61,28 +61,6 @@ impl RpcHandler {
 
         info!("Server name updated to: {}", name);
 
-        // Propagate to the mesh: the listener advertises the server name (when
-        // no explicit mesh advert_name overrides it), but it was only read at
-        // process startup — a rename never reached the radio/RNS until the
-        // next full restart. Push it into the service and bounce the listener
-        // in the background (the restart re-probes the radio, which can take
-        // seconds — don't block the rename response on it).
-        {
-            let mesh_arc = self.mesh_service_arc();
-            let name_for_mesh = name.clone();
-            tokio::spawn(async move {
-                let mut guard = mesh_arc.write().await;
-                if let Some(svc) = guard.as_mut() {
-                    svc.set_server_name(Some(name_for_mesh));
-                    if svc.config().advert_name.is_none() {
-                        if let Err(e) = svc.restart_listener_if_running().await {
-                            warn!("Mesh listener restart after rename failed: {}", e);
-                        }
-                    }
-                }
-            });
-        }
-
         // Push the new name to federation peers in background
         let data_dir = self.config.data_dir.clone();
         let state_manager = self.state_manager.clone();

core/archipelago/src/api/rpc/tor/mod.rs

@@ -498,9 +498,7 @@ pub(super) async fn notify_federation_peers_address_change(
                             "/rpc/v1",
                         )
                         .service(crate::settings::transport::PeerService::Peers)
-                        .timeout(std::time::Duration::from_secs(30))
-                        .fips_timeout(std::time::Duration::from_secs(6))
-                        .record_transport(data_dir);
+                        .timeout(std::time::Duration::from_secs(30));
                         match req.send_json(&payload).await {
                             Ok((_, transport)) => {
                                 info!(peer_did = %peer.did, transport = %transport, "Notified peer of address change")

core/archipelago/src/bootstrap.rs

@@ -848,17 +848,11 @@ pub async fn ensure_audio_stack() {
         {
             Ok(s) if s.success() => info!("audio: PipeWire stack installed"),
             Ok(s) => {
-                warn!(
-                    "audio: package install exited with {} — will retry next start",
-                    s
-                );
+                warn!("audio: package install exited with {} — will retry next start", s);
                 return;
             }
             Err(e) => {
-                warn!(
-                    "audio: package install failed: {:#} — will retry next start",
-                    e
-                );
+                warn!("audio: package install failed: {:#} — will retry next start", e);
                 return;
             }
         }
@@ -884,23 +878,12 @@ pub async fn ensure_audio_stack() {
     }
     if unit_was_missing {
         // First install on this node — bring it up now and on every boot.
-        let _ = host_sudo(&[
-            "systemctl",
-            "enable",
-            "--now",
-            "archipelago-audio-router.service",
-        ])
-        .await;
+        let _ = host_sudo(&["systemctl", "enable", "--now", "archipelago-audio-router.service"]).await;
         info!("audio: router installed and enabled (HDMI routing + ELD heal)");
     } else if script_changed || unit_changed {
         // Content update: restart only if it's running — never re-enable a
         // unit an operator deliberately disabled.
-        let _ = host_sudo(&[
-            "systemctl",
-            "try-restart",
-            "archipelago-audio-router.service",
-        ])
-        .await;
+        let _ = host_sudo(&["systemctl", "try-restart", "archipelago-audio-router.service"]).await;
         info!("audio: router updated");
     }
 }
@@ -928,21 +911,10 @@ pub async fn ensure_gamepad_keys() {
         }
     }
     if unit_was_missing {
-        let _ = host_sudo(&[
-            "systemctl",
-            "enable",
-            "--now",
-            "archipelago-gamepad-keys.service",
-        ])
-        .await;
+        let _ = host_sudo(&["systemctl", "enable", "--now", "archipelago-gamepad-keys.service"]).await;
         info!("gamepad: bridge installed and enabled (TV controller input)");
     } else if script_changed || unit_changed {
-        let _ = host_sudo(&[
-            "systemctl",
-            "try-restart",
-            "archipelago-gamepad-keys.service",
-        ])
-        .await;
+        let _ = host_sudo(&["systemctl", "try-restart", "archipelago-gamepad-keys.service"]).await;
         info!("gamepad: bridge updated");
     }
 }
@@ -1019,13 +991,6 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
     // B13: fedimint block present but lacking the asset-rewrite sub_filters.
     let needs_fedimint_css = content.contains("location /app/fedimint/")
         && !content.contains("'href=\"/' 'href=\"/app/fedimint/'");
-    // Companion mesh access: phones reach this node over FIPS at its fips0
-    // ULA (http://[fdxx:…]). Configs shipped before 2026-07-23 listened on
-    // IPv4 only, so the ULA could never connect — nothing answered [::]:80.
-    let missing_v6_http =
-        content.contains("listen 80 default_server;") && !content.contains("listen [::]:80");
-    let missing_v6_https =
-        content.contains("listen 443 ssl default_server;") && !content.contains("listen [::]:443");
     if !missing_app_catalog
         && !missing_bitcoin_status
         && !missing_lnd_proxy
@@ -1033,27 +998,12 @@ async fn patch_nginx_conf(path: &str) -> Result<bool> {
         && !missing_pine_status
         && !has_lnd_dup_cors
         && !needs_fedimint_css
-        && !missing_v6_http
-        && !missing_v6_https
     {
         return Ok(false);
     }
 
     let mut patched = content.clone();
 
-    if missing_v6_http {
-        patched = patched.replace(
-            "listen 80 default_server;",
-            "listen 80 default_server;\n    listen [::]:80 default_server;",
-        );
-    }
-    if missing_v6_https {
-        patched = patched.replace(
-            "listen 443 ssl default_server;",
-            "listen 443 ssl default_server;\n    listen [::]:443 ssl default_server;",
-        );
-    }
-
     if has_lnd_dup_cors {
         // Drop the redundant nginx-side CORS headers so the backend's single
         // validated Access-Control-Allow-Origin is the only one returned.

core/archipelago/src/container/boot_reconciler.rs

@@ -111,7 +111,8 @@ impl BootReconciler {
                 let mut failure_rounds: u32 = 0;
                 loop {
                     let installed = orchestrator.manifest_ids().await;
-                    let failures = crate::container::companion::reconcile(&installed).await;
+                    let failures =
+                        crate::container::companion::reconcile(&installed).await;
                     for (companion, err) in &failures {
                         tracing::warn!(
                             companion = %companion,

core/archipelago/src/container/companion.rs

@@ -22,10 +22,8 @@
 //! single declarative call.
 
 use anyhow::{Context, Result};
-use std::collections::HashMap;
 use std::path::PathBuf;
-use std::sync::{LazyLock, Mutex};
-use std::time::{Duration, Instant};
+use std::time::Duration;
 use tokio::fs;
 use tokio::process::Command;
 use tracing::{info, warn};
@@ -37,15 +35,6 @@ const COMPANION_REGISTRY: &str = "146.59.87.168:3000/lfg2025";
 const COMPANION_IMAGE_CHECK_TIMEOUT: Duration = Duration::from_secs(15);
 const COMPANION_BUILD_TIMEOUT: Duration = Duration::from_secs(900);
 const COMPANION_PULL_TIMEOUT: Duration = Duration::from_secs(300);
-/// After a failed repair (image build/pull included), leave the companion
-/// alone for this long. Without it, a node under IO pressure retried a 900s
-/// image build every 30s reconcile tick — each build pegging the disk that
-/// made the probes fail in the first place (live-diagnosed on zaza-optiplex
-/// 2026-07-28: load 50, podman scans starved, apps page stuck).
-const REPAIR_COOLDOWN: Duration = Duration::from_secs(600);
-
-static REPAIR_FAILED_AT: LazyLock<Mutex<HashMap<&'static str, Instant>>> =
-    LazyLock::new(|| Mutex::new(HashMap::new()));
 
 /// Static description of one companion. The full list per backend
 /// app_id lives in `companions_for`.
@@ -475,28 +464,12 @@ pub async fn reconcile(installed_apps: &[String]) -> Vec<(String, anyhow::Error)
             match needs_repair(spec).await {
                 Ok(false) => {}
                 Ok(true) => {
-                    if let Some(failed_at) =
-                        REPAIR_FAILED_AT.lock().unwrap().get(spec.name).copied()
-                    {
-                        if failed_at.elapsed() < REPAIR_COOLDOWN {
-                            continue;
-                        }
-                    }
                     info!(
                         companion = spec.name,
                         "reconcile: companion not active, repairing"
                     );
-                    match install_one(spec).await {
-                        Ok(()) => {
-                            REPAIR_FAILED_AT.lock().unwrap().remove(spec.name);
-                        }
-                        Err(e) => {
-                            REPAIR_FAILED_AT
-                                .lock()
-                                .unwrap()
-                                .insert(spec.name, Instant::now());
-                            failures.push((spec.name.to_string(), e));
-                        }
+                    if let Err(e) = install_one(spec).await {
+                        failures.push((spec.name.to_string(), e));
                     }
                 }
                 Err(e) => {
@@ -511,58 +484,19 @@ pub async fn reconcile(installed_apps: &[String]) -> Vec<(String, anyhow::Error)
 
 /// Does this companion need install_one to be re-run? Returns true if
 /// the unit file is missing, stale, or the service is not active.
-///
-/// This probe runs every reconcile tick for every companion, so it must be
-/// PASSIVE: no image builds, no pulls. It used to call ensure_image_present
-/// to render the expected unit — under IO pressure the image-existence check
-/// inside timed out, read as "image missing", and a 900s `podman build` ran
-/// inside the probe even though the companion was up (the .198 load spiral).
 async fn needs_repair(spec: &CompanionSpec) -> Result<bool> {
     let dir = quadlet::unit_dir().await?;
     let unit_path = dir.join(format!("{}.container", spec.name));
     if !fs::try_exists(&unit_path).await.unwrap_or(false) {
         return Ok(true);
     }
-    let svc = format!("{}.service", spec.name);
-    // A hung `systemctl is-active` under IO pressure must not read as
-    // "companion dead" — that's a repair (and possibly an image build) fired
-    // off exactly when the node can least afford one.
-    match tokio::time::timeout(Duration::from_secs(10), quadlet::is_active(&svc)).await {
-        Ok(active) => {
-            if !active {
-                return Ok(true);
-            }
-        }
-        Err(_) => {
-            warn!(
-                companion = spec.name,
-                "is-active probe timed out; assuming active"
-            );
-        }
-    }
-    // Service is running. Flag it stale only on definitive, cheap signals:
-    // the on-disk unit matching none of the image refs install_one could
-    // have written, or a local build context newer than the built image.
-    let on_disk = fs::read_to_string(&unit_path).await.unwrap_or_default();
-    let local_image = format!("localhost/{}:latest", spec.image_base);
-    let local_image_compat = format!("localhost/{}:local", spec.image_base);
-    let registry_image = format!("{}/{}:latest", COMPANION_REGISTRY, spec.image_base);
-    let matches_known_shape = [&local_image, &local_image_compat, &registry_image]
-        .iter()
-        .any(|img| build_unit(spec, img).render() == on_disk);
-    if !matches_known_shape {
+    let expected_image = ensure_image_present(spec).await?;
+    let expected_unit = build_unit(spec, &expected_image);
+    if expected_unit.render() != fs::read_to_string(&unit_path).await.unwrap_or_default() {
         return Ok(true);
     }
-    if on_disk.contains(&local_image) && !on_disk.contains(&local_image_compat) {
-        for dir in spec.build_dir_candidates {
-            let dockerfile = PathBuf::from(dir).join("Dockerfile");
-            if fs::try_exists(&dockerfile).await.unwrap_or(false) {
-                // Conservative on any timeout/error inside: reuse the cache.
-                return Ok(context_is_newer_than_image(dir, &local_image).await);
-            }
-        }
-    }
-    Ok(false)
+    let svc = format!("{}.service", spec.name);
+    Ok(!quadlet::is_active(&svc).await)
 }
 
 #[cfg(test)]

core/archipelago/src/container/quadlet.rs

@@ -248,17 +248,10 @@ impl QuadletUnit {
                 } else {
                     proto.as_str()
                 };
-                // Unbound publishes are pinned to 0.0.0.0: rootlessport's
-                // wildcard bind claims [::] too but BLACK-HOLES inbound v6
-                // (accepts, forwards nothing — "empty response" from the
-                // mesh, confirmed 2026-07-26). Pinning v4 frees the port's
-                // v6 side for the daemon's mesh relay (app_port_v6_relay_loop),
-                // which forwards to the v4 loopback listener that works.
-                // NOTE: this changes the rendered directive for unbound
-                // ports on purpose — the one-time drift/recreate at upgrade
-                // is the deploy vehicle for the fix.
+                // Keep the rendered directive byte-identical for unbound
+                // ports so existing units don't read as drifted.
                 if bind.is_empty() {
-                    let _ = writeln!(s, "PublishPort=0.0.0.0:{host}:{container}/{p}");
+                    let _ = writeln!(s, "PublishPort={host}:{container}/{p}");
                 } else {
                     let _ = writeln!(s, "PublishPort={bind}:{host}:{container}/{p}");
                 }
@@ -1025,7 +1018,7 @@ mod tests {
         u.network = NetworkMode::Bridge("archy-net".into());
         u.ports = vec![(3000, 3000, "tcp".into(), String::new())];
         let s = u.render();
-        assert!(s.contains("PublishPort=0.0.0.0:3000:3000/tcp"));
+        assert!(s.contains("PublishPort=3000:3000/tcp"));
     }
 
     #[test]
@@ -1174,8 +1167,8 @@ mod tests {
         let s = u.render();
         assert!(s.contains("PublishPort=127.0.0.1:8332:8332/tcp"));
         assert!(s.contains("PublishPort=10.89.0.1:8332:8332/tcp"));
-        assert!(s.contains("PublishPort=0.0.0.0:8333:8333/tcp"));
-        assert!(!s.contains("PublishPort=0.0.0.0:8332:8332/tcp"));
+        assert!(s.contains("PublishPort=8333:8333/tcp"));
+        assert!(!s.contains("PublishPort=8332:8332/tcp"));
     }
 
     #[test]
@@ -1207,8 +1200,8 @@ mod tests {
             ..QuadletUnit::default()
         };
         let s = u.render();
-        assert!(s.contains("PublishPort=0.0.0.0:8332:8332/tcp"));
-        assert!(s.contains("PublishPort=0.0.0.0:8333:8333/tcp"));
+        assert!(s.contains("PublishPort=8332:8332/tcp"));
+        assert!(s.contains("PublishPort=8333:8333/tcp"));
         assert!(s.contains("Environment=BITCOIN_RPC_USER=archipelago"));
         assert!(s.contains("Environment=BITCOIN_RPC_PASS=secret"));
         assert!(s.contains("Environment=\"RELAY_NAME=Archipelago Nostr Relay\""));
@@ -1324,7 +1317,7 @@ app:
         let m = AppManifest::parse(yaml).expect("manifest must parse");
         let s = QuadletUnit::from_manifest(&m, "searxng").render();
 
-        assert!(s.contains("PublishPort=0.0.0.0:8888:8080/tcp"));
+        assert!(s.contains("PublishPort=8888:8080/tcp"));
         assert!(!s.contains("Network=host"));
     }
 
@@ -1753,7 +1746,7 @@ app:
         assert!(body.contains("Network=archy-net"));
         assert!(body.contains("NetworkAlias=lnd"));
         assert!(body.contains("PodmanArgs=--network-alias=lnd"));
-        assert!(body.contains("PublishPort=0.0.0.0:10009:10009/tcp"));
+        assert!(body.contains("PublishPort=10009:10009/tcp"));
         assert!(body.contains("Volume=/var/lib/archipelago/lnd:/root/.lnd:Z"));
         assert!(body.contains("Environment=LND_NETWORK=mainnet"));
         assert!(body.contains("PodmanArgs=--memory=1024m"));

core/archipelago/src/fips/anchors.rs

@@ -90,13 +90,15 @@ pub fn archy_anchor() -> SeedAnchor {
 pub fn fips_network_anchors() -> Vec<SeedAnchor> {
     vec![
         SeedAnchor {
-            npub: "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u".to_string(),
+            npub: "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u"
+                .to_string(),
             address: "23.182.128.74:443".to_string(),
             transport: "tcp".to_string(),
             label: "FIPS network anchor (join.fips.network)".to_string(),
         },
         SeedAnchor {
-            npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98".to_string(),
+            npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
+                .to_string(),
             address: "217.77.8.91:443".to_string(),
             transport: "tcp".to_string(),
             label: "FIPS network anchor (join.fips.network)".to_string(),
@@ -156,24 +158,7 @@ pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
         .with_context(|| format!("read {}", path.display()))?;
     let anchors: Vec<SeedAnchor> =
         serde_json::from_slice(&bytes).with_context(|| format!("parse {}", path.display()))?;
-    Ok(repair_legacy_anchor_set(anchors))
-}
-
-/// Add the newer redundant public TCP anchors to legacy files that only carry
-/// the Archipelago-operated vps2 anchor. A deliberately custom/private anchor
-/// list remains authoritative; this only repairs the exact stale shape shipped
-/// before the join.fips.network anchors became defaults.
-fn repair_legacy_anchor_set(mut anchors: Vec<SeedAnchor>) -> Vec<SeedAnchor> {
-    let has_archy = anchors.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB);
-    let has_fips_network = fips_network_anchors()
-        .iter()
-        .any(|default| anchors.iter().any(|a| a.npub == default.npub));
-    if has_archy && !has_fips_network {
-        for anchor in fips_network_anchors() {
-            anchors.push(anchor);
-        }
-    }
-    anchors
+    Ok(anchors)
 }
 
 /// Persist the list. Overwrites atomically via write-then-rename so a
@@ -232,32 +217,26 @@ pub async fn remove(data_dir: &Path, npub: &str) -> Result<Vec<SeedAnchor>> {
 /// leaving `anchor_connected=false` and every peer dial falling back to
 /// a slow Tor timeout.
 pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
-    // Concurrent, each connect hard-capped: the old serial loop waited
-    // unbounded on every `sudo fipsctl connect`, so one hung subprocess
-    // stalled the whole apply — and the periodic anchor tick behind it,
-    // which is exactly when a wedged daemon most needs the re-apply.
-    let futs = anchors.iter().cloned().map(|anchor| async move {
-        let out = tokio::time::timeout(
-            std::time::Duration::from_secs(15),
-            Command::new("sudo")
-                .args([
-                    "-n",
-                    "fipsctl",
-                    "connect",
-                    &anchor.npub,
-                    &anchor.address,
-                    &anchor.transport,
-                ])
-                .output(),
-        )
-        .await;
+    let mut results = Vec::with_capacity(anchors.len());
+    for anchor in anchors {
+        let out = Command::new("sudo")
+            .args([
+                "-n",
+                "fipsctl",
+                "connect",
+                &anchor.npub,
+                &anchor.address,
+                &anchor.transport,
+            ])
+            .output()
+            .await;
         let result = match out {
-            Ok(Ok(o)) if o.status.success() => ApplyResult {
+            Ok(o) if o.status.success() => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: true,
                 message: String::from_utf8_lossy(&o.stdout).trim().to_string(),
             },
-            Ok(Ok(o)) => ApplyResult {
+            Ok(o) => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: false,
                 message: format!(
@@ -266,16 +245,11 @@ pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
                     String::from_utf8_lossy(&o.stderr).trim()
                 ),
             },
-            Ok(Err(e)) => ApplyResult {
+            Err(e) => ApplyResult {
                 npub: anchor.npub.clone(),
                 ok: false,
                 message: format!("sudo fipsctl launch failed: {}", e),
             },
-            Err(_) => ApplyResult {
-                npub: anchor.npub.clone(),
-                ok: false,
-                message: "sudo fipsctl connect timed out after 15s".to_string(),
-            },
         };
         if result.ok {
             tracing::debug!(npub = %result.npub, "Seed anchor applied");
@@ -286,9 +260,9 @@ pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
                 "Seed anchor apply failed (non-fatal)"
             );
         }
-        result
-    });
-    futures_util::future::join_all(futs).await
+        results.push(result);
+    }
+    results
 }
 
 /// Outcome of a single `fipsctl connect` call.
@@ -301,12 +275,12 @@ pub struct ApplyResult {
 
 /// FIPS UDP transport port (matches `transports.udp.bind_addr` in the generated
 /// `fips.yaml`). Direct peer links dial this, NOT the HTTP/LAN messaging port.
-const FIPS_UDP_PORT: u16 = crate::fips::PUBLISHED_UDP_PORT;
+const FIPS_UDP_PORT: u16 = 8668;
 
 /// Build transient seed-anchor entries that dial LAN-discovered federation peers
 /// directly over their FIPS UDP transport. For each peer the registry knows both
 /// a LAN socket address AND a FIPS npub for, point a `udp` anchor at
-/// `<lan-ip>:<FIPS_UDP_PORT>`. This lets co-located federation nodes form a DIRECT FIPS link
+/// `<lan-ip>:8668`. This lets co-located federation nodes form a DIRECT FIPS link
 /// instead of depending on the global anchor's spanning tree to route between
 /// them (the cause of every dial falling back to Tor when the anchor link flaps).
 ///
@@ -366,30 +340,6 @@ mod tests {
         assert!(got.iter().all(|a| a.transport == "tcp"));
     }
 
-    #[tokio::test]
-    async fn load_repairs_legacy_archy_only_anchor_file() {
-        let dir = tempfile::tempdir().unwrap();
-        save(dir.path(), &[archy_anchor()]).await.unwrap();
-
-        let got = load(dir.path()).await.unwrap();
-        assert!(got.iter().any(|a| a.npub == ARCHY_ANCHOR_NPUB));
-        for anchor in fips_network_anchors() {
-            assert!(got.iter().any(|a| a.npub == anchor.npub));
-        }
-    }
-
-    #[tokio::test]
-    async fn load_keeps_private_anchor_file_authoritative() {
-        let dir = tempfile::tempdir().unwrap();
-        let private = mk("npub1private");
-        save(dir.path(), std::slice::from_ref(&private))
-            .await
-            .unwrap();
-
-        let got = load(dir.path()).await.unwrap();
-        assert_eq!(got, vec![private]);
-    }
-
     #[tokio::test]
     async fn removing_one_default_persists_and_keeps_the_other() {
         // Editing the anchor list (here removing one default) makes the file
@@ -459,39 +409,4 @@ mod tests {
         assert_eq!(a.transport, "udp");
         assert_eq!(a.label, "");
     }
-
-    #[test]
-    fn lan_fips_anchor_port_matches_daemon_bind() {
-        // Drift guard: direct LAN anchors must dial the UDP port the
-        // generated fips.yaml actually binds. These were out of sync for
-        // months (anchors dialed 8668, the daemon bound 2121), making the
-        // whole direct-peering feature dial a dead port.
-        let yaml = crate::fips::config::render_config_yaml();
-        assert!(
-            yaml.contains(&format!("0.0.0.0:{FIPS_UDP_PORT}")),
-            "lan_fips_anchors dials :{FIPS_UDP_PORT} but the daemon config binds elsewhere"
-        );
-    }
-
-    #[test]
-    fn lan_fips_anchors_builds_direct_entry() {
-        let peer = crate::transport::PeerRecord {
-            did: "did:key:zpeer".to_string(),
-            lan_address: Some("192.168.63.198:5678".to_string()),
-            fips_npub: Some("npub1peer".to_string()),
-            ..Default::default()
-        };
-        let out = lan_fips_anchors(&[peer]);
-        assert_eq!(out.len(), 1);
-        assert_eq!(out[0].address, format!("192.168.63.198:{FIPS_UDP_PORT}"));
-        assert_eq!(out[0].transport, "udp");
-
-        // Peers missing either the LAN address or the npub produce nothing.
-        let no_npub = crate::transport::PeerRecord {
-            did: "did:key:zother".to_string(),
-            lan_address: Some("192.168.63.199:5678".to_string()),
-            ..Default::default()
-        };
-        assert!(lan_fips_anchors(&[no_npub]).is_empty());
-    }
 }

core/archipelago/src/fips/app_ports.rs

@@ -1,44 +0,0 @@
-//! Generated by scripts/generate-app-catalog.py. Do not edit manually.
-//!
-//! Catalog app launch ports (the web UIs the companion opens by direct
-//! port). Used to write the fips0 firewall allowance drop-in so app UIs
-//! are reachable over the mesh; ports of apps that aren't installed have
-//! no listener, so allowing them is inert.
-
-pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283,
-    2342,
-    3000,
-    3001,
-    3002,
-    4080,
-    5180,
-    7778,
-    8080,
-    8081,
-    8082,
-    8083,
-    8084,
-    8085,
-    8087,
-    8088,
-    8089,
-    8090,
-    8096,
-    8123,
-    8175,
-    8176,
-    8240,
-    8334,
-    8888,
-    8999,
-    9000,
-    9100,
-    10380,
-    11434,
-    18081,
-    18083,
-    23000,
-    32838,
-    50002,
-];

core/archipelago/src/fips/config.rs

@@ -48,30 +48,6 @@ pub struct FipsConfig {
 pub struct NodeSection {
     pub identity: IdentitySection,
     pub discovery: DiscoverySection,
-    pub retry: RetrySection,
-    pub rate_limit: RateLimitSection,
-}
-
-/// Fast-reconnect profile (`node.retry.*`). Upstream defaults (5s base
-/// doubling to 300s) are tuned for stable always-on links; a node redialing
-/// a recycled anchor sat off-mesh for ~90s. Field names verified live on
-/// 2026-07-24: a daemon restarted with these keys in fips.yaml and peered.
-#[derive(Debug, Clone, PartialEq, Serialize)]
-pub struct RetrySection {
-    pub base_interval_secs: u64,
-    pub max_backoff_secs: u64,
-    pub max_retries: u32,
-}
-
-/// Session-handshake resend pacing (`node.rate_limit.*`). Stock 1s x2.0
-/// gaps out to 8-16s between resends exactly when a route has just
-/// appeared; 400ms x1.5 keeps continuous coverage through the connect
-/// window (phone measured session-after-route: 225ms).
-#[derive(Debug, Clone, PartialEq, Serialize)]
-pub struct RateLimitSection {
-    pub handshake_resend_interval_ms: u64,
-    pub handshake_resend_backoff: f64,
-    pub handshake_max_resends: u32,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -84,14 +60,6 @@ pub struct IdentitySection {
 
 #[derive(Debug, Clone, PartialEq, Serialize)]
 pub struct DiscoverySection {
-    /// Lookup completion timeout. Lookups fired while the tree position is
-    /// still settling are doomed; failing them fast (5s, not 10s) lets the
-    /// 1s-backoff retry find the route the moment it exists.
-    pub timeout_secs: u64,
-    pub backoff_base_secs: u64,
-    pub backoff_max_secs: u64,
-    pub retry_interval_secs: u64,
-    pub max_attempts: u8,
     pub lan: LanDiscoverySection,
 }
 
@@ -155,23 +123,8 @@ impl Default for FipsConfig {
             node: NodeSection {
                 identity: IdentitySection { persistent: true },
                 discovery: DiscoverySection {
-                    timeout_secs: 5,
-                    backoff_base_secs: 1,
-                    backoff_max_secs: 30,
-                    retry_interval_secs: 2,
-                    max_attempts: 3,
                     lan: LanDiscoverySection { enabled: true },
                 },
-                retry: RetrySection {
-                    base_interval_secs: 1,
-                    max_backoff_secs: 30,
-                    max_retries: 30,
-                },
-                rate_limit: RateLimitSection {
-                    handshake_resend_interval_ms: 400,
-                    handshake_resend_backoff: 1.5,
-                    handshake_max_resends: 10,
-                },
             },
             tun: TunSection {
                 enabled: true,
@@ -233,75 +186,6 @@ pub async fn install(identity_dir: &Path) -> Result<()> {
     let _ = tokio::fs::remove_file(&stage).await;
     install_result?;
 
