dsh-mobile 0.6.18 → 0.7.1

package/lib/client.js

@@ -104,6 +104,11 @@ window.__ModuleLoader__.load({
 				collapseMobileAccess: "Collapse Mobile access",
 				downloadAndroid: "Download latest Android app",
 				downloadAndroidVersion: "Download latest Android app · v{version}",
+				downloadAndroidIroh: "Download full APK (iroh)",
+				downloadAndroidIrohAria: "Download the full Android APK that includes iroh",
+				downloadAndroidIrohVersion: "Download full APK (iroh) · v{version}",
+				downloadAndroidVersionSize: "Download latest Android app · v{version} · {size} MB",
+				downloadAndroidIrohVersionSize: "Download full APK (iroh) · v{version} · {size} MB",
 				downloadAndroidAria: "Download the latest Android app from GitHub Releases",
 				downloadAndroidVersionAria: "Download Android app v{version} from GitHub Releases",
 				updatePlugin: "Update plugin",
@@ -117,6 +122,7 @@ window.__ModuleLoader__.load({
 				updateNow: "Update now",
 				updateLater: "Not now",
 				lan: "Local network",
+				lanChoiceDescription: "Same Wi-Fi or hotspot. Fastest path, no internet or account needed.",
 				remote: "Remote",
 				lanAccess: "Local network access",
 				remoteAccess: "Remote access",
@@ -124,7 +130,7 @@ window.__ModuleLoader__.load({
 				remoteAddress: "Remote address",
 				loadingStatus: "Loading status…",
 				loadingRemoteStatus: "Loading remote status…",
-				generateCopyKey: "Generate and copy key",
+				generateCopyKey: "Generate pairing QR code",
 				copyPairLink: "Copy pairing link",
 				managePairedDevices: "Manage paired devices",
 				clearAllDevices: "Clear all devices",
@@ -139,11 +145,11 @@ window.__ModuleLoader__.load({
 				providerInfoAria: "View remote connection security and network information",
 				providerGroupAria: "Remote connection method",
 				providerSafeTitle: "You remain protected",
-				providerSafeText: "Only paired devices can access DSH. cpolar is installed on demand and can be removed completely; Tailscale may be slow or unavailable on mainland China networks, where cpolar is recommended.",
+				providerSafeText: "Only paired devices can access DSH. On mainland China networks prefer iroh (peer-to-peer, no domain or account needed) or cpolar; Tailscale may be slow or unavailable there. Every on-demand component can be removed completely.",
 				builtIn: "Built in",
 				mainlandPreferred: "Preferred in mainland China",
-				tailscaleDescription: "Wider coverage; mainland China networks may be unstable. The first connection requires login and Funnel authorization.",
-				cpolarDescription: "Installs the official component on demand and is suitable for mainland China networks.",
+				tailscaleDescription: "Built in, no install. Broad coverage; sign in to Tailscale and enable Funnel once. Mainland China networks may be unstable.",
+				cpolarDescription: "Works well on mainland China networks. Installs the official component on demand and gives you a temporary public address.",
 				prepareCpolar: "Prepare cpolar",
 				checkingComponent: "Checking component…",
 				installOfficial: "Install official component",
@@ -174,13 +180,35 @@ window.__ModuleLoader__.load({
 				disableRemote: "Disable remote access",
 				continueLogin: "Continue login",
 				reconnect: "Reconnect",
-				generateRemoteQr: "Generate remote pairing QR code",
+				generateRemoteQr: "Generate pairing QR code",
 				copyRemoteLink: "Copy remote pairing link",
 				manageRemoteDevices: "Manage remote devices",
 				resetRemoteLogin: "Sign out and clear remote login",
 				resetRemoteDevices: "Disable and clear remote devices",
 				lanOn: "Local network access is on.",
 				lanOff: "Local network access is off.",
+				lanBadgeOn: "On",
+				lanBadgeOff: "Off",
+				qrGenerated: "LAN QR code generated. Scan it from the app.",
+				qrPlaceholder: "Tap “Generate pairing QR code” to show the pairing QR.",
+				irohQrPlaceholder: "Tap “Generate iroh pairing QR code” to show the QR.",
+				irohLinkCopied: "Pairing link copied. Paste or open it in the full Android app; browsers cannot use iroh.",
+				remoteQrPlaceholder: "Tap “Generate pairing QR code” to show the QR.",
+				remoteQrPlaceholderIdle: "Turn on remote access to generate the pairing QR.",
+				pairingExpires: "Pairing QR valid until {time}. Regenerating invalidates the old code.",
+				pairingExpired: "The pairing QR has expired. Generate a new one.",
+				cloudflaredEnableNeedsConfig: "Save the named-tunnel settings with “Save and connect” before turning on remote access.",
+				cloudflaredShowConfig: "Show settings",
+				cloudflaredHideConfig: "Hide settings",
+				cloudflaredEditConfig: "Edit",
+				cloudflaredSwitchModeDisconnect: "Switching tunnel type closes the current remote connection first. Continue?",
+				cloudflaredTunnelSaved: "Settings saved. Check the connection status above.",
+				purgeIroh: "Remove the downloaded iroh component",
+				irohPurgeConfirm: "Remove the iroh component downloaded by this plugin? Saved identity, pairings, companion packages and other programs are kept.",
+				irohComponentRunning: "Turn off iroh remote access before removing its component.",
+				purgingIroh: "Removing the iroh component…",
+				devicesLanTitle: "LAN devices",
+				devicesRemoteTitle: "Remote devices",
 				enableLan: "Enable local network access",
 				disableLan: "Disable local network access",
 				extensionsLoaded: "Extensions: {loaded} loaded",
@@ -273,6 +301,11 @@ window.__ModuleLoader__.load({
 				collapseMobileAccess: "Riduci Accesso mobile",
 				downloadAndroid: "Scarica l’ultima app Android",
 				downloadAndroidVersion: "Scarica l’ultima app Android · v{version}",
+				downloadAndroidIroh: "Scarica APK completa (iroh)",
+				downloadAndroidIrohAria: "Scarica l’APK Android completo con iroh",
+				downloadAndroidIrohVersion: "Scarica APK completa (iroh) · v{version}",
+				downloadAndroidVersionSize: "Scarica l’ultima app Android · v{version} · {size} MB",
+				downloadAndroidIrohVersionSize: "Scarica APK completa (iroh) · v{version} · {size} MB",
 				downloadAndroidAria: "Scarica l’ultima app Android da GitHub Releases",
 				downloadAndroidVersionAria: "Scarica l’app Android v{version} da GitHub Releases",
 				updatePlugin: "Aggiorna plugin",
@@ -286,6 +319,7 @@ window.__ModuleLoader__.load({
 				updateNow: "Aggiorna ora",
 				updateLater: "Non ora",
 				lan: "Rete locale",
+				lanChoiceDescription: "Stessa Wi-Fi o hotspot. Percorso più veloce, senza internet né account.",
 				remote: "Remoto",
 				lanAccess: "Accesso rete locale",
 				remoteAccess: "Accesso remoto",
@@ -293,7 +327,7 @@ window.__ModuleLoader__.load({
 				remoteAddress: "Indirizzo remoto",
 				loadingStatus: "Lettura stato…",
 				loadingRemoteStatus: "Lettura stato remoto…",
-				generateCopyKey: "Genera e copia chiave",
+				generateCopyKey: "Genera codice QR di abbinamento",
 				copyPairLink: "Copia link di abbinamento",
 				managePairedDevices: "Gestisci dispositivi abbinati",
 				clearAllDevices: "Rimuovi tutti i dispositivi",
@@ -308,11 +342,11 @@ window.__ModuleLoader__.load({
 				providerInfoAria: "Informazioni su sicurezza e rete della connessione remota",
 				providerGroupAria: "Metodo di connessione remota",
 				providerSafeTitle: "La protezione resta attiva",
-				providerSafeText: "Solo i dispositivi abbinati possono accedere a DSH. cpolar viene installato su richiesta e può essere rimosso completamente; Tailscale può essere lento o non disponibile nelle reti della Cina continentale, dove è consigliato cpolar.",
+				providerSafeText: "Solo i dispositivi abbinati possono accedere a DSH. Sulle reti della Cina continentale preferisci iroh (peer-to-peer, senza dominio o account) o cpolar; Tailscale può essere lento o non disponibile. Ogni componente installato su richiesta può essere rimosso completamente.",
 				builtIn: "Integrato",
 				mainlandPreferred: "Preferito in Cina continentale",
-				tailscaleDescription: "Copertura più ampia; le reti della Cina continentale possono essere instabili. Il primo collegamento richiede accesso e autorizzazione Funnel.",
-				cpolarDescription: "Installa su richiesta il componente ufficiale, adatto alle reti della Cina continentale.",
+				tailscaleDescription: "Integrato, nessuna installazione. Copertura ampia; accedi a Tailscale e abilita Funnel una volta. Le reti della Cina continentale possono essere instabili.",
+				cpolarDescription: "Adatto alle reti della Cina continentale. Installa il componente ufficiale su richiesta e fornisce un indirizzo pubblico temporaneo.",
 				prepareCpolar: "Prepara cpolar",
 				checkingComponent: "Controllo componente…",
 				installOfficial: "Installa componente ufficiale",
@@ -343,13 +377,35 @@ window.__ModuleLoader__.load({
 				disableRemote: "Disattiva accesso remoto",
 				continueLogin: "Continua accesso",
 				reconnect: "Riconnetti",
-				generateRemoteQr: "Genera QR di abbinamento remoto",
+				generateRemoteQr: "Genera codice QR di abbinamento",
 				copyRemoteLink: "Copia link di abbinamento remoto",
 				manageRemoteDevices: "Gestisci dispositivi remoti",
 				resetRemoteLogin: "Esci e rimuovi accesso remoto",
 				resetRemoteDevices: "Disattiva e rimuovi dispositivi remoti",
 				lanOn: "Accesso dalla rete locale attivo.",
 				lanOff: "Accesso dalla rete locale disattivato.",
+				lanBadgeOn: "Attivo",
+				lanBadgeOff: "Disattivo",
+				qrGenerated: "Codice QR LAN generato. Scansionalo dall’app.",
+				qrPlaceholder: "Tocca «Genera codice QR di abbinamento» per mostrare il QR.",
+				irohQrPlaceholder: "Tocca «Genera codice QR iroh» per mostrare il QR.",
+				irohLinkCopied: "Link di abbinamento copiato. Incollalo o aprilo nell’app Android completa; i browser non supportano iroh.",
+				remoteQrPlaceholder: "Tocca «Genera codice QR di abbinamento» per mostrare il QR.",
+				remoteQrPlaceholderIdle: "Attiva l’accesso remoto per generare il QR di abbinamento.",
+				pairingExpires: "QR di abbinamento valido fino a {time}. Rigenerare invalida il vecchio codice.",
+				pairingExpired: "Il QR di abbinamento è scaduto. Generane uno nuovo.",
+				cloudflaredEnableNeedsConfig: "Salva le impostazioni del tunnel con nome («Salva e connetti») prima di attivare l’accesso remoto.",
+				cloudflaredShowConfig: "Mostra impostazioni",
+				cloudflaredHideConfig: "Nascondi impostazioni",
+				cloudflaredEditConfig: "Modifica",
+				cloudflaredSwitchModeDisconnect: "Cambiare tipo di tunnel chiude prima la connessione remota attuale. Continuare?",
+				cloudflaredTunnelSaved: "Impostazioni salvate. Controlla lo stato della connessione qui sopra.",
+				purgeIroh: "Rimuovi il componente iroh scaricato",
+				irohPurgeConfirm: "Rimuovere il componente iroh scaricato da questo plugin? Identità, abbinamenti, pacchetti esterni e altri programmi vengono conservati.",
+				irohComponentRunning: "Disattiva l’accesso remoto iroh prima di rimuovere il componente.",
+				purgingIroh: "Rimozione del componente iroh…",
+				devicesLanTitle: "Dispositivi rete locale",
+				devicesRemoteTitle: "Dispositivi remoti",
 				enableLan: "Attiva accesso rete locale",
 				disableLan: "Disattiva accesso rete locale",
 				extensionsLoaded: "Estensioni: {loaded} caricate",
@@ -453,6 +509,11 @@ window.__ModuleLoader__.load({
 			collapseMobileAccess: "收起移动访问",
 			downloadAndroid: "下载最新 Android App",
 			downloadAndroidVersion: "下载最新 Android App · v{version}",
+			downloadAndroidIroh: "下载完整版 APK（含 iroh）",
+			downloadAndroidIrohAria: "下载包含 iroh 的完整版 Android APK",
+			downloadAndroidIrohVersion: "下载完整版（含 iroh）· v{version}",
+			downloadAndroidVersionSize: "下载最新 Android App · v{version} · {size} MB",
+			downloadAndroidIrohVersionSize: "下载完整版（含 iroh）· v{version} · {size} MB",
 			downloadAndroidAria: "从 GitHub Releases 下载最新版 Android App",
 			downloadAndroidVersionAria: "从 GitHub Releases 下载 Android App v{version}",
 			updatePlugin: "更新插件",
@@ -466,6 +527,7 @@ window.__ModuleLoader__.load({
 			updateNow: "立即更新",
 			updateLater: "暂不",
 			lan: "局域网",
+			lanChoiceDescription: "同一 Wi-Fi 或热点下直连，最快，不需要外网或账号。",
 			remote: "远程",
 			lanAccess: "局域网访问",
 			remoteAccess: "远程访问",
@@ -473,7 +535,7 @@ window.__ModuleLoader__.load({
 			remoteAddress: "远程地址",
 			loadingStatus: "正在读取状态…",
 			loadingRemoteStatus: "正在读取远程状态…",
-			generateCopyKey: "生成并复制密钥",
+			generateCopyKey: "生成配对二维码",
 			copyPairLink: "复制配对链接",
 			managePairedDevices: "管理配对设备",
 			clearAllDevices: "清除所有设备",
@@ -488,11 +550,11 @@ window.__ModuleLoader__.load({
 			providerInfoAria: "查看远程连接安全与网络说明",
 			providerGroupAria: "远程连接方式",
 			providerSafeTitle: "你始终可以放心",
-			providerSafeText: "只有已配对设备能进入 DSH。cpolar 按需安装并可彻底清理；Tailscale 在中国大陆网络下可能连接缓慢、中断或无法使用，国内网络建议优先尝试 cpolar。",
+			providerSafeText: "只有已配对设备能进入 DSH。国内网络建议优先尝试 iroh（点对点直连，无需域名或账号）或 cpolar；Tailscale 在中国大陆网络下可能连接缓慢、中断或无法使用。所有按需安装的组件都可彻底清理。",
 			builtIn: "内置",
 			mainlandPreferred: "国内网络优先",
-			tailscaleDescription: "覆盖更广；中国大陆网络可能不稳定，首次需登录并允许 Funnel。",
-			cpolarDescription: "按需安装官方组件，适合国内网络环境。",
+			tailscaleDescription: "内置无需安装。覆盖广；首次需登录 Tailscale 并开启 Funnel。中国大陆网络可能不稳定。",
+			cpolarDescription: "国内网络友好。按需安装官方组件，提供临时公网地址。",
 			prepareCpolar: "准备 cpolar",
 			checkingComponent: "正在检查组件…",
 			installOfficial: "安装官方组件",
@@ -523,13 +585,35 @@ window.__ModuleLoader__.load({
 			disableRemote: "关闭远程访问",
 			continueLogin: "继续登录",
 			reconnect: "重新连接",
-			generateRemoteQr: "生成远程配对二维码",
+			generateRemoteQr: "生成配对二维码",
 			copyRemoteLink: "复制远程配对链接",
 			manageRemoteDevices: "管理远程设备",
 			resetRemoteLogin: "退出并清除远程登录",
 			resetRemoteDevices: "关闭并清除远程设备",
 			lanOn: "局域网访问已开启。",
 			lanOff: "局域网访问已关闭。",
+			lanBadgeOn: "已开启",
+			lanBadgeOff: "已关闭",
+			qrGenerated: "局域网二维码已生成，用 App 扫描。",
+			qrPlaceholder: "点击「生成配对二维码」显示配对二维码。",
+			irohQrPlaceholder: "点击「生成 iroh 配对二维码」显示配对二维码。",
+			irohLinkCopied: "配对链接已复制。请在完整版 Android App 中粘贴或打开；浏览器无法使用 iroh。",
+			remoteQrPlaceholder: "点击「生成配对二维码」显示配对二维码。",
+			remoteQrPlaceholderIdle: "开启远程访问后可生成配对二维码。",
+			pairingExpires: "配对二维码有效期至 {time}。重新生成会使旧码失效。",
+			pairingExpired: "配对二维码已过期，请重新生成。",
+			cloudflaredEnableNeedsConfig: "请先保存命名隧道配置（点「保存并连接」）后再启用远程访问。",
+			cloudflaredShowConfig: "展开配置",
+			cloudflaredHideConfig: "收起配置",
+			cloudflaredEditConfig: "修改",
+			cloudflaredSwitchModeDisconnect: "切换快速隧道/命名隧道会先关闭当前远程连接，是否继续？",
+			cloudflaredTunnelSaved: "配置已保存，连接结果以上方状态为准。",
+			purgeIroh: "移除已下载的 iroh 组件",
+			irohPurgeConfirm: "移除本插件下载的 iroh 组件？已保存的身份、配对、外部伴随包和其他程序均会保留。",
+			irohComponentRunning: "请先关闭 iroh 远程访问，再移除组件。",
+			purgingIroh: "正在移除 iroh 组件…",
+			devicesLanTitle: "局域网设备",
+			devicesRemoteTitle: "远程设备",
 			enableLan: "开启局域网访问",
 			disableLan: "关闭局域网访问",
 			extensionsLoaded: "扩展：{loaded} 个已加载",
@@ -755,7 +839,7 @@ window.__ModuleLoader__.load({
 			selfHostedConnections: "Self-hosted connection",
 			advanced: "Advanced",
 			frpName: "Self-hosted FRP",
-			frpDescription: "A restricted FRP channel for this DSH gateway only. You manage the VPS and public address.",
+			frpDescription: "Needs a server with a public IP. Opens one dedicated channel for this DSH gateway; you own the VPS and port.",
 			prepareFrp: "Configure self-hosted FRP",
 			frpStep1Title: "1 · Connection details",
 			frpStep1Text: "Enter the VPS address, frps control port, shared token, and public HTTPS origin.",
@@ -845,7 +929,7 @@ window.__ModuleLoader__.load({
 			selfHostedConnections: "Connessione autogestita",
 			advanced: "Avanzato",
 			frpName: "FRP autogestito",
-			frpDescription: "Canale FRP limitato al solo gateway DSH. VPS e indirizzo pubblico restano sotto il tuo controllo.",
+			frpDescription: "Richiede un server con IP pubblico. Apre un canale dedicato per questo gateway DSH; VPS e porta restano tuoi.",
 			prepareFrp: "Configura FRP autogestito",
 			frpStep1Title: "1 · Dati di connessione",
 			frpStep1Text: "Inserisci indirizzo VPS, porta di controllo frps, token condiviso e origine HTTPS pubblica.",
@@ -935,7 +1019,7 @@ window.__ModuleLoader__.load({
 			selfHostedConnections: "自建连接",
 			advanced: "高级",
 			frpName: "自建 FRP",
-			frpDescription: "只为当前 DSH 网关建立单用途 FRP 通道，VPS 和公开入口由你掌控。",
+			frpDescription: "需要一台有公网 IP 的服务器。只为当前 DSH 网关开一条专用通道，VPS 和端口由你掌控。",
 			prepareFrp: "配置自建 FRP",
 			frpStep1Title: "1 · 连接信息",
 			frpStep1Text: "填写中转服务器地址、frps 控制端口、共享 Token 和手机访问地址。没有域名时，可直接使用公网 IPv4。",
@@ -1021,8 +1105,111 @@ window.__ModuleLoader__.load({
 			frpStopped: "FRP 连接已停止。",
 			frpExited: "frpc 意外退出，请检查 VPS 配置后重新连接。"
 		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			irohName: "iroh (Experimental)",
+			irohExperimental: "Experimental",
+			irohNotReady: "iroh is not running. Start the channel first, then generate a pairing code.",
+			irohPairingFailed: "Could not open an iroh pairing window. Reconnect the channel and retry.",
+			irohPairingTitle: "Phone pairing (experimental)",
+			generateIrohQr: "Generate iroh pairing QR code",
+			enlargeQr: "Enlarge the QR code",
+			closeEnlargedQr: "Close the enlarged QR code",
+			irohPairingReady: "iroh pairing code {code} is live for five minutes. Scan it from the iroh pairing screen; opening another code replaces this one.",
+			irohDescription: "Peer-to-peer encrypted link with relay fallback. No domain, port or account needed; requires the full Android App.",
+			prepareIroh: "Prepare iroh",
+			irohInstallNote: "The Install button downloads the pinned sidecar release (dsh-mobile-iroh 0.1.0-alpha.1, about 15 MB on Windows x64, 24 MB on Linux x64) into the plugin private directory and verifies its SHA-256. An installed companion with a verified copy is reused instead, with no download.",
+			irohComponentNote: "An installed sidecar is re-verified by SHA-256 on every use. It is not bundled with the plugin package; a companion-provided copy can only be removed by removing the companion.",
+			irohPhaseNote: "Experimental connection. Requires the full Android App 0.7.0+ with iroh; the compatibility APK and mobile browsers cannot use it.",
+			irohUnavailable: "iroh is not ready: no sidecar is installed yet. Install the official component below to download and verify it.",
+			irohInstalledNotReady: "iroh is installed but not running. Turn on remote access to start it.",
+			irohStarting: "Resolving the iroh endpoint identity…",
+			irohConnecting: "Sidecar connected; starting the DSH authentication gateway…",
+			irohCompanionMissing: "No verified iroh sidecar is available. Use Install official component below; a separate companion plugin is optional.",
+			irohDataDirectoryInvalid: "Could not prepare the private sidecar directory. Check that DSH can manage its own profile directory, then retry.",
+			irohSidecarInvalid: "The installed sidecar failed checksum verification. Reinstall the component.",
+			irohDownloadFailed: "The sidecar download failed before verification. Check the network and retry.",
+			irohPlatformUnsupported: "iroh sidecars are published for Windows x64 and Linux x64 only.",
+			irohIdentityFailed: "Could not read the iroh endpoint identity from the sidecar.",
+			irohLaunchFailed: "The iroh sidecar failed to start.",
+			irohExited: "The iroh sidecar exited unexpectedly. Reconnect.",
+			irohTimeout: "Timed out waiting for the iroh sidecar. Reconnect.",
+			irohInstallConfirm: "Download and verify the pinned iroh sidecar now (about 15 MB on Windows x64, 24 MB on Linux x64)? Nothing else is installed.",
+			installingIroh: "Downloading and verifying the iroh sidecar…",
+			switchingIroh: "Switching to iroh…",
+			reconnectingIroh: "Reconnecting the iroh transport…",
+			resetIrohConfirm: "Disable the iroh channel? The companion and its pairings stay installed."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			irohName: "iroh (Sperimentale)",
