dsh-mobile 0.6.18 → 0.7.0

package/lib/client.js

@@ -1021,6 +1021,105 @@ window.__ModuleLoader__.load({
 			frpStopped: "FRP 连接已停止。",
 			frpExited: "frpc 意外退出，请检查 VPS 配置后重新连接。"
 		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			irohName: "iroh (Experimental)",
+			irohExperimental: "Experimental",
+			irohNotReady: "iroh is not running. Start the channel first, then generate a pairing code.",
+			irohPairingFailed: "Could not open an iroh pairing window. Reconnect the channel and retry.",
+			irohPairingTitle: "Phone pairing (experimental)",
+			generateIrohQr: "Generate iroh pairing QR code",
+			enlargeQr: "Enlarge the QR code",
+			closeEnlargedQr: "Close the enlarged QR code",
+			irohPairingReady: "iroh pairing code {code} is live for five minutes. Scan it from the iroh pairing screen; opening another code replaces this one.",
+			irohDescription: "Direct encrypted connection with relay fallback. No public domain or tunnel account needed.",
+			prepareIroh: "Prepare iroh",
+			irohInstallNote: "The Install button downloads the pinned sidecar release (dsh-mobile-iroh 0.1.0-alpha.1, about 15 MB on Windows x64, 24 MB on Linux x64) into the plugin private directory and verifies its SHA-256. An installed companion with a verified copy is reused instead, with no download.",
+			irohComponentNote: "An installed sidecar is re-verified by SHA-256 on every use. It is not bundled with the plugin package; a companion-provided copy can only be removed by removing the companion.",
+			irohPhaseNote: "Experimental connection. Requires the full Android App 0.7.0+ with iroh; the compatibility APK and mobile browsers cannot use it.",
+			irohUnavailable: "iroh is not ready: no sidecar is installed yet. Install the official component below to download and verify it.",
+			irohStarting: "Resolving the iroh endpoint identity…",
+			irohConnecting: "Sidecar connected; starting the DSH authentication gateway…",
+			irohCompanionMissing: "No verified iroh sidecar is available. Use Install official component below; a separate companion plugin is optional.",
+			irohDataDirectoryInvalid: "Could not prepare the private sidecar directory. Check that DSH can manage its own profile directory, then retry.",
+			irohSidecarInvalid: "The installed sidecar failed checksum verification. Reinstall the component.",
+			irohDownloadFailed: "The sidecar download failed before verification. Check the network and retry.",
+			irohPlatformUnsupported: "iroh sidecars are published for Windows x64 and Linux x64 only.",
+			irohIdentityFailed: "Could not read the iroh endpoint identity from the sidecar.",
+			irohLaunchFailed: "The iroh sidecar failed to start.",
+			irohExited: "The iroh sidecar exited unexpectedly. Reconnect.",
+			irohTimeout: "Timed out waiting for the iroh sidecar. Reconnect.",
+			irohInstallConfirm: "Download and verify the pinned iroh sidecar now (about 15 MB on Windows x64, 24 MB on Linux x64)? Nothing else is installed.",
+			installingIroh: "Downloading and verifying the iroh sidecar…",
+			switchingIroh: "Switching to iroh…",
+			reconnectingIroh: "Reconnecting the iroh transport…",
+			resetIrohConfirm: "Disable the iroh channel? The companion and its pairings stay installed."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			irohName: "iroh (Sperimentale)",
+			irohExperimental: "Sperimentale",
+			irohNotReady: "iroh non è attivo. Avvia il canale e genera di nuovo il codice.",
+			irohPairingFailed: "Impossibile aprire una finestra di abbinamento iroh. Riconnetti il canale e riprova.",
+			irohPairingTitle: "Abbinamento telefono (sperimentale)",
+			generateIrohQr: "Genera QR di abbinamento iroh",
+			enlargeQr: "Ingrandisci il codice QR",
+			closeEnlargedQr: "Chiudi il codice QR ingrandito",
+			irohPairingReady: "Il codice iroh {code} è attivo per cinque minuti. Scansionalo dalla schermata di abbinamento iroh; aprirne un altro sostituisce questo.",
+			irohDescription: "Connessione cifrata diretta con ripiego su relay. Nessun dominio pubblico o account tunnel richiesto.",
+			prepareIroh: "Prepara iroh",
+			irohInstallNote: "Il pulsante Installa scarica la release pinnata del sidecar (dsh-mobile-iroh 0.1.0-alpha.1, circa 15 MB su Windows x64, 24 MB su Linux x64) nella directory privata del plugin e ne verifica lo SHA-256. Un complemento installato con una copia verificata viene invece riutilizzato senza scaricare nulla.",
+			irohComponentNote: "Un sidecar installato viene riverificato tramite SHA-256 a ogni uso. Non è incluso nel pacchetto del plugin; una copia fornita dal complemento può essere rimossa solo rimuovendo il complemento.",
+			irohPhaseNote: "Connessione sperimentale. Richiede l’App Android completa 0.7.0+ con iroh; APK compatibile e browser mobili non sono supportati.",
+			irohUnavailable: "iroh non è pronto: nessun sidecar è ancora installato. Installa il componente ufficiale qui sotto per scaricarlo e verificarlo.",
+			irohStarting: "Risoluzione dell’identità endpoint iroh…",
+			irohConnecting: "Sidecar connesso; avvio del gateway di autenticazione DSH…",
+			irohCompanionMissing: "Nessun sidecar iroh verificato disponibile. Usa Installa componente ufficiale qui sotto; il plugin complementare è facoltativo.",
+			irohDataDirectoryInvalid: "Impossibile preparare la directory privata del sidecar. Verifica che DSH possa gestire la propria directory del profilo, poi riprova.",
+			irohSidecarInvalid: "Il sidecar installato non ha superato la verifica del checksum. Reinstalla il componente.",
+			irohDownloadFailed: "Download del sidecar non riuscito prima della verifica. Controlla la rete e riprova.",
+			irohPlatformUnsupported: "I sidecar iroh sono pubblicati solo per Windows x64 e Linux x64.",
+			irohIdentityFailed: "Impossibile leggere l’identità endpoint iroh dal sidecar.",
+			irohLaunchFailed: "Avvio del sidecar iroh non riuscito.",
+			irohExited: "Il sidecar iroh è terminato inaspettatamente. Riconnettiti.",