-    // The release-hardening firewall (/etc/fips/fips.nft, provisioned
-    // out-of-band) default-denies inbound on fips0 — without an explicit
-    // allowance the node's web UI is unreachable over the mesh (phones got
-    // RST on :80 with a healthy session; root-caused 2026-07-26 on
-    // framework-pt). Ship the allowance as a fips.d drop-in on every
-    // install/upgrade so no node ever regresses to a UI-less mesh.
-    sudo_install_dir("/etc/fips/fips.d").await?;
-    // PEER_PORT (5679) carries ALL federation sync, cloud browse/download,
-    // mesh envelopes, DWN and invoices. It was missing from this allowlist
-    // while the comment claimed "web UI + peer API" — so every hardened
-    // node silently dropped peers' FIPS dials at the firewall and the whole
-    // fleet fell back to Tor (root-caused live 2026-07-27: 28k drops on
-    // .198's counter; :5679 answered in 0.35s once the rule was inserted).
-    let dropin = format!(
-        "# Written by archipelago on every daemon config install.\n\
-         # Allows the web UI + peer API through the fips0\n\
-         # default-deny inbound baseline (fips.nft).\n\
-         tcp dport 80 accept\n\
-         tcp dport 8443 accept\n\
-         tcp dport {peer_port} accept\n",
-        peer_port = crate::fips::dial::PEER_PORT
-    );
-    let nft_stage = std::env::temp_dir().join(format!("fips-webui-{}.nft", std::process::id()));
-    tokio::fs::write(&nft_stage, dropin)
-        .await
-        .context("Failed to stage web-ui nft drop-in")?;
-    let nft_install = sudo_install_file(&nft_stage, "/etc/fips/fips.d/80-web-ui.nft", "0644").await;
-    let _ = tokio::fs::remove_file(&nft_stage).await;
-    nft_install?;
-
-    // App launch ports: the companion opens catalog apps by direct port
-    // over the mesh. Ports of apps that aren't installed have no listener,
-    // so the allowance is inert until an app exists to answer.
-    let port_list = super::app_ports::APP_LAUNCH_PORTS
-        .iter()
-        .map(|p| p.to_string())
-        .collect::<Vec<_>>()
-        .join(", ");
-    let app_dropin = format!(
-        "# Written by archipelago on every daemon config install.\n\
-         # Catalog app launch ports (web UIs) allowed through the fips0\n\
-         # default-deny inbound baseline. Service/RPC ports stay closed.\n\
-         tcp dport {{ {port_list} }} accept\n"
-    );
-    let app_stage = std::env::temp_dir().join(format!("fips-appports-{}.nft", std::process::id()));
-    tokio::fs::write(&app_stage, app_dropin)
-        .await
-        .context("Failed to stage app-ports nft drop-in")?;
-    let app_install =
-        sudo_install_file(&app_stage, "/etc/fips/fips.d/85-app-ports.nft", "0644").await;
-    let _ = tokio::fs::remove_file(&app_stage).await;
-    app_install?;
-    // Make the allowance live immediately; a no-op error when the
-    // hardening baseline isn't installed on this node yet.
-    if tokio::fs::try_exists("/etc/fips/fips.nft").await.unwrap_or(false) {
-        match Command::new("sudo")
-            .args(["nft", "-f", "/etc/fips/fips.nft"])
-            .output()
-            .await
-        {
-            Ok(out) if !out.status.success() => tracing::warn!(
-                "nft reload after web-ui drop-in failed: {}",
-                String::from_utf8_lossy(&out.stderr).trim()
-            ),
-            Err(e) => tracing::warn!("nft reload after web-ui drop-in failed: {e}"),
-            _ => {}
-        }
-    }
-
     sudo_install_file(&src_key, DAEMON_KEY_PATH, "0600").await?;
     // Heal a legacy fips_key.pub that was written as bech32 npub text
     // (pre-fix identity::write_fips_key_from_seed did this). Upstream
@@ -434,21 +318,8 @@ node:
   identity:
     persistent: true
   discovery:
-    timeout_secs: 5
-    backoff_base_secs: 1
-    backoff_max_secs: 30
-    retry_interval_secs: 2
-    max_attempts: 3
     lan:
       enabled: true
-  retry:
-    base_interval_secs: 1
-    max_backoff_secs: 30
-    max_retries: 30
-  rate_limit:
-    handshake_resend_interval_ms: 400
-    handshake_resend_backoff: 1.5
-    handshake_max_resends: 10
 tun:
   enabled: true
   name: fips0

core/archipelago/src/fips/dial.rs

@@ -24,7 +24,6 @@
 //! ```
 #![allow(dead_code)]
 
-use super::telemetry::{self, FallbackReason};
 use anyhow::{Context, Result};
 use std::net::{IpAddr, Ipv6Addr};
 use std::time::Duration;
@@ -151,12 +150,6 @@ pub async fn warm_path(npub: &str) {
     if !is_service_active().await {
         return;
     }
-    warm_path_unchecked(npub).await
-}
-
-/// [`warm_path`] without the service-active check — for callers (the warm
-/// tick) that already verified the daemon once for the whole batch.
-pub async fn warm_path_unchecked(npub: &str) {
     let Ok(base) = peer_base_url(npub).await else {
         return;
     };
@@ -283,39 +276,21 @@ pub fn as_ip_addr(v6: Ipv6Addr) -> IpAddr {
 
 // ── High-level peer request helpers ────────────────────────────────────
 
-/// TTL for the [`is_service_active`] cache. Every FIPS dial attempt and
-/// every warm-tick peer used to spawn up to two `systemctl` subprocesses;
-/// service state changes on human timescales, so 10s staleness is free.
-const SERVICE_ACTIVE_TTL_MS: u64 = 10_000;
-static SERVICE_ACTIVE: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
-static SERVICE_PROBED_AT_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-
 /// Quick poll: is the FIPS daemon (archipelago-supervised OR upstream)
-/// currently `systemctl is-active`? Cached for [`SERVICE_ACTIVE_TTL_MS`];
-/// concurrent refreshes are harmless (idempotent probe, last write wins).
+/// currently `systemctl is-active`? Async wrapper intended for the
+/// migration call sites; unlike `FipsTransport::is_available` this does
+/// not maintain a cache, so callers that poll frequently should cache
+/// themselves.
 pub async fn is_service_active() -> bool {
-    use std::sync::atomic::Ordering;
-    let now_ms = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_millis() as u64)
-        .unwrap_or(0);
-    let probed_at = SERVICE_PROBED_AT_MS.load(Ordering::Relaxed);
-    if probed_at != 0 && now_ms.saturating_sub(probed_at) < SERVICE_ACTIVE_TTL_MS {
-        return SERVICE_ACTIVE.load(Ordering::Relaxed);
-    }
-    let mut active = false;
     for unit in [
         crate::fips::SERVICE_UNIT,
         crate::fips::UPSTREAM_SERVICE_UNIT,
     ] {
         if crate::fips::service::unit_state(unit).await == "active" {
-            active = true;
-            break;
+            return true;
         }
     }
-    SERVICE_ACTIVE.store(active, Ordering::Relaxed);
-    SERVICE_PROBED_AT_MS.store(now_ms, Ordering::Relaxed);
-    active
+    false
 }
 
 /// Builder for a peer request that may be sent over FIPS (preferred) or
@@ -342,11 +317,6 @@ pub struct PeerRequest<'a> {
     /// large content download needs so its long FIPS transfer isn't truncated.
     pub fips_timeout: Option<std::time::Duration>,
     pub service: Option<crate::settings::transport::PeerService>,
-    /// When set, the transport that actually served this request is written
-    /// to federation storage (`record_peer_transport`, matched by onion) so
-    /// the per-peer FIPS/Tor badge reflects reality. Opt-in because not
-    /// every caller has a data dir in scope.
-    pub record_data_dir: Option<std::path::PathBuf>,
 }
 
 impl<'a> PeerRequest<'a> {
@@ -359,31 +329,6 @@ impl<'a> PeerRequest<'a> {
             timeout: std::time::Duration::from_secs(30),
             fips_timeout: None,
             service: None,
-            record_data_dir: None,
-        }
-    }
-
-    /// Record the transport that serves this request into federation storage
-    /// (matched by this request's onion host). Best-effort, off the hot path.
-    pub fn record_transport(mut self, data_dir: impl Into<std::path::PathBuf>) -> Self {
-        self.record_data_dir = Some(data_dir.into());
-        self
-    }
-
-    fn spawn_record(&self, kind: crate::transport::TransportKind) {
-        if let Some(dir) = &self.record_data_dir {
-            let dir = dir.clone();
-            let onion = self.onion_host.to_string();
-            let transport = kind.to_string();
-            tokio::spawn(async move {
-                let _ = crate::federation::record_peer_transport(
-                    &dir,
-                    None,
-                    Some(&onion),
-                    &transport,
-                )
-                .await;
-            });
         }
     }
 
@@ -444,22 +389,8 @@ impl<'a> PeerRequest<'a> {
                     // fix (404 path-not-served / 5xx) and we're allowed to
                     // fall back. FIPS-only never falls back.
                     if pref == TransportPref::Fips || !fips_should_fall_back(resp.status()) {
-                        telemetry::record_fips_ok();
-                        self.spawn_record(crate::transport::TransportKind::Fips);
                         return Ok((resp, crate::transport::TransportKind::Fips));
                     }
-                    let reason = if resp.status() == reqwest::StatusCode::NOT_FOUND {
-                        FallbackReason::Http404
-                    } else {
-                        FallbackReason::Http5xx
-                    };
-                    telemetry::record_fallback(reason);
-                    tracing::info!(
-                        reason = reason.key(),
-                        status = %resp.status(),
-                        "FIPS POST {} answered but status triggers Tor fallback",
-                        self.path
-                    );
                 }
                 None => {
                     if pref == TransportPref::Fips {
@@ -471,7 +402,6 @@ impl<'a> PeerRequest<'a> {
             }
         }
         let resp = self.send_tor_post_json(body).await?;
-        self.spawn_record(crate::transport::TransportKind::Tor);
         Ok((resp, crate::transport::TransportKind::Tor))
     }
 
@@ -483,22 +413,8 @@ impl<'a> PeerRequest<'a> {
             match self.try_fips_get().await? {
                 Some(resp) => {
                     if pref == TransportPref::Fips || !fips_should_fall_back(resp.status()) {
-                        telemetry::record_fips_ok();
-                        self.spawn_record(crate::transport::TransportKind::Fips);
                         return Ok((resp, crate::transport::TransportKind::Fips));
                     }
-                    let reason = if resp.status() == reqwest::StatusCode::NOT_FOUND {
-                        FallbackReason::Http404
-                    } else {
-                        FallbackReason::Http5xx
-                    };
-                    telemetry::record_fallback(reason);
-                    tracing::info!(
-                        reason = reason.key(),
-                        status = %resp.status(),
-                        "FIPS GET {} answered but status triggers Tor fallback",
-                        self.path
-                    );
                 }
                 None => {
                     if pref == TransportPref::Fips {
@@ -510,7 +426,6 @@ impl<'a> PeerRequest<'a> {
             }
         }
         let resp = self.send_tor_get().await?;
-        self.spawn_record(crate::transport::TransportKind::Tor);
         Ok((resp, crate::transport::TransportKind::Tor))
     }
 
@@ -519,127 +434,67 @@ impl<'a> PeerRequest<'a> {
         body: &B,
     ) -> Result<Option<reqwest::Response>> {
         let Some(npub) = self.fips_npub else {
-            telemetry::record_fallback(FallbackReason::NoNpub);
             return Ok(None);
         };
         if !is_service_active().await {
-            telemetry::record_fallback(FallbackReason::ServiceInactive);
             return Ok(None);
         }
         let base = match peer_base_url(npub).await {
             Ok(b) => b,
             Err(e) => {
-                telemetry::record_fallback(FallbackReason::DnsFail);
-                tracing::info!(
-                    reason = FallbackReason::DnsFail.key(),
-                    "FIPS resolve for {} failed: {}, falling back to Tor",
-                    npub,
-                    e
-                );
+                tracing::debug!("FIPS resolve for {} failed: {}", npub, e);
                 return Ok(None);
             }
         };
         let url = format!("{}{}", base, self.path);
-        let budget = self.fips_attempt_timeout();
-        // With an explicit fast-fail cap, halve the per-attempt client
-        // timeout so the one-retry path in send_with_retry fits inside the
-        // budget instead of silently doubling it ("fips_timeout(6s)" used
-        // to really mean ~12.6s). Without one (long streaming downloads),
-        // keep the full budget per attempt — the client timeout also
-        // governs body streaming and must not truncate a real transfer.
-        let per_attempt = if self.fips_timeout.is_some() {
-            budget / 2
-        } else {
-            budget
-        };
-        let c = client_with_timeout(per_attempt);
+        let c = client_with_timeout(self.fips_attempt_timeout());
         let mut rb = c.post(&url).json(body);
         for (k, v) in &self.headers {
             rb = rb.header(*k, v);
         }
-        match tokio::time::timeout(budget, send_with_retry(rb)).await {
-            Ok(Ok(r)) => Ok(Some(r)),
-            Ok(Err(e)) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+        match send_with_retry(rb).await {
+            Ok(r) => Ok(Some(r)),
+            Err(e) => {
+                tracing::debug!(
                     "FIPS POST {} failed after retry: {}, falling back to Tor",
                     url,
                     e
                 );
                 Ok(None)
             }
-            Err(_) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
-                    "FIPS POST {} exceeded attempt budget {:?}, falling back to Tor",
-                    url,
-                    budget
-                );
-                Ok(None)
-            }
         }
     }
 
     async fn try_fips_get(&self) -> Result<Option<reqwest::Response>> {
         let Some(npub) = self.fips_npub else {
-            telemetry::record_fallback(FallbackReason::NoNpub);
             return Ok(None);
         };
         if !is_service_active().await {
-            telemetry::record_fallback(FallbackReason::ServiceInactive);
             return Ok(None);
         }
         let base = match peer_base_url(npub).await {
             Ok(b) => b,
             Err(e) => {
-                telemetry::record_fallback(FallbackReason::DnsFail);
-                tracing::info!(
-                    reason = FallbackReason::DnsFail.key(),
-                    "FIPS resolve for {} failed: {}, falling back to Tor",
-                    npub,
-                    e
-                );
+                tracing::debug!("FIPS resolve for {} failed: {}", npub, e);
                 return Ok(None);
             }
         };
         let url = format!("{}{}", base, self.path);
-        let budget = self.fips_attempt_timeout();
-        // Same budget discipline as the POST path: halve per attempt only
-        // under an explicit fast-fail cap; hard-cap the retry sequence.
-        let per_attempt = if self.fips_timeout.is_some() {
-            budget / 2
-        } else {
-            budget
-        };
-        let c = client_with_timeout(per_attempt);
+        let c = client_with_timeout(self.fips_attempt_timeout());
         let mut rb = c.get(&url);
         for (k, v) in &self.headers {
             rb = rb.header(*k, v);
         }
-        match tokio::time::timeout(budget, send_with_retry(rb)).await {
-            Ok(Ok(r)) => Ok(Some(r)),
-            Ok(Err(e)) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
+        match send_with_retry(rb).await {
+            Ok(r) => Ok(Some(r)),
+            Err(e) => {
+                tracing::debug!(
                     "FIPS GET {} failed after retry: {}, falling back to Tor",
                     url,
                     e
                 );
                 Ok(None)
             }
-            Err(_) => {
-                telemetry::record_fallback(FallbackReason::ConnectFail);
-                tracing::info!(
-                    reason = FallbackReason::ConnectFail.key(),
-                    "FIPS GET {} exceeded attempt budget {:?}, falling back to Tor",
-                    url,
-                    budget
-                );
-                Ok(None)
-            }
         }
     }
 

core/archipelago/src/fips/mod.rs

@@ -26,12 +26,10 @@
 #![allow(dead_code)]
 
 pub mod anchors;
-pub mod app_ports;
 pub mod config;
 pub mod dial;
 pub mod iface;
 pub mod service;
-pub mod telemetry;
 pub mod update;
 
 use serde::{Deserialize, Serialize};
@@ -55,8 +53,7 @@ pub async fn ensure_activated(data_dir: &std::path::Path) {
         tracing::warn!("FIPS auto-activate: config install failed: {:#}", e);
         return;
     }
-    let unit = service::activation_unit().await;
-    if let Err(e) = service::activate(unit).await {
+    if let Err(e) = service::activate(SERVICE_UNIT).await {
         tracing::warn!("FIPS auto-activate: service activate failed: {:#}", e);
         return;
     }
@@ -80,73 +77,25 @@ pub async fn ensure_activated(data_dir: &std::path::Path) {
 pub fn spawn_fips_supervisor(data_dir: std::path::PathBuf) {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(std::time::Duration::from_secs(25));
-        // Connectivity watcher state: re-apply seed anchors the moment the
-        // anchor link drops (edge) or the data path degrades (dials keep
-        // failing with zero successes), instead of waiting for the 300s
-        // anchor tick. Bounded: at most one re-apply per RE_APPLY_BACKOFF.
-        const RE_APPLY_BACKOFF: std::time::Duration = std::time::Duration::from_secs(60);
-        let mut prev_connected: Option<bool> = None;
-        let mut prev_totals = telemetry::totals();
-        let mut last_apply: Option<std::time::Instant> = None;
         loop {
             tick.tick().await;
             // Bring FIPS up on its own once onboarding has materialised the key.
             ensure_activated(&data_dir).await;
             if !dial::is_service_active().await {
-                prev_connected = None; // daemon restart = fresh edge detection
                 continue;
             }
-
-            // ── Warm the union of federation peers + configured seed
-            // anchors. Warming only federation npubs left the direct
-            // anchors (vps2, LAN peers) to go cold between 300s ticks.
             let nodes = crate::federation::load_nodes(&data_dir)
                 .await
                 .unwrap_or_default();
-            let seed = anchors::load(&data_dir).await.unwrap_or_default();
-            let mut warm_npubs: std::collections::BTreeSet<String> = nodes
-                .iter()
-                .filter_map(|n| n.fips_npub.clone())
-                .collect();
-            warm_npubs.extend(seed.iter().map(|a| a.npub.clone()));
             let mut handles = Vec::new();
-            for npub in warm_npubs {
-                // Service-active was checked once above for the whole batch.
-                handles.push(tokio::spawn(
-                    async move { dial::warm_path_unchecked(&npub).await },
-                ));
+            for node in nodes {
+                if let Some(npub) = node.fips_npub.clone() {
+                    handles.push(tokio::spawn(async move { dial::warm_path(&npub).await }));
+                }
             }
             for h in handles {
                 let _ = h.await;
             }
-
-            // ── Connectivity watcher: detect anchor-link loss AND silent
-            // data-path death (daemon reports "connected" but every dial
-            // connect-fails — observed live on .198, 2026-07-27, where the
-            // 300s tick never healed it).
-            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
-            anchor_npubs.extend(seed.iter().map(|a| a.npub.clone()));
-            let (_, connected) = service::peer_connectivity_summary(&anchor_npubs).await;
-            let totals = telemetry::totals();
-            let link_dropped = prev_connected == Some(true) && !connected;
-            let never_connected = prev_connected.is_none() && !connected;
-            let data_path_dead =
-                totals.1.saturating_sub(prev_totals.1) >= 5 && totals.0 == prev_totals.0;
-            prev_connected = Some(connected);
-            prev_totals = totals;
-
-            let backoff_ok = last_apply.is_none_or(|t| t.elapsed() >= RE_APPLY_BACKOFF);
-            if (link_dropped || never_connected || data_path_dead) && backoff_ok && !seed.is_empty()
-            {
-                tracing::info!(
-                    link_dropped,
-                    never_connected,
-                    data_path_dead,
-                    "FIPS connectivity degraded — re-applying seed anchors now"
-                );
-                last_apply = Some(std::time::Instant::now());
-                let _ = anchors::apply(&seed).await;
-            }
         }
     });
 }

core/archipelago/src/fips/service.rs

@@ -32,16 +32,6 @@ pub async fn unit_state(unit: &str) -> String {
     }
 }
 
-/// Whether systemd knows about `unit`.
-pub async fn unit_exists(unit: &str) -> bool {
-    Command::new("systemctl")
-        .args(["cat", unit])
-        .output()
-        .await
-        .map(|out| out.status.success())
-        .unwrap_or(false)
-}
-
 /// Whether the `fips` debian package is installed on the host.
 pub async fn package_installed() -> bool {
     // dpkg-query -W -f='${Status}' fips → "install ok installed" when present.
@@ -91,7 +81,6 @@ async fn sudo_systemctl(verb: &str, unit: &str) -> Result<()> {
 /// Unmask + start + enable the FIPS service. Idempotent — safe to call
 /// on every backend startup once the key is on disk.
 pub async fn activate(unit: &str) -> Result<()> {
-    kill_stale_daemons().await?;
     // Order matters: unmask before enable/start, otherwise enable fails
     // on a masked unit.
     sudo_systemctl("unmask", unit).await?;
@@ -105,64 +94,20 @@ pub async fn stop(unit: &str) -> Result<()> {
 }
 
 pub async fn restart(unit: &str) -> Result<()> {
-    kill_stale_daemons().await?;
     sudo_systemctl("restart", unit).await
 }
 
-/// Kill orphaned `fips` processes not owned by either known systemd unit.
-///
-/// Field failure, 2026-07-24: a stale daemon survived outside systemd and kept
-/// `0.0.0.0:8443` bound. The supervised daemon then started UDP-only, so every
-/// TCP seed-anchor connect failed with "no operational transport" and phones
-/// on 5G could not discover the node. We keep the cleanup narrow: preserve the
-/// MainPID of both units and terminate only extra `pgrep -x fips` matches.
-pub async fn kill_stale_daemons() -> Result<()> {
-    let script = format!(
-        r#"keep="$(systemctl show -p MainPID --value {managed} 2>/dev/null; systemctl show -p MainPID --value {upstream} 2>/dev/null)"
-for pid in $(pgrep -x fips 2>/dev/null || true); do
-  case " $keep " in
-    *" $pid "*) ;;
-    *) kill "$pid" 2>/dev/null || true ;;
-  esac
-done
-"#,
-        managed = super::SERVICE_UNIT,
-        upstream = super::UPSTREAM_SERVICE_UNIT,
-    );
-    let out = Command::new("sudo")
-        .args(["sh", "-c", &script])
-        .output()
-        .await
-        .context("sudo stale fips cleanup failed to launch")?;
-    if !out.status.success() {
-        let stderr = String::from_utf8_lossy(&out.stderr).trim().to_string();
-        anyhow::bail!("stale fips cleanup failed: {}", stderr);
-    }
-    Ok(())
-}
-
-/// Resolve which systemd unit should be started when FIPS is inactive.
-/// Newer Archipelago images may ship `archipelago-fips.service`; nodes with
-/// the upstream Debian package may only have `fips.service`. Activation must
-/// choose a unit systemd can actually load, otherwise the dashboard repeatedly
-/// offers an "Activate" action that can never succeed.
-pub async fn activation_unit() -> &'static str {
-    if unit_exists(super::SERVICE_UNIT).await {
-        return super::SERVICE_UNIT;
-    }
-    if unit_exists(super::UPSTREAM_SERVICE_UNIT).await {
-        return super::UPSTREAM_SERVICE_UNIT;
-    }
-    super::SERVICE_UNIT
-}
-
-/// Resolve which systemd unit is actually supervising the fips daemon on this
-/// host. Restart/Reconnect must operate on whichever one is running, otherwise
-/// the UI button is a silent no-op.
+/// Resolve which systemd unit is actually supervising the fips daemon
+/// on this host. Nodes installed from the archipelago ISO run
+/// `archipelago-fips.service`; nodes that were apt-installed (or had
+/// fips running before archipelago took over) may only have the
+/// upstream `fips.service`. Restart/Reconnect must operate on whichever
+/// one is running, otherwise the UI button is a silent no-op.
 ///
 /// Returns the archipelago-managed unit name if it's active,
 /// else the upstream unit name if that's active,
-/// else a startable activation unit.
+/// else the archipelago-managed name as a default (so activate() can
+/// bring it up).
 pub async fn active_unit() -> &'static str {
     if unit_state(super::SERVICE_UNIT).await == "active" {
         return super::SERVICE_UNIT;
@@ -170,7 +115,7 @@ pub async fn active_unit() -> &'static str {
     if unit_state(super::UPSTREAM_SERVICE_UNIT).await == "active" {
         return super::UPSTREAM_SERVICE_UNIT;
     }
-    activation_unit().await
+    super::SERVICE_UNIT
 }
 
 pub async fn mask(unit: &str) -> Result<()> {
@@ -269,10 +214,4 @@ mod tests {
         // Must not panic regardless of host state.
         let _ = package_installed().await;
     }
-
-    #[tokio::test]
-    async fn test_unit_exists_is_bool() {
-        // Must not panic regardless of host state.
-        let _ = unit_exists("archipelago-bogus-test.service").await;
-    }
 }

core/archipelago/src/fips/telemetry.rs

@@ -1,155 +0,0 @@
-//! In-process counters for FIPS dial outcomes.
-//!
-//! Every peer dial that could have used FIPS either succeeds over FIPS or
-//! falls back to Tor for one of six reasons (F1–F6). Before these counters
-//! existed, fallbacks were `debug!`-only and invisible in production, which
-//! made "FIPS uptime" unfalsifiable — several paths were 100% Tor for months
-//! (dead ports, firewalled listeners, allowlist 404s) and nothing surfaced
-//! it. The counters are process-lifetime (reset on restart) and exposed via
-//! `fips.status` as `dial_stats`, so a fleet-wide fallback regression shows
-//! up on the dashboard instead of as vague slowness.
-
-use std::sync::atomic::{AtomicU64, Ordering};
-
-/// Why a FIPS-capable dial fell back to Tor.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FallbackReason {
-    /// F1 — no FIPS npub known for the peer (never meshed, or pre-npub
-    /// federation record). Expected for non-FIPS peers; high counts here
-    /// mean npub propagation is broken, not the transport.
-    NoNpub,
-    /// F2 — the local FIPS daemon service isn't active.
-    ServiceInactive,
-    /// F3 — the local FIPS DNS resolver couldn't resolve the peer's npub
-    /// (daemon up but peer not in the identity cache / mesh unreachable).
-    DnsFail,
-    /// F4 — TCP/HTTP dial to the peer's ULA failed or exceeded the FIPS
-    /// attempt budget (firewalled :5679, cold hole-punch, peer down).
-    ConnectFail,
-    /// F5 — peer answered over FIPS with 404: its listener doesn't serve
-    /// this path (older build / stricter allowlist).
-    Http404,
-    /// F6 — peer answered over FIPS with a 5xx server error.
-    Http5xx,
-}
-
-impl FallbackReason {
-    pub fn key(self) -> &'static str {
-        match self {
-            Self::NoNpub => "no_npub",
-            Self::ServiceInactive => "service_inactive",
-            Self::DnsFail => "dns_fail",
-            Self::ConnectFail => "connect_fail",
-            Self::Http404 => "http_404",
-            Self::Http5xx => "http_5xx",
-        }
-    }
-}
-
-static FIPS_OK: AtomicU64 = AtomicU64::new(0);
-static NO_NPUB: AtomicU64 = AtomicU64::new(0);
-static SERVICE_INACTIVE: AtomicU64 = AtomicU64::new(0);
-static DNS_FAIL: AtomicU64 = AtomicU64::new(0);
-static CONNECT_FAIL: AtomicU64 = AtomicU64::new(0);
-static HTTP_404: AtomicU64 = AtomicU64::new(0);
-static HTTP_5XX: AtomicU64 = AtomicU64::new(0);
-
-fn counter(reason: FallbackReason) -> &'static AtomicU64 {
-    match reason {
-        FallbackReason::NoNpub => &NO_NPUB,
-        FallbackReason::ServiceInactive => &SERVICE_INACTIVE,
-        FallbackReason::DnsFail => &DNS_FAIL,
-        FallbackReason::ConnectFail => &CONNECT_FAIL,
-        FallbackReason::Http404 => &HTTP_404,
-        FallbackReason::Http5xx => &HTTP_5XX,
-    }
-}
-
-/// A dial completed over FIPS (any HTTP status that wasn't a fallback
-/// trigger — the peer was reached on the mesh).
-pub fn record_fips_ok() {
-    FIPS_OK.fetch_add(1, Ordering::Relaxed);
-}
-
-/// A FIPS-capable dial fell back to Tor.
-pub fn record_fallback(reason: FallbackReason) {
-    counter(reason).fetch_add(1, Ordering::Relaxed);
-}
-
-/// `(fips_ok, connect_fail)` totals for the connectivity watcher: a window
-/// where connect_fail grows while fips_ok doesn't is a degraded data path —
-/// including the "daemon says connected but packets blackhole" failure the
-/// link-state check alone can't see (observed live 2026-07-27 on .198).
-pub fn totals() -> (u64, u64) {
-    (
-        FIPS_OK.load(Ordering::Relaxed),
-        CONNECT_FAIL.load(Ordering::Relaxed),
-    )
-}
-
-/// Snapshot for `fips.status` (`dial_stats`). Process-lifetime counts.
-pub fn snapshot() -> serde_json::Value {
-    let f1 = NO_NPUB.load(Ordering::Relaxed);
-    let f2 = SERVICE_INACTIVE.load(Ordering::Relaxed);
-    let f3 = DNS_FAIL.load(Ordering::Relaxed);
-    let f4 = CONNECT_FAIL.load(Ordering::Relaxed);
-    let f5 = HTTP_404.load(Ordering::Relaxed);
-    let f6 = HTTP_5XX.load(Ordering::Relaxed);
-    serde_json::json!({
-        "fips_ok": FIPS_OK.load(Ordering::Relaxed),
-        "fallbacks": {
-            "no_npub": f1,
-            "service_inactive": f2,
-            "dns_fail": f3,
-            "connect_fail": f4,
-            "http_404": f5,
-            "http_5xx": f6,
-            "total": f1 + f2 + f3 + f4 + f5 + f6,
-        },
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn snapshot_counts_recorded_events() {
-        // Counters are global; assert deltas rather than absolutes so this
-        // test stays correct alongside any other test that dials.
-        let before = snapshot();
-        record_fips_ok();
-        record_fallback(FallbackReason::ConnectFail);
-        record_fallback(FallbackReason::Http404);
-        let after = snapshot();
-        let d = |v: &serde_json::Value, path: &[&str]| -> u64 {
-            let mut cur = v;
-            for p in path {
-                cur = &cur[p];
-            }
-            cur.as_u64().unwrap()
-        };
-        assert_eq!(d(&after, &["fips_ok"]) - d(&before, &["fips_ok"]), 1);
-        assert_eq!(
-            d(&after, &["fallbacks", "connect_fail"]) - d(&before, &["fallbacks", "connect_fail"]),
-            1
-        );
-        assert_eq!(
-            d(&after, &["fallbacks", "http_404"]) - d(&before, &["fallbacks", "http_404"]),
-            1
-        );
-        assert!(d(&after, &["fallbacks", "total"]) >= 2);
-    }
-
-    #[test]
-    fn reason_keys_are_stable() {
-        // These strings are the fips.status API surface — renaming one is a
-        // breaking change for the UI.
-        assert_eq!(FallbackReason::NoNpub.key(), "no_npub");
-        assert_eq!(FallbackReason::ServiceInactive.key(), "service_inactive");
-        assert_eq!(FallbackReason::DnsFail.key(), "dns_fail");
-        assert_eq!(FallbackReason::ConnectFail.key(), "connect_fail");
-        assert_eq!(FallbackReason::Http404.key(), "http_404");
-        assert_eq!(FallbackReason::Http5xx.key(), "http_5xx");
-    }
-}

core/archipelago/src/main.rs

@@ -56,7 +56,6 @@ mod identity;
 mod identity_manager;
 mod marketplace;
 mod mesh;
-mod mesh_ports;
 mod monitoring;
 mod names;
 mod network;
@@ -199,26 +198,6 @@ async fn main() -> Result<()> {
     // Now mark this instance as running so the next startup can detect a crash.
     crash_recovery::write_pid_marker(&config.data_dir).await?;
 
