docs/hub: update Element Calling port guidance to the new port set

User-facing polish to match the element-calling port changes: - helpers.js: port-forward guide example now shows the 40000-40099 range instead of the removed 30000-40000. - versions.json: livekit dev fallback 1.5.2 -> 1.13.6 (the Nix-generated version in sovran-hub.nix already derives from pkgs.livekit.version). - server.py: docstring/comment examples reference 40000-40099. - CHANGELOG.md: record the calling changes under [Unreleased]. The tile/modal port tables themselves are data-driven from server.py's port_requirements / _PORTS_ELEMENT_CALLING (updated in the previous commit), so no further UI changes are needed.
element-calling: fix Wi-Fi calls and tighten media/TURN ports
2026-09-01 12:15:16 -05:00 · 2026-09-01 12:15:16 -05:00 · 2026-09-01 12:15:16 -05:00 · 2026-08-31 20:37:46 -05:00 · 2026-08-31 20:31:48 -05:00 · 2026-08-31 20:28:10 -05:00
74 changed files with 10718 additions and 3822 deletions
@@ -0,0 +1,406 @@
+# Changelog
+
+All notable changes to Sovran_SystemsOS will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Unreleased]
+
+### Changed
+- Element Calling: pin LiveKit to 1.13.6 and advertise the LAN interface
+  (rtc.advertise_internal_ip) so Wi-Fi callers get a local ICE candidate and
+  calls no longer depend on router NAT hairpin
+- Element Calling: use a single UDP media mux (7882); move the TURN relay to
+  40000-40099 and remove the unreachable 5349 TURN/TLS listener
+- Hub: update Element Calling router-port guidance to the new port set
+
+### Fixed
+- Element Calling: TURN relay could not deliver media to the SFU on routers
+  without NAT loopback (turn.allow_restricted_peer_cidrs now permits the LAN
+  subnet derived from the primary interface)
+
+## [1.1.3] - 2026-08-27
+
+### Added
+- Sparrow update
+- Nixpkgs update with bisq and bisq2
+- Albyhub: re-harvest hashes for fixed sovran tag
+- Albyhub default.nix hash update
+- Albyhub default.nix fix
+- Albyhub: build from sovran fork tag (LND-only, no frontend)
+- Vendor v1.24.0 LND-only, no-frontend build
+- Ux: simplify domain and router setup guidance
+
+### Fixed
+- Evaluate local vendored package versions directly
+- Use proxyVendor to preserve secp256k1-zkp cgo headers
+[1.1.3]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.3
+
+
+## [1.1.2] - 2026-08-21
+
+### Added
+- Nixpkgs update with Bisq update
+- Unify public-IP detection into one privacy-first script
+- Fix Element X discovery and harden federated calling
+- Nixpkgs update
+- Add tor-browser to the package list
+
+### Changed
+- Use pkgs.lndinit, drop local packages/lndinit
+- Update RTL to 0.15.10
+
+### Fixed
+- Move system.activationScripts under the config attribute
+- Reuse Hub external IP for LiveKit, drop egress service calls
+- Derive Restart required from boot default vs running system
+- Reconcile completed updates after polling stalls
+- Migrate i2pd SAM settings for nixpkgs 26.11
+- Order turn-setup after network-online to fix boot-time red dot
+- Restore a Zeus-scannable LND REST connect QR
+
+### Security
+- Prevent LND admin macaroon exposure in curl argv
+
+### Documentation
+- Update desktop and Sovran Hub screenshots
+[1.1.2]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.2
+
+
+## [1.1.1] - 2026-08-15
+
+### Added
+- Update release-stable.sh
+- Enhance release script with preflight checks and metadata
+- Migrate dock/folder/mime entries from brave to brave-origin on upgrade
+- Skip Brave Origin startup dialog in Hub launcher
+- Switch default browser to Brave Origin (brave-origin)
+- Add Bitcoin Core Tor IBD gossip control
+- Replace Bitcoin Knots with Bitcoin Core
+
+### Fixed
+- Persistent browser profile so logout survives window reopen
+- Recover from expired sessions and preserve logout
+- Prevent Bitcoin Core switch from hanging the Hub UI
+
+### Documentation
+- Update README ISO download links to v1.1.0
+[1.1.1]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.1
+
+
+## [Unreleased]
+
+### Changed
+  - Replaced Brave Browser with Brave Origin (the new `brave-origin` nixpkgs
+    package) as the desktop's default browser: installed package, dock
+    favorite, Browsers app-folder entry, `xdg.mime.defaultApplications`, and
+    the `$BROWSER` session variable now all point at Brave Origin, and the
+    Sovran Hub launcher runs it.
+  - On installs upgrading from the old Brave package, the desktop theme init
+    now migrates `brave-browser.desktop` → `brave-origin.desktop` in the dock
+    favorites, the Browsers app folder, and the user's `mimeapps.list`, so
+    the dock icon and default-browser handler survive the switch without a
+    manual re-pin.
+
+### Fixed
+  - Zeus Connect QR in the Hub was invalid: the LND-only `lndconnect`
+    wrapper used flags Zeus/`lndconnect` do not understand (`--cert`,
+    `--macaroon`), read a non-existent onion path (`free/lnd.onion`),
+    and collided with LND's P2P hidden service. The wrapper now matches
+    the nix-bitcoin contract — dedicated `lnd-rest` onion on port 8080,
+    `--nocert` over Tor, admin macaroon in the URI — so scanning the Hub
+    QR in Zeus works again.
+  - The Hub launcher now uses a persistent per-user browser profile
+    (`$XDG_STATE_HOME/sovran-hub-browser`) instead of a throwaway `/tmp`
+    profile that was deleted on exit. The throwaway profile wiped the
+    `hub_manual_logout` marker cookie on every close, so `/auto-login`
+    silently logged the user straight back in after they signed out and
+    reopened the Hub window. The persistent profile makes explicit logout
+    stick (until the next password login) while still skipping Brave Origin's
+    one-time startup dialog.
+  - The Hub now redirects to the login page when an API request finds an
+    expired browser session, instead of leaving the dashboard tile grid in a
+    loading state while `/api/services` continues returning 401 every five
+    seconds.
+  - Explicitly logging out now suppresses the desktop launcher's local
+    auto-login after the Hub window is closed and reopened. A successful
+    password login clears that preference.
+  - Sessions are now persisted to `/var/lib/secrets/hub-sessions.json` so the
+    browser login survives the Hub service restart that `nixos-rebuild switch`
+    performs during activation. Previously the in-memory session store was
+    wiped by that restart, the `/api/rebuild/status` poll started returning
+    401, and the rebuild modal spun forever showing "Applying changes…" while
+    the switch result was never displayed.
+  - Rebuild and update modals now bail out and reload the page after sustained
+    polling failures instead of hanging indefinitely.
+  - Rebuild/update scripts stream `nixos-rebuild` output into the live log
+    (it was buffered until completion, making long rebuilds look frozen).
+  - The update modal now reconciles persisted update state after a page/RDP
+    reconnect, bounds every status request with a timeout, prevents overlapping
+    async polls, and reports an explicit "status unavailable" state with a
+    Retry Status action instead of spinning forever. Verbose Nix logs are
+    rendered incrementally and bounded so they cannot stall the browser UI.
+  - Successful staged updates now record the exact NixOS generation. The Hub
+    keeps showing "Restart required" until that generation is active, then
+    clears the marker after reboot (with log-based recovery for older updates).
+  - Pending-reboot state is now derived from NixOS itself — the boot default
+    (`/nix/var/nix/profiles/system`) versus the running `/run/current-system`
+    — instead of from Hub-written marker files. Updates performed from a
+    terminal or support session (which never touch the Hub's status files)
+    previously left a stale `REBOOT_REQUIRED` marker the Hub could never
+    clear, pinning the "Restart required" badge forever even after many
+    reboots. The marker self-heals to `IDLE` on the next status read whenever
+    boot default and running system agree, and recording the informational
+    `.generation` marker can no longer fail an otherwise successful update.
+
+---
+
+## [1.1.0] - 2026-08-11
+
+### Added
+- Speed up Hub service status loading
+- Update Documentation
+- Njalla.nix: fail on ImportError; fix redundant except clause
+- Correctly escape DDNS placeholder in Nix string
+- Security hardening: fix all 8 blocking findings for PR #419
+- Security hardening: fix DDNS injection, Nix injection, reboot auth, support key, sudo rules
+- Harden btcpay and nbxplorer config handling
+- Add provenance headers and fix flake checks for PR409
+- Restore upstream nix-bitcoin fetchNodeModules for mempool and RTL packages
+- Refactor Nix build configuration for mempool
+- Update npm dependencies and patch handling in default.nix
+- Update npmDepsHash for backend and frontend packages
+- Mempool: use postPatch to copy lock file for npmDeps fetcher
+- Mempool: use preBuild cd instead of postUnpack so npmDeps fetcher finds lock files
+- Mempool: fix npmDeps fetcher — postUnpack instead of sourceRoot, postPatch instead of patches
+- Mempool: switch backend and frontend to buildNpmPackage with placeholder npmDepsHash
+- Update npmDepsHash with correct hash value
+- RTL: switch to buildNpmPackage with placeholder npmDepsHash
+- Add bitcoind.rpc.users.btcpayserver for NBXplorer
+- Restore original flake.nix with nixosModules.Sovran_SystemsOS export
+- Add vendored RTL package and fix rtl.nix to use it
+- Vendor mempool packages and wire mempool module to vendored pkgs
+- Refactor onion service configuration for LND
+- Add missing bitcoind-rpc-public-whitelist.nix
+- Remove joinmarket-ob-watcher from onion-services defaults
+- Tailor: make bitcoin modules truly Sovran-only (lnd-only) and delete stubs.nix
+- Vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)
+- Remove duplicate 1.0.6 release notes from CHANGELOG
+
+### Changed
+- Clean mempool module comment typo
+- Move vendor/nix-bitcoin to modules/bitcoin, remove overlays
+- Nix flake update - drop nix-bitcoin
+
+### Fixed
+- Correct RTL and Mempool Hub versions
+- Fix DDNS URL validation: replace ${IP} temporarily for validator, keep placeholder for storage
+- Fix all 8 security hardening blockers for PR #423
+- Fix Nix interpolation in DDNS runner
+- Fix IP validation in DDNS and document journalctl sudo rule
+- Report configured BTCPay Server version
+- Fix Matrix SIGPIPE and RTL v0.15.8 config schema regressions
+- Add NBXplorer cookie auth and WorkingDirectory for BTCPay service
+- Fix BTCPay startup regression: add home dirs to service users
+- Address btcpay hardening review feedback
+- Register bitcoin-HMAC-btcpayserver as managed secret owned by bitcoind user
+- Fix RTL: use fetchNodeModules instead of npm ci in buildPhase
+- Fix PostgreSQL ensureUsers: use ensureDBOwnership instead of ensureClauses
+- Fix lnd macaroons: replace invalid 'enable' with 'user'
+- Fix postgresql ensurePermissions -> ensureClauses for nixpkgs unstable
+- Fix btcpayserver.nix to use pkgs.stable overlay
+- Fix btcpayserver syntax error and pin to nixpkgs-stable (2.4.2)
+- Fix mempool package: remove fetchNodeModules dependency
+- Fix typo in onion-addresses service check
+- Fix formatting of extraGroups in btcpayserver.nix
+- Add missing semicolon after extraGroups in btcpayserver.nix
+- Remove services.clightning.enable assignment that fails on f13ff45
+- Remove clightning and clightning-rest from stubs to avoid duplicate on f13ff45
+- Add stubs for nixpkgs-unstable 2026-08 where services.clightning removed
+- Keep ISO artifacts out of the repo and auto-update README on release
+[1.1.0]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.0
+
+
+## [1.0.6] - 2026-08-07
+
+### Added
+- Iso: fix replaceStrings length mismatch in cleanVersion
+- Promote virtual machine trial option in README
+- Improve installer VM compatibility
+- Trim redundant dev-vs-stable Gitea explanations in README
+- Add Arean.Ai to AI tools used for development
+- Prefix OS version badge with 'v' (v1.0.5)
+- Match OS version badge styling to service modal version badges
+- Place OS version badge inline right after the Hub title
+- Center OS version badge under the Hub title
+- Strengthen entropy section: add DYOR emphasis and hardware wallet verification note
+- Add 'About Bitcoin wallet entropy' section to README
+- README: balance intro between Bitcoin sovereignty and sovereign computing
+
+### Changed
+- Removed temp patch file
+
+### Fixed
+- Resolve tag range detection and improve release diagnostics
+- Add token scope diagnostics and un-silence gh release errors
+- Harden error handling and sanitize exception details across security endpoints (CWE-209)
+- Sanitize exception handling in verify-integrity and security-reset (CWE-209)
+- Sanitize api_security_reset errors to prevent exception information exposure (CWE-209)
+- Use canonical prefix containment check for CodeQL path-injection
+- Pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338
+- Add CodeQL-recognized path sanitization for domain_name
+- Remove domain substring check for CodeQL incomplete-url
+- Use sentinel for njalla header check (CodeQL incomplete-url-substring)
+- Prevent reflected XSS in lnurl-qr print endpoint
+- Hash root password instead of storing in clear text (CWE-312)
+- Separate web auth hash from system password file
+- Fix Matrix Hub admin API credentials
+- Fix CWE-78: replace subprocess call with Synapse Admin API in create-user endpoint
+
+### Documentation
+- Add SECURITY.md detailing security policy and best practices
+- Versioned CDN downloads + add CDN upload script
+- Correct active development workflow
+- Make repo references mirror-neutral for Gitea readers
+- Clarify GitHub is the dev mirror of the Gitea stable repo
+[1.0.6]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.6
+
+## [1.0.5] - 2026-08-04
+
+### Added
+- LND Update to v0.21.1-beta
+- Nixpkgs Update
+- Nixpkgs Update
+- Update LND REST Zeus Connect instructions and design to match NWC exactly
+- UI: Align LND REST and NWC Zeus connection instructions styling
+- Make Zeus LND REST instructions coherent with NWC Zeus connect guide
+- Clarify Zeus NWC wallet setup
+- Make Manual Backup match the system role (Desktop Only scope)
+- Reload Caddy immediately when a domain (or ACME email) is saved
+- Unify Njal.la + router port-forwarding guidance across onboarding and feature enable modals
+- Enhance Lightning Wallet Connect modal with professional benefits grid and refined messaging
+
+### Fixed
+- Resolve 'vdev' version badge and align it under the Hub title
+- Align release script with Gitea staging-dev and stable branch workflow
+- Auto-detect git remotes and clean up temp files in release-stable.sh
+
+### Documentation
+- Write real v1.0.4 changelog and auto-generate release notes in release script
+[1.0.5]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.5
+
+
+## [Unreleased]
+
+### Fixed
+- Report the version of the configured BTCPay Server package in the Hub instead of the different package version from unstable nixpkgs.
+- Installer VM compatibility: legacy BIOS VM boots now install with GRUB, UEFI VM installs avoid depending on NVRAM boot-entry writes, VM users get clearer disk/resource guidance, and the internet check falls back to HTTPS when ICMP is blocked.
+- **Manual Backup now matches the system role**: on the Desktop Only role the Hub's
+  "What gets backed up" list no longer shows Node / Server + Desktop items
+  (nix-bitcoin secrets, `/var/lib` system service data, and the database/blockchain
+  caveats), and the backup script skips those stages entirely — Desktop Only backups
+  now mirror only the NixOS configuration (`/etc/nixos`) and home directory (`/home`).
+  The free-space estimate, stage numbering, backup manifest, and completion message
+  are all role-aware; Node and Server + Desktop backups are unchanged.
+
+---
+
+## [1.0.4] - 2026-07-29
+
+### Added
+- **Lightning Wallet Connections (NWC)** — Hub-managed Nostr Wallet Connect powered by Alby Hub + LND:
+  - Create, view, and delete wallet connections directly from the Sovran Hub with a tabbed modal UI
+  - Downloadable/printable LNURL QR codes for connecting external wallets
+  - Channel liquidity guide and onboarding guidance for new LND nodes
+  - Unique-hostname enforcement with conflict validation and UI guidance
+  - Official NWC branding and logo
+- **Version visibility across the Hub**:
+  - Sovran_SystemsOS version badge displayed under the Hub title
+  - Version numbers shown on all Hub service tiles and next to service modal titles
+  - Deployed PHP app versions surfaced in service titles
+  - Build-time version reference file (`VERSION`) so version lookups are instantaneous and consistent
+- **Automated stable release workflow** (`scripts/release-stable.sh`) with versioned ISO naming from the `VERSION` file
+- `CONTRIBUTING.md` and expanded project documentation
+
+### Changed
+- **Manual Backup overhauled**: replaced tar+DB+LND archive approach with a reliable ext4 + rsync workflow, including
+  mount checks, path safety, atomic completion markers, stale-marker cleanup, and behavioral test coverage
+- **Port-forwarding UX simplified**: removed onboarding Step 4 and the misleading local "ready" status;
+  Njal.la DDNS now runs automatically when the feature is enabled
+- README restructured for clarity, links, and accuracy; added router/ISP port-forwarding requirements
+  for Server + Desktop mode; acknowledged LiveKit and Alby Hub
+- Updated nixpkgs and Bitcoin clients
+- Repository cleanup: removed unused `.github`, `.tests`, `nix/`, and `docs/ai` directories
+
+### Fixed
+- NWC wallet certificate path wiring (now uses the nix-bitcoin LND cert path)
+- Deterministic LND/Alby Hub port collision
+- Alby Hub executable resolution and v1.23.0 patches regenerated against exact upstream source
+- Manual Backup exit-code failures (bash/gawk in service PATH, tar tolerance, flock, browser-cache exclusions)
+- rsync destination-directory failures in backups (auto `mkdir -p`, mount check, 19 behavioral tests)
+- `sovran-hosts-update` converted to `writeShellApplication` with explicit runtime inputs
+- Incorrect `lib.mkIf` usage in the NWC wallets module
+- Duplicate systemd LND strings
+- `git fetch` tag-clobber errors against Gitea (now uses `--force`)
+
+### Security
+- Hardened Lightning Wallet Connections (NWC): restricted `ReadOnlyPaths` for the unlock password,
+  fixed an Authorization-header bug, eliminated stack-trace exposure flagged by CodeQL,
+  and tightened credential access and amount validation
+
+[1.0.4]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.4
+
+
+## [1.0.3] - 2026-07-29
+
+### Added
+- Incremental stable updates
+
+## [1.0.2] - 2026-07-29
+
+### Added
+- Incremental stable updates
+
+## [1.0.1] - 2026-07-29
+
+### Added
+- Incremental stable updates
+
+## [1.0.0] - 2026-07-29
+
+### Added
+- Initial stable release of Sovran_SystemsOS
+- Full Bitcoin self-custody desktop environment
+- Integrated Sparrow Wallet, Bisq, and Bisq 2
+- Comprehensive Sovran Hub for service management
+- NixOS-based operating system with privacy and sovereignty focus
+- Support for Bitcoin Core, Electrs, LND, Ride The Lightning, BTCPay Server, and more
+- Server + Desktop hybrid mode with Matrix, Nextcloud, VaultWarden, and other self-hosted services
+- Automated installer with graphical GNOME desktop
+- Tor integration and onion services for all major components
+- Remote desktop (GNOME Remote Desktop) support
+- Role-based system configuration (desktop, server, server+desktop)
+- Detailed service credential management in the Sovran Hub
+
+### Changed
+- Moved from development/main branch to dedicated `stable` branch for production releases
+
+### Security
+- All services run with least-privilege principles where possible
+- Secrets stored in `/var/lib/secrets/`
+- Strong emphasis on user-controlled keys and self-sovereignty
+
+---
+
+## [Unreleased]
+
+### Added
+- (Nothing yet)
+
+[1.0.3]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.3
+[1.0.2]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.2
+[1.0.1]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.1
+[1.0.0]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.0
@@ -0,0 +1,112 @@
+# Contributing to Sovran Systems OS
+
+First off, thank you for considering contributing to Sovran_SystemsOS! 🎉
+
+## Development and Release Repositories
+
+The GitHub repository is the primary location for Sovran_SystemsOS development
+and collaboration and serves as the project's connection to the GitHub
+ecosystem. Most work is contributed through feature branches and pull requests
+that target GitHub `main`. Development may also begin in a local branch or on
+`staging-dev` at the project's self-hosted Gitea instance:
+https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS.
+
+GitHub `main` and Gitea `staging-dev` are kept synchronized as the active
+development line, although one may briefly lead the other while changes are
+being integrated. The canonical, release-ready code is maintained on Gitea's
+[`stable` branch](https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/src/branch/stable),
+in keeping with the self-sovereignty ethos of Sovran_SystemsOS.
+
+The workflow is:
+
+1. Most development and project collaboration — including issues, pull
+   requests, and reviews — happens through GitHub, with completed work
+   integrated into `main`.
+2. Work may also originate locally or on Gitea `staging-dev`. Accepted changes
+   are synchronized between GitHub `main` and Gitea `staging-dev`.
+3. When changes are complete and tested, they are promoted to Gitea `stable`,
+   which is the code used by released Sovran_SystemsOS builds.
+
+Please note: GitHub `main` and Gitea `staging-dev` may contain new features and
+code not yet in `stable`, and that code may not be fully tested.
+
+Moreover, Sovran_SystemsOS has been improved with the help of AI. We have used Copilot and Arena.ai to work through significant coding challenges and troubleshooting hurdles. We will continue to use AI to help keep Sovran_SystemsOS stable and maintained.
+
+## How Can I Contribute?
+
+### 🐛 Reporting Bugs
+- Open an [Issue](https://github.com/naturallaw777/Sovran_SystemsOS/issues)
+- Use a clear and descriptive title
+- Describe the steps to reproduce the bug
+- Include your OS version, hardware specs, and any relevant logs
+
+### 💡 Suggesting Features
+- Open an [Issue](https://github.com/naturallaw777/Sovran_SystemsOS/issues) with the tag `enhancement`
+- Explain the feature and why it would be useful
+- Be as detailed as possible
+
+### 🔧 Submitting Code Changes
+
+#### 1. Fork the Repository
+Click the "Fork" button at the top right of the GitHub repository.
+
+#### 2. Clone Your Fork
+```bash
+git clone https://github.com/YOUR_USERNAME/Sovran_SystemsOS.git
+cd Sovran_SystemsOS
+```
+
+#### 3. Create a Feature Branch
+```bash
+git checkout -b feature/your-feature-name
+```
+
+#### 4. Make Your Changes
+- Write clean, well-commented code
+- Follow the existing code style and structure
+- Test your changes thoroughly
+
+#### 5. Commit Your Changes
+```bash
+git add .
+git commit -m "Brief description of your changes"
+```
+
+#### 6. Push to Your Fork
+```bash
+git push origin feature/your-feature-name
+```
+
+#### 7. Open a Pull Request
+- Go to the original repository on GitHub
+- Click "New Pull Request"
+- Select your fork and branch
+- Provide a clear title and description of your changes
+- Reference any related Issues (e.g., "Closes #12")
+
+## Pull Request Guidelines
+
+- **One PR per feature/fix.** Do not bundle unrelated changes.
+- **Keep PRs small and focused.** Smaller PRs are easier to review and merge.
+- **Write meaningful commit messages.**
+- **Do not push directly to `main`.** Always use a feature branch and open a PR.
+- **Be patient.** PRs will be reviewed as soon as possible.
+
+## Security-Sensitive Changes
+
+- Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md).
+- Pin upstream revisions and hashes; do not use floating source references.
+- Update [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) when importing code.
+- Add regression tests and describe any threat-model change in the pull request.
+
+## Code Style
+
+- Follow the existing patterns in the codebase
+- Comment your code where necessary
+- Keep functions small and focused
+
+## Code of Conduct
+
+By participating in this project, you agree to be respectful and constructive.
+We are building something meaningful — let's do it together with integrity.
+
@@ -0,0 +1,103 @@
+# Security Policy
+
+## Supported versions
+
+| Release | Supported |
+|---|:---:|
+| Latest `1.0.x` stable release | Yes |
+| `main` / `staging-dev` | Development only |
+| Older than `1.0.0` | No |
+
+Install the newest stable point release to receive security fixes.
+
+## Report a vulnerability
+
+**Do not open a public issue or pull request.** Report privately through:
+
