diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb0b01c..6fe0177 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,9 @@ All notable changes to this project will be documented in this file.
 - **Checking reachability**: Ping destination shows a clear working state while the request runs.
 - **Archives**: Export saved snapshots as Micron (`.mu`) files; multi-export avoids filename clashes.
 - **Large Nomad Micron pages**: Smoother scrolling and resizing on big `.mu` pages (including a faster path for ordinary Latin/Cyrillic monospace text).
+- **Network visualizer**: Toolbar, legend, and loading state are clearer; path table and graph behaviour use shared helpers for trails, bounds, and layout constants.
+- **Connections**: The app WebSocket client heartbeats, reconnects, and handles ping/pong more predictably when the link drops or stalls.
+- **Theming**: Semantic design tokens feed Tailwind and Vuetify so light/dark surfaces and accents stay aligned across pages.
 - **Desktop app (Electron)**: Right-click menus in text fields (cut/copy/paste, spellcheck, add to dictionary), sensible behaviour for links, and file/folder pickers wired through the desktop shell where applicable.
 
 ### Platform and backend
@@ -31,13 +34,15 @@ All notable changes to this project will be documented in this file.
 - **AsyncUtils**: thread-safe scheduling; pending coroutines flushed when the main event loop is set.
 - **NomadNet downloader**: thread-safe link cache, **`get_cached_active_link`**, phased WebSocket progress, faster polling, safer UTF-8 and cancel handling.
 - **RNCP** (file transfer): receive-completed handling and error reporting; transfer start callbacks; **status** / **stop** API and websocket broadcast; listener destination setup/teardown and tests.
-- **RNPath / RNStatus**: interface discovery; optional geo fields on interfaces. **Network visualizer**: **`lxmf.delivery`** / **`nomadnetwork.node`** only; **`POST /api/v1/path-table`** filters by destination hashes; **max hops** filter in the UI.
+- **RNPath / RNStatus**: interface discovery; optional geo fields on interfaces. **Network visualizer**: **`lxmf.delivery`** / **`nomadnetwork.node`** only; **`POST /api/v1/path-table`** filters by destination hashes; **max hops** filter in the UI; refactored trail/bounds utilities and constants for the graph view.
 - **Licenses**: collector for Python and Node dependencies; **`GET /api/v1/licenses`**; **`licenses_frontend.json`** included in package data.
 - **CI / packaging**: Gitea shell-based jobs, optional **SLSA v1** cosign attestations; GitHub Actions for Windows/macOS; **`priv.sh`** / **`exec-priv.sh`**; macOS universal build avoids duplicate **`backend-manifest.json`**; stripped Python bytecode in backend bundle.
+- **CI**: Node dependency scanning uses **Trivy** (`scripts/ci/trivy-fs-scan.sh`) instead of **pnpm audit**, after npm retired the legacy registry audit API used by pnpm.
 - **Container**: non-root **`meshchat`**; **`HEALTHCHECK`** on **`/api/v1/status`** (TLS verify relaxed for default self-signed). Podman/OCI: no Docker-style **`HEALTHCHECK`** unless **`--format docker`**; **`/config`** bind mounts may need uid alignment.
 - **Debug Logs**: **Logs** and **Access attempts** tabs (search, filters, pagination).
 - **`scripts/ci/setup-python.sh`**: Sigstore verification and cosign download by architecture.
 - **Stickers**: per-identity image library (schema, validation, DAO), **`/api/v1/stickers`** CRUD and **`GET …/image`**, settings **import/export**, **`DELETE /api/v1/maintenance/stickers`**; **`tests/backend/fixtures/http_api_routes.json`** updated when routes change.
+- **Community packaging (`cx_setup.py`)**: Optional **`lxmfy`** and **`websockets`** dependencies; **`scripts/build_community_interfaces_json.py`**, **`scripts/move_wheels.py`**, and **`scripts/ci/slsa-predicate.py`** refinements for clearer outputs and metadata.
 