+			irohExperimental: "Sperimentale",
+			irohNotReady: "iroh non è attivo. Avvia il canale e genera di nuovo il codice.",
+			irohPairingFailed: "Impossibile aprire una finestra di abbinamento iroh. Riconnetti il canale e riprova.",
+			irohPairingTitle: "Abbinamento telefono (sperimentale)",
+			generateIrohQr: "Genera QR di abbinamento iroh",
+			enlargeQr: "Ingrandisci il codice QR",
+			closeEnlargedQr: "Chiudi il codice QR ingrandito",
+			irohPairingReady: "Il codice iroh {code} è attivo per cinque minuti. Scansionalo dalla schermata di abbinamento iroh; aprirne un altro sostituisce questo.",
+			irohDescription: "Collegamento cifrato peer-to-peer con ripiego su relay. Nessun dominio, porta o account richiesto; richiede l’App Android completa.",
+			prepareIroh: "Prepara iroh",
+			irohInstallNote: "Il pulsante Installa scarica la release pinnata del sidecar (dsh-mobile-iroh 0.1.0-alpha.1, circa 15 MB su Windows x64, 24 MB su Linux x64) nella directory privata del plugin e ne verifica lo SHA-256. Un complemento installato con una copia verificata viene invece riutilizzato senza scaricare nulla.",
+			irohComponentNote: "Un sidecar installato viene riverificato tramite SHA-256 a ogni uso. Non è incluso nel pacchetto del plugin; una copia fornita dal complemento può essere rimossa solo rimuovendo il complemento.",
+			irohPhaseNote: "Connessione sperimentale. Richiede l’App Android completa 0.7.0+ con iroh; APK compatibile e browser mobili non sono supportati.",
+			irohUnavailable: "iroh non è pronto: nessun sidecar è ancora installato. Installa il componente ufficiale qui sotto per scaricarlo e verificarlo.",
+			irohInstalledNotReady: "iroh è installato ma non in esecuzione. Attiva l’accesso remoto per avviarlo.",
+			irohStarting: "Risoluzione dell’identità endpoint iroh…",
+			irohConnecting: "Sidecar connesso; avvio del gateway di autenticazione DSH…",
+			irohCompanionMissing: "Nessun sidecar iroh verificato disponibile. Usa Installa componente ufficiale qui sotto; il plugin complementare è facoltativo.",
+			irohDataDirectoryInvalid: "Impossibile preparare la directory privata del sidecar. Verifica che DSH possa gestire la propria directory del profilo, poi riprova.",
+			irohSidecarInvalid: "Il sidecar installato non ha superato la verifica del checksum. Reinstalla il componente.",
+			irohDownloadFailed: "Download del sidecar non riuscito prima della verifica. Controlla la rete e riprova.",
+			irohPlatformUnsupported: "I sidecar iroh sono pubblicati solo per Windows x64 e Linux x64.",
+			irohIdentityFailed: "Impossibile leggere l’identità endpoint iroh dal sidecar.",
+			irohLaunchFailed: "Avvio del sidecar iroh non riuscito.",
+			irohExited: "Il sidecar iroh è terminato inaspettatamente. Riconnettiti.",
+			irohTimeout: "Attesa del sidecar iroh scaduta. Riconnettiti.",
+			irohInstallConfirm: "Scaricare e verificare ora il sidecar iroh pinnato (circa 15 MB su Windows x64, 24 MB su Linux x64)? Non viene installato altro.",
+			installingIroh: "Download e verifica del sidecar iroh…",
+			switchingIroh: "Passaggio a iroh…",
+			reconnectingIroh: "Riconnessione del trasporto iroh…",
+			resetIrohConfirm: "Disattivare il canale iroh? Complemento e abbinamenti restano installati."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			irohName: "iroh（实验性）",
+			irohExperimental: "实验性",
+			irohNotReady: "iroh 通道未运行，请先启动通道再生成配对码。",
+			irohPairingFailed: "无法打开 iroh 配对窗口，请重连通道后重试。",
+			irohPairingTitle: "手机配对（实验性）",
+			generateIrohQr: "生成 iroh 配对二维码",
+			enlargeQr: "放大二维码",
+			closeEnlargedQr: "关闭放大的二维码",
+			irohPairingReady: "iroh 配对码 {code} 已生效，有效期 5 分钟。请在 App 的 iroh 配对页扫码；再生成一个会替换当前这个。",
+			irohDescription: "点对点加密直连，跨网自动经中继。无需域名、端口或账号；需完整版 App。",
+			prepareIroh: "准备 iroh",
+			irohInstallNote: "点击安装会下载固定的 sidecar 发行版（dsh-mobile-iroh 0.1.0-alpha.1，Windows x64 约 15 MB，Linux x64 约 24 MB）到插件私有目录并校验 SHA-256；已安装的配套插件如有校验通过的副本会直接复用，不再下载。",
+			irohComponentNote: "已安装的 sidecar 每次使用都会重新校验 SHA-256。它不随插件包发布；配套提供的副本只能通过移除配套插件来删除。",
+			irohPhaseNote: "实验性连接。需使用含 iroh 的 Android App 0.7.0 及以上完整版；兼容版 APK 和手机浏览器不支持。",
+			irohUnavailable: "iroh 未就绪：尚未安装 sidecar，点击下方「安装官方组件」下载并校验。",
+			irohInstalledNotReady: "iroh 已安装但未运行，启用远程访问即可启动。",
+			irohStarting: "正在解析 iroh 端点身份…",
+			irohConnecting: "Sidecar 已连接，正在启动 DSH 认证网关…",
+			irohCompanionMissing: "尚无校验通过的 iroh 组件，请点击下方「安装官方组件」；无需另装配套插件。",
+			irohDataDirectoryInvalid: "无法准备 sidecar 私有目录。请确认 DSH 能管理自己的配置目录后重试。",
+			irohSidecarInvalid: "已安装的 sidecar 哈希校验失败，请重装组件。",
+			irohDownloadFailed: "下载 sidecar 失败，还没开始校验。请检查网络后重试。",
+			irohPlatformUnsupported: "iroh sidecar 仅发布 Windows x64 与 Linux x64 版本。",
+			irohIdentityFailed: "无法从 sidecar 读取 iroh 端点身份。",
+			irohLaunchFailed: "iroh sidecar 启动失败。",
+			irohExited: "iroh sidecar 意外退出，请重新连接。",
+			irohTimeout: "等待 iroh sidecar 超时，请重新连接。",
+			irohInstallConfirm: "现在下载并校验固定的 iroh sidecar 吗（Windows x64 约 15 MB，Linux x64 约 24 MB）？不会安装其他任何内容。",
+			installingIroh: "正在下载并校验 iroh sidecar…",
+			switchingIroh: "正在切换到 iroh…",
+			reconnectingIroh: "正在重连 iroh 传输…",
+			resetIrohConfirm: "要停用 iroh 通道吗？配套插件与配对不受影响。"
+		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
 			requestTimeout: "The operation timed out. Confirm that DSH is still running, then try again.",
+			invalidResponse: "The server replied with a body that is not valid JSON. Confirm the plugin and DSH versions match, then reload the page.",
 			diagnostics: "Diagnostics",
 			openDiagnostics: "Open connection diagnostics",
 			back: "Back",
@@ -1071,6 +1258,7 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
 			requestTimeout: "Operazione scaduta. Verifica che DSH sia ancora in esecuzione e riprova.",
+			invalidResponse: "Il server ha restituito un contenuto che non è JSON valido. Verifica che le versioni del plugin e di DSH corrispondano, poi ricarica la pagina.",
 			diagnostics: "Diagnostica",
 			openDiagnostics: "Apri diagnostica connessione",
 			back: "Indietro",
@@ -1119,6 +1307,7 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
 			requestTimeout: "操作超时，请确认 DSH 仍在运行后重试。",
+			invalidResponse: "服务端返回的内容不是有效的 JSON，请确认插件与 DSH 版本匹配后刷新页面。",
 			diagnostics: "诊断",
 			openDiagnostics: "打开连接诊断",
 			back: "返回",
@@ -1252,11 +1441,11 @@ window.__ModuleLoader__.load({
 			}
 		};
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
-			selfHostedDescription: "Use your own VPS or HTTPS reverse proxy without a public tunnel service.",
+			selfHostedDescription: "For your own server or domain. Does not depend on a third-party tunnel service.",
 			originName: "Own reverse proxy",
 			caddyName: "Managed Caddy",
 			caddyModePreviewNote: "HTTPS form preview differs from the current connection.",
-			originDescription: "Use managed Caddy or your existing HTTPS reverse proxy with DSH Mobile’s private, authenticated backend.",
+			originDescription: "Already have an HTTPS domain or reverse proxy (Caddy, Nginx)? Point it at the local DSH backend.",
 			prepareOrigin: "Connect your HTTPS reverse proxy",
 			originPublicOrigin: "Public HTTPS address",
 			originListenHost: "Private listen IP (IPv4 / IPv6)",
@@ -1311,11 +1500,11 @@ window.__ModuleLoader__.load({
 			originControllerUnavailable: "The reverse-proxy provider is not available in this session. Restart DSH and try again."
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
-			selfHostedDescription: "Usa il tuo VPS o reverse proxy HTTPS senza un servizio di tunnel pubblico.",
+			selfHostedDescription: "Per un tuo server o dominio. Non dipende da un servizio tunnel di terze parti.",
 			originName: "Reverse proxy proprio",
 			caddyName: "Caddy gestito",
 			caddyModePreviewNote: "L’anteprima del modulo HTTPS differisce dalla connessione attuale.",
-			originDescription: "Usa Caddy gestito o il tuo reverse proxy HTTPS con il backend privato autenticato di DSH Mobile.",
+			originDescription: "Hai già un dominio HTTPS o un reverse proxy (Caddy, Nginx)? Puntalo al backend DSH locale.",
 			prepareOrigin: "Collega il tuo reverse proxy HTTPS",
 			originPublicOrigin: "Indirizzo HTTPS pubblico",
 			originListenHost: "IP privato di ascolto (IPv4 / IPv6)",
@@ -1370,11 +1559,11 @@ window.__ModuleLoader__.load({
 			originControllerUnavailable: "Il provider reverse proxy non è disponibile in questa sessione. Riavvia DSH e riprova."
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
-			selfHostedDescription: "使用自己的 VPS 或 HTTPS 反向代理，不依赖公共隧道服务。",
+			selfHostedDescription: "有自己的服务器或域名时用这里，不依赖第三方隧道服务。",
 			originName: "自有反向代理",
 			caddyName: "托管 Caddy",
 			caddyModePreviewNote: "HTTPS 表单预览与当前连接不同。",
-			originDescription: "使用托管 Caddy 或已有 HTTPS 反向代理，接入 DSH Mobile 带认证的私有后端。",
+			originDescription: "已有 HTTPS 域名或反向代理（Caddy、Nginx 等）？直接指向本机 DSH 后端。",
 			prepareOrigin: "接入自有 HTTPS 反向代理",
 			originPublicOrigin: "公网 HTTPS 地址",
 			originListenHost: "私有监听 IP（IPv4 / IPv6）",
@@ -1430,13 +1619,13 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
 			cloudflaredBadge: "Account optional",
-			cloudflaredDescription: "Installs the official cloudflared client on demand. A quick tunnel needs no account and gives a temporary public address; a named tunnel uses a Cloudflare account token and keeps one hostname that survives restarts.",
+			cloudflaredDescription: "Free temporary address without an account; sign in to Cloudflare for a fixed domain. Installs the official client on demand.",
 			prepareCloudflared: "Prepare cloudflared",
 			cloudflaredUnsupported: "Windows x64, Linux x64/arm64, and macOS x64/arm64 are supported.",
 			cloudflaredNotInstalled: "Not installed. A fixed version is downloaded from the official cloudflared release page only after you click the button below.",
 			cloudflaredReady: "Official component {version} is ready.",
 			cloudflaredQuickNote: "Quick tunnel: no Cloudflare account is needed, but Cloudflare positions quick tunnels for testing — the address is random, rate-limited, and carries no uptime guarantee. Do not rely on one for access that must stay reachable.",
-			cloudflaredNamedNote: "Named tunnel: the hostname above stays the same across restarts and Cloudflare routes it to the local forward port. The connector token is stored only in the DSH Mobile private directory, is handed to cloudflared through its environment rather than the command line, and is never shown again once saved.",
+			cloudflaredNamedNote: "Named tunnel: the saved hostname stays the same across restarts and Cloudflare routes it to the local forward port. The connector token is stored only in the DSH Mobile private directory, is handed to cloudflared through its environment rather than the command line, and is never shown again once saved.",
 			cloudflaredComponentNote: "Downloaded from the official cloudflared release page and verified at a fixed version only after you choose Install. The client is started with automatic updates disabled. It does not add a system service, startup item, registry entry, or PATH entry.",
 			installConfirmCloudflared: "Download and verify cloudflared {size} from the official release page and store it only in the DSH Mobile private directory? No system service, PATH/registry entry, or startup item is added.",
 			installingCloudflared: "Installing the official cloudflared component. Keep DSH running until it completes.",
@@ -1498,13 +1687,13 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
 			cloudflaredBadge: "Account facoltativo",
-			cloudflaredDescription: "Installa su richiesta il client cloudflared ufficiale. Il tunnel rapido non richiede account e fornisce un indirizzo pubblico temporaneo; il tunnel con nome usa il token di un account Cloudflare e mantiene un hostname stabile tra i riavvii.",
+			cloudflaredDescription: "Indirizzo temporaneo gratuito senza account; accedi a Cloudflare per un dominio fisso. Installa il client ufficiale su richiesta.",
 			prepareCloudflared: "Prepara cloudflared",
 			cloudflaredUnsupported: "Sono supportati Windows x64, Linux x64/arm64 e macOS x64/arm64.",
 			cloudflaredNotInstalled: "Non installato. Una versione fissa viene scaricata dalla pagina ufficiale di cloudflared solo dopo aver premuto il pulsante.",
 			cloudflaredReady: "Componente ufficiale {version} pronto.",
 			cloudflaredQuickNote: "Tunnel rapido: non serve un account Cloudflare, ma Cloudflare li considera pensati per i test — l’indirizzo è casuale, soggetto a limiti di frequenza e senza garanzia di disponibilità. Non usarlo per un accesso che deve restare raggiungibile.",
-			cloudflaredNamedNote: "Tunnel con nome: l’hostname qui sopra resta lo stesso tra i riavvii e Cloudflare lo instrada verso la porta di inoltro locale. Il token del connettore è salvato solo nella directory privata DSH Mobile, viene passato a cloudflared tramite l’ambiente e non tramite la riga di comando, e dopo il salvataggio non viene più mostrato.",
+			cloudflaredNamedNote: "Tunnel con nome: l’hostname salvato resta lo stesso tra i riavvii e Cloudflare lo instrada verso la porta di inoltro locale. Il token del connettore è salvato solo nella directory privata DSH Mobile, viene passato a cloudflared tramite l’ambiente e non tramite la riga di comando, e dopo il salvataggio non viene più mostrato.",
 			cloudflaredComponentNote: "Viene scaricato dalla pagina ufficiale di cloudflared e verificato a una versione fissa solo dopo aver scelto Installa. Il client viene avviato con gli aggiornamenti automatici disattivati. Non aggiunge servizi di sistema, avvio automatico, voci di registro o PATH.",
 			installConfirmCloudflared: "Scaricare e verificare cloudflared {size} dalla pagina ufficiale e salvarlo solo nella directory privata DSH Mobile? Non vengono aggiunti servizi, PATH/registro o avvio automatico.",
 			installingCloudflared: "Installazione del componente cloudflared ufficiale. Mantieni DSH in esecuzione fino al termine.",
@@ -1566,13 +1755,13 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
 			cloudflaredBadge: "账号可选",
-			cloudflaredDescription: "按需安装官方 cloudflared 客户端。快速隧道无需账号，提供临时公网地址；命名隧道使用 Cloudflare 账号令牌，地址固定、重启不变。",
+			cloudflaredDescription: "免账号获得临时地址；登录 Cloudflare 可换固定域名。按需安装官方客户端。",
 			prepareCloudflared: "准备 cloudflared",
 			cloudflaredUnsupported: "支持 Windows x64、Linux x64/arm64 与 macOS x64/arm64。",
 			cloudflaredNotInstalled: "尚未安装。只有点击下方按钮后，才会从 cloudflared 官方发布页下载固定版本。",
 			cloudflaredReady: "官方组件 {version} 已就绪。",
 			cloudflaredQuickNote: "快速隧道：无需 Cloudflare 账号，但官方定位是测试用途 —— 地址随机、有限流、无可用性保证。请勿用于必须长期可达的访问。",
-			cloudflaredNamedNote: "命名隧道：上面的公网域名重启后不变，由 Cloudflare 转发到本机转发端口。连接器令牌只保存在 DSH Mobile 私有目录，经环境变量而非命令行传给 cloudflared，保存后不再显示。",
+			cloudflaredNamedNote: "命名隧道：保存的公网域名重启后不变，由 Cloudflare 转发到本机转发端口。连接器令牌只保存在 DSH Mobile 私有目录，经环境变量而非命令行传给 cloudflared，保存后不再显示。",
 			cloudflaredComponentNote: "仅在你点击安装后从 cloudflared 官方发布页下载并校验固定版本，且启动时关闭自动更新。不会写入系统服务、开机启动、注册表或 PATH。",
 			installConfirmCloudflared: "将从 cloudflared 官方发布页下载并校验固定版本（{size}），仅保存到 DSH Mobile 私有目录。不会安装系统服务、写入 PATH/注册表或设置开机启动。是否继续？",
 			installingCloudflared: "正在安装 cloudflared 官方组件。完成前请保持 DSH 运行。",
@@ -3550,6 +3739,8 @@ window.__ModuleLoader__.load({
   [data-dsh-mobile-sidebar][data-open="true"]:not(:has([data-dsh-mobile-settings])) [data-dsh-mobile-sidebar-root] > [class*="_regionArea"] { flex:1 0 50% !important; }
   [data-dsh-mobile-sidebar][data-open="true"] [data-dsh-mobile-sidebar-root] [class*="_logoRow"] { height:52px !important; padding:4px 0 4px 4px !important; margin-bottom:4px !important; }
   [data-dsh-mobile-sidebar][data-open="false"] [data-dsh-mobile-sidebar-root] { width:0 !important; border:0 !important; background:transparent !important; box-shadow:none !important; overflow:visible !important; }
+  [data-dsh-mobile-sidebar][data-open="false"]:not(:has([data-dsh-mobile-settings])) [data-dsh-mobile-sidebar-root] { box-sizing:border-box !important; min-width:0 !important; padding:0 !important; pointer-events:none !important; }
+  [data-dsh-mobile-sidebar][data-open="false"] [data-dsh-mobile-toggle] { pointer-events:auto !important; }
   [data-dsh-mobile-sidebar][data-open="false"] [data-dsh-mobile-sidebar-root] > :not(:has([data-dsh-mobile-toggle])) { display:none !important; }
   [data-dsh-mobile-sidebar][data-open="false"] [data-dsh-mobile-sidebar-root] > :has([data-dsh-mobile-toggle]) { position:fixed !important; z-index:244 !important; top:env(safe-area-inset-top) !important; left:0 !important; box-sizing:border-box !important; width:50px !important; height:52px !important; padding:4px !important; border:0 !important; background:transparent !important; }
    [data-dsh-mobile-sidebar][data-open="false"] [data-dsh-mobile-sidebar-root] > :has([data-dsh-mobile-toggle]) > :not([data-dsh-mobile-toggle]) { display:none !important; }
@@ -7857,25 +8048,64 @@ window.__ModuleLoader__.load({
 		function ownsMobileCustomization(gateway, frontend) {
 			return gateway === true || frontend === "dedicated";
 		}
-		/** Emit each safe failure once until recovery, and ignore work after cancellation or disposal. */
+		/**
+		* Emit each safe failure once until recovery, and ignore work after cancellation
+		* or disposal.
+		*
+		* A failure that only reaches the console is invisible to the user, who sees the
+		* customization disappear and cannot tell it from a third-party plugin bug
+		* (issue #298). The reporter therefore also publishes its current state so the
+		* page can render a visible, localized notice with an explicit recovery action.
+		* @param locale - resolves the active UI locale for the copy.
+		* @param output - console sink for the developer-facing line.
+		* @returns the reporting calls plus a subscribable snapshot.
+		*/
 		function createMobileAssetLoadReporter(locale, output = console) {
 			const reported = /* @__PURE__ */ new Set();
+			const listeners = /* @__PURE__ */ new Set();
 			let disposed = false;
+			const visible = () => {
+				if (reported.has("authentication_required")) return "authentication_required";
+				if (reported.has("gateway_required")) return "gateway_required";
+				return reported.values().next().done === true ? void 0 : reported.values().next().value;
+			};
+			const publish = () => {
+				const state = visible();
+				for (const listener of listeners) try {
+					listener(state);
+				} catch (error) {}
+			};
 			return {
 				fail(reason, signal) {
 					if (disposed || signal?.aborted === true || reported.has(reason)) return;
 					if (reason === "resource_unavailable" && reported.has("authentication_required")) return;
 					reported.add(reason);
 					output.warn(`[DSH Mobile] ${COPY[locale()][reason]}`);
+					publish();
 				},
 				recover(signal) {
 					if (disposed || signal.aborted || reported.size === 0) return;
 					reported.clear();
 					output.info(`[DSH Mobile] ${COPY[locale()].recovered}`);
+					publish();
 				},
 				dispose() {
 					disposed = true;
 					reported.clear();
+					listeners.clear();
+				},
+				getState() {
+					return disposed ? void 0 : visible();
+				},
+				subscribe(listener) {
+					if (disposed) return () => {};
+					listeners.add(listener);
+					return () => {
+						listeners.delete(listener);
+					};
+				},
+				message(reason) {
+					return COPY[locale()][reason];
 				}
 			};
 		}
@@ -7925,6 +8155,125 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/mobile-customization-notice.ts
+		/** Copy for the notice, per locale, kept beside the existing dictionaries. */
+		const NOTICE_COPY = {
+			en: {
+				title: {
+					authentication_required: "Device authentication is unavailable.",
+					gateway_required: "Custom mobile CSS, scripts and extensions need the paired Mobile access entry.",
+					other: "Mobile customization could not be loaded."
