@@ -8,9 +8,14 @@ vi.mock('../lanIpCache', () => ({
   refreshOnce: vi.fn().mockResolvedValue(undefined),
   rememberedLanIp: vi.fn().mockResolvedValue(null),
   noteRecord: vi.fn(),
+  noteLanIp: vi.fn(),
   clear: vi.fn(),
 }));
 
+vi.mock('@/services/lanDiscovery', () => ({
+  discoverBloxesOnLan: vi.fn().mockResolvedValue({ found: [], failure: 'not-found', lna: 'granted' }),
+}));
+
 vi.mock('../httpAiClient', async (importOriginal) => {
   const actual = await importOriginal<typeof import('../httpAiClient')>();
   return { ...actual, HttpAiClient: vi.fn() };
@@ -19,10 +24,13 @@ vi.mock('../httpAiClient', async (importOriginal) => {
 import { ipIsPrivateLan, selectAiTransport } from '../aiTransport';
 import * as lanIpCache from '../lanIpCache';
 import { HttpAiClient } from '../httpAiClient';
+import { discoverBloxesOnLan } from '@/services/lanDiscovery';
 
 const findAuthorizedBlox = lanIpCache.findAuthorizedBlox as unknown as ReturnType<typeof vi.fn>;
 const refreshOnce = lanIpCache.refreshOnce as unknown as ReturnType<typeof vi.fn>;
 const rememberedLanIp = lanIpCache.rememberedLanIp as unknown as ReturnType<typeof vi.fn>;
+const noteLanIp = lanIpCache.noteLanIp as unknown as ReturnType<typeof vi.fn>;
+const discoverMock = discoverBloxesOnLan as unknown as ReturnType<typeof vi.fn>;
 const HttpAiClientMock = HttpAiClient as unknown as ReturnType<typeof vi.fn>;
 
 function record(over: Record<string, unknown> = {}, host = '192.168.1.50') {
@@ -43,6 +51,8 @@ beforeEach(() => {
   findAuthorizedBlox.mockReset();
   refreshOnce.mockReset().mockResolvedValue(undefined);
   rememberedLanIp.mockReset().mockResolvedValue(null);
+  noteLanIp.mockReset();
+  discoverMock.mockReset().mockResolvedValue({ found: [], failure: 'not-found', lna: 'granted' });
   HttpAiClientMock.mockReset();
 });
 
