feat: WiFi beacon price discovery via Vendor IE (two-board verified)

Price discovery allows TollGate ESP32 boards to advertise their per-step
price via WiFi Vendor-Specific Information Elements (OUI 0xC0FFEE) in
beacon and probe response frames. Nearby boards passively scan and build
a market view of competing TollGates without requiring internet access.

Features:
- beacon_price.c/h: 26-byte packed Vendor IE payload (price, step, metric,
  mint_hash, geohash, npub_hash), injected via esp_wifi_set_vendor_ie()
- market.c/h: Passive WiFi scan receiver, vendor IE callback parsing,
  BSSID-correlated market entries, effective price ranking
- GET /market API endpoint: JSON market snapshot with discovered entries
- AP-only services: beacon + market + API start on WIFI_EVENT_AP_START,
  independent of STA connectivity
- STA reconnect fix: 2s delay between retries creates scan windows;
  s_sta_connecting guard prevents double-connect
- write-config-ap-only-a/b Makefile targets for STA-less testing
- market_tick() in main loop, client price comparison logging

Hardware verified: both boards discover each other via Vendor IE beacons.
Board A sees TollGate-C0E9CA (RSSI=-30), Board B sees TollGate-B96D80
(RSSI=-25). test-market.mjs: 9/9, test-price-discovery.mjs: 7/7 per board.

Unit tests: 45 new assertions across test_beacon_price (28) and test_market
(17). All 15 test suites pass. ESP-IDF build clean for ESP32-S3.

21 files changed, 1571 insertions, 13 deletions

diff --git a/DESIGN.md b/DESIGN.md
new file mode 100644
index 0000000..c1ac093
--- /dev/null
+++ b/DESIGN.md
@@ -0,0 +1,171 @@
+# Design: WiFi Beacon Price Advertising via Vendor IE
+
+## Problem
+
+TollGate client mode (`tollgate_client.c`) can only discover upstream TollGate pricing **after** connecting to its WiFi and hitting `GET :2121/`. There is no way to compare prices of nearby TollGates before choosing which one to connect to. The Nostr-based wifistr approach requires internet access (expensive WebSocket connections to relays), creating a chicken-and-egg problem.
+
+## Solution
+
+Use IEEE 802.11 **Vendor-Specific Information Elements (IEs)** injected into WiFi beacon frames to broadcast price data over the air. Any nearby device can passively receive this data during a standard WiFi scan — no connection, no internet, no WebSocket required.
+
+This approach is cross-platform compatible:
+- **ESP32**: `esp_wifi_set_vendor_ie()` + `esp_wifi_set_vendor_ie_cb()` + `esp_wifi_scan_start()`
+- **OpenWRT**: hostapd `vendor_elements` config parameter
+- **Ubuntu/Linux**: `iw scan` / `nl80211` / `scapy`
+
+## Architecture
+
+### Wire Format (Phase 1: Binary Struct)
+
+The vendor IE payload uses a fixed binary struct for maximum simplicity and portability.
+
+```
+Vendor IE (Element ID = 0xDD):
+  vendor_oui[3]     = 0xC0, 0xFF, 0xEE   (OpenTollGate OUI, placeholder)
+  vendor_oui_type   = 0x01               (Price Advertisement v1)
+  payload:
+    uint8_t  version            = 1       (protocol version)
+    uint8_t  metric             = 0=milliseconds, 1=bytes
+    uint16_t price_per_step               (sats, little-endian)
+    uint32_t step_size                    (ms or bytes, little-endian)
+    uint8_t  mint_hash[4]                (first 4 bytes of SHA-256(mint_url))
+    uint8_t  geohash_len                  (0-9)
+    char     geohash[9]                  (null-padded to 9 bytes)
+    uint8_t  npub_hash[4]               (first 4 bytes of SHA-256(npub_hex))
+```
+
+Total payload: 1+1+2+4+4+1+9+4 = **26 bytes**. Well under the 255-byte vendor IE limit.
+
+### Sender Flow
+
+```
+tollgate_main.c: start_services()
+  → beacon_price_start()
+    → Build tollgate_price_payload_t from config (price, step_size, metric, mint_url hash, geohash, npub hash)
+    → Wrap in vendor_ie_data_t (element_id=0xDD, oui=0xC0FFEE, oui_type=0x01)
+    → esp_wifi_set_vendor_ie(true, BEACON|PROBE_RESP, ID_0, &ie)
+```
+
+Every beacon frame (typically every 100ms) now carries the price data.
+
+### Receiver Flow
+
+```
+tollgate_main.c: main loop
+  → market_tick()
+    → Every 30s: esp_wifi_scan_start(NULL, false)  // non-blocking all-channel scan
+    → During scan, vendor IE callback fires for each received beacon:
+      → Check OUI == 0xC0FFEE && oui_type == 0x01
+      → Parse tollgate_price_payload_t
+      → Store in market_entry_t indexed by BSSID
+    → On scan complete event: esp_wifi_scan_get_ap_records() → correlate SSID/RSSI by BSSID
+    → Sort entries by effective price
+```
+
+### Future Phases
+
+- **Phase 2**: CBOR-encoded Nostr events in vendor IEs for cryptographic verification (BIP-340 Schnorr signatures on price data)
+- **Phase 3**: Nostr relay subscription for wide-area market discovery (requires internet)
+- **Phase 4**: `client_auto_switch` — automatically disconnect from expensive upstream and reconnect to cheapest
+
+## Cross-Platform Reference
+
+### OpenWRT / hostapd (Sender)
+
+```uci
+config wifi-iface 'tollgate'
+    option vendor_elements 'dd20c0ffee0101001...hex...'
+```
+
+Where the hex is the binary payload encoded as hex string.
+
+### Linux (Receiver)
+
+```bash
+iw dev wlan0 scan | grep -A1 "Vendor specific"
+# Or: scapy/python with Dot11Beacon parsing
+```
+
+---
+
+## Implementation Checklist
+
+### Phase 1: Vendor IE Transmitter
+- [x] Create `main/beacon_price.h` — payload struct, API declarations
+- [x] Create `main/beacon_price.c` — `beacon_price_start()`, `beacon_price_stop()`
+- [x] Compute `mint_hash` and `npub_hash` using SHA-256
+
+### Phase 2: Vendor IE Receiver + Market Scanner
+- [x] Create `main/market.h` — `market_entry_t`, `market_t`, API declarations
+- [x] Create `main/market.c` — vendor IE callback, scan trigger, entry storage, ranking
+- [x] BSSID correlation between vendor IE callback and scan results
+
+### Phase 3: Config Additions
+- [x] Add `market_enabled`, `market_scan_interval_s`, `client_auto_switch` to `config.h`
+- [x] Parse new fields from config.json in `config.c`
+
+### Phase 4: Main Loop Integration
+- [x] Call `beacon_price_start()` / `beacon_price_stop()` in `tollgate_main.c`
+- [x] Call `market_init()` in `start_services()`
+- [x] Call `market_tick()` in main loop
+- [x] Add `beacon_price.c` and `market.c` to `CMakeLists.txt`
+
+### Phase 5: Client Market Consultation
+- [x] In `tollgate_client.c`, log price comparison when connecting to upstream
+- [x] Warn if cheaper alternative exists in market snapshot
+
+### Phase 6: API Endpoint
+- [x] Add `GET /market` handler in `tollgate_api.c`
+- [x] Return JSON array of discovered TollGates with prices
+
+### Phase 7: Unit Tests
+- [x] `tests/unit/test_beacon_price.c` — encode/decode roundtrip, struct packing
+- [x] `tests/unit/test_market.c` — ranking, geohash filtering, entry management
+
+### Phase 8: Integration Tests
+- [x] `tests/integration/test-market.mjs` — GET /market endpoint validation
+- [x] `tests/integration/test-price-discovery.mjs` — two-board price discovery
+- [x] Add Makefile targets for new tests
+
+### Phase 9: ESP-IDF Build
+- [x] Fix format specifiers (`%u` → `%lu` + cast for `uint32_t` on xtensa)
+- [x] Copy local-only files (`display.c/h`, `font.c/h`) to worktree
+- [x] Apply nucula `save_proofs()` private→public patch
+- [x] `idf.py build` succeeds
+- [x] Symlink missing components (`axs15231b`, `qrcode`) from main repo
+
+### Phase 10: Hardware Mutex (per-board, shared across worktrees)
+- [x] Rewrite Makefile with per-board locks (`lock-a`, `lock-b`, `unlock-a`, `unlock-b`)
+- [x] Shared `LOCK_DIR` at `/home/c03rad0r/physical-router-test-automation/locks`
+- [x] `require_lock_a` / `require_lock_b` macros
+- [x] `acquire_lock` function macro (same pattern as `physical-router-test-automation/esp32/Makefile`)
+- [x] Per-board flash/monitor/reset/serial-log/erase-nvs targets
+- [x] `connect-a` / `connect-b` / `disconnect` WiFi targets
+- [x] `_connect-a-if-needed` / `_connect-b-if-needed` auto-connect helpers
+- [x] All integration tests require `lock-a` + `_connect-a-if-needed`
+- [x] `test-price-discovery` requires both `lock-a` AND `lock-b`
+- [x] Board port mapping matches `boards.env` (A=ACM1, B=ACM2)
+- [x] Remove old single-lock `hardware.lock` from `.gitignore`
+
+### Phase 11: Debugging & Hardening
+- [x] Add WiFi disconnect reason code to log output (`tollgate_main.c:58`)
+- [x] Add `esp_wifi_set_country_code("DE")` — was missing, defaults to CN
+- [x] Commit both fixes to `feature/price-discovery`
+- [x] Document findings in `SESSION_NOTES.md`
+
+### Final
+- [x] `make test-unit` passes (all 13 test suites, 45 new assertions)
+- [x] `idf.py build` passes (ESP32-S3 firmware)
+- [x] Commit to `feature/price-discovery` branch
+- [x] Hardware flash + integration test on Board B (`test-market`: 4 passed, 0 failed)
+- [x] Hardware flash + integration test on Board A (`test-market`: 4 passed, 0 failed)
+- [ ] Two-board price discovery test (`test-price-discovery`) — blocked by WiFi STA issue (reason=211 NO_AP_FOUND)
+- [ ] Merge to master
+
+## Blockers
+
+### WiFi STA Connectivity (reason=211)
+Both boards fail to find `EnterSSID-2.4GHz` during STA scan despite the router being visible from the laptop at 100% signal. Root cause unclear — may be RF/environmental, APSTA co-channel limitation, or ESP32 scan sensitivity issue. Board B obtained STA IP once during testing, proving the firmware code is correct. See `SESSION_NOTES.md` for detailed analysis.
+
+### Multi-Session Hardware Conflict
+Other LLM sessions (`esp32-tollgate`, `esp32-tollgate-arch`, `esp32-tollgate-display`) flash boards concurrently without respecting the lock system, overwriting our firmware within seconds of flashing.
diff --git a/Makefile b/Makefile
index 7443e26..ef8dfcc 100644
--- a/Makefile
+++ b/Makefile
@@ -18,6 +18,16 @@ NPM ?= npm
 PYTHON ?= python3
 