+				},
+				action: "Retry loading",
+				dismiss: "Dismiss"
+			},
+			zh: {
+				title: {
+					authentication_required: "设备认证暂不可用。",
+					gateway_required: "自定义移动样式、脚本与扩展需要通过已配对的移动访问入口打开。",
+					other: "移动定制加载失败。"
+				},
+				action: "重试加载",
+				dismiss: "忽略"
+			},
+			it: {
+				title: {
+					authentication_required: "Autenticazione del dispositivo non disponibile.",
+					gateway_required: "CSS, script ed estensioni mobili richiedono l’accesso Mobile abbinato.",
+					other: "Impossibile caricare la personalizzazione mobile."
+				},
+				action: "Riprova il caricamento",
+				dismiss: "Ignora"
+			}
+		};
+		const NOTICE_ATTRIBUTE = "data-dsh-mobile-customization-notice";
+		const NOTICE_STYLES = `
+[${NOTICE_ATTRIBUTE}]{position:fixed;z-index:1000;left:8px;right:8px;bottom:calc(env(safe-area-inset-bottom) + 8px);display:flex;align-items:flex-start;gap:10px;box-sizing:border-box;padding:10px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 8px 24px rgb(15 23 42 / 18%);font:13px/1.45 system-ui;color:var(--dsw-alias-label-primary,#16181d)}
+[${NOTICE_ATTRIBUTE}][hidden]{display:none}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{flex:1 1 auto;min-width:0}
+[${NOTICE_ATTRIBUTE}] button{flex:none;box-sizing:border-box;min-height:44px;min-width:44px;padding:0 10px;border:1px solid transparent;border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#16181d);font:600 13px/1.2 system-ui;cursor:pointer}
+[${NOTICE_ATTRIBUTE}] button.dshm-notice-action{background:var(--dsw-alias-state-business-primary,#2563eb);color:#fff;border-color:transparent}
+[${NOTICE_ATTRIBUTE}] button:hover{opacity:.9}
+[${NOTICE_ATTRIBUTE}]{max-height:40vh;overflow:auto;left:max(8px,env(safe-area-inset-left));right:max(8px,env(safe-area-inset-right));flex-wrap:wrap}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{margin:0;flex-basis:100%}
+[${NOTICE_ATTRIBUTE}] button:focus-visible{outline:2px solid currentColor;outline-offset:2px}
+[${NOTICE_ATTRIBUTE}]{background-color:Canvas;background-image:linear-gradient(var(--dsw-alias-bg-layer-2,Canvas),var(--dsw-alias-bg-layer-2,Canvas));color:var(--dsw-alias-label-primary,CanvasText)}
+`;
+		/** Copy key for a failure, so the notice and the console never disagree. */
+		function titleKey(reason) {
+			return reason === "authentication_required" || reason === "gateway_required" ? reason : "other";
+		}
+		/**
+		* Mount one visible notice that follows the customization reporter's state.
+		* @param document - the page that owns the notice.
+		* @param options - locale lookup and the reconnect action.
+		* @returns a disposer that removes the notice and its stylesheet.
+		*/
+		function installCustomizationNotice(document, options) {
+			if (!(typeof document.createElement === "function" && typeof document.body?.append === "function" && typeof document.head?.append === "function")) return () => {};
+			const style = document.createElement("style");
+			style.dataset.plugin = "dsh-mobile-notice";
+			style.textContent = NOTICE_STYLES;
+			document.head.append(style);
+			const notice = document.createElement("div");
+			if (typeof notice.setAttribute !== "function" || typeof notice.append !== "function") {
+				style.remove();
+				return () => {};
+			}
+			notice.setAttribute(NOTICE_ATTRIBUTE, "");
+			notice.setAttribute("role", "status");
+			notice.setAttribute("aria-live", "polite");
+			notice.hidden = true;
+			const text = document.createElement("p");
+			text.className = "dshm-notice-text";
+			const action = document.createElement("button");
+			action.type = "button";
+			action.className = "dshm-notice-action";
+			const dismiss = document.createElement("button");
+			dismiss.type = "button";
+			notice.append(text, action, dismiss);
+			document.body.append(notice);
+			let current;
+			let dismissed;
+			const render = () => {
+				const copy = NOTICE_COPY[options.locale()] ?? NOTICE_COPY.en;
+				if (current === void 0 || current === dismissed) {
+					notice.hidden = true;
+					return;
+				}
+				const detail = options.message(current);
+				text.textContent = `${copy.title[titleKey(current)]} ${detail}`;
+				action.textContent = copy.action;
+				dismiss.textContent = copy.dismiss;
+				notice.hidden = false;
+			};
+			let disposed = false;
+			const retry = () => {
+				if (!disposed) options.reconnect();
+			};
+			const close = () => {
+				if (disposed) return;
+				dismissed = current;
+				render();
+			};
+			action.addEventListener("click", retry);
+			dismiss.addEventListener("click", close);
+			const unsubscribe = options.subscribe((reason) => {
+				if (reason !== current) dismissed = void 0;
+				current = reason;
+				render();
+			});
+			render();
+			return () => {
+				disposed = true;
+				action.removeEventListener("click", retry);
+				dismiss.removeEventListener("click", close);
+				unsubscribe();
+				notice.remove();
+				style.remove();
+			};
+		}
+		//#endregion
 		//#region src/extension-limits.ts
 		/** Maximum sizes accepted for legacy mobile customization resources. */
 		const LEGACY_CUSTOM_ASSET_LIMIT = 262144;
@@ -7948,6 +8297,25 @@ window.__ModuleLoader__.load({
 		function shouldRenewSession(connection, downForMs) {
 			return isDisconnected(connection) && downForMs >= 5e3;
 		}
+		/**
+		* Authentication rejection can warrant one renewal even while transport appears
+		* connected. A 403 can also indicate a permission failure, so it is not proof
+		* that the Session expired.
+		*
+		* Issue #298: DSH keeps Sessions in memory, so a Host restart kills every phone
+		* Session while the device credential survives. The live WebSocket can keep
+		* reporting `connected` for a while, so waiting for a disconnect never fires and
+		* the customization channel stays dark. A 401/403 on an authenticated gateway
+		* request is the signal that actually arrives, and it must be able to start the
+		* same renewal the disconnect path uses.
+		* @param status - HTTP status of a rejected gateway request.
+		* @param connection - current public connection state, if known.
+		* @returns whether this rejection should request a renewal.
+		*/
+		function shouldRenewAfterRejection(status, connection) {
+			if (status !== 401 && status !== 403) return false;
+			return !isDisconnected(connection) || connection === void 0;
+		}
 		function isDisconnected(connection) {
 			return connection === "connecting" || connection === "disconnected";
 		}
@@ -7956,9 +8324,12 @@ window.__ModuleLoader__.load({
 		* @param getConnection - Resolve the current service to reject a replaced owner.
 		* @param page - The document's window and advertised native adapter.
 		* @param document - The mounted document; page replacement withdraws its work.
+		* @param onRejected - receives the rejection signal, so a caller that observes a
+		* 401 can ask this same owner for one renewal instead of starting its own.
+		* @param onRenewed - refresh read-only customization after confirmed Cookie installation.
 		* @returns An awaited disposer, or nothing when no public connection is present.
 		*/
-		function installMobileConnectionRecovery(getConnection, page, document) {
+		function installMobileConnectionRecovery(getConnection, page, document, onRejected, onRenewed) {
 			const connection = getConnection();
 			const state = connection?.state;
 			if (connection === void 0 || state === void 0 || typeof connection.reconnect !== "function") return;
@@ -7968,6 +8339,8 @@ window.__ModuleLoader__.load({
 			let currentState = state.getSnapshot();
 			let downSince = isDisconnected(currentState) ? Date.now() : void 0;
 			let attempted = false;
+			let credentialsRejected = false;
+			let rejectedSince;
 			let bridge = page.__DSH_MOBILE_NATIVE__;
 			let pending;
 			let pendingAbort;
@@ -7981,8 +8354,13 @@ window.__ModuleLoader__.load({
 				const next = state.getSnapshot();
 				if (!isDisconnected(next)) {
 					downSince = void 0;
-					attempted = false;
-					if (currentState !== next) cancelPending();
+					if (currentState !== next) {
+						if (next === "connected") {
+							rejectedSince = void 0;
+							attempted = false;
+						}
+						cancelPending();
+					}
 				} else if (downSince === void 0) {
 					downSince = Date.now();
 					attempted = false;
@@ -7999,30 +8377,63 @@ window.__ModuleLoader__.load({
 			const renew = () => {
 				if (!current()) {
 					dispose();
-					return;
+					return false;
 				}
 				updateState();
 				updateBridge();
 				const adapter = bridge;
-				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || downSince === void 0 || !shouldRenewSession(currentState, Date.now() - downSince)) return;
+				const downLongEnough = downSince !== void 0 && shouldRenewSession(currentState, Date.now() - downSince);
+				const rejectionPending = rejectedSince !== void 0;
+				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || credentialsRejected || !downLongEnough && !rejectionPending) return false;
 				attempted = true;
 				const owner = generation;
 				const abort = new AbortController();
 				pendingAbort = abort;
-				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter && isDisconnected(state.getSnapshot());
+				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter;
 				const task = Promise.resolve().then(async () => {
 					if (!owns()) return;
 					const capabilities = await adapter.capabilities();
 					if (!owns() || !capabilities.includes("auth.renew")) return;
 					const result = await adapter.invoke("auth.renew", {}, { signal: abort.signal });
 					if (!owns() || typeof result !== "object" || result === null || !("renewed" in result) || result.renewed !== true) return;
+					rejectedSince = void 0;
 					connection.reconnect?.();
-				}).catch((_error) => {}).finally(() => {
+					if (current()) onRenewed?.();
+				}).catch((error) => {
+					if (!owns() || typeof error !== "object" || error === null || !("code" in error)) return;
+					credentialsRejected = error.code === "device_revoked" || error.code === "device_expired" || error.code === "authentication_failed";
+				}).finally(() => {
 					if (pending !== task) return;
 					pending = void 0;
 					pendingAbort = void 0;
 				});
 				pending = task;
+				return true;
+			};
+			const retry = () => {
+				if (!current()) return false;
+				updateState();
+				updateBridge();
+				if (!current() || pending !== void 0 || credentialsRejected || bridge === void 0 || rejectedSince === void 0 && downSince === void 0) return false;
+				attempted = false;
+				return renew();
+			};
+			/**
+			* Record a rejected authenticated request and try the same single renewal.
+			*
+			* Only an owner that is still current and has not already attempted may act, so
+			* a burst of 401s cannot start parallel renewals, and a revoked device cannot
+			* keep retrying: revocation arrives as 401 too, but the native bridge refuses
+			* `auth.renew` and the attempt is not restarted.
+			* @param status - HTTP status the gateway returned.
+			*/
+			const rejected = (status) => {
+				if (!current()) return;
+				updateState();
+				updateBridge();
+				if (!shouldRenewAfterRejection(status, state.getSnapshot())) return;
+				rejectedSince ??= Date.now();
+				renew();
 			};
 			const resume = () => {
 				if (!current()) {
@@ -8054,6 +8465,7 @@ window.__ModuleLoader__.load({
 			document.addEventListener("visibilitychange", resume);
 			page.addEventListener("dsh-mobile-native-ready", updateBridge);
 			page.addEventListener("pagehide", pagehide);
+			onRejected?.(rejected, retry);
 			return dispose;
 		}
 		//#endregion
@@ -9165,7 +9577,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		//#region src/client.ts
 		/** Map a host-reported provider onto the UI union, defaulting to the built-in one. */
 		function parseMobileRemoteProvider(value) {
-			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" ? value : "tailscale";
+			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" || value === "iroh" ? value : "tailscale";
 		}
 		/**
 		* Set a surface's visibility; opening a page or overlay brings it to the front.
@@ -9513,11 +9925,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const androidVersion = releaseVersion(data.androidVersion);
 			const expectedAndroidDownloadUrls = androidVersion === void 0 ? [] : ["v", "android-v"].map((prefix) => `${GITHUB_RELEASES_URL}/download/${prefix}${androidVersion}/dsh-mobile-android-v${androidVersion}.apk`);
 			const androidDownloadUrl = typeof data.androidDownloadUrl === "string" && expectedAndroidDownloadUrls.includes(data.androidDownloadUrl) ? data.androidDownloadUrl : GITHUB_RELEASES_URL;
+			const androidIrohDownloadUrl = androidVersion === void 0 || androidDownloadUrl === GITHUB_RELEASES_URL ? void 0 : `${GITHUB_RELEASES_URL}/download/android-v${androidVersion}/dsh-mobile-android-v${androidVersion}-iroh.apk`;
 			return {
 				updateAvailable: data.updateAvailable === true && latestVersion !== void 0,
 				...latestVersion === void 0 ? {} : { latestVersion },
 				...androidVersion === void 0 ? {} : { androidVersion },
 				androidDownloadUrl,
+				...androidIrohDownloadUrl === void 0 ? {} : { androidIrohDownloadUrl },
+				...typeof data.androidCompatBytes === "number" && data.androidCompatBytes > 0 ? { androidCompatBytes: data.androidCompatBytes } : {},
+				...typeof data.androidIrohBytes === "number" && data.androidIrohBytes > 0 ? { androidIrohBytes: data.androidIrohBytes } : {},
 				...typeof data.releaseNotes === "string" && data.releaseNotes !== "" ? { releaseNotes: data.releaseNotes.slice(0, 4e3) } : {}
 			};
 		}
@@ -9538,7 +9954,18 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					signal: controller.signal,
 					headers: localAdminRequestHeaders(init, location)
 				});
-				const body = await response.json();
+				const text = await response.text();
+				let body = {};
+				if (text.trim() !== "") {
+					let parsed;
+					try {
+						parsed = JSON.parse(text);
+					} catch {
+						throw new Error(!response.ok ? `HTTP ${String(response.status)} (${path})` : `${controlTranslator()("invalidResponse")} (${path})`);
+					}
+					if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(!response.ok ? `HTTP ${String(response.status)} (${path})` : `${controlTranslator()("invalidResponse")} (${path})`);
+					body = parsed;
+				}
 				if (!response.ok) throw new Error(typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`);
 				return body;
 			} catch (error) {
@@ -9711,6 +10138,24 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frp_discovery_invalid: "frpDiscoveryInvalid",
 			frp_stopped: "frpStopped",
 			frp_exited: "frpExited",
+			iroh_companion_missing: "irohCompanionMissing",
+			iroh_data_directory_invalid: "irohDataDirectoryInvalid",
+			iroh_sidecar_invalid: "irohSidecarInvalid",
+			iroh_download_failed: "irohDownloadFailed",
+			iroh_download_size_mismatch: "irohDownloadFailed",
+			iroh_download_hash_mismatch: "irohSidecarInvalid",
+			iroh_download_timeout: "irohTimeout",
+			iroh_platform_unsupported: "irohPlatformUnsupported",
+			iroh_identity_failed: "irohIdentityFailed",
+			iroh_identity_timeout: "irohIdentityFailed",
+			iroh_identity_invalid: "irohIdentityFailed",
+			iroh_launch_failed: "irohLaunchFailed",
+			iroh_start_timeout: "irohTimeout",
+			iroh_start_failed: "irohLaunchFailed",
+			iroh_exited: "irohExited",
+			iroh_not_ready: "irohNotReady",
+			iroh_pairing_failed: "irohPairingFailed",
+			iroh_component_running: "irohComponentRunning",
 			frp_server_address_invalid: "frpServerAddressInvalid",
 			frp_server_port_invalid: "frpServerPortInvalid",
 			frp_token_invalid: "frpTokenInvalid",
@@ -9822,7 +10267,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cpolar: "cpolar",
 				cloudflared: "cloudflared",
 				frp: t("frpName"),
-				origin: t("originName")
+				origin: t("originName"),
+				iroh: t("irohName")
 			};
 			const providerId = typeof facts.provider === "string" ? facts.provider : "";
 			const controllerCode = typeof facts.controllerCode === "string" ? facts.controllerCode : "";
@@ -9923,17 +10369,31 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			close.type = "button";
 			close.textContent = "×";
 			close.setAttribute("aria-label", t("collapseMobileAccess"));
-			headerActions.append(updatePlugin, diagnosticsEntry, close);
+			const devicesEntry = element("button", "dsh-mobile-control__diagnostic-entry");
+			devicesEntry.type = "button";
+			devicesEntry.textContent = t("device");
+			devicesEntry.setAttribute("aria-label", t("managePairedDevices"));
+			devicesEntry.setAttribute("aria-pressed", "false");
+			headerActions.append(updatePlugin, diagnosticsEntry, devicesEntry, close);
 			const releaseNotice = element("p", "dsh-mobile-control__release-notice");
 			releaseNotice.hidden = true;
 			releaseNotice.setAttribute("role", "status");
 			releaseNotice.setAttribute("aria-live", "polite");
+			const appDownloads = element("div", "dsh-mobile-control__app-downloads");
 			const appDownload = element("a", "dsh-mobile-control__app-download");
 			appDownload.href = GITHUB_RELEASES_URL;
 			appDownload.target = "_blank";
 			appDownload.rel = "noopener noreferrer";
 			appDownload.textContent = t("downloadAndroid");
 			appDownload.setAttribute("aria-label", t("downloadAndroidAria"));
+			const appDownloadIroh = element("a", "dsh-mobile-control__app-download is-iroh");
+			appDownloadIroh.href = GITHUB_RELEASES_URL;
+			appDownloadIroh.target = "_blank";
+			appDownloadIroh.rel = "noopener noreferrer";
+			appDownloadIroh.textContent = t("downloadAndroidIroh");
+			appDownloadIroh.setAttribute("aria-label", t("downloadAndroidIrohAria"));
+			appDownloadIroh.hidden = true;
+			appDownloads.append(appDownload, appDownloadIroh);
 			const switcher = element("div", "dsh-mobile-control__switcher");
 			const lanTab = element("button", "dsh-mobile-control__tab is-active");
 			lanTab.type = "button";
@@ -10058,7 +10518,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			accessLink.rel = "noreferrer";
 			access.append(accessLabel, accessLink);
 			const qrBox = element("div", "dsh-mobile-control__qr");
-			qrBox.hidden = true;
+			const lanPairingValidity = element("p", "dsh-mobile-control__component-status");
+			lanPairingValidity.hidden = true;
+			let activeLanPairUrl = "";
+			let activeLanPairExpiresAt = 0;
+			let lanPairingBusy = false;
+			let lanPairingGeneration = 0;
 			const status = element("p", "dsh-mobile-control__status");
 			status.textContent = t("loadingStatus");
 			const extensionStatus = element("p", "dsh-mobile-control__extensions");
@@ -10079,11 +10544,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const resetAll = element("button", "dsh-mobile-control__manage");
 			resetAll.type = "button";
 			resetAll.textContent = t("clearAllDevices");
-			manageRow.append(manageDevices, resetAll);
+			manageRow.append(manageDevices);
 			const devicePanel = element("div", "dsh-mobile-control__devices");
-			devicePanel.hidden = true;
 			const remoteView = element("div", "dsh-mobile-control__view is-remote");
-			remoteView.hidden = true;
 			const remoteIntro = element("p", "dsh-mobile-control__intro");
 			remoteIntro.textContent = t("remoteIntro");
 			const httpFrameWarning = element("p", "dsh-mobile-control__http-frame-warning");
@@ -10093,27 +10556,6 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const providerSection = element("section", "dsh-mobile-control__provider-section");
 			const providerHeading = element("h3", "dsh-mobile-control__section-title");
 			providerHeading.textContent = t("chooseProvider");
-			const providerInfo = element("div", "dsh-mobile-control__provider-info");
-			const providerInfoButton = element("button", "dsh-mobile-control__provider-info-button");
-			providerInfoButton.type = "button";
-			providerInfoButton.setAttribute("aria-label", t("providerInfoAria"));
-			providerInfoButton.setAttribute("aria-expanded", "false");
-			providerInfoButton.setAttribute("aria-controls", "dsh-mobile-provider-info");
-			providerInfoButton.setAttribute("aria-describedby", "dsh-mobile-provider-info");
-			const providerInfoGlyph = element("span", "dsh-mobile-control__provider-info-glyph");
-			providerInfoGlyph.textContent = "i";
-			providerInfoGlyph.setAttribute("aria-hidden", "true");
-			const providerInfoPopover = element("div", "dsh-mobile-control__provider-info-popover");
-			providerInfoPopover.id = "dsh-mobile-provider-info";
-			providerInfoPopover.setAttribute("role", "tooltip");
-			providerInfoPopover.hidden = true;
-			const providerInfoTitle = element("strong");
-			providerInfoTitle.textContent = t("providerSafeTitle");
-			const providerInfoText = element("span");
-			providerInfoText.textContent = t("providerSafeText");
-			providerInfoButton.append(providerInfoGlyph);
-			providerInfoPopover.append(providerInfoTitle, providerInfoText);
-			providerInfo.append(providerInfoButton, providerInfoPopover);
 			const providerChoices = element("div", "dsh-mobile-control__provider-choices");
 			providerChoices.setAttribute("role", "radiogroup");
 			providerChoices.setAttribute("aria-label", t("providerGroupAria"));
@@ -10181,6 +10623,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const cpolarInstall = element("button", "dsh-mobile-control__primary");
 			cpolarInstall.type = "button";
 			cpolarInstall.textContent = t("installOfficial");
+			cpolarInstall.hidden = true;
 			const cpolarAccount = element("div", "dsh-mobile-control__cpolar-account");
 			cpolarAccount.hidden = true;
 			const cpolarAccountText = element("p", "dsh-mobile-control__component-note");
@@ -10232,7 +10675,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			cpolarPurge.textContent = t("purgeCpolar");
 			cpolarDetailsBody.append(cpolarDetailsText, cpolarStorage, cpolarOfficial, cpolarTerms, cpolarPurge);
 			cpolarDetails.append(cpolarDetailsSummary, cpolarDetailsBody);
-			cpolarSetup.append(cpolarSetupTitle, cpolarComponentStatus, cpolarInstall, cpolarAccount, cpolarDetails);
+			cpolarSetup.append(cpolarSetupTitle, cpolarComponentStatus, cpolarAccount);
 			const cloudflaredSetup = element("section", "dsh-mobile-control__cpolar-setup dsh-mobile-control__cloudflared-setup");
 			cloudflaredSetup.hidden = true;
 			const cloudflaredSetupTitle = element("h3", "dsh-mobile-control__section-title");
@@ -10249,6 +10692,41 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			cloudflaredMode.append(cloudflaredModeQuick, cloudflaredModeNamed);
 			const cloudflaredModeHint = element("p", "dsh-mobile-control__component-status");
 			cloudflaredModeHint.textContent = t("cloudflaredTunnelQuickHint");
+			const cloudflaredNotesToggle = element("button", "dsh-mobile-control__notes-toggle");
+			cloudflaredNotesToggle.type = "button";
