---
created: 2026-08-01T04:05:00.000Z
title: Make archi-dev-box double as a fresh test node (both shapes, no ISO flash)
area: testing-infra
severity: major
files:
  - core/archipelago/src/config.rs (the env seams: ARCHIPELAGO_DATA_DIR:125, ARCHIPELAGO_BIND:129, ARCHIPELAGO_PORT_OFFSET:155, ARCHIPELAGO_APPS_DIR)
  - core/container/src/port_manager.rs (port_offset applied at :44)
  - core/archipelago/src/auth.rs (:182 is_onboarding_complete — "fresh" is decided purely from state inside data_dir)
  - tests/lifecycle/ (existing gate harness — candidate host for the new node profile)
---

## Problem

Dorian (2026-08-01): wants archi-dev-box to serve as a testing node that can be exercised
"as if it's a new node", running alongside the existing Linux desktop app install, **without
flashing the ISO**. Both shapes are wanted — this is a testing node, so it needs to cover
first-run UX *and* real app lifecycle.

Today the box runs one real production-ish node: `archipelago.service` (systemd, enabled,
`/usr/local/bin/archipelago`) against a heavily-populated `/var/lib/archipelago` (bitcoin,
btcpay, botfights, blobs, live LND/mesh state). That node must not be disturbed — it is the
dev-pair deploy target gated before every OTA.

## Solution

Two shapes, both ISO-free. Ship A first, then B.

**(A) Lightweight second instance, same Linux user.** Own empty `ARCHIPELAGO_DATA_DIR`, own
`ARCHIPELAGO_BIND` port, `ARCHIPELAGO_PORT_OFFSET` set, mesh/Reticulum disabled. Boots
un-onboarded, so it exercises the true first-run path: seed generation, password/setup,
identity keygen, node naming, onboarding UI. Cheap to create and destroy — the natural
regression harness for onboarding changes.

**(B) Second Linux user** (`useradd` + `loginctl enable-linger` + its own rootless podman
namespace + own data dir). Gives a genuinely independent node where app install / uninstall /
reinstall lifecycle is real, not shared. This is what makes it a *testing node* rather than a
first-run mock.

## Hazards (verified by grep 2026-08-01, must be designed around)

1. **Hardcoded paths defeat `ARCHIPELAGO_DATA_DIR`.** Several constants point at
   `/var/lib/archipelago` literally and ignore the override: `bitcoin_rpc.rs:10`
   (`SECRETS_PATH`), `container/lnd.rs:131` (`ARCHY_DATA_DIR`), `electrs_status.rs:15`,
   `api/rpc/package/pine_ha.rs:34-36`, `bootstrap.rs:242` (secrets dir), `disk_monitor.rs:41`.
   Under shape (A) a test instance that installs **Bitcoin, LND, electrumx, or Pine/HA would
   read and write the LIVE node's files.** Those four are off-limits in (A); shape (B) fixes
   this properly via a different user's paths — or the constants get plumbed through config,
   which is arguably the real fix and a candidate follow-up.
2. **Rootless podman is per-Linux-user.** In (A) both instances share one container
   namespace: `PORT_OFFSET` resolves port collisions, container *name* collisions it does not.
3. **Reticulum/mesh contention.** The live daemon holds `/dev/mesh-radio` and
   `identity/node_key`; a second instance would fight it for the radio. Mesh must be off for
   the test node (or the radio explicitly assigned to one of them).

## Notes

Raised while resuming quick task 260731-upz (entropy/seed audit) — shape (A) is also the
natural on-node harness for that audit's UNVERIFIED checklist, since fresh-seed generation is
exactly the `[ARCHY-1]` path under review. Sequence this after 260731-upz lands.