Archipelago — open-source initial import

.gitea/workflows/build-iso.yml

@@ -1,62 +0,0 @@
-name: Build Archipelago release ISO (gated)
-
-# Resurrected from image-recipe/_archived/.gitea-workflows/build-iso-dev.yml.
-# Dispatch-only on purpose: the ISO is cut per release, not per push, and
-# the iso-builder runner is a live node — builds are deliberate events.
-on:
-  workflow_dispatch:
-
-jobs:
-  build-iso:
-    runs-on: iso-builder
-    timeout-minutes: 180
-    steps:
-      - name: Sync source to workspace
-        run: |
-          # Direct fetch + sync (actions/checkout token is broken on this Gitea)
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR" && git fetch origin main && git reset --hard origin/main
-          echo "=== Source at commit: $(git log --oneline -1) ==="
-
-      - name: Install ISO build dependencies
-        run: |
-          if dpkg -s debootstrap squashfs-tools xorriso isolinux syslinux-common mtools \
-               grub-efi-amd64-bin grub-pc-bin grub-common >/dev/null 2>&1; then
-            echo "ISO build deps already installed, skipping apt"
-          else
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq \
-              debootstrap squashfs-tools xorriso \
-              isolinux syslinux-common mtools \
-              grub-efi-amd64-bin grub-pc-bin grub-common
-          fi
-
-      - name: Build backend + frontend if stale
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR"
-          . "$HOME/.cargo/env" 2>/dev/null || true
-          VERSION=$(grep -m1 '^version' core/archipelago/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
-          if ! strings core/target/release/archipelago 2>/dev/null | grep -qF "$VERSION"; then
-            cargo build --release --manifest-path core/Cargo.toml -p archipelago
-          fi
-          if ! grep -rqoF "$VERSION" web/dist/neode-ui/assets/*.js 2>/dev/null; then
-            (cd neode-ui && npm ci && npm run build)
-          fi
-
-      - name: Gated ISO build (gates + build + smoke + qemu)
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          cd "$REPO_DIR"
-          . "$HOME/.cargo/env" 2>/dev/null || true
-          bash scripts/build-iso-release.sh
-
-      - name: Report artifacts
-        if: always()
-        run: |
-          REPO_DIR="$HOME/Projects/archy"
-          [ -d "$REPO_DIR" ] || REPO_DIR="$HOME/archy"
-          ls -lh "$REPO_DIR"/image-recipe/results/*.iso 2>/dev/null | tail -3 || echo "no ISO produced"

.gitea/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
+#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN
@@ -18,7 +18,7 @@ on:
     paths:
       - 'neode-ui/**'
       - 'docker-compose.demo.yml'
-      - '.gitea/workflows/demo-images.yml'
+      - '.github/workflows/demo-images.yml'
   workflow_dispatch:
 
 jobs:

.gitea/workflows/post-install-tests.yml

@@ -4,11 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: 'Target node IP or hostname'
+        description: 'Target node IP (e.g. 192.168.1.198)'
         required: true
+        default: '192.168.1.198'
       password:
-        description: 'Node UI password (leave blank to use the NODE_UI_PASSWORD secret)'
+        description: 'Node password (or "auto" for fresh install)'
         required: false
+        default: 'auto'
 
 jobs:
   post-install-tests:
@@ -20,46 +22,33 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Install SSH key
-        env:
-          SSH_KEY: ${{ secrets.NODE_SSH_KEY }}
-        run: |
-          if [ -z "$SSH_KEY" ]; then
-            echo "ERROR: repository secret NODE_SSH_KEY is not configured."
-            echo "Post-install tests authenticate by key; password auth is not supported."
-            exit 1
-          fi
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-
       - name: Run post-install tests on target
-        env:
-          TARGET: ${{ github.event.inputs.target }}
-          NODE_PASSWORD: ${{ github.event.inputs.password }}
-          NODE_UI_PASSWORD: ${{ secrets.NODE_UI_PASSWORD }}
-          SSH_USER: ${{ vars.NODE_SSH_USER }}
         run: |
-          PASSWORD="${NODE_PASSWORD:-$NODE_UI_PASSWORD}"
-          if [ -z "$PASSWORD" ]; then
-            echo "ERROR: no node password supplied (input or NODE_UI_PASSWORD secret)."
-            exit 1
+          TARGET="${{ github.event.inputs.target }}"
+          PASSWORD="${{ github.event.inputs.password }}"
+          if [ "$PASSWORD" = "auto" ]; then
+            PASSWORD="testpass123!"
           fi
-          USER_NAME="${SSH_USER:-archipelago}"
 
           echo "══════════════════════════════════════════"
           echo "Running post-install tests on $TARGET"
           echo "══════════════════════════════════════════"
 
-          scp -o StrictHostKeyChecking=accept-new \
+          # Copy test script to target and run
+          sshpass -p 'archipelago' scp -o StrictHostKeyChecking=no \
             scripts/run-post-install-tests.sh \
-            "${USER_NAME}@${TARGET}:/tmp/run-post-install-tests.sh"
+            archipelago@${TARGET}:/tmp/run-post-install-tests.sh 2>/dev/null || \
+          scp -o StrictHostKeyChecking=no \
+            scripts/run-post-install-tests.sh \
+            archipelago@${TARGET}:/tmp/run-post-install-tests.sh
 
-          # Password is passed over stdin, never as an argv the node's process
-          # list (or this job's log) would expose.
-          printf '%s' "$PASSWORD" | ssh -o StrictHostKeyChecking=accept-new \
-            "${USER_NAME}@${TARGET}" \
-            "sudo bash /tmp/run-post-install-tests.sh --password-stdin"
+          # Run tests (with sudo for service checks)
+          sshpass -p 'archipelago' ssh -o StrictHostKeyChecking=no \
+            archipelago@${TARGET} \
+            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'" 2>/dev/null || \
+          ssh -o StrictHostKeyChecking=no \
+            archipelago@${TARGET} \
+            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'"
 
   frontend-tests:
     runs-on: ubuntu-latest

.githooks/pre-push

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Keep the served companion APK in sync with main on every push.
+#
+# When a push to main includes Android changes, rebuild the APK, refresh
+# neode-ui/public/packages/archipelago-companion.apk, commit it, and ask
+# you to push again (so the refreshed APK rides along in the same push).
+#
+# Enable once per clone:  git config core.hooksPath .githooks
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "$ROOT"
+
+# ship-companion.sh already (re)published the APK for this push — don't redo it.
+[ -n "${SHIP_COMPANION:-}" ] && exit 0
+
+PUSH_MAIN=0; RANGE_OLD=""; RANGE_NEW=""
+while read -r _local_ref local_sha remote_ref remote_sha; do
+  if [ "${remote_ref##*/}" = "main" ]; then
+    PUSH_MAIN=1; RANGE_OLD="$remote_sha"; RANGE_NEW="$local_sha"
+  fi
+done
+[ "$PUSH_MAIN" = "1" ] || exit 0
+
+# Loop-break: if the tip is already the auto APK commit, let the push proceed.
+case "$(git log -1 --pretty=%s)" in
+  *"companion APK"*) exit 0 ;;
+esac
+
+# Only rebuild when this push actually touches the Android app.
+ZEROS="0000000000000000000000000000000000000000"
+if [ -z "$RANGE_OLD" ] || [ "$RANGE_OLD" = "$ZEROS" ]; then
+  ANDROID_CHANGED=1
+elif git diff --quiet "$RANGE_OLD" "$RANGE_NEW" -- Android/ 2>/dev/null; then
+  ANDROID_CHANGED=0
+else
+  ANDROID_CHANGED=1
+fi
+[ "$ANDROID_CHANGED" = "1" ] || exit 0
+
+bash scripts/publish-companion-apk.sh || exit 0
+
+DEST="neode-ui/public/packages/archipelago-companion.apk"
+if git diff --cached --quiet -- "$DEST"; then
+  exit 0   # APK unchanged — nothing to do
+fi
+
+git commit -q -m "chore(android): update companion APK download [skip ci]"
+echo "" >&2
+echo "▶ Companion APK rebuilt and committed. Run your push again to include it." >&2
+exit 1

.github/pull_request_template.md

@@ -1,16 +1,16 @@
 ## Summary
 
-<!-- What changed and why? -->
+<!-- Brief description of what this PR does -->
 
-## Verification
+## Changes
 
-<!-- Commands run, devices tested, screenshots, or reason testing was not run. -->
+-
 
 ## Checklist
 
-- [ ] Rust formatting/clippy/tests pass when backend code changed.
-- [ ] Frontend type-check/build/tests pass when frontend code changed.
-- [ ] App manifests validate when app packaging changed.
-- [ ] Generated catalogs are updated when manifest-owned catalog fields changed.
-- [ ] Docs are updated for user-facing or developer-facing behavior changes.
-- [ ] No secrets, generated build outputs, local screenshots, or private host details are included.
+- [ ] TypeScript type-check passes (`npm run type-check`)
+- [ ] Frontend builds (`npm run build`)
+- [ ] Tests pass (`npm test`)
+- [ ] Rust clippy clean (if backend changes)
+- [ ] No new compiler warnings
+- [ ] Tested on live server

.github/workflows/ci.yml

@@ -8,11 +8,11 @@ on:
 
 env:
   RUST_VERSION: stable
-  NODE_VERSION: 20
+  NODE_VERSION: 18
 
 jobs:
   rust:
-    name: Rust
+    name: Rust (fmt + clippy + test)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -28,35 +28,17 @@ jobs:
           toolchain: ${{ env.RUST_VERSION }}
           components: rustfmt, clippy
 
-      - name: Format
+      - name: Check formatting
         run: cargo fmt --all -- --check
 
-      # KEY-05 layer (b) is enforced HERE, with no step of its own: core/clippy.toml
-      # bans the defaulted RNG entry points, and `-D warnings` already turns a
-      # `disallowed_methods` hit into a build failure. `--all-targets` covers tests
-      # too, deliberately. See docs/security/KEY-05-ENTROPY-ENFORCEMENT.md
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      # KEY-05 layer (c) — see core/deny.toml for the policy and its rationale.
-      #
-      # The version is pinned deliberately. EmbarkStudios/cargo-deny-action exposes
-      # no input to pin the cargo-deny version, and an unpinned supply-chain checker
-      # is a contradiction in terms, so the tool is installed from crates.io — the
-      # source actually vetted at the 10-06 Task 5 legitimacy checkpoint — rather
-      # than by adding another unvetted action to this workflow.
-      #
-      # `check bans` ONLY: the advisories gate is not enabled (bans-only policy).
-      - name: Supply chain (cargo-deny)
-        run: |
-          cargo install --locked cargo-deny --version 0.20.2
-          cargo deny check bans
-
-      - name: Test
+      - name: Tests
         run: cargo test --all-features
 
   frontend:
-    name: Frontend
+    name: Frontend (type-check + lint)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -70,54 +52,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: npm
+          cache: 'npm'
           cache-dependency-path: neode-ui/package-lock.json
 
-      - name: Install
+      - name: Install dependencies
         run: npm ci
 
       - name: Type check
         run: npm run type-check
 
-      - name: Test
-        run: npm test
-
       - name: Build
         run: npm run build
-
-  manifests:
-    name: App Manifests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install YAML parser
-        run: python3 -m pip install --quiet pyyaml
-
-      - name: Validate manifests
-        run: |
-          for manifest in apps/*/manifest.yml; do
-            ./scripts/validate-app-manifest.sh --repo-audit "$manifest"
-          done
-
-      # The signed catalog overrides on-disk manifests on every node, so a
-      # catalog naming a registry host the deployed fleet does not trust breaks
-      # every install fleet-wide. Blocking, and cheap.
-      - name: Catalog registry trust floor
-        run: python3 scripts/check-catalog-registry-trust.py
-
-      # A stale image literal on the fallback install path deploys an old
-      # image after the manifest has moved on — how a withdrawn, vulnerable
-      # release gets installed post-fix. Blocking.
-      - name: Installer image pins
-        run: python3 scripts/check-installer-image-pins.py
-
-      # Advisory: shows where the release catalog has fallen behind the
-      # manifests in this repo. Not blocking, because the catalog can only be
-      # updated through the signing ceremony, so drift is expected between a
-      # manifest landing and the next signed release.
-      - name: Catalog drift (advisory)
-        continue-on-error: true
-        run: python3 scripts/check-app-catalog-drift.py --catalog releases/app-catalog.json --release

.github/workflows/demo-images.yml

@@ -5,7 +5,7 @@ name: Demo images
 # code (see demo-deploy/ and docs/demo-deployment-design.md).
 #
 # Required repo configuration:
-#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
+#   vars.DEMO_REGISTRY        e.g. 146.59.87.168:3000/lfg2025
 #   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
 #   secrets.DEMO_REGISTRY_USER
 #   secrets.DEMO_REGISTRY_TOKEN

.gitignore

@@ -1,9 +1,10 @@
-# SSH keys and sandbox copies
+# SSH keys (sandbox copies)
 .ssh/
 
 # Rust build output
 target/
 **/target/
+Cargo.lock
 
 # Node.js
 node_modules/
@@ -11,6 +12,7 @@ node_modules/
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+package-lock.json
 pnpm-debug.log*
 
 # Build outputs
@@ -19,9 +21,6 @@ dist-ssr/
 build/
 *.local
 
-# Vite build cache
-neode-ui/.vite/
-
 # IDE / editor
 .idea/
 .vscode/
@@ -29,53 +28,49 @@ neode-ui/.vite/
 *.swo
 *~
 .DS_Store
-._*
-Thumbs.db
 
 # Environment and local overrides
 .env
 .env.local
 .env.*.local
-.env.production
-core/.env.production
 scripts/deploy-config.sh
 
 # Logs
 logs/
 *.log
 
+# OS
+.DS_Store
+Thumbs.db
+
 # Testing
 coverage/
 .nyc_output/
 
-# Image / release artifacts
+# Temporary files
+*.tmp
+*.temp
+
+# Build artifacts
 *.iso
 *.img
 *.dmg
 *.app
-*.apk
-*.keystore
-*.s9pk
-*.tar.gz
 
-# Release artifacts live in release attachments, not Git history.
+# Release artifacts live in Gitea Release attachments, not Git history.
 releases/**
 !releases/
 !releases/manifest.json
-# The signed app catalog and the registry trust floor are source, not build
-# output: nodes fetch the catalog from this path on main, and the floor is what
-# scripts/check-catalog-registry-trust.py checks it against. Both were being
-# swallowed by the rule above — app-catalog.json only stayed tracked because it
-# predates it.
-!releases/app-catalog.json
-!releases/registry-trust-floor.json
+
+# macOS build output
+build/macos/
 
 # Image recipe output
 image-recipe/output/
 image-recipe/*.iso
 image-recipe/*.img
 
-# Loop tool artifacts
+# Loop tool artifacts (created in every subdirectory)
 */loop/
 loop/loop/
 loop/loop.log.bak
@@ -83,82 +78,21 @@ loop/loop.log.bak
 # Separate repos nested in tree
 web/
 
-# Resilience harness reports contain session cookies.
+._*
+
+# Resilience harness reports (generated, contains session cookies)
 scripts/resilience/reports/
 
 # Codex / pnpm / python caches / editor backups
 .codex
 .codex-target-*/
 .codex-tmp/
-.claude/
 .pnpm-store/
-
-# Key material and local databases — belt-and-braces so a stray key or a
-# copied node database can never be committed. Open-source readiness plan,
-# Phase 1 item 5: `.claude/settings.local.json` was previously only caught by
-# a machine-global ignore rule, which protects one machine and no contributor.
-*.key
-*.pem
-id_rsa*
-*.sqlite
-*.sqlite3
-*.db
-
-# ...except the throwaway TLS fixtures the appgate tests compile in via
-# include_bytes!. They are documented non-identity material (see that
-# directory's README) and are already tracked; the negation stops the rule
-# above from silently dropping them if they are ever regenerated.
-!core/archipelago/src/appgate/testdata/*.key
 **/__pycache__/
 *.bak
+.claude/scheduled_tasks.lock
 
 # Local evidence screenshots; intentional UI screenshots should live under an
 # app/docs asset path with a descriptive filename.
 Screenshot *.png
 uploads/
-
-# ── Local-only material ─────────────────────────────────────────────────────
-# Present on disk, never tracked: everything describing Archipelago's own
-# infrastructure or internal development process. The repo is source code and
-# guidelines only. Inventory: .local-only/manifest.txt — wipe: .local-only/wipe.sh
-/.local-only/
-/.planning/
-/loop/
-/docs/operations-runbook.md
-/docs/hotfix-process.md
-/docs/PRODUCTION-MASTER-PLAN.md
-/docs/UNIFIED-TASK-TRACKER.md
-/docs/FIPS-UPTIME-AND-UI-STATE-PLAN.md
-/docs/HANDOFF-2026-07-20-fips-peer-files.md
-/docs/HANDOFF-2026-07-23-companion-apk-deploy.md
-/docs/qr-scanner-snappiness-handover.md
-/docs/RETICULUM-TRANSPORT-PROGRESS.md
-/docs/combined-test-plan-2026-07-22.md
-/docs/pine-voice-release-test-plan.md
-/docs/OPEN-SOURCE-READINESS-PLAN.md
-/docs/archive/HANDOVER-2026-07-02-iso-feedback.md
-/docs/archive/SESSION-1.8.0-OTA-PROGRESS.md
-/docs/security/KEY-02-FLEET-ROTATION.md
-/docs/security/KEY-03-SIGNING-POSTURE.md
-/tests/production-quality/TRACKER.md
-/scripts/deploy-config-defaults.sh
-/scripts/deploy-tailscale.sh
-/scripts/deploy-to-target.sh
-/scripts/setup-target-dev.sh
-/scripts/setup-aiui-server.sh
-/scripts/setup-https-dev.sh
-/scripts/debug-frontend.sh
-/scripts/node-profile.sh
-/scripts/fleet-fips-pair.sh
-/scripts/fleet-fips-unpair.sh
-/image-recipe/sync-from-live.sh
-/docs/security/PHASE-10-VERIFICATION-GUIDE.md
-/docs/security/KEY-01-ON-NODE-VERIFICATION.md
-/docs/security/KEY-02-ROOTFS-EVIDENCE.md
-/docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md
-/image-recipe/INTEGRATION-GUIDE.md
-/docs/multinode-testing-plan.md
-/docs/bitcoin-version-bulletproof-rollout.md
-
-# Generated PWA dev output (vite-plugin-pwa) — never a source artifact
-neode-ui/dev-dist/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "indeedhub"]
+	path = indeedhub
+	url = http://146.59.87.168:3000/lfg2025/indeehub.git

Android/.gitignore

@@ -19,7 +19,3 @@ local.properties
 # updates then install over the top without an uninstall. Debug keys are not
 # secret (well-known password "android"); never commit a real release keystore.
 !/app/debug.keystore
-
-# Rust build outputs (archy-fips-core → jniLibs via buildRustArm64)
-/rust/archy-fips-core/target
-/app/src/main/jniLibs

Android/COMPANION_RELEASE.md

@@ -23,10 +23,6 @@ used by the `.githooks/pre-push` hook), which:
    **aborts** if any is missing.
 5. Stages the signed APK at `neode-ui/public/packages/archipelago-companion.apk`,
    commits, and pushes with `SHIP_COMPANION=1` (the sanctioned pre-push bypass).
-6. The first-launch companion modal and Android "Share this app" QR point at
-   `http://146.59.87.168:2100/packages/archipelago-companion.apk`. After the
-   repo artifact is built, mirror that exact APK to the VPS2-served path before
-   calling the release done.
 
 **Never** hand-roll `gradlew assembleDebug` + `cp` to the served path. That path
 skips the clean build and the signature enforcement and is exactly how a broken
@@ -86,16 +82,13 @@ home-screen app layouts wiped by an over-broad action.
 
 ## Verify the published download after shipping
 
-The checked-in artifact is Gitea raw-on-main. The QR/App Store download served
-to users is the VPS2 `:2100` URL. Confirm both live byte streams match what you
-built and signed:
+The download served to nodes is Gitea raw-on-main. Confirm the live bytes match
+what you built and signed:
 
 ```bash
 SERVED=neode-ui/public/packages/archipelago-companion.apk
-GITEA_URL=https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/$SERVED
-QR_URL=http://146.59.87.168:2100/packages/archipelago-companion.apk
-curl -sS -o /tmp/live-gitea.apk "$GITEA_URL"
-curl -sS -o /tmp/live-qr.apk "$QR_URL"
-shasum -a 256 "$SERVED" /tmp/live-gitea.apk /tmp/live-qr.apk  # all must match
-apksigner verify -v --min-sdk-version 21 /tmp/live-qr.apk | grep -i "scheme"  # v1/v2/v3 = true
+URL=http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/$SERVED
+curl -sS -o /tmp/live.apk "$URL"
+shasum -a 256 "$SERVED" /tmp/live.apk          # must match
+apksigner verify -v --min-sdk-version 21 /tmp/live.apk | grep -i "scheme"  # v1/v2/v3 = true
 ```

Android/app/build.gradle.kts

@@ -11,17 +11,12 @@ android {
         applicationId = "com.archipelago.app"
         minSdk = 26
         targetSdk = 35
-        versionCode = 45
-        versionName = "0.5.25"
+        versionCode = 18
+        versionName = "0.4.14"
 
         vectorDrawables {
             useSupportLibrary = true
         }
-
-        // The embedded FIPS mesh (libarchy_fips_core.so) is built arm64-only,
-        // matching real handsets. FipsNative.available gates every call, so
-        // the app still runs as a plain companion elsewhere (e.g. x86 emu).
-        ndk { abiFilters += "arm64-v8a" }
     }
 
     signingConfigs {
@@ -85,44 +80,6 @@ android {
     }
 }
 
-// ---------------------------------------------------------------------------
-// Embedded FIPS mesh: cross-compile Android/rust/archy-fips-core via cargo-ndk
-// into jniLibs before the native-libs merge, so a plain `gradlew assembleDebug`
-// builds the Rust too. Requires rustup target aarch64-linux-android, cargo-ndk,
-// and an NDK (ANDROID_NDK_HOME or the SDK's ndk/ dir).
-// ---------------------------------------------------------------------------
-val rustCrateDir = layout.projectDirectory.dir("../rust/archy-fips-core")
-val jniLibsDir = layout.projectDirectory.dir("src/main/jniLibs")
-
-tasks.register<Exec>("buildRustArm64") {
-    workingDir = rustCrateDir.asFile
-    inputs.dir(rustCrateDir.dir("src"))
-    inputs.file(rustCrateDir.file("Cargo.toml"))
-    outputs.dir(jniLibsDir)
-    // cargo/cargo-ndk live in ~/.cargo/bin, which Gradle's env may not have.
-    val home = System.getProperty("user.home")
-    environment("PATH", "$home/.cargo/bin:${System.getenv("PATH")}")
-    if (System.getenv("ANDROID_NDK_HOME") == null) {
-        val sdkNdk = file("$home/Library/Android/sdk/ndk")
-            .listFiles()?.maxByOrNull { it.name }
-        if (sdkNdk != null) environment("ANDROID_NDK_HOME", sdkNdk.absolutePath)
-    }
-    commandLine(
-        "cargo", "ndk",
-        "-t", "arm64-v8a",
-        "--platform", "26",
-        "-o", jniLibsDir.asFile.absolutePath,
-        "build", "--release",
-    )
-}
-
-tasks.matching {
-    it.name in listOf(
-        "mergeDebugNativeLibs", "mergeReleaseNativeLibs",
-        "mergeDebugJniLibFolders", "mergeReleaseJniLibFolders",
-    )
-}.configureEach { dependsOn("buildRustArm64") }
-
 dependencies {
     val composeBom = platform("androidx.compose:compose-bom:2024.05.00")
     implementation(composeBom)

Android/app/src/main/AndroidManifest.xml

@@ -7,10 +7,6 @@
     <!-- Pairing-QR scanner. Camera is optional: manual entry still works without one. -->
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-feature android:name="android.hardware.camera.any" android:required="false" />
-    <!-- Embedded FIPS mesh tunnel (ArchyVpnService) runs as a foreground service. -->
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
     <application
         android:name=".ArchipelagoApp"
@@ -23,18 +19,6 @@
         android:usesCleartextTraffic="true"
         tools:targetApi="35">
 
-        <!-- Party-screen "Share this app": exposes the copied APK from
-             cache/share/ to the system share sheet, nothing else. -->
-        <provider
-            android:name="androidx.core.content.FileProvider"
-            android:authorities="${applicationId}.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-                android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/file_paths" />
-        </provider>
-
         <activity
             android:name=".MainActivity"
             android:exported="true"
@@ -55,21 +39,6 @@
                 <data android:scheme="archipelago" android:host="pair" />
             </intent-filter>
         </activity>
-
-        <!-- Embedded FIPS mesh node: split-tunnel VpnService (fd00::/8 only),
-             configured entirely by scanning the node's pairing QR. -->
-        <service
-            android:name=".fips.ArchyVpnService"
-            android:exported="false"
-            android:foregroundServiceType="specialUse"
-            android:permission="android.permission.BIND_VPN_SERVICE">
-            <property
-                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="mesh-vpn-tunnel" />
-            <intent-filter>
-                <action android:name="android.net.VpnService" />
-            </intent-filter>
-        </service>
     </application>
 
 </manifest>

Android/app/src/main/java/com/archipelago/app/data/ServerPreferences.kt

@@ -19,45 +19,25 @@ data class ServerEntry(
     val port: String = "",
     val password: String = "",
     val name: String = "",
-    /** Node's FIPS mesh ULA (IPv6) — reachable from anywhere once meshed. */
-    val meshIp: String = "",
-    /** Node's FIPS npub — the durable identity. When present it, not the
-     *  address, is what identifies the entry: FIPS peers on npubs, IPs are
-     *  only dial hints (docs/companion-pairing-qr.md, npub-first contract). */
-    val npub: String = "",
 ) {
     /** Label to show in lists — the user-given name, or the address if unnamed. */
     fun displayName(): String = name.ifBlank { address }
 
-    /** Bracket bare IPv6 literals (the mesh ULA) so they form valid URLs. */
-    private fun urlHost(host: String): String =
-        if (host.contains(":") && !host.startsWith("[")) "[$host]" else host
-
     fun toUrl(): String {
         val scheme = if (useHttps) "https" else "http"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://${urlHost(address)}$portSuffix"
+        return "$scheme://$address$portSuffix"
     }
 
     fun toWsUrl(): String {
         val scheme = if (useHttps) "wss" else "ws"
         val portSuffix = if (port.isNotBlank()) ":$port" else ""
-        return "$scheme://${urlHost(address)}$portSuffix"
+        return "$scheme://$address$portSuffix"
     }
 
-    /** Mesh-address UI URL, or null when the node never advertised one. */
-    fun toMeshUrl(): String? =
-        meshIp.takeIf { it.isNotBlank() }?.let { "http://${urlHost(it)}" }
-
-    // name/meshIp/npub are trailing fields so entries saved before they
-    // existed (4/5/6 fields) still deserialize, defaulting to "".
-    fun serialize(): String = "$address|$useHttps|$port|$password|$name|$meshIp|$npub"
-
-    /** Same node as [other]? npub identity wins; address/port/scheme is the
-     *  fallback for LAN-only entries that never advertised FIPS. */
-    fun sameNode(other: ServerEntry): Boolean =
-        (npub.isNotBlank() && npub == other.npub) ||
-            (address == other.address && port == other.port && useHttps == other.useHttps)
+    // name is the trailing field so entries saved before naming existed
+    // (4 fields) still deserialize, with name defaulting to "".
+    fun serialize(): String = "$address|$useHttps|$port|$password|$name"
 
     companion object {
         fun deserialize(raw: String): ServerEntry? {
@@ -69,8 +49,6 @@ data class ServerEntry(
                 port = parts.getOrElse(2) { "" },
                 password = parts.getOrElse(3) { "" },
                 name = parts.getOrElse(4) { "" },
-                meshIp = parts.getOrElse(5) { "" },
-                npub = parts.getOrElse(6) { "" },
             )
         }
     }
@@ -83,11 +61,8 @@ class ServerPreferences(private val context: Context) {
     private val activePortKey = stringPreferencesKey("active_port")
     private val activePasswordKey = stringPreferencesKey("active_password")
     private val activeNameKey = stringPreferencesKey("active_name")
-    private val activeMeshIpKey = stringPreferencesKey("active_mesh_ip")
-    private val activeNpubKey = stringPreferencesKey("active_npub")
     private val savedServersKey = stringSetPreferencesKey("saved_servers")
     private val introSeenKey = booleanPreferencesKey("intro_seen")
-    private val gestureHintSeenKey = booleanPreferencesKey("gesture_hint_seen")
 
     val activeServer: Flow<ServerEntry?> = context.dataStore.data.map { prefs ->
         val address = prefs[activeAddressKey] ?: return@map null
@@ -97,8 +72,6 @@ class ServerPreferences(private val context: Context) {
             port = prefs[activePortKey] ?: "",
             password = prefs[activePasswordKey] ?: "",
             name = prefs[activeNameKey] ?: "",
-            meshIp = prefs[activeMeshIpKey] ?: "",
-            npub = prefs[activeNpubKey] ?: "",
         )
     }
 
@@ -111,11 +84,6 @@ class ServerPreferences(private val context: Context) {
         prefs[introSeenKey] ?: false
     }
 
-    /** One-shot flag for the three-finger-hold teaching overlay. */
-    val gestureHintSeen: Flow<Boolean> = context.dataStore.data.map { prefs ->
-        prefs[gestureHintSeenKey] ?: false
-    }
-
     suspend fun setActiveServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             prefs[activeAddressKey] = server.address
@@ -123,8 +91,6 @@ class ServerPreferences(private val context: Context) {
             prefs[activePortKey] = server.port
             prefs[activePasswordKey] = server.password
             prefs[activeNameKey] = server.name
-            prefs[activeMeshIpKey] = server.meshIp
-            prefs[activeNpubKey] = server.npub
         }
         addSavedServer(server)
     }
@@ -136,8 +102,6 @@ class ServerPreferences(private val context: Context) {
             prefs.remove(activePortKey)
             prefs.remove(activePasswordKey)
             prefs.remove(activeNameKey)
-            prefs.remove(activeMeshIpKey)
-            prefs.remove(activeNpubKey)
         }
     }
 
@@ -149,66 +113,63 @@ class ServerPreferences(private val context: Context) {
     }
 
     /**
-     * Replace a saved server in place. Matches the existing entry by node
-     * identity — npub first, address/port/scheme as the LAN-only fallback
-     * (ServerEntry.sameNode) — so edits that change the name, password or even
-     * every address still update the right record. An edit form that doesn't
-     * carry the npub keeps the stored one. If the edited server is also the
-     * active one, the active record is kept in sync.
+     * Replace a saved server in place. Matches the existing entry by connection
+     * identity (address/port/scheme) so edits that change the name or password —
+     * or that touch a legacy 4-field entry — still update the right record. If the
+     * edited server is also the active one, the active record is kept in sync.
      */
     suspend fun updateSavedServer(original: ServerEntry, updated: ServerEntry) {
-        val toStore = updated.copy(npub = updated.npub.ifBlank { original.npub })
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
             val filtered = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(original) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == original.address &&
+                    e.port == original.port &&
+                    e.useHttps == original.useHttps
             }.toSet()
-            prefs[savedServersKey] = filtered + toStore.serialize()
+            prefs[savedServersKey] = filtered + updated.serialize()
 
-            val activeNpub = prefs[activeNpubKey] ?: ""
-            val isActive = (activeNpub.isNotBlank() && activeNpub == original.npub) ||
-                (
-                    prefs[activeAddressKey] == original.address &&
-                        (prefs[activePortKey] ?: "") == original.port &&
-                        (prefs[activeHttpsKey] ?: false) == original.useHttps
-                    )
+            val isActive = prefs[activeAddressKey] == original.address &&
+                (prefs[activePortKey] ?: "") == original.port &&
+                (prefs[activeHttpsKey] ?: false) == original.useHttps
             if (isActive) {
-                prefs[activeAddressKey] = toStore.address
-                prefs[activeHttpsKey] = toStore.useHttps
-                prefs[activePortKey] = toStore.port
-                prefs[activePasswordKey] = toStore.password
-                prefs[activeNameKey] = toStore.name
-                prefs[activeMeshIpKey] = toStore.meshIp
-                prefs[activeNpubKey] = toStore.npub
+                prefs[activeAddressKey] = updated.address
+                prefs[activeHttpsKey] = updated.useHttps
+                prefs[activePortKey] = updated.port
+                prefs[activePasswordKey] = updated.password
+                prefs[activeNameKey] = updated.name
             }
         }
     }
 
     /**
-     * Add a server, or update the entry for the same node — npub first,
-     * address/port/scheme as the LAN-only fallback (ServerEntry.sameNode) —
-     * used by QR pairing so re-scanning a node never duplicates it, even after
-     * the LAN renumbered and every address changed (npub-first contract in
-     * docs/companion-pairing-qr.md). A blank incoming password/name keeps the
-     * stored value (a real node's QR never carries the password). Returns the
-     * merged entry.
+     * Add a server, or update the entry with the same connection identity
+     * (address/port/scheme) — used by QR pairing so re-scanning a node never
+     * duplicates it. A blank incoming password/name keeps the stored value
+     * (a real node's QR never carries the password). Returns the merged entry.
      */
     suspend fun upsertServer(server: ServerEntry): ServerEntry {
         var merged = server
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            val existing = current.mapNotNull { ServerEntry.deserialize(it) }
-                .firstOrNull { it.sameNode(server) }
+            val existing = current.mapNotNull { ServerEntry.deserialize(it) }.firstOrNull {
+                it.address == server.address &&
+                    it.port == server.port &&
+                    it.useHttps == server.useHttps
+            }
             if (existing != null) {
                 merged = server.copy(
                     password = server.password.ifBlank { existing.password },
                     name = server.name.ifBlank { existing.name },
-                    meshIp = server.meshIp.ifBlank { existing.meshIp },
-                    npub = server.npub.ifBlank { existing.npub },
                 )
             }
             val filtered = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(merged) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == server.address &&
+                    e.port == server.port &&
+                    e.useHttps == server.useHttps
             }.toSet()
             prefs[savedServersKey] = filtered + merged.serialize()
         }
@@ -218,11 +179,15 @@ class ServerPreferences(private val context: Context) {
     suspend fun removeSavedServer(server: ServerEntry) {
         context.dataStore.edit { prefs ->
             val current = prefs[savedServersKey] ?: emptySet()
-            // Match by node identity (npub, else address/port/scheme) rather
-            // than the exact serialized string, so a rename — or a legacy
-            // short-format entry — still removes the right record.
+            // Match by connection identity (address/port/scheme) rather than the
+            // exact serialized string, so a rename — or the legacy 4-field format
+            // saved before names existed — still removes the right entry.
             prefs[savedServersKey] = current.filterNot { raw ->
-                ServerEntry.deserialize(raw)?.sameNode(server) == true
+                val e = ServerEntry.deserialize(raw)
+                e != null &&
+                    e.address == server.address &&
+                    e.port == server.port &&
+                    e.useHttps == server.useHttps
             }.toSet()
         }
     }
@@ -232,10 +197,4 @@ class ServerPreferences(private val context: Context) {
             prefs[introSeenKey] = true
         }
     }
-
-    suspend fun markGestureHintSeen() {
-        context.dataStore.edit { prefs ->
-            prefs[gestureHintSeenKey] = true
-        }
-    }
 }

Android/app/src/main/java/com/archipelago/app/data/ServerQrParser.kt

@@ -1,8 +1,6 @@
 package com.archipelago.app.data
 
 import android.net.Uri
-import com.archipelago.app.fips.AnchorPeer
-import com.archipelago.app.fips.FipsPairInfo
 
 /**
  * Result of parsing a pairing QR / deep link.
@@ -12,11 +10,7 @@ import com.archipelago.app.fips.FipsPairInfo
  * user to update the app rather than call the code invalid.
  */
 sealed class PairResult {
-    data class Success(
-        val server: ServerEntry,
-        /** Mesh info when the node advertises FIPS (fnpub present). */
-        val fips: FipsPairInfo? = null,
-    ) : PairResult()
+    data class Success(val server: ServerEntry) : PairResult()
     object UnsupportedVersion : PairResult()
     object Invalid : PairResult()
 }
@@ -25,18 +19,13 @@ sealed class PairResult {
  * Parser for the companion pairing QR / OS deep link. Contract:
  * docs/companion-pairing-qr.md (repo root).
  *
- *   archipelago://pair?v=1&url=<origin>&name=…[&tok=…][&pw=…][&fnpub=…&fip=…&fhost=…&fudp=…&ftcp=…]
+ *   archipelago://pair?v=1&url=<percent-encoded origin>[&pw=<password>]
  *
  * - `url` is a full origin including scheme (http for LAN/mDNS nodes, https
  *   for the public demo); trailing slashes are normalized away.
- * - `tok` is a device token minted by the node; it goes through the password
- *   field on purpose — the whole password auto-login path (WebSocket auth +
- *   WebView form injection) then works unchanged, and the backend accepts
- *   device tokens wherever it accepts the password. `pw` (demo only) wins if
- *   both are ever present.
- * - `fnpub`/`fip`/`fhost`/`fudp`/`ftcp` describe the node's FIPS mesh; their
- *   absence just means LAN-only pairing (older node, or FIPS not provisioned).
- * - Unknown extra query params are tolerated (forward compat under v=1).
+ * - `pw` is only ever present for the public demo.
+ * - Unknown extra query params are tolerated (forward compat under v=1 —
+ *   `name` is already honored if present).
  */
 object ServerQrParser {
     private const val SUPPORTED_MAJOR = 1
@@ -65,64 +54,14 @@ object ServerQrParser {
         val host = server.host
         if (host.isNullOrBlank()) return PairResult.Invalid
 
-        val fips = parseFips(uri)
-        val credential = uri.getQueryParameter("pw")?.takeIf { it.isNotBlank() }
-            ?: uri.getQueryParameter("tok")
-            ?: ""
-
         return PairResult.Success(
-            server = ServerEntry(
+            ServerEntry(
                 address = host,
                 useHttps = scheme == "https",
                 port = if (server.port != -1) server.port.toString() else "",
-                password = credential,
+                password = uri.getQueryParameter("pw") ?: "",
                 name = uri.getQueryParameter("name") ?: "",
-                meshIp = fips?.ula ?: "",
-                // npub is the durable identity — saved-server upserts match on
-                // it, so re-scanning after a LAN renumber updates in place.
-                npub = fips?.npub ?: "",
-            ),
-            fips = fips,
+            )
         )
     }
-
-    private fun parseFips(uri: Uri): FipsPairInfo? {
-        val npub = uri.getQueryParameter("fnpub")?.trim()
-        var host = uri.getQueryParameter("fhost")?.trim()
-        if (npub.isNullOrBlank() || host.isNullOrBlank()) return null
-        // A .fips fhost is a dead dial hint: Android's system DNS can't
-        // resolve .fips, so every handshake send fails and first connect
-        // falls back to slow anchor discovery. If the QR's `url` host is a
-        // real address, dial that instead (QRs minted while the node UI was
-        // browsed over the mesh carry npub….fips here).
-        if (host.endsWith(".fips")) {
-            val urlHost = uri.getQueryParameter("url")
-                ?.let { runCatching { Uri.parse(it).host }.getOrNull() }
-            if (!urlHost.isNullOrBlank() && !urlHost.endsWith(".fips")) host = urlHost
-        }
-        return FipsPairInfo(
-            npub = npub,
-            ula = uri.getQueryParameter("fip")?.trim().orEmpty(),
-            host = host,
-            udpPort = uri.getQueryParameter("fudp")?.toIntOrNull() ?: 2121,
-            tcpPort = uri.getQueryParameter("ftcp")?.toIntOrNull() ?: 8443,
-            anchors = parseAnchors(uri.getQueryParameter("fanchors")),
-        )
-    }
-
-    /** `fanchors` = comma-joined `npub@host:port/transport`; bad items skipped. */
-    private fun parseAnchors(raw: String?): List<AnchorPeer> {
-        if (raw.isNullOrBlank()) return emptyList()
-        return raw.split(",").mapNotNull { item ->
-            val at = item.indexOf('@')
-            val slash = item.lastIndexOf('/')
-            if (at <= 0 || slash <= at) return@mapNotNull null
-            val npub = item.substring(0, at).trim()
-            val addr = item.substring(at + 1, slash).trim()
-            val transport = item.substring(slash + 1).trim().lowercase()
-            if (npub.isBlank() || !addr.contains(":")) return@mapNotNull null
-            if (transport != "udp" && transport != "tcp") return@mapNotNull null
-            AnchorPeer(npub = npub, addr = addr, transport = transport)
-        }
-    }
 }

Android/app/src/main/java/com/archipelago/app/fips/ArchyVpnService.kt

@@ -1,324 +0,0 @@
-package com.archipelago.app.fips
-
-import android.app.Notification
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.app.PendingIntent
-import android.content.Intent
-import android.net.ConnectivityManager
-import android.net.Network
-import android.net.NetworkCapabilities
-import android.net.NetworkRequest
-import android.net.VpnService
-import android.os.Build
-import android.util.Log
-import com.archipelago.app.MainActivity
-import com.archipelago.app.R
-import com.archipelago.app.data.ServerPreferences
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.isActive
-import kotlinx.coroutines.launch
-
-/**
- * VpnService hosting the embedded FIPS mesh node.
- *
- * Split tunnel: only fd00::/8 (the FIPS ULA space) routes into the TUN, so
- * normal phone traffic is untouched — this is mesh reachability, not a
- * default-route VPN. The established fd is detached and handed to the Rust
- * node (Node::start_with_tun_fd); the node owns it until stop.
- */
-class ArchyVpnService : VpnService() {
-
-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-    private var warmerJob: Job? = null
-
-    // Seamless transport handoff (Wi-Fi ⇄ 5G ⇄ future BLE). Without this the
-    // tunnel's underlying network stays pinned to the interface that was
-    // default when the VPN came up; when the phone leaves Wi-Fi for 5G the
-    // mesh sockets ride a dead network and sessions never recover until the
-    // app is restarted (user-reported 2026-07-27). The callback (a) re-pins
-    // the tunnel to the new default network via setUnderlyingNetworks and
-    // (b) forces an immediate mesh re-home so discovery + sessions rebuild
-    // on the new path within seconds instead of waiting out dead-link
-    // timeouts.
-    private var connectivityManager: ConnectivityManager? = null
-    private var networkCallback: ConnectivityManager.NetworkCallback? = null
-    @Volatile
-    private var currentUnderlying: Network? = null
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        if (intent?.action == ACTION_STOP) {
-            shutdown()
-            return START_NOT_STICKY
-        }
-        startForeground(NOTIFICATION_ID, buildNotification())
-        scope.launch { startMesh() }
-        return START_STICKY
-    }
-
-    private suspend fun startMesh() {
-        if (!FipsNative.available) {
-            shutdown()
-            return
-        }
-        val prefs = FipsPreferences(this)
-        val identity = FipsManager.ensureIdentity(prefs)
-        val peersJson = prefs.combinedPeersJson()
-        if (identity == null || peersJson == "[]") {
-            Log.w(TAG, "mesh not configured — stopping")
-            shutdown()
-            return
-        }
-        // Party mode: fixed inbound UDP bind so a nearby phone can dial us
-        // directly over a shared LAN/hotspot (no internet required).
-        val listenPort = if (prefs.partyListen()) PartyQr.PARTY_UDP_PORT else 0
-
-        // A fresh app open re-triggers the service. Tearing a HEALTHY mesh
-        // down to rebuild it costs ~8s of anchor+session bring-up on every
-        // launch (observed live: stop 00:34:38 → session back 00:34:49) and
-        // is what made "freshly loading the app" slow. Keep a running node;
-        // restart only when it's dead or a pairing changed the peer set.
-        if (FipsNative.isRunning() && !FipsManager.peersDirty) {
-            Log.i(TAG, "mesh already running — keeping warm sessions")
-            startSessionWarmer()
-            return
-        }
-        FipsManager.peersDirty = false
-        // Re-establishing while running would strand the old fd; restart clean.
-        if (FipsNative.isRunning()) FipsNative.stop()
-
-        val pfd = try {
-            Builder()
-                .setSession("Archipelago Mesh")
-                .setMtu(1280)
-                .addAddress(identity.address, 128)
-                .addRoute("fd00::", 8)
-                // The TUN is IPv6-only. Android blocks every address family
-                // the VPN has no address for — without this, bringing the
-                // mesh up cut ALL of the phone's IPv4 internet.
-                .allowFamily(android.system.OsConstants.AF_INET)
-                // And let apps that bind their own network skip the TUN
-                // entirely — this is mesh reachability, not a privacy VPN.
-                .allowBypass()
-                .apply {
-                    // Android 10+ treats VPN networks as METERED by default,
-                    // which flips the whole phone into data-saver behaviour
-                    // (background sync off, "metered" warnings) while the
-                    // mesh is up. It inherits the underlying network's real
-                    // metered state instead.
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) setMetered(false)
-                }
-                .establish()
-        } catch (e: Exception) {
-            Log.e(TAG, "VPN establish failed", e)
-            null
-        }
-        if (pfd == null) {
-            shutdown()
-            return
-        }
-
-        val fd = pfd.detachFd()
-        val result = FipsNative.start(identity.secret, peersJson, fd, listenPort)
-        Log.i(TAG, "mesh start: $result (listen=$listenPort)")
-        if (result.contains("\"error\"")) {
-            shutdown()
-        } else {
-            startSessionWarmer()
-            registerNetworkHandoff()
-            // Phone-to-phone chat/beam + the phone's own mesh-served page.
-            FlareServer.start(this, identity.address, identity.npub, prefs.partyName())
-            // Mutual pairing: when a phone that scanned OUR QR announces
-            // itself, store it as a party peer and re-run the mesh config so
-            // this side gets the peer + chat entry without scanning back.
-            FlareServer.onHello = { peer ->
-                scope.launch {
-                    prefs.upsertPartyPeer(peer)
-                    FipsManager.requestMeshRestart(this@ArchyVpnService)
-                }
-            }
-        }
-    }
-
-    /**
-     * Pre-warm + keep-warm mesh sessions to every known node ULA.
-     *
-     * Discovery + first session through the public tree can take 15s+
-     * (from node diagnosis) — paying that cost here, the
-     * moment the tunnel is up, means the connect probe and WebView hit an
-     * established session instead of timing out on a cold one. The periodic
-     * touch afterwards keeps the session from idling out. Failed connects
-     * are expected and cheap; the attempt itself is what drives discovery.
-     */
-    private fun startSessionWarmer() {
-        warmerJob?.cancel()
-        warmerJob = scope.launch {
-            val prefs = ServerPreferences(this@ArchyVpnService)
-            val fipsPrefs = FipsPreferences(this@ArchyVpnService)
-            var round = 0
-            while (isActive && FipsNative.isRunning()) {
-                val targets = try {
-                    prefs.savedServers.first()
-                        .mapNotNull { it.meshIp.ifBlank { null } }
-                        .map { it to 80 } +
-                        // Party phones answer on the flare port, not :80.
-                        fipsPrefs.partyPeers().map { it.ula to PartyQr.FLARE_PORT }
-                } catch (_: Exception) {
-                    emptyList()
-                }.distinct()
-                if (round == 0) Log.i(TAG, "session warmer: ${targets.map { it.first }}")
-                // Probe all targets CONCURRENTLY with a short timeout — the
-                // old sequential 20s-per-target loop let one cold node starve
-                // every other target for the whole aggressive window.
-                targets.map { (ula, port) ->
-                    launch {
-                        try {
-                            java.net.Socket().use { s ->
-                                s.connect(
-                                    java.net.InetSocketAddress(
-                                        java.net.InetAddress.getByName(ula),
-                                        port,
-                                    ),
-                                    5_000,
-                                )
-                            }
-                        } catch (_: Exception) {
-                            // Cold path / node away — the attempt still drove
-                            // session establishment; try again next round.
-                        }
-                    }
-                }.forEach { it.join() }
-                round++
-                // Aggressive for the first ~minute (session bring-up), then a
-                // slow keep-warm tick that costs nearly nothing.
-                delay(if (round < 12) 5_000 else 60_000)
-            }
-        }
-    }
-
-    /**
-     * Track the phone's default network and hand the mesh over to it as the
-     * phone roams (Wi-Fi ⇄ 5G, and later BLE). Two actions per change:
-     *  1. setUnderlyingNetworks(new) — the tunnel's packets follow the live
-     *     network instead of dying on the one it launched with.
-     *  2. re-home the mesh — kick the session warmer so discovery + sessions
-     *     rebuild on the new path immediately; the node's own fast-reconnect
-     *     (1s) redials peers over the new route.
-     * onAvailable also fires for the FIRST network, which is how the initial
-     * underlying network gets set.
-     */
-    private fun registerNetworkHandoff() {
-        if (networkCallback != null) return
-        val cm = getSystemService(ConnectivityManager::class.java) ?: return
-        connectivityManager = cm
-        val request = NetworkRequest.Builder()
-            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-            .build()
-        val cb = object : ConnectivityManager.NetworkCallback() {
-            override fun onAvailable(network: Network) {
-                handoffTo(network)
-            }
-
-            override fun onLost(network: Network) {
-                // The lost network was our underlying one — clear the pin so
-                // the system falls back to whatever default remains; the next
-                // onAvailable re-pins explicitly.
-                if (network == currentUnderlying) {
-                    currentUnderlying = null
-                    runCatching { setUnderlyingNetworks(null) }
-                }
-            }
-        }
-        networkCallback = cb
-        // requestNetwork tracks the BEST network of the request; when the
-        // phone moves Wi-Fi→5G the callback re-fires onAvailable with the new
-        // one. (registerDefaultNetworkCallback would also work; requestNetwork
-        // lets us extend to BLE-capable transports later.)
-        runCatching { cm.requestNetwork(request, cb) }
-    }
-
-    private fun handoffTo(network: Network) {
-        val changed = network != currentUnderlying
-        currentUnderlying = network
-        // Always re-assert; cheap and covers capability changes on the same
-        // Network object.
-        runCatching { setUnderlyingNetworks(arrayOf(network)) }
-        if (changed && FipsNative.isRunning()) {
-            Log.i(TAG, "network handoff → re-homing mesh on new default network")
-            // Fresh warmer pass drives immediate rediscovery/session rebuild
-            // on the new path instead of waiting out dead-link timeouts.
-            startSessionWarmer()
-        }
-    }
-
-    private fun unregisterNetworkHandoff() {
-        val cm = connectivityManager
-        val cb = networkCallback
-        if (cm != null && cb != null) {
-            runCatching { cm.unregisterNetworkCallback(cb) }
-        }
-        networkCallback = null
-        connectivityManager = null
-        currentUnderlying = null
-    }
-
-    private fun shutdown() {
-        warmerJob?.cancel()
-        unregisterNetworkHandoff()
-        FlareServer.stop()
-        FipsNative.stop()
-        stopForeground(STOP_FOREGROUND_REMOVE)
-        stopSelf()
-    }
-
-    override fun onDestroy() {
-        unregisterNetworkHandoff()
-        FipsNative.stop()
-        scope.cancel()
-        super.onDestroy()
-    }
-
-    override fun onRevoke() {
-        // User pulled VPN permission from system settings.
-        shutdown()
-    }
-
-    private fun buildNotification(): Notification {
-        val manager = getSystemService(NotificationManager::class.java)
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            manager.createNotificationChannel(
-                NotificationChannel(
-                    CHANNEL_ID,
-                    "Mesh connection",
-                    NotificationManager.IMPORTANCE_MIN,
-                ).apply { description = "Keeps the node reachable from anywhere" }
-            )
-        }
-        val tapIntent = PendingIntent.getActivity(
-            this,
-            0,
-            Intent(this, MainActivity::class.java),
-            PendingIntent.FLAG_IMMUTABLE,
-        )
-        return Notification.Builder(this, CHANNEL_ID)
-            .setContentTitle("Connected to your Archipelago")
-            .setContentText("Secure mesh link active")
-            .setSmallIcon(R.mipmap.ic_launcher)
-            .setContentIntent(tapIntent)
-            .setOngoing(true)
-            .build()
-    }
-
-    companion object {
-        const val ACTION_STOP = "com.archipelago.app.fips.STOP"
-        private const val CHANNEL_ID = "archy_mesh"
-        private const val NOTIFICATION_ID = 4841
-        private const val TAG = "ArchyVpnService"
-    }
-}