+			irohTimeout: "Attesa del sidecar iroh scaduta. Riconnettiti.",
+			irohInstallConfirm: "Scaricare e verificare ora il sidecar iroh pinnato (circa 15 MB su Windows x64, 24 MB su Linux x64)? Non viene installato altro.",
+			installingIroh: "Download e verifica del sidecar iroh…",
+			switchingIroh: "Passaggio a iroh…",
+			reconnectingIroh: "Riconnessione del trasporto iroh…",
+			resetIrohConfirm: "Disattivare il canale iroh? Complemento e abbinamenti restano installati."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			irohName: "iroh（实验性）",
+			irohExperimental: "实验性",
+			irohNotReady: "iroh 通道未运行，请先启动通道再生成配对码。",
+			irohPairingFailed: "无法打开 iroh 配对窗口，请重连通道后重试。",
+			irohPairingTitle: "手机配对（实验性）",
+			generateIrohQr: "生成 iroh 配对二维码",
+			enlargeQr: "放大二维码",
+			closeEnlargedQr: "关闭放大的二维码",
+			irohPairingReady: "iroh 配对码 {code} 已生效，有效期 5 分钟。请在 App 的 iroh 配对页扫码；再生成一个会替换当前这个。",
+			irohDescription: "加密直连，失败时走中继。不需要公网域名或隧道账号。",
+			prepareIroh: "准备 iroh",
+			irohInstallNote: "点击安装会下载固定的 sidecar 发行版（dsh-mobile-iroh 0.1.0-alpha.1，Windows x64 约 15 MB，Linux x64 约 24 MB）到插件私有目录并校验 SHA-256；已安装的配套插件如有校验通过的副本会直接复用，不再下载。",
+			irohComponentNote: "已安装的 sidecar 每次使用都会重新校验 SHA-256。它不随插件包发布；配套提供的副本只能通过移除配套插件来删除。",
+			irohPhaseNote: "实验性连接。需使用含 iroh 的 Android App 0.7.0 及以上完整版；兼容版 APK 和手机浏览器不支持。",
+			irohUnavailable: "iroh 未就绪：尚未安装 sidecar，点击下方「安装官方组件」下载并校验。",
+			irohStarting: "正在解析 iroh 端点身份…",
+			irohConnecting: "Sidecar 已连接，正在启动 DSH 认证网关…",
+			irohCompanionMissing: "尚无校验通过的 iroh 组件，请点击下方「安装官方组件」；无需另装配套插件。",
+			irohDataDirectoryInvalid: "无法准备 sidecar 私有目录。请确认 DSH 能管理自己的配置目录后重试。",
+			irohSidecarInvalid: "已安装的 sidecar 哈希校验失败，请重装组件。",
+			irohDownloadFailed: "下载 sidecar 失败，还没开始校验。请检查网络后重试。",
+			irohPlatformUnsupported: "iroh sidecar 仅发布 Windows x64 与 Linux x64 版本。",
+			irohIdentityFailed: "无法从 sidecar 读取 iroh 端点身份。",
+			irohLaunchFailed: "iroh sidecar 启动失败。",
+			irohExited: "iroh sidecar 意外退出，请重新连接。",
+			irohTimeout: "等待 iroh sidecar 超时，请重新连接。",
+			irohInstallConfirm: "现在下载并校验固定的 iroh sidecar 吗（Windows x64 约 15 MB，Linux x64 约 24 MB）？不会安装其他任何内容。",
+			installingIroh: "正在下载并校验 iroh sidecar…",
+			switchingIroh: "正在切换到 iroh…",
+			reconnectingIroh: "正在重连 iroh 传输…",
+			resetIrohConfirm: "要停用 iroh 通道吗？配套插件与配对不受影响。"
+		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
 			requestTimeout: "The operation timed out. Confirm that DSH is still running, then try again.",
 			diagnostics: "Diagnostics",
@@ -7857,25 +7956,64 @@ window.__ModuleLoader__.load({
 		function ownsMobileCustomization(gateway, frontend) {
 			return gateway === true || frontend === "dedicated";
 		}
-		/** Emit each safe failure once until recovery, and ignore work after cancellation or disposal. */
+		/**
+		* Emit each safe failure once until recovery, and ignore work after cancellation
+		* or disposal.
+		*
+		* A failure that only reaches the console is invisible to the user, who sees the
+		* customization disappear and cannot tell it from a third-party plugin bug
+		* (issue #298). The reporter therefore also publishes its current state so the
+		* page can render a visible, localized notice with an explicit recovery action.
+		* @param locale - resolves the active UI locale for the copy.
+		* @param output - console sink for the developer-facing line.
+		* @returns the reporting calls plus a subscribable snapshot.
+		*/
 		function createMobileAssetLoadReporter(locale, output = console) {
 			const reported = /* @__PURE__ */ new Set();
+			const listeners = /* @__PURE__ */ new Set();
 			let disposed = false;
+			const visible = () => {
+				if (reported.has("authentication_required")) return "authentication_required";
+				if (reported.has("gateway_required")) return "gateway_required";
+				return reported.values().next().done === true ? void 0 : reported.values().next().value;
+			};
+			const publish = () => {
+				const state = visible();
+				for (const listener of listeners) try {
+					listener(state);
+				} catch (error) {}
+			};
 			return {
 				fail(reason, signal) {
 					if (disposed || signal?.aborted === true || reported.has(reason)) return;
 					if (reason === "resource_unavailable" && reported.has("authentication_required")) return;
 					reported.add(reason);
 					output.warn(`[DSH Mobile] ${COPY[locale()][reason]}`);
+					publish();
 				},
 				recover(signal) {
 					if (disposed || signal.aborted || reported.size === 0) return;
 					reported.clear();
 					output.info(`[DSH Mobile] ${COPY[locale()].recovered}`);
+					publish();
 				},
 				dispose() {
 					disposed = true;
 					reported.clear();
+					listeners.clear();
+				},
+				getState() {
+					return disposed ? void 0 : visible();
+				},
+				subscribe(listener) {
+					if (disposed) return () => {};
+					listeners.add(listener);
+					return () => {
+						listeners.delete(listener);
+					};
+				},
+				message(reason) {
+					return COPY[locale()][reason];
 				}
 			};
 		}
@@ -7925,6 +8063,125 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/mobile-customization-notice.ts
+		/** Copy for the notice, per locale, kept beside the existing dictionaries. */
+		const NOTICE_COPY = {
+			en: {
+				title: {
+					authentication_required: "Device authentication is unavailable.",
+					gateway_required: "Custom mobile CSS, scripts and extensions need the paired Mobile access entry.",
+					other: "Mobile customization could not be loaded."
+				},
+				action: "Retry loading",
+				dismiss: "Dismiss"
+			},
+			zh: {
+				title: {
+					authentication_required: "设备认证暂不可用。",
+					gateway_required: "自定义移动样式、脚本与扩展需要通过已配对的移动访问入口打开。",
+					other: "移动定制加载失败。"
+				},
+				action: "重试加载",
+				dismiss: "忽略"
+			},
+			it: {
+				title: {
+					authentication_required: "Autenticazione del dispositivo non disponibile.",
+					gateway_required: "CSS, script ed estensioni mobili richiedono l’accesso Mobile abbinato.",
+					other: "Impossibile caricare la personalizzazione mobile."