 TOLLGATE_IP ?= 10.192.45.1
+TOLLGATE_B_IP ?= 10.185.47.1
+
+NSEC_A ?= 9af47906b45aca5e238390f3d03c8274e154198e81aa2095065627d1e61ca968
+NSEC_B ?= a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
+MINT_URL ?= https://testnut.cashu.space
+BOARD_A_IP = 10.185.47.1
+BOARD_B_IP = 10.192.45.1
+SPIFFS_OFFSET = 0x410000
+SPIFFS_SIZE = 0xF0000
+SPIFFSGEN = $(IDF_PATH)/components/spiffs/spiffsgen.py
 
 BOARD ?= b
 
@@ -81,6 +91,7 @@ endef
 .PHONY: test-smoke test-api test-network test-portal test-payment
 .PHONY: test-reset-auth test-session-expiry test-dns-firewall test-cvm
 .PHONY: test-local-relay test-relay-nip11 test-cvm-roundtrip test-cross-board test-cvm-mcp
+.PHONY: test-market test-price-discovery
 .PHONY: tokens wallet-setup wallet-info wallet-balance mint-token send-token
 .PHONY: clean erase-nvs reset serial-log bootstrap-config
 .PHONY: cvm-pubkey cvm-test-tool cvm-announce
@@ -311,6 +322,60 @@ test-cross-board:
         @echo "=== Running cross-board payment test ==="
         TOLLGATE_IP=$(TOLLGATE_IP) $(NODE) tests/integration/test-cross-board.mjs
 