Android/app/src/main/java/com/archipelago/app/fips/FipsManager.kt

@@ -1,103 +0,0 @@
-package com.archipelago.app.fips
-
-import android.content.Context
-import android.content.Intent
-import android.net.VpnService
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-
-/**
- * Glue between pairing and the mesh: persists the node peer from a scanned
- * QR and asks the UI to bring the tunnel up. There is deliberately no
- * settings surface — scanning a node's QR is the entire configuration.
- *
- * The one unavoidable interaction is Android's VPN consent dialog
- * (VpnService.prepare), which only an Activity can launch; [consentNeeded]
- * signals AppNavHost to run it, once, on first pairing.
- */
-object FipsManager {
-
-    /** Set when a pairing registered mesh info and the VPN needs starting. */
-    private val _consentNeeded = MutableStateFlow(false)
-    val consentNeeded: StateFlow<Boolean> = _consentNeeded
-
-    /** True after a pairing changed the peer set while the node was running —
-     *  tells the service a restart is genuinely needed (the ONLY case; a
-     *  routine app open must keep the warm mesh, not rebuild it). */
-    @Volatile
-    var peersDirty: Boolean = false
-
-    fun consentHandled() {
-        _consentNeeded.value = false
-    }
-
-    /**
-     * Persist mesh info from a pairing scan and request tunnel start.
-     * No-op on devices without the native lib (non-arm64).
-     */
-    suspend fun registerNode(context: Context, info: FipsPairInfo?, alias: String) {
-        if (info == null || !FipsNative.available) return
-        val prefs = FipsPreferences(context)
-        ensureIdentity(prefs)
-        prefs.upsertNodePeer(info, alias)
-        peersDirty = true
-        // Restart the mesh with the new peer RIGHT NOW when consent already
-        // exists — relying on the consentNeeded collector left a running
-        // mesh on the OLD peer list whenever the collector wasn't active
-        // (fresh pairings looked dead until a full app restart).
-        if (VpnService.prepare(context) == null) {
-            startService(context)
-        } else {
-            _consentNeeded.value = true
-        }
-    }
-
-    /** Generate-once mesh identity. Returns null only if the RNG/native fails. */
-    suspend fun ensureIdentity(prefs: FipsPreferences): FipsNative.Identity? {
-        prefs.identity()?.let { return it }
-        val generated = FipsNative.parseIdentity(FipsNative.generateIdentity()) ?: return null
-        prefs.saveIdentity(generated)
-        return generated
-    }
-
-    /**
-     * Start the mesh service if this device is paired and the user has already
-     * consented to the VPN (prepare() == null). Called on app start so the
-     * tunnel comes back without any interaction; first-time consent goes
-     * through AppNavHost instead.
-     */
-    suspend fun autoStartIfReady(context: Context) {
-        if (!FipsNative.available) return
-        val prefs = FipsPreferences(context)
-        if (prefs.identity() == null || !prefs.hasPeers()) return
-        if (VpnService.prepare(context) != null) return // consent missing — don't prompt here
-        startService(context)
-    }
-
-    fun startService(context: Context) {
-        val intent = Intent(context, ArchyVpnService::class.java)
-        context.startForegroundService(intent)
-    }
-
-    /**
-     * Re-run the mesh with current prefs (party listen toggled, peer added).
-     * Marks the peer set dirty so startMesh genuinely restarts the node —
-     * otherwise the keep-warm fast path would skip the new config.
-     * First-timers go through the consent flow.
-     */
-    fun requestMeshRestart(context: Context) {
-        if (!FipsNative.available) return
-        peersDirty = true
-        if (VpnService.prepare(context) == null) {
-            startService(context)
-        } else {
-            _consentNeeded.value = true
-        }
-    }
-
-    fun stopService(context: Context) {
-        val intent = Intent(context, ArchyVpnService::class.java)
-            .setAction(ArchyVpnService.ACTION_STOP)
-        context.startService(intent)
-    }
-}

Android/app/src/main/java/com/archipelago/app/fips/FipsNative.kt

@@ -1,49 +0,0 @@
-package com.archipelago.app.fips
-
-import org.json.JSONObject
-
-/**
- * JNI binding to the embedded FIPS mesh node (Android/rust/archy-fips-core,
- * built into libarchy_fips_core.so by the buildRustArm64 gradle task).
- *
- * All calls return JSON strings; failures come back as {"error": "…"} rather
- * than exceptions. [available] is false on ABIs the .so isn't built for
- * (anything but arm64) — every caller must gate on it so the app still runs
- * as a plain companion there.
- */
-object FipsNative {
-    val available: Boolean = try {
-        System.loadLibrary("archy_fips_core")
-        true
-    } catch (_: Throwable) {
-        false
-    }
-
-    external fun generateIdentity(): String
-    external fun deriveIdentity(secret: String): String
-
-    /**
-     * [listenPort] 0 = outbound-only (default posture). Non-zero binds UDP on
-     * that port so a nearby phone can dial us directly (party mode); the node
-     * stays leaf-only either way.
-     */
-    external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String
-    external fun stop()
-    external fun isRunning(): Boolean
-    external fun statusJson(): String
-
-    data class Identity(val secret: String, val npub: String, val address: String)
-
-    /** Parse an identity JSON reply; null on {"error": …} or malformed. */
-    fun parseIdentity(json: String): Identity? = try {
-        val obj = JSONObject(json)
-        if (obj.has("error")) null
-        else Identity(
-            secret = obj.getString("secret"),
-            npub = obj.getString("npub"),
-            address = obj.getString("address"),
-        )
-    } catch (_: Exception) {
-        null
-    }
-}

Android/app/src/main/java/com/archipelago/app/fips/FipsPairInfo.kt

@@ -1,29 +0,0 @@
-package com.archipelago.app.fips
-
-/**
- * Node mesh parameters carried by the pairing QR (fnpub/fip/fhost/fudp/ftcp —
- * docs/companion-pairing-qr.md). The phone's embedded FIPS node dials
- * host:udpPort / host:tcpPort claiming nothing; the mesh accepts inbound peers
- * without registration, so possession of these params is all pairing takes.
- */
-data class FipsPairInfo(
-    val npub: String,
-    /** Node's fips0 ULA — where its UI stays reachable once meshed. May be empty. */
-    val ula: String,
-    val host: String,
-    val udpPort: Int,
-    val tcpPort: Int,
-    /**
-     * Public rendezvous anchors (the node's seed-anchor list). The phone
-     * peers with these too, so it can route to the node via the mesh when
-     * the node's LAN endpoint isn't directly dialable.
-     */
-    val anchors: List<AnchorPeer> = emptyList(),
-)
-
-/** One rendezvous anchor from the QR's `fanchors` param (npub@addr/transport). */
-data class AnchorPeer(
-    val npub: String,
-    val addr: String,
-    val transport: String,
-)

Android/app/src/main/java/com/archipelago/app/fips/FipsPreferences.kt

@@ -1,341 +0,0 @@
-package com.archipelago.app.fips
-
-import android.content.Context
-import androidx.datastore.core.DataStore
-import androidx.datastore.preferences.core.Preferences
-import androidx.datastore.preferences.core.booleanPreferencesKey
-import androidx.datastore.preferences.core.edit
-import androidx.datastore.preferences.core.stringPreferencesKey
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
-import org.json.JSONArray
-import org.json.JSONObject
-import androidx.datastore.preferences.preferencesDataStore
-
-private val Context.fipsDataStore: DataStore<Preferences> by preferencesDataStore(name = "fips_prefs")
-
-// Archipelago-operated public anchor (vps2). Baked in so EVERY pairing yields
-// both paths — direct LAN p2p to the node AND a public rendezvous for
-// away-from-home — even when the scanned node is old enough that its QR
-// carries no fanchors. Keep in lockstep with
-// core/archipelago/src/fips/anchors.rs (ARCHY_ANCHOR_*).
-internal const val ARCHY_ANCHOR_NPUB =
-    "npub1dptaktwxv0mm245g2lqjykwm5ll0jpc6m3r4242ydfa9z7qe6urs3jvrak"
-internal const val ARCHY_ANCHOR_ADDR = "146.59.87.168:8444"
-internal const val ARCHY_ANCHOR_TRANSPORT = "tcp"
-
-/**
- * Public FIPS network anchors (join.fips.network — the dual-transport TCP
- * pair; keep in lockstep with core/archipelago/src/fips/anchors.rs
- * fips_network_anchors()). Baked into every pairing at trailing priority so
- * a degraded/unreachable vps2 anchor can never strand the phone: the mesh
- * still joins the public tree and routes to the node through it.
- */
-internal val PUBLIC_FIPS_ANCHORS = listOf(
-    Triple(
-        "npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u",
-        "23.182.128.74:443",
-        "tcp",
-    ),
-    Triple(
-        "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98",
-        "217.77.8.91:443",
-        "tcp",
-    ),
-)
-
-/**
- * Mesh identity + known node peers. Follows the same plaintext-DataStore
- * storage model as ServerPreferences (the server password lives there the
- * same way); the mesh secret only grants mesh membership, not node login.
- */
-class FipsPreferences(private val context: Context) {
-
-    private val secretKey = stringPreferencesKey("fips_secret")
-    private val npubKey = stringPreferencesKey("fips_npub")
-    private val addressKey = stringPreferencesKey("fips_address")
-    /** JSON array of node peers in fips PeerConfig shape (see NodePeer). */
-    private val peersKey = stringPreferencesKey("fips_node_peers")
-    /** JSON array of phone party peers (PartyPeer shape, NOT PeerConfig). */
-    private val partyPeersKey = stringPreferencesKey("fips_party_peers")
-    /** Party mode: accept a direct inbound mesh link (UDP 2121). */
-    private val partyListenKey = booleanPreferencesKey("fips_party_listen")
-    /** Name shown in this phone's party QR and outgoing flares. */
-    private val partyNameKey = stringPreferencesKey("fips_party_name")
-
-    suspend fun identity(): FipsNative.Identity? {
-        val prefs = context.fipsDataStore.data.first()
-        val secret = prefs[secretKey] ?: return null
-        return FipsNative.Identity(
-            secret = secret,
-            npub = prefs[npubKey] ?: "",
-            address = prefs[addressKey] ?: "",
-        )
-    }
-
-    suspend fun saveIdentity(identity: FipsNative.Identity) {
-        context.fipsDataStore.edit { prefs ->
-            prefs[secretKey] = identity.secret
-            prefs[npubKey] = identity.npub
-            prefs[addressKey] = identity.address
-        }
-    }
-
-    suspend fun peersJson(): String {
-        val prefs = context.fipsDataStore.data.first()
-        return prefs[peersKey] ?: "[]"
-    }
-
-    suspend fun hasPeers(): Boolean = JSONArray(peersJson()).length() > 0
-
-    // ── Mesh Party (phone↔phone) ────────────────────────────────────────────
-
-    suspend fun partyListen(): Boolean =
-        context.fipsDataStore.data.first()[partyListenKey] ?: false
-
-    val partyListenFlow: Flow<Boolean>
-        get() = context.fipsDataStore.data.map { it[partyListenKey] ?: false }
-
-    suspend fun setPartyListen(enabled: Boolean) {
-        context.fipsDataStore.edit { it[partyListenKey] = enabled }
-    }
-
-    suspend fun partyName(): String =
-        context.fipsDataStore.data.first()[partyNameKey]
-            ?: android.os.Build.MODEL.orEmpty().ifBlank { "Phone" }
-
-    suspend fun setPartyName(name: String) {
-        context.fipsDataStore.edit { it[partyNameKey] = name.trim() }
-    }
-
-    val partyPeersFlow: Flow<List<PartyPeer>>
-        get() = context.fipsDataStore.data.map { parsePartyPeers(it[partyPeersKey] ?: "[]") }
-
-    suspend fun partyPeers(): List<PartyPeer> =
-        parsePartyPeers(context.fipsDataStore.data.first()[partyPeersKey] ?: "[]")
-
-    /** Matched by npub, so re-scanning updates the direct-dial address in place. */
-    suspend fun upsertPartyPeer(peer: PartyPeer) {
-        context.fipsDataStore.edit { prefs ->
-            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != peer.npub }
-            prefs[partyPeersKey] = toJson(kept + peer)
-        }
-    }
-
-    suspend fun removePartyPeer(npub: String) {
-        context.fipsDataStore.edit { prefs ->
-            val kept = parsePartyPeers(prefs[partyPeersKey] ?: "[]").filter { it.npub != npub }
-            prefs[partyPeersKey] = toJson(kept)
-        }
-    }
-
-    /**
-     * Node peers + direct-dial party peers, in the fips PeerConfig JSON the
-     * Rust node deserializes. Party peers get the best priority: on a shared
-     * LAN/hotspot the direct link beats every anchor path, and while off-LAN
-     * the failed dial is cheap (auto-reconnect keeps retrying, which is
-     * exactly what makes the link snap up the moment both phones share WiFi).
-     * Party peers without an underlay address are mesh-routed and need no
-     * entry here at all.
-     */
-    suspend fun combinedPeersJson(): String {
-        val merged = JSONArray(peersJson())
-        val party = partyPeers()
-        for (peer in party) {
-            if (peer.ip.isBlank() || peer.port <= 0) continue
-            merged.put(JSONObject().apply {
-                put("npub", peer.npub)
-                put("alias", hostSafeAlias(peer.name.ifBlank { "party-phone" }))
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", "udp")
-                    put("addr", "${peer.ip}:${peer.port}")
-                    put("priority", 5)
-                }))
-            })
-        }
-        // A party-only phone (never paired with a node) still needs a public
-        // rendezvous to reach its peers ACROSS the internet — without it, two
-        // bare phones would be hotspot/LAN-only. Node pairing normally bakes
-        // this anchor in; do the same when there are party peers.
-        if (party.isNotEmpty() &&
-            (0 until merged.length()).none {
-                merged.optJSONObject(it)?.optString("npub") == ARCHY_ANCHOR_NPUB
-            }
-        ) {
-            merged.put(JSONObject().apply {
-                put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "archipelago-anchor")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", ARCHY_ANCHOR_TRANSPORT)
-                    put("addr", ARCHY_ANCHOR_ADDR)
-                    put("priority", 40)
-                }))
-            })
-        }
-        // Backfill anchor peers for entries paired before newer QR/app
-        // releases added them. `upsertNodePeer` persists these on re-scan, but
-        // startup must also self-heal old DataStore state so updating the APK is
-        // enough to get off-LAN redundancy.
-        if (merged.length() > 0) {
-            addAnchorIfMissing(merged, ARCHY_ANCHOR_NPUB, "archipelago-anchor", ARCHY_ANCHOR_ADDR, ARCHY_ANCHOR_TRANSPORT, 40)
-            for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
-                val (npub, addr, transport) = anchor
-                addAnchorIfMissing(merged, npub, "fips-network-anchor-${i + 1}", addr, transport, 50 + i * 10)
-            }
-        }
-        return merged.toString()
-    }
-
-    private fun addAnchorIfMissing(
-        peers: JSONArray,
-        npub: String,
-        alias: String,
-        addr: String,
-        transport: String,
-        priority: Int,
-    ) {
-        if ((0 until peers.length()).any { peers.optJSONObject(it)?.optString("npub") == npub }) return
-        peers.put(JSONObject().apply {
-            put("npub", npub)
-            put("alias", alias)
-            put("addresses", JSONArray().put(JSONObject().apply {
-                put("transport", transport)
-                put("addr", addr)
-                put("priority", priority)
-            }))
-        })
-    }
-
-    private fun parsePartyPeers(json: String): List<PartyPeer> = try {
-        val arr = JSONArray(json)
-        (0 until arr.length()).mapNotNull { i ->
-            val o = arr.optJSONObject(i) ?: return@mapNotNull null
-            val npub = o.optString("npub")
-            val ula = o.optString("ula")
-            if (npub.isBlank() || ula.isBlank()) return@mapNotNull null
-            PartyPeer(
-                npub = npub,
-                ula = ula,
-                name = o.optString("name").ifBlank { "Phone" },
-                ip = o.optString("ip"),
-                port = o.optInt("port"),
-            )
-        }
-    } catch (_: Exception) {
-        emptyList()
-    }
-
-    private fun toJson(peers: List<PartyPeer>): String {
-        val arr = JSONArray()
-        for (p in peers) {
-            arr.put(JSONObject().apply {
-                put("npub", p.npub)
-                put("ula", p.ula)
-                put("name", p.name)
-                put("ip", p.ip)
-                put("port", p.port)
-            })
-        }
-        return arr.toString()
-    }
-
-    /**
-     * Add or update the node peer plus its rendezvous anchors (each matched
-     * by npub, so re-pairing updates addresses instead of duplicating).
-     * Stored directly in the fips PeerConfig JSON shape the Rust side
-     * deserializes. The node's direct addresses get the best priorities;
-     * anchors trail so the mesh prefers the direct path when it works.
-     */
-    suspend fun upsertNodePeer(info: FipsPairInfo, alias: String) {
-        val incoming = mutableListOf<JSONObject>()
-        incoming += JSONObject().apply {
-            put("npub", info.npub)
-            put("alias", hostSafeAlias(alias.ifBlank { "Archipelago" }))
-            val addresses = JSONArray()
-            // .fips hosts are unresolvable on Android (no system .fips DNS):
-            // storing one gives the mesh a dial target that fails every
-            // handshake and stalls first connect on anchor discovery.
-            if (info.udpPort > 0 && !info.host.endsWith(".fips")) {
-                addresses.put(JSONObject().apply {
-                    put("transport", "udp")
-                    put("addr", "${info.host}:${info.udpPort}")
-                    put("priority", 10)
-                })
-            }
-            if (info.tcpPort > 0 && !info.host.endsWith(".fips")) {
-                addresses.put(JSONObject().apply {
-                    put("transport", "tcp")
-                    put("addr", "${info.host}:${info.tcpPort}")
-                    put("priority", 20)
-                })
-            }
-            put("addresses", addresses)
-        }
-        for (anchor in info.anchors) {
-            if (anchor.npub == info.npub) continue
-            if (anchor.addr.substringBeforeLast(":").endsWith(".fips")) continue
-            incoming += JSONObject().apply {
-                put("npub", anchor.npub)
-                put("alias", "mesh-anchor")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", anchor.transport)
-                    put("addr", anchor.addr)
-                    put("priority", 30)
-                }))
-            }
-        }
-        // Guarantee the public anchor: without it, a QR from an older node
-        // leaves the phone LAN-only and pairing/connecting dies off-LAN.
-        if (info.npub != ARCHY_ANCHOR_NPUB &&
-            incoming.none { it.optString("npub") == ARCHY_ANCHOR_NPUB }
-        ) {
-            incoming += JSONObject().apply {
-                put("npub", ARCHY_ANCHOR_NPUB)
-                put("alias", "archipelago-anchor")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", ARCHY_ANCHOR_TRANSPORT)
-                    put("addr", ARCHY_ANCHOR_ADDR)
-                    put("priority", 40)
-                }))
-            }
-        }
-        // And the public FIPS network anchors at trailing priority, so one
-        // degraded rendezvous (vps2, 2026-07-24) can never strand the phone.
-        for ((i, anchor) in PUBLIC_FIPS_ANCHORS.withIndex()) {
-            val (npub, addr, transport) = anchor
-            if (info.npub == npub || incoming.any { it.optString("npub") == npub }) continue
-            incoming += JSONObject().apply {
-                put("npub", npub)
-                put("alias", "fips-network-anchor-${i + 1}")
-                put("addresses", JSONArray().put(JSONObject().apply {
-                    put("transport", transport)
-                    put("addr", addr)
-                    put("priority", 50 + i * 10)
-                }))
-            }
-        }
-        val incomingNpubs = incoming.map { it.optString("npub") }.toSet()
-        context.fipsDataStore.edit { prefs ->
-            val current = JSONArray(prefs[peersKey] ?: "[]")
-            val merged = JSONArray()
-            for (i in 0 until current.length()) {
-                val existing = current.optJSONObject(i) ?: continue
-                if (existing.optString("npub") !in incomingNpubs) merged.put(existing)
-            }
-            incoming.forEach { merged.put(it) }
-            prefs[peersKey] = merged.toString()
-        }
-    }
-}
-
-/**
- * Peer aliases feed the fips host map as `<alias>.fips` hostnames; anything
- * that isn't a valid DNS label ("Test Node" — the space) gets rejected and
- * silently drops the peer from name resolution. Slug it instead of losing it.
- */
-internal fun hostSafeAlias(alias: String): String =
-    alias.lowercase()
-        .replace(Regex("[^a-z0-9.-]+"), "-")
-        .trim('-', '.')
-        .ifBlank { "archipelago" }

Android/app/src/main/java/com/archipelago/app/fips/FlareServer.kt

@@ -1,398 +0,0 @@
-package com.archipelago.app.fips
-
-import android.content.Context
-import android.util.Log
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.RequestBody.Companion.toRequestBody
-import org.json.JSONObject
-import java.io.BufferedInputStream
-import java.io.File
-import java.io.InputStream
-import java.net.InetAddress
-import java.net.InetSocketAddress
-import java.net.ServerSocket
-import java.net.Socket
-import java.util.UUID
-import java.util.concurrent.ExecutorService
-import java.util.concurrent.Executors
-import java.util.concurrent.TimeUnit
-
-/** One chat/photo message in a party conversation, keyed by the peer's npub. */
-data class FlareMessage(
-    val id: String,
-    val peerNpub: String,
-    val fromMe: Boolean,
-    val name: String,
-    val text: String = "",
-    val photoPath: String = "",
-    val ts: Long,
-    val status: Status = Status.RECEIVED,
-) {
-    enum class Status { SENDING, SENT, FAILED, RECEIVED }
-}
-
-/** In-memory conversation store (demo scope — nothing persists across restarts). */
-object FlareStore {
-    private val _messages = MutableStateFlow<List<FlareMessage>>(emptyList())
-    val messages: StateFlow<List<FlareMessage>> = _messages
-
-    fun add(message: FlareMessage) {
-        _messages.value = _messages.value + message
-    }
-
-    fun setStatus(id: String, status: FlareMessage.Status) {
-        _messages.value = _messages.value.map { if (it.id == id) it.copy(status = status) else it }
-    }
-}
-
-/**
- * Minimal HTTP listener bound ONLY on this phone's mesh ULA — plain HTTP is
- * fine there because FIPS is the encryption + peer-identity layer (same
- * stance as the node's ULA-only peer listener). This is what makes the phone
- * a *server* on the mesh: another phone (or `curl -6` from any mesh node)
- * reaches it by npub-derived address with no port forwarding, DNS, or CA.
- *
- * FIPS authenticates the node, not the request (project doctrine), so inputs
- * are still validated at this boundary: size caps, JSON shape, no
- * client-controlled paths.
- */
-object FlareServer {
-    private const val TAG = "FlareServer"
-    private const val MAX_PHOTO_BYTES = 8 * 1024 * 1024
-    private const val MAX_TEXT_CHARS = 4_000
-    private const val MAX_HEADER_BYTES = 16 * 1024
-
-    private var socket: ServerSocket? = null
-    private var pool: ExecutorService? = null
-    @Volatile private var identityName = "Phone"
-    @Volatile private var identityNpub = ""
-    @Volatile private var photoDir: File? = null
-
-    /** Invoked when a peer announces itself (POST /hello) — pairing used to
-     *  be one-way: only the SCANNING phone learned the other side, so the
-     *  scanned phone had no peer, no chat entry, no way in. The VPN service
-     *  wires this to upsert the peer + restart the mesh config. */
-    @Volatile var onHello: ((PartyPeer) -> Unit)? = null
-
-    @Synchronized
-    fun start(context: Context, ula: String, myNpub: String, myName: String) {
-        stop()
-        identityNpub = myNpub
-        identityName = myName
-        photoDir = File(context.cacheDir, "flare").apply { mkdirs() }
-        val pool = Executors.newCachedThreadPool().also { this.pool = it }
-        pool.execute {
-            try {
-                val server = ServerSocket().apply {
-                    reuseAddress = true
-                    bind(InetSocketAddress(InetAddress.getByName(ula), PartyQr.FLARE_PORT))
-                }
-                socket = server
-                Log.i(TAG, "flare listening on [$ula]:${PartyQr.FLARE_PORT}")
-                while (!server.isClosed) {
-                    val client = try {
-                        server.accept()
-                    } catch (_: Exception) {
-                        break
-                    }
-                    pool.execute { handle(client) }
-                }
-            } catch (e: Exception) {
-                Log.e(TAG, "flare server died: $e")
-            }
-        }
-    }
-
-    @Synchronized
-    fun stop() {
-        try {
-            socket?.close()
-        } catch (_: Exception) {
-        }
-        socket = null
-        pool?.shutdownNow()
-        pool = null
-    }
-
-    private fun handle(client: Socket) {
-        client.use { sock ->
-            sock.soTimeout = 30_000
-            try {
-                val input = BufferedInputStream(sock.getInputStream())
-                val requestLine = readLine(input) ?: return
-                val parts = requestLine.trim().split(" ")
-                if (parts.size < 2) return respond(sock, 400, json("bad_request"))
-                val (method, path) = parts[0] to parts[1]
-
-                var contentLength = 0
-                var from = ""
-                var fromName = ""
-                var headerBytes = requestLine.length
-                while (true) {
-                    val line = readLine(input) ?: return
-                    if (line.isEmpty()) break
-                    headerBytes += line.length
-                    if (headerBytes > MAX_HEADER_BYTES) return respond(sock, 431, json("headers_too_large"))
-                    val idx = line.indexOf(':')
-                    if (idx <= 0) continue
-                    val key = line.substring(0, idx).trim().lowercase()
-                    val value = line.substring(idx + 1).trim()
-                    when (key) {
-                        "content-length" -> contentLength = value.toIntOrNull() ?: 0
-                        "x-from" -> from = value.take(80)
-                        "x-name" -> fromName = value.take(80)
-                    }
-                }
-
-                when {
-                    method == "GET" && (path == "/" || path.startsWith("/?")) ->
-                        respondHtml(sock, profilePage())
-                    method == "POST" && path == "/hello" -> {
-                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receiveHello(String(body, Charsets.UTF_8))
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    method == "POST" && path == "/flare" -> {
-                        if (contentLength !in 1..MAX_HEADER_BYTES) return respond(sock, 413, json("too_large"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receiveFlare(String(body, Charsets.UTF_8))
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    method == "POST" && path == "/photo" -> {
-                        if (contentLength !in 1..MAX_PHOTO_BYTES) return respond(sock, 413, json("too_large"))
-                        if (!from.startsWith("npub1")) return respond(sock, 400, json("bad_request"))
-                        val body = readExactly(input, contentLength) ?: return
-                        receivePhoto(from, fromName, body)
-                        respond(sock, 200, """{"ok":true}""")
-                    }
-                    else -> respond(sock, 404, json("not_found"))
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "request failed: $e")
-            }
-        }
-    }
-
-    /** A peer that scanned OUR QR announces itself — mutual pairing. */
-    private fun receiveHello(body: String) {
-        val o = try {
-            JSONObject(body)
-        } catch (_: Exception) {
-            return
-        }
-        val from = o.optString("from")
-        val ula = o.optString("ula")
-        if (!from.startsWith("npub1") || !ula.startsWith("fd")) return
-        if (from == identityNpub) return
-        val peer = PartyPeer(
-            npub = from.take(80),
-            ula = ula.take(64),
-            name = o.optString("name").take(24).ifBlank { "Phone" },
-            ip = o.optString("ip").take(40),
-            port = o.optInt("port", 0),
-        )
-        onHello?.invoke(peer)
-        // Seed the conversation so the chat has a visible entry on this side.
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = peer.npub,
-                fromMe = false,
-                name = peer.name,
-                text = "👋 ${peer.name} joined the party",
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun receiveFlare(body: String) {
-        val o = try {
-            JSONObject(body)
-        } catch (_: Exception) {
-            return
-        }
-        val from = o.optString("from")
-        if (!from.startsWith("npub1")) return
-        val text = o.optString("text").take(MAX_TEXT_CHARS)
-        if (text.isBlank()) return
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = from,
-                fromMe = false,
-                name = o.optString("name").take(80).ifBlank { "Phone" },
-                text = text,
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun receivePhoto(from: String, fromName: String, bytes: ByteArray) {
-        // Server-generated filename — the sender never controls the path.
-        val dir = photoDir ?: return
-        val file = File(dir, "${UUID.randomUUID()}.jpg")
-        file.writeBytes(bytes)
-        FlareStore.add(
-            FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = from,
-                fromMe = false,
-                name = fromName.ifBlank { "Phone" },
-                photoPath = file.absolutePath,
-                ts = System.currentTimeMillis(),
-            )
-        )
-    }
-
-    private fun profilePage(): String {
-        val npub = identityNpub
-        val name = identityName
-        return """
-            <!doctype html><html><head><meta charset="utf-8">
-            <meta name="viewport" content="width=device-width,initial-scale=1">
-            <title>$name — on the mesh</title>
-            <style>
-              body{background:#0a0a0a;color:#eee;font-family:monospace;
-                   display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
-              .card{border:1px solid rgba(255,255,255,.12);border-radius:20px;padding:32px;
-                    max-width:560px;background:rgba(255,255,255,.04)}
-              h1{color:#f7931a;margin:0 0 8px;font-size:22px}
-              .npub{word-break:break-all;color:#888;font-size:12px;margin:12px 0}
-              p{line-height:1.5}
-            </style></head><body><div class="card">
-            <h1>⚡ $name</h1>
-            <div class="npub">$npub</div>
-            <p>This page is being served <b>by a phone</b>, addressed by its
-            cryptographic identity over the FIPS mesh.</p>
-            <p>No port forwarding. No DNS. No certificate authority. No cloud.
-            The key <i>is</i> the address — and the transport underneath can be
-            5G, WiFi, or a hotspot with no internet at all.</p>
-            </div></body></html>
-        """.trimIndent()
-    }
-
-    // ── tiny HTTP plumbing ──────────────────────────────────────────────────
-
-    /** Read one CRLF-terminated header line as ISO-8859-1; null on EOF. */
-    private fun readLine(input: InputStream): String? {
-        val sb = StringBuilder()
-        while (true) {
-            val b = input.read()
-            if (b == -1) return if (sb.isEmpty()) null else sb.toString()
-            if (b == '\n'.code) return sb.toString().trimEnd('\r')
-            sb.append(b.toChar())
-            if (sb.length > MAX_HEADER_BYTES) return null
-        }
-    }
-
-    private fun readExactly(input: InputStream, length: Int): ByteArray? {
-        val buf = ByteArray(length)
-        var off = 0
-        while (off < length) {
-            val n = input.read(buf, off, length - off)
-            if (n == -1) return null
-            off += n
-        }
-        return buf
-    }
-
-    private fun json(code: String) = """{"error":{"code":"$code","message":"request rejected"}}"""
-
-    private fun respond(sock: Socket, status: Int, body: String) =
-        writeResponse(sock, status, "application/json", body.toByteArray(Charsets.UTF_8))
-
-    private fun respondHtml(sock: Socket, body: String) =
-        writeResponse(sock, 200, "text/html; charset=utf-8", body.toByteArray(Charsets.UTF_8))
-
-    private fun writeResponse(sock: Socket, status: Int, contentType: String, body: ByteArray) {
-        val reason = when (status) {
-            200 -> "OK"; 400 -> "Bad Request"; 404 -> "Not Found"
-            413 -> "Payload Too Large"; 431 -> "Headers Too Large"
-            else -> "Error"
-        }
-        val head = "HTTP/1.1 $status $reason\r\n" +
-            "Content-Type: $contentType\r\n" +
-            "Content-Length: ${body.size}\r\n" +
-            "Connection: close\r\n\r\n"
-        sock.getOutputStream().apply {
-            write(head.toByteArray(Charsets.ISO_8859_1))
-            write(body)
-            flush()
-        }
-    }
-}
-
-/** Outbound flares: plain HTTP to the peer's ULA — FIPS encrypts underneath. */
-object FlareClient {
-    // Connect timeout must outlive cold mesh-session establishment (~15s via
-    // the public tree); the attempt itself drives
-    // session setup, same trick as the VPN service's session warmer.
-    private val http = OkHttpClient.Builder()
-        .connectTimeout(25, TimeUnit.SECONDS)
-        .readTimeout(15, TimeUnit.SECONDS)
-        .writeTimeout(60, TimeUnit.SECONDS)
-        .build()
-
-    private fun base(peer: PartyPeer) = "http://[${peer.ula}]:${PartyQr.FLARE_PORT}"
-
-    /** Announce myself to a freshly scanned peer so pairing becomes MUTUAL —
-     *  their phone gets me as a peer + a chat entry without scanning back.
-     *  Blocking — call from Dispatchers.IO. */
-    fun sendHello(
-        peer: PartyPeer,
-        myNpub: String,
-        myName: String,
-        myUla: String,
-        myIp: String?,
-        myPort: Int,
-    ): Boolean = try {
-        val body = JSONObject()
-            .put("from", myNpub)
-            .put("name", myName)
-            .put("ula", myUla)
-            .put("ip", myIp ?: "")
-            .put("port", if (myIp != null) myPort else 0)
-            .toString()
-            .toRequestBody("application/json".toMediaType())
-        http.newCall(
-            Request.Builder().url("${base(peer)}/hello").post(body).build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-
-    /** Blocking — call from Dispatchers.IO. */
-    fun sendText(peer: PartyPeer, myNpub: String, myName: String, text: String): Boolean = try {
-        val body = JSONObject()
-            .put("from", myNpub)
-            .put("name", myName)
-            .put("text", text)
-            .put("ts", System.currentTimeMillis())
-            .toString()
-            .toRequestBody("application/json".toMediaType())
-        http.newCall(
-            Request.Builder().url("${base(peer)}/flare").post(body).build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-
-    /** Blocking — call from Dispatchers.IO. */
-    fun sendPhoto(peer: PartyPeer, myNpub: String, myName: String, jpeg: ByteArray): Boolean = try {
-        http.newCall(
-            Request.Builder()
-                .url("${base(peer)}/photo")
-                .header("X-From", myNpub)
-                .header("X-Name", myName)
-                .post(jpeg.toRequestBody("image/jpeg".toMediaType()))
-                .build()
-        ).execute().use { it.isSuccessful }
-    } catch (_: Exception) {
-        false
-    }
-}

Android/app/src/main/java/com/archipelago/app/fips/PartyQr.kt

@@ -1,102 +0,0 @@
-package com.archipelago.app.fips
-
-import android.net.Uri
-import java.net.Inet4Address
-import java.net.NetworkInterface
-
-/**
- * Phone↔phone mesh pairing ("Mesh Party") QR contract:
- *
- *   archipelago://party?v=1&npub=<npub>&ula=<fd..>&name=<name>[&ip=<v4>&port=<udp>]
- *
- * npub + ula alone are enough to chat *through* the mesh (anchors route by
- * node address, no underlay info needed). ip/port are present only while the
- * showing phone has its inbound UDP listener up (party mode) — the scanner
- * then also gets a direct-dial link that works on a shared LAN/hotspot with
- * no internet at all. Same versioning stance as the node pairing QR
- * (docs/companion-pairing-qr.md): unknown params tolerated under v=1.
- */
-data class PartyPeer(
-    val npub: String,
-    val ula: String,
-    val name: String,
-    /** Direct-dial underlay endpoint; empty when the peer wasn't listening. */
-    val ip: String = "",
-    val port: Int = 0,
-)
-
-object PartyQr {
-    const val SCHEME_HOST = "party"
-    private const val SUPPORTED_MAJOR = 1
-
-    /** UDP port a party-mode phone listens on (matches the node's mesh port). */
-    const val PARTY_UDP_PORT = 2121
-
-    /** Application-layer chat/beam port, bound only on the mesh ULA. */
-    const val FLARE_PORT = 5680
-
-    fun build(npub: String, ula: String, name: String, ip: String?, port: Int): String {
-        val b = Uri.Builder()
-            .scheme("archipelago")
-            .authority(SCHEME_HOST)
-            .appendQueryParameter("v", "1")
-            .appendQueryParameter("npub", npub)
-            .appendQueryParameter("ula", ula)
-            .appendQueryParameter("name", name)
-        if (!ip.isNullOrBlank() && port > 0) {
-            b.appendQueryParameter("ip", ip)
-            b.appendQueryParameter("port", port.toString())
-        }
-        return b.build().toString()
-    }
-
-    /** Null when [raw] is not a valid party QR (foreign codes just keep scanning). */
-    fun parse(raw: String): PartyPeer? {
-        val uri = try {
-            Uri.parse(raw.trim())
-        } catch (_: Exception) {
-            return null
-        }
-        if (!"archipelago".equals(uri.scheme, ignoreCase = true)) return null
-        if (uri.isOpaque || !SCHEME_HOST.equals(uri.host, ignoreCase = true)) return null
-        val major = uri.getQueryParameter("v")?.takeWhile { it.isDigit() }?.toIntOrNull() ?: return null
-        if (major != SUPPORTED_MAJOR) return null
-
-        val npub = uri.getQueryParameter("npub")?.trim().orEmpty()
-        val ula = uri.getQueryParameter("ula")?.trim().orEmpty()
-        if (!npub.startsWith("npub1") || !ula.startsWith("fd")) return null
-        return PartyPeer(
-            npub = npub,
-            ula = ula,
-            name = uri.getQueryParameter("name")?.trim().orEmpty().ifBlank { "Phone" },
-            ip = uri.getQueryParameter("ip")?.trim().orEmpty(),
-            port = uri.getQueryParameter("port")?.toIntOrNull() ?: 0,
-        )
-    }
-
-    /**
-     * This phone's private IPv4 on WiFi or its own hotspot, for the QR's
-     * direct-dial hint. Hotspot interfaces (ap/swlan/softap) win over wlan so
-     * the hotspot-host phone advertises the address its guests can reach.
-     */
-    fun localWifiIpv4(): String? {
-        val candidates = mutableListOf<Pair<String, String>>() // ifname → addr
-        try {
-            for (nif in NetworkInterface.getNetworkInterfaces()) {
-                if (!nif.isUp || nif.isLoopback) continue
-                for (addr in nif.inetAddresses) {
-                    if (addr is Inet4Address && addr.isSiteLocalAddress) {
-                        candidates += nif.name to addr.hostAddress.orEmpty()
-                    }
-                }
-            }
-        } catch (_: Exception) {
-            return null
-        }
-        val hotspot = candidates.firstOrNull {
-            it.first.startsWith("ap") || it.first.startsWith("swlan") || it.first.startsWith("softap")
-        }
-        return (hotspot ?: candidates.firstOrNull { it.first.startsWith("wlan") } ?: candidates.firstOrNull())
-            ?.second
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/components/GamepadLayout.kt

@@ -38,7 +38,7 @@ import com.archipelago.app.ui.theme.neoRaised
 @Composable
 fun GamepadLayout(
     onKey: (String) -> Unit,
-    onThreeFingerHold: () -> Unit,
+    onTwoFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     val surface = Neo.surface()
@@ -54,9 +54,9 @@ fun GamepadLayout(
                     do {
                         val ev = awaitPointerEvent()
                         val a = ev.changes.filter { !it.changedToUp() }
-                        if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
-                        if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onThreeFingerHold() }
-                        if (a.size < 3) t = 0L
+                        if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
+                        if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onTwoFingerHold() }
+                        if (a.size < 2) t = 0L
                     } while (ev.changes.any { it.pressed })
                 }
             }

Android/app/src/main/java/com/archipelago/app/ui/components/GestureHintOverlay.kt

@@ -1,147 +0,0 @@
-package com.archipelago.app.ui.components
-
-import androidx.compose.animation.core.LinearEasing
-import androidx.compose.animation.core.RepeatMode
-import androidx.compose.animation.core.animateFloat
-import androidx.compose.animation.core.infiniteRepeatable
-import androidx.compose.animation.core.rememberInfiniteTransition
-import androidx.compose.animation.core.tween
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.interaction.MutableInteractionSource
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.offset
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.shape.CircleShape
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.remember
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.draw.scale
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import com.archipelago.app.R
-import com.archipelago.app.ui.theme.BitcoinOrange
-import kotlinx.coroutines.delay
-
-/**
- * First-launch teaching overlay for the three-finger hold gesture. Three
- * fingertip dots pulse in a "press" rhythm with an expanding ring while a
- * short caption explains what the gesture opens. Dismissed by tapping
- * anywhere (or automatically after a few seconds) — shown once, ever.
- */
-@Composable
-fun GestureHintOverlay(onDismiss: () -> Unit) {
-    // Auto-dismiss so a user who taps nothing is never stuck behind the scrim.
-    LaunchedEffect(Unit) {
-        delay(6500)
-        onDismiss()
-    }
-
-    val transition = rememberInfiniteTransition(label = "gesture-hint")
-    // Fingertips press down together…
-    val press by transition.animateFloat(
-        initialValue = 1f,
-        targetValue = 0.86f,
-        animationSpec = infiniteRepeatable(tween(650), RepeatMode.Reverse),
-        label = "press",
-    )
-    // …while a ring ripples outward on each press cycle.
-    val ripple by transition.animateFloat(
-        initialValue = 0f,
-        targetValue = 1f,
-        animationSpec = infiniteRepeatable(tween(1300, easing = LinearEasing)),
-        label = "ripple",
-    )
-
-    Box(
-        modifier = Modifier
-            .fillMaxSize()
-            .background(Color.Black.copy(alpha = 0.72f))
-            .clickable(
-                interactionSource = remember { MutableInteractionSource() },
-                indication = null,
-                onClick = onDismiss,
-            ),
-        contentAlignment = Alignment.Center,
-    ) {
-        Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            // Hand: three fingertip dots in a natural arc + ripple ring.
-            Box(Modifier.size(160.dp), contentAlignment = Alignment.Center) {
-                Box(
-                    Modifier
-                        .size(150.dp)
-                        .scale(0.4f + ripple * 0.6f)
-                        .border(
-                            2.dp,
-                            BitcoinOrange.copy(alpha = (1f - ripple) * 0.8f),
-                            CircleShape,
-                        ),
-                )
-                FingerDot(x = (-44).dp, y = 14.dp, scale = press)
-                FingerDot(x = 0.dp, y = (-12).dp, scale = press)
-                FingerDot(x = 44.dp, y = 8.dp, scale = press)
-            }
-
-            Spacer(Modifier.height(28.dp))
-
-            Text(
-                text = stringResource(R.string.gesture_hint_title),
-                style = MaterialTheme.typography.headlineSmall,
-                fontWeight = FontWeight.Bold,
-                color = Color.White,
-                textAlign = TextAlign.Center,
-            )
-            Spacer(Modifier.height(10.dp))
-            Text(
-                text = stringResource(R.string.gesture_hint_body),
-                style = MaterialTheme.typography.bodyMedium,
-                color = Color.White.copy(alpha = 0.7f),
-                textAlign = TextAlign.Center,
-                modifier = Modifier.padding(horizontal = 48.dp),
-            )
-
-            Spacer(Modifier.height(32.dp))
-
-            Box(
-                modifier = Modifier
-                    .clip(RoundedCornerShape(12.dp))
-                    .background(Color.White.copy(alpha = 0.12f))
-                    .clickable(onClick = onDismiss)
-                    .padding(horizontal = 28.dp, vertical = 12.dp),
-            ) {
-                Text(
-                    text = stringResource(R.string.gesture_hint_got_it),
-                    style = MaterialTheme.typography.labelLarge,
-                    color = Color.White,
-                )
-            }
-        }
-    }
-}
-
-@Composable
-private fun FingerDot(x: androidx.compose.ui.unit.Dp, y: androidx.compose.ui.unit.Dp, scale: Float) {
-    Box(
-        Modifier
-            .offset(x = x, y = y)
-            .size(26.dp)
-            .scale(scale)
-            .background(Color.White.copy(alpha = 0.92f), CircleShape),
-    )
-}

Android/app/src/main/java/com/archipelago/app/ui/components/MeshLoadingScreen.kt

@@ -1,77 +0,0 @@
-package com.archipelago.app.ui.components
-
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.size
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.ui.screens.PixelArtLogo
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceBlack
-import com.archipelago.app.ui.theme.TextMuted
-
-/**
- * The branded "F*CK IPs" full-screen loader — shown whenever the app is
- * dialing the node over the mesh (relaunch race, post-scan first connect),
- * instead of an anonymous spinner. The point of the brand: what's loading
- * is a connection to a cryptographic identity, not an IP.
- */
-@Composable
-fun MeshLoadingScreen(message: String = "Dialing your node by its key — no IPs harmed") {
-    Box(
-        Modifier
-            .fillMaxSize()
-            .background(SurfaceBlack),
-        contentAlignment = Alignment.Center,
-    ) {
-        Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            // The brand's circle-container logo (as on the connect screen /
-            // web login): pixel-art "a" centered in a black disc.
-            Box(
-                Modifier
-                    .size(120.dp)
-                    .clip(androidx.compose.foundation.shape.CircleShape)
-                    .background(Color.Black)
-                    .border(
-                        1.dp,
-                        Color.White.copy(alpha = 0.14f),
-                        androidx.compose.foundation.shape.CircleShape,
-                    ),
-                contentAlignment = Alignment.Center,
-            ) {
-                PixelArtLogo(Modifier.size(64.dp))
-            }
-            Spacer(Modifier.height(20.dp))
-            Text(
-                text = "F*CK IPs MESH",
-                color = BitcoinOrange,
-                fontSize = 18.sp,
-                fontWeight = FontWeight.Bold,
-                letterSpacing = 4.sp,
-            )
-            Spacer(Modifier.height(8.dp))
-            Text(
-                text = message,
-                color = TextMuted,
-                fontSize = 13.sp,
-                textAlign = TextAlign.Center,
-            )
-            Spacer(Modifier.height(24.dp))
-            CircularProgressIndicator(color = BitcoinOrange)
-        }
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/components/NESController.kt

@@ -23,7 +23,6 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Palette
 import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material3.Icon
 import androidx.compose.material3.Text
@@ -109,7 +108,6 @@ fun NESController(
     onKey: (String) -> Unit,
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
-    onToggleStyle: (() -> Unit)? = null,
     modifier: Modifier = Modifier,
 ) {
     val c = paletteFor(style)
@@ -118,7 +116,7 @@ fun NESController(
     Box(
         modifier = modifier
             .fillMaxSize()
-            .threeFingerHold(onMenu)
+            .twoFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -207,7 +205,6 @@ fun NESController(
                 ) {
                     PlayerPill(c, playerId, onPlayerToggle)
                     SettingsBtn(c, Modifier, onMenu)
-                    onToggleStyle?.let { StyleBtn(c, Modifier, it) }
                 }
             }
         }
@@ -434,23 +431,6 @@ fun SettingsBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Uni
     }
 }
 
-/** Dark/Classic style toggle — lives next to the settings gear (the menu hub
- *  no longer carries it). */
-@Composable
-fun StyleBtn(c: NESPalette, modifier: Modifier = Modifier, onClick: () -> Unit) {
-    var p by remember { mutableStateOf(false) }
-    Box(
-        modifier = modifier
-            .size(48.dp)
-            .clip(CircleShape)
-            .background(if (p) c.capsulePress else c.capsule)
-            .pointerInput(Unit) { detectTapGestures(onPress = { p = true; onClick(); tryAwaitRelease(); p = false }) },
-        contentAlignment = Alignment.Center,
-    ) {
-        Icon(Icons.Default.Palette, "Controller style", Modifier.size(26.dp), tint = c.labelMuted)
-    }
-}
-
 /** Player ID toggle pill (P1/P2/ALL) */
 @Composable
 fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {
@@ -471,17 +451,17 @@ fun PlayerPill(c: NESPalette, playerId: Int, onToggle: () -> Unit) {
     }
 }
 
-/** Three-finger hold gesture modifier (two fingers stay free for scrolling) */
-fun Modifier.threeFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
+/** Two-finger hold gesture modifier */
+fun Modifier.twoFingerHold(onHold: () -> Unit) = this.pointerInput(Unit) {
     awaitEachGesture {
         awaitFirstDown(requireUnconsumed = false)
         var t = 0L; var fired = false
         do {
             val ev = awaitPointerEvent()
             val a = ev.changes.filter { !it.changedToUp() }
-            if (a.size >= 3 && t == 0L) t = System.currentTimeMillis()
-            if (a.size >= 3 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
-            if (a.size < 3) t = 0L
+            if (a.size >= 2 && t == 0L) t = System.currentTimeMillis()
+            if (a.size >= 2 && !fired && t > 0 && System.currentTimeMillis() - t > 500) { fired = true; onHold() }
+            if (a.size < 2) t = 0L
         } while (ev.changes.any { it.pressed })
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESMenu.kt

@@ -21,40 +21,20 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material.icons.automirrored.filled.ArrowBack
-import androidx.compose.material.icons.filled.Bolt
-import androidx.compose.material.icons.filled.Dashboard
-import androidx.compose.material.icons.filled.Dns
-import androidx.compose.material.icons.filled.Groups
-import androidx.compose.material.icons.filled.Keyboard
-import androidx.compose.material.icons.filled.SportsEsports
-import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.QrCodeScanner
 import androidx.compose.material3.Icon
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.OutlinedTextFieldDefaults
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
-import androidx.compose.ui.platform.LocalClipboardManager
-import androidx.compose.ui.platform.LocalConfiguration
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.AnnotatedString
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
@@ -71,6 +51,7 @@ import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.ui.theme.BitcoinOrange
+import com.archipelago.app.ui.theme.ControllerStyle
 import com.archipelago.app.ui.theme.SurfaceDark
 import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
@@ -94,29 +75,26 @@ fun NESMenu(
     visible: Boolean,
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
+    isGamepadMode: Boolean,
+    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)? = null,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onRemote: () -> Unit,
-    onKeyboard: () -> Unit,
+    onToggleMode: () -> Unit,
+    onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)? = null,
-    onMeshParty: (() -> Unit)? = null,
 ) {
     AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
-        // Contained hub overlay: a centred glass panel (not full-screen) that
-        // holds the card page and its sub-pages (Nodes, FIPS) and scrolls
-        // inside its own bounds when content is tall. Tapping the dimmed
-        // backdrop dismisses.
         Box(
             Modifier.fillMaxSize().background(Color.Black.copy(alpha = 0.7f))
                 .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) { onDismiss() },
             contentAlignment = Alignment.Center,
         ) {
             AnimatedVisibility(visible = visible, enter = fadeIn() + scaleIn(initialScale = 0.95f), exit = fadeOut() + scaleOut(targetScale = 0.95f)) {
-                MenuPanel(servers, activeServer, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onRemote, onKeyboard, onBackToWebView, onMeshParty)
+                MenuPanel(servers, activeServer, isGamepadMode, controllerStyle, onDismiss, onSelectServer, onAddServer, onScanQr, onEditServer, onRemoveServer, onToggleMode, onToggleStyle, onBackToWebView)
             }
         }
     }
@@ -126,16 +104,17 @@ fun NESMenu(
 private fun MenuPanel(
     servers: List<ServerEntry>,
     activeServer: ServerEntry?,
+    isGamepadMode: Boolean,
+    controllerStyle: ControllerStyle,
     onDismiss: () -> Unit,
     onSelectServer: (ServerEntry) -> Unit,
     onAddServer: (ServerEntry) -> Unit,
     onScanQr: (() -> Unit)?,
     onEditServer: (ServerEntry, ServerEntry) -> Unit,
     onRemoveServer: (ServerEntry) -> Unit,
-    onRemote: () -> Unit,
-    onKeyboard: () -> Unit,
+    onToggleMode: () -> Unit,
+    onToggleStyle: () -> Unit,
     onBackToWebView: (() -> Unit)?,
-    onMeshParty: (() -> Unit)?,
 ) {
     var showAdd by remember { mutableStateOf(false) }
     // The saved server being edited, or null when adding a new one.
@@ -143,15 +122,14 @@ private fun MenuPanel(
     var nm by remember { mutableStateOf("") }
     var addr by remember { mutableStateOf("") }
     var pwd by remember { mutableStateOf("") }
-    var https by remember { mutableStateOf(false) }
 
     fun resetForm() {
-        nm = ""; addr = ""; pwd = ""; https = false; showAdd = false; editing = null
+        nm = ""; addr = ""; pwd = ""; showAdd = false; editing = null
     }
 
     fun startEdit(server: ServerEntry) {
         editing = server
-        nm = server.name; addr = server.address; pwd = server.password; https = server.useHttps
+        nm = server.name; addr = server.address; pwd = server.password
         showAdd = false
     }
 