+- [GitHub Private Vulnerability Reporting](https://github.com/naturallaw777/Sovran_SystemsOS/security/advisories/new)
+- Email: [support@sovransystems.com](mailto:support@sovransystems.com)
+
+Include the affected version, impact, reproduction steps, and a minimal proof of
+concept. Never send wallet recovery words, private keys, or live credentials.
+
+We aim to acknowledge reports within two business days. Please allow reasonable
+time for a fix and coordinated disclosure.
+
+## Security model
+
+### Local-first operation
+
+The Hub and core data run on operator-owned hardware. The Hub is intended for a
+trusted local network and must not be port-forwarded to the internet. Public
+services, DDNS, software updates, and optional third-party relays require
+external networks and are outside a “fully offline” model.
+
+The local Hub currently uses HTTP. Authentication does not encrypt local network
+traffic, so use a trusted LAN and avoid public or guest Wi-Fi.
+
+### Bitcoin stack
+
+Bitcoin and Lightning modules are maintained in the standalone
+[Sovran_Bitcoin](https://github.com/naturallaw777/Sovran_Bitcoin) repository
+and consumed as a flake input. OS-specific customizations (Second_Drive paths,
+operator user, Hub integration) are bridged by
+`modules/sovran-bitcoin-integration.nix`. The `nix-bitcoin.*` option namespace
+and `/etc/nix-bitcoin-secrets` path remain only for upgrade compatibility.
+
+### Supply chain and integrity
+
+`flake.lock` pins flake inputs, and fetched source archives use fixed hashes.
+Builds still depend on pinned Nixpkgs, NixVim, btc-clients-nix, upstream source
+archives, and any configured binary cache. Keeping the Bitcoin modules in this
+repository reduces an external dependency; it does not remove supply-chain
+risk.
+
+The Hub integrity check verifies Nix store contents and compares the running
+system with a build from local `/etc/nixos`. It does not authenticate the release
+publisher or protect against an attacker who already controls root and can
+change both the system and local configuration.
+
+### Access and service isolation
+
+- Firewall enabled by default
+- Public SSH and remote desktop disabled by default
+- Separate service users and systemd sandboxing where supported
+- Administrative service ports bound to loopback where practical
+- Tor enforced for supported Bitcoin traffic and onion services
+- Public web services exposed only when enabled by the operator
+
+Tor reduces network exposure for configured Bitcoin services. It is not a
+guarantee against every IP leak, application bug, or traffic-analysis attack.
+
+### Restricted support access
+
+Support uses a per-session SSH key on the non-root `sovran-support` account.
+Sessions expire after 24 hours and have a small allowlist of `sudo` commands.
+Wallet paths receive deny ACLs unless the operator explicitly removes them.
+Disabling support removes the key and reapplies the ACLs.
+
+Support events are written to `/var/log/sovran-support-audit.log`. This is a
+local audit log, not a cryptographically tamper-evident record.
+
+## Out of scope
+
+Sovran_SystemsOS cannot protect against:
+
+- Compromised root or administrator credentials
+- Stolen recovery words, private keys, or backups
+- Malicious or compromised hardware, firmware, or build infrastructure
+- Services the operator deliberately exposes or weakens
+- Physical access without appropriate disk and firmware protections
+
+## Operator basics
+
+- Verify downloads and stop if the checksum does not match.
+- Apply stable security updates promptly.
+- Use unique passwords and keep SSH/RDP off when not needed.
+- Prefer a well-reviewed hardware signer for meaningful Bitcoin balances.
+- Keep tested, offline backups in separate secure locations.
+- Never share recovery words or private keys with support.
+- Disable support access when the session ends and review the audit log.
+
+No software can provide absolute security. Review your configuration and threat
+model before storing important funds or data.
@@ -0,0 +1,36 @@
+# Third-Party Notices
+
+## nix-bitcoin
+
+The Bitcoin and Lightning modules were originally adapted from
+[fort-nix/nix-bitcoin](https://github.com/fort-nix/nix-bitcoin), commit
+[`360e30fee5ba32f9fecc89bc35628195d9d2dbbe`](https://github.com/fort-nix/nix-bitcoin/commit/360e30fee5ba32f9fecc89bc35628195d9d2dbbe).
+They now live in the standalone
+[Sovran_Bitcoin](https://github.com/naturallaw777/Sovran_Bitcoin) repository
+and are consumed by Sovran_SystemsOS as a flake input. The current Sovran build
+does not import or fetch nix-bitcoin.
+
+MIT License
+
+Copyright (c) 2019 nix-bitcoin developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Other packaged applications retain their own upstream licenses and copyright
+notices.
@@ -0,0 +1 @@
+1.1.3
@@ -1,244 +0,0 @@
-<svg width="256" height="256" version="1.1" viewBox="0 0 256 256" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
- <image width="256" height="256" image-rendering="optimizeQuality" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAABmJLR0QA/wD/AP+gvaeTAAAgAElE
-QVR4nO2dd3gU1frHv+9sTy9AKh2RIqh0kHJFpVoQO1IURa6CCFak6CrFdr1KU1HUa8NKEREQRQUR
-ASlSlR5KEkpIQtr2Ob8/Aj9Isrszuzu7s7s5n+fJo+zOnHmTmfOdU94CcDgcDofD4XA4HA6Hw+Fw
-OJyohtQ2gBM4zAytNTWtPkiozxjqChDqMiCVIKYyJtQBiakA6QGYiGAEAMaQAJDmfAsuIpSc/9wK
-wALABrCzBJxlEM4SEwtE4AwJKICDHTOeO3mCzHCq9CtzFIILQITAvoLGdjqrqSiiLQmsFYDGYKwR
-iBqBIRuANsQmOUE4AcZyQJQDRocZw98Cox2GohOHyAwxxPZw/IALQBjCzK31lpTidgKJnRmoDYAr
-AbQCEKOyaXKpAKM9ANtBwC4RtNlkSN9Ko7c61DaMUxUuAGEAm52SYIOxEyN0B3DN+R+TymYpjYMI
-O0XgdzBa79SzXxJG5xWobVRthwuACrCvoKnIz7iKNHQ9MdwEoCsAQW27VGAvMXwH4CeDIWMtHyGE
-Hi4AIaL4rQbJBtF1M0Q2gAg3MCBZbZvCjEIAq0FshdVh+C55Qk6x2gbVBrgABBE2PzPGZsN1IAxj
-wC0A9GrbFCHYGPAjMfraCMtSGldYorZB0QoXAIVh5tZ6S2rxLQLYEAb0Ayq33Th+YyXQChHiQpM+
-cxmfJigLFwCFsM7Nag6RjWSE+wHUU9ueaISAIgb6WhCdcwyPndqttj3RABeAAGCzmxmsKL8dJIwC
-WE/wv2eoYABbC9B7xrPJ35B5j11tgyIV/sD6AZudkmAjw/0M9CSAbLXtqeWcAvCO3SHMTnz8RKHa
-xkQaXAB8wDInrTEjzXhieABArNr2cKpQBtBCIrxuHJu7X21jIgUuADKwzclsIQLPA7gDgEZtezhe
-cYHwBYFe5EIgDRcAL1jeSG8EreZZgI1E6H3tOYEhErAIgjDJOObEQbWNCVe4ALjBMjejIUSaAsII
-ADq17eEEhAOgD5nApseMyTuutjHhBheAS2CvpcVajZqnADwDvn8fbdgZ4R2TaJ3KHYsuwgUAAGMg
-65ysYSD2MoAMte3hBJU8IvaCoSB/AQ9Z5gKAijmZ1xDwJoAOatvCCSVsM2PCYzHjcjeqbYma1FoB
-YPObJFoc1heJYSxqZyQeB2Bg9KndSeNrqw9BrRQA69ysGxljb4M78XAqyWdgj8Y8mr9IbUNCTa0S
-gLJ5ddM1Lv2rIDZMbVs44QcDlkMr/Dvm4RO5atsSKmqNAFTMzbpTYOwdHofPkaCQMRodMy73G7UN
-CQVRLwDslTrx1hjDfwD2kNq2cCIIRp8YNfZHaMyZMrVNCSZRLQAVs7M7EYmfAWimti2cCISQwxiG
-xjya97vapgSLqBQAZoZgTc2aDLDnwF14OYHhALHnjWPyXyYCU9sYpYk6AagM1TV+xIBBatvCiSq+
-t2m0w5IeOVaktiFKElUCYHsru63oEhcDaKq2LZyo5KAAYbDh0RO71DZEKaLGAaZiduY9okvcAN75
-OcGjmQhxk2Vu1gi1DVGKiB8BMDMEW2rmSwx4Wm1bOLUJesk4NndypK8LRLQAsNnNDFaq+BDAPWrb
-Eu6cLQdmrBFRZgNeGSggOVKKjIUxBFpkcNAwevyERW1b/CViBaBkblaqjrElAHqobUu4s3Q3g/kH
-EcXnH9N6cYTXbyb0aBKxtz+c2Ohk4s3x406eUdsQf4jIJ8A6u35TRq4VAJqrbUs4Y3EAz60S8fWO
-mqNUIuCBzgIm9iZoo2YlSDUOkQsDjePz9qltiK9EnACUz81sJ4j4AYQ6atsSzhwrAh76WsQ/p71P
-Ua+7jDB3sAATz3sUKKddAvWNG5P7l9qG+EJECUD5vPSOgiisApCiti3hzM48YOSXLhSUyzu+bSbw
-v7s1SOHrAgHBgGIQDYgZm/uH2rbIJWIEwDI3oydAy8EQr7Yt4czvRxhGfSWiwscCWk1Tgc+GapDO
-/7qBUk4Mg4zj8n5S2xA5RMTszzonvT8YreKd3zt/5TI89LXvnR8ADp0Fhi904Zw1one1woFYRlhu
-m5t5i9qGyCHsBcA6J70/g7AUgEltW8KZAwXA8M9FlAdQJGv/GWDsYgaHi4tAgBhEhq+s8zL6qW2I
-FGEtABVzMq9hEL4GL6vtlTI78PA3LpRYA2/rt8MMk1dwAVAAPRNpsWVO9r/UNsQbYSsAFbOzuhBh
-JXgJLkmeXCbiYIH0cckxQPO60sd9tYNh0U4uAgpgAsTllnmZ3dU2xBNhKQD22VlXErHv+ZxfmqW7
-GVb9I91Z4w3Ax/do8PlQDZqkSq/9vrCa4WQJFwEFiIWI5eVzM9upbYg7wk4ArHOzmrvAfgLf6pOk
-2AK8uFo6tb1WAObfIaBNBpAaCyy4S0CcxKSqxMrw3A9cABQiUWBYaZ2XHXaJacJKAErmZqUyxpZz
-Jx95vP6riMIK6eOevpbQrdHFt36TFOCVG6Vv/ep9DCtljC44sqjHRHFV6ex0GZOw0BE2AsA+bGTU
-gS0DcJnatkQCJ84BX2yX7py9mxFGdal5mwe2ItzWVvr2v/ozg7PW189RjKZaCIvZh43CpuxcWAgA
-YyBrmf19MHRT25ZIYdY6EQ6JjhmnB2YMEEAepvxTrifJqMAjhQzf7uajAMUgdLeV2T9m5vDoe2Fh
-hG1u5ssAhqhtR6RQUA4s3SXdKR/rSchI8Px9cgwwoaf0I/DBZi4ASsKAO6ypWdPVtgMIAwGomJ15
-D0/m4Rtf/sUk3/7JMcDQ9tK39552hOxE78fsOcmw7QQXAWVhz1pmZw1X2wpVM+aez+H3npo2RCIi
-YxjSzvtWXpeGJCvCTycAD3UV8Nwq74qybA9Du+yICR2JDIi9ZZuVts3w2Kndqpmg1oWL32qQbHA5
-/wTP4ac6pTag6ywXyry4EdeLI2x6zPN6AsdvDlid+k7JE3KK1bi4KlMAZoZgcDk/Ae/8YUG8Aejf
-0nvPPl3G8LdEbgGOX1xm0Km3KKjKRSuLdmCgGtfmuKdfC+lX+4YjXACCATHcZE3NVGUdLOQDuvNJ
-PX4HENE5aDYdQ8RHzXWoTzCeXwWyOYEr/+OC1en5+FuuIMwadPGdYXEAh88yxBsIqbFALA/ZCgQn
-I6F7zNgTm0J50ZAuArJ5deOsovAZIrzzA5XRd3K88MKZ9+8ScN1lle8AgxZok0n485hnUfv7VNXv
-Sm0MAxdcXDxMiQEapRBapxOuymToUJ/QMJkvGshES0z8jL1S52p6pqA0VBcN6RTAKmrnIUo8/d4c
-JCDBGNkP9x9Hq/77qkzvv8/RIoBdogH14qjK36CwAth2guGTLSKeWMbQa56I69524ZWfRew9Fdmj
-pRDR1BqjfyOUFwyZAFTMybgNINX3PZWiZxPC1yMEyT30cGZ7tb39xhLhVzYnaox6GiZ779iHzgJv
-b2AY8J6IQR+K+GantA9DLeeBijmZd4XqYiERgPI3GmYIoKjb77+8LvD1CA3qJ6ltiX/knqvaebNk
-iFlBNQFIjZU/Cvorl+HJZSL+Nc+Fhdt45iFPEPBW2Zv10kJxrZAIgEbrnMuA5FBcK9RkJACfDBFQ
-Ly7ypgMF5YDrkrdxSoz072CxV+20SX6EteSeAyatENH3XYb1fGfBHSkajXZWKC4UdAGwzs26kYEN
-DvZ11KRRCmHuYIJGdcdq33AxVHHsEUi6M9pcVUVCr/H/+ofPMgxbKGLSChEWPxKZRjl3hSKxaFAf
-WTa/SSJj7J1gXiNc6NSAMOaayFIAgwYQLunPLlF6BKAVqopEoPN5xoCF2xhu+cCFAzLSmtUmRIa3
-it5oFNQJZlCfWKvd+hqArGBeI5wYcw1FVF79RFPVDn+mXHoEoNdUPcfmxW/AF/afAW77n4gNOXxK
-cAmZBo09qFGDQROAijmZ1wB4MFjthyMGLTC2e+SsBbSqtsyULyMHYPX8AWdliIZcSqwMIxaKPAvR
-JRDh4Yq52Z2D1X5QBICZIRCjNxBBlYeUYnBbATER4ubUttq+/z+nvd8uIqButRzNueeUtckhAuOW
-MPxykIvAeQRi4izGgtOXguIJaE3NHAGwjsFoO9yJ0QG9mhFW/i3/AW6VTljxoPrrBzvzvU/oU2Iq
-RzmX4s112F8cLoYxixi+HqFB63Tl249AOlvnZtwL5H+qdMOKP3XslTrxAGYo3W4kcWkCTjmEwzCp
-xArsOen9mBb1alq6ebwGK0cJMPcV0LUhVVlUDIQKB/DIIhElvFTZeehl9lqa4jUyFBcAm0k/GUCG
-0u1GEm0i8K219hCr4hPgjsvr1fxMIKBlGuG+joTPhwlY/6gGj/ciJClQyO1oEcOUlVwAzpNlNWqe
-UbpRRQXAMjejISM8pmSbkchldX17DYbDI75URuLPDjIyAmUmAON6CPhtrAbje1LAEYLL9jD8zp2F
-LvBkxeysbCUbVHYNgNFUAGGT8lgtYvWVP3ILdfoiFw4XwwurK9OCeWNibwEJMu/E6TKGtYe8tycQ
-0LWhfEvjDcD4ngJubs0wbomI3RLTC2+YfxCx6iFNxDlaBQETkTgZwMNKNaiYAFhn12/K4IqaYJ9A
-qRNLKLfLe3P58n7TaQjbc0XsOen9rMvqMtzfUV6H/XgLJHP/t8mQTiHujiaphCUjNXh2eWUgkD8c
-KABW72foLyNpSfRDD1jfSnvN+Mipw0q0ppimMojPIwri/JXCl6Gvr491zybSx3y2VYQoo7+V2oCP
-t0gfeHNrGYZ5QCcAr94k4JYr/O/Ab2/gIYTn0TFRM1mpxhQRAOvcrOYgdo8SbUULugB85KUY0FL6
-th0sAFbI2Iqc/weTXGnXCMBAiZyBUggEvH6zgM4N/Dt/Zx5kVUCuFTCMsL6ZebkSTSkiAIyxF6Fy
-ivFwQ6+RP9z1dWDcJgNoJqN64n/Xeg+5zT0HLNgo/Wa9oTkhPSHw4bdWAF6/RVPDl0Auq/fxxcDz
-aJgWU5VoKGABsMxJawzgdgVsiSp82Q/3p2vdeaX0WYfPMizwkmHuhdWiLEeeBzsrN/fOTpRXsMQd
-aw5wAfh/GO62vpUmYzLonYAFgEHzOIAgDng57rj7apIs8Q1U1hA8Uliz46w9xGS9UTs1qEweqiTD
-2vt33p6T0r4KtQgNnNpHA20kIAEofqtBMgH3BWoEx3cSjIS720nfPqsTGLdEhN1V9fPujQmDZCzK
-PdNb+b23RikkawpTHasTyClS3JyIhREbde6/2RKJ3LwT0N01uFyPAIgLpA2O/zzSjRBvkD5uVz4w
-48eqr06NAPznZgEDvCzu9WtBaB+kcmBSCUg94W40U4uJ1enFUYE04LcAsNnNDAAbE8jFOYGREgOM
-6iKvI320pTJb76VoBWDWIHJbFShOD5j7Bs/zxt88iiUWZe2IdIhhHDO39tvf0u87bEX57ajlPv/h
-wOiuAhqnyBOBF1Yz/FRtIU2nIcy9VcDIagt9T/UWgprcxF8X4RKbsnZEAZmWlKLb/D3Zf4knesjv
-czmKYdAC0/qTrKKdThEYs0jEusNVRUAjAM/dIODlgQJ0GkKvpoTh7YPrdeetEKk3qqck4wBE/ife
-8UsArHOzmgPo4e9FOcrSvTFhqES58AvYnMDor0W3W2p3X034eAjh9ZuDXwX4lJ+1b5JN3B3YDdda
-Z2X7VXDHvxEAY6MQHmHsnPNMvkHAZTJX1i2OShH4fHtNEejakFBH8ajzmuT7KQCJCoQZRyHEBHGk
-Pyf6LADM3FrPAB70E2YYtcD8OzWyIwCdIvDs9yJe/lmERGCh4jhcDFuP+3fRFC4AnrifzW/vcyyO
-zwJgSS2+BYCb1BActWmSAswbLEDrw119ZwPDk9+xoKT28sS2XEKpH4t5eg3QzMdcC7WINIsj70Zf
-T/J9CsDYvT6fwwkZPZoQpvbx7bYu2inixgWhy8v/zQ7/3PmuygqsEEm0IwBD/DhHPmx2SgIR+vp6
-EU5oGdGBMMzHVfyDBcDgD10+JTP1h7wSYOku/67RqQHPCOINxmgAm1fXJ8c8n/6iVpgGgWf8iQhe
-6Cfgtra+dZhSG/DIYhFTVzFUBKlU18yfRL+rCfVvoawtUUiMxaW7yZcTfHtCiN3p0/GckHGqlFXZ
-WxcIePVGwq1tfMxPyIBPtojoO9+FzceUHQ0s2cWwfK9/bXZuALRO5/N/KQSCT31UtgCcr1F2g88W
-cYKOUwTGLmEY9aVYpVSXRgBeu0nAwFa+d5zjxcCQT0X851cWcP0/oDLl+HOr/G/ovo58+C8HBvRn
-85vIKPReiey/qlHnuAVAgDleOcHgP7+K+PMYwx9HGR5dIlbJ71fp7+9fOi6nCMxdL+KmBYEl9Txc
-CAz/3OXXyj9QGZLcl+cDlIvBarPI3g2QL6siG+CXOZygsisfeG/jxWH16n0MTy8Xq8TNawXgzVsE
-PCQzcKg6/5xmGPSBCy//XDOsWIqdecCdH7lwttyvS0OvAWYO0ChWcKRWIFB/2YfKOYh9BQ0I1/tv
-EScYuETgme/FGkkyFu9keGypWCUdGBEw6XoBz/Xxz83XKVb6DNy4wIWdefLOWb2P4e5PXCjws/MD
-lTb7kzugViOiLzPL69uyDrKcyuwCIKDEAxzlWbKbYa+H9ODL9zI89HVNB5+RnQiv3lgZ9OMP+88A
-g//nwuZjno9xuBjeXMfw72/EgHYThneorDjE8RFCnYq66bLyLskSACLWLzCLOErjEIE31npfVPvl
-IMOIha4akXd3XElYeC8hxY88/ykxwFu3CejkIbvv4bMMgz5keHOdvLTknri1DeGFIOYjiHYEJsia
-BsgTAMifU3BCw/I9TFZp7rwSuPX179iAsOR+34bXPZsQVo4S0Ody92/lRTtF3PS+dNESKe7vGJqI
-xKiGQdZLW1IASuZmpTKGqwO3iKMkH8ko5nFhB8BT2rCGyYTF92nQvbH3nmbSAdP6C/joHgFp8TWP
-LawAHv5GxBPLmOxyaO7QCMBzfQQ831fgi36B00nOdqCkAOhF1k3OcZzQcbgQ+CtXWgDGdBfQTiKn
-X4IR+OgewWMZsaapwOL7BAxr7z7pyJoDDP3eFbHyn8De+unxwOdDNRjZifd8hdDYnJauUgfJKdFw
-jQLGcBRk2W5ph5r0BMLD3eR1Jo0APN9XQKNUhmmrL/oRDG5LmNFfgMlNkGmxBZi6SsR3ewL3Fuzb
-onJhMpE7mSsKY7gGwCpvx0gKAOMCEHb8clD6mPE9CEYfK/CM6EBokiJgzGIRIzsJGN/TvYCsOcAw
-8XsRZ8p8a786KTGViUdvbs3f+sGBJPuu10eEmVvrrVTkZxkHTjAos0NykS0rEbhdRuUgd/RoQvhj
-nMZt0k67C3jpJxH/28ICSiJCBAy6gvDcDYJfFYc5MmHowsyt9WTe43FlxqsAWOoUtycGnoMljNhz
-UrqU96AryKekINVx1/kPFwKPLg58hb9JSmWkYo8m/K0fAkwVdc9eCeBPTwd4FQCBiZ0YT/0XVuw/
-I90Bb7lC2TXbRTtFPLcqsBX+GB3wUFcBY7oTdHxJOWRoXEJn+CsAjKitz6VrOUElp9D79xkJQPO6
-ylyrzA5MXiHi293+PwREwOA2Aib2JviWqoKjBIzQ1tv33peJmPeTOaGnsMJ7Z2ydpsyI7Xgx8OCX
-Luw7438brdIIL/QldGzg3iabExAZ3O4ycBSjjbcvPQ7G2FfQAGiluDmcgCixev++mQJv/y3HGQZ9
-6H/nN+mA8T0FfPuA4LHzrz/CMOA9F/rMd2H9ET7MDCJtvAUGeRwB2PIym0EDvkYbZkj51/tbcusC
-S3YxPP2d/2m7+rUgmPt6Lit2pJBh2mqGnw9e/EWGLRRxaxvC8324L0AQiLWl1G8MHD/k7kuPAiBq
-qC3xBYCwQ8pFVgjAgf6TrQzPr/IviCc1FpjeX0B/D4k7yuzA7HUiPtxcM8MQY5UhzBtyRLxxC6Fr
-Q77wrCQucrUB4FYAPA4NiFjLoFnE8RupyjgVdv9E+50NDFNX+tf5B7Qk/DRa47Hz//APw3Vvi3h3
-o/f0YidLGIZ+JuLNdaxGjgOO/wiMeZzKe1sEbBwEWzgBUieWAC8jM39y+/93LcPs33zvcYlG4OWB
-gtvy4gBwpqwyD6AvcQIuEXhznYiNRwmzbyXUi+OjgcAhj33Z844s83wSRz0aJnvvTP+c9u0V/sFm
-/zr/1VmE5Q9qPHb+FX8z9HnX5XeQ0MajDDe97znhCccHCI08feXFJYN5PImjHs3reH8jHiuSPwr4
-dKuIaT/61vk1AjC+J+GbEQLqJ7k/5tnvRTyySERRhU9N1+BUKcPdn1YmO+UEhG8jAGaGFkBW0Mzh
-+M0VGSRZHmuZDMedVf8wPLfKN5/+eAPw3p0CxvcUoPHy6njqWgEd68tv1xslVobhnwUeblzLaXB+
-W78Gbm+jNTWtPuSFCnNCjElXWSPPG9/srFofoDp7TzE8/q1vC34NkwmL7tOgdzPpOXlKDPD5MA1G
-dFBm/u4QgXFLGNYe4iLgJzprfqbbp8a9jjPykPGNEw5c39y7M31+CfDxFvdD+8IKYNRXviXr7NqQ
-sOwBwScXY61QGfQzc4D/CUgvxeGqTDK67QQXAb8g1tDdx+6nAKTh5b/DmBtbuc/OcynzfmduvQbH
-LBJl5RK8QJ/LCR8N8d9BZ0g7wgd3EeIUKCljcQCjvhZxsjTwtmobDHAr324FQABSg2sOJxAyEyoT
-dHqj2OK+FNewDuR1/n4pN7cmzBssveYgRY8mhC+Ga/zKQlyds+XAE8vEgPIR1EbIQ592PwJg4KUY
-whxPOfwuZeluhmXVUnYNaEl45UbppJv3tiO8OUiZ4TsAXJEOfDVcg9TYwNv6/QjDp1u5p5BPCO77
-tFsB8KQWnPChV1PClZnSnXPichF/n6oqAre3JTzf13Pa7XvbEab3Vz4zb7M6wMf3aDxmKfaFl9Yw
-nPBhKlPbIZAPIwAuAGHPhVJfUlQ4gAe+FJFfUvXzER0I0/pRjU5+Q3PCC/2Cl5O/dTow/w4hoIxF
-QOXv9aZEYRTORTz1afe3gRgvAxYBdG5QWUFHirwS4J5PxRo1+oa2F6oM86/OIsy+NfDOKUW3RoQJ
-vQK/yJLdDMeLFTCoFuCjAPAw4Ejh+T6CrEw7OYUMIz53ocRadTpwc2vC/DsIbTIq6wOEKjnHw90I
-XQKM+nOJ4GsBMvGU29ODHwAU2LThhIIkEzB3sEbWYt2ek8B9X7AaItC7GeHbkRokhDAWXyDgxX6B
-rzMs3sUCqkFYi3C78uJpHKbAMg0nVHRuADzXR15P2naC4Z5PWQ0/fTVKcTWvC9wUYE2AM2XAjjyu
-ANIw+QLA+Agg4hjWnmS73u45ydyuCajBv7sGrjwbjypgSJRDILd92v02IHEBiETMfQXcfbW8DvXP
-aYY7P3Kp7lXXMo2QLVnC0jvbZdRJrO0w36YA7tWCE94QATP6CxjgIUa/OocLgbs+9s01OBhcKyPA
-yBuHCrgASEM+rQFwIhSNAMwaRBjYSl6nOlrEcMdHLuQUqteJrs4KTAByz4G7BvuJBwFgAdSA4aiN
-TkOYPUjAbW3lday8EuDuT9QbCWQGOAWwOit/ON5gNnefeloE5AIQQZRYWQ13X40AvHaTgDtkFgk9
-WQoM/UydhUFfqxi7w+JDeHNthAD5AkDEBSCSmL0euOsThs3HqoqAQMCrNwoYLnN34Eghw/CFIs5Z
-QzueVuLtLTfCsbbCPIzqPf3Z3KoFJ/w4WsTw8Z8iSqyVKbVXVUudRQS80FfAsPbyRGDvKYbxS0Pr
-XFMYYO5AAIjR8UUA75D8EQD4CCBieGMtg91V+f92FzB2sYilu2uKwIv95E8HfjnIMOu30HWoE8WB
-XcuohWJhy1GMDwLAoIAmc4LN8WJg+d6qnccpVibMWLSzpgi8PFDAjTJ3B+b8JtaYUgSLvacCOz/R
-xDu/FIxgcfe5p12As8E0hqMM720U4XQTC+MSgae+E/HNzpoLg28MEmQF4YisMpeAvzUC5cIY8Ofx
-wISmMY9dlYQY3CaL95QQhAtAmGNxAEt3e/5eZMDT34n45WDVzqUTgHdu95zT/1IOFwL/2xxcBdh7
-igW8/XhZXT4CkMJTn/aQEETgAhDmrPy7ZlRfdfQaoEW9mp0jyQS8c7tG1vbbnPUM5UFcEfpie+DT
-jGY8gZ0kzBcBICb6UWGOE0qqL/S548EuAjIS3H/XOh0Y31N676zECny1IzhrAQXlqDFN8YfOPIm9
-NOTDFED0cDAnPCi3V9bO84ZRCzzY2fvQ+IHOkJXr/7MgJd2Y9qMYsANPejxwOZ8CSCL6tAbAGBeA
-AAnm+vm6wxe3/jwxqA0hSaKUuE5DmNZfOuf3wQJg/xkfDJTBsj0M38oYxUhxbTPpGgkcQGDuF/Y9
-5QQ8FlRragE2Z/Ceyg050sfcIzMsuHMDeUPonw8oJ2lbjjM8s1yZUcVgGTkROQDTUI67z90KgPHs
-qeMAeHhFAHirzRcom4967zzZiUDbDPkdY2h76bWAbQrF3K87zDDi88CH/kBlLoGODbgAyMBhqpuX
-5+4Lt+vAZIbTMhcnwDzXFed4p9QWnEnAOSuTLP/dr6Vvab17X1YZPnwhpNakAwyXPBkJRiBFYjoh
-hcPF8PaGSg9Dl0JLCnJjHDg4RnfC7aTR80YQYzkANQqKOVGOSwROlxGCsRKw7zQk/fS7ui0D6ZlY
-PTBvcPCiaX49BMz8SVR0HaFZHeD2tsq1F+Uc8fSFZwEgygnqSlYUc7qs8o0XDPad9t6uQECH+kG5
-tE+UWBlW7QM++lPEnpPKtz/lBg10AdYsrEX4IQBeTuJ4Z1d+8JQzp8j7yKJBMiHRGPqhcYmVYf8Z
-YNdJYO1BERuPBi9Jx4CWhH81DU7bUQljOZ6+8igAjLE9BD7H8gdfk1TanQzHitx/VycOiLmkWMep
-Uu9tV9/XL7MDf8m0p9TqfdIisso1iBIrnf8vkF8C7D8TuDuvXBokAy8P5A8P8RsAABVFSURBVM+l
-LwgC7fH0nUcBEEjYxXiiNb9Yf8S3v9uBAqDnPPcb+5/eK6B744sP/Jky7203Sq767x25lXkClEWd
-58KoBebeGtoCJtGAyFw7PX3nceXHUJB7EEAYZI6PLI4WMezKV669rGr58k6VeX/7pcVX/Xduifvj
-Ig2dALx1u4C2mWpbEmEQSo1jT+V4+tqjAJAZIsA8Dh047vlmh3JtEQGZCVU7vNQIoE5s1ePzoqCE
-tk4A5gwW0DvA9OG1EobdRJ6HbBJ7P7RLaXuimXNWho+2KDfcNmqr7sdbHJCMzKte3FMqYjDcSTIB
-nw7VoF8L3vn9gpjH4T/gfRcAxLCT8b+7bN7eULkwphTVt7nkeBdWPyeSl3Fa1CO8czuhEU/44Tck
-kpesERICIArCJmK8/LIcduYBCzYq29sM1e6OXYZvQZDcD0KKVgAe7EJ4vJcAPd/rDwgXsY3evvcq
-ACZd2jarPb8CQIyiVkUZpTZg/FKX2/RcgWCt5i9v1EoPx2zVzok1BMcjMVh0a0SYfD2hdTofeipA
-eczZ/L+8HeB1DYBGb3UA2KKoSVGGQwTGLBJxuFD5tsvsqOI3HyOjYmORpWpnb5Ds4cAw48pMwsdD
-BCwcKvDOrxQMG8nsPahPRlIo+h1gPZWyKZq4kIZ73eHgvGEZqxxdXIjr1wqVgTne1hnyq237ycn9
-pxY6AbjhcsKQdlTF14GjGL9LHSApAMTwO18IrMk5K/DQVy5sCnLmhOPFqJLYo34SYc9Jz4JzrLjq
-v69IJ+gEBD27r1wMWqB7Y8J1lxH6tSCk8Mll0CAlBMDmpD/0OiaCVxKuwj2fiAHns5dDTiFDm0ti
-+xsmw2twTXUnpHgD0LEBYUOOOusA6fGVcfvts4FODSodeZSoBciRxGUwGDdJHSR5KxIfP1FomZO5
-DUAHRcyKEro1JlyVFfzrJFaLw2+TQVjxt+fOfLSIobACVd6swzpcTA/mFIEKBbP8mnSVW48mHaFO
-LENaHCE1FmiUAjRJJcS7rUrPCTqETTT6sKQbmFwtXgkuAFWYcj0BKgRLtc3w/j1jwK8HGQZfUhq8
-fwtC/5A40vC5YtjAaJWcw2QN65kIWY1xgk+H+iQ5hP5Rwfx9nMhEhLhSznGyBMCUkbcJvFpQWGDQ
-Ap0lSnv9coDhnIIeiZwIg6Eg5mz+NjmHypoC0J1wWebgJwB3BWQYRxEGtiKsPeT5LW91At/sEPFA
-Z3nrtkUV0lGDBMb35yMFolWVwXzSyF+PJfY9GHEBCAP6Xg5MXek9NuDjLcCIjpW+A1I8+Z2INRLT
-hh5NCJ8M4QIQCTDGVsg9VvbWnlG0fQuADyzDgEQj4ebW3jvj0SJWo0S4O/48xiQ7PwAMkVlngKM6
-VhOs38s9WLYA0LjCEkb40T+bOEpzX0fpijiz1omo8JJ/3yUCL6yWHimmxROub+6jgRxVINAKGlco
-Ow2MT849JLIvfTeJEwxapxOuv8y7AuSVVIqAJz7awrBbRsbesd0JOg0fAUQCIsGnPuqTABgtjmUA
-LD5ZxAkaj/ciaCTu4PubGHa6qQlzpJDhv79Kv/2zE4G7+fA/UqgwWZyyh/+AryOAZwpKCSRrf5ET
-fFqmkeRKv1MExix2VQkgqgxiYiiT4RE46XoBOu4EHil8R0+d8imPp8+3VoS40NdzOMFjQk9Cw2Tv
-b+jjxcC4pSIcLgbGgInfi14Dii7QrwVhQEv+9o8UBMLnPp/j6wkmfeYyAEGo9cLxB5MOeGmg9ILg
-rwcZnl7OMHMNw2IZuwOpscC0fvzVH0Gc1OsyZG//XcDnO0yjtzqI8Imv53GCR7dGhPs7Sb+pl+xi
-eG+j9LxfpyHMGyygbpwS1nFCAtEH5xP4+IR/Ei9q5iOS8kzVAiZfp1za7MnXE7pIuBtzwgpGRB/6
-c6JfAmAcd/wQQOv8OZcTHDTnc+e3Sgus447qIuC+jrzzRxQMPxvHnDjoz6kBTPLYu/6fywkGsXrg
-/bsEZCT4d/6DXQRMvp53/kiDCVjg77l+C4BRn/E1gBP+ns8JDhkJwNL7BbT0YSRABIzvKZzPccCJ
-MHJNBcmL/T3ZbwE4v+Awz9/zOcEjLZ7wxTAB7bKlO7ROAP5zE2F8T975IxHGMIvMe/zO8RTQPo/V
-qX8HQFkgbXCCQ6IR+OxeAX0u99yxsxOBRfdpcFtbvt0XkRBKbS79e4E0EdCdT56QU8xA7wfSBid4
-mHTA/NsFTO9PNWoG9m9JWDFKw6vtRjDEMD95Qk6x9JFe2gjUCMsb6Y2gFQ7Al9wCnJBzvBiY8K2I
-/WcYJvYWMKQdH/JHOA6IaGZ6LC+gxPSKPAWWOZmfARiiRFuc4OFwMVQ4CIlGtS3hBA772PRo/ohA
-W1Fk8keiYAa8lyDiqI9Owzt/lOAiEmYo0ZBi40DHn7M3CGlXdVWqPQ6H4x7x9F+/6TqMU6Rcn2Lz
-9lMlSVPSr75mjUYqQJ3D4fiNyyWi8NDBF5VqT9GVoPffX5dzXGzZUMk2ORzORRpo9h4eObJXU6Xa
-U3Tl3pKz/q4/zqZvtDNeD4rDURq9YEVayobblWxT0fH62GmTNnWM37BeyTY5HE4lneI2/PrwtGe3
-K9mm4hP2VqacW1N1BXxHgMNRkBRNgesy01HF63IoLgBDzOaCDrF/cO9ADkdBOsZveGu42Xxa6XaD
-smRvNRQ80thwkMcIcDgK0Nh4sNRqODs+GG0HRQDMZrPYJmbrBJJXnozD4XiAIOLKmC1jzGZzUDpT
-UB3Cn35q4e4/y65pHcxrcDjRTKf433a88urQq4LVflC9dlon7umboilwBfMaHE60kqorcDbR7u0f
-zGsEVQBGTJmR2y1h3fRgXoPDiVa6xq1/ZfTMmfnBvEZIYkLHPbnk+K7ydtmhuBaHEw1cGbc1583X
-BjcO9nVC4rjfIm7HwFhNKU8jrhAxRgHxMRd/BD/volLtAJAsTMKRT4K2RGwRu3NgKK4Vstv22qQ3
-Xl5RNPiZUF0vWkmME/DF9CwY9Bdv3eiXTuLAcd/SwtVJ0mDhi5nQai+2M9ychxOn5flwEQHXto/B
-dR1j0bKRHolxGjhdDGeKXNi814Jl68qQk+9znQoOgP7JS994euZjj4fiWiEL3Xtq5oSJ7eI37Q/V
-9aKV4QMSq3R+fxl5U1KVzu8LSfEazH4iDVNG1kHXNiYkxWtABOi0hMy6WgzqFY93J6VjaP/EgO2s
-bXSI++PvUHV+IIQCAABXxuztkabP8zuDaW2nW1sTBvWKD7id3h1i0LdLrF/nxhgFvP5YPbRu4j3g
-S6shjLwpEcMHcBGQS5ou39E86dC1obxmSAVguNl8ukvs2ge0xEMFfKVrGxOmjqwT8Fy7V7sYPDM8
-1e92hg9IQONMnfSB5xk2IBFNsuQfX1vRkhNdY38bPWry5FOhvG7Is3eMnznx024Jv6wO9XUjFa2W
-8OAtSZg2um5AQ3+DjvDI7cl47oE60Pk59E9L0WLwtVVHIIwB7y4pxh3P5uLB6fnYvs9a5XuNAIy+
-Ndlvu2sLPRJ/Xv7YS0/5Vd8vEFRJ30PGE/3bxPyVq8a1I4n2LYx4Z2I6hvRN8HuFngjo1NqE+c+m
-4/be8QGNIK5tHwOtpmoD3/1Whi9+LMHZcy4cznPg+XcLUFpe1Wu1fQsjkhM0/l84ymlt2nFSNOTe
-osa1VREAs9kstjZs6pihz7Wpcf1wx6gnzH82Ha+Nq4cmPgy3qxMfK2DB5Ay8PKYuGqQHPgzv1S6m
-xmcr/6ga81VmEfHrtooqnwkC0OMqU8DXj0bS9Hn2dqadnYLl6y+Fagn8Rs+cmd8tZs1gk1DB/QOq
-odcRLquvr/H5vqN2n7b7YgyC2/n67kM2n7fodFpCs2o2uUTgUG7NdvYcrqnrLRvxLFHVMQoW1j1x
-zZ0jZ0w5rpYNqmbwHPvS1BXXJq56lYhrgDcYA5avL8P4/55Ccan/LwrGgMW/lOKJWadRWuFbO/Xr
-aVE932t+gRNOZ817d+JMzUXeRhl8IfBSiBiuTfzhzbEvTvlWTTtUr+bz1MwJE6c8ndLz99J/8ZTi
-bjhw3I53lxRj6z9W6YO9sPeIDfOXFGPXQf9mXfXdTCEKit3v5hQU1fy8fprqj1pY0S3+1/Wh3O/3
-RFjcFW3Mke5Xi7EHt5d3DLrvcyTAGPD7TguWry/D5j0WMD8HSC6RYe32CixfX4atfwcmIAmxNQeL
-Nrt7w+yOmp/HGAVoteR2xFDbuDJ22zGtKaeX2nYAKk8BLmA2m8UuFbvbXmb6p0htW8KB0goRU985
-g027/e/8AFBQ7MIL7xUE3PkBwGRwIwBuOjoA2D24eZgMPGCgqWn/uQ5xO9qotehXnbAQAAC48y1z
-WbuYzZ3TuadgWGJ044Pg7k0PAHYPb3l3IlKbqKc76eiU8GenoWZzidq2XCCs7si/p089cE3izwMS
-tOfCQh05fuJh1CLU4gFAkrZIvC5xzQ0PmSeFVTxMWAkAAIx9cfKaPokr7+Lhw+GFu+G+J49Cvc79
-5xXW2qnrMUI565mwcuhD0yatVduW6oSdAADAmOnPfNMn+YcHTYKFi0CYYLXV7LyeOrqnzy222nc7
-TUIF65P63f0TZjz7udq2uCMsBQAAxk174oO+ScsfMZBFbVM4AMrcaLHehxGAzcHgqGU7AHqy4bqk
-5Y8/9uIzH6ltiyfCVgAA4LEZT75zffKKqTx6UH3yztT0+EtJdO/fX8fN58dO1q7kIDpyoG/y8slP
-zHjqTbVt8UZYCwAAPDnj8el9k7+dqiceNqAmx0/VFOHMulq3wUXZ9Wq6lxytRdmB9IIV/ZKXTX58
-xuMz1bZFirAXAKBSBAakfDeWxw2oR5lFRH61ko8GHbl18XUX/7//WO3Y3TUKFtY38bsnI6HzAxEi
-AADw2PQn5vVJ/HZ4nFDCRUAlNuysuR7Tr2tclX9rtYR/ta+abYgxYN1f0b+WEyuUsT6Jyx56fOaT
-r6tti1wiRgCAymQi/ZOW38X9BNThl60VNT4bfG08eneIAVFl+PHTQ1NQL7nqGsDuwzacLozudZwk
-bZHYJ3n57RNmPr1AbVt8ISxiAXzhkRnPfv3uVHb615J/rc63Z9WMmeUEjb1HbFi3vQI9r76YF0Aj
-AFNG1sHTwxh0WqqxJsAYsGBpcYgtDS1punxH97g1A8dOn/yj2rb4SkSNAC7w0LRJa3vp17RqZtwX
-3U9WGDLv6yK3b3O9rmbnByrDmHcdit4F3MbGg6W9U36+YuzMyOv8QIQKAACMfm3qoV6JGxpeFbcl
-R21bahNnil14fNZpHMmTXtX//vcyzPqyMARWqUOb2G0neiT+1iDc3Ht9IaITtS3+9Vdbvz6t5mQL
-5/octzeqr7Y9oaBxhg52J0N+gfP/f9bvqEBJuW/LIk2z9LDYqrazblsFKqzSa6ylFSJW/F6Oc+Ui
-EuM0qJN08TGyOxg277Vi9ldFWPRzaUDRjOEKEcM1Cb+uj43dd+UEszmiVzejJjzjtSmzZv5S1Gei
-RYyJmt8pUtBpCcnxApwuoKjUFZWd/gJGwcKuTfzhzXBI5qEEUdVZ5k2Z1u/30t5L8+3ZPAEdR3HS
-9Hn2nvG/3PXI9ElL1bZFKaJKAABg/qRJGXtsnf/cVXFVltq2cKKHVqYdp9qbdnZUM4FnMIjYRUBP
-jJ45Mz8lfnuDXgmrf+AxBJxA0ZIT1yatXl43YVtmtHV+IApHAJcya/Irw/4o67nglD2T+wtwfCZd
-n2fvHLv2gfEzJ36qti3BIqoFAAAWmM0pByqa/by5tMeVatvCiRyuivvzcKukfd1CXasv1ES9AFzg
-1WffeG1d6Q1PlLvia83vzPGdBG2JeE3CmlefnjH+WbVtCQW1qjO8Pcl8xX7HFd/+Vdaxidq2cMKP
-NrHbTrSK29H332bzXrVtCRW1SgAu8PqkN8x/lPWcfNZRJ+JiITjKk6w56+qasPY/T82cMFFtW0JN
-rRQAAPjYbK63v6LptxtKu3dh0bcZwpEBEUP72I1/N9PtvG70zJn5atujBrVWAC4we+rrI/8qvWrW
-EVuzOOmjOdFCE+OBkrYxW8c+NuOZT9S2RU0iOhZACVauW739ln5NXmmlP5pQ5ErtaBHd1MDiRA3J
-2gJXz8Q1C2Jj/+kxcdqUHWrboza1fgRwKQvN5jr7rdkfbyrt3s8qmvjfJorQC1Z0jN28sWHisUHR
-vrXnC/whd8O8qS91zLE0/N9fFZ1bORlfJ4xktOTE1bGbdjcyHr3vkWnPblXbnnCDC4AX3ps8vct+
-e7MPtpd1bOmKvORJtRotOXFF7PbDzXT7Hhwzc/IvatsTrnABkMHcSTNuOORo8e6usqsacSEIb7Tk
-RNuY7Yea6PeN4h1fGi4APjBv8vTu+Y6Gr20vb9+5Qozlf7swwiRYWJvYLTub6XL+PWrGlI1q2xMp
-8IfYDz6aPjnraFn9OTvLO9x81lm31u+kqEmStkhsE7vtt7ra3PsfnT71iNr2RBpcAALgq0fMcUcS
-U186ZGt+70Hr5cmM8T9nKCBiaGb8p6iJ4cCnyYazE0ebzTXzlXNkwZ9YhZj73IzrTtszpu4tb9ud
-jwqCQ5K2SGxt2rU5Q3tsEp/fKwMXAIWZbzbHnHMkTc21NRr6T0WrbDvj2ckCQS9Y0cK093i28din
-dbRFL95vNlvVtima4AIQRBaYzSnFjqQJufbsIX+XX9HExkxqmxQR6MiO5qZ/TmUZjn6bgjxzbfXT
-DwVcAELER9MnZ+VXpD170pE9MMfSrME5VyJ3Ob6ERM05sYlx/9E0Xf73SZQ/k3f60MAFQAV+MZu1
-O+zGu4vFOkPy7VmdD1ubp9Q2j0OBXKivP1aRrT++M8Vw6pOrNWXvXms28ySOIYYLQBjw3owZaaVW
-w20ljqQbCxxp7Y5Ym9aLNj8DvWBFtv54SYYuf2+S7uxP8fbS/41+beohte2q7UTVQxYtfGg2G0ts
-sfeUs/j+hc6kNoXOutn5jqzYSAlQMgoWlqHLLU/VnTmerCneHas/932CYPmSL+CFHxHxQHEAs9ks
-1LXrelUgpm+5K75duRjfoMSZWLfYlRxf6KyjC/UUQktOpGgLHEnawtIETcmZWKH0WIy2bGuSULEq
-T2P/zWw28xLuEQAXgCjgK7NZf86hbVdBpvZ2UahvF/UZdhjS7aIh1S4akmzMFOdgWp2LaTROptcB
-gJUZtIxpCACIXMxINicA6MhuF8gl6sjpMJClzKCxFenIVqiH7aResOfrBfF4DLNsTdQ5t91pNtvV
-/L05HA6Hw+FwOBwOh8PhcDgcDocjwf8BnHZ+mE3sgIkAAAAASUVORK5CYII=
-"/>
-</svg>
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="128" height="120" fill="none"><g clip-path="url(#a)"><path fill="#472459" d="M127.2 65.67c-5.13 5.11-12.23 3.88-17.35-1.25l-41.4-41.6 19.4-19.47a11.35 11.35 0 0 1 18.4 3.37l21.58 56.22a2.5 2.5 0 0 1-.57 2.67l-13.63 13.57 13.58-13.51Z"/><path fill="url(#b)" d="m109.85 64.42-54.16-54.4a13.13 13.13 0 0 0-18.57-.05L3.87 43.07a13.13 13.13 0 0 0-.05 18.57l54.16 54.4a13.13 13.13 0 0 0 18.57.04l10.7-10.64 3.12-3.12-10-10.03a19.04 19.04 0 0 1-23.83-2.56l-6.8-6.85a2.46 2.46 0 0 1 0-3.5l3.35-3.32-8.4-8.46a3.67 3.67 0 0 1-.34-4.9 3.57 3.57 0 0 1 5.29-.23l8.51 8.56 6.68-6.63-8.41-8.46a3.67 3.67 0 0 1-.33-4.9 3.58 3.58 0 0 1 5.3-.24l8.5 8.57 3.36-3.34a2.47 2.47 0 0 1 3.5.01l6.8 6.84a19.03 19.03 0 0 1 2.41 23.86l10 10.03 5.69-5.67 8.16-8.12 17.4-17.31c-5.15 5.11-12.25 3.88-17.36-1.25Z"/></g><defs><linearGradient id="b" x1="63.6" x2="63.6" y1="6.15" y2="119.91" gradientUnits="userSpaceOnUse"><stop stop-color="#FFCA4A"/><stop offset="1" stop-color="#F7931A"/></linearGradient><clipPath id="a"><path fill="#fff" d="M0 0h128v119.91H0z"/></clipPath></defs></svg>
@@ -1,4 +1,4 @@
-"""Load the Nix-generated config for Sovran_SystemsOS_Hub."""
+"""Load the Nix-generated config and build-time versions for Sovran_SystemsOS_Hub."""