-    // Signal READY *before* the heavy synchronous boot recovery below. On a
-    // node with many stacks that recovery takes minutes, and the unit sat in
-    // `activating` the whole time — so anything that touched the service in
-    // that window (a superseding start/restart, a start-timeout) killed a
-    // half-started instance, which then exited 0 and (under the old
-    // Restart=on-failure) never came back: "server starting up" forever,
-    // reproduced on framework-pt installing apps on 2026-07-26. The daemon's
-    // real work (recovery, reconcile, listener) continues after READY; being
-    // "active" early is honest — the process is up and doing its job.
-    let _ = sd_notify::notify(false, &[sd_notify::NotifyState::Ready]);
-    // Watchdog pings must run DURING the long recovery too, or a slow boot
-    // trips WatchdogSec. Spawn the keepalive here rather than after serve().
-    tokio::spawn(async {
-        let mut interval = tokio::time::interval(std::time::Duration::from_secs(120));
-        loop {
-            interval.tick().await;
-            let _ = sd_notify::notify(false, &[sd_notify::NotifyState::Watchdog]);
-        }
-    });
-
     // Run crash recovery before starting the manifest reconciler. Both paths
     // mutate Podman; running them concurrently can corrupt transient runtime
     // state and leave netavark/conmon unable to start containers.
@@ -416,10 +395,6 @@ async fn main() -> Result<()> {
     // iframe on kiosk nodes (docs/tv-input-iframe-apps.md).
     tokio::spawn(bootstrap::ensure_gamepad_keys());
 
-    // Mesh access: mirror IPv4-published app ports onto [::] so direct-port
-    // app URLs (http://[<fips0 ULA>]:<port>) work from the companion.
-    tokio::spawn(mesh_ports::run_mesh_port_mirror());
-
     // Pine voice: re-point IP-pinned Wyoming satellite entries (speakers) when
     // DHCP renumbering strands them — HA never re-resolves on its own.
     tokio::spawn(api::rpc::wyoming_satellite_keeper());
@@ -499,9 +474,16 @@ async fn main() -> Result<()> {
 
     // Notify systemd that we're ready (Type=notify)
     // Note: first param `false` keeps NOTIFY_SOCKET so watchdog pings work
-    // READY + watchdog keepalive were already signalled/spawned earlier
-    // (before boot recovery) so the unit reaches `active` in seconds instead
-    // of sitting in `activating` through a minutes-long recovery.
+    let _ = sd_notify::notify(false, &[sd_notify::NotifyState::Ready]);
+
+    // Spawn systemd watchdog ping (WatchdogSec=300, ping every 120s)
+    tokio::spawn(async {
+        let mut interval = tokio::time::interval(std::time::Duration::from_secs(120));
+        loop {
+            interval.tick().await;
+            let _ = sd_notify::notify(false, &[sd_notify::NotifyState::Watchdog]);
+        }
+    });
 
     // Graceful shutdown: wait for SIGTERM or SIGINT
     let mut sigterm = signal::unix::signal(signal::unix::SignalKind::terminate())

core/archipelago/src/mesh/flash.rs

@@ -1,975 +0,0 @@
-// WIP mesh/transport protocol — suppress dead code warnings
-#![allow(dead_code)]
-//! Firmware flashing for LoRa mesh radios — Heltec V3/V4 in v1, across all
-//! three firmware families the mesh module already knows how to detect (see
-//! `mesh::types::DeviceType`). Firmware is always fetched from upstream at
-//! flash time (never bundled/pinned in the repo), and every flash defaults
-//! to a full chip erase before write.
-//!
-//! MeshCore and Meshtastic are flashed the same way: download a released
-//! image, `esptool erase_flash`, then `esptool write_flash 0x0 <image>`.
-//! Reticulum/RNode is different: `archy-rnodeconf --autoinstall` owns the
-//! whole fetch+erase+flash+EEPROM-bootstrap sequence itself (confirmed live
-//! via `archy-rnodeconf --help` — there is no raw esptool path exposed for
-//! this family, so we deliberately don't resolve a firmware URL ourselves
-//! for Reticulum; rnodeconf already knows how).
-
-use super::serial::DetectedDeviceInfo;
-use super::types::DeviceType;
-use super::MeshService;
-use anyhow::{Context, Result};
-use regex::Regex;
-use serde::Serialize;
-use std::path::{Path, PathBuf};
-use std::process::Stdio;
-use std::sync::{Arc, OnceLock};
-use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
-use tokio::process::Command;
-use tokio::sync::RwLock;
-use tracing::{info, warn};
-
-/// Boards supported for v1. Both are ESP32-S3 (a single `--chip esp32s3`
-/// esptool target covers both), but ship different USB identities and
-/// different per-board firmware assets upstream.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum FlashBoard {
-    HeltecV3,
-    HeltecV4,
-}
-
-impl FlashBoard {
-    /// Meshtastic's board id (matches the release manifest's `board` field
-    /// and its per-board asset naming, e.g. `firmware-heltec-v3-<ver>.factory.bin`).
-    fn meshtastic_id(self) -> &'static str {
-        match self {
-            Self::HeltecV3 => "heltec-v3",
-            Self::HeltecV4 => "heltec-v4",
-        }
-    }
-}
-
-/// Map a detected USB vid:pid to a known flashable board, using the same
-/// table as `image-recipe/configs/99-mesh-radio.rules`. CP2102 (10c4:ea60)
-/// is confirmed there as Heltec V3's USB-UART bridge chip, and is safe to
-/// auto-match since that vid:pid is bridge-chip-specific.
-///
-/// Heltec V4 is NOT auto-matchable and deliberately has no entry here: it
-/// was confirmed live (real hardware, 2026-07-23) to use the ESP32-S3's
-/// built-in native-USB JTAG/serial peripheral, reporting vid:pid 303a:1001
-/// with product string "USB JTAG/serial debug unit" — that descriptor is
-/// baked into the chip's ROM and is IDENTICAL across every ESP32-S3 board
-/// with native USB enabled, not just Heltec V4. Adding `303a:1001 =>
-/// HeltecV4` here would silently misidentify any other native-USB ESP32-S3
-/// board (a T3-S3, a bare devkit, etc.) as a V4 and risk writing the wrong
-/// board's image. Callers (the RPC layer / frontend) must let the user pick
-/// the board manually whenever this returns `None`.
-pub fn resolve_flash_board(info: &DetectedDeviceInfo) -> Option<FlashBoard> {
-    match (info.vid.as_deref(), info.pid.as_deref()) {
-        (Some("10c4"), Some("ea60")) => Some(FlashBoard::HeltecV3),
-        _ => None,
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "lowercase")]
-pub enum FlashStage {
-    Downloading,
-    Erasing,
-    Writing,
-    Autoinstalling,
-    Done,
-    Failed,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct FlashJobStatus {
-    pub board: FlashBoard,
-    pub family: DeviceType,
-    pub path: String,
-    pub stage: FlashStage,
-    pub percent: Option<u8>,
-    pub log_tail: Vec<String>,
-    pub done: bool,
-    pub error: Option<String>,
-}
-
-const LOG_TAIL_MAX: usize = 200;
-
-/// How long to wait after a successful flash before resuming the mesh
-/// listener, so the board finishes its own post-flash boot/reset before we
-/// start opening the port (which itself toggles DTR/RTS) again.
-const POST_FLASH_SETTLE_DELAY: std::time::Duration = std::time::Duration::from_secs(5);
-
-/// Absolute ceiling on a whole flash job (download + erase + write, or
-/// autoinstall), regardless of what it's doing internally. Last-resort
-/// safety net so a hang anywhere can't wedge the single-flash-job guard
-/// forever — generous enough to never trigger on a legitimately slow
-/// multi-hundred-MB transfer.
-const MAX_JOB_DURATION: std::time::Duration = std::time::Duration::from_secs(15 * 60);
-
-/// How long to wait for MeshService::stop() to release the serial port
-/// before giving up. Confirmed live 2026-07-23: the listener's own
-/// reconnect/multi-candidate-probe loop doesn't check its shutdown signal
-/// between candidates, so stop() can take a while (or, if the loop is
-/// wedged, never return) — 20s comfortably covers a normal handshake-probe
-/// cycle without leaving a flash request hanging indefinitely if the
-/// listener genuinely won't let go.
-const STOP_LISTENER_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-
-/// How long to keep retrying the port-free check before giving up.
-const PORT_FREE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
-
-/// Confirm nothing else has `path` open by actually opening (and immediately
-/// closing) it ourselves. Retries across the timeout since a just-stopped
-/// listener's fd can take a moment to actually release even after `stop()`
-/// returns (task abort is a request, not an instant guarantee the OS-level
-/// resource is gone yet).
-async fn wait_for_port_free(path: &str) -> Result<()> {
-    let deadline = tokio::time::Instant::now() + PORT_FREE_TIMEOUT;
-    let mut last_err = None;
-    loop {
-        match serial2_tokio::SerialPort::open(path, 115200) {
-            Ok(_) => return Ok(()),
-            Err(e) => last_err = Some(e),
-        }
-        if tokio::time::Instant::now() >= deadline {
-            break;
-        }
-        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-    }
-    Err(anyhow::anyhow!(
-        "{path} is still held open by something else after {}s (last error: {}) — refusing to start the flasher against a contended port",
-        PORT_FREE_TIMEOUT.as_secs(),
-        last_err.map(|e| e.to_string()).unwrap_or_default()
-    ))
-}
-
-/// Live state for the one flash job that can run at a time. A single global
-/// slot is sufficient because flashing needs exclusive serial access to the
-/// one port being flashed — there is no meaningful concept of two concurrent
-/// flash jobs on this node.
-pub struct FlashJob {
-    status: RwLock<FlashJobStatus>,
-    /// Set once the background task is spawned. Only used while `stage` is
-    /// still `Downloading` — an interrupted erase/write can leave the chip
-    /// in a worse state than either finished or unstarted, so cancellation
-    /// is refused once erase begins (see `cancel()`).
-    abort_handle: RwLock<Option<tokio::task::AbortHandle>>,
-}
-
-impl FlashJob {
-    fn new(board: FlashBoard, family: DeviceType, path: String) -> Arc<Self> {
-        Arc::new(Self {
-            abort_handle: RwLock::new(None),
-            status: RwLock::new(FlashJobStatus {
-                board,
-                family,
-                path,
-                stage: FlashStage::Downloading,
-                percent: None,
-                log_tail: Vec::new(),
-                done: false,
-                error: None,
-            }),
-        })
-    }
-
-    pub async fn snapshot(&self) -> FlashJobStatus {
-        self.status.read().await.clone()
-    }
-
-    async fn set_stage(&self, stage: FlashStage) {
-        let mut s = self.status.write().await;
-        s.stage = stage;
-        s.percent = None;
-    }
-
-    async fn set_percent(&self, percent: u8) {
-        self.status.write().await.percent = Some(percent.min(100));
-    }
-
-    async fn push_log(&self, line: impl Into<String>) {
-        let mut s = self.status.write().await;
-        s.log_tail.push(line.into());
-        let overflow = s.log_tail.len().saturating_sub(LOG_TAIL_MAX);
-        if overflow > 0 {
-            s.log_tail.drain(0..overflow);
-        }
-    }
-
-    async fn fail(&self, err: &anyhow::Error) {
-        let mut s = self.status.write().await;
-        s.stage = FlashStage::Failed;
-        s.error = Some(format!("{err:#}"));
-        s.done = true;
-    }
-
-    async fn finish(&self) {
-        let mut s = self.status.write().await;
-        s.stage = FlashStage::Done;
-        s.done = true;
-    }
-
-    /// Best-effort cancel: only honored before erase/write/autoinstall has
-    /// started (i.e. still in `Downloading`). Once a stage that touches the
-    /// chip begins, this refuses — interrupting an erase or write can leave
-    /// the flash in a state worse than either finished or unstarted.
-    pub async fn cancel(&self) -> Result<()> {
-        let mut s = self.status.write().await;
-        if s.done {
-            anyhow::bail!("Flash job already finished");
-        }
-        if s.stage != FlashStage::Downloading {
-            anyhow::bail!(
-                "Cannot cancel once {:?} has started — let it finish or fail on its own",
-                s.stage
-            );
-        }
-        if let Some(handle) = self.abort_handle.write().await.take() {
-            handle.abort();
-        }
-        s.stage = FlashStage::Failed;
-        s.error = Some("Cancelled by user".to_string());
-        s.done = true;
-        Ok(())
-    }
-}
-
-/// Shared handle held by `RpcHandler`, sibling to `mesh_service`.
-pub type FlashJobHandle = Arc<RwLock<Option<Arc<FlashJob>>>>;
-
-pub fn new_job_handle() -> FlashJobHandle {
-    Arc::new(RwLock::new(None))
-}
-
-fn firmware_cache_dir(data_dir: &Path) -> PathBuf {
-    data_dir.join("mesh").join("firmware-cache")
-}
-
-/// No blanket `.timeout()` here on purpose: reqwest's request timeout covers
-/// the *entire* request including streaming the response body, which would
-/// kill a legitimate large download partway through (Meshtastic's esp32s3
-/// zip is ~170MB) — not just a hung connection. `download_to_file` instead
-/// applies a per-chunk stall timeout, and metadata calls (small JSON
-/// responses) get their own short timeout at the call site.
-fn github_client() -> Result<reqwest::Client> {
-    reqwest::Client::builder()
-        .user_agent("archipelago-mesh-flash")
-        .connect_timeout(std::time::Duration::from_secs(10))
-        .build()
-        .context("Failed to build HTTP client")
-}
-
-/// Applied per-chunk while streaming a firmware download — if the transfer
-/// stalls (no bytes for this long) it's treated as a failure, but a slow
-/// download that's still making progress is never killed just for taking a
-/// while.
-const DOWNLOAD_STALL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
-
-/// Applied to metadata calls (GitHub release JSON) — these are small
-/// responses with no reason to ever take this long.
-const METADATA_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-
-/// Resolve what firmware is available for a board+family. v1 only ever
-/// offers "latest" — MeshCore/Meshtastic latest GitHub release, or, for
-/// Reticulum, "latest" meaning "whatever archy-rnodeconf --autoinstall
-/// resolves on its own" (it does its own version checking upstream).
-pub async fn list_firmware(family: DeviceType) -> Result<Vec<String>> {
-    match family {
-        DeviceType::Reticulum => Ok(vec!["latest".to_string()]),
-        DeviceType::Meshtastic => {
-            let client = github_client()?;
-            let release: GithubRelease = client
-                .get("https://api.github.com/repos/meshtastic/firmware/releases/latest")
-                .send()
-                .await
-                .context("Fetching Meshtastic release list")?
-                .error_for_status()
-                .context("Meshtastic releases API error")?
-                .json()
-                .await
-                .context("Parsing Meshtastic release JSON")?;
-            Ok(vec![release.tag_name])
-        }
-        DeviceType::Meshcore => {
-            let client = github_client()?;
-            let release: GithubRelease = client
-                .get("https://api.github.com/repos/meshcore-dev/MeshCore/releases/latest")
-                .send()
-                .await
-                .context("Fetching MeshCore release list")?
-                .error_for_status()
-                .context("MeshCore releases API error")?
-                .json()
-                .await
-                .context("Parsing MeshCore release JSON")?;
-            Ok(vec![release.tag_name])
-        }
-        DeviceType::Unknown => anyhow::bail!("Pick a firmware family before listing versions"),
-    }
-}
-
-#[derive(serde::Deserialize)]
-struct GithubAsset {
-    name: String,
-    browser_download_url: String,
-}
-
-#[derive(serde::Deserialize)]
-struct GithubRelease {
-    tag_name: String,
-    assets: Vec<GithubAsset>,
-}
-
-/// Start a flash job in the background. Returns as soon as the job has been
-/// registered and the listener released — callers poll `FlashJobHandle` via
-/// `mesh.flash-status` for progress. Only one job may be in flight at a time.
-pub async fn start_flash_job(
-    handle: &FlashJobHandle,
-    mesh_service: &Arc<RwLock<Option<MeshService>>>,
-    data_dir: PathBuf,
-    path: String,
-    board: FlashBoard,
-    family: DeviceType,
-) -> Result<()> {
-    {
-        let existing = handle.read().await;
-        if let Some(job) = existing.as_ref() {
-            if !job.snapshot().await.done {
-                anyhow::bail!("A firmware flash is already in progress on this node");
-            }
-        }
-    }
-
-    let job = FlashJob::new(board, family, path.clone());
-    *handle.write().await = Some(Arc::clone(&job));
-
-    let bg_job = Arc::clone(&job);
-    let bg_service = Arc::clone(mesh_service);
-    let task = tokio::spawn(async move {
-        // esptool/archy-rnodeconf need exclusive serial access — release
-        // the listener's hold on the port before touching it. This USED
-        // TO run synchronously in start_flash_job before the job was even
-        // spawned, blocking the RPC call itself on s.stop().await — a real
-        // 2026-07-23 incident: the mesh listener was mid a multi-candidate
-        // reconnect/probe sequence that doesn't check its shutdown signal
-        // between candidates, so stop() never returned. The HTTP request
-        // timed out client-side ("Operation failed"), while the job
-        // (already inserted into `handle`) was permanently wedged — nothing
-        // had been spawned yet to ever mark it done, so every later flash
-        // attempt failed with "already in progress" until a full restart.
-        // Now this runs inside the spawned task with its own bounded
-        // timeout, so the RPC call always returns immediately regardless,
-        // and a slow-to-stop listener fails the job cleanly instead of
-        // hanging everything downstream of it forever.
-        let stop_result = tokio::time::timeout(STOP_LISTENER_TIMEOUT, async {
-            let mut svc = bg_service.write().await;
-            if let Some(s) = svc.as_mut() {
-                s.stop().await;
-            }
-        })
-        .await;
-        if stop_result.is_err() {
-            let err = anyhow::anyhow!(
-                "Mesh listener did not release the serial port within {}s — it may still be mid a reconnect attempt. Try again once mesh.status shows the device idle, or restart the archipelago service if this persists.",
-                STOP_LISTENER_TIMEOUT.as_secs()
-            );
-            bg_job.push_log(format!("ERROR: {err:#}")).await;
-            bg_job.fail(&err).await;
-            return;
-        }
-
-        // Belt-and-suspenders port-free check. `stop()` above should have
-        // fully released the port, but esptool/rnodeconf run as external
-        // subprocesses for minutes outside our own async runtime — if
-        // ANYTHING else still has it open (a racing probe, a not-yet-dropped
-        // fd from an aborted task, anything we haven't anticipated), handing
-        // the port to the flasher anyway risks exactly the corruption
-        // confirmed live 2026-07-23: esptool's "device disconnected or
-        // multiple access on port?" and rnodeconf's raw `OSError: [Errno 71]
-        // Protocol error` on an RTS ioctl are both textbook two-openers-on-
-        // one-fd symptoms. Verify by actually opening it ourselves — cheap,
-        // and definitive — before ever starting the flasher.
-        if let Err(e) = wait_for_port_free(&path).await {
-            bg_job.push_log(format!("ERROR: {e:#}")).await;
-            bg_job.fail(&e).await;
-            return;
-        }
-
-        // Outer ceiling on top of run_flash's own internal timeouts —
-        // belt-and-suspenders so that no future hang (network, subprocess,
-        // anything) can ever wedge the single-flash-job guard permanently
-        // again the way a stuck download did on 2026-07-23 (every
-        // subsequent mesh.flash-device call failed with "already in
-        // progress" until the service was restarted). Generous enough that
-        // a legitimately slow multi-hundred-MB transfer still completes.
-        let result = match tokio::time::timeout(
-            MAX_JOB_DURATION,
-            run_flash(board, family, &data_dir, &path, &bg_job),
-        )
-        .await
-        {
-            Ok(inner) => inner,
-            Err(_) => Err(anyhow::anyhow!(
-                "Flash job exceeded the {}-minute ceiling — aborted",
-                MAX_JOB_DURATION.as_secs() / 60
-            )),
-        };
-        let succeeded = result.is_ok();
-
-        match &result {
-            Ok(()) => {
-                bg_job.push_log("Flash completed successfully".to_string()).await;
-                bg_job.finish().await;
-                info!(path = %path, board = ?board, family = %family, "LoRa firmware flash succeeded");
-            }
-            Err(e) => {
-                // {:#} (alternate Display) walks the full anyhow context
-                // chain — plain {} / %e only prints the outermost .context()
-                // message, which made a real 2026-07-23 esptool failure
-                // undiagnosable from journalctl alone (just "esptool
-                // erase_flash failed", no actual esptool stderr).
-                warn!(path = %path, error = %format!("{e:#}"), "LoRa firmware flash failed");
-                bg_job.push_log(format!("ERROR: {e:#}")).await;
-                bg_job.fail(e).await;
-            }
-        }
-
-        // The board's firmware may now differ from whatever was pinned
-        // before — clear the pin either way so a later reconnect's strict
-        // auto-detect order picks up reality instead of getting wedged
-        // trying the old protocol first.
-        if let Ok(mut config) = super::load_config(&data_dir).await {
-            config.device_kind = None;
-            if let Err(e) = super::save_config(&data_dir, &config).await {
-                warn!(error = %e, "Failed to clear device_kind pin after flash");
-            }
-        }
-
-        if !succeeded {
-            // Deliberately do NOT auto-restart the listener here. A failed
-            // flash means we can't vouch for the board's state — reopening
-            // the port immediately (esptool/rnodeconf's own reset sequence
-            // plus our open() toggling DTR/RTS again right after) risks
-            // hammering a marginal device with reconnect attempts. Confirmed
-            // live 2026-07-23: exactly this sequence left a real Heltec V3
-            // boot-looping for 5+ minutes after a failed flash. Leave mesh
-            // stopped; the user reconnects explicitly via the hot-swap
-            // modal/Mesh page once they've confirmed the board is alive.
-            warn!(
-                path = %path,
-                "Leaving mesh listener stopped after failed flash — reconnect manually once the board is confirmed responsive"
-            );
-            return;
-        }
-
-        // On success, give the board a moment to finish booting after the
-        // flash tool's own reset sequence before we start hammering it with
-        // connection attempts — same reasoning as above, just the
-        // lower-risk (successful-flash) side of it.
-        tokio::time::sleep(POST_FLASH_SETTLE_DELAY).await;
-
-        let mut svc = bg_service.write().await;
-        if let Some(s) = svc.as_mut() {
-            match super::load_config(&data_dir).await {
-                Ok(config) => {
-                    // Only resume if mesh is actually still enabled per the
-                    // CURRENT persisted config — confirmed live 2026-07-23:
-                    // unconditionally forcing a restart here, regardless of
-                    // `enabled`, overrode a user's own concurrent "disable
-                    // mesh" toggle and left the listener running while
-                    // config said disabled. That inconsistent state is what
-                    // made a later legitimate "Keep As Is" click (which
-                    // correctly tries to start on a false→true transition)
-                    // fail with "already running" — the listener had already
-                    // been force-started behind the config's back.
-                    let should_run = config.enabled;
-                    if let Err(e) = s.configure(config).await {
-                        warn!(error = %e, "Failed to resume mesh listener after flash");
-                    }
-                    if should_run {
-                        if let Err(e) = s.start() {
-                            warn!(error = %e, "Failed to restart mesh listener after flash");
-                        }
-                    }
-                }
-                Err(e) => warn!(error = %e, "Failed to load mesh config after flash"),
-            }
-        }
-    });
-    *job.abort_handle.write().await = Some(task.abort_handle());
-
-    Ok(())
-}
-
-async fn run_flash(
-    board: FlashBoard,
-    family: DeviceType,
-    data_dir: &Path,
-    path: &str,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    match family {
-        DeviceType::Meshtastic | DeviceType::Meshcore => {
-            let image = fetch_esptool_image(board, family, data_dir, job).await?;
-            esptool_erase_and_write(path, &image, job).await
-        }
-        DeviceType::Reticulum => {
-            let lora_region = super::load_config(data_dir)
-                .await
-                .ok()
-                .and_then(|c| c.lora_region);
-            rnodeconf_autoinstall(path, board, lora_region.as_deref(), job).await
-        }
-        DeviceType::Unknown => anyhow::bail!("Pick a firmware family before flashing"),
-    }
-}
-
-// ─── MeshCore / Meshtastic: esptool ─────────────────────────────────────
-
-async fn fetch_esptool_image(
-    board: FlashBoard,
-    family: DeviceType,
-    data_dir: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let cache = firmware_cache_dir(data_dir);
-    tokio::fs::create_dir_all(&cache)
-        .await
-        .context("Creating firmware cache dir")?;
-    let client = github_client()?;
-
-    match family {
-        DeviceType::Meshtastic => fetch_meshtastic_image(&client, board, &cache, job).await,
-        DeviceType::Meshcore => fetch_meshcore_image(&client, board, &cache, job).await,
-        _ => anyhow::bail!("{family} is not flashed via esptool"),
-    }
-}
-
-async fn fetch_meshtastic_image(
-    client: &reqwest::Client,
-    board: FlashBoard,
-    cache: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let release: GithubRelease = client
-        .get("https://api.github.com/repos/meshtastic/firmware/releases/latest")
-        .timeout(METADATA_TIMEOUT)
-        .send()
-        .await
-        .context("Fetching Meshtastic release list")?
-        .error_for_status()
-        .context("Meshtastic releases API error")?
-        .json()
-        .await
-        .context("Parsing Meshtastic release JSON")?;
-
-    // Meshtastic bundles all esp32s3 boards' images inside one per-platform
-    // zip rather than shipping per-board top-level assets — both Heltec V3
-    // and V4 are esp32s3, so this is the right zip for both (confirmed live
-    // against v2.7.26.54e0d8d).
-    let zip_asset = release
-        .assets
-        .iter()
-        .find(|a| a.name.starts_with("firmware-esp32s3-") && a.name.ends_with(".zip"))
-        .ok_or_else(|| anyhow::anyhow!("No esp32s3 firmware zip in latest Meshtastic release"))?;
-
-    let version = zip_asset
-        .name
-        .strip_prefix("firmware-esp32s3-")
-        .and_then(|s| s.strip_suffix(".zip"))
-        .ok_or_else(|| anyhow::anyhow!("Unexpected Meshtastic asset name: {}", zip_asset.name))?
-        .to_string();
-
-    let zip_path = cache.join(&zip_asset.name);
-    if tokio::fs::metadata(&zip_path).await.is_err() {
-        download_to_file(client, &zip_asset.browser_download_url, &zip_path, job).await?;
-    } else {
-        job.push_log(format!("Using cached {}", zip_asset.name)).await;
-    }
-
-    // "*.factory.bin" is Meshtastic's full merged image (bootloader +
-    // partition table + app) meant to be written at offset 0x0 on a freshly
-    // erased chip — confirmed by inspecting the real zip's contents, as
-    // opposed to the plain "*.bin" OTA-update image which assumes an
-    // existing bootloader/partition table already on the chip.
-    let entry_name = format!(
-        "firmware-{}-{}.factory.bin",
-        board.meshtastic_id(),
-        version
-    );
-    let out_path = cache.join(&entry_name);
-    if tokio::fs::metadata(&out_path).await.is_ok() {
-        return Ok(out_path);
-    }
-
-    job.push_log(format!(
-        "Extracting {entry_name} from {}",
-        zip_asset.name
-    ))
-    .await;
-    let zip_path_owned = zip_path.clone();
-    let entry_name_owned = entry_name.clone();
-    let out_path_owned = out_path.clone();
-    tokio::task::spawn_blocking(move || -> Result<()> {
-        let file = std::fs::File::open(&zip_path_owned).context("Opening downloaded firmware zip")?;
-        let mut archive = zip::ZipArchive::new(file).context("Reading firmware zip")?;
-        let mut entry = archive
-            .by_name(&entry_name_owned)
-            .with_context(|| format!("{entry_name_owned} not found in firmware zip"))?;
-        let mut out =
-            std::fs::File::create(&out_path_owned).context("Creating extracted firmware file")?;
-        std::io::copy(&mut entry, &mut out).context("Extracting firmware image")?;
-        Ok(())
-    })
-    .await
-    .context("Firmware extraction task panicked")??;
-
-    Ok(out_path)
-}
-
-async fn fetch_meshcore_image(
-    client: &reqwest::Client,
-    board: FlashBoard,
-    cache: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<PathBuf> {
-    let release: GithubRelease = client
-        .get("https://api.github.com/repos/meshcore-dev/MeshCore/releases/latest")
-        .timeout(METADATA_TIMEOUT)
-        .send()
-        .await
-        .context("Fetching MeshCore release list")?
-        .error_for_status()
-        .context("MeshCore releases API error")?
-        .json()
-        .await
-        .context("Parsing MeshCore release JSON")?;
-
-    // Upstream's casing differs between boards (Heltec_v3_... vs
-    // heltec_v4_...) — match case-insensitively on the exact per-board
-    // substring so V4 isn't accidentally matched by "heltec_v4_tft_..."
-    // variants (there's a "_tft_" in between, so a straight substring match
-    // on "heltec_v4_companion_radio_usb" is already safe).
-    let needle = match board {
-        FlashBoard::HeltecV3 => "heltec_v3_companion_radio_usb",
-        FlashBoard::HeltecV4 => "heltec_v4_companion_radio_usb",
-    };
-    let asset = release
-        .assets
-        .iter()
-        .find(|a| {
-            let lower = a.name.to_lowercase();
-            lower.contains(needle) && lower.ends_with("-merged.bin")
-        })
-        .ok_or_else(|| {
-            anyhow::anyhow!("No matching MeshCore image in release {}", release.tag_name)
-        })?;
-
-    let out_path = cache.join(&asset.name);
-    if tokio::fs::metadata(&out_path).await.is_ok() {
-        job.push_log(format!("Using cached {}", asset.name)).await;
-        return Ok(out_path);
-    }
-    download_to_file(client, &asset.browser_download_url, &out_path, job).await?;
-    Ok(out_path)
-}
-
-async fn download_to_file(
-    client: &reqwest::Client,
-    url: &str,
-    dest: &Path,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    job.set_stage(FlashStage::Downloading).await;
-    // Bound only the wait for the response to *start* (headers) — NOT a
-    // request-level `.timeout()`, which would cap the whole body transfer
-    // again (the bug this replaced: a blanket 30s client timeout killed
-    // large downloads mid-stream). If the server never responds at all,
-    // this is what stops the job from hanging forever; the per-chunk stall
-    // timeout below is what guards the body once streaming starts. Without
-    // this, a server that accepts the TCP connection but never sends
-    // headers back hangs this call indefinitely — confirmed live
-    // 2026-07-23: a stuck `.send()` here wedged the single-flash-job guard
-    // for good, permanently blocking every subsequent flash attempt with
-    // "already in progress" until the service was restarted.
-    let resp = tokio::time::timeout(METADATA_TIMEOUT, client.get(url).send())
-        .await
-        .context("Firmware download server did not respond")?
-        .context("Starting firmware download")?
-        .error_for_status()
-        .context("Firmware download returned an error status")?;
-    let total = resp.content_length();
-    let tmp = dest.with_extension("part");
-    let mut file = tokio::fs::File::create(&tmp)
-        .await
-        .context("Creating firmware download file")?;
-    let mut stream = resp.bytes_stream();
-    let mut downloaded: u64 = 0;
-    use futures_util::StreamExt;
-    loop {
-        let next = tokio::time::timeout(DOWNLOAD_STALL_TIMEOUT, stream.next())
-            .await
-            .context("Firmware download stalled")?;
-        let Some(chunk) = next else { break };
-        let chunk = chunk.context("Reading firmware download stream")?;
-        file.write_all(&chunk)
-            .await
-            .context("Writing firmware download")?;
-        downloaded += chunk.len() as u64;
-        if let Some(total) = total {
-            if total > 0 {
-                job.set_percent(((downloaded.saturating_mul(100)) / total) as u8)
-                    .await;
-            }
-        }
-    }
-    file.flush().await.ok();
-    tokio::fs::rename(&tmp, dest)
-        .await
-        .context("Finalizing firmware download")?;
-    job.push_log(format!(
-        "Downloaded {} ({downloaded} bytes)",
-        dest.display()
-    ))
-    .await;
-    Ok(())
-}
-
-/// Both Heltec V3 and V4 are ESP32-S3 boards.
-const ESPTOOL_CHIP: &str = "esp32s3";
-
-/// esptool's auto-reset-into-bootloader handshake (toggling DTR/RTS in a
-/// specific timed pattern) is well-known to be flaky on some CP2102/CH340
-/// board+adapter combinations — esptool's own docs recommend retrying at a
-/// lower baud rate when this happens. Rather than fail the whole job on the
-/// first hiccup, retry once at a conservative baud before giving up.
-const ESPTOOL_FALLBACK_BAUD: &str = "115200";
-
-/// `write_flash --erase-all` erases the whole chip before writing, in one
-/// esptool invocation. This needs the esp32s3 stub flasher loaded (see
-/// esptool_global_args' doc comment) — without it, --erase-all hits the
-/// exact same ROM limitation a standalone `erase_flash` does ("ESP32-S3 ROM
-/// does not support function erase_flash", confirmed live 2026-07-23), since
-/// esptool's --erase-all is implemented as the same full-chip-erase command,
-/// not a per-sector loop.
-async fn esptool_erase_and_write(path: &str, image: &Path, job: &Arc<FlashJob>) -> Result<()> {
-    job.set_stage(FlashStage::Writing).await;
-    let image_str = image.to_string_lossy().to_string();
-    esptool_with_retry(
-        path,
-        &["write_flash", "--erase-all", "0x0", &image_str],
-        job,
-    )
-    .await
-    .context("esptool write_flash failed")?;
-
-    Ok(())
-}
-
-/// esptool's global flags (--chip/--port/--baud) MUST precede the subcommand
-/// token (erase_flash/write_flash/...) — confirmed live 2026-07-23:
-/// appending `--baud 115200` after the subcommand on the retry path
-/// produced "esptool: error: unrecognized arguments: --baud 115200" every
-/// time, so the fallback-baud retry never actually got a chance to run.
-/// Building global args separately from subcommand args keeps this correct
-/// by construction instead of relying on call-site ordering.
-///
-/// Normal stub-loader mode (no --no-stub) needs the esp32s3 stub flasher
-/// blob at /usr/lib/python3/dist-packages/esptool/targets/stub_flasher/
-/// stub_flasher_32s3.json — Debian's `esptool` package (4.7.0+dfsg-0.1)
-/// ships without it (stripped for DFSG compliance: the prebuilt blob has no
-/// buildable-from-source path Debian could verify), so scripts/self-update.sh
-/// fetches the exact same file from the matching upstream esptool release
-/// tag and installs it alongside the apt package (see the esptool install
-/// step there). --no-stub (talk directly to the ROM bootloader, skip the
-/// stub) was tried first and works for connecting, but the ROM bootloader
-/// doesn't implement a full-chip-erase opcode at all — only the stub does —
-/// so --no-stub broke our "always erase before write" default outright
-/// rather than just being slower. Restoring the real stub file is the
-/// correct fix, not routing around its absence.
-fn esptool_global_args<'a>(path: &'a str, baud: Option<&'a str>) -> Vec<&'a str> {
-    let mut args = vec!["--chip", ESPTOOL_CHIP, "--port", path];
-    if let Some(b) = baud {
-        args.push("--baud");
-        args.push(b);
-    }
-    args
-}
-
-async fn esptool_with_retry(path: &str, subcommand: &[&str], job: &Arc<FlashJob>) -> Result<()> {
-    let mut cmd = Command::new("esptool");
-    cmd.args(esptool_global_args(path, None));
-    cmd.args(subcommand);
-    match run_streamed(cmd, None, job).await {
-        Ok(()) => Ok(()),
-        Err(first_err) => {
-            job.push_log(format!(
-                "First attempt failed ({first_err:#}); retrying once at {ESPTOOL_FALLBACK_BAUD} baud"
-            ))
-            .await;
-            let mut retry = Command::new("esptool");
-            retry.args(esptool_global_args(path, Some(ESPTOOL_FALLBACK_BAUD)));
-            retry.args(subcommand);
-            run_streamed(retry, None, job)
-                .await
-                .context(format!("retry also failed (first attempt: {first_err:#})"))
-        }
-    }
-}
-
-// ─── Reticulum/RNode: archy-rnodeconf ───────────────────────────────────
-
-fn rnodeconf_bin() -> String {
-    std::env::var("ARCHY_RNODECONF_BIN")
-        .unwrap_or_else(|_| "/usr/local/bin/archy-rnodeconf".to_string())
-}
-
-/// `--autoinstall`'s "which board is this" step is interactive by design —
-/// confirmed live against a real Heltec V4 (2026-07-23): even with a board
-/// given on the command line, rnodeconf can't always tell V3 from V4 apart
-/// (their bootstrap-time USB identity is often generic, same root cause as
-/// `resolve_flash_board`'s doc comment), so it always asks. The full prompt
-/// sequence observed for a Heltec board that already has *some* RNode
-/// firmware installed (the common case — a truly blank chip likely skips
-/// straight to the same "Device Selection" menu):
-///   1. numbered device-type menu  → answer with the menu number
-///   2. "Hit enter to continue"    → answer with a blank line
-///   3. numbered band menu         → answer with the menu number
-///   4. "Is the above correct? [y/N]" → answer "y"
-/// Feeding all four answers up front (rather than watching stdout for each
-/// prompt text) works because the menu is always asked in this fixed order
-/// for every board that needs (re)provisioning — verified by driving it
-/// through an unprovisioned real V4 end-to-end (erase → flash → EEPROM
-/// bootstrap → "Device signature validated" on the next probe).
-fn rnodeconf_device_menu_number(board: FlashBoard) -> &'static str {
-    match board {
-        FlashBoard::HeltecV3 => "8",
-        FlashBoard::HeltecV4 => "9",
-    }
-}
-
-/// rnodeconf's band choice is a coarse RF-frontend bootstrap parameter
-/// (868/915/923 MHz), not the final operating frequency — that's still
-/// configured later via the daemon's interface config, same as today. This
-/// is a best-effort mapping from the node's persisted Meshtastic-style
-/// region code (see `mesh::meshtastic::region_name_to_code`) down to
-/// rnodeconf's 3-way menu; regions with no exact 868/923 match fall back to
-/// 915 MHz as the broadest-compatibility default.
-fn rnodeconf_band_menu_number(lora_region: Option<&str>) -> &'static str {
-    match lora_region.map(|s| s.trim().to_uppercase()) {
-        Some(r) if r.contains("868") => "1",
-        Some(r) if r.contains("923") => "3",
-        _ => "2",
-    }
-}
-
-/// `--autoinstall` fetches, erases, flashes, and bootstraps the EEPROM for
-/// a detected board as one atomic step (confirmed via `archy-rnodeconf
-/// --help` AND a real end-to-end flash on real hardware) — this is the
-/// RNode-side equivalent of our "always erase before write" default, since
-/// autoinstall doesn't try to preserve any existing on-device state.
-async fn rnodeconf_autoinstall(
-    path: &str,
-    board: FlashBoard,
-    lora_region: Option<&str>,
-    job: &Arc<FlashJob>,
-) -> Result<()> {
-    job.set_stage(FlashStage::Autoinstalling).await;
-    let bin = rnodeconf_bin();
-    let mut cmd = if Path::new(&bin).exists() {
-        Command::new(bin)
-    } else {
-        // Dev fallback if only a plain venv/system rnodeconf is on PATH.
-        Command::new("rnodeconf")
-    };
-    cmd.args(["--autoinstall", path]);
-    let stdin = format!(
-        "{}\n\n{}\ny\n",
-        rnodeconf_device_menu_number(board),
-        rnodeconf_band_menu_number(lora_region)
-    );
-    run_streamed(cmd, Some(stdin.into_bytes()), job)
-        .await
-        .context("archy-rnodeconf --autoinstall failed")
-}
-
-// ─── Subprocess streaming ────────────────────────────────────────────────
-
-fn percent_regex() -> &'static Regex {
-    static RE: OnceLock<Regex> = OnceLock::new();
-    RE.get_or_init(|| Regex::new(r"\((\d{1,3})\s*%\)").expect("valid regex"))
-}
-
-async fn run_streamed(mut cmd: Command, stdin: Option<Vec<u8>>, job: &Arc<FlashJob>) -> Result<()> {
-    cmd.stdout(Stdio::piped());
-    cmd.stderr(Stdio::piped());
-    if stdin.is_some() {
-        cmd.stdin(Stdio::piped());
-    }
-    // Deliberately NOT kill_on_drop: an interrupted erase/write can leave
-    // the chip in a worse state than either finished or unstarted (see the
-    // cancellation-safety note in mesh flashing docs). The job is expected
-    // to run to completion or fail on its own.
-    let mut child = cmd.spawn().context("Failed to start subprocess")?;
-
-    if let Some(bytes) = stdin {
-        if let Some(mut child_stdin) = child.stdin.take() {
-            child_stdin
-                .write_all(&bytes)
-                .await
-                .context("Writing to subprocess stdin")?;
-        }
-    }
-
-    let mut tasks = Vec::new();
-    if let Some(stdout) = child.stdout.take() {
-        let job = Arc::clone(job);
-        tasks.push(tokio::spawn(async move {
-            let mut lines = BufReader::new(stdout).lines();
-            while let Ok(Some(line)) = lines.next_line().await {
-                if let Some(cap) = percent_regex().captures(&line) {
-                    if let Ok(pct) = cap[1].parse::<u8>() {
-                        job.set_percent(pct).await;
-                    }
-                }
-                job.push_log(line).await;
-            }
-        }));
-    }
-    if let Some(stderr) = child.stderr.take() {
-        let job = Arc::clone(job);
-        tasks.push(tokio::spawn(async move {
-            let mut lines = BufReader::new(stderr).lines();
-            while let Ok(Some(line)) = lines.next_line().await {
-                job.push_log(line).await;
-            }
-        }));
-    }
-
-    let status = child.wait().await.context("Waiting for subprocess")?;
-    for t in tasks {
-        let _ = t.await;
-    }
-    if !status.success() {
-        // Exit status alone isn't diagnosable — the actual esptool/rnodeconf
-        // stderr (already captured into job.log_tail by the reader tasks
-        // above) is what actually explains a failure. Confirmed live
-        // 2026-07-23: a bare "Command exited with exit status: 1" told us
-        // nothing when esptool's real error was sitting in the log tail the
-        // whole time, only visible via the UI's live poll, not journald.
-        let tail: Vec<String> = job
-            .snapshot()
-            .await
-            .log_tail
-            .iter()
-            .rev()
-            .take(10)
-            .rev()
-            .cloned()
-            .collect();
-        anyhow::bail!("Command exited with {status}\n{}", tail.join("\n"));
-    }
-    Ok(())
-}

