diff --git a/desktop/src/electron/csp.ts b/desktop/src/electron/csp.ts
index 06414b71e..f7070d369 100644
--- a/desktop/src/electron/csp.ts
+++ b/desktop/src/electron/csp.ts
@@ -2,13 +2,14 @@
 // SPDX-License-Identifier: Apache-2.0
 
 export function buildCspHeader(): string {
-    const connectSrc = ["'self'", 'http://127.0.0.1:*', 'http://localhost:*']
+    // https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+    // https://www.w3.org/TR/CSP/
     return (
         [
             "default-src 'none'",
             "script-src 'self'",
             "style-src 'self' 'unsafe-inline'",
-            `connect-src ${connectSrc.join(' ')}`,
+            "connect-src 'self'",
             // `blob:` is needed so the SVG rasterizer can assign a blob URL
             // to `<img>` for decode (see `extract-svg.ts`). `data:` covers
             // the inline previews we generate from base64 attachments.
@@ -18,10 +19,7 @@ export function buildCspHeader(): string {
             // fallbacks only, so no remote font origin is needed.
             "font-src 'self'",
             "manifest-src 'self'",
-            // `'self'` covers the Vite-served pdf.js worker module; `blob:`
-            // is the pdf.js fallback when the worker module can't be loaded
-            // directly (some Chromium builds spin up a blob-URL shim).
-            "worker-src 'self' blob:",
+            "worker-src 'none'",
             "object-src 'none'",
             "frame-src 'none'",
             "base-uri 'self'",
diff --git a/desktop/src/electron/model-hub/index.ts b/desktop/src/electron/model-hub/index.ts
index d1fda727c..ef6882e0b 100644
--- a/desktop/src/electron/model-hub/index.ts
+++ b/desktop/src/electron/model-hub/index.ts
@@ -2,8 +2,13 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import type { EngineType } from '@/shared/types/engines'
-import type { EngineHubModel, EngineHubSearchResponse } from '@/shared/types/engine-api'
+import type {
+    EngineHubLookupResponse,
+    EngineHubModel,
+    EngineHubSearchResponse
+} from '@/shared/types/engine-api'
 import { loadOllamaModels, type OllamaTagsModel } from '@/electron/model-hub/ollama-library'
+import { lookupOllamaModel } from '@/electron/model-hub/ollama-registry'
 import {
     lmStudioCatalogCache,
     type LmStudioCatalogModel
@@ -15,11 +20,16 @@ function ollamaToHubModel(m: OllamaTagsModel): EngineHubModel {
         id: m.name,
         name: m.name,
         author: '',
-        url: `https://ollama.com/library/${base}`,
+        // A namespaced name addresses that namespace's page; a bare one is a
+        // first-party model under `library`.
+        url: base.includes('/')
+            ? `https://ollama.com/${base}`
+            : `https://ollama.com/library/${base}`,
         size: m.size > 0 ? m.size : undefined,
         downloads: 0,
         likes: 0,
-        updatedAt: m.modified_at || new Date().toISOString(),
+        // Empty means the source reported no date; the row omits its age.
+        updatedAt: m.modified_at,
         tags: [],
         family: m.details.family || undefined,
         parameterSize: m.details.parameter_size || undefined
@@ -57,6 +67,30 @@ export async function getEngineHubModels(engineType: EngineType): Promise<Engine
     }
 }
 