+			cloudflaredNotesToggle.textContent = "i";
+			cloudflaredNotesToggle.setAttribute("aria-label", t("providerInfoAria"));
+			cloudflaredNotesToggle.setAttribute("aria-expanded", "false");
+			const cloudflaredNotesPanel = element("div", "dsh-mobile-control__notes-panel");
+			cloudflaredNotesPanel.hidden = true;
+			const cloudflaredNotesQuick = element("p");
+			cloudflaredNotesQuick.textContent = t("cloudflaredQuickNote");
+			const cloudflaredNotesNamed = element("p");
+			cloudflaredNotesNamed.textContent = t("cloudflaredNamedNote");
+			cloudflaredNotesPanel.append(cloudflaredNotesQuick, cloudflaredNotesNamed);
+			const cloudflaredModeRow = element("div", "dsh-mobile-control__mode-row");
+			cloudflaredModeRow.append(cloudflaredMode, cloudflaredNotesToggle, cloudflaredNotesPanel);
+			const setCloudflaredNotesOpen = (open) => {
+				cloudflaredNotesPanel.hidden = !open;
+				cloudflaredNotesToggle.setAttribute("aria-expanded", String(open));
+			};
+			const hoverCapable = typeof window.matchMedia === "function" ? window.matchMedia("(hover: hover)") : void 0;
+			cloudflaredModeRow.addEventListener("pointerenter", () => {
+				if (hoverCapable?.matches) setCloudflaredNotesOpen(true);
+			});
+			cloudflaredModeRow.addEventListener("pointerleave", () => {
+				if (hoverCapable?.matches) setCloudflaredNotesOpen(false);
+			});
+			cloudflaredNotesToggle.addEventListener("click", (event) => {
+				setCloudflaredNotesOpen(hoverCapable?.matches && event.detail !== 0 ? true : Boolean(cloudflaredNotesPanel.hidden));
+			});
+			cloudflaredModeRow.addEventListener("keydown", (event) => {
+				if (event.key !== "Escape" || cloudflaredNotesPanel.hidden) return;
+				event.preventDefault();
+				event.stopPropagation();
+				setCloudflaredNotesOpen(false);
+				cloudflaredNotesToggle.focus();
+			});
 			const cloudflaredTunnel = element("div", "dsh-mobile-control__tunnel");
 			cloudflaredTunnel.hidden = true;
 			const cloudflaredTunnelFields = element("div", "dsh-mobile-control__frp-fields");
@@ -10291,12 +10769,23 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			cloudflaredTunnelForget.type = "button";
 			cloudflaredTunnelForget.textContent = t("cloudflaredTunnelForget");
 			cloudflaredTunnelForget.hidden = true;
-			cloudflaredTunnel.append(cloudflaredTunnelFields, cloudflaredTunnelStatus, cloudflaredTunnelHint);
+			const cloudflaredTunnelToggle = element("button", "dsh-mobile-control__tunnel-toggle");
+			cloudflaredTunnelToggle.type = "button";
+			cloudflaredTunnelToggle.textContent = t("cloudflaredShowConfig") + " ▾";
+			cloudflaredTunnelToggle.hidden = true;
+			const cloudflaredEditButton = element("button", "dsh-mobile-control__secondary");
+			cloudflaredEditButton.type = "button";
+			cloudflaredEditButton.textContent = t("cloudflaredEditConfig");
+			cloudflaredEditButton.hidden = true;
+			const cloudflaredTunnelFeedback = element("p", "dsh-mobile-control__component-status");
+			cloudflaredTunnelFeedback.hidden = true;
+			cloudflaredTunnel.append(cloudflaredTunnelFields, cloudflaredTunnelStatus, cloudflaredTunnelHint, cloudflaredEditButton, cloudflaredTunnelSave, cloudflaredTunnelForget, cloudflaredTunnelFeedback);
 			const cloudflaredComponentStatus = element("p", "dsh-mobile-control__component-status");
 			cloudflaredComponentStatus.textContent = t("checkingComponent");
 			const cloudflaredInstall = element("button", "dsh-mobile-control__primary");
 			cloudflaredInstall.type = "button";
 			cloudflaredInstall.textContent = t("installOfficial");
+			cloudflaredInstall.hidden = true;
 			const cloudflaredNote = element("p", "dsh-mobile-control__origin-warning");
 			cloudflaredNote.textContent = t("cloudflaredQuickNote");
 			const cloudflaredDetails = element("details", "dsh-mobile-control__details");
@@ -10322,19 +10811,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			cloudflaredPurge.textContent = t("purgeCloudflared");
 			cloudflaredDetailsBody.append(cloudflaredDetailsText, cloudflaredStorage, cloudflaredOfficial, cloudflaredTerms, cloudflaredPurge);
 			cloudflaredDetails.append(cloudflaredDetailsSummary, cloudflaredDetailsBody);
-			cloudflaredSetup.append(cloudflaredSetupTitle, cloudflaredTunnelTitle, cloudflaredMode, cloudflaredModeHint, cloudflaredTunnel, cloudflaredTunnelSave, cloudflaredTunnelForget, cloudflaredComponentStatus, cloudflaredInstall, cloudflaredNote, cloudflaredDetails);
-			const selfHosted = element("details", "dsh-mobile-control__self-hosted");
-			const selfHostedSummary = element("summary", "dsh-mobile-control__self-hosted-summary");
-			const selfHostedSummaryText = element("span");
-			const selfHostedSummaryTitle = element("strong");
-			selfHostedSummaryTitle.textContent = t("selfHostedConnections");
-			const selfHostedSummaryDescription = element("span");
-			selfHostedSummaryDescription.textContent = t("selfHostedDescription");
-			const selfHostedBadge = element("span", "dsh-mobile-control__provider-badge is-frp");
-			selfHostedBadge.textContent = t("advanced");
-			selfHostedSummaryText.append(selfHostedSummaryTitle, selfHostedSummaryDescription);
-			selfHostedSummary.append(selfHostedSummaryText, selfHostedBadge);
-			const selfHostedBody = element("div", "dsh-mobile-control__self-hosted-body");
+			cloudflaredSetup.append(cloudflaredSetupTitle, cloudflaredTunnelTitle, cloudflaredModeRow, cloudflaredModeHint, cloudflaredTunnelToggle, cloudflaredTunnel, cloudflaredComponentStatus);
 			const frpChoice = element("button", "dsh-mobile-control__provider is-frp");
 			frpChoice.type = "button";
 			frpChoice.setAttribute("aria-pressed", "false");
@@ -10343,7 +10820,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpChoiceName.textContent = t("frpName");
 			const frpChoiceDescription = element("span", "dsh-mobile-control__provider-description");
 			frpChoiceDescription.textContent = t("frpDescription");
-			frpChoiceTop.append(frpChoiceName);
+			const frpChoiceBadge = element("span", "dsh-mobile-control__provider-badge is-frp");
+			frpChoiceBadge.textContent = t("advanced");
+			frpChoiceTop.append(frpChoiceName, frpChoiceBadge);
 			frpChoice.append(frpChoiceTop, frpChoiceDescription);
 			const originChoice = element("button", "dsh-mobile-control__provider is-origin");
 			originChoice.type = "button";
@@ -10353,11 +10832,37 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoiceName.textContent = t("originName");
 			const originChoiceDescription = element("span", "dsh-mobile-control__provider-description");
 			originChoiceDescription.textContent = t("originDescription");
-			originChoiceTop.append(originChoiceName);
+			const originChoiceBadge = element("span", "dsh-mobile-control__provider-badge");
+			originChoiceBadge.textContent = t("advanced");
+			originChoiceTop.append(originChoiceName, originChoiceBadge);
 			originChoice.append(originChoiceTop, originChoiceDescription);
-			selfHostedBody.append(frpChoice, originChoice);
-			selfHosted.append(selfHostedSummary, selfHostedBody);
-			providerSection.append(providerHeading, providerInfo, providerChoices, selfHosted);
+			const irohChoice = element("button", "dsh-mobile-control__provider is-iroh");
+			irohChoice.type = "button";
+			irohChoice.setAttribute("aria-pressed", "false");
+			const irohChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const irohChoiceName = element("strong");
+			irohChoiceName.textContent = t("irohName");
+			const irohChoiceBadge = element("span", "dsh-mobile-control__provider-badge is-iroh");
+			irohChoiceBadge.textContent = t("irohExperimental");
+			const irohChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			irohChoiceDescription.textContent = t("irohDescription");
+			irohChoiceTop.append(irohChoiceName, irohChoiceBadge);
+			irohChoice.append(irohChoiceTop, irohChoiceDescription);
+			providerChoices.append(irohChoice, frpChoice, originChoice);
+			const lanChoice = element("button", "dsh-mobile-control__provider is-lan");
+			lanChoice.type = "button";
+			lanChoice.setAttribute("role", "radio");
+			lanChoice.setAttribute("aria-checked", "true");
+			const lanChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const lanChoiceName = element("strong");
+			lanChoiceName.textContent = t("lan");
+			const lanChoiceBadge = element("span", "dsh-mobile-control__provider-badge");
+			lanChoiceBadge.textContent = t("builtIn");
+			const lanChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			lanChoiceDescription.textContent = t("lanChoiceDescription");
+			lanChoiceTop.append(lanChoiceName, lanChoiceBadge);
+			lanChoice.append(lanChoiceTop, lanChoiceDescription);
+			providerSection.append(providerHeading, lanChoice, providerChoices);
 			const frpSetup = element("section", "dsh-mobile-control__frp-setup");
 			frpSetup.hidden = true;
 			const frpSetupTitle = element("h3", "dsh-mobile-control__section-title");
@@ -10653,7 +11158,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const frpVerifySummary = element("summary");
 			frpVerifySummary.textContent = t("frpStep4Title");
 			frpVerifyGroup.append(frpVerifySummary, frpStep4);
-			frpSetup.append(frpSetupTitle, frpOverview, frpConnectionGroup, frpVpsGroup, frpComponentGroup, frpVerifyGroup, frpDetails);
+			frpSetup.append(frpSetupTitle, frpOverview, frpConnectionGroup, frpVpsGroup, frpComponentGroup, frpVerifyGroup);
 			const originSetup = element("section", "dsh-mobile-control__origin-setup");
 			originSetup.hidden = true;
 			const originSetupTitle = element("h3", "dsh-mobile-control__section-title");
@@ -10828,18 +11333,82 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			tailscaleInfoText.textContent = t("tailscaleHelpText");
 			tailscaleInfoBody.append(tailscaleInfoText);
 			tailscaleInfo.append(tailscaleInfoSummary, tailscaleInfoBody);
-			const providerSetupHeader = element("div", "dsh-mobile-control__stage-header");
-			const providerSetupHeading = element("h3", "dsh-mobile-control__section-title");
-			providerSetupHeading.textContent = t("currentProvider");
-			const providerSetupName = element("span", "dsh-mobile-control__stage-value");
-			providerSetupName.textContent = "Tailscale Funnel";
-			const remoteStateBadge = element("span", "dsh-mobile-control__state-badge");
-			remoteStateBadge.textContent = t("remoteStateOff");
-			const providerSetupMeta = element("div", "dsh-mobile-control__stage-meta");
-			providerSetupMeta.append(providerSetupName, remoteStateBadge);
-			providerSetupHeader.append(providerSetupHeading, providerSetupMeta);
 			const providerSetupBody = element("div", "dsh-mobile-control__provider-setup-body");
-			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, tailscaleInfo);
+			const irohSetup = element("section", "dsh-mobile-control__frp-setup");
+			irohSetup.hidden = true;
+			const irohSetupTitle = element("h3", "dsh-mobile-control__section-title");
+			irohSetupTitle.textContent = t("prepareIroh");
+			const irohPhaseNote = element("p", "dsh-mobile-control__component-note");
+			irohPhaseNote.textContent = t("irohPhaseNote");
+			const irohComponentStatus = element("p", "dsh-mobile-control__component-status");
+			irohComponentStatus.textContent = t("checkingComponent");
+			irohComponentStatus.setAttribute("role", "status");
+			irohComponentStatus.setAttribute("aria-live", "polite");
+			const irohInstall = element("button", "dsh-mobile-control__primary");
+			irohInstall.type = "button";
+			irohInstall.textContent = t("installOfficial");
+			const irohInstallProgress = element("progress", "dsh-mobile-control__progress");
+			irohInstallProgress.hidden = true;
+			irohInstallProgress.setAttribute("aria-hidden", "true");
+			const irohPairing = element("div", "dsh-mobile-control__iroh-pairing");
+			const irohPairingTitle = element("p", "dsh-mobile-control__component-status");
+			irohPairingTitle.textContent = t("irohPairingTitle");
+			const irohPair = element("button", "dsh-mobile-control__primary");
+			irohPair.type = "button";
+			irohPair.textContent = t("generateIrohQr");
+			const irohQr = element("div", "dsh-mobile-control__qr is-expandable");
+			irohQr.hidden = true;
+			const irohPairStatus = element("p", "dsh-mobile-control__component-status");
+			const irohCopyDescriptor = element("button", "dsh-mobile-control__secondary");
+			irohCopyDescriptor.type = "button";
+			irohCopyDescriptor.textContent = t("copyPairLink");
+			irohCopyDescriptor.hidden = true;
+			irohCopyDescriptor.disabled = true;
+			irohPairing.append(irohPairingTitle, irohQr, irohPairStatus);
+			const irohDetails = element("details", "dsh-mobile-control__details");
+			const irohDetailsSummary = element("summary");
+			irohDetailsSummary.textContent = t("componentDetails");
+			const irohDetailsBody = element("div", "dsh-mobile-control__details-body");
+			const irohDetailsText = element("p");
+			irohDetailsText.textContent = t("irohComponentNote");
+			const irohInstallNote = element("p");
+			irohInstallNote.textContent = t("irohInstallNote");
+			const irohStorage = element("code", "dsh-mobile-control__storage");
+			irohStorage.textContent = t("pluginPrivateDirectory");
+			const irohOfficial = element("a", "dsh-mobile-control__text-link");
+			irohOfficial.href = "https://www.npmjs.com/package/dsh-mobile-iroh";
+			irohOfficial.target = "_blank";
+			irohOfficial.rel = "noopener noreferrer";
+			irohOfficial.textContent = t("officialDownload");
+			const irohPurge = element("button", "dsh-mobile-control__danger");
+			irohPurge.type = "button";
+			irohPurge.textContent = t("purgeIroh");
+			irohDetailsBody.append(irohDetailsText, irohInstallNote, irohStorage, irohOfficial, irohPurge);
+			irohDetails.append(irohDetailsSummary, irohDetailsBody);
+			irohSetup.append(irohSetupTitle, irohPhaseNote, irohComponentStatus, irohInstall, irohInstallProgress, irohPairing);
+			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, irohSetup, tailscaleInfo);
+			const irohQrZoom = element("div", "dsh-mobile-control__qr-zoom");
+			irohQrZoom.hidden = true;
+			const irohQrZoomImage = element("img", "dsh-mobile-control__qr-zoom-image");
+			irohQrZoomImage.alt = t("pairingQr");
+			const irohQrZoomClose = element("button", "dsh-mobile-control__qr-zoom-close");
+			irohQrZoomClose.type = "button";
+			irohQrZoomClose.textContent = "×";
+			irohQrZoomClose.setAttribute("aria-label", t("closeEnlargedQr"));
+			const setIrohQrZoomOpen = (open) => {
+				if (open) {
+					irohQrZoom.setAttribute("role", "dialog");
+					irohQrZoom.setAttribute("aria-modal", "true");
+					irohQrZoom.setAttribute("aria-label", t("enlargeQr"));
+				} else {
+					irohQrZoom.removeAttribute("role");
+					irohQrZoom.removeAttribute("aria-modal");
+					irohQrZoom.removeAttribute("aria-label");
+				}
+				irohQrZoom.hidden = !open;
+			};
+			irohQrZoom.append(irohQrZoomImage, irohQrZoomClose);
+			root.append(irohQrZoom);
 			const remoteAccess = element("div", "dsh-mobile-control__access");
 			remoteAccess.hidden = true;
 			const remoteAccessLabel = element("span", "dsh-mobile-control__access-label");
@@ -10903,9 +11472,16 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remoteCopyLink.disabled = true;
 			const remotePairLink = element("p", "dsh-mobile-control__status");
 			remotePairLink.hidden = true;
+			const pairingValidity = element("p", "dsh-mobile-control__component-status");
+			pairingValidity.hidden = true;
 			let activeRemotePairUrl = "";
 			let activeRemotePairExpiresAt = 0;
-			remoteActions.append(remoteToggle, remoteLogin, remoteReconnect, remotePair, remoteCopyLink);
+			let remotePairingBusy = false;
+			let remotePairingGeneration = 0;
+			let activeIrohDescriptor = "";
+			let activeIrohPairExpiresAt = 0;
+			let activeIrohQrSvg = "";
+			remoteActions.append(remoteToggle, irohPair, irohCopyDescriptor, remoteLogin, remoteReconnect, remotePair, remoteCopyLink);
 			const remoteManageRow = element("div", "dsh-mobile-control__manage-row");
 			const remoteDevices = element("button", "dsh-mobile-control__manage");
 			remoteDevices.type = "button";
@@ -10916,7 +11492,6 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remoteReset.textContent = t("resetRemoteLogin");
 			remoteManageRow.append(remoteDevices, remoteReset);
 			const remoteDevicePanel = element("div", "dsh-mobile-control__devices");
-			remoteDevicePanel.hidden = true;
 			const wsPathsSection = element("section", "dsh-mobile-control__ws-paths");
 			const wsPathsTitle = element("h3", "dsh-mobile-control__section-title");
 			wsPathsTitle.textContent = t("wsPathsTitle");
@@ -11100,10 +11675,53 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				wsPathsInput.value = "";
 				saveWsPaths([...wsPathsCurrent, value]);
 			});
-			const remoteWorkspace = element("section", "dsh-mobile-control__remote-workspace");
-			remoteWorkspace.append(providerSetupHeader, remoteStatus, remoteAccess, remoteGuide, providerSetupBody, remoteActions, remoteQr, remotePairLink, remoteManageRow, remoteDevicePanel);
+			const remoteWorkspace = element("div", "dsh-mobile-control__remote-workspace");
+			const providerInstallRow = element("div", "dsh-mobile-control__provider-install");
+			providerInstallRow.append(cpolarInstall, cloudflaredInstall);
+			const setupDetailsRow = element("div", "dsh-mobile-control__setup-details");
+			for (const disclosure of [
+				cpolarDetails,
+				cloudflaredDetails,
+				frpDetails,
+				irohDetails
+			]) {
+				disclosure.hidden = true;
+				setupDetailsRow.append(disclosure);
+			}
+			remoteWorkspace.append(remoteStatus, remoteAccess, remoteGuide, providerSetupBody, remoteQr, pairingValidity, providerInstallRow, remoteActions, remotePairLink, setupDetailsRow);
 			const diagnosticsView = element("div", "dsh-mobile-control__view is-diagnostics");
 			diagnosticsView.hidden = true;
+			const devicesView = element("div", "dsh-mobile-control__view is-devices");
+			devicesView.hidden = true;
+			const devicesSwitcher = element("div", "dsh-mobile-control__switcher");
+			const devicesLanTab = element("button", "dsh-mobile-control__tab is-active");
+			devicesLanTab.type = "button";
+			devicesLanTab.textContent = t("devicesLanTitle");
+			const devicesRemoteTab = element("button", "dsh-mobile-control__tab");
+			devicesRemoteTab.type = "button";
+			devicesRemoteTab.textContent = t("devicesRemoteTitle");
+			devicesSwitcher.append(devicesLanTab, devicesRemoteTab);
+			const devicesLanGroup = element("div");
+			const devicesLanRow = element("div", "dsh-mobile-control__manage-row");
+			devicesLanRow.append(resetAll);
+			devicesLanGroup.append(devicePanel, devicesLanRow);
+			const devicesRemoteGroup = element("div");
+			devicesRemoteGroup.hidden = true;
+			const devicesRemoteRow = element("div", "dsh-mobile-control__manage-row");
+			devicesRemoteRow.append(remoteReset);
+			devicesRemoteGroup.append(remoteDevicePanel, devicesRemoteRow);
+			devicesView.append(devicesSwitcher, devicesLanGroup, devicesRemoteGroup);
+			const showDevicesGroup = (which) => {
+				const lan = which === "lan";
+				devicesLanGroup.hidden = !lan;
+				devicesRemoteGroup.hidden = lan;
+				devicesLanTab.classList.toggle("is-active", lan);
+				devicesRemoteTab.classList.toggle("is-active", !lan);
+				if (lan) loadDevices();
+				else loadRemoteDevices();
+			};
+			devicesLanTab.addEventListener("click", () => showDevicesGroup("lan"));
+			devicesRemoteTab.addEventListener("click", () => showDevicesGroup("remote"));
 			const diagnosticsIntro = element("p", "dsh-mobile-control__intro");
 			diagnosticsIntro.textContent = t("diagnosticsIntro");
 			const diagnosticsSummary = element("section", "dsh-mobile-control__diagnostic-summary is-idle");
@@ -11145,10 +11763,14 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			diagnosticsDetails.append(diagnosticsDetailsSummary, diagnosticsReport);
 			header.append(title, headerActions);
 			actions.append(toggle, pair, linkPair);
-			lanView.append(lanSetup, access, qrBox, status, extensionStatus, actions, manageRow, devicePanel, trustedNetworks);
-			remoteView.append(remoteIntro, httpFrameWarning, providerSection, remoteWorkspace);
+			lanView.append(lanSetup, access, qrBox, lanPairingValidity, status, extensionStatus, actions, trustedNetworks);
+			const channelPane = element("div", "dsh-mobile-control__channel-pane");
+			channelPane.append(lanView, remoteWorkspace);
+			const remoteColumns = element("div", "dsh-mobile-control__remote-columns");
+			remoteColumns.append(providerSection, channelPane);
+			remoteView.append(remoteIntro, httpFrameWarning, remoteColumns);
 			diagnosticsView.append(diagnosticsIntro, diagnosticsSummary, diagnosticsToolbar, diagnosticsFeedback, diagnosticsChecks, wsPathsSection, diagnosticsDetails);
-			panel.append(header, releaseNotice, updateCard, appDownload, extensionRecovery.section, switcher, lanView, remoteView, diagnosticsView);
+			panel.append(header, releaseNotice, updateCard, appDownloads, extensionRecovery.section, remoteView, diagnosticsView, devicesView);
 			root.append(panel);
 			document.body.append(root);
 			let running = false;
@@ -11171,6 +11793,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let cloudflaredInstalled = false;
 			let cloudflaredDownloadSize = "";
 			let cloudflaredTunnelMode = "quick";
+			let cloudflaredConfigEditing = false;
 			let cloudflaredModeDraft = null;
 			let cloudflaredTunnelConfigured = false;
 			let configuredCloudflaredHostname = "";
@@ -11201,6 +11824,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let latestRemoteState = {};
 			let frpInstalled = false;
 			let frpConfigured = false;
+			let irohInstalled = false;
+			/** True while a companion checksum verification is in flight; polls must not wipe its progress. */
+			let irohVerifying = false;
 			let frpLayoutInitialized = false;
 			let frpDownloadSize = "14.0";
 			let configuredFrpServer = "";
@@ -11216,8 +11842,6 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let frpEntryTlsDraft = false;
 			let frpVhostDraft = false;
 			let frpAttachVhostExplicit = false;
-			let providerInfoPinned = false;
-			let providerInfoHovered = false;
 			let previousAccessView = "lan";
 			let diagnosticsBusy = false;
 			let copiedDiagnosticReport = "";
@@ -11234,78 +11858,140 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				updatePlugin.textContent = t("updatePlugin");
 				if (pluginLatestVersion !== "") updatePlugin.setAttribute("aria-label", t("updatePluginAria", { version: pluginLatestVersion }));
 				if (release.androidVersion !== void 0) {
-					appDownload.textContent = t("downloadAndroidVersion", { version: release.androidVersion });
-					appDownload.setAttribute("aria-label", t("downloadAndroidVersionAria", { version: release.androidVersion }));
+					const version = release.androidVersion;