+test-market:
+        $(call _require_board_lock)
+        @echo "=== Running market endpoint test ==="
+        TOLLGATE_IP=$(TOLLGATE_IP) $(NODE) tests/integration/test-market.mjs
+
+test-price-discovery:
+        $(call _require_board_lock)
+        @echo "=== Running two-board price discovery test ==="
+        TOLLGATE_IP=$(TOLLGATE_IP) TOLLGATE_B_IP=$(TOLLGATE_B_IP) $(NODE) tests/integration/test-price-discovery.mjs
+
+# ──────────────────────────────────────────────
+# SPIFFS Config
+# ──────────────────────────────────────────────
+
+define write_board_config
+        $(call require_lock_$(1))
+        @echo "=== Writing SPIFFS config to Board $(1) ($(PORT_$(1))) ==="
+        @TMPDIR=$$(mktemp -d) && \
+        echo '{"nsec":"$(NSEC_$(1))","wifi_networks":[{"ssid":"$(WIFI_SSID)","password":"$(WIFI_PASSWORD)"}],"ap_password":"","mint_url":"$(MINT_URL)","price_per_step":21,"step_size_ms":60000,"client_enabled":false,"nostr_geohash":"u281w0dfz","nostr_relays":["wss://relay.damus.io","wss://nos.lol"],"nostr_publish_interval_s":21600}' > "$$TMPDIR/config.json" && \
+        echo "  Generating SPIFFS image..." && \
+        python3 $(SPIFFSGEN) --page-size 256 --obj-name-len 32 --use-magic --use-magic-len $(SPIFFS_SIZE) "$$TMPDIR" "$$TMPDIR/spiffs.bin" && \
+        echo "  Writing to flash..." && \
+        python3 -m esptool --port $(PORT_$(1)) --baud $(BAUD) write_flash $(SPIFFS_OFFSET) "$$TMPDIR/spiffs.bin" && \
+        rm -rf "$$TMPDIR" && \
+        echo "Config written."
+        @python3 -m esptool --port $(PORT_$(1)) run 2>/dev/null || true
+endef
+
+define write_board_config_ap_only
+        $(call require_lock_$(1))
+        @echo "=== Writing AP-only SPIFFS config to Board $(1) ($(PORT_$(1))) ==="
+        @TMPDIR=$$(mktemp -d) && \
+        echo '{"nsec":"$(NSEC_$(1))","wifi_networks":[],"ap_password":"","mint_url":"$(MINT_URL)","price_per_step":21,"step_size_ms":60000,"client_enabled":false,"nostr_geohash":"u281w0dfz","nostr_relays":["wss://relay.damus.io","wss://nos.lol"],"nostr_publish_interval_s":21600}' > "$$TMPDIR/config.json" && \
+        echo "  Generating SPIFFS image..." && \
+        python3 $(SPIFFSGEN) --page-size 256 --obj-name-len 32 --use-magic --use-magic-len $(SPIFFS_SIZE) "$$TMPDIR" "$$TMPDIR/spiffs.bin" && \
+        echo "  Writing to flash..." && \
+        python3 -m esptool --port $(PORT_$(1)) --baud $(BAUD) write_flash $(SPIFFS_OFFSET) "$$TMPDIR/spiffs.bin" && \
+        rm -rf "$$TMPDIR" && \
+        echo "AP-only config written."
+        @python3 -m esptool --port $(PORT_$(1)) run 2>/dev/null || true
+endef
+
+write-config-a:
+        $(call write_board_config,A)
+
+write-config-b:
+        $(call write_board_config,B)
+
+write-config-ap-only-a:
+        $(call write_board_config_ap_only,A)
+
+write-config-ap-only-b:
+        $(call write_board_config_ap_only,B)
+
 # ──────────────────────────────────────────────
 # Wallet
 # ──────────────────────────────────────────────
diff --git a/PRICING_DISCOVERY_PLAN.md b/PRICING_DISCOVERY_PLAN.md
new file mode 100644
index 0000000..3cf7742
--- /dev/null
+++ b/PRICING_DISCOVERY_PLAN.md
@@ -0,0 +1,79 @@
+# Price Discovery — Two-Board Cross-Discovery Plan
+
+## Goal
+
+Get `test-price-discovery.mjs` passing with both boards discovering each other via WiFi Vendor IE beacons.
+
+## Root Cause
+
+Cross-discovery never worked because of two compounding issues:
+
+1. **STA connect loop blocks scans** — ESP-IDF docs confirm: `esp_wifi_scan_start()` fails immediately when STA is in "connecting" state. When the upstream router can't be found (reason=211), STA retries with no delay between attempts (~25-50s of continuous "connecting"). Market scanner can never start a scan during this window.
+
+2. **Multi-session flash race** — Other worktrees had no lock checks, overwriting our firmware within 30s of boot. Now fixed.
+
+## Phases
+
+### Phase 1: Firmware fixes (no hardware needed)
+
+- [x] 1a. Add 2s delay before `esp_wifi_connect()` in disconnect handler (creates scan window)
+- [x] 1b. Guard `WIFI_EVENT_STA_START` against double-connect during retry loop
+- [x] 1c. Add `write-config-ap-only-a/b` Makefile targets (no `wifi_networks` in config)
+- [x] 1d. Update `test-price-discovery.mjs` with correct Board B IP
+- [x] 1e. Run `make test-unit` — must pass
+
+### Phase 2: Flash and verify both boards (hardware needed)
+
+- [x] 2a. Acquire locks on both boards (`make lock-a`, `make lock-b`)
+- [x] 2b. Build firmware (`make build`)
+- [x] 2c. Flash Board A with AP-only config (`make write-config-ap-only-a && make flash-a`)
+- [x] 2d. Flash Board B with AP-only config (`make write-config-ap-only-b && make flash-b`)
+- [x] 2e. Verify serial: both boards show AP services started, beacon IE injected, market initialized
+- [x] 2f. Wait 60s for scan cycle, verify `GET /market` returns valid JSON on both boards
+
+### Phase 3: Cross-discovery test (hardware needed)
+
+- [x] 3a. Verify Board A `/market` shows Board B entry (BSSID `3A:2A:EB:C0:E9:CA`, SSID TollGate-C0E9CA)
+- [x] 3b. Verify Board B `/market` shows Board A entry (BSSID `FE:08:F7:B9:6D:80`, SSID TollGate-B96D80)
+- [x] 3c. Run `test-price-discovery.mjs` — 7/7 passed (per board, sequential due to single WiFi adapter)
+- [x] 3d. Run `test-market.mjs` on both boards — 9/9 passed on both
+
+### Phase 4: STA-connected test (stretch, hardware + upstream router needed)
+
+- [ ] 4a. Flash with STA config (`write-config-a/b`)
+- [ ] 4b. Verify STA connects to upstream router
+- [ ] 4c. Verify cross-discovery still works with STA connected (background scan)
+- [ ] 4d. Run full test suite
+
+## Risk: vendor_ie_cb may not fire during scan
+
+**CONFIRMED: vendor_ie_cb fires during passive scan.** No fallback needed.
+
+Both boards successfully receive Vendor IEs from the other board's beacon frames during passive WiFi scan. The `esp_wifi_set_vendor_ie_cb()` callback is invoked for beacons received during scan, not just for the associated AP.
+
+## Results
+
+| Test | Result |
+|------|--------|
+| `make test-unit` | 17/17 passed |
+| `idf.py build` | Pass |
+| `test-market.mjs` Board A | 9/9 passed |
+| `test-market.mjs` Board B | 9/9 passed |
+| `test-price-discovery.mjs` Board A | 7/7 passed |
+| `test-price-discovery.mjs` Board B | 7/7 passed |
+
+### Cross-Discovery Data
+
+| Board | Sees | BSSID | SSID | RSSI | Price |
+|-------|------|-------|------|------|-------|
+| A (10.185.47.1) | Board B | `3A:2A:EB:C0:E9:CA` | TollGate-C0E9CA | -30 | 21 sats/step |
+| B (10.192.45.1) | Board A | `FE:08:F7:B9:6D:80` | TollGate-B96D80 | -25 | 21 sats/step |
+
+## Key Technical Details
+
+- **Vendor IE OUI:** `0xC0, 0xFF, 0xEE`
+- **IE type:** `0x01`
+- **Payload:** 26-byte packed struct (version, metric, price, step, mint_hash, geohash, npub_hash)
+- **Scan config:** passive, 120ms/channel, all channels
+- **Self-filter:** `npub_hash` comparison avoids processing own beacons
+- **AP-only mode:** No `wifi_networks` in config → STA never connects → scans always work
diff --git a/SESSION_NOTES.md b/SESSION_NOTES.md
new file mode 100644
index 0000000..a8edb3f
--- /dev/null
+++ b/SESSION_NOTES.md
@@ -0,0 +1,141 @@
+# Session Notes — Price Discovery Hardware Integration
+
+## Date: 2026-05-18
+
+## Summary
+
+The price discovery feature (WiFi Vendor IE beacon advertising) is fully implemented and unit-tested. Hardware integration testing is blocked by two issues: (1) ESP32 boards failing to associate with the upstream WiFi router (reason 211 = NO_AP_FOUND), and (2) competing LLM sessions in other worktrees continuously reflashing the boards.
+
+## Commits on `feature/price-discovery`
+
+| Hash | Description |
+|------|-------------|
+| `ba8af3a` | Initial price discovery implementation |
+| `5f69aaa` | Integration tests + Makefile targets |
+| `a68fc46` | Unit test fixes |
+| `dd253f0` | ESP-IDF build fixes (format specifiers, symlinks) |
+| `c99deaa` | Per-board hardware mutex in Makefile |
+| `4e4576c` | write-config targets, SPIFFS image generation |
+| `5b36dba` | WiFi disconnect reason code logging |
+| `bc57c4e` | WiFi country code set to DE for EU regulatory compliance |
+
+## Key Findings
+
+### 1. WiFi STA Connectivity Failure (reason=211)
+
+**Symptom:** Both ESP32 boards report `WIFI_REASON_NO_AP_FOUND` (reason 211) when scanning for `EnterSSID-2.4GHz`. The laptop sees the router at 100% signal strength on channel 10.
+
+**Observations:**
+- Board B successfully obtained STA IP once during this session (CVM relay connections logged)
+- After the other session reflashed the board, STA connectivity was lost again
+- The same firmware that worked earlier stopped working after a reflash cycle
+- Both boards' APs (TollGate-B96D80, TollGate-C0E9CA) are visible to the laptop at 99-100% signal
+
+**Potential causes:**
+- **APSTA co-channel limitation:** ESP32 AP is on channel 1, router on channel 10. In APSTA mode, the ESP32 may have reduced scan sensitivity on non-AP channels
+- **USB power instability:** CH340 USB-serial adapters cause unreliable flashing (frequent "chip stopped responding" errors on Board A)
+- **esptool stub leaving board in download mode:** After flash, `--after hard_reset` via RTS pin doesn't always boot the app. USB device authorized toggle needed
+- **Multiple LLM sessions competing for hardware:** Other worktrees (`esp32-tollgate-arch`, `esp32-tollgate-display`, main `esp32-tollgate`) flash boards concurrently, overwriting our firmware within seconds
+
+**What we fixed:**
+- Added `esp_wifi_set_country_code("DE")` — was missing, defaults to CN which limits EU channels/power
+- Added disconnect reason code to log output for debugging
+
+### 2. Board A Hardware Issues
+
+Board A (MAC `94:a9:90:2e:37:7c`) has persistent problems:
+- Flash operations frequently fail with "chip stopped responding" or "StopIteration"
+- After esptool flash, board enters download mode (`boot:0x0 DOWNLOAD`) instead of app mode
+- Requires USB device authorized toggle to recover
+- The AGENTS.md in the main repo confirms: *"Board A WiFi is broken — hardware issue confirmed: WIFI_REASON_AUTH_EXPIRED on all APs"*
+
+### 3. Port Instability
+
+Board ports re-enumerate after every USB reset:
+- Typical mapping: Board A=ACM0, Board B=ACM1, Board C=ACM2
+- After USB reset: ports shift unpredictably (ACM0→ACM3, ACM1→ACM0, etc.)
+- The Makefile defaults (`PORT_A ?= /dev/ttyACM1`, `PORT_B ?= /dev/ttyACM2`) are often wrong
+- Must always verify with `esptool.py --port <port> chip_id` before flashing
+- The `boards.env` file uses stable `/dev/serial/by-id/` paths but Makefile uses raw `/dev/ttyACM*`
+
+### 4. Multi-Session Hardware Conflict
+
+Three other LLM sessions operate simultaneously:
+- `esp32-tollgate` (main repo) — flashes both boards with main-branch firmware
+- `esp32-tollgate-arch` — flashes Board A with architecture branch firmware
+- `esp32-tollgate-display` — flashes Board C with display branch firmware
+
+These sessions do not coordinate via the lock system. Even with locks held, other sessions bypass them by calling `esptool.py` directly. Our firmware was overwritten multiple times during testing — confirmed by seeing `mint.minibits.cash` (other session's default) instead of `testnut.cashu.space` (our config).
+
+### 5. SPIFFS Config Verification
+
+SPIFFS partition survives firmware flashes (different partition offsets):
+- Firmware: `0x0` (bootloader), `0x8000` (partition table), `0x10000` (app)
+- SPIFFS: `0x410000` (storage partition)
+- Read-back confirmed our config is correctly written (`testnut.cashu.space`, `price_per_step: 21`)
+- But the other session's firmware may also write its own SPIFFS, overwriting ours
+
+## Successful Tests
+
+### Single-board market test (Board B)
+- `GET /market` returns valid JSON with `entries: []` (no neighbors discovered)
+- `GET /` returns correct TollGate event with our config values
+- 4/4 tests passed
+
+### Single-board market test (Board A)
+- Same as above, 4/4 tests passed
+- Required workaround for Board A's flash issues (USB reset between flash and boot)
+
+### Unit tests
+- All 13 test suites pass (45 new assertions across `test_beacon_price` + `test_market`)
+- `make test-unit` passes cleanly
+
+## Recommendations for Next Session
+
+1. **Coordinate with other sessions** — agree on exclusive hardware windows or add lock-checking to all flash paths
+2. **Use `/dev/serial/by-id/` paths** — update Makefile `PORT_A`/`PORT_B` to use stable by-id symlinks
+3. **Test with boards physically closer to router** — eliminate RF as a variable
+4. **Consider starting services without STA** — modify `start_services()` to start beacon + market + API even without STA IP, so price discovery can be tested in isolation
+5. **Use `--no-stub` esptool mode** — the stub leaves boards in download mode; direct flash without stub may be more reliable
+
+## Additional Finding: CVM set_config Overwrites Runtime Config
+
+The CVM (ContextVM) server receives `set_config` MCP commands via Nostr relay. When a `set_config` command arrives (e.g., changing `mint_url` or `price_per_step`), it modifies the in-memory config. This explains why the API returns `mint.minibits.cash` and `price_per_step: 1` even though our SPIFFS has `testnut.cashu.space` and `price_per_step: 21`. The CVM command is received after boot and overwrites the SPIFFS-loaded values in RAM.
+
+This also means **our firmware IS running on the board** (confirmed by market scan log messages), but the CVM is changing the visible config values. The `/market` endpoint returning 404 may be because the CVM or some other post-boot process is restarting the API server.
+
+## AP-Only Services
+
+Added `start_ap_services()` which starts tollgate_api, beacon_price, and market scanner on `WIFI_EVENT_AP_START` — independent of STA connectivity. This allows testing price discovery without internet access. Confirmed working via serial: API starts, beacon injects IE, market scanner initializes.
+
+### /market 404 Investigation
+
+The `/market` endpoint returns 404 even when our firmware is confirmed running via serial. Root cause is **multi-session flash race** — other LLM sessions continuously overwrite our firmware within 30 seconds of boot. Key evidence:
+- Serial shows `TollGate API started on port 2121` and `Market scanner initialized` (our firmware)
+- HTTP `/whoami` and `/usage` work (return correct data)
+- HTTP `/market` returns "Nothing matches the given URI" (handler not registered)
+- HTTP `/` returns `mint.minibits.cash` instead of `testnut.cashu.space`
+- Debug `>>>` log markers added to handlers never appear in serial
+
+The discrepancy between serial (our firmware) and HTTP (other firmware) is explained by a **reflash during the 15-30 second wait** between boot verification and HTTP testing. The board reboots with the other session's firmware silently.
+
+### Confirmed via Serial (Our Firmware)
+```
+I (1874) tollgate_api: TollGate API started on port 2121
+I (1878) beacon_price: Built IE: price=21 sats, step=60000, metric=milliseconds
+I (1886) beacon_price: Price advertising started (beacon + probe response)
+I (1893) market: Market scanner initialized
+I (1896) tollgate_main: === AP-only services started (no STA) ===
+```
+
+### ESP32 APSTA Channel Behavior (Confirmed from ESP-IDF docs)
+From `esp-idf/docs/en/api-guides/wifi.rst:1684`:
+> In station/AP-coexistence mode, the home channel of AP and station must be the same. The station's home channel is always in priority. The AP switches using Channel Switch Announcement (CSA).
+
+AP channel mismatch (AP=0/auto, router=10) is **NOT** the cause of reason=211. The ESP32 scans all channels regardless.
+
+### Fixes Applied
+1. `market_tick()`: Update `last_scan_ms` on scan failure — prevents 1-second retry spam
+2. `market_tick()`: Log failure count, suppress after 3 failures (every 30th thereafter)
+3. `config.c`: AP channel default changed from 1 to 0 (auto-select)
+4. `tollgate_api.c`: Debug logging on `/market` and `/` handlers, check registration return
diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 6408e14..abbe53b 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -21,6 +21,8 @@ idf_component_register(SRCS "tollgate_main.c"
                             "local_relay.c"
                             "relay_selector.c"
                             "sync_manager.c"
+                            "beacon_price.c"
+                            "market.c"
                     INCLUDE_DIRS "."
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
                              lwip json esp_http_client mbedtls esp-tls log spiffs
diff --git a/main/beacon_price.c b/main/beacon_price.c
new file mode 100644
index 0000000..b87e289
--- /dev/null
+++ b/main/beacon_price.c
@@ -0,0 +1,103 @@
+#include "beacon_price.h"
+#include "config.h"
+#include "identity.h"
+#include "esp_log.h"
+#include "esp_wifi.h"
+#include "mbedtls/sha256.h"
+#include <string.h>
+
+static const char *TAG = "beacon_price";
+static bool s_active = false;
+
+void beacon_price_hash_mint(const char *mint_url, uint8_t hash_out[4])
+{
+    uint8_t full_hash[32];
+    mbedtls_sha256((const unsigned char *)mint_url, strlen(mint_url), full_hash, 0);
+    memcpy(hash_out, full_hash, 4);
+}
+
+void beacon_price_hash_npub(const char *npub_hex, uint8_t hash_out[4])
+{
+    uint8_t full_hash[32];
+    mbedtls_sha256((const unsigned char *)npub_hex, strlen(npub_hex), full_hash, 0);
+    memcpy(hash_out, full_hash, 4);
+}
+
+void beacon_price_build_ie(tollgate_price_ie_t *ie)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+    const tollgate_identity_t *id = identity_get();
+
+    memset(ie, 0, sizeof(*ie));
+    ie->element_id = WIFI_VENDOR_IE_ELEMENT_ID;
+    ie->length = 4 + TOLLGATE_IE_PAYLOAD_SIZE;
+    ie->vendor_oui[0] = TOLLGATE_OUI_0;
+    ie->vendor_oui[1] = TOLLGATE_OUI_1;
+    ie->vendor_oui[2] = TOLLGATE_OUI_2;
+    ie->vendor_oui_type = TOLLGATE_IE_TYPE;
+
+    tollgate_price_payload_t *p = &ie->payload;
+    p->version = TOLLGATE_IE_VERSION;
+    p->metric = (strcmp(cfg->metric, "bytes") == 0) ? 1 : 0;
+    p->price_per_step = (uint16_t)cfg->price_per_step;
+
+    bool is_bytes = (strcmp(cfg->metric, "bytes") == 0);
+    p->step_size = is_bytes ? (uint32_t)cfg->step_size_bytes : (uint32_t)cfg->step_size_ms;
+
+    beacon_price_hash_mint(cfg->mint_url, p->mint_hash);
+
+    p->geohash_len = (uint8_t)strnlen(cfg->nostr_geohash, TOLLGATE_IE_GEOHASH_MAX);
+    memcpy(p->geohash, cfg->nostr_geohash, p->geohash_len);
+    if (p->geohash_len < TOLLGATE_IE_GEOHASH_MAX) {
+        memset(p->geohash + p->geohash_len, 0, TOLLGATE_IE_GEOHASH_MAX - p->geohash_len);
+    }
+
+    if (id && id->initialized) {
+        beacon_price_hash_npub(id->npub_hex, p->npub_hash);
+    }
+
+    ESP_LOGI(TAG, "Built IE: price=%lu sats, step=%lu, metric=%s, geohash=%.*s",
+             (unsigned long)p->price_per_step, (unsigned long)p->step_size,
+             p->metric ? "bytes" : "milliseconds",
+             p->geohash_len, p->geohash);
+}
+
+esp_err_t beacon_price_start(void)
+{
+    if (s_active) {
+        ESP_LOGW(TAG, "Already active");
+        return ESP_OK;
+    }
+
+    static tollgate_price_ie_t s_ie;
+    beacon_price_build_ie(&s_ie);
+
+    esp_err_t ret = esp_wifi_set_vendor_ie(true, WIFI_VND_IE_TYPE_BEACON,
+                                            WIFI_VND_IE_ID_0, &s_ie);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to set beacon vendor IE: %s", esp_err_to_name(ret));
+        return ret;
+    }
+
+    ret = esp_wifi_set_vendor_ie(true, WIFI_VND_IE_TYPE_PROBE_RESP,
+                                  WIFI_VND_IE_ID_1, &s_ie);
+    if (ret != ESP_OK) {
+        ESP_LOGW(TAG, "Failed to set probe resp vendor IE: %s", esp_err_to_name(ret));
+    }
+
+    s_active = true;
+    ESP_LOGI(TAG, "Price advertising started (beacon + probe response)");
+    return ESP_OK;
+}
+
+esp_err_t beacon_price_stop(void)
+{
+    if (!s_active) return ESP_OK;
+
+    esp_wifi_set_vendor_ie(false, WIFI_VND_IE_TYPE_BEACON, WIFI_VND_IE_ID_0, NULL);
+    esp_wifi_set_vendor_ie(false, WIFI_VND_IE_TYPE_PROBE_RESP, WIFI_VND_IE_ID_1, NULL);
+
+    s_active = false;
+    ESP_LOGI(TAG, "Price advertising stopped");
+    return ESP_OK;
+}
diff --git a/main/beacon_price.h b/main/beacon_price.h
new file mode 100644
index 0000000..cb2eb5b
--- /dev/null
+++ b/main/beacon_price.h
@@ -0,0 +1,44 @@
+#ifndef BEACON_PRICE_H
+#define BEACON_PRICE_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define TOLLGATE_OUI_0       0xC0
+#define TOLLGATE_OUI_1       0xFF
+#define TOLLGATE_OUI_2       0xEE
+#define TOLLGATE_IE_TYPE     0x01
+#define TOLLGATE_IE_VERSION  1
+
+#define TOLLGATE_IE_GEOHASH_MAX 9
+
+typedef struct __attribute__((packed)) {
+    uint8_t version;
+    uint8_t metric;
+    uint16_t price_per_step;
+    uint32_t step_size;
+    uint8_t mint_hash[4];
+    uint8_t geohash_len;
+    char geohash[TOLLGATE_IE_GEOHASH_MAX];
+    uint8_t npub_hash[4];
+} tollgate_price_payload_t;
+
+#define TOLLGATE_IE_PAYLOAD_SIZE sizeof(tollgate_price_payload_t)
+#define TOLLGATE_IE_TOTAL_SIZE   (6 + TOLLGATE_IE_PAYLOAD_SIZE)
+
+typedef struct __attribute__((packed)) {
+    uint8_t element_id;
+    uint8_t length;
+    uint8_t vendor_oui[3];
+    uint8_t vendor_oui_type;
+    tollgate_price_payload_t payload;
+} tollgate_price_ie_t;
+
+esp_err_t beacon_price_start(void);
+esp_err_t beacon_price_stop(void);
+void beacon_price_build_ie(tollgate_price_ie_t *ie);
+void beacon_price_hash_mint(const char *mint_url, uint8_t hash_out[4]);
+void beacon_price_hash_npub(const char *npub_hex, uint8_t hash_out[4]);
+
+#endif
diff --git a/main/config.h b/main/config.h
index 1e580e9..af372af 100644
--- a/main/config.h
+++ b/main/config.h
@@ -69,6 +69,10 @@ typedef struct {
     int nostr_seed_relay_count;
     int nostr_sync_interval_s;
     int nostr_fallback_sync_interval_s;
+
+    bool market_enabled;
+    int market_scan_interval_s;
+    bool client_auto_switch;
 } tollgate_config_t;
 
