# Phase 1 Context — Federation & Mesh Hardening

**Source:** User decisions captured in conversation 2026-07-29 (no full discuss-phase run)

<domain>
Federation/fleet + mesh hardening on a live OTA fleet, plus two lightning-adjacent UI features
(channel-open UX, on-brand paid-tick animation). Backend: Rust workspace at core/. Frontend:
neode-ui (Vue), dev preview :8100 against archi-dev.
</domain>

<decisions>
- **FED-05 "public nodes" scope (LOCKED, user 2026-07-29, corrected same day):** the
  public/other list in the channel-open picker = MESHED PEER NODES THAT HAVE LIGHTNING
  INSTALLED — nodes known over the mesh (mesh peers/contacts beyond bilateral federation
  trust) that advertise lightning capability. NOT lnd listpeers, NOT a curated list, NOT
  a live LN-graph query. Implies peers need to advertise a "lightning installed/available"
  capability (plus their URI/pubkey) over mesh/federation state so the picker can list
  them. Manual URI paste can remain as a fallback entry path. Primary lists: (1) trusted
  federated nodes by hostname, (2) meshed peers with lightning installed — "request to
  open a channel with" these.
- **FED-05 URI sharing default (Claude's discretion, revisable):** a federated peer's
  Lightning URI/pubkey rides the federation sync payload by default — federation trust is
  already bilateral and explicit. Follow the existing shared-field pattern in
  NodeStateSnapshot; if an opt-in toggle already exists for similar fields (e.g.
  shared_location), mirror that pattern with default ON for lightning URI.
- **FED-06 (LOCKED, user):** paid-tick circle = ScreensaverRing.vue style (EQ segments),
  applied consistently to every paid/success tick surface (SendBitcoinModal success pane,
  WalletScanModal success-ring).
- **FED-04:** demo attachment parity core already shipped on main (c2ce71c6) — remaining
  scope is the leftover mock gaps found in research (contacts-list/save, reaction/reply/
  edit/delete/forward stubs that never mutate demo state).
- **Priority framing (user):** federation removal/sync correctness is the reason this phase
  exists — "we should just be working on making that as tight as possible".
</decisions>

<specifics>
- UI work verified on the :8100 dev preview against archi-dev BEFORE any deploy (user
  requirement, applies to FED-05/FED-06).
- Deploy discipline per CLAUDE.md: dev pair before OTA; commit+push every unit of work.
- Modals must Teleport to body (repeated user complaint — see project feedback memory).
</specifics>

<deferred>
- Live Lightning-graph search of arbitrary public nodes (not connected peers) — out of
  scope for FED-05 v1.
- Curated/shipped public-node directory — not wanted.
</deferred>

<scope_fence>
Do not touch federation trust/join cryptography beyond what removal/sync correctness
requires (STATE.md blocker: tombstone fix touches trust code — re-verify with
tests/multinode/smoke.sh, don't patch blind). No data-destroying migrations.
</scope_fence>