diff --git a/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt b/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt
index 9effd5977..4861afde7 100644
--- a/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt
+++ b/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt
@@ -12,10 +12,6 @@ import androidx.core.view.ViewCompat
 import androidx.core.view.WindowInsetsCompat
 import kotlin.math.max
 
-/**
- * iOS-style pairing scan chrome: dim outside a central square + white corner brackets.
- * Hole layout matches iOS `layoutScanOverlayGeometry` ([pairingIosStyleHoleRectF]).
- */
 class PairingQrScanOverlayView @JvmOverloads constructor(
     context: Context,
     attrs: AttributeSet? = null,
@@ -27,12 +23,11 @@ class PairingQrScanOverlayView @JvmOverloads constructor(
         isFocusable = false
     }
 
-    /** Let taps reach [PreviewView] below for tap-to-focus. */
     @Suppress("ClickableViewAccessibility")
     override fun onTouchEvent(event: MotionEvent): Boolean = false
 
     private val dimPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply {
-        color = 0x8C000000.toInt() // ~55% black, same role as QML dimAlpha 0.55
+        color = 0x8C000000.toInt()
         style = Paint.Style.FILL
     }
 
diff --git a/tools/local_gateway/main.go b/tools/local_gateway/main.go
index ab2e24009..619b020ba 100644
--- a/tools/local_gateway/main.go
+++ b/tools/local_gateway/main.go
@@ -214,6 +214,13 @@ func handleGenerateQR(w http.ResponseWriter, r *http.Request) {
 
 	mu.Lock()
 	cleanupExpiredSessions(time.Now())
+	if _, exists := sessions[req.QRUUID]; exists {
+		mu.Unlock()
+		writeJSON(w, http.StatusConflict, map[string]string{
+			"message": "Conflict: QR session with this UUID already exists.",
+		})
+		return
+	}
 	sessions[req.QRUUID] = session
 	mu.Unlock()
 
@@ -271,7 +278,7 @@ func handleScanQR(w http.ResponseWriter, r *http.Request) {
 	// Keep compatibility with current gateway behavior: key problems are mapped to 403.
 	if req.AuthData.APIKey == "invalid" {
 		writeJSON(w, http.StatusForbidden, map[string]string{
-			"detail": "Forbidden: Invalid API key or unauthorized request.",
+			"message": "Forbidden: Invalid API key or unauthorized request.",
 		})
 		return
 	}