 import json
 import os
@@ -18,3 +18,23 @@ def load_config() -> dict:
            return json.load(fh)
    except (FileNotFoundError, json.JSONDecodeError):
        return {"refresh_interval": 5, "command_method": "systemctl", "services": []}
+
+
+def load_versions() -> dict:
+    """Read the Nix-generated or fallback build-time package versions."""
+    path = os.environ.get("SOVRAN_HUB_VERSIONS")
+    if not path:
+        # Candidate 1: parent folder (same as config.json, typical for Nix layout)
+        parent_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        candidate1 = os.path.join(parent_dir, "versions.json")
+        if os.path.exists(candidate1):
+            path = candidate1
+        else:
+            # Candidate 2: local package folder (dev folder structure)
+            path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "versions.json")
+
+    try:
+        with open(path, "r") as fh:
+            return json.load(fh)
+    except (FileNotFoundError, json.JSONDecodeError):
+        return {}
@@ -1,12 +1,29 @@
 #!/usr/bin/env bash
 # ── Sovran Hub External Backup Script ────────────────────────────
-# Backs up Sovran_SystemsOS data to an external USB hard drive.
+# Backs up Sovran_SystemsOS data to an external USB hard drive using rsync.
 # Designed for the Hub web UI (no GUI dependencies).
 #
-# Your Sovran Pro already backs up your data automatically to its
-# internal second drive (BTCEcoandBackup at /run/media/Second_Drive).
-# This script creates an additional copy on an external USB drive —
-# storing your data in a third location for maximum protection.
+# On Server + Desktop and Node systems, your Sovran Pro already backs up
+# your data automatically to its internal second drive (BTCEcoandBackup at
+# /run/media/Second_Drive); this script stores a copy in a third location.
+# Desktop Only systems have no internal second drive, so the external copy
+# is the second location.
+#
+# What gets mirrored depends on the system role:
+#   - Node / Server + Desktop: /etc/nixos, /etc/nix-bitcoin-secrets,
+#     /home, and /var/lib (minus databases, blockchain data, logs, caches).
+#   - Desktop Only: /etc/nixos and /home. Desktop Only runs no server or
+#     Bitcoin services, so there are no nix-bitcoin secrets or system
+#     service data to back up.
+#
+# The external drive must be formatted as ext4. Files are stored as
+# directly browsable files under Sovran_SystemsOS_Backup/current/.
+# Later runs update the same mirror and only transfer changed or new
+# files, making repeat backups fast.
+#
+# PostgreSQL and MariaDB/MySQL databases are NOT included. Bitcoin
+# blockchain and Electrs index data are NOT included (they live on
+# the internal second drive).
 #
 # Usage:
 #   BACKUP_TARGET=/run/media/<user>/<drive> bash sovran-hub-backup.sh
@@ -17,18 +34,28 @@ set -euo pipefail
 BACKUP_LOG="/var/log/sovran-hub-backup.log"
 BACKUP_STATUS="/var/log/sovran-hub-backup.status"
 MEDIA_ROOT="/run/media"
-MIN_FREE_GB=10
 HUB_CONFIG_JSON="/var/lib/sovran-hub/config.json"
 ROLE_STATE_NIX="/etc/nixos/role-state.nix"
+SECOND_DRIVE_MOUNT="/run/media/Second_Drive"
+SAFETY_MARGIN_BYTES=$((1024 * 1024 * 1024))

 # ── Internal drive labels/paths to NEVER use as backup targets ───
 INTERNAL_LABELS=("BTCEcoandBackup" "sovran_systemsos")
-INTERNAL_MOUNTS=("/run/media/Second_Drive" "/boot/efi" "/")
+INTERNAL_MOUNTS=("$SECOND_DRIVE_MOUNT" "/boot/efi" "/")
+
+FAILED_ALREADY=0
+BACKUP_COMPLETE=0
+RSYNC_WARNINGS=()
+
+# Stable rsync mirror sub-path under the target drive. Not timestamped
+# so later runs update the same destination and only transfer new or changed files.
+BACKUP_SUBPATH="Sovran_SystemsOS_Backup/current"

 # ── Logging helpers ──────────────────────────────────────────────

 log() {
-  local msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
+  local msg
+  msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
  echo "$msg" | tee -a "$BACKUP_LOG"
 }

@@ -37,16 +64,47 @@ set_status() {
 }

 fail() {
+  FAILED_ALREADY=1
  log "ERROR: $*"
  set_status "FAILED"
  exit 1
 }

+cleanup() {
+  local rc=$?
+
+  # Release the concurrency lock file descriptor if it was opened
+  if [[ -n "${LOCK_FD:-}" ]]; then
+    exec {LOCK_FD}>&- 2>/dev/null || true
+  fi
+
+  if [[ "$BACKUP_COMPLETE" -eq 1 && "$rc" -eq 0 ]]; then
+    return
+  fi
+
+  if [[ "$FAILED_ALREADY" -eq 0 ]]; then
+    log "ERROR: Backup terminated unexpectedly (exit code $rc)."
+    set_status "FAILED"
+  fi
+
+  # Mark the backup directory as incomplete so failed runs are identifiable
+  if [[ -n "${BACKUP_DIR:-}" && -d "${BACKUP_DIR:-}" && ! -f "${BACKUP_DIR:-}/BACKUP_COMPLETE" ]]; then
+    touch "${BACKUP_DIR}/INCOMPLETE" 2>/dev/null || true
+  fi
+}
+
+trap cleanup EXIT
+trap 'exit 1' INT TERM
+
+require_cmd() {
+  local cmd="$1"
+  command -v "$cmd" >/dev/null 2>&1 || fail "Required command not found: $cmd"
+}
+
 # ── Check whether a mount point is an internal drive ────────────

 is_internal() {
  local mnt="$1"
-  # Reject known internal mount points and their subdirectories
  for internal in "${INTERNAL_MOUNTS[@]}"; do
    if [[ "$mnt" == "$internal" || "$mnt" == "${internal}/"* ]]; then
      return 0
@@ -59,39 +117,37 @@ is_internal() {

 find_external_drive() {
  local target=""
-  # lsblk JSON output: NAME,LABEL,MOUNTPOINT,HOTPLUG,RM,TYPE
-  if command -v lsblk &>/dev/null; then
-    while IFS=$'\t' read -r dev_type hotplug removable label mountpoint; do
-      # Must be a partition or disk, and be removable/hotplug
-      [[ "$dev_type" == "part" || "$dev_type" == "disk" ]] || continue
-      [[ "$hotplug" == "1" || "$removable" == "1" ]] || continue
-      [[ -n "$mountpoint" ]] || continue

-      # Filter out internal labels
-      local skip=0
-      for lbl in "${INTERNAL_LABELS[@]}"; do
-        [[ "$label" == "$lbl" ]] && skip=1 && break
-      done
-      [[ "$skip" -eq 1 ]] && continue
+  while IFS=$'\t' read -r dev_type hotplug removable label mountpoint; do
+    [[ "$dev_type" == "part" || "$dev_type" == "disk" ]] || continue
+    [[ "$hotplug" == "1" || "$removable" == "1" ]] || continue
+    [[ -n "$mountpoint" ]] || continue

-      # Filter out internal mount points
-      is_internal "$mountpoint" && continue
+    local skip=0
+    for lbl in "${INTERNAL_LABELS[@]}"; do
+      [[ "$label" == "$lbl" ]] && skip=1 && break
+    done
+    [[ "$skip" -eq 1 ]] && continue

-      if mountpoint -q "$mountpoint" 2>/dev/null; then
-        target="$mountpoint"
-        break
-      fi
-    done < <(lsblk -J -o NAME,LABEL,MOUNTPOINT,HOTPLUG,RM,TYPE 2>/dev/null | \
-      python3 -c "
+    is_internal "$mountpoint" && continue
+
+    if mountpoint -q "$mountpoint" 2>/dev/null; then
+      target="$mountpoint"
+      break
+    fi
+  done < <(lsblk -J -o NAME,LABEL,MOUNTPOINT,HOTPLUG,RM,TYPE 2>/dev/null | \
+    python3 -c "
 import sys, json
-data = json.load(sys.stdin)
+
 def flatten(devs):
    for d in devs:
        yield d
        for c in d.get('children', []):
            yield from flatten([c])
+
+data = json.load(sys.stdin)
 for d in flatten(data.get('blockdevices', [])):
-    print('\t'.join([
+    print('\\t'.join([
        d.get('type') or '',
        str(d.get('hotplug') or '0'),
        str(d.get('rm') or '0'),
@@ -99,24 +155,10 @@ for d in flatten(data.get('blockdevices', [])):
        d.get('mountpoint') or '',
    ]))
 " 2>/dev/null || true)
-  fi

-  # Fallback: walk /run/media/ if lsblk produced nothing
  if [[ -z "$target" && -d "$MEDIA_ROOT" ]]; then
    while IFS= read -r -d '' mnt; do
      is_internal "$mnt" && continue
-      # Check label via lsblk on the device backing this mount
-      local dev
-      dev=$(findmnt -n -o SOURCE "$mnt" 2>/dev/null || true)
-      if [[ -n "$dev" ]]; then
-        local lbl
-        lbl=$(lsblk -n -o LABEL "$dev" 2>/dev/null || true)
-        local skip=0
-        for internal_lbl in "${INTERNAL_LABELS[@]}"; do
-          [[ "$lbl" == "$internal_lbl" ]] && skip=1 && break
-        done
-        [[ "$skip" -eq 1 ]] && continue
-      fi
      if mountpoint -q "$mnt" 2>/dev/null; then
        target="$mnt"
        break
@@ -128,16 +170,10 @@ for d in flatten(data.get('blockdevices', [])):
 }

 # ── Detect the configured system role ───────────────────────────
-#
-# Priority:
-#   1. Hub config JSON  (/var/lib/sovran-hub/config.json)  — "role" key
-#   2. role-state.nix   (/etc/nixos/role-state.nix)        — grep for true flag
-#   3. Default: server_plus_desktop

 detect_role() {
  local role="server_plus_desktop"

-  # 1. Try the Hub config JSON
  if [[ -f "$HUB_CONFIG_JSON" ]] && command -v python3 &>/dev/null; then
    local r
    r=$(python3 -c \
@@ -149,7 +185,6 @@ detect_role() {
    fi
  fi

-  # 2. Fall back to parsing role-state.nix
  if [[ -f "$ROLE_STATE_NIX" ]]; then
    if grep -q 'roles\.desktop = lib\.mkDefault true' "$ROLE_STATE_NIX" 2>/dev/null; then
      role="desktop"
@@ -161,6 +196,119 @@ detect_role() {
  echo "$role"
 }

+validate_target_mount() {
+  local target="$1"
+  [[ "$target" == "${MEDIA_ROOT}/"* ]] || fail "Target '$target' must be mounted under $MEDIA_ROOT."
+  [[ -d "$target" ]] || fail "Target path '$target' does not exist."
+  mountpoint -q "$target" || fail "Target path '$target' is not a mount point."
+
+  local fstype=""
+  fstype=$(findmnt -n -o FSTYPE -T "$target" 2>/dev/null || true)
+  [[ -n "$fstype" ]] || fail "Could not determine filesystem type for '$target'."
+
+  if [[ "$fstype" != "ext4" ]]; then
+    fail "Target '$target' must be formatted as ext4 (detected filesystem: $fstype). Manual Backup requires an ext4-formatted external drive for Linux metadata preservation. exFAT, FAT32, and NTFS are not supported."
+  fi
+
+  local write_test
+  write_test="$target/.sovran-write-test-$$"
+  if ! ( : > "$write_test" && echo "ok" >> "$write_test" && rm -f "$write_test" ); then
+    fail "Target '$target' is not writable."
+  fi
+
+  log "Verified backup target filesystem: $fstype"
+}
+
+estimate_path_bytes() {
+  local path="$1"
+  shift || true
+  [[ -e "$path" ]] || {
+    echo 0
+    return
+  }
+
+  local size
+  size=$(du -s -B1 -x "$@" "$path" 2>/dev/null | awk '{print $1}' || true)
+  [[ -n "$size" ]] || size=0
+  echo "$size"
+}
+
+# ── Sync one source tree to its backup destination ───────────────
+# Usage: sync_tree <label> <allow_vanished> <source> <destination> [rsync options...]
+#
+# allow_vanished: "yes" means rsync exit 24 (vanished files) is nonfatal.
+# Used for /home only — files may disappear while the desktop is active.
+# All other nonzero exit codes are always fatal.
+#
+# Before every rsync call this helper:
+#   1. Re-verifies $TARGET is still a mount point (fails if drive disconnected).
+#   2. Verifies the destination path remains beneath $BACKUP_DIR and $BACKUP_DIR
+#      remains beneath $TARGET (safe-path check).
+#   3. Creates the full destination directory hierarchy with mkdir -p so that
+#      rsync never fails trying to create a directory whose parent is absent.
+sync_tree() {
+  local label="$1"
+  local allow_vanished="$2"
+  local source="$3"
+  local destination="$4"
+  shift 4
+  # Remaining "$@" are rsync options (--exclude, etc.)
+
+  # ── Re-verify the external drive is still mounted ────────────────
+  mountpoint -q "$TARGET" 2>/dev/null || \
+    fail "Stage $label: external drive '$TARGET' is no longer mounted. Refusing to write."
+
+  # ── Verify path safety ────────────────────────────────────────────
+  # BACKUP_DIR must remain beneath TARGET.
+  case "$BACKUP_DIR" in
+    "$TARGET"/*) ;;
+    *) fail "Stage $label: BACKUP_DIR '$BACKUP_DIR' is outside TARGET '$TARGET'." ;;
+  esac
+  # Destination must remain beneath BACKUP_DIR.
+  case "$destination" in
+    "$BACKUP_DIR"/*|"$BACKUP_DIR") ;;
+    *) fail "Stage $label: destination '$destination' is outside BACKUP_DIR '$BACKUP_DIR'. Refusing to write." ;;
+  esac
+
+  # ── Create complete destination directory hierarchy ───────────────
+  # This is the fix for the production failure:
+  #   rsync: [Receiver] mkdir ".../current/etc/nixos" failed: No such file or directory
+  # mkdir -p creates all intermediate parents (e.g. current/etc/) before rsync runs.
+  mkdir -p -- "$destination" || \
+    fail "Stage $label: failed to create destination directory '$destination' (source: '$source')."
+
+  local rsync_err_tmp
+  rsync_err_tmp="$(mktemp /tmp/sovran-rsync-err.XXXXXX)"
+
+  local rc=0
+  rsync \
+    --archive \
+    --acls \
+    --xattrs \
+    --hard-links \
+    --numeric-ids \
+    --one-file-system \
+    --partial \
+    "$@" "$source" "$destination" 2>"$rsync_err_tmp" || rc=$?
+
+  if [[ -s "$rsync_err_tmp" ]]; then
+    while IFS= read -r rline; do
+      log "rsync: $rline"
+    done < "$rsync_err_tmp"
+  fi
+  rm -f "$rsync_err_tmp"
+
+  if [[ "$rc" -eq 0 ]]; then
+    return 0
+  elif [[ "$allow_vanished" == "yes" && "$rc" -eq 24 ]]; then
+    log "NOTE: $label — some files vanished during sync (normal on an active desktop). Your important data is backed up."
+    RSYNC_WARNINGS+=("$label: some files vanished during sync (rsync exit 24 — normal on active desktop)")
+    return 0
+  else
+    fail "rsync failed for $label (exit code $rc). See the rsync errors above."
+  fi
+}
+
 # ── Initialise log file ──────────────────────────────────────────

 : > "$BACKUP_LOG"
@@ -169,22 +317,58 @@ set_status "RUNNING"
 log "=== Sovran_SystemsOS External Hub Backup ==="
 log "Starting backup process…"

+# ── Acquire exclusive run lock ────────────────────────────────────
+# Prevents two simultaneous backup runs (e.g. from double-click or
+# stale RUNNING status after a Hub restart).
+
+LOCK_FILE="/var/lock/sovran-hub-backup.lock"
+# Note: exec {LOCK_FD}>>file requires bash 4.1+ (NixOS provides bash 5.x).
+exec {LOCK_FD}>>"$LOCK_FILE" 2>/dev/null || \
+  fail "Cannot open lock file: $LOCK_FILE. Ensure /var/lock is writable."
+flock --nonblock "$LOCK_FD" 2>/dev/null || \
+  fail "Another backup is already running. Wait for it to complete or check $BACKUP_STATUS."
+
+require_cmd rsync
+require_cmd findmnt
+require_cmd lsblk
+require_cmd mountpoint
+require_cmd df
+require_cmd du
+require_cmd awk
+require_cmd find
+require_cmd hostname
+require_cmd date
+require_cmd python3
+require_cmd flock
+
 # ── Detect system role ───────────────────────────────────────────

 ROLE="$(detect_role)"
 case "$ROLE" in
-  desktop)            ROLE_LABEL="Desktop Only" ;;
-  node)               ROLE_LABEL="Node (Bitcoin-only)" ;;
-  server_plus_desktop) ROLE_LABEL="Server + Desktop" ;;
-  *)                  ROLE_LABEL="$ROLE" ;;
+  desktop)              ROLE_LABEL="Desktop Only" ;;
+  node)                 ROLE_LABEL="Node (Bitcoin-only)" ;;
+  server_plus_desktop)  ROLE_LABEL="Server + Desktop" ;;
+  *)                    ROLE_LABEL="$ROLE" ;;
 esac
 log "Detected role: $ROLE_LABEL"

+# Backup scope depends on the role. Desktop Only systems run no server or
+# Bitcoin services, so only the NixOS configuration and home directory are
+# mirrored (2 stages). Node and Server + Desktop systems also mirror the
+# nix-bitcoin secrets and /var/lib system service data (4 stages).
+if [[ "$ROLE" == "desktop" ]]; then
+  TOTAL_STAGES=2
+  HOME_STAGE_NUM=2
+  log "Desktop Only role: backing up the NixOS configuration (/etc/nixos) and home directory (/home) only."
+else
+  TOTAL_STAGES=4
+  HOME_STAGE_NUM=3
+fi
+
 # ── Detect target drive ──────────────────────────────────────────

 if [[ -n "${BACKUP_TARGET:-}" ]]; then
  TARGET="$BACKUP_TARGET"
-  # Safety: never allow internal drives even if explicitly passed
  if is_internal "$TARGET"; then
    fail "Target '$TARGET' is an internal system drive and cannot be used for external backup."
  fi
@@ -193,129 +377,261 @@ else
  log "Auto-detecting external USB drives…"
  TARGET="$(find_external_drive)"
  if [[ -z "$TARGET" ]]; then
-    fail "No external USB drive detected. " \
-         "Please plug in an exFAT-formatted USB drive (≥500 GB) and try again."
+    fail "No external USB drive detected. Please plug in an ext4-formatted USB drive and try again."
  fi
  log "Detected external drive: $TARGET"
 fi

-# ── Verify mount point ───────────────────────────────────────────
+validate_target_mount "$TARGET"

-[[ -d "$TARGET" ]] || fail "Target path '$TARGET' does not exist."
-mountpoint -q "$TARGET" || fail "Target path '$TARGET' is not a mount point."
+# ── Set up stable backup destination ────────────────────────────
+# Subsequent runs update the same mirror, transferring only new or changed files.

-# ── Check free disk space (require ≥ 10 GB) ──────────────────────
+BACKUP_DIR="${TARGET}/${BACKUP_SUBPATH}"
+mkdir -p -- "$BACKUP_DIR"

-FREE_KB=$(df -k --output=avail "$TARGET" | tail -1)
-FREE_GB=$(( FREE_KB / 1024 / 1024 ))
-log "Free space on drive: ${FREE_GB} GB"
-(( FREE_GB >= MIN_FREE_GB )) || \
-  fail "Not enough free space on drive (${FREE_GB} GB available, ${MIN_FREE_GB} GB required)."
+# Remove any stale BACKUP_COMPLETE left by a previous successful run.
+# The new run will re-earn it only after all stages succeed.
+rm -f "$BACKUP_DIR/BACKUP_COMPLETE"

-# ── Create timestamped backup directory ─────────────────────────
-
-TIMESTAMP="$(date '+%Y%m%d_%H%M%S')"
-BACKUP_DIR="${TARGET}/Sovran_SystemsOS_Backup/${TIMESTAMP}"
-mkdir -p "$BACKUP_DIR"
+# Write an INCOMPLETE marker immediately; replaced by BACKUP_COMPLETE only
+# after all rsync stages and manifest write succeed. Failed or interrupted
+# runs keep this marker so they are clearly identifiable.
+touch "$BACKUP_DIR/INCOMPLETE"
 log "Backup destination: $BACKUP_DIR"

-# ── Stage 1/4: NixOS configuration ──────────────────────────────
+# ── Estimate required free space ─────────────────────────────────
+# PostgreSQL/MariaDB raw directories and Bitcoin/Electrs data are excluded
+# from the estimate to avoid inflating the required size.
+
+ETC_NIXOS_BYTES=$(estimate_path_bytes /etc/nixos)
+HOME_BYTES=$(estimate_path_bytes /home --exclude='*/.cache' --exclude='*/.local/share/Trash' --exclude='*/Trash')
+
+# nix-bitcoin secrets and /var/lib system service data exist only on the
+# Node and Server + Desktop roles — they are skipped entirely on Desktop Only.
+SECRETS_BYTES=0
+VAR_LIB_BYTES=0
+if [[ "$ROLE" != "desktop" ]]; then
+  SECRETS_BYTES=$(estimate_path_bytes /etc/nix-bitcoin-secrets)
+  VAR_LIB_BYTES=$(estimate_path_bytes /var/lib \
+    --exclude='postgresql' \
+    --exclude='mysql' \
+    --exclude='mariadb' \
+    --exclude='bitcoind' \
+    --exclude='electrs' \
+    --exclude='*/log' \
+    --exclude='*/logs' \
+    --exclude='*/cache' \
+    --exclude='*/tmp')
+fi
+
+ESTIMATED_BYTES=$(( ETC_NIXOS_BYTES + HOME_BYTES + SECRETS_BYTES + VAR_LIB_BYTES ))
+# Require 20% growth headroom plus a fixed 1 GiB safety margin.
+# Later incremental runs need far less space, but a conservative first-run
+# check protects against running out of space mid-backup.
+REQUIRED_BYTES=$(( ESTIMATED_BYTES + (ESTIMATED_BYTES / 5) + SAFETY_MARGIN_BYTES ))
+
+FREE_BYTES=$(df -B1 --output=avail "$TARGET" | tail -1 | tr -d ' ')
+FREE_GB=$(( FREE_BYTES / 1024 / 1024 / 1024 ))
+REQUIRED_GB=$(( REQUIRED_BYTES / 1024 / 1024 / 1024 ))
+
+log "Estimated backup size: $(( ESTIMATED_BYTES / 1024 / 1024 / 1024 )) GB"
+log "Required free space (with safety margin): ${REQUIRED_GB} GB"
+log "Free space on drive: ${FREE_GB} GB"
+
+(( FREE_BYTES >= REQUIRED_BYTES )) || \
+  fail "Not enough free space on drive (${FREE_GB} GB available, ${REQUIRED_GB} GB required)."
+
+# ── Stage 1: NixOS configuration ────────────────────────────────

 log ""
-log "── Stage 1/4: NixOS configuration (/etc/nixos) ──────────────"
+log "── Stage 1/${TOTAL_STAGES}: NixOS configuration (/etc/nixos) ──────────────"
 if [[ -d /etc/nixos ]]; then
-  rsync -a --info=progress2 /etc/nixos/ "$BACKUP_DIR/nixos/" 2>&1 | tee -a "$BACKUP_LOG" || \
-    fail "Stage 1 failed while copying /etc/nixos"
+  sync_tree "/etc/nixos" no /etc/nixos/ "$BACKUP_DIR/etc/nixos/"
  log "Stage 1 complete."
 else
  log "WARNING: /etc/nixos not found — skipping."
 fi

-# ── Stage 2/4: Secrets ──────────────────────────────────────────
+# ── Stage 2: Secrets ────────────────────────────────────────────
+# Only applies to the Node and Server + Desktop roles. Desktop Only systems
+# run no nix-bitcoin services, so there are no secrets to back up and this
+# stage does not exist for them.