+					const sizeMb = (bytes) => bytes === void 0 ? void 0 : (bytes / 1048576).toFixed(1);
+					const compatSize = sizeMb(release.androidCompatBytes);
+					const irohSize = sizeMb(release.androidIrohBytes);
+					appDownload.textContent = compatSize === void 0 ? t("downloadAndroidVersion", { version }) : t("downloadAndroidVersionSize", {
+						version,
+						size: compatSize
+					});
+					appDownload.setAttribute("aria-label", t("downloadAndroidVersionAria", { version }));
+					appDownloadIroh.textContent = irohSize === void 0 ? t("downloadAndroidIrohVersion", { version }) : t("downloadAndroidIrohVersionSize", {
+						version,
+						size: irohSize
+					});
+					appDownloadIroh.setAttribute("aria-label", t("downloadAndroidIrohAria", { version }));
 				}
 				appDownload.href = release.androidDownloadUrl;
+				if (release.androidIrohDownloadUrl === void 0) appDownloadIroh.hidden = true;
+				else {
+					appDownloadIroh.href = release.androidIrohDownloadUrl;
+					appDownloadIroh.hidden = false;
+				}
+			};
+			let currentAccessView = "lan";
+			const applyChoiceSelection = () => {
+				const inRemote = currentAccessView === "remote";
+				lanChoice.classList.toggle("is-selected", currentAccessView === "lan");
+				lanChoice.setAttribute("aria-checked", String(currentAccessView === "lan"));
+				tailscaleChoice.classList.toggle("is-selected", inRemote && remoteProvider === "tailscale");
+				cpolarChoice.classList.toggle("is-selected", inRemote && remoteProvider === "cpolar");
+				cloudflaredChoice.classList.toggle("is-selected", inRemote && remoteProvider === "cloudflared");
+				frpChoice.classList.toggle("is-selected", inRemote && remoteProvider === "frp");
+				originChoice.classList.toggle("is-selected", inRemote && remoteProvider === "origin");
+				irohChoice.classList.toggle("is-selected", inRemote && remoteProvider === "iroh");
 			};
-			const syncProviderInfo = () => {
-				const open = providerInfoPinned || providerInfoHovered || providerInfo.contains(document.activeElement);
-				providerInfoPopover.hidden = !open;
-				providerInfoButton.setAttribute("aria-expanded", String(open));
-			};
-			providerInfo.addEventListener("pointerenter", () => {
-				providerInfoHovered = true;
-				syncProviderInfo();
-			});
-			providerInfo.addEventListener("pointerleave", () => {
-				providerInfoHovered = false;
-				syncProviderInfo();
-			});
-			providerInfo.addEventListener("focusin", syncProviderInfo);
-			providerInfo.addEventListener("focusout", () => {
-				window.setTimeout(syncProviderInfo, 0);
-			});
-			providerInfoButton.addEventListener("click", () => {
-				providerInfoPinned = !providerInfoPinned;
-				syncProviderInfo();
-			});
-			providerInfoButton.addEventListener("keydown", (event) => {
-				if (event.key !== "Escape") return;
-				providerInfoPinned = false;
-				providerInfoHovered = false;
-				providerInfoPopover.hidden = true;
-				providerInfoButton.setAttribute("aria-expanded", "false");
-			});
 			const selectView = (view) => {
 				if (!panel.hidden) extensionRecovery.refresh();
-				if (view !== "diagnostics") previousAccessView = view;
+				currentAccessView = view;
+				if (view === "lan" || view === "remote") previousAccessView = view;
+				const subpage = view === "diagnostics" || view === "devices";
+				remoteView.hidden = subpage;
 				lanView.hidden = view !== "lan";
-				remoteView.hidden = view !== "remote";
+				remoteWorkspace.hidden = view !== "remote";
 				diagnosticsView.hidden = view !== "diagnostics";
+				devicesView.hidden = view !== "devices";
 				lanTab.classList.toggle("is-active", view === "lan");
 				remoteTab.classList.toggle("is-active", view === "remote");
+				applyChoiceSelection();
 				lanTab.setAttribute("aria-pressed", String(view === "lan"));
 				remoteTab.setAttribute("aria-pressed", String(view === "remote"));
 				diagnosticsEntry.setAttribute("aria-pressed", String(view === "diagnostics"));
 				diagnosticsEntry.textContent = view === "diagnostics" ? t("back") : t("diagnostics");
 				diagnosticsEntry.setAttribute("aria-label", view === "diagnostics" ? t("backToMobile") : t("openDiagnostics"));
+				devicesEntry.setAttribute("aria-pressed", String(view === "devices"));
+				devicesEntry.textContent = view === "devices" ? t("back") : t("device");
+				devicesEntry.setAttribute("aria-label", view === "devices" ? t("backToMobile") : t("managePairedDevices"));
 				if (view === "diagnostics") {
 					wsPathsSeenAttempts = wsBlockedTotal(wsPathsBlocked);
 					renderWsDot();
 					if (!wsPathsLoaded) loadWsPaths();
 				}
-				updatePlugin.hidden = view === "diagnostics" || !pluginUpdateAvailable;
-				appDownload.hidden = view === "diagnostics";
-				switcher.hidden = view === "diagnostics";
-				title.textContent = view === "lan" ? t("lanAccess") : view === "remote" ? t("remoteAccess") : t("connectionDiagnostics");
+				updatePlugin.hidden = subpage || !pluginUpdateAvailable;
+				appDownloads.hidden = subpage;
+				switcher.hidden = subpage;
+				title.textContent = view === "lan" ? t("lanAccess") : view === "remote" ? t("remoteAccess") : view === "devices" ? t("managePairedDevices") : t("connectionDiagnostics");
 			};
 			lanTab.addEventListener("click", () => {
 				selectView("lan");
 			});
+			lanChoice.addEventListener("click", () => {
+				selectView("lan");
+			});
+			providerChoices.addEventListener("click", () => {
+				selectView("remote");
+				loadRemote();
+			});
 			remoteTab.addEventListener("click", () => {
 				selectView("remote");
 				loadRemote();
 			});
+			selectView("lan");
+			let returnFocus;
 			const setOpen = (open) => {
+				const changed = panel.hidden === open;
+				if (open && changed && document.activeElement instanceof HTMLElement) returnFocus = document.activeElement;
 				panel.hidden = !open;
+				if (open) {
+					panel.setAttribute("role", "dialog");
+					panel.setAttribute("aria-modal", "true");
+				} else {
+					panel.removeAttribute("role");
+					panel.removeAttribute("aria-modal");
+				}
 				if (open) extensionRecovery.refresh();
+				if (open && changed) controlRequestJson("/api/mobile-access/release").then(renderRelease, () => {});
+				if (changed) {
+					if (open) close.focus();
+					else if (returnFocus?.isConnected) returnFocus.focus();
+				}
 				for (const trigger of document.querySelectorAll(".dsh-mobile-control__trigger")) trigger.setAttribute("aria-expanded", String(open));
 			};
+			panel.addEventListener("keydown", (event) => {
+				if (event.defaultPrevented) return;
+				if (event.key === "Escape") {
+					event.preventDefault();
+					setOpen(false);
+					return;
+				}
+				if (event.key !== "Tab") return;
+				const controls = [...panel.querySelectorAll("button,a[href],input,select,textarea,[tabindex]")].filter((node) => node.tabIndex >= 0 && !node.matches(":disabled") && node.getClientRects().length > 0);
+				const first = controls[0], last = controls.at(-1);
+				if (event.shiftKey && document.activeElement === first && last !== void 0) {
+					event.preventDefault();
+					last.focus();
+				} else if (!event.shiftKey && document.activeElement === last && first !== void 0) {
+					event.preventDefault();
+					first.focus();
+				}
+			});
+			const renderLanPairingExpiry = () => {
+				if (!running || activeLanPairExpiresAt === 0) return;
+				lanPairingValidity.hidden = false;
+				if (Date.now() >= activeLanPairExpiresAt) {
+					activeLanPairUrl = "";
+					showQr("");
+					qrBox.textContent = t("pairingExpired");
+					lanPairingValidity.textContent = t("pairingExpired");
+				} else lanPairingValidity.textContent = t("pairingExpires", { time: formatTime(activeLanPairExpiresAt) });
+			};
 			const render = (data) => {
+				const previousOrigin = origin;
 				lanConfigured = data.configured !== false;
 				lanRestartRequired = data.restartRequired === true;
 				running = data.running === true;
+				lanChoiceBadge.textContent = running ? t("lanBadgeOn") : t("lanBadgeOff");
 				origin = running && typeof data.origin === "string" ? data.origin : "";
 				lanSetup.hidden = lanConfigured && !lanRestartRequired;
 				lanSetupForm.hidden = lanRestartRequired;
@@ -11332,12 +12018,18 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 						failed
 					});
 				} else extensionStatus.hidden = true;
-				if (!running) qrBox.hidden = true;
+				if (!running || previousOrigin !== origin) {
+					lanPairingGeneration += 1;
+					activeLanPairUrl = "";
+					activeLanPairExpiresAt = 0;
+					lanPairingValidity.hidden = true;
+					showQr("");
+				} else renderLanPairingExpiry();
 				toggle.textContent = running ? t("disableLan") : t("enableLan");
 				actions.hidden = !lanConfigured || lanRestartRequired;
 				manageRow.hidden = !lanConfigured || lanRestartRequired;
-				pair.disabled = !running;
-				linkPair.disabled = !running;
+				pair.disabled = !running || lanPairingBusy;
+				linkPair.disabled = !running || lanPairingBusy;
 				manageDevices.disabled = !running;
 				resetAll.disabled = !running;
 			};
@@ -11406,10 +12098,25 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					lanSetupConfigure.disabled = lanRestartRequired || lanSetupSelect.options.length === 0;
 				});
 			});
+			const clearQrTarget = (target) => {
+				if (typeof target.replaceChildren === "function") {
+					target.replaceChildren();
+					return;
+				}
+				try {
+					while (target.firstChild) target.removeChild(target.firstChild);
+				} catch {}
+			};
 			const showQr = (svg, target = qrBox) => {
-				target.replaceChildren();
+				clearQrTarget(target);
 				if (svg === "") {
-					target.hidden = true;
+					const placeholderText = target === irohQr ? t("irohQrPlaceholder") : target === remoteQr ? t("remoteQrPlaceholder") : target === qrBox ? t("qrPlaceholder") : void 0;
+					if (placeholderText !== void 0) {
+						const placeholder = element("span", "dsh-mobile-control__qr-placeholder");
+						placeholder.textContent = placeholderText;
+						target.hidden = false;
+						target.append(placeholder);
+					} else target.hidden = true;
 					return;
 				}
 				const image = element("img");
@@ -11420,23 +12127,68 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				target.hidden = false;
 				target.append(image);
 			};
+			showQr("");
+			const showIrohQrPlaceholder = () => {
+				clearQrTarget(irohQr);
+				const placeholder = element("span", "dsh-mobile-control__qr-placeholder");
+				placeholder.textContent = t("irohQrPlaceholder");
+				irohQr.hidden = false;
+				irohQr.append(placeholder);
+			};
+			const showRemoteQrPlaceholder = (text) => {
+				clearQrTarget(remoteQr);
+				const placeholder = element("span", "dsh-mobile-control__qr-placeholder");
+				placeholder.textContent = text;
+				remoteQr.hidden = false;
+				remoteQr.append(placeholder);
+			};
 			const openPairing = (target) => {
-				controlRequestJson("/api/mobile-access/lan/pairing/open", {
+				if (lanPairingBusy || !running) return;
+				lanPairingBusy = true;
+				pair.disabled = true;
+				linkPair.disabled = true;
+				const pairingOrigin = origin;
+				const generation = lanPairingGeneration;
+				if (target === "key" || activeLanPairExpiresAt <= Date.now()) {
+					activeLanPairUrl = "";
+					activeLanPairExpiresAt = 0;
+					lanPairingValidity.hidden = true;
+					status.classList.remove("is-key");
+					showQr("");
+				}
+				(target === "link" && activeLanPairUrl !== "" && activeLanPairExpiresAt > Date.now() ? Promise.resolve({
+					pairUrl: activeLanPairUrl,
+					expiresAt: activeLanPairExpiresAt
+				}) : controlRequestJson("/api/mobile-access/lan/pairing/open", {
 					method: "POST",
 					body: "{}"
-				}).then(async (data) => {
-					const value = target === "key" ? typeof data.appKey === "string" ? data.appKey : "" : typeof data.pairUrl === "string" ? data.pairUrl : "";
-					showQr(typeof data.qrSvg === "string" ? data.qrSvg : "");
+				})).then(async (data) => {
+					if (lifecycle.signal.aborted || !running || origin !== pairingOrigin || generation !== lanPairingGeneration) return;
+					const value = typeof data.pairUrl === "string" ? data.pairUrl : "";
+					if (value === "" || typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt) || data.expiresAt <= Date.now()) {
+						status.textContent = t("keyGenerationFailed");
+						return;
+					}
+					activeLanPairUrl = value;
+					activeLanPairExpiresAt = data.expiresAt;
+					lanPairingValidity.hidden = false;
+					lanPairingValidity.textContent = t("pairingExpires", { time: formatTime(data.expiresAt) });
+					if ("qrSvg" in data) showQr(typeof data.qrSvg === "string" ? data.qrSvg : "");
+					if (target === "key") {
+						status.classList.remove("is-key");
+						status.textContent = t("qrGenerated");
+						return;
+					}
 					if (value === "") {
 						status.textContent = t("keyGenerationFailed");
 						return;
 					}
 					try {
 						await navigator.clipboard.writeText(value);
-						status.textContent = target === "key" ? t("keyCopied") : t("linkCopied");
+						status.textContent = t("linkCopied");
 					} catch {
 						status.textContent = t("copySecret", {
-							kind: target === "key" ? t("pairingKey") : t("pairingLink"),
+							kind: t("pairingLink"),
 							value
 						});
 						status.classList.add("is-key");
@@ -11444,6 +12196,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				}, (error) => {
 					status.textContent = t("requestFailed", { error: String(error) });
 				}).finally(() => {
+					lanPairingBusy = false;
 					pair.disabled = !running;
 					linkPair.disabled = !running;
 				});
@@ -11498,12 +12251,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const loadDevices = () => {
 				controlRequestJson("/api/mobile-access/lan/devices").then(renderDevices, (error) => {
 					status.textContent = t("requestFailed", { error: String(error) });
+					devicePanel.replaceChildren();
+					const note = element("p", "dsh-mobile-control__device-empty");
+					note.textContent = t("noDevices");
+					devicePanel.append(note);
 				});
 			};
 			manageDevices.addEventListener("click", () => {
-				const show = devicePanel.hidden;
-				devicePanel.hidden = !show;
-				if (show) loadDevices();
+				selectView("devices");
+				loadDevices();
 			});
 			resetAll.addEventListener("click", () => {
 				if (!window.confirm(t("confirmResetDevices"))) return;
@@ -11515,6 +12271,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			});
 			const renderRemote = (data) => {
+				if (data.provider !== latestRemoteState.provider || data.origin !== latestRemoteState.origin) {
+					remotePairingGeneration += 1;
+					activeRemotePairUrl = "";
+					activeRemotePairExpiresAt = 0;
+					remotePairLink.hidden = true;
+					remotePairLink.textContent = "";
+					pairingValidity.hidden = true;
+					showQr("", remoteQr);
+				}
 				latestRemoteState = data;
 				remoteRunning = data.running === true;
 				remoteProvider = parseMobileRemoteProvider(data.provider);
@@ -11522,13 +12287,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const cloudflared = remoteProvider === "cloudflared";
 				const frp = remoteProvider === "frp";
 				const origin = remoteProvider === "origin";
+				const iroh = remoteProvider === "iroh";
 				const managedOrigin = origin && data.originMode === "managed";
 				const tailscale = remoteProvider === "tailscale";
-				tailscaleChoice.classList.toggle("is-selected", tailscale);
-				cpolarChoice.classList.toggle("is-selected", cpolar);
-				cloudflaredChoice.classList.toggle("is-selected", cloudflared);
-				frpChoice.classList.toggle("is-selected", frp);
-				originChoice.classList.toggle("is-selected", origin);
 				tailscaleChoice.setAttribute("aria-checked", String(tailscale));
 				cpolarChoice.setAttribute("aria-checked", String(cpolar));
 				cloudflaredChoice.setAttribute("aria-checked", String(cloudflared));
@@ -11537,17 +12298,19 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.tabIndex = cloudflared ? 0 : -1;
 				frpChoice.setAttribute("aria-pressed", String(frp));
 				originChoice.setAttribute("aria-pressed", String(origin));
-				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t(managedOrigin ? "caddyName" : "originName") : "Tailscale Funnel";
+				irohChoice.setAttribute("aria-pressed", String(iroh));
+				applyChoiceSelection();
 				tailscaleChoice.disabled = remoteProviderBusy;
 				cpolarChoice.disabled = remoteProviderBusy;
 				cloudflaredChoice.disabled = remoteProviderBusy;
 				frpChoice.disabled = remoteProviderBusy;
 				originChoice.disabled = remoteProviderBusy;
+				irohChoice.disabled = remoteProviderBusy;
 				cpolarSetup.hidden = !cpolar;
 				cloudflaredSetup.hidden = !cloudflared;
 				frpSetup.hidden = !frp;
 				originSetup.hidden = !origin;
-				if (frp || origin) selfHosted.open = true;
+				irohSetup.hidden = !iroh;
 				tailscaleInfo.hidden = !tailscale;
 				remoteReset.textContent = tailscale ? t("resetRemoteLogin") : t("resetRemoteDevices");
 				const providers = data.providers !== null && typeof data.providers === "object" ? data.providers : {};
@@ -11562,7 +12325,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const componentStorage = typeof component.storagePath === "string" ? component.storagePath : `DSH Mobile ${t("pluginPrivateDirectory")}`;
 				cpolarStorage.textContent = componentStorage;
 				cpolarStorage.title = componentStorage;
-				cpolarInstall.hidden = cpolarInstalled || !cpolarSupported;
+				cpolarInstall.hidden = !cpolar || cpolarInstalled || !cpolarSupported;
 				cpolarInstall.textContent = componentDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(componentDownloadBytes) }) : t("installOfficial");
 				cpolarInstall.disabled = remoteProviderBusy;
 				cpolarAccount.hidden = !cpolarInstalled || cpolarConfigured;
@@ -11581,7 +12344,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredStorage.textContent = cloudflaredStoragePath;
 				cloudflaredStorage.title = cloudflaredStoragePath;
 				cloudflaredChoiceBadge.textContent = cloudflaredInstalled ? t("ready") : t("cloudflaredBadge");
-				cloudflaredInstall.hidden = cloudflaredInstalled || !cloudflaredSupported;
+				cloudflaredInstall.hidden = !cloudflared || cloudflaredInstalled || !cloudflaredSupported;
 				cloudflaredInstall.textContent = cloudflaredDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(cloudflaredDownloadBytes) }) : t("installOfficial");
 				cloudflaredInstall.disabled = remoteProviderBusy;
 				cloudflaredPurge.hidden = !cloudflaredInstalled;
@@ -11602,8 +12365,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredModeNamed.disabled = remoteProviderBusy;
 				cloudflaredModeHint.textContent = cloudflaredShownMode === "named" ? t("cloudflaredTunnelNamedHint") : t("cloudflaredTunnelQuickHint");
 				cloudflaredNote.textContent = cloudflaredShownMode === "named" ? t("cloudflaredNamedNote") : t("cloudflaredQuickNote");
-				cloudflaredTunnel.hidden = cloudflaredShownMode !== "named";
 				cloudflaredTunnelSave.textContent = cloudflaredSaveLabel();
+				syncCloudflaredForm();
 				if (!cloudflaredHostnameDirty) cloudflaredHostname.value = configuredCloudflaredHostname;
 				if (!cloudflaredPortDirty) cloudflaredPort.value = String(configuredCloudflaredPort);
 				cloudflaredToken.placeholder = cloudflaredTunnelConfigured ? t("cloudflaredTunnelTokenSaved") : t("cloudflaredTunnelTokenPlaceholder");
@@ -11702,6 +12465,32 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					frpVpsGroup.open = !frpConfigured;
 					frpLayoutInitialized = true;
 				}
+				const irohProvider = providers.iroh !== null && typeof providers.iroh === "object" ? providers.iroh : {};
+				const irohComponent = irohProvider.component !== null && typeof irohProvider.component === "object" ? irohProvider.component : {};
+				irohInstalled = irohComponent.installed === true;
+				const irohSupported = irohComponent.supported !== false;
+				const irohComponentError = typeof irohComponent.errorCode === "string" ? irohComponent.errorCode : "";
+				const irohVersion = typeof irohComponent.version === "string" ? irohComponent.version : "";
+				const irohDownloadBytes = typeof irohComponent.downloadBytes === "number" ? irohComponent.downloadBytes : 0;
+				const irohStoragePath = typeof irohComponent.storagePath === "string" ? irohComponent.storagePath : `DSH Mobile ${t("pluginPrivateDirectory")}`;
+				irohInstall.hidden = irohInstalled || !irohSupported;
+				irohPurge.hidden = !irohInstalled;
+				irohPurge.disabled = iroh && remoteRunning;
+				if (irohVerifying) {
+					irohInstallProgress.hidden = false;
+					irohInstall.disabled = true;
+					irohInstall.textContent = t("installingIroh");
+					irohInstall.setAttribute("aria-busy", "true");
+					irohComponentStatus.textContent = t("installingIroh");
+				} else {
+					irohInstallProgress.hidden = true;
+					irohInstall.setAttribute("aria-busy", "false");
+					irohInstall.disabled = remoteProviderBusy;
+					irohInstall.textContent = irohDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(irohDownloadBytes) }) : t("installOfficial");
+					irohComponentStatus.textContent = !irohSupported ? t("irohPlatformUnsupported") : irohInstalled ? t("installed") + (irohVersion === "" ? "" : ` · ${irohVersion}`) : irohComponentError === "irohSidecarInvalid" ? t("irohSidecarInvalid") : t("irohUnavailable");
+				}
+				irohStorage.textContent = irohStoragePath;
+				irohStorage.title = irohStoragePath;
 				const originProvider = providers.origin !== null && typeof providers.origin === "object" ? providers.origin : {};
 				const originConfiguration = originProvider.configuration !== null && typeof originProvider.configuration === "object" ? originProvider.configuration : {};
 				originConfigured = originConfiguration.configured === true;
@@ -11780,11 +12569,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				}[errorCode] ?? "";
 				const needsFunnelSetup = state === "error" && remoteSetupUrl !== "";
 				remoteReady = remoteRunning && state === "ready" && remoteOrigin !== "";
-				selfHostedBadge.textContent = origin ? managedOrigin ? t(remoteReady ? "ready" : "advanced") : originListening ? t("originBackendReady") : t("advanced") : frpConfigured && frpInstalled ? t("ready") : t("advanced");
-				remoteStateBadge.classList.toggle("is-ready", remoteReady);
-				remoteStateBadge.classList.toggle("is-busy", state === "starting" || state === "connecting" || state === "needs-login");
-				remoteStateBadge.classList.toggle("is-attention", state === "error" || state === "unavailable");
-				remoteStateBadge.textContent = remoteReady ? origin && !managedOrigin ? t("originBackendReady") : t("ready") : state === "starting" || state === "connecting" || state === "needs-login" ? t("remoteStateConnecting") : state === "error" || state === "unavailable" ? t("remoteStateAttention") : t("remoteStateOff");