core/archipelago/src/mesh/listener/decode.rs

@@ -578,7 +578,7 @@ pub(super) async fn handle_identity_received(
         .insert(contact_id, shared_secret);
 
     // Update peer record
-    let mut peer = MeshPeer {
+    let peer = MeshPeer {
         contact_id,
         // .get(): a malformed DID shorter than the "did:key:" prefix must
         // not panic the listener on a radio-supplied string.
@@ -607,24 +607,6 @@ pub(super) async fn handle_identity_received(
     let is_new = {
         let mut peers = state.peers.write().await;
         let is_new = !peers.contains_key(&contact_id);
-        if let Some(existing) = peers.get(&contact_id) {
-            // This id is shared with the federation-seeded row for the same
-            // node (that's the point — identity adverts MERGE, not duplicate).
-            // The wholesale insert below must not stomp the federation row's
-            // real node name with our synthetic "Archy-…" placeholder — with
-            // Reticulum re-emitting identity adverts every announce tick,
-            // that renamed every federated contact once a minute. Same for a
-            // known position: keep it rather than nulling it out.
-            if !existing.advert_name.trim().is_empty()
-                && !existing.advert_name.starts_with("Archy-")
-            {
-                peer.advert_name = existing.advert_name.clone();
-            }
-            if peer.lat.is_none() {
-                peer.lat = existing.lat;
-                peer.lon = existing.lon;
-            }
-        }
         peers.insert(contact_id, peer.clone());
         is_new
     };

core/archipelago/src/mesh/listener/mod.rs

@@ -87,18 +87,6 @@ const RECONNECT_DELAY_INIT: Duration = Duration::from_secs(5);
 /// Maximum reconnect delay (cap for exponential backoff).
 const RECONNECT_DELAY_MAX: Duration = Duration::from_secs(60);
 
-/// Minimum time a session must run before we trust it enough to reset
-/// backoff to the minimum. Without this gate, a device that connects then
-/// fails again within a couple of seconds (e.g. mid-boot-loop) never backs
-/// off — every retry immediately re-opens the port, which toggles DTR/RTS
-/// (resets many ESP32 boards' MCU on native-USB and CP2102/CH340
-/// auto-reset-circuit boards alike), turning a device that's merely
-/// unstable into a self-sustaining boot loop that outlasts whatever
-/// triggered the original instability. Confirmed live 2026-07-23: a Heltec
-/// V3 stuck retrying every ~5-15s for 5+ minutes after a failed firmware
-/// flash left it in a marginal state.
-const STABLE_SESSION_THRESHOLD: Duration = Duration::from_secs(20);
-
 /// Number of consecutive write failures before we consider the device dead
 /// and trigger a reconnection cycle.
 const MAX_CONSECUTIVE_WRITE_FAILURES: u32 = 3;
@@ -450,10 +438,7 @@ impl MeshState {
         let persisted: PersistedMessages = match serde_json::from_slice(&bytes) {
             Ok(p) => p,
             Err(e) => {
-                warn!(
-                    "mesh: parsing {} failed (skipping restore): {e}",
-                    path.display()
-                );
+                warn!("mesh: parsing {} failed (skipping restore): {e}", path.display());
                 return;
             }
         };
@@ -469,10 +454,7 @@ impl MeshState {
                 *id = max_id + 1;
             }
         }
-        info!(
-            "mesh: restored {count} persisted messages (next id {})",
-            max_id + 1
-        );
+        info!("mesh: restored {count} persisted messages (next id {})", max_id + 1);
     }
 }
 
@@ -516,11 +498,7 @@ pub fn spawn_message_persister(state: Arc<MeshState>) {
                 warn!("mesh: chmod {} failed: {e}", tmp.display());
             }
             if let Err(e) = tokio::fs::rename(&tmp, &path).await {
-                warn!(
-                    "mesh: renaming {} -> {} failed: {e}",
-                    tmp.display(),
-                    path.display()
-                );
+                warn!("mesh: renaming {} -> {} failed: {e}", tmp.display(), path.display());
                 continue;
             }
             last_written = Some(json);
@@ -557,10 +535,6 @@ pub fn spawn_mesh_listener(
         let mut shutdown = shutdown;
         let mut cmd_rx = cmd_rx;
         let mut reconnect_delay = RECONNECT_DELAY_INIT;
-        // Mutable so a successful auto-detect can pin the firmware kind for
-        // the rest of this listener's lifetime — see the pin-on-first-success
-        // block below for why.
-        let mut device_kind = device_kind;
         // Backlog #12 hot-swap re-binding: each run_mesh_session call already
         // builds a fresh device struct (contacts/current_region/etc. all
         // start empty), so per-device session state is naturally isolated
@@ -576,7 +550,6 @@ pub fn spawn_mesh_listener(
                 return;
             }
 
-            let session_start = std::time::Instant::now();
             match session::run_mesh_session(
                 &state,
                 &data_dir,
@@ -599,14 +572,13 @@ pub fn spawn_mesh_listener(
             {
                 Ok(()) => {
                     info!("Mesh session ended cleanly");
-                    // Only trust a session that actually ran for a while —
-                    // see STABLE_SESSION_THRESHOLD's doc comment.
-                    if session_start.elapsed() >= STABLE_SESSION_THRESHOLD {
-                        reconnect_delay = RECONNECT_DELAY_INIT;
-                    }
+                    // Session was established before ending — reset backoff
+                    reconnect_delay = RECONNECT_DELAY_INIT;
                 }
                 Err(e) => {
-                    if session_start.elapsed() >= STABLE_SESSION_THRESHOLD {
+                    // Check if session was ever connected (vs failed to open)
+                    let was_connected = state.status.read().await.device_connected;
+                    if was_connected {
                         reconnect_delay = RECONNECT_DELAY_INIT;
                     }
                     error!("Mesh session error: {} (retry in {:?})", e, reconnect_delay);
@@ -632,45 +604,6 @@ pub fn spawn_mesh_listener(
                 }
             }
 
-            // Pin the firmware kind after the first successful auto-detect.
-            // Confirmed live 2026-07-23: with device_kind left unpinned (e.g.
-            // after clearing a stale pin), EVERY reconnect re-runs the full
-            // Reticulum→Meshcore→Meshtastic auto-detect cascade — each
-            // candidate past the first does its own open() with the DTR/RTS
-            // reset both boards need, so a device correctly identified as
-            // Meshtastic still gets reset once for the failed Meshcore
-            // attempt before Meshtastic's own open() resets it again. That
-            // doubled the reset count on every single reconnect indefinitely,
-            // not just during initial detection. Once auto-detect has
-            // identified the device this listener is actually talking to,
-            // there's no reason to keep guessing on subsequent reconnects —
-            // pin it, both in this task's own loop (takes effect
-            // immediately) and on disk (survives a service restart). A
-            // genuine hot-swap to different firmware is still handled: the
-            // setup modal's `mesh.probe-device` always re-probes unpinned,
-            // and the flash flow already clears this pin on its own.
-            if device_kind.is_none() {
-                let detected = state.status.read().await.device_type;
-                if detected != super::types::DeviceType::Unknown {
-                    device_kind = Some(detected);
-                    match super::load_config(&data_dir).await {
-                        Ok(mut cfg) if cfg.device_kind.is_none() => {
-                            cfg.device_kind = Some(detected);
-                            if let Err(e) = super::save_config(&data_dir, &cfg).await {
-                                warn!("Failed to persist auto-detected device_kind: {}", e);
-                            } else {
-                                info!(
-                                    kind = %detected,
-                                    "Pinned auto-detected firmware kind to avoid repeated multi-protocol resets on reconnect"
-                                );
-                            }
-                        }
-                        Ok(_) => {}
-                        Err(e) => warn!("Failed to load mesh config to persist device_kind: {}", e),
-                    }
-                }
-            }
-
             // Update status to disconnected. device_type/firmware_version are
             // reset too — they were previously left holding the LAST radio's
             // identity, so after a hot-swap the UI showed the old firmware

core/archipelago/src/mesh/listener/session.rs

@@ -269,26 +269,11 @@ async fn auto_detect_and_open(
     our_ed_pubkey_hex: &str,
     our_x25519_pubkey_hex: &str,
     device_kind: Option<DeviceType>,
-    skip_path: Option<&str>,
-    advert_name: Option<&str>,
 ) -> Result<(String, MeshRadioDevice, DeviceInfo)> {
-    let mut paths = super::super::serial::detect_serial_devices().await;
-    // When falling back from a just-failed preferred path, don't probe that
-    // same device again in the same cycle — every open() toggles DTR/RTS,
-    // which resets ESP32-family boards, and back-to-back re-probes are what
-    // keeps a mid-boot board from ever finishing its boot.
-    if let Some(skip) = skip_path {
-        let canon = |p: &str| std::fs::canonicalize(p).unwrap_or_else(|_| p.into());
-        let skip_canon = canon(skip);
-        paths.retain(|p| canon(p) != skip_canon);
-    }
+    let paths = super::super::serial::detect_serial_devices().await;
     if paths.is_empty() {
-        anyhow::bail!(match skip_path {
-            Some(skip) => format!("No serial devices found in /dev besides {skip}, which was already probed this cycle"),
-            None => "No serial devices found in /dev".to_string(),
-        });
+        anyhow::bail!("No serial devices found in /dev");
     }
-    info!(candidates = ?paths, "Auto-detect candidate ports for this attempt");
     for path in &paths {
         debug!(path = %path, "Probing for mesh radio device");
         // Tried FIRST: `ReticulumLink::open()` gates its expensive daemon
@@ -306,7 +291,6 @@ async fn auto_detect_and_open(
                 data_dir,
                 Some(our_ed_pubkey_hex),
                 Some(our_x25519_pubkey_hex),
-                advert_name,
             )
             .await
             {
@@ -375,16 +359,6 @@ pub struct DeviceProbe {
     pub max_contacts: Option<u16>,
 }
 
-/// Serializes serial-port open sequences between the listener's session
-/// opens and the RPC probe (`mesh.probe-device`). Linux happily double-opens
-/// a tty, and two concurrent handshakes corrupt each other into silence —
-/// observed live on .116 (2026-07-26): the kiosk browser's hot-swap
-/// auto-probe collided with the listener's cycle on every backoff window, so
-/// neither ever succeeded, and each collision's open() DTR/RTS-reset the
-/// board again. The probe's retry-across-idle-gaps heuristic (5f01ec31)
-/// narrowed but could not close the race; this closes it.
-static PORT_OPEN_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
-
 /// Probe a serial port for a mesh radio WITHOUT provisioning it: identify the
 /// firmware (same strict Reticulum→Meshcore→Meshtastic order as auto-detect,
 /// for the same RNode-wedging reason) and read what's currently configured on
@@ -392,10 +366,11 @@ static PORT_OPEN_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(()
 /// loop can pick the device up afterwards. Reticulum uses the bare KISS
 /// DETECT probe — no daemon spawn just to identify a stick.
 pub(crate) async fn probe_device(path: &str) -> Result<DeviceProbe> {
-    // Retries kept even with PORT_OPEN_LOCK closing the double-open race:
-    // the board may still be mid-boot from a previous open's DTR/RTS reset,
-    // and a later attempt after a quiet gap can succeed where the first
-    // couldn't.
+    // The listener's reconnect loop may hold this port for ~10s of every
+    // backoff cycle, and Linux happily double-opens a tty — two concurrent
+    // handshakes corrupt each other into silence (observed on framework-pt:
+    // every firmware "failed" while the listener was mid-cycle). Retry across
+    // the listener's idle gaps instead of failing on first collision.
     let mut last_err = None;
     for attempt in 0..3u32 {
         if attempt > 0 {
@@ -410,7 +385,6 @@ pub(crate) async fn probe_device(path: &str) -> Result<DeviceProbe> {
 }
 
 async fn probe_device_once(path: &str) -> Result<DeviceProbe> {
-    let _port_guard = PORT_OPEN_LOCK.lock().await;
     if super::super::reticulum::probe_rnode(path).await.is_ok() {
         return Ok(DeviceProbe {
             path: path.to_string(),
@@ -468,7 +442,6 @@ async fn open_preferred_path(
     our_ed_pubkey_hex: &str,
     our_x25519_pubkey_hex: &str,
     device_kind: Option<DeviceType>,
-    advert_name: Option<&str>,
 ) -> Result<(MeshRadioDevice, DeviceInfo)> {
     // Pinned: try only the configured firmware and surface its own error —
     // never fall through to (and inject probe bytes into) another firmware's
@@ -501,7 +474,6 @@ async fn open_preferred_path(
                     data_dir,
                     Some(our_ed_pubkey_hex),
                     Some(our_x25519_pubkey_hex),
-                    advert_name,
                 )
                 .await
                 .context("Could not open preferred path as Reticulum")?;
@@ -515,21 +487,40 @@ async fn open_preferred_path(
         };
     }
 
-    // Unpinned: don't probe this path ourselves at all. Confirmed live
-    // 2026-07-23 — this function used to run its own Reticulum→Meshcore→
-    // Meshtastic sequence here, and the caller (run_mesh_session) falls
-    // back to `auto_detect_and_open` on any error, which scans every
-    // candidate path (this one included) with the exact same three-protocol
-    // sequence. With a single physical radio — the overwhelmingly common
-    // case — `path` here IS the one candidate `auto_detect_and_open` is
-    // about to try, so every unpinned reconnect was resetting the board via
-    // Reticulum/Meshcore/Meshtastic's DTR/RTS toggle TWICE: once here, once
-    // again moments later in auto-detect. Bailing immediately (no port
-    // access at all) means auto-detect's single pass is the only one that
-    // ever touches the port when nothing is pinned yet. (auto_detect_and_open
-    // carries the advert_name threading from main, so nothing is lost.)
-    let _ = advert_name;
-    anyhow::bail!("No device_kind pin — deferring to auto-detect for {path}")
+    // Reticulum first — see the matching comment on auto_detect_and_open:
+    // its cheap probe_rnode gate fails in ~1s for non-RNode firmware, while
+    // trying Meshcore/Meshtastic first was observed leaving a real RNode
+    // board unresponsive by the time Reticulum's turn came.
+    match ReticulumLink::open(
+        path,
+        data_dir,
+        Some(our_ed_pubkey_hex),
+        Some(our_x25519_pubkey_hex),
+    )
+    .await
+    {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => return Ok((MeshRadioDevice::Reticulum(dev), info)),
+            Err(e) => {
+                debug!(path = %path, error = %e, "Preferred path is not a working Reticulum RNode")
+            }
+        },
+        Err(e) => debug!(path = %path, error = %e, "Could not open preferred path as Reticulum"),
+    }
+    match MeshcoreDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => return Ok((MeshRadioDevice::Meshcore(dev), info)),
+            Err(e) => debug!(path = %path, error = %e, "Preferred path is not Meshcore"),
+        },
+        Err(e) => debug!(path = %path, error = %e, "Could not open preferred path as Meshcore"),
+    }
+    match MeshtasticDevice::open(path).await {
+        Ok(mut dev) => match dev.initialize().await {
+            Ok(info) => Ok((MeshRadioDevice::Meshtastic(dev), info)),
+            Err(e) => Err(e).context("Preferred path is not a working Meshtastic device"),
+        },
+        Err(e) => Err(e).context("Could not open preferred path as Meshtastic"),
+    }
 }
 