+				},
+				action: "Riprova il caricamento",
+				dismiss: "Ignora"
+			}
+		};
+		const NOTICE_ATTRIBUTE = "data-dsh-mobile-customization-notice";
+		const NOTICE_STYLES = `
+[${NOTICE_ATTRIBUTE}]{position:fixed;z-index:1000;left:8px;right:8px;bottom:calc(env(safe-area-inset-bottom) + 8px);display:flex;align-items:flex-start;gap:10px;box-sizing:border-box;padding:10px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 8px 24px rgb(15 23 42 / 18%);font:13px/1.45 system-ui;color:var(--dsw-alias-label-primary,#16181d)}
+[${NOTICE_ATTRIBUTE}][hidden]{display:none}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{flex:1 1 auto;min-width:0}
+[${NOTICE_ATTRIBUTE}] button{flex:none;box-sizing:border-box;min-height:44px;min-width:44px;padding:0 10px;border:1px solid transparent;border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#16181d);font:600 13px/1.2 system-ui;cursor:pointer}
+[${NOTICE_ATTRIBUTE}] button.dshm-notice-action{background:var(--dsw-alias-state-business-primary,#2563eb);color:#fff;border-color:transparent}
+[${NOTICE_ATTRIBUTE}] button:hover{opacity:.9}
+[${NOTICE_ATTRIBUTE}]{max-height:40vh;overflow:auto;left:max(8px,env(safe-area-inset-left));right:max(8px,env(safe-area-inset-right));flex-wrap:wrap}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{margin:0;flex-basis:100%}
+[${NOTICE_ATTRIBUTE}] button:focus-visible{outline:2px solid currentColor;outline-offset:2px}
+[${NOTICE_ATTRIBUTE}]{background-color:Canvas;background-image:linear-gradient(var(--dsw-alias-bg-layer-2,Canvas),var(--dsw-alias-bg-layer-2,Canvas));color:var(--dsw-alias-label-primary,CanvasText)}
+`;
+		/** Copy key for a failure, so the notice and the console never disagree. */
+		function titleKey(reason) {
+			return reason === "authentication_required" || reason === "gateway_required" ? reason : "other";
+		}
+		/**
+		* Mount one visible notice that follows the customization reporter's state.
+		* @param document - the page that owns the notice.
+		* @param options - locale lookup and the reconnect action.
+		* @returns a disposer that removes the notice and its stylesheet.
+		*/
+		function installCustomizationNotice(document, options) {
+			if (!(typeof document.createElement === "function" && typeof document.body?.append === "function" && typeof document.head?.append === "function")) return () => {};
+			const style = document.createElement("style");
+			style.dataset.plugin = "dsh-mobile-notice";
+			style.textContent = NOTICE_STYLES;
+			document.head.append(style);
+			const notice = document.createElement("div");
+			if (typeof notice.setAttribute !== "function" || typeof notice.append !== "function") {
+				style.remove();
+				return () => {};
+			}
+			notice.setAttribute(NOTICE_ATTRIBUTE, "");
+			notice.setAttribute("role", "status");
+			notice.setAttribute("aria-live", "polite");
+			notice.hidden = true;
+			const text = document.createElement("p");
+			text.className = "dshm-notice-text";
+			const action = document.createElement("button");
+			action.type = "button";
+			action.className = "dshm-notice-action";
+			const dismiss = document.createElement("button");
+			dismiss.type = "button";
+			notice.append(text, action, dismiss);
+			document.body.append(notice);
+			let current;
+			let dismissed;
+			const render = () => {
+				const copy = NOTICE_COPY[options.locale()] ?? NOTICE_COPY.en;
+				if (current === void 0 || current === dismissed) {
+					notice.hidden = true;
+					return;
+				}
+				const detail = options.message(current);
+				text.textContent = `${copy.title[titleKey(current)]} ${detail}`;
+				action.textContent = copy.action;
+				dismiss.textContent = copy.dismiss;
+				notice.hidden = false;
+			};
+			let disposed = false;
+			const retry = () => {
+				if (!disposed) options.reconnect();
+			};
+			const close = () => {
+				if (disposed) return;
+				dismissed = current;
+				render();
+			};
+			action.addEventListener("click", retry);
+			dismiss.addEventListener("click", close);
+			const unsubscribe = options.subscribe((reason) => {
+				if (reason !== current) dismissed = void 0;
+				current = reason;
+				render();
+			});
+			render();
+			return () => {
+				disposed = true;
+				action.removeEventListener("click", retry);
+				dismiss.removeEventListener("click", close);
+				unsubscribe();
+				notice.remove();
+				style.remove();
+			};
+		}
+		//#endregion
 		//#region src/extension-limits.ts
 		/** Maximum sizes accepted for legacy mobile customization resources. */
 		const LEGACY_CUSTOM_ASSET_LIMIT = 262144;
@@ -7948,6 +8205,25 @@ window.__ModuleLoader__.load({
 		function shouldRenewSession(connection, downForMs) {
 			return isDisconnected(connection) && downForMs >= 5e3;
 		}
+		/**
+		* Authentication rejection can warrant one renewal even while transport appears
+		* connected. A 403 can also indicate a permission failure, so it is not proof
+		* that the Session expired.
+		*
+		* Issue #298: DSH keeps Sessions in memory, so a Host restart kills every phone
+		* Session while the device credential survives. The live WebSocket can keep
+		* reporting `connected` for a while, so waiting for a disconnect never fires and
+		* the customization channel stays dark. A 401/403 on an authenticated gateway
+		* request is the signal that actually arrives, and it must be able to start the
+		* same renewal the disconnect path uses.
+		* @param status - HTTP status of a rejected gateway request.
+		* @param connection - current public connection state, if known.
+		* @returns whether this rejection should request a renewal.
+		*/
+		function shouldRenewAfterRejection(status, connection) {
+			if (status !== 401 && status !== 403) return false;
+			return !isDisconnected(connection) || connection === void 0;
+		}
 		function isDisconnected(connection) {
 			return connection === "connecting" || connection === "disconnected";
 		}
@@ -7956,9 +8232,12 @@ window.__ModuleLoader__.load({
 		* @param getConnection - Resolve the current service to reject a replaced owner.
 		* @param page - The document's window and advertised native adapter.
 		* @param document - The mounted document; page replacement withdraws its work.
+		* @param onRejected - receives the rejection signal, so a caller that observes a
+		* 401 can ask this same owner for one renewal instead of starting its own.
