feat(cvm): fix CVM MCP roundtrip - task creation, subscription, relay selection

- Move CVM server start before mint_health_start (avoids RAM fragmentation)
- Fix NIP-01 subscription: #p tag must be array not string
- Fix read loop: tolerate TLS timeouts, don't disconnect
- Reduce TLS timeout from 15s to 5s for faster event delivery
- Add WS frame logging for debugging
- Sign test events with board's nsec (--sec flag) for owner auth
- Change default CVM relay to nos.lol (forwards ephemeral kind 25910)
- MCP get_config and get_balance roundtrips confirmed working
- Unit tests pass (16/16)

5 files changed, 112 insertions, 38 deletions

diff --git a/PLAN_remaining_tests.md b/PLAN_remaining_tests.md
new file mode 100644
index 0000000..e61735b
--- /dev/null
+++ b/PLAN_remaining_tests.md
@@ -0,0 +1,60 @@
+# PLAN_remaining_tests.md — Remaining Integration Tests
+
+## Overview
+
+All high-priority wallet work is complete (receive, send, swap, persistence, burst test). This plan covers the remaining integration test validation and fixes.
+
+## Phase A: Fix Stale Mint URLs — TODO
+
+Three test files still reference `testnut.cashu.space` (dead mint):
+
+- [ ] `tests/integration/test-session-expiry.mjs` (lines 26-27)
+- [ ] `tests/integration/test-reset-auth.mjs` (lines 27-28)
+- [ ] `tests/integration/test-dns-firewall.mjs` (lines 26-27)
+
+Replace with `testnut-nutshell.mints.orangesync.tech`.
+
+## Phase B: Single-Board Integration Tests — TODO
+
+Board A at `10.185.47.1`, port `/dev/ttyACM0`.
+
+- [ ] `test-reset-auth.mjs` — payment + reset + re-auth flow
+- [ ] `test-session-expiry.mjs` — session time-based expiry
+- [ ] `test-dns-firewall.mjs` — DNS hijack + firewall per-client
+- [ ] `test-local-relay.mjs` — WS pub/sub on port 4869
+- [ ] `test-relay-nip11.mjs` — NIP-11 info document
+- [ ] `test-market.mjs` — GET /market endpoint
+
+## Phase C: Cross-Board Test — TODO
+
+- [ ] Write Board C SPIFFS config (nsec `71bf3f4d...`)
+- [ ] Verify Board C API responds
+- [ ] Run `test-cross-board.mjs` against Board C
+
+Board C: `10.74.63.1`, SSID `TollGate-4A2510`, port `/dev/ttyACM2`.
+
+## Phase D: CVM Round-Trip Fix — TODO
+
+9/11 tests pass. MCP kind 25910 requests go unanswered.
+
+- [ ] Check serial logs for `cvm_relay` task creation failure
+- [ ] Add error logging to `cvm_server_start` for `xTaskCreate` failure
+- [ ] If task creation fails: try `xTaskCreatePinnedToCore(..., 1)` or reduce stack to 12KB
+- [ ] Re-run `test-cvm-roundtrip.mjs`
+
+**Root cause hypothesis:** `cvm_relay_task` (16KB stack) fails to create due to internal RAM fragmentation, same as old TLS worker.
+
+## Phase E: Two-Board Price Discovery — DEFERRED
+
+Requires both boards on same network. Complex network setup. Defer until user requests.
+
+## Completed This Session
+
+- [x] Wallet receive via health task queue (5/5 burst)
+- [x] Wallet send (valid cashuA tokens)
+- [x] Wallet swap (proof consolidation)
+- [x] NVS persistence across reboots
+- [x] Fix 4 API integration tests (19/19)
+- [x] Fix E2E mint URL pattern (14/14 Playwright)
+- [x] Flash Board C
+- [x] CVM round-trip (9/11, 2 MCP response failures)
diff --git a/main/config.c b/main/config.c
index e3cbf46..2edb6da 100644
--- a/main/config.c
+++ b/main/config.c
@@ -36,7 +36,7 @@ esp_err_t tollgate_config_init(void)
     g_config.payout.recipient_count = 0;
     g_config.payout.mint_count = 0;
     g_config.cvm_enabled = true;
-    strncpy(g_config.cvm_relays, "wss://relay.primal.net", sizeof(g_config.cvm_relays) - 1);
+    strncpy(g_config.cvm_relays, "wss://nos.lol", sizeof(g_config.cvm_relays) - 1);
     strncpy(g_config.wifi_auth_mode, "WPA2", sizeof(g_config.wifi_auth_mode) - 1);
     g_config.display_enabled = true;
     g_config.nostr_sync_interval_s = 1800;
diff --git a/main/cvm_server.c b/main/cvm_server.c
index f3a5ab8..1ac5cb6 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -12,6 +12,7 @@
 #include "esp_tls.h"
 #include "esp_crt_bundle.h"
 #include "esp_random.h"
+#include "esp_heap_caps.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include <string.h>
@@ -150,7 +151,7 @@ static esp_err_t ws_connect(const char *relay_url, esp_tls_t **tls_out)
 
