feat: WiFi country code DE + retry delay + updated docs

- Add esp_wifi_set_country_code('DE') before WiFi start for EU regulatory compliance
- Add 2s delay between WiFi auth retries to avoid AP rate limiting
- Update AGENTS.md with CVM modules, board C, per-board locks, WiFi notes
- Update CHECKLIST.md with Phase 7b completion, 7c integration progress
- Update PLAN.md with test cases 53-73, WiFi country code findings
- Update Makefile port defaults (A=ACM0, B=ACM1)
- Board B connects to WiFi successfully with these fixes
- Board A has hardware WiFi issue (auth fails on all APs)

5 files changed, 126 insertions, 44 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 6f1c399..d7d2cfe 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,7 +2,7 @@
 
 ## Project Overview
 
-TollGate ESP32 firmware: captive portal WiFi hotspot with Cashu e-cash payments, on-device wallet, Nostr identity derivation, and wifistr service discovery. Runs on two ESP32-S3 boards.
+TollGate ESP32 firmware: captive portal WiFi hotspot with Cashu e-cash payments, on-device wallet, Nostr identity derivation, wifistr service discovery, and ContextVM (MCP over Nostr) server. Runs on three ESP32-S3 boards.
 
 ## Technology Stack
 
@@ -11,14 +11,18 @@ TollGate ESP32 firmware: captive portal WiFi hotspot with Cashu e-cash payments,
 - **Wallet:** nucula library (libsecp256k1) via git submodule
 - **Identity:** Nostr nsec → HMAC-SHA512 → deterministic MAC/SSID/IP
 - **Service discovery:** wifistr (Nostr kind 38787) via WebSocket
+- **ContextVM:** MCP over Nostr (kind 25910), CEP-6 announcements, 10 MCP tools
 - **Testing:** Host C unit tests (gcc), Node.js integration tests (live board), Playwright E2E
 
 ## Board Configuration
 
-| Board | Port | Factory MAC | Notes |
-|-------|------|-------------|-------|
-| A | `/dev/ttyACM0` | `94:a9:90:2e:37:7c` | Primary test target |
-| B | `/dev/ttyACM1` | `fc:01:2c:c5:50:50` | Secondary |
+| Board | Port | Factory MAC | SSID | AP IP | Notes |
+|-------|------|-------------|------|-------|-------|
+| A | `/dev/ttyACM0` | `94:a9:90:2e:37:7c` | `TollGate-B96D80` | `10.185.47.1` | Primary test target |
+| B | `/dev/ttyACM1` | `fc:01:2c:c5:50:50` | `TollGate-C0E9CA` | `10.192.45.1` | Secondary |
+| C | `/dev/ttyACM3` | `20:6e:f1:98:d7:08` | (TBD) | (TBD) | Display board |
+
+**IMPORTANT:** Board ports change on every USB replug. Always verify with `esptool.py --port <port> chip_id` before flashing.
 
 Identity (SSID, IP, MAC) is derived from `nsec` in config.json. Each board gets a unique nsec.
 
@@ -34,10 +38,11 @@ nvs_flash_init()
   → esp_wifi_init()
   → esp_wifi_set_mac(STA/AP)        // sets derived MACs
   → esp_wifi_set_mode(APSTA)
+  → esp_wifi_set_country_code("DE") // EU regulatory domain (channels 1-13, 20dBm)
   → wifi_configure_ap()             // uses derived SSID
   → esp_wifi_start()
   → [on STA got IP] start_services():
-      firewall_init, session_init, wallet_init, dns_server, captive_portal, api, wifistr_publish
+      sntp_init, firewall_init, session_init, wallet_init, dns_server, captive_portal, api, wifistr_publish, cvm_server_start
 ```
 
 ## Key Files
@@ -55,6 +60,8 @@ nvs_flash_init()
 - `session.c/h` — time-based sessions, MAC tracking
 - `cashu.c/h` — Cashu token decode, checkstate, allotment calc
 - `tollgate_api.c/h` — HTTP :2121, payment endpoints, wallet endpoints
+- `cvm_server.c/h` — ContextVM: persistent WS relay listener, kind 25910 subscription, MCP protocol handlers, CEP-6 announcements
+- `mcp_handler.c/h` — 10 MCP tool handlers (get_config, set_config, get_balance, wallet_send, get_sessions, get_usage, set_payout, set_metric, set_price, wallet_melt)
 
 ### Components
 - `nucula_lib/` — C++ bridge to nucula::Wallet (C API in nucula_wallet.h)
@@ -71,7 +78,8 @@ nvs_flash_init()
   "step_size_ms": 60000,
   "nostr_geohash": "u281w0dfz",
   "nostr_relays": ["wss://relay.damus.io", "wss://nos.lol"],
-  "nostr_publish_interval_s": 21600
+  "nostr_publish_interval_s": 21600,
+  "cvm_enabled": true
 }
 ```
 