+		* @param onRenewed - refresh read-only customization after confirmed Cookie installation.
 		* @returns An awaited disposer, or nothing when no public connection is present.
 		*/
-		function installMobileConnectionRecovery(getConnection, page, document) {
+		function installMobileConnectionRecovery(getConnection, page, document, onRejected, onRenewed) {
 			const connection = getConnection();
 			const state = connection?.state;
 			if (connection === void 0 || state === void 0 || typeof connection.reconnect !== "function") return;
@@ -7968,6 +8247,8 @@ window.__ModuleLoader__.load({
 			let currentState = state.getSnapshot();
 			let downSince = isDisconnected(currentState) ? Date.now() : void 0;
 			let attempted = false;
+			let credentialsRejected = false;
+			let rejectedSince;
 			let bridge = page.__DSH_MOBILE_NATIVE__;
 			let pending;
 			let pendingAbort;
@@ -7981,8 +8262,13 @@ window.__ModuleLoader__.load({
 				const next = state.getSnapshot();
 				if (!isDisconnected(next)) {
 					downSince = void 0;
-					attempted = false;
-					if (currentState !== next) cancelPending();
+					if (currentState !== next) {
+						if (next === "connected") {
+							rejectedSince = void 0;
+							attempted = false;
+						}
+						cancelPending();
+					}
 				} else if (downSince === void 0) {
 					downSince = Date.now();
 					attempted = false;
@@ -7999,30 +8285,63 @@ window.__ModuleLoader__.load({
 			const renew = () => {
 				if (!current()) {
 					dispose();
-					return;
+					return false;
 				}
 				updateState();
 				updateBridge();
 				const adapter = bridge;
-				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || downSince === void 0 || !shouldRenewSession(currentState, Date.now() - downSince)) return;
+				const downLongEnough = downSince !== void 0 && shouldRenewSession(currentState, Date.now() - downSince);
+				const rejectionPending = rejectedSince !== void 0;
+				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || credentialsRejected || !downLongEnough && !rejectionPending) return false;
 				attempted = true;
 				const owner = generation;
 				const abort = new AbortController();
 				pendingAbort = abort;
-				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter && isDisconnected(state.getSnapshot());
+				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter;
 				const task = Promise.resolve().then(async () => {
 					if (!owns()) return;
 					const capabilities = await adapter.capabilities();
 					if (!owns() || !capabilities.includes("auth.renew")) return;
 					const result = await adapter.invoke("auth.renew", {}, { signal: abort.signal });
 					if (!owns() || typeof result !== "object" || result === null || !("renewed" in result) || result.renewed !== true) return;
+					rejectedSince = void 0;
 					connection.reconnect?.();
-				}).catch((_error) => {}).finally(() => {
+					if (current()) onRenewed?.();
+				}).catch((error) => {
+					if (!owns() || typeof error !== "object" || error === null || !("code" in error)) return;
+					credentialsRejected = error.code === "device_revoked" || error.code === "device_expired" || error.code === "authentication_failed";
+				}).finally(() => {
 					if (pending !== task) return;
 					pending = void 0;
 					pendingAbort = void 0;
 				});
 				pending = task;
+				return true;
+			};
+			const retry = () => {
+				if (!current()) return false;
+				updateState();
+				updateBridge();
+				if (!current() || pending !== void 0 || credentialsRejected || bridge === void 0 || rejectedSince === void 0 && downSince === void 0) return false;
+				attempted = false;
+				return renew();
+			};
+			/**
+			* Record a rejected authenticated request and try the same single renewal.
+			*
+			* Only an owner that is still current and has not already attempted may act, so
+			* a burst of 401s cannot start parallel renewals, and a revoked device cannot
+			* keep retrying: revocation arrives as 401 too, but the native bridge refuses
+			* `auth.renew` and the attempt is not restarted.
+			* @param status - HTTP status the gateway returned.
+			*/
+			const rejected = (status) => {
+				if (!current()) return;
+				updateState();
+				updateBridge();
+				if (!shouldRenewAfterRejection(status, state.getSnapshot())) return;
+				rejectedSince ??= Date.now();
+				renew();
 			};
 			const resume = () => {
 				if (!current()) {
@@ -8054,6 +8373,7 @@ window.__ModuleLoader__.load({
 			document.addEventListener("visibilitychange", resume);
 			page.addEventListener("dsh-mobile-native-ready", updateBridge);
 			page.addEventListener("pagehide", pagehide);
+			onRejected?.(rejected, retry);
 			return dispose;
 		}
 		//#endregion
@@ -9165,7 +9485,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		//#region src/client.ts
 		/** Map a host-reported provider onto the UI union, defaulting to the built-in one. */
 		function parseMobileRemoteProvider(value) {
-			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" ? value : "tailscale";
+			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" || value === "iroh" ? value : "tailscale";
 		}
 		/**
 		* Set a surface's visibility; opening a page or overlay brings it to the front.