+/**
+ * Resolve one exact model name {@link getEngineHubModels} did not return.
+ * Ollama's list is a committed snapshot, so a model published since it was taken
+ * is absent from the browse list even though the engine can pull it; this asks
+ * Ollama's registry for that one name.
+ *
+ * A null model means "not available" for every cause alike — no lookup source
+ * for the engine, no such model, or an unreachable registry. LM Studio has none
+ * because its catalog is fetched live and never falls behind a release.
+ */
+export async function lookupEngineHubModel(
+    engineType: EngineType,
+    name: string
+): Promise<EngineHubLookupResponse> {
+    switch (engineType) {
+        case 'ollama': {
+            const found = await lookupOllamaModel(name)
+            return { model: found ? ollamaToHubModel(found) : null }
+        }
+        default:
+            return { model: null }
+    }
+}
+
 /**
  * Kick a background refresh of the live engine hub caches so the first modal
  * open is instant. Ollama needs no warming (it is a committed static list);
diff --git a/desktop/src/electron/model-hub/ollama-registry.ts b/desktop/src/electron/model-hub/ollama-registry.ts
new file mode 100644
index 000000000..f8f96ee78
--- /dev/null
+++ b/desktop/src/electron/model-hub/ollama-registry.ts
@@ -0,0 +1,246 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import axios, { isAxiosError } from 'axios'
+import { createStructuredLogger } from '@/shared/utils/log'
+import getErrorString from '@/shared/utils/get-error-string'
+import type { OllamaTagsModel } from '@/electron/model-hub/ollama-library'
+import type { JsonValue } from '@/shared/types/json'
+
+const log = createStructuredLogger('ollama-registry')
+
+/**
+ * Resolve one Ollama model by exact name, for names the committed catalog
+ * snapshot (`ollama-models.json`) does not carry.
+ *
+ * `registry.ollama.ai` speaks the OCI distribution API that `ollama pull` uses,
+ * so this asks the same source the engine would. It only reads manifests: the
+ * registry answers 404 for `/tags/list`, so enumerating a catalog still needs
+ * the snapshot and a lookup is an exact-name check rather than a search.
+ */
+
+const REGISTRY_BASE = 'https://registry.ollama.ai/v2'
+const USER_AGENT = 'PAIR/1.0'
+
+/**
+ * Bounds the whole request rather than just the response. `axios`'s `timeout` is
+ * a socket timeout and does not start until a socket exists, so it misses a
+ * wedged DNS resolver; an `AbortSignal` covers every phase. `lmstudio-catalog.ts`
+ * carries the same reasoning at more length.
+ */
+const HTTP_TIMEOUT_MS = 8_000
+
+/** What `ollama pull <name>` resolves a bare name to. */
+const DEFAULT_TAG = 'latest'
+
+/** Ollama's namespace for first-party models, implied by a bare name. */
+const DEFAULT_NAMESPACE = 'library'
+
+/**
+ * Characters a repository segment or tag may contain. This is the only guard on
+ * what reaches the request URL, so it has to hold on its own: the renderer runs
+ * its own check before asking, but a lookup arrives over IPC and main-process
+ * code does not treat the renderer as trusted. Without it, `foo/..` walks out of
+ * the namespace and `foo/bar#z` truncates the path.
+ */
+const SAFE_SEGMENT = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/
+
+/**
+ * Positive and negative results both cached, because the hub looks names up as
+ * the user types and would otherwise re-request on every keystroke past a
+ * resolved name. Bounded so a long session cannot grow it without limit.
+ */
+const CACHE_LIMIT = 256
+const cache = new Map<string, OllamaTagsModel | null>()
+
+function remember(key: string, value: OllamaTagsModel | null): OllamaTagsModel | null {
+    if (cache.size >= CACHE_LIMIT) {
+        // Map iteration is insertion-ordered, so the first key is the oldest.
+        const oldest = cache.keys().next()
+        if (!oldest.done) cache.delete(oldest.value)
+    }
+    cache.set(key, value)
+    return value
+}
+
+/**
+ * Split `[namespace/]name[:tag]` into a registry path and tag, or null for a
+ * reference this registry cannot answer.
+ *
+ * OCI clients read a dot in the first of *several* segments as a registry
+ * hostname, which is how `hf.co/<user>/<repo>` is recognized as someone else's
+ * registry and declined rather than reported as missing. That rule must not
+ * reach a lone segment: bare model names legitimately carry dots — `qwen3.8`,
+ * `llama3.1`, `phi3.5` — and are always first-party names under `library`.
+ */
+function parseReference(name: string): { path: string; tag: string } | null {
+    const colon = name.lastIndexOf(':')
+    const slash = name.lastIndexOf('/')
+    // A colon ahead of the last slash belongs to a host:port, not a tag.
+    const hasTag = colon > slash
+    const repository = hasTag ? name.slice(0, colon) : name
+    const tag = hasTag ? name.slice(colon + 1) : DEFAULT_TAG
+    if (!SAFE_SEGMENT.test(tag)) return null
+
+    const segments = repository.split('/')
+    if (!segments.every(segment => SAFE_SEGMENT.test(segment))) return null
+    if (segments.length === 1) return { path: `${DEFAULT_NAMESPACE}/${segments[0]}`, tag }
+    if (segments.length > 2 || segments[0].includes('.')) return null
+    return { path: repository, tag }
+}
+
+type JsonObject = { [key: string]: JsonValue }
+
+function isRecord(v: JsonValue | undefined): v is JsonObject {
+    return v !== null && v !== undefined && typeof v === 'object' && !Array.isArray(v)
+}
+
+function manifestLayers(raw: JsonValue): JsonObject[] {
+    if (!isRecord(raw) || !Array.isArray(raw.layers)) return []
+    return raw.layers.filter(isRecord)
+}
+
+/**
+ * Total bytes the engine downloads: every layer, not just the weights. The
+ * others (template, params, license) are a few kilobytes each, but the sum is
+ * what lands on disk.
+ */
+function totalLayerBytes(raw: JsonValue): number {
+    let total = 0
+    for (const layer of manifestLayers(raw)) {
+        if (typeof layer.size === 'number' && layer.size > 0) total += layer.size
+    }
+    return total
+}
+
+/**
+ * Capability chip for the row. `details.family` carries a capability rather than
+ * a model family here, because that is what the catalog scraper puts there and
+ * what the row renders.
+ *
+ * Vision is the only one a manifest proves: a multimodal model carries an extra
+ * `projector` layer for its vision encoder and nothing else does. Tools,
+ * thinking and embedding exist only on ollama.com's rendered page, so a model
+ * with those and no projector gets no chip instead of a wrong one.
+ */
+function capabilityFromLayers(raw: JsonValue): string {
+    const vision = manifestLayers(raw).some(
+        layer => layer.mediaType === 'application/vnd.ollama.image.projector'
+    )
+    return vision ? 'vision' : ''
+}
+
+function configDigest(raw: JsonValue): string {
+    if (!isRecord(raw)) return ''
+    const config = raw.config
+    if (!isRecord(config)) return ''
+    return typeof config.digest === 'string' ? config.digest : ''
+}
+
+/** The 12-character form Ollama shows in its own model lists. */
+function shortenDigest(digest: string): string {
+    return digest.replace(/^sha256:/, '').slice(0, 12)
+}
+
+/**
+ * What the model says about itself, read from the config blob the manifest
+ * points at. Worth the extra request because a tag like `27b-coding-mxfp8` is a
+ * label the publisher chose, while these are the real figures.
+ */
+interface OllamaModelConfig {
+    format: string
+    families: string[] | null
+    parameterSize: string
+    quantizationLevel: string
+}
+
+/** Resolves to null on any failure; the row still renders, with less on it. */
+async function fetchConfig(path: string, digest: string): Promise<OllamaModelConfig | null> {
+    if (!digest) return null
+    try {
+        const { data } = await axios.get<JsonValue>(`${REGISTRY_BASE}/${path}/blobs/${digest}`, {
+            headers: { 'User-Agent': USER_AGENT, Accept: 'application/json' },
+            signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+        })
+        if (!isRecord(data)) return null
+        const families = Array.isArray(data.model_families)
+            ? data.model_families.filter((f): f is string => typeof f === 'string')
+            : []
+        return {
+            format: typeof data.model_format === 'string' ? data.model_format : '',
+            families: families.length > 0 ? families : null,
+            parameterSize: typeof data.model_type === 'string' ? data.model_type : '',
+            quantizationLevel: typeof data.file_type === 'string' ? data.file_type : ''
+        }
+    } catch {
+        return null
+    }
+}
+
+/**
+ * Look one exact model name up in Ollama's registry.
+ *
+ * Null covers every "not available" case alike — a reference this registry does
+ * not serve, a model or tag that does not exist, a timeout, an offline machine.
+ * None of them surface as an error: the lookup is speculative, and the user
+ * asked to search rather than to make this request.
+ */
+export async function lookupOllamaModel(name: string): Promise<OllamaTagsModel | null> {
+    const cached = cache.get(name)
+    if (cached !== undefined) return cached
+
+    const reference = parseReference(name)
+    if (!reference) return remember(name, null)
+
+    try {
+        const { data } = await axios.get<JsonValue>(
+            `${REGISTRY_BASE}/${reference.path}/manifests/${reference.tag}`,
+            {
+                headers: {
+                    'User-Agent': USER_AGENT,
+                    Accept: 'application/vnd.docker.distribution.manifest.v2+json'
+                },
+                signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+            }
+        )
+        const size = totalLayerBytes(data)
+        if (size === 0) return remember(name, null)
+
+        const digest = configDigest(data)
+        const config = await fetchConfig(reference.path, digest)
+
+        log.info({ sublevel: 'lookup', message: `resolved ${name} outside the catalog snapshot` })
+        return remember(name, {
+            name,
+            model: name,
+            // Neither the manifest nor its headers carry a publication date.
+            // Empty means unknown, and the row omits its age rather than
+            // claiming the model was updated just now.
+            modified_at: '',
+            size,
+            digest: shortenDigest(digest),
+            details: {
+                parent_model: '',
+                format: config?.format ?? '',
+                family: capabilityFromLayers(data),
+                families: config?.families ?? null,
+                // Falls back to the tag, which is what the catalog shows here.
+                parameter_size:
+                    config?.parameterSize || (reference.tag === DEFAULT_TAG ? '' : reference.tag),
+                quantization_level: config?.quantizationLevel ?? ''
+            }
+        })
+    } catch (err) {
+        const status = isAxiosError(err) ? err.response?.status : undefined
+        // 404 is the ordinary answer for a name that does not exist.
+        // 404 is the ordinary answer for a name that does not exist, and is
+        // remembered. Anything else (a timeout, an offline machine, a 5xx) may
+        // pass, so it is not cached and the next search asks again.
+        if (status === 404) return remember(name, null)
+        log.warn({
+            sublevel: 'http',
+            message: `lookup for ${name} failed: ${status ?? ''} ${getErrorString(err)}`.trim()
+        })
+        return null
+    }
+}
diff --git a/desktop/src/electron/service-bridge/empty-handlers.ts b/desktop/src/electron/service-bridge/empty-handlers.ts
index 0bae0f5a5..1a4c6303d 100644
--- a/desktop/src/electron/service-bridge/empty-handlers.ts
+++ b/desktop/src/electron/service-bridge/empty-handlers.ts
@@ -20,7 +20,7 @@ import {
     MODULAR_ENGINE_LIFECYCLE_CALL_TIMEOUT_MS
 } from '@/shared/constants/modular-runtime'
 import getErrorString from '@/shared/utils/get-error-string'
-import { getEngineHubModels } from '@/electron/model-hub'
+import { getEngineHubModels, lookupEngineHubModel } from '@/electron/model-hub'
 import { getModularSupervisor } from './modular-supervisor'
 import {
     getModularBridgeState,
@@ -1180,6 +1180,8 @@ const EMPTY_SERVICE_BRIDGE_HANDLERS: BridgeHandlerMap = {
     'engine:command': payload => handleEngineCommand(payload),
     'engine:search-hub': payload =>
         payload ? getEngineHubModels(payload.engineType) : { models: [] },
+    'engine:lookup-hub-model': payload =>
+        payload ? lookupEngineHubModel(payload.engineType, payload.name) : { model: null },
 
     'errors:get-initial': () => handleErrorsGetInitial(),
     'errors:clear': payload => (payload ? handleErrorsClear(payload) : null),
diff --git a/desktop/src/shared/types/engine-api.ts b/desktop/src/shared/types/engine-api.ts
index 351f5c5be..208caf2ab 100644
--- a/desktop/src/shared/types/engine-api.ts
+++ b/desktop/src/shared/types/engine-api.ts
@@ -37,6 +37,15 @@ export interface EngineHubSearchResponse {
     models: EngineHubModel[]
 }
 
+/**
+ * Response for the `engine:lookup-hub-model` channel. `null` means the name is
+ * not available, whether because it does not exist, the engine has no registry
+ * to ask, or that registry could not be reached.
+ */
+export interface EngineHubLookupResponse {
+    model: EngineHubModel | null
+}
+
 /** Engine command discriminator. */
 export type EngineCommandType =
     | 'toggle'
diff --git a/desktop/src/shared/types/ws-channels.ts b/desktop/src/shared/types/ws-channels.ts
index 7e66c85f2..111a34719 100644
--- a/desktop/src/shared/types/ws-channels.ts
+++ b/desktop/src/shared/types/ws-channels.ts
@@ -25,6 +25,7 @@
  */
 import type {
     EngineCommandPayload,
+    EngineHubLookupResponse,
     EngineHubSearchResponse,
     EngineInitialState,
     EngineStatePatch
@@ -116,6 +117,12 @@ export interface WsInvokeChannelMap {
     'engines:get-initial': { request: void; response: EngineInitialState }
     'engine:command': { request: EngineCommandPayload; response: null }
     'engine:search-hub': { request: { engineType: EngineType }; response: EngineHubSearchResponse }
+    // Exact-name lookup, used only when a search matches nothing, so the
+    // catalog the app ships with cannot hide a model the engine could pull.
+    'engine:lookup-hub-model': {
+        request: { engineType: EngineType; name: string }
+        response: EngineHubLookupResponse
+    }
 
     // Errors
     'errors:get-initial': { request: void; response: ServiceError[] }
diff --git a/desktop/src/shared/utils/log.ts b/desktop/src/shared/utils/log.ts
index b3c8ff7fd..40131827c 100644
--- a/desktop/src/shared/utils/log.ts
+++ b/desktop/src/shared/utils/log.ts
@@ -97,11 +97,18 @@ function writeEntry(scope: string, level: LogLevel, payload: StructuredLogPayloa
         }
     }
 
