feat(openwrt): make TollGate payout Lightning address configurable

Archipelago never touched /etc/tollgate/identities.json — the "owner"
payout identity was whatever the router's TollGate install happened to
default to. Confirmed live against archy-x250-pa3: an unmodified upstream
placeholder (tollgate@minibits.cash), meaning 79% of every customer payment
would auto-payout to an address the operator never chose and doesn't
control.

Adds TollGateConfig.payout_address (opt-in — None leaves the router
untouched), config::apply_payout_identity() to merge it into the "owner"
entry of identities.json without disturbing the merchant keypair or the
other profit-share identities, an RPC param on openwrt.provision-tollgate,
and a status field + reconfigure-form input in the OpenWrt Gateway panel.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KTdMfVJChCwCCYF1ZTRQLc

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## v1.8.11-alpha (2026-09-07)
+
+- **Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.
+
+- **OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.
+
+- **Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links.
+
 ## v1.8.10-alpha (2026-09-02)
 
 - **Lightning sends work again — v1.8.9's payment switch lost the fee budget.** Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as **zero allowed fees**: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered "No route to the recipient" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (`fee_limit=0 mSAT` on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.

apps/cuprate/manifest.yml

@@ -45,7 +45,12 @@ app:
 
   resources:
     cpu_limit: 0
-    memory_limit: 4Gi
+    # Raised from 4Gi alongside target_max_memory below (see files[] comment)
+    # — 2026-09-03 incident: a 4Gi/3GB-cache config starved
+    # cuprated's DB cache into constant eviction/flush, driving 45% sustained
+    # CPU and ~595GB/24h of block I/O on a fully-synced node. 10Gi leaves
+    # headroom above the 8GiB cache for the process itself.
+    memory_limit: 10Gi
     disk_limit: 300Gi
 
   security:
@@ -82,17 +87,21 @@ app:
     # bind without an explicit i_know_what_im_doing override.
     # Restricted RPC: Monero's own purpose-built safe-for-public subset —
     # what wallets use when connecting to a "remote node". Disabled by
-    # cuprated's own default; enabled via files[] below. A dashboard login
-    # would break wallet clients connecting programmatically, same
-    # reasoning as electrumx's port. The daemon still uses its canonical
-    # container port 18089, but Penpot already owns host port 18089, so this
-    # maps the public host port to the free 18090 instead.
+    # cuprated's own default; enabled via files[] below. `open`, not `gated`:
+    # the gate still takes the port over (loopback pin, external binds,
+    # fronts the Tor onion) but skips the dashboard login challenge, same
+    # reasoning as electrumx's port — wallet clients (Feather,
+    # monero-wallet-rpc, GUI) speak plain HTTP JSON-RPC programmatically and
+    # cannot complete a browser login or hold a session cookie. The daemon
+    # still uses its canonical container port 18089, but Penpot already owns
+    # host port 18089, so this maps the public host port to the free 18090
+    # instead.
     - host: 18090
       container: 18089
       protocol: tcp
-      auth: none
+      auth: open
       auth_rationale: >-
-        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.
+        Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.
 
   volumes:
     - type: bind
@@ -103,11 +112,23 @@ app:
   # Settings that need to differ from cuprated's own documented defaults
   # (verified against `cuprated --generate-config` and `--dry-run` locally,
   # 2026-08-21):
+  #   - fast_sync: cuprated's own default is false, which performs full
+  #     cryptographic verification (ring signatures + RandomX PoW) on every
+  #     incoming block instead of trusting checkpointed history. Root-caused
+  #     2026-09-03 as the dominant cause of a sustained 45% CPU node,
+  #     vs. 2.8% on a reference node with fast_sync = true — same chain height, same
+  #     block rate. Set explicitly rather than relying on the binary
+  #     default so fresh deploys don't silently regress into full-verify.
   #   - target_max_memory: cuprated's own default auto-detects total *host*
   #     RAM via sysinfo, which inside a memory-limited container would let
   #     it size caches far past what resources.memory_limit above actually
   #     grants — same class of problem bitcoin-knots' -dbcache sizing
-  #     comment addresses. Set explicitly, comfortably under the 4Gi limit.
+  #     comment addresses. Set explicitly, comfortably under the 10Gi limit.
+  #     Previously 3000000000 (~2.8GiB); that starved the DB cache and
+  #     forced constant eviction/flush (595GB/24h block I/O on a node just
+  #     appending ~2MB blocks every 2 minutes) — raised to 8GiB, matching
+  #     the healthy reference node, and
+  #     resources.memory_limit above raised in step to keep headroom above it.
   #   - rpc.restricted.enable: cuprated ships this off by default; flip on
   #     so the auth:none host port above actually serves something instead
   #     of refusing every connection. port stays at its documented default
@@ -128,21 +149,21 @@ app:
   #   - tracing.stdout.level / tracing.file.{level,max_log_files}: an
   #     operator reading Cuprated.toml on disk should be able to see and
   #     tune the log level directly instead of the file silently omitting
-  #     the whole [tracing] table (verified live on amishparadise
+  #     the whole [tracing] table (verified live on the affected node
   #     2026-09-01: the deployed file had no [tracing] section at all, and
   #     the level was only discoverable by running `cuprated
   #     --generate-config` and diffing). file.level is set to "info", NOT
   #     cuprated's own raw default of "debug" — matches the reference dev
-  #     config this app was built and tested against
-  #     (ssmithx@archy-dev-pa:/home/ssmithx/cuprate/Cuprated.toml,
-  #     verified 2026-09-01), which deliberately runs file logging quieter
+  #     config this app was built and tested against (verified 2026-09-01),
+  #     which deliberately runs file logging quieter
   #     than the binary default. max_log_files similarly follows that
   #     reference (14, not the binary default of 7).
   files:
     - path: /var/lib/archipelago/cuprate/Cuprated.toml
       content: |
         network = "Mainnet"
-        target_max_memory = 3000000000
+        fast_sync = true
+        target_max_memory = 8589934592
 