 /// Bring up a Reticulum daemon over plain TCP — no physical RNode, no
@@ -542,7 +533,6 @@ async fn open_reticulum_tcp(
     data_dir: &Path,
     our_ed_pubkey_hex: &str,
     our_x25519_pubkey_hex: &str,
-    advert_name: Option<&str>,
 ) -> Result<(String, MeshRadioDevice, DeviceInfo)> {
     let mut dev = match cfg {
         ReticulumTcpConfig::Server { bind } => ReticulumLink::open_tcp_server(
@@ -550,7 +540,6 @@ async fn open_reticulum_tcp(
             data_dir,
             Some(our_ed_pubkey_hex),
             Some(our_x25519_pubkey_hex),
-            advert_name,
         )
         .await
         .context("Could not open Reticulum TCP server interface")?,
@@ -559,7 +548,6 @@ async fn open_reticulum_tcp(
             data_dir,
             Some(our_ed_pubkey_hex),
             Some(our_x25519_pubkey_hex),
-            advert_name,
         )
         .await
         .context("Could not open Reticulum TCP client interface")?,
@@ -975,93 +963,41 @@ pub(super) async fn run_mesh_session(
     // set, otherwise try the preferred serial path, falling back to
     // auto-detect. TCP mode is additive/dev-only; it never changes behavior
     // for existing serial/RNode deployments where `reticulum_tcp` is None.
-    //
-    // The name we present on the mesh: the operator's configured mesh name /
-    // server name, falling back to a DID fragment. Computed BEFORE the open
-    // sequence because Reticulum needs it at daemon-spawn time — the RNS
-    // announce carries it from the very first announce. (Meshcore/Meshtastic
-    // still receive it via set_advert_name after connect, below.)
-    let desired_advert_name: String = match server_name {
-        // Meshcore firmware limits advert names — truncate to 20 chars.
-        Some(name) => name.chars().take(20).collect(),
-        None => format!(
-            "Archy-{}",
-            our_did.chars().skip(8).take(8).collect::<String>()
-        ),
-    };
-
-    // The whole open sequence runs under PORT_OPEN_LOCK so an RPC probe
-    // can't interleave its own handshakes on the same tty (see the lock's
-    // doc comment). Held only until the device is opened, then released.
-    //
-    // The sequence is raced against the shutdown signal: probes/handshakes
-    // can take 10s+, and without this a stop() issued mid-probe (config
-    // change, disable, rename) always burned the full listener-shutdown
-    // timeout and ended in a hard abort — observed live on archi-dev-box
-    // 2026-07-28. Dropping the open future mid-probe is safe: it holds no
-    // session state yet and the port guard/serial handle close with it.
-    let open_fut = async {
-        let port_guard = PORT_OPEN_LOCK.lock().await;
-        let result = if let Some(tcp_cfg) = &reticulum_tcp {
-            open_reticulum_tcp(
-                tcp_cfg,
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                Some(&desired_advert_name),
-            )
-            .await
-        } else if let Some(path) = preferred_path {
-            match open_preferred_path(
-                path,
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                device_kind,
-                Some(&desired_advert_name),
-            )
-            .await
-            {
-                Ok((dev, info)) => Ok((path.to_string(), dev, info)),
-                Err(e) => {
-                    warn!(
-                        "Preferred path {} probe failed: {} — trying auto-detect",
-                        path, e
-                    );
-                    auto_detect_and_open(
-                        data_dir,
-                        our_ed_pubkey_hex,
-                        our_x25519_pubkey_hex,
-                        device_kind,
-                        Some(path),
-                        Some(&desired_advert_name),
-                    )
-                    .await
-                }
+    let (device_path, mut device, device_info) = if let Some(tcp_cfg) = &reticulum_tcp {
+        open_reticulum_tcp(tcp_cfg, data_dir, our_ed_pubkey_hex, our_x25519_pubkey_hex).await?
+    } else if let Some(path) = preferred_path {
+        match open_preferred_path(
+            path,
+            data_dir,
+            our_ed_pubkey_hex,
+            our_x25519_pubkey_hex,
+            device_kind,
+        )
+        .await
+        {
+            Ok((dev, info)) => (path.to_string(), dev, info),
+            Err(e) => {
+                warn!(
+                    "Preferred path {} probe failed: {} — trying auto-detect",
+                    path, e
+                );
+                auto_detect_and_open(
+                    data_dir,
+                    our_ed_pubkey_hex,
+                    our_x25519_pubkey_hex,
+                    device_kind,
+                )
+                .await?
             }
-        } else {
-            auto_detect_and_open(
-                data_dir,
-                our_ed_pubkey_hex,
-                our_x25519_pubkey_hex,
-                device_kind,
-                None,
-                Some(&desired_advert_name),
-            )
-            .await
-        };
-        drop(port_guard);
-        result
-    };
-    let (device_path, mut device, device_info) = tokio::select! {
-        res = open_fut => res?,
-        _ = shutdown.changed() => {
-            if *shutdown.borrow() {
-                info!("Shutdown requested during device open — ending session");
-                return Ok(());
-            }
-            anyhow::bail!("shutdown signal changed during device open");
         }
+    } else {
+        auto_detect_and_open(
+            data_dir,
+            our_ed_pubkey_hex,
+            our_x25519_pubkey_hex,
+            device_kind,
+        )
+        .await?
     };
 
     // Update status
@@ -1209,14 +1145,19 @@ pub(super) async fn run_mesh_session(
         }
     }
 
-    // Set advert name to the configured mesh/server name (computed above).
-    // Skipped in keep-as-is mode for radio-held names — the radio keeps the
-    // name it came with (already reflected in status from the connect
-    // handshake). Reticulum is exempt from keep-as-is: its display name
-    // lives in OUR daemon (the RNode holds no name), so "keep as is" has
-    // nothing to preserve and an unnamed node would be anonymous on RNS.
-    if manage_radio || matches!(device, MeshRadioDevice::Reticulum(_)) {
-        if let Err(e) = device.set_advert_name(&desired_advert_name).await {
+    // Set advert name to the server's human-readable name (e.g. "ThinkPad"),
+    // falling back to the DID fragment if no name is configured. Skipped in
+    // keep-as-is mode — the radio keeps the name it came with (already
+    // reflected in status from the connect handshake).
+    if manage_radio {
+        let advert_name = if let Some(name) = server_name {
+            // Meshcore firmware limits advert names — truncate to 20 chars
+            name.chars().take(20).collect::<String>()
+        } else {
+            let short_did = our_did.chars().skip(8).take(8).collect::<String>();
+            format!("Archy-{}", short_did)
+        };
+        if let Err(e) = device.set_advert_name(&advert_name).await {
             warn!("Failed to set advert name: {}", e);
         } else {
             // Reflect the post-set name in MeshStatus too so the UI can filter
@@ -1224,7 +1165,7 @@ pub(super) async fn run_mesh_session(
             // still carries whatever pre-set name the firmware reported and the
             // self-filter never matches.
             let mut status = state.status.write().await;
-            status.self_advert_name = Some(desired_advert_name.clone());
+            status.self_advert_name = Some(advert_name.clone());
         }
     }
 
@@ -1517,15 +1458,6 @@ async fn handle_send_command(
             } else {
                 *consecutive_write_failures = 0;
             }
-            // The self-advert alone is a no-op for discovery on Meshtastic
-            // (heartbeat + time carry no identity) — the NodeInfo broadcast
-            // is what makes peers learn/refresh us. want_response=true so
-            // neighbours answer with their own NodeInfo: the user pressed
-            // Broadcast to be seen AND to see who's out there. No-op on
-            // Meshcore/Reticulum, whose self-advert already carries identity.
-            if let Err(e) = device.send_nodeinfo_advert(true).await {
-                warn!("Failed to send NodeInfo advert: {}", e);
-            }
         }
         MeshCommand::RebootRadio { seconds } => {
             if let Err(e) = device.reboot(seconds).await {

core/archipelago/src/mesh/meshtastic.rs

@@ -191,13 +191,10 @@ impl MeshtasticDevice {
                 .current_modem_preset
                 .and_then(modem_preset_name)
                 .map(str::to_string),
-            primary_channel: self.current_primary_channel.as_ref().map(|(name, _)| {
-                if name.is_empty() {
-                    "(default public)".to_string()
-                } else {
-                    name.clone()
-                }
-            }),
+            primary_channel: self
+                .current_primary_channel
+                .as_ref()
+                .map(|(name, _)| if name.is_empty() { "(default public)".to_string() } else { name.clone() }),
             secondary_channel: self
                 .current_secondary_channel
                 .as_ref()
@@ -217,20 +214,11 @@ impl MeshtasticDevice {
             path
         ))?;
         // See probe_rnode() in reticulum.rs for why: ESP32-S3 native-USB
-        // boards (and CP2102/CH340-bridged boards wired for Arduino-style
-        // auto-reset) reset on a DTR/RTS transition, so deassert both and
-        // settle before the handshake below. 300ms is nowhere near a real
-        // firmware boot time (LoRa radio init alone can take longer) —
-        // confirmed live 2026-07-23: with every one of Reticulum/Meshcore/
-        // Meshtastic's open() doing this same reset, a single auto-detect
-        // cycle trying multiple protocols in sequence kept re-resetting the
-        // board before it ever finished booting from the PREVIOUS attempt's
-        // reset, on both a Heltec V3 and V4, regardless of firmware family —
-        // a self-sustaining "never finishes booting" loop with a boot-time
-        // root cause hiding behind what looked like a per-protocol failure.
+        // boards reset on a DTR/RTS transition, so deassert both and settle
+        // before the handshake below.
         let _ = port.set_dtr(false);
         let _ = port.set_rts(false);
-        tokio::time::sleep(Duration::from_millis(2000)).await;
+        tokio::time::sleep(Duration::from_millis(300)).await;
         info!(path = %path, baud = BAUD_RATE, "Opened Meshtastic serial port");
 
         Ok(Self {

core/archipelago/src/mesh/mod.rs

@@ -8,7 +8,6 @@
 pub mod alerts;
 pub mod bitcoin_relay;
 pub mod crypto;
-pub mod flash;
 pub mod listener;
 pub mod meshtastic;
 pub mod message_types;
@@ -39,14 +38,6 @@ use tokio::sync::watch;
 use tracing::{error, info, warn};
 
 const MESH_CONFIG_FILE: &str = "mesh-config.json";
-
-/// How long `MeshService::stop()` waits for the listener task to notice its
-/// shutdown signal and exit gracefully before force-aborting it. See
-/// `stop()`'s doc comment for the real incident this guards against: without
-/// a hard abort fallback, a slow-to-notice listener could be left running
-/// forever, orphaned, racing a later independently-started listener on the
-/// same serial port.
-const LISTENER_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(15);
 const MESH_IGNORED_RADIO_FILE: &str = "mesh-ignored-radio-contacts.json";
 const MESH_CONTACTS_FILE: &str = "mesh-contacts.json";
 
@@ -478,31 +469,6 @@ impl Default for MeshConfig {
     }
 }
 
-/// Whether a mesh config file has ever been written for this node — lets the
-/// boot path distinguish "operator explicitly disabled mesh" (file exists,
-/// enabled=false) from "never configured" (no file), which is the only case
-/// radio auto-enable should touch.
-pub fn config_file_exists(data_dir: &Path) -> bool {
-    data_dir.join(MESH_CONFIG_FILE).exists()
-}
-
-/// True when `new` differs from `old` in any field a running mesh session
-/// captured by value at spawn (device path/kind, advert name, region, PHY
-/// params, channel, manage_radio, TCP interface) — i.e. when applying `new`
-/// to a live service requires a listener restart. Fields the session reads
-/// live from shared state (broadcast flags, assistant settings, steganography
-/// mode, …) deliberately don't trigger a restart.
-fn session_config_changed(old: &MeshConfig, new: &MeshConfig) -> bool {
-    old.device_path != new.device_path
-        || old.device_kind != new.device_kind
-        || old.advert_name != new.advert_name
-        || old.lora_region != new.lora_region
-        || old.lora_radio_params != new.lora_radio_params
-        || old.channel_name != new.channel_name
-        || old.manage_radio != new.manage_radio
-        || old.reticulum_tcp != new.reticulum_tcp
-}
-
 pub async fn load_config(data_dir: &Path) -> Result<MeshConfig> {
     let path = data_dir.join(MESH_CONFIG_FILE);
     if !path.exists() {
@@ -768,18 +734,10 @@ impl MeshService {
         self.server_name = name;
     }
 
-    /// Start the background mesh listener. Idempotent: if the listener is
-    /// already running, this is a harmless no-op rather than an error —
-    /// confirmed live 2026-07-23, a real race between the flash job's own
-    /// post-flash restart and a concurrent user "Keep As Is" click (both
-    /// legitimately trying to ensure the listener is running) surfaced this
-    /// as a user-facing "Mesh listener already running" RPC error. Ensuring
-    /// the listener is running is the intent every caller actually has;
-    /// whichever caller's start() happens to win the race, the other
-    /// finding it already satisfied is success, not failure.
+    /// Start the background mesh listener.
     pub fn start(&mut self) -> Result<()> {
         if self.listener_handle.is_some() {
-            return Ok(());
+            anyhow::bail!("Mesh listener already running");
         }
 
         let (shutdown_tx, shutdown_rx) = watch::channel(false);
@@ -798,11 +756,7 @@ impl MeshService {
             self.our_ed_pubkey_hex.clone(),
             self.our_x25519_secret,
             self.our_x25519_pubkey_hex.clone(),
-            // The mesh-page "Name on the mesh" (config.advert_name) wins over
-            // the server name — it existed as write-only config with no reader
-            // until this line, which is why renaming on the Mesh page never
-            // changed anything on the air.
-            self.config.advert_name.clone().or_else(|| self.server_name.clone()),
+            self.server_name.clone(),
             self.config.lora_region.clone(),
             self.config.lora_radio_params,
             self.config.channel_name.clone(),
@@ -1013,36 +967,8 @@ impl MeshService {
         if let Some(tx) = self.shutdown_tx.take() {
             let _ = tx.send(true);
         }
-        if let Some(mut handle) = self.listener_handle.take() {
-            // Bounded wait for graceful shutdown, with a hard abort as
-            // fallback — confirmed live 2026-07-23: a caller-side timeout
-            // wrapping stop() (mesh::flash's STOP_LISTENER_TIMEOUT) cancelled
-            // this await when the listener was slow to notice its shutdown
-            // signal (mid multi-candidate probe), but `.take()` above had
-            // already cleared `listener_handle` to None — so MeshService
-            // believed it was stopped while the task kept running, orphaned
-            // (dropping a JoinHandle does not abort the task it points to).
-            // A later start() then spawned a second, fully independent
-            // listener session racing the orphaned one on the same serial
-            // port — neither could ever get a clean response, so every
-            // mesh.configure/probe against that device failed indefinitely
-            // even though the device itself was fine.
-            //
-            // Awaiting `&mut handle` (not `handle` by value) is what makes
-            // the fallback possible: the Future is polled through the
-            // reference, so if the timeout fires, this task's own `handle`
-            // binding is still ours to call `.abort()` on afterward —
-            // unlike moving `handle` into the timeout future outright, which
-            // would drop (and thus orphan) it on timeout with nothing left
-            // to abort.
-            if tokio::time::timeout(LISTENER_SHUTDOWN_TIMEOUT, &mut handle)
-                .await
-                .is_err()
-            {
-                warn!("Mesh listener did not shut down gracefully in time — aborting it");
-                handle.abort();
-                let _ = handle.await;
-            }
+        if let Some(handle) = self.listener_handle.take() {
+            let _ = handle.await;
         }
         if let Some(handle) = self.deadman_handle.take() {
             handle.abort();
@@ -1093,27 +1019,19 @@ impl MeshService {
         self.state.peers.read().await.values().cloned().collect()
     }
 
-    /// Refuse to probe the port the live session currently occupies (the
-    /// probe would steal the serial port from under the session); a
+    /// Probe a serial port for a mesh radio without provisioning or keeping
+    /// it — powers the hot-swap "device detected" modal's current-details
+    /// view. Refuses to probe the port the live session currently occupies
+    /// (the probe would steal the serial port from under the session); a
     /// detected-but-not-connected port is fair game, accepting a benign race
-    /// with the reconnect loop (whichever loses just retries). Split out from
-    /// the actual probe on purpose — see `probe_device`'s doc comment.
-    pub async fn ensure_probe_allowed(&self, path: &str) -> Result<()> {
+    /// with the reconnect loop (whichever loses just retries).
+    pub async fn probe_device(&self, path: &str) -> Result<listener::DeviceProbe> {
         let status = self.state.status.read().await;
-        if status.device_connected {
-            if let Some(active) = status.device_path.as_deref() {
-                // Compare canonical paths: /dev/mesh-radio is a symlink to the
-                // ttyUSB*/ttyACM* node, and a probe through the alias would
-                // still open the very tty the live session is holding.
-                let canon = |p: &str| {
-                    std::fs::canonicalize(p).unwrap_or_else(|_| std::path::PathBuf::from(p))
-                };
-                if canon(active) == canon(path) {
-                    anyhow::bail!("{path} is the active mesh radio — already connected");
-                }
-            }
+        if status.device_connected && status.device_path.as_deref() == Some(path) {
+            anyhow::bail!("{path} is the active mesh radio — already connected");
         }
-        Ok(())
+        drop(status);
+        listener::probe_device(path).await
     }
 
     /// Get message history.
@@ -1160,32 +1078,7 @@ impl MeshService {
         let peer = peers
             .get(&contact_id)
             .ok_or_else(|| anyhow::anyhow!("Peer not found"))?;
-        // Cross-transport twin resolution: callers frequently hold the
-        // FEDERATION twin's contact_id (the UI's merged conversation row),
-        // whose pubkey_hex is the Archipelago ed25519 key — NOT a radio
-        // routing key. Sending a Reticulum resource with that prefix fails
-        // with "Unknown Reticulum prefix" (observed live 2026-07-28,
-        // image-over-LoRa to a merged contact). Route via the radio twin —
-        // same arch identity, radio-range id — whose pubkey_hex is the
-        // actual over-the-air routing key (RNS dest hash / firmware key).
-        let radio_peer = if peer.contact_id >= FEDERATION_CONTACT_ID_BASE {
-            peer.arch_pubkey_hex
-                .as_deref()
-                .and_then(|arch| {
-                    peers.values().find(|p| {
-                        p.contact_id < FEDERATION_CONTACT_ID_BASE
-                            && p.arch_pubkey_hex.as_deref() == Some(arch)
-                    })
-                })
-                .ok_or_else(|| {
-                    anyhow::anyhow!(
-                        "Peer is federation-only (no radio twin) — not reachable over the radio"
-                    )
-                })?
-        } else {
-            peer
-        };
-        let pubkey_hex = radio_peer
+        let pubkey_hex = peer
             .pubkey_hex
             .as_ref()
             .ok_or_else(|| anyhow::anyhow!("Peer has no public key"))?;
@@ -1323,44 +1216,12 @@ impl MeshService {
                 .map(|p| !p.reachable && p.arch_pubkey_hex.is_some())
                 .unwrap_or(false)
         };
-        // Transport policy: LoRa first when it can actually carry the message,
-        // then FIPS, then Tor. A federation-synthetic id (what the UI's merged
-        // conversation holds) used to ALWAYS take the federation path, even
-        // when the very same node was sitting one LoRa hop away — so chats
-        // between two radio-equipped nodes silently rode FIPS/Tor. If the
-        // federation contact has a REACHABLE radio twin (same archipelago
-        // identity, radio-range id) and the payload fits the radio, skip the
-        // federation branch: the fall-through LoRa path twin-resolves the
-        // routing key via peer_dest_prefix.
-        let device_connected = self.state.status.read().await.device_connected;
-        let radio_twin_reachable = is_federation_synthetic && !exceeds_lora && device_connected && {
-            let peers = self.state.peers.read().await;
-            peers
-                .get(&contact_id)
-                .and_then(|p| p.arch_pubkey_hex.clone())
-                .map(|arch| {
-                    peers.values().any(|p| {
-                        p.contact_id < FEDERATION_CONTACT_ID_BASE
-                            && p.reachable
-                            && p.arch_pubkey_hex.as_deref() == Some(arch.as_str())
-                    })
-                })
-                .unwrap_or(false)
-        };
         let mesh_only_mode = load_config(&self.data_dir)
             .await
             .ok()
             .and_then(|cfg| cfg.mesh_only_mode)
             .unwrap_or(false);
-        if radio_twin_reachable && !mesh_only_mode {
-            tracing::info!(
-                contact_id,
-                bytes = wire.len(),
-                "Radio-first routing: federation contact has a reachable radio twin — sending over LoRa"
-            );
-        }
         if !mesh_only_mode
-            && !radio_twin_reachable
             && (is_federation_synthetic || exceeds_lora || radio_federated_unreachable)
         {
             // Resolve the peer's pubkey/did. Prefer the live mesh peer table,
@@ -2184,7 +2045,6 @@ impl MeshService {
         save_config(&self.data_dir, &config).await?;
 
         let was_enabled = self.config.enabled;
-        let needs_session_restart = session_config_changed(&self.config, &config);
         self.config = config.clone();
 
         // Update the status to reflect new config
@@ -2209,31 +2069,11 @@ impl MeshService {
             status.firmware_version = None;
             status.self_node_id = None;
             status.peer_count = 0;
-        } else if config.enabled && was_enabled && needs_session_restart {
-            info!("Mesh session config changed — restarting listener to apply");
-            self.stop().await;
-            self.start()?;
         }
 
         Ok(())
     }
 
-    /// The service's current (last-applied) config.
-    pub fn config(&self) -> &MeshConfig {
-        &self.config
-    }
-
-    /// Restart the listener (if running) so it picks up out-of-band state a
-    /// spawn captured by value — currently the server name pushed by
-    /// `server.set-name`.
-    pub async fn restart_listener_if_running(&mut self) -> Result<()> {
-        if self.listener_handle.is_some() {
-            self.stop().await;
-            self.start()?;
-        }
-        Ok(())
-    }
-
     /// Get a reference to shared state (for RPC handlers).
     pub fn shared_state(&self) -> Arc<MeshState> {
         Arc::clone(&self.state)
@@ -2355,46 +2195,6 @@ async fn bitcoin_rpc_getblockheader_by_height(
 mod tests {
     use super::*;
 
-    #[test]
-    fn session_config_change_detection() {
-        let base = MeshConfig::default();
-
-        // Same config → no restart.
-        assert!(!session_config_changed(&base, &base.clone()));
-
-        // Every session-captured field individually triggers a restart.
-        let mut c = base.clone();
-        c.device_kind = Some(types::DeviceType::Reticulum);
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.device_path = Some("/dev/ttyUSB0".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.advert_name = Some("RNode Shaza".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.manage_radio = !base.manage_radio;
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.lora_region = Some("EU_868".into());
-        assert!(session_config_changed(&base, &c));
-
-        let mut c = base.clone();
-        c.channel_name = Some("private-net".into());
-        assert!(session_config_changed(&base, &c));
-
-        // Live-read fields must NOT force a session restart.
-        let mut c = base.clone();
-        c.broadcast_identity = !base.broadcast_identity;
-        c.announce_block_headers = !base.announce_block_headers;
-        c.assistant_enabled = !base.assistant_enabled;
-        assert!(!session_config_changed(&base, &c));
-    }
-
     fn mk_peer(contact_id: u32, name: &str, arch: Option<&str>, reachable: bool) -> MeshPeer {
         MeshPeer {
             contact_id,

core/archipelago/src/mesh/reticulum.rs

@@ -121,7 +121,6 @@ fn daemon_command(
     identity_key: &Path,
     archy_ed_pubkey_hex: Option<&str>,
     archy_x25519_pubkey_hex: Option<&str>,
-    display_name: Option<&str>,
 ) -> Command {
     let bin = std::env::var("ARCHY_RETICULUM_DAEMON_BIN")
         .unwrap_or_else(|_| "/usr/local/bin/archy-reticulum-daemon".to_string());
@@ -160,15 +159,6 @@ fn daemon_command(
             .arg("--archy-x25519-pubkey-hex")
             .arg(x);
     }
-    // The RNS-visible display name (what Sideband/NomadNet/other archy nodes
-    // show for us). Without this the daemon falls back to its argparse
-    // default and every archy node announces the same anonymous name.
-    if let Some(name) = display_name {
-        let name = name.trim();
-        if !name.is_empty() {
-            cmd.arg("--display-name").arg(name);
-        }
-    }
     // Run the daemon as its own process-group leader. The packaged binary is
     // a PyInstaller one-file bootloader that forks the real Python process;
     // making it a group leader lets shutdown signal the WHOLE group so the
@@ -217,10 +207,6 @@ struct ReticulumPeer {
     /// `bind_federation_twins`, which those two transports rely on instead).
     arch_pubkey_hex: Option<String>,
     reachable: bool,
-    /// Unix time of the last announce heard from this peer over the air.
-    /// In-memory only (a persisted value would be stale by definition) —
-    /// `0` after a restart until the peer re-announces.
-    last_advert_at: u64,
 }
 
 /// On-disk shape of `ReticulumPeer` — `[u8; 16]` can't be a JSON object key,
@@ -259,11 +245,6 @@ pub struct ReticulumLink {
     /// matching `resource_progress`/`resource_sent`/`resource_failed` events
     /// back to a log line; sends are fire-and-forget (see `send_resource`).
     resource_id_counter: u64,
-    /// Set when the daemon's RPC socket closes or its process exits. Once
-    /// true, `try_recv_frame` returns an error so the session loop tears
-    /// down and the outer reconnect loop respawns the daemon — without this
-    /// a dead daemon was invisible until the 30-minute RX-stall watchdog.
-    daemon_gone: bool,
 }
 
 impl ReticulumLink {
@@ -288,7 +269,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         probe_rnode(path)
             .await
@@ -298,7 +278,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -311,7 +290,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         let host = bind.rsplit_once(':').map(|(h, _)| h).unwrap_or(bind);
         anyhow::ensure!(
@@ -324,7 +302,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -336,7 +313,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         anyhow::ensure!(
             !targets.is_empty(),
@@ -347,7 +323,6 @@ impl ReticulumLink {
             data_dir,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         )
         .await
     }
@@ -357,7 +332,6 @@ impl ReticulumLink {
         data_dir: &Path,
         our_ed_pubkey_hex: Option<&str>,
         our_x25519_pubkey_hex: Option<&str>,
-        display_name: Option<&str>,
     ) -> Result<Self> {
         // Keep the RPC socket under the archipelago-owned data dir (not the
         // shared system temp dir) so its access is bounded by the same
@@ -405,7 +379,6 @@ impl ReticulumLink {
             &identity_key,
             our_ed_pubkey_hex,
             our_x25519_pubkey_hex,
-            display_name,
         );
         cmd.env("TMPDIR", &tmp_dir);
         let child = cmd
@@ -477,7 +450,6 @@ impl ReticulumLink {
             peers_file: runtime_dir.join("peers.json"),
             inbound: std::collections::VecDeque::new(),
             resource_id_counter: 0,
-            daemon_gone: false,
         };
         link.load_persisted_peers();
         Ok(link)
@@ -500,25 +472,15 @@ impl ReticulumLink {
             };
             let prefix: [u8; 6] = hash[..6].try_into().unwrap();
             self.prefix_to_hash.insert(prefix, hash);
-            // Heal names persisted by pre-2026-07-28 builds, which could
-            // store a raw `ARCHY:…` identity blob as the display name (seen
-            // live on archi-dev-box). Blob-only announces assert no name, so
-            // nothing would ever overwrite it — swap in the placeholder.
-            let display_name = if p.display_name.starts_with("ARCHY:") {
-                format!("Reticulum {}", hex::encode(&hash[..4]))
-            } else {
-                p.display_name
-            };
             self.peers.insert(
                 hash,
                 ReticulumPeer {
                     dest_hash: hash,
-                    display_name,
+                    display_name: p.display_name,
                     arch_pubkey_hex: p.arch_pubkey_hex,
                     // Reachability is a live property, not a persisted fact —
                     // start conservative and let the first real event refresh it.
                     reachable: false,
-                    last_advert_at: 0,
                 },
             );
         }
@@ -571,12 +533,10 @@ impl ReticulumLink {
     }
 
     pub async fn set_advert_name(&mut self, name: &str) -> Result<()> {
-        // Live rename: the daemon's `set_name` verb updates the LXMF delivery
-        // destination's display_name and re-announces, so peers pick the new
-        // name up on their next announce receipt. Also tracked locally so
-        // `advert_name()` reflects it immediately.
-        self.send_rpc(serde_json::json!({"cmd": "set_name", "name": name}))
-            .await?;
+        // The daemon's display_name is fixed at spawn time (CLI arg); changing
+        // it live would require an RPC verb we haven't added. Track locally so
+        // `advert_name()` reflects the caller's intent even though the
+        // RNS-visible name doesn't change until the daemon restarts.
         self.display_name = Some(name.to_string());
         Ok(())
     }
@@ -725,7 +685,7 @@ impl ReticulumLink {
             .map(|p| ParsedContact {
                 public_key_hex: hex::encode(p.dest_hash),
                 advert_name: p.display_name.clone(),
-                last_advert: p.last_advert_at as u32,
+                last_advert: 0,
                 // Deliberately not 1 ("friend"/meshcore type), so the
                 // meshcore-only auto-heal `reset_contact_path` loop in
                 // `refresh_contacts` (session.rs) skips these — RNS does its
@@ -758,12 +718,6 @@ impl ReticulumLink {
 
     pub async fn try_recv_frame(&mut self) -> Result<Option<InboundFrame>> {
         self.drain_events().await;
-        if self.daemon_gone {
-            // Surface the dead daemon as a hard error so run_mesh_session
-            // bails and the outer reconnect loop respawns it, instead of
-            // idling on an empty queue until the RX-stall watchdog fires.
-            anyhow::bail!("reticulum-daemon is gone (process exited or RPC socket closed)");
-        }
         Ok(self.inbound.pop_front())
     }
 