@@ -159,381 +137,156 @@ private fun MenuPanel(
         if (addr.isBlank()) return
         val orig = editing
         if (orig != null) {
-            // Preserve port (compact form doesn't expose it); scheme is now editable.
-            onEditServer(orig, orig.copy(address = addr, useHttps = https, password = pwd, name = nm))
+            // Preserve fields the compact form doesn't expose (scheme, port).
+            onEditServer(orig, orig.copy(address = addr, password = pwd, name = nm))
         } else {
-            onAddServer(ServerEntry(addr, https, password = pwd, name = nm))
+            onAddServer(ServerEntry(addr, false, password = pwd, name = nm))
         }
         resetForm()
     }
 
-    var page by remember { mutableStateOf(HubPage.HUB) }
-
     Column(
         modifier = Modifier
             .widthIn(max = 420.dp)
-            .fillMaxWidth()
             .padding(horizontal = 20.dp)
-            // Cap height just short of the full screen; the panel wraps short
-            // content and only scrolls in the rare case it outgrows this.
-            .heightIn(max = (LocalConfiguration.current.screenHeightDp * 0.92f).dp)
             .clip(RoundedCornerShape(PANEL_R))
-            .background(PanelBg.copy(alpha = 0.86f))
+            .background(PanelBg)
             .border(1.dp, PanelBorder, RoundedCornerShape(PANEL_R))
             .clickable(indication = null, interactionSource = remember { MutableInteractionSource() }) {}
-            .verticalScroll(rememberScrollState())
-            .padding(20.dp),
-        verticalArrangement = Arrangement.spacedBy(12.dp),
+            .padding(22.dp),
+        verticalArrangement = Arrangement.spacedBy(10.dp),
     ) {
-        // Header: back (on sub-pages) or title, and a close on the hub.
-        Row(
-            Modifier.fillMaxWidth(),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.SpaceBetween,
-        ) {
-            if (page == HubPage.HUB) {
-                Text("Menu", color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 2.sp)
-                IconRound(Icons.Default.Close, "Close") { onDismiss() }
-            } else {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    IconRound(Icons.AutoMirrored.Filled.ArrowBack, "Back") { resetForm(); page = HubPage.HUB }
-                    Spacer(Modifier.width(12.dp))
-                    Text(
-                        if (page == HubPage.NODES) "Nodes" else "FIPS Mesh",
-                        color = TextPrimary, fontSize = 20.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 1.sp,
-                    )
-                }
-                IconRound(Icons.Default.Close, "Close") { onDismiss() }
-            }
-        }
-        Spacer(Modifier.height(4.dp))
+        // Title
+        Text(
+            "Menu",
+            color = TextPrimary,
+            fontSize = 18.sp,
+            fontWeight = FontWeight.SemiBold,
+            letterSpacing = 2.sp,
+            modifier = Modifier.fillMaxWidth(),
+            textAlign = TextAlign.Center,
+        )
+        Spacer(Modifier.height(2.dp))
 
-        when (page) {
-            HubPage.HUB -> {
-                // Card page — one card per destination. Dashboard first: it's a
-                // peer of the others so three-finger → hub → Dashboard returns
-                // to the node UI, same shape as every other option.
-                if (onBackToWebView != null) {
-                    HubCard(Icons.Default.Dashboard, "Dashboard", "The node's web interface") { onBackToWebView() }
-                }
-                HubCard(Icons.Default.SportsEsports, "Remote", "Game controller for the node") { onRemote() }
-                HubCard(Icons.Default.Keyboard, "Keyboard", "Type into the node") { onKeyboard() }
-                HubCard(Icons.Default.Dns, "Nodes", activeServer?.displayName() ?: "Add or switch servers") {
-                    page = HubPage.NODES
-                }
-                if (FipsNative.available) {
-                    HubCard(Icons.Default.Bolt, "FIPS Mesh", "Mesh identity & status") { page = HubPage.FIPS }
-                }
-                if (onMeshParty != null) {
-                    HubCard(Icons.Default.Groups, "Mesh Party", "Phone-to-phone chat & beam") { onMeshParty() }
-                }
-                // Dark/Classic style lives on the remote/keyboard screen next to
-                // the settings button — not here.
-            }
-
-            HubPage.NODES -> {
-                servers.forEach { server ->
-                    val active = server.serialize() == activeServer?.serialize()
-                    MenuItem(
-                        label = server.displayName(),
-                        selected = active,
-                        onClick = { onSelectServer(server) },
-                        onEdit = { startEdit(server) },
-                        onRemove = { onRemoveServer(server) },
-                    )
-                }
-                if (servers.isEmpty()) {
-                    Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
-                }
-
-                if (showAdd || editing != null) {
-                    Column(
-                        Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(ROW_R))
-                            .background(FieldBg)
-                            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                            .padding(12.dp),
-                        verticalArrangement = Arrangement.spacedBy(8.dp),
-                    ) {
-                        Row(
-                            Modifier.fillMaxWidth(),
-                            verticalAlignment = Alignment.CenterVertically,
-                            horizontalArrangement = Arrangement.SpaceBetween,
-                        ) {
-                            Text(
-                                if (editing != null) "Edit Server" else "Add Server",
-                                color = TextMuted, fontSize = 13.sp, letterSpacing = 1.sp, fontWeight = FontWeight.Medium,
-                            )
-                            Text(
-                                "Cancel", color = TextMuted, fontSize = 13.sp,
-                                modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
-                            )
-                        }
-                        GlassField(
-                            value = nm, onValueChange = { nm = it },
-                            placeholder = "Name (optional)",
-                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
-                        )
-                        GlassField(
-                            value = addr, onValueChange = { addr = it.trim() },
-                            placeholder = "192.168.1.100",
-                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
-                        )
-                        Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
-                            GlassField(
-                                value = pwd, onValueChange = { pwd = it },
-                                placeholder = "Password",
-                                modifier = Modifier.weight(1f),
-                                visualTransformation = PasswordVisualTransformation(),
-                                keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
-                                keyboardActions = KeyboardActions(onGo = { submit() }),
-                            )
-                            Box(
-                                Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
-                                    .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
-                                    .clickable { submit() },
-                                contentAlignment = Alignment.Center,
-                            ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
-                        }
-                        // HTTPS scheme toggle (available on both add and edit).
-                        Row(
-                            Modifier
-                                .fillMaxWidth()
-                                .clip(RoundedCornerShape(ROW_R))
-                                .clickable { https = !https }
-                                .padding(vertical = 2.dp),
-                            verticalAlignment = Alignment.CenterVertically,
-                            horizontalArrangement = Arrangement.SpaceBetween,
-                        ) {
-                            Text("Use HTTPS", color = TextMuted, fontSize = 13.sp)
-                            Box(
-                                Modifier
-                                    .width(46.dp).height(26.dp)
-                                    .clip(RoundedCornerShape(13.dp))
-                                    .background(if (https) BitcoinOrange.copy(alpha = 0.9f) else RowBg)
-                                    .border(1.dp, if (https) BitcoinOrange else RowBorder, RoundedCornerShape(13.dp)),
-                                contentAlignment = if (https) Alignment.CenterEnd else Alignment.CenterStart,
-                            ) {
-                                Box(
-                                    Modifier
-                                        .padding(horizontal = 3.dp)
-                                        .size(20.dp)
-                                        .clip(RoundedCornerShape(10.dp))
-                                        .background(if (https) Color.White else TextMuted),
-                                )
-                            }
-                        }
-                    }
-                } else {
-                    Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
-                        Box(Modifier.weight(1f)) {
-                            MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
-                        }
-                        if (onScanQr != null) {
-                            Box(
-                                Modifier
-                                    .size(ROW_H)
-                                    .clip(RoundedCornerShape(ROW_R))
-                                    .background(RowBg)
-                                    .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                                    .clickable { onScanQr() },
-                                contentAlignment = Alignment.Center,
-                            ) {
-                                Icon(
-                                    Icons.Default.QrCodeScanner,
-                                    contentDescription = stringResource(R.string.add_server_qr),
-                                    tint = BitcoinOrange,
-                                    modifier = Modifier.size(24.dp),
-                                )
-                            }
-                        }
-                    }
-                }
-            }
-
-            HubPage.FIPS -> {
-                FipsSection(embedded = true)
-            }
-        }
-    }
-}
-
-private enum class HubPage { HUB, NODES, FIPS }
-
-/** Big tappable destination card for the hub page: icon + title + subtitle. */
-@Composable
-private fun HubCard(
-    icon: androidx.compose.ui.graphics.vector.ImageVector,
-    title: String,
-    subtitle: String,
-    onClick: () -> Unit,
-) {
-    Row(
-        Modifier
-            .fillMaxWidth()
-            .clip(RoundedCornerShape(ROW_R))
-            .background(RowBg)
-            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-            .clickable { onClick() }
-            .padding(16.dp),
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.spacedBy(14.dp),
-    ) {
-        Box(
-            Modifier.size(40.dp).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.14f)),
-            contentAlignment = Alignment.Center,
-        ) {
-            Icon(icon, contentDescription = title, tint = BitcoinOrange, modifier = Modifier.size(22.dp))
-        }
-        Column(Modifier.weight(1f)) {
-            Text(title, color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold)
-            Text(subtitle, color = TextMuted, fontSize = 12.sp, maxLines = 1)
-        }
-    }
-}
-
-/** Small circular icon button used in the hub header. */
-@Composable
-private fun IconRound(
-    icon: androidx.compose.ui.graphics.vector.ImageVector,
-    desc: String,
-    onClick: () -> Unit,
-) {
-    Box(
-        Modifier
-            .size(40.dp)
-            .clip(RoundedCornerShape(20.dp))
-            .background(RowBg)
-            .border(1.dp, RowBorder, RoundedCornerShape(20.dp))
-            .clickable { onClick() },
-        contentAlignment = Alignment.Center,
-    ) {
-        Icon(icon, contentDescription = desc, tint = TextPrimary, modifier = Modifier.size(20.dp))
-    }
-}
-
-/** Snapshot of the phone's mesh identity + state for the FIPS menu section. */
-private data class FipsInfo(
-    val available: Boolean,
-    val running: Boolean,
-    val npub: String,
-    val meshAddress: String,
-    val peerCount: Int,
-)
-
-/**
- * FIPS mesh oversight: shows what the phone's embedded mesh node is doing —
- * running state, its mesh identity (npub), its mesh address (fd…ULA), how
- * many peers/anchors it's configured with — and a one-tap Reconnect that
- * re-homes the mesh (also the manual fix if a network handoff ever misses).
- * Collapsed by default so the menu stays compact.
- */
-@Composable
-private fun FipsSection(embedded: Boolean = false) {
-    if (!FipsNative.available) return
-    val context = LocalContext.current
-    val clipboard = LocalClipboardManager.current
-    var expanded by remember { mutableStateOf(embedded) }
-    var info by remember { mutableStateOf<FipsInfo?>(null) }
-
-    // Load identity/state when the section opens (cheap DataStore + JSON read).
-    LaunchedEffect(expanded) {
-        if (expanded && info == null) {
-            val prefs = FipsPreferences(context)
-            val id = prefs.identity()
-            val peers = runCatching {
-                org.json.JSONArray(prefs.peersJson()).length()
-            }.getOrDefault(0)
-            info = FipsInfo(
-                available = true,
-                running = FipsNative.isRunning(),
-                npub = id?.npub.orEmpty(),
-                meshAddress = id?.address.orEmpty(),
-                peerCount = peers,
+        // Servers
+        servers.forEach { server ->
+            val active = server.serialize() == activeServer?.serialize()
+            MenuItem(
+                label = server.displayName(),
+                selected = active,
+                onClick = { onSelectServer(server) },
+                onEdit = { startEdit(server) },
+                onRemove = { onRemoveServer(server) },
             )
         }
-    }
 
-    Column(Modifier.fillMaxWidth()) {
-        // Embedded in the hub's FIPS sub-page the header row would duplicate
-        // the page title, so only the standalone (collapsible) form shows it.
-        if (!embedded) MenuItem(
-            label = "FIPS Mesh",
-            labelColor = BitcoinOrange,
-            onClick = { expanded = !expanded },
-        )
-        if (expanded) {
-            val i = info
+        if (servers.isEmpty()) {
+            Text("No servers", color = TextMuted, fontSize = 14.sp, modifier = Modifier.padding(vertical = 4.dp))
+        }
+
+        // Add / edit server
+        if (showAdd || editing != null) {
             Column(
                 Modifier
                     .fillMaxWidth()
-                    .padding(top = 6.dp)
                     .clip(RoundedCornerShape(ROW_R))
                     .background(FieldBg)
                     .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
-                    .padding(14.dp),
-                verticalArrangement = Arrangement.spacedBy(10.dp),
+                    .padding(12.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp),
             ) {
-                if (i == null) {
-                    Text("Loading…", color = TextMuted, fontSize = 13.sp)
-                } else {
-                    FipsRow("Status", if (i.running) "Connected" else "Stopped",
-                        valueColor = if (i.running) BitcoinOrange else TextMuted)
-                    if (i.meshAddress.isNotBlank()) {
-                        FipsRow("Mesh address", i.meshAddress, mono = true,
-                            onCopy = { clipboard.setText(AnnotatedString(i.meshAddress)) })
-                    }
-                    if (i.npub.isNotBlank()) {
-                        FipsRow("Identity (npub)", i.npub, mono = true,
-                            onCopy = { clipboard.setText(AnnotatedString(i.npub)) })
-                    }
-                    FipsRow("Peers & anchors", i.peerCount.toString())
+                Row(
+                    Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                ) {
                     Text(
-                        "Your node reaches this phone over the mesh by its npub — no ports opened to the internet.",
-                        color = TextMuted, fontSize = 11.sp,
+                        if (editing != null) "Edit Server" else "Add Server",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        letterSpacing = 1.sp,
+                        fontWeight = FontWeight.Medium,
                     )
-                    MenuItem(
-                        label = "Reconnect mesh",
-                        labelColor = BitcoinOrange,
-                        onClick = {
-                            FipsManager.requestMeshRestart(context)
-                            info = null
-                            if (!embedded) expanded = false
-                        },
+                    Text(
+                        "Cancel",
+                        color = TextMuted,
+                        fontSize = 13.sp,
+                        modifier = Modifier.clickable { resetForm() }.padding(start = 8.dp),
                     )
                 }
+                GlassField(
+                    value = nm, onValueChange = { nm = it },
+                    placeholder = "Name (optional)",
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Text, imeAction = ImeAction.Next),
+                )
+                GlassField(
+                    value = addr, onValueChange = { addr = it.trim() },
+                    placeholder = "192.168.1.100",
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri, imeAction = ImeAction.Next),
+                )
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp), verticalAlignment = Alignment.CenterVertically) {
+                    GlassField(
+                        value = pwd, onValueChange = { pwd = it },
+                        placeholder = "Password",
+                        modifier = Modifier.weight(1f),
+                        visualTransformation = PasswordVisualTransformation(),
+                        keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password, imeAction = ImeAction.Go),
+                        keyboardActions = KeyboardActions(onGo = { submit() }),
+                    )
+                    Box(
+                        Modifier.size(FIELD_H).clip(RoundedCornerShape(12.dp)).background(BitcoinOrange.copy(alpha = 0.15f))
+                            .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
+                            .clickable { submit() },
+                        contentAlignment = Alignment.Center,
+                    ) { Text("OK", color = BitcoinOrange, fontSize = 14.sp, fontWeight = FontWeight.Bold) }
+                }
+            }
+        } else {
+            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(10.dp)) {
+                Box(Modifier.weight(1f)) {
+                    MenuItem(label = "Add Server", labelColor = BitcoinOrange, onClick = { showAdd = true })
+                }
+                if (onScanQr != null) {
+                    // Add server by scanning the node's pairing QR
+                    Box(
+                        Modifier
+                            .size(ROW_H)
+                            .clip(RoundedCornerShape(ROW_R))
+                            .background(RowBg)
+                            .border(1.dp, RowBorder, RoundedCornerShape(ROW_R))
+                            .clickable { onScanQr() },
+                        contentAlignment = Alignment.Center,
+                    ) {
+                        Icon(
+                            Icons.Default.QrCodeScanner,
+                            contentDescription = stringResource(R.string.add_server_qr),
+                            tint = BitcoinOrange,
+                            modifier = Modifier.size(24.dp),
+                        )
+                    }
+                }
             }
         }
-    }
-}
 
-@Composable
-private fun FipsRow(
-    label: String,
-    value: String,
-    valueColor: Color = TextPrimary,
-    mono: Boolean = false,
-    onCopy: (() -> Unit)? = null,
-) {
-    Row(
-        Modifier
-            .fillMaxWidth()
-            .then(if (onCopy != null) Modifier.clickable { onCopy() } else Modifier),
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.SpaceBetween,
-    ) {
-        Text(label, color = TextMuted, fontSize = 12.sp, modifier = Modifier.width(120.dp))
-        Text(
-            value,
-            color = valueColor,
-            fontSize = if (mono) 11.sp else 13.sp,
-            fontWeight = FontWeight.Medium,
-            modifier = Modifier.weight(1f),
-            textAlign = TextAlign.End,
+        Spacer(Modifier.height(2.dp))
+        Box(Modifier.fillMaxWidth().height(1.dp).background(PanelBorder))
+        Spacer(Modifier.height(2.dp))
+
+        // Mode toggle
+        MenuItem(
+            label = if (isGamepadMode) "Switch to Keyboard" else "Switch to Gamepad",
+            onClick = onToggleMode,
         )
-        if (onCopy != null) {
-            Text("⧉", color = TextMuted, fontSize = 13.sp, modifier = Modifier.padding(start = 8.dp))
+
+        // Style toggle
+        MenuItem(
+            label = if (controllerStyle == ControllerStyle.CLASSIC) "Style: Classic" else "Style: Dark",
+            onClick = onToggleStyle,
+        )
+
+        // Back to dashboard
+        if (onBackToWebView != null) {
+            MenuItem(label = "Back to Dashboard", onClick = onBackToWebView)
         }
     }
 }

Android/app/src/main/java/com/archipelago/app/ui/components/NESPortraitController.kt

@@ -43,7 +43,6 @@ fun NESPortraitController(
     onMouseScroll: (Int) -> Unit = { _ -> },
     onMenu: () -> Unit,
     onPlayerToggle: () -> Unit = {},
-    onToggleStyle: (() -> Unit)? = null,
 ) {
     val c = paletteFor(style)
     val isClassic = style == ControllerStyle.CLASSIC
@@ -51,7 +50,7 @@ fun NESPortraitController(
     Box(
         Modifier
             .fillMaxSize()
-            .threeFingerHold(onMenu)
+            .twoFingerHold(onMenu)
             .padding(horizontal = 40.dp, vertical = 24.dp),
         contentAlignment = Alignment.Center,
     ) {
@@ -88,7 +87,7 @@ fun NESPortraitController(
                     onMove = { dx, dy -> onMouseMove(dx, dy) },
                     onClick = { onMouseClick(it) },
                     onScroll = { dy -> onMouseScroll(dy) },
-                    onThreeFingerHold = onMenu,
+                    onTwoFingerHold = onMenu,
                     modifier = Modifier
                         .fillMaxWidth()
                         .weight(1f),
@@ -152,10 +151,6 @@ fun NESPortraitController(
                     PlayerPill(c, playerId, onPlayerToggle)
                     Spacer(Modifier.width(10.dp))
                     SettingsBtn(c, Modifier, onMenu)
-                    onToggleStyle?.let {
-                        Spacer(Modifier.width(10.dp))
-                        StyleBtn(c, Modifier, it)
-                    }
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/components/QrScannerOverlay.kt

@@ -56,6 +56,7 @@ import androidx.compose.ui.viewinterop.AndroidView
 import androidx.core.content.ContextCompat
 import com.archipelago.app.R
 import com.archipelago.app.data.PairResult
+import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerQrParser
 import com.archipelago.app.ui.screens.GlassButton
 import com.archipelago.app.ui.theme.BitcoinOrange
@@ -81,7 +82,7 @@ import java.util.concurrent.Executors
 fun QrScannerOverlay(
     visible: Boolean,
     onDismiss: () -> Unit,
-    onServerScanned: (PairResult.Success) -> Unit,
+    onServerScanned: (ServerEntry) -> Unit,
 ) {
     val context = LocalContext.current
     var hasPermission by remember {
@@ -130,7 +131,7 @@ fun QrScannerOverlay(
                             when (val result = ServerQrParser.parse(text)) {
                                 is PairResult.Success -> {
                                     handled = true
-                                    onServerScanned(result)
+                                    onServerScanned(result.server)
                                 }
                                 is PairResult.UnsupportedVersion -> hintRes = R.string.update_app_for_qr
                                 is PairResult.Invalid -> hintRes = R.string.invalid_pairing_qr
@@ -217,20 +218,13 @@ fun QrScannerOverlay(
     }
 }
 
-/** Shared by the pairing scanner and the wallet scan modal. */
 @Composable
-internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
+private fun CameraQrPreview(onDecoded: (String) -> Unit) {
     val context = LocalContext.current
     val lifecycleOwner = LocalLifecycleOwner.current
     val currentOnDecoded by rememberUpdatedState(onDecoded)
     val previewView = remember {
-        PreviewView(context).apply {
-            scaleType = PreviewView.ScaleType.FILL_CENTER
-            // TextureView, not the SurfaceView default: SurfaceView punches a
-            // hole in the window, which black-flashes inside Compose fades and
-            // ignores rounded-corner clipping (wallet modal).
-            implementationMode = PreviewView.ImplementationMode.COMPATIBLE
-        }
+        PreviewView(context).apply { scaleType = PreviewView.ScaleType.FILL_CENTER }
     }
 
     DisposableEffect(Unit) {
@@ -238,7 +232,6 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
         val mainExecutor = ContextCompat.getMainExecutor(context)
         val providerFuture = ProcessCameraProvider.getInstance(context)
         var provider: ProcessCameraProvider? = null
-        val focusScheduler = Executors.newSingleThreadScheduledExecutor()
 
         providerFuture.addListener({
             val p = providerFuture.get()
@@ -246,15 +239,12 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
             val preview = Preview.Builder().build().also {
                 it.setSurfaceProvider(previewView.surfaceProvider)
             }
-            // Dense Lightning-invoice QRs need BOTH enough pixels per module and
-            // sharp focus. 1280x720 + a far-focused camera (e.g. Pixel 9a's main
-            // lens, which won't focus close) left dense invoices undecodable
-            // while sparse address QRs still read — the "scanner doesn't pick up
-            // invoices" report. 1920x1080 roughly doubles module resolution so a
-            // QR held at the camera's actual focus distance still resolves.
+            // CameraX's analysis default is 640x480 — too few pixels per module
+            // to decode a modal-sized QR at arm's length. 1280x720 more than
+            // doubles the pixel density at negligible analysis cost.
             @Suppress("DEPRECATION")
             val analysis = ImageAnalysis.Builder()
-                .setTargetResolution(android.util.Size(1920, 1080))
+                .setTargetResolution(android.util.Size(1280, 720))
                 .setBackpressureStrategy(ImageAnalysis.STRATEGY_KEEP_ONLY_LATEST)
                 .build()
                 .also {
@@ -265,27 +255,13 @@ internal fun CameraQrPreview(onDecoded: (String) -> Unit) {
                 }
             try {
                 p.unbindAll()
-                val cam = p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
-                // Force a centre autofocus on a repeating tick. A hand-held QR is
-                // a static scene, so continuous-AF often never retriggers and the
-                // lens sits at its resting (far) focus — fatal for dense codes.
-                // A normalized centre point works before the view is measured.
-                val point = androidx.camera.core.SurfaceOrientedMeteringPointFactory(1f, 1f)
-                    .createPoint(0.5f, 0.5f)
-                val focusAction = androidx.camera.core.FocusMeteringAction.Builder(
-                    point,
-                    androidx.camera.core.FocusMeteringAction.FLAG_AF,
-                ).disableAutoCancel().build()
-                focusScheduler.scheduleWithFixedDelay({
-                    runCatching { cam.cameraControl.startFocusAndMetering(focusAction) }
-                }, 0, 2, java.util.concurrent.TimeUnit.SECONDS)
+                p.bindToLifecycle(lifecycleOwner, CameraSelector.DEFAULT_BACK_CAMERA, preview, analysis)
             } catch (_: Exception) {
                 // Camera unavailable — the user can dismiss and enter details manually.
             }
         }, mainExecutor)
 
         onDispose {
-            focusScheduler.shutdownNow()
             provider?.unbindAll()
             analysisExecutor.shutdown()
         }
@@ -307,19 +283,7 @@ private class QrCodeAnalyzer(private val onDecoded: (String) -> Unit) : ImageAna
         )
     }
 
-    private var lastAttempt = 0L
-
     override fun analyze(image: ImageProxy) {
-        // Decode ~7x/s, not on every frame: TRY_HARDER (plus the inverted
-        // retry) pegs a core when run at camera rate, and that CPU contention
-        // is what made the preview itself stutter. KEEP_ONLY_LATEST means the
-        // frames skipped here are simply dropped, so decodes stay current.
-        val now = System.currentTimeMillis()
-        if (now - lastAttempt < 140) {
-            image.close()
-            return
-        }
-        lastAttempt = now
         try {
             val plane = image.planes[0]
             val buffer = plane.buffer

Android/app/src/main/java/com/archipelago/app/ui/components/Trackpad.kt

@@ -32,7 +32,7 @@ fun Trackpad(
     onMove: (dx: Int, dy: Int) -> Unit,
     onClick: (button: Int) -> Unit,
     onScroll: (dy: Int) -> Unit,
-    onThreeFingerHold: () -> Unit,
+    onTwoFingerHold: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
     var fingers by remember { mutableIntStateOf(0) }
@@ -53,7 +53,7 @@ fun Trackpad(
                     val t0 = System.currentTimeMillis()
                     var maxPtrs = 1
                     var holdFired = false
-                    var threeStart = 0L
+                    var twoStart = 0L
                     var scrollAcc = 0f
                     fingers = 1
 
@@ -64,24 +64,19 @@ fun Trackpad(
                         fingers = active.size
 
                         when {
-                            // Three fingers = hold for menu; two = scroll. Kept
-                            // on separate counts so a long two-finger scroll can
-                            // never fire the menu mid-gesture.
-                            active.size >= 3 -> {
-                                if (threeStart == 0L) threeStart = System.currentTimeMillis()
-                                if (!holdFired && System.currentTimeMillis() - threeStart > 500) {
+                            active.size >= 2 -> {
+                                if (twoStart == 0L) twoStart = System.currentTimeMillis()
+                                if (!holdFired && System.currentTimeMillis() - twoStart > 500) {
                                     holdFired = true
-                                    onThreeFingerHold()
+                                    onTwoFingerHold()
                                 }
-                                ev.changes.forEach { it.consume() }
-                            }
-                            active.size == 2 -> {
-                                threeStart = 0L
-                                val dy = active.map { it.positionChange().y }.average().toFloat()
-                                scrollAcc += dy
-                                if (kotlin.math.abs(scrollAcc) > 12f) {
-                                    onScroll(if (scrollAcc > 0) 1 else -1)
-                                    scrollAcc = 0f
+                                if (!holdFired) {
+                                    val dy = active.map { it.positionChange().y }.average().toFloat()
+                                    scrollAcc += dy
+                                    if (kotlin.math.abs(scrollAcc) > 12f) {
+                                        onScroll(if (scrollAcc > 0) 1 else -1)
+                                        scrollAcc = 0f
+                                    }
                                 }
                                 ev.changes.forEach { it.consume() }
                             }
@@ -104,11 +99,7 @@ fun Trackpad(
         contentAlignment = Alignment.Center,
     ) {
         Text(
-            text = when {
-                fingers >= 3 -> "hold for menu"
-                fingers == 2 -> "scroll"
-                else -> ""
-            },
+            text = if (fingers >= 2) "hold for menu" else "",
             style = MaterialTheme.typography.labelSmall,
             color = muted.copy(alpha = 0.4f),
         )

Android/app/src/main/java/com/archipelago/app/ui/components/WalletQrScannerModal.kt

@@ -1,294 +0,0 @@
-package com.archipelago.app.ui.components
-
-import android.Manifest
-import android.content.Context
-import android.content.pm.PackageManager
-import android.graphics.BitmapFactory
-import android.net.Uri
-import androidx.activity.compose.BackHandler
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.animation.AnimatedVisibility
-import androidx.compose.animation.fadeIn
-import androidx.compose.animation.fadeOut
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.interaction.MutableInteractionSource
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.aspectRatio
-import androidx.compose.foundation.layout.defaultMinSize
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Close
-import androidx.compose.material3.Icon
-import androidx.compose.material3.IconButton
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.core.content.ContextCompat
-import com.archipelago.app.R
-import com.archipelago.app.ui.screens.GlassButton
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.google.zxing.BarcodeFormat
-import com.google.zxing.BinaryBitmap
-import com.google.zxing.DecodeHintType
-import com.google.zxing.MultiFormatReader
-import com.google.zxing.NotFoundException
-import com.google.zxing.RGBLuminanceSource
-import com.google.zxing.common.HybridBinarizer
-
-/**
- * Native replacement for the web wallet's scan pane — same visual design as
- * neode-ui's WalletScanModal (dark glass card, square preview, orange
- * viewfinder, status strip) but the camera and decoding run natively, so the
- * preview doesn't lag the way getUserMedia does inside a WebView.
- *
- * Decoded text is handed back to the page ([onDecoded]) which does all the
- * detection/spend logic; the page in turn streams status lines (animated-QR
- * progress, "not recognised" errors) back in via [status] and closes the
- * modal through the JS bridge once it accepts a code.
- */
-@Composable
-fun WalletQrScannerModal(
-    visible: Boolean,
-    status: Pair<String, Boolean>?, // message from the web page + isError
-    onDecoded: (String) -> Unit,
-    onDismiss: () -> Unit,
-) {
-    val context = LocalContext.current
-    var hasPermission by remember {
-        mutableStateOf(
-            ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
-                PackageManager.PERMISSION_GRANTED
-        )
-    }
-    val permissionLauncher = rememberLauncherForActivityResult(
-        ActivityResultContracts.RequestPermission()
-    ) { granted -> hasPermission = granted }
-
-    // Local error from a failed image upload; a fresh web status replaces it.
-    var uploadError by remember { mutableStateOf<String?>(null) }
-    val noQrMessage = stringResource(R.string.no_qr_in_image)
-    val imagePicker = rememberLauncherForActivityResult(
-        ActivityResultContracts.GetContent()
-    ) { uri ->
-        if (uri != null) {
-            val decoded = decodeQrFromUri(context, uri)
-            if (decoded != null) {
-                uploadError = null
-                onDecoded(decoded)
-            } else {
-                uploadError = noQrMessage
-            }
-        }
-    }
-
-    LaunchedEffect(visible) {
-        if (visible) {
-            uploadError = null
-            val granted = ContextCompat.checkSelfPermission(context, Manifest.permission.CAMERA) ==
-                PackageManager.PERMISSION_GRANTED
-            hasPermission = granted
-            if (!granted) permissionLauncher.launch(Manifest.permission.CAMERA)
-        }
-    }
-    LaunchedEffect(status) { if (status != null) uploadError = null }
-
-    AnimatedVisibility(visible = visible, enter = fadeIn(), exit = fadeOut()) {
-        BackHandler { onDismiss() }
-        Box(
-            Modifier
-                .fillMaxSize()
-                .background(Color.Black.copy(alpha = 0.6f))
-                .clickable(
-                    interactionSource = remember { MutableInteractionSource() },
-                    indication = null,
-                    onClick = onDismiss,
-                ),
-            contentAlignment = Alignment.Center,
-        ) {
-            Column(
-                Modifier
-                    .padding(16.dp)
-                    .widthIn(max = 420.dp)
-                    .fillMaxWidth()
-                    .clip(RoundedCornerShape(24.dp))
-                    .background(Color(0xF212151C))
-                    .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(24.dp))
-                    .clickable(
-                        interactionSource = remember { MutableInteractionSource() },
-                        indication = null,
-                        onClick = {}, // swallow — only the scrim dismisses
-                    )
-                    .padding(24.dp),
-            ) {
-                // Header — mirrors the web modal's title row
-                Row(
-                    Modifier.fillMaxWidth(),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
-                    Text(
-                        text = stringResource(R.string.scan_to_send),
-                        style = MaterialTheme.typography.titleLarge,
-                        fontWeight = FontWeight.SemiBold,
-                        color = Color.White,
-                    )
-                    IconButton(onClick = onDismiss) {
-                        Icon(
-                            Icons.Default.Close,
-                            stringResource(R.string.close),
-                            tint = Color.White.copy(alpha = 0.7f),
-                        )
-                    }
-                }
-
-                Spacer(Modifier.height(8.dp))
-
-                // Square camera preview with the orange viewfinder
-                Box(
-                    Modifier
-                        .fillMaxWidth()
-                        .aspectRatio(1f)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(Color.Black.copy(alpha = 0.4f))
-                        .border(1.dp, Color.White.copy(alpha = 0.10f), RoundedCornerShape(12.dp)),
-                    contentAlignment = Alignment.Center,
-                ) {
-                    if (hasPermission) {
-                        // Throttle repeat frames: a static QR decodes ~20x/s but
-                        // the page only needs one; animated QRs still stream
-                        // because each frame's text differs.
-                        var lastText by remember { mutableStateOf("") }
-                        var lastSentAt by remember { mutableStateOf(0L) }
-                        CameraQrPreview(onDecoded = { text ->
-                            val now = System.currentTimeMillis()
-                            if (text != lastText || now - lastSentAt > 250) {
-                                lastText = text
-                                lastSentAt = now
-                                onDecoded(text)
-                            }
-                        })
-                        Box(
-                            Modifier
-                                .fillMaxSize(0.62f)
-                                .border(
-                                    2.dp,
-                                    BitcoinOrange.copy(alpha = 0.85f),
-                                    RoundedCornerShape(16.dp),
-                                ),
-                        )
-                    } else {
-                        Column(
-                            Modifier.padding(horizontal = 24.dp),
-                            horizontalAlignment = Alignment.CenterHorizontally,
-                            verticalArrangement = Arrangement.spacedBy(12.dp),
-                        ) {
-                            Text(
-                                text = stringResource(R.string.camera_permission_needed),
-                                color = Color.White.copy(alpha = 0.7f),
-                                style = MaterialTheme.typography.bodyMedium,
-                                textAlign = TextAlign.Center,
-                            )
-                            GlassButton(
-                                text = stringResource(R.string.grant_camera_access),
-                                onClick = { permissionLauncher.launch(Manifest.permission.CAMERA) },
-                                modifier = Modifier.fillMaxWidth().height(48.dp),
-                            )
-                        }
-                    }
-                }
-
-                Spacer(Modifier.height(16.dp))
-
-                // Status strip — same slot the web modal uses for hints/errors
-                val message = uploadError ?: status?.first
-                val isError = uploadError != null || status?.second == true
-                Box(
-                    Modifier
-                        .fillMaxWidth()
-                        .clip(RoundedCornerShape(8.dp))
-                        .background(Color.White.copy(alpha = 0.05f))
-                        .padding(12.dp)
-                        .defaultMinSize(minHeight = 24.dp),
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Text(
-                        text = message?.takeIf { it.isNotBlank() }
-                            ?: stringResource(R.string.scan_wallet_hint),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = if (isError) Color(0xFFF87171) else Color.White.copy(alpha = 0.6f),
-                        textAlign = TextAlign.Center,
-                    )
-                }
-
-                Spacer(Modifier.height(16.dp))
-
-                GlassButton(
-                    text = stringResource(R.string.upload_qr_image),
-                    onClick = { imagePicker.launch("image/*") },
-                    modifier = Modifier.fillMaxWidth().height(48.dp),
-                )
-            }
-        }
-    }
-}
-
-/** Decode a QR from a picked image, downsampled so huge photos stay cheap. */
-private fun decodeQrFromUri(context: Context, uri: Uri): String? {
-    return try {
-        val resolver = context.contentResolver
-        val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
-        resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, bounds) }
-        var sample = 1
-        val maxDim = maxOf(bounds.outWidth, bounds.outHeight)
-        while (maxDim / (sample * 2) >= 1600) sample *= 2
-        val opts = BitmapFactory.Options().apply { inSampleSize = sample }
-        val bmp = resolver.openInputStream(uri)?.use { BitmapFactory.decodeStream(it, null, opts) }
-            ?: return null
-        val pixels = IntArray(bmp.width * bmp.height)
-        bmp.getPixels(pixels, 0, bmp.width, 0, 0, bmp.width, bmp.height)
-        val source = RGBLuminanceSource(bmp.width, bmp.height, pixels)
-        val reader = MultiFormatReader().apply {
-            setHints(
-                mapOf(
-                    DecodeHintType.POSSIBLE_FORMATS to listOf(BarcodeFormat.QR_CODE),
-                    DecodeHintType.TRY_HARDER to true,
-                )
-            )
-        }
-        try {
-            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source))).text
-        } catch (_: NotFoundException) {
-            // Light-on-dark QRs (dark-themed wallets) decode inverted.
-            reader.reset()
-            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source.invert()))).text
-        }
-    } catch (_: Exception) {
-        null
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/navigation/NavGraph.kt

@@ -1,8 +1,5 @@
 package com.archipelago.app.ui.navigation
 
-import android.net.VpnService
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
@@ -12,19 +9,14 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.platform.LocalContext
-import androidx.navigation.NavType
 import androidx.navigation.compose.NavHost
 import androidx.navigation.compose.composable
 import androidx.navigation.compose.rememberNavController
-import androidx.navigation.navArgument
 import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
 import com.archipelago.app.data.ServerQrParser
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.ui.screens.FlareScreen
 import com.archipelago.app.ui.screens.IntroScreen
-import com.archipelago.app.ui.screens.PartyScreen
 import com.archipelago.app.ui.screens.RemoteInputScreen
 import com.archipelago.app.ui.screens.ServerConnectScreen
 import com.archipelago.app.ui.screens.WebViewScreen
@@ -35,8 +27,6 @@ object Routes {
     const val SERVER_CONNECT = "server_connect"
     const val WEB_VIEW = "web_view"
     const val REMOTE_INPUT = "remote_input"
-    const val MESH_PARTY = "mesh_party"
-    const val FLARE = "flare"
 }
 
 @Composable
@@ -56,34 +46,6 @@ fun AppNavHost(
     // connect form so the user lands on the password prompt for that server.
     var pairPrefill by remember { mutableStateOf<ServerEntry?>(null) }
 
-    // Mesh tunnel: Android's VPN consent dialog is the single unavoidable
-    // interaction — it can only be launched from an Activity, so pairing
-    // paths raise FipsManager.consentNeeded and it is handled here, once.
-    val consentNeeded by FipsManager.consentNeeded.collectAsState()
-    val vpnConsentLauncher = rememberLauncherForActivityResult(
-        ActivityResultContracts.StartActivityForResult()
-    ) { result ->
-        FipsManager.consentHandled()
-        if (result.resultCode == android.app.Activity.RESULT_OK) {
-            FipsManager.startService(context)
-        }
-    }
-    LaunchedEffect(consentNeeded) {
-        if (!consentNeeded) return@LaunchedEffect
-        val consentIntent = VpnService.prepare(context)
-        if (consentIntent == null) {
-            FipsManager.consentHandled()
-            FipsManager.startService(context)
-        } else {
-            vpnConsentLauncher.launch(consentIntent)
-        }
-    }
-
-    // Paired + previously consented → the mesh comes back silently on launch.
-    LaunchedEffect(Unit) {
-        FipsManager.autoStartIfReady(context)
-    }
-
     if (introSeen == null) return
 
     // Declared after the introSeen gate so it can't fire before the NavHost
@@ -96,7 +58,6 @@ fun AppNavHost(
                 // Pairing implies the app is installed and in use — skip the intro.
                 prefs.markIntroSeen()
                 val merged = prefs.upsertServer(result.server)
-                FipsManager.registerNode(context, result.fips, merged.displayName())
                 if (merged.password.isNotBlank()) {
                     // Demo flow: password came with the link — connect in one step.
                     prefs.setActiveServer(merged)
@@ -128,9 +89,6 @@ fun AppNavHost(
     ) {
         composable(Routes.INTRO) {
             IntroScreen(
-                onMeshParty = {
-                    navController.navigate(Routes.MESH_PARTY)
-                },
                 onContinue = {
                     scope.launch {
                         prefs.markIntroSeen()
@@ -167,7 +125,6 @@ fun AppNavHost(
                 WebViewScreen(
                     serverUrl = server.toUrl(),
                     serverPassword = server.password,
-                    meshFallbackUrl = server.toMeshUrl(),
                     onDisconnect = {
                         scope.launch {
                             prefs.clearActiveServer()
@@ -179,46 +136,15 @@ fun AppNavHost(
                     onRemoteInput = {
                         navController.navigate(Routes.REMOTE_INPUT)
                     },
-                    onRemoteKeyboard = {
-                        navController.navigate("${Routes.REMOTE_INPUT}?keyboard=true")
-                    },
-                    onMeshParty = {
-                        navController.navigate(Routes.MESH_PARTY)
-                    },
                 )
             }
         }
 
-        composable(
-            "${Routes.REMOTE_INPUT}?keyboard={keyboard}",
-            arguments = listOf(
-                navArgument("keyboard") {
-                    type = NavType.BoolType
-                    defaultValue = false
-                },
-            ),
-        ) { entry ->
+        composable(Routes.REMOTE_INPUT) {
             RemoteInputScreen(
                 onBack = {
                     navController.popBackStack()
                 },
-                onMeshParty = {
-                    navController.navigate(Routes.MESH_PARTY)
-                },
-                startInKeyboard = entry.arguments?.getBoolean("keyboard") == true,
-            )
-        }
-
-        composable(Routes.MESH_PARTY) {
-            PartyScreen(
-                onBack = { navController.popBackStack() },
-                onOpenChat = { navController.navigate(Routes.FLARE) },
-            )
-        }
-
-        composable(Routes.FLARE) {
-            FlareScreen(
-                onBack = { navController.popBackStack() },
             )
         }
     }

Android/app/src/main/java/com/archipelago/app/ui/screens/FlareScreen.kt

@@ -1,359 +0,0 @@
-package com.archipelago.app.ui.screens
-
-import android.graphics.Bitmap
-import android.graphics.BitmapFactory
-import android.net.Uri
-import androidx.activity.compose.BackHandler
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.navigationBarsPadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.lazy.rememberLazyListState
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Image
-import androidx.compose.material3.Icon
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.OutlinedTextFieldDefaults
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.collectAsState
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.asImageBitmap
-import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
-import com.archipelago.app.fips.FlareClient
-import com.archipelago.app.fips.FlareMessage
-import com.archipelago.app.fips.FlareStore
-import com.archipelago.app.fips.PartyPeer
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceDark
-import com.archipelago.app.ui.theme.TextMuted
-import com.archipelago.app.ui.theme.TextPrimary
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-import java.io.ByteArrayOutputStream
-import java.io.File
-import java.util.UUID
-
-private val BubbleTheirs = Color.White.copy(alpha = 0.07f)
-private val BubbleBorder = Color.White.copy(alpha = 0.08f)
-
-/**
- * Flare — phone↔phone chat and photo beam over the FIPS mesh. Every byte is
- * E2E encrypted by the mesh layer and addressed by npub; whether it travels
- * via a public anchor (5G) or a direct hotspot link is invisible up here —
- * which is the entire point.
- */
-@Composable
-fun FlareScreen(onBack: () -> Unit) {
-    val context = LocalContext.current
-    val prefs = remember { FipsPreferences(context) }
-    val scope = rememberCoroutineScope()
-
-    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
-    var myName by remember { mutableStateOf("Phone") }
-    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
-    var selectedNpub by remember { mutableStateOf<String?>(null) }
-    val allMessages by FlareStore.messages.collectAsState()
-    var draft by remember { mutableStateOf("") }
-
-    LaunchedEffect(Unit) {
-        identity = FipsManager.ensureIdentity(prefs)
-        myName = prefs.partyName()
-    }
-    LaunchedEffect(peers) {
-        if (selectedNpub == null || peers.none { it.npub == selectedNpub }) {
-            selectedNpub = peers.firstOrNull()?.npub
-        }
-    }
-
-    val peer = peers.firstOrNull { it.npub == selectedNpub }
-    val messages = allMessages.filter { it.peerNpub == selectedNpub }
-    val listState = rememberLazyListState()
-    LaunchedEffect(messages.size) {
-        if (messages.isNotEmpty()) listState.animateScrollToItem(messages.size - 1)
-    }
-
-    fun sendText() {
-        val target = peer ?: return
-        val me = identity ?: return
-        val text = draft.trim()
-        if (text.isEmpty()) return
-        draft = ""
-        val msg = FlareMessage(
-            id = UUID.randomUUID().toString(),
-            peerNpub = target.npub,
-            fromMe = true,
-            name = myName,
-            text = text,
-            ts = System.currentTimeMillis(),
-            status = FlareMessage.Status.SENDING,
-        )
-        FlareStore.add(msg)
-        scope.launch(Dispatchers.IO) {
-            val ok = FlareClient.sendText(target, me.npub, myName, text)
-            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
-        }
-    }
-
-    fun sendPhoto(uri: Uri) {
-        val target = peer ?: return
-        val me = identity ?: return
-        scope.launch(Dispatchers.IO) {
-            val jpeg = compressPhoto(context, uri) ?: return@launch
-            // Local copy so our own bubble renders the sent photo.
-            val dir = File(context.cacheDir, "flare").apply { mkdirs() }
-            val local = File(dir, "${UUID.randomUUID()}.jpg").apply { writeBytes(jpeg) }
-            val msg = FlareMessage(
-                id = UUID.randomUUID().toString(),
-                peerNpub = target.npub,
-                fromMe = true,
-                name = myName,
-                photoPath = local.absolutePath,
-                ts = System.currentTimeMillis(),
-                status = FlareMessage.Status.SENDING,
-            )
-            FlareStore.add(msg)
-            val ok = FlareClient.sendPhoto(target, me.npub, myName, jpeg)
-            FlareStore.setStatus(msg.id, if (ok) FlareMessage.Status.SENT else FlareMessage.Status.FAILED)
-        }
-    }
-
-    val photoPicker = rememberLauncherForActivityResult(
-        ActivityResultContracts.GetContent()
-    ) { uri -> uri?.let { sendPhoto(it) } }
-
-    BackHandler { onBack() }
-
-    Column(
-        Modifier
-            .fillMaxSize()
-            .background(SurfaceDark)
-            .statusBarsPadding()
-            .navigationBarsPadding()
-            .imePadding(),
-    ) {
-        // Header
-        Row(
-            Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 10.dp),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.SpaceBetween,
-        ) {
-            Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(6.dp))
-            Column(horizontalAlignment = Alignment.CenterHorizontally) {
-                Text("FLARE", color = TextPrimary, fontSize = 16.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
-                peer?.let {
-                    Text(
-                        it.name + if (it.ip.isNotBlank()) "  ·  direct+mesh" else "  ·  mesh",
-                        color = BitcoinOrange,
-                        fontSize = 11.sp,
-                    )
-                }
-            }
-            Spacer(Modifier.size(48.dp))
-        }
-
-        // Peer tabs when chatting with more than one phone
-        if (peers.size > 1) {
-            Row(
-                Modifier.fillMaxWidth().padding(horizontal = 16.dp),
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                peers.forEach { p ->
-                    val active = p.npub == selectedNpub
-                    Text(
-                        p.name,
-                        color = if (active) BitcoinOrange else TextMuted,
-                        fontSize = 13.sp,
-                        modifier = Modifier
-                            .clip(RoundedCornerShape(10.dp))
-                            .background(if (active) BitcoinOrange.copy(alpha = 0.12f) else Color.Transparent)
-                            .border(
-                                1.dp,
-                                if (active) BitcoinOrange.copy(alpha = 0.4f) else BubbleBorder,
-                                RoundedCornerShape(10.dp),
-                            )
-                            .clickable { selectedNpub = p.npub }
-                            .padding(horizontal = 12.dp, vertical = 6.dp),
-                    )
-                }
-            }
-        }
-
-        if (peer == null) {
-            Box(Modifier.weight(1f).fillMaxWidth(), contentAlignment = Alignment.Center) {
-                Text("No party peers yet — scan a phone first", color = TextMuted, fontSize = 14.sp)
-            }
-        } else {
-            LazyColumn(
-                state = listState,
-                modifier = Modifier.weight(1f).fillMaxWidth(),
-                contentPadding = androidx.compose.foundation.layout.PaddingValues(16.dp),
-                verticalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                items(messages, key = { it.id }) { msg ->
-                    MessageBubble(msg)
-                }
-            }
-
-            // Composer
-            Row(
-                Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp),
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                Box(
-                    Modifier
-                        .size(48.dp)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(BubbleTheirs)
-                        .border(1.dp, BubbleBorder, RoundedCornerShape(12.dp))
-                        .clickable { photoPicker.launch("image/*") },
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Icon(Icons.Default.Image, "Beam a photo", tint = BitcoinOrange, modifier = Modifier.size(22.dp))
-                }
-                OutlinedTextField(
-                    value = draft,
-                    onValueChange = { draft = it },
-                    placeholder = { Text("Send a flare…", color = TextMuted, fontSize = 14.sp) },
-                    modifier = Modifier.weight(1f),
-                    singleLine = true,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Send),
-                    keyboardActions = KeyboardActions(onSend = { sendText() }),
-                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp),
-                    colors = OutlinedTextFieldDefaults.colors(
-                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
-                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
-                        cursorColor = BitcoinOrange,
-                        focusedTextColor = TextPrimary,
-                        unfocusedTextColor = TextPrimary,
-                    ),
-                    shape = RoundedCornerShape(12.dp),
-                )
-                Box(
-                    Modifier
-                        .size(48.dp)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(BitcoinOrange.copy(alpha = 0.15f))
-                        .border(1.dp, BitcoinOrange.copy(alpha = 0.4f), RoundedCornerShape(12.dp))
-                        .clickable { sendText() },
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Text("➤", color = BitcoinOrange, fontSize = 18.sp)
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun MessageBubble(msg: FlareMessage) {
-    Row(
-        Modifier.fillMaxWidth(),
-        horizontalArrangement = if (msg.fromMe) Arrangement.End else Arrangement.Start,
-    ) {
-        Column(
-            Modifier
-                .widthIn(max = 300.dp)
-                .clip(RoundedCornerShape(16.dp))
-                .background(if (msg.fromMe) BitcoinOrange.copy(alpha = 0.14f) else BubbleTheirs)
-                .border(
-                    1.dp,
-                    if (msg.fromMe) BitcoinOrange.copy(alpha = 0.35f) else BubbleBorder,
-                    RoundedCornerShape(16.dp),
-                )
-                .padding(horizontal = 12.dp, vertical = 8.dp),
-        ) {
-            if (msg.photoPath.isNotBlank()) {
-                val bmp = remember(msg.photoPath) { BitmapFactory.decodeFile(msg.photoPath) }
-                bmp?.let {
-                    Image(
-                        bitmap = it.asImageBitmap(),
-                        contentDescription = "Beamed photo",
-                        modifier = Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(10.dp)),
-                        contentScale = ContentScale.FillWidth,
-                    )
-                }
-            }
-            if (msg.text.isNotBlank()) {
-                Text(msg.text, color = TextPrimary, fontSize = 15.sp)
-            }
-            Text(
-                when (msg.status) {
-                    FlareMessage.Status.SENDING -> "sending…"
-                    FlareMessage.Status.SENT -> "sent · E2E via mesh"
-                    FlareMessage.Status.FAILED -> "failed — tap to retry later"
-                    FlareMessage.Status.RECEIVED -> msg.name
-                },
-                color = if (msg.status == FlareMessage.Status.FAILED) BitcoinOrange else TextMuted,
-                fontSize = 10.sp,
-                modifier = Modifier.padding(top = 2.dp),
-            )
-        }
-    }
-}
-
-/** Decode, downscale (≤1600px) and JPEG-compress a picked photo off-main. */
-private suspend fun compressPhoto(context: android.content.Context, uri: Uri): ByteArray? =
-    withContext(Dispatchers.IO) {
-        try {
-            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
-            context.contentResolver.openInputStream(uri)?.use {
-                BitmapFactory.decodeStream(it, null, bounds)
-            }
-            var sample = 1
-            while (maxOf(bounds.outWidth, bounds.outHeight) / sample > 1600) sample *= 2
-            val opts = BitmapFactory.Options().apply { inSampleSize = sample }
-            val bitmap = context.contentResolver.openInputStream(uri)?.use {
-                BitmapFactory.decodeStream(it, null, opts)
-            } ?: return@withContext null
-            val out = ByteArrayOutputStream()
-            bitmap.compress(Bitmap.CompressFormat.JPEG, 80, out)
-            bitmap.recycle()
-            out.toByteArray()
-        } catch (_: Exception) {
-            null
-        }
-    }