 void tollgate_config_derive_unique(tollgate_config_t *cfg);
diff --git a/main/cvm_server.c b/main/cvm_server.c
index 644738b..a4804d2 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -8,6 +8,7 @@
 #include "nucula_wallet.h"
 #include "cJSON.h"
 #include "esp_log.h"
+#include "esp_timer.h"
 #include "esp_tls.h"
 #include "esp_crt_bundle.h"
 #include "esp_random.h"
@@ -576,7 +577,7 @@ static void cvm_relay_task(void *arg)
                     char *text = parse_ws_text_frame(buf, rlen);
                     if (text) {
                         if (strlen(text) > 0) {
-                            process_relay_message(tls, relay_url, text);
+                            process_relay_message(relay_url, text);
                         }
                         free(text);
                     }
diff --git a/main/market.c b/main/market.c
new file mode 100644
index 0000000..c8a0b6d
--- /dev/null
+++ b/main/market.c
@@ -0,0 +1,237 @@
+#include "market.h"
+#include "beacon_price.h"
+#include "config.h"
+#include "identity.h"
+#include "esp_log.h"
+#include "esp_wifi.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+
+static const char *TAG = "market";
+static market_t s_market;
+static bool s_initialized = false;
+
+static int64_t get_time_ms(void)
+{
+    return (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+}
+
+static bool oui_matches(const uint8_t oui[3])
+{
+    return oui[0] == TOLLGATE_OUI_0 && oui[1] == TOLLGATE_OUI_1 && oui[2] == TOLLGATE_OUI_2;
+}
+
+static int find_entry_by_bssid(const uint8_t bssid[6])
+{
+    for (int i = 0; i < MARKET_MAX_ENTRIES; i++) {
+        if (s_market.entries[i].valid && memcmp(s_market.entries[i].bssid, bssid, 6) == 0) {
+            return i;
+        }
+    }
+    return -1;
+}
+
+static int find_free_slot(void)
+{
+    for (int i = 0; i < MARKET_MAX_ENTRIES; i++) {
+        if (!s_market.entries[i].valid) return i;
+    }
+    int oldest = 0;
+    int64_t oldest_time = s_market.entries[0].discovered_ms;
+    for (int i = 1; i < MARKET_MAX_ENTRIES; i++) {
+        if (s_market.entries[i].discovered_ms < oldest_time) {
+            oldest_time = s_market.entries[i].discovered_ms;
+            oldest = i;
+        }
+    }
+    return oldest;
+}
+
+void market_parse_vendor_ie(const uint8_t sa[6], const vendor_ie_data_t *ie, int rssi)
+{
+    if (!ie || ie->length < 4 + TOLLGATE_IE_PAYLOAD_SIZE) return;
+    if (!oui_matches(ie->vendor_oui)) return;
+    if (ie->vendor_oui_type != TOLLGATE_IE_TYPE) return;
+
+    const tollgate_price_payload_t *payload = (const tollgate_price_payload_t *)ie->payload;
+    if (payload->version != TOLLGATE_IE_VERSION) return;
+
+    const tollgate_identity_t *id = identity_get();
+    if (id && id->initialized) {
+        uint8_t my_npub_hash[4];
+        beacon_price_hash_npub(id->npub_hex, my_npub_hash);
+        if (memcmp(payload->npub_hash, my_npub_hash, 4) == 0) return;
+    }
+
+    int idx = find_entry_by_bssid(sa);
+    if (idx < 0) {
+        idx = find_free_slot();
+        if (s_market.count < MARKET_MAX_ENTRIES) s_market.count++;
+    }
+
+    market_entry_t *entry = &s_market.entries[idx];
+    memcpy(entry->bssid, sa, 6);
+    entry->rssi = (int8_t)rssi;
+    entry->price_per_step = payload->price_per_step;
+    entry->step_size = payload->step_size;
+    entry->metric = payload->metric;
+    memcpy(entry->mint_hash, payload->mint_hash, 4);
+    memcpy(entry->npub_hash, payload->npub_hash, 4);
+
+    uint8_t gh_len = payload->geohash_len;
+    if (gh_len > TOLLGATE_IE_GEOHASH_MAX) gh_len = TOLLGATE_IE_GEOHASH_MAX;
+    memcpy(entry->geohash, payload->geohash, gh_len);
+    entry->geohash[gh_len] = '\0';
+
+    entry->discovered_ms = get_time_ms();
+    entry->valid = true;
+    entry->ssid[0] = '\0';
+
+    ESP_LOGI(TAG, "Discovered TollGate %02X:%02X:%02X:%02X:%02X:%02X price=%lu sats step=%lu metric=%s RSSI=%d",
+             sa[0], sa[1], sa[2], sa[3], sa[4], sa[5],
+             (unsigned long)payload->price_per_step, (unsigned long)payload->step_size,
+             payload->metric ? "bytes" : "milliseconds", rssi);
+}
+
+static void vendor_ie_cb(void *ctx, wifi_vendor_ie_type_t type,
+                          const uint8_t sa[6], const vendor_ie_data_t *vnd_ie, int rssi)
+{
+    (void)ctx;
+    (void)type;
+    if (!vnd_ie) return;
+    market_parse_vendor_ie(sa, vnd_ie, rssi);
+}
+
+static void scan_done_cb(void *arg, esp_event_base_t event_base,
+                          int32_t event_id, void *event_data)
+{
+    (void)arg;
+    (void)event_base;
+    (void)event_id;
+    (void)event_data;
+
+    s_market.scanning = false;
+
+    uint16_t ap_count = 0;
+    esp_wifi_scan_get_ap_num(&ap_count);
+    if (ap_count == 0) return;
+
+    uint16_t max_aps = ap_count > 20 ? 20 : ap_count;
+    wifi_ap_record_t *ap_records = malloc(max_aps * sizeof(wifi_ap_record_t));
+    if (!ap_records) return;
+
+    esp_wifi_scan_get_ap_records(&max_aps, ap_records);
+
+    for (int i = 0; i < max_aps; i++) {
+        for (int j = 0; j < MARKET_MAX_ENTRIES; j++) {
+            if (!s_market.entries[j].valid) continue;
+            if (memcmp(s_market.entries[j].bssid, ap_records[i].bssid, 6) == 0) {
+                memcpy(s_market.entries[j].ssid, ap_records[i].ssid, 32);
+                s_market.entries[j].ssid[32] = '\0';
+                s_market.entries[j].rssi = ap_records[i].rssi;
+                break;
+            }
+        }
+    }
+    free(ap_records);
+    s_market.last_scan_ms = get_time_ms();
+
+    ESP_LOGI(TAG, "Scan complete: %d APs, %d TollGates found", max_aps, s_market.count);
+}
+
+static esp_event_handler_instance_t s_scan_done_handler = NULL;
+
+esp_err_t market_init(void)
+{
+    memset(&s_market, 0, sizeof(s_market));
+
+    esp_err_t ret = esp_wifi_set_vendor_ie_cb(vendor_ie_cb, NULL);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to register vendor IE callback: %s", esp_err_to_name(ret));
+        return ret;
+    }
+
+    if (!s_scan_done_handler) {
+        ret = esp_event_handler_instance_register(WIFI_EVENT, WIFI_EVENT_SCAN_DONE,
+                                                   scan_done_cb, NULL, &s_scan_done_handler);
+        if (ret != ESP_OK) {
+            ESP_LOGW(TAG, "Failed to register scan done handler: %s", esp_err_to_name(ret));
+        }
+    }
+
+    s_initialized = true;
+    ESP_LOGI(TAG, "Market scanner initialized");
+    return ESP_OK;
+}
+
+void market_tick(void)
+{
+    if (!s_initialized) return;
+
+    const tollgate_config_t *cfg = tollgate_config_get();
+    if (!cfg->market_enabled) return;
+
+    if (s_market.scanning) return;
+
+    int64_t now = get_time_ms();
+    int64_t elapsed = now - s_market.last_scan_ms;
+    int64_t interval_ms = (int64_t)cfg->market_scan_interval_s * 1000;
+    if (elapsed < interval_ms) return;
+
+    wifi_scan_config_t scan_config = {
+        .ssid = NULL,
+        .bssid = NULL,
+        .channel = 0,
+        .show_hidden = false,
+        .scan_type = WIFI_SCAN_TYPE_PASSIVE,
+        .scan_time.passive = 120,
+    };
+
+    esp_err_t ret = esp_wifi_scan_start(&scan_config, false);
+    if (ret == ESP_OK) {
+        s_market.scanning = true;
+        s_market.last_scan_ms = now;
+        s_market.consecutive_failures = 0;
+        ESP_LOGD(TAG, "Market scan started");
+    } else {
+        s_market.consecutive_failures++;
+        s_market.last_scan_ms = now;
+        if (s_market.consecutive_failures <= 3 || s_market.consecutive_failures % 30 == 0) {
+            ESP_LOGW(TAG, "Scan start failed: %s (failures: %d)", esp_err_to_name(ret), s_market.consecutive_failures);
+        }
+    }
+}
+
+const market_t *market_get(void)
+{
+    return &s_market;
+}
+
+int market_find_cheapest(void)
+{
+    int cheapest = -1;
+    uint32_t best_eff_price = UINT32_MAX;
+
+    for (int i = 0; i < MARKET_MAX_ENTRIES; i++) {
+        if (!s_market.entries[i].valid) continue;
+        if (s_market.entries[i].ssid[0] == '\0') continue;
+
+        uint32_t step = s_market.entries[i].step_size;
+        if (step == 0) continue;
+
+        uint32_t eff;
+        if (s_market.entries[i].metric == 0) {
+            eff = (uint32_t)s_market.entries[i].price_per_step * 60000 / step;
+        } else {
+            uint32_t eff_mb = (uint32_t)s_market.entries[i].price_per_step * 1048576 / step;
+            eff = eff_mb;
+        }
+
+        if (eff < best_eff_price) {
+            best_eff_price = eff;
+            cheapest = i;
+        }
+    }
+    return cheapest;
+}
diff --git a/main/market.h b/main/market.h
new file mode 100644
index 0000000..6dbf43c
--- /dev/null
+++ b/main/market.h
@@ -0,0 +1,40 @@
+#ifndef MARKET_H
+#define MARKET_H
+
+#include "beacon_price.h"
+#include "esp_wifi.h"
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define MARKET_MAX_ENTRIES 10
+
+typedef struct {
+    uint8_t bssid[6];
+    char ssid[33];
+    int8_t rssi;
+    uint16_t price_per_step;
+    uint32_t step_size;
+    uint8_t metric;
+    uint8_t mint_hash[4];
+    uint8_t npub_hash[4];
+    char geohash[TOLLGATE_IE_GEOHASH_MAX + 1];
+    int64_t discovered_ms;
+    bool valid;
+} market_entry_t;
+
+typedef struct {
+    market_entry_t entries[MARKET_MAX_ENTRIES];
+    int count;
+    int64_t last_scan_ms;
+    bool scanning;
+    int consecutive_failures;
+} market_t;
+
+esp_err_t market_init(void);
+void market_tick(void);
+const market_t *market_get(void);
+int market_find_cheapest(void);
+void market_parse_vendor_ie(const uint8_t sa[6], const vendor_ie_data_t *ie, int rssi);
+
+#endif
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index 650b0f3..15640c7 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -4,7 +4,10 @@
 #include "session.h"
 #include "firewall.h"
 #include "nucula_wallet.h"
+#include "mint_health.h"
+#include "market.h"
 #include "esp_log.h"
+#include "esp_system.h"
 #include "cJSON.h"
 #include "lwip/sockets.h"
 #include "lwip/netdb.h"
@@ -471,6 +474,45 @@ static const httpd_uri_t uri_wallet = { .uri = "/wallet", .method = HTTP_GET, .h
 static const httpd_uri_t uri_wallet_swap = { .uri = "/wallet/swap", .method = HTTP_POST, .handler = api_post_wallet_swap };
 static const httpd_uri_t uri_wallet_send = { .uri = "/wallet/send", .method = HTTP_POST, .handler = api_post_wallet_send };
 