-    // Console output with scope prefix
+    // Console output with scope prefix. Best-effort: a closed stdout (parent
+    // process gone, launched from a pipe that later closed) raises write EPIPE
+    // from afterWriteDispatched. That is an uncaughtException in Electron and
+    // surfaces as "A JavaScript error occurred in the main process".
     const prefix = `(${scope})`.padEnd(24)
     const msg = payload.message ?? ''
     const dataStr = payload.data ? ` ${JSON.stringify(payload.data)}` : ''
-    process.stdout.write(`${now.toLocaleTimeString()} ${prefix} > ${msg}${dataStr}\n`)
+    try {
+        process.stdout.write(`${now.toLocaleTimeString()} ${prefix} > ${msg}${dataStr}\n`)
+    } catch {
+        /* best-effort */
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -141,6 +148,15 @@ export function initFileLogger(paths: PathProvider): void {
     } catch {
         approxFileSize = 0
     }
+
+    // Swallow async write errors on stdio. try/catch around write() only
+    // covers the synchronous throw; EPIPE from a broken pipe is emitted later.
+    if (process.stdout.listenerCount('error') === 0) {
+        process.stdout.on('error', () => {})
+    }
+    if (process.stderr.listenerCount('error') === 0) {
+        process.stderr.on('error', () => {})
+    }
 }
 
 export function createStructuredLogger(scope: string): StructuredLogger {
diff --git a/desktop/src/ui/api/engine-api.ts b/desktop/src/ui/api/engine-api.ts
index 69fd71a24..e691ba981 100644
--- a/desktop/src/ui/api/engine-api.ts
+++ b/desktop/src/ui/api/engine-api.ts
@@ -9,6 +9,7 @@
  */
 import type { PreloadServiceTransport as ServiceTransport } from '@/shared/types/service-bridge'
 import type {
+    EngineHubLookupResponse,
     EngineHubSearchResponse,
     EngineInitialState,
     EngineStatePatch,
@@ -49,6 +50,8 @@ export interface IEngineApi {
     setModelExpiry(engineType: EngineType, nodeId: string, model: string, expiry: string): void
     /** Search the model registry/hub for available models. */
     searchHub(engineType: EngineType): Promise<EngineHubSearchResponse>
+    /** Resolve one exact model name the hub catalog does not list. */
+    lookupHubModel(engineType: EngineType, name: string): Promise<EngineHubLookupResponse>
 
     /** Durable engine state changed. Prefer this for new renderer state. */
     onStateChanged(callback: (patch: EngineStatePatch) => void): () => void
@@ -103,6 +106,8 @@ export function createEngineApi(transport: ServiceTransport): IEngineApi {
                 expiry
             }),
         searchHub: engineType => transport.invoke('engine:search-hub', { engineType }),
+        lookupHubModel: (engineType, name) =>
+            transport.invoke('engine:lookup-hub-model', { engineType, name }),
 
         onStateChanged: cb => transport.subscribePush('engines:state-changed', cb),
         onProgress: cb => transport.subscribePush('engines:progress-changed', cb),
diff --git a/desktop/src/ui/components/ModelHub/EngineHubListRow.tsx b/desktop/src/ui/components/ModelHub/EngineHubListRow.tsx
index 10c0ccdb2..17bba0431 100644
--- a/desktop/src/ui/components/ModelHub/EngineHubListRow.tsx
+++ b/desktop/src/ui/components/ModelHub/EngineHubListRow.tsx
@@ -75,12 +75,14 @@ const EngineHubListRow = memo(function EngineHubListRow({
                             </Text>
                         )}
 
-                        <Text
-                            kind="body/regular/sm"
-                            className="text-subtle-color whitespace-nowrap"
-                        >
-                            Updated {formatRelativeTime(new Date(model.updatedAt).getTime())}
-                        </Text>
+                        {!!model.updatedAt && (
+                            <Text
+                                kind="body/regular/sm"
+                                className="text-subtle-color whitespace-nowrap"
+                            >
+                                Updated {formatRelativeTime(model.updatedAt.getTime())}
+                            </Text>
+                        )}
 
                         {!!model.url && (
                             <Button
diff --git a/desktop/src/ui/components/ModelHub/ModelHubContent.tsx b/desktop/src/ui/components/ModelHub/ModelHubContent.tsx
index 061b25f6b..ed6f7d641 100644
--- a/desktop/src/ui/components/ModelHub/ModelHubContent.tsx
+++ b/desktop/src/ui/components/ModelHub/ModelHubContent.tsx
@@ -8,9 +8,10 @@ import { ModelHubActions } from './ModelHubActions'
 import { InlineErrorBanner } from '@/ui/components/InlineErrorBanner'
 import { ModelEntry, SortState } from '@/ui/types/model-hub'
 import { ModelHubList } from './ModelHubList'
-import { searchEngineHub } from '@/ui/utils/model-hub-search'
+import { lookupEngineHubModel, searchEngineHub } from '@/ui/utils/model-hub-search'
 import { resolveStoredSort, writeStoredSort } from '@/ui/utils/model-hub-content-storage'
 import { isHubEntryDownloaded } from '@/ui/utils/match-downloaded-model'
+import { resolveLookupQuery } from '@/ui/utils/model-hub-lookup'
 import { EngineType } from '@/shared/types/engines'
 import type { ModelItem } from '@/ui/types/engine-info'
 import getErrorString from '@/shared/utils/get-error-string'
@@ -23,6 +24,12 @@ type ModelHubContentProps = {
     downloadedModels?: readonly ModelItem[]
 }
 
+/** Stable empty list so the lookup memo does not churn every render. */
+const NO_DOWNLOADED_MODELS: readonly ModelItem[] = []
+
+/** How long typing has to settle before an unlisted name is looked up. */
+const LOOKUP_DEBOUNCE_MS = 400
+
 const SORT_DEFAULT_STATE: SortState = {
     sort: 'lastModified',
     sortDescending: false,
@@ -48,6 +55,9 @@ export const ModelHubContent = ({
         engine ? resolveStoredSort(engine, SORT_DEFAULT_STATE) : { ...SORT_DEFAULT_STATE }
     )
     const [errors, setErrors] = useState<{ id: string; message: string }[]>([])
+    // At most one, since a lookup resolves an exact name rather than searching.
+    const [lookupResult, setLookupResult] = useState<ModelEntry | null>(null)
+    const [lookingUp, setLookingUp] = useState(false)
 
     // Per-engine raw-response cache so reopening an engine is instant and
     // keystrokes filter locally instead of re-invoking the search IPC.
@@ -55,6 +65,8 @@ export const ModelHubContent = ({
     // Monotonic generation guard so a stale in-flight fetch never overwrites
     // results for the engine the user has since switched to.
     const fetchGenRef = useRef(0)
+    // The same guard for lookups, which race each other as the query changes.
+    const lookupGenRef = useRef(0)
 
     const loadModels = useCallback(async (backend: EngineType) => {
         const cached = cacheRef.current.get(backend)
@@ -111,6 +123,51 @@ export const ModelHubContent = ({
         return queryFiltered.filter(m => !isHubEntryDownloaded(engine, m, downloadedModels))
     }, [engine, queryFiltered, downloadedModels])
 
+    // A query that matches nothing locally may still name a real model, because
+    // the catalog is a snapshot. Resolve the exact name against the engine's
+    // registry and fold the answer in as an ordinary row.
+    //
+    // Runs only once the local list is known to be empty, and debounced, so
+    // filtering stays instant and a query the snapshot already answers never
+    // leaves the renderer.
+    useEffect(() => {
+        setLookupResult(null)
+        const name = loading || visibleModels.length > 0 ? null : resolveLookupQuery(engine, query)
+        if (!engine || !name) {
+            setLookingUp(false)
+            return
+        }
+
+        const generation = ++lookupGenRef.current
+        setLookingUp(true)
+        const timer = setTimeout(() => {
+            void lookupEngineHubModel(engine, name).then(found => {
+                if (lookupGenRef.current !== generation) return
+                setLookupResult(found)
+                setLookingUp(false)
+            })
+        }, LOOKUP_DEBOUNCE_MS)
+
+        return () => {
+            clearTimeout(timer)
+            // Supersede a request still in flight for the previous query.
+            lookupGenRef.current += 1
+        }
+    }, [engine, query, loading, visibleModels.length])
+
+    // A resolved model that is already installed stays hidden: the hub filters
+    // downloaded models out, which is what emptied the list and prompted the
+    // lookup to begin with.
+    const displayModels = useMemo(() => {
+        if (!engine || !lookupResult) return visibleModels
+        const installed = isHubEntryDownloaded(
+            engine,
+            lookupResult,
+            downloadedModels ?? NO_DOWNLOADED_MODELS
+        )
+        return installed ? visibleModels : [...visibleModels, lookupResult]
+    }, [visibleModels, lookupResult, engine, downloadedModels])
+
     const handleSortPersist = useCallback(
         (next: SortState) => {
             setSort(next)
@@ -121,8 +178,9 @@ export const ModelHubContent = ({
         [engine]
     )
 
-    const modelsRef = useRef(allModels)
-    modelsRef.current = allModels
+    // Covers the looked-up row too, so selecting it resolves like any other.
+    const modelsRef = useRef(displayModels)
+    modelsRef.current = displayModels
 
     const handleSubmit = useCallback(
         (ids: string[]) => {
@@ -192,8 +250,8 @@ export const ModelHubContent = ({
                     className="grow min-h-0"
                     disabled={disabledListClick}
                     multiple={multiple}
-                    loading={loading}
-                    models={visibleModels}
+                    loading={loading || (lookingUp && displayModels.length === 0)}
+                    models={displayModels}
                     selectedModels={selectedModels}
                     onToggleSelectModel={handleListToggle}
                     sort={sort}
diff --git a/desktop/src/ui/components/ModelHub/ModelHubList.tsx b/desktop/src/ui/components/ModelHub/ModelHubList.tsx
index b8e23048c..5581486c1 100644
--- a/desktop/src/ui/components/ModelHub/ModelHubList.tsx
+++ b/desktop/src/ui/components/ModelHub/ModelHubList.tsx
@@ -84,9 +84,10 @@ export const ModelHubList = ({
 
         switch (sort.sort) {
             case 'lastModified': {
-                const lastModifiedSort = copy.sort(
-                    (a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime()
-                )
+                // A row with no known date sorts oldest, rather than NaN-ing the
+                // comparator and leaving the whole order undefined.
+                const when = (m: ModelEntry): number => m.updatedAt?.getTime() ?? 0
+                const lastModifiedSort = copy.sort((a, b) => when(b) - when(a))
                 return sort.sortDescending ? lastModifiedSort.reverse() : lastModifiedSort
             }
             case 'name': {
diff --git a/desktop/src/ui/components/NodeList/NodeCardDetails.tsx b/desktop/src/ui/components/NodeList/NodeCardDetails.tsx
index 3784e0737..9793dcea0 100644
--- a/desktop/src/ui/components/NodeList/NodeCardDetails.tsx
+++ b/desktop/src/ui/components/NodeList/NodeCardDetails.tsx
@@ -97,6 +97,11 @@ function NodeCardDetails({ node }: NodeCardDetailsProps) {
         })
     }, [hasGpu, node, nodeMetrics])
 