Android/app/src/main/java/com/archipelago/app/ui/screens/IntroScreen.kt

@@ -55,12 +55,7 @@ import com.archipelago.app.ui.theme.TextPrimary
 import kotlinx.coroutines.delay
 
 @Composable
-fun IntroScreen(
-    onContinue: () -> Unit,
-    // Mesh Party works with no node at all (phone↔phone) — offered right on
-    // the first screen so a friend who just got the app can join a party.
-    onMeshParty: () -> Unit = {},
-) {
+fun IntroScreen(onContinue: () -> Unit) {
     val logoAlpha = remember { Animatable(0f) }
     var showContent by remember { mutableStateOf(false) }
 
@@ -148,14 +143,6 @@ fun IntroScreen(
                         onClick = onContinue,
                         modifier = Modifier.fillMaxWidth().height(56.dp),
                     )
-
-                    Spacer(modifier = Modifier.height(12.dp))
-
-                    GlassButton(
-                        text = stringResource(R.string.mesh_party),
-                        onClick = onMeshParty,
-                        modifier = Modifier.fillMaxWidth().height(48.dp),
-                    )
                 }
             }
         }

Android/app/src/main/java/com/archipelago/app/ui/screens/PartyScreen.kt

@@ -1,519 +0,0 @@
-package com.archipelago.app.ui.screens
-
-import android.graphics.Bitmap
-import androidx.activity.compose.BackHandler
-import androidx.compose.animation.AnimatedVisibility
-import androidx.compose.animation.fadeIn
-import androidx.compose.animation.fadeOut
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.border
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.OutlinedTextFieldDefaults
-import androidx.compose.material3.Switch
-import androidx.compose.material3.SwitchDefaults
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.collectAsState
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberCoroutineScope
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.asImageBitmap
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.TextStyle
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.fips.FipsNative
-import com.archipelago.app.fips.FipsPreferences
-import com.archipelago.app.fips.FlareClient
-import com.archipelago.app.fips.PartyPeer
-import com.archipelago.app.fips.PartyQr
-import com.archipelago.app.ui.components.CameraQrPreview
-import com.archipelago.app.ui.theme.BitcoinOrange
-import com.archipelago.app.ui.theme.SurfaceDark
-import com.archipelago.app.ui.theme.TextMuted
-import com.archipelago.app.ui.theme.TextPrimary
-import com.google.zxing.BarcodeFormat
-import com.google.zxing.EncodeHintType
-import com.google.zxing.qrcode.QRCodeWriter
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-
-private val CardBg = Color.White.copy(alpha = 0.05f)
-private val CardBorder = Color.White.copy(alpha = 0.08f)
-
-/** Public companion download (vps2 demo host — serves the same APK as the
- *  nodes' QR link). Rendered as the "Share this app" QR. */
-private const val APP_DOWNLOAD_URL =
-    "http://146.59.87.168:2100/packages/archipelago-companion.apk"
-
-/**
- * Mesh Party — phone↔phone FIPS pairing. Show your QR, scan theirs, and the
- * two embedded mesh nodes link up: through anchors when there's internet,
- * directly over any shared WiFi/hotspot when there isn't.
- */
-@Composable
-fun PartyScreen(
-    onBack: () -> Unit,
-    onOpenChat: () -> Unit,
-) {
-    val context = LocalContext.current
-    val prefs = remember { FipsPreferences(context) }
-    val scope = rememberCoroutineScope()
-
-    var identity by remember { mutableStateOf<FipsNative.Identity?>(null) }
-    var name by remember { mutableStateOf("") }
-    var localIp by remember { mutableStateOf<String?>(null) }
-    var showScanner by remember { mutableStateOf(false) }
-    var showShareQr by remember { mutableStateOf(false) }
-    var scanHint by remember { mutableStateOf<String?>(null) }
-
-    // Camera permission — fresh installs (and reinstalls: uninstall wipes
-    // grants) land here with no CAMERA grant, and the raw preview just showed
-    // black. Ask the moment the scanner opens.
-    var hasCamera by remember {
-        mutableStateOf(
-            androidx.core.content.ContextCompat.checkSelfPermission(
-                context, android.Manifest.permission.CAMERA,
-            ) == android.content.pm.PackageManager.PERMISSION_GRANTED
-        )
-    }
-    val cameraPermLauncher = androidx.activity.compose.rememberLauncherForActivityResult(
-        androidx.activity.result.contract.ActivityResultContracts.RequestPermission()
-    ) { hasCamera = it }
-    LaunchedEffect(showScanner) {
-        if (showScanner && !hasCamera) {
-            cameraPermLauncher.launch(android.Manifest.permission.CAMERA)
-        }
-    }
-    val listenOn by prefs.partyListenFlow.collectAsState(initial = false)
-    val peers by prefs.partyPeersFlow.collectAsState(initial = emptyList())
-
-    LaunchedEffect(Unit) {
-        identity = FipsManager.ensureIdentity(prefs)
-        name = prefs.partyName()
-        // The hotspot/WiFi address can change while this screen is open
-        // (e.g. the user flips the hotspot on mid-demo) — keep it fresh.
-        while (true) {
-            localIp = withContext(Dispatchers.IO) { PartyQr.localWifiIpv4() }
-            delay(3_000)
-        }
-    }
-
-    val qrPayload = identity?.let { id ->
-        PartyQr.build(
-            npub = id.npub,
-            ula = id.address,
-            name = name.ifBlank { "Phone" },
-            ip = if (listenOn) localIp else null,
-            port = PartyQr.PARTY_UDP_PORT,
-        )
-    }
-    val qrBitmap = remember(qrPayload) { qrPayload?.let { renderQr(it) } }
-
-    BackHandler {
-        when {
-            showScanner -> showScanner = false
-            showShareQr -> showShareQr = false
-            else -> onBack()
-        }
-    }
-
-    Box(Modifier.fillMaxSize().background(SurfaceDark)) {
-        Column(
-            Modifier
-                .fillMaxSize()
-                .statusBarsPadding()
-                .verticalScroll(rememberScrollState())
-                .padding(horizontal = 24.dp, vertical = 16.dp),
-            verticalArrangement = Arrangement.spacedBy(14.dp),
-        ) {
-            Row(
-                Modifier.fillMaxWidth(),
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.SpaceBetween,
-            ) {
-                Text("‹ Back", color = TextMuted, fontSize = 15.sp, modifier = Modifier.clickable { onBack() }.padding(8.dp))
-                Text("MESH PARTY", color = TextPrimary, fontSize = 17.sp, fontWeight = FontWeight.SemiBold, letterSpacing = 3.sp)
-                Spacer(Modifier.size(56.dp))
-            }
-
-            // My QR card
-            Column(
-                Modifier
-                    .fillMaxWidth()
-                    .clip(RoundedCornerShape(20.dp))
-                    .background(CardBg)
-                    .border(1.dp, CardBorder, RoundedCornerShape(20.dp))
-                    .padding(18.dp),
-                horizontalAlignment = Alignment.CenterHorizontally,
-                verticalArrangement = Arrangement.spacedBy(12.dp),
-            ) {
-                qrBitmap?.let { bmp ->
-                    Box(
-                        Modifier
-                            .clip(RoundedCornerShape(16.dp))
-                            .background(Color.White)
-                            .padding(12.dp),
-                    ) {
-                        Image(
-                            bitmap = bmp.asImageBitmap(),
-                            contentDescription = "My mesh party QR",
-                            modifier = Modifier.size(220.dp),
-                        )
-                    }
-                } ?: Text("Mesh identity unavailable on this device", color = TextMuted, fontSize = 14.sp)
-
-                identity?.let {
-                    Text(
-                        it.npub.take(16) + "…" + it.npub.takeLast(6),
-                        color = TextMuted,
-                        fontSize = 12.sp,
-                        textAlign = TextAlign.Center,
-                    )
-                }
-
-                OutlinedTextField(
-                    value = name,
-                    onValueChange = {
-                        name = it.take(24)
-                        scope.launch { prefs.setPartyName(name) }
-                    },
-                    placeholder = { Text("Your name", color = TextMuted, textAlign = TextAlign.Center, modifier = Modifier.fillMaxWidth()) },
-                    modifier = Modifier.fillMaxWidth().height(56.dp),
-                    singleLine = true,
-                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
-                    textStyle = TextStyle(color = TextPrimary, fontSize = 15.sp, textAlign = TextAlign.Center),
-                    colors = OutlinedTextFieldDefaults.colors(
-                        focusedBorderColor = Color.White.copy(alpha = 0.3f),
-                        unfocusedBorderColor = Color.White.copy(alpha = 0.12f),
-                        cursorColor = BitcoinOrange,
-                        focusedTextColor = TextPrimary,
-                        unfocusedTextColor = TextPrimary,
-                    ),
-                    shape = RoundedCornerShape(12.dp),
-                )
-
-                // Direct-link toggle (hotspot mode)
-                Row(
-                    Modifier.fillMaxWidth(),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
-                    Column(Modifier.padding(end = 12.dp)) {
-                        Text("Accept direct links", color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
-                        Text(
-                            when {
-                                listenOn && localIp != null -> "Dialable at $localIp:${PartyQr.PARTY_UDP_PORT} — no internet needed"
-                                listenOn -> "Waiting for a WiFi/hotspot address…"
-                                else -> "Off — mesh routes via anchors only"
-                            },
-                            color = if (listenOn) BitcoinOrange else TextMuted,
-                            fontSize = 12.sp,
-                        )
-                    }
-                    Switch(
-                        checked = listenOn,
-                        onCheckedChange = { on ->
-                            scope.launch {
-                                prefs.setPartyListen(on)
-                                FipsManager.requestMeshRestart(context)
-                            }
-                        },
-                        colors = SwitchDefaults.colors(
-                            checkedTrackColor = BitcoinOrange,
-                            checkedThumbColor = Color.White,
-                        ),
-                    )
-                }
-            }
-
-            GlassButton(
-                text = "Scan a Phone",
-                onClick = { showScanner = true },
-                modifier = Modifier.fillMaxWidth().height(56.dp),
-            )
-
-            if (peers.isNotEmpty()) {
-                Text("PARTY PEERS", color = TextMuted, fontSize = 12.sp, letterSpacing = 2.sp)
-                peers.forEach { peer ->
-                    Row(
-                        Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(14.dp))
-                            .background(CardBg)
-                            .border(1.dp, CardBorder, RoundedCornerShape(14.dp))
-                            .clickable { onOpenChat() }
-                            .padding(horizontal = 16.dp, vertical = 12.dp),
-                        verticalAlignment = Alignment.CenterVertically,
-                        horizontalArrangement = Arrangement.SpaceBetween,
-                    ) {
-                        Column(Modifier.padding(end = 8.dp)) {
-                            Text(peer.name, color = TextPrimary, fontSize = 15.sp, fontWeight = FontWeight.Medium)
-                            Text(
-                                peer.npub.take(14) + "…" + if (peer.ip.isNotBlank()) "  ·  direct ${peer.ip}" else "  ·  via mesh",
-                                color = TextMuted,
-                                fontSize = 11.sp,
-                            )
-                        }
-                        Text(
-                            "✕",
-                            color = TextMuted,
-                            fontSize = 16.sp,
-                            modifier = Modifier.clickable {
-                                scope.launch {
-                                    prefs.removePartyPeer(peer.npub)
-                                    FipsManager.requestMeshRestart(context)
-                                }
-                            }.padding(8.dp),
-                        )
-                    }
-                }
-                GlassButton(
-                    text = "Open Flare Chat",
-                    onClick = onOpenChat,
-                    modifier = Modifier.fillMaxWidth().height(56.dp),
-                )
-            } else {
-                Text(
-                    "Scan another phone's party QR (or let them scan yours) to link your mesh nodes — works over 5G via anchors, or over any shared WiFi/hotspot with zero internet.",
-                    color = TextMuted,
-                    fontSize = 13.sp,
-                    textAlign = TextAlign.Center,
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 8.dp),
-                )
-            }
-            Spacer(Modifier.height(12.dp))
-            // Hand the app itself to a friend: shares this install's own APK
-            // through the system sheet (Quick Share/Bluetooth), so a nearby
-            // phone gets the companion with zero internet — the whole party
-            // premise.
-            GlassButton(
-                text = "Share this app",
-                onClick = { showShareQr = true },
-                modifier = Modifier.fillMaxWidth().height(48.dp),
-            )
-            Spacer(Modifier.height(12.dp))
-        }
-
-        // "Share this app" — a QR of the public download link, so the other
-        // phone scans it with its normal camera and installs over any
-        // internet. (The vps2 demo host serves the same APK the nodes do.)
-        AnimatedVisibility(visible = showShareQr, enter = fadeIn(), exit = fadeOut()) {
-            Box(
-                Modifier
-                    .fillMaxSize()
-                    .background(Color.Black.copy(alpha = 0.94f))
-                    .clickable { showShareQr = false },
-                contentAlignment = Alignment.Center,
-            ) {
-                Column(horizontalAlignment = Alignment.CenterHorizontally) {
-                    val dlQr = remember { renderQr(APP_DOWNLOAD_URL) }
-                    dlQr?.let { bmp ->
-                        Box(
-                            Modifier
-                                .clip(RoundedCornerShape(16.dp))
-                                .background(Color.White)
-                                .padding(14.dp),
-                        ) {
-                            Image(
-                                bitmap = bmp.asImageBitmap(),
-                                contentDescription = "Companion download QR",
-                                modifier = Modifier.size(240.dp),
-                            )
-                        }
-                    }
-                    Spacer(Modifier.height(18.dp))
-                    Text(
-                        "Scan with any camera to download\nthe Archipelago Companion",
-                        color = TextPrimary,
-                        fontSize = 15.sp,
-                        textAlign = TextAlign.Center,
-                    )
-                    Spacer(Modifier.height(10.dp))
-                    Text(
-                        "…or send the APK file directly",
-                        color = BitcoinOrange,
-                        fontSize = 13.sp,
-                        modifier = Modifier.clickable { shareCompanionApk(context) }.padding(8.dp),
-                    )
-                    Spacer(Modifier.height(6.dp))
-                    Text("Close", color = TextMuted, fontSize = 14.sp, modifier = Modifier.clickable { showShareQr = false }.padding(8.dp))
-                }
-            }
-        }
-
-        // Party QR scanner overlay
-        AnimatedVisibility(visible = showScanner, enter = fadeIn(), exit = fadeOut()) {
-            Box(Modifier.fillMaxSize().background(Color.Black)) {
-                if (!hasCamera) {
-                    Column(
-                        Modifier.align(Alignment.Center).padding(horizontal = 32.dp),
-                        horizontalAlignment = Alignment.CenterHorizontally,
-                        verticalArrangement = Arrangement.spacedBy(14.dp),
-                    ) {
-                        Text(
-                            "Camera access is needed to scan a party QR.",
-                            color = TextPrimary,
-                            fontSize = 15.sp,
-                            textAlign = TextAlign.Center,
-                        )
-                        GlassButton(
-                            text = "Grant camera access",
-                            onClick = { cameraPermLauncher.launch(android.Manifest.permission.CAMERA) },
-                            modifier = Modifier.fillMaxWidth().height(48.dp),
-                        )
-                    }
-                } else CameraQrPreview(onDecoded = { text ->
-                    val peer = PartyQr.parse(text)
-                    when {
-                        peer == null -> scanHint = "Not a mesh party QR"
-                        peer.npub == identity?.npub -> scanHint = "That's your own QR"
-                        else -> {
-                            showScanner = false
-                            scanHint = null
-                            scope.launch {
-                                prefs.upsertPartyPeer(peer)
-                                // Pick up the direct-dial PeerConfig (and the
-                                // listener, if ours is on) immediately.
-                                FipsManager.requestMeshRestart(context)
-                                // Pairing must be MUTUAL: announce ourselves so
-                                // the scanned phone gets us as a peer + a chat
-                                // entry without scanning back. Retried while
-                                // the fresh link/session comes up.
-                                val me = identity
-                                if (me != null) {
-                                    launch(Dispatchers.IO) {
-                                        for (attempt in 0 until 6) {
-                                            val ok = FlareClient.sendHello(
-                                                peer = peer,
-                                                myNpub = me.npub,
-                                                myName = name.ifBlank { "Phone" },
-                                                myUla = me.address,
-                                                myIp = if (listenOn) localIp else null,
-                                                myPort = PartyQr.PARTY_UDP_PORT,
-                                            )
-                                            if (ok) break
-                                            delay(3_000)
-                                        }
-                                    }
-                                }
-                                onOpenChat()
-                            }
-                        }
-                    }
-                })
-                Box(
-                    Modifier
-                        .align(Alignment.Center)
-                        .size(260.dp)
-                        .border(2.dp, BitcoinOrange.copy(alpha = 0.85f), RoundedCornerShape(20.dp)),
-                )
-                Text(
-                    "Close",
-                    color = TextPrimary,
-                    fontSize = 16.sp,
-                    modifier = Modifier
-                        .align(Alignment.TopEnd)
-                        .statusBarsPadding()
-                        .clickable { showScanner = false }
-                        .padding(20.dp),
-                )
-                scanHint?.let {
-                    Text(
-                        it,
-                        color = BitcoinOrange,
-                        fontSize = 14.sp,
-                        textAlign = TextAlign.Center,
-                        modifier = Modifier
-                            .align(Alignment.BottomCenter)
-                            .padding(bottom = 48.dp)
-                            .fillMaxWidth(),
-                    )
-                }
-            }
-        }
-    }
-
-    // Scan hints fade so the camera feels live again.
-    LaunchedEffect(scanHint) {
-        if (scanHint != null) {
-            delay(2500)
-            scanHint = null
-        }
-    }
-}
-
-/** Render a QR payload as a bitmap (dark modules on white). */
-private fun renderQr(payload: String, size: Int = 640): Bitmap? = try {
-    val matrix = QRCodeWriter().encode(
-        payload,
-        BarcodeFormat.QR_CODE,
-        size,
-        size,
-        mapOf(EncodeHintType.MARGIN to 1),
-    )
-    val pixels = IntArray(size * size)
-    for (y in 0 until size) {
-        for (x in 0 until size) {
-            pixels[y * size + x] = if (matrix[x, y]) 0xFF0A0A0A.toInt() else 0xFFFFFFFF.toInt()
-        }
-    }
-    Bitmap.createBitmap(pixels, size, size, Bitmap.Config.ARGB_8888)
-} catch (_: Exception) {
-    null
-}
-
-/** Share this install's own APK via the system share sheet — a nearby friend
- *  gets the companion with no internet at all (Quick Share / Bluetooth). */
-private fun shareCompanionApk(context: android.content.Context) {
-    try {
-        val src = java.io.File(context.applicationInfo.sourceDir)
-        val dir = java.io.File(context.cacheDir, "share").apply { mkdirs() }
-        val out = java.io.File(dir, "archipelago-companion.apk")
-        src.copyTo(out, overwrite = true)
-        val uri = androidx.core.content.FileProvider.getUriForFile(
-            context, "${context.packageName}.fileprovider", out,
-        )
-        val send = android.content.Intent(android.content.Intent.ACTION_SEND).apply {
-            type = "application/vnd.android.package-archive"
-            putExtra(android.content.Intent.EXTRA_STREAM, uri)
-            addFlags(android.content.Intent.FLAG_GRANT_READ_URI_PERMISSION)
-        }
-        context.startActivity(
-            android.content.Intent.createChooser(send, "Share Archipelago Companion")
-                .addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK),
-        )
-    } catch (_: Exception) {
-        // No share targets / copy failed — nothing sensible to do here.
-    }
-}

Android/app/src/main/java/com/archipelago/app/ui/screens/RemoteInputScreen.kt

@@ -4,10 +4,8 @@ import android.content.res.Configuration
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
-import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.WindowInsets
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -39,7 +37,6 @@ import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.unit.dp
 import com.archipelago.app.R
 import com.archipelago.app.data.ServerPreferences
-import com.archipelago.app.fips.FipsManager
 import com.archipelago.app.network.ConnectionState
 import com.archipelago.app.network.InputWebSocket
 import com.archipelago.app.ui.components.NESController
@@ -56,12 +53,7 @@ import com.archipelago.app.ui.theme.TextMuted
 import kotlinx.coroutines.launch
 
 @Composable
-fun RemoteInputScreen(
-    onBack: () -> Unit,
-    onMeshParty: (() -> Unit)? = null,
-    // Land on the keyboard instead of the gamepad (hub menu's Keyboard card).
-    startInKeyboard: Boolean = false,
-) {
+fun RemoteInputScreen(onBack: () -> Unit) {
     val context = LocalContext.current
     val prefs = remember { ServerPreferences(context) }
     val scope = rememberCoroutineScope()
@@ -70,7 +62,7 @@ fun RemoteInputScreen(
     val savedServers by prefs.savedServers.collectAsState(initial = emptyList())
     val activeServer by prefs.activeServer.collectAsState(initial = null)
 
-    var isGamepadMode by remember { mutableStateOf(!startInKeyboard) }
+    var isGamepadMode by remember { mutableStateOf(true) }
     var showModal by remember { mutableStateOf(false) }
     var showQrScanner by remember { mutableStateOf(false) }
     var controllerStyle by remember { mutableStateOf(ControllerStyle.DARK) }
@@ -97,9 +89,6 @@ fun RemoteInputScreen(
         playerId = when (playerId) { 0 -> 1; 1 -> 2; else -> 0 }
         ws.playerId = playerId
     }
-    fun toggleStyle() {
-        controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
-    }
     val connectionState by ws.state.collectAsState()
     val lifecycleOwner = LocalLifecycleOwner.current
 
@@ -163,7 +152,6 @@ fun RemoteInputScreen(
                 onKey = { ws.sendKey(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
-                onToggleStyle = ::toggleStyle,
             )
             isGamepadMode && !isLandscape -> NESPortraitController(
                 style = controllerStyle,
@@ -174,7 +162,6 @@ fun RemoteInputScreen(
                 onMouseScroll = { ws.sendScroll(it) },
                 onMenu = { showModal = true },
                 onPlayerToggle = ::togglePlayer,
-                onToggleStyle = ::toggleStyle,
             )
             else -> {
                 // Keyboard mode: trackpad fills top, keyboard pinned bottom
@@ -184,7 +171,7 @@ fun RemoteInputScreen(
                             onMove = { dx, dy -> ws.sendMouseMove(dx, dy) },
                             onClick = { ws.sendClick(it) },
                             onScroll = { ws.sendScroll(it) },
-                            onThreeFingerHold = { showModal = true },
+                            onTwoFingerHold = { showModal = true },
                             modifier = Modifier.fillMaxWidth().weight(1f)
                                 .padding(horizontal = 16.dp, vertical = 8.dp),
                         )
@@ -194,20 +181,12 @@ fun RemoteInputScreen(
                             modifier = Modifier.fillMaxWidth(),
                         )
                     }
-                    // Settings + style icons top-right in keyboard mode
-                    Row(
-                        Modifier.align(Alignment.TopEnd).padding(8.dp),
-                        horizontalArrangement = Arrangement.spacedBy(8.dp),
-                    ) {
-                        com.archipelago.app.ui.components.SettingsBtn(
-                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
-                            onClick = { showModal = true },
-                        )
-                        com.archipelago.app.ui.components.StyleBtn(
-                            c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
-                            onClick = ::toggleStyle,
-                        )
-                    }
+                    // Settings icon top-right in keyboard mode
+                    com.archipelago.app.ui.components.SettingsBtn(
+                        c = com.archipelago.app.ui.components.paletteFor(controllerStyle),
+                        modifier = Modifier.align(Alignment.TopEnd).padding(8.dp),
+                        onClick = { showModal = true },
+                    )
                 }
             }
         }
@@ -230,6 +209,8 @@ fun RemoteInputScreen(
             visible = showModal,
             servers = savedServers,
             activeServer = activeServer,
+            isGamepadMode = isGamepadMode,
+            controllerStyle = controllerStyle,
             onDismiss = { showModal = false },
             onSelectServer = { server ->
                 scope.launch { ws.disconnect(); prefs.setActiveServer(server) }; showModal = false
@@ -263,10 +244,11 @@ fun RemoteInputScreen(
                     }
                 }
             },
-            onRemote = { isGamepadMode = true; showModal = false },
-            onKeyboard = { isGamepadMode = false; showModal = false },
+            onToggleMode = { isGamepadMode = !isGamepadMode; showModal = false },
+            onToggleStyle = {
+                controllerStyle = if (controllerStyle == ControllerStyle.CLASSIC) ControllerStyle.DARK else ControllerStyle.CLASSIC
+            },
             onBackToWebView = { showModal = false; onBack() },
-            onMeshParty = onMeshParty?.let { open -> { showModal = false; open() } },
         )
 
         // Pairing-QR scan launched from the menu's Add Server row. The menu stays
@@ -274,11 +256,10 @@ fun RemoteInputScreen(
         QrScannerOverlay(
             visible = showQrScanner,
             onDismiss = { showQrScanner = false },
-            onServerScanned = { scan ->
+            onServerScanned = { server ->
                 showQrScanner = false
                 scope.launch {
-                    val merged = prefs.upsertServer(scan.server)
-                    FipsManager.registerNode(context, scan.fips, merged.displayName())
+                    val merged = prefs.upsertServer(server)
                     if (activeServer == null) prefs.setActiveServer(merged)
                 }
             },

Android/app/src/main/java/com/archipelago/app/ui/screens/ServerConnectScreen.kt

@@ -71,11 +71,8 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import com.archipelago.app.R
-import com.archipelago.app.data.PairResult
 import com.archipelago.app.data.ServerEntry
 import com.archipelago.app.data.ServerPreferences
-import com.archipelago.app.fips.FipsManager
-import com.archipelago.app.ui.components.MeshLoadingScreen
 import com.archipelago.app.ui.components.QrScannerOverlay
 import com.archipelago.app.ui.theme.BitcoinOrange
 import com.archipelago.app.ui.theme.ErrorRed
@@ -86,7 +83,6 @@ import com.archipelago.app.ui.theme.TextMuted
 import com.archipelago.app.ui.theme.TextPrimary
 import com.archipelago.app.ui.theme.TextSecondary
 import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import java.net.HttpURLConnection
@@ -173,35 +169,10 @@ fun ServerConnectScreen(
         errorMessage = null
 
         scope.launch {
-            var reachable = testConnection(server)
-
-            // LAN address didn't answer — phone off-LAN (5G) or DHCP moved the
-            // node. The scanned IP was only ever a dial hint; the node's real
-            // identity is its npub and its ULA is reachable from anywhere over
-            // the mesh. Bring the tunnel up and probe the ULA before failing.
-            if (!reachable && server.meshIp.isNotBlank()) {
-                FipsManager.autoStartIfReady(context)
-                val meshServer = server.copy(
-                    address = server.meshIp,
-                    useHttps = false,
-                    port = "",
-                )
-                // Mesh discovery + first session can take 15s+ through the
-                // public tree (per node diagnosis), and on a
-                // first-ever pairing the VPN consent dialog is on screen at
-                // the same time — so probe patiently inside a 60s budget with
-                // per-attempt timeouts wide enough to ride out TCP
-                // retransmit backoff. The VPN service pre-warms the session
-                // in parallel (ArchyVpnService.startSessionWarmer).
-                val deadline = System.currentTimeMillis() + 60_000
-                while (!reachable && System.currentTimeMillis() < deadline) {
-                    reachable = testConnection(meshServer, timeoutMs = 15_000)
-                    if (!reachable) delay(3000)
-                }
-            }
+            val result = testConnection(server)
             isConnecting = false
 
-            if (reachable) {
+            if (result) {
                 prefs.setActiveServer(server)
                 onConnected(server.toUrl())
             } else {
@@ -219,14 +190,12 @@ fun ServerConnectScreen(
     }
 
     // Pairing QR scanned: dedupe against saved servers, then either auto-connect
-    // (payload carried a credential — demo password or a real node's device
-    // token) or land on the password prompt with everything else filled in.
-    // Mesh info (when present) is registered so the FIPS tunnel comes up too.
-    fun onQrScanned(scan: PairResult.Success) {
+    // (payload carried a password — the demo flow) or land on the password
+    // prompt with everything else filled in (real nodes never embed one).
+    fun onQrScanned(scanned: ServerEntry) {
         showScanner = false
         scope.launch {
-            val merged = prefs.upsertServer(scan.server)
-            FipsManager.registerNode(context, scan.fips, merged.displayName())
+            val merged = prefs.upsertServer(scanned)
             prefill(merged)
             if (merged.password.isNotBlank()) {
                 connect(merged)
@@ -611,14 +580,6 @@ fun ServerConnectScreen(
             onDismiss = { showScanner = false },
             onServerScanned = { onQrScanned(it) },
         )
-
-        // Full-screen branded loader while the first connect runs — most
-        // visibly right after a pairing-QR scan, when the mesh may still be
-        // establishing (LAN probe → tunnel up → ULA probe can take a while).
-        // The small inline spinner stays for context; this owns the screen.
-        if (isConnecting) {
-            MeshLoadingScreen()
-        }
     }
 }
 
@@ -686,10 +647,8 @@ private fun sanitizeAddress(input: String): String {
         .trimEnd('/')
 }
 
-/** Test RPC connectivity. Accepts self-signed certs for local LAN servers.
- *  [timeoutMs] is per-phase (connect / read) — mesh probes need far more
- *  patience than LAN ones (first session through the tree can take 15s+). */
-private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000): Boolean {
+/** Test RPC connectivity. Accepts self-signed certs for local LAN servers. */
+private suspend fun testConnection(server: ServerEntry): Boolean {
     return withContext(Dispatchers.IO) {
         try {
             val url = URL("${server.toUrl()}/rpc/v1")
@@ -709,8 +668,8 @@ private suspend fun testConnection(server: ServerEntry, timeoutMs: Int = 5000):
             }
 
             connection.requestMethod = "POST"
-            connection.connectTimeout = timeoutMs
-            connection.readTimeout = timeoutMs
+            connection.connectTimeout = 5000
+            connection.readTimeout = 5000
             connection.setRequestProperty("Content-Type", "application/json")
             connection.doOutput = true
             val body = """{"method":"server.echo","params":{"message":"ping"}}"""

Android/app/src/main/res/values/strings.xml

@@ -11,7 +11,6 @@
     <string name="welcome_title">Your Sovereign\nPersonal Server</string>
     <string name="welcome_subtitle">Bitcoin node, app platform, and private cloud — all in one box you control.</string>
     <string name="get_started">Get Started</string>
-    <string name="mesh_party">Mesh Party</string>
     <string name="use_https">Use HTTPS</string>
     <string name="port_label">Port (optional)</string>
     <string name="saved_servers">Saved Servers</string>
@@ -42,11 +41,4 @@
     <string name="edit_server_title">Edit Server</string>
     <string name="save_changes">Save Changes</string>
     <string name="cancel">Cancel</string>
-    <string name="gesture_hint_title">Hold with three fingers</string>
-    <string name="gesture_hint_body">Anywhere in the app — opens the remote control and menu</string>
-    <string name="gesture_hint_got_it">Got it</string>
-    <string name="scan_to_send">Scan to send</string>
-    <string name="scan_wallet_hint">Point the camera at a Lightning invoice, Bitcoin address, Cashu or Fedimint code</string>
-    <string name="upload_qr_image">Upload image</string>
-    <string name="no_qr_in_image">No QR code found in that image — try another, closer and well-lit</string>
 </resources>

Android/app/src/main/res/xml/file_paths.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- FileProvider scope for the party-screen "Share this app" APK handoff. -->
-<paths>
-    <cache-path name="share" path="share/" />
-</paths>

Android/rust/archy-fips-core/Cargo.toml

@@ -1,48 +0,0 @@
-# Embedded FIPS mesh node for the Archipelago companion app.
-#
-# Built for Android via cargo-ndk (see Android/app/build.gradle.kts, task
-# buildRustArm64) into app/src/main/jniLibs/arm64-v8a/libarchy_fips_core.so.
-# Also builds on the host so `cargo test` covers the non-JNI logic.
-#
-# `fips` is pinned to the fips-native fork rev that this integration was
-# developed against — the fork carries Android support upstream lacks
-# (Tun::from_fd for a VpnService-owned fd, cfg(target_os = "android") paths).
-# Override with a local checkout when hacking on fips itself:
-#   CARGO_NET_OFFLINE=false cargo ndk ... --config 'patch."https://github.com/9qeklajc/fips-native".fips.path="/path/to/fips-native/fips"'
-[package]
-name = "archy-fips-core"
-version = "0.1.0"
-edition = "2021"
-license = "MIT"
-publish = false
-
-[lib]
-name = "archy_fips_core"
-# rlib for host tests; cdylib for the Android shared library.
-crate-type = ["lib", "cdylib"]
-
-[dependencies]
-# default-features drops the ratatui TUI; tun-support enables Node::start_with_tun_fd.
-# Zazawowow/fips-native `fast-join-pinned` = upstream pinned rev 46494a74 +
-# discovery re-fire on topology change (fresh 5G join: first route no longer
-# waits out doomed pre-join lookups). Upstream 9qeklajc denies pushes.
-fips = { git = "https://github.com/Zazawowow/fips-native", rev = "07d21d4482be56b14295d2525e41f8386d1bfe6f", default-features = false, features = ["tun-support"] }
-anyhow = "1.0"
-serde_json = "1.0"
-hex = "0.4"
-# OS CSPRNG for identity generation (crypto rule: no thread-local RNG for keys).
-getrandom = "0.2"
-tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "macros"] }
-tracing = "0.1"
-# fcntl: force the VpnService TUN fd into blocking mode (see mesh::start).
-libc = "0.2"
-
-# The JNI surface only exists on Android; host builds skip it and drive the
-# mesh module directly (tests).
-[target.'cfg(target_os = "android")'.dependencies]
-jni = "0.21"
-# Bridge `tracing` (ours + fips) to logcat: `adb logcat -s archy-fips`.
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-paranoid-android = "0.2"
-
-[workspace]

Android/rust/archy-fips-core/src/jni_glue.rs

@@ -1,129 +0,0 @@
-//! JNI surface for `com.archipelago.app.fips.FipsNative` — JSON over strings,
-//! no codegen (the myco / nostr-vpn embedding pattern). Errors come back as
-//! `{"error": "…"}` so Kotlin never sees a raw exception from native code.
-
-use std::sync::Once;
-
-use jni::objects::{JClass, JString};
-use jni::sys::{jboolean, jint, jstring};
-use jni::JNIEnv;
-
-use crate::mesh;
-
-static LOG_INIT: Once = Once::new();
-
-fn init_logging() {
-    LOG_INIT.call_once(|| {
-        use tracing_subscriber::layer::SubscriberExt;
-        use tracing_subscriber::util::SubscriberInitExt;
-        let _ = tracing_subscriber::registry()
-            .with(tracing_subscriber::EnvFilter::new("info"))
-            .with(paranoid_android::layer("archy-fips"))
-            .try_init();
-    });
-}
-
-fn jstr(env: &mut JNIEnv, s: &JString) -> String {
-    env.get_string(s).map(|s| s.into()).unwrap_or_default()
-}
-
-fn out(env: &JNIEnv, s: String) -> jstring {
-    env.new_string(s)
-        .map(|s| s.into_raw())
-        .unwrap_or(std::ptr::null_mut())
-}
-
-fn err_json(e: impl std::fmt::Display) -> String {
-    serde_json::json!({ "error": e.to_string() }).to_string()
-}
-
-fn identity_json(info: &mesh::IdentityInfo) -> String {
-    serde_json::json!({
-        "secret": info.secret_hex,
-        "npub": info.npub,
-        "address": info.address,
-    })
-    .to_string()
-}
-
-/// Kotlin: `external fun generateIdentity(): String`
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_generateIdentity(
-    env: JNIEnv,
-    _class: JClass,
-) -> jstring {
-    init_logging();
-    let json = match mesh::generate_identity() {
-        Ok(info) => identity_json(&info),
-        Err(e) => err_json(e),
-    };
-    out(&env, json)
-}
-
-/// Kotlin: `external fun deriveIdentity(secret: String): String`
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_deriveIdentity(
-    mut env: JNIEnv,
-    _class: JClass,
-    secret: JString,
-) -> jstring {
-    init_logging();
-    let secret = jstr(&mut env, &secret);
-    let json = match mesh::derive_identity(&secret) {
-        Ok(info) => identity_json(&info),
-        Err(e) => err_json(e),
-    };
-    out(&env, json)
-}
-
-/// Kotlin: `external fun start(secret: String, peersJson: String, tunFd: Int, listenPort: Int): String`
-/// Returns `{"npub": "...", "address": "..."}` or `{"error": "..."}`.
-/// `listenPort` 0 = outbound-only; non-zero = fixed UDP bind (party mode).
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_start(
-    mut env: JNIEnv,
-    _class: JClass,
-    secret: JString,
-    peers_json: JString,
-    tun_fd: jint,
-    listen_port: jint,
-) -> jstring {
-    init_logging();
-    let secret = jstr(&mut env, &secret);
-    let peers = jstr(&mut env, &peers_json);
-    let listen_port = u16::try_from(listen_port).unwrap_or(0);
-    let json = match mesh::start(&secret, &peers, tun_fd, listen_port) {
-        Ok((npub, address)) => {
-            serde_json::json!({ "npub": npub, "address": address }).to_string()
-        }
-        Err(e) => err_json(e),
-    };
-    out(&env, json)
-}
-
-/// Kotlin: `external fun stop()`
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_stop(
-    _env: JNIEnv,
-    _class: JClass,
-) {
-    mesh::stop();
-}
-
-/// Kotlin: `external fun isRunning(): Boolean`
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_isRunning(
-    _env: JNIEnv,
-    _class: JClass,
-) -> jboolean {
-    mesh::is_running() as jboolean
-}
-
-/// Kotlin: `external fun statusJson(): String`
-#[no_mangle]
-pub extern "system" fn Java_com_archipelago_app_fips_FipsNative_statusJson(
-    env: JNIEnv,
-    _class: JClass,
-) -> jstring {
-    out(&env, mesh::status_json())
-}

Android/rust/archy-fips-core/src/lib.rs

@@ -1,17 +0,0 @@
-//! Embedded FIPS mesh node for the Archipelago companion app.
-//!
-//! The phone runs a real, leaf-only FIPS node in-process: Android's
-//! `VpnService` owns the TUN fd (routing only `fd00::/8`, so normal traffic
-//! never touches the tunnel) and hands it to [`fips::Node::start_with_tun_fd`].
-//! Peering is outbound-only — the pairing QR carries the node's npub and
-//! transport endpoints, and FIPS nodes accept inbound peers without prior
-//! registration, so no server-side enrollment step exists.
-//!
-//! The JNI surface (`jni_glue`, Android-only) is deliberately tiny and
-//! JSON-over-strings, mirroring the myco / nostr-vpn embedding pattern:
-//! `generateIdentity`, `deriveIdentity`, `start`, `stop`, `isRunning`.
-
-pub mod mesh;
-
-#[cfg(target_os = "android")]
-mod jni_glue;

Android/rust/archy-fips-core/src/mesh.rs

@@ -1,295 +0,0 @@
-//! Mesh lifecycle: identity, config assembly, and the node task.
-//!
-//! Host-buildable (no JNI) so the config/identity logic is unit-testable;
-//! only [`start`] needs a real TUN fd and therefore only runs on-device.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex};
-use std::time::Duration;
-
-use anyhow::{anyhow, Context, Result};
-use fips::config::{PeerConfig, TransportInstances, UdpConfig};
-use fips::{Config, Identity, Node};
-use tokio::sync::Notify;
-
-/// How long `start` waits for the node to come up (TUN attach + transports).
-const START_TIMEOUT: Duration = Duration::from_secs(15);
-
-/// How long `stop` waits for the node task to drain.
-const STOP_TIMEOUT: Duration = Duration::from_secs(5);
-
-struct MeshHandle {
-    runtime: tokio::runtime::Runtime,
-    task: Option<tokio::task::JoinHandle<()>>,
-    shutdown: Arc<Notify>,
-    running: Arc<AtomicBool>,
-    npub: String,
-    address: String,
-}
-
-static MESH: Mutex<Option<MeshHandle>> = Mutex::new(None);
-
-#[derive(Debug, Clone)]
-pub struct IdentityInfo {
-    pub secret_hex: String,
-    pub npub: String,
-    /// The phone's own ULA on the mesh (fd::/8), for VpnService.addAddress.
-    pub address: String,
-}
-
-/// Generate a fresh mesh identity from the OS CSPRNG.
-pub fn generate_identity() -> Result<IdentityInfo> {
-    // ~1 in 2^128 chance a candidate is off the curve; loop regardless.
-    loop {
-        let mut bytes = [0u8; 32];
-        getrandom::getrandom(&mut bytes).context("OS RNG")?;
-        if let Ok(id) = Identity::from_secret_bytes(&bytes) {
-            return Ok(IdentityInfo {
-                secret_hex: hex::encode(bytes),
-                npub: id.npub(),
-                address: id.address().to_ipv6().to_string(),
-            });
-        }
-    }
-}
-
-/// Re-derive npub + ULA from a stored secret.
-pub fn derive_identity(secret: &str) -> Result<IdentityInfo> {
-    let id = Identity::from_secret_str(secret).map_err(|e| anyhow!("bad secret: {e}"))?;
-    Ok(IdentityInfo {
-        secret_hex: secret.to_string(),
-        npub: id.npub(),
-        address: id.address().to_ipv6().to_string(),
-    })
-}
-
-/// Build the phone-side node config: leaf-only (never routes third-party
-/// traffic — battery), no DNS responder, TUN enabled but attached to the
-/// VpnService fd rather than created.
-///
-/// `listen_port` 0 = ephemeral UDP (outbound-only, the default posture).
-/// Non-zero = fixed UDP bind so a nearby phone can dial us directly over a
-/// local link (party mode); leaf_only still guarantees we never carry
-/// third-party transit even while accepting an inbound link.
-pub fn build_config(secret: &str, peers: Vec<PeerConfig>, listen_port: u16) -> Config {
-    let mut cfg = Config::default();
-    cfg.node.identity.nsec = Some(secret.to_string());
-    cfg.node.identity.persistent = false;
-    cfg.node.leaf_only = true;
-    cfg.tun.enabled = true;
-    cfg.tun.mtu = Some(1280);
-    cfg.dns.enabled = false;
-    cfg.transports.udp = TransportInstances::Single(UdpConfig {
-        bind_addr: Some(format!("0.0.0.0:{listen_port}")),
-        ..Default::default()
-    });
-    // TCP with no bind_addr = outbound-only (fallback when UDP is blocked).
-    cfg.transports.tcp = TransportInstances::Single(Default::default());
-    // Fast-connect profile — a phone opens the app and expects the node NOW.
-    // Stock pacing is tuned for always-on routers: a failed discovery backs
-    // off 30s, session resends gap out to 8-16s, dead links redial at
-    // 5s→300s. Over 5G that stacked into a ~40s first connect (observed
-    // 2026-07-24: anchor +10s, session +40s). Retries only fire while a
-    // link/session is down, so steady-state traffic is unchanged.
-    cfg.node.retry.base_interval_secs = 1; // dead-link redial 1s,2s,4s…
-    cfg.node.retry.max_backoff_secs = 30; // …capped at 30s, not 5 min
-    cfg.node.retry.max_retries = 30;
-    cfg.node.rate_limit.handshake_resend_interval_ms = 400;
-    cfg.node.rate_limit.handshake_resend_backoff = 1.5;
-    cfg.node.rate_limit.handshake_max_resends = 10;
-    cfg.node.discovery.backoff_base_secs = 1; // failed lookup retries fast
-    cfg.node.discovery.backoff_max_secs = 30;
-    cfg.node.discovery.retry_interval_secs = 2;
-    cfg.node.discovery.max_attempts = 3;
-    // Lookups launched before the tree position settles are doomed; a 10s
-    // completion timeout made each one cost 10s before the 1s retry could
-    // fire (observed: 19s to a route on a fresh join). Fail fast instead —
-    // the resend-within-window above still gives each attempt two shots.
-    cfg.node.discovery.timeout_secs = 5;
-    cfg.peers = peers;
-    cfg
-}
-
-/// Parse the peers JSON handed over from Kotlin. Shape = fips `PeerConfig`:
-/// `[{"npub":"…","alias":"…","addresses":[{"transport":"udp","addr":"host:2121","priority":10},…]}]`
-pub fn parse_peers(peers_json: &str) -> Result<Vec<PeerConfig>> {
-    serde_json::from_str(peers_json).context("peers JSON")
-}
-
-/// Start the mesh node on the given TUN fd (from `VpnService.establish()`,
-/// detached — the node owns it from here). Returns (npub, ula) on success.
-/// Any previously running node is stopped first.
-pub fn start(secret: &str, peers_json: &str, tun_fd: i32, listen_port: u16) -> Result<(String, String)> {
-    stop();
-
-    // Android hands the VpnService TUN fd over in non-blocking mode on some
-    // OS builds. The fips TUN reader is a dedicated blocking-read thread that
-    // treats EAGAIN as fatal — the loop died at startup ("TUN read error …
-    // Try again (os error 11)" on-device), so sessions came up but no packet
-    // ever entered the mesh. Force the fd into the blocking mode the reader
-    // is designed for.
-    unsafe {
-        let flags = libc::fcntl(tun_fd, libc::F_GETFL);
-        if flags >= 0 && (flags & libc::O_NONBLOCK) != 0 {
-            libc::fcntl(tun_fd, libc::F_SETFL, flags & !libc::O_NONBLOCK);
-        }
-    }
-
-    let peers = parse_peers(peers_json)?;
-    let config = build_config(secret, peers, listen_port);
-    let mut node = Node::new(config).map_err(|e| anyhow!("node init: {e}"))?;
-    let npub = node.npub();
-    let address = node.identity().address().to_ipv6().to_string();
-
-    let runtime = tokio::runtime::Builder::new_multi_thread()
-        .worker_threads(2)
-        .enable_all()
-        .thread_name("archy-fips")
-        .build()
-        .context("tokio runtime")?;
-
-    let shutdown = Arc::new(Notify::new());
-    let running = Arc::new(AtomicBool::new(false));
-    let (started_tx, started_rx) = tokio::sync::oneshot::channel::<Result<()>>();
-
-    let task = {
-        let shutdown = shutdown.clone();
-        let running = running.clone();
-        runtime.spawn(async move {
-            match node.start_with_tun_fd(tun_fd).await {
-                Ok(()) => {
-                    running.store(true, Ordering::SeqCst);
-                    let _ = started_tx.send(Ok(()));
-                }
-                Err(e) => {
-                    let _ = started_tx.send(Err(anyhow!("node start: {e}")));
-                    return;
-                }
-            }
-            tokio::select! {
-                result = node.run_rx_loop() => {
-                    if let Err(e) = result {
-                        tracing::error!("mesh rx loop error: {e}");
-                    }
-                }
-                _ = shutdown.notified() => {}
-            }
-            if let Err(e) = node.stop().await {
-                tracing::warn!("mesh stop: {e}");
-            }
-            running.store(false, Ordering::SeqCst);
-        })
-    };
-
-    let started = runtime
-        .block_on(async { tokio::time::timeout(START_TIMEOUT, started_rx).await })
-        .map_err(|_| anyhow!("node start timed out"))?
-        .map_err(|_| anyhow!("node task died during start"))?;
-    if let Err(e) = started {
-        runtime.shutdown_background();
-        return Err(e);
-    }
-
-    *MESH.lock().unwrap() = Some(MeshHandle {
-        runtime,
-        task: Some(task),
-        shutdown,
-        running,
-        npub: npub.clone(),
-        address: address.clone(),
-    });
-    Ok((npub, address))
-}
-
-/// Stop the mesh node if running. Idempotent.
-pub fn stop() {
-    let Some(mut handle) = MESH.lock().unwrap().take() else {
-        return;
-    };
-    handle.shutdown.notify_waiters();
-    if let Some(task) = handle.task.take() {
-        let _ = handle
-            .runtime
-            .block_on(async { tokio::time::timeout(STOP_TIMEOUT, task).await });
-    }
-    handle.runtime.shutdown_background();
-}
-
-pub fn is_running() -> bool {
-    MESH.lock()
-        .unwrap()
-        .as_ref()
-        .map(|h| h.running.load(Ordering::SeqCst))
-        .unwrap_or(false)
-}
-
-/// `{running, npub, address}` for the Kotlin status surface.
-pub fn status_json() -> String {
-    let guard = MESH.lock().unwrap();
-    match guard.as_ref() {
-        Some(h) => serde_json::json!({
-            "running": h.running.load(Ordering::SeqCst),
-            "npub": h.npub,
-            "address": h.address,
-        })
-        .to_string(),
-        None => serde_json::json!({ "running": false }).to_string(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn identity_roundtrip() {
-        let a = generate_identity().unwrap();
-        let b = derive_identity(&a.secret_hex).unwrap();
-        assert_eq!(a.npub, b.npub);
-        assert_eq!(a.address, b.address);
-        // ULA in fd::/8
-        assert!(a.address.starts_with("fd"));
-    }
-
-    #[test]
-    fn peers_json_parses_into_peer_config() {
-        let peers = parse_peers(
-            r#"[{
-                "npub": "npub1abc",
-                "alias": "My Archipelago",
-                "addresses": [
-                    {"transport": "udp", "addr": "192.0.2.10:2121", "priority": 10},
-                    {"transport": "tcp", "addr": "192.0.2.10:8443", "priority": 20}
-                ]
-            }]"#,
-        )
-        .unwrap();
-        assert_eq!(peers.len(), 1);
-        assert_eq!(peers[0].addresses.len(), 2);
-        assert!(peers[0].is_auto_connect());
-    }
-
-    #[test]
-    fn config_is_leaf_only_with_tun() {
-        let id = generate_identity().unwrap();
-        let cfg = build_config(&id.secret_hex, vec![], 0);
-        assert!(cfg.node.leaf_only);
-        assert!(cfg.tun.enabled);
-        assert_eq!(cfg.tun.mtu(), 1280);
-        assert!(!cfg.dns.enabled);
-        assert!(!cfg.transports.udp.is_empty());
-        assert!(!cfg.transports.tcp.is_empty());
-    }
-
-    #[test]
-    fn listen_port_sets_fixed_udp_bind() {
-        let id = generate_identity().unwrap();
-        let cfg = build_config(&id.secret_hex, vec![], 2121);
-        // Party mode keeps leaf_only — accepting a link is not routing transit.
-        assert!(cfg.node.leaf_only);
-        let TransportInstances::Single(udp) = &cfg.transports.udp else {
-            panic!("expected single UDP transport");
-        };
-        assert_eq!(udp.bind_addr.as_deref(), Some("0.0.0.0:2121"));
-    }
-}

