diff --git a/VERSION b/VERSION
index d6f3a38..1a31d39 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.18.7
+1.18.8
diff --git a/VERSIONS.md b/VERSIONS.md
index dd623e1..6a89347 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.18.8** | 2026-07-19 | **Bugfix:** e2e wallet — require `taler-helper-sqlite3` on PATH; use absolute `node` + `timeout` instead of fragile `perl -e alarm` for wcli; clearer accept-uri errors (no raw alarm-shift noise). |
 | **v1.18.7** | 2026-07-19 | **Bugfix:** mail/surface catalogs — TSA/Anastasis MX is **mail.anastasis.lu** (→ pixel), not non-resolving `anastasis.taler-systems.com`; add `anastasis.lu` + pixel host probes (fixes surface_err mail.*). **Also:** FP stage host-agent defaults include **e2e** + 1800s timeout; stagepaysan.env.example wires francpaysan-secrets + wallet-cli. |
 | **v1.18.6** | 2026-07-19 | **Bugfix:** TESTS.md table cell for `e2e.bankwd-` markdown typo from rename. |
 | **v1.18.5** | 2026-07-19 | **Bugfix:** TESTS.md e2e group list `atm` → `bankwd` (missed in 1.18.4). |
diff --git a/check_e2e.sh b/check_e2e.sh
index 1eea677..d219c73 100755
--- a/check_e2e.sh
+++ b/check_e2e.sh
@@ -35,22 +35,22 @@ wcli_bal_snap() {
     fi
   fi
   local err="${out}.err"
-  if command -v perl >/dev/null 2>&1; then
-    if [ -n "${WSERVE_PID:-}" ] && [ -S "${WSOCK:-}" ]; then
-      perl -e 'alarm shift; exec @ARGV' 10 \
-        node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle balance \
+  local _node="${NODE_BIN:-$(command -v node 2>/dev/null || true)}"
+  [ -n "$_node" ] || { echo "(no node)" >"$out"; return 1; }
+  if [ -n "${WSERVE_PID:-}" ] && [ -S "${WSOCK:-}" ]; then
+    if command -v timeout >/dev/null 2>&1; then
+      timeout -k 2 10 "$_node" "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle balance \
         >"$out" 2>"$err" || true
     else
-      perl -e 'alarm shift; exec @ARGV' 10 \
-        node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults balance \
+      "$_node" "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle balance \
         >"$out" 2>"$err" || true
     fi
   else
-    if [ -n "${WSERVE_PID:-}" ] && [ -S "${WSOCK:-}" ]; then
-      node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle balance \
+    if command -v timeout >/dev/null 2>&1; then
+      timeout -k 2 10 "$_node" "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults balance \
         >"$out" 2>"$err" || true
     else
-      node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults balance \
+      "$_node" "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults balance \
         >"$out" 2>"$err" || true
     fi
   fi
@@ -378,13 +378,35 @@ WALLET_CLI=$(find_wallet_cli) || {
   blocker "prereq" "taler-wallet-cli not found (set WALLET_CLI=)"
   exit 1
 }
+# wallet-core spawns `taler-helper-sqlite3` via PATH (not an absolute path).
+# Ensure operator wallet bindir + ~/.local/bin are first (systemd mon jobs).
+export PATH="${WALLET_CLI_BINDIR:+$WALLET_CLI_BINDIR:}${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+NODE_BIN=$(command -v node 2>/dev/null || true)
+if [ -z "$NODE_BIN" ] || [ ! -x "$NODE_BIN" ]; then
+  blocker "prereq" "node not found on PATH (install Node or set PATH; need node for wallet-cli)"
+  exit 1
+fi
+if ! command -v taler-helper-sqlite3 >/dev/null 2>&1; then
+  for _h in \
+    "${WALLET_CLI_BINDIR:+$WALLET_CLI_BINDIR/taler-helper-sqlite3}" \
+    "${HOME}/.local/bin/taler-helper-sqlite3" \
+    /usr/bin/taler-helper-sqlite3
+  do
+    [ -n "$_h" ] && [ -x "$_h" ] && export PATH="$(dirname "$_h"):$PATH" && break
+  done
+fi
+if ! command -v taler-helper-sqlite3 >/dev/null 2>&1; then
+  blocker "prereq" "taler-helper-sqlite3 not on PATH (wallet accept-uri/pay will fail with spawn ENOENT) — install next to wallet-cli or set WALLET_CLI_BINDIR"
+  exit 1
+fi
+ok "wallet-helper" "taler-helper-sqlite3=$(command -v taler-helper-sqlite3)"
 # Implementation version (--version) + wallet-core API ranges (version command)
 WALLET_IMPL_VER=$(
-  node "$WALLET_CLI" --version 2>/dev/null | head -1 | tr -d '\r' || true
+  "$NODE_BIN" "$WALLET_CLI" --version 2>/dev/null | head -1 | tr -d '\r' || true
 )
 WALLET_CORE_VER=$(
   _wver_db=$(mktemp "${TMPDIR:-/tmp}/wver.XXXXXX.sqlite3" 2>/dev/null || echo "${TMPDIR:-/tmp}/wver-$$.sqlite3")
-  node "$WALLET_CLI" --wallet-db="$_wver_db" --no-throttle --skip-defaults version 2>/dev/null \
+  "$NODE_BIN" "$WALLET_CLI" --wallet-db="$_wver_db" --no-throttle --skip-defaults version 2>/dev/null \
     | python3 -c '
 import json,re,sys
 raw=sys.stdin.read()
@@ -577,7 +599,7 @@ start_wallet_serve() {
   stop_wallet_serve
   rm -f "$WSOCK"
   # serve holds the DB open; clients use --wallet-connection only
-  node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults \
+  "$NODE_BIN" "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults \
     advanced serve --unix-path "$WSOCK" \
     >"$SCRATCH/wallet-serve.log" 2>&1 &
   WSERVE_PID=$!
@@ -594,6 +616,25 @@ start_wallet_serve() {
   return 1
 }
 