-log ""
-log "── Stage 2/4: Secrets ───────────────────────────────────────"
-mkdir -p "$BACKUP_DIR/secrets"
-
-if [[ "$ROLE" == "desktop" ]]; then
-  log "Skipping /etc/nix-bitcoin-secrets — not applicable for Desktop Only role."
-else
+if [[ "$ROLE" != "desktop" ]]; then
+  log ""
+  log "── Stage 2/${TOTAL_STAGES}: Secrets (/etc/nix-bitcoin-secrets) ───────────"
  if [[ -e /etc/nix-bitcoin-secrets ]]; then
-    rsync -a --info=progress2 /etc/nix-bitcoin-secrets "$BACKUP_DIR/secrets/" 2>&1 | tee -a "$BACKUP_LOG" || \
-      log "WARNING: Could not copy /etc/nix-bitcoin-secrets — continuing."
+    sync_tree "/etc/nix-bitcoin-secrets" no /etc/nix-bitcoin-secrets/ "$BACKUP_DIR/etc/nix-bitcoin-secrets/"
  else
-    log "  (not found: /etc/nix-bitcoin-secrets — skipping)"
+    log "(not found: /etc/nix-bitcoin-secrets — skipping)"
  fi
+  log "Stage 2 complete."
 fi

-log "Stage 2 complete."
-
-# ── Stage 3/4: Home directory ────────────────────────────────────
+# ── Home directory ──────────────────────────────────────────────
+# Stage 2/2 on Desktop Only, stage 3/4 on Node and Server + Desktop.
+# Rsync exit code 24 (vanished source files) is treated as nonfatal here
+# because the desktop may be active and files can disappear between the
+# directory scan and the copy. All other nonzero exit codes remain fatal.

 log ""
-log "── Stage 3/4: Home directory (/home) ───────────────────────"
+log "── Stage ${HOME_STAGE_NUM}/${TOTAL_STAGES}: Home directory (/home) ───────────────────────"
 if [[ -d /home ]]; then
-  rsync -a --info=progress2 \
+  sync_tree "/home" yes /home/ "$BACKUP_DIR/home/" \
    --exclude='.cache/' \
    --exclude='.local/share/Trash/' \
-    --exclude='*/Trash/' \
-    /home/ "$BACKUP_DIR/home/" 2>&1 | tee -a "$BACKUP_LOG" || \
-    fail "Stage 3 failed while copying /home"
-  log "Stage 3 complete."
+    --exclude='Trash/' \
+    --exclude='.mozilla/firefox/*/cache2/' \
+    --exclude='.mozilla/firefox/*/startupCache/' \
+    --exclude='.mozilla/firefox/*/thumbnails/' \
+    --exclude='.config/google-chrome/*/Cache/' \
+    --exclude='.config/google-chrome/*/Code Cache/' \
+    --exclude='.config/chromium/*/Cache/' \
+    --exclude='.config/chromium/*/Code Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Browser/*/Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Browser/*/Code Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Origin/*/Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Origin/*/Code Cache/' \
+    --exclude='.local/share/baloo/' \
+    --exclude='.thumbnails/' \
+    --exclude='.xsession-errors' \
+    --exclude='.xsession-errors.old'
+  log "Stage ${HOME_STAGE_NUM} complete."
 else
  log "WARNING: /home not found — skipping."
 fi

-# ── Stage 4/4: System data ───────────────────────────────────────
+# ── Stage 4: System data ────────────────────────────────────────
+# Only applies to the Node and Server + Desktop roles — Desktop Only systems
+# run no server services, so /var/lib holds no service data worth mirroring.
+# PostgreSQL/MariaDB raw database directories are excluded. Application
+# databases must be backed up separately with native database tools.
+# Bitcoin/Electrs data are excluded; they live on the internal second drive.

-log ""
-log "── Stage 4/4: System data (/var/lib) ────────────────────────"
-if [[ "$ROLE" == "desktop" ]]; then
+if [[ "$ROLE" != "desktop" ]]; then
+  log ""
+  log "── Stage 4/${TOTAL_STAGES}: System data (/var/lib) ───────────────────────"
  if [[ -d /var/lib ]]; then
-    rsync -a --info=progress2 \
-      --filter='- /lnd/***' \
-      --exclude='logs/' \
-      --exclude='log/' \
-      --exclude='*/logs/' \
+    sync_tree "/var/lib" no /var/lib/ "$BACKUP_DIR/var/lib/" \
+      --exclude='postgresql/' \
+      --exclude='mysql/' \
+      --exclude='mariadb/' \
+      --exclude='bitcoind/' \
+      --exclude='electrs/' \
      --exclude='*/log/' \
-      /var/lib/ "$BACKUP_DIR/var-lib/" 2>&1 | tee -a "$BACKUP_LOG" || \
-      fail "Stage 4 failed while copying /var/lib for Desktop Only role"
-    log "Stage 4 complete (Desktop Only role excludes /var/lib/lnd)."
+      --exclude='*/logs/' \
+      --exclude='*/cache/' \
+      --exclude='*/tmp/'
+    log "Stage 4 complete."
  else
    log "WARNING: /var/lib not found — skipping."
  fi
-elif [[ -d /var/lib ]]; then
-  rsync -a --info=progress2 \
-    --exclude='logs/' \
-    --exclude='log/' \
-    --exclude='*/logs/' \
-    --exclude='*/log/' \
-    /var/lib/ "$BACKUP_DIR/var-lib/" 2>&1 | tee -a "$BACKUP_LOG" || \
-    fail "Stage 4 failed while copying /var/lib"
-  log "Stage 4 complete."
-else
-  log "WARNING: /var/lib not found — skipping."
 fi

 # ── Generate manifest ────────────────────────────────────────────

 log ""
 log "Generating BACKUP_MANIFEST.txt …"
+MANIFEST_FILE="$BACKUP_DIR/BACKUP_MANIFEST.txt"
+
 {
  echo "Sovran_SystemsOS Backup Manifest"
-  echo "Generated: $(date)"
+  echo "Updated:   $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
  echo "Hostname:  $(hostname)"
  echo "Role:      $ROLE_LABEL"
  echo "Target:    $TARGET"
  echo ""
-  echo "Contents:"
-  find "$BACKUP_DIR" -mindepth 1 -maxdepth 2 | sort
-} > "$BACKUP_DIR/BACKUP_MANIFEST.txt"
-log "Manifest written to $BACKUP_DIR/BACKUP_MANIFEST.txt"
+  echo "Backup type: Live rsync mirror (directly browsable files)"
+  echo "Location:    ${BACKUP_DIR}"
+  echo ""
+  echo "Source paths mirrored:"
+  echo "- /etc/nixos  →  current/etc/nixos/"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "- /etc/nix-bitcoin-secrets (when present)  →  current/etc/nix-bitcoin-secrets/"
+  fi
+  echo "- /home  →  current/home/"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "- /var/lib  →  current/var/lib/"
+  fi
+  echo ""
+  echo "Exclusions:"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "- /var/lib/postgresql (PostgreSQL raw database files — not included)"
+    echo "- /var/lib/mysql, /var/lib/mariadb (MariaDB raw database files — not included)"
+    echo "- /var/lib/bitcoind (Bitcoin blockchain — excluded; lives on internal second drive)"
+    echo "- /var/lib/electrs (Electrs index — excluded; lives on internal second drive)"
+    echo "- /run/media/Second_Drive (internal second drive — never traversed)"
+    echo "- /var/lib/*/log, /var/lib/*/logs, /var/lib/*/cache, /var/lib/*/tmp"
+  fi
+  echo "- Browser disk caches, thumbnail caches, trash directories, X session error logs"
+  echo ""
+  echo "Important limitations:"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "- PostgreSQL and MariaDB/MySQL application databases are NOT included in this"
+    echo "  backup. If you use Nextcloud, Matrix/Synapse, or other database-backed"
+    echo "  applications, their data must be backed up separately using native tools."
+    echo "- Bitcoin blockchain data and Electrs indexes are NOT included; they are"
+    echo "  reconstructable or stored on the internal second drive."
+  fi
+  echo "- This is a live file-level mirror, not a transactional database backup."
+  echo "  Files being written during the backup may be in an inconsistent state."
+  echo ""
+  echo "Restore guidance:"
+  echo "- Files are directly browsable on the backup drive under: ${BACKUP_DIR}"
+  echo "- To restore a directory:"
+  echo "    sudo rsync -aAXH --numeric-ids current/etc/nixos/ /etc/nixos/"
+  echo "    sudo rsync -aAXH --numeric-ids current/home/ /home/"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "    sudo rsync -aAXH --numeric-ids current/var/lib/ /var/lib/"
+  fi
+  echo "- To copy individual files:"
+  echo "    sudo cp -a current/home/username/ /home/username/"
+  echo "- When restoring /etc/nixos to replacement hardware, regenerate"
+  echo "  hardware-configuration.nix for the new hardware before rebuilding."
+  echo ""
+  echo "Nonfatal warnings:"
+  if [[ "${#RSYNC_WARNINGS[@]}" -eq 0 ]]; then
+    echo "- none"
+  else
+    for warning in "${RSYNC_WARNINGS[@]}"; do
+      echo "- $warning"
+    done
+  fi
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo ""
+    echo "Note: Bitcoin blockchain and Electrs index data are intentionally excluded"
+    echo "from manual external backup because they already live on the internal second drive"
+    echo "(/run/media/Second_Drive) and are reconstructable/internal-backup data."
+  fi
+} > "$MANIFEST_FILE"
+
+log "Manifest written to $MANIFEST_FILE"

 # ── Done ─────────────────────────────────────────────────────────

 log ""
-log "All Finished! Your data is now backed up to a third location."
+if [[ "${#RSYNC_WARNINGS[@]}" -gt 0 ]]; then
+  log "Backup completed with nonfatal warnings:"
+  for warning in "${RSYNC_WARNINGS[@]}"; do
+    log "  WARNING: $warning"
+  done
+  log "Your important data is backed up. The warnings above indicate files that"
+  log "vanished during backup, which is normal on an active desktop."
+  log ""
+fi
+if [[ "$ROLE" == "desktop" ]]; then
+  log "All Finished! Your data is now backed up to a second, external location."
+else
+  log "All Finished! Your data is now backed up to a third location."
+fi
+log "Files are directly browsable on the drive under: ${BACKUP_DIR}"
 log "Please eject the drive safely before removing it from your Sovran Pro."
+
+# Remove incomplete marker and write completion marker only after all work succeeds.
+# A later successful run will update the same mirror and replace any INCOMPLETE state.
+rm -f "$BACKUP_DIR/INCOMPLETE"
+date -u '+%Y-%m-%dT%H:%M:%SZ' > "$BACKUP_DIR/BACKUP_COMPLETE"
+
+BACKUP_COMPLETE=1
 set_status "SUCCESS"
@@ -0,0 +1,313 @@
+"""Sovran Hub — pure security validation helpers.
+
+This module contains the dependency-light security helper functions used by
+the Hub server.  Keeping them here allows tests to import and exercise the
+exact production implementations rather than maintaining separate copies.
+
+All functions in this module depend only on the Python standard library.
+"""
+
+from __future__ import annotations
+
+import base64
+import ipaddress
+import json
+import os
+import re
+import tempfile
+import time
+import urllib.parse
+
+# ── Nix string escaping ────────────────────────────────────────────────────────
+
+def _nix_escape(value: str) -> str:
+    """Escape *value* for use inside a Nix double-quoted string literal.
+
+    Handles backslashes, double-quotes, newlines, carriage returns, tabs, and
+    Nix-specific anti-quotation sequences (``${...}``).  The returned value is
+    safe to embed as ``"<returned_value>"`` in generated Nix source.
+    """
+    value = value.replace("\\", "\\\\")
+    value = value.replace('"', '\\"')
+    value = value.replace("\n", "\\n")
+    value = value.replace("\r", "\\r")
+    value = value.replace("\t", "\\t")
+    value = value.replace("${", "\\${")
+    return value
+
+
+# ── Nostr npub validation (NIP-19 / Bech32) ───────────────────────────────────
+
+# Fast pre-filter: "npub1" followed by exactly 58 lower-case bech32 characters.
+NPUB_RE = re.compile(r"^npub1[023456789acdefghjklmnpqrstuvwxyz]{58}$")
+
+_BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+_BECH32_GENERATOR = (0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3)
+
+
+def _bech32_polymod(values: list[int]) -> int:
+    chk = 1
+    for value in values:
+        top = chk >> 25
+        chk = ((chk & 0x1FFFFFF) << 5) ^ value
+        for i in range(5):
+            if (top >> i) & 1:
+                chk ^= _BECH32_GENERATOR[i]
+    return chk
+
+
+def _bech32_hrp_expand(hrp: str) -> list[int]:
+    return [ord(c) >> 5 for c in hrp] + [0] + [ord(c) & 31 for c in hrp]
+
+
+def _bech32_create_checksum(hrp: str, data: list[int]) -> list[int]:
+    values = _bech32_hrp_expand(hrp) + data
+    polymod = _bech32_polymod(values + [0, 0, 0, 0, 0, 0]) ^ 1
+    return [(polymod >> (5 * (5 - i))) & 31 for i in range(6)]
+
+
+def _bech32_convertbits_decode(data: list[int]) -> list[int] | None:
+    """Convert a 5-bit integer sequence to 8-bit bytes, stripping padding."""
+    acc = 0
+    bits = 0
+    ret: list[int] = []
+    for value in data:
+        acc = (acc << 5) | value
+        bits += 5
+        while bits >= 8:
+            bits -= 8
+            ret.append((acc >> bits) & 0xFF)
+    if bits >= 5 or ((acc << (8 - bits)) & 0xFF):
+        return None  # invalid padding
+    return ret
+
+
+def _bech32_decode(bech: str) -> tuple[str, bytes] | None:
+    """Decode a bech32 string.  Returns ``(hrp, payload_bytes)`` or ``None``.
+
+    Verifies:
+    - Lowercase-only (mixed case rejected per BIP-173).
+    - Only valid bech32 charset characters.
+    - Valid checksum.
+    - Exactly one separator (``1``).
+    - Minimum data part length (≥ 8 chars = 6 checksum + ≥ 2 data).
+    """
+    if bech != bech.lower():
+        return None  # mixed case
+    sep = bech.rfind("1")
+    if sep < 1 or sep + 7 > len(bech):
+        return None
+    hrp = bech[:sep]
+    data_part = bech[sep + 1:]
+    if any(c not in _BECH32_CHARSET for c in data_part):
+        return None
+    decoded = [_BECH32_CHARSET.index(c) for c in data_part]
+    if _bech32_polymod(_bech32_hrp_expand(hrp) + decoded) != 1:
+        return None  # bad checksum
+    converted = _bech32_convertbits_decode(decoded[:-6])
+    if converted is None:
+        return None
+    return hrp, bytes(converted)
+
+
+def _validate_npub(value: str) -> bool:
+    """Return ``True`` iff *value* is a valid NIP-19 Nostr npub.
+
+    Checks:
+    - Lowercase ``npub`` HRP.
+    - Valid bech32 charset (no uppercase, no invalid chars).
+    - Valid bech32 checksum.
+    - Exactly 32 decoded payload bytes (256-bit public key).
+    - Retains the original regex as a fast pre-filter.
+    """
+    if not NPUB_RE.fullmatch(value):
+        return False
+    result = _bech32_decode(value)
+    if result is None:
+        return False
+    hrp, payload = result
+    return hrp == "npub" and len(payload) == 32
+
+
+# ── DDNS URL validation ────────────────────────────────────────────────────────
+
+_DDNS_URL_MAX_LEN = 2048
+_DDNS_CONTROL_RE = re.compile(r"[\x00-\x1f\x7f]")
+
+# Allowlist: only the official Njal.la provider hostnames are accepted for
+# DDNS update URLs.  Any other host would allow SSRF against the Hub's
+# internal network.
+_DDNS_ALLOWED_HOSTNAMES: frozenset[str] = frozenset(["njal.la", "www.njal.la"])
+
+
+def _validate_ddns_url(url: str) -> str:
+    """Validate *url* as a safe DDNS update URL and return it normalised.
+
+    Rules:
+    - Must be a valid URL parseable by urllib.parse.
+    - Scheme must be ``https`` (case-insensitive).
+    - No userinfo (credentials must not be embedded in the URL).
+    - No fragment.
+    - No control characters.
+    - Must not exceed ``_DDNS_URL_MAX_LEN`` bytes.
+    - Hostname must be the exact Njal.la provider hostname (njal.la or www.njal.la).
+    - Port must be absent or the default HTTPS port 443.
+    - No percent-encoded null bytes.
+
+    Raises ``ValueError`` with a safe (non-secret) message on failure.
+    """
+    if not url:
+        raise ValueError("DDNS URL must not be empty")
+    if len(url) > _DDNS_URL_MAX_LEN:
+        raise ValueError("DDNS URL exceeds maximum length")
+    if _DDNS_CONTROL_RE.search(url):
+        raise ValueError("DDNS URL contains control characters")
+    try:
+        parsed = urllib.parse.urlparse(url)
+    except Exception:
+        raise ValueError("DDNS URL could not be parsed")
+    if parsed.scheme.lower() != "https":
+        raise ValueError("DDNS URL must use the https scheme")
+    if parsed.username or parsed.password:
+        raise ValueError("DDNS URL must not contain credentials")
+    if parsed.fragment:
+        raise ValueError("DDNS URL must not contain a fragment")
+    if parsed.port is not None and parsed.port != 443:
+        raise ValueError("DDNS URL must use the default HTTPS port")
+    hostname = parsed.hostname or ""
+    if not hostname:
+        raise ValueError("DDNS URL must contain a hostname")
+    # Reject raw IP addresses
+    try:
+        ipaddress.ip_address(hostname)
+        raise ValueError("DDNS URL hostname must not be a raw IP address")
+    except ValueError as exc:
+        if "raw IP" in str(exc):
+            raise
+    # Allowlist: only Njal.la
+    if hostname.lower() not in _DDNS_ALLOWED_HOSTNAMES:
+        raise ValueError(
+            f"DDNS URL hostname is not an allowed Njal.la host "
+            f"(got {hostname!r})"
+        )
+    if "%00" in url.lower():
+        raise ValueError("DDNS URL must not contain encoded null bytes")
+    # Reject any remaining $ expressions — after ${IP} substitution there
+    # must be none.  Callers that store ${IP} placeholder URLs must substitute
+    # before calling this function.
+    if "$" in url:
+        raise ValueError("DDNS URL must not contain $ expressions")
+    # Require the exact /update/ path used by Njal.la
+    if parsed.path != "/update/":
+        raise ValueError("DDNS URL path must be exactly /update/")
+    return url
+
+
+# ── SSH public-key validation ─────────────────────────────────────────────────
+
+_SSH_PUBKEY_ALGORITHMS = frozenset([
+    "ssh-ed25519",
+    "ecdsa-sha2-nistp256",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp521",
+    "sk-ssh-ed25519@openssh.com",
+])
+
+
+def _validate_ssh_pubkey(key: str) -> str:
+    """Validate *key* as a single OpenSSH public key and return it normalised.
+
+    Accepts only single-line keys with a supported algorithm, valid base64
+    payload, and an optional comment.  Rejects options, multiple lines,
+    control characters, and unsupported algorithms.
+
+    Raises ``ValueError`` with a safe message on failure.
+    """
+    key = key.strip()
+    if not key:
+        raise ValueError("SSH public key must not be empty")
+    if _DDNS_CONTROL_RE.search(key):
+        raise ValueError("SSH public key contains control characters")
+    if "\n" in key or "\r" in key:
+        raise ValueError("SSH public key must be a single line")
+    parts = key.split()
+    if len(parts) < 2:
+        raise ValueError("SSH public key is malformed")
+    algo, b64 = parts[0], parts[1]
+    if algo not in _SSH_PUBKEY_ALGORITHMS:
+        raise ValueError(f"Unsupported SSH key algorithm: {algo!r}")
+    try:
+        decoded = base64.b64decode(b64, validate=True)
+    except Exception:
+        raise ValueError("SSH public key payload is not valid base64")
+    if len(decoded) < 20:
+        raise ValueError("SSH public key payload is too short")
+    return key
+
+
+# ── Persistent Hub session store ─────────────────────────────────────────────
+
+def load_session_store(path: str) -> dict[str, float]:
+    """Load persisted Hub sessions from *path*.
+
+    Returns a mapping of session token → expiry timestamp (epoch seconds).
+    Expired entries are discarded.  A missing, unreadable or malformed file
+    yields an empty mapping — losing sessions is a UX inconvenience (the user
+    must log in again), never a fatal error.
+
+    Persistence exists so that authenticated sessions survive a restart of
+    the Hub service itself.  ``nixos-rebuild switch`` restarts
+    ``sovran-hub-web.service`` during activation (its unit definition changes
+    with every feature toggle), and without persistence the in-progress
+    rebuild/update status polling loses authentication and the UI hangs.
+    """
+    try:
+        with open(path, "r") as f:
+            data = json.load(f)
+    except (OSError, ValueError):
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    now = time.time()
+    sessions: dict[str, float] = {}
+    for token, expiry in data.items():
+        if not isinstance(token, str) or not token:
+            continue
+        if isinstance(expiry, bool) or not isinstance(expiry, (int, float)):
+            continue
+        if expiry > now:
+            sessions[token] = float(expiry)
+    return sessions
+
+
+def save_session_store(path: str, sessions: dict[str, float]) -> bool:
+    """Atomically persist *sessions* (token → expiry) to *path* with mode 0600.
+
+    Writes to a temp file in the same directory and renames it into place so
+    the store is never left partially written.  Returns True on success,
+    False otherwise (persistence is best-effort).
+    """
+    directory = os.path.dirname(path) or "."
+    fd = None
+    tmp_path = None
+    try:
+        os.makedirs(directory, exist_ok=True)
+        fd, tmp_path = tempfile.mkstemp(dir=directory, prefix=".hub_sessions_tmp")
+        with os.fdopen(fd, "w") as f:
+            fd = None  # os.fdopen takes ownership of the descriptor
+            json.dump(sessions, f)
+        os.chmod(tmp_path, 0o600)
+        os.replace(tmp_path, path)
+        return True
+    except OSError:
+        if fd is not None:
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+        if tmp_path is not None:
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+        return False
@@ -171,3 +171,67 @@ domain-field-actions {
 .port-req-status {
  font-weight: 600;
 }
+
+/* ── Port-forwarding instructions ─────────────────────────────────── */
+
+.port-req-steps {
+  margin: 4px 0 12px;
+  padding-left: 20px;
+  font-size: 0.84rem;
+  color: var(--text-secondary);
+  line-height: 1.65;
+}
+
+.port-req-steps li {
+  margin-bottom: 5px;
+}
+
+.port-proto-badge {
+  display: inline-block;
+  font-family: 'JetBrains Mono', 'Fira Code', 'Source Code Pro', monospace;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  padding: 2px 7px;
+  border-radius: 5px;
+  white-space: nowrap;
+}
+
+.port-proto-badge--tcp {
+  color: #6dbf8b;
+  background: rgba(109, 191, 139, 0.12);
+  border: 1px solid rgba(109, 191, 139, 0.4);
+}
+
+.port-proto-badge--udp {
+  color: #6aa9e0;
+  background: rgba(106, 169, 224, 0.12);
+  border: 1px solid rgba(106, 169, 224, 0.4);
+}
+
+.port-proto-badge--both {
+  color: #e5a50a;
+  background: rgba(229, 165, 10, 0.12);
+  border: 1px solid rgba(229, 165, 10, 0.45);
+}
+
+.port-proto-note {
+  display: block;
+  margin-top: 3px;
+  font-size: 0.68rem;
+  color: var(--text-dim);
+  text-transform: none;
+  letter-spacing: 0;
+}
+
+/* ── Wallet Connections unique-hostname warning ───────────────────── */
+
+.domain-nwc-warning {
+  margin-bottom: 14px;
+  padding: 10px 14px;
+  background: rgba(255, 180, 0, 0.10);
+  border: 1px solid var(--warning-color, #f59e0b);
+  border-radius: 8px;
+  font-size: 0.88rem;
+  line-height: 1.6;
+}
@@ -29,6 +29,15 @@
  color: var(--text-primary);
 }

+.title-group {
+  display: flex;
+  flex-direction: row;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: center;
+  gap: 6px 10px;
+}
+
 .header-buttons {
  display: flex;
  align-items: center;
@@ -45,6 +54,23 @@
  letter-spacing: 0.03em;
 }

+/* ── OS Version Badge — identical styling to the version badge ────
+   ── shown next to titles in the service modal windows ──────────── */
+.os-version-badge {
+  background-color: rgba(255, 255, 255, 0.06);
+  color: var(--text-secondary);
+  font-size: 0.72rem;
+  font-weight: 600;
+  padding: 2px 10px;
+  border-radius: 12px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  letter-spacing: 0.02em;
+  display: inline-flex;
+  align-items: center;
+  white-space: nowrap;
+  flex-shrink: 0;
+}
+
 /* ── IP bar ─────────────────────────────────────────────────────── */

 .ip-bar {
@@ -1,5 +1,56 @@
+/* ── NWC Benefits Grid ─────────────────────────────────────────── */
+
+.nwc-benefits-grid {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 12px;
+  margin-top: 14px;
+}
+
+.nwc-benefit-item {
+  background: rgba(255, 255, 255, 0.02);
+  border: 1px solid var(--border-color);
+  border-radius: 10px;
+  padding: 10px 14px;
+  display: flex;
+  gap: 12px;
+  align-items: flex-start;
+  transition: background-color 0.2s;
+}
+
+.nwc-benefit-item:hover {
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.nwc-benefit-icon {
+  font-size: 1.25rem;
+  margin-top: 2px;
+  opacity: 0.9;
+}
+
+.nwc-benefit-content strong {
+  display: block;
+  font-size: 0.82rem;
+  color: var(--text-primary);
+  margin-bottom: 2px;
+}
+
+.nwc-benefit-content p {
+  margin: 0;
+  font-size: 0.75rem;
+  line-height: 1.45;
+  color: var(--text-secondary);
+}
+
+@media (max-width: 800px) {
+  .nwc-benefits-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
 /* ── Update modal ────────────────────────────────────────────────── */

+
 .modal-overlay {
  display: none;
  position: fixed;
@@ -200,6 +251,19 @@ button.btn-reboot:hover:not(:disabled) {
  gap: 10px;
 }

+.creds-title-version-badge {
+  background-color: rgba(255, 255, 255, 0.06);
+  color: var(--text-secondary);
+  font-size: 0.72rem;
+  font-weight: 600;
+  padding: 2px 10px;
+  border-radius: 12px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  letter-spacing: 0.02em;
+  display: inline-flex;
+  align-items: center;
+}
+
 .creds-title-icon {
  width: 28px;
  height: 28px;
@@ -223,6 +287,10 @@ button.btn-reboot:hover:not(:disabled) {
  color: var(--text-primary);
 }

+.creds-dialog--wide {
+  max-width: 980px;
+}
+
 .creds-body {
  padding: 24px 28px;
  overflow-y: auto;
@@ -478,3 +546,593 @@ button.btn-reboot:hover:not(:disabled) {
  color: var(--text-secondary);
  font-style: italic;
 }
+
+.nwc-secret-warning {
+  margin: 0 0 14px;
+  padding: 10px 12px;
+  border-radius: 8px;
+  border: 1px solid #f59e0b;
+  background: rgba(245, 158, 11, 0.12);
+  color: #fbbf24;
+  font-size: 0.86rem;
+}
+
+/* ── Lightning Wallet Connections: tabbed shell ─────────────────── */
+
+.nwc-tabs-bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: 12px;
+  margin: -6px 0 20px;
+  padding-bottom: 12px;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.nwc-tabs-btns {
+  display: flex;
+  gap: 4px;
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid var(--border-color);
+  border-radius: 10px;
+  padding: 4px;
+}
+
+.nwc-tab-btn {
+  background: none;
+  border: none;
+  color: var(--text-secondary);
+  font-size: 0.86rem;
+  font-weight: 600;
+  padding: 8px 16px;
+  border-radius: 7px;
+  cursor: pointer;
+  white-space: nowrap;
+  transition: background-color 0.15s ease, color 0.15s ease;
+}
+
+.nwc-tab-btn:hover:not(.active) {
+  color: var(--text-primary);
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.nwc-tab-btn.active {
+  background: var(--accent-color);
+  color: #0A1A10;
+}
+
+.nwc-header-chips {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+
+.nwc-header-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 0.75rem;
+  color: var(--text-secondary);
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid var(--border-color);
+  border-radius: 999px;
+  padding: 4px 10px;
+  max-width: 260px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.nwc-header-chip--domain {
+  font-family: 'JetBrains Mono', 'Fira Code', 'Source Code Pro', monospace;
+  font-size: 0.72rem;
+}
+
+.nwc-header-chip--warn {
+  border-color: rgba(245, 158, 11, 0.5);
+  color: #fbbf24;
+}
+
+.nwc-tab-panel {
+  display: none;
+}
+
+.nwc-tab-panel.active {
+  display: block;
+  animation: nwc-tab-fade 0.16s ease-out;
+}
+
+@keyframes nwc-tab-fade {
+  from { opacity: 0; transform: translateY(4px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+
+/* Setup tab: first section shouldn't double up on top padding */
+#nwc-tab-setup .svc-detail-section:first-child {
+  padding-top: 0;
+  margin-top: 0;
+  border-top: none;
+}
+
+.nwc-tab-intro {
+  display: flex;
+  flex-direction: column;
+  align-items: stretch;
+  gap: 16px;
+  margin-bottom: 20px;
+  padding-bottom: 20px;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.nwc-tab-intro-title {
+  font-size: 1rem;
+  font-weight: 700;
+  color: var(--text-primary);
+  margin-bottom: 4px;
+}
+
+.nwc-tab-intro-desc {
+  margin: 0;
+  font-size: 0.85rem;
+  line-height: 1.5;
+  color: var(--text-secondary);
+  max-width: 62ch;
+}
+
+/* ── Wallet toolbar ─────────────────────────────────────────────── */
+
+.nwc-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+  margin-bottom: 14px;
+}
+
+.nwc-toolbar-count {
+  font-size: 0.78rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-dim);
+}
+
+.nwc-toolbar-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.nwc-toolbar-actions .matrix-action-btn,
+.nwc-toolbar-actions .matrix-form-back {
+  padding: 8px 14px;
+  font-size: 0.82rem;
+}
+
+/* ── Domain-required callout ────────────────────────────────────── */
+
+.nwc-domain-required {
+  border: 1px solid rgba(245, 158, 11, 0.4);
+  background: rgba(245, 158, 11, 0.08);
+  border-radius: 10px;
+  padding: 14px 16px;
+  margin-bottom: 16px;
+  font-size: 0.86rem;
+  color: var(--text-primary);
+}
+
+.nwc-domain-required-body {
+  margin-top: 6px;
+  color: var(--text-secondary);
+  line-height: 1.5;
+}
+
+.nwc-domain-required-btn {
+  margin-top: 12px;
+}
+
+/* ── Empty / disabled states ────────────────────────────────────── */
+
+.nwc-empty-state,
+.nwc-disabled-state {
+  text-align: center;
+  padding: 36px 24px;
+  border: 1px dashed var(--border-color);
+  border-radius: 12px;
+  background: rgba(255, 255, 255, 0.015);
+}
+
+.nwc-empty-icon,
+.nwc-disabled-icon {
+  font-size: 2rem;
+  margin-bottom: 10px;
+}
+
+.nwc-empty-title,
+.nwc-disabled-title {
+  font-size: 1rem;
+  font-weight: 700;
+  color: var(--text-primary);
+  margin-bottom: 6px;
+}
+
+.nwc-empty-desc,
+.nwc-disabled-desc {
+  margin: 0 auto 14px;
+  max-width: 46ch;
+  font-size: 0.86rem;
+  line-height: 1.55;
+  color: var(--text-secondary);
+}
+
+/* ── Wallet cards ───────────────────────────────────────────────── */
+
+.nwc-wallet-list {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(340px, 1fr));
+  gap: 12px;
+  margin-top: 12px;
+}
+
+.nwc-wallet-card {
+  border: 1px solid var(--border-color);
+  border-radius: 12px;
+  padding: 14px 16px;
+  background: rgba(255, 255, 255, 0.02);
+  display: flex;
+  flex-direction: column;
+  transition: border-color 0.15s ease;
+}
+
+.nwc-wallet-card:hover {
+  border-color: rgba(255, 255, 255, 0.16);
+}
+
+.nwc-wallet-card-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 10px;
+  margin-bottom: 12px;
+}
+
+.nwc-wallet-card-title {
+  font-weight: 700;
+  font-size: 0.95rem;
+  color: var(--text-primary);
+  word-break: break-word;
+}
+
+.nwc-wallet-chips {
+  display: flex;
+  gap: 6px;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  flex-shrink: 0;
+}
+
+.nwc-wallet-chip {
+  display: inline-flex;
+  align-items: center;
+  font-size: 0.72rem;
+  font-weight: 700;
+  border-radius: 999px;
+  padding: 4px 10px;
+  white-space: nowrap;
+}
+
+.nwc-wallet-chip--balance {
+  background: rgba(109, 191, 139, 0.14);
+  color: var(--green);
+  font-family: 'JetBrains Mono', 'Fira Code', 'Source Code Pro', monospace;
+}
+
+.nwc-wallet-chip--pending {
+  background: rgba(245, 158, 11, 0.14);
+  color: #fbbf24;
+}
+
+.nwc-wallet-address {
+  margin-bottom: 4px;
+}
+
+.nwc-wallet-address .creds-value {
+  font-size: 0.82rem;
+  padding: 9px 12px;
+}
+
+.nwc-wallet-address .creds-copy-btn {
+  margin-top: 5px;
+  padding: 7px 12px;
+}
+
+.nwc-wallet-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+  margin-top: 12px;
+  padding-top: 12px;
+  border-top: 1px solid var(--border-color);
+}
+
+.nwc-wallet-actions-spacer {
+  flex: 1;
+  min-width: 0;
+}
+
+.nwc-wallet-actions .matrix-form-back,
+.nwc-wallet-actions .btn-close-modal,
+.nwc-wallet-actions .matrix-action-btn {
+  padding: 7px 12px;
+  font-size: 0.8rem;
+}
+
+.nwc-wallet-danger-btn {
+  color: #f08a8a;
+}
+
+.nwc-wallet-danger-btn:hover:not(:disabled) {
+  background-color: rgba(220, 80, 80, 0.14);
+  color: #ff9d9d;
+}
+
+/* ── NWC LNURL share / download view ───────────────────────────── */
+
+.nwc-share-actions {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+  margin-top: 14px;
+}
+
+.nwc-share-actions .matrix-form-back,
+.nwc-share-actions .matrix-form-submit {
+  padding: 8px 12px;
+  font-size: 0.82rem;
+}
+
+.nwc-lnurl-value {
+  font-size: 0.72rem;
+  word-break: break-all;
+}
+
+.nwc-share-formats-hint {
+  text-align: center;
+}
+
+/* ── NWC Liquidity Guide (collapsible) ──────────────────────────── */
+
+.nwc-liquidity-details {
+  margin-top: 20px;
+  border: 1px solid var(--border-color);
+  border-radius: 12px;
+  background: rgba(255, 255, 255, 0.015);
+}
+
+.nwc-liquidity-summary {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 14px 16px;
+  cursor: pointer;
+  list-style: none;
+  color: var(--text-primary);
+  font-size: 0.9rem;
+}
+
+.nwc-liquidity-summary::-webkit-details-marker {
+  display: none;
+}
+
+.nwc-liquidity-summary::after {
+  content: "▸";
+  margin-left: auto;
+  color: var(--text-dim);
+  transition: transform 0.15s ease;
+}
+
+.nwc-liquidity-details[open] .nwc-liquidity-summary::after {
+  transform: rotate(90deg);
+}
+
+.nwc-liquidity-summary:hover {
+  background: rgba(255, 255, 255, 0.02);
+  border-radius: 12px;
+}
+
+.nwc-liquidity-icon {
+  font-size: 22px;
+}
+
+.nwc-liquidity-subtitle {
+  display: block;
+  margin-top: 2px;
+  font-size: 0.75rem;
+  font-weight: 400;
+  color: var(--text-secondary);
+}
+
+.nwc-liquidity-guide-card {
+  padding: 0 16px 16px;
+  color: var(--text-primary);
+}
+
+.nwc-liquidity-body {
+  font-size: 0.82rem;
+  line-height: 1.55;
+  margin: 0 0 12px;
+  color: var(--text-secondary);
+}
+
+.nwc-liquidity-steps {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  margin-bottom: 14px;
+}
+
+.nwc-liquidity-step {
+  display: flex;
+  gap: 10px;
+  align-items: flex-start;
+  font-size: 0.85rem;
+}
+
+.nwc-liquidity-step-desc {
+  margin: 2px 0 0;
+  color: var(--text-secondary);
+  font-size: 0.78rem;
+  line-height: 1.5;
+}
+
+.step-num {
+  background: var(--accent-color);
+  color: #0A1A10;
+  width: 20px;
+  height: 20px;
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 0.75rem;
+  flex-shrink: 0;
+  margin-top: 1px;
+}
+
+.nwc-liquidity-action {
+  background: rgba(109, 191, 139, 0.08);
+  border-left: 3px solid var(--green);
+  padding: 10px 12px;
+  border-radius: 0 8px 8px 0;
+  font-size: 0.82rem;
+}
+
+.nwc-liquidity-analogy {
+  margin: 0 0 10px;
+  font-size: 0.8rem;
+  line-height: 1.45;
+}
+
+.nwc-rtl-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  background: var(--border-color);
+  color: var(--text-primary);
+  border: none;
+  padding: 8px 14px;
+  border-radius: 8px;
+  font-size: 0.8rem;
+  cursor: pointer;
+}
+
+.nwc-rtl-btn:hover {
+  background: #1c2a24;
+}
+
+/* ── NWC Connect Guide (shown after wallet creation) ────────────── */
+
+.nwc-connect-guide {
+  margin-top: 16px;
+  padding: 16px;
+  border: 1px solid var(--border-color);
+  border-radius: 12px;
+  background: rgba(109, 191, 139, 0.04);
+}
+
+.nwc-connect-guide-title {
+  font-size: 1rem;
+  font-weight: 700;
+  color: var(--text-primary);
+  margin-bottom: 8px;
+}
+
+.nwc-connect-guide-intro {
+  margin: 0 0 14px;
+  font-size: 0.85rem;
+  line-height: 1.55;
+  color: var(--text-secondary);
+}
+
+.nwc-connect-steps {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  margin-bottom: 14px;
+}
+
+.nwc-connect-step {
+  display: flex;
+  gap: 10px;
+  align-items: flex-start;
+  font-size: 0.86rem;
+  line-height: 1.5;
+}
+
+.nwc-step-num {
+  background: var(--accent-color);
+  color: #0A1A10;
+  width: 22px;
+  height: 22px;
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 0.78rem;
+  flex-shrink: 0;
+  margin-top: 2px;
+}
+
+.nwc-connect-note {
+  background: rgba(245, 158, 11, 0.08);
+  border-left: 3px solid #f59e0b;
+  padding: 10px 12px;
+  border-radius: 0 8px 8px 0;
+  font-size: 0.8rem;
+  line-height: 1.5;
+  color: var(--text-secondary);
+}
+
+.nwc-connect-note strong {
+  color: #fbbf24;
+}
+
+/* ── Narrow screens ─────────────────────────────────────────────── */
+
+@media (max-width: 720px) {
+  .nwc-tabs-bar {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .nwc-tabs-btns {
+    justify-content: stretch;
+  }
+
+  .nwc-tab-btn {
+    flex: 1;
+    padding: 8px 10px;
+  }
+
+  .nwc-wallet-list {
+    grid-template-columns: 1fr;
+  }
+
+  .nwc-wallet-card-head {
+    flex-direction: column;
+  }
+
+  .nwc-wallet-chips {
+    justify-content: flex-start;
+  }
+
+  .nwc-wallet-actions-spacer {
+    display: none;
+  }
+}
@@ -1,5 +1,28 @@
 /* ── Service tile card (status-only) ─────────────────────────────── */