@@ -9711,6 +10031,23 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frp_discovery_invalid: "frpDiscoveryInvalid",
 			frp_stopped: "frpStopped",
 			frp_exited: "frpExited",
+			iroh_companion_missing: "irohCompanionMissing",
+			iroh_data_directory_invalid: "irohDataDirectoryInvalid",
+			iroh_sidecar_invalid: "irohSidecarInvalid",
+			iroh_download_failed: "irohDownloadFailed",
+			iroh_download_size_mismatch: "irohDownloadFailed",
+			iroh_download_hash_mismatch: "irohSidecarInvalid",
+			iroh_download_timeout: "irohTimeout",
+			iroh_platform_unsupported: "irohPlatformUnsupported",
+			iroh_identity_failed: "irohIdentityFailed",
+			iroh_identity_timeout: "irohIdentityFailed",
+			iroh_identity_invalid: "irohIdentityFailed",
+			iroh_launch_failed: "irohLaunchFailed",
+			iroh_start_timeout: "irohTimeout",
+			iroh_start_failed: "irohLaunchFailed",
+			iroh_exited: "irohExited",
+			iroh_not_ready: "irohNotReady",
+			iroh_pairing_failed: "irohPairingFailed",
 			frp_server_address_invalid: "frpServerAddressInvalid",
 			frp_server_port_invalid: "frpServerPortInvalid",
 			frp_token_invalid: "frpTokenInvalid",
@@ -9822,7 +10159,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cpolar: "cpolar",
 				cloudflared: "cloudflared",
 				frp: t("frpName"),
-				origin: t("originName")
+				origin: t("originName"),
+				iroh: t("irohName")
 			};
 			const providerId = typeof facts.provider === "string" ? facts.provider : "";
 			const controllerCode = typeof facts.controllerCode === "string" ? facts.controllerCode : "";
@@ -10355,7 +10693,19 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoiceDescription.textContent = t("originDescription");
 			originChoiceTop.append(originChoiceName);
 			originChoice.append(originChoiceTop, originChoiceDescription);
-			selfHostedBody.append(frpChoice, originChoice);
+			const irohChoice = element("button", "dsh-mobile-control__provider is-iroh");
+			irohChoice.type = "button";
+			irohChoice.setAttribute("aria-pressed", "false");
+			const irohChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const irohChoiceName = element("strong");
+			irohChoiceName.textContent = t("irohName");
+			const irohChoiceBadge = element("span", "dsh-mobile-control__provider-badge is-iroh");
+			irohChoiceBadge.textContent = t("irohExperimental");
+			const irohChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			irohChoiceDescription.textContent = t("irohDescription");
+			irohChoiceTop.append(irohChoiceName, irohChoiceBadge);
+			irohChoice.append(irohChoiceTop, irohChoiceDescription);
+			selfHostedBody.append(frpChoice, originChoice, irohChoice);
 			selfHosted.append(selfHostedSummary, selfHostedBody);
 			providerSection.append(providerHeading, providerInfo, providerChoices, selfHosted);
 			const frpSetup = element("section", "dsh-mobile-control__frp-setup");
@@ -10839,7 +11189,77 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			providerSetupMeta.append(providerSetupName, remoteStateBadge);
 			providerSetupHeader.append(providerSetupHeading, providerSetupMeta);
 			const providerSetupBody = element("div", "dsh-mobile-control__provider-setup-body");
-			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, tailscaleInfo);
+			const irohSetup = element("section", "dsh-mobile-control__frp-setup");
+			irohSetup.hidden = true;
+			const irohSetupTitle = element("h3", "dsh-mobile-control__section-title");
+			irohSetupTitle.textContent = t("prepareIroh");
+			const irohPhaseNote = element("p", "dsh-mobile-control__component-note");
+			irohPhaseNote.textContent = t("irohPhaseNote");
+			const irohComponentStatus = element("p", "dsh-mobile-control__component-status");
+			irohComponentStatus.textContent = t("checkingComponent");
+			irohComponentStatus.setAttribute("role", "status");
+			irohComponentStatus.setAttribute("aria-live", "polite");
+			const irohInstall = element("button", "dsh-mobile-control__primary");
+			irohInstall.type = "button";
+			irohInstall.textContent = t("installOfficial");
+			const irohInstallProgress = element("progress", "dsh-mobile-control__progress");
+			irohInstallProgress.hidden = true;
+			irohInstallProgress.setAttribute("aria-hidden", "true");
+			const irohPairing = element("div", "dsh-mobile-control__ws-paths");
+			const irohPairingTitle = element("p", "dsh-mobile-control__component-status");
+			irohPairingTitle.textContent = t("irohPairingTitle");
+			const irohPair = element("button", "dsh-mobile-control__primary");
+			irohPair.type = "button";
+			irohPair.textContent = t("generateIrohQr");
+			const irohQr = element("div", "dsh-mobile-control__qr is-expandable");
+			irohQr.hidden = true;
+			const irohPairStatus = element("p", "dsh-mobile-control__component-status");
+			const irohCopyDescriptor = element("button", "dsh-mobile-control__secondary");
+			irohCopyDescriptor.type = "button";
+			irohCopyDescriptor.textContent = t("copyPairLink");
+			irohCopyDescriptor.hidden = true;
+			irohPairing.append(irohPairingTitle, irohPair, irohQr, irohPairStatus, irohCopyDescriptor);
+			const irohDetails = element("details", "dsh-mobile-control__details");
+			const irohDetailsSummary = element("summary");
+			irohDetailsSummary.textContent = t("componentDetails");
+			const irohDetailsBody = element("div", "dsh-mobile-control__details-body");
+			const irohDetailsText = element("p");
+			irohDetailsText.textContent = t("irohComponentNote");
+			const irohInstallNote = element("p");
+			irohInstallNote.textContent = t("irohInstallNote");
+			const irohStorage = element("code", "dsh-mobile-control__storage");
+			irohStorage.textContent = t("pluginPrivateDirectory");
+			const irohOfficial = element("a", "dsh-mobile-control__text-link");
+			irohOfficial.href = "https://www.npmjs.com/package/dsh-mobile-iroh";
+			irohOfficial.target = "_blank";
+			irohOfficial.rel = "noopener noreferrer";
+			irohOfficial.textContent = t("officialDownload");
+			irohDetailsBody.append(irohDetailsText, irohInstallNote, irohStorage, irohOfficial);
+			irohDetails.append(irohDetailsSummary, irohDetailsBody);
+			irohSetup.append(irohSetupTitle, irohPhaseNote, irohComponentStatus, irohInstall, irohInstallProgress, irohPairing, irohDetails);
+			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, irohSetup, tailscaleInfo);
+			const irohQrZoom = element("div", "dsh-mobile-control__qr-zoom");
+			irohQrZoom.hidden = true;
+			const irohQrZoomImage = element("img", "dsh-mobile-control__qr-zoom-image");
+			irohQrZoomImage.alt = t("pairingQr");
+			const irohQrZoomClose = element("button", "dsh-mobile-control__qr-zoom-close");
+			irohQrZoomClose.type = "button";
+			irohQrZoomClose.textContent = "×";
+			irohQrZoomClose.setAttribute("aria-label", t("closeEnlargedQr"));
+			const setIrohQrZoomOpen = (open) => {
+				if (open) {
+					irohQrZoom.setAttribute("role", "dialog");
+					irohQrZoom.setAttribute("aria-modal", "true");
+					irohQrZoom.setAttribute("aria-label", t("enlargeQr"));
+				} else {
+					irohQrZoom.removeAttribute("role");