@@ -349,3 +359,57 @@ describe('selectAiTransport — the address must be the right Blox', () => {
     expect(choice.kind).toBe('ble');
   });
 });
+
+describe('selectAiTransport — searching this network when nothing else is left', () => {
+  // Before this tier existed, a browser with no remembered address and no typed IP had nothing to try:
+  // `refreshOnce` only asks discovery `/find-box` for private ip4 entries, which needs unshipped firmware and
+  // returns nothing. Blox AI reported "cannot reach your Blox" about a Blox on the same switch.
+  test('finds the Blox by scanning and uses it', async () => {
+    findAuthorizedBlox.mockReturnValue(null);
+    discoverMock.mockResolvedValue({ found: [{ host: '192.168.2.159', peerId: 'BLOX1' }], lna: 'granted' });
+    HttpAiClientMock.mockImplementation(clientHealthyAt('192.168.2.159'));
+
+    const choice = await selectAiTransport('BLOX1', 'APP1', { scanIfEmpty: true });
+    expect(choice.kind).toBe('lan-http');
+    expect(choice.reason).toContain('network scan found 192.168.2.159');
+    // Written back, so the next session takes the remembered-address tier and never pays for a scan again.
+    expect(noteLanIp).toHaveBeenCalledWith(
+      expect.objectContaining({ ip: '192.168.2.159', bloxPeerId: 'BLOX1', authorizer: 'APP1' }),
+    );
+  });
+
+  test('a `.local` name is usable, and is not written back to a cache that only holds addresses', async () => {
+    findAuthorizedBlox.mockReturnValue(null);
+    discoverMock.mockResolvedValue({ found: [{ host: 'fxblox-rk1.local', peerId: 'BLOX1' }], lna: 'granted' });
+    HttpAiClientMock.mockImplementation(clientHealthyAt('fxblox-rk1.local'));
+
+    const choice = await selectAiTransport('BLOX1', 'APP1', { scanIfEmpty: true });
+    expect(choice.kind).toBe('lan-http');
+    expect(noteLanIp).not.toHaveBeenCalled();
+  });
+
+  test('a Blox that is not the one we mean is ignored', async () => {
+    // The scan reads each answer's peer id, so a private address pointing at someone else's box on another
+    // network is rejected before anything is sent to it.
+    findAuthorizedBlox.mockReturnValue(null);
+    discoverMock.mockResolvedValue({ found: [{ host: '192.168.2.7', peerId: 'SOMEONE-ELSE' }], lna: 'granted' });
+    HttpAiClientMock.mockImplementation(clientHealthyAt('192.168.2.7'));
+
+    const choice = await selectAiTransport('BLOX1', 'APP1', { scanIfEmpty: true });
+    expect(choice.kind).toBe('ble');
+  });
+
+  test('does not scan when the caller did not ask for it', async () => {
+    findAuthorizedBlox.mockReturnValue(null);
+    const choice = await selectAiTransport('BLOX1', 'APP1', { scanIfEmpty: false });
+    expect(discoverMock).not.toHaveBeenCalled();
+    expect(choice.kind).toBe('ble');
+  });
+
+  test('a scan that throws falls through to BLE rather than breaking the screen', async () => {
+    findAuthorizedBlox.mockReturnValue(null);
+    discoverMock.mockRejectedValue(new Error('permission dismissed'));
+    const choice = await selectAiTransport('BLOX1', 'APP1', { scanIfEmpty: true });
+    expect(choice.kind).toBe('ble');
+  });
+});
@@ -123,8 +123,21 @@ export async function selectAiTransport(bloxPeerId: string, appPeerId: string, o
     hit = lanIpCache.findAuthorizedBlox(bloxPeerId, appPeerId, mdnsMaxAgeMs);
   }
 
+  // 5) Search this network directly. `refreshOnce` above only asks discovery `/find-box` for private `/ip4/`
+  //    entries, which needs fula-ota PR-D and returns nothing today — so before this tier existed, a browser
+  //    with no remembered address and no typed IP had literally nothing left to try and reported "cannot
+  //    reach your Blox" about a Blox on the same switch, one that the setup screen's own search finds in
+  //    seconds. This is that same search.
+  if (!hit && scanIfEmpty) {
+    const scanned = await qualifyLanScan(bloxPeerId, appPeerId, probeTimeoutMs);
+    if (scanned) return scanned;
+  }
+
   if (!hit) {
-    return { kind: 'ble', reason: 'no LAN candidate: no fresh record, no manual IP, no remembered address' };
+    return {
+      kind: 'ble',
+      reason: 'no LAN candidate: no fresh record, no manual IP, no remembered address, nothing on this network',
+    };
   }
 
   const ip = hit.service.txt?.ipAddress ?? hit.service.host ?? '';
@@ -142,6 +155,50 @@ export async function selectAiTransport(bloxPeerId: string, appPeerId: string, o
   return { kind: 'ble', reason: `LAN HTTP /health probe failed (latency=${probe.latencyMs}ms)` };
 }
 