+# Run node wallet-cli with a hard wall clock. Prefer GNU/coreutils `timeout`
+# (clear errors). Fall back to perl alarm only if timeout is missing.
+# Always use absolute NODE_BIN + WALLET_CLI so systemd PATH quirks cannot
+# turn into opaque "alarm shift; exec @ARGV" noise in accept-uri output.
+_wcli_exec() {
+  local cap="$1"
+  shift
+  local -a cmd=( "$NODE_BIN" "$WALLET_CLI" "$@" )
+  if command -v timeout >/dev/null 2>&1; then
+    timeout -k 2 "$cap" "${cmd[@]}"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout --kill-after=2 "$cap" "${cmd[@]}"
+  elif command -v perl >/dev/null 2>&1; then
+    perl -e 'alarm shift; exec @ARGV' "$cap" "${cmd[@]}"
+  else
+    "${cmd[@]}"
+  fi
+}
+
 # $1 = max seconds for this call (optional); rest = wallet-cli args
 # Prefer live serve socket so the shepherd stays up (alternative to run-until-done).
 wcli() {
@@ -605,22 +646,15 @@ wcli() {
   e2e_over && return 124
   local cap
   cap=$(e2e_left)
-  [ "$cap" -gt "$maxc" ] && cap=$maxc
-  [ "$cap" -lt 3 ] && return 124
+  # e2e_left may print warnings on stdout — keep only first integer token
+  cap=$(printf '%s' "$cap" | awk '/^[0-9]+$/{print; exit} {for(i=1;i<=NF;i++) if($i+0==$i){print $i; exit}}')
+  [ -z "$cap" ] && cap=$maxc
+  [ "$cap" -gt "$maxc" ] 2>/dev/null && cap=$maxc
+  [ "$cap" -lt 3 ] 2>/dev/null && return 124
   if [ -n "${WSERVE_PID:-}" ] && [ -S "${WSOCK:-}" ]; then
-    if command -v perl >/dev/null 2>&1; then
-      perl -e 'alarm shift; exec @ARGV' "$cap" \
-        node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle "$@"
-    else
-      node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle "$@"
-    fi
+    _wcli_exec "$cap" --wallet-connection="$WSOCK" --no-throttle "$@"
   else
-    if command -v perl >/dev/null 2>&1; then
-      perl -e 'alarm shift; exec @ARGV' "$cap" \
-        node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
-    else
-      node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
-    fi
+    _wcli_exec "$cap" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
   fi
 }
 
@@ -629,9 +663,10 @@ wcli_pay() {
   local cap=$E2E_PAY_SECS
   local left
   left=$(e2e_left)
-  if [ "$left" -gt "$cap" ]; then
+  left=$(printf '%s' "$left" | awk '/^[0-9]+$/{print; exit} {for(i=1;i<=NF;i++) if($i+0==$i){print $i; exit}}')
+  if [ -n "$left" ] && [ "$left" -gt "$cap" ] 2>/dev/null; then
     cap=$E2E_PAY_SECS
-  elif [ "$left" -ge 8 ]; then
+  elif [ -n "$left" ] && [ "$left" -ge 8 ] 2>/dev/null; then
     cap=$left
   else
     # still try once with floor 12s so Alarm clock is not the blocker
@@ -639,19 +674,9 @@ wcli_pay() {
   fi
   info "pay wallet cap" "${cap}s"
   if [ -n "${WSERVE_PID:-}" ] && [ -S "${WSOCK:-}" ]; then
-    if command -v perl >/dev/null 2>&1; then
-      perl -e 'alarm shift; exec @ARGV' "$cap" \
-        node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle "$@"
-    else
-      node "$WALLET_CLI" --wallet-connection="$WSOCK" --no-throttle "$@"
-    fi
+    _wcli_exec "$cap" --wallet-connection="$WSOCK" --no-throttle "$@"
   else
-    if command -v perl >/dev/null 2>&1; then
-      perl -e 'alarm shift; exec @ARGV' "$cap" \
-        node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
-    else
-      node "$WALLET_CLI" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
-    fi
+    _wcli_exec "$cap" --wallet-db="$WDB" --no-throttle --skip-defaults "$@"
   fi
 }
 
@@ -935,7 +960,13 @@ e2e_one_withdraw() {
     && wcli withdraw accept-uri --exchange "${EXCHANGE_PUBLIC}/" "$URI_CLEAN" >"$SCRATCH/accept-$tag.out" 2>&1; then
     ok "wallet accept $WITHDRAW_AMT (no :443)"
   else
-    warn "Bank withdraw $WITHDRAW_AMT" "accept-uri failed — $(tail -c 100 "$SCRATCH/accept-$tag.out" | tr '\n' ' ')"
+    # Prefer the real Error/ENOENT line over noise (perl -e source, stack frames)
+    _acc_err=$(
+      grep -E 'Error:|ENOENT|spawn taler-helper|code:|An error occurred' \
+        "$SCRATCH/accept-$tag.out" 2>/dev/null | head -3 | tr '\n' ' ' | head -c 200
+    )
+    [ -z "$_acc_err" ] && _acc_err=$(tail -c 160 "$SCRATCH/accept-$tag.out" 2>/dev/null | tr '\n' ' ')
+    warn "Bank withdraw $WITHDRAW_AMT" "accept-uri failed — ${_acc_err:-unknown}"
     return 1
   fi
   cp "$SCRATCH/accept-$tag.out" "$SCRATCH/accept.out"