+				frpChoiceBadge.textContent = frpConfigured && frpInstalled ? t("ready") : t("advanced");
+				originChoiceBadge.textContent = managedOrigin ? t(remoteReady ? "ready" : "advanced") : originListening ? t("originBackendReady") : t("advanced");
+				if (remoteStatus.style) remoteStatus.style.display = state === "off" && remoteFailureText === "" ? "none" : "";
 				remoteAccess.hidden = !remoteReady;
 				remoteAccessLink.href = remoteOrigin;
 				remoteAccessLink.textContent = remoteOrigin;
@@ -11792,10 +12579,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteStatus.classList.toggle("is-running", remoteReady);
 				const labels = {
 					off: t("remoteOff"),
-					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : t("remoteUnavailableTailscale"),
-					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : t("remoteStartingTailscale"),
+					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : iroh ? irohInstalled ? t("irohInstalledNotReady") : t("irohUnavailable") : t("remoteUnavailableTailscale"),
+					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : iroh ? t("irohStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
-					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : t("remoteConnectingTailscale"),
+					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : iroh ? t("irohConnecting") : t("remoteConnectingTailscale"),
 					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
@@ -11810,24 +12597,71 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteSetupRetry.disabled = remoteReconnectBusy;
 				remoteToggle.textContent = remoteRunning ? t("disableRemote") : t("enableRemote");
 				const originPrepared = data.originMode === "managed" ? caddySupported && caddyInstalled && caddyConfiguration.configured === true : originConfigured && !caddyModeManagedSelected;
-				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : true;
-				remoteToggle.disabled = remoteProviderBusy || !providerPrepared && !(origin && remoteRunning);
+				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : iroh ? irohInstalled : true;
+				const namedUnconfigured = cloudflared && cloudflaredShownMode === "named" && cloudflaredTunnelMode !== "named" && !remoteRunning;
+				remoteToggle.disabled = remoteProviderBusy || !providerPrepared && !(origin && remoteRunning) || namedUnconfigured;
+				if (namedUnconfigured) {
+					remoteStatus.textContent = t("cloudflaredEnableNeedsConfig");
+					if (remoteStatus.style) remoteStatus.style.display = "";
+				}
 				remoteLogin.hidden = !tailscale || state !== "needs-login" || remoteLoginUrl === "";
 				remoteReconnect.hidden = needsFunnelSetup || state !== "error" && state !== "unavailable" || !providerPrepared;
 				remoteActions.hidden = !providerPrepared && !(origin && remoteRunning);
-				remotePair.disabled = !remoteReady || remoteProviderBusy;
-				remoteCopyLink.disabled = !remoteReady || remoteProviderBusy;
+				if (!providerPrepared) remoteQr.hidden = true;
+				providerInstallRow.hidden = cpolarInstall.hidden && cloudflaredInstall.hidden;
+				remotePair.disabled = !remoteReady || remoteProviderBusy || remotePairingBusy;
+				remoteCopyLink.disabled = !remoteReady || remoteProviderBusy || remotePairingBusy;
 				remoteDevices.disabled = !remoteReady || remoteProviderBusy;
+				remotePair.hidden = iroh;
+				remoteCopyLink.hidden = iroh;
+				if (iroh) {
+					remoteQr.hidden = true;
+					remotePairLink.hidden = true;
+				}
+				irohPair.disabled = !remoteReady || !iroh || remoteProviderBusy;
+				irohPair.hidden = !iroh;
+				irohCopyDescriptor.hidden = !iroh;
+				if (iroh && irohInstalled && activeIrohQrSvg === "") showIrohQrPlaceholder();
+				else if (!iroh || !irohInstalled) irohQr.hidden = true;
+				if ((!iroh || !remoteReady) && activeIrohDescriptor !== "") {
+					activeIrohDescriptor = "";
+					activeIrohPairExpiresAt = 0;
+					activeIrohQrSvg = "";
+					showQr("", irohQr);
+					setIrohQrZoomOpen(false);
+					irohPairStatus.textContent = "";
+				}
+				irohCopyDescriptor.disabled = !iroh || !remoteReady || remoteProviderBusy || activeIrohDescriptor === "" || activeIrohPairExpiresAt <= Date.now();
 				if (origin) {
 					remoteReconnect.disabled = remoteProviderBusy || remoteReconnectBusy;
 					remoteReset.disabled = remoteProviderBusy;
 				} else remoteReset.disabled = false;
 				if (!remoteReady) {
-					remoteQr.hidden = true;
+					remotePairingGeneration += 1;
 					remotePairLink.hidden = true;
 					activeRemotePairUrl = "";
 					activeRemotePairExpiresAt = 0;
+					pairingValidity.hidden = true;
+					if (iroh) remoteQr.hidden = true;
+					else showRemoteQrPlaceholder(t("remoteQrPlaceholderIdle"));
+				} else if (!iroh && activeRemotePairExpiresAt > 0 && Date.now() >= activeRemotePairExpiresAt) {
+					activeRemotePairUrl = "";
+					remotePairLink.hidden = true;
+					remotePairLink.textContent = "";
+					showRemoteQrPlaceholder(t("pairingExpired"));
+					pairingValidity.hidden = false;
+					pairingValidity.textContent = t("pairingExpired");
+				} else if (!iroh && activeRemotePairUrl !== "") {
+					pairingValidity.hidden = false;
+					pairingValidity.textContent = t("pairingExpires", { time: formatTime(activeRemotePairExpiresAt) });
+				} else {
+					pairingValidity.hidden = true;
+					if (!iroh) showQr("", remoteQr);
 				}
+				cpolarDetails.hidden = !cpolar;
+				cloudflaredDetails.hidden = !cloudflared;
+				frpDetails.hidden = !frp;
+				irohDetails.hidden = !iroh;
 				if (!needsFunnelSetup) remoteSetupPending = false;
 			};
 			frpMode.addEventListener("change", () => {
@@ -11882,7 +12716,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.disabled = true;
 				frpChoice.disabled = true;
 				originChoice.disabled = true;
-				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : t("switchingTailscale");
+				irohChoice.disabled = true;
+				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : provider === "iroh" ? t("switchingIroh") : t("switchingTailscale");
 				controlRequestJson("/api/mobile-access/remote/provider", {
 					method: "POST",
 					body: JSON.stringify({ provider })
@@ -11909,6 +12744,140 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoice.addEventListener("click", () => {
 				chooseRemoteProvider("origin");
 			});
+			irohChoice.addEventListener("click", () => {
+				chooseRemoteProvider("iroh");
+			});
+			irohInstall.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("irohInstallConfirm"))) return;
+				remoteProviderBusy = true;
+				irohVerifying = true;
+				irohInstall.disabled = true;
+				irohInstall.textContent = t("installingIroh");
+				irohInstall.setAttribute("aria-busy", "true");
+				irohInstallProgress.hidden = false;
+				irohComponentStatus.textContent = t("installingIroh");
+				remoteStatus.textContent = t("installingIroh");
+				controlRequestJson("/api/mobile-access/remote/iroh/component/install", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
+					irohComponentStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					irohVerifying = false;
+					loadRemote();
+				});
+			});
+			irohPurge.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("irohPurgeConfirm"))) return;
+				remoteProviderBusy = true;
+				irohPurge.disabled = true;
+				irohComponentStatus.textContent = t("purgingIroh");
+				remoteStatus.textContent = t("purgingIroh");
+				controlRequestJson("/api/mobile-access/remote/iroh/component/purge", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "purgeFailed");
+					remoteStatus.textContent = remoteFailureText;
+					irohComponentStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					irohPurge.disabled = false;
+					loadRemote();
+				});
+			});
+			const openIrohQrZoom = () => {
+				if (activeIrohQrSvg === "" || irohQr.hidden) return;
+				irohQrZoomImage.src = `data:image/svg+xml;base64,${btoa(activeIrohQrSvg)}`;
+				setIrohQrZoomOpen(true);
+				irohQrZoomClose.focus();
+			};
+			const closeIrohQrZoom = () => {
+				setIrohQrZoomOpen(false);
+				if (!irohQr.hidden) irohQr.focus();
+			};
+			irohQr.setAttribute("role", "button");
+			irohQr.setAttribute("tabindex", "0");
+			irohQr.setAttribute("aria-label", t("enlargeQr"));
+			irohQr.addEventListener("click", openIrohQrZoom);
+			irohQr.addEventListener("keydown", (event) => {
+				if (event.key !== "Enter" && event.key !== " ") return;
+				event.preventDefault();
+				openIrohQrZoom();
+			});
+			irohQrZoom.addEventListener("click", closeIrohQrZoom);
+			irohQrZoomClose.addEventListener("click", closeIrohQrZoom);
+			irohQrZoom.addEventListener("keydown", (event) => {
+				if (event.key !== "Escape") return;
+				closeIrohQrZoom();
+			});
+			const openIrohPairing = async () => {
+				const generation = remotePairingGeneration;
+				activeIrohDescriptor = "";
+				activeIrohPairExpiresAt = 0;
+				irohCopyDescriptor.disabled = true;
+				const data = await controlRequestJson("/api/mobile-access/remote/iroh/pairing/begin", {
+					method: "POST",
+					body: "{}"
+				});
+				if (lifecycle.signal.aborted || remoteProvider !== "iroh" || !remoteReady || generation !== remotePairingGeneration) return;
+				const record = data;
+				const qrSvg = typeof record.qrSvg === "string" ? record.qrSvg : "";
+				const code = typeof record.irohCode === "string" ? record.irohCode : "";
+				const expiresAt = typeof record.expiresAt === "number" && Number.isFinite(record.expiresAt) ? record.expiresAt : 0;
+				showQr(qrSvg, irohQr);
+				if (qrSvg === "" || code === "" || expiresAt <= Date.now()) {
+					activeIrohQrSvg = "";
+					irohPairStatus.textContent = t("keyGenerationFailed");
+					return;
+				}
+				activeIrohQrSvg = qrSvg;
+				const fields = [
+					"version",
+					"type",
+					"endpointId",
+					"origin",
+					"localPort",
+					"irohCode",
+					"gatewayToken",
+					"caCertificate",
+					"instanceId",
+					"expiresAt"
+				];
+				const descriptor = {};
+				for (const field of fields) descriptor[field] = record[field];
+				activeIrohDescriptor = JSON.stringify(descriptor);
+				activeIrohPairExpiresAt = expiresAt;
+				irohPairStatus.textContent = t("irohPairingReady", { code });
+			};
+			irohPair.addEventListener("click", () => {
+				if (remoteProviderBusy || !remoteReady || remoteProvider !== "iroh") return;
+				remoteProviderBusy = true;
+				remoteSnapshotEpoch += 1;
+				renderRemote(latestRemoteState);
+				irohPair.disabled = true;
+				irohPairStatus.textContent = t("loadingRemoteStatus");
+				openIrohPairing().catch((error) => {
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					irohPairStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					loadRemote();
+				});
+			});
+			irohCopyDescriptor.addEventListener("click", () => {
+				if (remoteProviderBusy || !remoteReady || remoteProvider !== "iroh" || activeIrohDescriptor === "" || activeIrohPairExpiresAt <= Date.now()) return;
+				navigator.clipboard.writeText(activeIrohDescriptor).then(() => {
+					irohPairStatus.textContent = t("irohLinkCopied");
+				}, () => {
+					irohPairStatus.textContent = t("remoteQrReady");
+				});
+			});
 			cloudflaredInstall.addEventListener("click", () => {
 				if (remoteProviderBusy) return;
 				if (!window.confirm(t("installConfirmCloudflared", { size: cloudflaredDownloadSize }))) return;
@@ -11945,6 +12914,19 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					loadRemote();
 				});
 			});
+			const syncCloudflaredForm = () => {
+				const named = (cloudflaredModeDraft ?? cloudflaredTunnelMode) === "named";
+				const locked = named && cloudflaredTunnelConfigured && cloudflaredTunnelMode === "named" && !cloudflaredConfigEditing;
+				cloudflaredHostname.disabled = locked || remoteProviderBusy;
+				cloudflaredPort.disabled = locked || remoteProviderBusy;
+				cloudflaredToken.disabled = locked || remoteProviderBusy;
+				cloudflaredEditButton.disabled = remoteProviderBusy;
+				cloudflaredTunnelForget.disabled = remoteProviderBusy;
+				cloudflaredTunnelToggle.hidden = !named;
+				cloudflaredEditButton.hidden = !locked;
+				cloudflaredTunnelSave.hidden = !named || locked;
+				cloudflaredTunnelForget.hidden = !named || cloudflaredTunnelMode !== "named" || cloudflaredConfigEditing;
+			};
 			const showCloudflaredMode = (mode) => {
 				cloudflaredModeDraft = mode;
 				cloudflaredModeQuick.classList.toggle("is-active", mode === "quick");
@@ -11953,14 +12935,60 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredModeNamed.setAttribute("aria-pressed", String(mode === "named"));
 				cloudflaredModeHint.textContent = mode === "named" ? t("cloudflaredTunnelNamedHint") : t("cloudflaredTunnelQuickHint");
 				cloudflaredNote.textContent = mode === "named" ? t("cloudflaredNamedNote") : t("cloudflaredQuickNote");
-				cloudflaredTunnel.hidden = mode !== "named";
+				cloudflaredTunnel.hidden = true;
+				cloudflaredTunnelToggle.textContent = t("cloudflaredShowConfig") + " ▾";
 				cloudflaredTunnelSave.textContent = cloudflaredSaveLabel();
+				syncCloudflaredForm();
+				if (mode === "named" && cloudflaredTunnelMode !== "named") {
+					remoteToggle.disabled = true;
+					remoteStatus.textContent = t("cloudflaredEnableNeedsConfig");
+					if (remoteStatus.style) remoteStatus.style.display = "";
+				}
+			};
+			cloudflaredTunnelToggle.addEventListener("click", () => {
+				const open = cloudflaredTunnel.hidden;
+				cloudflaredTunnel.hidden = !open;
+				cloudflaredTunnelToggle.textContent = open ? t("cloudflaredHideConfig") + " ▴" : t("cloudflaredShowConfig") + " ▾";
+			});
+			cloudflaredEditButton.addEventListener("click", () => {
+				cloudflaredConfigEditing = true;
+				syncCloudflaredForm();
+				cloudflaredTunnel.hidden = false;
+				cloudflaredTunnelToggle.textContent = t("cloudflaredHideConfig") + " ▴";
+			});
+			const switchCloudflaredMode = (mode) => {
+				if (remoteProviderBusy || (cloudflaredModeDraft ?? cloudflaredTunnelMode) === mode) return;
+				const activeState = typeof latestRemoteState.state === "string" ? latestRemoteState.state : "off";
+				if (remoteRunning || activeState !== "off") {
+					if (!window.confirm(t("cloudflaredSwitchModeDisconnect"))) return;
+					remoteProviderBusy = true;
+					remoteSnapshotEpoch += 1;
+					renderRemote(latestRemoteState);
+					controlRequestJson("/api/mobile-access/remote/control", {
+						method: "POST",
+						body: JSON.stringify({
+							running: false,
+							provider: "cloudflared"
+						})
+					}).then((data) => {
+						renderRemote(data);
+						showCloudflaredMode(mode);
+					}, (error) => {
+						remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+						remoteStatus.textContent = remoteFailureText;
+					}).finally(() => {
+						remoteProviderBusy = false;
+						loadRemote();
+					});
+					return;
+				}
+				showCloudflaredMode(mode);
 			};
 			cloudflaredModeQuick.addEventListener("click", () => {
-				if (!remoteProviderBusy) showCloudflaredMode("quick");
+				switchCloudflaredMode("quick");
 			});
 			cloudflaredModeNamed.addEventListener("click", () => {
-				if (!remoteProviderBusy) showCloudflaredMode("named");
+				switchCloudflaredMode("named");
 			});
 			cloudflaredHostname.addEventListener("input", () => {
 				cloudflaredHostnameDirty = true;
@@ -11970,6 +12998,11 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			});
 			cloudflaredTunnelSave.addEventListener("click", () => {
 				if (remoteProviderBusy) return;
+				const report = (message) => {
+					remoteStatus.textContent = message;
+					cloudflaredTunnelFeedback.hidden = false;
+					cloudflaredTunnelFeedback.textContent = message;
+				};
 				const mode = cloudflaredModeDraft ?? cloudflaredTunnelMode;
 				const hostname = String(cloudflaredHostname.value ?? "").trim();
 				const portValue = String(cloudflaredPort.value ?? "").trim();
@@ -11977,48 +13010,57 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const token = String(cloudflaredToken.value ?? "");
 				if (mode === "named") {
 					if (hostname === "") {
-						remoteStatus.textContent = t("cloudflaredTunnelHostnameInvalid");
+						report(t("cloudflaredTunnelHostnameInvalid"));
 						return;
 					}
 					if (portValue === "" || !Number.isSafeInteger(port) || port < 1024 || port > 65535) {
-						remoteStatus.textContent = t("cloudflaredTunnelPortInvalid");
+						report(t("cloudflaredTunnelPortInvalid"));
 						return;
 					}
 					if (port === 3443) {
-						remoteStatus.textContent = t("cloudflaredTunnelPortReserved");
+						report(t("cloudflaredTunnelPortReserved"));
 						return;
 					}
 					if (token === "" && !cloudflaredTunnelConfigured) {
-						remoteStatus.textContent = t("cloudflaredTunnelConfigMissing");
+						report(t("cloudflaredTunnelConfigMissing"));
 						return;
 					}
 					if (token !== "" && (token.length < 32 || !/^[A-Za-z0-9_=+/-]+$/u.test(token))) {
-						remoteStatus.textContent = t("cloudflaredTunnelTokenInvalid");
+						report(t("cloudflaredTunnelTokenInvalid"));
 						return;
 					}
 				}
 				remoteProviderBusy = true;
+				remoteSnapshotEpoch += 1;
+				renderRemote(latestRemoteState);
 				cloudflaredTunnelSave.disabled = true;
 				cloudflaredTunnelSave.textContent = t("saving");
-				remoteStatus.textContent = mode === "named" ? t("cloudflaredTunnelSaving") : t("switchingCloudflared");
+				report(mode === "named" ? t("cloudflaredTunnelSaving") : t("switchingCloudflared"));
 				controlRequestJson("/api/mobile-access/remote/cloudflared/tunnel", {
 					method: "POST",
 					body: JSON.stringify(mode === "named" ? {
 						mode,
 						hostname,
 						port,
-						token
-					} : { mode: "quick" })
+						token,
+						connect: true
+					} : {
+						mode: "quick",
+						connect: true
+					})
 				}).then((data) => {
 					cloudflaredToken.value = "";
 					cloudflaredModeDraft = null;
+					cloudflaredConfigEditing = false;
 					cloudflaredHostnameDirty = false;
 					cloudflaredPortDirty = false;
 					remoteFailureText = "";
+					cloudflaredTunnelFeedback.hidden = false;
+					cloudflaredTunnelFeedback.textContent = t("cloudflaredTunnelSaved");
 					renderRemote(data);
 				}, (error) => {
 					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
-					remoteStatus.textContent = remoteFailureText;
+					report(remoteFailureText);
 				}).finally(() => {
 					remoteProviderBusy = false;
 					cloudflaredTunnelSave.disabled = false;
@@ -12883,14 +13925,35 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			});
 			remoteToggle.addEventListener("click", () => {
-				remoteToggle.disabled = true;
-				controlRequestJson("/api/mobile-access/remote/control", {
+				if (remoteProviderBusy) return;
+				const nextRunning = !remoteRunning;
+				const provider = remoteProvider;
+				remoteProviderBusy = true;
+				remoteSnapshotEpoch += 1;
+				renderRemote(latestRemoteState);
+				(nextRunning && provider === "cloudflared" && cloudflaredModeDraft !== null && cloudflaredModeDraft !== cloudflaredTunnelMode ? controlRequestJson("/api/mobile-access/remote/cloudflared/tunnel", {
 					method: "POST",
-					body: JSON.stringify({ running: !remoteRunning })
-				}).then(renderRemote, (error) => {
+					body: JSON.stringify({
+						mode: cloudflaredModeDraft,
+						connect: true
+					})
+				}) : controlRequestJson("/api/mobile-access/remote/control", {
+					method: "POST",
+					body: JSON.stringify({
+						running: nextRunning,
+						provider
+					})
+				})).then(renderRemote, (error) => {
 					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
 					remoteStatus.textContent = remoteFailureText;
-				}).finally(loadRemote);
+					if (remoteProvider === "cloudflared") {
+						cloudflaredTunnelFeedback.hidden = false;
+						cloudflaredTunnelFeedback.textContent = remoteFailureText;
+					}
+				}).finally(() => {
+					remoteProviderBusy = false;
+					loadRemote();
+				});
 			});
 			remoteLogin.addEventListener("click", () => {
 				if (remoteLoginUrl !== "") window.open(remoteLoginUrl, "_blank", "noopener,noreferrer");
@@ -12901,7 +13964,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteReconnect.disabled = true;
 				remoteSetup.disabled = true;
 				remoteSetupRetry.disabled = true;
-				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : t("reconnectingTailscale");
+				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : remoteProvider === "iroh" ? t("reconnectingIroh") : t("reconnectingTailscale");
 				controlRequestJson("/api/mobile-access/remote/reconnect", {
 					method: "POST",
 					body: "{}"
@@ -12942,40 +14005,64 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					remoteStatus.textContent = t("remoteQrReady");
 				}
 			};
-			const openRemotePairing = () => controlRequestJson("/api/mobile-access/remote/pairing/open", {
-				method: "POST",
-				body: "{}"
-			}).then(async (data) => {
-				const pairUrl = typeof data.pairUrl === "string" ? data.pairUrl : "";
-				const expiresAt = typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt) ? data.expiresAt : 0;
-				showQr(typeof data.qrSvg === "string" ? data.qrSvg : "", remoteQr);
-				if (pairUrl === "") {
-					remoteStatus.textContent = t("keyGenerationFailed");
-					return;
-				}
-				activeRemotePairUrl = pairUrl;
-				activeRemotePairExpiresAt = expiresAt;
-				remotePairLink.textContent = pairUrl;
-				remotePairLink.classList.add("is-key");
-				remotePairLink.hidden = false;
-				await copyRemotePairUrl();
-			});
+			const openRemotePairing = () => {
+				const provider = remoteProvider;
+				const origin = latestRemoteState.origin;
+				const generation = remotePairingGeneration;
+				activeRemotePairUrl = "";
+				activeRemotePairExpiresAt = 0;
+				pairingValidity.hidden = true;
+				remotePairLink.hidden = true;
+				remotePairLink.textContent = "";
+				showQr("", remoteQr);
+				return controlRequestJson("/api/mobile-access/remote/pairing/open", {
+					method: "POST",
+					body: "{}"
+				}).then(async (data) => {
+					if (lifecycle.signal.aborted || !remoteReady || provider !== remoteProvider || origin !== latestRemoteState.origin || generation !== remotePairingGeneration) return;
+					const pairUrl = typeof data.pairUrl === "string" ? data.pairUrl : "";
+					const expiresAt = typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt) ? data.expiresAt : 0;
+					if (pairUrl === "" || expiresAt <= Date.now()) {
+						remoteStatus.textContent = t("keyGenerationFailed");
+						return;
+					}
+					showQr(typeof data.qrSvg === "string" ? data.qrSvg : "", remoteQr);
+					activeRemotePairUrl = pairUrl;
+					activeRemotePairExpiresAt = expiresAt;
+					pairingValidity.hidden = false;