@@ -789,15 +743,6 @@ impl ReticulumLink {
     /// Drain any buffered daemon events (non-blocking) and translate them into
     /// peer-table updates / synthetic InboundFrames.
     async fn drain_events(&mut self) {
-        // A daemon that died without closing the socket cleanly (SIGKILL,
-        // OOM) leaves the socket readable-with-EOF or just silent — poll the
-        // child's exit status too so death is never mistaken for quiet.
-        if !self.daemon_gone {
-            if let Ok(Some(status)) = self.child.try_wait() {
-                warn!(%status, "reticulum-daemon process exited");
-                self.daemon_gone = true;
-            }
-        }
         loop {
             let mut line = String::new();
             let read =
@@ -805,16 +750,10 @@ impl ReticulumLink {
                     .await;
             let n = match read {
                 Ok(Ok(n)) => n,
-                Ok(Err(e)) => {
-                    warn!("Reticulum daemon RPC read failed: {}", e);
-                    self.daemon_gone = true;
-                    break;
-                }
-                Err(_) => break, // timeout — no data buffered
+                _ => break, // timeout (no data) or read error — stop draining
             };
             if n == 0 {
                 warn!("Reticulum daemon RPC connection closed");
-                self.daemon_gone = true;
                 break;
             }
             let Ok(ev) = serde_json::from_str::<Value>(line.trim()) else {
@@ -836,23 +775,6 @@ impl ReticulumLink {
                 };
                 let prefix: [u8; 6] = hash[..6].try_into().unwrap();
                 self.prefix_to_hash.insert(prefix, hash);
-                // Current daemons decode the LXMF announce app_data themselves
-                // and hand us clean fields: `display_name` (LXMF-standard
-                // msgpack name, Sideband-interoperable) and `archy_blob` (the
-                // `ARCHY:n:` identity string, carried as an extra msgpack list
-                // element stock clients ignore). The raw `app_data` text path
-                // below remains for announces from pre-upgrade archy nodes,
-                // whose app_data was EITHER the blob OR a bare-utf8 name.
-                let explicit_name = ev
-                    .get("display_name")
-                    .and_then(Value::as_str)
-                    .map(|s| s.trim().to_string())
-                    .filter(|s| !s.is_empty());
-                let explicit_blob = ev
-                    .get("archy_blob")
-                    .and_then(Value::as_str)
-                    .map(str::to_string)
-                    .filter(|s| !s.is_empty());
                 let app_data_text = ev
                     .get("app_data")
                     .and_then(Value::as_str)
@@ -872,17 +794,12 @@ impl ReticulumLink {
                 // now carry the same `arch_pubkey_hex`, instead of relying on
                 // `bind_federation_twins`'s advert_name matching, which never
                 // matches here — see `display_name` below.
-                let legacy_identity = app_data_text
+                let parsed_identity = app_data_text
                     .as_deref()
                     .and_then(protocol::parse_identity_broadcast);
-                let is_legacy_blob = legacy_identity.is_some();
-                let identity_blob_text = explicit_blob.or_else(|| {
-                    app_data_text.clone().filter(|_| is_legacy_blob)
-                });
-                let parsed_identity = identity_blob_text
-                    .as_deref()
-                    .and_then(protocol::parse_identity_broadcast);
-                if let Some(text) = identity_blob_text.as_deref().filter(|_| parsed_identity.is_some()) {
+                let is_identity_blob = parsed_identity.is_some();
+                if is_identity_blob {
+                    let text = app_data_text.clone().unwrap();
                     let mut data = Vec::with_capacity(7 + text.len());
                     data.push(0); // channel index — unused by the identity path
                     data.extend_from_slice(&prefix);
@@ -895,31 +812,23 @@ impl ReticulumLink {
                 }
                 let arch_pubkey_hex = parsed_identity.map(|(_did, ed_pubkey, _x25519)| ed_pubkey);
 
-                let announced_name =
-                    pick_announced_name(explicit_name, app_data_text, is_legacy_blob);
-                let now = std::time::SystemTime::now()
-                    .duration_since(std::time::UNIX_EPOCH)
-                    .unwrap_or_default()
-                    .as_secs();
+                let display_name = app_data_text
+                    .filter(|_| !is_identity_blob)
+                    .unwrap_or_else(|| format!("Reticulum {}", hex::encode(&hash[..4])));
                 self.peers
                     .entry(hash)
                     .and_modify(|p| {
-                        if let Some(name) = announced_name.clone() {
-                            p.display_name = name;
-                        }
+                        p.display_name = display_name.clone();
                         p.reachable = true;
-                        p.last_advert_at = now;
                         if arch_pubkey_hex.is_some() {
                             p.arch_pubkey_hex = arch_pubkey_hex.clone();
                         }
                     })
-                    .or_insert_with(|| ReticulumPeer {
+                    .or_insert(ReticulumPeer {
                         dest_hash: hash,
-                        display_name: announced_name
-                            .unwrap_or_else(|| format!("Reticulum {}", hex::encode(&hash[..4]))),
+                        display_name,
                         arch_pubkey_hex,
                         reachable: true,
-                        last_advert_at: now,
                     });
                 self.persist_peers();
             }
@@ -935,24 +844,16 @@ impl ReticulumLink {
                 // A peer that messages us without ever announcing still needs
                 // to survive a restart — give it a placeholder name (the real
                 // one, if any, arrives via a later "announce" and overwrites
-                // this) so its routing entry alone doesn't get lost. An
-                // existing entry is proof of life too: mark it reachable so a
-                // restart-restored (reachable=false) peer that DMs us doesn't
-                // stay red-dotted until its next announce.
-                match self.peers.entry(source_hash) {
-                    std::collections::hash_map::Entry::Vacant(e) => {
-                        e.insert(ReticulumPeer {
-                            dest_hash: source_hash,
-                            display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
-                            arch_pubkey_hex: None,
-                            reachable: true,
-                            last_advert_at: 0,
-                        });
-                        self.persist_peers();
-                    }
-                    std::collections::hash_map::Entry::Occupied(mut e) => {
-                        e.get_mut().reachable = true;
-                    }
+                // this) so its routing entry alone doesn't get lost.
+                if let std::collections::hash_map::Entry::Vacant(e) = self.peers.entry(source_hash)
+                {
+                    e.insert(ReticulumPeer {
+                        dest_hash: source_hash,
+                        display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
+                        arch_pubkey_hex: None,
+                        reachable: true,
+                    });
+                    self.persist_peers();
                 }
 
                 // A stock LXMF client (Sideband/NomadNet — not an archy peer)
@@ -1031,20 +932,15 @@ impl ReticulumLink {
                 };
                 let prefix: [u8; 6] = source_hash[..6].try_into().unwrap();
                 self.prefix_to_hash.insert(prefix, source_hash);
-                match self.peers.entry(source_hash) {
-                    std::collections::hash_map::Entry::Vacant(e) => {
-                        e.insert(ReticulumPeer {
-                            dest_hash: source_hash,
-                            display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
-                            arch_pubkey_hex: None,
-                            reachable: true,
-                            last_advert_at: 0,
-                        });
-                        self.persist_peers();
-                    }
-                    std::collections::hash_map::Entry::Occupied(mut e) => {
-                        e.get_mut().reachable = true;
-                    }
+                if let std::collections::hash_map::Entry::Vacant(e) = self.peers.entry(source_hash)
+                {
+                    e.insert(ReticulumPeer {
+                        dest_hash: source_hash,
+                        display_name: format!("Reticulum {}", hex::encode(&source_hash[..4])),
+                        arch_pubkey_hex: None,
+                        reachable: true,
+                    });
+                    self.persist_peers();
                 }
                 use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
                 let Some(data) = ev
@@ -1193,10 +1089,8 @@ pub(crate) async fn probe_rnode(path: &str) -> Result<()> {
     // ESP32-S3 native-USB boards (Heltec V3/V4 etc. — no separate USB-UART
     // bridge chip) treat a DTR/RTS transition on open as a reset signal, the
     // same mechanism esptool uses to force bootloader entry. Deassert both
-    // before writing the probe. Boards behind a USB-UART bridge (CP2102 on
-    // the Heltec V3) get the reset pulse from the open() itself, before we
-    // can deassert anything — that case is handled by the boot-settle retry
-    // below.
+    // and let the board settle before writing the probe, or the reboot eats
+    // the DETECT_RESP window below.
     let _ = port.set_dtr(false);
     let _ = port.set_rts(false);
     tokio::time::sleep(Duration::from_millis(300)).await;
@@ -1215,81 +1109,26 @@ pub(crate) async fn probe_rnode(path: &str) -> Result<()> {
         0x00,
         KISS_FEND,
     ];
-    // Attempt 1: probe immediately. A board that did NOT reset on open (it
-    // was already up — e.g. a re-probe of a running RNode) answers in well
-    // under a second, so the fast path stays fast.
     tokio::time::timeout(Duration::from_millis(500), port.write_all(&probe))
         .await
         .context("RNode probe write timed out")?
         .context("RNode probe write failed")?;
+
     let mut buf = [0u8; 256];
     let mut seen = Vec::new();
-    if await_detect_resp(&port, &mut buf, &mut seen, PROBE_READ_TIMEOUT).await {
-        return Ok(());
-    }
-
-    // No DETECT_RESP. If the open() power-cycled the board (verified live on
-    // a Heltec V3 RNode behind a CP2102: the ESP32 spends ~2.5-3s in boot
-    // ROM + app init and silently eats anything written meanwhile, so the
-    // first probe lands in the void), wait for its boot chatter to go quiet
-    // and probe once more with a fresh response window.
-    const BOOT_QUIET_WINDOW: Duration = Duration::from_millis(800);
-    const BOOT_SETTLE_MAX: Duration = Duration::from_secs(6);
-    let settle_deadline = tokio::time::Instant::now() + BOOT_SETTLE_MAX;
-    let mut last_data = tokio::time::Instant::now();
-    while tokio::time::Instant::now() < settle_deadline {
+    let deadline = tokio::time::Instant::now() + PROBE_READ_TIMEOUT;
+    while tokio::time::Instant::now() < deadline {
         match tokio::time::timeout(Duration::from_millis(150), port.read(&mut buf)).await {
             Ok(Ok(n)) if n > 0 => {
                 seen.extend_from_slice(&buf[..n]);
-                // A late DETECT_RESP to the first write still counts.
                 if contains_detect_resp(&seen) {
                     return Ok(());
                 }
-                last_data = tokio::time::Instant::now();
-            }
-            _ => {
-                if last_data.elapsed() >= BOOT_QUIET_WINDOW {
-                    break;
-                }
-            }
-        }
-    }
-
-    tokio::time::timeout(Duration::from_millis(500), port.write_all(&probe))
-        .await
-        .context("RNode probe rewrite timed out")?
-        .context("RNode probe rewrite failed")?;
-    seen.clear();
-    if await_detect_resp(&port, &mut buf, &mut seen, PROBE_READ_TIMEOUT).await {
-        return Ok(());
-    }
-    anyhow::bail!(
-        "No RNode DETECT_RESP within {:?} (incl. post-boot-settle retry)",
-        PROBE_READ_TIMEOUT
-    )
-}
-
-/// Read from `port` for up to `window`, accumulating into `seen`; true once
-/// the KISS DETECT_RESP sequence shows up anywhere in the stream.
-async fn await_detect_resp(
-    port: &serial2_tokio::SerialPort,
-    buf: &mut [u8],
-    seen: &mut Vec<u8>,
-    window: Duration,
-) -> bool {
-    let deadline = tokio::time::Instant::now() + window;
-    while tokio::time::Instant::now() < deadline {
-        match tokio::time::timeout(Duration::from_millis(150), port.read(buf)).await {
-            Ok(Ok(n)) if n > 0 => {
-                seen.extend_from_slice(&buf[..n]);
-                if contains_detect_resp(seen) {
-                    return true;
-                }
             }
             _ => continue,
         }
     }
-    false
+    anyhow::bail!("No RNode DETECT_RESP within {:?}", PROBE_READ_TIMEOUT)
 }
 
 /// Look for the `[FEND, CMD_DETECT, DETECT_RESP]` sequence anywhere in the
@@ -1299,33 +1138,6 @@ fn contains_detect_resp(buf: &[u8]) -> bool {
         .any(|w| w == [KISS_FEND, KISS_CMD_DETECT, KISS_DETECT_RESP])
 }
 
-/// The display name an announce actually asserted, if any.
-///
-/// Precedence: the daemon-decoded LXMF display name (`display_name` event
-/// field), then — legacy peers only — bare-utf8 app_data that wasn't an
-/// identity blob. The bare-utf8 fallback must actually look like text:
-/// lossy-decoded msgpack (a new-format announce whose name the daemon failed
-/// to decode) is full of U+FFFD/control chars and would otherwise become a
-/// mojibake display name. `None` (e.g. a blob-only legacy announce) means
-/// "no name asserted" and must NOT stomp a previously-learned name.
-fn pick_announced_name(
-    explicit_name: Option<String>,
-    app_data_text: Option<String>,
-    is_legacy_blob: bool,
-) -> Option<String> {
-    explicit_name
-        // A legacy blob-only announce utf8-decodes cleanly, so LXMF's
-        // display_name_from_app_data hands the daemon the ENTIRE `ARCHY:…`
-        // string as a "name" — seen live from a pre-upgrade Framework PT.
-        // An identity blob is never a display name.
-        .filter(|s| !s.starts_with("ARCHY:"))
-        .or_else(|| {
-            app_data_text
-                .filter(|_| !is_legacy_blob)
-                .filter(|s| !s.chars().any(|c| c.is_control() || c == '\u{FFFD}'))
-        })
-}
-
 impl Drop for ReticulumLink {
     fn drop(&mut self) {
         // Group-wide SIGTERM with a delayed SIGKILL backstop (`terminate_group`).
@@ -1342,37 +1154,6 @@ impl Drop for ReticulumLink {
 mod tests {
     use super::*;
 
-    #[test]
-    fn announced_name_precedence() {
-        // Daemon-decoded LXMF name always wins.
-        assert_eq!(
-            pick_announced_name(
-                Some("RNode Shaza".into()),
-                Some("ARCHY:2:aa:bb".into()),
-                true
-            ),
-            Some("RNode Shaza".to_string())
-        );
-        // Legacy bare-utf8 name (old daemon, no explicit field).
-        assert_eq!(
-            pick_announced_name(None, Some("zaza".into()), false),
-            Some("zaza".to_string())
-        );
-        // Legacy blob-only announce asserts NO name (must not stomp).
-        assert_eq!(
-            pick_announced_name(None, Some("ARCHY:2:aa:bb".into()), true),
-            None
-        );
-        // Lossy-decoded msgpack must not become a mojibake name.
-        assert_eq!(
-            pick_announced_name(None, Some("\u{FFFD}\u{FFFD}Shaza\u{FFFD}".into()), false),
-            None
-        );
-        assert_eq!(pick_announced_name(None, Some("has\u{1}ctl".into()), false), None);
-        // Nothing at all.
-        assert_eq!(pick_announced_name(None, None, false), None);
-    }
-
     #[test]
     fn detect_resp_found_in_kiss_stream() {
         let stream = [

core/archipelago/src/mesh/serial.rs

@@ -58,20 +58,11 @@ impl MeshcoreDevice {
             path
         ))?;
         // See probe_rnode() in reticulum.rs for why: ESP32-S3 native-USB
-        // boards (and CP2102/CH340-bridged boards wired for Arduino-style
-        // auto-reset) reset on a DTR/RTS transition, so deassert both and
-        // settle before the handshake below. 300ms is nowhere near a real
-        // firmware boot time (LoRa radio init alone can take longer) —
-        // confirmed live 2026-07-23: with every one of Reticulum/Meshcore/
-        // Meshtastic's open() doing this same reset, a single auto-detect
-        // cycle trying multiple protocols in sequence kept re-resetting the
-        // board before it ever finished booting from the PREVIOUS attempt's
-        // reset, on both a Heltec V3 and V4, regardless of firmware family —
-        // a self-sustaining "never finishes booting" loop with a boot-time
-        // root cause hiding behind what looked like a per-protocol failure.
+        // boards reset on a DTR/RTS transition, so deassert both and settle
+        // before the handshake below.
         let _ = port.set_dtr(false);
         let _ = port.set_rts(false);
-        tokio::time::sleep(Duration::from_millis(2000)).await;
+        tokio::time::sleep(Duration::from_millis(300)).await;
 
         info!(path = %path, baud = BAUD_RATE, "Opened serial port");
 
@@ -556,40 +547,14 @@ fn likely_non_mesh_serial_device(path: &str) -> bool {
 
 /// Scan for serial devices that could be Meshcore radios.
 /// Returns paths to existing serial device files.
-///
-/// Dedupes by canonical (symlink-resolved) target: `/dev/mesh-radio` is a
-/// stable udev symlink to whatever `/dev/ttyUSB*`/`/dev/ttyACM*` node the
-/// primary radio currently enumerates as, so both names always pointed at
-/// the same candidate list entry and both passed this scan — confirmed live
-/// 2026-07-23, this made an already-connected, working radio (connected via
-/// its `/dev/mesh-radio` alias) simultaneously appear as a second, separate
-/// "detected but unclaimed" device under its raw `/dev/ttyUSBn` name. The
-/// hot-swap UI's active-session guard compares path strings, so it didn't
-/// recognize the two aliases as the same port, showed the "device detected"
-/// modal for a radio that was already set up, and probing it there opened
-/// (and DTR/RTS-reset) the exact port the live session was mid-conversation
-/// with — a continuous, UI-driven reset loop that only ran while that view
-/// was open (matches the reported "stops when I leave, resumes when I come
-/// back"). SERIAL_CANDIDATES lists `/dev/mesh-radio` first, so it wins the
-/// dedup and is what's reported when both alias and target are present.
-/// (Independently re-discovered and fixed on main 2026-07-26 — both sides
-/// of the 2026-07-28 merge carried an equivalent implementation.)
 pub async fn detect_serial_devices() -> Vec<String> {
     let mut devices = Vec::new();
-    let mut seen_real_paths = std::collections::HashSet::new();
     for path in SERIAL_CANDIDATES {
         if tokio::fs::metadata(path).await.is_ok() {
             if likely_non_mesh_serial_device(path) {
                 debug!(path = %path, "Skipping known non-mesh serial device");
                 continue;
             }
-            let real_path = tokio::fs::canonicalize(path)
-                .await
-                .unwrap_or_else(|_| std::path::PathBuf::from(path));
-            if !seen_real_paths.insert(real_path.clone()) {
-                debug!(path = %path, real_path = %real_path.display(), "Skipping duplicate alias for an already-listed device");
-                continue;
-            }
             devices.push(path.to_string());
         }
     }
@@ -620,23 +585,12 @@ pub async fn detect_serial_devices_info() -> Vec<DetectedDeviceInfo> {
     let mut out = Vec::new();
     for path in detect_serial_devices().await {
         let usb = usb_info_for_tty(&path).await;
-        // Birth time (btime), falling back to inode-change time (ctime) —
-        // NOT mtime: a tty node's mtime bumps on every open()/write, so with
-        // mtime here each probe/session open minted a "new" plugged_at, the
-        // UI's (path, plugged_at) dismissal key never matched again, and the
-        // setup modal re-fired forever on a device that never left the port
-        // (observed live on archi-dev-box 2026-07-28). btime/ctime only
-        // change when udev (re)creates/chowns the node — i.e. on real plugs.
-        let plugged_at = tokio::fs::metadata(&path).await.ok().and_then(|m| {
-            m.created()
-                .ok()
-                .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
-                .map(|d| d.as_secs())
-                .or_else(|| {
-                    use std::os::unix::fs::MetadataExt;
-                    u64::try_from(m.ctime()).ok()
-                })
-        });
+        let plugged_at = tokio::fs::metadata(&path)
+            .await
+            .ok()
+            .and_then(|m| m.modified().ok())
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+            .map(|d| d.as_secs());
         out.push(DetectedDeviceInfo {
             path,
             vid: usb.0,

core/archipelago/src/mesh_ports.rs

@@ -1,145 +0,0 @@
-//! Mirror IPv4-published app ports onto IPv6 for mesh access.
-//!
-//! The companion (and anything else on the FIPS mesh) reaches this node at
-//! its fips0 ULA. The web UI builds app links from the current host + each
-//! app's DIRECT port (Direct Port Rule) — but rootless-podman published
-//! ports bind 0.0.0.0 only, so `http://[<ULA>]:8334` was refused for every
-//! catalog app even after nginx :80 learned IPv6 (2026-07-23, third
-//! "the node wasn't listening on v6" bug of the night).
-//!
-//! Instead of touching the container layer (port-publish changes would
-//! recreate every container), a reconcile loop mirrors the host's public
-//! IPv4 listeners: any port ≥1024 listening on 0.0.0.0 without an IPv6
-//! any-address listener gets a v6-only `[::]:<port>` forwarder to
-//! `127.0.0.1:<port>`. Ports appear/disappear with app install/remove, so
-//! the mirror follows `/proc/net/tcp*` rather than the catalog — companion
-//! containers with hardcoded ports (bitcoin-ui :8334) are covered the same
-//! as manifest-declared ones. Nothing is exposed that IPv4 didn't already
-//! expose to the LAN; the ULA is the established remote-access surface.
-
-use std::collections::{HashMap, HashSet};
-use std::net::{Ipv6Addr, SocketAddrV6};
-use std::time::Duration;
-
-use anyhow::{Context, Result};
-use tokio::task::JoinHandle;
-use tracing::{debug, info, warn};
-
-const RECONCILE_INTERVAL: Duration = Duration::from_secs(15);
-/// Never mirror system ports; nginx (80/443) handles its own v6 listeners.
-const MIN_PORT: u16 = 1024;
-
-/// Entry point — spawned from main; runs for the process lifetime.
-pub async fn run_mesh_port_mirror() {
-    let mut active: HashMap<u16, JoinHandle<()>> = HashMap::new();
-    loop {
-        match reconcile(&mut active).await {
-            Ok(()) => {}
-            Err(e) => debug!("mesh-ports: reconcile skipped: {e:#}"),
-        }
-        tokio::time::sleep(RECONCILE_INTERVAL).await;
-    }
-}
-
-async fn reconcile(active: &mut HashMap<u16, JoinHandle<()>>) -> Result<()> {
-    let v4 = listening_ports("/proc/net/tcp", 8).await?;
-    let v6 = listening_ports("/proc/net/tcp6", 32).await?;
-
-    // Drop mirrors whose backing IPv4 listener vanished (app removed/stopped).
-    active.retain(|port, handle| {
-        if v4.contains(port) && !handle.is_finished() {
-            true
-        } else {
-            handle.abort();
-            info!("mesh-ports: released [::]:{port} (backing 0.0.0.0 listener gone)");
-            false
-        }
-    });
-
-    for port in v4 {
-        if port < MIN_PORT || active.contains_key(&port) {
-            continue;
-        }
-        // A foreign IPv6 any-listener already serves this port (our own
-        // mirrors are excluded above via `active`).
-        if v6.contains(&port) {
-            continue;
-        }
-        match spawn_forwarder(port) {
-            Ok(handle) => {
-                info!("mesh-ports: mirroring [::]:{port} -> 127.0.0.1:{port}");
-                active.insert(port, handle);
-            }
-            Err(e) => debug!("mesh-ports: cannot mirror port {port}: {e:#}"),
-        }
-    }
-    Ok(())
-}
-
-/// Ports in LISTEN state bound to the any-address, parsed from /proc/net/tcp
-/// (`addr_hex_len` 8) or /proc/net/tcp6 (32).
-async fn listening_ports(path: &str, addr_hex_len: usize) -> Result<HashSet<u16>> {
-    let raw = tokio::fs::read_to_string(path)
-        .await
-        .with_context(|| format!("read {path}"))?;
-    let any_addr = "0".repeat(addr_hex_len);
-    let mut ports = HashSet::new();
-    for line in raw.lines().skip(1) {
-        let mut cols = line.split_whitespace();
-        let (Some(_sl), Some(local), Some(_rem), Some(state)) =
-            (cols.next(), cols.next(), cols.next(), cols.next())
-        else {
-            continue;
-        };
-        if state != "0A" {
-            continue; // not LISTEN
-        }
-        let Some((addr, port_hex)) = local.split_once(':') else {
-            continue;
-        };
-        if addr != any_addr {
-            continue;
-        }
-        if let Ok(port) = u16::from_str_radix(port_hex, 16) {
-            ports.insert(port);
-        }
-    }
-    Ok(ports)
-}
-
-/// A v6-only listener on [::]:port forwarding each connection to 127.0.0.1:port.
-fn spawn_forwarder(port: u16) -> Result<JoinHandle<()>> {
-    use socket2::{Domain, Protocol, Socket, Type};
-    let socket =
-        Socket::new(Domain::IPV6, Type::STREAM, Some(Protocol::TCP)).context("create v6 socket")?;
-    // v6only so we coexist with the app's own 0.0.0.0:<port> bind.
-    socket.set_only_v6(true).context("set v6only")?;
-    socket.set_reuse_address(true).ok();
-    socket.set_nonblocking(true).context("set nonblocking")?;
-    let addr = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, port, 0, 0);
-    socket.bind(&addr.into()).context("bind [::]")?;
-    socket.listen(128).context("listen")?;
-    let listener =
-        tokio::net::TcpListener::from_std(socket.into()).context("register with tokio")?;
-
-    Ok(tokio::spawn(async move {
-        loop {
-            let (mut inbound, _peer) = match listener.accept().await {
-                Ok(conn) => conn,
-                Err(e) => {
-                    warn!("mesh-ports: accept failed on [::]:{port}: {e}");
-                    tokio::time::sleep(Duration::from_millis(500)).await;
-                    continue;
-                }
-            };
-            tokio::spawn(async move {
-                match tokio::net::TcpStream::connect(("127.0.0.1", port)).await {
-                    Ok(mut upstream) => {
-                        let _ = tokio::io::copy_bidirectional(&mut inbound, &mut upstream).await;
-                    }
-                    Err(e) => debug!("mesh-ports: upstream 127.0.0.1:{port} refused: {e}"),
-                }
-            });
-        }
-    }))
-}

core/archipelago/src/network/dwn_sync.rs

@@ -134,7 +134,6 @@ pub async fn sync_with_peers(data_dir: &Path, peer_onions: &[String]) -> Result<
         for onion in &unique_onions {
             let fips_npub = crate::federation::fips_npub_for_onion(data_dir, onion).await;
             match sync_single_peer(
-                data_dir,
                 fips_npub.as_deref(),
                 &store,
                 onion,
@@ -174,7 +173,6 @@ pub async fn sync_with_peers(data_dir: &Path, peer_onions: &[String]) -> Result<
 /// Sync with a single peer: pull their messages and push ours.
 /// Each HTTP call picks FIPS when a npub is known, otherwise Tor.
 async fn sync_single_peer(
-    data_dir: &Path,
     fips_npub: Option<&str>,
     store: &crate::network::dwn_store::DwnStore,
     onion: &str,
@@ -188,8 +186,6 @@ async fn sync_single_peer(
     let (health_resp, _) = PeerRequest::new(fips_npub, onion, "/dwn/health")
         .service(crate::settings::transport::PeerService::Federation)
         .timeout(std::time::Duration::from_secs(30))
-        .fips_timeout(std::time::Duration::from_secs(6))
-        .record_transport(data_dir)
         .send_get()
         .await
         .context("Peer DWN unreachable")?;
@@ -215,8 +211,6 @@ async fn sync_single_peer(
     let (pull_res, _) = PeerRequest::new(fips_npub, onion, "/dwn")
         .service(crate::settings::transport::PeerService::Federation)
         .timeout(std::time::Duration::from_secs(30))
-        .fips_timeout(std::time::Duration::from_secs(6))
-        .record_transport(data_dir)
         .send_json(&pull_body)
         .await
         .context("Failed to query peer DWN")?;
@@ -275,8 +269,6 @@ async fn sync_single_peer(
         match PeerRequest::new(fips_npub, onion, "/dwn")
             .service(crate::settings::transport::PeerService::Federation)
             .timeout(std::time::Duration::from_secs(30))
-            .fips_timeout(std::time::Duration::from_secs(6))
-            .record_transport(data_dir)
             .send_json(&push_body)
             .await
         {

core/archipelago/src/node_message.rs

@@ -342,9 +342,6 @@ pub async fn send_to_peer(
     signing_key: Option<&ed25519_dalek::SigningKey>,
     recipient_pubkey: Option<&str>,
     from_name: Option<&str>,
-    // Federation data dir for last-transport recording; None skips recording
-    // (callers without a data dir in scope).
-    record_data_dir: Option<&std::path::Path>,
 ) -> Result<()> {
     validate_onion(onion)?;
 
@@ -373,15 +370,10 @@ pub async fn send_to_peer(
         body["from_name"] = serde_json::Value::String(name.to_string());
     }
 
-    let mut req =
+    let (resp, transport) =
         crate::fips::dial::PeerRequest::new(fips_npub, onion, "/archipelago/node-message")
             .service(crate::settings::transport::PeerService::Messaging)
             .timeout(std::time::Duration::from_secs(60))
-            .fips_timeout(std::time::Duration::from_secs(8));
-    if let Some(dir) = record_data_dir {
-        req = req.record_transport(dir);
-    }
-    let (resp, transport) = req
             .send_json(&body)
             .await
             .map_err(|e| {
@@ -418,7 +410,6 @@ pub async fn check_peer_reachable(onion: &str, fips_npub: Option<&str>) -> Resul
         // circuit that hasn't answered /health in 12s is "offline" for UI
         // purposes; the old 30s made the Connected Nodes probes crawl.
         .timeout(std::time::Duration::from_secs(12))
-        .fips_timeout(std::time::Duration::from_secs(4))
         .send_get()
         .await
     {

core/archipelago/src/server.rs

@@ -294,13 +294,8 @@ impl Server {
                         .await
                         .unwrap_or_default();
 