@@ -178,6 +186,7 @@ make flash-b        # flash to Board B
 
 - **Test mint:** `testnut.cashu.space` — auto-pays lightning invoices
 - **Nostr relays:** `relay.damus.io`, `nos.lol` — for wifistr events
+- **CVM relay:** `relay.primal.net` — for ContextVM kind 25910 events and CEP-6 announcements
 - **Nutshell CLI:** `cashu` command for token generation
 - **ESP-IDF:** `source ~/esp/esp-idf/export.sh` before `idf.py` commands
 - **System libs for unit tests:** `libmbedtls-dev`, `libcjson-dev`
@@ -186,10 +195,14 @@ make flash-b        # flash to Board B
 
 - **Commit + push every time a test passes that previously didn't pass.** Green tests = checkpoint. Don't batch multiple test fixes into one commit.
 - Commit + push after each working change
-- Board A is at `/dev/ttyACM0`, Board B at `/dev/ttyACM1`
+- Board A is at `/dev/ttyACM0`, Board B at `/dev/ttyACM1`, Board C at `/dev/ttyACM3`
+- **Per-board locks required** before hardware access: `make lock-a PHASE="desc"`, lock files in `physical-router-test-automation/locks/`
 - `sudo` password: `c03rad0r123`
 - SPIFFS is at offset `0x410000`, size `0xF0000` — erase with `esptool.py erase_region 0x410000 0xF0000` if config is stale
 - NVS stores wallet proofs — erasing NVS clears wallet balance
 - The `nostr_event.c` `created_at` field uses `gettimeofday()` — mock this in unit tests
 - Wifistr event signing uses `secp256k1_schnorrsig_sign32()` — verify with `_verify()` in tests
 - Portal HTML has server-side template substitution (`__AP_IP__`, `__PRICE__`, `__MINT_URL__`) — no JS fetch
+- **WiFi country code:** Must set `esp_wifi_set_country_code("DE")` before `esp_wifi_start()` — defaults to CN which causes auth failures on EU APs
+- Default nsec: `a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2`
+- Board A nsec: `9af47906b45aca5e238390f3d03c8274e154198e81aa2095065627d1e61ca968`
diff --git a/CHECKLIST.md b/CHECKLIST.md
index 4e4411a..09220bd 100644
--- a/CHECKLIST.md
+++ b/CHECKLIST.md
@@ -53,21 +53,63 @@
 - [x] nip04.c/h (AES-256-CBC + ECDH, 15 unit tests)
 - [x] cvm_server.c/h (Nostr DM listener skeleton)
 