+					pairingValidity.textContent = t("pairingExpires", { time: formatTime(expiresAt) });
+					remotePairLink.textContent = pairUrl;
+					remotePairLink.classList.add("is-key");
+					remotePairLink.hidden = false;
+					await copyRemotePairUrl();
+				});
+			};
 			remotePair.addEventListener("click", () => {
+				if (!remoteReady || remoteProviderBusy || remotePairingBusy) return;
+				remotePairingBusy = true;
 				remotePair.disabled = true;
+				remoteCopyLink.disabled = true;
 				openRemotePairing().catch((error) => {
 					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
 					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
-					remotePair.disabled = !remoteReady;
+					remotePairingBusy = false;
+					remotePair.disabled = !remoteReady || remoteProviderBusy;
+					remoteCopyLink.disabled = !remoteReady || remoteProviderBusy;
 				});
 			});
 			remoteCopyLink.addEventListener("click", () => {
+				if (!remoteReady || remoteProviderBusy || remotePairingBusy) return;
+				remotePairingBusy = true;
+				remotePair.disabled = true;
 				remoteCopyLink.disabled = true;
 				(activeRemotePairUrl !== "" && activeRemotePairExpiresAt > Date.now() ? copyRemotePairUrl() : openRemotePairing()).catch((error) => {
 					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
 					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
-					remoteCopyLink.disabled = !remoteReady;
+					remotePairingBusy = false;
+					remotePair.disabled = !remoteReady || remoteProviderBusy;
+					remoteCopyLink.disabled = !remoteReady || remoteProviderBusy;
 				});
 			});
 			const renderRemoteDevices = (data) => {
@@ -13014,6 +14101,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				controlRequestJson("/api/mobile-access/remote/devices").then(renderRemoteDevices, (error) => {
 					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
 					remoteStatus.textContent = remoteFailureText;
+					remoteDevicePanel.replaceChildren();
+					const note = element("p", "dsh-mobile-control__device-empty");
+					note.textContent = remoteRunning ? t("noRemoteDevices") : t("remoteOff");
+					remoteDevicePanel.append(note);
 				});
 			};
 			remoteDevices.addEventListener("click", () => {
@@ -13022,7 +14113,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (show) loadRemoteDevices();
 			});
 			remoteReset.addEventListener("click", () => {
-				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : t("resetTailscaleConfirm");
+				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : remoteProvider === "iroh" ? t("resetIrohConfirm") : t("resetTailscaleConfirm");
 				if (!window.confirm(prompt)) return;
 				controlRequestJson("/api/mobile-access/remote/reset", {
 					method: "POST",
@@ -13172,6 +14263,14 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				selectView("diagnostics");
 				loadDiagnostics();
 			});
+			devicesEntry.addEventListener("click", () => {
+				if (!devicesView.hidden) {
+					selectView(previousAccessView);
+					return;
+				}
+				selectView("devices");
+				showDevicesGroup("lan");
+			});
 			diagnosticsRun.addEventListener("click", loadDiagnostics);
 			diagnosticsRun.addEventListener("click", () => {
 				extensionRecovery.refresh();
@@ -13232,11 +14331,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			});
 			pair.addEventListener("click", () => {
-				pair.disabled = true;
 				openPairing("key");
 			});
 			linkPair.addEventListener("click", () => {
-				linkPair.disabled = true;
 				openPairing("link");
 			});
 			close.addEventListener("click", () => {
@@ -13244,12 +14341,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			});
 			const dismiss = (event) => {
 				if (panel.hidden || !(event.target instanceof Node)) return;
-				if (!providerInfo.contains(event.target)) {
-					providerInfoPinned = false;
-					providerInfoHovered = false;
-					syncProviderInfo();
-				}
-				if (!panel.contains(event.target) && !document.querySelector(".dsh-mobile-control__trigger")?.contains(event.target)) setOpen(false);
+				if (!panel.contains(event.target) && !irohQrZoom.contains(event.target) && !document.querySelector(".dsh-mobile-control__trigger")?.contains(event.target)) setOpen(false);
 			};
 			document.addEventListener("pointerdown", dismiss);
 			controlRequestJson("/api/mobile-access/release").then(renderRelease, () => {});
@@ -13258,7 +14350,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			});
 			loadRemote();
 			const remotePoll = window.setInterval(() => {
-				if (!panel.hidden && !remoteView.hidden) loadRemote();
+				if (!panel.hidden && !remoteView.hidden) {
+					renderLanPairingExpiry();
+					loadRemote();
+				}
 			}, 1500);
 			const pollWsBlocked = () => {
 				controlRequestJson("/api/mobile-access/remote/websocket-paths/blocked").then((blocked) => {
@@ -13821,10 +14916,28 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			}
 		};
-		/** Install authenticated mobile customization refresh, retaining loaded legacy assets through temporary failures. */
-		function installCustomAssets() {
+		/**
+		* Install authenticated customization refresh, retaining assets through temporary failures.
+		* @param recovery - optional instance-owned authentication feedback and refresh registration.
+		* @returns synchronous teardown for the customization UI and refresh admission.
+		*/
+		function installCustomAssets(recovery) {
 			const reporter = createMobileAssetLoadReporter(selectedMobileControlLocale);
+			let refreshNow = () => {};
 			const customizationOwner = ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__);
+			const removeNotice = customizationOwner ? installCustomizationNotice(document, {
+				locale: () => {
+					const locale = selectedMobileControlLocale();
+					return locale === "zh" || locale === "it" ? locale : "en";
+				},
+				reconnect: () => {
+					const attempted = recovery?.retry() ?? false;
+					refreshNow();
+					return attempted;
+				},
+				subscribe: (listener) => reporter.subscribe(listener),
+				message: (reason) => reporter.message(reason)
+			}) : () => {};
 			const legacyStyle = element("style");
 			legacyStyle.dataset.plugin = "dsh-mobile-custom";
 			document.head.append(legacyStyle);
@@ -13856,7 +14969,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (reason === "authentication_required") events?.setEnabled(false);
 			};
 			const unavailable = (response, signal, fallback) => {
-				failed(response.status === 401 || response.status === 403 ? "authentication_required" : fallback, signal);
+				const rejectedAuth = response.status === 401 || response.status === 403;
+				failed(rejectedAuth ? "authentication_required" : fallback, signal);
+				if (rejectedAuth && !disposed && !signal.aborted) recovery?.rejected(response.status);
 				response.body?.cancel().catch((error) => {});
 			};
 			let expectedDefinitionId;
@@ -14416,6 +15531,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					events?.setEnabled(true);
 				}
 			});
+			refreshNow = () => {
+				stopRefresh.refresh();
+			};
+			const unregisterRefresh = recovery?.registerRefresh(refreshNow);
 			const stopEvents = startExtensionChangeStream(() => {
 				stopRefresh.refresh();
 			}, void 0, (payload) => {
@@ -14436,6 +15555,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			events = stopEvents;
 			return () => {
 				disposed = true;
+				unregisterRefresh?.();
+				removeNotice();
 				reporter.dispose();
 				stopNativeBack();
 				stopEvents();
@@ -14495,9 +15616,31 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		/** Theme-aware desktop Mobile Access panel styles. */
 		const CONTROL_STYLES = `
 .dsh-mobile-control{position:fixed;z-index:1000;left:16px;bottom:112px;font:14px/1.45 system-ui;color:var(--dsw-alias-label-primary,#16181d)}
-.dsh-mobile-control__panel{box-sizing:border-box;width:min(380px,calc(100vw - 32px));max-height:calc(100vh - 140px);overflow-y:auto;padding:16px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:18px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 18px 50px rgb(15 23 42 / 18%)}
+.dsh-mobile-control__panel{box-sizing:border-box;width:min(704px,calc(100vw - 32px));max-height:calc(100vh - 140px);overflow-y:auto;padding:16px;border:0;border-radius:16px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 12px 34px rgb(15 23 42 / 13%)}.dsh-mobile-control__remote-columns{display:grid;grid-template-columns:minmax(230px,300px) minmax(0,1fr);gap:14px;align-items:start;max-height:calc(100vh - 330px)}
+/* Floating panel with dense, borderless content. */
+.dsh-mobile-control{inset:auto;left:16px;bottom:112px;pointer-events:none}
+.dsh-mobile-control__panel{position:relative;inset:auto;width:min(704px,calc(100vw - 32px));height:auto;max-height:calc(100vh - 140px);border:0;border-radius:16px;box-shadow:0 12px 34px rgb(15 23 42 / 13%);display:flex;flex-direction:column;overflow:hidden;pointer-events:auto;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__panel[hidden]{display:none}
+.dsh-mobile-control__header{flex:none;margin:0;padding:12px 16px;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__app-downloads{flex:none;padding:8px 16px;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);margin:0}
+.dsh-mobile-control__view.is-remote{flex:1;min-height:0;display:flex;flex-direction:column}
+.dsh-mobile-control__remote-columns{flex:1;min-height:0;display:grid;grid-template-columns:260px minmax(0,1fr);gap:0;max-height:none;align-items:stretch}
+.dsh-mobile-control__remote-columns>.dsh-mobile-control__provider-section{overflow-y:auto;border-right:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-1,#f7f8fa);padding:10px 8px}
+.dsh-mobile-control__channel-pane{overflow-y:auto;padding:14px 20px;min-width:0;scrollbar-gutter:stable}
+.dsh-mobile-control__provider{position:relative;border:0;border-radius:8px;padding:8px 10px;min-height:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__provider:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f5f9)}
+.dsh-mobile-control__provider.is-selected{background:var(--dsw-alias-interactive-bg-active,#f5f8ff);box-shadow:none}
+.dsh-mobile-control__provider.is-selected::before{content:"";position:absolute;left:0;top:8px;bottom:8px;width:2px;border-radius:2px;background:var(--dsw-alias-label-primary-bluish,#2563eb)}
+.dsh-mobile-control__remote-workspace section{border:0;border-radius:0;padding:12px 0;background:transparent;box-shadow:none;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__remote-workspace section:first-child{border-top:0}
+.dsh-mobile-control__remote-workspace .dsh-mobile-control__details{border:0;border-radius:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__btn,.dsh-mobile-control__primary,.dsh-mobile-control__secondary{min-height:32px;padding:6px 12px;border-radius:8px;font-size:12px}
+.dsh-mobile-control__self-hosted{border:0;border-radius:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__self-hosted-summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__self-hosted-body{padding:0}
+@media (max-width:860px){.dsh-mobile-control__remote-columns{grid-template-columns:1fr}.dsh-mobile-control__remote-columns>.dsh-mobile-control__provider-section{border-right:0;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);max-height:40vh}}
+.dsh-mobile-control__channel-pane{min-width:0;overflow-y:auto;padding-right:4px;max-height:100%}.dsh-mobile-control__channel-pane>.dsh-mobile-control__view{display:block}.dsh-mobile-control__provider.is-lan{border-color:var(--dsw-alias-label-primary-bluish,#2563eb);background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-bg-layer-1,#f5f8ff))}.dsh-mobile-control__remote-columns>.dsh-mobile-control__provider-section{overflow-y:auto;padding-right:4px}.dsh-mobile-control__remote-columns>.dsh-mobile-control__remote-workspace{overflow-y:auto;padding-right:4px}.dsh-mobile-control__remote-columns>.dsh-mobile-control__provider-section{margin:0}@media (max-width:760px){.dsh-mobile-control__remote-columns{grid-template-columns:1fr}}
 .dsh-mobile-control__header{display:flex;align-items:center;justify-content:space-between;gap:8px;margin-bottom:10px}.dsh-mobile-control__panel h2{margin:0;font-size:17px;line-height:24px}.dsh-mobile-control__header-actions{display:flex;align-items:center;gap:2px}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry,.dsh-mobile-control__close{display:inline-flex;align-items:center;justify-content:center;min-width:44px;height:44px;padding:0;border:0;border-radius:10px;background:transparent;color:inherit;cursor:pointer}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry{padding:0 8px;color:var(--dsw-alias-label-primary-bluish,#2563eb);font:650 12px/1 system-ui;white-space:nowrap}.dsh-mobile-control__update-plugin[hidden]{display:none}.dsh-mobile-control__update-plugin:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__close{font-size:24px;line-height:1}.dsh-mobile-control__update-plugin:hover:not(:disabled),.dsh-mobile-control__diagnostic-entry:hover,.dsh-mobile-control__close:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}
-.dsh-mobile-control__release-notice{margin:-2px 0 10px;padding:8px 10px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#eff6ff);color:var(--dsw-alias-label-primary,#1d4ed8);font-size:11px;line-height:1.45}.dsh-mobile-control__release-notice.is-error{color:var(--dsw-alias-label-primary,#dc2626);border-left:3px solid var(--dsw-alias-state-error-primary,#dc2626)}.dsh-mobile-control__release-notice[hidden]{display:none}.dsh-mobile-control__update-card{margin:0 0 10px;padding:11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__update-card[hidden]{display:none}.dsh-mobile-control__update-card-title{margin:0 0 7px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__update-notes{display:block;box-sizing:border-box;max-height:150px;overflow-y:auto;margin:0 0 8px;padding:8px 10px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:9px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#475569);white-space:pre-wrap;word-break:break-word;font:11px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.dsh-mobile-control__update-notes[hidden]{display:none}.dsh-mobile-control__update-notice{margin:0 0 9px;padding:7px 9px;border-radius:8px;background:var(--dsw-alias-state-warn-tertiary,#fff4d6);color:var(--dsw-alias-state-warn-label,#92400e);font-size:11px;line-height:1.5}.dsh-mobile-control__update-actions{display:flex;align-items:center;justify-content:flex-end;gap:8px}.dsh-mobile-control__update-actions .dsh-mobile-control__primary,.dsh-mobile-control__update-actions .dsh-mobile-control__secondary{min-height:36px;padding:0 12px}.dsh-mobile-control__app-download{display:flex;align-items:center;justify-content:space-between;box-sizing:border-box;min-height:44px;margin:0 0 10px;padding:8px 11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:600 12px/1.3 system-ui;text-decoration:none}.dsh-mobile-control__app-download[hidden]{display:none}.dsh-mobile-control__app-download::after{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:14px;content:"↗"}.dsh-mobile-control__app-download:hover{border-color:#9fb9e8;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-2,#f5f8ff));color:var(--dsw-alias-label-primary,#1d4ed8)}
+.dsh-mobile-control__release-notice{margin:-2px 0 10px;padding:8px 10px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#eff6ff);color:var(--dsw-alias-label-primary,#1d4ed8);font-size:11px;line-height:1.45}.dsh-mobile-control__release-notice.is-error{color:var(--dsw-alias-label-primary,#dc2626);border-left:3px solid var(--dsw-alias-state-error-primary,#dc2626)}.dsh-mobile-control__release-notice[hidden]{display:none}.dsh-mobile-control__update-card{margin:0 0 10px;padding:11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__update-card[hidden]{display:none}.dsh-mobile-control__update-card-title{margin:0 0 7px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__update-notes{display:block;box-sizing:border-box;max-height:150px;overflow-y:auto;margin:0 0 8px;padding:8px 10px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:9px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#475569);white-space:pre-wrap;word-break:break-word;font:11px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.dsh-mobile-control__update-notes[hidden]{display:none}.dsh-mobile-control__update-notice{margin:0 0 9px;padding:7px 9px;border-radius:8px;background:var(--dsw-alias-state-warn-tertiary,#fff4d6);color:var(--dsw-alias-state-warn-label,#92400e);font-size:11px;line-height:1.5}.dsh-mobile-control__update-actions{display:flex;align-items:center;justify-content:flex-end;gap:8px}.dsh-mobile-control__primary{display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;min-height:40px;padding:9px 14px;border:1px solid var(--dsw-alias-label-primary-bluish,#2563eb);border-radius:10px;background:var(--dsw-alias-label-primary-bluish,#2563eb);color:#fff;font:600 12px/1.3 system-ui;cursor:pointer;touch-action:manipulation}.dsh-mobile-control__primary:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__primary:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__primary:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__primary[hidden]{display:none}.dsh-mobile-control__update-actions .dsh-mobile-control__primary,.dsh-mobile-control__update-actions .dsh-mobile-control__secondary{min-height:36px;padding:0 12px}.dsh-mobile-control__app-download{display:flex;align-items:center;justify-content:space-between;box-sizing:border-box;min-height:44px;margin:0 0 10px;padding:8px 11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:600 12px/1.3 system-ui;text-decoration:none}.dsh-mobile-control__app-downloads{display:flex;flex-wrap:wrap;gap:6px;margin:0 0 10px}.dsh-mobile-control__app-downloads .dsh-mobile-control__app-download{flex:1 1 240px;margin:0}.dsh-mobile-control__app-download.is-iroh{border-color:var(--dsw-alias-label-primary-bluish,#2563eb);color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__app-download.is-iroh[hidden]{display:none}.dsh-mobile-control__app-download[hidden]{display:none}.dsh-mobile-control__app-download::after{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:14px;content:"↗"}.dsh-mobile-control__app-download:hover{border-color:#9fb9e8;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-2,#f5f8ff));color:var(--dsw-alias-label-primary,#1d4ed8)}
 .dsh-mobile-control__switcher{display:grid;grid-template-columns:repeat(2,1fr);gap:4px;margin:0 0 14px;padding:4px;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f3f5f8)}.dsh-mobile-control__switcher[hidden]{display:none}.dsh-mobile-control__tab{min-height:36px;border:0;border-radius:9px;background:transparent;color:var(--dsw-alias-label-secondary,#606873);font:600 13px/1 system-ui;cursor:pointer}.dsh-mobile-control__tab.is-active{background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);box-shadow:0 1px 3px rgb(15 23 42 / 10%)}.dsh-mobile-control__view[hidden]{display:none}.dsh-mobile-control__intro{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.55}.dsh-mobile-control__http-frame-warning{box-sizing:border-box;margin:-4px 0 12px;padding:8px 10px;border:1px solid #d6a83f;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#fff7df);color:var(--dsw-alias-label-primary,#694b00);font-size:11px;line-height:1.5;overflow-wrap:anywhere}.dsh-mobile-control__http-frame-warning[hidden]{display:none}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions{display:grid;grid-template-columns:1fr 1fr;gap:8px}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions button[hidden]{display:none}
 .dsh-mobile-control__provider-section{position:relative;margin:0 0 14px}.dsh-mobile-control__section-title{margin:0 0 8px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__provider-section>.dsh-mobile-control__section-title{padding-right:42px}.dsh-mobile-control__provider-choices{display:grid;grid-template-columns:1fr;gap:8px}.dsh-mobile-control__provider{display:flex;min-width:0;flex-direction:column;gap:6px;min-height:94px;padding:10px 11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);text-align:left;cursor:pointer;touch-action:manipulation;transition:border-color 160ms ease,background-color 160ms ease,box-shadow 160ms ease}.dsh-mobile-control__provider:hover{border-color:#6f96db;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-1,#f8fbff))}.dsh-mobile-control__provider.is-selected{border-color:var(--dsw-alias-label-primary-bluish,#2563eb);background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-bg-layer-1,#f5f8ff));box-shadow:0 0 0 1px var(--dsw-alias-label-primary-bluish,#2563eb) inset}.dsh-mobile-control__provider:disabled{cursor:wait;opacity:.62}.dsh-mobile-control__provider-top{display:flex;min-width:0;align-items:flex-start;justify-content:space-between;gap:5px}.dsh-mobile-control__provider-top strong{min-width:0;font-size:12px;line-height:1.3}.dsh-mobile-control__provider-badge{flex:none;padding:2px 5px;border-radius:999px;background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8);font:650 11px/1.25 system-ui}.dsh-mobile-control__provider-badge.is-cpolar{background:var(--dsw-alias-state-success-tertiary,#eaf8f2);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__provider-description{color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.45}.dsh-mobile-control__provider-info{position:absolute;z-index:5;top:-13px;right:-8px}.dsh-mobile-control__provider-info-button{display:flex;align-items:center;justify-content:center;width:44px;height:44px;padding:0;border:0;border-radius:50%;background:transparent;color:var(--dsw-alias-label-secondary,#475569);cursor:pointer;touch-action:manipulation}.dsh-mobile-control__provider-info-button:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f5f9);color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__provider-info-glyph{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:18px;height:18px;border:1.5px solid currentColor;border-radius:50%;font:700 12px/1 system-ui}.dsh-mobile-control__provider-info-popover{position:absolute;z-index:6;top:38px;right:4px;box-sizing:border-box;width:min(292px,calc(100vw - 72px));padding:10px 12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 10px 28px rgb(15 23 42 / 16%)}.dsh-mobile-control__provider-info-popover[hidden]{display:none}.dsh-mobile-control__provider-info-popover strong,.dsh-mobile-control__provider-info-popover span{display:block}.dsh-mobile-control__provider-info-popover strong{margin-bottom:3px;font-size:12px}.dsh-mobile-control__provider-info-popover span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}