+.dashboard-loading {
+  min-height: 180px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  color: var(--text-secondary);
+  font-size: 0.9rem;
+}
+
+.dashboard-loading-spinner {
+  width: 16px;
+  height: 16px;
+  border: 2px solid var(--border-color);
+  border-top-color: var(--accent-color);
+  border-radius: 50%;
+  animation: dashboard-loading-spin 0.8s linear infinite;
+}
+
+@keyframes dashboard-loading-spin {
+  to { transform: rotate(360deg); }
+}
+
 .service-tile {
  width: 160px;
  min-height: 130px;
@@ -155,68 +178,6 @@
  white-space: nowrap;
 }

-/* ── BIP-110 status badge (tile + detail modal) ───────────────────── */
-
-.tile-bip110-badge {
-  display: inline-flex;
-  align-items: center;
-  gap: 3px;
-  font-size: 0.64rem;
-  font-weight: 600;
-  border-radius: 4px;
-  padding: 2px 6px;
-  margin-top: 4px;
-  white-space: nowrap;
-  letter-spacing: 0.02em;
-}
-
-.tile-bip110-badge--active {
-  background: rgba(109, 191, 139, 0.18);
-  color: var(--green);
-  border: 1px solid rgba(109, 191, 139, 0.3);
-}
-
-.tile-bip110-badge--locked_in {
-  background: rgba(94, 173, 138, 0.15);
-  color: var(--accent-color);
-  border: 1px solid rgba(94, 173, 138, 0.3);
-}
-
-.tile-bip110-badge--signaling {
-  background: rgba(94, 173, 138, 0.12);
-  color: var(--accent-color);
-  border: 1px solid rgba(94, 173, 138, 0.2);
-}
-
-.tile-bip110-badge--not_signaling {
-  background: rgba(229, 165, 10, 0.12);
-  color: var(--yellow);
-  border: 1px solid rgba(229, 165, 10, 0.25);
-}
-
-.tile-bip110-badge--unsupported {
-  background: rgba(94, 122, 106, 0.12);
-  color: var(--grey);
-  border: 1px solid rgba(94, 122, 106, 0.2);
-}
-
-.tile-bip110-badge--unknown {
-  background: transparent;
-  color: var(--text-dim);
-  border: 1px solid var(--border-color);
-}
-
-.bip110-status-row {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  flex-wrap: wrap;
-}
-
-.bip110-source-label {
-  color: var(--text-dim);
-  font-size: 0.75rem;
-}

 /* ── Service detail modal sections ───────────────────────────────── */

@@ -404,6 +365,45 @@
  color: var(--text-dim);
 }

+.svc-detail-option-card {
+  padding: 16px;
+  background: rgba(94, 173, 138, 0.06);
+  border: 1px solid rgba(94, 173, 138, 0.24);
+  border-radius: 10px;
+}
+
+.svc-detail-option-list {
+  margin: 10px 0 0;
+  padding-left: 20px;
+  color: var(--text-secondary);
+  font-size: 0.84rem;
+  line-height: 1.55;
+}
+
+.svc-detail-option-list li {
+  margin-bottom: 5px;
+}
+
+.svc-detail-option-privacy {
+  margin-top: 12px;
+  padding: 10px 12px;
+  border-left: 3px solid var(--accent-color);
+  background: rgba(94, 173, 138, 0.08);
+  border-radius: 6px;
+  color: var(--text-secondary);
+  font-size: 0.82rem;
+  line-height: 1.5;
+}
+
+.svc-detail-option-privacy strong {
+  color: var(--accent-color);
+}
+
+.svc-detail-related-feature-btn:disabled {
+  cursor: not-allowed;
+  opacity: 0.55;
+}
+
 .feature-conflict-warning {
  margin-top: 8px;
  margin-bottom: 8px;
@@ -4,7 +4,17 @@

 const POLL_INTERVAL_SERVICES    = 5000;
 const POLL_INTERVAL_UPDATES     = 1800000;
-const UPDATE_POLL_INTERVAL      = 2000;
+const UPDATE_POLL_INTERVAL          = 2000;
+// A pending fetch never rejects by itself. Bound every status request so a
+// wedged browser connection cannot leave the modal spinning forever.
+const STATUS_POLL_FETCH_TIMEOUT      = 15000;
+// Eight timed-out requests plus the poll interval is a little over two minutes.
+// A brief Hub restart or a heavily loaded Nix build remains well inside this.
+const STATUS_POLL_MAX_FAILURES       = 8;
+// Keep verbose Nix output from making textContent updates quadratic and
+// freezing the Hub renderer (especially noticeable over RDP).
+const UPDATE_VISIBLE_LOG_MAX_CHARS   = 250000;
+const UPDATE_VISIBLE_LOG_TRIM_CHARS  = 200000;
 const REBOOT_CHECK_INTERVAL     = 5000;
 const REBOOT_FETCH_TIMEOUT      = 12000;
 const REBOOT_REQUEST_TIMEOUT    = 4000;
@@ -0,0 +1,104 @@
+/* Sovran_SystemsOS Hub — Shared domain and router instructions.
+
+   This is the single source of truth for the simple setup guidance shown in:
+
+     • First-boot onboarding for Server + Desktop
+     • Feature setup in the Hub
+     • Domain reconfiguration and troubleshooting
+
+   Keep the wording consistent by editing it here. */
+"use strict";
+
+function dpEsc(str) {
+  return String(str)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+/* Explain only what the user needs for the step in front of them. */
+function renderDomainNeedsHtml(opts) {
+  opts = opts || {};
+  var serviceName = opts.serviceName || null;
+  var purpose = opts.purpose || "";
+  var html = "";
+
+  if (purpose === "btcpay") {
+    html += "<p><strong>Put your BTCPay Server online</strong></p>";
+    html += "<p>Let people donate Bitcoin, pay you, or visit your online store.</p>";
+    html += "<p>BTCPay Server needs a domain so people can reach it. "
+      + "Sovran_SystemsOS walks you through getting your domain from "
+      + '<a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">Njal.la</a>'
+      + " and connecting it. Just follow the steps below.</p>";
+  } else if (serviceName) {
+    html += "<p>To make <strong>" + dpEsc(serviceName) + "</strong> available outside your home, it needs a domain.</p>";
+    html += "<p>Sovran_SystemsOS walks you through getting your domain from "
+      + '<a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">Njal.la</a>'
+      + " and connecting it. Just follow the steps below.</p>";
+  } else {
+    html += "<p>Your domain is the address people use to reach your services on the internet.</p>";
+    html += "<p>Sovran_SystemsOS walks you through getting your domain from "
+      + '<a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">Njal.la</a>'
+      + " and connecting your services. Just follow the steps below.</p>";
+  }
+  return html;
+}
+
+/* The shortest Njal.la steps that still tell the user exactly what to do. */
+function renderNjallaStepsHtml(opts) {
+  var hostExample = dpEsc((opts && opts.hostExample) || "call");
+  var pasteHint = (opts && opts.pasteHint) || "below";
+  var html = "";
+
+  html += '<p style="margin-top:12px;"><strong>Get and connect your domain:</strong></p>';
+  html += '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">';
+  html += '<li>Open <a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">Njal.la</a>, create an account, and get a domain.</li>';
+  html += "<li>Open your domain and add a <strong>Dynamic</strong> record for this service. "
+    + "In the <strong>Name</strong> box, enter only the first part of the address. "
+    + "For <code>" + hostExample + ".yourdomain.com</code>, enter <code>" + hostExample + "</code>. "
+    + "If you are using the whole domain, leave the box blank or enter <code>@</code>.</li>";
+  html += "<li>Copy the update command Njal.la gives you and paste it " + pasteHint + ".</li>";
+  html += "</ol>";
+  return html;
+}
+
+/* One router task shared by all normal domain-based services. */
+function renderRouterPortsHtml(opts) {
+  opts = opts || {};
+  var ipPart = opts.internalIp
+    ? " to this computer at <strong>" + dpEsc(opts.internalIp) + "</strong>"
+    : " to this computer";
+
+  var html = "";
+  html += "🔌 <strong>One router task:</strong> in your router&rsquo;s <strong>Port Forwarding</strong> settings, "
+    + "forward <strong>80 (TCP)</strong> and <strong>443 (TCP)</strong>"
+    + ipPart + ". If your router asks for outside and inside port numbers, use the same number for both. "
+    + "You only need to do this once. All your services share these two ports.";
+  if (opts.extraNote) {
+    html += " " + dpEsc(opts.extraNote);
+  }
+  return html;
+}
+
+/* Show generic wording immediately, then add the computer's address when found. */
+function renderRouterPortsBox(elId, opts) {
+  var el = document.getElementById(elId);
+  if (!el) return;
+  el.innerHTML = renderRouterPortsHtml(opts || {});
+  fetch("/api/network")
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      var target = document.getElementById(elId);
+      if (!target) return;
+      var ip = data && data.internal_ip;
+      if (ip && ip !== "unavailable") {
+        var next = {};
+        for (var k in (opts || {})) next[k] = opts[k];
+        next.internalIp = String(ip).trim();
+        target.innerHTML = renderRouterPortsHtml(next);
+      }
+    })
+    .catch(function() { /* Generic wording is already shown. */ });
+}
@@ -6,6 +6,16 @@
 if ($btnCloseModal) $btnCloseModal.addEventListener("click", closeUpdateModal);
 if ($btnReboot) $btnReboot.addEventListener("click", doReboot);
 if ($btnSave) $btnSave.addEventListener("click", saveErrorReport);
+if ($btnRetryUpdate) $btnRetryUpdate.addEventListener("click", retryUpdateStatus);
+
+// Browser timers and requests may be suspended while an RDP session/tab is in
+// the background. Reconcile immediately when the user returns instead of
+// waiting for the next interval.
+window.addEventListener("focus", resumeUpdateStatusAfterInterruption);
+window.addEventListener("online", resumeUpdateStatusAfterInterruption);
+document.addEventListener("visibilitychange", function() {
+  if (document.visibilityState === "visible") resumeUpdateStatusAfterInterruption();
+});
 if ($credsCloseBtn) $credsCloseBtn.addEventListener("click", closeCredsModal);
 if ($supportCloseBtn) $supportCloseBtn.addEventListener("click", closeSupportModal);

@@ -187,30 +197,39 @@ function showSecurityBanner() {
 // ── Init ──────────────────────────────────────────────────────────

 async function init() {
-  // Check onboarding status first — redirect to wizard if not complete
+  // These lightweight requests are independent.  Running them together avoids
+  // making the dashboard wait through three serial network round-trips before
+  // it can even start loading the service tiles.
+  var onboardingStatus = null;
+  var bannerData = null;
+  var cfg;
  try {
-    var onboardingStatus = await apiFetch("/api/onboarding/status");
-    if (!onboardingStatus.complete) {
-      window.location.href = "/onboarding";
-      return;
-    }
+    var startupResults = await Promise.all([
+      apiFetch("/api/onboarding/status").catch(function() { return null; }),
+      apiFetch("/api/security/banner-status").catch(function() { return null; }),
+      apiFetch("/api/config"),
+    ]);
+    onboardingStatus = startupResults[0];
+    bannerData = startupResults[1];
+    cfg = startupResults[2];
  } catch (_) {
-    // If we can't reach the endpoint, continue to normal dashboard
+    // If config cannot be loaded, continue with the normal service fallback.
+    cfg = null;
+  }
+
+  if (onboardingStatus && !onboardingStatus.complete) {
+    window.location.href = "/onboarding";
+    return;
  }

  // Show first-login security banner only for machines that went through onboarding
  // (legacy machines without the onboarding flag will never see this)
-  try {
-    var bannerData = await apiFetch("/api/security/banner-status");
-    if (bannerData && bannerData.show) {
-      showSecurityBanner();
-    }
-  } catch (_) {
-    // Non-fatal — silently ignore
+  if (bannerData && bannerData.show) {
+    showSecurityBanner();
  }

  try {
-    var cfg = await apiFetch("/api/config");
+    if (!cfg) throw new Error("Hub config unavailable");
    _currentRole = cfg.role || "server_plus_desktop";
    if (cfg.category_order) {
      for (var i = 0; i < cfg.category_order.length; i++) {
@@ -239,6 +258,11 @@ async function init() {
    setInterval(checkUpdates, POLL_INTERVAL_UPDATES);
    loadAutolaunchToggle();
  }
+
+  // If the page was reloaded or the RDP/browser session resumed during an
+  // update, reopen the modal from the persisted backend state. This also
+  // surfaces a completed update that is waiting for its activation reboot.
+  await restoreUpdateModalIfNeeded();
 }

 document.addEventListener("DOMContentLoaded", init);
@@ -59,6 +59,9 @@ function openDomainSetupModal(feat, onSaved) {
  if (!$domainSetupModal) return;
  if ($domainSetupTitle) $domainSetupTitle.textContent = "🌐 Domain Setup — " + feat.name;

+  var isWalletConnections = (feat.id === "nwc-wallets" || feat.domain_name === "lightning");
+  var isBtcpay = feat.id === "btcpay-web";
+
  var npubField = "";
  if (feat.id === "haven") {
    var currentNpub = "";
@@ -73,48 +76,32 @@ function openDomainSetupModal(feat, onSaved) {
    npubField = '<div class="domain-field-group"><label class="domain-field-label" for="domain-npub-input">Nostr Public Key (npub1...):</label><input class="domain-field-input" type="text" id="domain-npub-input" placeholder="npub1..." value="' + escHtml(currentNpub) + '" /></div>';
  }

-  var introHtml;
-  if (_currentRole === "node") {
-    introHtml =
-      '<p>To enable <strong>' + escHtml(feat.name) + '</strong>, it needs its own domain from Njal.la.</p>' +
-      '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
-      '<li>Create an account at <a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">njal.la</a>.</li>' +
-      '<li>Set up a domain for it — either a free subdomain or a separate domain. Pick one option:</li>' +
-      '</ol>';
-  } else {
-    introHtml =
-      '<p>To enable <strong>' + escHtml(feat.name) + '</strong>, it needs its own domain from Njal.la. ' +
-      'In your Njal.la account, set up a domain for it — either a free subdomain or a separate domain. Pick one option:</p>';
-  }
+  var nwcWarning = isWalletConnections
+    ? '<div class="domain-nwc-warning">' +
+      '<strong>Lightning Wallet Connections needs its own address.</strong> ' +
+      'Use a new address such as <code>lightning.yourdomain.com</code>. Do not use an address already connected to another service.' +
+      '</div>'
+    : '';
+
+  var domainPlaceholder = isWalletConnections ? "lightning.yourdomain.com" : (isBtcpay ? "btcpay.yourdomain.com" : "myservice.example.com");
+  var domainLabelExample = isWalletConnections ? "lightning.yourdomain.com" : (isBtcpay ? "btcpay.yourdomain.com" : "call.yourdomain.com");
+
+  // Shared instructions (single source of truth: static/js/domain-prereqs.js) —
+  // identical wording to the Server + Desktop onboarding wizard and every other
+  // domain-based feature, regardless of role (Node / Desktop / Server+Desktop).
+  var hostExample = isWalletConnections ? "lightning" : (isBtcpay ? "btcpay" : "call");
+  var purpose = isBtcpay ? "btcpay" : "";

  $domainSetupBody.innerHTML =
    '<div class="domain-setup-intro">' +
-    introHtml +
-    '<details style="margin-top:10px;">' +
-    '<summary style="cursor:pointer;font-weight:600;">Option A — Free subdomain (recommended)</summary>' +
-    '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
-    '<li>In Njal.la, open a domain you own and click &quot;Add record&quot;.</li>' +
-    '<li>Set record type to <strong>Dynamic</strong>.</li>' +
-    '<li>In the <strong>Name</strong> field, type ONLY the host part — the word before your domain.<br>' +
-    '(Example only, your choice — for &quot;call.yourdomain.com&quot; you&apos;d type just: &nbsp;<code>call</code>)<br>' +
-    '&#9888; Do NOT type the full domain here — Njal.la adds it automatically.</li>' +
-    '<li>A Dynamic record has NO IP field — the IP auto-fills after the rebuild/reboot.</li>' +
-    '<li>Copy the curl command Njal.la gives you, e.g.:<br>' +
-    '<code style="font-size:0.8em;">curl &quot;https://njal.la/update/?h=call.yourdomain.com&amp;k=abc123&amp;auto&quot;</code></li>' +
-    '</ol>' +
-    '</details>' +
-    '<details style="margin-top:6px;">' +
-    '<summary style="cursor:pointer;font-weight:600;">Option B — Separate / new domain</summary>' +
-    '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
-    '<li>In Njal.la, buy the domain you want.</li>' +
-    '<li>Add a Dynamic record as in Option A. If this domain is dedicated to the service, leave the Name field blank or use <code>@</code>.</li>' +
-    '<li>Copy the curl command Njal.la gives you.</li>' +
-    '</ol>' +
-    '</details>' +
-    '<p style="margin-top:10px;">Below, enter the full domain for this service — a subdomain (e.g. call.yourdomain.com) or a separate domain (e.g. call.com) — and paste its curl command.</p>' +
+    nwcWarning +
+    renderDomainNeedsHtml({ serviceName: feat.name, hostExample: hostExample, purpose: purpose }) +
+    renderNjallaStepsHtml({ hostExample: hostExample, pasteHint: "below" }) +
+    '<div class="onboarding-port-warn" id="domain-router-box" style="margin-top:12px;"></div>' +
+    '<p style="margin-top:10px;">Enter the address for this service and paste the update command from Njal.la.</p>' +
    '</div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service domain (e.g. call.yourdomain.com):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="myservice.example.com" /></div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=myservice.example.com&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service address (e.g. ' + domainLabelExample + '):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="' + domainPlaceholder + '" /></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=' + domainPlaceholder + '&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">Paste the update command from Njal.la</p></div>' +
    npubField +
    '<div class="domain-field-actions"><button class="btn btn-close-modal" id="domain-setup-cancel-btn">Cancel</button><button class="btn btn-primary" id="domain-setup-save-btn">Save &amp; Enable</button></div>';

@@ -150,17 +137,23 @@ function openDomainSetupModal(feat, onSaved) {
    } catch (err) {
      saveBtn.disabled = false;
      saveBtn.textContent = "Save & Enable";
-      alert("Failed to save domain. Please try again.");
+      var msg = (err && err.message) ? err.message : "Failed to save domain. Please try again.";
+      alert(msg);
    }
  });

  $domainSetupModal.classList.add("open");
+
+  // Fill the router port-forwarding box with this computer's LAN IP (best-effort)
+  renderRouterPortsBox("domain-router-box");
 }

 function openDomainReconfigureModal(feat, existingDomain, onSaved) {
  if (!$domainSetupModal) return;
  if ($domainSetupTitle) $domainSetupTitle.textContent = "🔄 Reconfigure Domain — " + feat.name;

+  var isWalletConnections = (feat.id === "nwc-wallets" || feat.domain_name === "lightning");
+
  var npubField = "";
  if (feat.id === "haven") {
    var currentNpub = "";
@@ -175,11 +168,22 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
    npubField = '<div class="domain-field-group"><label class="domain-field-label" for="domain-npub-input">Nostr Public Key (npub1...):</label><input class="domain-field-input" type="text" id="domain-npub-input" placeholder="npub1..." value="' + escHtml(currentNpub) + '" /></div>';
  }

+  var nwcWarning = isWalletConnections
+    ? '<div class="domain-nwc-warning">' +
+      '<strong>Lightning Wallet Connections needs its own address.</strong> ' +
+      'Use a new address such as <code>lightning.yourdomain.com</code>. Do not use an address already connected to another service.' +
+      '</div>'
+    : '';
+
+  var domainPlaceholder = isWalletConnections ? "lightning.yourdomain.com" : "myservice.example.com";
+  var domainLabelExample = isWalletConnections ? "lightning.yourdomain.com" : "call.yourdomain.com";
+
  var externalIp = _cachedExternalIp || "your external IP";
  var currentDomain = existingDomain || "";

  $domainSetupBody.innerHTML =
    '<div class="domain-setup-intro">' +
+    nwcWarning +
    '<p>Your domain <strong>' + escHtml(currentDomain || "this domain") + '</strong> is configured but isn\'t resolving correctly.</p>' +
    '<p><strong>Troubleshooting steps:</strong></p>' +
    '<ol>' +
@@ -189,10 +193,12 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
    '<span style="display:inline-block;margin-top:4px;padding:4px 10px;background:var(--card-color);border:1px solid var(--border-color);border-radius:6px;font-family:monospace;font-size:1em;font-weight:700;">' + escHtml(externalIp) + '</span></li>' +
    '<li>If the IP is wrong or the record is missing, update it</li>' +
    '<li>If you changed the DDNS curl command, paste the updated one below</li>' +
+    '<li>Confirm ports <strong>80</strong> and <strong>443</strong> (TCP) are still forwarded on your router to this computer — see the reminder below:</li>' +
    '</ol>' +
+    '<div class="onboarding-port-warn" id="domain-router-box" style="margin-top:12px;"></div>' +
    '</div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service domain (e.g. call.yourdomain.com):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="myservice.example.com" value="' + escHtml(currentDomain) + '" /></div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=myservice.example.com&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service domain (e.g. ' + domainLabelExample + '):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="' + domainPlaceholder + '" value="' + escHtml(currentDomain) + '" /></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=' + domainPlaceholder + '&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
    npubField +
    '<div class="domain-field-actions"><button class="btn btn-close-modal" id="domain-setup-cancel-btn">Cancel</button><button class="btn btn-primary" id="domain-setup-save-btn">Save &amp; Update</button></div>';

@@ -228,11 +234,15 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
    } catch (err) {
      saveBtn.disabled = false;
      saveBtn.textContent = "Save & Update";
-      alert("Failed to save domain. Please try again.");
+      var msg = (err && err.message) ? err.message : "Failed to save domain. Please try again.";
+      alert(msg);
    }
  });

  $domainSetupModal.classList.add("open");
+
+  // Fill the router port-forwarding box with this computer's LAN IP (best-effort)
+  renderRouterPortsBox("domain-router-box");
 }

 function closeDomainSetupModal() {
@@ -249,28 +259,12 @@ function openPortRequirementsModal(featureName, ports, onContinue) {
    : '';

  function renderPortRequirements(internalIp) {
-    var rows = ports.map(function(p) {
-      return '<tr><td class="port-req-port">' + escHtml(p.port) + '</td>' +
-        '<td class="port-req-proto">' + escHtml(p.protocol) + '</td>' +
-        '<td class="port-req-desc">' + escHtml(p.description) + '</td></tr>';
-    }).join("");
-    var ipLine = internalIp
-      ? '<p class="port-req-intro">Forward each port below <strong>to this machine\'s internal IP: <code class="port-req-internal-ip">' + escHtml(internalIp) + '</code></strong></p>'
-      : "<p class=\"port-req-intro\">Forward each port below to this machine's internal LAN IP in your router's port forwarding settings.</p>";
-
    $portReqBody.innerHTML =
-      '<p class="port-req-intro"><strong>Port Forwarding Required</strong></p>' +
-      '<p class="port-req-intro">For <strong>' + escHtml(featureName) + "</strong> to work with clients outside your local network, " +
-      "you must configure <strong>port forwarding</strong> in your router's admin panel.</p>" +
-      ipLine +
-      '<table class="port-req-table">' +
-      '<thead><tr><th>Port(s)</th><th>Protocol</th><th>Purpose</th></tr></thead>' +
-      '<tbody>' + rows + '</tbody>' +
-      '</table>' +
-      "<p class=\"port-req-hint\"><strong>How to verify:</strong> Router-side forwarding cannot be checked from inside your network. " +
-      "To confirm ports are forwarded correctly, test from a device on a different network (e.g. a phone on mobile data) " +
-      "or check your router's port forwarding page.</p>" +
-      '<p class="port-req-hint">ℹ Search "<em>how to set up port forwarding on [your router model]</em>" for step-by-step instructions.</p>' +
+      renderPortForwardGuideHtml(ports, {
+        internalIp: internalIp,
+        serviceName: featureName,
+      }) +
+      '<p class="port-req-hint">💡 This list is always available again on the <strong>' + escHtml(featureName) + '</strong> tile.</p>' +
      '<div class="domain-field-actions">' +
      '<button class="btn btn-close-modal" id="port-req-dismiss-btn">Dismiss</button>' +
      continueBtn +
@@ -348,8 +342,11 @@ async function performFeatureToggle(featId, enabled, extra) {
 function handleFeatureToggle(feat, newEnabled) {
  if (!newEnabled) {
    // Disable: ask confirmation
+    var disableMessage = (feat.id === "bitcoin-tor-gossip")
+      ? "This will stop advertising your Bitcoin Core onion address to other peers. Nodes that already know the address can still connect through Tor, and no clearnet port will be opened. The system will rebuild. Continue?"
+      : "This will disable " + feat.name + ". The system will rebuild. Continue?";
    openFeatureConfirm(
-      "This will disable " + feat.name + ". The system will rebuild. Continue?",
+      disableMessage,
      function() { performFeatureToggle(feat.id, false, {}); }
    );
    return;
@@ -403,44 +400,15 @@ function handleFeatureToggle(feat, newEnabled) {
      return;
    }

-    // Check which ports are actually closed before showing the modal
-    fetch("/api/ports/status", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ports: ports }),
-    })
-      .then(function(r) {
-        if (!r.ok) throw new Error("Port status request failed: " + r.status);
-        return r.json();
-      })
-      .then(function(data) {
-        var portStatuses = {};
-        (data.ports || []).forEach(function(p) {
-          portStatuses[p.port + "/" + p.protocol] = p.status;
-        });
-
-        var closedPorts = ports.filter(function(p) {
-          var key = p.port + "/" + p.protocol;
-          var status = portStatuses[key] || "unknown";
-          return status !== "listening" && status !== "firewall_open";
-        });
-
-        if (closedPorts.length === 0) {
-          proceedAfterPortCheck();
-        } else {
-          openPortRequirementsModal(feat.name, closedPorts, proceedAfterPortCheck);
-        }
-      })
-      .catch(function(err) {
-        console.warn("Failed to fetch port status for feature enable flow:", err);
-        // Safe fallback if status check fails
-        openPortRequirementsModal(feat.name, ports, proceedAfterPortCheck);
-      });
+    // Always show the full list of ports to forward. Port forwarding happens on
+    // the router, which this computer cannot inspect — a local check would only
+    // hide ports the user still has to open.
+    openPortRequirementsModal(feat.name, ports, proceedAfterPortCheck);
  }