 ### Frontend and UX
 
@@ -53,14 +58,18 @@ All notable changes to this project will be documented in this file.
 - **NomadNet link isolation and Reticulum-only navigation**: Relative and mesh-style links in **HTML**, **Markdown**, and **Micron** output are rewritten to `href="#"` with `data-nomadnet-url` so the SPA does not navigate the browser to `/page/...` or off-app URLs. The Nomad browser and **Archives** viewer handle `.nomadnet-link` clicks in-app; in-page `#fragment` links scroll within the viewer. `href` sanitization explicitly rejects **http**, **https**, protocol-relative `//`, **mailto**, **ftp**, **file**, **data**, **javascript**, and similar schemes so clearnet and dangerous URLs are not preserved as navigable links.
 - **Tools**: Removed the duplicate **Third-party licenses** entry from the Tools grid (licenses remain under **About**).
 - **Shell chrome**: Opaque **white** / dark **zinc-950** surfaces aligned across the top bar, navigation drawer, Messages/Nomad sidebars, conversation header, message list, and composer (replacing mixed translucent, backdrop-blur, and gradient backgrounds for consistent light/dark appearance).
+- **Theme (`designTokens.js`)**: Semantic tokens integrated with **Tailwind** (`tailwind.config.js`) and **Vuetify** theme overrides; optional theme-variable injection for integrators using **`cx_setup`**.
+- **Network visualiser (UI)**: Dedicated **toolbar**, **legend**, and **loading overlay** components; internal modules for **trail** placement, **view bounds**, and shared **constants** (cleaner layout and future work).
+- **NomadNetwork**: Separate **AbortController** instances for the node list and node detail fetches so navigation cancels the right request.
+- **WebSocket (`WebSocketConnection.js`)**: Heartbeat, backoff/reconnect, and **ping/pong** handling with shared helpers in **`wsConnectionSupport.js`**.
 - **Context menus (Vue)**: Shared **ContextMenuPanel**, **ContextMenuItem**, **ContextMenuDivider**, and **ContextMenuSectionLabel** (`components/contextmenu/`); styling tokens in **`style.css`**. Wired into **Contacts**, **Messages** sidebar, **ConversationViewer** message menu, **NomadNetwork** sidebar (favourites, sections, announces), and **Map** (optional **header** slot for the title row).
 - **LXMF emoji reactions (UI)**: **React** section in the message context menu (Columba-aligned emoji set); inbound/outbound websocket paths merge reactions onto the target message instead of a separate row; **`mergeLxmfReactionRowsIntoMessages`** when loading history; chips below the bubble with **`title`** tooltips via **`reactionReactorLabel`** (self, selected peer, sidebar conversations, else short hash).
 - **Vue lint**: **`vue/no-reserved-keys`** — internal **`data()`** fields renamed (peer header **ResizeObserver**, Nomad Micron partial scheduling **requestAnimationFrame** handle) so ESLint passes without reserved `_` prefixes.
 - **Map**: pop-out window.
-- **Tools**: list-style **ToolsPage**; refreshed **Bots**, **Paper message**, **RN path**, **RN path trace**, **RNode flasher**; **About**, **Interface**, **Settings**, **Contacts**, **App** polish (loading overlays, display names, license links).
+- **Tools**: list-style **ToolsPage**; refreshed **Bots**, **Paper message**, **RN path**, **RN path trace**, **RNode flasher**; **About**, **Interface**, **Settings**, **Contacts**, **App** polish (loading overlays, display names, license links). Many tool and settings pages use adjusted **backgrounds and padding** for alignment with the global shell.
 - **Electron**: default **context menu** for editable fields (cut/copy/paste, **spellcheck** suggestions, add to dictionary), links, and related actions; **pick file** / **pick directory** / **open path** / notifications and related **preload** helpers; loading screen refresh; CSP and **backend HTTP-only** IPC where applicable.
 - **`/robots.txt`** in **`public/`**; **`SECURITY.md`** crawler note.
-- **Locales**: `import.meta.glob` discovery; new strings for outbound status, archives, NomadNet, RNCP (including browse/folder/web hints), max hops, stickers, emoji picker tabs, **message reactions** (react / you / send failed) in **en** / **de** / **it** / **ru**, etc.
+- **Locales**: `import.meta.glob` discovery; new strings for outbound status, archives, NomadNet, RNCP (including browse/folder/web hints), max hops, stickers, emoji picker tabs, **message reactions** (react / you / send failed), and **backend connection status** copy in **en** / **de** / **it** / **ru**, etc.
 
 ### Micron and archives
 
@@ -81,8 +90,8 @@ All notable changes to this project will be documented in this file.
 