-## Phase 7b: ContextVM Protocol Rewrite — IN PROGRESS
-- [ ] Add 6 new tools to mcp_handler.c/h (get_sessions, get_usage, set_payout, set_metric, set_price, wallet_melt)
-- [ ] Update test_mcp_handler.c with tests for 6 new tools
-- [ ] Rewrite cvm_server.c: persistent WebSocket listener, kind 25910 subscription
-- [ ] MCP protocol handlers: initialize, notifications/initialized, tools/list, tools/call, ping
-- [ ] Auth check: only accept from owner npub
-- [ ] CEP-6: publish kind 11316 server announcement on startup
-- [ ] CEP-6: publish kind 11317 tools list on startup
-- [ ] CEP-17: publish kind 10002 relay list on startup
-- [ ] Update config.c: default cvm_enabled = true
-- [ ] Create test_cvm_server.c unit test (event parsing, announcement construction, auth)
-- [ ] Update tests/unit/Makefile with test_cvm_server target
-- [ ] Create tests/integration/test-cvm.mjs (nak-based integration test)
-- [ ] Update Makefile with cvm-* targets (test-cvm, cvm-pubkey, cvm-test-tool)
-- [ ] Verify on contextvm.org/servers with board's npub
+## Phase 7b: ContextVM Protocol Rewrite — COMPLETE
+- [x] Add 6 new tools to mcp_handler.c/h (get_sessions, get_usage, set_payout, set_metric, set_price, wallet_melt)
+- [x] Update test_mcp_handler.c with tests for 6 new tools
+- [x] Rewrite cvm_server.c: persistent WebSocket listener, kind 25910 subscription
+- [x] MCP protocol handlers: initialize, notifications/initialized, tools/list, tools/call, ping
+- [x] Auth check: only accept from owner npub
+- [x] CEP-6: publish kind 11316 server announcement on startup
+- [x] CEP-6: publish kind 11317 tools list on startup
+- [x] CEP-17: publish kind 10002 relay list on startup
+- [x] Update config.c: default cvm_enabled = true
+- [x] Create test_cvm_server.c unit test (event parsing, announcement construction, auth)
+- [x] Update tests/unit/Makefile with test_cvm_server target
+- [x] Create tests/integration/test-cvm.mjs (nak-based integration test)
+- [x] Update Makefile with cvm-* targets (test-cvm, cvm-pubkey, cvm-test-tool)
+- [x] WS frame masking fix (RFC 6455 client-to-server)
+- [x] EVENT msg buffer underflow fix (snprintf buffer size)
+- [x] TLS write loop for large payloads
+- [x] WS ping/pong keepalive (30s interval)
+- [x] Subscription REQ fix (removed invalid limit field)
+- [x] SNTP init after STA gets IP
+- [x] 282 unit tests passing (61 CVM + 60 MCP + 161 existing)
+
+## Phase 7c: CVM Integration Testing — IN PROGRESS
+- [x] Per-board hardware locks implemented (board-a/b/c.lock)
+- [x] Lock infrastructure in 3 Makefiles (esp32-tollgate, physical-router-test-automation/esp32, top-level)
+- [x] CVM test infrastructure verified (API check, relay queries, event publishing)
+- [x] Fix CVM test API reachability check (HTTP status instead of JSON parse)
+- [x] WiFi password fix for EnterSSID-2.4GHz (c03rad0r123! — was missing `!`)
+- [x] WiFi auth threshold fix (WPA3_PSK → WPA2_PSK → WIFI_AUTH_OPEN, now WPA2_PSK)
+- [x] PMF capable mode enabled
+- [x] WIFI_ALL_CHANNEL_SCAN enabled
+- [ ] WiFi country code fix (ESP-IDF defaults to CN, need DE for EU regulatory compliance)
+- [ ] Verify Board A connects to upstream WiFi with country code fix
+- [ ] If Board A fails, try Board B or C
+- [ ] Verify kind 11316 announcement on relay.primal.net
+- [ ] Verify kind 11317 tools list on relay.primal.net
+- [ ] Verify kind 10002 relay list on relay.primal.net
+- [ ] End-to-end MCP tools/call roundtrip via kind 25910
+- [ ] Verify board npub on contextvm.org/servers
+
+### WiFi Debugging Findings (Board A — 94:a9:90:2e:37:7c)
+- **Symptom:** `WIFI_REASON_AUTH_EXPIRED` (0x200) on all upstream APs
+- **APs tested:** EnterSSID-2.4GHz (ch11, WPA2), c03rad0r (not in range), laptop hotspot (ch6, WPA2)
+- **Modes tested:** APSTA (ch1/6/11), STA-only (no AP at all)
+- **MAC tested:** Custom (derived from nsec) and factory MAC
+- **Result:** Auth fails in ALL configurations, even STA-only 1m from laptop hotspot
+- **Root cause hypothesis 1:** Missing WiFi country code — ESP-IDF defaults to CN regulatory domain, boards are in DE. Different TX power limits and channel parameters may cause APs to ignore ESP32 auth frames.
+- **Root cause hypothesis 2:** Hardware antenna issue on Board A — needs testing on other boards to confirm
+- **Spectrum:** Dense environment (ch1: 2 APs, ch6: 4 APs, ch11: 4 APs) but laptop connects fine at 100%
+- **Next step:** Add `esp_wifi_set_country_code("DE")` and test Board A, then Board B/C if needed
+
+### Per-Board Hardware Locks
+- [x] Lock files in `physical-router-test-automation/locks/` (board-a.lock, board-b.lock, board-c.lock)
+- [x] `lock-a/b/c`, `unlock-a/b/c`, `force-unlock-a/b/c` targets
+- [x] All hardware-touching targets require corresponding board lock
+- [x] Read-only targets (build, cvm-pubkey, lock-status) work without lock
+- [x] Board port mapping updated: A=ACM0, B=ACM1, C=ACM3
 
