Connection & pairing issues

Work top-down: hub reachable → bridge connected → pair healthy. Each layer has a definitive check.

The app can't connect to the hub

Is the hub up? On the hub machine: c3sync hub status (or just try c3sync hub run in the foreground and read its output).
Is 8443 reachable from the phone's network? The phone uses the WSS listener, not 4222. If the hub sits on a LAN or VPN, the phone must be on it.
Certificate pin failure? The app refuses non-matching certificates by design — there is no override. A pin mismatch after a hub rebuild or hub tls rotate-ca is expected: the old enrollment is invalid. Settings → Remove hub, then re-enroll. (hub tls renew-leaf does not change the pin and needs no re-enrollment.)

Enrollment QR won't scan or is rejected

Enrollment secrets are short-lived — re-run c3sync hub control enroll-phone and scan promptly.
Each QR is single-use. If a scan half-completed, mint a fresh one.
The hub must be running when the phone completes enrollment, since the phone connects to it during the flow.

A host is missing from the Signal map

On that host:

c3bridge service status — is the bridge running? (c3bridge run in a foreground shell shows errors directly.)
c3bridge doctor — checks config, hub reachability (port 4222), and Herdr sockets in one shot.
Herdr itself running? A bridge with no reachable Herdr session reports herdr_unavailable on commands and has nothing to show.
Revoked? c3sync hub control devices on the hub — a revoked bridge can't connect and must be re-enrolled (enroll-bridge + c3bridge init).

Then pull-to-refresh in the app — discovery is on-demand.

Pairing fails

Offers expire (default 5 minutes) — run c3bridge pair again and scan promptly.
Phone and host must both reach the same hub — a phone enrolled against a different hub than the bridge's cannot pair with it.
If pairing succeeds but the bridge shows as inactive under Settings → encrypted channels, the bridge has likely gone offline since — check c3bridge service status.

Paired, but a host shows as unavailable after a revocation elsewhere

Revocation manifests apply when a bridge (re)connects. If you've just revoked a device and things look stale, restart the bridge service on affected hosts to force a reconnect.

After hub recovery (`hub restore`)

Restore rotates the CA and control account: every phone and bridge must re-enroll and re-pair. Phones need Settings → Remove hub first. This is by design — see hub commands & ceremonies.

Still stuck? Capture c3bridge doctor output (it's redacted by design) and open an issue.