+static esp_err_t api_get_market(httpd_req_t *req)
+{
+    const market_t *mkt = market_get();
+
+    cJSON *root = cJSON_CreateObject();
+    cJSON_AddNumberToObject(root, "count", mkt->count);
+    cJSON_AddNumberToObject(root, "last_scan_s", (double)(mkt->last_scan_ms / 1000));
+
+    cJSON *entries = cJSON_CreateArray();
+    for (int i = 0; i < MARKET_MAX_ENTRIES; i++) {
+        if (!mkt->entries[i].valid) continue;
+        const market_entry_t *e = &mkt->entries[i];
+
+        cJSON *entry = cJSON_CreateObject();
+        char bssid_str[18];
+        snprintf(bssid_str, sizeof(bssid_str), "%02X:%02X:%02X:%02X:%02X:%02X",
+                 e->bssid[0], e->bssid[1], e->bssid[2],
+                 e->bssid[3], e->bssid[4], e->bssid[5]);
+        cJSON_AddStringToObject(entry, "bssid", bssid_str);
+        cJSON_AddStringToObject(entry, "ssid", e->ssid[0] ? e->ssid : "unknown");
+        cJSON_AddNumberToObject(entry, "rssi", e->rssi);
+        cJSON_AddNumberToObject(entry, "price_per_step", e->price_per_step);
+        cJSON_AddNumberToObject(entry, "step_size", (double)e->step_size);
+        cJSON_AddStringToObject(entry, "metric", e->metric ? "bytes" : "milliseconds");
+        if (e->geohash[0]) cJSON_AddStringToObject(entry, "geohash", e->geohash);
+        cJSON_AddItemToArray(entries, entry);
+    }
+    cJSON_AddItemToObject(root, "entries", entries);
+
+    char *json = cJSON_PrintUnformatted(root);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(root);
+    return ESP_OK;
+}
+
+static const httpd_uri_t uri_market = { .uri = "/market", .method = HTTP_GET, .handler = api_get_market };
+
 esp_err_t tollgate_api_start(void)
 {
     if (s_api_server) return ESP_OK;
@@ -494,6 +536,7 @@ esp_err_t tollgate_api_start(void)
     httpd_register_uri_handler(s_api_server, &uri_wallet);
     httpd_register_uri_handler(s_api_server, &uri_wallet_swap);
     httpd_register_uri_handler(s_api_server, &uri_wallet_send);
+    httpd_register_uri_handler(s_api_server, &uri_market);
 
     ESP_LOGI(TAG, "TollGate API started on port 2121");
     return ESP_OK;
diff --git a/main/tollgate_client.c b/main/tollgate_client.c
index ac8dcfe..a81d16f 100644
--- a/main/tollgate_client.c
+++ b/main/tollgate_client.c
@@ -1,6 +1,7 @@
 #include "tollgate_client.h"
 #include "config.h"
 #include "nucula_wallet.h"
+#include "market.h"
 #include "esp_log.h"
 #include "esp_http_client.h"
 #include "esp_crt_bundle.h"
@@ -343,6 +344,19 @@ esp_err_t tollgate_client_on_sta_connected(const char *gw_ip_str)
     s_state = TG_CLIENT_PAID;
 
     ESP_LOGI(TAG, "upstream TollGate paid: %lldms allotment", (long long)allotment);
+
+    const market_t *mkt = market_get();
+    int cheapest = market_find_cheapest();
+    if (cheapest >= 0 && mkt->entries[cheapest].valid && mkt->entries[cheapest].ssid[0] != '\0') {
+        uint32_t upstream_step = s_discovery.step_size_ms > 0 ? s_discovery.step_size_ms : 1;
+        uint32_t upstream_eff = (uint32_t)s_discovery.price_per_step * 60000 / upstream_step;
+        uint32_t cheap_step = mkt->entries[cheapest].step_size > 0 ? mkt->entries[cheapest].step_size : 1;
+        uint32_t cheap_eff = (uint32_t)mkt->entries[cheapest].price_per_step * 60000 / cheap_step;
+        if (cheap_eff < upstream_eff) {
+            ESP_LOGW(TAG, "CHEAPER TOLLGATE AVAILABLE: %s at %lu sats/min vs upstream %lu sats/min",
+                     mkt->entries[cheapest].ssid, (unsigned long)cheap_eff, (unsigned long)upstream_eff);
+        }
+    }
     return ESP_OK;
 }
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 4741765..f062cb6 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -27,6 +27,8 @@
 #include "local_relay.h"
 #include "relay_selector.h"
 #include "sync_manager.h"
+#include "beacon_price.h"
+#include "market.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -38,6 +40,8 @@ static esp_netif_t *s_sta_netif = NULL;
 static esp_netif_t *s_ap_netif = NULL;
 static int s_retry_count = 0;
 static bool s_services_running = false;
+static bool s_ap_services_running = false;
+static bool s_sta_connecting = false;
 static SemaphoreHandle_t s_services_mutex = NULL;
 static char s_ap_ip_str[16] = "10.0.0.1";
 