-  if (feat.id === "bitcoin-core") {
-    var confirmMsg = "Only one Bitcoin node implementation can be active. Enabling Bitcoin Core will replace Bitcoin Knots + BIP110 as the active node. Your timechain data will be preserved — you will not need to re-download the timechain. Continue?";
-    openFeatureConfirm(confirmMsg, proceedAfterConflictCheck);
+  if (feat.id === "bitcoin-tor-gossip") {
+    var torGossipConfirmMsg = "This will advertise your Bitcoin Core .onion P2P address through Bitcoin peer gossip. More Tor-capable nodes may discover your node and request historical blocks during IBD, which can use significant upload bandwidth. Your home IP remains hidden and no clearnet port or router forwarding is opened. Continue?";
+    openFeatureConfirm(torGossipConfirmMsg, proceedAfterConflictCheck);
  } else if (conflictNames.length > 0) {
    openFeatureConfirm("This will disable " + conflictNames.join(", ") + ". Continue?", proceedAfterConflictCheck);
  } else {
@@ -40,6 +40,66 @@ function linkify(str) {
  return escHtml(str).replace(/(https?:\/\/[^\s<]+)/g, '<a href="$1" target="_blank" rel="noopener noreferrer" class="creds-link">$1</a>');
 }

+// ── Router port-forwarding guide ──────────────────────────────────
+// Whether a port is truly reachable can only be judged from OUTSIDE the
+// network, so we never show a local "ready" verdict here. We only tell the
+// user exactly what to enter in their router.
+
+// Render the protocol cell so TCP / UDP / both is unmistakable.
+function portProtocolHtml(protocol) {
+  var p = String(protocol || "TCP").toUpperCase();
+  var isTcp = p.indexOf("TCP") !== -1;
+  var isUdp = p.indexOf("UDP") !== -1;
+  if (isTcp && isUdp) {
+    return '<span class="port-proto-badge port-proto-badge--both">TCP + UDP</span>' +
+      '<span class="port-proto-note">both required</span>';
+  }
+  if (isUdp) return '<span class="port-proto-badge port-proto-badge--udp">UDP</span>';
+  return '<span class="port-proto-badge port-proto-badge--tcp">TCP</span>';
+}
+
+// ports: [{ port, protocol, description }]
+// opts:  { internalIp, serviceName, tableClass, introClass, noteClass }
+function renderPortForwardGuideHtml(ports, opts) {
+  opts = opts || {};
+  var tableClass = opts.tableClass || "port-req-table";
+  var introClass = opts.introClass || "port-req-intro";
+  var noteClass  = opts.noteClass  || "port-req-hint";
+  var ipHtml = opts.internalIp
+    ? '<code class="port-req-internal-ip">' + escHtml(opts.internalIp) + '</code>'
+    : 'this computer&rsquo;s <strong>internal IP</strong> (shown as &ldquo;Internal IP&rdquo; at the top of the Hub dashboard)';
+
+  var rows = (ports || []).map(function(p) {
+    return '<tr>' +
+      '<td class="port-req-port">' + escHtml(p.port) + '</td>' +
+      '<td class="port-req-proto">' + portProtocolHtml(p.protocol) + '</td>' +
+      '<td class="port-req-desc">' + escHtml(p.description || "") + '</td>' +
+      '</tr>';
+  }).join("");
+
+  var forWhat = opts.serviceName
+    ? 'For <strong>' + escHtml(opts.serviceName) + '</strong> to be reachable from outside your home network, open'
+    : 'Open';
+
+  return '<p class="' + introClass + '">' +
+      forWhat + ' the ports below in your router&rsquo;s <strong>port forwarding</strong> settings ' +
+      'and point them at ' + ipHtml + '.' +
+    '</p>' +
+    '<ul class="port-req-steps">' +
+      '<li>Set the <strong>internal (private) port</strong> and the <strong>external (public) port</strong> to the <strong>same number</strong>.</li>' +
+      '<li>Match the <strong>protocol</strong> exactly — a rule set to TCP will not pass UDP traffic. Where the table says <strong>TCP + UDP</strong>, create both rules (or pick &ldquo;Both&rdquo;/&ldquo;TCP/UDP&rdquo; if your router offers it).</li>' +
+      '<li>For a range such as <strong>40000-40099</strong>, use your router&rsquo;s port-range fields — start 40000, end 40099 — rather than one rule per port.</li>' +
+    '</ul>' +
+    '<table class="' + tableClass + '">' +
+      '<thead><tr><th>Port(s)</th><th>Protocol</th><th>Used for</th></tr></thead>' +
+      '<tbody>' + rows + '</tbody>' +
+    '</table>' +
+    '<p class="' + noteClass + '">' +
+      '📱 <strong>How to confirm it worked:</strong> forwarding happens on your router, so it can only be verified from outside your network. ' +
+      'Turn Wi-Fi off on your phone and open the service over mobile data — if it loads, your ports are open.' +
+    '</p>';
+}
+
 function formatDuration(seconds) {
  const h = Math.floor(seconds / 3600);
  const m = Math.floor((seconds % 3600) / 60);
@@ -51,26 +111,55 @@ function formatDuration(seconds) {

 // ── Fetch wrappers ────────────────────────────────────────────────

+// Avoid issuing multiple redirects when several startup requests discover an
+// expired session at the same time.
+let _authRedirectInProgress = false;
+
 async function apiFetch(path, options) {
  const res = await fetch(path, options || {});
+  if (res.status === 401) {
+    if (!_authRedirectInProgress) {
+      _authRedirectInProgress = true;
+      window.location.replace("/login");
+    }
+    throw new Error("Unauthenticated");
+  }
  if (!res.ok) {
    let detail = res.status + " " + res.statusText;
-    try { const body = await res.json(); if (body && body.detail) detail = body.detail; } catch (e) {}
+    try {
+      const body = await res.json();
+      if (body && body.detail) {
+        if (typeof body.detail === "string") {
+          detail = body.detail;
+        } else if (body.detail && typeof body.detail.message === "string") {
+          detail = body.detail.message;
+        }
+      } else if (body && typeof body.message === "string") {
+        detail = body.message;
+      } else if (body && typeof body.error === "string") {
+        detail = body.error;
+      }
+    } catch (e) {}
    throw new Error(detail);
  }
  return res.json();
 }

-
-// ── BIP-110 badge state config ────────────────────────────────────
-// Shared lookup used by tiles.js and service-detail.js.
-// Keys match the "state" values returned by /api/bitcoin/bip110.
-
-var BIP110_BADGE_CONFIG = {
-  active:        { cls: 'tile-bip110-badge--active',       label: 'Active',         title: 'BIP-110 is active on this node' },
-  locked_in:     { cls: 'tile-bip110-badge--locked_in',    label: 'Locked In',      title: 'BIP-110 is locked in and will activate shortly' },
-  signaling:     { cls: 'tile-bip110-badge--signaling',    label: 'Signaling',      title: 'Node is signaling readiness for BIP-110' },
-  not_signaling: { cls: 'tile-bip110-badge--not_signaling',label: 'Not Signaling',  title: 'Node supports BIP-110 but is not signaling this period' },
-  unsupported:   { cls: 'tile-bip110-badge--unsupported',  label: 'Not Supported',  title: 'This node build does not include BIP-110' },
-  unknown:       { cls: 'tile-bip110-badge--unknown',      label: '\u2014',          title: 'Status unavailable (node syncing or RPC not ready)' }
-};
+async function apiFetchWithTimeout(path, options, timeoutMs) {
+  var controller = new AbortController();
+  var fetchOptions = Object.assign({}, options || {});
+  fetchOptions.signal = controller.signal;
+  var timer = setTimeout(function() { controller.abort(); }, timeoutMs);
+  try {
+    return await apiFetch(path, fetchOptions);
+  } catch (err) {
+    if (controller.signal.aborted) {
+      var timeoutError = new Error("Request timed out");
+      timeoutError.name = "TimeoutError";
+      throw timeoutError;
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
@@ -8,6 +8,8 @@ function openRebuildModal() {
  _rebuildLogOffset = 0;
  _rebuildServerDown = false;
  _rebuildFinished = false;
+  _rebuildPollInFlight = false;
+  _rebuildPollFailures = 0;
  if ($rebuildLog) { $rebuildLog.textContent = ""; $rebuildLog.style.display = "none"; }
  var action = _rebuildIsEnabling ? "Enabling" : "Disabling";
  var label = _rebuildFeatureName || "feature";
@@ -33,6 +35,7 @@ function appendRebuildLog(text) {
 }

 function startRebuildPoll() {
+  if (_rebuildPollTimer) clearInterval(_rebuildPollTimer);
  pollRebuildStatus();
  _rebuildPollTimer = setInterval(pollRebuildStatus, UPDATE_POLL_INTERVAL);
 }
@@ -42,9 +45,15 @@ function stopRebuildPoll() {
 }

 async function pollRebuildStatus() {
-  if (_rebuildFinished) return;
+  if (_rebuildFinished || _rebuildPollInFlight) return;
+  _rebuildPollInFlight = true;
  try {
-    var data = await apiFetch("/api/rebuild/status?offset=" + _rebuildLogOffset);
+    var data = await apiFetchWithTimeout(
+      "/api/rebuild/status?offset=" + _rebuildLogOffset,
+      { cache: "no-store" },
+      STATUS_POLL_FETCH_TIMEOUT
+    );
+    _rebuildPollFailures = 0;
    if (_rebuildServerDown) { _rebuildServerDown = false; }
    if (data.log) appendRebuildLog(data.log);
    _rebuildLogOffset = data.offset;
@@ -57,7 +66,19 @@ async function pollRebuildStatus() {
      onRebuildDone(data.result === "success");
    }
  } catch (err) {
+    _rebuildPollFailures += 1;
+    // The Hub restarts itself during activation, which briefly drops this poll.
+    // If polling stays broken long past a normal restart, reload to
+    // re-authenticate and show the resulting feature state.
+    if (_rebuildPollFailures >= STATUS_POLL_MAX_FAILURES) {
+      _rebuildFinished = true;
+      stopRebuildPoll();
+      window.location.reload();
+      return;
+    }
    if (!_rebuildServerDown) { _rebuildServerDown = true; if ($rebuildStatus) $rebuildStatus.textContent = "Applying changes…"; }
+  } finally {
+    _rebuildPollInFlight = false;
  }
 }

@@ -6,9 +6,13 @@ let _servicesCache    = [];
 let _categoryLabels   = {};
 let _updateLog        = "";
 let _updatePollTimer  = null;
+let _updatePollInFlight = false;
 let _updateLogOffset  = 0;
+let _updateVisibleLogChars = 0;
 let _serverWasDown    = false;
 let _updateFinished   = false;
+let _updateStatusUnavailable = false;
+let _updatePollFailures = 0; // consecutive failed update-status polls
 let _supportTimerInt      = null;
 let _supportEnabledAt     = null;
 let _supportStatus        = null;   // last fetched /api/support/status payload
@@ -23,8 +27,10 @@ let _featuresData         = null;
 let _rebuildLog           = "";
 let _rebuildLogOffset     = 0;
 let _rebuildPollTimer     = null;
+let _rebuildPollInFlight  = false;
 let _rebuildFinished      = false;
 let _rebuildServerDown    = false;
+let _rebuildPollFailures  = 0; // consecutive failed rebuild-status polls
 let _pendingToggle        = null; // {feature, extra} waiting for domain/confirm
 let _rebuildFeatureName   = "";
 let _rebuildIsEnabling    = true;
@@ -46,6 +52,7 @@ const $modalStatus    = document.getElementById("modal-status");
 const $modalLog       = document.getElementById("modal-log");
 const $btnReboot      = document.getElementById("btn-reboot");
 const $btnSave        = document.getElementById("btn-save-report");
+const $btnRetryUpdate = document.getElementById("btn-retry-update-status");
 const $btnCloseModal  = document.getElementById("btn-close-modal");

 const $rebootOverlay  = document.getElementById("reboot-overlay");
@@ -110,12 +110,26 @@ function renderSupportInactive() {
    '</div>',
    '<div class="support-steps"><div class="support-steps-title">What happens:</div><ol>',
      '<li>A restricted <code>sovran-support</code> user is created with limited access</li>',
-      '<li>Our SSH key is added only to that restricted account</li>',
+      '<li>Support\'s SSH key is added only to that restricted account — not to root</li>',
      '<li>Wallet files are locked via access controls — not visible to support</li>',
      '<li>You control if and when wallet access is granted (time-limited)</li>',
      '<li>All session events are logged for your audit</li>',
+      '<li>Access expires automatically after 24 hours</li>',
    '</ol></div>',
+    '<div class="support-key-section">',
+      '<label class="support-key-label" for="support-ssh-pubkey">',
+        '<strong>Paste the support SSH public key provided by Sovran Systems:</strong>',
+      '</label>',
+      '<textarea id="support-ssh-pubkey" class="support-key-input" rows="3" ',
+        'placeholder="ssh-ed25519 AAAA… support-session" ',
+        'spellcheck="false" autocomplete="off" autocorrect="off" autocapitalize="off"></textarea>',
+      '<p class="support-key-hint">',
+        'The key must start with <code>ssh-ed25519</code> or <code>ecdsa-sha2-nistp256</code>. ',
+        'Do not paste your own private key — only paste the one-time public key sent by Sovran Systems support.',
+      '</p>',
+    '</div>',
    '<button class="btn support-btn-enable" id="btn-support-enable">Enable Support Access</button>',
+    '<p id="support-key-error" class="support-key-error" style="display:none;color:#c0392b;margin-top:8px;"></p>',
    '<p class="support-fine-print">You can revoke access at any time. When you end the session, you\'ll be able to disable SSH to return to the default secure state.</p>',
    '</div>',
  ].join("");
@@ -227,16 +241,43 @@ function renderSupportRemoved(verified) {

 async function enableSupport() {
  var btn = document.getElementById("btn-support-enable");
+  var errEl = document.getElementById("support-key-error");
+  var textarea = document.getElementById("support-ssh-pubkey");
+  if (errEl) { errEl.style.display = "none"; errEl.textContent = ""; }
+
+  var sshKey = textarea ? textarea.value.trim() : "";
+  if (!sshKey) {
+    if (errEl) { errEl.textContent = "Please paste the SSH public key provided by Sovran Systems support."; errEl.style.display = "block"; }
+    return;
+  }
+  // Client-side pre-validation: key must start with a known algorithm prefix
+  var validPrefixes = ["ssh-ed25519 ", "ecdsa-sha2-nistp256 ", "ecdsa-sha2-nistp384 ", "ecdsa-sha2-nistp521 ", "sk-ssh-ed25519@openssh.com "];
+  var hasValidPrefix = validPrefixes.some(function(p) { return sshKey.startsWith(p); });
+  if (!hasValidPrefix) {
+    if (errEl) { errEl.textContent = "Invalid key format. The key must start with ssh-ed25519 or ecdsa-sha2-nistp256. Do not paste a private key."; errEl.style.display = "block"; }
+    return;
+  }
+  if (sshKey.indexOf("\n") !== -1) {
+    if (errEl) { errEl.textContent = "The key must be a single line. Please check the pasted value."; errEl.style.display = "block"; }
+    return;
+  }
+
  if (btn) { btn.disabled = true; btn.textContent = "Enabling…"; }
  try {
-    await apiFetch("/api/support/enable", { method: "POST" });
+    await apiFetch("/api/support/enable", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ ssh_public_key: sshKey }),
+    });
    var status = await apiFetch("/api/support/status");
    _supportStatus = status;
    _supportEnabledAt = status.enabled_at;
    renderSupportActive(status);
  } catch (err) {
    if (btn) { btn.disabled = false; btn.textContent = "Enable Support Access"; }
-    alert("Failed to enable support access. Please try again.");
+    var detail = (err && err.detail) ? err.detail : "Failed to enable support access. Please check the key and try again.";
+    if (errEl) { errEl.textContent = detail; errEl.style.display = "block"; }
+    else { alert(detail); }
  }
 }

@@ -473,45 +514,99 @@ function renderBackupReady(drives) {
    ].join("");
  }

+  // ── Role-aware backup description ─────────────────────────────
+  // Desktop Only systems run no server or Bitcoin services and have no
+  // internal second drive, so the backup mirrors only the NixOS configuration
+  // and home directory. nix-bitcoin secrets, /var/lib system service data,
+  // and the database/blockchain caveats apply only to the Node and
+  // Server + Desktop roles.
+  var isDesktopOnly = (_currentRole === "desktop");
+
+  var introHtml;
+  if (isDesktopOnly) {
+    introHtml = [
+      '<div class="support-wallet-box support-wallet-protected" style="margin-bottom:16px;">',
+        '<p class="support-wallet-desc">',
+          'This manual backup lets you create a copy of your system on an external USB drive \u2014 ',
+          'storing your data in a second location, outside the computer, for maximum protection ',
+          'against hardware failure or physical damage.',
+        '</p>',
+      '</div>',
+    ].join("");
+  } else {
+    introHtml = [
+      '<div class="support-wallet-box support-wallet-protected" style="margin-bottom:16px;">',
+        '<p class="support-wallet-desc">',
+          'Your Sovran Pro already backs up your data automatically to its internal second drive. ',
+          'This manual backup lets you create an additional copy on an external USB drive \u2014 ',
+          'storing your data in a third location, outside the computer, for maximum protection ',
+          'against hardware failure or physical damage.',
+        '</p>',
+      '</div>',
+    ].join("");
+  }
+
+  var backupItemsHtml;
+  if (isDesktopOnly) {
+    backupItemsHtml = [
+      '<li>NixOS configuration (<code>/etc/nixos</code>)</li>',
+      '<li>Home directory (<code>/home</code>)</li>',
+    ].join("");
+  } else {
+    backupItemsHtml = [
+      '<li>NixOS configuration (<code>/etc/nixos</code>)</li>',
+      '<li>nix-bitcoin secrets (<code>/etc/nix-bitcoin-secrets</code>)</li>',
+      '<li>System service data (<code>/var/lib</code>) — excluding databases and blockchain data (see note below)</li>',
+      '<li>Home directory (<code>/home</code>)</li>',
+    ].join("");
+  }
+
+  // The database/blockchain caveat is only relevant when server services exist.
+  var dbNoteHtml = "";
+  if (!isDesktopOnly) {
+    dbNoteHtml = [
+      '<div class="support-wallet-box support-wallet-warning">',
+        '<div class="support-wallet-header">',
+          '<span class="support-wallet-icon">\u2139\ufe0f</span>',
+          '<span class="support-wallet-title">Database and Blockchain Data</span>',
+        '</div>',
+        '<p class="support-wallet-desc">Application databases stored in PostgreSQL or MariaDB/MySQL are <strong>not included</strong> in Manual Backup. Bitcoin blockchain and Electrs index data are also excluded (they are stored on the internal second drive). If you use Nextcloud, Matrix, or other database-backed applications, back up those databases separately with their native tools.</p>',
+      '</div>',
+    ].join("");
+  }
+
  $supportBody.innerHTML = [
    '<div class="support-section">',
    '<div class="support-icon-big">\ud83d\udcbe</div>',
    '<h3 class="support-heading">Manual Backup</h3>',

-    '<div class="support-wallet-box support-wallet-protected" style="margin-bottom:16px;">',
-      '<p class="support-wallet-desc">',
-        'Your Sovran Pro already backs up your data automatically to its internal second drive. ',
-        'This manual backup lets you create an additional copy on an external USB drive \u2014 ',
-        'storing your data in a third location, outside the computer, for maximum protection ',
-        'against hardware failure or physical damage.',
-      '</p>',
-    '</div>',
+    introHtml,

    '<div class="support-steps">',
      '<div class="support-steps-title">Requirements</div>',
      '<ol class="support-backup-steps">',
        '<li>USB hard drive plugged into one of the open USB ports on your Sovran Pro</li>',
-        '<li>At least 500 GB of free space on the drive</li>',
-        '<li>Drive must be formatted as <strong>exFAT</strong></li>',
+        '<li>Enough free space for your data (the backup checks this before starting)</li>',
+        '<li>Drive must be formatted as <strong>ext4</strong> (a Linux filesystem). Drives with exFAT, FAT32, or NTFS are not supported. To format a drive as ext4, use a Linux tool such as GParted or <code>mkfs.ext4</code> — note that formatting erases all data on the drive.</li>',
+        '<li>The drive is intended for Linux/Sovran recovery. It may not be directly readable by Windows or macOS without additional software.</li>',
      '</ol>',
    '</div>',

    '<div class="support-steps">',
      '<div class="support-steps-title">What gets backed up</div>',
      '<ol class="support-backup-steps">',
-        '<li>NixOS configuration (<code>/etc/nixos</code>)</li>',
-        '<li>nix-bitcoin secrets (<code>/etc/nix-bitcoin-secrets</code>)</li>',
-        '<li>System service data (<code>/var/lib</code>) including Vaultwarden, bitcoind, LND, sovran-hub, domains, and secrets</li>',
-        '<li>Home directory (<code>/home</code>)</li>',
+        backupItemsHtml,
      '</ol>',
    '</div>',

-    '<div class="support-wallet-box support-wallet-warning">',
+    dbNoteHtml,
+
+    '<div class="support-wallet-box support-wallet-protected">',
      '<div class="support-wallet-header">',
        '<span class="support-wallet-icon">\u23f1\ufe0f</span>',
        '<span class="support-wallet-title">Time Estimate</span>',
      '</div>',
-      '<p class="support-wallet-desc">This backup can take <strong>up to 4 hours</strong> depending on the amount of data stored on your Sovran Pro and the speed of your external hard drive. Be patient\u2026</p>',
+      '<p class="support-wallet-desc">The first backup may take a while depending on how much data you have. Later backups are much faster because only changed or new files are copied. Files are stored directly on the drive and can be browsed without any special software.</p>',
    '</div>',

    driveSelector,
@@ -584,9 +679,10 @@ async function pollBackupStatus() {
      logDiv.scrollTop = logDiv.scrollHeight;
    }
    _backupLogOffset = data.offset;
-    if (!data.running) {
+    const result = (data.result || "").toLowerCase();
+    if (result === "success" || result === "failed") {
      stopBackupPoll();
-      renderBackupDone(data.result === "success");
+      renderBackupDone(result === "success");
    }
  } catch (_) {}
 }
@@ -618,7 +714,7 @@ function renderBackupDone(success) {
      '<div class="support-section">',
      '<div class="support-icon-big">\u26a0\ufe0f</div>',
      '<h3 class="support-heading">Backup Failed</h3>',
-      '<p class="support-desc">The backup did not complete successfully. Please check that the USB drive is still connected, has enough free space, and is formatted as exFAT. Then try again.</p>',
+      '<p class="support-desc">The backup did not complete successfully. Please check that the USB drive is still connected, has enough free space, and is formatted as ext4. Then try again.</p>',
      '<div class="modal-log" id="backup-log-fail" style="text-align:left;"></div>',
      '<button class="btn support-btn-done" id="btn-backup-close">Close</button>',
      '</div>',
@@ -4,14 +4,6 @@
 // Keyed by tileId: { progress: float, timestamp: ms }
 var _btcSyncPrev = {};

-// ── BIP-110 badge helper ──────────────────────────────────────────
-
-function _renderBip110Badge(bip110) {
-  if (!bip110) return '';
-  var state = bip110.state || 'unknown';
-  var cfg = BIP110_BADGE_CONFIG[state] || BIP110_BADGE_CONFIG.unknown;
-  return '<div class="tile-bip110-badge ' + cfg.cls + '" title="' + escHtml(cfg.title) + '">' + escHtml(cfg.label) + '</div>';
-}

 function _firstElementFromHtml(html) {
  var tmp = document.createElement("div");
@@ -156,13 +148,10 @@ function buildTile(svc) {
    var pct = Math.round((svc.sync_progress || 0) * 100);
    var id = tileId(svc);
    var eta = _calcBtcEta(id, svc.sync_progress || 0);
-    var ver = svc.version || svc.bitcoin_version || '';
-    var versionLabel = ver ? '<div class="tile-version">' + escHtml(ver) + '</div>' : '';
    tile.innerHTML =
      '<img class="tile-icon" src="/static/icons/' + escHtml(svc.icon) + '.svg" alt="' + escHtml(svc.name) + '" onerror="this.style.display=\'none\';this.nextElementSibling.style.display=\'flex\'">' +
      '<div class="tile-icon-fallback" style="display:none">?</div>' +
      '<div class="tile-name">' + escHtml(svc.name) + '</div>' +
-      versionLabel +
      '<div class="tile-sync-container">' +
        '<div class="tile-sync-label">\u23F3 Syncing Timechain</div>' +
        '<div class="tile-sync-bar-row">' +
@@ -178,10 +167,7 @@ function buildTile(svc) {
    return tile;
  }

-  var ver = svc.version || svc.bitcoin_version || '';
-  var versionLabel = ver ? '<div class="tile-version">' + escHtml(ver) + '</div>' : '';
-  var bip110Badge = (svc.icon === 'bip110') ? _renderBip110Badge(svc.bip110) : '';
-  tile.innerHTML = '<img class="tile-icon" src="/static/icons/' + escHtml(svc.icon) + '.svg" alt="' + escHtml(svc.name) + '" onerror="this.style.display=\'none\';this.nextElementSibling.style.display=\'flex\'"><div class="tile-icon-fallback" style="display:none">?</div><div class="tile-name">' + escHtml(svc.name) + '</div>' + versionLabel + bip110Badge + '<div class="tile-status"><span class="status-dot ' + sc + '"></span><span class="status-text">' + st + '</span></div>';
+  tile.innerHTML = '<img class="tile-icon" src="/static/icons/' + escHtml(svc.icon) + '.svg" alt="' + escHtml(svc.name) + '" onerror="this.style.display=\'none\';this.nextElementSibling.style.display=\'flex\'"><div class="tile-icon-fallback" style="display:none">?</div><div class="tile-name">' + escHtml(svc.name) + '</div><div class="tile-status"><span class="status-dot ' + sc + '"></span><span class="status-text">' + st + '</span></div>';

  tile.style.cursor = "pointer";
  tile.addEventListener("click", function() {
@@ -235,22 +221,6 @@ function updateTiles(services) {
      if (fill) fill.style.width = pct + "%";
      if (pctEl) pctEl.textContent = pct + "%";
      if (etaEl) etaEl.textContent = etaText;
-      // Update or insert version label
-      var syncVer = svc.version || svc.bitcoin_version || '';
-      if (syncVer) {
-        var syncVerEl = tile.querySelector(".tile-version");
-        if (syncVerEl) {
-          syncVerEl.textContent = syncVer;
-        } else {
-          var syncNameEl = tile.querySelector(".tile-name");
-          if (syncNameEl) {
-            var newSyncVerEl = document.createElement("div");
-            newSyncVerEl.className = "tile-version";
-            newSyncVerEl.textContent = syncVer;
-            syncNameEl.insertAdjacentElement("afterend", newSyncVerEl);
-          }
-        }
-      }
    } else {
      // IBD finished or not syncing — if tile had sync layout rebuild it normally
      if (tile.querySelector(".tile-sync-container")) {
@@ -265,39 +235,6 @@ function updateTiles(services) {
      var text = tile.querySelector(".status-text");
      if (dot) dot.className = "status-dot " + sc;
      if (text) text.textContent = st;
-      // Update or insert version label for all service tiles
-      var tileVer = svc.version || svc.bitcoin_version || '';
-      if (tileVer) {
-        var verEl = tile.querySelector(".tile-version");
-        if (verEl) {
-          verEl.textContent = tileVer;
-        } else {
-          var nameEl = tile.querySelector(".tile-name");
-          if (nameEl) {
-            var newVerEl = document.createElement("div");
-            newVerEl.className = "tile-version";
-            newVerEl.textContent = tileVer;
-            nameEl.insertAdjacentElement("afterend", newVerEl);
-          }
-        }
-      }
-      // Update BIP-110 badge for bip110 tiles
-      if (svc.icon === 'bip110') {
-        var badgeHtml = _renderBip110Badge(svc.bip110);
-        var badgeEl = tile.querySelector(".tile-bip110-badge");
-        if (badgeEl) {
-          // Replace existing badge in-place
-          var newBadge = _firstElementFromHtml(badgeHtml);
-          if (newBadge) { badgeEl.replaceWith(newBadge); } else { badgeEl.remove(); }
-        } else if (badgeHtml) {
-          // Insert badge after version label (or after tile-name if no version)
-          var anchorEl = tile.querySelector(".tile-version") || tile.querySelector(".tile-name");
-          if (anchorEl) {
-            var newBadgeEl = _firstElementFromHtml(badgeHtml);
-            if (newBadgeEl) anchorEl.insertAdjacentElement("afterend", newBadgeEl);
-          }
-        }
-      }
    }
  }
 }
@@ -334,10 +271,19 @@ async function checkUpdates() {
  try {
    var data = await apiFetch("/api/updates/check");
    var hasUpdates = !!data.available;
+    var updateStatus = data.status || "idle";
    var sidebarUpdateBtn = document.getElementById("sidebar-btn-update");
    var sidebarUpdateHint = document.getElementById("sidebar-update-hint");
    if (sidebarUpdateBtn) {
-      if (hasUpdates) {
+      if (updateStatus === "reboot_required") {
+        sidebarUpdateBtn.style.borderColor = "#e5a50a";
+        sidebarUpdateBtn.style.backgroundColor = "rgba(229, 165, 10, 0.10)";
+        if (sidebarUpdateHint) sidebarUpdateHint.textContent = "Restart required";
+      } else if (updateStatus === "running") {
+        sidebarUpdateBtn.style.borderColor = "#3584e4";
+        sidebarUpdateBtn.style.backgroundColor = "rgba(53, 132, 228, 0.10)";
+        if (sidebarUpdateHint) sidebarUpdateHint.textContent = "Update in progress…";
+      } else if (hasUpdates) {
        sidebarUpdateBtn.style.borderColor = "#2ec27e";
        sidebarUpdateBtn.style.backgroundColor = "rgba(46, 194, 126, 0.08)";
        if (sidebarUpdateHint) sidebarUpdateHint.textContent = "Updates available!";
@@ -2,20 +2,45 @@

 // ── Update modal ──────────────────────────────────────────────────

-function openUpdateModal() {
+async function openUpdateModal() {
  if (!$modal) return;
-  apiFetch("/api/updates/check")
+
+  // Reattach before checking for new updates. This makes a browser reload,
+  // RDP reconnect, or suspended tab recover the authoritative systemd-backed
+  // state instead of starting over or claiming the system is merely up to date.
+  try {
+    var current = await apiFetchWithTimeout(
+      "/api/updates/status?offset=0",
+      { cache: "no-store" },
+      STATUS_POLL_FETCH_TIMEOUT
+    );
+    if (current.running || current.result === "reboot_required") {
+      showExistingUpdate(current);
+      return;
+    }
+  } catch (_) {
+    // The normal start path below has its own visible error handling.
+  }
+
+  apiFetchWithTimeout(
+    "/api/updates/check",
+    { cache: "no-store" },
+    STATUS_POLL_FETCH_TIMEOUT
+  )
    .then(function(data) {
      if (!data.available) {
        stopUpdatePoll();
        _updateLog = "";
        _updateLogOffset = 0;
+        _updateVisibleLogChars = 0;
        _updateFinished = true;
+        _updateStatusUnavailable = false;
        if ($modalLog) $modalLog.textContent = "";
        if ($modalStatus) $modalStatus.textContent = "✓ System is already up to date";
        if ($modalSpinner) $modalSpinner.classList.remove("spinning");
        if ($btnReboot) $btnReboot.style.display = "none";
        if ($btnSave) $btnSave.style.display = "none";
+        if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
        if ($btnCloseModal) $btnCloseModal.disabled = false;
        $modal.classList.add("open");
        return;
@@ -27,22 +52,69 @@ function openUpdateModal() {
    });
 }

-function _doOpenUpdateModal() {
+function prepareUpdateModal() {
  if (!$modal) return;
+  stopUpdatePoll();
  _updateLog = "";
  _updateLogOffset = 0;
+  _updateVisibleLogChars = 0;
+  _updatePollInFlight = false;
  _serverWasDown = false;
  _updateFinished = false;
+  _updateStatusUnavailable = false;
+  _updatePollFailures = 0;
  if ($modalLog) $modalLog.textContent = "";
  if ($modalStatus) $modalStatus.textContent = "Starting update…";
  if ($modalSpinner) $modalSpinner.classList.add("spinning");
  if ($btnReboot) $btnReboot.style.display = "none";
  if ($btnSave) $btnSave.style.display = "none";
+  if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
  if ($btnCloseModal) $btnCloseModal.disabled = true;
  $modal.classList.add("open");
+}
+
+function _doOpenUpdateModal() {
+  prepareUpdateModal();
  startUpdate();
 }