CHANGELOG.md

@@ -1,273 +1,5 @@
 # Changelog
 
-## Unreleased
-
-- **You can now replace your Lightning connection keys from Settings, without touching a terminal.** The tokens wallet apps like Zeus use to reach your node are bearer keys: anything that has ever seen one can spend from your node until they are replaced, and there is no way to cancel one individually. Replacing them was previously a script you had to SSH in and run, which in practice meant it never happened. Settings → Lightning credentials now shows when yours were issued, which node they belong to and how many channels must survive, then does the whole job behind your node password — with a step-by-step progress list, and a refusal to call it a success unless it has confirmed your node identity and every channel came back. Your coins and channels are not touched: nothing is closed, and the wallet is never re-created. Afterwards you re-pair Zeus by scanning the Lightning app's QR code again.
-- **Replacing those keys no longer silently breaks BTCPay Server.** BTCPay holds its own copy of the key, and that copy cannot repair itself — so a node that replaced its keys ended up with BTCPay running, healthy, and unable to take a single Lightning payment, with nothing anywhere saying why. The dashboard now updates BTCPay's copy as part of the run and restarts it around its existing data, and the Settings screen warns you if it finds a node already stuck in that state. The command-line script fixes the same gap.
-- **Lightning stops getting stuck locked on a busy node.** Lightning opens its databases before it will accept the password that unlocks the wallet, and on a loaded node that took nearly three minutes — longer than the node was willing to wait. Giving up restarted Lightning, which started the slow open again, so the wallet stayed locked forever and everything depending on it stayed broken. The node now waits as long as it takes. A genuinely wrong password still fails immediately.
-
-## v1.7.126-alpha (2026-08-07)
-
-- **The most important fix in this release: the update button could take you backwards onto a version withdrawn for a security hole.** BTCPay Server published 2.4.2 to close a flaw that was being actively exploited — a way past two-factor authentication. Nodes that had already moved to 2.4.2 were then shown an "Update" button offering 2.3.9, the very release being withdrawn, and taking it would have rolled the node back onto the vulnerable version. The cause was that the node only asked whether the two version numbers differed, never which was newer, so any stale record anywhere could present a rollback as an upgrade. It now refuses to offer a lower version as an update, so a stale record fails safe instead of becoming a trap. BTCPay itself is on 2.4.2, and every place that still named the old version — including the fallback installer, which would have installed it outright — has been corrected.
-- **An app now reports its own version, not a helper's.** Where an app is made of several parts, the node could read the version of the wrong part: BTCPay showed as "15.17", which is the version of its database, while offering an update to 2.4.2. That is the number update decisions are made from, so a nonsensical pair was being presented as a legitimate upgrade. When the node cannot identify an app's own container it now says so rather than guessing at a neighbour.
-- **Your node issues its own certificate, so apps stop being flagged as insecure.** Each node now has its own certificate authority, with a one-step install from Settings, and app screens are served over the same secure connection as the dashboard rather than dropping back to an unprotected one. Apps answer on both the secure and plain address on the same port, so nothing that worked before stops working.
-- **An app that is still starting says "starting".** It previously reported "App not reachable", which reads as a failure when the app is simply warming up.
-- **Updates and app downloads now come from a proper domain name.** They previously used a bare numeric address over an unprotected connection. Downloads are now encrypted in transit, and the old address is kept as an automatic fallback for nodes whose clock or name lookup is off — the signature, not the address, is what makes either source safe.
-- Also in this release: the tool app developers run to check their app description no longer rejects every valid file (it needed a program most machines do not have, and reported the missing program as a broken file); and the node's own security audit, which had been reporting all-clear, now actually inspects the files where credentials had been sitting.
-- Housekeeping, disclosed rather than buried: this release removes Archipelago's own infrastructure details from the published source — machine names, addresses and internal working notes — ahead of the code being opened to the public. No behaviour changes for your node.
-- Known gaps, unchanged from the last release: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
-
-## v1.7.125-alpha (2026-08-06)
-
-- **The Lightning, Bitcoin, Electrum and mesh screens work again behind the login gate.** Since the gate went up, those screens loaded their frame and then showed every number as unreachable. The gate was deliberately hiding your login from the apps it protects — right for third-party apps, wrong for the node's own screens, which need that login to fetch your data. The gate now removes only its own credential, and the node's own screens explicitly receive yours. The same mistake was also quietly signing you out of apps with their own logins — Vaultwarden, Nextcloud, Gitea — on every single request; that stops too.
-- **IndeeHub heals itself.** Three separate faults fixed: its database helper was recreated with permissions too tight to read its own files (it had crashed and restarted roughly ten thousand times on one node); on another node two of its seven parts could never be recreated at all because of how the node asked for their storage — it would remove the old part and then fail to build its replacement, leaving the app half-missing forever; and a regenerated password could lock the app out of a database that keeps the original. The storage fault fixes the same trap for every future multi-part app.
-- **A missing piece of a running app now gets put back automatically.** If one container of a multi-part app disappears while its siblings are still running, the node treats that as a hole to repair rather than a choice to respect, and rebuilds the missing piece. An app you actually uninstalled stays uninstalled.
-- **Send and Receive open clean every time.** Whatever you typed last — an address, an amount, and above all an armed "send all funds" toggle — no longer quietly carries over into the next payment. Choosing "send all funds" also shows the amount being swept instead of a confusing 0.
-- **A sweep that cannot happen now says why.** Trying to sweep a balance that is below Bitcoin's dust minimum (about 546 sats) or not yet confirmed used to fail with "check server logs"; it now explains that no transaction can be built from those coins.
-- **The camera scanner option no longer vanishes on desktop.** Browsers only allow the live camera on secure (HTTPS) pages, and the scan window silently hid the camera choice on plain connections — which read as "the scanner is gone". The option now stays visible and explains itself, and the photo and paste routes always work. The companion app's built-in scanner is untouched.
-- **App data folders can no longer be "repaired" into a state the app cannot use.** When the node fixed a folder's ownership through its fallback path, it wrote the container's raw user number instead of the translated one, so the fix reported success while the app still could not open its own files — one node's BotFights restarted every ten seconds over exactly this. The translation is now applied.
-- Also: the app login page uses the Archipelago mark and stays centred on phones with the keyboard open, app icons in the install window are no longer cropped, and when the node fails to build a container it now records the actual reason instead of a one-line stub that hid the cause of the IndeeHub fault for days.
-- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
-
-## v1.7.124-alpha (2026-08-05)
-
-- **The most important fix in this release: some nodes were left switched off by their own update, and could not switch themselves back on.** The node replaces its program and then exits, expecting the system to start it again — but nodes installed from older images carried a setting that only restarts the program if it *crashes*. A clean, deliberate exit looked like success, so nothing restarted it, and the node sat dead showing "server starting" with nothing able to start it. One of ours was down for over two hours this way, and three of four checked had the same setting waiting to bite. Your node now repairs that setting itself the first time it starts, so it survives every future update.
-- **Portainer opens again.** Its screen reported the app as not responding because the app was quietly refusing to start: nodes have been running Portainer 2.39.1, their stored data was written by that version, and the app list pinned a version from two years earlier — so when the container was rebuilt it landed on the old one, which will not read newer data. The correct version is now pinned, older installs upgrade cleanly, and no data was touched.
-- **Bitcoin starts reliably again.** A leftover settings file in the Bitcoin folder — one the node itself kept rewriting and Bitcoin no longer reads — is treated as fatal by Bitcoin, so affected nodes restarted every few seconds forever. The node no longer writes that file, removes stale copies, and treats any that remain as harmless.
-- **Every app screen opens from My Apps again.** The login gate refused to be displayed inside another page at all, which is exactly how My Apps opens an app, so protected apps appeared broken. It now allows only your own node to display it, and refuses everyone else — a distinction the old setting could not express.
-- **The app login screen now looks like the node's own.** Same rotating artwork, the same panel, the Archipelago mark, and the app's real icon shown as a tile the way My Apps shows it, instead of a plain box with a letter.
-- **The Mesh screen uses wide displays properly.** On very large screens it stacked all five panels on top of each other, clipping three of the headings to a sliver and squeezing the map into a letterbox — more screen producing a worse view. It now shows one panel at a time, filling the space, with the map running edge to edge.
-- **You can choose how long you stay signed in.** Settings → Account now offers an inactivity timeout and a hard limit, plus an option to re-enter your password before sending funds. TV and kiosk screens are never signed out for sitting idle, because there is nobody there to sign them back in.
-- Updates now come from `source.archipelago-foundation.org` rather than a bare address, with the old one kept as an automatic fallback for nodes whose clock or name lookup is off. Also included: clearer wallet errors from ecash mints, and mesh peers reconnecting via their last known address before falling back to the wider network.
-- Known gaps, disclosed rather than buried: three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
-
-## v1.7.123-alpha (2026-08-05)
-
-- **Five more screens on your node were readable by anyone who could reach it, and the previous release's own check said they were fine.** The Bitcoin, Lightning, Electrum, FIPS mesh and Fedimint Guardian screens each answered on their port with no login. They were missed because they work differently from ordinary apps: they run directly on the node's network rather than behind its container plumbing, so there was no address to pin and their descriptions listed no port at all — and the node builds its list of what to protect from exactly those descriptions. It therefore neither protected them nor listed them as unprotected. A check that reports success while five screens are open is worse than no check, and this was found by scanning the node from another machine rather than asking the node about itself.
-- **What was actually readable was the page, not your money.** Every request on those ports that could have returned a credential — the Lightning connection details, the wallet passthrough, container logs, and every node command — already required a login and still refused without one. The Lightning macaroon fix from v1.7.120 was verified directly rather than assumed. What leaked was the screen itself: layout and code, no wallet data, no keys.
-- All five now serve only to the node itself, with the login gate in front of them, exactly like the twenty app screens closed in the previous release.
-- **Every port on the node now has a stated policy — there are no undecided ones left.** Eleven ports previously had no instruction either way and stayed open by default. The BotFights arena, the router screen and the Pine voice screen now require the node password. The ones that genuinely cannot take a login page stay open with a written reason: Fedimint's guardian and gateway connections (federation members authenticate to the federation), NetBird's management and dashboard ports (your VPN devices carry their own credentials and cannot hold a browser session, and its dashboard needs its own certificate), Pine's secure listener, and the Lightning REST port, which wallets reach with a macaroon exactly as before.
-- Fresh installs are covered too, not just existing nodes. The five screens are delivered as prebuilt images, so a newly flashed node would have come up open even after this fix. All five were rebuilt, published, and then pulled back and inspected to confirm the fix is really inside them.
-- Two delivery faults fixed alongside, either of which would have silently undone the above: two of the five screens were reaching nodes through no update path at all, so edits to them never arrived; and a fourth copy of the Bitcoin screen's configuration was being rewritten on every health check, which would have re-opened that port after everything else was corrected.
-- Known gaps, disclosed rather than buried: non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. Three voice-assistant ports remain open without authentication; the correct fix puts them on a private network with the assistant. The 5x real-node lifecycle gate was not run for this release.
-
-## v1.7.122-alpha (2026-08-04)
-
-- **Your apps now ask for your node password before they open — over your home network, Tailscale, the mesh and Tor alike.** Until now anyone who could reach your node could open Immich, Nextcloud, Vaultwarden, Jellyfin, Grafana and the rest simply by typing the address and port, with no login at all. Twenty app screens now sit behind the same login you use for the node, showing you which app you are opening, and honouring two-factor if you have it switched on. Logging in at an app address logs you into the dashboard too, so it is one password, not one per app. This completes the groundwork disclosed in v1.7.121.
-- **The things that must stay open stayed open.** Zeus and other remote wallets still reach your Lightning node directly, Electrum wallets still connect, and Bitcoin still talks to its peers — those connections carry their own proof of identity and a login page would simply break them. Every one of these seventeen exceptions now has to state in writing why it is safe to leave open, so the list is something you can read rather than something you have to discover.
-- **A private address on your node was answering the mesh without a password.** One app's port was marked as being for this machine only, and the part of the node that carries mesh traffic did not know that — it forwarded requests from the whole mesh straight to it. Found while verifying the work above on a real node, not in testing. That path now refuses anything marked machine-only, and the app is reachable only from the node itself, as intended.
-- **Tor addresses no longer skip the login.** An app published as a .onion address was handed straight to the app, because a Tor visitor carries no session cookie to check. The login gate now takes those addresses first, closing the last of the four routes that went around it.
-- Nodes fix themselves after this update. Apps installed before this system used its current container setup kept their old wide-open address even after the signed list told them to move, and each would otherwise have needed hand-holding on every node. Your node now notices the difference and rebuilds those apps itself, keeping their data, within about half a minute of starting. Verified by putting a node back into the old state deliberately and watching it repair.
-- The node had been reading two different sets of instructions about its own apps — the signed list it downloads, and older copies on disk — which is how a port meant to stay private was briefly opened on a test node. Both now come from the signed list, and a port withdrawn from the login gate is released without needing a restart.
-- **The key that signs these updates has been replaced.** The previous signing key was exposed where it should not have been, so it is treated as compromised and this release installs its replacement. This update is the last one signed with the old key, by necessity — it is the one that teaches your node the new one.
-- Known gaps, disclosed rather than buried: eleven app ports still have no stated policy — BotFights, the Fedimint gateway, NetBird, the voice assistant's own screens and the router screen — and remain reachable without a login until each is decided deliberately; the node reports them rather than guessing, because guessing at an unstated setting caused both incidents behind this work. Three voice-assistant ports are still open without authentication; the correct fix puts them on a private network with the assistant. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — will now meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release.
-
-## v1.7.121-alpha (2026-08-04)
-
-- **Making another node "Trusted" now asks for your node password.** Trust was being handed out by machines rather than by you: any node able to reach yours could join and mark itself Trusted, because the check proved only that the caller owned the key it had just presented — never that you had approved it. Trust also spread on its own, since every peer a Trusted node advertised was added as Trusted too, so one grant quietly propagated across the whole federation. Uninvited joins are now capped at Observer, advertised peers arrive as Observers, and raising anyone to Trusted — whether by generating an invite or by changing the dropdown on a node — requires your password. Lowering trust deliberately does not, because the safe action must never be the inconvenient one. Existing peers are left exactly as they are rather than silently demoted, and each one now records how its trust was granted so you can review them.
-- **Nodes you have peered with can be messaged straight away.** Peering was not enough: you also had to be within LoRa radio range of the other node once before chat would work. The node picked how to send a message based on which radio was plugged in, and only one of those paths knew how to reach a peer over the mesh's internet transports — so on a node with a different radio, or no radio at all, messaging a peer you had just federated with simply failed until a radio contact happened to appear. Peered nodes are reachable without radio by definition, so that choice no longer depends on the hardware. Radio is still preferred when the other node is actually in range and the message fits.
-- The dashboard no longer flickers a vertical line across its cards. A rendering seam appeared at random while moving the mouse, because the two large cards used a background-blur effect that this system already disables everywhere else on the dashboard — that browser mis-draws it inside the dashboard's animated container, and these two cards had been missed when the workaround was written. Diagnosed from a single screenshot rather than by trying to reproduce it.
-- The Lightning screen will actually update from now on. Its image was set to "latest", and the container system will not re-fetch a label it already holds, so nodes kept the same Lightning screen forever no matter how many updates shipped. A separate copy of the same setting used only by brand-new installs also described the screen incorrectly, so fresh installs got a screen that never answered.
-- Apps that provide their own screens stop rebuilding themselves in a loop. On this system's own node one of them rebuilt every thirty-five seconds indefinitely, burning processor time and restarting the app each round. The node decided a rebuild was needed by comparing file dates against the image's creation date, but a rebuild that changes nothing reuses the existing image and leaves that date untouched — so the condition that triggered the rebuild was still true afterwards, forever. Nodes taking this update repair themselves the first time they check.
-- Groundwork you can see but that does not change access yet: the node can now tell you which of its app ports answer without a login, and every port that is deliberately open — Bitcoin's peer connections for syncing the chain, Lightning's wallet connections, the Electrum wallet protocol — now has to state in writing why it is safe, so the list of exceptions is something you can read rather than something you have to discover. The login gate that will sit in front of the rest is built and proven working end to end on a real node, but it is not yet closing any ports; that arrives with the signed app catalog that tells each app to hand its address over.
-- Releases can no longer ship an unsigned update file. Signing was skippable, and when it was skipped the release was still committed and tagged — producing an update that every node correctly refuses to install. It had been caught by hand every cycle; now the release simply stops.
-- Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. App ports other than the deliberate exceptions above are still reachable without a login — the gate reports them, and closing them needs the next signed catalog. Three voice-assistant ports are open without authentication and should not be; the correct fix puts them on a private network with the assistant instead, which needs testing on a node that runs both. Two nodes on the fleet still share SSH host keys (detection shipped, rotation remains a deliberate operator decision).
-
-## v1.7.120-alpha (2026-08-02)
-
-- **Security, and the reason to take this update: two ports on your node handed anyone who could reach them complete control of your money, with no password.** The Lightning app's port answered a plain web request with the LND admin macaroon, the TLS certificate and the node's onion address — everything needed to drain the wallet remotely, and the onion meant an attacker kept that ability even after losing access to your network. The Bitcoin app's port reached Bitcoin Core's control interface using credentials the node itself supplied on the caller's behalf, with a wallet loaded. Anything on your home network, your Tailscale network or the mesh could use either one. Both now require you to be logged in. If your node has been reachable by anyone you do not fully trust, treat the Lightning macaroon and the Bitcoin RPC password as known to them.
-- The Bitcoin and Lightning app screens can no longer be published as public Tor addresses automatically. They were one app-id away from being handed a worldwide, permanent address as a silent side effect of being installed — which would have re-opened the hole above to the entire internet. Turning Tor on for them deliberately still works; it just never happens on its own.
-- **Fixes shipped inside the program now actually reach apps that your system keeps running.** A container the node had been told to uninstall, but that the system service manager kept alive anyway, was quietly skipped by the part of the node that applies configuration — so it never received updates that shipped with the program. This was found the hard way: the Bitcoin control-interface fix above appeared to be installed and silently was not, while the Lightning half applied correctly, which is the most misleading way for a security fix to fail. Both halves are now proven to land on a real node.
-- The Lightning and Bitcoin node screens have been rebuilt to match what umbrelOS offers. Lightning gains Overview, Channels, Activity, Insights, Connect and Settings tabs with a sats/BTC switch; Bitcoin gains Insights, Peers, Connect and Sharing. Along the way: every copy button on those screens silently did nothing (the browser blocks clipboard access inside an embedded page) and now works; the channels link led to a dead page; and Node ID showed a bare key instead of the full address someone can actually connect to.
-- Updates to the Bitcoin screen show up without a hard refresh. The page was being cached by the browser, so a freshly updated screen kept rendering the previous one.
-- The AI sidebar loads again. It was asking for its program files at an address that pointed at the main app's files, where they do not exist, so it silently loaded nothing.
-- The navigation above the bottom bar no longer follows you between screens. Back buttons and the mesh tab bar stayed pinned over every other page once you had visited the screen that owns them. Keeping tabs loaded in the background — the change that made switching between them instant — means leaving a screen hides it rather than destroying it, and this floating navigation sits outside the screen it belongs to, so it was never being hidden with it. It is now tied to whether its own screen is on display. The speed is unchanged: the screens are still kept loaded, so returning to one is still instant.
-- Wallet: Lightning actions are now offered based on whether you actually have a usable channel rather than just a running node, sending is gated the same way, and an invoice you cannot yet receive offers to install a Lightning node instead of simply failing.
-- Onboarding and viewing fixes: the "I have written down my recovery words" tickbox is findable on short screens, paid pictures and videos open in the app's own viewer with a visible loading state instead of a blank browser tab, picture-in-picture survives changing tabs, and the FIPS/Tor labels on peer cards stay put instead of wrapping into the card below.
-- Key-material hardening across the node: a node that is already set up refuses to have its identity replaced by an unauthenticated request; first-boot secret generation now fails loudly instead of silently continuing with shared keys; the node proves its TLS certificate and key are actually a matching pair; the Bitcoin Core wallet path that kept a second copy of your spending key outside the encrypted store has been removed; and every place the node generates a key, token or nonce now names its source of randomness explicitly, enforced at build time.
-- Federation and mesh: a rotated gateway credential now reaches the already-running container instead of leaving the old one in place, sync failures are surfaced to you instead of being swallowed, and nodes can share their Lightning connection details with a chosen peer over the mesh — the groundwork for opening channels with nodes you already talk to.
-- Known gaps, disclosed rather than buried: the 5x real-node lifecycle gate was not run for this release. Two nodes on the fleet still share SSH host keys with each other (detection shipped, rotation is a deliberate operator decision and has not been performed). Bitcoin Core can now reach Tor from its container, but is not yet routed through it — the network mode is becoming a setting you choose, and until then Core's peers remain on the clear internet.
-
-## v1.7.119-alpha (2026-07-31)
-
-- Wallet payments now work on nodes whose channels are private/unannounced. Every invoice-creation call site — the wallet's own Receive flow, and the seller-side paid-content/peer-files flow — only ever sent LND the amount and memo, so LND defaulted private to false and returned invoices with no route hints. Any node whose only usable channel is private or unannounced (the common shape for a channel someone opened to you) was silently unpayable through the wallet, and unpayable through paid file/content sales too. Both call sites now set LND's private flag correctly; this was broken in the field and is the main reason for this release.
-- Tor and the mesh's Tor fallback are reliable again. The node's background "doctor" health-checker was fighting Tor over the permission bits on its own hidden-service directory: it compared the directory's mode against the literal string "700", but Tor's own setgid hidden-service mode is 2700 — a value the doctor's check never recognized as correct. Every ~5 minutes it "corrected" the mode back to 700 and restarted Tor to apply it, and Tor immediately reasserted 2700 — a permanent restart loop that meant Tor could never hold onto its consensus/HSDir cache long enough to be useful, breaking the mesh's Tor fallback path entirely. The check now compares only the owner/group/other bits that actually matter (both 700 and 2700 pass; genuinely wrong modes like 750 or 2755 are still corrected and restart Tor), plus a 30-minute restart backoff so no future condition can reproduce the storm.
-- Wallet balances and your node's own FIPS identity key (npub) are no longer written to the browser's sessionStorage — caught by an audit of the page-caching work below. Every cache call site in the app now makes an explicit, reviewed decision about whether its data is allowed to persist across a reload, and a one-time migration purges any legacy, unaudited snapshot left behind by an older build.
-- Server, Home, Mesh, Chat/AI chat, and the secondary screens (app details, marketplace, cloud, federation, monitoring, router/OpenWrt) now load instantly from cache when you revisit them and refresh quietly in the background, instead of blanking and re-fetching everything on every tab switch — this closes out the page-performance work started back in v1.7.116/117.
-- App updates (including this one) now apply automatically in the background instead of waiting on a tap-to-update prompt, matching how kiosk/TV installs already behaved — the reload still waits for any in-progress splash/dashboard animation to finish first, so it won't land mid-motion. This was a direct, explicit decision made with the mid-payment-reload risk spelled out in advance; reverting to a confirmation prompt for beta is a one-line change if wanted later.
-- Known gap, disclosed rather than buried: the project's 5x production lifecycle gate (install/UI/stop/start/restart/reinstall/reboot-survive/archipelago-restart-survive/uninstall, run on a real node — CLAUDE.md's own definition of done before a release tag) was NOT run for this release, because its target node was unreachable and running it here would have required rebooting a shared, live build machine out from under other active work. This release's own automated gates (release-gate harness, strict catalog-drift check, the full cargo test suite, a mount-level ISO smoke test, and a headless QEMU boot test) all still ran and passed — this is specifically about the separate 5x real-node lifecycle gate, which is still outstanding and should be run as soon as the node is reachable again.
-
-## v1.7.118-alpha (2026-07-29)
-
-- Fixes mesh radios dropping off on nodes that took the v1.7.117 update. Updates only ever replaced the main program, never the packaged radio helpers — so updated nodes were left running an older radio daemon that didn't understand a new option and quietly gave up, showing "device not connected" with a Connect button that did nothing. The node now checks what its radio daemon supports before using new options, and updates finally carry the radio helpers themselves, so every node gets current radio support with the update instead of only from a fresh install.
-- The in-app "Flash LoRa" flow works on updated nodes. The RNode flashing tool was only ever included on freshly installed nodes; everywhere else flashing failed with a cryptic "No such file or directory". The tool now ships with updates and is included on new install images, and if it's somehow still missing the error says exactly what to do instead.
-- Message notification badges finally remember what you've read. Unread counts were only kept in memory, so every visit re-counted old messages as new — including a phantom badge for chats with nothing new in them. Read-state is now saved on the device, opening a chat marks all its linked conversations read, and history no longer re-badges after a reload.
-- Every mesh message now has a visible "⋯" button that opens the route view: watch the path your message took animate — sender and receiver appear, a pulse travels the link, and each relay hop lights up in order — with signal quality for radio links and delivery status. (Tapping the transport pill still works too.)
-
-## v1.7.117-alpha (2026-07-29)
-
-- Flash your LoRa radio from inside the app. The Mesh page now has a "Flash LoRa" button that opens a guided flow: pick the firmware family (MeshCore, Meshtastic, or Reticulum RNode) and your board, and the node downloads the latest release and flashes it with live progress — no external flasher website, no cables to a computer. The same flow appears when a freshly plugged-in radio is detected, and a long list of flashing pitfalls was fixed along the way: radios no longer boot-loop after a flash, failures show the real error instead of silently bouncing back, wedged flash jobs can't get stuck forever, and board auto-detection no longer misidentifies Heltec boards.
-- Every Archipelago node now acts as a Reticulum relay. Nodes forward mesh traffic and re-broadcast peer announcements, so two radios that can't hear each other directly can still discover and message each other through any Archipelago node in between — your nodes become infrastructure for the whole neighbourhood mesh, including non-Archipelago apps like Sideband.
-- Reticulum (RNode) radios are now first-class mesh citizens. Radios are reliably detected on node startup (a boot-timing race used to leave them unclaimed), settings changes apply live without a restart, your node's name propagates over the Reticulum network so other apps like Sideband see it properly, and a crashed Reticulum daemon is detected and restarted automatically. Photo and file attachments sent over Reticulum now actually arrive — four separate delivery bugs were found and fixed, verified end-to-end over real radio hardware.
-- Messages to contacts that exist on both the internet mesh and a LoRa radio now prefer the radio when it's live, and attachments follow the same path — so co-located nodes talk over the air even when the internet path exists.
-- Mesh chat polish: each message in the image viewer shows which transport carried it, a new hop-route view shows the path a message took, reactions moved into a tidy dropdown, and read-tracking now reflects what you've actually seen. The Refresh and Broadcast buttons give real feedback, and the radio-setup modal shows honest probe progress instead of freezing.
-- The wallet transactions list works properly on phones now: it scrolls (it silently couldn't on touch screens before), and the All / On-chain / Lightning / Ecash filter tabs stay pinned at the top with a subtle blur while the list scrolls underneath.
-- Backend services no longer masquerade as launchable apps. Anything without a real web interface — databases, APIs, background workers, including stacks you deploy by hand for testing — now files under Services with no Launch button. Apps declare their interface in their manifest; for everything else the node checks the port itself to see whether a browser page actually lives there.
-- Lightning payments that take a while (slow multi-hop routes) are no longer reported as failed while they're still in flight. The wallet now waits properly, shows an honest "pending" state, and reports the true final outcome.
-- Server pages feel instant: Server, Federation, Lightning channels, Monitoring, wallet, Cloud, and Credentials screens now render immediately from a shared cache and refresh live in the background (including push updates over the node's websocket), instead of blanking while every panel refetches.
-- The node stays responsive under heavy load: the connection handler now sheds excess load instead of stalling everything behind it, and companion-app probes no longer trigger container builds during routine checks.
-- FIPS mesh uptime hardening continues: the node's peer port is opened explicitly everywhere, LAN anchors use the right port, direct peering between co-located nodes works again, dials fail fast instead of hanging, and a connectivity watcher re-applies anchors immediately when the network comes back.
-- FIPS startup is more reliable on nodes that have the packaged `fips.service` instead of Archipelago's `archipelago-fips.service`. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.
-- App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.
-- Companion app 0.5.25: a redesigned settings hub (three-finger tap opens it over the dashboard), seamless transport handoff with FIPS mesh settings, the wallet scanner reads dense invoice QR codes, app webviews clear the phone status bar with an HTTPS toggle on add/edit, and off-LAN loads fall back to the mesh URL instead of a dead LAN address.
-- Public-source preparation now includes a Nostr Git hosting plan using `ngit`, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.
-
-## v1.7.116-alpha (2026-07-27)
-
-- Nodes no longer get stuck on "server starting up" after an update or reboot. On a node running many apps, the backend used to spend minutes recovering containers before it told the system it was ready, and anything that touched it during that window could leave it down for good. It now reports ready immediately and recovers in the background, and it always restarts itself if it ever does go down.
-- Installing apps no longer crashes the node. A change that made app screens reachable over the mesh was accidentally holding onto every app's network port in advance — so installing an app like Grafana, Photoprism, Uptime Kuma, or Jellyfin collided with it and the port-cleanup step took the whole backend down, rolling the install back. Installs are now clean and the backend can never be caught by that cleanup.
-- Rolls up everything from v1.7.115: app screens and the dashboard load over the mesh out of the box (firewall openings shipped automatically, IPv6 support end to end), and nodes rejoin the mesh in seconds after their rendezvous point restarts.
-
-## v1.7.115-alpha (2026-07-26)
-
-- The companion app can reach your node's screen from anywhere again. The recent security hardening locked down the node's mesh interface so tightly that the dashboard itself was blocked — the phone would pair and connect, then sit on a blank screen. The node now explicitly opens its own web interface (and only that) through the mesh firewall on every install and upgrade, so the phone's view of your node works out of the box, on any network, and can't silently break in a future update.
-- The node's web interface also answers on IPv6 everywhere it answers on IPv4 — the mesh runs entirely on IPv6, and one v4-only listener was enough to make a working connection show nothing.
-- Nodes now come back onto the mesh in seconds instead of minutes after their rendezvous anchor restarts: the fast-reconnect tuning proven on the phone this week is now baked into every node's mesh configuration, and it survives upgrades.
-
-## v1.7.114-alpha (2026-07-26)
-
-- Plugging in a mesh radio no longer traps it in an endless reboot loop. The device detector itself was causing it: every scan pulsed the radio's reset line, the same board was probed twice under two names, and retries came so fast the radio never finished booting before the next reset hit. Detection now gives the board real time to boot, probes it once, backs off properly between attempts, and no longer fights the "device detected" popup for the port. Radios that could never connect now come up within a minute of being plugged in.
-- The Lightning channels screen now has All / Active / Pending / Closed tabs. Pending gathers everything in motion (opening, closing, force-closing — each with its own status dot and a link to the closing transaction), and Closed is a real history: how each channel ended, what settled back to you, and the closing transaction for each.
-- Sending bitcoin on-chain now puts you in charge of the network fee: pick Fast, Standard, or Slow (Standard is the default), or set your own target blocks or sats-per-vByte. The confirmation step shows the estimated fee for your chosen speed before any money moves.
-- Type on-chain amounts in whichever unit you think in — a sats/BTC switch on the amount field converts as you type.
-- Back up your seed by scanning it. Every recovery-phrase screen (onboarding, Settings, and the Lightning wallet seed) now has Words and QR code tabs — words always shown first. The QR for your node's recovery phrase uses the SeedQR standard, so hardware wallets like Passport Prime, SeedSigner, and Keystone can import it with a single scan (a plain-text option remains for wallets that read the phrase as text). The Lightning seed's QR is plain text with an honest note: it's an LND-format seed that restores into Lightning wallets like Zeus or Blixt, not into hardware wallets.
-
-## v1.7.113-alpha (2026-07-25)
-
-- Fixed a money bug in Cashu ecash sends: the token you handed a recipient could carry your own change proofs along with it, letting the same sats be credited twice. Change now stays in your wallet — only the amount you meant to send leaves it.
-- Closing a Lightning channel is no longer a leap of faith. The close used to hang (or time out with an error) even though it had actually gone through; it now comes back within seconds with the closing transaction ID. Channels mid-close appear in the channel list as Closing or Force-closing with their transaction attached, and a new closed-channels history keeps past closes visible instead of letting them vanish from the list.
-- The wallet card now leads with your total bitcoin across everything, and the on-chain balance gets its own chain icon so the rows read at a glance.
-- The companion phone app (0.5.15) connects dramatically faster away from home: a cold connect over 5G dropped from 40+ seconds to about 5. First connects no longer stall on unreachable mesh dial hints, fresh joins fail fast and retry instead of waiting out long timeouts, and the phone re-announces itself the moment the network around it changes. The node side's mesh-join handling was hardened to match.
-
-## v1.7.112-alpha (2026-07-23)
-
-- Sound works on TVs out of the box. Fresh installs were missing the audio system entirely, and even when present a boot-time race left HDMI silent until the cable was unplugged and replugged. Both are fixed: installer images now ship the full audio stack, and a small background helper detects the silent-HDMI state and heals it automatically.
-- Plug in a game controller and drive the whole TV interface with it — navigation, menus, and media playback all respond to the gamepad, and dialogs that pop up are controller-navigable too.
-- The companion phone app took a huge leap (0.5.9). Your node and its apps now work from anywhere — on 5G or any internet connection, the phone reaches the node over the encrypted mesh with zero port forwarding or VPN setup. Startup away from home is instant, apps on your node open inside the app, the phone's native camera handles QR scanning, and a branded full-screen loader shows while the mesh connects.
-- Mesh Party: two phones scan each other's QR and instantly get a direct encrypted chat and app sharing between them — plus a "Share this app" QR that anyone can scan with a normal camera to install the companion app.
-- Pairing a second phone no longer silently logs out the first. Every device now keeps its own named access credential, ending the mystery reconnects when a household paired more than one phone.
-- The companion pairing QR is scannable again (it had grown too dense for phone cameras) and now identifies your node by its identity key, so the app recognizes your node even after it moves or gets a new address.
-- Every app your node serves on your home network is now also reachable over the mesh — remote access covers the apps themselves, not just the dashboard.
-- Selling files: you now choose which payment methods you accept (Lightning, ecash, …) and buyers are only offered those — enforced by the node itself, not just the buttons. Paying twice for the same file is impossible now, purchases file themselves into a new Paid Files tab, purchased music always plays in the bottom-bar player, and videos get picture-in-picture.
-- Sending Lightning is invoice-first: paste or scan an invoice and the amount fills in and locks by itself. An expired invoice now tells you plainly to ask for a fresh one instead of failing cryptically, and payment errors always reach your screen.
-- Sending to a pasted address gets a confirmation step showing exactly what will happen before any money moves, and buying ecash is an explicit two-step — no more accidental purchases.
-- Apps keep running when you change how they're displayed. Switching an app between windowed and fullscreen used to reload it from scratch (stopping any playing media); the app now stays live through the switch, and each app remembers its own preferred display mode.
-- A watchdog notices when the Lightning (LND) node wedges and revives it before you do; Fedi ecash gets its own send option with scannable token QR codes.
-- Fedimint's Lightning gateway and guardian now follow whichever bitcoin version is actually running instead of pointing at a stale address — switching bitcoin versions no longer strands them.
-- If your router starts handing out different addresses, the Pine voice speaker re-links itself automatically instead of staying silent until someone re-configures it.
-- Polish: mesh radios never show garbled device names anymore, the TV kiosk uses slim overlay scrollbars instead of fat grey bars, and the AI chat's background artwork shows through again.
-- Your mesh messages now survive restarts. Chat history — channels and DMs alike — used to live only in memory, so a reboot or update wiped every conversation; worse, other nodes silently discarded the first messages you sent after a reboot. Everything is now saved on the node and restored on startup, and post-reboot messages deliver reliably.
-- Plug in any LoRa radio and the node walks you through it. A setup window appears every time a radio is connected, shows what firmware is already on it (MeshCore, Meshtastic, or Reticulum RNode — with its current name, region, and channels where available), and offers two honest choices: "Set Up with Archipelago Settings" (a preview screen shows exactly what will be written before anything touches the radio) or "Keep As Is" (the radio is used untouched, and you can hot-swap radios freely). Swapping sticks mid-session now just works — including Reticulum RNodes, which fresh installer images now support out of the box.
-- Incoming bitcoin appears in your wallet within seconds of being sent — balance and the yellow "unconfirmed" entry update live, no refresh, no waiting for the next poll.
-- The speaker now announces the very first mesh message a node ever receives, and DMs announce just like channel messages (a safety guard against announcement storms was quietly swallowing them). Announcements also react about twice as fast.
-- Opening a Lightning channel right after the node starts no longer fails with a scary red error. The node quietly retries while Lightning finishes waking up, and if it's still not ready you get a calm "still finishing its startup — try again shortly" notice instead.
-- Viewing a transaction works on every node now, including small ones. Nodes with pruned bitcoin storage can't run the Mempool explorer app; transaction links now open your choice of external explorer instead (tx1138.com by default) — after a clear one-time warning that a third-party server will see which transaction you looked up. Set your preferred explorer in Wallet Settings → the new On-chain tab.
-- Voice commands respond noticeably faster: speech recognition now transcribes in roughly half the time, with identical accuracy on short commands.
-- Scanning a Lightning invoice with your phone's camera is far more reliable — dense invoice QR codes that the photo scanner missed are now read by the phone's native barcode engine.
-- The companion app's pairing QR always contains an address your phone can actually reach. If you manage your node over a VPN (Tailscale), the QR used to embed the VPN address, and pairing silently failed; it now advertises the node's home-network address.
-- Peer requests sent from Nostr discovery now actually arrive: your node checks for incoming requests every five minutes by itself (previously they sat unseen until someone manually pressed "Poll"), requests publish to all your configured relays instead of two hardcoded ones, and a failed send tells you instead of pretending it worked.
-- The Connected Nodes list refreshes instantly. It previously froze for up to 30 seconds per offline peer while checking who's reachable, one peer at a time; the checks now run all at once in the background while the list shows immediately.
-- Apps opened from inside a window (like a transaction from the wallet) now animate smoothly on top instead of loading invisibly underneath.
-- Settings-style windows keep their tabs pinned at the top and their buttons pinned at the bottom; only the middle scrolls. The wallet's tabs are now Channels / Cashu / Fedi / Ark / On-chain so all five fit.
-- On the TV screen, menus no longer flash open and instantly close. And the interface never follows your computer's light/dark preference anymore — dropdowns and other native controls stay dark on every device.
-- Error messages tell you what's actually wrong: "Insufficient balance: need 80 sats, have 0 sats" now reaches your screen instead of "Operation failed. Check server logs."
-- Installing Mempool no longer refuses to start while ElectrumX is mid-resync (it connects by itself once ElectrumX is ready), and installs no longer fail just because the system was momentarily busy.
-- Much quieter logs: the node no longer tries to start containers that are already running (hundreds of harmless-but-alarming errors per day), and a node that's offline stops hammering unreachable servers every 30 seconds with rebuild attempts.
-- Phones pairing with the companion app connect over the node's embedded mesh for remote access, with instant QR pairing and per-device access tokens (contributed alongside this release).
-
-## v1.7.111-alpha (2026-07-22)
-
-- Ask your node anything, out loud. Install Pine (the voice assistant app) alongside Home Assistant and everything wires itself automatically: speech recognition, the speaking voice, and a Claude-powered brain. Questions about your node — "what's the block height?", "how many peers am I connected to?", "is bitcoin synced?", "what's my Lightning balance?" — are answered instantly from the node itself without costing anything; anything else goes to Claude for a real conversation. New mesh radio messages are read out on your speaker as they arrive.
-- Pine now ships a wake-word listener, so a paired speaker can sit on standby and activate when it hears its wake word instead of needing a button press. (A custom "Yo Archy" wake word is in the works.)
-- Pine's launcher page shows your node's live status at a glance: software version, uptime, bitcoin sync progress, and mesh peers.
-- Fixed: installing Pine could send Home Assistant into a crash loop on startup (a record the installer wrote was missing a timestamp field Home Assistant requires). Two noisy warnings that repeated in Home Assistant's log every half minute are silenced too.
-- The companion phone app opens every app in its fast built-in browser view again, with native back/forward/reload controls, instead of embedding some apps inside the page where they scroll and render worse. This had quietly regressed.
-- Turning on federation discovery now shows you exactly what you're about to sign: a panel explains the announcement before your key signs it, you can review the signing details any time from the discoverability strip, and the panel fits and scrolls properly on small phones.
-- Fixed a bug on nodes using the newer app-management engine where Bitcoin's access credentials were written out incorrectly (a placeholder leaked through as the literal text "/bin/bash"), which broke the node's Bitcoin status display, Lightning's connection to the chain, and any app that reads Bitcoin data.
-- Bitcoin's access credentials also moved out of the process command line into a protected file, so they're no longer visible to other software on the node.
-- Desktop app windows have one-click buttons to switch between side panel, overlay, and fullscreen viewing.
-- On the phone home screen, the wallet card moved up to sit right under My Apps.
-- Home Assistant updated to 2026.7.3, which keeps voice satellites (like Pine's speaker) connected reliably.
-
-## v1.7.110-alpha (2026-07-21)
-
-- Pay by pointing your camera: the wallet has a new Scan button (on the wallet card and inside both the Send and Receive windows) that reads any payment QR code — Lightning invoices, Bitcoin addresses, Cashu tokens, and Fedimint invites — and takes you straight to the right send or redeem screen with everything filled in. It also understands the animated, multi-part QR codes some wallets show for long payloads. If your browser can't open a live camera preview (common when reaching the node over plain http), a "Take photo of QR" button snaps a picture with your phone's camera and reads the code from the photo instead.
-- The TV screen got a complete overhaul. A deep bug made the display freeze on the intro artwork on 4K TVs — that's fixed, and along the way: the interface now picks a comfortable, sharp size for big screens (a 4K TV gets a full desktop layout at double sharpness), the artwork behind every page shows again instead of a black void, switching between tabs animates smoothly, the built-in AI assistant stays in its dark theme, and the Cashu and Ark wallet icons no longer render as empty squares.
-- You can now choose how big the interface renders on your node's attached screen: Settings → Display offers Auto (recommended), Large UI, Balanced, and Native — changing it applies immediately.
-- The companion phone app can steer the TV again. Remote input from the phone was being silently ignored on kiosk displays; the remote-control relay now runs there like everywhere else.
-- The companion app is also ready to grant its built-in browser camera access, so the wallet scanner can work inside the app (ships with the next companion app build).
-- Zero-amount Lightning invoices can now be paid: the wallet asks you for the amount and sends it along, instead of failing on invoices that leave the amount up to the payer.
-- The Lightning setup guidance now reads the same everywhere: "Open a channel with Zeus Olympus node and start sending and receiving Lightning payments. Minimum 150,000 · maximum 1,500,000 on-chain sats required."
-- Installer images now bundle a color-emoji font, so emoji anywhere in the interface render properly on the TV screen.
-
-## v1.7.109-alpha (2026-07-21)
-
-- Meet Pine, your node's voice assistant: a new app in the App Store that gives your node ears and a voice — speech-to-text and text-to-speech engines that run entirely on your own hardware, ready to wire into Home Assistant for private, offline voice control. Install it like any other app; nothing you say leaves your node.
-- Your node can now program its MeshCore radio's RF settings — frequency, bandwidth, spreading factor, and coding rate — from Mesh → Device settings. Radios that were flashed with mismatched settings could hear that other radios exist but never decode their messages, and until now the only fix was a separate phone app. Set the values once and the node programs the radio automatically (it restarts once to apply); every radio on your mesh must use the same values to talk to each other.
-- The Device settings panel is tidier: values you can edit (name, region, channel) are no longer also shown as separate read-only rows.
-
-## v1.7.108-alpha (2026-07-20)
-
-- Your node connects to the private mesh far more reliably. Nodes rely on a public rendezvous point to find each other, and the only one available was unreachable from many home and office networks — leaving some nodes unable to join the mesh at all. There is now a second, always-reachable rendezvous point, and your node tries every one it knows, so it joins the mesh in seconds instead of being stranded.
-- Wi-Fi setup now heals itself on older nodes. Some nodes set up before a mid-year fix couldn't connect to a Wi-Fi network from the screen — it failed with a permissions error — because the piece that lets the node manage networking on your behalf was missing. Nodes now put that piece in place automatically on startup, so "scan, pick a network, type the password, connect" works without reinstalling.
-- Your node rejoins the mesh within seconds after an update. Applying an update briefly restarts the mesh service, and previously a node could sit disconnected from other nodes for up to five minutes before it retried.
-- The TV screen now fits your television. On a large or 4K TV the interface rendered tiny with no way to zoom on a keyboard-less screen; it now sizes itself to a comfortable, readable scale automatically (and small laptop panels are left unchanged).
-- More TV-screen polish: the built-in assistant shows its dark theme instead of bright white panels, the on-screen hint for switching between the kiosk and a terminal now points at the right keys, the welcome logo no longer occasionally renders as garbled characters, and an accidental tap of the power button no longer shuts the node down — hold it to power off on purpose.
-- Behind the scenes: fixed the installer image build so it no longer stops on a component that was removed from the product, and so it correctly includes the private relay it was meant to bundle.
-
-## v1.7.106-alpha (2026-07-20)
-
-- Nodes on the same network now find each other directly. Your node announces itself on your local network and connects straight to other Archipelago nodes nearby, instead of every connection having to be introduced by a public rendezvous server out on the internet. Peers in the same home or office stay connected to each other even when that server is unreachable, and they reach each other faster.
-- On a phone, the peer files screen tells you how you're connected again. The badge showing whether a peer's files are arriving over the fast mesh or over Tor was only visible on desktop — on narrow screens it disappeared entirely. It now appears next to the peer name on mobile too.
-- Your node's mesh settings can no longer be written in a way that breaks the mesh. The configuration file used to be assembled as free-form text, where one wrong setting would stop the mesh service from starting and quietly drop your node off the network. It's now generated from a checked description of the file, with tests that verify the exact output.
-- When your node has trouble reaching another node, the logs now record the real reason instead of a generic summary. A failure to open a peer's files previously logged only "Failed to connect to peer" and threw away the actual cause, which made these problems very hard to diagnose. Nothing changes on screen, and no internal detail is exposed.
-- Behind the scenes: the installer image now builds its mesh component at a fixed, known version instead of whatever upstream had published that day, so two images built from the same source are identical.
-
-## v1.7.105-alpha (2026-07-20)
-
-- Fixed a failure loop where a node that lost power or was moved could get stuck on a blank "can't reach your node" screen forever: startup recovery no longer spends minutes retrying containers that no longer exist, and a genuinely large recovery is no longer cut off half-way and forced to start over. The node now reaches its login screen even after the messiest shutdown.
-- Phone tunnel setup (WireGuard) is now dependable: the QR screen automatically retries while a fresh install is still settling instead of dead-ending at "failed to fetch", and if your node has moved to a different network the QR and downloadable config now carry the node's current address instead of the old one.
-- Fixed the white screen some laptop displays showed right after the intro on v1.7.104.
-- The companion phone app no longer suggests installing the companion app from inside itself.
-- The Tor page now lists onion addresses only for apps you actually have installed — fresh installs no longer come with six pre-made addresses for apps that were never set up.
-- Running `archipelago --version` or `--help` on the command line now prints and exits instead of silently starting a second copy of the node, which could briefly disrupt running apps.
-- Behind the scenes: installer image builds now stop loudly if VPN components are missing instead of producing a broken image, and a background file-permission sweep runs far less often, reducing disk churn on busy nodes.
-
-## v1.7.104-alpha (2026-07-19)
-
-- Software updates are now much safer to receive: the node will never install an update that isn't completely downloaded and verified byte-for-byte, closing a rare bug where an interrupted or cancelled download could leave a node unable to start.
-- If a freshly installed update does fail to start, the node now notices and automatically restores the previous working version by itself — no manual rescue needed.
-- The Electrum server now works with whichever Bitcoin you run: it finds Bitcoin Knots or Bitcoin Core automatically instead of assuming Knots.
-- While the Electrum server is first building its index, its waiting screen now shows the ElectrumX app icon and live progress.
-
-## v1.7.103-alpha (2026-07-18)
-
-- Connecting from the phone app no longer replays the intro cinematic on a loop: signing in after scanning the pairing QR could accidentally trigger "Replay Intro" instead of logging you in. The companion app now lands you straight on your dashboard, and the Android app waits for the login screen to be ready before it types your password.
-- Pressing Enter in any password box now does what you expect — it signs you in or moves to the next field, and can no longer "click" a nearby button by mistake when using a controller or the companion app.
-- The public demo no longer interrupts you with an "Update Available" popup that reset the site back to the intro — demo visitors simply get the newest version on their next visit.
-
-## v1.7.102-alpha (2026-07-17)
-
-- The password you choose during setup is now truly your node's password: it also becomes the system login for console and SSH access, instead of leaving the factory default in place. If you ever renamed your node and the TV screen went black on the next boot, that's fixed too — renaming no longer breaks the kiosk display.
-- Setting up Lightning is now a guided journey: a fund-your-wallet step that shows a live countdown while Bitcoin syncs, suggested channels you can open straight into the Zeus mobile wallet with one tap, and a "finish setup" prompt that walks you to the end — goals now complete when you've actually done the steps, not just when apps happen to be running.
-- Pair your phone by pointing it at the screen: the companion app now connects by scanning a QR code — scan, and it fills in your node's address and logs you in. The App Store has a banner to grab the Android app, and the pairing flow can now also set up secure remote access so your phone reaches home from anywhere.
-- First installs are far more dependable: app downloads that stall now retry instead of hanging forever (the old "first install fails, the second works" pattern), big multi-part apps show their real download progress instead of sitting at "Preparing", Lightning no longer fails its first install over temporary hiccups, and a brand-new node now comes up with its core apps — file cloud and ecash wallet — even with no internet connection.
-- The installer image is about 160MB smaller and gets to a working screen faster, because the apps bundled for offline setup are now compressed.
-- The first-run experience keeps its magic: the typing intro is back on fresh installs and can no longer be cut short by a mid-play refresh — updates now politely wait for the cinematic to finish — and dark backgrounds stay dark instead of flashing black or white.
-- Your backups now include your secrets — including the key that protects your Lightning wallet's recovery seed — and there's a Download button to take a copy off the node; the seed-backup reminder now actually opens the backup flow when you tap it.
-- Networking Profits grew into a full dashboard, network cards keep their action buttons in reach on every screen size, "Connect to Mesh" goes to the right page instead of a dead end, and the identity pages got a round of mobile polish.
-- Behind the scenes: apps that report their own health are no longer second-guessed by a port probe (fewer false "restarting" states), and pressing arrow keys or a gamepad is once again the only thing that shows the controller focus ring.
-
 ## v1.7.101-alpha (2026-07-15)
 
 - The wallet speaks Ark: a new Ark tab shows your Ark balance and history, you can send and receive over the Ark protocol, pay Lightning invoices from your Ark balance, and Ark payments appear in the transactions view with their own filter chip.
@@ -466,14 +198,14 @@
 - Saleor storefront proxying now forwards `X-Forwarded-Host`, fixing Next.js Server Actions requests that compared the browser origin with the internal `storefront-app:3000` upstream host.
 - Saleor storefront media now routes `/thumbnail/` and `/media/` through the same `9011` proxy to the Saleor API, fixing product image optimizer failures caused by `localhost:8000` media URLs.
 - The Saleor storefront container receives an explicit internal media origin so rewritten media URLs resolve inside the Podman network without exposing private API ports to browsers.
-- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on the staging node for storefront HTML, static assets, GraphQL, media redirects, and optimized product images.
+- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on `100.114.134.21` for storefront HTML, static assets, GraphQL, media redirects, and optimized product images.
 
 ## v1.7.81-alpha (2026-05-21)
 
 - Saleor storefront installs now use the prebuilt registry image instead of building the Next.js app on-device, avoiding Podman build failures during stack installation.
 - Existing Saleor stacks are repaired on adoption by recreating missing storefront containers, forcing the storefront app to bind `0.0.0.0:3000`, and resolving nginx upstreams dynamically after container restarts.
 - The shipped Saleor storefront image now includes public assets and omits Vercel-only Speed Insights injection, fixing broken static asset responses and the local `/_vercel/speed-insights/script.js` browser warning.
-- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on the staging node for `9011` storefront, static assets, and proxied GraphQL.
+- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on `100.114.134.21` for `9011` storefront, static assets, and proxied GraphQL.
 