     esp_tls_cfg_t tls_cfg = {
         .crt_bundle_attach = esp_crt_bundle_attach,
-        .timeout_ms = 15000,
+        .timeout_ms = 5000,
     };
     esp_tls_t *tls = esp_tls_init();
     if (!tls) return ESP_ERR_NO_MEM;
@@ -507,7 +508,9 @@ static esp_err_t subscribe_to_relay(esp_tls_t *tls, const char *npub)
     cJSON *kinds = cJSON_CreateArray();
     cJSON_AddItemToArray(kinds, cJSON_CreateNumber(25910));
     cJSON_AddItemToObject(filter, "kinds", kinds);
-    cJSON_AddStringToObject(filter, "#p", npub);
+    cJSON *p_tag = cJSON_CreateArray();
+    cJSON_AddItemToArray(p_tag, cJSON_CreateString(npub));
+    cJSON_AddItemToObject(filter, "#p", p_tag);
     cJSON_AddNumberToObject(filter, "limit", 100);
     cJSON_AddItemToArray(sub, filter);
 
@@ -556,33 +559,33 @@ static void cvm_relay_task(void *arg)
         }
 
         int64_t last_ping_time = (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) / 1000;
-        int consecutive_timeouts = 0;
         while (g_running) {
             int rlen = esp_tls_conn_read(tls, buf, CVM_WS_BUF_SIZE - 1);
-            if (rlen < 0) {
-                ESP_LOGW(TAG, "Read error on %s (rlen=%d)", relay_url, rlen);
-                break;
-            }
             if (rlen == 0) {
+                ESP_LOGW(TAG, "Connection closed by relay");
                 break;
-            } else {
-                consecutive_timeouts = 0;
-                if ((buf[0] & 0x0F) == 0x01) {
-                    char *text = parse_ws_text_frame(buf, rlen);
-                    if (text) {
-                        if (strlen(text) > 0) {
-                            process_relay_message(relay_url, text);
-                        }
-                        free(text);
+            }
+            if (rlen < 0) {
+                vTaskDelay(pdMS_TO_TICKS(100));
+                continue;
+            }
+
+            ESP_LOGI(TAG, "WS frame received: %d bytes, opcode=0x%02x", rlen, buf[0] & 0x0F);
+
+            if ((buf[0] & 0x0F) == 0x01) {
+                char *text = parse_ws_text_frame(buf, rlen);
+                if (text) {
+                    if (strlen(text) > 0) {
+                        process_relay_message(relay_url, text);
                     }
-                } else if ((buf[0] & 0x0F) == 0x09) {
-                    ESP_LOGD(TAG, "Relay ping received, sending pong");
-                    uint8_t pong[2] = {0x8A, 0x00};
-                    esp_tls_conn_write(tls, pong, 2);
-                } else if ((buf[0] & 0x0F) == 0x08) {
-                    ESP_LOGW(TAG, "Relay sent close frame");
-                    break;
+                    free(text);
                 }
+            } else if ((buf[0] & 0x0F) == 0x09) {
+                uint8_t pong[2] = {0x8A, 0x00};
+                esp_tls_conn_write(tls, pong, 2);
+            } else if ((buf[0] & 0x0F) == 0x08) {
+                ESP_LOGW(TAG, "Relay sent close frame");
+                break;
             }
 
             int64_t now = (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) / 1000;
@@ -590,7 +593,6 @@ static void cvm_relay_task(void *arg)
                 uint8_t ping[2] = {0x89, 0x00};
                 esp_tls_conn_write(tls, ping, 2);
                 last_ping_time = now;
-                ESP_LOGD(TAG, "Sent WS keepalive ping");
             }
         }
 
@@ -726,8 +728,20 @@ void cvm_server_start(void)
     const tollgate_config_t *cfg = tollgate_config_get();
     const char *relay = (cfg->cvm_relays[0]) ? cfg->cvm_relays : "wss://relay.primal.net";
 