+function showExistingUpdate(data) {
+  prepareUpdateModal();
+  if (data.log) appendLog(data.log);
+  _updateLogOffset = Number(data.offset) || 0;
+
+  if (data.running) {
+    if ($modalStatus) $modalStatus.textContent = "Updating…";
+    startUpdatePoll();
+    return;
+  }
+
+  _updateFinished = true;
+  if (data.result === "reboot_required") {
+    onUpdateDone("reboot_required");
+  } else if (data.result === "success") {
+    onUpdateDone(true);
+  } else {
+    onUpdateDone(false);
+  }
+}
+
+async function restoreUpdateModalIfNeeded() {
+  if (!$modal || $modal.classList.contains("open")) return;
+  try {
+    var data = await apiFetchWithTimeout(
+      "/api/updates/status?offset=0",
+      { cache: "no-store" },
+      STATUS_POLL_FETCH_TIMEOUT
+    );
+    if (data.running || data.result === "reboot_required") {
+      showExistingUpdate(data);
+    }
+  } catch (_) {
+    // Dashboard startup must remain usable when status cannot be reached.
+  }
+}
+
 function closeUpdateModal() {
  if (!$modal) return;
  $modal.classList.remove("open");
@@ -52,21 +124,36 @@ function closeUpdateModal() {
 function appendLog(text) {
  if (!text) return;
  _updateLog += text;
-  if ($modalLog) { $modalLog.textContent += text; $modalLog.scrollTop = $modalLog.scrollHeight; }
+  if ($modalLog) {
+    // Appending a text node avoids reparsing/replacing the complete log on
+    // every two-second poll. Trim only occasionally once the visible log is
+    // large; the complete _updateLog remains available for error reports.
+    if (_updateVisibleLogChars + text.length > UPDATE_VISIBLE_LOG_MAX_CHARS) {
+      var tail = _updateLog.slice(-UPDATE_VISIBLE_LOG_TRIM_CHARS);
+      var notice = "[Earlier update output hidden from this view; it remains in the saved report.]\n\n";
+      $modalLog.textContent = notice + tail;
+      _updateVisibleLogChars = notice.length + tail.length;
+    } else {
+      $modalLog.appendChild(document.createTextNode(text));
+      _updateVisibleLogChars += text.length;
+    }
+    $modalLog.scrollTop = $modalLog.scrollHeight;
+  }
 }

 function startUpdate() {
-  fetch("/api/updates/run", { method: "POST" })
-    .then(function(response) {
-      if (!response.ok) return response.text().then(function(t) { throw new Error(t); });
-      return response.json();
-    })
+  apiFetchWithTimeout(
+    "/api/updates/run",
+    { method: "POST" },
+    STATUS_POLL_FETCH_TIMEOUT * 2
+  )
    .then(function(data) {
      if (data.status === "no_updates") {
        if ($modalStatus) $modalStatus.textContent = "✓ System is already up to date";
        if ($modalSpinner) $modalSpinner.classList.remove("spinning");
        if ($btnReboot) $btnReboot.style.display = "none";
        if ($btnSave) $btnSave.style.display = "none";
+        if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
        if ($btnCloseModal) $btnCloseModal.disabled = false;
        _updateFinished = true;
        return;
@@ -82,6 +169,7 @@ function startUpdate() {
 }

 function startUpdatePoll() {
+  if (_updatePollTimer) clearInterval(_updatePollTimer);
  pollUpdateStatus();
  _updatePollTimer = setInterval(pollUpdateStatus, UPDATE_POLL_INTERVAL);
 }
@@ -91,32 +179,45 @@ function stopUpdatePoll() {
 }

 async function pollUpdateStatus() {
-  if (_updateFinished) return;
+  // setInterval does not wait for an async callback. The guard prevents a slow
+  // request from creating overlapping, out-of-order status polls.
+  if (_updateFinished || _updatePollInFlight) return;
+  _updatePollInFlight = true;
  try {
-    var data = await apiFetch("/api/updates/status?offset=" + _updateLogOffset);
+    var data = await apiFetchWithTimeout(
+      "/api/updates/status?offset=" + _updateLogOffset,
+      { cache: "no-store" },
+      STATUS_POLL_FETCH_TIMEOUT
+    );
+    _updatePollFailures = 0;
    if (_serverWasDown) {
      _serverWasDown = false;
      if (!data.running) {
-        // The update finished while the server was restarting.  Reset to
-        // offset 0 and re-fetch so the complete log is shown from the top.
+        // The update finished while the server or browser connection was away.
+        // Re-fetch from offset 0 so the final result and complete tail agree.
        _updateLog = "";
        _updateLogOffset = 0;
+        _updateVisibleLogChars = 0;
        if ($modalLog) $modalLog.textContent = "";
        try {
-          var fullData = await apiFetch("/api/updates/status?offset=0");
+          var fullData = await apiFetchWithTimeout(
+            "/api/updates/status?offset=0",
+            { cache: "no-store" },
+            STATUS_POLL_FETCH_TIMEOUT
+          );
          if (fullData.log) appendLog(fullData.log);
          _updateLogOffset = fullData.offset;
-        } catch (e) {
-          // If the re-fetch fails, fall through with whatever we have.
+          data = fullData;
+        } catch (_) {
          if (data.log) appendLog(data.log);
          _updateLogOffset = data.offset;
        }
        if (data.result === "reboot_required") {
-          appendLog("[Server restarted — update completed, reboot required.]\n");
+          appendLog("[Reconnected — update completed, reboot required.]\n");
        } else if (data.result === "success") {
-          appendLog("[Server restarted — update completed successfully.]\n");
+          appendLog("[Reconnected — update completed successfully.]\n");
        } else {
-          appendLog("[Server restarted — update encountered an error.]\n");
+          appendLog("[Reconnected — update encountered an error.]\n");
        }
        _updateFinished = true;
        stopUpdatePoll();
@@ -127,7 +228,7 @@ async function pollUpdateStatus() {
        }
        return;
      }
-      appendLog("[Server reconnected]\n");
+      appendLog("[Update status reconnected]\n");
      if ($modalStatus) $modalStatus.textContent = "Updating…";
    }
    if (data.log) appendLog(data.log);
@@ -143,12 +244,58 @@ async function pollUpdateStatus() {
      onUpdateDone(false);
    }
  } catch (err) {
-    if (!_serverWasDown) { _serverWasDown = true; appendLog("\n[Server restarting — waiting for it to come back…]\n"); if ($modalStatus) $modalStatus.textContent = "Server restarting…"; }
+    _updatePollFailures += 1;
+    if (_updatePollFailures >= STATUS_POLL_MAX_FAILURES) {
+      showUpdateStatusUnavailable();
+      return;
+    }
+    if (!_serverWasDown) {
+      _serverWasDown = true;
+      appendLog("\n[Update status connection interrupted — retrying…]\n");
+      if ($modalStatus) $modalStatus.textContent = "Reconnecting to update…";
+    }
+  } finally {
+    _updatePollInFlight = false;
+  }
+}
+
+function showUpdateStatusUnavailable() {
+  _updateFinished = true;
+  _updateStatusUnavailable = true;
+  stopUpdatePoll();
+  if ($modalSpinner) $modalSpinner.classList.remove("spinning");
+  if ($modalStatus) $modalStatus.textContent = "Update status unavailable — update may still be running";
+  appendLog("\n[The Hub could not confirm update status. The background update was not stopped. Select Retry Status after reconnecting.]\n");
+  if ($btnRetryUpdate) $btnRetryUpdate.style.display = "inline-flex";
+  if ($btnCloseModal) $btnCloseModal.disabled = false;
+}
+
+function retryUpdateStatus() {
+  if (!$modal) return;
+  _updateFinished = false;
+  _updateStatusUnavailable = false;
+  _updatePollFailures = 0;
+  _serverWasDown = true;
+  if ($modalSpinner) $modalSpinner.classList.add("spinning");
+  if ($modalStatus) $modalStatus.textContent = "Reconnecting to update…";
+  if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
+  if ($btnCloseModal) $btnCloseModal.disabled = true;
+  startUpdatePoll();
+}
+
+function resumeUpdateStatusAfterInterruption() {
+  if (!$modal || !$modal.classList.contains("open")) return;
+  if (_updateStatusUnavailable) {
+    retryUpdateStatus();
+  } else if (!_updateFinished) {
+    pollUpdateStatus();
  }
 }

 function onUpdateDone(result) {
+  _updateStatusUnavailable = false;
  if ($modalSpinner) $modalSpinner.classList.remove("spinning");
+  if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
  if ($btnCloseModal) $btnCloseModal.disabled = false;
  if (result === true) {
    if ($modalStatus) $modalStatus.textContent = "✓ Update complete";
@@ -175,6 +322,7 @@ function saveErrorReport() {
  URL.revokeObjectURL(url);
 }

+
 // ── Reboot ────────────────────────────────────────────────────────

 var _rebootStartTime = 0;
@@ -1,16 +1,16 @@
 /* Sovran_SystemsOS Hub — First-Boot Onboarding Wizard
-   Drives the 5-step post-install setup flow. */
+   Drives the 4-step post-install setup flow. */
 "use strict";

 // ── Constants ─────────────────────────────────────────────────────

-const TOTAL_STEPS = 5;
+const TOTAL_STEPS = 4;

-// Steps to skip per role (steps 3 and 4 involve domain/port setup)
+// Steps to skip per role (step 3 involves domain setup)
 // Step 2 (timezone/locale) is NEVER skipped — all roles need it.
 const ROLE_SKIP_STEPS = {
-  "desktop": [3, 4],
-  "node":    [3, 4],
+  "desktop": [3],
+  "node":    [3],
 };

 // ── Role state (loaded at init) ───────────────────────────────────
@@ -66,7 +66,7 @@ function setStatus(elId, msg, type) {
  el.className = "onboarding-save-status" + (type ? " onboarding-save-status--" + type : "");
 }

-function updateStep5Checklist() {
+function updateCompleteChecklist() {
  var checklist = document.getElementById("onboarding-checklist");
  if (!checklist) return;
  var existing = document.getElementById("onboarding-migration-check");
@@ -135,8 +135,7 @@ function showStep(step) {
  // Lazy-load step content
  if (step === 2) loadStep2();
  if (step === 3) loadStep3();
-  if (step === 4) loadStep4();
-  // Step 5 (Complete) is static — no lazy-load needed
+  // Step 4 (Complete) is static — no lazy-load needed
 }

 // Return the next step number, skipping over role-excluded steps
@@ -319,20 +318,27 @@ async function loadStep3() {
  if (!body) return;

  try {
-    // Fetch services, domains, and network info in parallel
+    // Fetch services and domains in parallel (network info is best-effort below)
    var results = await Promise.all([
      apiFetch("/api/services"),
      apiFetch("/api/domains/status"),
-      apiFetch("/api/network"),
    ]);
    _servicesData = results[0];
    _domainsData  = results[1];
-    var networkData = results[2];
  } catch (err) {
    body.innerHTML = '<p class="onboarding-error">⚠ Could not load service data: ' + escHtml(err.message) + '</p>';
    return;
  }

+  // Best-effort internal IP for the router note — never blocks this step
+  var internalIp = "";
+  try {
+    var networkData = await apiFetch("/api/network");
+    if (networkData && networkData.internal_ip && networkData.internal_ip !== "unavailable") {
+      internalIp = String(networkData.internal_ip).trim();
+    }
+  } catch (_) {}
+
  // Build set of enabled service units
  var enabledUnits = new Set();
  (_servicesData || []).forEach(function(svc) {
@@ -344,49 +350,47 @@ async function loadStep3() {
    return enabledUnits.has(d.unit);
  });

+  var domainValues = (_domainsData && _domainsData.domains) || {};
+
  var html = "";

  if (relevantDomains.length === 0) {
    html += '<p class="onboarding-body-text">No domain-based services are enabled for your role. You can skip this step.</p>';
  } else {
+    // Shared instructions (single source of truth: static/js/domain-prereqs.js) —
+    // identical wording to the feature-enable domain modal shown for NWC,
+    // BTCPay Server, and every other domain-based feature, in every role.
    html += '<div class="onboarding-port-warn" style="margin-bottom:16px;">'
-      + '<p style="margin:0 0 8px;"><strong>Sovran_SystemsOS uses Njal.la for domains and Dynamic DNS.</strong></p>'
-      + '<ol style="margin:8px 0 0 16px; padding:0; line-height:1.7;">'
-      + '<li>Create an account at <a href="https://njal.la" target="_blank" style="color:var(--accent-color);">https://njal.la</a>.</li>'
-      + '<li>Buy at least one domain. Each service below needs its own domain — you can either give each service its own subdomain of a single domain you buy (subdomains are free, and one domain can have many), OR use a separate domain for each. Your choice.</li>'
-      + '<li>For each service, add a <strong>Dynamic</strong> record in Njal.la:'
-      + '<ul style="margin:4px 0 0 16px;padding:0;line-height:1.7;">'
-      + '<li>In the Njal.la <strong>Name</strong> field, type ONLY the host part — the word before your domain.<br>'
-      + '(Example only, your choice — for &quot;call.yourdomain.com&quot; you&apos;d type just: <code>call</code>.)<br>'
-      + 'If you bought a whole separate domain just for this service, leave Name blank or use <code>@</code>.<br>'
-      + '&#9888; Do NOT type the full domain in the Name field — Njal.la adds it automatically.</li>'
-      + '<li>A Dynamic record has NO IP field. You don&apos;t enter an IP anywhere — it auto-fills once Sovran_SystemsOS updates it (on save, and again after reboot).</li>'
-      + '</ul>'
-      + '</li>'
-      + '<li>Njal.la gives you a curl command like:<br>'
-      + '<code style="font-size:0.8em;">curl &quot;https://njal.la/update/?h=call.yourdomain.com&amp;k=abc123&amp;auto&quot;</code></li>'
-      + '</ol>'
+      + renderDomainNeedsHtml({ serviceName: null, hostExample: "call" })
+      + renderNjallaStepsHtml({ hostExample: "call", pasteHint: "next to its service below" })
      + '</div>';
-    html += '<p class="onboarding-hint">Enter each service\'s full domain — a subdomain (e.g. <code>call.yourdomain.com</code>) or a separate domain (e.g. <code>call.com</code>) — and its Njal.la DDNS curl command.</p>';
+    html += '<p class="onboarding-hint">Enter the address for each service and paste its update command from Njal.la.</p>';
+
+    // Router note (the same wording is shown again, per-service, whenever a
+    // domain-based feature is enabled, and lives on each service tile afterwards)
+    html += '<div class="onboarding-port-warn" style="margin-bottom:16px;">'
+      + renderRouterPortsHtml({ internalIp: internalIp })
+      + '</div>';
+
    relevantDomains.forEach(function(d) {
-      var currentVal = (_domainsData && _domainsData[d.name]) || "";
+      var currentVal = domainValues[d.name] || "";
      html += '<div class="onboarding-domain-group">';
      html += '<label class="onboarding-domain-label">' + escHtml(d.label) + '</label>';
      html += '<input class="onboarding-domain-input domain-field-input" type="text" id="domain-input-' + escHtml(d.name) + '" data-domain="' + escHtml(d.name) + '" placeholder="e.g. ' + escHtml(d.name) + '.yourdomain.com" value="' + escHtml(currentVal) + '" />';
-      html += '<label class="onboarding-domain-label onboarding-domain-label--sub">Njal.la DDNS Curl Command</label>';
+      html += '<label class="onboarding-domain-label onboarding-domain-label--sub">Njal.la Update Command</label>';
      html += '<input class="onboarding-domain-input domain-field-input" type="text" id="ddns-input-' + escHtml(d.name) + '" data-ddns="' + escHtml(d.name) + '" placeholder="curl &quot;https://njal.la/update/?h=...&amp;k=...&amp;auto&quot;" />';
-      html += '<p class="onboarding-hint" style="margin-top:4px;">ℹ Paste the curl URL from your Njal.la dashboard\'s Dynamic record</p>';
+      html += '<p class="onboarding-hint" style="margin-top:4px;">Paste the update command from Njal.la</p>';
      html += '<button type="button" class="btn btn-primary onboarding-domain-save-btn" data-save-domain="' + escHtml(d.name) + '" style="align-self:flex-start;margin-top:8px;font-size:0.82rem;padding:6px 16px;">Save</button>';
      html += '<span class="onboarding-domain-save-status" id="domain-save-status-' + escHtml(d.name) + '" style="font-size:0.82rem;min-height:1.2em;"></span>';
      html += '</div>';
    });
  }

-  // SSL email section
-  var emailVal = (_domainsData && _domainsData["sslemail"]) || "";
+  // Contact email section
+  var emailVal = domainValues["sslemail"] || "";
  html += '<div class="onboarding-domain-group onboarding-domain-group--email">';
-  html += '<label class="onboarding-domain-label">📧 SSL Certificate Email</label>';
-  html += '<p class="onboarding-hint onboarding-hint--inline">Let\'s Encrypt uses this for certificate expiry notifications.</p>';
+  html += '<label class="onboarding-domain-label">📧 Email Address</label>';
+  html += '<p class="onboarding-hint onboarding-hint--inline">Used to send important notices about your services.</p>';
  html += '<input class="onboarding-domain-input domain-field-input" type="email" id="ssl-email-input" placeholder="you@example.com" value="' + escHtml(emailVal) + '" />';
  html += '<button type="button" class="btn btn-primary onboarding-domain-save-btn" data-save-email="true" style="align-self:flex-start;margin-top:8px;font-size:0.82rem;padding:6px 16px;">Save</button>';
  html += '<span class="onboarding-domain-save-status" id="domain-save-status-email" style="font-size:0.82rem;min-height:1.2em;"></span>';
@@ -511,106 +515,10 @@ async function saveStep3() {
  return true;
 }

-// ── Step 4: Port Forwarding ───────────────────────────────────────
-
-async function loadStep4() {
-  var body = document.getElementById("step-4-body");
-  if (!body) return;
-  body.innerHTML = '<p class="onboarding-loading">Loading router setup…</p>';
-
-  var networkData = null;
-
-  try {
-    networkData = await apiFetch("/api/network");
-  } catch (err) {
-    body.innerHTML = '<p class="onboarding-error">⚠ Could not load network data: ' + escHtml(err.message) + '</p>';
-    return;
-  }
-
-  var trimmedInternalIp = (networkData && networkData.internal_ip) ? String(networkData.internal_ip).trim() : "";
-  var internalIp = trimmedInternalIp || "";
-  var hasInternalIp = !!internalIp;
-  var ip = escHtml(internalIp || "Could not detect");
-  var routerIpHelp = hasInternalIp
-    ? "Use this IP address as the destination/internal IP when creating each router forwarding rule."
-    : "Use this computer’s internal IP as the destination/internal IP when creating each router forwarding rule.";
-  var destinationInstruction = hasInternalIp
-    ? 'Set the destination/internal IP to <strong>' + ip + '</strong>'
-    : 'Use this computer’s internal IP as the destination/internal IP';
-
-  var html = '<p class="onboarding-port-note" style="margin-bottom:14px;">'
-    + '⚠ <strong>Each port only needs to be forwarded once — all services share the same ports.</strong>'
-    + '</p>';
-
-  html += '<div class="onboarding-port-ip">';
-  html += '  <span class="onboarding-port-ip-label">Forward router traffic to this Sovran_SystemsOS computer:</span>';
-  html += '  <span class="port-req-internal-ip">' + ip + '</span>';
-  html += '</div>';
-  html += '<div class="onboarding-port-note" style="margin:8px 0 16px;">' + routerIpHelp + '</div>';
-
-  // Required ports table
-  html += '<div class="onboarding-port-section" style="margin-bottom:20px;">';
-  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:8px;">Required Router Rules</div>';
-  html += '<table class="onboarding-port-table">';
-  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;To</th><th>Used For</th></tr></thead>';
-  html += '<tbody>';
-  html += '<tr><td class="port-req-port">80</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">HTTP / SSL setup</td></tr>';
-  html += '<tr><td class="port-req-port">443</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">HTTPS</td></tr>';
-  html += '<tr><td class="port-req-port">22</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">Remote SSH access</td></tr>';
-  html += '</tbody></table>';
-  html += '</div>';
-
-  // Optional ports table
-  html += '<div class="onboarding-port-section" style="margin-bottom:20px;">';
-  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:4px;">Element Call Router Rules</div>';
-  html += '<div style="font-size:0.88em;margin-bottom:8px;color:var(--color-text-muted,#888);">Only add these if you enable Element Call. These ports help video and audio calls connect reliably.</div>';
-  html += '<table class="onboarding-port-table">';
-  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;To</th><th>Used For</th></tr></thead>';
-  html += '<tbody>';
-  html += '<tr><td class="port-req-port">7881</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">LiveKit WebRTC signalling</td></tr>';
-  html += '<tr><td class="port-req-port">7882</td><td class="port-req-proto">UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">LiveKit media (UDP mux)</td></tr>';
-  html += '<tr><td class="port-req-port">5349</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN over TLS</td></tr>';
-  html += '<tr><td class="port-req-port">3478</td><td class="port-req-proto">UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN (STUN/relay)</td></tr>';
-  html += '<tr><td class="port-req-port">30000-40000</td><td class="port-req-proto">TCP &amp; UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN relay (WebRTC)</td></tr>';
-  html += '</tbody></table>';
-  html += '<div style="font-size:0.85em;margin-top:6px;color:var(--color-text-muted,#888);">ℹ The <strong>30000-40000</strong> range is a single forwarding rule — just set its protocol to <strong>both TCP and UDP</strong> (often shown as "Both" or "TCP/UDP" on your router).</div>';
-  html += '</div>';
-
-  // Totals
-  html += '<div class="onboarding-port-totals">';
-  html += '<strong>Total port openings: 3</strong> (without Element Call)<br>';
-  html += '<strong>Total port openings: 8</strong> (with Element Call — 3 required + 5 optional)';
-  html += '</div>';
-
-  html += '<div class="onboarding-port-warn" style="margin-bottom:16px;">'
-    + '⚠ <strong>Ports 80 and 443 must be forwarded first.</strong> '
-    + 'Caddy uses these to obtain SSL certificates from Let\'s Encrypt. '
-    + 'If they are closed, HTTPS will not work and your services will be unreachable from outside your network.'
-    + '</div>';
-
-  html += '<details class="onboarding-port-details" style="margin-bottom:16px;">'
-    + '<summary class="onboarding-port-details-summary">How to set up port forwarding</summary>'
-    + '<ol style="margin:12px 0 0 16px; padding:0; line-height:1.8;">'
-    + '<li>Open your router\'s admin panel — usually <code>http://192.168.1.1</code> or <code>http://192.168.0.1</code></li>'
-    + '<li>Look for <strong>"Port Forwarding"</strong>, <strong>"NAT"</strong>, or <strong>"Virtual Server"</strong> in the settings</li>'
-    + '<li>Create a new rule for each port listed above</li>'
-    + '<li>' + destinationInstruction + '</li>'
-    + '<li>Set both internal and external port to the same number</li>'
-    + '<li>Save and apply changes</li>'
-    + '</ol>'
-    + '</details>';
-
-  html += '<div class="onboarding-port-note" style="margin-top:12px;">'
-    + '<strong>Important:</strong> The Hub can show which ports Sovran_SystemsOS needs, but it cannot fully confirm router forwarding from inside your home network. Full public port verification requires an outside internet check.'
-    + '</div>';
-
-  body.innerHTML = html;
-}
-
-// ── Step 5: Complete ──────────────────────────────────────────────
+// ── Step 4: Complete ──────────────────────────────────────────────

 async function completeOnboarding() {
-  var btn = document.getElementById("step-5-finish");
+  var btn = document.getElementById("step-4-finish");
  if (btn) { btn.disabled = true; btn.textContent = "Finishing…"; }

  try {
@@ -633,7 +541,7 @@ function wireNavButtons() {
    try {
      await apiFetch("/api/migration/password-acknowledge", { method: "POST" });
      _migrationOccurred = true;
-      updateStep5Checklist();
+      updateCompleteChecklist();
      showStep1FromMigration();
    } catch (err) {
      setStatus("migration-password-status", "⚠ " + err.message, "error");
@@ -669,13 +577,9 @@ function wireNavButtons() {
    showStep(nextStep(3));
  });

-  // Step 4 → 5 (port forwarding — no save needed)
-  var s4next = document.getElementById("step-4-next");
-  if (s4next) s4next.addEventListener("click", function() { showStep(nextStep(4)); });
-
-  // Step 5: finish
-  var s5finish = document.getElementById("step-5-finish");
-  if (s5finish) s5finish.addEventListener("click", completeOnboarding);
+  // Step 4: finish
+  var s4finish = document.getElementById("step-4-finish");
+  if (s4finish) s4finish.addEventListener("click", completeOnboarding);

  // Back buttons
  document.querySelectorAll(".onboarding-btn-back").forEach(function(btn) {
@@ -707,13 +611,13 @@ document.addEventListener("DOMContentLoaded", async function() {
  try {
    var migration = await apiFetch("/api/migration/password-status");
    if (migration && migration.pending) {
-      updateStep5Checklist();
+      updateCompleteChecklist();
      showMigrationStep(migration.password || "");
      return;
    }
  } catch (_) {}

-  updateStep5Checklist();
+  updateCompleteChecklist();
  showStep(1);
  loadStep1();
 });
@@ -0,0 +1,283 @@
+"""Sovran Hub — injectable support session operations.
+
+Functions here handle legacy migration, root-key removal, and support-session
+expiry.  All filesystem paths, clocks, and callback functions are injectable
+so that the test suite can exercise the exact production implementations with
+temporary files and mocks rather than maintaining separate copies.
+
+All functions depend only on the Python standard library and the co-located
+``security_helpers`` module.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import tempfile
+import time as _time_module
+from typing import Callable
+
+# ── Legacy Njalla curl line regex ─────────────────────────────────────────────
+#
+# Matches both forms written by old Hub versions:
+#   curl [flags] https://njal.la/...           (unquoted)
+#   curl [flags] "https://njal.la/..."          (quoted — historical form)
+#
+# Optional flags (in order): --silent, --max-time N, --fail
+#
+# Rejected outright: semicolons, pipes, backticks, redirects, newlines,
+# ${...} except the literal ${IP} placeholder, and any extra arguments.
+_LEGACY_NJALLA_CURL_RE = re.compile(
+    r'^curl\s+(?:--silent\s+)?(?:--max-time\s+\d+\s+)?(?:--fail\s+)?'
+    r'(?:'
+    r'"(https://(?:www\.)?njal\.la/(?:[^\s;|`$\x00-\x1f"]|\$\{IP\})+)"'   # group 1: quoted
+    r'|(https://(?:www\.)?njal\.la/(?:[^\s;|`$\x00-\x1f"]|\$\{IP\})+)'    # group 2: unquoted
+    r')$'
+)
+
+# The exact base64 blob of the historical fleet-wide root support key that
+# was shipped with old releases of Sovran_SystemsOS and must be removed from
+# /root/.ssh/authorized_keys on upgrade.
+LEGACY_ROOT_KEY_BLOB = (
+    "AAAAC3NzaC1lZDI1NTE5AAAAIPxPF2Qm11FQxC20wydKtlmn/Bo07YnDda3b9/CyXxQP"
+)
+
+
+def remove_legacy_root_key(
+    authorized_keys_path: str,
+    target_blob: str,
+    *,
+    audit_fn: Callable[[str, str], None] | None = None,
+) -> bool:
+    """Remove the exact historical fleet-wide support key from an authorized_keys file.
+
+    Identifies the key by its exact base64 blob (``parts[1]``), regardless of
+    algorithm prefix or comment field.  All other keys, blank lines, and comment
+    lines are preserved unchanged.  The file is written back atomically.
+
+    Args:
+        authorized_keys_path: Path to the authorized_keys file to modify.
+        target_blob: The exact base64 key blob to remove.  Only lines whose
+            second whitespace-delimited field matches this value are removed;
+            no substring or comment matching is performed.
+        audit_fn: Optional callback ``(event: str, details: str)`` for audit
+            logging.  The full key blob is **never** passed to this callback.
+
+    Returns:
+        ``True`` if the file was modified (at least one line removed),
+        ``False`` if unchanged or absent.
+    """
+
+    def _audit(event: str, details: str = "") -> None:
+        if audit_fn:
+            audit_fn(event, details)
+
+    try:
+        with open(authorized_keys_path, "r") as f:
+            lines = f.readlines()
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return False
+
+    kept: list[str] = []
+    removed_count = 0
+    for line in lines:
+        stripped = line.rstrip("\n")
+        parts = stripped.split()
+        # Key lines have at least two space-separated fields: algorithm + blob.
+        # Remove only lines whose blob (parts[1]) matches exactly — no
+        # substring matching, no comment matching.
+        if len(parts) >= 2 and parts[1] == target_blob:
+            removed_count += 1
+            # Audit without logging the key blob itself.
+            _audit("LEGACY_ROOT_KEY_REMOVED", "removed exact historical root support key")
+        else:
+            kept.append(line)
+
+    if removed_count == 0:
+        return False
+
+    # Atomic write: mkstemp in same directory + os.replace
+    auth_dir = os.path.dirname(os.path.abspath(authorized_keys_path))
+    fd, tmp = tempfile.mkstemp(dir=auth_dir, prefix=".authorized_keys_tmp")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.writelines(kept)
+        os.chmod(tmp, 0o600)
+        os.replace(tmp, authorized_keys_path)
+    except Exception:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        return False
+
+    _audit(
+        "LEGACY_ROOT_KEY_CLEANUP_COMPLETE",
+        f"removed={removed_count} keys_retained={len(kept)}",
+    )
+    return True
+
+
+def migrate_legacy_njalla_script(
+    script_path: str,
+    validate_fn: Callable[[str], str],
+    save_fn: Callable[[list[str]], None],
+    load_fn: Callable[[], list[str]],
+    *,
+    audit_fn: Callable[[str, str], None] | None = None,
+) -> None:
+    """Safely migrate legacy curl DDNS lines from a njalla.sh script to JSON store.
+
+    Reads the script **without** executing or sourcing it.  Parses only the
+    exact narrow curl-pattern lines (quoted or unquoted) written by old Hub
+    versions.  Any other line is silently discarded — never executed or logged
+    (it may contain secret tokens).
+
+    On successful persistence the script is archived with mode ``0o000`` so
+    it can no longer be executed.  If persistence fails the script is left
+    **untouched**.
+
+    Args:
+        script_path: Path to the legacy njalla.sh file.
+        validate_fn: URL validation function; raises ``ValueError`` on invalid
+            URLs.  Callers must substitute the ``${IP}`` placeholder before
+            calling — this function passes ``url.replace("${IP}", "127.0.0.1")``
+            to the validator.
+        save_fn: Callable that atomically writes a ``list[str]`` URL list to
+            the persistent JSON store.
+        load_fn: Callable that returns the current ``list[str]`` URL list from
+            the persistent store.
+        audit_fn: Optional callback ``(event: str, details: str)`` for audit
+            logging.  Token-bearing URLs are **never** passed to this callback.
+    """
+
+    def _audit(event: str, details: str = "") -> None:
+        if audit_fn:
+            audit_fn(event, details)
+
+    try:
+        with open(script_path, "r") as f:
+            content = f.read()
+    except FileNotFoundError:
+        return
+    except OSError:
+        return
+
+    existing_urls = load_fn()
+
+    new_urls: list[str] = []
+    for raw_line in content.splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#") or line.startswith("IP=") or line.startswith("#!/"):
+            continue
+        m = _LEGACY_NJALLA_CURL_RE.match(line)
+        if not m:
+            # Unrecognised line — discard silently, do NOT log (may contain tokens)
+            continue
+        # group(1) = quoted form, group(2) = unquoted form
+        raw_url = m.group(1) or m.group(2)
+        # Substitute placeholder so host/scheme/path validation works
+        url_to_validate = raw_url.replace("${IP}", "127.0.0.1")
+        try:
+            validate_fn(url_to_validate)
+        except ValueError:
+            continue  # Silently discard invalid/non-Njal.la URLs
+        if raw_url not in existing_urls and raw_url not in new_urls:
+            new_urls.append(raw_url)
+
+    if new_urls:
+        combined = existing_urls + new_urls
+        try:
+            save_fn(combined)
+        except Exception:
+            # Persistence failed — leave the script untouched, return without
+            # archiving so the migration can be retried.
+            return
+        _audit("NJALLA_MIGRATION", f"migrated {len(new_urls)} DDNS URLs from legacy script")
+
+    # Archive: remove all permission bits so cron/any mechanism cannot run it
+    try:
+        os.chmod(script_path, 0o000)
+    except OSError:
+        pass
+
+
+def expire_if_stale(
+    status_file: str,
+    *,
+    clock_fn: Callable[[], float] | None = None,
+    disable_fn: Callable[[], bool] | None = None,
+    audit_fn: Callable[[str, str], None] | None = None,
+    session_id: str | None = None,
+    expected_expiry: float | None = None,
+    max_session_seconds: float = 86400.0,
+) -> bool:
+    """Expire a support session if its deadline has passed.
+
+    **Stale-timer guard:** when ``session_id`` and/or ``expected_expiry`` are
+    provided (used by the server-side timer callback), the stored session
+    metadata is compared field-by-field.  A mismatch means a replacement
+    session has been started after this timer was scheduled; in that case the
+    function returns ``False`` without touching anything.
+
+    Args:
+        status_file: Path to the JSON session metadata file.
+        clock_fn: Callable returning current Unix time (default: ``time.time``).
+        disable_fn: Callable that performs the full disable sequence — removes
+            the support key, removes wallet-unlock metadata, restores deny
+            ACLs, clears session metadata, and audits the event.  If ``None``,
+            expiry is detected but no action is taken (useful for tests that
+            want to inspect detection only).
+        audit_fn: Optional callback ``(event: str, details: str)`` for audit
+            logging.
+        session_id: If given, expiry is skipped unless the stored
+            ``session_id`` field matches exactly.
+        expected_expiry: If given, expiry is skipped unless the stored
+            ``expires_at`` field matches exactly.
+        max_session_seconds: Legacy fallback: maximum age (from ``enabled_at``)
+            when ``expires_at`` is absent.
+
+    Returns:
+        ``True`` if a session was expired, ``False`` otherwise.
+    """
+    _now = clock_fn if clock_fn is not None else _time_module.time
+
+    def _audit(event: str, details: str = "") -> None:
+        if audit_fn:
+            audit_fn(event, details)
+
+    def _disable() -> bool:
+        return disable_fn() if disable_fn is not None else True
+
+    try:
+        with open(status_file, "r") as f:
+            info = json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError):
+        return False
+
+    # Stale-timer guard
+    if session_id is not None and info.get("session_id") != session_id:
+        return False
+    if expected_expiry is not None and info.get("expires_at") != expected_expiry:
+        return False
+
+    expires_at = info.get("expires_at")
+    now = _now()
+
+    if expires_at is None:
+        enabled_at = info.get("enabled_at", 0)
+        if enabled_at and (now - enabled_at) > max_session_seconds:
+            _audit("SUPPORT_EXPIRED", "legacy session without expires_at exceeded max duration")
+            _disable()
+            return True
+        return False
+
+    if now >= expires_at:
+        _audit("SUPPORT_EXPIRED", f"session expired at {expires_at:.0f}")
+        _disable()
+        return True
+
+    return False
@@ -18,6 +18,45 @@ def is_active(unit: str, scope: Literal["system", "user"] = "system") -> str:
    return _run(["systemctl", f"--{scope}", "is-active", unit]) or "unknown"