+    // Memoized so the label's segment list keeps a stable identity across
+    // renders; NodeLabel observes its segments and would otherwise rebuild the
+    // ResizeObserver every render.
+    const gpuLabels = useMemo(() => gpuInfo.map(gpu => gpu.name), [gpuInfo])
+
     const cpuFallbackInfo: CpuFallbackInfo | null = useMemo(() => {
         if (hasGpu) return null
         const ramTotal = node.topology.ram
@@ -301,7 +306,7 @@ function NodeCardDetails({ node }: NodeCardDetailsProps) {
                             <NodeLabel
                                 name={node.name}
                                 ipAddress={node.ipAddress}
-                                gpuLabel={gpuInfo.length > 0 ? gpuInfo[0].name : undefined}
+                                gpuLabels={gpuLabels}
                                 isLocal={isLocal}
                             />
                         </div>
diff --git a/desktop/src/ui/components/NodeList/NodeLabel.tsx b/desktop/src/ui/components/NodeList/NodeLabel.tsx
index 219ee88e0..b43ea8e88 100644
--- a/desktop/src/ui/components/NodeList/NodeLabel.tsx
+++ b/desktop/src/ui/components/NodeList/NodeLabel.tsx
@@ -4,37 +4,26 @@
 import { Flex, Text } from '@nvidia/foundations-react-core'
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import { LocalBadge } from '@/ui/components/LocalBadge'
-
-interface LabelSegment {
-    id: string
-    text: string
-}
+import { buildNodeLabelSegments } from '@/ui/utils/node-label-segments'
 
 export default function NodeLabel({
     name,
     ipAddress,
-    gpuLabel,
+    gpuLabels,
     isLocal
 }: {
     name: string
     ipAddress: string
-    gpuLabel: string | undefined
+    gpuLabels: string[]
     isLocal?: boolean
 }) {
     const segmentRefs = useRef<(HTMLDivElement | null)[]>([])
     const containerRef = useRef<HTMLDivElement | null>(null)
     const [separatorAfter, setSeparatorAfter] = useState<boolean[]>([])
-    const segments = useMemo(() => {
-        const primaryText = (name || ipAddress).toUpperCase()
-        const nextSegments: LabelSegment[] = [{ id: 'primary', text: primaryText }]
-        if (name && ipAddress) {
-            nextSegments.push({ id: 'ip', text: ipAddress })
-        }
-        if (gpuLabel) {
-            nextSegments.push({ id: 'gpu', text: gpuLabel })
-        }
-        return nextSegments
-    }, [gpuLabel, ipAddress, name])
+    const segments = useMemo(
+        () => buildNodeLabelSegments(name, ipAddress, gpuLabels),
+        [gpuLabels, ipAddress, name]
+    )
 