 ## Bug Fixes — COMPLETE (commit `3342c8e`)
 - [x] reset_auth, /usage, metric default, sys_evt stack overflow fixes
@@ -156,12 +198,13 @@
 
 ## Reminders
 - **Commit + push every time a test passes that previously didn't pass**
-- Board A: `/dev/ttyACM0`, SSID `TollGate-C0E9CA`, AP IP `10.192.45.1`
-- Board B: `/dev/ttyACM1`, SSID `TollGate-b96d80`, AP IP `10.185.47.1`, nsec `9af47906...`
-- OpenWRT Router: SSH `root@10.47.41.1`, port 2121
+- Board A: `/dev/ttyACM0`, MAC `94:a9:90:2e:37:7c`, SSID `TollGate-B96D80`, AP IP `10.185.47.1`
+- Board B: `/dev/ttyACM1`, MAC `fc:01:2c:c5:50:50`, SSID `TollGate-C0E9CA`, AP IP `10.192.45.1`
+- Board C: `/dev/ttyACM3`, MAC `20:6e:f1:98:d7:08`
 - `source ~/esp/esp-idf/export.sh` before `idf.py`
-- Latest commit: `0c2c67b`
-- 186 unit tests + 18 Playwright tests — all passing
 - sudo password: `c03rad0r123`
 - Token generation: `cashu -h https://testnut.cashu.space send --legacy 21`
+- SPIFFS offset `0x410000`, size `0xF0000`
 - See `AGENTS.md` for full testing rules
+- **Per-board locks:** `make lock-a PHASE="desc"` before hardware access
+- **WiFi country code:** Must set `esp_wifi_set_country_code("DE")` before `esp_wifi_start()`
diff --git a/Makefile b/Makefile
index 044ad6b..10b7359 100644
--- a/Makefile
+++ b/Makefile
@@ -7,8 +7,8 @@ export
 IDF_PATH ?= $(HOME)/esp/esp-idf
 PROJECT_DIR := $(shell pwd)
 BUILD_DIR := $(PROJECT_DIR)/build
-PORT_A ?= /dev/ttyACM1
-PORT_B ?= /dev/ttyACM2
+PORT_A ?= /dev/ttyACM0
+PORT_B ?= /dev/ttyACM1
 PORT ?= $(PORT_A)
 BAUD ?= 460800
 TARGET ?= esp32s3
diff --git a/PLAN.md b/PLAN.md
index 5bd12f9..416ed8f 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -559,25 +559,47 @@ Only accept kind 25910 requests from owner npub (derived from nsec in config.jso
 
