feat(wallet): lazy keyset loading with exponential backoff + jitter

- Remove eager load_keysets() from init_wallet(), load on first use
- Add ensure_keysets() with binary exponential backoff + random jitter
- Guard all wallet operations (receive, send, melt, swap_all) with ensure_keysets()
- Skip checkstate on TLS failure, let wallet swap verify proofs instead
- Pin HTTP server to core 0 (fixes TLS cert verification in checkstate)
- Rewrite nucula http.c to use manual open/write/read (same as working health probe)
- Disable hardware MPI (CONFIG_MBEDTLS_HARDWARE_MPI=n)
- Add http.h stub for unit tests

Known issue: progressive TLS failure after 2-3 connections (PK verify 0x4290),
wallet receive swap fails. Needs deeper mbedTLS/PSRAM investigation.

6 files changed, 194 insertions, 23 deletions

diff --git a/PLAN_lazy_keysets.md b/PLAN_lazy_keysets.md
new file mode 100644
index 0000000..a92dbf3
--- /dev/null
+++ b/PLAN_lazy_keysets.md
@@ -0,0 +1,67 @@
+# Plan: Lazy Keyset Loading + Jittered Exponential Backoff
+
+## Problem
+`nucula_wallet_init()` calls `load_keysets()` which does HTTPS to the mint. At boot (~3s after STA gets IP), other services are initializing, internal RAM is fragmented, and TLS allocation fails. Wallet ends up with zero keysets → `receive()` fails because `active_keyset()` returns null.
+
+## Solution
+Lazy keyset loading (load on first use) + exponential backoff with jitter on failure. Blocking approach — no background task.
+
+## Checklist
+
+### Implementation — DONE
+- [x] Add per-slot state tracking (`s_keysets_loaded`, `s_keyset_attempts`, delay constants)
+- [x] Add `ensure_keysets(int slot)` helper with exponential backoff + jitter
+- [x] Remove eager `load_keysets()` from `init_wallet()`
+- [x] Add `ensure_keysets()` guard to `nucula_wallet_receive()`
+- [x] Add `ensure_keysets()` guard to `nucula_wallet_send()`
+- [x] Add `ensure_keysets()` guard to `nucula_wallet_melt()`
+- [x] Add `ensure_keysets()` guard to `nucula_wallet_swap_all()`
+- [x] Add required includes (`freertos/FreeRTOS.h`, `freertos/task.h`, `esp_random.h`)
+- [x] Fix lazy keyset loading success log (save attempts before reset)
+
+### TLS Fixes — DONE
+- [x] Skip checkstate on TLS failure, let wallet swap verify (tollgate_api.c)
+- [x] Pin HTTP server to core 0 (fixes checkstate and keyset TLS)
+- [x] Rewrite nucula http.c to use manual open/write/read path (same as working health probe)
+- [x] Disable hardware MPI (CONFIG_MBEDTLS_HARDWARE_MPI=n, did not fix but kept for safety)
+- [x] Add 2s delay after ensure_keysets before receive to let TLS resources free
+
+### Verification — DONE
+- [x] `make test-unit` passes (407/407)
+- [x] Firmware builds and flashes to Board A
+- [x] Payment accepted (session created with correct allotment)
+- [x] Keyset loading succeeds on first use (lazy loading confirmed via serial)
+- [x] Checkstate succeeds (Certificate validated via serial)
+
+### Remaining Issue — TLS Progressive Failure
+- [ ] After 2-3 TLS connections, subsequent connections fail with `PK verify failed 0x4290`
+- [ ] This affects the wallet's swap POST (3rd TLS connection in payment flow)
+- [ ] Root cause: internal RAM fragmentation after multiple TLS handshakes
+- [ ] Workaround tried: core pinning, manual HTTP client, hardware MPI disable, delays
+- [ ] **Next step**: Investigate mbedTLS internal allocations, consider forcing SSL context to PSRAM, or use `mbedtls_ssl_session_reset()` to reuse SSL context