     const updateSeparators = useCallback(() => {
         const next = segments.map((_segment, index) => {
diff --git a/desktop/src/ui/types/model-hub.ts b/desktop/src/ui/types/model-hub.ts
index 668e57a7f..df792f76d 100644
--- a/desktop/src/ui/types/model-hub.ts
+++ b/desktop/src/ui/types/model-hub.ts
@@ -14,7 +14,12 @@ export interface ModelEntry {
     author: string
     url: string
     size?: number
-    updatedAt: Date
+    /**
+     * Publication date, when the source reports one. Undefined for a model
+     * resolved by exact-name lookup, since an OCI manifest carries no date and
+     * the current time would give the row an age it never had.
+     */
+    updatedAt?: Date
     family?: string
     parameterSize?: string
 }
diff --git a/desktop/src/ui/utils/model-hub-lookup.ts b/desktop/src/ui/utils/model-hub-lookup.ts
new file mode 100644
index 000000000..a52aec12b
--- /dev/null
+++ b/desktop/src/ui/utils/model-hub-lookup.ts
@@ -0,0 +1,68 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { EngineType } from '@/shared/types/engines'
+
+/**
+ * Decides whether a search that matched nothing is worth resolving against the
+ * engine's registry.
+ *
+ * The Ollama hub browses a committed snapshot, so a model published after that
+ * snapshot was taken is missing from the list even though the engine can pull
+ * it; `engine:lookup-hub-model` closes that gap for one exact name. A lookup
+ * costs a request, so the pointless ones are stopped here rather than sent.
+ */
+
+/**
+ * Longest name worth asking about. Ollama references are far shorter in
+ * practice; the cap keeps a paste of unbounded text away from the matcher, the
+ * same reason `formatModelDisplayName` caps its input.
+ */
+const MAX_NAME_LENGTH = 256
+
+/**
+ * `[namespace/]name[:tag]`, the form `ollama pull` accepts. Neither `/` nor `:`
+ * is in the segment character class, so each separator is the only place a
+ * repetition can start and matching stays linear.
+ */
+const OLLAMA_MODEL_REFERENCE =
+    /^[a-zA-Z0-9][a-zA-Z0-9._-]*(?:\/[a-zA-Z0-9][a-zA-Z0-9._-]*)*(?::[a-zA-Z0-9][a-zA-Z0-9._-]*)?$/
+
+/**
+ * Ollama's hosted cloud-only tags (`qwen3-vl:235b-cloud`, `gpt-oss:120b-cloud`,
+ * `…:cloud-preview`) cannot run on a local engine, so resolving one would only
+ * add a row nobody can use. The catalog scraper drops them for the same reason.
+ * `cloud` is matched as a whole delimited token, leaving `icloud-*` alone.
+ */
+function isOllamaCloudTag(name: string): boolean {
+    return /(^|[-:])cloud($|[-:])/i.test(name)
+}
+
+function isOllamaLookupCandidate(name: string): boolean {
+    return OLLAMA_MODEL_REFERENCE.test(name) && !isOllamaCloudTag(name)
+}
+
+/**
+ * Per-engine gate, keyed like the matchers in `match-downloaded-model.ts`. An
+ * engine missing from this map is never looked up, which is why LM Studio is
+ * absent: its catalog is fetched live on a six-hour TTL, so it does not fall
+ * behind between releases and has no gap to close.
+ */
+const LOOKUP_CANDIDATES: Partial<Record<EngineType, (name: string) => boolean>> = {
+    ollama: isOllamaLookupCandidate
+}
+
+/**
+ * The exact model name to resolve, or null when the query is not worth a
+ * request — an engine with no registry to ask, a query that is not a model
+ * reference, or a cloud-only tag.
+ */
+export function resolveLookupQuery(engine: EngineType | null, query: string): string | null {
+    if (!engine) return null
+    const isCandidate = LOOKUP_CANDIDATES[engine]
+    if (!isCandidate) return null
+
+    const name = query.trim()
+    if (!name || name.length > MAX_NAME_LENGTH) return null
+    return isCandidate(name) ? name : null
+}
diff --git a/desktop/src/ui/utils/model-hub-search.ts b/desktop/src/ui/utils/model-hub-search.ts
index 8111cbecc..4740b32be 100644
--- a/desktop/src/ui/utils/model-hub-search.ts
+++ b/desktop/src/ui/utils/model-hub-search.ts
@@ -32,7 +32,9 @@ function hubModelToEntry(m: EngineHubModel): ModelEntry {
         author: m.author,
         url: m.url,
         size: m.size,
-        updatedAt: m.updatedAt ? new Date(m.updatedAt) : new Date(),
+        // Empty means the source reported no date; the row omits its age rather
+        // than showing the current time as a publication date.
+        updatedAt: m.updatedAt ? new Date(m.updatedAt) : undefined,
         family: m.family,
         parameterSize: m.parameterSize
     }
@@ -48,3 +50,25 @@ export async function searchEngineHub(engine: EngineType): Promise<ModelEntry[]>
     const { models } = await window.pairApi.engines.searchHub(engine)
     return models.map(hubModelToEntry)
 }
+
+/**
+ * Resolve one exact model name against the engine's own registry, for a name
+ * the catalog does not carry.
+ *
+ * Failures resolve to null rather than throwing. The user asked to search, not
+ * to make this request, so a banner about it failing would be noise — but that
+ * also swallows a broken channel, hence the warning.
+ */
+export async function lookupEngineHubModel(
+    engine: EngineType,
+    name: string
+): Promise<ModelEntry | null> {
+    if (!getEngineHub(engine)) return null
+    try {
+        const { model } = await window.pairApi.engines.lookupHubModel(engine, name)
+        return model ? hubModelToEntry(model) : null
+    } catch (error) {
+        console.warn('Model hub lookup failed', error)
+        return null
+    }
+}
diff --git a/desktop/src/ui/utils/node-label-segments.ts b/desktop/src/ui/utils/node-label-segments.ts
new file mode 100644
index 000000000..c4d11acb3
--- /dev/null
+++ b/desktop/src/ui/utils/node-label-segments.ts
@@ -0,0 +1,42 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/** A single text run in a node card's header label. */
+interface LabelSegment {
+    id: string
+    text: string
+}
+
+/**
+ * Header-label segments for a node card: name, address, then one segment per
+ * GPU.
+ *
+ * Each GPU gets its OWN segment rather than being folded into one joined
+ * string, because `NodeLabel` applies wrapping, `·` separators and truncation
+ * per segment. A joined string is a single segment, so on a narrow card it
+ * truncates after the first card name and the rest of a multi-GPU host becomes
+ * invisible — which is the failure this shape exists to prevent.
+ *
+ * Empty GPU names are dropped so a backend that reports a blank name cannot
+ * render a stray separator with nothing after it.
+ */
+export function buildNodeLabelSegments(
+    name: string,
+    ipAddress: string,
+    gpuLabels: string[]
+): LabelSegment[] {
+    const primaryText = (name || ipAddress).toUpperCase()
+    const segments: LabelSegment[] = [{ id: 'primary', text: primaryText }]
+
+    if (name && ipAddress) {
+        segments.push({ id: 'ip', text: ipAddress })
+    }
+
+    gpuLabels.forEach((gpuLabel, index) => {
+        if (gpuLabel) {
+            segments.push({ id: `gpu-${index}`, text: gpuLabel })
+        }
+    })
+
+    return segments
+}
diff --git a/desktop/tests/modular/csp.test.ts b/desktop/tests/modular/csp.test.ts
new file mode 100644
index 000000000..a5a27e65d
--- /dev/null
+++ b/desktop/tests/modular/csp.test.ts
@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from 'vitest'
+import { buildCspHeader } from '@/electron/csp'
+
+describe('content security policy', () => {
+    it('keeps security-critical directives restrictive', () => {
+        const directives = buildCspHeader()
+            .split(';')
+            .map(directive => directive.trim())
+
+        expect(directives).toContain("default-src 'none'")
+        expect(directives).toContain("script-src 'self'")
+        expect(directives).toContain("connect-src 'self'")
+        expect(directives).toContain("worker-src 'none'")
+        expect(directives).toContain("base-uri 'self'")
+        expect(directives).toContain("object-src 'none'")
+    })
+})
diff --git a/desktop/tests/modular/model-hub-lookup.test.ts b/desktop/tests/modular/model-hub-lookup.test.ts
new file mode 100644
index 000000000..8e2830a69
--- /dev/null
+++ b/desktop/tests/modular/model-hub-lookup.test.ts
@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from 'vitest'
+import { resolveLookupQuery } from '@/ui/utils/model-hub-lookup'
+
+/**
+ * The Ollama hub browses a committed snapshot, so a model published after that
+ * snapshot cannot be found by searching. When a search matches nothing, the hub
+ * resolves the typed name against the registry instead. These cover which
+ * queries earn that request.
+ */
+
+describe('resolveLookupQuery', () => {
+    it('accepts a well-formed model reference', () => {
+        expect(resolveLookupQuery('ollama', 'qwen3.5:32b')).toBe('qwen3.5:32b')
+        expect(resolveLookupQuery('ollama', 'gemma3')).toBe('gemma3')
+        expect(resolveLookupQuery('ollama', 'some-namespace/some-model:q4_K_M')).toBe(
+            'some-namespace/some-model:q4_K_M'
+        )
+    })
+
+    it('trims surrounding whitespace from a pasted name', () => {
+        expect(resolveLookupQuery('ollama', '  gemma3:27b \n')).toBe('gemma3:27b')
+    })
+
+    it('declines a query that is not a model reference', () => {
+        // Free-text searching is what the local filter is for; only an exact
+        // name is worth a request, because the registry has no search endpoint.
+        for (const query of [
+            '',
+            '   ',
+            'a model with spaces',
+            'has:two:colons',
+            '/leading-slash',
+            'trailing-slash/',
+            '-leading-punctuation',
+            'inject`whoami`',
+            'x'.repeat(257)
+        ]) {
+            expect(resolveLookupQuery('ollama', query)).toBeNull()
+        }
+    })
+
+    it('declines cloud-only tags, which cannot be pulled to a local engine', () => {
+        // Same rule the catalog scraper applies when it strips these rows.
+        expect(resolveLookupQuery('ollama', 'qwen3-vl:235b-cloud')).toBeNull()
+        expect(resolveLookupQuery('ollama', 'gpt-oss:120b-cloud')).toBeNull()
+        expect(resolveLookupQuery('ollama', 'deepseek-v3.1:cloud-preview')).toBeNull()