-                    // Auto-enable mesh if a radio is detected and no config exists
-                    // yet. Only on a genuinely missing config: an existing file
-                    // with enabled=false is an explicit operator decision (e.g.
-                    // via mesh.configure) and force-re-enabling it on every boot
-                    // made "disable mesh" impossible on any node with a radio
-                    // plugged in.
-                    if !mesh_config.enabled && !crate::mesh::config_file_exists(&data_dir) {
+                    // Auto-enable mesh if a radio is detected and no config exists yet
+                    if !mesh_config.enabled {
                         let devices = crate::mesh::detect_devices().await;
                         if !devices.is_empty() {
                             info!("📡 Auto-detected mesh radio: {:?} — enabling mesh", devices);
@@ -438,18 +433,8 @@ impl Server {
                         ),
                     ));
 
-                    // LAN transport (mDNS discovery). Advertise our FIPS npub in
-                    // the TXT record so co-located peers can form a direct FIPS
-                    // link (see `lan_fips_anchors`).
-                    let local_fips_npub = crate::identity::fips_npub(&data_dir.join("identity"))
-                        .await
-                        .unwrap_or(None);
-                    let mut lan = crate::transport::lan::LanTransport::new(
-                        &did,
-                        &pubkey_hex,
-                        5678,
-                        local_fips_npub,
-                    );
+                    // LAN transport (mDNS discovery)
+                    let mut lan = crate::transport::lan::LanTransport::new(&did, &pubkey_hex, 5678);
                     match lan.start(registry.clone()) {
                         Ok(()) => info!("📡 LAN transport (mDNS) started"),
                         Err(e) => debug!("LAN transport init (non-fatal): {}", e),
@@ -768,25 +753,12 @@ impl Server {
                     // (often flaky) global anchor's spanning tree to route to each
                     // other. For every peer the registry knows both a LAN address
                     // AND a FIPS npub for, dial it on its FIPS UDP transport port
-                    // at its LAN IP. This is FIPS's own transport over the
+                    // (8668) at its LAN IP. This is FIPS's own transport over the
                     // LAN — NOT Tailscale, NOT the HTTP/LAN messaging port. Pure
                     // FIPS. `fipsctl connect` is idempotent, so re-applying every
                     // tick just keeps the direct link warm; unknown/remote peers
                     // (no LAN address) are left to the anchor as before.
                     if let Some(reg) = fips_peer_registry.as_ref() {
-                        // Hydrate FIPS npubs into the registry from federation
-                        // storage (did-keyed). Peers discovered before the mDNS
-                        // TXT `fips` key existed — or running builds that don't
-                        // advertise it yet — would otherwise never satisfy the
-                        // `fips_npub` requirement in lan_fips_anchors(), leaving
-                        // direct LAN peering a no-op.
-                        if let Ok(nodes) = crate::federation::load_nodes(&data_dir).await {
-                            for n in &nodes {
-                                if let Some(npub) = n.fips_npub.as_deref() {
-                                    reg.set_fips_npub(&n.did, npub).await;
-                                }
-                            }
-                        }
                         let direct = crate::fips::anchors::lan_fips_anchors(&reg.all_peers().await);
                         if !direct.is_empty() {
                             let _ = crate::fips::anchors::apply(&direct).await;
@@ -919,7 +891,7 @@ impl Server {
         // Post-onboarding auto-activation for archipelago-fips. Runs once
         // at startup: if fips_key is on disk, install /etc/fips/fips.yaml
         // (schema-refreshed) and start the service. This removes the
-        // need for a user-facing manual Start button — the node comes up
+        // need for a user-facing "Activate" button — the node comes up
         // with FIPS running whenever the seed has been onboarded. Also
         // self-heals legacy raw-byte fips.key files (load_fips_keys
         // rewrites them as bech32 nsec the first time they're read).
@@ -968,16 +940,14 @@ impl Server {
                         );
                     }
                 }
-                let unit = crate::fips::service::activation_unit().await;
-                if let Err(e) = crate::fips::service::activate(unit).await {
+                if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await {
                     tracing::warn!(
-                        "FIPS activate failed on startup via {}: {} — user can retry via fips.install RPC",
-                        unit,
+                        "archipelago-fips activate failed on startup: {} — user can retry via fips.install RPC",
                         e
                     );
                     return;
                 }
-                tracing::info!("FIPS auto-activated on startup via {}", unit);
+                tracing::info!("archipelago-fips auto-activated on startup");
             });
         }
 
@@ -1018,55 +988,8 @@ impl Server {
             main_addr,
         ));
 
-        // The mesh is IPv6-only: a phone reaching the node over its fips0
-        // ULA lands on port 80 over v6, where a 0.0.0.0 listener never
-        // answers — the UI was structurally unreachable over the mesh
-        // (RST -> ERR_CONNECTION_ABORTED, confirmed 2026-07-26: v4:80 = 200,
-        // v6:80 = refused). Mirror an IPv4-any main listener with a
-        // V6ONLY [::] socket on the same port — v6-only so it coexists
-        // with the v4 listener regardless of net.ipv6.bindv6only.
-        let v4_any_port = match main_addr {
-            SocketAddr::V4(v4) if v4.ip().is_unspecified() => Some(v4.port()),
-            _ => None,
-        };
-        let v6_task = if let Some(port) = v4_any_port {
-            let v6_addr =
-                SocketAddr::new(std::net::IpAddr::V6(std::net::Ipv6Addr::UNSPECIFIED), port);
-            match bind_v6_only(v6_addr) {
-                Ok(listener) => {
-                    info!("IPv6 web listener bound {} (mesh ULA reachable)", v6_addr);
-                    Some(tokio::spawn(accept_loop(
-                        self.api_handler.clone(),
-                        listener,
-                        active_connections.clone(),
-                        false, // same semantics as the main listener
-                        tx.subscribe(),
-                        v6_addr,
-                    )))
-                }
-                Err(e) => {
-                    warn!(
-                        "IPv6 web listener bind {} failed: {} — UI stays v4-only",
-                        v6_addr, e
-                    );
-                    None
-                }
-            }
-        } else {
-            None
-        };
-
         // Peer listener: late-binding so we don't need an archipelago
         // restart when fips0 comes up after onboarding.
-        // App UIs over the mesh: rootless podman's port forwarder binds
-        // IPv4 only for most apps, so a phone dialing [ULA]:8123 got
-        // nothing even with the firewall open (HA/FileBrowser/Gitea/
-        // Portainer/Pine all v4-only on 2026-07-26; a few bind [::]
-        // themselves). Bridge each catalog launch port on the fips0 ULA
-        // only. Binding wildcard [::]:port reserves the same host ports
-        // Podman needs and can restart-loop apps that publish those ports.
-        let relay_task = tokio::spawn(app_port_v6_relay_loop(tx.subscribe()));
-
         let peer_task = tokio::spawn(peer_late_bind_loop(
             self.api_handler.clone(),
             active_connections.clone(),
@@ -1089,10 +1012,6 @@ impl Server {
         }
 
         let _ = main_task.await;
-        if let Some(t) = v6_task {
-            let _ = t.await;
-        }
-        relay_task.abort();
         let _ = peer_task.await;
 
         info!("Shutdown complete");
@@ -1100,100 +1019,6 @@ impl Server {
     }
 }
 
-/// Bind a V6ONLY `[::]` TCP listener. V6ONLY is set explicitly so the
-/// socket never claims the IPv4 side (which the main listener owns) —
-/// without it, Linux hosts with `net.ipv6.bindv6only=0` would fail with
-/// EADDRINUSE.
-fn bind_v6_only(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
-    let socket = socket2::Socket::new(
-        socket2::Domain::IPV6,
-        socket2::Type::STREAM,
-        Some(socket2::Protocol::TCP),
-    )?;
-    socket.set_only_v6(true)?;
-    socket.set_reuse_address(true)?;
-    socket.set_nonblocking(true)?;
-    socket.bind(&addr.into())?;
-    socket.listen(1024)?;
-    tokio::net::TcpListener::from_std(socket.into())
-}
-
-fn fips_app_relay_addr(ip: std::net::Ipv6Addr, port: u16) -> SocketAddr {
-    SocketAddr::new(std::net::IpAddr::V6(ip), port)
-}
-
-/// IPv6→IPv4 relay for catalog app launch ports (see the spawn site for
-/// why). Rescans every 60s so ports of freshly installed apps get bridged
-/// without a daemon restart. Each relay binds to the fips0 ULA only and
-/// forwards raw TCP to the same port on IPv4 loopback.
-async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bool>) {
-    use std::collections::HashSet;
-    let mut bridged: HashSet<u16> = HashSet::new();
-    let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
-    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-    loop {
-        tokio::select! {
-            _ = interval.tick() => {
-                let Some(fips_ip) = crate::fips::iface::fips0_ula() else { continue };
-                for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {
-                    if bridged.contains(&port) {
-                        continue;
-                    }
-                    // ONLY bridge a port that a running app already answers on
-                    // over IPv4. Binding [::]:port for an app that isn't
-                    // installed is actively harmful: it makes that app's
-                    // later install hit "address already in use", and the
-                    // install's port-free step (`fuser -k <port>/tcp`) then
-                    // kills THIS daemon, which holds the port — the exact
-                    // cause of installs failing + apps vanishing on
-                    // framework-pt 2026-07-27. No v4 listener → skip; the
-                    // next rescan picks it up once the app is up.
-                    let v4_up = tokio::time::timeout(
-                        std::time::Duration::from_millis(300),
-                        tokio::net::TcpStream::connect(("127.0.0.1", port)),
-                    )
-                    .await
-                    .ok()
-                    .and_then(|r| r.ok())
-                    .is_some();
-                    if !v4_up {
-                        continue;
-                    }
-                    let addr = fips_app_relay_addr(fips_ip, port);
-                    // EADDRINUSE = fipsd or another process already answers
-                    // on this mesh address/port, so stay out of the way.
-                    let Ok(listener) = bind_v6_only(addr) else { continue };
-                    bridged.insert(port);
-                    debug!("v6 relay bridging [{fips_ip}]:{port} -> 127.0.0.1:{port}");
-                    let mut rx = shutdown_rx.clone();
-                    tokio::spawn(async move {
-                        loop {
-                            tokio::select! {
-                                accepted = listener.accept() => {
-                                    let Ok((mut inbound, _)) = accepted else { break };
-                                    tokio::spawn(async move {
-                                        let Ok(mut outbound) = tokio::net::TcpStream::connect(
-                                            ("127.0.0.1", port),
-                                        )
-                                        .await else { return };
-                                        let _ = tokio::io::copy_bidirectional(
-                                            &mut inbound,
-                                            &mut outbound,
-                                        )
-                                        .await;
-                                    });
-                                }
-                                _ = rx.changed() => break,
-                            }
-                        }
-                    });
-                }
-            }
-            _ = shutdown_rx.changed() => return,
-        }
-    }
-}
-
 /// Poll every 30s for `fips0`'s ULA; when it appears, bind the peer
 /// listener and run the normal accept loop. If the bind fails (port
 /// already taken, permissions), log and keep retrying. Returns on
@@ -1222,36 +1047,18 @@ async fn peer_late_bind_loop(
                     }
                 };
                 info!("FIPS peer listener bound {}", addr);
-                // Serve until shutdown, a persistent accept failure, or a
-                // fips0 ULA change. The listener must be REBINDABLE: a
-                // daemon re-key tears fips0 down and brings it back with a
-                // (possibly different) ULA, and the old one-shot bind left
-                // the node inbound-dead over FIPS until process restart.
-                tokio::select! {
-                    _ = accept_loop(
-                        handler.clone(),
-                        listener,
-                        active_connections.clone(),
-                        true, // peer listener: apply path filter
-                        shutdown_rx.clone(),
-                        addr,
-                    ) => {
-                        if *shutdown_rx.borrow() { return; }
-                        warn!("FIPS peer accept loop ended — rebinding");
-                    }
-                    _ = async {
-                        loop {
-                            tokio::time::sleep(std::time::Duration::from_secs(30)).await;
-                            if crate::fips::iface::fips0_ula() != Some(ip) {
-                                break;
-                            }
-                        }
-                    } => {
-                        info!("fips0 ULA changed — rebinding FIPS peer listener");
-                        // Dropping the select arm cancels accept_loop and
-                        // frees the socket; the outer loop rebinds fresh.
-                    }
-                }
+                // Once bound, serve until shutdown fires. accept_loop
+                // returns on shutdown, which also ends this outer loop.
+                accept_loop(
+                    handler,
+                    listener,
+                    active_connections,
+                    true, // peer listener: apply path filter
+                    shutdown_rx,
+                    addr,
+                )
+                .await;
+                return;
             }
             _ = shutdown_rx.changed() => {
                 if *shutdown_rx.borrow() { return; }
@@ -1287,12 +1094,6 @@ pub fn is_peer_allowed_path(path: &str) -> bool {
     )
     // Prefix-matched content endpoints (peer file browse + fetch)
         || path.starts_with("/content/")
-        // Mesh file sharing — blob fetch by CID, signature-gated in the
-        // handler. Absent from this list it 404'd over FIPS and the feature
-        // was 100% Tor by construction.
-        || path.starts_with("/blob/")
-        // DWN sync — /dwn/health is step 1 of every sync; same story.
-        || path.starts_with("/dwn/")
 }
 
 async fn accept_loop(
@@ -1303,70 +1104,22 @@ async fn accept_loop(
     mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
     local_addr: SocketAddr,
 ) {
-    // Consecutive accept-error tracking: a fips0 teardown/re-key leaves the
-    // peer listener's socket permanently broken — `continue`-ing forever
-    // made the node inbound-dead over FIPS until process restart. After a
-    // burst of consecutive errors the peer accept loop returns so its
-    // caller (peer_late_bind_loop) can rebind on the current ULA.
-    let mut consecutive_errors: u32 = 0;
     loop {
         tokio::select! {
             result = listener.accept() => {
                 let (stream, peer_addr) = match result {
-                    Ok(c) => { consecutive_errors = 0; c }
+                    Ok(c) => c,
                     Err(e) => {
                         error!("{} accept error: {}", local_addr, e);
-                        consecutive_errors += 1;
-                        if peer_only && consecutive_errors >= 10 {
-                            warn!("{} accept failing persistently — returning for rebind", local_addr);
-                            return;
-                        }
-                        // Don't hot-loop on a dead socket.
-                        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
                         continue;
                     }
                 };
                 let handler = handler.clone();
-                // NEVER park the accept loop on the connection budget.
-                // `acquire_owned().await` here froze accept() entirely when
-                // permits drained — and permits drained because half-open
-                // clients and hung upstreams held them forever (the .228
-                // session-flapping / CLOSE-WAIT `inode: 0` signature). Shed
-                // load instead: accept, answer 503, close.
-                let permit = match active_connections.clone().try_acquire_owned() {
-                    Ok(p) => p,
-                    Err(_) => {
-                        warn!(
-                            "{} connection budget exhausted — shedding {}",
-                            local_addr, peer_addr
-                        );
-                        tokio::spawn(async move {
-                            use tokio::io::AsyncWriteExt;
-                            let mut stream = stream;
-                            let _ = tokio::time::timeout(
-                                std::time::Duration::from_secs(5),
-                                stream.write_all(
-                                    b"HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\nContent-Length: 0\r\n\r\n",
-                                ),
-                            )
-                            .await;
-                            let _ = stream.shutdown().await;
-                        });
-                        continue;
-                    }
-                };
+                let permit = active_connections.clone().acquire_owned().await;
                 tokio::spawn(async move {
                     let _permit = permit;
-                    // Set when a request carries an Upgrade header (websocket):
-                    // upgraded connections are legitimately long-lived and are
-                    // exempt from the non-upgraded connection deadline below.
-                    let upgraded = Arc::new(std::sync::atomic::AtomicBool::new(false));
-                    let upgraded_flag = upgraded.clone();
                     let service = service_fn(move |mut req: hyper::Request<hyper::Body>| {
                         let handler = handler.clone();
-                        if req.headers().contains_key(hyper::header::UPGRADE) {
-                            upgraded_flag.store(true, std::sync::atomic::Ordering::Relaxed);
-                        }
                         async move {
                             // Record the TCP peer so rate limiting only trusts
                             // forwarded headers on loopback (nginx) connections.
@@ -1385,48 +1138,13 @@ async fn accept_loop(
                                 .map_err(|e| std::io::Error::other(format!("{}", e)))
                         }
                     });
-                    // header_read_timeout: a client that connects and never
-                    // sends a request (slowloris / half-open) is dropped
-                    // instead of holding a permit until the heat death of the
-                    // node. Long RPCs are safe — the clock only covers header
-                    // read.
-                    let conn = Http::new()
+                    if let Err(e) = Http::new()
                         .http1_keep_alive(false)
-                        .http1_header_read_timeout(std::time::Duration::from_secs(30))
                         .serve_connection(stream, service)
-                        .with_upgrades();
-                    tokio::pin!(conn);
-                    // Deadline watchdog for NON-upgraded connections. With
-                    // keep-alive off a plain connection serves one exchange;
-                    // 15 min bounds even the slowest legitimate RPC/stream
-                    // while guaranteeing a hung upstream can't hold a permit
-                    // forever. Upgraded (websocket) connections are exempt.
-                    const NON_UPGRADED_DEADLINE: std::time::Duration =
-                        std::time::Duration::from_secs(900);
-                    let started = std::time::Instant::now();
-                    let watchdog = async {
-                        loop {
-                            tokio::time::sleep(std::time::Duration::from_secs(30)).await;
-                            if !upgraded.load(std::sync::atomic::Ordering::Relaxed)
-                                && started.elapsed() >= NON_UPGRADED_DEADLINE
-                            {
-                                return;
-                            }
-                        }
-                    };
-                    tokio::select! {
-                        r = &mut conn => {
-                            if let Err(e) = r {
-                                error!("Error serving connection from {}: {}", peer_addr, e);
-                            }
-                        }
-                        _ = watchdog => {
-                            warn!(
-                                "connection from {} exceeded {}s without completing or upgrading — dropping",
-                                peer_addr,
-                                NON_UPGRADED_DEADLINE.as_secs()
-                            );
-                        }
+                        .with_upgrades()
+                        .await
+                    {
+                        error!("Error serving connection from {}: {}", peer_addr, e);
                     }
                 });
             }
@@ -2079,25 +1797,10 @@ mod merge_tests {
         );
         assert!(is_peer_allowed_path("/rpc/v1"));
         assert!(is_peer_allowed_path("/health"));
-        // Mesh blob fetch + DWN sync — both were missing from the allowlist,
-        // which made them deterministically 404 over FIPS and therefore
-        // 100% Tor by construction.
-        assert!(is_peer_allowed_path("/blob/abc123"), "blob fetch by CID");
-        assert!(is_peer_allowed_path("/dwn/health"), "DWN sync step 1");
         // Not on the allow-list → rejected (no broad surface over the mesh).
         assert!(!is_peer_allowed_path("/contention"), "must not prefix-leak");
         assert!(!is_peer_allowed_path("/"));
         assert!(!is_peer_allowed_path("/rpc/v2"));
-        assert!(!is_peer_allowed_path("/blobber"), "must not prefix-leak");
-        assert!(!is_peer_allowed_path("/dwnx"), "must not prefix-leak");
-    }
-
-    #[test]
-    fn app_relay_binds_to_fips_ula_not_wildcard() {
-        let ula = "fd12:3456:789a::1".parse().unwrap();
-        let addr = fips_app_relay_addr(ula, 8083);
-        assert_eq!(addr.ip(), std::net::IpAddr::V6(ula));
-        assert_eq!(addr.port(), 8083);
     }
 
     #[test]

core/archipelago/src/transport/lan.rs

@@ -24,27 +24,17 @@ pub struct LanTransport {
     our_did: String,
     our_pubkey_hex: String,
     our_port: u16,
-    /// This node's FIPS npub, advertised in the mDNS TXT record so
-    /// co-located peers can form a direct FIPS link (`lan_fips_anchors`)
-    /// without waiting for federation storage to sync.
-    our_fips_npub: Option<String>,
     daemon: Option<ServiceDaemon>,
     available: AtomicBool,
 }
 
 impl LanTransport {
     /// Create a new LAN transport. Does not start discovery yet.
-    pub fn new(
-        our_did: &str,
-        our_pubkey_hex: &str,
-        port: u16,
-        our_fips_npub: Option<String>,
-    ) -> Self {
+    pub fn new(our_did: &str, our_pubkey_hex: &str, port: u16) -> Self {
         Self {
             our_did: our_did.to_string(),
             our_pubkey_hex: our_pubkey_hex.to_string(),
             our_port: port,
-            our_fips_npub,
             daemon: None,
             available: AtomicBool::new(false),
         }
@@ -57,14 +47,11 @@ impl LanTransport {
 
         // Advertise our service
         let hostname = format!("archy-{}.local.", &self.our_pubkey_hex[..8]);
-        let mut properties = vec![
+        let properties = vec![
             ("did".to_string(), self.our_did.clone()),
             ("pubkey".to_string(), self.our_pubkey_hex.clone()),
             ("version".to_string(), "0.1.0".to_string()),
         ];
-        if let Some(npub) = &self.our_fips_npub {
-            properties.push(("fips".to_string(), npub.clone()));
-        }
 
         let service_info = ServiceInfo::new(
             SERVICE_TYPE,
@@ -106,11 +93,6 @@ impl LanTransport {
                             .map(|v| v.val_str().to_string());
                         let addresses = info.get_addresses();
 
-                        let fips_npub = info
-                            .get_properties()
-                            .get("fips")
-                            .map(|v| v.val_str().to_string());
-
                         if let (Some(did), Some(pubkey)) = (did, pubkey) {
                             if let Some(scoped_ip) = addresses.iter().next() {
                                 let ip: std::net::IpAddr = match scoped_ip.to_string().parse() {
@@ -124,9 +106,6 @@ impl LanTransport {
                                     .await;
                                 registry_clone.set_lan_address(&did, socket_addr).await;
                                 registry_clone.set_name(&did, info.get_fullname()).await;
-                                if let Some(npub) = fips_npub.as_deref() {
-                                    registry_clone.set_fips_npub(&did, npub).await;
-                                }
                             }
                         }
                     }

core/archipelago/src/transport/mod.rs

@@ -106,7 +106,7 @@ pub enum PeerSource {
 }
 
 /// Unified peer record with per-transport capabilities.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PeerRecord {
     pub did: String,
     pub pubkey_hex: String,

core/archipelago/src/update.rs

@@ -1868,38 +1868,13 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
     // UI before systemd kills us. --no-block makes sure systemctl doesn't
     // try to wait for the current service (us) to exit cleanly before
     // starting the new process — it would deadlock otherwise.
-    // PID1-owned timer transient: submit NOW (synchronously, while we are
-    // definitely alive), fire in 2s from systemd itself. The old approach —
-    // tokio sleep + `systemd-run --wait -- systemctl --no-block restart` —
-    // ran as a child of the process being stopped; on v1.7.114->115 the
-    // stop landed but the start never fired and the node sat dead all
-    // night. A timer unit owned by PID1 cannot be killed by our own death,
-    // and Restart=always on the unit is the second net.
-    let submitted = tokio::process::Command::new("sudo")
-        .args([
-            "systemd-run",
-            "--collect",
-            "--on-active=2",
-            "--timer-property=AccuracySec=100ms",
-            "--",
-            "systemctl",
-            "restart",
-            "archipelago",
-        ])
-        .status()
-        .await;
-    match submitted {
-        Ok(st) if st.success() => {}
-        other => {
-            tracing::warn!(
-                "detached restart submission failed ({other:?}) — falling back to in-process restart"
-            );
-            tokio::spawn(async {
-                tokio::time::sleep(std::time::Duration::from_secs(2)).await;
-                let _ = host_sudo(&["systemctl", "--no-block", "restart", "archipelago"]).await;
-            });
-        }
-    }
+    tokio::spawn(async {
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        // systemctl talks to PID 1 over D-Bus — doesn't need the host
+        // mount namespace, but routing through host_sudo keeps the
+        // apply flow's sudo calls uniform.
+        let _ = host_sudo(&["systemctl", "--no-block", "restart", "archipelago"]).await;
+    });
 
     Ok(())
 }

core/archipelago/src/wallet/ecash.rs

@@ -632,30 +632,11 @@ pub async fn send_token_at(data_dir: &Path, mint_url: &str, amount_sats: u64) ->
         // Mark original proofs as spent
         wallet.mark_spent(&indices);
 
-        // Separate send proofs from change proofs BY COUNT, not membership:
-        // partition(contains) put EVERY proof whose denomination appeared in
-        // send_denoms into the token — when change shared a denomination with
-        // the send (worst case: spending from a proof worth exactly 2× the
-        // amount, send [n] + change [n]), the change proofs rode along and the
-        // receiver was credited double. Consume exactly one proof per needed
-        // send denomination; everything else is change.
-        let mut send_needed = send_denoms.clone();
-        let mut send: Vec<Proof> = Vec::new();
-        let mut change: Vec<Proof> = Vec::new();
-        for p in swap_result.new_proofs {
-            if let Some(pos) = send_needed.iter().position(|&d| d == p.amount) {
-                send_needed.swap_remove(pos);
-                send.push(p);
-            } else {
-                change.push(p);
-            }
-        }
-        if !send_needed.is_empty() {
-            anyhow::bail!(
-                "Mint swap returned incomplete send denominations (missing {:?})",
-                send_needed
-            );
-        }
+        // Separate send proofs from change proofs
+        let (send, change): (Vec<_>, Vec<_>) = swap_result
+            .new_proofs
+            .into_iter()
+            .partition(|p| send_denoms.contains(&p.amount));
 
         // Add change proofs back to wallet
         if !change.is_empty() {

demo/content/README.md

@@ -1,9 +0,0 @@
-# Demo Content Provenance
-
-All media in `demo/content/` and `demo/peer-media/` — music tracks, photos,
-book covers, posters, and documents — are original works created and owned by
-the Archipelago project author (Dorian), included here as demo content and
-released with the project under the repository MIT license.
-
-None of this content is sourced from third-party stock libraries or
-commercial catalogs.