         [rpc.restricted]
         enable = true

core/Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.8.10-alpha"
+version = "1.8.11-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.8.10-alpha"
+version = "1.8.11-alpha"
 edition = "2021"
 license.workspace = true
 description = "Archipelago Bitcoin Node OS - Native backend"

core/archipelago/src/api/rpc/openwrt.rs

@@ -150,6 +150,7 @@ impl RpcHandler {
                         "min_steps":     router.uci_get("tollgate.main.min_steps").ok().and_then(|v| v.parse::<u32>().ok()).unwrap_or(1),
                         "currency":      router.uci_get("tollgate.main.currency").unwrap_or_default(),
                         "mint_url":      router.uci_get("tollgate.main.mint_url").unwrap_or_default(),
+                        "payout_address":router.uci_get("tollgate.main.payout_address").unwrap_or_default(),
                     })
                 } else {
                     serde_json::json!({ "installed": false })
@@ -199,10 +200,15 @@ impl RpcHandler {
     ///
     /// Params: `{ "host": "192.168.1.1", "ssh_user": "root", "ssh_password": "",
     ///             "price_sats": 10, "step_size_ms": 60000, "min_steps": 1,
-    ///             "mint_url": "<optional override>" }`
+    ///             "mint_url": "<optional override>",
+    ///             "payout_address": "<optional Lightning address>" }`
     ///
     /// `mint_url` defaults to `http://<this node's IP>:3338` — the local Cashu
     /// mint that must be running as an Archy app before calling this endpoint.
+    ///
+    /// `payout_address` sets the "owner" identity's Lightning address for
+    /// TollGate's own built-in payout (see `config::apply_payout_identity`).
+    /// Omitted or blank leaves whatever's already on the router untouched.
     pub(super) async fn handle_openwrt_provision_tollgate(
         &self,
         params: Option<serde_json::Value>,
@@ -240,12 +246,31 @@ impl RpcHandler {
             .unwrap_or_default();
 
         let default_mint_url = format!("http://{}:{}", self.config.host_ip, LOCAL_MINT_PORT);
+        // Trim trailing slash(es): tollgate-wrt matches a token's embedded
+        // mint URL against this value with an exact string compare, and
+        // Cashu wallets (Minibits included) encode mint URLs without a
+        // trailing slash. A stray slash here means every otherwise-valid
+        // token gets rejected as "untrusted mint" — confirmed live against
+        // archy-x250-pa3 2026-09-07 with a manually-entered
+        // "https://mint.minibits.cash/Bitcoin/".
         let mint_url = p
             .get("mint_url")
             .and_then(|v| v.as_str())
             .unwrap_or(&default_mint_url)
+            .trim_end_matches('/')
             .to_string();
 
+        // `None` (not sent, or sent blank) leaves whatever's already on the
+        // router untouched — see apply_payout_identity's doc comment for why
+        // that matters (an upstream-default placeholder otherwise survives
+        // forever, since nothing else ever writes this field).
+        let payout_address = p
+            .get("payout_address")
+            .and_then(|v| v.as_str())
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(str::to_string);
+
         let config = TollGateConfig {
             ssid: "archipelago".to_string(),
             mint_url,
@@ -256,6 +281,7 @@ impl RpcHandler {
                 .unwrap_or(60_000),
             min_steps: p.get("min_steps").and_then(|v| v.as_u64()).unwrap_or(1) as u32,
             enabled: p.get("enabled").and_then(|v| v.as_bool()).unwrap_or(true),
+            payout_address,
         };
 
         // Blocking SSH session, and provision runs `opkg install` over it —

core/archipelago/src/tollgate_sweep.rs

@@ -22,6 +22,46 @@ use crate::wallet::ecash;
 ///
 /// Returns the total sats swept in (0 if there was nothing to do, including
 /// when no router is configured or it doesn't have TollGate installed).
+///
+/// # KNOWN BROKEN as of 2026-09-07 — do not "fix" by adding `--json` without
+/// reading the rest of this comment first.
+///
+/// Confirmed live against archy-x250-pa3, two stacked bugs in the upstream
+/// `tollgate` CLI, not in this function:
+///
+/// 1. **This call never actually drains anything.** `tollgate wallet drain
+///    cashu` (no flags — what this function runs) prints an interactive
+///    `Are you sure? (y/N)` confirmation and reads stdin for the answer.
+///    `Router::run` executes over SSH with no PTY and empty stdin, so it
+///    always reads EOF, defaults to "N", and prints "Operation cancelled." —
+///    **with exit code 0**. The `drain_code != 0` check below can never catch
+///    this, so every single tick silently falls through to "no `Token:`
+///    lines found" → `Ok(0)`. No error, no log line (even at `warn!`), just
+///    quiet total inaction, forever. This has presumably never swept a
+///    single sat on any node.
+///
+/// 2. **The obvious fix is worse.** `tollgate --json wallet drain cashu`
+///    *does* skip the confirmation prompt — but confirmed live: when the
+///    wallet's internal per-mint registry holds more than one entry for what
+///    is really the same mint (here: `https://mint.minibits.cash/Bitcoin` vs.
+///    a stale `.../Bitcoin/` — leftover from before the trailing-slash
+///    `mint_url` fix elsewhere in this codebase; `wallet.db` still had a
+///    proof/registry entry keyed under the old slashed URL even after
+///    `config.json` was corrected), the CLI appears to complete a real swap
+///    against the *good* entry — spending and irreversibly consuming the
+///    original proofs, per how Cashu swaps work — then hits the second,
+///    empty, stale-keyed entry, reports the whole command as
+///    `"success": false`, and **never prints or persists the resulting
+///    token anywhere** (checked every location its own "will be saved to a
+///    file" warning implies: `/etc/tollgate/ecash/`, `/root`, `/tmp`,
+///    nothing). Balance went from 50 sats to 0 across that one call. The
+///    funds are gone — there is no undo once a swap is submitted to the
+///    mint.
+///
+/// Do not wire `--json` into this function until upstream fixes partial
+/// per-mint failure handling in `drain cashu` to preserve/return whatever it
+/// already successfully drained. Until then, the current silent-no-op
+/// behavior, while useless, is at least safe.
 pub async fn sweep_once(data_dir: &Path) -> Result<u64> {
     let cfg = net_router::load_router_config(data_dir).await?;
     if !cfg.configured {

core/openwrt/src/tollgate/config.rs

@@ -23,6 +23,14 @@ pub struct TollGateConfig {
     pub min_steps: u32,
     /// Whether the TollGate service should be running and enabled at boot.
     pub enabled: bool,
+    /// Operator's own Lightning address for the daemon's built-in payout
+    /// (the "owner" entry in `/etc/tollgate/identities.json`, `profit_share`
+    /// weight 0.79 in the upstream default). `None` leaves whatever is
+    /// already on the router untouched — which, on a router whose TollGate
+    /// wasn't provisioned through this project, is an unmodified upstream
+    /// placeholder nobody actually controls (confirmed live against
+    /// archy-x250-pa3 2026-09-07: shipped as `tollgate@minibits.cash`).
+    pub payout_address: Option<String>,
 }
 