+        // The token is delimited, so a name that merely contains "cloud" stays.
+        expect(resolveLookupQuery('ollama', 'icloud-summarizer:7b')).toBe('icloud-summarizer:7b')
+    })
+
+    it('declines engines whose catalog is already fetched live', () => {
+        // LM Studio refetches from Hugging Face on a six-hour TTL, so it never
+        // falls behind a release and has no gap for a lookup to close.
+        expect(resolveLookupQuery('lm-studio', 'lmstudio-community/Qwen3-8B-GGUF')).toBeNull()
+        expect(resolveLookupQuery(null, 'qwen3:8b')).toBeNull()
+    })
+
+    it('matches in linear time on an adversarial query', () => {
+        // Neither `/` nor `:` is in the segment character class, so each
+        // separator is the only place a repetition can start. A catastrophic
+        // backtrack would blow past this budget by orders of magnitude.
+        //
+        // Kept under the 256-char cap on purpose: a longer string would be
+        // rejected on length alone and would never reach the matcher.
+        const hostile = `${'a/'.repeat(60)}${'b.'.repeat(60)}!`
+        expect(hostile.length).toBeLessThanOrEqual(256)
+        const start = performance.now()
+        expect(resolveLookupQuery('ollama', hostile)).toBeNull()
+        expect(performance.now() - start).toBeLessThan(200)
+    })
+})
diff --git a/desktop/tests/modular/node-label-segments.test.ts b/desktop/tests/modular/node-label-segments.test.ts
new file mode 100644
index 000000000..1bc7231b0
--- /dev/null
+++ b/desktop/tests/modular/node-label-segments.test.ts
@@ -0,0 +1,77 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from 'vitest'
+import { buildNodeLabelSegments } from '@/ui/utils/node-label-segments'
+
+// The node card header previously rendered `gpus[0].name` alone, so a host with
+// more than one GPU was represented by its first card and every other card was
+// invisible in the summary view. `buildNodeLabelSegments` emits one segment per
+// GPU instead. These tests pin that every GPU survives, in order, at the counts
+// real hosts actually have — including the 8-GPU servers this has to hold for.
+
+const gpuTexts = (name: string, ip: string, gpus: string[]) =>
+    buildNodeLabelSegments(name, ip, gpus)
+        .filter(segment => segment.id.startsWith('gpu-'))
+        .map(segment => segment.text)
+
+describe('buildNodeLabelSegments', () => {
+    it('puts the name first, uppercased, followed by the address', () => {
+        const segments = buildNodeLabelSegments('pluto.local.tld', '172.16.24.46', [])
+        expect(segments).toEqual([
+            { id: 'primary', text: 'PLUTO.LOCAL.TLD' },
+            { id: 'ip', text: '172.16.24.46' }
+        ])
+    })
+
+    it('falls back to the address as the primary segment when there is no name', () => {
+        const segments = buildNodeLabelSegments('', '172.16.24.46', [])
+        expect(segments).toEqual([{ id: 'primary', text: '172.16.24.46' }])
+    })
+
+    it('renders a single-GPU host unchanged', () => {
+        expect(gpuTexts('TELESTO', '172.16.29.18', ['NVIDIA GeForce GTX 1060 6GB'])).toEqual([
+            'NVIDIA GeForce GTX 1060 6GB'
+        ])
+    })
+
+    it('renders BOTH cards of a dual-GPU host, in topology order', () => {
+        // The reported case: only the first card was ever shown.
+        expect(
+            gpuTexts('pluto.local.tld', '172.16.24.46', [
+                'Tesla P100-PCIE-16GB',
+                'NVIDIA GeForce RTX 3060'
+            ])
+        ).toEqual(['Tesla P100-PCIE-16GB', 'NVIDIA GeForce RTX 3060'])
+    })
+
+    it.each([3, 4, 5, 6, 7, 8])('renders every GPU on a %i-GPU host', count => {
+        const gpus = Array.from({ length: count }, (_, index) => `NVIDIA H100 80GB HBM3 #${index}`)
+        const texts = gpuTexts('dgx-01', '10.0.0.10', gpus)
+
+        expect(texts).toHaveLength(count)
+        expect(texts).toEqual(gpus)
+    })
+
+    it('keeps ids unique and stable across an 8-GPU host so React can key them', () => {
+        const gpus = Array.from({ length: 8 }, (_, index) => `NVIDIA A100-SXM4-80GB #${index}`)
+        const ids = buildNodeLabelSegments('dgx-02', '10.0.0.11', gpus).map(segment => segment.id)
+
+        expect(new Set(ids).size).toBe(ids.length)
+        expect(ids).toEqual([
+            'primary',
+            'ip',
+            ...Array.from({ length: 8 }, (_, index) => `gpu-${index}`)
+        ])
+    })
+
+    it('drops blank GPU names without disturbing the indices of the rest', () => {
+        // A blank name would otherwise render a separator with nothing after it.
+        const texts = gpuTexts('mixed', '10.0.0.12', ['Tesla P100-PCIE-16GB', '', 'RTX 3060'])
+        expect(texts).toEqual(['Tesla P100-PCIE-16GB', 'RTX 3060'])
+    })
+
+    it('emits no GPU segments for a host that reports none', () => {
+        expect(gpuTexts('cpu-only', '10.0.0.13', [])).toEqual([])
+    })
+})
diff --git a/desktop/tests/modular/ollama-registry-lookup.test.ts b/desktop/tests/modular/ollama-registry-lookup.test.ts
new file mode 100644
index 000000000..7a3778916
--- /dev/null
+++ b/desktop/tests/modular/ollama-registry-lookup.test.ts
@@ -0,0 +1,248 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import axios, { AxiosError } from 'axios'
+import { lookupOllamaModel } from '@/electron/model-hub/ollama-registry'
+
+/**
+ * Exact-name lookup against Ollama's registry, the fallback for a model the
+ * committed catalog snapshot does not list. A lookup reads the manifest for the
+ * download size, then the config blob it points at for the model's own
+ * description of itself.
+ *
+ * `lookupOllamaModel` memoizes by name — including negative results — so every
+ * case below uses a distinct model name and a cache hit never masks a behavior
+ * under test. The one test that asserts caching does so explicitly.
+ */
+
+const CONFIG_DIGEST = 'sha256:455f34728c9b5dd9c69b6ba1dc93c0e69a1c3b2e4f5a6b7c8d9e0f1a2b3c4d5e'
+
+/** An OCI manifest shaped the way registry.ollama.ai answers. */
+const manifest = (modelLayerBytes: number, extraLayers: { mediaType: string }[] = []) => ({
+    schemaVersion: 2,
+    mediaType: 'application/vnd.docker.distribution.manifest.v2+json',
+    config: {
+        mediaType: 'application/vnd.docker.container.image.v1+json',
+        digest: CONFIG_DIGEST,
+        size: 487
+    },
+    layers: [
+        {
+            mediaType: 'application/vnd.ollama.image.model',
+            digest: 'sha256:aa',
+            size: modelLayerBytes
+        },
+        { mediaType: 'application/vnd.ollama.image.license', digest: 'sha256:cc', size: 11338 },
+        ...extraLayers.map(l => ({ ...l, digest: 'sha256:dd', size: 1000 }))
+    ]
+})
+
+/** The config blob Ollama writes, describing the model itself. */
+const config = {
+    model_format: 'gguf',
+    model_family: 'qwen35',
+    model_families: ['qwen35'],
+    model_type: '27.3B',
+    file_type: 'Q4_K_M'
+}
+
+/**
+ * Answer by URL, the way the registry does: manifests carry sizes and the
+ * config digest, blobs carry the model's description.
+ */
+const serve = (manifestBody: unknown, configBody: unknown = config) =>
+    vi.spyOn(axios, 'get').mockImplementation(async (url: string) => {
+        if (url.includes('/blobs/')) return { data: configBody }
+        return { data: manifestBody }
+    })
+
+const notFound = (): AxiosError => {
+    const err = new AxiosError('Request failed with status code 404')
+    err.response = {
+        status: 404,
+        statusText: 'Not Found',
+        data: 'not found',
+        headers: {},
+        config: { headers: new axios.AxiosHeaders() }
+    }
+    return err
+}
+
+afterEach(() => {
+    vi.restoreAllMocks()
+})
+
+describe('lookupOllamaModel', () => {
+    it('resolves a model and reports the total bytes the engine downloads', async () => {
+        serve(manifest(4_920_738_944))
+
+        const found = await lookupOllamaModel('resolve-test:8b')
+
+        expect(found?.name).toBe('resolve-test:8b')
+        // Every layer, not just the weights — that is what lands on disk.
+        expect(found?.size).toBe(4_920_738_944 + 11338)
+        // Ollama shows the manifest's config digest, shortened.
+        expect(found?.digest).toBe('455f34728c9b')
+        // Neither the manifest nor its headers carry a publication date; empty
+        // means unknown so the row hides its age rather than inventing one.
+        expect(found?.modified_at).toBe('')
+    })
+
+    it('describes the model from its config blob rather than from its tag', async () => {
+        serve(manifest(1000))
+
+        const found = await lookupOllamaModel('config-test:27b-coding-mxfp8')
+
+        // A tag is a label the publisher chose; the config carries the figures.
+        expect(found?.details.parameter_size).toBe('27.3B')
+        expect(found?.details.quantization_level).toBe('Q4_K_M')
+        expect(found?.details.format).toBe('gguf')
+        expect(found?.details.families).toEqual(['qwen35'])
+    })
+
+    it('falls back to the tag when the config states no parameter size', async () => {
+        // Ollama's MLX builds carry no `model_type`.
+        serve(manifest(1000), { model_format: 'safetensors', file_type: 'nvfp4' })
+
+        const found = await lookupOllamaModel('mlx-fallback-test:27b-mlx')
+
+        expect(found?.details.parameter_size).toBe('27b-mlx')
+        expect(found?.details.quantization_level).toBe('nvfp4')
+    })
+
+    it('reads vision off the projector layer, and claims no other capability', async () => {
+        serve(manifest(1000, [{ mediaType: 'application/vnd.ollama.image.projector' }]))
+        expect((await lookupOllamaModel('vision-test:27b'))?.details.family).toBe('vision')
+
+        // Tools and thinking come from ollama.com's rendered page and have no
+        // manifest equivalent, so a model without a projector claims nothing
+        // rather than claiming something wrong.
+        serve(manifest(1000, [{ mediaType: 'application/vnd.ollama.image.template' }]))
+        expect((await lookupOllamaModel('no-vision-test:8b'))?.details.family).toBe('')