+/** A `.local` name is local by definition; anything else has to be an RFC1918/link-local address. */
+export function hostIsLocal(host: string): boolean {
+  return host.toLowerCase().endsWith('.local') || ipIsPrivateLan(host);
+}
+
+/**
+ * Search this network for the Blox, the way the setup screen does.
+ *
+ * `discoverBloxesOnLan` probes candidate `.local` names AND sweeps the subnets this device is on, reading each
+ * answer's peer id from blox-ai's `/diag/relay`. That peer id is a STRONGER identity check than the `/health`
+ * probe the other tiers rely on — the address is only used if the box behind it says it is the one we mean, so
+ * a private address that points at a stranger on some other network is rejected before anything is sent to it.
+ *
+ * A found IPv4 address is written back to the cache, so the next session takes tier 3 and never pays for this
+ * scan again.
+ */
+async function qualifyLanScan(
+  bloxPeerId: string,
+  appPeerId: string,
+  probeTimeoutMs: number,
+): Promise<AiTransportChoice | null> {
+  let outcome;
+  try {
+    const { discoverBloxesOnLan } = await import('@/services/lanDiscovery');
+    outcome = await discoverBloxesOnLan();
+  } catch {
+    return null;
+  }
+  const match = outcome.found.find((blox) => blox.peerId === bloxPeerId);
+  if (!match || !hostIsLocal(match.host)) return null;
+  const client = new HttpAiClient(match.host, DEFAULT_BLOX_AI_PORT);
+  const probe = await client.health(probeTimeoutMs);
+  if (!probe.ok) return null;
+  // Only an address is worth remembering; a `.local` name would fail tier 3's RFC1918 gate on the way back in.
+  if (ipIsPrivateLan(match.host)) {
+    lanIpCache.noteLanIp({ ip: match.host, bloxPeerId, authorizer: appPeerId });
+  }
+  return {
+    kind: 'lan-http',
+    httpClient: client,
+    reason: `network scan found ${match.host}, peer id matched, /health 200 in ${probe.latencyMs}ms`,
+  };
+}
+
 function readBloxAiPortFromTxt(txt: Record<string, unknown> | undefined): number | undefined {
   if (!txt) return undefined;
   const raw = txt.bloxAiPort ?? txt.ai_port;
 
@@ -260,7 +260,14 @@ export class FulaClient {
   }
 
   /** Reuse the tracked connection, or dial (candidate order: bloxAddr → find-box → relays → hardcoded). */
-  async ensureConnected(opts: { signal?: AbortSignal; refresh?: boolean } = {}): Promise<TrackedConnection> {
+  async ensureConnected(
+    opts: {
+      signal?: AbortSignal;
+      refresh?: boolean;
+      /** Internal: set on the one automatic retry after a stale certhash, so it cannot loop. */
+      retriedCerthash?: boolean;
+    } = {},
+  ): Promise<TrackedConnection> {
     if (this.closed) throw new FulaWebError('CLIENT_CLOSED', 'the client was shut down');
     const box = this.requireBox();
     const now = cfg.now;
@@ -330,8 +337,23 @@ export class FulaClient {
     } catch (e) {
       const err = isFulaWebError(e) ? e : new FulaWebError('DIAL_FAILED', errorMessage(e), { cause: e });
       this.lastError = err;
-      // A stale certhash is the one dial failure discovery can fix → refresh next time.
-      if (err.code === 'NO_CERTHASH') this.refreshDiscovery = true;
+      // A stale certhash is the one dial failure discovery can fix, so fix it and try again NOW.
+      //
+      // This used to only set the flag and rethrow, which made the refresh happen on the *next* call — so the
+      // first action after a relay rotated its WebTransport certificate always failed with "certificate"/
+      // NO_CERTHASH, and the user had to press the button a second time to get the retry they were owed. Two
+      // taps for every plugin install and every plugin screen, reported from the field exactly that way.
+      //
+      // kubo rotates those certs on a 14-day cycle and advertises current AND next, so a stale hash is a
+      // routine event, not an exceptional one. One retry is enough: `retriedCerthash` makes it a single extra
+      // attempt with freshly resolved candidates, never a loop against a relay that is genuinely unreachable.
+      if (err.code === 'NO_CERTHASH') {
+        this.refreshDiscovery = true;
+        if (!opts.retriedCerthash) {
+          log.info('stale certhash — refreshing discovery and redialling once');
+          return this.ensureConnected({ ...opts, refresh: true, retriedCerthash: true });
+        }
+      }
       throw err;
     }
   }