 impl Default for TollGateConfig {
@@ -34,6 +42,7 @@ impl Default for TollGateConfig {
             step_size_ms: 60_000,
             min_steps: 1,
             enabled: true,
+            payout_address: None,
         }
     }
 }
@@ -46,19 +55,27 @@ impl Default for TollGateConfig {
 /// tollgate.main.enabled` etc.); changing pricing or the mint here has no
 /// effect on what the daemon advertises or accepts.
 pub fn apply(router: &Router, cfg: &TollGateConfig) -> Result<()> {
-    router.uci_apply(
-        "tollgate",
-        &[
-            ("tollgate.main", "tollgate"),
-            ("tollgate.main.enabled", if cfg.enabled { "1" } else { "0" }),
-            ("tollgate.main.metric", "milliseconds"),
-            ("tollgate.main.step_size", &cfg.step_size_ms.to_string()),
-            ("tollgate.main.min_steps", &cfg.min_steps.to_string()),
-            ("tollgate.main.price_per_step", &cfg.price_sats.to_string()),
-            ("tollgate.main.currency", "sat"),
-            ("tollgate.main.mint_url", &cfg.mint_url),
-        ],
-    )?;
+    let step_size = cfg.step_size_ms.to_string();
+    let min_steps = cfg.min_steps.to_string();
+    let price_sats = cfg.price_sats.to_string();
+
+    let mut pairs = vec![
+        ("tollgate.main", "tollgate"),
+        ("tollgate.main.enabled", if cfg.enabled { "1" } else { "0" }),
+        ("tollgate.main.metric", "milliseconds"),
+        ("tollgate.main.step_size", step_size.as_str()),
+        ("tollgate.main.min_steps", min_steps.as_str()),
+        ("tollgate.main.price_per_step", price_sats.as_str()),
+        ("tollgate.main.currency", "sat"),
+        ("tollgate.main.mint_url", &cfg.mint_url),
+    ];
+    // Status-display only (see doc comment above) — only written when the
+    // caller actually supplied one, so a reconfigure that doesn't touch
+    // payout leaves whatever's already there alone.
+    if let Some(addr) = &cfg.payout_address {
+        pairs.push(("tollgate.main.payout_address", addr));
+    }
+    router.uci_apply("tollgate", &pairs)?;
     Ok(())
 }
 
@@ -97,3 +114,61 @@ pub fn apply_daemon_config(router: &Router, cfg: &TollGateConfig) -> Result<()>
         .context("upload /etc/tollgate/config.json")?;
     Ok(())
 }
+
+/// Set the operator's own payout Lightning address in
+/// `/etc/tollgate/identities.json` — the "owner" entry under
+/// `public_identities` (`profit_share` weight 0.79 in the upstream default;
+/// the other entries there are revenue-share addresses for the upstream
+/// project's own maintainers and must never be touched by this function).
+///
+/// No-op when `payout_address` is `None` — the UI only sends one when the
+/// operator has actually filled the field in, so a reconfigure of price/mint
+/// alone never overwrites this. Merges into whatever identities.json already
+/// exists (same reasoning as `apply_daemon_config`: `owned_identities` holds
+/// the merchant's own private key and must survive untouched); creates an
+/// "owner" entry if none exists yet rather than erroring, since a router
+/// whose TollGate wasn't provisioned through this project may have any
+/// upstream-default shape here.
+///
+/// Must run before the daemon restart in `restart_services` — like
+/// `config.json`, `tollgate-wrt` only reads `identities.json` at startup.
+pub fn apply_payout_identity(router: &Router, payout_address: Option<&str>) -> Result<()> {
+    let Some(address) = payout_address else {
+        return Ok(());
+    };
+
+    let existing = router.run_ok("cat /etc/tollgate/identities.json 2>/dev/null || echo '{}'")?;
+    let mut doc: serde_json::Value =
+        serde_json::from_str(existing.trim()).unwrap_or_else(|_| serde_json::json!({}));
+
+    let identities = doc
+        .as_object_mut()
+        .context("identities.json root is not a JSON object")?
+        .entry("public_identities")
+        .or_insert_with(|| serde_json::json!([]));
+    let identities = identities
+        .as_array_mut()
+        .context("identities.json public_identities is not an array")?;
+
+    match identities
+        .iter_mut()
+        .find(|i| i.get("name").and_then(|n| n.as_str()) == Some("owner"))
+    {
+        Some(owner) => {
+            owner["lightning_address"] = serde_json::json!(address);
+        }
+        None => {
+            identities.push(serde_json::json!({
+                "name": "owner",
+                "pubkey": "not currently used",
+                "lightning_address": address,
+            }));
+        }
+    }
+
+    let json_str = serde_json::to_string_pretty(&doc).context("serialize identities.json")?;
+    router
+        .upload_file("/etc/tollgate/identities.json", json_str.as_bytes())
+        .context("upload /etc/tollgate/identities.json")?;
+    Ok(())
+}

core/openwrt/src/tollgate/install.rs

@@ -24,12 +24,12 @@ const TOLLGATE_VERSION: &str = "v0.5.0";
 /// Source: https://github.com/OpenTollGate/tollgate-module-basic-go/releases/tag/v0.5.0
 fn ipk_url(arch: &str) -> Option<String> {
     let name = match arch {
-        "mips_24kc"          => "mips_24kc",
-        "mipsel_24kc"        => "mipsel_24kc",
+        "mips_24kc" => "mips_24kc",
+        "mipsel_24kc" => "mipsel_24kc",
         "aarch64_cortex-a53" => "aarch64_cortex-a53",
         "aarch64_cortex-a72" => "aarch64_cortex-a72",
-        "arm_cortex-a7"      => "arm_cortex-a7",
-        "x86_64"             => "x86_64",
+        "arm_cortex-a7" => "arm_cortex-a7",
+        "x86_64" => "x86_64",
         _ => return None,
     };
     Some(format!(
@@ -69,8 +69,9 @@ pub fn install_tollgate(router: &Router) -> Result<()> {
     }
 