+    })
+
+    it('still resolves when the config blob cannot be read', async () => {
+        vi.spyOn(axios, 'get').mockImplementation(async (url: string) => {
+            if (url.includes('/blobs/')) throw new Error('blob unavailable')
+            return { data: manifest(2048) }
+        })
+
+        // The size is the part that matters; the description is a bonus.
+        const found = await lookupOllamaModel('no-config-test:8b')
+        expect(found?.size).toBe(2048 + 11338)
+        expect(found?.details.parameter_size).toBe('8b')
+    })
+
+    it('implies the library namespace and the latest tag, like `ollama pull`', async () => {
+        const get = serve(manifest(1000))
+
+        await lookupOllamaModel('bare-name-test')
+
+        expect(get.mock.calls[0][0]).toBe(
+            'https://registry.ollama.ai/v2/library/bare-name-test/manifests/latest'
+        )
+    })
+
+    it('treats a dotted bare name as a model, not a registry hostname', async () => {
+        const get = serve(manifest(1000))
+
+        // Regression: the "dotted first segment is a hostname" rule that
+        // declines `hf.co/...` was once applied to lone segments too, which
+        // silently rejected most real Ollama names — `qwen3.8`, `llama3.1`,
+        // `phi3.5`. A single segment is always a name under `library`.
+        const found = await lookupOllamaModel('dotted.name.test')
+
+        expect(found).not.toBeNull()
+        expect(get.mock.calls[0][0]).toBe(
+            'https://registry.ollama.ai/v2/library/dotted.name.test/manifests/latest'
+        )
+    })
+
+    it('addresses a namespaced model without rewriting its namespace', async () => {
+        const get = serve(manifest(1000))
+
+        await lookupOllamaModel('some-user/namespaced-test:q4')
+
+        expect(get.mock.calls[0][0]).toBe(
+            'https://registry.ollama.ai/v2/some-user/namespaced-test/manifests/q4'
+        )
+    })
+
+    it('resolves a missing model to null without raising', async () => {
+        vi.spyOn(axios, 'get').mockRejectedValue(notFound())
+
+        // A lookup is speculative, so "not there" is an answer, not an error.
+        await expect(lookupOllamaModel('missing-model-test:1b')).resolves.toBeNull()
+    })
+
+    it('resolves to null when the registry cannot be reached', async () => {
+        vi.spyOn(axios, 'get').mockRejectedValue(new Error('getaddrinfo ENOTFOUND'))
+
+        await expect(lookupOllamaModel('offline-test:1b')).resolves.toBeNull()
+    })
+
+    it('asks again after the registry could not be reached', async () => {
+        vi.spyOn(axios, 'get').mockRejectedValue(new Error('getaddrinfo ENOTFOUND'))
+        await expect(lookupOllamaModel('retry-after-offline:1b')).resolves.toBeNull()
+
+        // A transient failure is not an answer, so it is not remembered.
+        vi.restoreAllMocks()
+        serve(manifest(1_000_000))
+        await expect(lookupOllamaModel('retry-after-offline:1b')).resolves.not.toBeNull()
+    })
+
+    it('declines a reference belonging to another registry', async () => {
+        const get = vi.spyOn(axios, 'get')
+
+        // A dot in the first of several segments is a registry hostname. This
+        // registry cannot answer for it, and asking would report a real model
+        // as missing.
+        await expect(lookupOllamaModel('hf.co/some-user/some-repo:Q4_K_M')).resolves.toBeNull()
+        expect(get).not.toHaveBeenCalled()
+    })
+
+    it('refuses a name that would steer the request URL', async () => {
+        const get = vi.spyOn(axios, 'get')
+
+        // The renderer screens queries before asking, but a lookup arrives over
+        // IPC and this runs in main, so it screens its own input. Unchecked,
+        // `foo/..` walks out of the namespace and `foo/bar#z` truncates the
+        // path, both landing on an endpoint nobody asked for.
+        for (const hostile of [
+            'foo/..',
+            'foo/bar?x=1',
+            'foo/bar#z',
+            'foo/bar:tag#z',
+            '../etc',
+            'foo//bar',
+            'foo/bar:'
+        ]) {
+            await expect(lookupOllamaModel(hostile)).resolves.toBeNull()
+        }
+        expect(get).not.toHaveBeenCalled()
+    })
+
+    it('declines a manifest that reports no layers rather than showing a 0-byte model', async () => {
+        serve({ schemaVersion: 2, layers: [] })
+
+        await expect(lookupOllamaModel('empty-manifest-test:1b')).resolves.toBeNull()
+    })
+
+    it('caches both answers so typing past a resolved name does not refetch', async () => {
+        const get = serve(manifest(2048))
+
+        const first = await lookupOllamaModel('cache-test:8b')
+        const second = await lookupOllamaModel('cache-test:8b')
+
+        expect(second).toBe(first)
+        // Manifest plus config blob for the first call, nothing for the second.
+        expect(get).toHaveBeenCalledTimes(2)
+
+        get.mockRejectedValue(notFound())
+        await expect(lookupOllamaModel('cache-miss-test:8b')).resolves.toBeNull()
+        await expect(lookupOllamaModel('cache-miss-test:8b')).resolves.toBeNull()
+        // One more call for the first miss; the second is served from the cache.
+        expect(get).toHaveBeenCalledTimes(3)
+    })
+})
diff --git a/desktop/tests/modular/structured-log-stdout.test.ts b/desktop/tests/modular/structured-log-stdout.test.ts
new file mode 100644
index 000000000..65710fc61
--- /dev/null
+++ b/desktop/tests/modular/structured-log-stdout.test.ts
@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { readFileSync } from 'fs'
+import { join } from 'path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createStructuredLogger, initFileLogger } from '@/shared/utils/log'
+import { assertIsolated } from '../fixtures/isolation'
+import { createTmpUserData } from '../fixtures/tmpdir'
+
+/**
+ * File append is already best-effort. Console write was not, so a closed
+ * stdout pipe became an uncaughtException in the Electron main process
+ * ("A JavaScript error occurred in the main process" / write EPIPE).
+ */
+describe('structured logger stdout', () => {
+    const tmp = createTmpUserData()
+
+    afterEach(() => {
+        vi.restoreAllMocks()
+    })
+
+    function paths() {
+        return {
+            getUserData: () => tmp.dir,
+            getTemp: () => tmp.dir,
+            getResourcesPath: () => process.cwd(),
+            getAppName: () => 'Personal AI Router'
+        }
+    }
+
+    it('does not throw when stdout.write fails with EPIPE', () => {
+        assertIsolated()
+        initFileLogger(paths())
+        vi.spyOn(process.stdout, 'write').mockImplementation(() => {
+            throw new Error('write EPIPE')
+        })
+        const log = createStructuredLogger('app')
+        expect(() => log.info({ sublevel: 'lifecycle', message: 'ping' })).not.toThrow()
+        const onDisk = readFileSync(join(tmp.dir, 'logs', 'nvpair.jsonl'), 'utf8')
+        expect(onDisk).toContain('"message":"ping"')
+    })
+
+    it('does not turn a later stdout error event into an uncaughtException', () => {
+        assertIsolated()
+        initFileLogger(paths())
+        expect(() => process.stdout.emit('error', new Error('write EPIPE'))).not.toThrow()
+    })
+})
diff --git a/services/nvpair-cluster-manager/httpserver.go b/services/nvpair-cluster-manager/httpserver.go
index 3165215de..41ed0cf44 100644
--- a/services/nvpair-cluster-manager/httpserver.go
+++ b/services/nvpair-cluster-manager/httpserver.go
@@ -209,7 +209,7 @@ func (m *Manager) handlePairingInitial(w http.ResponseWriter, env *pairingEnvelo
 			return out, err
 		}
 		if out.State == eapnoob.StateWaiting && !sess.invitedEmitted {
-			completed = m.prepareJoinerInitialComplete(env.InviteID, sess)
+			completed = m.prepareJoinerInitialComplete(env.InviteID, sess, inviterIP)
 		}
 		return out, nil
 	}()
@@ -500,12 +500,22 @@ func (m *Manager) handlePairingTerminalSignal(env *pairingEnvelope, state Invite
 // prepareJoinerInitialComplete captures the inviter's authenticated PairingInfo
 // while the caller holds sess.mu. The returned invite is published after that
 // lock is released so same-sender supersession can safely lock older sessions.
-func (m *Manager) prepareJoinerInitialComplete(inviteID string, sess *pairingSession) *Invite {
+func (m *Manager) prepareJoinerInitialComplete(inviteID string, sess *pairingSession, inviterIP string) *Invite {
 	pi, cert, err := parsePairingInfo(sess.peer.ServerInfo())
 	if err != nil {
 		log.Printf("pairing %s: cannot read inviter PairingInfo: %v", inviteID, err)
 		return nil
 	}
+	// The inviter's advertised link-local address carries the zone of its own
+	// interface; give it ours before it is dialled or recorded as the member's
+	// address, and keep it as an observation so a roster claim of the inviter's
+	// spelling cannot replace it.
+	if scoped := localScope(pi.Addr, inviterIP); scoped != pi.Addr {
+		pi.Addr = scoped
+		if host, _, err := net.SplitHostPort(scoped); err == nil {
+			m.noteObservedPeerHost(pi.NodeUUID, host)
+		}
+	}
 	sess.peerPairing = pi
 	sess.peerCert = cert
 	sess.addr = pi.Addr
diff --git a/services/nvpair-cluster-manager/invite.go b/services/nvpair-cluster-manager/invite.go
index 388acef19..e87d164d5 100644
--- a/services/nvpair-cluster-manager/invite.go
+++ b/services/nvpair-cluster-manager/invite.go
@@ -15,7 +15,9 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
 	"eapnoob"
@@ -331,7 +333,7 @@ func postPairingBlob(client *http.Client, target, inviteID, phase string, blob [
 	if err != nil {
 		return nil, err
 	}
-	resp, err := client.Post("http://"+target+pairingPath, "application/json", bytes.NewReader(body))
+	resp, err := client.Post(peerURL("http", target, pairingPath), "application/json", bytes.NewReader(body))
 	if err != nil {
 		return nil, err
 	}
@@ -376,7 +378,7 @@ func postPairingSignalScheme(client *http.Client, scheme, target, inviteID, phas
 	if err != nil {
 		return err
 	}
-	resp, err := client.Post(scheme+"://"+target+pairingPath, "application/json", bytes.NewReader(body))