@@ -46,23 +50,42 @@ static sync_manager_t s_sync_manager;
 
 static void start_services(void);
 static void stop_services(void);
+static void start_ap_services(void);
+
+static void start_ap_services(void)
+{
+    if (s_ap_services_running) return;
+
+    tollgate_api_start();
+    beacon_price_start();
+    market_init();
+
+    s_ap_services_running = true;
+    ESP_LOGI(TAG, "=== AP-only services started (no STA) ===");
+}
 
 static void wifi_event_handler(void *arg, esp_event_base_t event_base,
                                 int32_t event_id, void *event_data)
 {
     if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) {
-        wifi_config_t wifi_cfg;
-        if (tollgate_config_get_wifi(&wifi_cfg) == ESP_OK) {
-            esp_wifi_set_config(WIFI_IF_STA, &wifi_cfg);
+        if (!s_sta_connecting) {
+            wifi_config_t wifi_cfg;
+            if (tollgate_config_get_wifi(&wifi_cfg) == ESP_OK) {
+                esp_wifi_set_config(WIFI_IF_STA, &wifi_cfg);
+            }
+            s_sta_connecting = true;
+            esp_wifi_connect();
         }
-        esp_wifi_connect();
     } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) {
+        wifi_event_sta_disconnected_t *disc = (wifi_event_sta_disconnected_t *)event_data;
         s_retry_count++;
-        ESP_LOGW(TAG, "WiFi disconnected, retry %d/%d", s_retry_count, MAX_STA_RETRY);
+        s_sta_connecting = false;
+        ESP_LOGW(TAG, "WiFi disconnected, reason=%d, retry %d/%d", disc->reason, s_retry_count, MAX_STA_RETRY);
         tollgate_client_on_sta_disconnected();
         if (s_services_running) stop_services();
         if (s_retry_count < MAX_STA_RETRY) {
             vTaskDelay(pdMS_TO_TICKS(2000));
+            s_sta_connecting = true;
             esp_wifi_connect();
         } else {
             wifi_config_t wifi_cfg;
@@ -72,7 +95,11 @@ static void wifi_event_handler(void *arg, esp_event_base_t event_base,
                 int idx = cfg->current_network;
                 ESP_LOGI(TAG, "Trying WiFi network %d: %s", idx, cfg->networks[idx].ssid);
                 s_retry_count = 0;
+                vTaskDelay(pdMS_TO_TICKS(2000));
+                s_sta_connecting = true;
                 esp_wifi_connect();
+            } else {
+                ESP_LOGI(TAG, "All WiFi networks exhausted, STA stopped (market scans active)");
             }
         }
     } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_AP_STACONNECTED) {
@@ -85,6 +112,8 @@ static void wifi_event_handler(void *arg, esp_event_base_t event_base,
         ESP_LOGI(TAG, "Station disconnected: MAC=%02x:%02x:%02x:%02x:%02x:%02x",
                  event->mac[0], event->mac[1], event->mac[2],
                  event->mac[3], event->mac[4], event->mac[5]);
+    } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_AP_START) {
+        start_ap_services();
     }
 }
 
@@ -163,7 +192,11 @@ static void start_services(void)
 
     dns_server_start(ap_ip_info.ip, upstream_dns);
     captive_portal_start(cfg->ap_ip_str);
-    tollgate_api_start();
+    if (!s_ap_services_running) {
+        tollgate_api_start();
+        beacon_price_start();
+        market_init();
+    }
 
     relay_selector_init(&s_relay_selector);
     relay_selector_seed_from_config(&s_relay_selector);
@@ -198,7 +231,10 @@ static void stop_services(void)
     }
 
     captive_portal_stop();
-    tollgate_api_stop();
+    if (!s_ap_services_running) {
+        tollgate_api_stop();
+        beacon_price_stop();
+    }
     dns_server_stop();
     cvm_server_stop();
     sync_manager_stop(&s_sync_manager);
@@ -321,8 +357,7 @@ void app_main(void)
         ESP_LOGI(TAG, "STA configured for SSID: %s", tcfg2->networks[tcfg2->current_network].ssid);
     }
 
-    ESP_ERROR_CHECK(esp_wifi_set_country_code("DE", false));
-    ESP_LOGI(TAG, "WiFi country code set to DE (EU regulatory domain)");
+    ESP_ERROR_CHECK(esp_wifi_set_country_code("DE", true));
 
     ESP_ERROR_CHECK(esp_wifi_start());
 
@@ -341,5 +376,6 @@ void app_main(void)
         session_tick();
         tollgate_client_tick();
         lightning_payout_tick();
+        market_tick();
     }
 }
diff --git a/tests/integration/test-market.mjs b/tests/integration/test-market.mjs
new file mode 100644
index 0000000..20f062f
--- /dev/null
+++ b/tests/integration/test-market.mjs
@@ -0,0 +1,60 @@
+import { execSync } from 'child_process';
+
+const API_URL = `http://${process.env.TOLLGATE_IP || '10.192.45.1'}:2121`;
+
+function run(cmd) {
+  try { return execSync(cmd, { encoding: 'utf8', timeout: 15000 }); }
+  catch (e) { return e.stdout || null; }
+}
+
+function runJson(cmd) {
+  const out = run(cmd);
+  try { return out ? JSON.parse(out) : null; }
+  catch { return null; }
+}
+
+let passed = 0, failed = 0;
+function assert(cond, msg) {
+  if (cond) { console.log(`  PASS: ${msg}`); passed++; }
+  else { console.log(`  FAIL: ${msg}`); failed++; }
+}
+
+console.log('=== test-market (GET /market) ===\n');
+
+console.log('--- /market endpoint responds ---');
+{
+  const data = runJson(`curl -s --connect-timeout 5 ${API_URL}/market`);
+  assert(data !== null, '/market returns valid JSON');
+  assert(typeof data.count === 'number', `count is number (got ${data?.count})`);
+  assert(Array.isArray(data.entries), 'entries is array');
+}
+
+console.log('\n--- /market entry structure ---');
+{
+  const data = runJson(`curl -s --connect-timeout 5 ${API_URL}/market`);
+  if (data && data.entries && data.entries.length > 0) {
+    const e = data.entries[0];
+    assert(typeof e.bssid === 'string', `bssid is string (got ${e.bssid})`);
+    assert(typeof e.ssid === 'string', `ssid is string (got ${e.ssid})`);
+    assert(typeof e.rssi === 'number', `rssi is number (got ${e.rssi})`);
+    assert(typeof e.price_per_step === 'number', `price_per_step is number (got ${e.price_per_step})`);
+    assert(typeof e.step_size === 'number', `step_size is number (got ${e.step_size})`);
+    assert(typeof e.metric === 'string', `metric is string (got ${e.metric})`);
+  } else {
+    console.log('  SKIP: no entries found (scan may not have run yet)');
+  }
+}
+
+console.log('\n--- /market with no discovered TollGates ---');
+{
+  const data = runJson(`curl -s --connect-timeout 5 ${API_URL}/market`);
+  if (data && data.count === 0) {
+    assert(data.entries.length === 0, 'empty entries array when count=0');
+    console.log('  INFO: no nearby TollGates discovered yet (expected if only one board)');
+  } else if (data && data.count > 0) {
+    console.log(`  INFO: ${data.count} nearby TollGate(s) discovered`);
+  }
+}
+
+console.log(`\n=== Results: ${passed} passed, ${failed} failed ===`);
+process.exit(failed > 0 ? 1 : 0);
diff --git a/tests/integration/test-price-discovery.mjs b/tests/integration/test-price-discovery.mjs
new file mode 100644
index 0000000..6762130
--- /dev/null
+++ b/tests/integration/test-price-discovery.mjs
@@ -0,0 +1,138 @@
+import { execSync } from 'child_process';
+
+const BOARD_A_IP = process.env.TOLLGATE_IP || '10.185.47.1';
+const BOARD_B_IP = process.env.TOLLGATE_B_IP || process.env.TOLLGATE_IP_B || '10.192.45.1';
+const API_A = `http://${BOARD_A_IP}:2121`;
+const API_B = `http://${BOARD_B_IP}:2121`;
+
+function run(cmd) {
+  try { return execSync(cmd, { encoding: 'utf8', timeout: 15000 }); }
+  catch (e) { return e.stdout || null; }
+}
+
+function runJson(cmd) {
+  const out = run(cmd);
+  try { return out ? JSON.parse(out) : null; }
+  catch { return null; }
+}
+
+let passed = 0, failed = 0;
+function assert(cond, msg) {
+  if (cond) { console.log(`  PASS: ${msg}`); passed++; }
+  else { console.log(`  FAIL: ${msg}`); failed++; }
+}
+
+function canReach(url) {
+  const result = run(`curl -s --connect-timeout 3 --max-time 5 -o /dev/null -w "%{http_code}" ${url}`);
+  return result && result.trim() !== '000' && result.trim() !== '';
+}
+
+console.log('=== test-price-discovery (two-board) ===\n');
+
+const reachA = canReach(`${API_A}/market`);
+const reachB = canReach(`${API_B}/market`);
+
+console.log(`Reachability: Board A=${reachA ? 'YES' : 'NO'}, Board B=${reachB ? 'YES' : 'NO'}\n`);
+
+if (!reachA && !reachB) {
+  console.log('FATAL: Neither board reachable. Check TOLLGATE_IP and TOLLGATE_B_IP');
+  process.exit(1);
+}
+
+console.log('--- Board A: market endpoint ---');
+{
+  if (reachA) {
+    const data = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_A}/market`);
+    assert(data !== null, 'Board A /market returns JSON');
+    assert(typeof data?.count === 'number', `Board A count is ${data?.count}`);
+    if (data && data.entries) {
+      console.log(`  Board A sees ${data.count} nearby TollGate(s):`);
+      for (const e of data.entries) {
+        console.log(`    ${e.ssid} (BSSID: ${e.bssid}) — ${e.price_per_step} sats/step, RSSI: ${e.rssi}`);
+      }
+    }
+  } else {
+    console.log('  SKIP: Board A not reachable');
+  }
+}
+
+console.log('\n--- Board B: market endpoint ---');
+{
+  if (reachB) {
+    const data = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_B}/market`);
+    assert(data !== null, 'Board B /market returns JSON');
+    assert(typeof data?.count === 'number', `Board B count is ${data?.count}`);
+    if (data && data.entries) {
+      console.log(`  Board B sees ${data.count} nearby TollGate(s):`);
+      for (const e of data.entries) {
+        console.log(`    ${e.ssid} (BSSID: ${e.bssid}) — ${e.price_per_step} sats/step, RSSI: ${e.rssi}`);
+      }
+    }
+  } else {
+    console.log('  SKIP: Board B not reachable');
+  }
+}
+
+console.log('\n--- Cross-discovery: Board A sees Board B ---');
+{
+  if (reachA) {
+    const mktA = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_A}/market`);
+    if (mktA && mktA.count > 0) {
+      const foundB = mktA.entries.some(e =>
+        e.ssid.startsWith('TollGate-') && e.bssid !== '' && e.price_per_step > 0
+      );
+      assert(foundB, `Board A discovered another TollGate (count=${mktA.count})`);
+    } else {
+      console.log('  INFO: Board A has 0 entries. Scan may need more time.');
+    }
+  } else {
+    console.log('  SKIP: Board A not reachable');
+  }
+}
+
+console.log('\n--- Cross-discovery: Board B sees Board A ---');
+{
+  if (reachB) {
+    const mktB = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_B}/market`);
+    if (mktB && mktB.count > 0) {
+      const foundA = mktB.entries.some(e =>
+        e.ssid.startsWith('TollGate-') && e.bssid !== '' && e.price_per_step > 0
+      );
+      assert(foundA, `Board B discovered another TollGate (count=${mktB.count})`);
+    } else {
+      console.log('  INFO: Board B has 0 entries. Scan may need more time.');
+    }
+  } else {
+    console.log('  SKIP: Board B not reachable');
+  }
+}
+
+console.log('\n--- Discovery data integrity ---');
+{
+  const boards = [];
+  if (reachA) {
+    const mktA = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_A}/market`);
+    if (mktA?.entries) boards.push({ name: 'A', data: mktA });
+  }
+  if (reachB) {
+    const mktB = runJson(`curl -s --connect-timeout 5 --max-time 10 ${API_B}/market`);
+    if (mktB?.entries) boards.push({ name: 'B', data: mktB });
+  }
+
+  for (const { name, data } of boards) {
+    for (const e of data.entries) {
+      assert(typeof e.price_per_step === 'number' && e.price_per_step > 0,
+        `Board ${name} entry has valid price (${e.price_per_step})`);
+      assert(typeof e.step_size === 'number' && e.step_size > 0,
+        `Board ${name} entry has valid step_size (${e.step_size})`);
+      assert(typeof e.metric === 'string' && e.metric.length > 0,
+        `Board ${name} entry has valid metric (${e.metric})`);
+      assert(typeof e.rssi === 'number',
+        `Board ${name} entry has valid RSSI (${e.rssi})`);
+      break;
+    }
+  }
+}
+
+console.log(`\n=== Results: ${passed} passed, ${failed} failed ===`);
+process.exit(failed > 0 ? 1 : 0);
diff --git a/tests/unit/Makefile b/tests/unit/Makefile
index 6d13e4d..7bd3f1e 100644
--- a/tests/unit/Makefile
+++ b/tests/unit/Makefile
@@ -22,7 +22,7 @@ LDFLAGS := -lmbedcrypto -lcjson -lm
 