     // Package not in any feed — download the .ipk directly.
-    let arch = router
-        .run_ok("opkg print-architecture | grep -v all | grep -v noarch | tail -1 | awk '{print $2}'")?;
+    let arch = router.run_ok(
+        "opkg print-architecture | grep -v all | grep -v noarch | tail -1 | awk '{print $2}'",
+    )?;
     let arch = arch.trim();
 
     let url = ipk_url(arch).ok_or_else(|| {
@@ -162,8 +163,7 @@ pub fn install_tollgate_apk_native(router: &Router) -> Result<()> {
                 size
             );
         }
-        let (add_out, add_code) =
-            router.run("apk add --allow-untrusted /tmp/tollgate.apk 2>&1")?;
+        let (add_out, add_code) = router.run("apk add --allow-untrusted /tmp/tollgate.apk 2>&1")?;
         router.run_ok("rm -f /tmp/tollgate.apk")?;
         if add_code != 0 {
             anyhow::bail!("TollGate .apk install failed: {}", add_out.trim());

core/openwrt/src/tollgate/mod.rs

@@ -59,10 +59,17 @@ pub async fn provision(router: &Router, config: &TollGateConfig) -> Result<()> {
 
     config::apply(router, config)?;
     wifi::provision_ssid(router, config)?;
+    // Must come after provision_ssid (creates the `tollgate` network this
+    // folds the upstream installer's own default AP onto) — see
+    // regate_upstream_default_aps for why this is needed at all.
+    wifi::regate_upstream_default_aps(router)
+        .context("re-gate upstream tollgate-module-basic-go default AP(s)")?;
     // Must come after provision_ssid (which creates br-tollgate) and before
     // the daemon restart below — config.json is only read at startup.
     config::apply_daemon_config(router, config)
         .context("write /etc/tollgate/config.json — tollgate-wrt reads this, not UCI")?;
+    config::apply_payout_identity(router, config.payout_address.as_deref())
+        .context("write /etc/tollgate/identities.json owner payout address")?;
     // Also must come after provision_ssid: points gatewayinterface at
     // br-tollgate, which provision_ssid is what creates.
     nodogsplash::configure(router, config)

core/openwrt/src/tollgate/wifi.rs

@@ -118,6 +118,49 @@ fn provision_firewall(router: &Router) -> Result<()> {
     Ok(())
 }
 
+/// Fold the upstream `tollgate-module-basic-go` installer's own default
+/// AP(s) onto the gated `tollgate` network.
+///
+/// `install::install_ipk` runs the package's `/etc/uci-defaults/*` first-boot
+/// scripts itself (no real package manager to trigger them on OpenWrt 25.x —
+/// see its doc comment). Those upstream scripts rebrand OpenWrt's
+/// factory-default wifi sections (`wireless.default_radioN`, present on
+/// every fresh install) to a `TollGate-<serial>` SSID, but only ever touch
+/// the SSID — they leave `network` at its original `lan` binding. Nothing
+/// else in this project's own provisioning (`provision_ssid` above) ever
+/// looks at those sections; it only manages the separate `wireless.tollgate`
+/// SSID it creates itself. Left alone, the result is two open SSIDs
+/// broadcasting side by side: ours (gated by NoDogSplash) and upstream's
+/// (wide open on `lan`, with a direct route to whatever's plugged into the
+/// wired LAN port).
+///
+/// Confirmed live against archy-x250-pa3 2026-09-07: a client joining
+/// "TollGate-3458" landed on `br-lan` with unrestricted WAN forwarding and
+/// zero NoDogSplash involvement — free, unmetered internet, no captive
+/// portal, on the router's own admin network.
+///
+/// Must run after `provision_network` (needs the `tollgate` network/bridge
+/// to already exist) and before the network/wifi restart in
+/// `restart_services` picks the new binding up.
+pub fn regate_upstream_default_aps(router: &Router) -> Result<()> {
+    let sections = router.run_ok(
+        "uci show wireless 2>/dev/null | grep -o '^wireless\\.default_radio[0-9]*' | sort -u",
+    )?;
+    for section in sections.lines().map(str::trim).filter(|s| !s.is_empty()) {
+        let network_key = format!("{}.network", section);
+        let current = router.uci_get(&network_key).unwrap_or_default();
+        if current == "lan" {
+            info!(
+                "[{}] Re-gating upstream default AP {} (was network=lan) onto the tollgate network",
+                router.host, section
+            );
+            router.uci_set(&network_key, "tollgate")?;
+        }
+    }
+    router.uci_commit(Some("wireless"))?;
+    Ok(())
+}
+
 /// Return the first available wireless radio device name (e.g. "radio0").
 fn detect_radio(router: &Router) -> Result<String> {
     let out =

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.8.10-alpha",
+  "version": "1.8.11-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.8.10-alpha",
+      "version": "1.8.11-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.8.10-alpha",
+  "version": "1.8.11-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/src/views/appSession/__tests__/appSessionConfig.test.ts

@@ -64,10 +64,10 @@ describe('appSessionConfig', () => {
       configurable: true,
     })
 
-    // did-wallet's manifest publishes host port 8088 (apps/did-wallet/
+    // searxng's manifest publishes host port 8888 (apps/searxng/
     // manifest.yml) — assert against the manifest-generated value, which is
     // exactly what this test exists to protect.
-    expect(resolveAppUrl('did-wallet')).toBe('http://192.0.2.10:8088')
+    expect(resolveAppUrl('searxng')).toBe('http://192.0.2.10:8888')
   })
 
   it('does not treat service-only tcp ports as web launch surfaces', () => {

neode-ui/src/views/server/OpenWrtGateway.vue

@@ -36,6 +36,7 @@ interface TollGateStatus {
   min_steps?: number
   currency?: string
   mint_url?: string
+  payout_address?: string
 }
 
 interface WanStatus {
@@ -149,6 +150,7 @@ const editPriceSats = ref(10)
 const editStepSizeMin = ref(1)
 const editMinSteps = ref(1)
 const editMintUrl = ref('')
+const editPayoutAddress = ref('')
 const editEnabled = ref(true)
 
