The nvpn daemon config at /var/lib/archipelago/nostr-vpn/ is owned by root, but the backend runs as archipelago. Direct write silently failed, so adding a second phone's npub never reached the daemon — service restarted with stale config. Now falls back to sudo cp for root-owned paths, and first-boot sets ownership to archipelago. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>