+
+## Design Details
+
+### Parameters
+- `BASE_DELAY_MS = 1000` (1s initial delay)
+- `MAX_DELAY_MS = 30000` (30s cap)
+- `JITTER_MS = 500` (random 0-500ms added)
+- No max attempts — retries indefinitely until success
+
+### ensure_keysets(slot) logic
+1. If `s_keysets_loaded[slot]` → return true (no-op)
+2. If `s_wallets[slot]->keysets()` non-empty → set loaded flag, return true (NVS cache hit)
+3. Compute `delay = min(BASE_DELAY_MS << attempts, MAX_DELAY_MS) + (esp_random() % JITTER_MS)`
+4. `vTaskDelay(delay / portTICK_PERIOD_MS)`
+5. Call `s_wallets[slot]->load_keysets()`
+   - Success → set loaded flag, log success, return true
+   - Failure → increment attempts counter, return false
+
+### Key Changes
+| File | Change |
+|------|--------|
+| `components/nucula_lib/nucula_wallet.cpp` | Lazy keysets + ensure_keysets guards |
+| `main/tollgate_api.c` | Skip checkstate on failure, core_id=0 |
+| `nucula_src/main/http.c` | Manual open/write/read (same as health probe) |
+| `sdkconfig.defaults` | MBEDTLS_HARDWARE_MPI=n |
+| `tests/unit/stubs/http.h` | Stub for unit tests |
diff --git a/components/nucula_lib/nucula_wallet.cpp b/components/nucula_lib/nucula_wallet.cpp
index 7c9141d..278c9bc 100644
--- a/components/nucula_lib/nucula_wallet.cpp
+++ b/components/nucula_lib/nucula_wallet.cpp
@@ -4,8 +4,11 @@
 #include "crypto.h"
 #include "hex.h"
 #include "esp_log.h"
+#include "esp_random.h"
 #include "secp256k1.h"
 #include "cJSON.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
 #include <cstring>
 #include <string>
 #include <vector>
@@ -18,6 +21,55 @@ static secp256k1_context *s_ctx = nullptr;
 static cashu::Wallet *s_wallets[MAX_WALLETS] = {};
 static int s_wallet_count = 0;
 static char s_wallet_urls[MAX_WALLETS][256] = {};
+static bool s_keysets_loaded[MAX_WALLETS] = {};
+static int s_keyset_attempts[MAX_WALLETS] = {};
+
+static const int KEYSET_BASE_DELAY_MS = 1000;
+static const int KEYSET_MAX_DELAY_MS = 30000;
+static const int KEYSET_JITTER_MS = 500;
+
+static bool ensure_keysets(int slot)
+{
+    if (slot < 0 || slot >= MAX_WALLETS || !s_wallets[slot])
+        return false;
+
+    if (s_keysets_loaded[slot])
+        return true;
+
+    if (!s_wallets[slot]->keysets().empty()) {
+        s_keysets_loaded[slot] = true;
+        return true;
+    }
+
+    int delay_ms = KEYSET_BASE_DELAY_MS << s_keyset_attempts[slot];
+    if (delay_ms > KEYSET_MAX_DELAY_MS)
+        delay_ms = KEYSET_MAX_DELAY_MS;
+    delay_ms += (int)(esp_random() % KEYSET_JITTER_MS);
+
+    ESP_LOGI(TAG, "Keyset load attempt %d for slot %d, waiting %d ms",
+             s_keyset_attempts[slot] + 1, slot, delay_ms);
+
+    vTaskDelay(pdMS_TO_TICKS(delay_ms));
+
+    if (s_wallets[slot]->load_keysets()) {
+        int attempts = s_keyset_attempts[slot] + 1;
+        s_keysets_loaded[slot] = true;
+        s_keyset_attempts[slot] = 0;
+        ESP_LOGI(TAG, "Keyset load succeeded for slot %d after %d attempt(s)",
+                 slot, attempts);
+        return true;
+    }
+
+    s_keyset_attempts[slot]++;
+    return false;
+}
+
+static int wallet_slot(const cashu::Wallet *w)
+{
+    for (int i = 0; i < s_wallet_count; i++)
+        if (s_wallets[i] == w) return i;
+    return -1;
+}
 
 static cashu::Wallet *find_wallet_for_token(const cashu::Token &tok)
 {
@@ -61,14 +113,9 @@ static esp_err_t init_wallet(int slot, const char *mint_url)
 
     s_wallets[slot]->load_from_nvs();
 