docs/FIPS-UPTIME-AND-UI-STATE-PLAN.md

@@ -1,300 +0,0 @@
-# FIPS near-100% uptime + optimistic UI state — implementation plan
-
-**Date:** 2026-07-27. **Status:** researched + root-caused live on the fleet; ready to
-implement for the next release. Two workstreams: (A) make node↔node FIPS transport
-succeed whenever a FIPS path physically exists, (B) stop the UI reloading everything
-on every navigation (optimistic/cached cards, stale-while-revalidate) while keeping
-data fresh.
-
-**Honesty note on "100%":** if a node's network blackholes every anchor (the .116
-WiFi case, `docs/HANDOFF-2026-07-20-fips-peer-files.md:117-133`), Tor fallback is
-*correct*. The achievable target is: **FIPS wins whenever a FIPS path exists, and
-fallback frequency is measured in-product so regressions are visible.** Today several
-paths are 0% FIPS *by construction* regardless of network health — that's the bug.
-
----
-
-## Part A — why Cloud/FIPS "commonly falls back to Tor": ranked root causes
-
-All verified live on 2026-07-27 (.116 local, .198, .228, Framework PT, x250s) plus a
-full code audit of `core/archipelago/src/{fips,transport,federation,server.rs}`.
-
-### RC0 — 🔥 The hardening firewall drops the peer-API port on every hardened node (PROVEN)
-
-The fips0 default-deny baseline (`/etc/fips/fips.nft`) is opened by archipelago's
-drop-in `80-web-ui.nft` (`fips/config.rs:236-255`) for **80 + 8443 + app ports only**.
-The peer-API listener — which carries *all* federation sync, cloud browse/download,
-mesh envelopes, DWN, invoices — is **`PEER_PORT = 5679`** (`fips/dial.rs:35`).
-**5679 is not in the allowlist.** The drop-in's own comment claims "web UI + peer
-API" but the peer API port was never added.
-
-Live proof (2026-07-27):
-- .116 nft chain: 5,965 dropped packets; .198: **28,670 dropped packets** — that's
-  peers' FIPS dials dying at the firewall.
-- .198 → .116 `GET :5679/health`: **timeout (6s)** before; **HTTP 200 in 0.35s**
-  after `nft insert rule inet fips inbound iifname fips0 tcp dport 5679 accept`.
-  Same result in reverse direction (200 in 0.64s).
-- Explains the exact fleet split in `federation/nodes.json`: hardened-baseline nodes
-  (Framework PT, .198, .228, x250-dev, x250-mad2) = `last_transport: tor`;
-  non-hardened nodes (Austin Sapien, X250-Beta, X250-PA) answer :5679 (404 from the
-  path allowlist = listener reachable) = `last_transport: fips`.
-- Every dial to a hardened peer pays the 8s FIPS connect timeout
-  (`dial.rs:114`) ×2 (retry, `dial.rs:128-140`) → then Tor. That's the "Cloud takes
-  forever / shows Tor" experience.
-
-**Fix (one line + reload):** add `tcp dport 5679 accept` to the drop-in in
-`fips/config.rs` (use a constant shared with `dial.rs::PEER_PORT`, not a literal).
-The drop-in reinstalls on every daemon config install, so it heals fleet-wide on OTA.
-⚠️ Transient manual rules were inserted on .116 and .198 during diagnosis (2026-07-27)
-— they vanish on the next `nft -f /etc/fips/fips.nft` reload or reboot; the code fix
-makes them permanent.
-
-### RC1 — .228 (Shorty's) runs fips 0.3.0-dev; the 0.4.1 fleet can't reach it
-
-.228's daemon: `0.3.0-dev (rev 34e00b9f6e)`, both anchor links "connected", but its
-ULA is 100% unreachable from 0.4.1 nodes (ping loss 100%). FIPS wire format is not
-stable across revs (`docs/HANDOFF-2026-07-23-companion-apk-deploy.md:78`). Everything
-to/from .228 rides Tor no matter what else we fix.
-
-**Fix:** fleet fips-version audit + upgrade to v0.4.1 everywhere (in-product updater
-exists: `fips/update.rs`; .deb path per `reference_vps2_fips_anchor`). Add a version
-check to `fips.status` and surface a "peer daemon outdated" warning.
-
-### RC2 — Direct LAN/endpoint peering is dead code + wrong port + stale seed anchors
-
-Without direct links, all peer traffic hairpins through the vps2 anchor spanning
-tree (observed: .116→.198 cold RTT 1.5–3.5s on the same LAN; also the wedged-anchor
-latency-rot incident, `HANDOFF-2026-07-23:141-160`).
-
-- **G1 — `lan_fips_anchors()` has never run.** It needs `PeerRecord.fips_npub`, but
-  `PeerRegistry::set_fips_npub` (`transport/mod.rs:302`) has **zero callers** — mDNS
-  TXT records only carry `did`/`pubkey`/`version` (`transport/lan.rs:50-54`). So the
-  "co-located peers form a direct link" feature (`anchors.rs:294-305`,
-  `server.rs:761-766`) is a fleet-wide no-op.
-- **G2 — wrong UDP port.** `anchors.rs:293` dials `8668`, but the generated
-  fips.yaml binds UDP **2121** (`fips/config.rs:187`, `fips/mod.rs:130`). Even if G1
-  ran, it would dial a dead port. `.116`'s live `seed-anchors.json` still carries
-  `.198@192.168.1.198:8668` — **stale IP (LAN renumbered to 192.168.63.x) AND dead
-  port**; both manual entries are useless today.
-- No Tailscale/alternate endpoint fallback when LAN is unreachable (the .116↔.198
-  fix of 2026-07-20 was hand-applied per-node config, never productized).
-
-**Fix:** (a) `FIPS_UDP_PORT` → `crate::fips::PUBLISHED_UDP_PORT` + drift-guard test;
-(b) hydrate `fips_npub` into the registry from federation storage (did-keyed join) so
-`lan_fips_anchors` goes live with no wire change; (c) advertise the npub in the mDNS
-TXT + `set_fips_npub` on resolve as the proper fix; (d) teach the LAN-anchor tick to
-also try a peer's Tailscale/last-known-good endpoint when LAN fails (reviewed change
-— this area got handoffs wrong twice, per memory).
-
-### RC3 — No fast-fail on the hottest call sites; retry silently doubles every budget
-
-- `content.browse-peer` — **the Cloud page** — has NO `fips_timeout`
-  (`api/rpc/content.rs:363-366`): a cold FIPS path burns up to ~16.6s (8s connect +
-  600ms + 8s retry) before Tor even starts, against a UI deadline of 30s
-  (`Cloud.vue:720`) — and the frontend then retries ×3. Users see errors, not
-  fallback. 12 call sites total lack `fips_timeout` (browse/download/preview-peer,
-  `/blob`, DWN, node_message, rotation notifies).
-- `dial.rs:128-140` runs 2 full-budget attempts, so `fips_timeout(6s)` really means
-  ~12.6s everywhere.
-
-**Fix:** wrap `send_with_retry` in a single `tokio::time::timeout(fips_attempt_timeout())`
-(call sites `dial.rs:455`, `dial.rs:488`; halve per-attempt client timeout), then add
-`.fips_timeout(...)`: `content.rs:366` (6s), `content.rs:281` (8s), `content.rs:1139`
-(6s), `typed_messages.rs:822` (8s), `dwn_sync.rs:188/213/272` (6s),
-`node_message.rs:376` (8s), `node_message.rs:412` (4s), `tor/mod.rs:501` (6s),
-`federation/handlers.rs:869` (6s). **Skip the three 900s streaming downloads**
-(`content.rs:552/870/1061`, `proxy.rs:236`) — `dial.rs:311-319` documents why; the
-retry-budget wrap covers their connect phase.
-
-### RC4 — Two features are 100% Tor by construction (allowlist 404)
-
-The peer listener path allowlist (`server.rs:1219-1239`) omits `/blob/<cid>` (mesh
-file sharing, `typed_messages.rs:813-822`) and `/dwn/health` (step 1 of DWN sync,
-`dwn_sync.rs:186`) → deterministic 404 over FIPS (`dial.rs:44-46` treats 404 as
-fall-back) → deterministic Tor, after paying the full FIPS cost. Both endpoints are
-already cryptographically gated, so they meet the allowlist's stated criterion.
-
-**Fix:** add `|| path.starts_with("/blob/") || path.starts_with("/dwn/")`; extend the
-existing test block at `server.rs:1935-1945` (assert `/blob/abc` + `/dwn/health`
-allowed, `/blobber` + `/dwnx` denied).
-
-### RC5 — Inbound listener can't heal; anchor flap = 5-minute Tor window; probe overhead
-
-- `peer_late_bind_loop` returns after first successful bind (`server.rs:1203`) and
-  `accept_loop` `continue`s on errors forever (`server.rs:1249-1258`): a fips0
-  teardown/re-key leaves the node inbound-dead until process restart → **every peer**
-  falls back to Tor against it.
-- Nothing reacts to anchor-link drops: anchors re-apply only on the 300s tick
-  (`server.rs:731`); worst-case 5min Tor-only after a flap (the historic "link dead
-  timeout 30s" flapping made this chronic).
-- `is_service_active()` spawns up to 2 `systemctl` per FIPS attempt *and* per peer
-  per 25s warm tick (`dial.rs:284-294`); `warm_path` skips peers without
-  `fips_npub` in federation storage (`fips/mod.rs:88-95`); `anchors::apply` is
-  serial with unbounded subprocess waits (`anchors.rs:234-283`).
-
-**Fix:** rebindable listener; a ~25s connectivity watcher (reuse
-`service::peer_connectivity_summary`, `fips/service.rs:178-207`) that re-applies
-anchors immediately on a connected→disconnected edge with bounded backoff; 10s TTL
-cache for `is_service_active` (mirror `transport/fips.rs:24-107`); warm the union of
-federation+registry peers; make `apply()` concurrent with per-connect timeouts.
-
-### RC6 — Zero observability: fallbacks are invisible, so "uptime" is unfalsifiable
-
-Fallbacks log at `debug!` only (`dial.rs:458,491`); no counters; `last_transport` is
-written by only 7 of ~20 call sites and **never read** to influence anything
-(`storage.rs:120-147`). The parallel `TransportRouter` system can't even see FIPS
-(`FipsTransport` is never constructed — `server.rs:422-442` registers Tor/Mesh/LAN
-only).
-
-**Fix:** per-reason fallback counters (F1 no-npub / F2 service-inactive / F3
-DNS-fail / F4 connect-fail / F5 404 / F6 5xx) surfaced in `fips.status` + `info!`
-logs with a `reason` field; call `record_peer_transport` from all peer-dial sites;
-UI: per-peer transport badge on Cloud (the response already carries `transport` —
-`content.rs:392-400` — Cloud.vue currently throws it away at `:716-721`).
-
----
-
-## Part A — execution phases
-
-### Phase A0 — fleet triage (no release needed; do first, validates everything)
-1. Fleet audit: `fipsctl --version` + `nft list table inet fips` + `ss -tlnp | grep 5679`
-   on every node (roster: `reference_test_deploy_roster`).
-2. Transient `nft insert rule inet fips inbound iifname fips0 tcp dport 5679 accept`
-   on hardened nodes (already done on .116 + .198, 2026-07-27) — instant fleet-wide
-   FIPS recovery while the code fix rides the OTA.
-3. Upgrade .228 (and any other 0.3.x) fips daemon to v0.4.1.
-4. Regenerate/clean stale `seed-anchors.json` on .116 (dead 192.168.1.x + :8668 entries).
-5. Baseline measurement: for each node pair, `content.browse-peer` time + transport.
-
-### Phase A1 — P0 code (one commit, mechanical, offline-testable)
-1. **nft drop-in: open 5679** — `fips/config.rs` (share the constant with
-   `dial.rs::PEER_PORT`). ← RC0
-2. **Allowlist `/blob/`, `/dwn/`** — `server.rs:1219-1239` + tests. ← RC4
-3. **`FIPS_UDP_PORT` = `PUBLISHED_UDP_PORT` (2121)** — `anchors.rs:293` + drift-guard
-   test against `render_config_yaml()`. ← RC2-G2
-4. **Un-deaden `lan_fips_anchors`** — hydrate `fips_npub` from federation storage in
-   `server.rs:761-766`; then mDNS TXT `fips` key + `set_fips_npub`
-   (`transport/lan.rs:50-54`, `lan.rs:96-108`, `LanTransport::new` 4th arg via
-   `crate::identity::fips_npub(&data_dir.join("identity"))`). ← RC2-G1
-5. **Retry-budget wrap + `fips_timeout` on 12 call sites** (list in RC3). ← RC3
-   Verify: `cd core && cargo test -p archipelago` — watch `test_rendered_yaml_exact_snapshot`
-   (`config.rs:419`) + `test_render_is_deterministic` (`config.rs:476`); item 3 must
-   not change rendered output.
-
-### Phase A2 — telemetry BEFORE tuning (second commit)
-6. Fallback counters by reason + `fips.status` exposure + `info!` reason logs;
-   `record_peer_transport` from all sites. ← RC6 (gives the baseline that makes A3
-   measurable and "100%" falsifiable)
-
-### Phase A3 — resilience (third commit, measured against A2 baseline)
-7. `is_service_active` 10s TTL cache; warm-path union + `warm_path_unchecked`.
-8. Link-state watcher → immediate anchor re-apply on drop (replaces waiting for the
-   300s tick); concurrent `apply()` with subprocess timeouts.
-9. Rebindable peer listener (`server.rs:1203`, `1249-1258`).
-10. (Reviewed, separate PR) endpoint-fallback for direct peering: LAN → Tailscale →
-    last-known-good, npub-keyed. Mesh-routing area — needs careful review per memory.
-
-### Phase A4 — verification gate (on nodes, before tag)
-- On .116/.198/framework-pt/.228: `content.browse-peer` to every peer must return
-  `transport: "fips"` with sub-second latency (LAN pairs) / <3s (WAN), 20/20 calls.
-- Kill the fips daemon on one node → calls fall back to Tor gracefully within the
-  fast-fail budget (<8s), UI shows partial results, no errors.
-- Restart daemon → FIPS recovers within one watcher tick (~25s), verified in
-  `fips.status` counters.
-- Flap the anchor link (drop vps2 route) → direct LAN pairs keep FIPS via their
-  direct link (G1 fix proof).
-- Add these as `tests/multinode/` cases per `docs/multinode-testing-plan.md`; also
-  fix the known `node_rpc()` missing `--max-time` (tracker item).
-
----
-
-## Part B — optimistic loading + state management (frontend)
-
-Full audit: Pinia exists but pages fetch-on-mount with `loading=true` spinners;
-`Dashboard.vue:89` keys the router-view by `route.path`, so **every navigation
-unmounts and refetches everything**; no KeepAlive/onActivated anywhere; no dedup,
-no abort, no SWR layer. Four hand-rolled cache implementations already exist and
-prove the pattern (`useFleetData.ts:198-231` sessionStorage hydrate;
-`homeStatus.ts` sticky-ready loadState; `Home.vue:591-621` wallet localStorage
-snapshot; `curatedApps.ts:21-77` TTL cache). `SkeletonCard.vue` exists, imported by
-zero files.
-
-### B1 — one shared primitive: `useCachedResource` composable + `resources` Pinia store
-Semantics (generalize `homeStatus.ts` + `useFleetData.ts`):
-- Keyed resource: `{ data, loadState: idle|loading|ready|error|refreshing, fetchedAt, error }`.
-- **Hydrate synchronously** from memory (Pinia, survives navigation) → sessionStorage
-  snapshot (survives reload) → then revalidate in background.
-- Sticky-ready: once `ready`, never regress to `loading`
-  (`loadState = loadState==='ready' ? 'ready' : 'loading'` — the `homeStatus.ts:80` idiom);
-  keep-last-known-value on error with a stale badge (age from `fetchedAt`).
-- TTL per resource; `revalidateOnFocus` + on WS push (debounced, the
-  `Home.vue:539-542` pattern); explicit `invalidate(key)` for mutations.
-- Optimistic mutation helper: apply → RPC → rollback on error (generalize
-  `TransportPrefsCard.vue:112-127`).
-
-### B2 — rpc-client upgrades (`src/api/rpc-client.ts`)
-- `AbortSignal` in `RPCOptions` (today the AbortController at `:87` is timeout-only)
-  → abort-on-unmount for fan-outs.
-- In-flight dedup keyed `method+JSON(params)` — collapses duplicate concurrent calls.
-- Per-call `maxRetries` override; set `maxRetries: 1` for `content.browse-peer` /
-  `preview-peer` (retry×3 on a 30s timeout is why one slow peer = 90s spinner).
-
-### B3 — Cloud page conversion (worst offender, the marquee win)
-- Move `sectionCounts`, `peerNodes`, `myFiles`, `peerFiles`, `paidItems` out of
-  `Cloud.vue` component state (`:403,:476,:582,:689,:427`) into the cached store —
-  instant render on revisit, background refresh.
-- **Incremental per-peer fan-in**: render each peer's card as its
-  `content.browse-peer` resolves (today `Promise.allSettled` at `:708-747` blocks on
-  the slowest peer). Per-peer states: cached/fresh/loading/unreachable.
-- **Surface `transport` per peer** (already in the response, discarded at `:716-721`):
-  FIPS/Tor badge + latency — this is also the fleet-wide FIPS-uptime dashboard the
-  user asked for, for free.
-- Skeleton cards (revive `SkeletonCard.vue`, copy `FileGrid.vue:3-19` shimmer) instead
-  of spinners for counts/folders/peer grids.
-- Stop `CloudFolder.vue:307-319` calling `cloudStore.reset()` on every folder entry —
-  cache per-path listings, navigate renders cache + revalidates.
-- `PeerFiles.vue`: persist catalog + preview cache in the store; cap the
-  `preview-peer` fan-out (`:832-841`, currently unbounded) with a small concurrency
-  queue + abort-on-unmount.
-
-### B4 — roll out to remaining offenders (in audit order)
-PeerFiles → Web5 wallet/ecash/LND slices → Monitoring → Lightning channels
-(`LightningChannelsPanel.vue:650`) → Federation (already has `{showLoader:false}` —
-just adopt the store) → Server → Credentials/OpenWrtGateway/ContainerApps.
-`Apps.vue`/`Marketplace.vue`/`Fleet.vue` are already good; don't touch.
-
-### B5 — freshness via the existing push channel
-`/ws/db` firehose + `sync.ts` JSON-patch already exist. Wire `useCachedResource`
-revalidation to relevant WS pushes (debounced 800ms), keep the 30s staleness
-reconciliation as backstop. No new backend needed for v1; a per-topic subscribe can
-come later.
-
-### Part B verification (on nodes)
-- Navigate Cloud → Apps → Cloud: peer files render instantly from cache (0 spinner),
-  refresh indicator while revalidating, updated data lands without layout jump.
-- One unreachable peer: its card shows stale/unreachable state; other peers render
-  immediately (no 30s all-or-nothing).
-- Kill backend mid-view: stale data stays visible with age badge; recovery
-  revalidates automatically.
-- Hard reload: sessionStorage hydrate paints before first RPC completes.
-
----
-
-## Sequencing for the next release
-
-1. **A0 now** (fleet triage + transient nft rules + .228 daemon upgrade + baseline).
-2. **A1 + A2** land together (P0 fixes + telemetry) → deploy to .116/.198 →
-   Phase A4 checks on the pair → framework-pt → full fleet.
-3. **B1 + B2 + B3** (composable + rpc-client + Cloud) in parallel with A-testing —
-   frontend-only, verifiable against .116 dev (`reference_neode_ui_dev_testing`).
-4. **A3** after telemetry baseline exists; **B4/B5** ride the same or next OTA.
-5. Gate: Phase A4 checklist green + Part B verification on-device + existing
-   single-node gate stays green → tag/OTA per ship ritual.
-
-## Success criteria
-- `content.browse-peer` transport = fips for ≥99% of calls between healthy 0.4.1
-  nodes over 24h (measured by the new counters), Tor reserved for genuinely
-  FIPS-unreachable peers (.116-WiFi-class networks).
-- Cloud revisit paints in <100ms from cache; fresh data within one revalidate.
-- Fallback counters visible in `fips.status` so regressions are caught on the
-  dashboard, not by users.

docs/HANDOFF-2026-07-23-companion-apk-deploy.md

@@ -1,205 +0,0 @@
-# HANDOFF — deploy companion APK 0.5.1 (vc21) to nodes
-
-**For: the agent on archi-dev-box.** User-reported failure this evening:
-pairing flow on Framework PT — downloaded the companion from the node's
-QR, then the pairing scan didn't work. The APK the node serves predates
-today's scanner fixes; the pipeline below gets the fixed build into the
-user's hands.
-
-## What changed on main today (all merged)
-
-- **Pairing-scanner fix** (`QrScannerOverlay.kt`): ZXing decode attempts are
-  frame-gated (~7/s, was every frame — the CPU contention made the preview
-  stutter badly enough to never decode) and PreviewView uses TextureView (no
-  more black flash on open). This is the likely fix for "doesn't scan".
-- Three-finger menu gesture (was two-finger, collided with scroll) + one-time
-  teaching overlay ~2 min after login.
-- Native wallet QR scanner behind `window.ArchipelagoQr` + WebView file-chooser
-  support; web scan modal hands live scanning to it.
-- npub-keyed saved servers (pairing contract item 1, PR #106).
-- Served APK refreshed: `neode-ui/public/packages/archipelago-companion.apk`
-  is now **0.5.3 / versionCode 23**. On top of the 0.5.1 scanner fixes it
-  guarantees dual-path peering — the node's LAN endpoint (direct p2p, npub-
-  keyed dial hints) AND the Archipelago public anchor (vps2, baked into the
-  app so even an old node's QR can't leave the phone LAN-only) — and fixes
-  the two field failures from the user's 5G test (screenshots, 21:54):
-  - **Mesh VPN no longer kills the phone's internet** — the IPv6-only TUN
-    never called `allowFamily(AF_INET)`, so Android blocked all IPv4 while
-    the mesh was up. Now allowed (+ `allowBypass`).
-  - **Off-LAN connect works** — `connect()` no longer hard-fails when the
-    scanned LAN IP doesn't answer; it brings the mesh up and probes the
-    node's ULA (`meshIp`) with retries before reporting failure.
-
-## What to do
-
-1. Redeploy the web-ui bundle from current main to the active nodes —
-   web root `/opt/archipelago/web-ui/` (NOT a neode-ui/ subfolder), all
-   nodes the user pairs against, at minimum the one Framework PT scans.
-2. Verify the served artifact really updated:
-   `curl -sI http://<node>/packages/archipelago-companion.apk` — size should
-   change (~27 MB build of 2026-07-23), or pull it and check
-   `aapt dump badging` shows `versionCode='21' versionName='0.5.1'`.
-3. The demo stack gets its images from CI (run 100 pushed today with the new
-   web bundle) — confirm the Portainer stack re-pulled, or trigger its
-   redeploy, so the demo QR also serves vc21.
-4. **Node side is half the 5G story**: away-from-home reachability needs the
-   NODE connected to the public anchor too. On Framework PT (and any test
-   node): deploy current main (node-side npub-first `fips.pair-info`), then
-   verify `sudo -n fipsctl show status` reports the anchor connected —
-   `fips.reconnect` RPC if not. A phone can dial the anchor perfectly and
-   still fail if the node never enrolled with it.
-5. Re-test the user's exact flows with **vc24** (updates any older install in
-   place): (a) pair ON the LAN, then switch the phone to 5G — the UI must
-   come up via the mesh ULA; (b) pair while ALREADY on 5G (never on the
-   node's LAN) — scan, VPN consent, and the connect must succeed through
-   the anchor.
-
-## Live diagnosis update (22:30–22:50, phone on adb — Mac agent)
-
-vc23 on-device testing found and fixed the phone-side blocker, and narrowed
-what remains to the node side. State as of vc24:
-
-- **Fixed: TUN reader died at startup.** Android hands the VpnService fd over
-  non-blocking; the fips fork's blocking reader thread treats EAGAIN as fatal
-  ("TUN read error … Try again (os error 11)") — so mesh sessions came up but
-  NO packet ever entered the tunnel. archy-fips-core now forces the fd
-  blocking before `start_with_tun_fd`. Verified on-device: reader survives,
-  and the 30s anchor-link flap disappeared with it (stable 8+ min on 5G).
-- **Fixed: VPN marked not-metered** (`setMetered(false)`) — Android 10+
-  defaults VPNs to metered, putting the phone into data-restricted behaviour
-  while the mesh is up. Note the user's phone also has system **always-on
-  VPN** enabled for the app (`always_on_vpn_app`), a Settings-side toggle.
-- **Verified good on-device**: peer store has node (LAN udp/tcp hints) + vps2
-  anchor; saved server is npub-keyed with ULA; anchor session establishes
-  from 5G in ~6s; VPN is bypassable, VALIDATED, only fd00::/8 routed.
-- **REMAINING BLOCKER (node side)**: from the phone (app uid), ping6 and
-  HTTP to the node's ULA `fd79:1aa:b9e9:4c9f:1f80:5376:9385:1824` get no
-  reply — packets enter the mesh, nothing returns. Phone↔anchor works, so
-  suspect phone-fork ↔ node-daemon session/routing mismatch (FIPS wire
-  format is not stable across revs; phone pins fips-native fork 46494a74).
-  From Framework PT please capture:
-    - `fipsctl show status` (daemon version + anchor state)
-    - `fipsctl show sessions` and `show bloom` while the phone pings
-    - `ping6 <phone ULA fd68:496d:fe34:a06d:cf1:6e4:b6a4:3586>` from the
-      node (tests the reverse path)
-    - `ip addr show fips0` + confirm the web server listens on `[::]:80`
-  Report whether the node ever sees a session attempt from
-  `npub132c5whrsa6ccs0eylcpzaejq9uxul5ldvczz0axq78dh7fxkqj9st4uvzu`.
-
-## Node-side diagnosis complete (23:00–23:30, archi-dev-box agent)
-
-Chain of findings, each verified live:
-
-1. **FIXED: nginx had no IPv6 listener anywhere** — every shipped config
-   listened on 0.0.0.0 only, so `http://[<ULA>]` could NEVER connect on any
-   node, ever. Live-fixed on framework-pt + .116, canonical conf + bootstrap
-   self-heal shipped (`1e89362e`), heal binary deployed. ULA HTTP verified
-   answering on both nodes (local + over-mesh).
-2. Firewall clean, fd00::/8 routes correct both ends, wire compat proven
-   (node + vps2 anchor both run fips 0.4.1 rev 15db6471db — the latest
-   upstream stable; nothing newer exists).
-3. **THE REMAINING PROBLEM IS MESH SESSION PATH QUALITY.** From the vps2
-   anchor — a DIRECT connected peer — `GET /health` on the node's ULA takes
-   **15–17 s per request and intermittently fails outright** (nginx logs
-   show 499 client-gave-up then 200; TCP SYN-retransmit backoff signature).
-   Session MMP is wildly asymmetric: node→vps2 srtt 204 ms, **vps2→node
-   srtt 4270 ms** — on a direct link whose raw RTT is 4 ms. Session traffic
-   is not riding the direct link; it appears to route through the ~1271-node
-   public tree (node's tree root is the public 00001a8c, depth 8; the node's
-   log also shows chronic "Discovery lookup timed out" for other targets).
-4. The phone's npub never appears in the node's sessions — consistent with
-   discovery/handshake dying on the same degraded tree path, and the app's
-   ~8 s probe window being far smaller than the observed 15 s+ first-request
-   latency even on the GOOD path.
-
-### Recommendations
-
-- **App side (Mac agent):** widen the ULA probe/connect window to ≥30 s
-  with retransmit-friendly pacing, and PRE-WARM the mesh session (start
-  pinging the node ULA as soon as the VPN is up, decoupled from the UI
-  probe) so the WebView hits a warm session.
-- **Infra decision (user):** consider detaching the fleet from the public
-  v0l mesh — private tree rooted at the vps2 anchor (drop the legacy
-  185.18.221.160 seed anchor fleet-wide AND vps2's public peering). A
-  2-hop private tree would make session paths ride the direct links and
-  should collapse latency to ms. Trade-off: no reachability to/from the
-  broader public mesh.
-- **Upstream:** report the direct-peer session-path asymmetry to
-  jmcorgan/fips (0.4.1).
-
-## App-side recommendations implemented (23:30–23:50, Mac agent — 0.5.5/vc25)
-
-- Connect probe: mesh ULA now probed inside a **60s budget** with 15s
-  per-phase timeouts (rides out TCP retransmit backoff), replacing the old
-  ~8s window.
-- **Session pre-warm**: the VPN service starts probing every saved node ULA
-  the moment the tunnel is up (5s cadence for the first minute, then a 60s
-  keep-warm tick) — discovery/handshake cost is paid in the background, and
-  the session never idles out while the mesh is connected.
-- (A phone-side ping test in this window still showed zero replies — that
-  measurement predated the vps2 daemon restart below and is superseded.)
-
-## RESOLVED — root cause was vps2's degraded daemon, NOT the public tree (23:45)
-
-The privatize-the-mesh recommendation above is WITHDRAWN. Final diagnosis:
-vps2's fips daemon (3 days uptime, 0.2% CPU, idle box) had internally
-degraded — EVERY link it carried showed ~4.5 s RTT (even to peers 30 ms
-away), and since the anchor sits on the phone↔node path, everything through
-it inherited that. `systemctl restart fips` on vps2 restored link RTTs to
-40–340 ms, and anchor→node mesh HTTP went from 14–17 s (intermittent hard
-fails) to a steady **165–275 ms**. Node↔node direct sessions were always
-fine (.116→framework-pt ULA HTTP: 894 ms cold, sub-second warm) — the
-user's read was correct.
-
-Actions taken: dead legacy anchor (185.18.221.160) removed from
-framework-pt + .116 seed files (fleet keeps vps2 + public-mesh membership
-via vps2 — we stay in the open mesh); fresh daemons on both nodes;
-**vps2 fips now has RuntimeMaxSec=1d + Restart=always** so a wedged anchor
-daemon can never rot for days again. Report the slow-degradation behaviour
-upstream (jmcorgan/fips, 0.4.1): long-running daemon in a ~1400-node mesh
-accumulates multi-second link latency at idle CPU, cleared by restart.
-
-Phone side: vc25's 60 s probe + pre-warm now has a millisecond-latency mesh
-to work with. Ready for the user's 5G test.
-
-## NEXT (00:05, Mac agent → dev-box agent): app direct ports are IPv4-only over the mesh
-
-The kiosk loads over the ULA now — but opening any APP dies with
-`ERR_CONNECTION_REFUSED` at `http://[<ULA>]:<port>/`. User-hit first on
-**Bitcoin Knots (:8334)**, and it will be every catalog app: the web UI
-builds app URLs from the current host + the app's DIRECT port (Direct Port
-Rule), and container-published ports only bind 0.0.0.0. Verified:
-`192.168.63.249:8334` → HTTP 200 (nginx), ULA:8334 → refused. Same disease
-as your :80 nginx fix, one layer down.
-
-Fix must cover EVERY catalog app port and survive app install/remove. Two
-shapes; pick what fits the container layer best:
-
-1. **IPv6 publish at the container layer** — publish on `[::]` too
-   (pasta/rootless podman support address-specific `-p`), wired into the
-   container manager so new apps inherit it; or
-2. **Host-side v6→v4 forwarders** — generated nginx `stream {}` (or
-   systemd-socket) units: `listen [::]:<port>` → `127.0.0.1:<port>`, one per
-   catalog app port, regenerated on app install/remove, boot-time
-   self-healed like the :80 fix. Keeps the Direct Port Rule URL contract
-   without touching containers.
-
-Either way: extend the bootstrap self-heal, and verify from the MESH side
-(curl the ULA on 2–3 app ports incl. :8334 from vps2 or .116) — not just
-from the LAN.
-
-## DONE (00:30, dev-box agent): app direct ports live over the mesh
-
-Shape 2-variant implemented INSIDE the backend (`mesh_ports.rs`, `2ad57c63`):
-a reconcile loop mirrors every public IPv4 listener (>=1024, bound 0.0.0.0,
-no existing IPv6 any-listener) as a v6-ONLY `[::]:<port>` forwarder to
-`127.0.0.1:<port>`, following `/proc/net/tcp*` every 15s — so app
-install/remove and hardcoded companion ports (bitcoin-ui :8334) are covered
-with zero container changes and no generated units; self-healing because it
-lives in the binary. Strictly ADDITIVE: IPv4/LAN/Tor paths untouched, v6only
-cannot intercept v4, foreign IPv6 listeners win.
-
-Verified FROM THE MESH (vps2 → node ULA): :8334 HTTP 200 (466ms),
-:18083 200 (306ms), :50002 200 (239ms); LAN :8334 still 200. Deployed to
-framework-pt + .116 (binary sha 52ac0d8a…). Direct-port apps should now
-open in the companion over 5G.