 // WAN setup flow
@@ -306,6 +308,7 @@ function startEditTollgate() {
   editStepSizeMin.value = Math.max(1, Math.round((tg?.step_size_ms ?? 60000) / 60000))
   editMinSteps.value = tg?.min_steps ?? 1
   editMintUrl.value = tg?.mint_url ?? ''
+  editPayoutAddress.value = tg?.payout_address ?? ''
   editEnabled.value = tg?.enabled ?? true
   updateTollgateError.value = ''
   editingTollgate.value = true
@@ -321,6 +324,7 @@ async function saveTollgateConfig() {
       step_size_ms: editStepSizeMin.value * 60_000,
       min_steps: editMinSteps.value,
       mint_url: editMintUrl.value,
+      payout_address: editPayoutAddress.value,
       enabled: editEnabled.value,
     }
     await rpcClient.call({ method: 'openwrt.provision-tollgate', params, timeout: 300000 })
@@ -935,6 +939,21 @@ onMounted(() => {
               class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white placeholder-white/30 focus:outline-none focus:border-white/40 transition-colors font-mono text-xs"
             />
           </div>
+          <div class="mb-4">
+            <label class="block text-xs text-white/40 mb-2">Payout Lightning address</label>
+            <input
+              v-model="editPayoutAddress"
+              type="text"
+              placeholder="you@yourwallet.example"
+              class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white placeholder-white/30 focus:outline-none focus:border-white/40 transition-colors font-mono text-xs"
+            />
+            <p class="mt-2 text-xs text-white/40">
+              Where TollGate's built-in auto-payout sends your share once the on-router balance
+              crosses its threshold. Leave blank to keep whatever's already set on the router —
+              on a router not originally provisioned here, that may be an upstream default you
+              don't control.
+            </p>
+          </div>
           <div class="flex items-center gap-2">
             <button
               :disabled="updatingTollgate"

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -362,6 +362,18 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.8.11-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.11-alpha</span>
+                  <span class="text-xs text-white/40">September 7, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Cuprate now syncs without burning a core for days.</strong> The app's shipped config now enables Cuprate's checkpoint-backed fast_sync path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.</p>
+                  <p><strong>OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.</strong> The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds opkg/apk through the router's actual PATH instead of assuming /usr/bin, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to v0.5.0 with a native .apk install path where upstream provides one.</p>
+                  <p><strong>Release publishing now checks the public Gitea download links before a manifest goes live.</strong> The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea ROOT_URL or proxy setting cannot publish working files behind broken public HTTPS download links.</p>
+                </div>
+              </div>
               <!-- v1.8.10-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">
@@ -369,9 +381,9 @@ init()
                   <span class="text-xs text-white/40">September 2, 2026</span>
                 </div>
                 <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
-                  <p><strong>Lightning sends work again.</strong> v1.8.9's move to LND 0.21's supported payment route shipped without a fee budget, and the API treats a missing one as zero allowed fees — so every wallet send failed "No route to the recipient" all day, on perfectly healthy channels. Payments now carry a proper fee budget and a test keeps it from ever regressing.</p>
-                  <p><strong>A channel that drops its peer link now heals itself — on every node.</strong> Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails "no route to the recipient". The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't. Nodes without LND are untouched; an unreachable peer is retried gently.</p>
-                  <p><strong>The Lightning wallet says what's actually wrong, instead of "you have no channel".</strong> Trying to send while a channel you just opened was still confirming — or when all its balance sits on the far side — produced a modal claiming you had no channel at all, and payment routing failures even showed the receiving copy. The gate now reads your real channel list: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", and only a genuinely channel-less node is sent to open one.</p>
+                  <p><strong>Lightning sends work again — v1.8.9's payment switch lost the fee budget.</strong> Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as <strong>zero allowed fees</strong>: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered "No route to the recipient" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (fee_limit=0 mSAT on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.</p>
+                  <p><strong>A channel that drops its peer link now heals itself — on every node.</strong> Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails "no route to the recipient". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.</p>
+                  <p><strong>The Lightning wallet states the node's real funding state instead of "you have no channel."</strong> Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the <em>receiving</em> copy. The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance.</p>
                 </div>
               </div>
               <!-- v1.8.9-alpha -->
@@ -381,12 +393,13 @@ init()
                   <span class="text-xs text-white/40">September 1, 2026</span>
                 </div>
                 <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
-                  <p><strong>Lightning sends work again after the LND 0.21.2 update.</strong> LND 0.21 removed the payment route the node's backend used — every send answered "Not Found". Payments now go through LND's supported v2 router route, slow multi-hop payments are still tracked to completion (never falsely declared failed), failures explain themselves in plain language, and a new test speaks the payment route directly at release-gate time so an image/backend mismatch like this can never ship silently again.</p>
-                  <p><strong>HTTP and HTTPS both work, and no longer break each other.</strong> The HTTPS listener used to pin a year-long browser policy (HSTS); once your browser had visited HTTPS, it silently rewrote the HTTP dashboard's calls to HTTPS — cross-origin, so everything showed "Failed to fetch"/CORS errors while the node was healthy. The pin is gone, the HTTPS listener now actively clears the stale policy browsers already cached (visit HTTPS once after this update to clear yours), and plain-HTTP access — which is deliberate on nodes whose self-signed certificate you haven't installed — keeps working exactly as before.</p>
-                  <p><strong>Apps open over HTTPS again, including Mempool, Bitcoin and IndeeHub.</strong> The launcher looked each app's port policy up in the signed catalog under the name you click, but the catalog lists that port under the app that owns it — so Mempool "did not connect", Bitcoin opened a plain-http tab, and Nostr sign-in on IndeeHub silently did nothing over HTTPS. Launches now follow the alias to the owning manifest, the catalog is loaded before the first app you open (not just in the App Store), and the Nostr bridge replies to the app frame's real origin instead of a stale recorded address.</p>
-                  <p><strong>Nginx Proxy Manager starts again.</strong> Its manifest was missing two things its image requires — the LetsEncrypt folder mount and the permission to bind low ports — leaving it in an endless restart loop on nodes that had it installed. Both are declared now; your existing certificates are untouched, and the fix arrives via the signed catalog without waiting for this release.</p>
-                  <p><strong>Portainer's first-run token is on the app page, not buried in "server logs".</strong> New Portainer versions hand the first admin a one-time setup token that was only printed in the container logs — on this box, that token now appears with your app's other credentials, with a copy button, and disappears once setup is done.</p>
-                  <p><strong>The Lightning wallet says what's actually wrong, instead of "you have no channel".</strong> Trying to send while a channel you just opened was still confirming — or when all its balance sits on the far side — produced a modal claiming you had no channel at all. The gate now looks at your real channel list: a confirming channel gets "it unlocks automatically once confirmed, nothing needed from you", a far-side balance gets "you can receive but there's nothing to send right now", and only a genuinely channel-less node is sent to open one.</p>
+                  <p><strong>Lightning sends work again after the LND 0.21.2 update.</strong> LND 0.21 removed the old synchronous payment route the node's backend paid through (/v1/channels/transactions) — every Lightning send answered the literal "Not Found" and the wallet showed "Payment failed: Not Found". The backend now pays through the supported Router.SendPaymentV2 route, keeps the same settle-then-report behaviour (a slow multi-hop payment is still tracked to completion, never falsely declared failed), and translates LND's failure reasons into plain advice. A new gate test speaks the payment route directly against the running LND, so an image/backend skew like this can never ship silently again.</p>
+                  <p><strong>The node no longer pins HSTS — HTTP access is a supported mode, and it stays working.</strong> The HTTPS listener used to send Strict-Transport-Security: max-age=31536000; includeSubDomains; browsers that visited HTTPS once cached that and then silently upgraded the still-open HTTP dashboard's calls to HTTPS, which is a scheme change — cross-origin — so every request died as "CORS blocked / Failed to fetch" while the node was perfectly healthy. The HTTPS listener now actively clears the cached policy (max-age=0) and port 80 sends no HSTS at all, which is deliberate: the node's certificate is optional and self-signed, and devices that haven't installed the CA must keep plain-HTTP access (that's what Settings → Node certificate is for). If your browser already cached the old policy, visiting the dashboard over HTTPS once after this update clears it; a gate test now refuses any config that reintroduces the pin.</p>
+                  <p><strong>App frames open over HTTPS again — including the ones that "did not connect."</strong> The launcher asked the signed catalog for each app's port policy under the name you click ("Mempool Web", "Bitcoin Knots"), but the catalog declares those ports under the manifest that owns them (the Mempool web container, Bitcoin UI). The lookup missed, the launcher handed the iframe an http:// address, and the browser blocked it as mixed content — the app tile went blank or spun forever. Port resolution now follows launch aliases (mempool-web, bitcoin-knots/bitcoin-core, lnd, electrs and friends), falls back to a port-wide catalog scan when the id is unknown, and the catalog is warmed as soon as the dashboard loads rather than only in the App Store, so the very first app you open already knows which ports serve TLS.</p>
+                  <p><strong>Signing in to IndeeHub with Nostr works over HTTPS.</strong> The NIP-07 bridge compared the app frame's origin for exact equality with the recorded http:// app URL — a frame the browser upgraded to HTTPS (or any scheme change) was silently ignored, and replies addressed to the stale origin were refused outright, so Nostr sign-in quietly did nothing. The bridge now matches host and port (scheme intentionally ignored) and always replies to the frame's real origin.</p>
+                  <p><strong>Nginx Proxy Manager starts again.</strong> Converting it to a platform manifest dropped two things its image needs: the /etc/letsencrypt mount its boot script hard-requires, and the NET_BIND_SERVICE capability its internal nginx needs to bind ports 80/443/81 under the orchestrator's --cap-drop=ALL. The result was an endless start/die loop (a node watched it restart 3,176 times). Both are declared in its manifest now, its certs live on unchanged under the same persistent app directory, and the signed catalog carries the fix so installed nodes heal on the next update.</p>
+                  <p><strong>Portainer's first-run token is in the app page, not buried in "server logs."</strong> New Portainer versions mint a one-time setup token on a fresh install and print it only to the container logs — on an appliance that meant telling the user to go read a server log to get into their own app. The token now appears in the same launch interstitial as app login credentials (with a copy button), only while first-run setup is actually pending; once the admin account exists the card disappears on its own.</p>
+                  <p><strong>The Lightning wallet states the node's real funding state instead of "you have no channel."</strong> Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had no channel at all (the outbound sum is legitimately zero in both states). The funding gate now reads the channel list it already fetched: a confirming channel gets "it unlocks automatically once confirmed, nothing is needed from you", a far-side balance gets "you can receive, but there's nothing to send right now", a routing/liquidity payment failure says so instead of pointing at channel setup, and only a genuinely channel-less node is sent to open one.</p>
                 </div>
               </div>
               <!-- v1.8.8-alpha -->