+    ESP_LOGI(TAG, "Starting CVM relay task (free internal: %u, largest: %u)",
+             heap_caps_get_free_size(MALLOC_CAP_INTERNAL),
+             heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL));
+
     char *relay_copy = strdup(relay);
-    xTaskCreate(cvm_relay_task, "cvm_relay", 16384, relay_copy, 5, &g_task);
+    BaseType_t ret = xTaskCreatePinnedToCore(cvm_relay_task, "cvm_relay", 16384, relay_copy, 5, &g_task, 1);
+    if (ret != pdPASS) {
+        ESP_LOGE(TAG, "Failed to create cvm_relay task (ret=%d, free internal: %u)",
+                 ret, heap_caps_get_free_size(MALLOC_CAP_INTERNAL));
+        g_running = false;
+        free(relay_copy);
+        return;
+    }
+    ESP_LOGI(TAG, "CVM relay task created on core %d", xPortGetCoreID());
 }
 
 void cvm_server_stop(void)
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 60503eb..2d4fa22 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -237,6 +237,12 @@ static void start_services(void)
     session_manager_init();
 
     const tollgate_config_t *cfg = tollgate_config_get();
+
+    if (cfg->cvm_enabled) {
+        cvm_server_init();
+        cvm_server_start();
+    }
+
     mint_health_init(cfg->accepted_mints, cfg->accepted_mint_count);
     mint_health_start();
 
@@ -268,19 +274,13 @@ static void start_services(void)
 
     xTaskCreate(publish_wifistr_task, "wifistr_init", 16384, NULL, 3, NULL);
 
-    const tollgate_config_t *cfg2 = tollgate_config_get();
-    if (cfg2->cvm_enabled) {
-        cvm_server_init();
-        cvm_server_start();
-    }
-
-    if (cfg2->mining_enabled) {
+    if (cfg->mining_enabled) {
         ESP_LOGI(TAG, "Mining subsystem enabled, initializing...");
         mining_payment_init();
         stratum_client_init();
-        stratum_proxy_init(cfg2->mining_port);
+        stratum_proxy_init(cfg->mining_port);
 
-        if (cfg2->mining_payout_mode != MINING_PAYOUT_UPSTREAM) {
+        if (cfg->mining_payout_mode != MINING_PAYOUT_UPSTREAM) {
             stratum_client_start();
         }
 
diff --git a/tests/integration/test-cvm-roundtrip.mjs b/tests/integration/test-cvm-roundtrip.mjs
index 821cfe7..87caf1a 100644
--- a/tests/integration/test-cvm-roundtrip.mjs
+++ b/tests/integration/test-cvm-roundtrip.mjs
@@ -2,7 +2,7 @@ import { execSync } from 'child_process';
 import WebSocket from 'ws';
 
 const IP = process.env.TOLLGATE_IP || '10.192.45.1';
-const CVM_RELAY = process.env.CVM_RELAY || 'wss://relay.primal.net';
+const CVM_RELAY = process.env.CVM_RELAY || 'wss://nos.lol';
 const NSEC = process.env.CVM_NSEC || 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2';
 
 let passed = 0, failed = 0;
@@ -104,7 +104,7 @@ async function runTests() {
       params: { name: 'get_config', arguments: {} }
     });
 
-    const eventOut = nak(`event --kind 25910 --tag p=${npub} --content '${content.replace(/'/g, "'\\''")}' ${CVM_RELAY}`, 8000);
+    const eventOut = nak(`event --sec ${NSEC} --kind 25910 --tag p=${npub} --content '${content.replace(/'/g, "'\\''")}' ${CVM_RELAY}`, 8000);
     const published = eventOut.includes('Success') || eventOut.includes('"id"');
     assert(published, `Published kind 25910 get_config to ${CVM_RELAY}`);
 
@@ -149,7 +149,7 @@ async function runTests() {
       params: { name: 'get_balance', arguments: {} }
     });
 
-    const eventOut = nak(`event --kind 25910 --tag p=${npub} --content '${content.replace(/'/g, "'\\''")}' ${CVM_RELAY}`, 8000);
+    const eventOut = nak(`event --sec ${NSEC} --kind 25910 --tag p=${npub} --content '${content.replace(/'/g, "'\\''")}' ${CVM_RELAY}`, 8000);
     const published = eventOut.includes('Success') || eventOut.includes('"id"');
     assert(published, `Published kind 25910 get_balance to ${CVM_RELAY}`);