 ## v1.7.80-alpha (2026-05-21)
 
@@ -504,7 +236,7 @@
 - Saleor installs now create or repair the `admin@example.com` staff account idempotently after sample data loads, use the correct dashboard mount path, and re-check stack containers after startup so stopped containers are caught.
 - NetBird embedded login now uses the upstream-compatible IdP signing-key behavior and sends ID tokens from the dashboard to the management API, fixing the post-signup `Unauthenticated` state while preserving the unified local proxy/logout routes.
 - Transient unnamed Podman helper containers created during app install tasks are hidden from My Apps, so generated names like `eager_keldysh` no longer appear as user applications.
-- Validation passed with catalog/release JSON checks, `npm run type-check`, and `cargo fmt --all --check --manifest-path core/Cargo.toml`; live checks on the staging node confirmed Saleor dashboard/API availability, generated Saleor admin login, NetBird OAuth availability, and NetBird logout redirects.
+- Validation passed with catalog/release JSON checks, `npm run type-check`, and `cargo fmt --all --check --manifest-path core/Cargo.toml`; live checks on `100.114.134.21` confirmed Saleor dashboard/API availability, generated Saleor admin login, NetBird OAuth availability, and NetBird logout redirects.
 
 ## v1.7.76-alpha (2026-05-20)
 
@@ -513,7 +245,7 @@
 - NetBird's browser proxy now sends API, OAuth, relay, WebSocket, and management traffic through the stable host-published server port at `169.254.1.2:8086`, avoiding stale rootless Podman DNS/IPs after `netbird-server` restarts.
 - Mobile App Store category chips now stay visible above the tab bar, Discover is available on mobile, and category selection updates the page route/query so the selected category is actually shown.
 - Apps that require a real browser tab now open directly from the app icon tap instead of first entering an in-shell app-session route, including BTCPay, Grafana, Home Assistant, Vaultwarden, Nextcloud, Portainer, OnlyOffice, Tailscale, Uptime Kuma, Gitea, and Nginx Proxy Manager.
-- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`; live checks on a fleet node confirmed Saleor dashboard `9010`/API `8000` and NetBird API/OAuth routes survive `netbird-server` restart.
+- Validation passed with catalog JSON checks, `npm run type-check`, `cargo fmt --all --check --manifest-path core/Cargo.toml`, and `cargo check -p archipelago --manifest-path core/Cargo.toml`; live checks on `100.70.96.88` confirmed Saleor dashboard `9010`/API `8000` and NetBird API/OAuth routes survive `netbird-server` restart.
 
 ## v1.7.75-alpha (2026-05-19)
 
@@ -535,7 +267,7 @@
 - Mobile app launches for iframe-blocked apps now open the direct app URL in a new browser tab immediately instead of landing in a broken in-shell webview that requires a second tap.
 - Mobile My Apps/Websites tabs now react to route query changes, App Store pages label the mobile view as Discover, mobile filters have safe bottom spacing, and App Store search ignores the current category so searches cover all available apps.
 - My Apps search now surfaces matching App Store entries when the app is not installed, making it possible to jump directly from a failed My Apps search to the installable app details.
-- NetBird self-host installs now prefer a `100.x` tailnet/CGNAT address for dashboard, management, relay, STUN, and auth redirect origins when one is present; live repair on a fleet node updated the existing stack from LAN origins to its tailnet address and restored `netbird-server`.
+- NetBird self-host installs now prefer a `100.x` tailnet/CGNAT address for dashboard, management, relay, STUN, and auth redirect origins when one is present; live repair on `100.89.209.89` updated the existing stack from LAN origins to `100.89.209.89` and restored `netbird-server`.
 - App-session iframe frames now focus automatically and wrap the iframe in a scroll host so wheel/touch scrolling works in the active right frame without requiring an initial click.
 
 ## v1.7.72-alpha (2026-05-19)
@@ -546,7 +278,7 @@
 
 ## v1.7.71-alpha (2026-05-19)
 
-- NetBird stack installs now pre-create `/var/lib/archipelago/netbird/data` before binding it into `netbird-server`, fixing the failed install/start path seen on a fleet node where Podman rejected the missing host directory.
+- NetBird stack installs now pre-create `/var/lib/archipelago/netbird/data` before binding it into `netbird-server`, fixing the failed install/start path seen on `100.70.96.88` where Podman rejected the missing host directory.
 - NetBird start/restart ordering now starts `netbird-server` before the dashboard container so lifecycle actions bring the control plane up before the UI.
 - App-session invalid IDs and panel-mode fallbacks now return to `/dashboard/apps`, avoiding the stale `/apps` route that could render a 404.
 - Mobile launches for apps that block iframes now stay inside the Archipelago app-session fallback instead of automatically opening an external browser tab.
@@ -564,7 +296,7 @@
 ## v1.7.69-alpha (2026-05-19)
 
 - App installs now allow up to 10 minutes for the initial `package.install` RPC to return, matching slow container image pulls and preventing apps from disappearing from My Apps while the backend is still pulling or retrying mirrors.
-- Live diagnostics on a fleet node confirmed the Gitea install did not fail; the primary registry pull timed out after 300 seconds, the fallback mirror succeeded, and Gitea came up healthy on `3001` while the frontend had already timed out at 15 seconds.
+- Live diagnostics on `100.70.96.88` confirmed the Gitea install did not fail; the primary registry pull timed out after 300 seconds, the fallback mirror succeeded, and Gitea came up healthy on `3001` while the frontend had already timed out at 15 seconds.
 - Gitea and other Docker-image app installs now stay visible during slow registry pulls instead of being marked as failed by the browser before backend install progress can complete.
 - Gitea is now categorized as a known Data app in My Apps, so a running Gitea container appears with installed apps instead of being filtered into the Websites/Services split.
 - NetBird `0.71.2` is now available in the app catalog and fallback marketplace data as a recommended networking app using the official `docker.io/netbirdio/netbird:0.71.2` image.
@@ -582,8 +314,8 @@
 - App session close buttons now return to the previous dashboard screen when possible and otherwise fall back to My Apps, avoiding the 404 page after closing an app launched from an invalid or stale history entry.
 - System Update confirmation and mirror modals now teleport to the document body with a full-screen overlay, so they cover the whole app instead of only the right-hand dashboard panel.
 - Mobile app launches stay inside Archipelago's app-session webview and hide desktop-only new-tab launch affordances, including apps such as Home Assistant that previously looked like they would leave the mobile shell.
-- Live recovery on a fleet node upgraded only the `btcpay-server` container to `docker.io/btcpayserver/btcpayserver:2.3.9`, preserved the existing datadir and Postgres database, and confirmed the container is healthy after a pre-upgrade backup.
-- Public validation confirmed ``the BTCPay host`/`www` redirect to BTCPay login over HTTPS and `the L484 host`/`www` serve the L484 page over HTTPS using the issued Let's Encrypt certificates.
+- Live recovery on `100.70.96.88` upgraded only the `btcpay-server` container to `docker.io/btcpayserver/btcpayserver:2.3.9`, preserved the existing datadir and Postgres database, and confirmed the container is healthy after a pre-upgrade backup.
+- Public validation confirmed `spay.tx1138.com`/`www` redirect to BTCPay login over HTTPS and `sapien.tx1138.com`/`www` serve the L484 page over HTTPS using the issued Let's Encrypt certificates.
 
 ## v1.7.67-alpha (2026-05-18)
 
@@ -592,18 +324,18 @@
 - Settings What's New is filled through `v1.7.67-alpha`, including the missing historical `v1.7.44-alpha` through `v1.7.66-alpha` entries.
 - Bitcoin/Knots/Core shell lifecycle specs now match the Rust app config memory policy: 8 GiB on normal hosts, 4 GiB on low-memory hosts, and pruned Knots uses a larger dbcache on hosts with enough RAM to improve IBD throughput.
 - ElectrumX/electrs shell lifecycle specs now match the 4 GiB memory policy used by the Rust app config, reducing drift between first boot, reconcile, and app lifecycle paths.
-- Live assessment of a fleet node identified the current IBD bottlenecks as CPU/thermal/I/O pressure rather than RAM exhaustion, with follow-up work planned for existing-node swap repair, kiosk Chromium CPU reduction, and reconcile failure cleanup.
+- Live assessment of `100.70.96.88` identified the current IBD bottlenecks as CPU/thermal/I/O pressure rather than RAM exhaustion, with follow-up work planned for existing-node swap repair, kiosk Chromium CPU reduction, and reconcile failure cleanup.
 
 ## v1.7.66-alpha (2026-05-18)
 
 - Nginx Proxy Manager stale-port repair now detects stopped or `Created` Podman records by inspecting `podman ps -a` port metadata, covering records where `podman port nginx-proxy-manager` returns no mapping until start.
-- Live recovery on a fleet node removed only the stale Nginx Proxy Manager container record and recreated it with `8081:81`, `8084:80`, and `8444:443`, preserving `/var/lib/archipelago/nginx-proxy-manager` data.
+- Live recovery on `100.70.96.88` removed only the stale Nginx Proxy Manager container record and recreated it with `8081:81`, `8084:80`, and `8444:443`, preserving `/var/lib/archipelago/nginx-proxy-manager` data.
 - Validation confirmed Nginx Proxy Manager recovered as healthy and responds through direct admin port `8081`, host compatibility port `81`, and `/app/nginx-proxy-manager/`.
 
 ## v1.7.65-alpha (2026-05-18)
 
 - Orchestrator-backed app starts now run the same pre-start repairs as the legacy Podman path, so Nginx Proxy Manager stale `81:81` container metadata is removed and recreated before the orchestrator tries to start it.
-- Live diagnostics on a fleet node confirmed host nginx is healthy while Nginx Proxy Manager has no listeners on `8081`, `8084`, or `8444`, causing host nginx `502` responses for NPM proxy paths.
+- Live diagnostics on `100.70.96.88` confirmed host nginx is healthy while Nginx Proxy Manager has no listeners on `8081`, `8084`, or `8444`, causing host nginx `502` responses for NPM proxy paths.
 
 ## v1.7.64-alpha (2026-05-18)
 
@@ -628,7 +360,7 @@
 - Multi-container stack installs now keep their app card in the `Installing` state for up to 20 minutes while dependency containers are being pulled and prepared.
 - BTCPay Server installs no longer appear to vanish or fail after two minutes while Postgres and NBXplorer are still being created before the primary `btcpay-server` container exists.
 - The stale-transition escape hatch remains short for start, stop, restart, update, and removal operations, so genuinely wedged lifecycle actions still recover quickly.
-- Live validation on a fleet node confirmed BTCPay Server completed installation and responds on port `23000` with the expected HTTP redirect.
+- Live validation on `100.70.96.88` confirmed BTCPay Server completed installation and responds on port `23000` with the expected HTTP redirect.
 
 ## v1.7.60-alpha (2026-05-18)
 
@@ -636,7 +368,7 @@
 - Mesh radio auto-detection now skips known non-mesh serial devices such as Sierra Wireless LTE modems and Zooz/Z-Wave sticks, avoiding interference with production peripherals.
 - Meshtastic config sync now sends `want_config_id` with the correct protobuf wire type, fixing radio-side `ignore malformed toradio` errors and allowing node-info/contact ingestion.
 - The stable `/dev/mesh-radio` udev rule no longer claims every `ttyACM*` device; it only matches known mesh USB serial adapters and known USB CDC ACM radio vendors.
-- Live validation on a fleet node confirmed Archipelago selects `/dev/ttyUSB0`, identifies the Meshtastic node, and refreshes 103 mesh contacts.
+- Live validation on `100.70.96.88` confirmed Archipelago selects `/dev/ttyUSB0`, identifies the Meshtastic node, and refreshes 103 mesh contacts.
 
 ## v1.7.59-alpha (2026-05-17)
 
@@ -660,7 +392,7 @@
 - Host nginx now serves `/assets/*` hashed frontend chunks as immutable static files with a hard 404 on misses instead of falling back to `index.html`, preventing strict MIME errors when a browser has a stale pre-update HTML shell.
 - The SPA HTML shell and service-worker files now revalidate on every load, reducing stale frontend references after OTA updates.
 - OTA runtime promotion now installs the bundled `nginx-archipelago.conf` into `/etc/nginx/sites-available/archipelago` and reloads nginx after a successful config test, so frontend cache/fallback fixes reach existing nodes without a manual deploy.
-- Local validation passed with `cargo check -p archipelago`; live SSH testing against a fleet node was not completed because temporary public-key authentication was rejected on the target.
+- Local validation passed with `cargo check -p archipelago`; live SSH testing against `100.70.96.88` was not completed because temporary public-key authentication was rejected on the target.
 
 ## v1.7.57-alpha (2026-05-17)
 
@@ -741,7 +473,7 @@
 - Health monitor no longer pages "Auto-restart failed" for orphaned containers. After a variant switch (bitcoin-core ↔ bitcoin-knots) the previous variant's container could survive uninstall and the health monitor would try restarting it forever. Now skipped silently with a debug log.
 - Apps no longer disappear from My Apps when an install fails. The card stays visible with state=Stopped so the user can retry or uninstall, with the failure reason surfaced via the new install_progress.message field.
 - "Downloading…" progress now actually advances during multi-image stack pulls. Was sticking at 20% until all pulls finished; now interpolates 20%→70% based on which image of N has landed.
-- Pulled four docker.io images (bitcoin, gitea, nextcloud, valkey) into the lfg2025 registries on the registry mirrors. Removes a docker.io dependency from first-boot installs.
+- Pulled four docker.io images (bitcoin, gitea, nextcloud, valkey) into the lfg2025 registries on OVH and tx1138. Removes a docker.io dependency from first-boot installs.
 - Resilience harness improvements: install-fail entries no longer vanish, install/uninstall/probe cells are timing-tolerant (60s retry on ui_probe and auth_probe), dep snapshots no longer leak companion containers into the dependent app's "new containers" set.
 
 ## v1.7.45-alpha (2026-04-29)
@@ -787,7 +519,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Infrastructure
 - CI pipeline added (.github/workflows/ci.yml) — cargo fmt, clippy, tests + frontend type-check, build
-- Update system now fetches from the release Gitea instance (configurable via ARCHIPELAGO_UPDATE_URL)
+- Update system now fetches from git.tx1138.com Gitea instance (configurable via ARCHIPELAGO_UPDATE_URL)
 - Cleaned up stale git branches (app-store, overnight/2026-03-12, overnight/2026-03-13)
 
 ## [1.3.0] - 2026-03-19

CLAUDE.md

@@ -1,72 +1,84 @@
-# Archipelago — contributor guide
+# Archipelago — agent guide
 
-This file orients anyone (human or AI) working in this repository: the
-invariants that must hold, how to build and verify, and where the deeper
-design docs live. The authoritative behaviour is always the code in `core/`.
+## ✅ Single-node production gate is GREEN (2026-06-23)
 
-**Read [`docs/ROADMAP.md`](docs/ROADMAP.md) for where the project is going** and
-[`docs/README.md`](docs/README.md) for the full documentation index.
+`tests/lifecycle/run-gate.sh` is **5/5 on .228, 0 failures** — the single-node exit
+criterion is met and the priority banner is demoted. Next exit-criteria: the
+**multinode pass** (`docs/multinode-testing-plan.md`) and workstreams B/C/D.
 
-The north star: a world-class, **developer-ready app platform** — every app
-manifest-driven, rootless, secure, and 100%-uptime-capable, with third-party
-developers publishing via an external/decentralized registry.
+**For day-to-day work, use `docs/UNIFIED-TASK-TRACKER.md`** — the consolidated,
+priority-ordered "what's left" list across the 1.8.0 OTA and master-plan docs
+(fastest/simplest tasks first). It supersedes hunting through the two source docs
+below for open items; those remain the narrative/history.
 
-Detailed sub-plans:
-- App platform / packaging phases + security model → [`docs/APP-PACKAGING-MIGRATION-PLAN.md`](docs/APP-PACKAGING-MIGRATION-PLAN.md)
-- Registry-distributed manifests → [`docs/registry-manifest-design.md`](docs/registry-manifest-design.md)
-- External/decentralized marketplace for devs → [`docs/marketplace-protocol.md`](docs/marketplace-protocol.md)
-- App manifest schema → [`docs/app-manifest-spec.md`](docs/app-manifest-spec.md)
-- Production test gate → [`tests/lifecycle/TESTING.md`](tests/lifecycle/TESTING.md)
+**Read `docs/PRODUCTION-MASTER-PLAN.md` first** — it is still the authoritative plan
+for the north star: a world-class, **developer-ready app platform** where every app
+is manifest-driven, manifests ship via the **signed registry** (not OTA disk files),
+and **third-party developers publish apps via an external/decentralized registry** —
+all rootless, secure, robust, and 100%-uptime-capable. It no longer overrides all
+ad-hoc direction now that the gate is green, but it remains the source of truth for
+sequencing the remaining workstreams.
 
-## Commit & push every unit of work
+Detailed sub-plans (all linked from the master):
+- App platform / packaging phases + security model → `docs/APP-PACKAGING-MIGRATION-PLAN.md`
+- Registry-distributed manifests (in progress) → `docs/registry-manifest-design.md`
+- External/decentralized marketplace for devs → `docs/marketplace-protocol.md`
+- Current per-app state → `docs/archive/app-registry-status-2026-06-21.md`
+- Production test gate (exit criterion) → `tests/lifecycle/TESTING.md`
 
-Work is not "done" until it is committed **and** pushed. Finished work has been
-lost by sitting uncommitted in a shared tree across sessions. To prevent that:
+## Commit & push every unit of work (never violate)
+
+**The #1 process rule: work is not "done" until it is committed AND pushed.** This
+exists because finished work has been lost/clobbered by sitting uncommitted in the
+shared tree across agents and sessions. To prevent that:
 
 - **Commit each feature/fix the moment it works** — one focused, self-contained
-  commit per logical change (it compiles and its targeted tests pass). Don't let
+  commit per logical change (it compiles and its targeted tests pass). Do not let
   unrelated changes accumulate uncommitted.
-- **Push immediately after committing** so nothing lives only on one machine.
-- **Never leave a stack of finished work uncommitted** overnight or when handing
-  off — if you must pause mid-change, commit a clearly-labelled WIP checkpoint
-  rather than leaving the tree dirty.
-- **Stage explicitly by path** (`git add <paths>`) when another contributor's
-  uncommitted work shares the tree — never `git add -A` / `git commit -a`, which
-  clobbers or entangles their changes.
-- **Never commit secrets** (mnemonics, private keys, API tokens). Signing is done
-  offline; artifacts (catalog/manifest) are signed, not the keys.
+- **Push immediately after committing** so nothing lives only on one machine. `main`
+  is protected → push via `git push gitea-ai main` (account `ai`, see the memory
+  note); feature branches push to their own remote.
+- **Never leave a stack of finished work uncommitted** overnight or when handing off
+  between agents — if you must pause mid-change, commit a clearly-labelled WIP
+  checkpoint rather than leaving it dirty.
+- **Stage explicitly by path** (`git add <paths>`) when another agent's uncommitted
+  work shares the tree — never `git add -A` / `git commit -a`, which clobbers or
+  entangles their changes.
+- **Never commit or push secrets** (mnemonics, private keys, API tokens). Signing is
+  done offline; artifacts (catalog/manifest) are signed, not the keys.
+- Commit messages end with the `Co-Authored-By: Claude …` trailer.
 
 ## Invariants (never violate)
 
 - **Rootless Podman only.** No rootful, no Docker-socket mounts, no privileged
   containers unless explicitly approved.
 - **No per-app Rust installers / no OS-level reliance.** Apps are declarative;
-  the orchestrator owns the lifecycle. A hardcoded `podman run` + `sudo chown`
-  installer is the anti-pattern being deleted, not a template.
+  the orchestrator owns the lifecycle. `install_immich_stack` (hardcoded
+  `podman run` + `sudo chown`) is the anti-pattern being deleted, not a template.
 - **Secrets are manifest-declared** (`generated_secrets`, materialised by
   `container::secrets`, 0600/rootless) — never hardcoded, per-app, or logged.
 - **Migrations never destroy data** — preserve `/var/lib/archipelago/<app>`,
   secrets, credentials, ports, and adoption container names; keep a rollback path.
-- **Verify on a real node before any release tag.**
+- **Verify on the real node .228 before any tag.** (Fleet-wide multinode
+  verification is a separate plan: `docs/multinode-testing-plan.md`.)
 
 ## Build / verify
 
-- Rust workspace root is `core/` (no Cargo.toml at repo root). Run `cargo` from `core/`.
+- Rust workspace root is `core/` (no Cargo.toml at repo root). `cargo` from `core/`.
 - If a `cargo test`/build hits `rust-lld: undefined hidden symbol`, it's
   incremental-cache corruption — rebuild with `CARGO_INCREMENTAL=0`.
 - Frontend: `neode-ui/` → `npm run build` outputs to `web/dist/neode-ui/`.
-  Grep the built bundle for new strings before shipping (the build can silently
-  no-op).
-- App manifests are delivered inside the **signed catalog** (`releases/app-catalog.json`),
-  whose entry overrides the on-disk `/opt/archipelago/apps/*/manifest.yml`
-  (origin-wins; disk is the fallback). Editing a disk manifest alone does **not**
-  change a catalog-covered app — regenerate and re-sign the catalog.
+  Grep the built bundle for new strings before shipping (build can silently no-op).
+- App manifests load from disk on nodes at `/opt/archipelago/apps/*/manifest.yml`
+  (today); the goal is to distribute them via the signed catalog instead.
 
 ## Production test gate (definition of done)
 
-`tests/lifecycle/run-gate.sh` must be green across install / UI / stop / start /
-restart / reinstall / reboot-survive / archipelago-restart-survive / uninstall.
-**Run the gate on the node** (it uses local podman/systemctl/bitcoin probes), not
-via RPC from another host, and re-run it after any orchestrator/lifecycle change.
-Multinode / fleet testing is a separate pass. See
-[`tests/lifecycle/TESTING.md`](tests/lifecycle/TESTING.md).
+`tests/lifecycle/run-gate.sh` green across install / UI / stop / start / restart /
+reinstall / reboot-survive / archipelago-restart-survive / uninstall — **5× on
+.228** (`ARCHY_ITERATIONS=5`). **Run the gate ON the node** (it uses local podman/systemctl/bitcoin
+probes), not via RPC from another host. **✅ GREEN 2026-06-23 (5/5, 0 not-ok)** — keep it
+green (re-run after orchestrator/lifecycle changes); regressions are top priority again.
+**Multinode testing (.198 + the rest of the fleet) is a SEPARATE plan** —
+`docs/multinode-testing-plan.md` — not part of this single-node gate criterion, and is
+the next exit criterion now that single-node is green.

CODE_OF_CONDUCT.md

@@ -1,19 +0,0 @@
-# Code of Conduct
-
-## Our standard
-
-Be direct, respectful, and focused on the work. Healthy disagreement is welcome;
-harassment, personal attacks, and discriminatory language are not.
-
-## Scope
-
-This code of conduct applies to project repositories, issue trackers, pull
-requests, documentation, chat, and community spaces connected to Archipelago.
-
-## Enforcement
-
-Maintainers may edit, hide, or remove comments and may restrict participation
-for behavior that makes collaboration unsafe or unproductive.
-
-Report conduct concerns privately through the repository owner account or the
-private contact channel listed on the project homepage.

CONTRIBUTING.md

@@ -1,100 +1,161 @@
 # Contributing to Archipelago
 
-This project is preparing for public developer contribution. The highest-value
-contributions are focused fixes, tests, app manifests, documentation
-improvements, and clear bug reports with reproducible evidence.
+Thank you for your interest in contributing to Archipelago! This document covers the process for contributing code, reporting bugs, and submitting apps.
 
-## Development setup
+## Code of Conduct
 
-### Frontend
+Be respectful. We follow the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+## Getting Started
+
+1. Fork the repository on the project's Gitea instance
+2. Clone your fork: `git clone <your-fork-url>/archy.git`
+3. Set up the dev environment (see `docs/developer-guide.md`)
+4. Create a feature branch: `git checkout -b feature/your-feature`
+
+## Development Setup
+
+### Frontend (Vue.js)
 
 ```bash
 cd neode-ui
 npm install
-npm start
-npm run type-check
-npm test
+npm start          # Dev server on :8100
+npm run type-check # TypeScript validation
+npm run build      # Production build
+npm test           # Run tests
 ```
 
-### Backend
+### Backend (Rust)
+
+Build on a Linux server (Debian 13), **not** macOS:
 
 ```bash
-cd core
-cargo fmt --all -- --check
-cargo clippy --all-targets --all-features -- -D warnings
+cargo clippy --all-targets --all-features
+cargo fmt --all
 cargo test --all-features
 ```
 
-Linux is required for host integration work involving Podman, systemd,
-networking, or image builds. Frontend development works locally with the mock
-backend.
-
-## App manifests
-
-App packages live under `apps/<app-id>/manifest.yml` and use the schema
-documented in [docs/app-manifest-spec.md](docs/app-manifest-spec.md). Validate
-before submitting:
+### Deploy to dev server
 
 ```bash
-./scripts/validate-app-manifest.sh apps/<app-id>/manifest.yml
-python3 scripts/generate-app-catalog.py
-python3 scripts/check-app-catalog-drift.py --release --strict
+./scripts/deploy-to-target.sh --live
 ```
 
-App submissions must:
+## Code Style
 
-- pin container image versions;
-- avoid hardcoded secrets;
-- use `security.no_new_privileges: true`;
-- use `security.readonly_root: true` unless the manifest explains why writable
-  root is required;
-- request only necessary Linux capabilities;
-- store durable data under `/var/lib/archipelago/<app-id>/`;
-- define truthful health checks and launch interfaces for user-facing UIs.
+### Frontend (TypeScript + Vue)
 
-## Code style
+- `<script setup lang="ts">` — always Composition API
+- TypeScript strict mode — no `any`, use `unknown` or proper types
+- Global CSS classes in `src/style.css` — never inline Tailwind in components
+- Pinia for state management — focused single-purpose stores
+- Use `@/api/rpc-client.ts` for RPC calls
 
-- Rust: prefer `?` over `unwrap()`/`expect()` in production paths.
-- Rust: use `tracing` for structured logs.
-- TypeScript: avoid `any`; use explicit types or `unknown`.
-- Vue: prefer `<script setup lang="ts">`.
-- Keep changes scoped; do not mix drive-by refactors with behavioral changes.
-- Remove dead code rather than commenting it out.
-- Add tests for new behavior and regression tests for bug fixes.
+### Backend (Rust)
 
-## Pull requests
+- No `unwrap()` or `expect()` in production code — use `?` operator
+- `thiserror` for library errors, `anyhow` for application errors
+- `tracing` for structured logging — never `println!`
+- Run `cargo clippy` and `cargo fmt` before commits
 
-1. Open one focused PR per behavior or documentation change.
-2. Explain what changed, why it changed, and how it was verified.
-3. Include screenshots for UI changes.
-4. Link relevant issues or docs.
-5. Keep generated catalog changes in sync with manifest changes.
+### General
 
-Suggested commit format:
+- Functions under 50 lines, single responsibility
+- Comment WHY not WHAT
+- Remove dead code — never comment it out
+- No `TODO`/`FIXME` in commits
 
-```text
-feat: add backup scheduling
-fix: reject unsafe manifest volume
-docs: clarify app deployment flow
-test: cover catalog drift check
+## Commit Format
+
+```
+type: description
 ```
 
-## Reporting bugs
+**Types**: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`, `perf:`
 
-Include:
+Examples:
+- `feat: add backup scheduling to settings page`
+- `fix: handle WiFi connection timeout gracefully`
+- `test: add unit tests for RPC client retry logic`
 
-- exact version or commit;
-- host platform and architecture;
-- steps to reproduce;
-- expected and actual behavior;
-- logs from the relevant component;
-- screenshots for UI issues.
+## Pull Request Process
 
-## Security
+1. Ensure your branch is up to date with `main`
+2. All checks must pass: TypeScript, build, tests, clippy
+3. Include a clear description of what changed and why
+4. Link any related issues
+5. Request review from a maintainer
 
-Do not report vulnerabilities in public issues. Follow [SECURITY.md](SECURITY.md).
+### PR Checklist
+
+- [ ] TypeScript type-check passes (`npm run type-check`)
+- [ ] Frontend builds (`npm run build`)
+- [ ] Tests pass (`npm test`)
+- [ ] Rust clippy clean (`cargo clippy --all-targets --all-features`)
+- [ ] No new compiler warnings
+- [ ] Follows code style guidelines above
+
+## Testing Requirements
+
+- New features need tests
+- Bug fixes need a regression test
+- Frontend: Vitest + Vue Test Utils
+- Backend: `#[test]` and `#[tokio::test]`
+- Target: maintain or improve existing coverage
+
+## Reporting Bugs
+
+Use the **Bug Report** issue template. Include:
+
+1. Steps to reproduce
+2. Expected behavior
+3. Actual behavior
+4. System info (hardware, OS version, Archipelago version)
+5. Screenshots if applicable
+6. Relevant logs (`journalctl -u archipelago`)
+
+## Feature Requests
+
+Use the **Feature Request** issue template. Include:
+
+1. Problem description
+2. Proposed solution
+3. Alternatives considered
+4. Impact on existing users
+
+## App Submissions
+
+To submit an app for the Archipelago marketplace:
+
+1. Create a manifest following `docs/app-manifest-spec.md`
+2. Ensure the container image is published to a public registry
+3. Test on Archipelago hardware (x86_64 and ARM64 if possible)
+4. Open a PR adding the app to the curated list
+5. Include: app description, icon, resource requirements, dependencies
+
+### App Requirements
+
+- Container must run as non-root (UID > 1000)
+- `readonly_root: true` unless explicitly justified
+- Drop all capabilities except those required
+- `no-new-privileges: true`
+- Pin specific image versions (no `latest` tag)
+- No hardcoded secrets
+
+## Security Disclosure
+
+**Do NOT open public issues for security vulnerabilities.**
+
+Email security concerns to the maintainers directly. Include:
+
+1. Description of the vulnerability
+2. Steps to reproduce
+3. Potential impact
+4. Suggested fix (if any)
+
+We will acknowledge receipt within 48 hours and provide a timeline for a fix.
 
 ## License
 
-By contributing, you agree that your contribution is licensed under the
-project's MIT License.
+By contributing, you agree that your contributions will be licensed under the same license as the project.

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Dorian and the Archipelago Project contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

NOTICE

@@ -1,73 +0,0 @@
-# Archipelago — Third-Party Notices
-
-Archipelago is licensed under the MIT License (see LICENSE).
-This file lists third-party components included in this repository and its
-release artifacts, with their licenses and required attributions.
-
-## Embedded / vendored components
-
-- **FIPS mesh networking** — https://github.com/jmcorgan/fips
-  Copyright (c) 2026 Johnathan Corgan. MIT License.
-  Used as the embedded mesh VPN in the OS (`fips` daemon, pinned v0.4.1) and
-  compiled into the Android companion app (`Android/rust/archy-fips-core`).
-
-- **QR Code Generator for JavaScript** — http://www.d-project.com/
-  Copyright (c) 2009 Kazuhiko Arase. MIT License.
-  Vendored at `docker/lnd-ui/qrcode.js` and `docker/electrs-ui/qrcode.js`
-  (original headers preserved).
-
-- **nostr-rs-relay** — https://github.com/scsibug/nostr-rs-relay — MIT License.
-  Binary extracted into the OS image at `/opt/archipelago/bin/`.
-
-- **Reticulum (RNS) and LXMF** — https://github.com/markqvist/Reticulum
-  Copyright Mark Qvist. Distributed under the Reticulum License (an MIT-style
-  license with field-of-use restrictions: no use in systems designed to harm
-  human beings, and no use in AI/ML training datasets). The optional
-  `archy-reticulum-daemon` binary bundles RNS 1.3.5 and LXMF 1.0.1. The
-  Reticulum License is NOT an OSI-approved open-source license; it applies
-  only to that optional component, not to Archipelago itself.
-
-## Fonts
-
-- **Montserrat** — SIL Open Font License 1.1
-  (`neode-ui/public/assets/fonts/Montserrat/OFL.txt`).
-- **Open Sans** — Apache License 2.0
-  (`neode-ui/public/assets/fonts/Open_Sans/LICENSE.txt`).
-
-## Artwork and icons
-
-- **Mesh device artwork** (`neode-ui/public/assets/img/mesh-devices/`):
-  device illustrations from the Meshtastic project — https://meshtastic.org
-  © Meshtastic contributors, GPL-3.0. Meshtastic® is a registered trademark
-  of Meshtastic LLC. See the ATTRIBUTION.md in that directory.
-- Some UI icons are derived from **game-icons.net** (CC BY 3.0 — see
-  ATTRIBUTION.md in `neode-ui/public/assets/icon/`) and **pixelarticons**
-  (MIT, https://github.com/halfmage/pixelarticons).
-- Third-party application logos under `neode-ui/public/assets/img/app-icons/`
-  and `service-icons/` are trademarks of their respective owners, used solely
-  to identify the corresponding applications. No endorsement is implied.
-
-## Original media
-
-All demo content (music, photos, posters in `demo/`), UI sound effects,
-background images, and intro video in `neode-ui/public/assets/` are original
-works created and owned by the Archipelago project author, released with the
-project. The welcome voice line (`welcome-noderunner.mp3`) was generated with
-ElevenLabs TTS under a commercial-use plan.
-
-## Redistributed software (ISO and container registry)
-
-The Archipelago OS image is based on Debian and redistributes Debian packages
-(including the Linux kernel, GRUB, and non-free firmware/microcode blobs
-required for hardware support); per-package license texts are preserved at
-`/usr/share/doc/*/copyright` in the installed system, and corresponding source
-is available via Debian (https://snapshot.debian.org) as referenced in each
-release's notes. Container images offered through the app catalog and mirror
-registry remain under their upstream licenses (including GPL/AGPL software
-such as mempool, Nextcloud, Vaultwarden, SearXNG, PhotoPrism, Immich,
-Jellyfin, MariaDB, AdGuard Home, and strfry); source links are provided in
-the app catalog. The modified mempool-frontend image is built from
-`docker/mempool-frontend/` in this repository (AGPL-3.0 corresponding source).
-
-Full per-crate and per-package license inventories for release binaries are
-generated at build time (see THIRD-PARTY-LICENSES files in release artifacts).

README.md

@@ -1,11 +1,8 @@
 # Archipelago
 
-> Self-sovereign Bitcoin node OS and manifest-driven app platform.
+> Self-Sovereign Bitcoin Node OS
 
-Archipelago is a bootable personal server OS for Bitcoin infrastructure,
-self-hosted apps, mesh communication, decentralized identity, and federation.
-Apps are packaged as declarative `manifest.yml` files and run as rootless
-Podman containers managed by the Rust backend.
+**Archipelago** is a bootable personal server OS. Flash it to a USB drive, install on any x86_64 or ARM64 machine, and manage Bitcoin infrastructure, self-hosted apps, mesh communication, and decentralized identity through a glassmorphism web UI.
 
 [![Debian 13](https://img.shields.io/badge/Debian-13%20Trixie-a80030)](https://www.debian.org/)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
@@ -13,100 +10,193 @@ Podman containers managed by the Rust backend.
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
 [![Version](https://img.shields.io/badge/version-1.8.0--alpha-blue)]()
 
-## What is here
+## Philosophy
 
-- `core/` - Rust workspace: backend API, container runtime, security, OpenWrt
-  helpers, and performance/resource management.
-- `neode-ui/` - Vue 3 + TypeScript frontend.
-- `apps/` - app manifests and custom app container sources.
-- `docker/` - supporting container build contexts for UI companion surfaces.
-- `image-recipe/` - bootable image/ISO build inputs.
-- `Android/` - Android companion app.
-- `scripts/` - development, release, deployment, and validation tooling.
-- `docs/` - architecture, app packaging, operations, API, and roadmap docs.
+Archipelago is being built as a **developer-ready app platform**, not a fixed appliance:
 
-## Platform model
+- **Manifest-driven apps.** Every app is declared in a single `manifest.yml` — image, ports, volumes, secrets, health checks, security policy. The orchestrator owns the entire lifecycle; there is no per-app installer code and no host-level provisioning.
+- **Signed distribution.** App manifests ship inside an Ed25519-signed catalog verified against a pinned release-root key, not as loose files on disk. OTA release manifests are signed the same way.
+- **Decentralized marketplace.** Third-party developers publish apps via Nostr-based discovery (NIP-78) with DID-signed manifests and federation-weighted trust scoring — no gatekept central store.
+- **Rootless and secure by default.** Rootless Podman only. Read-only root, no-new-privileges, capability allow-list, secrets materialised 0600 and never logged. Never rootful, never a Docker socket mount.
+- **100%-uptime-capable.** Every container is a systemd Quadlet unit under `user.slice` that survives backend restarts; a level-triggered reconciler self-heals drift every 30 seconds; migrations never destroy data.
 
-Archipelago is built as a developer-ready app platform, not a fixed appliance:
+## Features
 
-- Apps are declared in `apps/<app-id>/manifest.yml`.
-- The Rust parser in `core/container/src/manifest.rs` is the canonical schema.
-- The orchestrator compiles manifests to rootless Podman/Quadlet runtime state.
-- App data lives under `/var/lib/archipelago/<app-id>/`.
-- Secrets are generated or read from `/var/lib/archipelago/secrets/` and
-  injected through Podman secrets rather than static environment values.
-- Release and app catalogs are signed and verified against a pinned trust
-  anchor.
+### Bitcoin Infrastructure
+- **Bitcoin Core and Bitcoin Knots** full nodes with per-app version pinning and bulletproof version switching, automatic prune/full mode based on disk size
+- **LND** and **Core Lightning** with channel management
+- **ElectrumX** Electrum server for wallet connectivity
+- **BTCPay Server** for accepting Bitcoin payments
+- **Mempool** block explorer and fee estimator
+- **Fedimint** federation guardian, gateway, and client — plus Cashu ecash wallet support
 
-Start with:
+### Self-Hosted Apps (50+)
+Storage (FileBrowser, Immich, Nextcloud), Productivity (Vaultwarden), Media (Jellyfin, PhotoPrism, IndeeHub), Search (SearXNG), Network (NetBird, Tailscale), Home (Home Assistant), Nostr (nostr-rs-relay, strfry), Dev/Ops (Gitea, Grafana, Portainer, Uptime Kuma), and more — 27 curated in the store UI, 50+ packaged as manifests.
 
-- [Architecture](docs/architecture.md)
-- [Developer Guide](docs/developer-guide.md)
-- [App Developer Guide](docs/app-developer-guide.md)
-- [App Manifest Spec](docs/app-manifest-spec.md)
-- [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md)
-- [Troubleshooting](docs/troubleshooting.md)
+### Mesh Networking (tri-protocol)
+- **Meshtastic**, **MeshCore**, and **Reticulum (RNS/LXMF)** LoRa transports behind one mesh chat UI
+- End-to-end encryption with X3DH key agreement + double-ratchet
+- RNode radio support with an OS-level `archy-rnodeconf` tool; interop verified against Sideband
+- Image/voice attachments, mesh AI assistant (`!ai`), Bitcoin balance relay over mesh
 
-## Quick start
+### Decentralized Identity
+- Ed25519 node identity with DID Documents (did:key)
+- Multi-identity management (Personal/Business/Anonymous)
+- W3C Verifiable Credentials issuance and verification
+- Nostr integration: NIP-33 node discovery, NIP-44/NIP-04 encryption, NIP-07 signer bridge for iframe apps, relay hosting
+- Decentralized Web Node (DWN) record sync between federated nodes over Tor
 
-### Frontend
+### Multi-Node Federation
+- Invite-based node joining over Tor hidden services
+- Trust levels (Trusted/Verified/Untrusted) with DID-based auth
+- State sync and app deployment across federated nodes
+- File sharing with access controls (free/peers-only/paid via Lightning, on-chain, or ecash)
+
+### System Updates
+- OTA updates from a self-hosted Gitea release server, Ed25519-signature-verified against a pinned release-root key
+- Resumable downloads, automatic pre-update backup, rollback with a post-update self-verify window
+- Manual, scheduled-check, and auto-apply modes (auto-apply refuses unsigned manifests)
+
+### Security
+- Argon2id password hashing (transparent upgrade from legacy hashes), ChaCha20-Poly1305 encrypted secrets at rest
+- Rootless Podman: read-only root, cap-drop ALL with a reviewed allow-list, no-new-privileges
+- Signed release manifests and signed app catalog (Ed25519, pinned trust anchor)
+- TOTP two-factor authentication, per-endpoint rate limiting, CSRF protection
+- AppArmor profiles for container confinement; Tor hidden services for inter-node traffic
+- Independent security audit of an early version archived in [`docs/archive/`](docs/archive/security-code-audit-2026-03.md); top findings since remediated
+
+## Roadmap
+
+**Done**
+- Single-node production gate **green** — install / stop / start / restart / reinstall / reboot-survive / uninstall, 5 consecutive full runs with zero failures on real hardware
+- Quadlet migration validated (all backends as `user.slice` services on the canary node)
+- Release signing ceremony completed — release-root key pinned, catalog and OTA manifests signed
+- Reticulum third mesh transport (real-RF LoRa gates passed), Bitcoin Core/Knots multi-version switching, decentralized marketplace backend, public demo
+
+**In progress**
+- Multinode pass: the same production gate across the whole test fleet ([`docs/multinode-testing-plan.md`](docs/multinode-testing-plan.md))
+- Quadlet default flip fleet-wide + container-flapping elimination
+- 1.8.0 release hardening tail ([`docs/1.8.0-RELEASE-HARDENING-PLAN.md`](docs/1.8.0-RELEASE-HARDENING-PLAN.md)): OTA upgrade soak on real hardware, ISO/image hardening (per-device keys, no default creds, signed ISO)
+
+**Planned**
+- Developer CLI (`archy app validate/render/install/test`) to open third-party app publishing
+- External marketplace trust UX + publishing tooling ([`docs/marketplace-protocol.md`](docs/marketplace-protocol.md))
+- DHT/P2P distribution of releases and app images ([`docs/dht-distribution-design.md`](docs/dht-distribution-design.md))
+- P2P encrypted voice/video over Tor, dual-ecash (Fedimint + Cashu) phases, paid streaming, hardware signer support
+
+The live, priority-ordered task list is [`docs/UNIFIED-TASK-TRACKER.md`](docs/UNIFIED-TASK-TRACKER.md); the full narrative plan is [`docs/PRODUCTION-MASTER-PLAN.md`](docs/PRODUCTION-MASTER-PLAN.md).
+
+## Quick Start
+
+### Install from ISO
+
+1. Build or download the ISO for your architecture (x86_64 or ARM64) — see [`image-recipe/`](image-recipe/)
+2. Flash to USB drive with Balena Etcher or `dd`
+3. Boot from USB on target hardware and follow the automated installer
+4. Access the web UI at `http://<device-ip>`
+5. Set your password and complete the onboarding wizard (seed backup, DID identity)
+
+### Supported Hardware
+
+| Platform | Examples | Minimum |
+|----------|----------|---------|
+| **x86_64** | Intel NUC, mini PCs, any 64-bit PC | 4GB RAM, 32GB storage |
+| **ARM64** | Raspberry Pi 5, ARM64 SBCs | 4GB RAM, 32GB storage |
+
+**Recommended**: 8GB+ RAM, 1TB+ NVMe SSD (for a full Bitcoin node). Optional: an RNode-compatible LoRa radio for mesh networking.
+
+## Development
+
+### Prerequisites
+- macOS or Linux for frontend development
+- Linux dev server (Debian 13) for backend builds — **never build Rust on macOS for Linux**
+- Node.js 20+, Rust stable toolchain
+
+### Frontend Development
 
 ```bash
 cd neode-ui
 npm install
-npm start
+npm start          # Dev server on http://localhost:8100 (mock backend on :5959)
+npm run type-check # TypeScript validation
+npm run build      # Production build → web/dist/neode-ui/
 ```
 
-The dev UI runs at `http://localhost:8100` with a mock backend on `:5959`.
-
-### Backend
+### Backend Development
 
 ```bash
-cd core
+cd core            # Rust workspace root (no Cargo.toml at repo root)
 cargo build
-cargo test --all-features
+cargo test
 ```
 
-Linux is the supported backend runtime and release-build target. macOS is fine
-for frontend work and many Rust compile/test loops, but host integration tests
-that touch Podman, systemd, networking, or image build paths require Linux.
-
-### App manifests
+### Deploy to a Test Node
 