release-manifest.json

@@ -1,29 +1,29 @@
 {
   "changelog": [
-    "**Lightning sends work again — v1.8.9's payment switch lost the fee budget.** Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as **zero allowed fees**: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered \"No route to the recipient\" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (`fee_limit=0 mSAT` on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.",
-    "**A channel that drops its peer link now heals itself — on every node.** Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails \"no route to the recipient\". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.",
-    "**The Lightning wallet states the node's real funding state instead of \"you have no channel.\"** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the *receiving* copy. The funding gate now reads the channel list it already fetched: a confirming channel gets \"it unlocks automatically once confirmed, nothing is needed from you\", a far-side balance gets \"you can receive, but there's nothing to send right now\", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance."
+    "**Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.",
+    "**OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.",
+    "**Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links."
   ],
   "components": [
     {
-      "current_version": "1.8.10-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.10-alpha/archipelago",
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.8.10-alpha",
-      "sha256": "6c8bd41fed44cd999cb360c00e1b66a2d19d19812cc2b0c8a1677eec2a9579e6",
-      "size_bytes": 64178056
+      "new_version": "1.8.11-alpha",
+      "sha256": "ae569054edd6b2491beb101815f6809bc00c95a7dbe86bd084bcb9a7c36e1853",
+      "size_bytes": 64179264
     },
     {
-      "current_version": "1.8.10-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.10-alpha/archipelago-frontend-1.8.10-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.10-alpha.tar.gz",
-      "new_version": "1.8.10-alpha",
-      "sha256": "6b25de8a8e1a4f7fe51594f9bbbe21f5820f417af47a8b309c2dbf8f8723b719",
-      "size_bytes": 97736297
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago-frontend-1.8.11-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.11-alpha.tar.gz",
+      "new_version": "1.8.11-alpha",
+      "sha256": "192fd0470b6ccf66e78c80b4a4c3af5468882b85d81959362a3bd11f88b9d71d",
+      "size_bytes": 97741740
     }
   ],
-  "release_date": "2026-09-01",
-  "signature": "b69926bcb1851ff7d6a5b24519cd4a8015aab4ed4b588ee989d8ce6e3beaeb2cc0eb38078f522ded0d389fe53b7dbcdbf3f40c534b4bfafa5cf4a2ab2c59e40f",
+  "release_date": "2026-09-07",
+  "signature": "6449ce6ef35a4ef4fa6d0923bb58a2bff52ea5430d5532496e8f0af9ed52eaec293f19d7bec272dc9bc1af5fb2cdfa0e46068c827a9a4dd9cbef92d1c5845301",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.10-alpha"
+  "version": "1.8.11-alpha"
 }