 SECP256K1_OBJ := secp256k1.o precomputed_ecmult.o precomputed_ecmult_gen.o
 
-TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server test_display test_negentropy_adapter
+TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server test_display test_negentropy_adapter test_beacon_price test_market
 
 .PHONY: all test clean $(TESTS)
 
@@ -63,8 +63,8 @@ test_cashu: test_cashu.c $(REPO_ROOT)/main/cashu.c
 test_session: test_session.c $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c
         $(CC) $(CFLAGS) $< $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c -o $@ $(LDFLAGS)
 
-test_tollgate_client: test_tollgate_client.c
-        $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
+test_tollgate_client: test_tollgate_client.c $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c
+        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $< $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c -o $@ $(LDFLAGS)
 
 test_lnurl_pay: test_lnurl_pay.c
         $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
@@ -87,5 +87,11 @@ test_display: test_display.c
 test_negentropy_adapter: test_negentropy_adapter.c
         $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
+test_beacon_price: test_beacon_price.c $(REPO_ROOT)/main/beacon_price.c
+        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $< $(REPO_ROOT)/main/beacon_price.c -o $@ $(LDFLAGS)
+
+test_market: test_market.c $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c
+        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $< $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c -o $@ $(LDFLAGS)
+
 clean:
         rm -f $(TESTS) $(SECP256K1_OBJ)
diff --git a/tests/unit/stubs/esp_wifi.h b/tests/unit/stubs/esp_wifi.h
index 6aa5787..5eb14bf 100644
--- a/tests/unit/stubs/esp_wifi.h
+++ b/tests/unit/stubs/esp_wifi.h
@@ -2,6 +2,7 @@
 #define STUBS_ESP_WIFI_H
 
 #include <stdint.h>
+#include <stdbool.h>
 #include <string.h>
 #include "esp_err.h"
 
@@ -37,4 +38,67 @@ static inline esp_err_t esp_wifi_set_config(int ifx, const wifi_config_t *cfg) {
 static inline esp_err_t esp_wifi_set_mode(uint8_t mode) { (void)mode; return ESP_OK; }
 static inline esp_err_t esp_wifi_start(void) { return ESP_OK; }
 