 ### Testing and docs
 
-- **Frontend**: Vitest expanded for **ConversationViewer** (outbound bubble styling, clipboard images vs non-images, **paste** toolbar, file attachments, translation, conversation fetch ordering, compose drafts, **stickers** / emoji picker); **Toast** (`toast-dismiss`); **RNCP handler** listener/status tests; **HTTP route contract** (`tests/backend/fixtures/http_api_routes.json`); **`tests/frontend/setup.js`**: **`fake-indexeddb`**, **`fetch`** stub for bundled emoji JSON; console noise suppressed in CI; **MicronParser** tests for Cyrillic/CJK monospace paths; **NomadNetwork** sidebar/page tests aligned with collapse and Micron behavior; **i18n** parity for RNCP keys (**de** / **it** / **ru**); **SettingsPage** visibility test updated for **three** message bubble color pickers; large-list **performance** tests use looser jsdom timing ceilings to reduce CI flake; **`contextMenuStyles.test.js`** asserts shared CSS classes and **ContextMenu** component usage across pages (sidebar/button tests updated for **`.context-menu-panel`** selectors); **`lxmfReactions.test.js`** for **`mergeLxmfReactionRowsIntoMessages`** (merge + dedupe).
-- **Backend**: access attempts, announce limits, downloader, Micron, SSL CLI, **memory-leak** regressions (message state updates, etc.), **sticker** utils/DAO/API tests, fuzzing where applicable; WebM-to-OGG conversion unit tests; **`test_lxmf_reactions.py`** (field 16 reaction shape, DB round-trip, **`reply_to`** in app extensions without treating as reaction).
+- **Frontend**: Vitest expanded for **ConversationViewer** (outbound bubble styling, clipboard images vs non-images, **paste** toolbar, file attachments, translation, conversation fetch ordering, compose drafts, **stickers** / emoji picker); **Toast** (`toast-dismiss`); **RNCP handler** listener/status tests; **HTTP route contract** (`tests/backend/fixtures/http_api_routes.json`); **`tests/frontend/setup.js`**: **`fake-indexeddb`**, **`fetch`** stub for bundled emoji JSON; console noise suppressed in CI; **MicronParser** tests for Cyrillic/CJK monospace paths; **NomadNetwork** sidebar/page tests aligned with collapse and Micron behavior; **i18n** parity for RNCP keys (**de** / **it** / **ru**); **SettingsPage** visibility test updated for **three** message bubble color pickers; **`contextMenuStyles.test.js`** asserts shared CSS classes and **ContextMenu** component usage across pages (sidebar/button tests updated for **`.context-menu-panel`** selectors); **`lxmfReactions.test.js`** for **`mergeLxmfReactionRowsIntoMessages`** (merge + dedupe); **WebSocket** unit tests for connection helpers. **Load-time / large-list sidebar** tests (`tests/frontend/LoadTimePerformance.test.js`) are **not** run in default **`pnpm test`** or CI; run **`pnpm run test:loadtime`** or **`task test:fe:loadtime`** locally when you need that check.
+- **Backend**: access attempts, announce limits, downloader, Micron, SSL CLI, **memory-leak** regressions (message state updates, etc.), **sticker** utils/DAO/API tests, fuzzing where applicable; WebM-to-OGG conversion unit tests; **`test_lxmf_reactions.py`** (field 16 reaction shape, DB round-trip, **`reply_to`** in app extensions without treating as reaction); **incoming-call policy** tests (DND, contacts-only, blocking); conversation and announce **search** integration tests; JSON **API response** schema/contract coverage on selected handlers.
 - **E2E**: **Playwright** (`tests/e2e/`, **`pnpm run test:e2e`**) smoke, navigation, shell chrome.
 - **Docs**: **README** / **`docs/meshchatx.md`** and **`docs/nomadmesh_pages.md`** (Nomad/Mesh Server page formats); **README** section **Linux desktop: emoji fonts** (e.g. **`noto-fonts-emoji`** on Arch/Artix, Debian/Fedora equivalents) when glyphs show as tofu. Dependency bumps via **pnpm** / **Poetry** (Electron, Vue, Vuetify, Playwright, **emoji-picker-element**, **emoji-picker-element-data**, **fake-indexeddb**, **cryptography** 46.0.7, **hypothesis**, **pytest**, **ruff**, **rns** 1.1.5, Python **3.14** in CI, etc.).