releases/app-catalog.json

@@ -1319,7 +1319,7 @@
           "description": "Alternative Monero node implementation in Rust. Independently validates Monero consensus rules, providing a layer of security and redundancy for the network.",
           "files": [
             {
-              "content": "network = \"Mainnet\"\ntarget_max_memory = 3000000000\n\n[rpc.restricted]\nenable = true\n\n[tracing.stdout]\nlevel = \"info\"\n\n[tracing.file]\nlevel = \"info\"\nmax_log_files = 14\n",
+              "content": "network = \"Mainnet\"\nfast_sync = true\ntarget_max_memory = 8589934592\n\n[rpc.restricted]\nenable = true\n\n[tracing.stdout]\nlevel = \"info\"\n\n[tracing.file]\nlevel = \"info\"\nmax_log_files = 14\n",
               "overwrite": false,
               "path": "/var/lib/archipelago/cuprate/Cuprated.toml"
             }
@@ -1350,8 +1350,8 @@
               "protocol": "tcp"
             },
             {
-              "auth": "none",
-              "auth_rationale": "Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot hold a dashboard session cookie.",
+              "auth": "open",
+              "auth_rationale": "Monero restricted RPC — the subset upstream considers safe for public/remote-node use. Wallets (Feather, monero-wallet-rpc, GUI) connect directly over plain HTTP JSON-RPC and cannot complete a browser login or hold a dashboard session cookie.",
               "container": 18089,
               "host": 18090,
               "protocol": "tcp"
@@ -1360,7 +1360,7 @@
           "resources": {
             "cpu_limit": 0,
             "disk_limit": "300Gi",
-            "memory_limit": "4Gi"
+            "memory_limit": "10Gi"
           },
           "security": {
             "capabilities": [],
@@ -5429,7 +5429,7 @@
     }
   },
   "schema": 1,
-  "signature": "f982faeb9823062d9d39f6e4b38a171b4442cad0f35e74792ea161b5d77246ab9128044acbdc390ec23f921363af2d13bbba66c558b188d14d06a3f9a7f42406",
+  "signature": "3e87496a7197177ea295eba416cd1ed9a2c41ddca3328a160b1db2c65d39ce813c2b1e63df1313680a8e48e0113e2bbe6118df01df4a777bd33b189e7ef69206",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "updated": "2026-09-01"
+  "updated": "2026-09-03"
 }

releases/manifest.json

@@ -1,29 +1,29 @@
 {
   "changelog": [
-    "**Lightning sends work again — v1.8.9's payment switch lost the fee budget.** Moving payments to LND 0.21's supported route (Router.SendPaymentV2) shipped without a fee limit, and the v2 API treats an absent limit as **zero allowed fees**: every real route carries a routing fee, so the pathfinder rejected them all and the wallet answered \"No route to the recipient\" on every send — all day, on healthy channels with plenty of liquidity. The router debug log made it unambiguous (`fee_limit=0 mSAT` on every failing wallet payment; the same payment succeeded by hand the moment a fee limit was set). Payments now carry lncli's default budget (the payment amount), the wallet's amount handling for zero-value invoices is preserved, and a unit test pins the limit can never be zero again.",
-    "**A channel that drops its peer link now heals itself — on every node.** Restarting LND (an app update, a reboot, container churn) can leave a channel's peer connection down for hours while both endpoints keep the channel flagged disabled in the routing graph: the node looks perfectly healthy, the wallet shows balance, and every payment in either direction fails \"no route to the recipient\". Observed live: a node's only channel sat unroutable for ~17 hours after the LND 0.21.2 update, with no sign of it in any dashboard. The daemon now watches the channel graph as desired state — every open channel should have a live peer — and reconnects any that don't, using the peer's advertised addresses. Nodes without LND are untouched; an unreachable peer is retried gently, not hammered.",
-    "**The Lightning wallet states the node's real funding state instead of \"you have no channel.\"** Trying to send while a freshly opened channel was still waiting for on-chain confirmations — or when all its balance sits on the far side — raised a modal that claimed the node had NO channel at all (the outbound sum is legitimately zero in both states), pointed the user at opening a second channel, and — for payment routing failures — even showed the *receiving* copy. The funding gate now reads the channel list it already fetched: a confirming channel gets \"it unlocks automatically once confirmed, nothing is needed from you\", a far-side balance gets \"you can receive, but there's nothing to send right now\", a routing/liquidity payment failure says so instead of claiming channel problems, and only a genuinely channel-less node keeps the open-one guidance."
+    "**Cuprate now syncs without burning a core for days.** The app's shipped config now enables Cuprate's checkpoint-backed `fast_sync` path, raises the database cache to 8 GiB, and gives the container a 10 GiB memory limit so the cache has real headroom. A live comparison that motivated the change saw the affected node sit around 45% CPU while the corrected config held near low single digits at the same chain height and block rate. The restricted RPC remains fronted through the safe app gate/Tor path.",
+    "**OpenWrt Gateway setup is documented from a real install, and two setup bugs are fixed.** The new guide walks a node operator through flashing a GL.iNet AX3000 to stock OpenWrt, pairing it with Archipelago, and installing TollGate pay-as-you-go WiFi. The installer now finds `opkg`/`apk` through the router's actual `PATH` instead of assuming `/usr/bin`, the UI no longer sends an empty password over a saved router connection, and the pinned TollGate package moves to `v0.5.0` with a native `.apk` install path where upstream provides one.",
+    "**Release publishing now checks the public Gitea download links before a manifest goes live.** The publisher already fetched every artifact back and verified its size and SHA-256; this release adds a second guard for the release page itself, so a bad Gitea `ROOT_URL` or proxy setting cannot publish working files behind broken public HTTPS download links."
   ],
   "components": [
     {
-      "current_version": "1.8.10-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.10-alpha/archipelago",
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.8.10-alpha",
-      "sha256": "6c8bd41fed44cd999cb360c00e1b66a2d19d19812cc2b0c8a1677eec2a9579e6",
-      "size_bytes": 64178056
+      "new_version": "1.8.11-alpha",
+      "sha256": "ae569054edd6b2491beb101815f6809bc00c95a7dbe86bd084bcb9a7c36e1853",
+      "size_bytes": 64179264
     },
     {
-      "current_version": "1.8.10-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.10-alpha/archipelago-frontend-1.8.10-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.10-alpha.tar.gz",
-      "new_version": "1.8.10-alpha",
-      "sha256": "6b25de8a8e1a4f7fe51594f9bbbe21f5820f417af47a8b309c2dbf8f8723b719",
-      "size_bytes": 97736297
+      "current_version": "1.8.11-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.11-alpha/archipelago-frontend-1.8.11-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.11-alpha.tar.gz",
+      "new_version": "1.8.11-alpha",
+      "sha256": "192fd0470b6ccf66e78c80b4a4c3af5468882b85d81959362a3bd11f88b9d71d",
+      "size_bytes": 97741740
     }
   ],
-  "release_date": "2026-09-01",
-  "signature": "b69926bcb1851ff7d6a5b24519cd4a8015aab4ed4b588ee989d8ce6e3beaeb2cc0eb38078f522ded0d389fe53b7dbcdbf3f40c534b4bfafa5cf4a2ab2c59e40f",
+  "release_date": "2026-09-07",
+  "signature": "6449ce6ef35a4ef4fa6d0923bb58a2bff52ea5430d5532496e8f0af9ed52eaec293f19d7bec272dc9bc1af5fb2cdfa0e46068c827a9a4dd9cbef92d1c5845301",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.10-alpha"
+  "version": "1.8.11-alpha"
 }