 .dsh-mobile-control__self-hosted{margin:8px 0 0;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__self-hosted-summary{display:flex;box-sizing:border-box;min-height:48px;align-items:center;justify-content:space-between;gap:10px;padding:8px 11px;cursor:pointer;list-style-position:inside}.dsh-mobile-control__self-hosted-summary>span:first-child{display:flex;min-width:0;flex-direction:column;gap:1px}.dsh-mobile-control__self-hosted-summary strong{font-size:11px}.dsh-mobile-control__self-hosted-summary span span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.35}.dsh-mobile-control__provider-badge.is-frp{background:var(--dsw-alias-bg-layer-1,#eef0f3);color:var(--dsw-alias-label-secondary,#475569)}.dsh-mobile-control__self-hosted-body{padding:0 8px 8px}.dsh-mobile-control__provider.is-frp{width:100%;min-height:64px;background:var(--dsw-alias-bg-layer-2,#fff)}
@@ -14506,12 +15649,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 /* The cloudflared setup section deliberately reuses this card, so
    .dsh-mobile-control__cloudflared-setup is a DOM hook for targeting rather than a
    style rule of its own. */
-.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
+.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__progress{box-sizing:border-box;width:100%;height:6px;margin:0 0 10px}.dsh-mobile-control__progress[hidden]{display:none}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
 .dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
-.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
+.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}.dsh-mobile-control__qr.is-expandable{cursor:zoom-in}.dsh-mobile-control__qr.is-expandable:focus-visible{outline:3px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px;border-radius:12px}.dsh-mobile-control__qr-zoom{position:fixed;inset:0;z-index:1001;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.72)}.dsh-mobile-control__qr-zoom[hidden]{display:none}.dsh-mobile-control__qr-zoom-image{width:min(84vw,360px);height:min(84vw,360px);border-radius:12px;background:#fff;padding:12px}.dsh-mobile-control__qr-zoom-close{position:absolute;top:12px;right:16px;min-width:44px;min-height:44px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:600 18px/1 system-ui;cursor:pointer}
 .dsh-mobile-control__status{margin:0 0 14px;overflow-wrap:anywhere;color:var(--dsw-alias-label-secondary,#606873)}.dsh-mobile-control__status::before{display:inline-block;width:8px;height:8px;margin-right:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary,#98a1ad);content:""}.dsh-mobile-control__status.is-running::before{background:var(--dsw-alias-state-success-primary,#16a36a)}.dsh-mobile-control__status.is-key{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;word-break:break-all}
 .dsh-mobile-control__guide{margin:0 0 14px;padding:12px;border:1px solid #6f96db;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#eff6ff)}.dsh-mobile-control__guide[hidden]{display:none}.dsh-mobile-control__guide-title{margin:0;color:var(--dsw-alias-label-primary,#172554);font:650 13px/1.45 system-ui}.dsh-mobile-control__guide-summary,.dsh-mobile-control__guide-note{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#475569);font-size:12px;line-height:1.5}.dsh-mobile-control__guide-steps{margin:8px 0 0;padding-left:20px;color:var(--dsw-alias-label-primary,#1e293b);font-size:12px;line-height:1.6}.dsh-mobile-control__guide-note{color:var(--dsw-alias-label-secondary,#64748b)}.dsh-mobile-control__guide-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:10px}.dsh-mobile-control__guide-actions button{min-width:0;min-height:44px;padding:8px;border-radius:10px;font:12px/1.25 system-ui;cursor:pointer}.dsh-mobile-control__guide-actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control__extensions{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px}
@@ -14521,7 +15664,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 .dsh-mobile-control__diagnostic-checks{display:grid;gap:12px;margin-top:12px;animation:dsh-diagnostic-reveal 160ms ease-out both}.dsh-mobile-control__diagnostic-checks[hidden]{display:none}.dsh-mobile-control__diagnostic-group{overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-group-header{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:8px 11px;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__diagnostic-group-header h3{margin:0;font:650 11px/1.4 system-ui}.dsh-mobile-control__diagnostic-group-header span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__diagnostic-list{display:flex;flex-direction:column}.dsh-mobile-control__diagnostic-check{display:grid;grid-template-columns:26px minmax(0,1fr);gap:9px;padding:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-check + .dsh-mobile-control__diagnostic-check{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__diagnostic-marker{position:relative;width:26px;height:26px;border-radius:50%;background:var(--dsw-alias-bg-layer-1,#edf1f5);color:var(--dsh-diagnostic-info)}.dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-marker::after{position:absolute;content:""}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker::before{top:7px;left:7px;width:9px;height:5px;border-bottom:1.8px solid currentColor;border-left:1.8px solid currentColor;transform:rotate(-45deg)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-error-secondary,#fdecec);color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::after,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::after{bottom:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::after{top:10px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check-body{min-width:0}.dsh-mobile-control__diagnostic-check-header{display:flex;align-items:flex-start;justify-content:space-between;gap:8px}.dsh-mobile-control__diagnostic-check-header strong{min-width:0;font-size:12px;line-height:1.4}.dsh-mobile-control__diagnostic-badge{flex:none;padding:2px 6px;border-radius:999px;background:var(--dsw-alias-bg-layer-1,#edf1f5);color:var(--dsh-diagnostic-info);font:650 11px/1.3 system-ui}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-error-secondary,#fdecec);color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check p{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5;overflow-wrap:anywhere}.dsh-mobile-control__diagnostic-check .dsh-mobile-control__diagnostic-action{margin-top:7px;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f8fafc);color:var(--dsw-alias-label-primary,#16181d)}.dsh-mobile-control__diagnostic-action span{display:inline-block;margin-right:6px;color:var(--dsw-alias-label-primary-bluish,#2563eb);font-weight:700}.dsh-mobile-control__diagnostic-details{margin-top:12px}.dsh-mobile-control__diagnostic-details[hidden]{display:none}.dsh-mobile-control__diagnostic-details>summary{box-sizing:border-box;min-height:44px;line-height:44px}.dsh-mobile-control__diagnostic-report{box-sizing:border-box;max-height:220px;margin:4px 0 0;overflow:auto;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:10px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#606873);font:11px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere}
 .dsh-mobile-control__diagnostic-checks{transition:opacity 150ms ease}.dsh-mobile-control__diagnostic-checks.is-refreshing{opacity:.52}
 @keyframes dsh-diagnostic-spin{to{transform:rotate(360deg)}}@keyframes dsh-diagnostic-reveal{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}
-.dsh-mobile-control__actions{display:flex;flex-wrap:nowrap;gap:6px}.dsh-mobile-control__actions[hidden],.dsh-mobile-control__manage-row[hidden]{display:none}.dsh-mobile-control__actions button{flex:1 1 0;min-width:0;min-height:44px;padding:8px 4px;border-radius:10px;font:12px/1.2 system-ui;cursor:pointer;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.dsh-mobile-control__secondary{border:1px solid var(--dsw-alias-border-l3,#cfd5dd);background:transparent;color:inherit}.dsh-mobile-control__primary{border:1px solid #2563eb;background:#2563eb;color:#fff}.dsh-mobile-control__actions button:disabled{cursor:not-allowed;opacity:.45}
+.dsh-mobile-control__actions{display:flex;flex-wrap:nowrap;gap:6px}.dsh-mobile-control__actions[hidden],.dsh-mobile-control__manage-row[hidden]{display:none}.dsh-mobile-control__actions button{flex:1 1 0;min-width:0;min-height:44px;padding:8px 4px;border-radius:10px;font:12px/1.2 system-ui;cursor:pointer;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.dsh-mobile-control__secondary{display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;min-height:40px;padding:9px 14px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:transparent;color:inherit;font:600 12px/1.3 system-ui;cursor:pointer;touch-action:manipulation}.dsh-mobile-control__secondary:hover:not(:disabled){border-color:#6f96db;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-1,#f8fbff))}.dsh-mobile-control__secondary:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__secondary[hidden]{display:none}.dsh-mobile-control__primary{border:1px solid #2563eb;background:#2563eb;color:#fff}.dsh-mobile-control__actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control button:focus-visible,.dsh-mobile-control a:focus-visible,.dsh-mobile-control input:focus-visible,.dsh-mobile-control select:focus-visible,.dsh-mobile-control summary:focus-visible{outline:3px solid rgb(37 99 235 / 28%);outline-offset:2px}
 /* 42px matches the DSH sidebar footer row; it is not one of the panel target tiers. */
 /* Other footer entries share the shell's row; only our own action becomes compact. */
@@ -14535,9 +15678,71 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 .dsh-mobile-control__origin-modes{min-width:0;margin:0 0 14px;padding:0;border:0}.dsh-mobile-control__origin-modes legend{margin:0 0 8px;padding:0;color:var(--dsw-alias-label-secondary,#606873);font:600 12px/1.4 system-ui}.dsh-mobile-control__origin-mode{display:flex;box-sizing:border-box;min-height:44px;align-items:center;gap:10px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:10px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);font:12px/1.5 system-ui;cursor:pointer}.dsh-mobile-control__origin-mode+.dsh-mobile-control__origin-mode{margin-top:8px}.dsh-mobile-control__origin-mode:has(input:checked){border-color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__origin-mode:focus-within{outline:2px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px}.dsh-mobile-control__origin-mode:has(input:disabled){cursor:wait;opacity:.55}.dsh-mobile-control__origin-mode input[type=radio]{flex:0 0 18px;box-sizing:border-box;width:18px;height:18px;min-height:18px;margin:0;padding:0;accent-color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__origin-mode span{min-width:0;overflow-wrap:anywhere}
 /* Base the columns on the card width, not the desktop viewport behind the popup. */
 .dsh-mobile-control__origin-fields{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,140px),1fr));gap:12px}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field{min-width:0;grid-column:auto;font-size:12px}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field--full{grid-column:1/-1}.dsh-mobile-control__origin-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__origin-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__caddy-form{display:grid;gap:12px}.dsh-mobile-control__caddy-form>.dsh-mobile-control__component-note,.dsh-mobile-control__caddy-form>.dsh-mobile-control__component-status,.dsh-mobile-control__caddy-form>.dsh-mobile-control__origin-feedback{margin:0;overflow-wrap:anywhere}.dsh-mobile-control__origin-setup .dsh-mobile-control__actions.dsh-mobile-control__caddy-actions{grid-template-columns:minmax(0,1fr);margin:0}.dsh-mobile-control__caddy-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:10px 12px;border-radius:10px;font:600 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__origin-warning{margin:12px 0;padding:10px 12px;border-left:3px solid var(--dsw-alias-state-warn-primary,#a56810);border-radius:4px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:12px;line-height:1.6}.dsh-mobile-control__origin-feedback{font-size:12px;line-height:1.6;overflow-wrap:anywhere}.dsh-mobile-control__origin-feedback.is-error{color:var(--dsw-alias-state-error-primary,#bc3030)}.dsh-mobile-control__origin-fields input[aria-invalid=true]{border-color:var(--dsw-alias-state-error-primary,#bc3030)}.dsh-mobile-control__origin-backend{display:flex;min-width:0;flex-direction:column;align-items:stretch;gap:8px;margin-top:12px;padding-top:12px;border-top:1px solid var(--dsw-alias-border-l2,#dbe1e8)}.dsh-mobile-control__origin-backend button{align-self:flex-start;min-height:44px}.dsh-mobile-control__self-hosted-body .is-origin{margin-top:8px}
+/* Final overrides: dense borderless layout must beat the base rules above.
+   The earlier dense block sits before those base rules, so these repeat the
+   essential de-boxing here at the end of the sheet where they win. */
+.dsh-mobile-control__provider{position:relative;border:0;border-radius:8px;padding:8px 10px;min-height:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__provider:hover{border-color:transparent;background:var(--dsw-alias-interactive-bg-hover,#f1f5f9)}
+.dsh-mobile-control__provider.is-selected{border-color:transparent;background:var(--dsw-alias-interactive-bg-active,#f5f8ff);box-shadow:none}
+.dsh-mobile-control__provider.is-lan:not(.is-selected){border-color:transparent;background:transparent}
+.dsh-mobile-control__view:not(.is-remote)>.dsh-mobile-control__actions{display:grid;grid-template-columns:repeat(3,1fr);gap:8px}
+.dsh-mobile-control__view.is-diagnostics,.dsh-mobile-control__view.is-devices{flex:1;min-height:0;overflow-y:auto;padding:14px 20px}
+.dsh-mobile-control__view.is-devices .dsh-mobile-control__devices{max-height:none;margin-top:0}
+.dsh-mobile-control__actions button{white-space:normal;overflow:visible;text-overflow:clip;line-height:1.25;height:auto;padding-top:8px;padding-bottom:8px;word-break:break-word}
+.dsh-mobile-control__qr-placeholder{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:192px;height:192px;padding:12px;border:1px dashed var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.5;text-align:center}
+.dsh-mobile-control__lan-setup .dsh-mobile-control__actions,.dsh-mobile-control__cpolar-setup .dsh-mobile-control__actions,.dsh-mobile-control__frp-setup .dsh-mobile-control__actions,.dsh-mobile-control__origin-setup .dsh-mobile-control__actions{margin-top:12px}
+.dsh-mobile-control__origin-setup .dsh-mobile-control__actions.dsh-mobile-control__caddy-actions{margin-top:12px}
+.dsh-mobile-control__qr-zoom{pointer-events:auto}
+.dsh-mobile-control__iroh-pairing{border:0;border-radius:0;background:transparent;padding:0;margin:12px 0 0}
+/* Config setup panels: drop the rounded card frame so provider configuration
+   reads as one flat page with hairline dividers instead of nested boxes. */
+.dsh-mobile-control__lan-setup,.dsh-mobile-control__cpolar-setup,.dsh-mobile-control__frp-setup,.dsh-mobile-control__origin-setup{border:0;border-radius:0;background:transparent;padding:0;margin:0 0 12px}
+.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step,.dsh-mobile-control__frp-group,.dsh-mobile-control__frp-overview{border:0;border-radius:0;background:transparent}
+.dsh-mobile-control__ws-paths{border:0;border-radius:0;background:transparent;padding:0;margin:10px 0 0}
+.dsh-mobile-control__view.is-remote .dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}
+.dsh-mobile-control__view.is-remote .dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions[hidden]{display:none}
+.dsh-mobile-control__view.is-remote .dsh-mobile-control__origin-setup .dsh-mobile-control__actions.dsh-mobile-control__caddy-actions{display:grid;grid-template-columns:minmax(0,1fr)}
+.dsh-mobile-control__remote-workspace{border:0;border-radius:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__stage-header{border:0;border-radius:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__app-downloads{display:flex;gap:8px;padding:6px 16px;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__app-download{flex:1 1 0;display:flex;align-items:center;justify-content:space-between;gap:6px;box-sizing:border-box;min-height:34px;padding:6px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:8px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font-size:12px;text-decoration:none;white-space:normal}
+.dsh-mobile-control__app-download.is-iroh{border-color:var(--dsw-alias-label-primary-bluish,#2563eb)}
+.dsh-mobile-control__setup-details{margin-top:12px;padding-top:8px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin-bottom:18px}
+.dsh-mobile-control__stage-header{display:none}
+.dsh-mobile-control__provider-install{margin:0 0 12px}
+.dsh-mobile-control__provider-install>.dsh-mobile-control__primary{width:100%;min-height:44px}
+.dsh-mobile-control__tunnel-toggle{display:inline-flex;align-items:center;gap:4px;box-sizing:border-box;margin:0 0 10px;padding:6px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:8px;background:transparent;color:var(--dsw-alias-label-primary-bluish,#2563eb);font:600 12px/1 system-ui;cursor:pointer}
+.dsh-mobile-control__tunnel-toggle:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}
+.dsh-mobile-control__tunnel>.dsh-mobile-control__primary,.dsh-mobile-control__tunnel>.dsh-mobile-control__secondary{width:100%;min-height:44px;margin-top:10px}
+.dsh-mobile-control__provider-info-popover p{margin:0 0 8px;font-size:11px;line-height:1.5}
+.dsh-mobile-control__provider-info-popover p:last-child{margin-bottom:0}
+.dsh-mobile-control__provider-info-popover{max-width:240px;max-height:44vh;overflow:auto;white-space:normal}
+.dsh-mobile-control__mode-row{position:relative;display:flex;align-items:center;gap:8px;margin:0 0 8px}
+.dsh-mobile-control__mode-row>.dsh-mobile-control__switcher{flex:1 1 auto;margin:0}
+.dsh-mobile-control__notes-toggle{flex:none;display:inline-flex;align-items:center;justify-content:center;width:24px;height:24px;padding:0;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:50%;background:transparent;color:var(--dsw-alias-label-secondary,#606873);font:600 13px/1 system-ui;cursor:pointer}
+.dsh-mobile-control__notes-toggle:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}
+.dsh-mobile-control__notes-panel{position:absolute;top:calc(100% + 6px);right:0;z-index:40;width:min(320px,78vw);max-height:50vh;overflow:auto;box-sizing:border-box;margin:0;padding:10px 12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:8px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 6px 20px rgb(15 23 42 / 12%);font-size:11px;line-height:1.5;color:var(--dsw-alias-label-secondary,#475569)}
+.dsh-mobile-control__notes-panel p{margin:0 0 8px}.dsh-mobile-control__notes-panel p:last-child{margin:0}
+.dsh-mobile-control__notes-panel[hidden]{display:none}
+.dsh-mobile-control__tunnel-toggle[hidden]{display:none}
+.dsh-mobile-control__provider-setup-body .dsh-mobile-control__switcher{border-radius:0;background:transparent;padding:0;gap:8px}
+.dsh-mobile-control__provider-setup-body .dsh-mobile-control__tab{border-radius:0;box-shadow:none;border-bottom:2px solid transparent}
+.dsh-mobile-control__provider-setup-body .dsh-mobile-control__tab.is-active{background:transparent;box-shadow:none;border-bottom-color:var(--dsw-alias-label-primary-bluish,#2563eb)}
+.dsh-mobile-control__origin-setup .dsh-mobile-control__origin-mode{border-radius:0;background:transparent}
+.dsh-mobile-control__devices{border:0;border-radius:0;padding:0;margin:0;background:transparent;max-height:none}
+.dsh-mobile-control__provider.is-frp:not(.is-selected),.dsh-mobile-control__provider.is-origin:not(.is-selected),.dsh-mobile-control__provider.is-iroh:not(.is-selected){border-color:transparent;background:transparent}
+.dsh-mobile-control__provider.is-selected::before{content:"";position:absolute;left:0;top:8px;bottom:8px;width:2px;border-radius:2px;background:var(--dsw-alias-label-primary-bluish,#2563eb)}
+.dsh-mobile-control__remote-workspace section{border:0;border-radius:0;padding:12px 0;background:transparent;box-shadow:none;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__remote-workspace section:first-child{border-top:0}
+.dsh-mobile-control__remote-workspace .dsh-mobile-control__details{border:0;border-radius:0;background:transparent;box-shadow:none}
+.dsh-mobile-control__self-hosted{border:0;border-radius:0;background:transparent;box-shadow:none}
 ` + EXTENSION_RECOVERY_STYLES;
 		/** Mount the desktop control or mobile feature enhancements. */
 		function apply(ctx) {
+			let gatewayRejectionSink;
+			let retryRecovery;
+			let refreshCustomization;
 			ctx.effect(() => installMobileUiLocalePersistence(document, window), "dsh-mobile: browser UI locale persistence");
 			ctx.effect(() => {
 				if (window.__DSH_MOBILE_FRONTEND__ !== "dedicated") return;
@@ -14546,7 +15751,26 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			}, "dsh-mobile: authenticated gateway client trust");
 			ctx.effect(() => {
 				if (!ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__)) return;
-				return installMobileConnectionRecovery(() => ctx.get("connection"), window, document);
+				let ownedRejection;
+				const recovery = installMobileConnectionRecovery(() => ctx.get("connection"), window, document, (rejected, retry) => {
+					ownedRejection = rejected;
+					gatewayRejectionSink = rejected;
+					retryRecovery = retry;
+				}, () => {
+					refreshCustomization?.();
+				});
+				if (recovery === void 0) {
+					gatewayRejectionSink = void 0;
+					retryRecovery = void 0;
+					return;
+				}
+				return () => {
+					if (gatewayRejectionSink === ownedRejection) {
+						gatewayRejectionSink = void 0;
+						retryRecovery = void 0;
+					}
+					return recovery();
+				};
 			}, "dsh-mobile: connection recovery");
 			ctx.effect(() => {
 				const desktopAdmin = isDesktopAdminSurface(location.hostname, location.search, window.__DSH_MOBILE_FRONTEND__, location.protocol);
@@ -14556,7 +15780,18 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				style.textContent = desktopAdmin ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
 				style.textContent += CLIENT_MODULE_STYLES;
 				document.head.append(style);
-				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets() : () => void 0;
+				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets({
+					rejected: (status) => {
+						gatewayRejectionSink?.(status);
+					},
+					retry: () => retryRecovery?.() ?? false,
+					registerRefresh: (refresh) => {
+						refreshCustomization = refresh;
+						return () => {
+							if (refreshCustomization === refresh) refreshCustomization = void 0;
+						};
+					}
+				}) : () => void 0;
 				const removeVoiceSession = installVoiceSession(!desktopAdmin);
 				const removeDraftTransfer = !desktopAdmin && document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null ? installDraftTransfer(ctx, window, document) : () => void 0;
 				const removeModuleSettings = ctx.slots.inject("settings.general.item", () => ctx.slots.register({