+					irohQrZoom.removeAttribute("aria-modal");
+					irohQrZoom.removeAttribute("aria-label");
+				}
+				irohQrZoom.hidden = !open;
+			};
+			irohQrZoom.append(irohQrZoomImage, irohQrZoomClose);
+			root.append(irohQrZoom);
 			const remoteAccess = element("div", "dsh-mobile-control__access");
 			remoteAccess.hidden = true;
 			const remoteAccessLabel = element("span", "dsh-mobile-control__access-label");
@@ -10905,6 +11325,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remotePairLink.hidden = true;
 			let activeRemotePairUrl = "";
 			let activeRemotePairExpiresAt = 0;
+			let activeIrohDescriptor = "";
+			let activeIrohQrSvg = "";
 			remoteActions.append(remoteToggle, remoteLogin, remoteReconnect, remotePair, remoteCopyLink);
 			const remoteManageRow = element("div", "dsh-mobile-control__manage-row");
 			const remoteDevices = element("button", "dsh-mobile-control__manage");
@@ -11201,6 +11623,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let latestRemoteState = {};
 			let frpInstalled = false;
 			let frpConfigured = false;
+			let irohInstalled = false;
+			/** True while a companion checksum verification is in flight; polls must not wipe its progress. */
+			let irohVerifying = false;
 			let frpLayoutInitialized = false;
 			let frpDownloadSize = "14.0";
 			let configuredFrpServer = "";
@@ -11522,6 +11947,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const cloudflared = remoteProvider === "cloudflared";
 				const frp = remoteProvider === "frp";
 				const origin = remoteProvider === "origin";
+				const iroh = remoteProvider === "iroh";
 				const managedOrigin = origin && data.originMode === "managed";
 				const tailscale = remoteProvider === "tailscale";
 				tailscaleChoice.classList.toggle("is-selected", tailscale);
@@ -11537,17 +11963,20 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.tabIndex = cloudflared ? 0 : -1;
 				frpChoice.setAttribute("aria-pressed", String(frp));
 				originChoice.setAttribute("aria-pressed", String(origin));
-				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t(managedOrigin ? "caddyName" : "originName") : "Tailscale Funnel";
+				irohChoice.setAttribute("aria-pressed", String(iroh));
+				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t(managedOrigin ? "caddyName" : "originName") : iroh ? t("irohName") : "Tailscale Funnel";
 				tailscaleChoice.disabled = remoteProviderBusy;
 				cpolarChoice.disabled = remoteProviderBusy;
 				cloudflaredChoice.disabled = remoteProviderBusy;
 				frpChoice.disabled = remoteProviderBusy;
 				originChoice.disabled = remoteProviderBusy;
+				irohChoice.disabled = remoteProviderBusy;
 				cpolarSetup.hidden = !cpolar;
 				cloudflaredSetup.hidden = !cloudflared;
 				frpSetup.hidden = !frp;
 				originSetup.hidden = !origin;
-				if (frp || origin) selfHosted.open = true;
+				irohSetup.hidden = !iroh;
+				if (frp || origin || iroh) selfHosted.open = true;
 				tailscaleInfo.hidden = !tailscale;
 				remoteReset.textContent = tailscale ? t("resetRemoteLogin") : t("resetRemoteDevices");
 				const providers = data.providers !== null && typeof data.providers === "object" ? data.providers : {};
@@ -11702,6 +12131,30 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					frpVpsGroup.open = !frpConfigured;
 					frpLayoutInitialized = true;
 				}
+				const irohProvider = providers.iroh !== null && typeof providers.iroh === "object" ? providers.iroh : {};
+				const irohComponent = irohProvider.component !== null && typeof irohProvider.component === "object" ? irohProvider.component : {};
+				irohInstalled = irohComponent.installed === true;
+				const irohSupported = irohComponent.supported !== false;
+				const irohComponentError = typeof irohComponent.errorCode === "string" ? irohComponent.errorCode : "";
+				const irohVersion = typeof irohComponent.version === "string" ? irohComponent.version : "";
+				const irohDownloadBytes = typeof irohComponent.downloadBytes === "number" ? irohComponent.downloadBytes : 0;
+				const irohStoragePath = typeof irohComponent.storagePath === "string" ? irohComponent.storagePath : `DSH Mobile ${t("pluginPrivateDirectory")}`;
+				irohInstall.hidden = irohInstalled || !irohSupported;
+				if (irohVerifying) {
+					irohInstallProgress.hidden = false;
+					irohInstall.disabled = true;
+					irohInstall.textContent = t("installingIroh");
+					irohInstall.setAttribute("aria-busy", "true");
+					irohComponentStatus.textContent = t("installingIroh");
+				} else {
+					irohInstallProgress.hidden = true;
+					irohInstall.setAttribute("aria-busy", "false");
+					irohInstall.disabled = remoteProviderBusy;
+					irohInstall.textContent = irohDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(irohDownloadBytes) }) : t("installOfficial");
+					irohComponentStatus.textContent = !irohSupported ? t("irohPlatformUnsupported") : irohInstalled ? t("installed") + (irohVersion === "" ? "" : ` · ${irohVersion}`) : irohComponentError === "irohSidecarInvalid" ? t("irohSidecarInvalid") : t("irohUnavailable");
+				}
+				irohStorage.textContent = irohStoragePath;
+				irohStorage.title = irohStoragePath;
 				const originProvider = providers.origin !== null && typeof providers.origin === "object" ? providers.origin : {};
 				const originConfiguration = originProvider.configuration !== null && typeof originProvider.configuration === "object" ? originProvider.configuration : {};
 				originConfigured = originConfiguration.configured === true;
@@ -11792,10 +12245,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteStatus.classList.toggle("is-running", remoteReady);
 				const labels = {
 					off: t("remoteOff"),
-					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : t("remoteUnavailableTailscale"),
-					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : t("remoteStartingTailscale"),
+					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : iroh ? t("irohUnavailable") : t("remoteUnavailableTailscale"),
+					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : iroh ? t("irohStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
-					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : t("remoteConnectingTailscale"),
+					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : iroh ? t("irohConnecting") : t("remoteConnectingTailscale"),
 					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
@@ -11810,7 +12263,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteSetupRetry.disabled = remoteReconnectBusy;
 				remoteToggle.textContent = remoteRunning ? t("disableRemote") : t("enableRemote");
 				const originPrepared = data.originMode === "managed" ? caddySupported && caddyInstalled && caddyConfiguration.configured === true : originConfigured && !caddyModeManagedSelected;
-				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : true;
+				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : iroh ? irohInstalled : true;
 				remoteToggle.disabled = remoteProviderBusy || !providerPrepared && !(origin && remoteRunning);