scripts/check-gitea-release-download-links.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# check-gitea-release-download-links.sh - verify Gitea's public release page
+# points users at the canonical HTTPS download URLs, not an internal ROOT_URL.
+#
+# Usage:
+#   scripts/check-gitea-release-download-links.sh VERSION ASSET_NAME...
+
+set -euo pipefail
+
+VERSION="${1:-}"
+if [ -z "$VERSION" ] || [ "$#" -lt 2 ]; then
+  echo "usage: $0 VERSION ASSET_NAME..." >&2
+  exit 2
+fi
+shift
+
+PUBLIC_BASE="${ARCHY_RELEASE_PUBLIC_BASE:-https://source.archipelago-foundation.org/lfg2025/archy}"
+page_url="$PUBLIC_BASE/releases/tag/v$VERSION"
+
+command -v curl >/dev/null 2>&1 || { echo "ERROR: curl required" >&2; exit 2; }
+command -v python3 >/dev/null 2>&1 || { echo "ERROR: python3 required" >&2; exit 2; }
+
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+curl -fsSL "$page_url" -o "$tmp"
+
+python3 - "$tmp" "$PUBLIC_BASE" "$VERSION" "$page_url" "$@" <<'PY'
+from html.parser import HTMLParser
+from urllib.parse import quote
+import sys
+
+html_path, public_base, version, page_url, *assets = sys.argv[1:]
+with open(html_path, encoding="utf-8") as f:
+    html = f.read()
+
+class LinkParser(HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.hrefs = []
+
+    def handle_starttag(self, tag, attrs):
+        if tag.lower() != "a":
+            return
+        attrs = dict(attrs)
+        href = attrs.get("href")
+        if href:
+            self.hrefs.append(href)
+
+parser = LinkParser()
+parser.feed(html)
+hrefs = set(parser.hrefs)
+
+bad_internal = sorted(
+    h for h in hrefs
+    if "/releases/download/" in h and h.startswith(("http://", "https://"))
+    and not h.startswith(public_base + "/releases/download/")
+)
+
+failures = []
+for asset in assets:
+    expected = f"{public_base}/releases/download/v{quote(version)}/{quote(asset)}"
+    if expected not in hrefs:
+        matches = sorted(h for h in hrefs if h.endswith("/" + quote(asset)))
+        if matches:
+            failures.append(f"{asset}: expected {expected}, found {matches[0]}")
+        else:
+            failures.append(f"{asset}: expected {expected}, but no matching release-page link was found")
+
+if bad_internal:
+    failures.append("release page contains non-canonical download href(s):")
+    failures.extend(f"  {h}" for h in bad_internal[:10])
+
+if failures:
+    print(f"FAIL: public release page has broken download links: {page_url}", file=sys.stderr)
+    for failure in failures:
+        print(f"  {failure}", file=sys.stderr)
+    print(
+        "Fix the Gitea public URL/proxy configuration so release links are generated "
+        "from the canonical HTTPS origin, then re-run the publish check.",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+print(f"OK: public release page download links use {public_base}")
+PY

scripts/publish-release-assets.sh

@@ -145,6 +145,11 @@ echo "Verifying public download URLs (full GET + size + sha256)..."
 "$PROJECT_ROOT/scripts/check-release-assets.sh" "$MANIFEST" \
     || fail "asset verification failed — NOT pushing main. The manifest stays off the branch nodes read, so no node sees a version it cannot fetch. Repair the assets and re-run."
 
+"$PROJECT_ROOT/scripts/check-gitea-release-download-links.sh" "$VERSION" \
+    "archipelago" \
+    "archipelago-frontend-${VERSION}.tar.gz" \
+    || fail "release page download links are not public HTTPS URLs — fix Gitea ROOT_URL/proxy configuration before publishing."
+
 # Assets are proven fetchable — only now may the manifest become live. First
 # incorporate concurrent work, then promote in a dedicated commit. Until the
 # final push succeeds the remote still serves the previous manifest.
@@ -261,4 +266,10 @@ for b in bad:
 sys.exit(1 if bad else 0)
 PY
 
+"$PROJECT_ROOT/scripts/check-gitea-release-download-links.sh" "$VERSION" \
+    "$ISO_NAME" \
+    "$ISO_NAME.sha256" \
+    "$ISO_NAME.sha256.json" \
+    || fail "ISO is uploaded but the release page links are not public HTTPS URLs — fix Gitea ROOT_URL/proxy configuration."
+
 echo "ISO for v${VERSION} published and verified on $REMOTE."