 ```bash
-./scripts/validate-app-manifest.sh apps/filebrowser/manifest.yml
-python3 scripts/generate-app-catalog.py
-python3 scripts/check-app-catalog-drift.py --release --strict
+./scripts/deploy-to-target.sh --live   # Deploy to primary dev server
+./scripts/deploy-to-target.sh --both   # Deploy to both LAN servers
 ```
 
-`scripts/generate-app-catalog.py` requires Python with PyYAML installed.
+### Release (tarball-only)
 
-## Documentation map
+Releases ship as a backend binary and a frontend tarball referenced by
+`releases/manifest.json`, published to the self-hosted Gitea release server.
 
-The full, grouped index lives at **[docs/README.md](docs/README.md)**. The most
-common entry points:
+```bash
+./scripts/create-release.sh 1.2.3
+git push origin main --tags
+```
+
+## Architecture
+
+```
+Debian 13 (Trixie)
+  ├── Rootless Podman — every app a systemd Quadlet unit under user.slice
+  ├── Nginx (reverse proxy, security headers, rate limiting)
+  ├── Rust Backend (JSON-RPC API on 127.0.0.1:5678, ~380 RPC methods)
+  │     ├── core/archipelago/  — API, orchestrator + reconciler, mesh, identity,
+  │     │                        federation, wallet, updates, marketplace
+  │     ├── core/container/    — Podman client, manifest schema, Quadlet compiler,
+  │     │                        health monitor, signed app catalog
+  │     ├── core/security/     — AppArmor/seccomp policy, secrets manager
+  │     ├── core/openwrt/      — TollGate gateway provisioning (SSH/UCI)
+  │     └── core/performance/  — resource limits
+  ├── Vue 3 Frontend (Composition API + TypeScript strict + Pinia + Tailwind, PWA)
+  │     └── Three UI modes (Pro/Easy/Chat) + gamepad navigation + i18n
+  ├── Reticulum daemon (supervised Python/PyInstaller, one per LoRa radio)
+  └── System Tor (hidden services, SOCKS5 proxy)
+```
+
+~117,000 lines of Rust | ~69,000 lines of TypeScript/Vue | 51 packaged apps | Android companion app
+
+## Documentation
 
 | Doc | Purpose |
 |-----|---------|
-| [Architecture](docs/architecture.md) | System layers, crates, data paths, security model |
-| [Developer Guide](docs/developer-guide.md) | Local setup, code workflow, testing |
-| [API Reference](docs/api-reference.md) | JSON-RPC API overview |
-| [App Developer Guide](docs/app-developer-guide.md) | How to package and test apps |
-| [App Manifest Spec](docs/app-manifest-spec.md) | Manifest schema and validation rules |
-| [Nostr Git Source Hosting Plan](docs/nostr-git-source-hosting.md) | ngit/NIP-34 contribution workflow and maintainer model |
-| [Apps README](apps/README.md) | Packaged app catalog overview |
-| [Image Recipe](image-recipe/README.md) | Bootable image build flow |
-| [Roadmap](docs/ROADMAP.md) | Shipped, in-progress, and planned work |
-| [Archive](docs/archive/) | Historical plans, audits, and handoffs |
+| [Architecture](docs/architecture.md) | System design, crate map, data paths |
+| [Developer Guide](docs/developer-guide.md) | Dev setup, workflow, code conventions |
+| [API Reference](docs/api-reference.md) | RPC endpoint reference |
+| [App Developer Guide](docs/app-developer-guide.md) | Building and publishing apps |
+| [App Manifest Spec](docs/app-manifest-spec.md) | The `manifest.yml` schema |
+| [User Walkthrough](docs/user-walkthrough.md) | End-user installation and usage guide |
+| [Troubleshooting](docs/troubleshooting.md) | Diagnostic scenarios and solutions |
+| [Operations Runbook](docs/operations-runbook.md) | Ops commands and emergency recovery |
+| [Production Master Plan](docs/PRODUCTION-MASTER-PLAN.md) | North star and workstream narrative |
+| [Unified Task Tracker](docs/UNIFIED-TASK-TRACKER.md) | Live, priority-ordered open items |
+| [Test Gate](tests/lifecycle/TESTING.md) | Production lifecycle test gate (definition of done) |
+| [Archive](docs/archive/) | Historical audits, session logs, shipped designs |
 
 ## Contributing
 
-Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. For
-security issues, follow [SECURITY.md](SECURITY.md) and do not open a public
-issue.
+1. Fork the repository
+2. Create a feature branch (`feature/description`)
+3. Follow the coding standards in [CONTRIBUTING.md](CONTRIBUTING.md) and [CLAUDE.md](CLAUDE.md)
+4. Submit a pull request
 
 ## License
 
-Archipelago is licensed under the [MIT License](LICENSE). Third-party notices
-are listed in [NOTICE](NOTICE) and generated license inventories in component
-release artifacts.
+[MIT License](LICENSE)
+
+## Acknowledgments
+
+Built with: [Rust](https://www.rust-lang.org/), [Vue.js](https://vuejs.org/), [Podman](https://podman.io/), [Bitcoin Core](https://bitcoin.org/), [LND](https://lightning.engineering/), [Reticulum](https://reticulum.network/), [Debian](https://www.debian.org/)

RELEASE-NOTES-v1.0.0.md

@@ -0,0 +1,112 @@
+# Archipelago v1.0.0 Release Notes
+
+**Release Date**: March 2026
+**Target Platform**: Debian 13 (Trixie) — x86_64 and ARM64
+
+## What is Archipelago?
+
+Archipelago is a self-sovereign Bitcoin Node OS. Flash it to a USB drive, install on any x86_64 or ARM64 machine, and manage your personal server through a modern web interface. Run Bitcoin infrastructure, self-hosted apps, and Web5 identity — all from hardware you control.
+
+## Key Features
+
+### Bitcoin Infrastructure
+- **Bitcoin Knots** full node with pruning support
+- **LND** Lightning Network daemon with channel management UI
+- **Electrs** Electrum server for wallet connectivity
+- **BTCPay Server** for accepting Bitcoin payments
+- **Mempool** block explorer and fee estimator
+- **Fedimint** federation guardian and gateway
+
+### Self-Hosted Apps (20+)
+- **Storage**: File Browser, Immich, PhotoPrism, Nextcloud
+- **Productivity**: Penpot, OnlyOffice, Vaultwarden
+- **Media**: Jellyfin
+- **Search**: SearXNG (private search)
+- **AI**: Ollama (local LLMs with Claude, GPT, and open models)
+- **Network**: Tailscale VPN, Nginx Proxy Manager, Uptime Kuma
+- **Home**: Home Assistant
+- **Platform**: IndeedHub, Grafana monitoring
+
+### Web5 Identity
+- DID-based digital identity (Ed25519 + secp256k1 dual key)
+- Verifiable Credentials issuance and verification
+- Decentralized Web Node (DWN) for data sync
+- Nostr relay integration for node discovery
+
+### Federation
+- DID-authenticated peer-to-peer federation
+- Remote node monitoring and management
+- Bilateral trust with single-use invite codes
+- Tor hidden services for private communication
+
+### Security
+- AES-256-GCM encrypted secrets at rest
+- Container isolation: read-only root, capability dropping, non-root user
+- TOTP two-factor authentication with backup codes
+- Session management: HttpOnly cookies, SameSite=Strict, CSRF tokens
+- Rate limiting on sensitive endpoints
+- AppArmor profiles for container confinement
+- Per-endpoint input validation
+
+### System
+- Rust backend with JSON-RPC API (<1ms response time)
+- Vue 3 frontend with glassmorphism design
+- WebSocket real-time updates
+- Automated OTA updates with rollback
+- Tor hidden services for all apps
+- Goal-based onboarding wizard
+- Kiosk mode for dedicated hardware
+
+## Supported Hardware
+
+- **x86_64**: Any 64-bit PC, Intel NUC, mini PCs
+- **ARM64**: Raspberry Pi 5, other ARM64 SBCs
+- **Minimum**: 4GB RAM, 32GB storage (500GB+ recommended for Bitcoin)
+- **Recommended**: 8GB+ RAM, 1TB+ NVMe SSD
+
+## Installation
+
+1. Download the ISO for your architecture
+2. Flash to USB drive (use Balena Etcher or `dd`)
+3. Boot from USB on target hardware
+4. Follow the automated installer
+5. Access the web UI at `http://<device-ip>`
+6. Set your password and start the onboarding wizard
+
+## Known Limitations
+
+- Bitcoin initial block download takes 3-7 days depending on hardware
+- Some apps (BTCPay Server, Home Assistant) open in new tab due to X-Frame-Options
+- ARM64 builds may have slower container pulls due to less cached registry content
+- Tor hidden service generation takes 1-2 minutes on first boot
+
+## Upgrade from Beta
+
+If upgrading from v0.5.0-beta:
+1. Back up your data via Settings > Backup
+2. The OTA update system will handle the upgrade automatically
+3. If OTA fails, reflash with the v1.0.0 ISO (app data is preserved on separate partition)
+
+## Security Model
+
+Archipelago follows defense-in-depth:
+- **Network**: Nginx reverse proxy, Tor hidden services, VPN support
+- **Application**: Container isolation with Podman (rootless)
+- **Data**: AES-256-GCM encryption for secrets, 0600 file permissions
+- **Auth**: Argon2 password hashing, TOTP 2FA, session rotation
+- **Updates**: SHA-256 verified downloads with rollback capability
+
+See `docs/adr/` for architectural decision records on security choices.
+
+## Contributing
+
+Archipelago is open source. To contribute:
+1. Fork the repository
+2. Create a feature branch (`feature/description`)
+3. Follow the coding standards in `CLAUDE.md`
+4. Submit a pull request with tests
+
+## License
+
+MIT License. See `LICENSE` for details.
+# 2026-04-18 ISO build trigger

SECURITY.md

@@ -1,38 +0,0 @@
-# Security Policy
-
-## Reporting vulnerabilities
-
-Please do not open a public issue for a security vulnerability.
-
-Until a dedicated security intake address is published, report privately to the
-project maintainer through the repository owner account or the private contact
-channel listed on the project homepage.
-
-Include:
-
-- affected commit, version, or release;
-- affected component;
-- reproduction steps;
-- expected impact;
-- logs, proof of concept, or packet captures when relevant;
-- whether the issue is already public.
-
-We aim to acknowledge credible reports within 48 hours and coordinate fixes
-before public disclosure.
-
-## Scope
-
-Security-sensitive areas include:
-
-- authentication, session handling, CSRF, and rate limiting;
-- release and app-catalog signature verification;
-- container manifest validation and runtime compilation;
-- Podman/Quadlet isolation, capabilities, volumes, and secret injection;
-- backup encryption and key derivation;
-- federation, Tor, Nostr, mesh, DID, and credential flows;
-- Android companion pairing and device-token handling.
-
-## Supported versions
-
-Archipelago is currently pre-1.0 alpha software. Security fixes target the
-current `main` branch and the latest published alpha release.

aiui/.claude/hooks/block-risky-bash.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse Bash guard: block dangerous shell commands.
-# Denies: rm -rf, git reset --hard, git push -f, git clean -fd, chmod -R 777,
-# fork bombs, block device overwrites, mkfs, paths escaping project root.
-# Uses python3 instead of jq for JSON (guaranteed on macOS).
-set -euo pipefail
-
-INPUT=$(cat)
-CMD=$(python3 -c "
-import json, sys
-try:
-    data = json.loads(sys.stdin.read())
-    print(data.get('tool_input', {}).get('command', ''))
-except: pass
-" <<< "$INPUT")
-BASE="${CLAUDE_PROJECT_DIR:-}"
-[[ -z "$BASE" ]] && BASE=$(python3 -c "
-import json, sys
-try:
-    data = json.loads(sys.stdin.read())
-    print(data.get('cwd', ''))
-except: pass
-" <<< "$INPUT")
-[[ -z "$BASE" ]] && BASE="$(pwd)"
-
-# Normalize: collapse whitespace, strip leading/trailing
-CMD_NORM=$(echo "$CMD" | tr -s '[:space:]' ' ' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-
-deny() {
-  local reason="$1"
-  python3 -c "
-import json
-print(json.dumps({
-    'hookSpecificOutput': {
-        'hookEventName': 'PreToolUse',
-        'permissionDecision': 'deny',
-        'permissionDecisionReason': '$reason'
-    }
-}))
-"
-  exit 0
-}
-
-# Dangerous patterns (case-insensitive where sensible)
-case "$CMD_NORM" in
-  *"rm -rf"*|*"rm -fr"*|*"rm -f -r"*|*"rm -r -f"*)  deny "Destructive rm -rf blocked by security hook" ;;
-  *"git reset --hard"*)                               deny "git reset --hard would lose uncommitted work" ;;
-  *"git push --force"*|*"git push -f"*|*"git push -f "*) deny "git push --force would rewrite history" ;;
-  *"git clean -fd"*|*"git clean -f -d"*)             deny "git clean -fd deletes untracked files" ;;
-  *"chmod -R 777"*|*"chmod -R 0777"*)                deny "chmod -R 777 is a security risk" ;;
-  *":(){ :"*"};:"*)                                   deny "Fork bomb pattern blocked" ;;
-  *"> /dev/sd"*|*">/dev/sd"*)                        deny "Block device overwrite blocked" ;;
-  *"mkfs "*|*"mkfs."*)                               deny "Disk format command blocked" ;;
-esac
-
-# Check for path traversal escaping project root (../ outside project)
-# Only if we have a sensible base
-if [[ -n "$BASE" ]] && [[ -d "$BASE" ]]; then
-  # Simple heuristic: command contains .. and would resolve outside project
-  if echo "$CMD_NORM" | grep -qE '\.\./|/\.\.'; then
-    # Extract plausible paths and check - allow ../ within project
-    if echo "$CMD_NORM" | grep -qE '(rm|mv|cp|cat|chmod|chown)\s+.*\.\.'; then
-      # Could be risky; be conservative for rm/mv/cp
-      if echo "$CMD_NORM" | grep -qE '\brm\b.*\.\.'; then
-        deny "Path traversal with rm blocked"
-      fi
-    fi
-  fi
-fi
-
-exit 0

aiui/.claude/hooks/post-push-progress.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-# PostToolUse Bash hook: detect git push/commit and prompt Claude to update PROGRESS.md.
-# Returns structured feedback with recent commits so Claude can write a session log entry.
-# Uses python3 instead of jq for JSON (guaranteed on macOS).
-set -euo pipefail
-
-INPUT=$(cat)
-
-# Extract command from JSON using python3
-CMD=$(python3 -c "
-import json, sys
-try:
-    data = json.loads(sys.stdin.read())
-    print(data.get('tool_input', {}).get('command', ''))
-except: pass
-" <<< "$INPUT")
-
-# Only trigger on git push or git commit commands
-if ! echo "$CMD" | grep -qE '\bgit\s+(push|commit)\b'; then
-  exit 0
-fi
-
-# Gather context for the progress update
-BASE="${CLAUDE_PROJECT_DIR:-$(pwd)}"
-BRANCH=$(git -C "$BASE" branch --show-current 2>/dev/null || echo "unknown")
-PROGRESS_FILE="$BASE/PROGRESS.md"
-TIMESTAMP=$(date '+%Y-%m-%d %H:%M')
-
-# Get recent commits (branch vs main, or last 10)
-if git -C "$BASE" rev-parse --verify main &>/dev/null; then
-  COMMITS=$(git -C "$BASE" log --oneline main..HEAD 2>/dev/null | head -15)
-  if [ -z "$COMMITS" ]; then
-    COMMITS=$(git -C "$BASE" log --oneline -10 2>/dev/null)
-  fi
-else
-  COMMITS=$(git -C "$BASE" log --oneline -10 2>/dev/null)
-fi
-
-# Get changed files in recent commits
-CHANGED_FILES=$(git -C "$BASE" diff --name-only main..HEAD 2>/dev/null | head -20 || \
-  git -C "$BASE" diff --name-only HEAD~5..HEAD 2>/dev/null | head -20 || \
-  echo "unknown")
-
-# Build the feedback message and output as JSON using python3
-python3 -c "
-import json, sys
-
-message = '''Progress Update Needed
-
-A git push/commit was detected on branch \`$BRANCH\` at $TIMESTAMP.
-
-Recent commits:
-\`\`\`
-$COMMITS
-\`\`\`
-
-Changed files:
-\`\`\`
-$CHANGED_FILES
-\`\`\`
-
-Please update PROGRESS.md:
-1. Add a session log entry under '## Session Log' with format: ### $TIMESTAMP — $BRANCH
-2. Summarize what was accomplished (2-4 bullet points based on the commits above)
-3. Update any roadmap checkboxes if tasks were completed
-4. Commit the PROGRESS.md update'''
-
-output = {
-    'hookSpecificOutput': {
-        'hookEventName': 'PostToolUse',
-        'progressUpdate': message
-    }
-}
-print(json.dumps(output))
-"

aiui/.claude/hooks/protect-files.sh

@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse Edit|Write guard: block edits outside project and to protected paths.
-# Denies: paths outside project, .git/, .env*, lockfiles, node_modules/
-# Uses python3 instead of jq for JSON (guaranteed on macOS).
-set -euo pipefail
-
-INPUT=$(cat)
-FILE_PATH=$(python3 -c "
-import json, sys
-try:
-    data = json.loads(sys.stdin.read())
-    print(data.get('tool_input', {}).get('file_path', ''))
-except: pass
-" <<< "$INPUT")
-BASE="${CLAUDE_PROJECT_DIR:-}"
-[[ -z "$BASE" ]] && BASE=$(python3 -c "
-import json, sys
-try:
-    data = json.loads(sys.stdin.read())
-    print(data.get('cwd', ''))
-except: pass
-" <<< "$INPUT")
-[[ -z "$BASE" ]] && BASE="$(pwd)"
-
-# Resolve to absolute path
-if [[ -z "$FILE_PATH" ]]; then
-  exit 0
-fi
-ABS_BASE=$(cd "$BASE" 2>/dev/null && pwd) || true
-[[ -z "$ABS_BASE" ]] && ABS_BASE=$(python3 -c "import os,sys; print(os.path.abspath(os.path.normpath(sys.argv[1])))" "$BASE" 2>/dev/null) || true
-[[ -z "$ABS_BASE" ]] && ABS_BASE="$BASE"
-# Ensure base has trailing slash for prefix check
-[[ "$ABS_BASE" != */ ]] && ABS_BASE="${ABS_BASE}/"
-if [[ "$FILE_PATH" != /* ]]; then
-  ABS_PATH="$ABS_BASE${FILE_PATH#./}"
-else
-  ABS_PATH="$FILE_PATH"
-fi
-# Normalize path (collapse .. and ., no symlink resolution needed)
-ABS_PATH=$(python3 -c "import os,sys; print(os.path.abspath(os.path.normpath(sys.argv[1])))" "$ABS_PATH" 2>/dev/null) || true
-[[ -z "$ABS_PATH" ]] && ABS_PATH="$ABS_BASE${FILE_PATH#./}"
-
-deny() {
-  local reason="$1"
-  echo "Blocked: $ABS_PATH — $reason" >&2
-  python3 -c "
-import json
-print(json.dumps({
-    'hookSpecificOutput': {
-        'hookEventName': 'PreToolUse',
-        'permissionDecision': 'deny',
-        'permissionDecisionReason': '$reason'
-    }
-}))
-"
-  exit 0
-}
-
-# Protected patterns (path contains or equals)
-PROTECTED_PATTERNS=(
-  ".git/"
-  ".env"
-  ".env.local"
-  "node_modules/"
-  "package-lock.json"
-  "pnpm-lock.yaml"
-)
-
-for pattern in "${PROTECTED_PATTERNS[@]}"; do
-  if [[ "$ABS_PATH" == *"$pattern"* ]] || [[ "$ABS_PATH" == *"/$pattern" ]]; then
-    deny "Edit blocked: path matches protected pattern ($pattern)"
-  fi
-done
-
-# .env.*.local
-if [[ "$ABS_PATH" =~ \.env\..*\.local$ ]]; then
-  deny "Edit blocked: .env.*.local files contain secrets"
-fi
-
-# Ensure path is under project root (ABS_BASE has trailing /)
-if [[ "$ABS_PATH" != "$ABS_BASE"* ]] && [[ "$ABS_PATH" != "$BASE"* ]]; then
-  deny "Edit blocked: path is outside project directory"
-fi
-
-exit 0

aiui/.claude/launch.json

@@ -1,12 +0,0 @@
-{
-  "version": "0.0.1",
-  "configurations": [
-    {
-      "name": "app",
-      "runtimeExecutable": "bash",
-      "runtimeArgs": ["packages/app/scripts/dev.sh"],
-      "port": 5173,
-      "autoPort": true
-    }
-  ]
-}

aiui/.claude/memory/MEMORY.md

@@ -1,61 +0,0 @@
-# AIUI Project Memory
-
-## Session Startup
-1. Run `preview_start` with name `"app"` immediately — runs both Vite (:5173) + Claude proxy (:3141) via `packages/app/scripts/dev.sh`
-2. Always commit work before ending a session
-3. Work on `development` branch, merge to `main` only when production ready
-
-## User Preferences
-- NO worktrees, NO temporary branches — just `development` and `main`
-- Always use combined dev script (proxy + frontend), never bare `vite`
-- Commit frequently to avoid losing work
-
-## Current State (2026-03-04)
-- Branch: `overnight/2026-03-03`, all committed and pushed to remote (git.tx1138.com)
-- Typecheck passes clean
-
-## What's Been Built
-- Chat: AI streaming with stop generation, web search, article integration, paste & extract
-- Content panel tabs: Films, Music, Magazine, News, Books, TV Series, Images, Places, Code, Design System, Nostr, **Apps**
-- Detail views for each content type (side-by-side desktop, overlay mobile)
-- **Apps tab**: curated DB of ~30 Nostr/Bitcoin apps, AppsGrid + AppDetail with search/category filtering/how-to
-- Design system viewer (grid + detail) for tokens, colors, typography, components
-- Nostr feed scaffold with note/article/zap filtering
-- Content extraction: contentExtraction.ts + contentFiltering.ts (overhauled classifiers)
-- **Bare domain extraction** from AI text (e.g. "check out damus.io")
-- Banner fallback composable (primary → API → gradient)
-- Image fallbacks: Wikipedia + Google Books sources
-- Loading skeletons per content type variant
-- Project grid with breadcrumb nav and inline creation
-- Filesystem Vite plugin for local project browsing
-- PWA with star icon, TMDB proxy, Jamendo for music
-- **Slash command palette**: /code, /nostr, /design, /search show in palette with auto-send
-- **Chat action buttons**: wrapped in glass container (backdrop blur, border, shadow)
-- **Settings modal**: Memory + Advanced Settings via gear icon
-- **Chat history**: dedicated clock icon button
-- **Web search**: Brave API primary, SearXNG rotation fallback, DuckDuckGo fallback
-- iOS HIG mobile UX rules in `.cursor/rules/15-mobile-ux.mdc`
-
-## Key Files
-- Dev script: `packages/app/scripts/dev.sh`
-- Launch config: `.claude/launch.json` (name: "app")
-- Main page: `packages/app/src/pages/ChatPage.vue`
-- Content panel: `packages/app/src/components/content/ContentPanel.vue`
-- Content grids: `packages/app/src/components/content/*Grid.vue`
-- Detail views: `packages/app/src/components/content/*Detail.vue`
-- **Apps**: `packages/app/src/data/apps.ts` (curated DB), `AppsGrid.vue`, `AppDetail.vue`
-- AI composable: `packages/app/src/composables/useAI.ts`
-- Content extraction: `packages/app/src/composables/contentExtraction.ts`
-- Content filtering: `packages/app/src/composables/contentFiltering.ts`
-- Content panel logic: `packages/app/src/composables/useContentPanel.ts`
-- Image fallbacks: `packages/app/src/composables/useImageFallback.ts`
-- Banner fallback: `packages/app/src/composables/useBannerFallback.ts`
-- Chat input: `packages/app/src/components/chat/ChatInput.vue`
-- Prompt palette: `packages/app/src/components/chat/PromptPalette.vue`
-- Chat message: `packages/app/src/components/chat/ChatMessage.vue`
-- Settings modal: `packages/app/src/components/chat/SettingsModal.vue`
-- Web search plugin: `packages/app/vite-web-search.ts`
-- Prompt templates store: `packages/app/src/stores/promptTemplates.ts`
-
-## Recent Session Work (2026-03-04)
-See `session-2026-03-04.md` for details.

aiui/.claude/memory/code-mode-ui.md

@@ -1,18 +0,0 @@
-# Code Mode UI — Future Work
-
-## After content surfacing is complete, implement:
-
-### 1. Code Mode Visual Treatment
-- Colour the message container in orange (`#F7931A`) styling when in code mode
-- Change header text from "Message AIUI" to "Code"
-- Visual signal so user knows they're in coding context
-
-### 2. Design System Context Selection
-- All design system items should be selectable with a cursor/pointer icon on hover
-- Selecting a design system item provides that UI context to the code generation
-- Think of it as "code with this component/token in mind"
-
-### 3. File Browser / Open File Context
-- File browser or open file in the content panel
-- Selected files provide context for coding
-- Pairs with the design system selection — user picks UI + files as coding context

aiui/.claude/memory/session-2026-03-04.md

@@ -1,66 +0,0 @@
-# Session 2026-03-04
-
-## Completed This Session
-
-### 1. Chat UX Changes
-- **History button**: Changed from title-click dropdown to dedicated clock icon in ChatHeader
-- **Settings modal**: Created `SettingsModal.vue` — Memory + Advanced Settings behind gear icon, glass-card with backdrop blur
-- **PromptIndex fix**: Reverted to original behavior (current conversation only), fixed broken v-if/v-else chain where StreamingDots broke the template chain
-- **Chat action buttons**: Wrapped hover icons in proper glass container (`bg-black/60 backdrop-blur-md border border-white/10`) with divider between actions and thumbs
-
-### 2. iOS HIG Integration
-- Created `.cursor/rules/15-mobile-ux.mdc` with comprehensive iOS HIG values
-- Updated CLAUDE.md Mobile UX section
-
-### 3. Web Search Fix
-- All SearXNG instances were returning 429, DuckDuckGo rate-limiting
-- Added Brave Search API as primary backend (`BRAVE_SEARCH_API_KEY` env var)
-- Expanded SearXNG pool to 8 instances with rotation
-- Added HTML response guard for captcha pages
-
-### 4. Content Detection Overhaul (MAJOR)
-- **Expanded all classifiers** in `contentFiltering.ts`: isNewsQuery, isMusicQuery, isBookQuery, isTVQuery, isPlaceQuery, isWebsitesQuery + response variants
-- **Added Nostr detection**: `isNostrQuery()`, `isNostrLikeResponse()`
-- **Added App detection**: `isAppQuery()`, `isAppLikeResponse()`
-- **Updated `filterTabsByContext()`**: new `hasNostr` + `hasApps` params, nostr/app query priority
-- **Updated `preferredFirstTab()`**: nostr + app checks
-
-### 5. Bare Domain Extraction
-- `extractBareDomainLinks(text)` in contentExtraction.ts
-- Detects plain domains like "damus.io" not inside markdown/bold/URL patterns
-- Known TLDs whitelist, file extension blacklist
-
-### 6. Apps Tab (NEW FEATURE)
-- **Database**: `packages/app/src/data/apps.ts` — AppEntry interface, ~30 curated apps
-  - Nostr clients: Damus, Primal, Snort, Amethyst, Coracle, Iris, noStrudel
-  - Lightning wallets: Phoenix, Breez, Zeus, Alby, Mutiny, WoS
-  - Bitcoin wallets: Sparrow, BlueWallet, Nunchuk, Coldcard
-  - Privacy: SimpleX Chat, Signal, Mullvad VPN
-  - Node software: Start9, Umbrel, RaspiBlitz, myNode
-  - Dev tools: NDK, nostr-tools, Nak
-- **Extraction**: `extractApps(text, userQuery)` — keyword matching against DB, surfaces with 1+ match for app/nostr/known-app queries, 2+ for general
-- **UI**: `AppsGrid.vue` (list with search/category filter), `AppDetail.vue` (gradient header, how-to steps, related apps, external link)
-- **Wired in**: useContentPanel.ts (panelApps ref, selectedApp, open/close), ContentPanel.vue (registered), PromptIndex badges
-
-### 7. Slash Command Palette
-- `/code`, `/nostr`, `/design`, `/search` appear as commands in PromptPalette
-- Commands section above Templates section with `/slash` prefix styling
-- Auto-send on select (except `/search` which sets text for query input)
-- 8px side margins (`left-2 right-2`), no max-height scroll limit
-- `ChatInput.vue`: simplified `isPaletteMode` — no longer excludes command names
-
-### 8. App Detection Fix
-- Queries mentioning known app names (e.g. "start9") now match via `queryMatchesApp` check
-- Previously required explicit app/nostr query patterns like "what app" or "best wallet"
-
-## Known Issues / TODO for Next Session
-- User reported "start9" search shows Brief but Apps tab was empty — FIXED in last commit
-- The `/design` command was added to palette and ChatWindow handleSend
-- Consider adding more apps to the curated database over time
-- The plan file is at `.claude/plans/content-detection-overhaul.md` (all steps complete)
-
-## Git State
-- Branch: `overnight/2026-03-03`
-- Latest commit: `f346992` — feat(chat): slash command palette, action button containers, app detection fix
-- Previous commit: `84ccdc7` — feat(app): content detection overhaul, apps tab, chat UX, web search
-- All pushed to origin

aiui/.claude/plans/content-detection-overhaul.md

@@ -1,160 +0,0 @@
-# Plan: Overhaul Content Detection + Add Apps Tab
-
-## Context
-
-The content surfacing system misses many common AI response patterns. Example: AI responds about Nostr (mentioning damus.io, primal.net, snort.social) but the Nostr tab never surfaces. Query/response classifiers use narrow regexes that miss natural language variations. There's no "topic detection" layer, no app detection, and bare domains in AI text aren't extracted as websites.
-
-**Goals:**
-1. Fix content detection to handle how AIs actually respond
-2. Add Nostr tab surfacing (currently only via `/nostr` command)
-3. Add Apps tab with curated Nostr + Bitcoin ecosystem apps (local DB + AI extraction fallback)
-4. Extract bare domains from AI text (e.g. "check out damus.io")
-
----
-
-## Part 1: Expand Query & Response Classifiers
-
-**File:** `packages/app/src/composables/contentFiltering.ts`
-
-### 1A. Add Nostr classifiers (new functions)
-
-- `isNostrQuery(q)` — matches: nostr, npub, nip-\d, damus, primal, snort, amethyst, coracle, zap, relay, note1, nevent, nprofile, fiatjaf, nostrich, "decentralized social"
-- `isNostrLikeResponse(text)` — requires literal "nostr" OR 2+ Nostr-specific signals (npub, nip-, client names, relay+wss, zap+lightning)
-
-### 1B. Add App classifiers (new functions)
-
-- `isAppQuery(q)` — matches: app, client, wallet, tool, software, download, install, "what app", "best app for", "recommend.*app"
-- `isAppLikeResponse(text)` — matches: "you can use", "popular clients include", "I'd recommend", "available on", "download from"
-
-### 1C. Expand existing classifiers with broader patterns
-
-| Classifier | Add these patterns |
-|---|---|
-| `isNewsQuery` | "what happened today", "any updates on", "trending", "catch me up", "brief me", "current events" |
-| `isMusicQuery` | "genre", "spotify", "bandcamp", "grammys", "billboard", "mixtape", "discography", "banger", "favorite jam" |
-| `isBookQuery` | "what should I read", "favorite reads", "reading list", "book club", "memoir", "audiobook", "goodreads", "worth reading" |
-| `isTVQuery` | "what's good on netflix", "anything to binge", "hbo", "disney+", "apple tv", "amazon prime", "docuseries", "limited series" |
-| `isPlaceQuery` | "hungry", "food near me", "best brunch spot", "happy hour", "speakeasy", "rooftop bar", "food truck" |
-| `isWebsitesQuery` | "point me to", "link me", "any good sites", "tools for", "platforms for" |
-| `isWebsitesLikeResponse` | "here are some resources", "I'd recommend checking", "you can visit", "useful resources" |
-| `isNewsLikeResponse` | "I can't access the web but", "having trouble reaching", "unable to browse but" |
-
-### 1D. Update `preferredFirstTab()` — add nostr + app checks
-
-### 1E. Update `filterTabsByContext()` — add `hasNostr` and `hasApps` params, integrate into tab ordering
-
----
-
-## Part 2: Bare Domain Extraction
-
-**File:** `packages/app/src/composables/contentExtraction.ts`
-
-Add `extractBareDomainLinks(text)`:
-- Detect plain-text domains like "damus.io", "primal.net" not inside markdown links or bold patterns
-- Skip positions covered by existing extractors (markdown links, bold-domain, full URLs)
-- Require known TLDs (.com, .org, .io, .net, .social, .app, etc.)
-- Block file extensions (.js, .ts, .vue, .json, .css)
-- Use existing `normUrl()` for dedup
-
----
-
-## Part 3: Apps Tab — Curated Database + AI Extraction
-
-### 3A. Create app database
-
-**New file:** `packages/app/src/data/apps.ts`
-
-```ts
-interface AppEntry {
-  id: string
-  name: string
-  description: string          // One-liner
-  longDescription: string      // Why use this, how it works
-  category: 'nostr-client' | 'lightning-wallet' | 'bitcoin-wallet' | 'privacy' | 'node' | 'dev-tool' | 'relay'
-  platforms: ('ios' | 'android' | 'web' | 'desktop' | 'cli' | 'nodeos')[]
-  url: string
-  icon?: string
-  keywords: string[]           // For matching AI responses
-  howTo?: string[]             // Getting started steps
-  relatedApps?: string[]       // IDs of related apps
-}
-```
-
-**Initial curated apps (~25-30):**
-- Nostr clients: Damus, Primal, Snort, Amethyst, Coracle, Iris, Nostrudel, nos.social
-- Lightning wallets: Phoenix, Mutiny, Breez, Zeus, Alby, Wallet of Satoshi
-- Bitcoin wallets: Sparrow, Blue Wallet, Nunchuk, Coldcard, Green
-- Privacy tools: Tor, SimpleX Chat, Signal, Mullvad VPN
-- Node software: Start9, Umbrel, RaspiBlitz, myNode
-- Dev tools: NDK, nostr-tools, Nak
-
-### 3B. Add app extraction
-
-**File:** `packages/app/src/composables/contentExtraction.ts`
-
-Add `extractApps(text, userQuery)`:
-1. Match AI text against known app names/keywords from database
-2. If app query detected OR 2+ known apps mentioned → return matched apps
-3. For unknown apps, create basic entries from context (name + URL if bare domain found)
-
-### 3C. Create UI components
-
-**New files:**
-- `packages/app/src/components/content/AppsGrid.vue` — Grid of app cards (icon, name, category badge, one-liner)
-- `packages/app/src/components/content/AppDetail.vue` — Detail: icon, name, platforms, long description, how-to steps, link, related apps
-
-Follow existing grid/detail patterns (e.g. `BookGrid.vue`/`BookDetail.vue`).
-
-### 3D. Register in ContentPanel.vue
-
-Add rendering for `activeTab === 'app'`, add `'app'` to `ContentTab` type.
-
----
-
-## Part 4: Wire Everything Together
-
-**File:** `packages/app/src/composables/useContentPanel.ts`
-
-In `updatePanelFromText()`:
-- Call `extractBareDomainLinks(text)`, merge with website sources
-- Call `extractApps(text, userQuery)`
-- Compute `hasNostr = isNostrQuery(userQuery) || isNostrLikeResponse(text)`
-- Compute `hasApps = apps.length > 0`
-- Pass `hasNostr` and `hasApps` to `filterTabsByContext()`
-- Add `panelApps` ref, title logic for apps/nostr tabs
-
-Same changes in `getContextualInlineContent()`.
-
-Broaden magazine detection: add tech/protocol keywords, surface magazine for 3+ sections with no other structured content.
-
----
-
-## Part 5: PromptIndex badges
-
-**File:** `packages/app/src/components/chat/PromptIndex.vue`
-
-Add 'Nostr' and 'Apps' badge detection.
-
----
-
-## Implementation Order
-
-1. `contentFiltering.ts` — classifiers + filterTabsByContext signature
-2. `contentExtraction.ts` — `extractBareDomainLinks()` + `extractApps()`
-3. `data/apps.ts` — curated app database
-4. `useContentPanel.ts` — wire everything
-5. `AppsGrid.vue` + `AppDetail.vue` — UI components
-6. `ContentPanel.vue` — register tab + components
-7. `PromptIndex.vue` — badges
-8. Typecheck + manual test
-
-## Verification
-
-1. `pnpm typecheck` passes
-2. "tell me about Nostr" → Nostr + magazine tabs surface
-3. "best Nostr clients?" → Apps tab with Damus, Primal, Snort
-4. "recommend a bitcoin wallet" → Apps tab with Phoenix, Sparrow
-5. "what happened with BIP 110?" → Magazine tab (regression)
-6. "best movies of 2024" → Films tab (regression)
-7. Bare domains in AI text extracted as websites
-8. PromptIndex badges show Nostr/Apps

aiui/.claude/plans/fluffy-bouncing-whisper.md

@@ -1,74 +0,0 @@
-# Plan: Code Mode UI — Orange Input, Design System Context, File Browser Context
-
-## Context
-The user wants three connected features that enhance the coding experience in AIUI:
-1. Visual indication when in code mode (orange input container, "Code" label)
-2. Ability to select design system items as coding context
-3. Ability to select files from file browser as coding context
-
-After this, the user wants to circle back and create a flawless version of content extraction/tab surfacing.
-
-## Changes
-
-### 1. Orange Code Mode Input Container
-**Files**: `ChatWindow.vue`, `ChatInput.vue`
-
-**ChatWindow.vue** (line 106-115):
-- Pass `activeTab` to ChatInput as a prop: `:active-tab="activeTab"`
-- Change placeholder logic: `activeTab === 'code' ? 'Code...' : isStreaming ? 'Waiting for response...' : 'Message AIUI...'`
-
-**ChatInput.vue**:
-- Add `activeTab` prop (optional string, default `''`)
-- Conditionally style the container div (line 79-81):
-  - When `activeTab === 'code'`: use `bg-accent/15 border border-accent/25 backdrop-blur-xl` instead of `path-glass-bubble`
-  - Keep the `rounded-2xl px-4 py-3 flex items-end gap-2 transition-all duration-300` classes
-- Conditionally style the send button orange when in code mode
-
-### 2. Design System Item Selection for Coding Context
-**Files**: `useCodeContext.ts`, `DesignSystemGrid.vue`
-
-**useCodeContext.ts**:
-- Add `selectedDesignTokens: ref<string[]>([])` to module state (stores item IDs)
-- Add `toggleDesignToken(id)` — adds/removes from selection array
-- Add `clearDesignTokens()` — clears selection
-- Add `isDesignTokenSelected(id)` — checks if item is in selection
-- Clear on `exitCodeMode()`
-- Export all new state/actions
-
-**DesignSystemGrid.vue**:
-- Import `useCodeContext`
-- When `codeMode` is true, show a selection indicator (accent ring + checkmark) on items
-- `selectItem` should call `toggleDesignToken(item.id)` when in code mode (instead of `openDesignSystemItem`)
-- When NOT in code mode, keep existing behavior (open detail view)
-- Selected items get `ring-2 ring-accent/50 bg-accent/10` styling
-
-### 3. File Browser Selection for Coding Context
-**Files**: `useCodeContext.ts`, `ProjectGrid.vue`
-
-**useCodeContext.ts**:
-- Add `selectedFiles: ref<string[]>([])` — paths of files selected for context
-- Add `toggleFileSelection(path)` — adds/removes from selection
-- Add `clearFileSelection()` — clears all
-- Add `isFileSelected(path)` — checks if file in selection
-- Clear on `exitCodeMode()`
-- Export new state/actions
-
-**ProjectGrid.vue**:
-- Import `useCodeContext`
-- When `codeMode` is true, file clicks toggle selection instead of (or in addition to) opening
-- Show visual selection state (accent highlight/checkmark) on selected files in FileTreeNode
-
-## Files to Modify
-1. `packages/app/src/components/chat/ChatWindow.vue` — pass activeTab prop
-2. `packages/app/src/components/chat/ChatInput.vue` — conditional orange styling + "Code" placeholder
-3. `packages/app/src/composables/useCodeContext.ts` — add design token + file selection state
-4. `packages/app/src/components/content/DesignSystemGrid.vue` — toggle selection in code mode
-5. `packages/app/src/components/content/ProjectGrid.vue` — toggle file selection in code mode
-
-## Verification
-1. `pnpm typecheck` — no type errors
-2. `pnpm lint` — no new lint errors
-3. Manual: `/code` command → input turns orange with "Code..." placeholder
-4. Manual: In code mode, design system tab → clicking items toggles selection (accent ring)
-5. Manual: In code mode, file browser → clicking files toggles selection
-6. Manual: Exiting code mode clears all selections

aiui/.claude/settings.json

@@ -1,35 +0,0 @@
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-risky-bash.sh"
-          }
-        ]
-      },
-      {
-        "matcher": "Edit|Write",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/protect-files.sh"
-          }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/post-push-progress.sh"
-          }
-        ]
-      }
-    ]
-  }
-}

aiui/.claude/skills/add-content-type/SKILL.md

@@ -1,43 +0,0 @@
----
-name: add-content-type
-description: Scaffold a complete new content type (tag, extraction, grid, detail, prompt)
-allowed-tools: Bash(*), Read, Edit, Write, Glob, Grep, Agent
----
-
-Add a complete new content type to AIUI. The user will provide the content type name (e.g., "event", "product", "video").
-
-Follow ALL steps — this is the full pipeline for a content type:
-
-1. **Tag format**: Add a new `[[{type}_ext:Field1|Field2|...]]` regex to `packages/app/src/composables/contentExtraction.ts` alongside the existing ones (FILM_EXT_RE, SONG_EXT_RE, etc.)
-
-2. **Type definition**: Add the TypeScript interface to `packages/core/src/types/content.ts` if it doesn't exist
-
-3. **Extraction function**: Add `extractAll{Type}s(text, userQuery)` to `contentExtraction.ts` following the pattern of `extractAllFilms` or `extractAllBooks`
-
-4. **Strip tags function**: Add `strip{Type}Tags()` and include it in `stripContentTags()`
-
-5. **Query classifier**: Add `is{Type}Query()` and optionally `is{Type}LikeResponse()` to `contentFiltering.ts`
-
-6. **ContentTab type**: Add the new tab name to the `ContentTab` union in `contentFiltering.ts`
-
-7. **Tab filtering**: Update `filterTabsByContext()` and `preferredFirstTab()` in `contentFiltering.ts`
-
-8. **Grid component**: Create `packages/app/src/components/content/{Type}Grid.vue` following the glass-morphism pattern of existing grids (BookGrid.vue is a good template)
-
-9. **Detail component**: Create `packages/app/src/components/content/{Type}Detail.vue` following the pattern of BookDetail.vue
-
-10. **Wire into ContentPanel.vue**: Add import, grid render block, detail render block, and panel state refs
-
-11. **Wire into ContentGridView.vue**: Add import, props, and grid render block
-
-12. **Wire into ChatPage.vue**: Pass the new panel data as props to ContentGridView
-
-13. **Wire into useContentPanel.ts**: Add panel ref, selected ref, open/close functions, extraction call in `updatePanelFromText()`
-
-14. **System prompt**: Add tag format instructions to the `SYSTEM_PROMPT` in `useAI.ts`
-
-15. **Tab label**: Add to `TAB_LABELS` in `ContentPanel.vue`
-
-16. **Verify**: Run `pnpm typecheck` and fix any errors
-
-Report what was created and the tag format to use.

aiui/.claude/skills/add-tool/SKILL.md

@@ -1,32 +0,0 @@
----
-name: add-tool
-description: Add a new AI tool (function call) to the Claude proxy for the AI to use
-allowed-tools: Bash(*), Read, Edit, Write, Glob, Grep
----
-
-Add a new tool that the AI model can call via Claude's tool_use API. The user will describe what the tool should do (e.g., "search local files", "get app status", "browse media").
-
-## Steps
-
-1. **Read the proxy**: Read `packages/app/server/claude-proxy.ts` to understand the existing tool_use loop and `SEARCH_WEB_TOOL` definition.
-
-2. **Define the tool**: Add a new tool definition following the Claude tool_use format:
-   ```ts
-   const NEW_TOOL = {
-     name: 'tool_name',
-     description: 'What this tool does...',
-     input_schema: {
-       type: 'object',
-       properties: { ... },
-       required: [...]
-     }
-   }
-   ```
-
-3. **Add handler**: In the tool_use loop (where `search_web` calls are handled), add a handler for the new tool name.
-
-4. **Implement backend**: If the tool needs a new API endpoint (e.g., `/api/media/scan`), create a Vite plugin or add a route to the proxy.
-
-5. **Update system prompt**: Add instructions in `useAI.ts` SYSTEM_PROMPT telling the AI when and how to use the new tool.
-
-6. **Verify**: Run `pnpm typecheck` and test the proxy starts without errors.

aiui/.claude/skills/audit-prompts/SKILL.md

@@ -1,37 +0,0 @@
----
-name: audit-prompts
-description: Deep audit of AI system prompts — find gaps, test extraction coverage, verify tag formats
-allowed-tools: Bash(*), Read, Glob, Grep, Agent
----
-
-Perform a comprehensive audit of AIUI's AI prompt system. Do NOT make changes — report findings only.
-
-## Steps
-
-1. **Read the full system prompt**: Read `packages/app/src/composables/useAI.ts` and reconstruct the complete system prompt including all dynamic sections (persona, Wavlake, memory, web search, Archy context, code context).
-
-2. **Catalog all tag formats**: List every `[[type:...]]` and `[[type_ext:...]]` format defined in the prompt. Cross-reference with regexes in `contentExtraction.ts`.
-
-3. **Check for gaps**: For each content type in `ContentTab` (contentFiltering.ts), verify:
-   - Is there a tag format in the system prompt?
-   - Is there a matching extraction regex?
-   - Is there a query classifier?
-   - Is there a grid + detail component?
-   - Is the tab wired in ContentPanel.vue and ContentGridView.vue?
-
-4. **Test extraction coverage**: Read the seed prompts in `src/__tests__/fixtures/seedPrompts.ts`. For each seed, verify:
-   - Does the extraction function find the expected number of items?
-   - Are there edge cases that would break extraction?
-
-5. **Analyze prompt quality**: Check for:
-   - Conflicting instructions
-   - Missing edge case handling (e.g., "what if the AI can't find a match?")
-   - Overly vague instructions
-   - Missing content types that should have tag formats
-
-6. **Check proxy tools**: Read `server/claude-proxy.ts` and verify tool definitions match what the prompt claims.
-
-7. **Report**: Create a structured summary with:
-   - Content type coverage matrix (tag/extraction/grid/detail/prompt)
-   - Identified gaps and inconsistencies
-   - Priority recommendations

aiui/.claude/skills/check/SKILL.md

@@ -1,17 +0,0 @@
----
-name: check
-description: Run all quality checks (typecheck, lint, test) and auto-fix errors
-allowed-tools: Bash(*), Read, Edit, Glob, Grep, Agent
----
-
-Run all quality checks for the AIUI project and fix any issues found. Execute in order:
-
-1. **TypeScript**: Run `pnpm typecheck`. If errors found, read the failing files and fix the type errors.
-2. **Lint**: Run `pnpm lint`. If fixable errors, run `pnpm lint --fix` first, then fix remaining manually.
-3. **Tests**: Run `pnpm --filter @aiui/app test -- --run`. For each failure:
-   - Read the test file and the source file it tests
-   - Determine if the test is wrong (outdated assertion) or the source has a bug
-   - Fix whichever is incorrect
-4. Report a summary: pass/fail counts, what was fixed.
-
-Important: Do NOT change test expectations just to make them pass — understand WHY they fail first.

aiui/.claude/skills/deploy/SKILL.md

@@ -1,32 +0,0 @@
----
-name: deploy
-description: Build and prepare AIUI for deployment to Archy node
-allowed-tools: Bash(*), Read, Edit, Glob, Grep
----
-
-Build AIUI for production deployment. Steps:
-
-1. **Pre-flight checks**:
-   - `pnpm typecheck` — must pass
-   - `pnpm lint` — must pass
-   - `pnpm --filter @aiui/app test -- --run` — report failures but continue
-
-2. **Build**:
-   - `pnpm build`
-   - Verify `packages/app/dist/` exists and contains `index.html`
-
-3. **Bundle analysis**:
-   - Report total dist size and gzip estimate
-   - List the 5 largest chunks
-   - Check against 250KB gzipped budget (warn if over)
-
-4. **Verify nginx config**:
-   - Read `packages/app/server/nginx-archy.conf`
-   - Verify SPA routing (`try_files $uri $uri/ /aiui/index.html`)
-   - Verify proxy paths for Claude API
-
-5. **Container build** (if Dockerfile exists):
-   - `podman build -t aiui:latest packages/app/`
-   - Report image size
-
-6. **Report**: Build status, bundle size, any warnings.

aiui/.claude/skills/fix-tab/SKILL.md

@@ -1,33 +0,0 @@
----
-name: fix-tab
-description: Diagnose and fix a broken content panel tab (extraction, routing, rendering)
-allowed-tools: Bash(*), Read, Edit, Glob, Grep, Agent
----
-
-Diagnose and fix a broken content panel tab. The user will specify which tab (e.g., "app", "code", "image", "nostr").
-
-## Diagnostic pipeline — check each layer:
-
-1. **System prompt**: Does `useAI.ts` SYSTEM_PROMPT tell the AI to use the tag format for this content type? If not, add instructions.
-
-2. **Tag regex**: Does `contentExtraction.ts` have a regex for this content type's tags? If not, add one.
-
-3. **Extraction function**: Does `extractAll{Type}s()` or `extract{Type}s()` exist and work correctly? Test with sample input.
-
-4. **Query classifier**: Do `is{Type}Query()` and/or `is{Type}LikeResponse()` exist in `contentFiltering.ts`?
-
-5. **Tab filtering**: Is the tab included in `filterTabsByContext()` and `preferredFirstTab()`? Check the boolean flag is wired.
-
-6. **useContentPanel.ts**: Is the extraction called in `updatePanelFromText()`? Is the panel ref populated? Is the tab added to `availableTabs`?
-
-7. **ContentPanel.vue**: Is there a grid render block for `activeTab === '{tab}'`? Are imports present? Is the tab in TAB_LABELS?
-
-8. **ContentGridView.vue**: Same checks for the wide desktop view.
-
-9. **ChatPage.vue**: Are the panel data props passed to ContentGridView?
-
-10. **Grid component**: Does the grid component exist and render correctly?
-
-11. **Detail component**: Does the detail component exist?
-
-Fix each broken layer. Run `pnpm typecheck` after all fixes.

aiui/.claude/skills/mock-archy/SKILL.md

@@ -1,32 +0,0 @@
----
-name: mock-archy
-description: Enable/configure mock Archy data for standalone dev testing
-allowed-tools: Bash(*), Read, Edit, Glob, Grep
----
-
-Set up or modify mock Archy data for testing the Archipelago integration without a real Archy host.
-
-## How it works
-
-Mock data is in `packages/app/src/mocks/archy.ts`. When enabled, `useArchy.ts` loads this data instead of waiting for the Archy bridge.
-
-## Enable mock mode
-
-Two ways:
-1. Add `VITE_MOCK_ARCHY=true` to `.env.local`
-2. Add `?mockArchy` to the URL: `http://localhost:5173/?mockArchy`
-
-## Customization
-
-The user may ask to:
-- Add/remove mock apps from the installed list
-- Change wallet balance or channel count
-- Add/modify files in the mock file list
-- Change system info or network status
-- Test specific scenarios (e.g., "node is syncing", "wallet offline", "no files")
-
-Edit `packages/app/src/mocks/archy.ts` accordingly.
-
-## Verify
-
-After changes, check that `buildArchyContext()` in `useArchy.ts` produces the expected system prompt section by reading the function and tracing the mock data through it.

aiui/.claude/skills/new-detail/SKILL.md

@@ -1,27 +0,0 @@
----
-name: new-detail
-description: Generate a detail view component following AIUI glass-morphism patterns
-allowed-tools: Read, Write, Edit, Glob, Grep
----
-
-Create a new detail view component at `packages/app/src/components/content/{Name}Detail.vue`.
-
-## Requirements
-
-1. **Read a reference**: Read `BookDetail.vue` or `PlaceDetail.vue` as a template.
-
-2. **Follow conventions**:
-   - `<script setup lang="ts">` with single item prop
-   - Back button at top (emits 'back' event)
-   - Hero image/banner area with gradient overlay and fallback
-   - Title, subtitle, and metadata section
-   - Description/long text body with proper typography
-   - Action buttons (external links, share, etc.) with glass-button styling
-   - Dark/light mode via `useTheme()`
-   - Smooth scroll, overflow-y-auto
-
-3. **Props**: Accept single item of the content type
-4. **Emits**: `back` event for navigation
-5. **Responsive**: Full height, works in sidebar and mobile overlay
-
-The user will specify the content type and which fields to display.

aiui/.claude/skills/new-grid/SKILL.md

@@ -1,27 +0,0 @@
----
-name: new-grid
-description: Generate a content grid component following AIUI glass-morphism patterns
-allowed-tools: Read, Write, Edit, Glob, Grep
----
-
-Create a new content grid component at `packages/app/src/components/content/{Name}Grid.vue`.
-
-## Requirements
-
-1. **Read a reference**: Read `BookGrid.vue` or `PlaceGrid.vue` as a template — they show the standard pattern.
-
-2. **Follow conventions**:
-   - `<script setup lang="ts">` with props and emits
-   - Glass morphism styling (bg-white/5, rounded-xl, hover:bg-white/10)
-   - Dark/light mode support via `useTheme()`
-   - Search input at top (if the content type has enough items)
-   - Grid of cards with image fallback, title, subtitle, metadata
-   - Touch targets min 44x44px
-   - Empty state message when no items match
-   - Custom scrollbar class
-
-3. **Props**: Accept array of items + title string
-4. **Emits**: `select-{type}` event when a card is clicked
-5. **Responsive**: Works on mobile (full width) and desktop (sidebar width)
-
-The user will specify the content type and its fields.

aiui/.claude/skills/overnight/SKILL.md

@@ -1,19 +0,0 @@
----
-name: overnight
-description: Commit, branch, and start the overnight automation loop
-disable-model-invocation: true
-allowed-tools: Bash(*), Read, Write, Edit, Glob, Grep
----
-
-Prepare and launch the overnight automation loop. Do ALL steps in order, stopping on any failure:
-
-1. Stage and commit all uncommitted changes: `git add -A && git commit -m "chore: pre-overnight snapshot"` (skip if working tree is clean)
-2. Push current branch to origin
-3. Get today's date as YYYY-MM-DD. Check if `overnight/$DATE` branch exists:
-   - If yes: `git checkout overnight/$DATE`
-   - If no: run `./loop/prepare.sh`
-4. Verify `loop/plan.md` has unchecked tasks (`grep -c '^\- \[ \]' loop/plan.md`)
-5. Commit plan files if modified: `git add loop/plan.md loop/prompt.md && git commit -m "chore: overnight plan $DATE"` (skip if clean)
-6. Push: `git push -u origin overnight/$DATE`
-7. Start the loop: run `caffeinate -i ./loop/loop.sh` with `run_in_background: true`
-8. Report: branch name, number of tasks, and confirm the loop is running in background

aiui/.claude/skills/pwa-icon-cache-fix/SKILL.md

@@ -1,102 +0,0 @@
----
-name: pwa-icon-cache-fix
-description: Use when the user reports a PWA icon not updating, stale PWA icon, wrong icon after install, or any PWA caching issue. Also applies when changing PWA icons in a Vite + vite-plugin-pwa project.
-version: 2.0.0
----
-
-# PWA Icon Cache Fix
-
-## Problem
-
-PWA icons are cached at FOUR independent layers:
-1. **Service worker cache** (Workbox precache)
-2. **Browser HTTP cache**
-3. **Browser manifest resources** (Chromium stores resized icons in its profile data, keyed by a permanent extension ID tied to the origin — NEVER re-fetched even after uninstall/reinstall)
-4. **macOS .app bundle** (`.icns` file baked into the `.app` in `~/Applications/`)
-