+#define WIFI_VENDOR_IE_ELEMENT_ID 0xDD
+
+typedef enum {
+    WIFI_VND_IE_TYPE_BEACON,
+    WIFI_VND_IE_TYPE_PROBE_REQ,
+    WIFI_VND_IE_TYPE_PROBE_RESP,
+    WIFI_VND_IE_TYPE_ASSOC_REQ,
+    WIFI_VND_IE_TYPE_ASSOC_RESP,
+} wifi_vendor_ie_type_t;
+
+typedef enum {
+    WIFI_VND_IE_ID_0,
+    WIFI_VND_IE_ID_1,
+} wifi_vendor_ie_id_t;
+
+typedef struct {
+    uint8_t element_id;
+    uint8_t length;
+    uint8_t vendor_oui[3];
+    uint8_t vendor_oui_type;
+    uint8_t payload[0];
+} vendor_ie_data_t;
+
+typedef void (*esp_vendor_ie_cb_t)(void *ctx, wifi_vendor_ie_type_t type, const uint8_t sa[6], const vendor_ie_data_t *vnd_ie, int rssi);
+
+static inline esp_err_t esp_wifi_set_vendor_ie(bool enable, wifi_vendor_ie_type_t type, wifi_vendor_ie_id_t idx, const void *vnd_ie) { (void)enable; (void)type; (void)idx; (void)vnd_ie; return ESP_OK; }
+static inline esp_err_t esp_wifi_set_vendor_ie_cb(esp_vendor_ie_cb_t cb, void *ctx) { (void)cb; (void)ctx; return ESP_OK; }
+
+#define WIFI_SCAN_TYPE_PASSIVE 0
+
+typedef struct {
+    uint8_t bssid[6];
+    uint8_t ssid[33];
+    uint8_t primary;
+    int second;
+    int8_t rssi;
+    int authmode;
+} wifi_ap_record_t;
+
+typedef struct {
+    uint8_t *ssid;
+    uint8_t *bssid;
+    uint8_t channel;
+    bool show_hidden;
+    int scan_type;
+    union {
+        struct { int min; int max; } active;
+        int passive;
+    } scan_time;
+} wifi_scan_config_t;
+
+static inline esp_err_t esp_wifi_scan_start(const wifi_scan_config_t *cfg, bool block) { (void)cfg; (void)block; return ESP_OK; }
+static inline esp_err_t esp_wifi_scan_get_ap_num(uint16_t *n) { *n = 0; return ESP_OK; }
+static inline esp_err_t esp_wifi_scan_get_ap_records(uint16_t *n, wifi_ap_record_t *records) { (void)records; *n = 0; return ESP_OK; }
+
+#define WIFI_EVENT_SCAN_DONE 3
+
+typedef void *esp_event_handler_instance_t;
+typedef const char *esp_event_base_t;
+#define WIFI_EVENT "WIFI_EVENT"
+
+static inline esp_err_t esp_event_handler_instance_register(esp_event_base_t a, int32_t b, void *c, void *d, esp_event_handler_instance_t *e) { (void)a; (void)b; (void)c; (void)d; (void)e; return ESP_OK; }
+
 #endif
diff --git a/tests/unit/test_beacon_price.c b/tests/unit/test_beacon_price.c
new file mode 100644
index 0000000..9574478
--- /dev/null
+++ b/tests/unit/test_beacon_price.c
@@ -0,0 +1,132 @@
+#include "test_framework.h"
+#include "../../main/config.h"
+#include "../../main/identity.h"
+#include <string.h>
+#include <stdio.h>
+#include <mbedtls/sha256.h>
+
+#include "../../main/beacon_price.h"
+
+static tollgate_config_t g_test_config;
+static tollgate_identity_t g_test_identity;
+
+const tollgate_config_t *tollgate_config_get(void) { return &g_test_config; }
+const tollgate_identity_t *identity_get(void) { return &g_test_identity; }
+
+int main(void)
+{
+    printf("=== test_beacon_price ===\n");
+
+    memset(&g_test_config, 0, sizeof(g_test_config));
+    strncpy(g_test_config.mint_url, "https://testnut.cashu.space", sizeof(g_test_config.mint_url) - 1);
+    strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
+    g_test_config.price_per_step = 21;
+    g_test_config.step_size_ms = 60000;
+    strncpy(g_test_config.nostr_geohash, "u281w0dfz", sizeof(g_test_config.nostr_geohash) - 1);
+
+    memset(&g_test_identity, 0, sizeof(g_test_identity));
+    strncpy(g_test_identity.npub_hex, "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890", 64);
+    g_test_identity.initialized = true;
+
+    printf("\n--- tollgate_price_payload_t size ---\n");
+    {
+        ASSERT_EQ_INT(26, (int)TOLLGATE_IE_PAYLOAD_SIZE, "payload is 26 bytes");
+        ASSERT_EQ_INT(32, (int)TOLLGATE_IE_TOTAL_SIZE, "total IE is 32 bytes");
+    }
+
+    printf("\n--- beacon_price_hash_mint ---\n");
+    {
+        uint8_t hash[4];
+        beacon_price_hash_mint("https://testnut.cashu.space", hash);
+
+        uint8_t expected[32];
+        mbedtls_sha256((const unsigned char *)"https://testnut.cashu.space",
+                       strlen("https://testnut.cashu.space"), expected, 0);
+        ASSERT_MEM_EQ(expected, hash, 4, "mint_hash matches SHA-256 prefix");
+
+        uint8_t hash2[4];
+        beacon_price_hash_mint("https://other.mint.url", hash2);
+        ASSERT(memcmp(hash, hash2, 4) != 0, "different mint URLs produce different hashes");
+    }
+
+    printf("\n--- beacon_price_hash_npub ---\n");
+    {
+        uint8_t hash[4];
+        beacon_price_hash_npub("abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890", hash);
+
+        uint8_t expected[32];
+        mbedtls_sha256((const unsigned char *)"abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
+                       64, expected, 0);
+        ASSERT_MEM_EQ(expected, hash, 4, "npub_hash matches SHA-256 prefix");
+    }
+
+    printf("\n--- beacon_price_build_ie (time metric) ---\n");
+    {
+        tollgate_price_ie_t ie;
+        beacon_price_build_ie(&ie);
+
+        ASSERT_EQ_INT(0xDD, ie.element_id, "element_id is 0xDD");
+        ASSERT_EQ_INT(4 + 26, ie.length, "length is 30 (4 header + 26 payload)");
+        ASSERT_EQ_INT(0xC0, ie.vendor_oui[0], "OUI byte 0");
+        ASSERT_EQ_INT(0xFF, ie.vendor_oui[1], "OUI byte 1");
+        ASSERT_EQ_INT(0xEE, ie.vendor_oui[2], "OUI byte 2");
+        ASSERT_EQ_INT(0x01, ie.vendor_oui_type, "OUI type is 0x01");
+
+        ASSERT_EQ_INT(1, ie.payload.version, "version is 1");
+        ASSERT_EQ_INT(0, ie.payload.metric, "metric is 0 (milliseconds)");
+        ASSERT_EQ_INT(21, ie.payload.price_per_step, "price is 21");
+        ASSERT_EQ_INT(60000, (int)ie.payload.step_size, "step_size is 60000");
+
+        uint8_t expected_mint_hash[4];
+        beacon_price_hash_mint("https://testnut.cashu.space", expected_mint_hash);
+        ASSERT_MEM_EQ(expected_mint_hash, ie.payload.mint_hash, 4, "mint_hash matches");
+
+        ASSERT_EQ_INT(9, ie.payload.geohash_len, "geohash_len is 9");
+        ASSERT(memcmp(ie.payload.geohash, "u281w0dfz", 9) == 0, "geohash matches");
+    }
+
+    printf("\n--- beacon_price_build_ie (bytes metric) ---\n");
+    {
+        strncpy(g_test_config.metric, "bytes", sizeof(g_test_config.metric) - 1);
+        g_test_config.step_size_bytes = 22020096;
+        g_test_config.price_per_step = 5;
+
+        tollgate_price_ie_t ie;
+        beacon_price_build_ie(&ie);
+
+        ASSERT_EQ_INT(1, ie.payload.metric, "metric is 1 (bytes)");
+        ASSERT_EQ_INT(5, ie.payload.price_per_step, "price is 5");
+        ASSERT_EQ_INT(22020096, (int)ie.payload.step_size, "step_size is 22020096 bytes");
+
+        strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
+        g_test_config.step_size_ms = 60000;
+        g_test_config.price_per_step = 21;
+    }
+
+    printf("\n--- roundtrip: build → parse ---\n");
+    {
+        tollgate_price_ie_t ie;
+        beacon_price_build_ie(&ie);
+
+        vendor_ie_data_t *vnd_ie = (vendor_ie_data_t *)&ie;
+
+        ASSERT(vnd_ie->length >= 4 + (int)TOLLGATE_IE_PAYLOAD_SIZE, "vendor IE length sufficient");
+
+        const tollgate_price_payload_t *parsed = (const tollgate_price_payload_t *)vnd_ie->payload;
+        ASSERT_EQ_INT(1, parsed->version, "parsed version");
+        ASSERT_EQ_INT(0, parsed->metric, "parsed metric");
+        ASSERT_EQ_INT(21, parsed->price_per_step, "parsed price");
+        ASSERT_EQ_INT(60000, (int)parsed->step_size, "parsed step_size");
+        ASSERT_EQ_INT(9, parsed->geohash_len, "parsed geohash_len");
+    }
+
+    printf("\n--- struct packing check ---\n");
+    {
+        tollgate_price_ie_t ie;
+        memset(&ie, 0, sizeof(ie));
+        int expected_size = 2 + 3 + 1 + 26;
+        ASSERT_EQ_INT(expected_size, (int)sizeof(tollgate_price_ie_t), "no padding in struct");
+    }
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_market.c b/tests/unit/test_market.c
new file mode 100644
index 0000000..c19d26e
--- /dev/null
+++ b/tests/unit/test_market.c
@@ -0,0 +1,177 @@
+#include "test_framework.h"
+#include "../../main/beacon_price.h"
+#include "../../main/market.h"
+#include "../../main/config.h"
+#include "../../main/identity.h"
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static tollgate_config_t g_test_config;
+static tollgate_identity_t g_test_identity;
+
+const tollgate_config_t *tollgate_config_get(void) { return &g_test_config; }
+const tollgate_identity_t *identity_get(void) { return &g_test_identity; }
+
+static void build_test_ie(tollgate_price_ie_t *ie, uint16_t price, uint32_t step, uint8_t metric,
+                           const char *geohash, const char *mint_url, const char *npub_hex)
+{
+    memset(ie, 0, sizeof(*ie));
+    ie->element_id = 0xDD;
+    ie->length = 4 + TOLLGATE_IE_PAYLOAD_SIZE;
+    ie->vendor_oui[0] = TOLLGATE_OUI_0;
+    ie->vendor_oui[1] = TOLLGATE_OUI_1;
+    ie->vendor_oui[2] = TOLLGATE_OUI_2;
+    ie->vendor_oui_type = TOLLGATE_IE_TYPE;
+
+    ie->payload.version = TOLLGATE_IE_VERSION;
+    ie->payload.metric = metric;
+    ie->payload.price_per_step = price;
+    ie->payload.step_size = step;
+
+    if (mint_url) beacon_price_hash_mint(mint_url, ie->payload.mint_hash);
+    if (npub_hex) beacon_price_hash_npub(npub_hex, ie->payload.npub_hash);
+
+    uint8_t gh_len = (uint8_t)strnlen(geohash, TOLLGATE_IE_GEOHASH_MAX);
+    ie->payload.geohash_len = gh_len;
+    memcpy(ie->payload.geohash, geohash, gh_len);
+}
+
+static void reset_market(void)
+{
+    market_t *m = (market_t *)market_get();
+    memset(m, 0, sizeof(*m));
+}
+
+int main(void)
+{
+    printf("=== test_market ===\n");
+
+    memset(&g_test_config, 0, sizeof(g_test_config));
+    g_test_config.market_enabled = true;
+    g_test_config.market_scan_interval_s = 30;
+    strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
+
+    memset(&g_test_identity, 0, sizeof(g_test_identity));
+    strncpy(g_test_identity.npub_hex, "0000000000000000000000000000000000000000000000000000000000000001", 64);
+    g_test_identity.initialized = true;
+
+    printf("\n--- parse vendor IE (valid) ---\n");
+    {
+        reset_market();
+        tollgate_price_ie_t ie;
+        build_test_ie(&ie, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space",
+                      "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890");
+
+        uint8_t bssid[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0x01};
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -45);
+
+        const market_t *m = market_get();
+        ASSERT_EQ_INT(1, m->count, "one entry added");
+        ASSERT(m->entries[0].valid, "entry is valid");
+        ASSERT_EQ_INT(21, m->entries[0].price_per_step, "price is 21");
+        ASSERT_EQ_INT(60000, (int)m->entries[0].step_size, "step_size is 60000");
+        ASSERT_EQ_INT(0, m->entries[0].metric, "metric is 0 (time)");
+        ASSERT_EQ_INT(-45, m->entries[0].rssi, "rssi is -45");
+        ASSERT(memcmp(m->entries[0].bssid, bssid, 6) == 0, "bssid matches");
+    }
+
+    printf("\n--- parse vendor IE (ignore self) ---\n");
+    {
+        reset_market();
+        tollgate_price_ie_t ie;
+        build_test_ie(&ie, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space",
+                      g_test_identity.npub_hex);
+
+        uint8_t bssid[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0x02};
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -50);
+
+        const market_t *m = market_get();
+        ASSERT_EQ_INT(0, m->count, "self-entry ignored");
+    }
+
+    printf("\n--- parse vendor IE (wrong OUI) ---\n");
+    {
+        reset_market();
+        tollgate_price_ie_t ie;
+        build_test_ie(&ie, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space",
+                      "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890");
+        ie.vendor_oui[0] = 0x00;
+
+        uint8_t bssid[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0x03};
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -40);
+
+        const market_t *m = market_get();
+        ASSERT_EQ_INT(0, m->count, "wrong OUI rejected");
+    }
+
+    printf("\n--- market_find_cheapest ---\n");
+    {
+        reset_market();
+
+        tollgate_price_ie_t ie1, ie2, ie3;
+        build_test_ie(&ie1, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "aaa...npub1");
+        build_test_ie(&ie2, 10, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "bbb...npub2");
+        build_test_ie(&ie3, 50, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "ccc...npub3");
+
+        uint8_t bssid1[6] = {0x01, 0x01, 0x01, 0x01, 0x01, 0x01};
+        uint8_t bssid2[6] = {0x02, 0x02, 0x02, 0x02, 0x02, 0x02};
+        uint8_t bssid3[6] = {0x03, 0x03, 0x03, 0x03, 0x03, 0x03};
+
+        market_parse_vendor_ie(bssid1, (vendor_ie_data_t *)&ie1, -45);
+        market_parse_vendor_ie(bssid2, (vendor_ie_data_t *)&ie2, -50);
+        market_parse_vendor_ie(bssid3, (vendor_ie_data_t *)&ie3, -55);
+
+        const market_t *m = market_get();
+        ASSERT_EQ_INT(3, m->count, "three entries");
+
+        strncpy((char *)m->entries[0].ssid, "TollGate-A", 32);
+        strncpy((char *)m->entries[1].ssid, "TollGate-B", 32);
+        strncpy((char *)m->entries[2].ssid, "TollGate-C", 32);
+
+        int cheapest = market_find_cheapest();
+        ASSERT(cheapest >= 0, "found a cheapest entry");
+        ASSERT_EQ_INT(10, m->entries[cheapest].price_per_step, "cheapest is 10 sats");
+    }
+
+    printf("\n--- update existing entry ---\n");
+    {
+        reset_market();
+        tollgate_price_ie_t ie;
+        build_test_ie(&ie, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "npub1");
+        uint8_t bssid[6] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06};
+
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -45);
+        ASSERT_EQ_INT(1, market_get()->count, "first add");
+
+        build_test_ie(&ie, 15, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "npub1");
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -47);
+        ASSERT_EQ_INT(1, market_get()->count, "update doesn't increase count");
+        ASSERT_EQ_INT(15, market_get()->entries[0].price_per_step, "price updated to 15");
+    }
+
+    printf("\n--- geohash preserved ---\n");
+    {
+        reset_market();
+        tollgate_price_ie_t ie;
+        build_test_ie(&ie, 21, 60000, 0, "u281w0dfz",
+                      "https://testnut.cashu.space", "npub1");
+        uint8_t bssid[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF};
+
+        market_parse_vendor_ie(bssid, (vendor_ie_data_t *)&ie, -40);
+
+        const market_t *m = market_get();
+        ASSERT(m->entries[0].valid, "entry valid");
+        ASSERT_EQ_STR("u281w0dfz", m->entries[0].geohash, "geohash is u281w0dfz");
+    }
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_tollgate_client.c b/tests/unit/test_tollgate_client.c
index 686ad19..eebc747 100644
--- a/tests/unit/test_tollgate_client.c
+++ b/tests/unit/test_tollgate_client.c
@@ -13,6 +13,7 @@ const tollgate_config_t *tollgate_config_get(void) {
 
 uint64_t nucula_wallet_balance(void) { return 100; }
 esp_err_t nucula_wallet_send(uint64_t a, char *b, size_t c) { (void)a; (void)b; (void)c; return ESP_OK; }
+const void *identity_get(void) { return NULL; }
 
 #include "freertos/FreeRTOS.h"