-    if (!s_wallets[slot]->load_keysets()) {
-        ESP_LOGW(TAG, "Keyset load failed for slot %d (may be offline)", slot);
-    }
-
-    ESP_LOGI(TAG, "Wallet[%d] initialized: url=%s balance=%d proofs=%d keysets=%d",
+    ESP_LOGI(TAG, "Wallet[%d] initialized: url=%s balance=%d proofs=%d (keysets lazy)",
              slot, mint_url, s_wallets[slot]->balance(),
-             (int)s_wallets[slot]->proofs().size(),
-             (int)s_wallets[slot]->keysets().size());
+             (int)s_wallets[slot]->proofs().size());
     return ESP_OK;
 }
 
@@ -136,6 +183,13 @@ esp_err_t nucula_wallet_receive(const char *token_str)
         return ESP_FAIL;
     }
 
+    if (!ensure_keysets(wallet_slot(w))) {
+        ESP_LOGE(TAG, "Keysets not available for receive");
+        return ESP_FAIL;
+    }
+
+    vTaskDelay(pdMS_TO_TICKS(2000));
+
     std::vector<cashu::Proof> proofs_out;
     if (!w->receive(tok, proofs_out)) {
         ESP_LOGE(TAG, "Receive failed");
@@ -157,6 +211,11 @@ esp_err_t nucula_wallet_send(uint64_t amount_sat, char *token_out, size_t token_
     cashu::Wallet *w = find_wallet_for_send(amount);
     if (!w) return ESP_FAIL;
 
+    if (!ensure_keysets(wallet_slot(w))) {
+        ESP_LOGE(TAG, "Keysets not available for send");
+        return ESP_FAIL;
+    }
+
     std::vector<cashu::Proof> selected, remaining;
     if (!w->select_proofs(amount, selected, remaining)) {
         ESP_LOGE(TAG, "Insufficient balance for %d sat", amount);
@@ -246,6 +305,11 @@ esp_err_t nucula_wallet_swap_all(void)
         auto &proofs = mutable_proofs(s_wallets[i]);
         if (proofs.empty()) continue;
 
+        if (!ensure_keysets(i)) {
+            ESP_LOGE(TAG, "Keysets not available for swap_all wallet[%d]", i);
+            continue;
+        }
+
         int old_balance = s_wallets[i]->balance();
 
         std::vector<cashu::Proof> inputs = proofs;
@@ -301,6 +365,11 @@ esp_err_t nucula_wallet_melt(const char *bolt11_invoice, uint64_t max_fee_sats)
     }
     if (!w) return ESP_FAIL;
 
+    if (!ensure_keysets(wallet_slot(w))) {
+        ESP_LOGE(TAG, "Keysets not available for melt");
+        return ESP_FAIL;
+    }
+
     cashu::MeltQuote quote;
     if (!w->request_melt_quote(std::string(bolt11_invoice), quote)) {
         ESP_LOGE(TAG, "Melt quote request failed");
diff --git a/main/cashu.c b/main/cashu.c
index da12ff9..4bcda4d 100644
--- a/main/cashu.c
+++ b/main/cashu.c
@@ -199,6 +199,7 @@ esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *to
     if (!client) { free(post_body); free(resp_buf); return ESP_FAIL; }
 