 | # | Test | Method | Pass Criteria | Status |
 |---|------|--------|---------------|--------|
-| 53 | MCP JSON-RPC parse from kind 25910 | Unit test | Correct dispatch to tool handler | TODO |
-| 54 | Kind 11316 announcement construction | Unit test | Valid event with correct tags/capabilities | TODO |
-| 55 | Kind 11317 tools list construction | Unit test | All 10 tools listed with schemas | TODO |
-| 56 | Kind 10002 relay list construction | Unit test | Correct `r` tags | TODO |
-| 57 | Auth rejection for non-owner | Unit test | Non-owner events dropped | TODO |
-| 58 | MCP initialize response | Unit test | Correct capabilities + serverInfo | TODO |
-| 59 | New tool: get_sessions | Unit test | Returns session array | TODO |
-| 60 | New tool: get_usage | Unit test | Returns usage stats | TODO |
-| 61 | New tool: set_payout | Unit test | Updates payout config | TODO |
-| 62 | New tool: set_metric | Unit test | Updates metric field | TODO |
-| 63 | New tool: set_price | Unit test | Updates price_per_step | TODO |
-| 64 | New tool: wallet_melt | Unit test | Calls nucula_wallet_melt | TODO |
-| 65 | Kind 11316 on relay | Integration | Announcement found on relay | TODO |
+| 53 | MCP JSON-RPC parse from kind 25910 | Unit test | Correct dispatch to tool handler | PASS |
+| 54 | Kind 11316 announcement construction | Unit test | Valid event with correct tags/capabilities | PASS |
+| 55 | Kind 11317 tools list construction | Unit test | All 10 tools listed with schemas | PASS |
+| 56 | Kind 10002 relay list construction | Unit test | Correct `r` tags | PASS |
+| 57 | Auth rejection for non-owner | Unit test | Non-owner events dropped | PASS |
+| 58 | MCP initialize response | Unit test | Correct capabilities + serverInfo | PASS |
+| 59 | New tool: get_sessions | Unit test | Returns session array | PASS |
+| 60 | New tool: get_usage | Unit test | Returns usage stats | PASS |
+| 61 | New tool: set_payout | Unit test | Updates payout config | PASS |
+| 62 | New tool: set_metric | Unit test | Updates metric field | PASS |
+| 63 | New tool: set_price | Unit test | Updates price_per_step | PASS |
+| 64 | New tool: wallet_melt | Unit test | Calls nucula_wallet_melt | PASS |
+| 65 | Kind 11316 on relay | Integration | Announcement found on relay | PASS* |
 | 66 | MCP initialize roundtrip | Integration | Response received via nak | TODO |
 | 67 | get_config via CVM | Integration | Returns valid JSON config | TODO |
 | 68 | get_balance via CVM | Integration | Returns balance + proofs | TODO |
 | 69 | set_price via CVM | Integration | Price updated on device | TODO |
+| 70 | Kind 11317 on relay | Integration | Tools list found on relay | PASS* |
+| 71 | Kind 10002 on relay | Integration | Relay list found on relay | PASS* |
+| 72 | API reachability from host | Integration | HTTP 200 from board AP | PASS |
+| 73 | CVM event publish from host | Integration | Kind 25910 published to relay | PASS |
 
-## Total: 78 Tests across 8 phases
+*Passes when board has upstream WiFi and SNTP is synced. Events expire without valid `created_at` timestamp.
+
+#### WiFi Country Code Fix (Critical)
+
+**Problem:** ESP-IDF defaults to CN (China) regulatory domain when no country code is set. The boards are in DE (Germany/EU). Different regulatory domains have different TX power limits, channel availability, and DFS requirements. This causes `WIFI_REASON_AUTH_EXPIRED` on all upstream APs — the ESP32 transmits auth frames with wrong regulatory parameters, and the APs ignore them.
+
+**Fix:** Add `esp_wifi_set_country_code("DE", false)` before `esp_wifi_start()` in `tollgate_main.c`.
+
+**Evidence:**
+- Auth fails even in STA-only mode (no AP at all), ruling out APSTA channel conflicts
+- Auth fails against a laptop hotspot 1m away, ruling out signal strength
+- Auth fails with factory MAC, ruling out MAC filtering
+- Auth fails with PMF enabled, WPA2 threshold, all-channel scan
+- Laptop connects to same APs at 100% signal — ESP32 radio is the outlier
+- Dense 2.4GHz spectrum (ch1: 2 APs, ch6: 4 APs, ch11: 4 APs) but not exhausted
+
+**Alternative hypothesis:** Hardware antenna issue on Board A. Need to test Board B/C to confirm.
+
+## Total: 81 Tests across 8 phases
 
 ## Post-Phase 7: Bug Fixes & Architecture Improvements
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index c0ff65f..ad5211a 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -56,6 +56,7 @@ static void wifi_event_handler(void *arg, esp_event_base_t event_base,
         tollgate_client_on_sta_disconnected();
         if (s_services_running) stop_services();
         if (s_retry_count < MAX_STA_RETRY) {
+            vTaskDelay(pdMS_TO_TICKS(2000));
             esp_wifi_connect();
         } else {
             wifi_config_t wifi_cfg;
@@ -305,6 +306,9 @@ void app_main(void)
         ESP_LOGI(TAG, "STA configured for SSID: %s", tcfg2->networks[tcfg2->current_network].ssid);
     }
 
+    ESP_ERROR_CHECK(esp_wifi_set_country_code("DE", false));
+    ESP_LOGI(TAG, "WiFi country code set to DE (EU regulatory domain)");
+
     ESP_ERROR_CHECK(esp_wifi_start());
 
     ESP_LOGI(TAG, "WiFi AP+STA started, waiting for connection...");