+	resp, err := client.Post(peerURL(scheme, target, pairingPath), "application/json", bytes.NewReader(body))
 	if err != nil {
 		return err
 	}
@@ -495,6 +497,10 @@ func newInviteID() (string, error) {
 // outboundIP returns the local IP that routes to target, so the inviter can tell
 // the joiner where to POST the Completion Exchange. Returns "" if it can't be
 // determined (the joiner then falls back to the source address).
+//
+// A link-local target (fe80::/10) is only dialable with its scope zone, so the
+// zone is preserved on the returned address: dropping it made the joiner's
+// return POST unroutable and pairing failed after the PIN step (#69).
 func outboundIP(target string) string {
 	host, _, err := net.SplitHostPort(target)
 	if err != nil {
@@ -506,7 +512,47 @@ func outboundIP(target string) string {
 	}
 	defer conn.Close()
 	if ua, ok := conn.LocalAddr().(*net.UDPAddr); ok {
-		return ua.IP.String()
+		return scopedHost(ua)
 	}
 	return ""
 }
+
+// scopedHost renders the IP of a UDP address, preserving the scope zone that
+// link-local addresses (fe80::/10) require to be dialable. net.IP.String()
+// drops the zone; without it the address has no route.
+func scopedHost(ua *net.UDPAddr) string {
+	if ua.Zone != "" {
+		return ua.IP.String() + "%" + ua.Zone
+	}
+	return ua.IP.String()
+}
+
+// localScope gives an advertised link-local address the scope zone it needs on
+// this machine. A zone names an interface of the machine that wrote it, so the
+// one a peer advertises (its own %en0) is meaningless here; the right one is
+// that of the connection the peer reached us on, as seen locally (via). Any
+// other address is returned unchanged.
+func localScope(advertised, via string) string {
+	host, port, err := net.SplitHostPort(advertised)
+	if err != nil {
+		return advertised
+	}
+	bare, _, _ := strings.Cut(host, "%")
+	ip := net.ParseIP(bare)
+	if ip == nil || !ip.IsLinkLocalUnicast() || ip.To4() != nil {
+		return advertised
+	}
+	_, zone, _ := strings.Cut(via, "%")
+	if zone == "" {
+		return net.JoinHostPort(bare, port)
+	}
+	return net.JoinHostPort(bare+"%"+zone, port)
+}
+
+// peerURL renders scheme://hostport + path for a peer address. The host may
+// carry an IPv6 scope zone (fe80::…%en0); net/url percent-encodes it (%25en0,
+// RFC 6874) because a raw % is rejected as an invalid URL escape and the peer
+// would otherwise be undialable (#69).
+func peerURL(scheme, hostport, path string) string {
+	return (&url.URL{Scheme: scheme, Host: hostport, Path: path}).String()
+}
diff --git a/services/nvpair-cluster-manager/mtls.go b/services/nvpair-cluster-manager/mtls.go
index 2eff4c673..43d6cca3c 100644
--- a/services/nvpair-cluster-manager/mtls.go
+++ b/services/nvpair-cluster-manager/mtls.go
@@ -159,7 +159,7 @@ func (m *Manager) notifyPeerRemoval(addr, peerUUID string, proof RemovalProof) {
 		return
 	}
 	body, _ := json.Marshal(membersRemoveRequest{NodeUUID: m.identity.NodeUUID, Proof: proof})
-	resp, err := client.Post("https://"+addr+membersRemovePath, "application/json", bytes.NewReader(body))
+	resp, err := client.Post(peerURL("https", addr, membersRemovePath), "application/json", bytes.NewReader(body))
 	if err != nil {
 		log.Printf("notify removal to %s (%s): %v", addr, peerUUID, err)
 		return
diff --git a/services/nvpair-cluster-manager/pairing_linklocal_test.go b/services/nvpair-cluster-manager/pairing_linklocal_test.go
new file mode 100644
index 000000000..85c59555c
--- /dev/null
+++ b/services/nvpair-cluster-manager/pairing_linklocal_test.go
@@ -0,0 +1,156 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	"eapnoob"
+)
+
+// The joiner's Completion Exchange POST targets the inviter address carried in
+// PairingInfo.Addr. When the inviter was reached over IPv6 link-local, that
+// address is only dialable with its scope zone (#69).
+func TestScopedHostPreservesZone(t *testing.T) {
+	ua := &net.UDPAddr{IP: net.ParseIP("fe80::c16:bee4:c6a1:3fd"), Zone: "en0"}
+	if got := scopedHost(ua); got != "fe80::c16:bee4:c6a1:3fd%en0" {
+		t.Fatalf("scopedHost = %q, want the scope zone preserved", got)
+	}
+}
+
+func TestScopedHostWithoutZoneUnchanged(t *testing.T) {
+	for _, ip := range []string{"192.168.86.10", "fe80::1"} {
+		ua := &net.UDPAddr{IP: net.ParseIP(ip)}
+		if got := scopedHost(ua); got != ip {
+			t.Errorf("scopedHost(%q) = %q, want unchanged", ip, got)
+		}
+	}
+}
+
+// outboundIP against loopback must keep returning the bare IP (no zone).
+func TestOutboundIPLoopbackHasNoZone(t *testing.T) {
+	if got := outboundIP("127.0.0.1:9"); got != "127.0.0.1" {
+		t.Fatalf("outboundIP = %q, want 127.0.0.1", got)
+	}
+}
+
+// A raw % in the URL host is rejected as an invalid URL escape, so the zone
+// must be percent-encoded (RFC 6874) for the joiner's return POST to parse.
+func TestPeerURLZoneEncoding(t *testing.T) {
+	got := peerURL("http", "[fe80::c16:bee4:c6a1:3fd%en0]:14321", "/v1/cluster/pairing")
+	want := "http://[fe80::c16:bee4:c6a1:3fd%25en0]:14321/v1/cluster/pairing"
+	if got != want {
+		t.Fatalf("peerURL = %q, want %q", got, want)
+	}
+	u, err := url.Parse(got)
+	if err != nil {
+		t.Fatalf("peerURL output does not parse: %v", err)
+	}
+	if u.Hostname() != "fe80::c16:bee4:c6a1:3fd%en0" || u.Port() != "14321" {
+		t.Fatalf("reparsed host = %q port = %q, zone lost", u.Hostname(), u.Port())
+	}
+}
+
+func TestPeerURLPlainHostportUnchanged(t *testing.T) {
+	got := peerURL("https", "192.168.86.10:14321", "/v1/cluster/members/remove")
+	want := "https://192.168.86.10:14321/v1/cluster/members/remove"
+	if got != want {
+		t.Fatalf("peerURL = %q, want %q", got, want)
+	}
+}
+
+// A zone names an interface of the machine that wrote it. The inviter's
+// advertised %en0 means nothing to a joiner whose interface is eth0; the
+// joiner dials with the zone of the connection the inviter reached it on.
+func TestLocalScopeUsesTheReceivingInterface(t *testing.T) {
+	for _, tc := range []struct{ advertised, via, want string }{
+		{"[fe80::1%en0]:14321", "fe80::1%eth0", "[fe80::1%eth0]:14321"},
+		{"[fe80::1]:14321", "fe80::1%eth0", "[fe80::1%eth0]:14321"},
+		{"[fe80::1%en0]:14321", "192.168.1.5", "[fe80::1]:14321"},
+		{"192.168.1.5:14321", "fe80::1%eth0", "192.168.1.5:14321"},
+		{"[2001:db8::1]:14321", "fe80::1%eth0", "[2001:db8::1]:14321"},
+	} {
+		if got := localScope(tc.advertised, tc.via); got != tc.want {
+			t.Errorf("localScope(%q, %q) = %q, want %q", tc.advertised, tc.via, got, tc.want)
+		}
+	}
+}
+
+type recordingTransport struct{ urls []string }
+
+func (r *recordingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	r.urls = append(r.urls, req.URL.String())
+	return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("")), Request: req}, nil
+}
+
+// Decline, fail and expire signals go to the same scoped addresses as the
+// pairing exchange, so they need the same URL encoding.
+func TestPairingSignalReachesAScopedTarget(t *testing.T) {
+	rt := &recordingTransport{}
+	client := &http.Client{Transport: rt}
+	for _, scheme := range []string{"http", "https"} {
+		if err := postPairingSignalScheme(client, scheme, "[fe80::1%en0]:14321", "inv-1", "decline", ""); err != nil {
+			t.Fatalf("%s: %v", scheme, err)
+		}
+	}
+	want := []string{"http://[fe80::1%25en0]:14321/v1/cluster/pairing", "https://[fe80::1%25en0]:14321/v1/cluster/pairing"}
+	if len(rt.urls) != 2 || rt.urls[0] != want[0] || rt.urls[1] != want[1] {
+		t.Fatalf("urls = %v, want %v", rt.urls, want)
+	}
+}
+
+// The joiner dials, and records as the member's address, the inviter's
+// advertised link-local address with the zone of its own receiving interface,
+// not the inviter's.
+func TestJoinerRecordsTheInviterWithItsOwnZone(t *testing.T) {
+	inviter := testManagerAt(t, t.TempDir(), 15221)
+	joiner := testManagerAt(t, t.TempDir(), 15222)
+	inviterEpoch, err := inviter.reserveAdmissionEpoch()
+	if err != nil {
+		t.Fatal(err)
+	}
+	joinerEpoch, err := joiner.reserveAdmissionEpoch()
+	if err != nil {
+		t.Fatal(err)
+	}
+	serverInfo, err := inviter.localPairingInfo("[fe80::1%en0]:15221", inviterEpoch).toMap()
+	if err != nil {
+		t.Fatal(err)
+	}
+	peerInfo, err := joiner.localPairingInfo("[fe80::2%eth0]:15222", joinerEpoch).toMap()
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := newPairingServer(serverInfo)
+	peer := newPairingPeer(peerInfo)
+	msg, err := server.Start()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for peerTurn := true; len(msg) > 0; peerTurn = !peerTurn {
+		var out eapnoob.Outcome
+		if peerTurn {
+			out, err = peer.Receive(msg)
+		} else {
+			out, err = server.Receive(msg)
+		}
+		if err != nil || out.Err != nil {
+			t.Fatalf("initial exchange: %v %v", err, out.Err)
+		}
+		msg = out.Send
+	}
+	sess := &pairingSession{inviteID: "inv-ll", role: roleJoiner, peer: peer}
+	if joiner.prepareJoinerInitialComplete("inv-ll", sess, "fe80::1%eth0") == nil {
+		t.Fatal("no invite prepared")
+	}
+	want := "[fe80::1%eth0]:15221"
+	if sess.addr != want || sess.peerPairing.Addr != want {
+		t.Fatalf("dial %q, recorded %q, want %q for both", sess.addr, sess.peerPairing.Addr, want)
+	}
+}
diff --git a/services/nvpair-cluster-manager/roster_http.go b/services/nvpair-cluster-manager/roster_http.go
index 8157d729e..f78425b91 100644
--- a/services/nvpair-cluster-manager/roster_http.go
+++ b/services/nvpair-cluster-manager/roster_http.go
@@ -265,7 +265,7 @@ func confirmedFirst(addrs []string, confirmed string) []string {
 // reconcileWith to try the next candidate; every actual response — including a
 // rejection — is that peer's answer and ends the walk.
 func (m *Manager) reconcileOnce(ctx context.Context, client *http.Client, body []byte, addr, peerUUID string) (outcome reconcileOutcome, provenRemoval, answered bool) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://"+addr+rosterPath, bytes.NewReader(body))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, peerURL("https", addr, rosterPath), bytes.NewReader(body))
 	if err != nil {
 		log.Printf("roster: build reconcile request for %s (%s): %v", addr, peerUUID, err)
 		return reconcileUnreachable, false, false