-Query string cache busting (`?v=2`) and uninstall/reinstall do NOT fix this. Chromium reuses the same extension ID for the same origin, so it keeps the old cached icons.
-
-## Fix Steps
-
-### 1. Verify icon files on disk and server are correct
-
-```bash
-# Visual check
-Read packages/app/public/pwa-192x192.png
-Read packages/app/public/pwa-512x512.png
-
-# Hash match check
-curl -s http://localhost:5173/pwa-192x192.png | md5
-md5 -q packages/app/public/pwa-192x192.png
-```
-
-### 2. Find the PWA's Chromium extension ID
-
-Read the installed `.app` bundle's `Info.plist` to get the `CrAppModeShortcutID`:
-
-```bash
-plutil -p "~/Applications/Brave Browser Apps.localized/AIUI.app/Contents/Info.plist" | grep CrAppModeShortcutID
-```
-
-This returns an ID like `idemibpphagihbobmgmaojhjfidlfpdl`.
-
-### 3. Overwrite the cached icons in browser profile
-
-Chromium stores resized icons at:
-`~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/Manifest Resources/{ID}/Icons/`
-
-Overwrite every size using `sips`:
-
-```bash
-ICON_DIR="~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/Manifest Resources/{ID}/Icons"
-SRC="packages/app/public/pwa-512x512.png"
-for size in 32 48 64 96 128 192 256 512; do
-  sips -z $size $size "$SRC" --out "${ICON_DIR}/${size}.png"
-done
-```
-
-### 4. Rebuild the macOS .icns in the .app bundle
-
-```bash
-ICONSET="/tmp/aiui.iconset"
-mkdir -p "$ICONSET"
-SRC="packages/app/public/pwa-512x512.png"
-sips -z 16 16 "$SRC" --out "$ICONSET/icon_16x16.png"
-sips -z 32 32 "$SRC" --out "$ICONSET/icon_16x16@2x.png"
-sips -z 32 32 "$SRC" --out "$ICONSET/icon_32x32.png"
-sips -z 64 64 "$SRC" --out "$ICONSET/icon_32x32@2x.png"
-sips -z 128 128 "$SRC" --out "$ICONSET/icon_128x128.png"
-sips -z 256 256 "$SRC" --out "$ICONSET/icon_128x128@2x.png"
-sips -z 256 256 "$SRC" --out "$ICONSET/icon_256x256.png"
-sips -z 512 512 "$SRC" --out "$ICONSET/icon_256x256@2x.png"
-sips -z 512 512 "$SRC" --out "$ICONSET/icon_512x512.png"
-cp "$SRC" "$ICONSET/icon_512x512@2x.png"
-iconutil -c icns "$ICONSET" -o "~/Applications/Brave Browser Apps.localized/AIUI.app/Contents/Resources/app.icns"
-```
-
-### 5. Flush macOS icon cache
-
-```bash
-touch "~/Applications/Brave Browser Apps.localized/AIUI.app"
-killall Finder
-killall Dock
-```
-
-### 6. Bump PWA_CACHE_VERSION in main.ts
-
-Increment the `PWA_CACHE_VERSION` constant — this nukes all SW caches on next page load for web-layer caching.
-
-### 7. Delete stale build artifacts
-
-Remove old `dist/` and `dev-dist/` SW/manifest files.
-
-## Browser-Specific Paths
-
-- **Brave**: `~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/`
-- **Chrome**: `~/Library/Application Support/Google/Chrome/Default/Web Applications/`
-- **PWA apps (Brave)**: `~/Applications/Brave Browser Apps.localized/`
-- **PWA apps (Chrome)**: `~/Applications/Chrome Apps.localized/`
-
-## Key Insight
-
-Chromium assigns a permanent extension ID per origin (e.g., `localhost:5173`). This ID persists across uninstall/reinstall. The icon cache in `Manifest Resources/{ID}/Icons/` is populated ONCE and never refreshed from the manifest. The only fix is to overwrite the files directly on disk.

aiui/.claude/skills/test-prompts/SKILL.md

@@ -1,26 +0,0 @@
----
-name: test-prompts
-description: Test AI prompt quality by simulating queries and checking extraction results
-allowed-tools: Bash(*), Read, Edit, Glob, Grep, Agent
----
-
-Test the AIUI AI prompt and content extraction pipeline end-to-end. This skill does NOT call the actual AI — it uses the seed prompts and extraction functions directly.
-
-## Steps
-
-1. **Read seed prompts**: Read `packages/app/src/__tests__/fixtures/seedPrompts.ts` to get all test cases.
-
-2. **Run extraction tests**: For each seed prompt, run the test via `pnpm --filter @aiui/app test -- --run -t "seed"` and report results.
-
-3. **Test edge cases**: Create and test these additional scenarios by calling extraction functions in a test:
-   - Mixed content response (films + songs + books in one response)
-   - App recommendation response (should trigger app tab)
-   - News query with web search results
-   - Place/restaurant recommendations
-   - Code response with 3+ code blocks
-   - Nostr-related query
-   - Empty/minimal response
-
-4. **Verify tab routing**: For each scenario, check that `filterTabsByContext()` returns the expected tabs in the expected order.
-
-5. **Report**: Summary of what works, what's broken, and what's missing. Include specific test cases that fail.

aiui/.claude/skills/trace/SKILL.md

@@ -1,28 +0,0 @@
----
-name: trace
-description: End-to-end trace of a query through prompt, extraction, tabs, and rendering
-allowed-tools: Bash(*), Read, Glob, Grep, Agent
----
-
-Trace how a specific user query flows through the entire AIUI pipeline. The user will provide a sample query (e.g., "best nostr apps", "recommend some films", "bitcoin news").
-
-## Trace each stage:
-
-1. **Query classifiers**: Run the query through each classifier in `contentFiltering.ts`:
-   - `isNewsQuery()`, `isMusicQuery()`, `isBookQuery()`, `isTVQuery()`, `isImageQuery()`, `isPlaceQuery()`, `isRecipeQuery()`, `isCodeQuery()`, `isNostrQuery()`, `isAppQuery()`, `isWebsitesQuery()`
-   - Report which ones return true
-
-2. **Preferred tab**: What does `preferredFirstTab()` return for this query?
-
-3. **System prompt**: What would `buildSystemPrompt()` include? Read `useAI.ts` and trace all dynamic sections.
-
-4. **Expected AI response**: Based on the system prompt instructions, what tags would the AI likely use? Construct a realistic sample response.
-
-5. **Extraction**: Run the sample response through each extraction function and report what gets found:
-   - `extractAllFilms()`, `extractAllSongs()`, `extractAllPodcasts()`, `extractAllBooks()`, `extractAllTVSeries()`, `extractAllImages()`, `extractAllPlaces()`, `extractApps()`, `extractCodeBlocks()`, `extractRecipes()`
-
-6. **Tab filtering**: What tabs would `filterTabsByContext()` return? In what order?
-
-7. **Rendering**: Which grid component would render? Trace through ContentPanel.vue and/or ContentGridView.vue.
-
-8. **Report**: Complete flow diagram showing: Query -> Classifiers -> Prompt -> Expected Response -> Extraction -> Tabs -> Grid

aiui/.cursor/rules/00-master-philosophy.mdc

@@ -1,65 +0,0 @@
----
-description: Core development philosophy for AIUI - the foundational rules that govern all code and design decisions
-globs: "**/*"
-alwaysApply: true
----
-
-# Master Philosophy
-
-## Mission
-Build the next-generation AI content surface UI — a paradigm where AI responses are rendered as rich, interactive content, not plain text. Delivered as a reusable component library (@aiui/core) and a reference application (AIUI App).
-
-## Philosophical Pillars
-
-### 1. Open Source Only
-Every dependency must be OSS (MIT, Apache-2.0, GPL-compatible). No proprietary SDKs, no vendor-locked services. Before adding any dependency, verify its license.
-
-### 2. Decentralized-First
-No hard dependency on any centralized service. AI backends, messaging protocols, storage, search — all connect through pluggable adapter interfaces. Users choose their own providers.
-
-### 3. Bitcoin Only
-Bitcoin is the only monetary unit. On-chain, Lightning, ecash (Cashu, Fedimint/Fedi). No fiat payment rails, no altcoins, no stablecoins — anywhere in the UI or codebase. AIUI is never a wallet and never handles funds directly. See `10-bitcoin-only.mdc` for full rules.
-
-### 4. Cryptography for Everything Sensitive
-E2E encryption for messages, encrypted local storage, proper key management. Privacy is not a feature — it is a requirement.
-
-### 5. Mobile-First, Everywhere-Perfect
-Every component works flawlessly on mobile, tablet, and desktop. Mobile is the foundation, not an afterthought. Touch targets, viewport management, and safe areas are first-class citizens.
-
-### 6. Consistency is Sacred
-Mobile and desktop versions show identical content and functionality unless explicitly designed otherwise. Design tokens ensure visual consistency across all breakpoints.
-
-### 7. Theme-First Architecture
-Theming is a core architectural decision from day one. Themes are CSS-based with reactive state management. Dark mode and light mode are equals.
-
-### 8. Utility-First, Component-Second
-Tailwind CSS utilities in templates for maximum flexibility. Component classes only for truly reusable patterns. Extract components when you repeat, not before.
-
-### 9. Performance as a Feature
-Initial load < 250KB gzipped. Lazy load everything that isn't immediately visible. CSS transforms for GPU acceleration. SVG over raster images. Code splitting by default.
-
-### 10. Plugin-Everything
-Every external integration connects through a typed plugin interface. AI providers, media sources, messaging protocols, wallets, social embeds — all pluggable.
-
-### 11. Accessibility is Not Optional
-WCAG AA compliance minimum. Keyboard navigation everywhere. Screen reader friendly. Color contrast tested and validated.
-
-### 12. MCP-Native
-First-class Model Context Protocol support for AI tool interoperability.
-
-## Anti-Patterns to Avoid
-
-- Desktop-first thinking
-- Hardcoded values (use design tokens)
-- Premature abstraction (build three times before abstracting)
-- Magic numbers without comments
-- Invisible state (user should always know what's happening)
-- Handling funds or private keys
-- Loading third-party tracking scripts
-- Proprietary dependencies
-
-## The Ultimate Goal
-
-When someone uses AIUI, they should think: "This feels incredibly polished", "Everything just works", "My data is safe", "I control my own setup."
-
-When a developer reads the code: "This is well organized", "I understand exactly what's happening", "Adding a new renderer is straightforward."

aiui/.cursor/rules/01-vue-conventions.mdc

@@ -1,84 +0,0 @@
----
-description: Vue 3 Composition API conventions and best practices for AIUI
-globs: "**/*.vue,**/*.ts"
-alwaysApply: false
----
-
-# Vue 3 Conventions
-
-## Composition API with `<script setup>`
-Always use `<script setup lang="ts">`. Never use Options API.
-
-## Component Organization Order
-1. Imports — external, then internal
-2. Props — with TypeScript-style validation
-3. Emits — explicitly defined
-4. State (refs and reactive)
-5. Computed — derived values, always pure
-6. Watchers — side effects only
-7. Methods — business logic
-8. Lifecycle hooks — ordered by execution
-9. Expose — public API (if needed)
-
-## File Organization
-```
-src/
-  components/
-    ui/           # Primitives (Button, Card, Badge, Input)
-    chat/         # Chat window, message list, input
-    content-panel/ # Side panel for surfaced content
-    renderers/    # Content type renderers
-    layout/       # Shell, split-pane, responsive containers
-  composables/    # Shared composition functions (useTheme, useMedia, useCrypto)
-  stores/         # Pinia stores
-  plugins/        # Plugin system
-  types/          # Shared TypeScript types
-  styles/         # Global CSS, themes, design tokens
-  utils/          # Pure utility functions
-```
-
-## Naming Conventions
-- Components: PascalCase (`ProjectCard.vue`)
-- Composables: camelCase, prefixed with "use" (`useTheme.ts`)
-- Props: camelCase in JS, kebab-case in templates
-- Boolean props: prefix with `is`, `has`, `can`, `should`
-- Handler props: prefix with `on` (`onClick`, `onClose`)
-- Emits: explicit, kebab-case in templates (`project:updated`)
-
-## Props — Always Validate
-```typescript
-defineProps({
-  title: { type: String, required: true },
-  count: { type: Number, default: 0 },
-  status: {
-    type: String as PropType<'pending' | 'active' | 'complete'>,
-    default: 'pending'
-  }
-})
-```
-
-Never use array-style props: `defineProps(['title', 'count'])`
-
-## Reactive State
-- `ref` for primitives and single values
-- `reactive` for objects with multiple properties
-- `computed` for derived state (never side effects in computed)
-- `shallowRef` for large objects that change at top level only
-
-## Templates — Keep Clean
-Move complex logic to computed properties or methods. No inline logic in templates. Use `v-if` for infrequent toggles, `v-show` for frequent ones.
-
-## Composables
-- One responsibility per composable
-- Return only what's needed
-- Handle cleanup in `onUnmounted`
-- Make composables testable
-
-## Performance
-- Lazy load heavy components: `defineAsyncComponent(() => import(...))`
-- Use `shallowRef` for large lists
-- Use `:key` with unique identifiers, never index
-- Avoid reactive objects in templates (create in script)
-
-## Error Handling
-Use `onErrorCaptured` for component-level error boundaries. Always handle async errors with try/catch/finally pattern (loading, error, data states).

aiui/.cursor/rules/02-tailwind-styling.mdc

@@ -1,111 +0,0 @@
----
-description: Tailwind CSS utility-first styling conventions for AIUI, ported from Archy
-globs: "**/*.vue,**/*.css,**/*.ts"
-alwaysApply: false
----
-
-# Tailwind CSS Styling
-
-## Source of Truth
-All glass morphism, container, and button patterns originate from the Archy project (`/Projects/Archy/neode-ui/src/style.css`). When in doubt, match Archy exactly.
-
-## Utility-First
-Use Tailwind utilities directly in templates. Extract to component classes only when a pattern repeats 3+ times.
-
-## 4px Spacing Grid
-```
-1 = 4px, 2 = 8px, 3 = 12px, 4 = 16px, 5 = 20px, 6 = 24px, 7 = 28px, 8 = 32px
-```
-
-## Typography Scale
-```
-text-xs    = 12px  (metadata, timestamps)
-text-sm    = 14px  (body text, buttons)
-text-base  = 16px  (default body, inputs)
-text-lg    = 18px  (subtitles)
-text-xl    = 20px  (card titles)
-text-2xl   = 24px  (section headings)
-text-3xl   = 30px  (page headings)
-text-4xl   = 36px  (hero headings)
-```
-
-Font weights: `font-normal` (body), `font-medium` (emphasis), `font-semibold` (headings/buttons), `font-bold` (strong emphasis).
-
-## Glass Morphism (from Archy)
-
-### Containers (exact Archy values)
-- `.glass` — base: `bg: rgba(0,0,0,0.35)`, `blur(18px)`, `border: 1px solid rgba(255,255,255,0.18)`, `shadow: 0 8px 24px rgba(0,0,0,0.45)`
-- `.glass-strong` — stronger blur: same bg but `blur(24px)`
-- `.glass-card` — primary card: `bg: rgba(0,0,0,0.65)`, `blur(18px)`, `border-radius: 1rem`, same border/shadow
-- `.gradient-card` — gradient: `linear-gradient(135deg, rgba(255,255,255,0.1) 0%, rgba(0,0,0,0.8) 100%)`
-- `.gradient-card-dark` — dark gradient: `linear-gradient(180deg, rgba(0,0,0,0.4) 0%, rgba(0,0,0,0.9) 100%)`
-- `.gradient-border-container` — gradient border with inner glass, `border-radius: 1.5rem`
-- `.toast-glass` — `border-radius: 0.75rem`, same glass as `.glass-card`
-
-### Buttons (exact Archy values)
-- `.glass-button` — 48px height, `bg: rgba(0,0,0,0.6)`, `blur(18px)`, border `rgba(255,255,255,0.18)`, `color: rgba(255,255,255,0.9)`
-- `.glass-button-sm` — compact variant (auto height, `py-1.5 px-3`)
-
-### Icon / Ghost buttons (Archy pattern)
-```html
-<button class="p-2 rounded-lg text-white/70 hover:text-white hover:bg-white/10 transition-colors">
-```
-Touch target: minimum 44x44px via padding.
-
-### Active Navigation
-`.nav-tab-active` — `bg: rgba(0,0,0,0.35)`, inset highlight, gradient border via CSS mask `::before`
-
-### Usage Rules
-- ✅ Cards, panels, modals, sidebars
-- ✅ Navigation bars, headers (fixed positioning)
-- ✅ Hover states, buttons
-- ❌ Body text containers (readability)
-- ❌ Form input fields (confusing UX)
-
-## Inset Highlight
-The signature Archy inset glow:
-```css
-box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.22);
-```
-Apply to headers, selected cards, active nav items.
-
-## Border — No Separators Between Sections
-Per Archy theme rules: no borders between sidebar and content, or header and content. Only subtle `rgba(255,255,255,0.06-0.08)` borders for internal dividers.
-
-## Gradient Text
-```html
-<h1 class="gradient-text">Title</h1>
-```
-`linear-gradient(to right, #ffffff, #9ca3af)` with `background-clip: text`.
-
-## Focus States — Gamepad/Keyboard Glow
-All focusable elements get a blue glow (no outline):
-```css
-*:focus-visible {
-  outline: none;
-  box-shadow: 0 0 16px rgba(120, 180, 255, 0.2), 0 0 32px rgba(100, 160, 255, 0.1);
-}
-```
-
-## Scrollbar
-- `.custom-scrollbar` — gradient thumb (`rgba(255,255,255,0.3)` to `0.1`), dark track
-- `.scrollbar-hide` — hidden scrollbar, keeps scroll functionality
-
-## Responsive — Mobile First
-Base styles for mobile, enhance with breakpoints:
-```html
-<div class="text-base md:text-lg lg:text-xl p-4 md:p-6 lg:p-8">
-```
-Breakpoints: `sm` (640px), `md` (768px), `lg` (1024px), `xl` (1280px), `2xl` (1536px).
-
-## Hover States (from Archy)
-```html
-<div class="transition-all duration-300 hover:bg-white/10 hover:text-white">
-```
-Interactive card lift: `hover:translateY(-2px)` with intensified shadow.
-
-## Animations (Archy timings)
-- `animate-fade-up` — 900ms `cubic-bezier(0.22, 1, 0.36, 1)` with 120ms delay
-- `animate-fade-up-fast` — 400ms, no delay (for chat messages)
-- `animate-fade-in` — 500ms ease
-- `animate-scale-in` — 250ms for modals/popups

aiui/.cursor/rules/03-design-system.mdc

@@ -1,118 +0,0 @@
----
-description: Design system foundations - glassmorphism from Archy, colors, typography, spacing
-globs: "**/*.vue,**/*.css,**/*.ts"
-alwaysApply: false
----
-
-# Design System
-
-All glass morphism, container, and button patterns are ported from the Archy project and must match exactly.
-
-## Glass Morphism Hierarchy (from Archy)
-
-### Glass Intensity Levels
-| Class | Background | Blur | Use Case |
-|-------|-----------|------|----------|
-| `.glass` | `rgba(0,0,0,0.35)` | 18px | Sidebar, panels, inputs |
-| `.glass-strong` | `rgba(0,0,0,0.35)` | 24px | Headers, message bubbles (user) |
-| `.glass-card` | `rgba(0,0,0,0.65)` | 18px | Primary cards, modals, main containers |
-| `.gradient-card` | gradient white→black | 18px | Feature cards |
-| `.gradient-card-dark` | gradient black→black | 18px | Dark feature cards |
-
-All share: `border: 1px solid rgba(255,255,255,0.18)`, `box-shadow: 0 8px 24px rgba(0,0,0,0.45)`.
-
-### Button Hierarchy (from Archy)
-| Class | Purpose | Details |
-|-------|---------|---------|
-| `.glass-button` | Default | 48px height, `rgba(0,0,0,0.6)`, blur 18px |
-| `.glass-button-sm` | Compact | Auto height, smaller padding |
-| Ghost | Icon/text actions | `p-2 rounded-lg text-white/70 hover:text-white hover:bg-white/10` |
-
-### Inset Highlight
-Signature Archy top-edge glow on focused/active elements:
-```css
-box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.22);
-```
-
-### Gradient Border (CSS mask technique)
-For premium-feel borders on selected cards and active nav:
-```css
-::before {
-  content: '';
-  position: absolute;
-  inset: 0;
-  border-radius: inherit;
-  padding: 2px;
-  background: linear-gradient(135deg, rgba(255, 255, 255, 0.3), transparent);
-  -webkit-mask: linear-gradient(#fff 0 0) content-box, linear-gradient(#fff 0 0);
-  -webkit-mask-composite: xor;
-  mask-composite: exclude;
-  pointer-events: none;
-}
-```
-
-## Design Tokens
-
-### Color Palette
-Semantic color tokens defined by purpose:
-- `primary` — main brand actions (#606060)
-- `accent` — highlight, Bitcoin orange (#F7931A)
-- `success` — positive states (#10B981)
-- `error` — negative states (#EF4444)
-- `warning` — caution states (#F59E0B)
-- `info` — informational (#3B82F6)
-
-### Glass Tokens (from Archy Tailwind config)
-- `glass-dark`: `rgba(0, 0, 0, 0.35)`
-- `glass-darker`: `rgba(0, 0, 0, 0.6)`
-- `glass-border`: `rgba(255, 255, 255, 0.18)`
-- `glass-highlight`: `rgba(255, 255, 255, 0.22)`
-
-### Shadows
-- `shadow-glass`: `0 8px 24px rgba(0, 0, 0, 0.45)`
-- `shadow-glass-sm`: `0 6px 18px rgba(0, 0, 0, 0.35)`
-- `shadow-glass-inset`: `inset 0 1px 0 rgba(255, 255, 255, 0.22)`
-
-### Typography
-- Body font: Inter, system-ui (AIUI default)
-- Mono font: Menlo, Monaco, Courier New
-- Text opacity scale: `text-white/25` (placeholders), `text-white/40` (muted), `text-white/60` (secondary), `text-white/70` (interactive default), `text-white/80` (body), `text-white/90` (emphasis), `text-white/96` (headings), `text-white` (active/selected)
-
-### Spacing
-4px grid: `4, 8, 12, 16, 20, 24, 28, 32` px.
-
-### Border Radius
-- `rounded-lg` (8px) — buttons, nav items, inputs
-- `rounded-xl` (12px) — toasts, small cards
-- `rounded-2xl` (16px) — main cards, modals
-- `rounded-3xl` (24px) — bottom sheets
-- `rounded-full` — pills, avatars, FABs
-- `1rem` (16px) — `.glass-card` default
-
-## Component Patterns
-
-### Cards
-Use `.glass-card` with additional padding:
-```html
-<div class="glass-card p-6">Content</div>
-```
-
-### Modals
-```html
-<div class="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/60 backdrop-blur-sm">
-  <div class="glass-card p-6 max-w-md w-full">...</div>
-</div>
-```
-
-### Icons
-- SVG, using `currentColor`
-- Sizes: 16px, 20px, 24px, 32px
-- Icon-only buttons: `p-2 rounded-lg` (reaches 44px touch target with 24px icon)
-- Must have `aria-label`
-
-## Theme Architecture
-- Base background: `#0a0a0a` (near-black)
-- No separator borders between sidebar/header/content
-- Header, sidebar, root share same visual weight
-- CSS-based themes with reactive Vue state
-- `localStorage` persistence

aiui/.cursor/rules/04-component-architecture.mdc

@@ -1,91 +0,0 @@
----
-description: Component architecture principles - composition, patterns, and structure
-globs: "**/*.vue,**/*.ts"
-alwaysApply: false
----
-
-# Component Architecture
-
-## Core Philosophy: Composition Over Configuration
-Build complex UIs from simple, focused components that compose well together.
-
-- Single Responsibility: each component does one thing well
-- Use slots instead of complex prop APIs
-- Provide sensible defaults
-- Clear TypeScript interfaces for props
-- Keep component state local and minimal
-
-## Anti-Patterns
-- God components that do everything
-- Prop drilling through many layers (use provide/inject or Pinia)
-- Hard-coded values instead of props
-- Component logic mixed with layout
-- Tight coupling between components
-
-## Compound Component Pattern
-Components that work together as a cohesive unit:
-```vue
-<Card>
-  <Card.Header>Title</Card.Header>
-  <Card.Body>Content</Card.Body>
-  <Card.Footer>Actions</Card.Footer>
-</Card>
-```
-
-## Container/Presenter Pattern
-Separate logic from presentation:
-- Container: handles data fetching, state, side effects
-- Presenter: pure rendering, receives data via props, emits events
-
-## Slot Pattern (Vue)
-Use named slots for flexible content injection:
-```vue
-<template>
-  <div class="section">
-    <slot name="title" />
-    <slot name="content" />
-    <slot name="actions" />
-  </div>
-</template>
-```
-
-## Prop Interface Design
-```typescript
-interface BaseComponentProps {
-  class?: string
-  testId?: string
-}
-
-interface ButtonProps extends BaseComponentProps {
-  variant?: 'primary' | 'secondary' | 'ghost'
-  size?: 'sm' | 'md' | 'lg'
-  disabled?: boolean
-  loading?: boolean
-}
-```
-
-## Component File Template
-```
-1. Imports (external, then internal)
-2. Types/Interfaces
-3. Constants
-4. Main component (props, emits, state, computed, methods, lifecycle)
-5. Sub-components (if any)
-```
-
-## Error Boundaries
-Every major section should have error boundary handling via `onErrorCaptured`. Show fallback UI, never a blank screen.
-
-## Responsive Components
-Use CSS-based responsive (`hidden md:block`) over JS-based (`useMediaQuery`) when possible. JS-based only when behavior changes (not just visibility).
-
-## Component Checklist
-Before shipping any component:
-- [ ] TypeScript interface defined
-- [ ] Sensible default props
-- [ ] Loading and error states handled
-- [ ] ARIA attributes added
-- [ ] Keyboard navigation works
-- [ ] Responsive behavior tested
-- [ ] Dark mode styling works
-- [ ] Touch interactions verified on mobile

aiui/.cursor/rules/05-content-surfaces.mdc

@@ -1,91 +0,0 @@
----
-description: The five content surfaces that define how content is rendered in AIUI
-globs: "**/renderers/**,**/chat/**,**/content-panel/**"
-alwaysApply: false
----
-
-# Content Surfaces
-
-AIUI has five distinct surfaces where content can appear. Every renderer must define how it behaves in each applicable surface.
-
-## Surface 1: Chat Preview
-- Location: inline in chat message bubble
-- Max height: ~120px
-- Purpose: identify content at a glance (thumbnail, title, brief metadata)
-- Always tappable/clickable to expand to Panel Preview or Panel Play
-- Lightweight rendering only — no heavy libraries loaded
-- Examples: film poster thumbnail strip, file icon with name, code snippet (first 5 lines), image thumbnail
-
-## Surface 2: Chat Play
-- Location: inline in chat message bubble
-- Max height: ~200px
-- Purpose: inline playback without leaving the chat
-- Must not disrupt chat scrolling
-- Has an "expand" button to open in Panel Play
-- Examples: voice note waveform with play button, short video player, audio player, small interactive widget
-
-## Surface 3: Panel Preview
-- Location: content panel (beside chat on desktop, overlay on mobile)
-- No height limit (scrollable within panel)
-- Purpose: full browsing/exploration experience
-- Supports: filtering, sorting, searching, pagination
-- Click items to go to Panel Play or Panel Edit
-- Examples: film grid (tiled, filterable), image gallery, search results list, document preview, file tree
-
-## Surface 4: Panel Play
-- Location: content panel
-- Purpose: full immersive media playback
-- Examples: full video player with controls, audio with spectrum visualization, slideshow, trailer playback
-
-## Surface 5: Panel Edit/Interactive
-- Location: content panel
-- Purpose: full interaction and editing
-- Changes can be sent back to chat as new messages
-- Examples: code editor (CodeMirror), form filling, approval workflow, spreadsheet editing, diagram creation
-
-## Surface Transitions
-```
-Chat Preview  --tap-->  Panel Preview  --tap item-->  Panel Play
-                                       --tap item-->  Panel Edit
-Chat Play     --expand-->  Panel Play
-Panel Edit    --submit-->  Chat (new message with result)
-```
-
-## Renderer Interface
-Every renderer must export:
-```typescript
-interface RendererDefinition {
-  id: string
-  name: string
-  contentType: string                    // MIME-like type identifier
-  surfaces: SurfaceType[]               // which surfaces this renderer supports
-  chatPreview?: Component               // Surface 1
-  chatPlay?: Component                  // Surface 2
-  panelPreview?: Component              // Surface 3
-  panelPlay?: Component                 // Surface 4
-  panelEdit?: Component                 // Surface 5
-  lazyDependencies?: () => Promise<any> // heavy libs loaded on demand
-}
-```
-
-## Mobile Behavior
-- On mobile, there is no side-by-side layout
-- Panel surfaces open as a full-screen overlay or bottom sheet
-- Chat Preview and Chat Play remain inline
-- Transition: tap Chat Preview → full-screen Panel Preview (slide up)
-- Back gesture or button returns to chat
-
-## Performance Rules
-- Chat Preview and Chat Play must render with zero lazy-loaded dependencies
-- Panel surfaces may lazy-load heavy libraries (CodeMirror, pdf.js, etc.)
-- Never block the chat scroll with renderer loading
-- Use skeleton/placeholder while panel content loads
-
-## Content Type Expert Rules
-For extraction, parsing, and surfacing logic, see:
-- `20-content-films.mdc` — Films
-- `21-content-songs.mdc` — Songs (includes looksLikeSong blocklist)
-- `22-content-podcasts.mdc` — Podcasts (includes looksLikePodcast)
-- `23-content-news.mdc` — News + RSS, ArticleDetail security
-- `24-content-websites.mdc` — Websites vs News, overlay
-- `25-content-magazine.mdc` — Magazine/Brief parsing, hero, meme

aiui/.cursor/rules/06-plugin-system.mdc

@@ -1,98 +0,0 @@
----
-description: Plugin architecture rules - interfaces, registration, lifecycle, sandboxing
-globs: "**/plugins/**,**/*.plugin.ts"
-alwaysApply: false
----
-
-# Plugin System
-
-## Philosophy
-Every external integration connects through a typed plugin interface. No direct coupling to any service, provider, or protocol.
-
-## Plugin Types
-```typescript
-type PluginType =
-  | 'ai-provider'     // LLM backends (OpenRouter, Ollama, Claude, etc.)
-  | 'media-source'    // Content sources (Plex, YouTube, Nextcloud, Archive.org)
-  | 'messaging'       // Chat protocols (Nostr, Matrix, local)
-  | 'storage'         // File storage (local FS, IPFS, Nextcloud)
-  | 'renderer'        // Custom content renderers
-  | 'file-handler'    // File open/preview handlers
-  | 'crypto'          // Encryption providers
-  | 'search'          // Search backends (SearXNG, local)
-  | 'auth'            // Authentication (Nostr keys, DID, passkeys)
-  | 'wallet'          // Bitcoin wallet deep-linking (Phoenix, Zeus, Alby, etc.)
-  | 'social-embed'    // Social post fetching (X, Nostr, Mastodon)
-  | 'mcp'             // Model Context Protocol servers
-  | 'media'           // Media processing (ffmpeg.wasm, whisper, TTS)
-```
-
-## Base Plugin Interface
-```typescript
-interface AIUIPlugin {
-  id: string
-  name: string
-  version: string
-  type: PluginType
-  description?: string
-  icon?: string
-  init(context: PluginContext): Promise<void>
-  destroy(): Promise<void>
-  isAvailable(): Promise<boolean>
-}
-```
-
-## Plugin Context
-Plugins receive a context object with access to:
-- Settings store (read/write plugin-specific settings)
-- Event bus (emit/listen for app events)
-- Logger (structured logging)
-- Crypto utilities (for encrypting plugin data at rest)
-
-Plugins do NOT receive:
-- Direct DOM access (community plugins)
-- File system access (without explicit capability grant)
-- Network access to arbitrary hosts (without declaration)
-
-## Sandboxing Tiers
-
-### Tier 1: Trusted (built-in, official)
-Run in main thread with full API access. AI adapters, core renderers, crypto providers.
-
-### Tier 2: Community
-Run in sandboxed iframes with `postMessage` API. Custom renderers, themes, visual extensions. Cannot access host DOM, file system, or network directly.
-
-### Tier 3: External Processes
-MCP servers, local AI runners. Run as separate processes (Tauri IPC) or connect via HTTP. Isolated by OS process boundary.
-
-## Plugin Lifecycle
-1. `register()` — declare plugin to registry
-2. `init()` — plugin sets up, connects to services
-3. Active — plugin responds to requests
-4. `destroy()` — cleanup on disable/uninstall
-
-## Registration
-```typescript
-import { registerPlugin } from '@aiui/core'
-
-registerPlugin({
-  id: 'ai-openrouter',
-  name: 'OpenRouter',
-  type: 'ai-provider',
-  version: '1.0.0',
-  async init(ctx) { /* setup */ },
-  async destroy() { /* cleanup */ },
-  // ... adapter methods
-})
-```
-
-## Plugin Settings
-Each plugin can declare settings schema. Settings are stored encrypted and exposed through a standard settings UI.
-
-## Rules
-- Every plugin must declare its type
-- Every plugin must implement `init()` and `destroy()`
-- Every plugin must implement `isAvailable()` to report its status
-- Plugins must handle errors gracefully — never crash the host
-- Community plugins must not load external scripts
-- All network requests must go through the plugin context (for privacy/proxy control)

aiui/.cursor/rules/07-ai-integration.mdc

@@ -1,83 +0,0 @@
----
-description: AI adapter patterns, streaming, tool calling, context injection
-globs: "**/ai/**,**/plugins/ai-*/**"
-alwaysApply: false
----
-
-# AI Integration
-
-## Universal AI Adapter
-All AI providers connect through the `AIProviderAdapter` interface:
-
-```typescript
-interface AIProviderAdapter extends AIUIPlugin {
-  type: 'ai-provider'
-  chat(messages: Message[], options: ChatOptions): AsyncIterable<ChatChunk>
-  models(): Promise<Model[]>
-  supportsStreaming: boolean
-  supportsVision: boolean
-  supportsTools: boolean
-  supportsMultimodal: boolean
-}
-```
-
-## Provider Hierarchy
-1. **OpenAI-Compatible Adapter** — covers OpenRouter, Ollama, vLLM, llama.cpp, LocalAI, Mistral, DeepSeek, xAI, Qwen. Just change `baseURL` + API key.
-2. **Anthropic Adapter** — Claude. Different tool_use format (content blocks vs tool_calls).
-3. **Gemini Adapter** — Google. Different multimodal format.
-4. **MCP Client** — connects to any MCP server for tools, resources, prompts.
-
-## Streaming
-- All AI responses use Server-Sent Events (SSE) over HTTP
-- Pattern: `data: {"token": "Hello"}\n\n` with `data: [DONE]\n\n` termination
-- Client: parse SSE stream, feed tokens to `StreamingTextRenderer`
-- Always show a typing indicator while waiting for first token
-- Handle connection drops gracefully (show error, offer retry)
-
-## Tool Calling
-AI can invoke tools. The adapter normalizes tool call formats:
-```typescript
-interface ToolCall {
-  id: string
-  name: string
-  arguments: Record<string, unknown>
-}
-
-interface ToolResult {
-  toolCallId: string
-  content: string | StructuredContent
-  isError: boolean
-}
-```
-
-Normalize across providers:
-- OpenAI: `tool_calls` in assistant message → `role: "tool"` result
-- Claude: `type: "tool_use"` content block → `tool_result` in user message
-- Map both to AIUI's unified `ToolCall` / `ToolResult` types
-
-## Context Injection
-The system prompt includes context about the user's environment:
-- Connected media sources and their capabilities
-- Available tools and plugins
-- User preferences (language, theme, preferred wallet)
-- In dev mode: mock data summaries
-
-Never include sensitive data (API keys, passwords) in system prompts.
-
-## Model Selection
-Users can switch models within a conversation. The UI shows:
-- Available models from all connected providers
-- Model capabilities (vision, tools, streaming)
-- Cost per token in sats (if applicable)
-
-## Dev Mode
-- `VITE_OPENROUTER_API_KEY` in `.env.local`
-- Free models available (Llama, Mistral via OpenRouter)
-- Mock tool responses available via dev fixtures
-- Debug panel shows: raw messages, token count, latency
-
-## Error Handling
-- Rate limits: show user-friendly message, auto-retry with backoff
-- Auth errors: prompt to check API key in settings
-- Network errors: show offline indicator, queue message for retry
-- Model errors: show error in chat, suggest alternative model

aiui/.cursor/rules/08-renderer-development.mdc

@@ -1,80 +0,0 @@
----
-description: How to build content renderers - interfaces, lazy loading, accessibility
-globs: "**/renderers/**"
-alwaysApply: false
----
-
-# Renderer Development
-
-## What is a Renderer?
-A renderer is a set of Vue components that know how to display a specific content type across the five content surfaces (chat-preview, chat-play, panel-preview, panel-play, panel-edit).
-
-## Renderer Registration
-```typescript
-import { registerRenderer } from '@aiui/core'
-
-registerRenderer({
-  id: 'film',
-  name: 'Film',
-  contentType: 'application/x-aiui-film',
-  surfaces: ['chat-preview', 'panel-preview', 'panel-play'],
-  chatPreview: () => import('./FilmChatPreview.vue'),
-  panelPreview: () => import('./FilmGrid.vue'),
-  panelPlay: () => import('./FilmDetail.vue'),
-})
-```
-
-## Content Type Detection
-Renderers are matched to content by `contentType` field in the message data:
-```typescript
-interface ContentBlock {
-  contentType: string           // e.g., 'application/x-aiui-film'
-  data: Record<string, unknown> // renderer-specific data
-  title?: string                // human-readable title for panel tab
-}
-```
-
-## Performance Rules
-1. Chat surfaces (preview, play) must render with ZERO lazy-loaded heavy dependencies
-2. Panel surfaces may lazy-load libraries (CodeMirror, pdf.js, etc.)
-3. Use `defineAsyncComponent` for panel components
-4. Show skeleton/placeholder while loading
-5. Never block the main thread — use Web Workers for heavy parsing
-
-## Data Contracts
-Each renderer defines its expected data shape as a TypeScript interface:
-```typescript
-interface FilmRendererData {
-  films: Film[]
-  query?: string
-  filters?: FilmFilters
-}
-```
-Document the interface. Validate incoming data. Show graceful error if data is malformed.
-
-## Accessibility Requirements
-- All renderers must be keyboard navigable
-- Images need alt text
-- Interactive elements need ARIA labels
-- Media players need captions/transcripts when available
-- Focus management when transitioning between surfaces
-
-## Mobile Behavior
-- Chat Preview: constrained to message bubble width
-- Chat Play: full message width, max 200px height
-- Panel surfaces on mobile: full-screen overlay with back gesture
-- Touch targets: minimum 44x44px
-- Swipe gestures where appropriate (image gallery, film cards)
-
-## Renderer Checklist
-- [ ] TypeScript data interface defined and exported
-- [ ] All applicable surfaces implemented
-- [ ] Lazy loading for heavy dependencies
-- [ ] Skeleton/placeholder states
-- [ ] Error state (malformed data)
-- [ ] Empty state (no data)
-- [ ] Keyboard navigation
-- [ ] ARIA labels on interactive elements
-- [ ] Mobile responsive
-- [ ] Dark mode compatible
-- [ ] Transition animations (per motion design rules)

aiui/.cursor/rules/09-security-crypto.mdc

@@ -1,60 +0,0 @@
----
-description: Cryptography and security rules - E2E encryption, key management, storage
-globs: "**/crypto/**,**/*.ts"
-alwaysApply: false
----
-
-# Security & Cryptography
-
-## Principles
-- Privacy is a requirement, not a feature
-- Zero telemetry, zero analytics unless user explicitly opts in
-- Never transmit unencrypted sensitive data
-- Never store plaintext credentials
-- Minimal data collection — store only what's needed
-
-## Encryption Stack
-
-### E2E Message Encryption
-- Library: **tweetnacl.js** (6KB, audited by Cure53)
-- Algorithm: XSalsa20-Poly1305 via NaCl `box` (public-key authenticated encryption)
-- Each conversation has a shared secret derived from key exchange
-
-### Local Storage Encryption
-- Library: **Web Crypto API** (native, zero bundle cost)
-- Algorithm: AES-256-GCM for encrypting IndexedDB values
-- Key derived from user's master password via PBKDF2 (100K+ iterations)
-
-### Key Management
-- **Desktop (Tauri)**: OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
-- **Web**: Encrypted IndexedDB with user-derived key
-- **Nostr compatibility**: secp256k1 keys via @noble/curves, NIP-07 browser extension support
-- **Passkeys/WebAuthn**: For passwordless authentication
-
-### Credential Storage
-- API keys encrypted at rest using AES-256-GCM
-- Never stored in localStorage (use encrypted IndexedDB or OS keychain)
-- Never included in logs, error reports, or system prompts
-- Display as masked values in settings UI (show last 4 chars only)
-
-## Dev Mode Bypass
-When `VITE_DISABLE_CRYPTO=true` (dev only):
-- Skip E2E encryption (messages stored in plain text)
-- Skip storage encryption (IndexedDB unencrypted)
-- API keys stored in `.env.local` (gitignored)
-- This flag must NEVER exist in production builds
-
-## Security Rules for Code
-- Never log sensitive data (keys, tokens, passwords, message content)
-- Never include secrets in error messages
-- Sanitize all user input before rendering (XSS prevention)
-- Use Content Security Policy headers
-- Validate all data from plugins before rendering
-- Community plugins run in sandboxed iframes (no direct DOM access)
-- Never eval() or innerHTML with untrusted content
-
-## Network Security
-- All external requests over HTTPS only
-- Certificate pinning for known services (Tauri)
-- Proxy social media fetches to avoid leaking user IP
-- No third-party tracking scripts, analytics, or telemetry SDKs

aiui/.cursor/rules/10-bitcoin-only.mdc

@@ -1,72 +0,0 @@
----
-description: Bitcoin-only payment and monetary policy - on-chain, Lightning, ecash
-globs: "**/*"
-alwaysApply: true
----
-
-# Bitcoin Only
-
-## Core Rule
-Bitcoin is the only monetary unit in AIUI. This applies everywhere — UI labels, data models, API responses, documentation, and conversation context.
-
-## Supported Payment Protocols
-- **On-chain Bitcoin**: BIP21 URI scheme (`bitcoin:bc1q...?amount=0.001`)
-- **Lightning Network**: BOLT11 invoices, LNURL-pay, LNURL-withdraw, keysend
-- **Cashu ecash**: Cashu tokens, mint interactions (`cashu:` URI, `web+cashu:`)
-- **Fedimint/Fedi**: Federation ecash (`fedi:` URI)
-- **Nostr Zaps**: NIP-57 Lightning zaps (social tipping)
-
-## AIUI is NEVER a Wallet
-
-### Never Do
-- Store private keys or seed phrases
-- Sign Bitcoin transactions
-- Build or broadcast transactions
-- Track wallet balances
-- Display transaction history
-- Create send/receive screens
-- Implement payment processing logic
-- Hold funds in custody
-
-### Always Do
-- Construct deep-link URIs and hand off to external wallet apps
-- Detect installed wallet apps (via URI scheme probing or Tauri app detection)
-- Let users configure preferred wallets in settings
-- Display payment requests as QR codes with "Open in Wallet" buttons
-- Show invoice/address details (amount, memo, expiry) as read-only information
-
-## Wallet Deep-Linking
-```typescript
-// Construct URI, open external wallet — that's it
-const uri = `lightning:${bolt11Invoice}`
-window.open(uri) // or Tauri shell.open(uri)
-```
-
-Supported wallet URI schemes:
-- `bitcoin:` — BIP21 (any on-chain wallet)
-- `lightning:` — BOLT11 (any Lightning wallet)
-- `cashu:` — Cashu tokens
-- `fedi:` — Fedimint
-- Wallet-specific: `phoenix://`, `zeus://`, `mutiny://`, `alby://`
-
-## Denomination
-- Primary unit: **sats** (1 BTC = 100,000,000 sats)
-- Display: `1,234 sats` or `₿0.00001234`
-- User preference: sats or BTC (configurable in settings)
-- AI cost tracking: show token costs in sats
-
-## Prohibited
-- No fiat currencies (USD, EUR, etc.) — not in UI, not in code, not in variable names
-- No altcoins or tokens
-- No stablecoins (USDT, USDC, etc.)
-- No fiat-denominated pricing
-- No payment processor integrations (Stripe, PayPal, etc.)
-- No KYC/AML flows
-
-## Renderer Components
-- `LightningInvoiceRenderer` — BOLT11 QR + amount + memo + "Open in Wallet"
-- `BitcoinAddressRenderer` — BIP21 QR + "Open in Wallet"
-- `CashuTokenRenderer` — ecash token + mint info + "Redeem in Wallet"
-- `FedimintRenderer` — federation ecash + "Open in Fedi"
-- `PaymentRequestRenderer` — unified card with payment method options
-- `ZapRenderer` — Nostr zap display (NIP-57)

aiui/.cursor/rules/11-dev-prod-modes.mdc

@@ -1,101 +0,0 @@
----
-description: Development vs production configuration, feature flags, mock data patterns
-globs: "**/*"
-alwaysApply: false
----
-
-# Dev & Prod Modes
-
-## Development Mode
-
-### Environment
-```env
-# .env.local (gitignored)
-VITE_OPENROUTER_API_KEY=sk-or-...
-VITE_TMDB_API_KEY=...
-VITE_DEV_MODE=true
-VITE_MOCK_MEDIA_SOURCES=true
-VITE_DISABLE_CRYPTO=true
-```
-
-### What's Enabled
-- Hot reload via Vite HMR
-- Debug panel overlay (AI context, plugin status, renderer registry, message data)
-- Mock media source plugins (Plex, YouTube, Nextcloud from JSON fixtures)
-- OpenRouter AI connection (real API, free models available)
-- Component playground (Storybook/Histoire)
-- Verbose logging
-- TypeScript strict mode
-- All renderers available without lazy loading (for dev speed)
-
-### What's Disabled
-- E2E encryption (plain text messages for debugging)
-- Storage encryption (plain IndexedDB)
-- Tauri features (dev runs as pure web app)
-- Production optimizations (tree-shaking, minification)
-- Service worker / offline mode
-
-### Mock Data
-- Film fixtures: 50-100 films with real TMDB poster URLs
-- Media source mocks: JSON files returning fake Plex/YouTube/Nextcloud responses
-- Located in: `packages/app/src/mocks/`
-- Auto-loaded when `VITE_MOCK_MEDIA_SOURCES=true`
-- Mock data must match production data interfaces exactly
-
-### Dev Scripts
-```
-pnpm dev              # Web dev server
-pnpm dev:desktop      # Tauri dev (when needed)
-pnpm storybook        # Component playground
-pnpm test             # Vitest
-pnpm lint             # ESLint + Prettier
-pnpm typecheck        # TypeScript
-pnpm build            # Production build
-pnpm turbo build      # Turborepo cached build
-```
-
-## Production Mode
-
-### What's Enabled
-- E2E encryption for all messages
-- Encrypted local storage
-- Key management via OS keychain (Tauri) or encrypted IndexedDB (web)
-- User-configured AI providers (settings page)
-- Real media source connections (Plex API, YouTube, etc.)
-- Optimized builds (tree-shaken, code-split, minified)
-- Lazy loading for all heavy renderers
-- Service worker for offline support
-- Auto-update (Tauri)
-
-### What's Disabled
-- Debug panels
-- Mock data
-- Dev logging
-- Source maps (in distributed builds)
-- `VITE_DISABLE_CRYPTO` flag (must not exist)
-
-### Build Targets
-- Web: Static SPA bundle (< 250KB initial gzipped)
-- Desktop: Tauri app (macOS .dmg, Windows .msi, Linux .AppImage)
-- Mobile: Tauri mobile (iOS .ipa, Android .apk)
-
-## Feature Flags
-Use composable `useFeatureFlags()`:
-```typescript
-const { isDev, isTauri, isMobile, isCryptoEnabled, isMockData } = useFeatureFlags()
-```
-
-Gate platform-specific features:
-```typescript
-if (isTauri()) {
-  // Native file system access
-} else {
-  // File System Access API or file picker
-}
-```
-
-## Environment Variable Rules
-- All env vars prefixed with `VITE_` (Vite requirement)
-- Secrets only in `.env.local` (gitignored)
-- `.env.example` committed with placeholder values
-- Never read `process.env` directly — use typed config module

aiui/.cursor/rules/12-accessibility.mdc

@@ -1,69 +0,0 @@
----
-description: Accessibility standards - WCAG AA, keyboard navigation, screen readers
-globs: "**/*.vue"
-alwaysApply: false
----
-
-# Accessibility
-
-## Standard
-WCAG AA compliance minimum. Target AAA where feasible.
-
-## Color Contrast
-- Normal text: 4.5:1 minimum ratio
-- Large text (18px+ or 14px+ bold): 3:1 minimum
-- Interactive elements: 3:1 against adjacent colors
-- Test with browser DevTools accessibility panel
-
-## Keyboard Navigation
-- All interactive elements focusable via Tab
-- Visible focus indicators on every focusable element (`focus:ring-2`)
-- Escape closes modals, drawers, dropdowns
-- Arrow keys navigate within lists, grids, tabs
-- Enter/Space activates buttons and controls
-- Focus trap inside modals (Tab cycles within modal)
-
-## Semantic HTML
-```html
-<header>, <nav>, <main>, <article>, <aside>, <footer>
-```
-Never `<div class="header">`. Use semantic elements.
-
-## ARIA
-- Icon-only buttons: `aria-label="Close modal"`
-- Dynamic content: `aria-live="polite"` for updates
-- Screen reader only text: `class="sr-only"`
-- Expandable sections: `aria-expanded="true/false"`
-- Form fields: `aria-describedby` for help text, `aria-invalid` for errors
-
-## Images
-- All `<img>` tags need `alt` text
-- Decorative images: `alt=""`
-- Complex images: `aria-describedby` pointing to description
-
-## Media
-- Audio/video players: keyboard-accessible controls
-- Provide transcripts/captions when available
-- Respect `prefers-reduced-motion` for animations
-
-## Touch Targets
-- Minimum: 44x44px (Apple HIG)
-- Recommended: 48x48px (Material Design)
-- Minimum 8px gap between adjacent targets
-
-## Reduced Motion
-```css
-@media (prefers-reduced-motion: reduce) {
-  * {
-    animation-duration: 0.01ms !important;
-    transition-duration: 0.01ms !important;
-  }
-}
-```
-Check in JS: `window.matchMedia('(prefers-reduced-motion: reduce)').matches`
-
-## Testing
-- VoiceOver (macOS), TalkBack (Android), NVDA (Windows)
-- Keyboard-only navigation test
-- axe DevTools or Lighthouse accessibility audit
-- High contrast mode test

aiui/.cursor/rules/13-performance.mdc

@@ -1,60 +0,0 @@
----
-description: Performance optimization - bundle budget, lazy loading, virtual scrolling
-globs: "**/*"
-alwaysApply: false
----
-
-# Performance
-
-## Bundle Budget
-- Initial load: **< 250KB gzipped**
-- Core (Vue + Tailwind + Pinia + Router + chat UI): ~150KB
-- First renderer batch (markdown, streaming text): ~50KB
-- Everything else: lazy-loaded on demand
-
-## Lazy Loading Strategy
-- Route-based code splitting via Vue Router `() => import(...)`
-- Renderer components via `defineAsyncComponent`
-- Heavy libraries loaded only when their renderer is activated:
-  - CodeMirror 6: ~300KB (on code edit)
-  - Monaco: ~5MB (on IDE panel open)
-  - pdf.js: ~400KB (on PDF view)
-  - KaTeX: ~300KB (on math render)
-  - Mermaid: ~200KB (on diagram render)
-  - Leaflet: ~40KB (on map render)
-  - Whisper WASM: ~50MB (on STT activation, cached)
-  - Piper TTS: ~100MB (on TTS activation, cached)
-
-## Virtual Scrolling
-- Chat message list uses TanStack Virtual
-- Dynamic row heights (messages vary in size)
-- Inverted scroll (newest at bottom, load older on scroll up)
-- Buffer: render 5 items above and below viewport
-- Recycle DOM nodes for off-screen messages
-
-## GPU Acceleration
-Only animate `transform` and `opacity` — never `width`, `height`, `top`, `left`.
-Use `will-change` sparingly and remove after animation.
-
-## Image Optimization
-- Use `loading="lazy"` on all non-critical images
-- Provide `srcset` with multiple sizes
-- Use WebP/AVIF where supported
-- Skeleton placeholders while loading
-
-## Network
-- Preconnect to known API hosts
-- Preload critical resources
-- Debounce scroll and resize handlers (100ms)
-- Batch API requests where possible
-
-## Memory
-- Clean up event listeners in `onUnmounted`
-- Use `shallowRef` for large data sets
-- Dispose heavy library instances when panel closes
-- Monitor memory with browser DevTools
-
-## Core Web Vitals Targets
-- LCP (Largest Contentful Paint): < 2.5s
-- FID (First Input Delay): < 100ms
-- CLS (Cumulative Layout Shift): < 0.1

aiui/.cursor/rules/14-animation-motion.mdc

@@ -1,79 +0,0 @@
----
-description: Animation principles - timing, easing, stagger, reduced motion
-globs: "**/*.vue,**/*.css"
-alwaysApply: false
----
-
-# Animation & Motion Design
-
-## Philosophy
-Every animation serves a purpose: guide attention, provide feedback, show relationships, enhance perceived performance, or add delight. Never animate for decoration alone.
-
-## Duration Scale
-```
-100ms  - Instant: micro-feedback (hover states, button press)
-200ms  - Fast: small elements (tooltips, dropdowns)
-300ms  - Moderate: standard UI transitions (modals, cards)
-500ms  - Normal: page sections, complex components
-600ms  - Slow: hero animations, page transitions (max for UI)
-```
-Never exceed 600ms for UI element animations.
-
-## Easing Functions
-- **ease-out** (90% of animations): elements entering viewport
-- **ease-in**: elements exiting viewport
-- **ease-in-out**: elements moving within viewport
-- **spring**: playful interactions (button press, drag-and-drop)
-- **linear**: progress bars, loading spinners only
-
-Custom smooth deceleration: `cubic-bezier(0.16, 1, 0.3, 1)`
-
-## Common Patterns
-
-### Fade & Slide Up (entrance)
-```css
-@keyframes fadeSlideUp {
-  from { opacity: 0; transform: translateY(20px); }
-  to { opacity: 1; transform: translateY(0); }
-}
-```
-
-### Scale & Fade (emphasis)
-```css
-@keyframes scaleIn {
-  from { opacity: 0; transform: scale(0.8); }
-  to { opacity: 1; transform: scale(1); }
-}
-```
-
-### Hover feedback
-```css
-.interactive {
-  transition: transform 0.1s ease, opacity 0.1s ease;
-}
-.interactive:active {
-  transform: scale(0.95);
-  opacity: 0.8;
-}
-```
-
-## Staggered Animations
-When animating multiple elements, stagger by 50-150ms per item:
-```css
-.card { animation-delay: calc(var(--index) * 0.1s); }
-```
-Max items in a stagger cascade: 6-8. Total cascade: under 1 second.
-
-## Reduced Motion
-Always respect `prefers-reduced-motion`. Provide instant transitions as fallback.
-
-## Performance
-- Only animate `transform` and `opacity` (GPU-composited)
-- Use `will-change` sparingly, remove after animation
-- Limit simultaneous animations
-- Use `requestAnimationFrame` for JS animations
-
-## Loading States
-- Skeleton shimmer: 2s infinite, `linear-gradient` sweep
-- Pulse: 2s infinite, opacity 1 → 0.5 → 1
-- Spinner: 1s infinite linear rotation