 				remoteLogin.hidden = !tailscale || state !== "needs-login" || remoteLoginUrl === "";
 				remoteReconnect.hidden = needsFunnelSetup || state !== "error" && state !== "unavailable" || !providerPrepared;
@@ -11818,6 +12271,21 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remotePair.disabled = !remoteReady || remoteProviderBusy;
 				remoteCopyLink.disabled = !remoteReady || remoteProviderBusy;
 				remoteDevices.disabled = !remoteReady || remoteProviderBusy;
+				remotePair.hidden = iroh;
+				remoteCopyLink.hidden = iroh;
+				if (iroh) {
+					remoteQr.hidden = true;
+					remotePairLink.hidden = true;
+				}
+				irohPair.disabled = !remoteReady || !iroh || remoteProviderBusy;
+				if ((!iroh || !remoteReady) && activeIrohDescriptor !== "") {
+					activeIrohDescriptor = "";
+					activeIrohQrSvg = "";
+					showQr("", irohQr);
+					setIrohQrZoomOpen(false);
+					irohCopyDescriptor.hidden = true;
+					irohPairStatus.textContent = "";
+				}
 				if (origin) {
 					remoteReconnect.disabled = remoteProviderBusy || remoteReconnectBusy;
 					remoteReset.disabled = remoteProviderBusy;
@@ -11882,7 +12350,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.disabled = true;
 				frpChoice.disabled = true;
 				originChoice.disabled = true;
-				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : t("switchingTailscale");
+				irohChoice.disabled = true;
+				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : provider === "iroh" ? t("switchingIroh") : t("switchingTailscale");
 				controlRequestJson("/api/mobile-access/remote/provider", {
 					method: "POST",
 					body: JSON.stringify({ provider })
@@ -11909,6 +12378,111 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoice.addEventListener("click", () => {
 				chooseRemoteProvider("origin");
 			});
+			irohChoice.addEventListener("click", () => {
+				chooseRemoteProvider("iroh");
+			});
+			irohInstall.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("irohInstallConfirm"))) return;
+				remoteProviderBusy = true;
+				irohVerifying = true;
+				irohInstall.disabled = true;
+				irohInstall.textContent = t("installingIroh");
+				irohInstall.setAttribute("aria-busy", "true");
+				irohInstallProgress.hidden = false;
+				irohComponentStatus.textContent = t("installingIroh");
+				remoteStatus.textContent = t("installingIroh");
+				controlRequestJson("/api/mobile-access/remote/iroh/component/install", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
+					irohComponentStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					irohVerifying = false;
+					loadRemote();
+				});
+			});
+			const openIrohQrZoom = () => {
+				if (activeIrohQrSvg === "" || irohQr.hidden) return;
+				irohQrZoomImage.src = `data:image/svg+xml;base64,${btoa(activeIrohQrSvg)}`;
+				setIrohQrZoomOpen(true);
+				irohQrZoomClose.focus();
+			};
+			const closeIrohQrZoom = () => {
+				setIrohQrZoomOpen(false);
+				if (!irohQr.hidden) irohQr.focus();
+			};
+			irohQr.setAttribute("role", "button");
+			irohQr.setAttribute("tabindex", "0");
+			irohQr.setAttribute("aria-label", t("enlargeQr"));
+			irohQr.addEventListener("click", openIrohQrZoom);
+			irohQr.addEventListener("keydown", (event) => {
+				if (event.key !== "Enter" && event.key !== " ") return;
+				event.preventDefault();
+				openIrohQrZoom();
+			});
+			irohQrZoom.addEventListener("click", closeIrohQrZoom);
+			irohQrZoomClose.addEventListener("click", closeIrohQrZoom);
+			irohQrZoom.addEventListener("keydown", (event) => {
+				if (event.key !== "Escape") return;
+				closeIrohQrZoom();
+			});
+			const openIrohPairing = () => controlRequestJson("/api/mobile-access/remote/iroh/pairing/begin", {
+				method: "POST",
+				body: "{}"
+			}).then(async (data) => {
+				const record = data;
+				const qrSvg = typeof record.qrSvg === "string" ? record.qrSvg : "";
+				const code = typeof record.irohCode === "string" ? record.irohCode : "";
+				showQr(qrSvg, irohQr);
+				if (qrSvg === "" || code === "") {
+					activeIrohQrSvg = "";
+					irohPairStatus.textContent = t("keyGenerationFailed");
+					return;
+				}
+				activeIrohQrSvg = qrSvg;
+				const fields = [
+					"version",
+					"type",
+					"endpointId",
+					"origin",
+					"localPort",
+					"irohCode",
+					"gatewayToken",
+					"caCertificate",
+					"instanceId",
+					"expiresAt"
+				];
+				const descriptor = {};
+				for (const field of fields) descriptor[field] = record[field];
+				activeIrohDescriptor = JSON.stringify(descriptor);
+				irohCopyDescriptor.hidden = false;
+				irohPairStatus.textContent = t("irohPairingReady", { code });
+			});
+			irohPair.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				remoteProviderBusy = true;
+				irohPair.disabled = true;
+				irohPairStatus.textContent = t("loadingRemoteStatus");
+				openIrohPairing().catch((error) => {
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					irohPairStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					loadRemote();
+				});
+			});
+			irohCopyDescriptor.addEventListener("click", () => {
+				if (activeIrohDescriptor === "") return;
+				navigator.clipboard.writeText(activeIrohDescriptor).then(() => {
+					irohPairStatus.textContent = t("linkCopied");
+				}, () => {
+					irohPairStatus.textContent = t("remoteQrReady");
+				});
+			});
 			cloudflaredInstall.addEventListener("click", () => {
 				if (remoteProviderBusy) return;
 				if (!window.confirm(t("installConfirmCloudflared", { size: cloudflaredDownloadSize }))) return;
@@ -12901,7 +13475,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteReconnect.disabled = true;
 				remoteSetup.disabled = true;
 				remoteSetupRetry.disabled = true;
-				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : t("reconnectingTailscale");
+				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : remoteProvider === "iroh" ? t("reconnectingIroh") : t("reconnectingTailscale");
 				controlRequestJson("/api/mobile-access/remote/reconnect", {
 					method: "POST",
 					body: "{}"
@@ -13022,7 +13596,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (show) loadRemoteDevices();
 			});
 			remoteReset.addEventListener("click", () => {
-				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : t("resetTailscaleConfirm");
+				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : remoteProvider === "iroh" ? t("resetIrohConfirm") : t("resetTailscaleConfirm");
 				if (!window.confirm(prompt)) return;
 				controlRequestJson("/api/mobile-access/remote/reset", {
 					method: "POST",
@@ -13821,10 +14395,28 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			}
 		};
-		/** Install authenticated mobile customization refresh, retaining loaded legacy assets through temporary failures. */
-		function installCustomAssets() {
+		/**
+		* Install authenticated customization refresh, retaining assets through temporary failures.
+		* @param recovery - optional instance-owned authentication feedback and refresh registration.
+		* @returns synchronous teardown for the customization UI and refresh admission.