     esp_http_client_set_header(client, "Content-Type", "application/json");
+
     esp_err_t err = esp_http_client_open(client, strlen(post_body));
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "checkstate open failed: %s", esp_err_to_name(err));
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index 80fe6ed..7f2102e 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -280,16 +280,8 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     err = cashu_check_proof_states(mint_url, token, states, &state_count);
     ESP_LOGI(TAG, "Stack HWM after checkstate: %u", uxTaskGetStackHighWaterMark(NULL));
     if (err != ESP_OK) {
-        free(states);
-        free(token);
-        cJSON *notice = create_notice("error", "payment-error-verification", "Failed to verify token with mint");
-        char *json = cJSON_PrintUnformatted(notice);
-        httpd_resp_set_status(req, "502 Bad Gateway");
-        httpd_resp_set_type(req, "application/json");
-        httpd_resp_send(req, json, strlen(json));
-        cJSON_free(json);
-        cJSON_Delete(notice);
-        return ESP_OK;
+        ESP_LOGW(TAG, "Checkstate failed, proceeding without spend check (wallet swap will verify)");
+        state_count = 0;
     }
 
     for (int i = 0; i < state_count; i++) {
@@ -795,11 +787,12 @@ esp_err_t tollgate_api_start(void)
 {
     if (s_api_server) return ESP_OK;
 
-    httpd_config_t config = HTTPD_DEFAULT_CONFIG();
-    config.server_port = 2121;
-    config.ctrl_port = 32769;
-    config.max_uri_handlers = 16;
-    config.stack_size = 16384;
+     httpd_config_t config = HTTPD_DEFAULT_CONFIG();
+     config.server_port = 2121;
+     config.ctrl_port = 32769;
+     config.max_uri_handlers = 16;
+     config.stack_size = 16384;
+     config.core_id = 0;
 
     esp_err_t ret = httpd_start(&s_api_server, &config);
     if (ret != ESP_OK) {
diff --git a/sdkconfig.defaults b/sdkconfig.defaults
index bed04fe..f67ce67 100644
--- a/sdkconfig.defaults
+++ b/sdkconfig.defaults
@@ -40,6 +40,7 @@ CONFIG_MBEDTLS_CERTIFICATE_BUNDLE=y
 CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
 CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=4096
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
+CONFIG_MBEDTLS_HARDWARE_MPI=n
 
 # PSRAM (ESP32-S3 has 8MB)
 CONFIG_SPIRAM=y
@@ -48,4 +49,3 @@ CONFIG_SPIRAM_SPEED_80M=y
 CONFIG_SPIRAM_USE_MALLOC=y
 CONFIG_SPIRAM_MALLOC_ALWAYSINTERNAL=4096
 CONFIG_SPIRAM_MALLOC_RESERVE_INTERNAL=32768
-CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
diff --git a/tests/unit/stubs/http.h b/tests/unit/stubs/http.h
new file mode 100644
index 0000000..753ebd8
--- /dev/null
+++ b/tests/unit/stubs/http.h
@@ -0,0 +1,41 @@
+#ifndef STUBS_HTTP_H
+#define STUBS_HTTP_H
+
+#include "esp_err.h"
+#include <stddef.h>
+
+typedef struct {
+    int status;
+    char *body;
+    size_t body_len;
+} http_response_t;
+
+static inline esp_err_t http_get(const char *url, http_response_t *resp)
+{
+    (void)url; (void)resp;
+    return ESP_FAIL;
+}
+
+static inline esp_err_t http_post_json(const char *url, const char *json_body,
+                                        http_response_t *resp)
+{
+    (void)url; (void)json_body; (void)resp;
+    return ESP_FAIL;
+}
+
+static inline esp_err_t http_post_json_timeout(const char *url, const char *json_body,
+                                                http_response_t *resp, int timeout_ms)
+{
+    (void)url; (void)json_body; (void)resp; (void)timeout_ms;
+    return ESP_FAIL;
+}
+
+static inline void http_response_free(http_response_t *resp)
+{
+    if (resp && resp->body) {
+        free(resp->body);
+        resp->body = NULL;
+    }
+}
+
+#endif