+		*/
+		function installCustomAssets(recovery) {
 			const reporter = createMobileAssetLoadReporter(selectedMobileControlLocale);
+			let refreshNow = () => {};
 			const customizationOwner = ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__);
+			const removeNotice = customizationOwner ? installCustomizationNotice(document, {
+				locale: () => {
+					const locale = selectedMobileControlLocale();
+					return locale === "zh" || locale === "it" ? locale : "en";
+				},
+				reconnect: () => {
+					const attempted = recovery?.retry() ?? false;
+					refreshNow();
+					return attempted;
+				},
+				subscribe: (listener) => reporter.subscribe(listener),
+				message: (reason) => reporter.message(reason)
+			}) : () => {};
 			const legacyStyle = element("style");
 			legacyStyle.dataset.plugin = "dsh-mobile-custom";
 			document.head.append(legacyStyle);
@@ -13856,7 +14448,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (reason === "authentication_required") events?.setEnabled(false);
 			};
 			const unavailable = (response, signal, fallback) => {
-				failed(response.status === 401 || response.status === 403 ? "authentication_required" : fallback, signal);
+				const rejectedAuth = response.status === 401 || response.status === 403;
+				failed(rejectedAuth ? "authentication_required" : fallback, signal);
+				if (rejectedAuth && !disposed && !signal.aborted) recovery?.rejected(response.status);
 				response.body?.cancel().catch((error) => {});
 			};
 			let expectedDefinitionId;
@@ -14416,6 +15010,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					events?.setEnabled(true);
 				}
 			});
+			refreshNow = () => {
+				stopRefresh.refresh();
+			};
+			const unregisterRefresh = recovery?.registerRefresh(refreshNow);
 			const stopEvents = startExtensionChangeStream(() => {
 				stopRefresh.refresh();
 			}, void 0, (payload) => {
@@ -14436,6 +15034,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			events = stopEvents;
 			return () => {
 				disposed = true;
+				unregisterRefresh?.();
+				removeNotice();
 				reporter.dispose();
 				stopNativeBack();
 				stopEvents();
@@ -14506,12 +15106,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 /* The cloudflared setup section deliberately reuses this card, so
    .dsh-mobile-control__cloudflared-setup is a DOM hook for targeting rather than a
    style rule of its own. */
-.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
+.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__progress{box-sizing:border-box;width:100%;height:6px;margin:0 0 10px}.dsh-mobile-control__progress[hidden]{display:none}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
 .dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
-.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
+.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}.dsh-mobile-control__qr.is-expandable{cursor:zoom-in}.dsh-mobile-control__qr.is-expandable:focus-visible{outline:3px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px;border-radius:12px}.dsh-mobile-control__qr-zoom{position:fixed;inset:0;z-index:1001;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.72)}.dsh-mobile-control__qr-zoom[hidden]{display:none}.dsh-mobile-control__qr-zoom-image{width:min(84vw,360px);height:min(84vw,360px);border-radius:12px;background:#fff;padding:12px}.dsh-mobile-control__qr-zoom-close{position:absolute;top:12px;right:16px;min-width:44px;min-height:44px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:600 18px/1 system-ui;cursor:pointer}
 .dsh-mobile-control__status{margin:0 0 14px;overflow-wrap:anywhere;color:var(--dsw-alias-label-secondary,#606873)}.dsh-mobile-control__status::before{display:inline-block;width:8px;height:8px;margin-right:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary,#98a1ad);content:""}.dsh-mobile-control__status.is-running::before{background:var(--dsw-alias-state-success-primary,#16a36a)}.dsh-mobile-control__status.is-key{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;word-break:break-all}
 .dsh-mobile-control__guide{margin:0 0 14px;padding:12px;border:1px solid #6f96db;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#eff6ff)}.dsh-mobile-control__guide[hidden]{display:none}.dsh-mobile-control__guide-title{margin:0;color:var(--dsw-alias-label-primary,#172554);font:650 13px/1.45 system-ui}.dsh-mobile-control__guide-summary,.dsh-mobile-control__guide-note{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#475569);font-size:12px;line-height:1.5}.dsh-mobile-control__guide-steps{margin:8px 0 0;padding-left:20px;color:var(--dsw-alias-label-primary,#1e293b);font-size:12px;line-height:1.6}.dsh-mobile-control__guide-note{color:var(--dsw-alias-label-secondary,#64748b)}.dsh-mobile-control__guide-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:10px}.dsh-mobile-control__guide-actions button{min-width:0;min-height:44px;padding:8px;border-radius:10px;font:12px/1.25 system-ui;cursor:pointer}.dsh-mobile-control__guide-actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control__extensions{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px}
@@ -14538,6 +15138,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 ` + EXTENSION_RECOVERY_STYLES;
 		/** Mount the desktop control or mobile feature enhancements. */
 		function apply(ctx) {
+			let gatewayRejectionSink;
+			let retryRecovery;
+			let refreshCustomization;
 			ctx.effect(() => installMobileUiLocalePersistence(document, window), "dsh-mobile: browser UI locale persistence");
 			ctx.effect(() => {
 				if (window.__DSH_MOBILE_FRONTEND__ !== "dedicated") return;
@@ -14546,7 +15149,26 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			}, "dsh-mobile: authenticated gateway client trust");
 			ctx.effect(() => {
 				if (!ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__)) return;
-				return installMobileConnectionRecovery(() => ctx.get("connection"), window, document);
+				let ownedRejection;
+				const recovery = installMobileConnectionRecovery(() => ctx.get("connection"), window, document, (rejected, retry) => {
+					ownedRejection = rejected;
+					gatewayRejectionSink = rejected;
+					retryRecovery = retry;
+				}, () => {
+					refreshCustomization?.();
+				});
+				if (recovery === void 0) {
+					gatewayRejectionSink = void 0;
+					retryRecovery = void 0;
+					return;
+				}
+				return () => {
+					if (gatewayRejectionSink === ownedRejection) {
+						gatewayRejectionSink = void 0;
+						retryRecovery = void 0;
+					}
+					return recovery();
+				};
 			}, "dsh-mobile: connection recovery");
 			ctx.effect(() => {
 				const desktopAdmin = isDesktopAdminSurface(location.hostname, location.search, window.__DSH_MOBILE_FRONTEND__, location.protocol);
@@ -14556,7 +15178,18 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				style.textContent = desktopAdmin ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
 				style.textContent += CLIENT_MODULE_STYLES;
 				document.head.append(style);
-				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets() : () => void 0;
+				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets({
+					rejected: (status) => {
+						gatewayRejectionSink?.(status);
+					},
+					retry: () => retryRecovery?.() ?? false,
+					registerRefresh: (refresh) => {
+						refreshCustomization = refresh;
+						return () => {
+							if (refreshCustomization === refresh) refreshCustomization = void 0;
+						};
+					}
+				}) : () => void 0;
 				const removeVoiceSession = installVoiceSession(!desktopAdmin);
 				const removeDraftTransfer = !desktopAdmin && document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null ? installDraftTransfer(ctx, window, document) : () => void 0;
 				const removeModuleSettings = ctx.slots.inject("settings.general.item", () => ctx.slots.register({