+def active_states(units_by_scope: dict[str, list[str]], timeout: float = 5) -> dict[tuple[str, str], str]:
+    """Return active states for many units with one systemctl call per scope.
+
+    The dashboard polls service state frequently. Spawning one ``systemctl``
+    process per tile makes a slow or unavailable system bus multiply the delay
+    (and can make the first dashboard render wait through many timeouts).  The
+    ``is-active`` command accepts multiple units, so batch them and cap the
+    whole batch at a single timeout.
+    """
+    states: dict[tuple[str, str], str] = {}
+    valid_scopes = {"system", "user"}
+
+    for scope, units in units_by_scope.items():
+        unique_units = list(dict.fromkeys(unit for unit in units if unit))
+        if not unique_units:
+            continue
+        if scope not in valid_scopes:
+            for unit in unique_units:
+                states[(scope, unit)] = "unknown"
+            continue
+
+        try:
+            result = subprocess.run(
+                ["systemctl", f"--{scope}", "is-active", "--", *unique_units],
+                capture_output=True,
+                text=True,
+                timeout=timeout,
+            )
+            lines = result.stdout.splitlines()
+            for index, unit in enumerate(unique_units):
+                state = lines[index].strip() if index < len(lines) else ""
+                states[(scope, unit)] = state or "unknown"
+        except Exception:
+            for unit in unique_units:
+                states[(scope, unit)] = "unknown"
+
+    return states
+
+
 def is_enabled(unit: str, scope: Literal["system", "user"] = "system") -> str:
    return _run(["systemctl", f"--{scope}", "is-enabled", unit]) or "unknown"

@@ -21,7 +21,14 @@
  <!-- Header bar -->
  <header class="header-bar">
    <img src="/static/sovran-hub-icon.svg" alt="Sovran Hub" class="header-logo" />
-    <span class="title">Sovran_SystemsOS Hub</span>
+
+    <div class="title-group">
+      <span class="title">Sovran_SystemsOS Hub</span>
+
+      <!-- OS Version Badge — styled identically to the version badge in service modals -->
+      <span class="os-version-badge" id="os-version-badge" title="Sovran_SystemsOS Version">v{{ sovran_version }}</span>
+    </div>
+
    <div class="header-buttons">
      <span class="role-badge" id="role-badge">Loading…</span>
      <button class="btn btn-header-reboot" id="btn-header-reboot" title="Restart the entire computer">Reboot</button>
@@ -48,7 +55,12 @@
      <div id="sidebar-support"></div>
      <div id="sidebar-features"></div>
    </aside>
-    <div id="tiles-area"></div>
+    <div id="tiles-area">
+      <div class="dashboard-loading" role="status" aria-live="polite">
+        <span class="dashboard-loading-spinner" aria-hidden="true"></span>
+        <span>Loading service status…</span>
+      </div>
+    </div>
  </main>

  <!-- Update modal -->
@@ -62,6 +74,7 @@
      <div class="modal-log" id="modal-log" aria-live="polite"></div>
      <div class="modal-footer">
        <button class="btn btn-save" id="btn-save-report" style="display:none">Save Error Report</button>
+        <button class="btn btn-save" id="btn-retry-update-status" style="display:none">Retry Status</button>
        <button class="btn btn-reboot" id="btn-reboot" style="display:none">Restart Entire System</button>
        <button class="btn btn-close-modal" id="btn-close-modal" disabled>Close</button>
      </div>
@@ -184,22 +197,14 @@
          encrypted messaging, password management, cloud storage, website hosting, and more.
        </p>
        <div class="upgrade-info-box">
-          <p class="upgrade-info-title">⚠ What you should know:</p>
+          <p class="upgrade-info-title">Simple, guided setup:</p>
          <ul class="upgrade-info-list">
-            <li>You will need to purchase domains for your services — <a href="https://njal.la" target="_blank" rel="noopener noreferrer">Njal.la</a> is the only supported domain provider</li>
-            <li>Some services require ports to be opened on your router</li>
-          </ul>
-        </div>
-        <div class="upgrade-info-box">
-          <p class="upgrade-info-title">ℹ️ Good to know:</p>
-          <ul class="upgrade-info-list">
-            <li>Your services will be accessible via your home internet connection. Your approximate geographic area may be visible through DNS records — this is normal for all self-hosted services</li>
-            <li>Your Bitcoin node remains fully private over Tor</li>
+            <li>Sovran_SystemsOS walks you through getting your domain from <a href="https://njal.la" target="_blank" rel="noopener noreferrer">Njal.la</a> and connecting your services</li>
+            <li>To make your services available outside your home, complete one router task: forward ports <strong>80 and 443</strong> to this computer</li>
          </ul>
        </div>
        <p class="support-desc">
-          <strong>Don't worry</strong> — the Hub will walk you through every step after the upgrade.
-          Domain setup, port forwarding, and configuration are all guided.
+          The Hub guides you through every step.
        </p>
        <p class="support-desc upgrade-rebuild-note">
          The system will rebuild after upgrading. This may take several minutes.
@@ -302,6 +307,7 @@
  <script src="/static/js/constants.js?v={{ asset_version }}"></script>
  <script src="/static/js/state.js?v={{ asset_version }}"></script>
  <script src="/static/js/helpers.js?v={{ asset_version }}"></script>
+  <script src="/static/js/domain-prereqs.js?v={{ asset_version }}"></script>
  <script src="/static/js/tiles.js?v={{ asset_version }}"></script>
  <script src="/static/js/service-detail.js?v={{ asset_version }}"></script>
  <script src="/static/js/support.js?v={{ asset_version }}"></script>
@@ -34,8 +34,6 @@
      <span class="onboarding-step-dot" data-step="3">3</span>
      <span class="onboarding-step-connector"></span>
      <span class="onboarding-step-dot" data-step="4">4</span>
-      <span class="onboarding-step-connector"></span>
-      <span class="onboarding-step-dot" data-step="5">5</span>
    </div>

    <!-- Step panels -->
@@ -125,11 +123,10 @@
      <div class="onboarding-panel" id="step-3" style="display:none">
        <div class="onboarding-step-header">
          <span class="onboarding-step-icon">🌐</span>
-          <h2 class="onboarding-step-title">Domain Configuration</h2>
+          <h2 class="onboarding-step-title">Connect Your Services</h2>
          <p class="onboarding-step-desc">
-            Sovran_SystemsOS uses <strong><a href="https://njal.la" target="_blank" style="color: var(--accent-color);">Njal.la</a></strong> for domains and Dynamic DNS.
-            Create an account at Njal.la, then for each service below, add a <strong>Dynamic</strong> record — no IP needed, it auto-populates once the DDNS curl command runs.
-            Paste the curl command from your Njal.la dashboard for each service.
+            Sovran_SystemsOS walks you through getting your domain from <strong><a href="https://njal.la" target="_blank" style="color: var(--accent-color);">Njal.la</a></strong> and connecting your services.
+            To make your services available outside your home, you’ll complete one router task: forward ports <strong>80</strong> and <strong>443</strong> to this computer.
          </p>
        </div>
        <div class="onboarding-card" id="step-3-body">
@@ -144,29 +141,8 @@
        </div>
      </div>

-      <!-- ── Step 4: Port Forwarding ── -->
+      <!-- ── Step 4: Complete ── -->
      <div class="onboarding-panel" id="step-4" style="display:none">
-        <div class="onboarding-step-header">
-          <span class="onboarding-step-icon">🔌</span>
-          <h2 class="onboarding-step-title">Router Setup</h2>
-          <p class="onboarding-step-desc">
-            Forward these ports in your router to this Sovran_SystemsOS computer. These rules let people reach your services from outside your home network.
-            <strong>Ports 80 and 443 are required for HTTPS and SSL certificates.</strong>
-          </p>
-        </div>
-        <div class="onboarding-card" id="step-4-body">
-          <p class="onboarding-loading">Loading router setup…</p>
-        </div>
-        <div class="onboarding-footer">
-          <button class="btn btn-close-modal onboarding-btn-back" data-prev="3">← Back</button>
-          <button class="btn btn-primary onboarding-btn-next" id="step-4-next">
-            Continue →
-          </button>
-        </div>
-      </div>
-
-      <!-- ── Step 5: Complete ── -->
-      <div class="onboarding-panel" id="step-5" style="display:none">
        <div class="onboarding-hero">
          <div class="onboarding-logo">✅</div>
          <h1 class="onboarding-title">Your Sovran_SystemsOS is Ready!</h1>
@@ -180,12 +156,11 @@
          <ul class="onboarding-checklist" id="onboarding-checklist">
            <li>✅ Timezone &amp; locale configured</li>
            <li>✅ Domain configuration saved</li>
-            <li>✅ Port forwarding reviewed</li>
          </ul>
        </div>
        <div class="onboarding-footer">
-          <button class="btn btn-close-modal onboarding-btn-back" data-prev="4">← Back</button>
-          <button class="btn btn-primary" id="step-5-finish">
+          <button class="btn btn-close-modal onboarding-btn-back" data-prev="3">← Back</button>
+          <button class="btn btn-primary" id="step-4-finish">
            Go to Dashboard →
          </button>
        </div>
@@ -194,6 +169,7 @@
    </div><!-- /panel-wrap -->
  </div><!-- /shell -->

+  <script src="/static/js/domain-prereqs.js?v={{ asset_version }}"></script>
  <script src="/static/onboarding.js?v={{ onboarding_js_hash }}"></script>
 </body>
 </html>
@@ -0,0 +1,88 @@
+"""Update-state helpers for the Sovran Hub.
+
+The full-system updater stages a NixOS generation with ``nixos-rebuild boot``.
+That generation is not active until the machine reboots — and the same is true
+for updates started from a terminal or an SSH support session, which never go
+near the Hub's status files.
+
+The ONLY reliable indicator that a reboot is pending is NixOS itself: the
+system profile (``/nix/var/nix/profiles/system``), which ``nixos-rebuild``
+points at the newest generation on every ``boot`` AND every ``switch``, versus
+``/run/current-system``, the generation actually running since the last boot.
+When the two differ, a staged generation has not been booted yet.
+
+Earlier revisions reconstructed this from a marker file and log tails written
+by the Hub's own updater.  Any system updated by other means — or whose
+``REBOOT_REQUIRED`` status was written by an updater older than the marker
+feature — left the Hub showing "Restart required" forever: the recorded
+generation could never equal the (since advanced) running one, so the marker
+could never be cleared.
+
+This module has no FastAPI or systemd dependencies so the policy can be tested
+without importing the Hub server.
+"""
+
+from __future__ import annotations
+
+import os
+
+# The NixOS system profile.  ``nixos-rebuild boot`` and ``nixos-rebuild
+# switch`` both add a generation here; ``boot`` additionally makes it the
+# bootloader default.  The path is a symlink chain (``system`` ->
+# ``system-N-link`` -> ``/nix/store/...-nixos-system-...``).
+BOOT_PROFILE_PATH = "/nix/var/nix/profiles/system"
+CURRENT_SYSTEM_PATH = "/run/current-system"
+
+
+def reboot_is_pending(
+    boot_profile_path: str = BOOT_PROFILE_PATH,
+    current_system_path: str = CURRENT_SYSTEM_PATH,
+) -> bool:
+    """Return whether a staged NixOS generation has not been booted yet.
+
+    This is deliberately independent of how the update was started — Hub
+    "Update System", terminal ``nixos-rebuild boot``, or a support session all
+    move the system profile the same way:
+
+    * after ``nixos-rebuild boot``:  profile -> new, current -> old  → pending
+    * after rebooting:               both -> new                     → cleared
+    * after ``nixos-rebuild switch``: both move together             → no reboot
+      ever needed (switch activates immediately)
+    * after a rollback:              both point at the rollback target → cleared
+
+    Unreadable or missing paths are treated as "not pending": the Hub must
+    never demand a reboot it cannot substantiate.
+    """
+    try:
+        boot_default = os.path.realpath(boot_profile_path)
+        current = os.path.realpath(current_system_path)
+    except OSError:
+        return False
+    if not os.path.exists(boot_default) or not os.path.exists(current):
+        return False
+    return boot_default != current
+
+
+def effective_update_status(
+    status: str,
+    boot_profile_path: str = BOOT_PROFILE_PATH,
+    current_system_path: str = CURRENT_SYSTEM_PATH,
+) -> str:
+    """Map a persisted Hub status to the one that reflects live NixOS state.
+
+    Only ``REBOOT_REQUIRED`` is re-validated: it means "the update staged a
+    generation the machine has not booted into", a claim that must stay true
+    no matter which tool performed the last update.  When the boot default IS
+    the running system the claim is stale — the staged generation booted, was
+    superseded by a newer update, or the marker was written by an updater that
+    could never clear it — so the effective status is ``IDLE``.
+
+    All other statuses (``RUNNING``, ``FAILED``, ``SUCCESS``, ``IDLE``) pass
+    through unchanged; RUNNING staleness is handled separately against the
+    systemd unit itself.
+    """
+    if status == "REBOOT_REQUIRED" and not reboot_is_pending(
+        boot_profile_path, current_system_path
+    ):
+        return "IDLE"
+    return status
@@ -0,0 +1,16 @@
+{
+  "caddy.service": "2.8.4",
+  "tor.service": "0.4.8.12",
+  "gnome-remote-desktop.service": "46.0",
+  "bitcoind.service": "27.1.0",
+  "electrs.service": "0.10.6",
+  "lnd.service": "0.18.0",
+  "rtl.service": "0.15.10",
+  "btcpayserver.service": "2.4.2",
+  "albyhub.service": "1.24.0",
+  "mempool.service": "3.2.1",
+  "matrix-synapse.service": "1.115.0",
+  "livekit.service": "1.13.6",
+  "vaultwarden.service": "1.32.0",
+  "haven-relay.service": "0.1.0"
+}
@@ -1,166 +0,0 @@
-import unittest
-from unittest.mock import patch
-from pathlib import Path
-import sys
-import types
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-
-
-def _install_web_stubs():
-    if "fastapi" in sys.modules:
-        return
-
-    class _HTTPException(Exception):
-        def __init__(self, status_code=None, detail=None):
-            super().__init__(detail)
-            self.status_code = status_code
-            self.detail = detail
-
-    class _FastAPI:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        def mount(self, *args, **kwargs):
-            return None
-
-        def add_middleware(self, *args, **kwargs):
-            return None
-
-        def __getattr__(self, _name):
-            def _decorator_factory(*args, **kwargs):
-                def _decorator(func):
-                    return func
-
-                return _decorator
-
-            return _decorator_factory
-
-    class _BaseModel:
-        pass
-
-    class _StaticFiles:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _Jinja2Templates:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _BaseHTTPMiddleware:
-        pass
-
-    fastapi_module = types.ModuleType("fastapi")
-    fastapi_module.FastAPI = _FastAPI
-    fastapi_module.HTTPException = _HTTPException
-    sys.modules["fastapi"] = fastapi_module
-
-    responses_module = types.ModuleType("fastapi.responses")
-    responses_module.HTMLResponse = object
-    responses_module.JSONResponse = object
-    responses_module.RedirectResponse = object
-    sys.modules["fastapi.responses"] = responses_module
-
-    staticfiles_module = types.ModuleType("fastapi.staticfiles")
-    staticfiles_module.StaticFiles = _StaticFiles
-    sys.modules["fastapi.staticfiles"] = staticfiles_module
-
-    templating_module = types.ModuleType("fastapi.templating")
-    templating_module.Jinja2Templates = _Jinja2Templates
-    sys.modules["fastapi.templating"] = templating_module
-
-    requests_module = types.ModuleType("fastapi.requests")
-    requests_module.Request = object
-    sys.modules["fastapi.requests"] = requests_module
-
-    pydantic_module = types.ModuleType("pydantic")
-    pydantic_module.BaseModel = _BaseModel
-    sys.modules["pydantic"] = pydantic_module
-
-    starlette_base_module = types.ModuleType("starlette.middleware.base")
-    starlette_base_module.BaseHTTPMiddleware = _BaseHTTPMiddleware
-    sys.modules["starlette.middleware.base"] = starlette_base_module
-
-    starlette_middleware_module = types.ModuleType("starlette.middleware")
-    starlette_middleware_module.base = starlette_base_module
-    sys.modules["starlette.middleware"] = starlette_middleware_module
-
-    starlette_module = types.ModuleType("starlette")
-    starlette_module.middleware = starlette_middleware_module
-    sys.modules["starlette"] = starlette_module
-
-
-_install_web_stubs()
-from sovran_systemsos_web import server
-
-
-class Bip110StatusTests(unittest.TestCase):
-    def _status(self, deploy_info, net_info):
-        with patch.object(server, "_get_bitcoin_deployment_info", return_value=deploy_info), patch.object(
-            server, "_get_bitcoin_version_info", return_value=net_info
-        ):
-            return server._get_bip110_status()
-
-    def test_started_reduced_data_reports_signaling(self):
-        deploy_info = {
-            "deployments": {
-                "reduced_data": {
-                    "type": "bip9",
-                    "active": False,
-                    "bip9": {
-                        "bit": 4,
-                        "status": "started",
-                        "statistics": {"elapsed": 833, "count": 4, "threshold": 1109},
-                        "signalling": "--#--",
-                    },
-                }
-            }
-        }
-
-        result = self._status(deploy_info, {"subversion": "/Satoshi:29.0.0/"})
-        self.assertEqual(
-            result,
-            {"supported": True, "signaling": True, "state": "signaling", "source": "getdeploymentinfo"},
-        )
-
-    def test_active_reduced_data_reports_active(self):
-        deploy_info = {
-            "deployments": {"reduced_data": {"active": True, "bip9": {"bit": 4, "status": "active"}}}
-        }
-
-        result = self._status(deploy_info, {"subversion": "/Satoshi:29.0.0/"})
-        self.assertEqual(result["state"], "active")
-        self.assertTrue(result["supported"])
-        self.assertTrue(result["signaling"])
-        self.assertEqual(result["source"], "getdeploymentinfo")
-
-    def test_locked_in_reduced_data_reports_locked_in(self):
-        deploy_info = {
-            "deployments": {"reduced_data": {"active": False, "bip9": {"bit": 4, "status": "locked_in"}}}
-        }
-
-        result = self._status(deploy_info, {"subversion": "/Satoshi:29.0.0/"})
-        self.assertEqual(result["state"], "locked_in")
-        self.assertTrue(result["supported"])
-        self.assertTrue(result["signaling"])
-        self.assertEqual(result["source"], "getdeploymentinfo")
-
-    def test_no_bip110_deployment_and_plain_subversion_reports_unsupported(self):
-        deploy_info = {
-            "deployments": {
-                "taproot": {"type": "bip9", "active": True, "bip9": {"bit": 2, "status": "active"}},
-            }
-        }
-        result = self._status(deploy_info, {"subversion": "/Satoshi:27.0.0/"})
-        self.assertEqual(
-            result,
-            {"supported": False, "signaling": False, "state": "unsupported", "source": "subversion"},
-        )
-
-    def test_node_unreachable_reports_unknown(self):
-        result = self._status(None, None)
-        self.assertEqual(result, {"supported": False, "signaling": False, "state": "unknown", "source": "none"})
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,44 +0,0 @@
-import unittest
-from pathlib import Path
-
-
-HUB_NIX = Path(__file__).resolve().parents[2] / "modules" / "core" / "sovran-hub.nix"
-
-
-def _section(source: str, start: str, end: str) -> str:
-    start_idx = source.find(start)
-    if start_idx == -1:
-        raise AssertionError(f"Expected section start not found: {start!r}")
-    end_idx = source.find(end, start_idx)
-    if end_idx == -1:
-        raise AssertionError(f"Expected section end not found: {end!r}")
-    return source[start_idx:end_idx]
-
-
-class HubUpdateBootStagingTests(unittest.TestCase):
-    def setUp(self):
-        self.source = HUB_NIX.read_text()
-        self.update_section = _section(
-            self.source,
-            'update-script = pkgs.writeShellScript "sovran-hub-update.sh" \'\'',
-            "# ── Rebuild wrapper script",
-        )
-        self.rebuild_section = _section(
-            self.source,
-            'rebuild-script = pkgs.writeShellScript "sovran-hub-rebuild.sh" \'\'',
-            "# ── Brave launcher wrapper",
-        )
-
-    def test_full_update_uses_boot_not_switch(self):
-        self.assertIn("nixos-rebuild boot --flake /etc/nixos", self.update_section)
-        self.assertNotIn("nixos-rebuild switch --flake /etc/nixos", self.update_section)
-
-    def test_full_update_marks_reboot_required(self):
-        self.assertIn('echo "REBOOT_REQUIRED" > "$STATUS"', self.update_section)
-
-    def test_rebuild_path_keeps_switch_semantics(self):
-        self.assertIn("nixos-rebuild switch --flake /etc/nixos", self.rebuild_section)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,399 +0,0 @@
-"""Tests for server-local loopback diagnostics and domain validation.
-
-Covers:
- Domain value validation and injection prevention.
- Loopback address detection (IPv4 and IPv6).
- _resolve_all_addresses returning multiple addresses.
- _check_domain_health_fast with loopback resolution.
- _evaluate_domain_checklist with loopback override — no false dns_mismatch.
- _evaluate_domain_checklist with genuine DNS mismatch — still reports error.
- api_services health stays "healthy" when domain resolves to loopback.
- api_services health stays "needs_attention" when DNS is genuinely wrong.
- api_domains_check returns "local_override" for loopback-resolved domains.
-"""
-
-import unittest
-from pathlib import Path
-from unittest.mock import MagicMock, mock_open, patch
-import sys
-import types
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-
-
-# ---------------------------------------------------------------------------
-# Minimal stubs so server.py can be imported without the full FastAPI stack.
-# ---------------------------------------------------------------------------
-
-def _install_web_stubs():
-    if "fastapi" in sys.modules:
-        return
-
-    class _HTTPException(Exception):
-        def __init__(self, status_code=None, detail=None):
-            super().__init__(detail)
-            self.status_code = status_code
-            self.detail = detail
-
-    class _FastAPI:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        def mount(self, *args, **kwargs):
-            return None
-
-        def add_middleware(self, *args, **kwargs):
-            return None
-
-        def __getattr__(self, _name):
-            def _decorator_factory(*args, **kwargs):
-                def _decorator(func):
-                    return func
-                return _decorator
-            return _decorator_factory
-
-    class _BaseModel:
-        pass
-
-    class _StaticFiles:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _Jinja2Templates:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _BaseHTTPMiddleware:
-        pass
-
-    fastapi_module = types.ModuleType("fastapi")
-    fastapi_module.FastAPI = _FastAPI
-    fastapi_module.HTTPException = _HTTPException
-    sys.modules["fastapi"] = fastapi_module
-
-    responses_module = types.ModuleType("fastapi.responses")
-    responses_module.HTMLResponse = object
-    responses_module.JSONResponse = object
-    responses_module.RedirectResponse = object
-    sys.modules["fastapi.responses"] = responses_module
-
-    staticfiles_module = types.ModuleType("fastapi.staticfiles")
-    staticfiles_module.StaticFiles = _StaticFiles
-    sys.modules["fastapi.staticfiles"] = staticfiles_module
-
-    templating_module = types.ModuleType("fastapi.templating")
-    templating_module.Jinja2Templates = _Jinja2Templates
-    sys.modules["fastapi.templating"] = templating_module
-
-    requests_module = types.ModuleType("fastapi.requests")
-    requests_module.Request = object
-    sys.modules["fastapi.requests"] = requests_module
-
-    pydantic_module = types.ModuleType("pydantic")
-    pydantic_module.BaseModel = _BaseModel
-    sys.modules["pydantic"] = pydantic_module
-
-    starlette_base_module = types.ModuleType("starlette.middleware.base")
-    starlette_base_module.BaseHTTPMiddleware = _BaseHTTPMiddleware
-    sys.modules["starlette.middleware.base"] = starlette_base_module
-
-    starlette_middleware_module = types.ModuleType("starlette.middleware")
-    starlette_middleware_module.base = starlette_base_module
-    sys.modules["starlette.middleware"] = starlette_middleware_module
-
-    starlette_module = types.ModuleType("starlette")
-    starlette_module.middleware = starlette_middleware_module
-    sys.modules["starlette"] = starlette_module
-
-
-_install_web_stubs()
-from sovran_systemsos_web import server  # noqa: E402
-
-
-# ===========================================================================
-# Domain value validation
-# ===========================================================================
-
-class TestValidateDomainValue(unittest.TestCase):
-    """_validate_domain_value must reject anything that could corrupt /etc/hosts."""
-
-    def _v(self, value: str) -> bool:
-        return server._validate_domain_value(value)
-
-    # -- Valid values --------------------------------------------------------
-
-    def test_simple_domain_valid(self):
-        self.assertTrue(self._v("cloud.example.com"))
-
-    def test_subdomain_valid(self):
-        self.assertTrue(self._v("matrix.home.example.org"))
-
-    def test_single_label_with_tld_valid(self):
-        self.assertTrue(self._v("example.com"))
-
-    def test_hyphen_in_domain_valid(self):
-        self.assertTrue(self._v("my-nextcloud.example.com"))
-
-    # -- Injection / malformed values ----------------------------------------
-
-    def test_empty_string_invalid(self):
-        self.assertFalse(self._v(""))
-
-    def test_newline_injection_invalid(self):
-        self.assertFalse(self._v("evil.com\n127.0.0.1 other.host"))
-
-    def test_carriage_return_injection_invalid(self):
-        self.assertFalse(self._v("evil.com\r127.0.0.1 other.host"))
-
-    def test_space_injection_invalid(self):
-        self.assertFalse(self._v("evil.com 127.0.0.1"))
-
-    def test_hash_comment_injection_invalid(self):
-        self.assertFalse(self._v("evil.com# comment"))
-
-    def test_bare_hostname_no_dot_invalid(self):
-        self.assertFalse(self._v("localhost"))
-
-    def test_bare_ip_invalid(self):
-        self.assertFalse(self._v("192.168.1.1"))
-
-    def test_too_long_invalid(self):
-        self.assertFalse(self._v("a" * 254 + ".com"))
-
-    def test_leading_dot_invalid(self):
-        self.assertFalse(self._v(".example.com"))
-
-    def test_trailing_dot_invalid(self):
-        self.assertFalse(self._v("example.com."))
-
-
-# ===========================================================================
-# Loopback address detection
-# ===========================================================================
-
-class TestIsLoopbackAddress(unittest.TestCase):
-
-    def test_ipv4_loopback(self):
-        self.assertTrue(server._is_loopback_address("127.0.0.1"))
-
-    def test_ipv4_loopback_other(self):
-        self.assertTrue(server._is_loopback_address("127.0.0.2"))
-
-    def test_ipv4_loopback_high(self):
-        self.assertTrue(server._is_loopback_address("127.255.255.255"))
-
-    def test_ipv6_loopback(self):
-        self.assertTrue(server._is_loopback_address("::1"))
-
-    def test_public_ipv4_not_loopback(self):
-        self.assertFalse(server._is_loopback_address("203.0.113.10"))
-
-    def test_private_ipv4_not_loopback(self):
-        self.assertFalse(server._is_loopback_address("192.168.1.50"))
-
-    def test_ipv6_public_not_loopback(self):
-        self.assertFalse(server._is_loopback_address("2001:db8::1"))
-
-    def test_invalid_string_not_loopback(self):
-        self.assertFalse(server._is_loopback_address("not-an-ip"))
-
-
-# ===========================================================================
-# _check_domain_health_fast
-# ===========================================================================
-
-class TestCheckDomainHealthFast(unittest.TestCase):
-    """_check_domain_health_fast returns True when there is an issue,
-    False when everything looks fine."""
-
-    def _fast(self, domain, external_ip, resolved_addrs):
-        with patch.object(server, "_resolve_all_addresses", return_value=resolved_addrs):
-            return server._check_domain_health_fast(domain, external_ip)
-
-    def test_no_domain_no_issue(self):
-        # None/empty domain: the fast check reports True (handled by checklist).
-        result = server._check_domain_health_fast(None, "203.0.113.10")
-        self.assertTrue(result)
-
-    def test_empty_domain_no_issue(self):
-        result = server._check_domain_health_fast("", "203.0.113.10")
-        self.assertTrue(result)
-
-    def test_loopback_ipv4_no_issue(self):
-        """Loopback override must not be flagged as a DNS mismatch."""
-        result = self._fast("cloud.example.com", "203.0.113.10", ["127.0.0.1"])
-        self.assertFalse(result)
-
-    def test_loopback_ipv6_no_issue(self):
-        result = self._fast("cloud.example.com", "203.0.113.10", ["::1"])
-        self.assertFalse(result)
-
-    def test_matches_external_ip_no_issue(self):
-        result = self._fast("cloud.example.com", "203.0.113.10", ["203.0.113.10"])
-        self.assertFalse(result)
-
-    def test_mismatch_is_an_issue(self):
-        result = self._fast("cloud.example.com", "203.0.113.10", ["198.51.100.1"])
-        self.assertTrue(result)
-
-    def test_unavailable_external_ip_no_issue(self):
-        result = self._fast("cloud.example.com", "unavailable", ["198.51.100.1"])
-        self.assertFalse(result)
-
-    def test_multiple_addresses_one_matches_no_issue(self):
-        """If any resolved address matches external_ip the check should pass."""
-        result = self._fast(
-            "cloud.example.com", "203.0.113.10",
-            ["198.51.100.1", "203.0.113.10"],
-        )
-        self.assertFalse(result)
-
-
-# ===========================================================================
-# _evaluate_domain_checklist — loopback override path
-# ===========================================================================
-
-class TestEvaluateDomainChecklistLoopback(unittest.TestCase):
-
-    def _eval(self, domain, external_ip, resolved_addrs, reachable_result=None):
-        with (
-            patch.object(server, "_resolve_all_addresses", return_value=resolved_addrs),
-            patch.object(server, "_check_domain_reachable",
-                         return_value=reachable_result or {"reachable": True, "status_code": 200}),
-        ):
-            return server._evaluate_domain_checklist(domain, external_ip)
-
-    def test_loopback_dns_step_is_ok_not_error(self):
-        result = self._eval("cloud.example.com", "203.0.113.10", ["127.0.0.1"])
-        dns_step = next(s for s in result["domain_check_steps"] if s["step"] == 2)
-        self.assertEqual(dns_step["status"], "ok")
-        self.assertNotIn("mismatch", dns_step.get("detail", "").lower())
-
-    def test_loopback_domain_status_is_local_override(self):
-        result = self._eval("cloud.example.com", "203.0.113.10", ["127.0.0.1"])
-        self.assertEqual(result["domain_status"]["status"], "local_override")
-
-    def test_loopback_has_no_issues_when_reachable(self):
-        result = self._eval(
-            "cloud.example.com", "203.0.113.10", ["127.0.0.1"],
-            reachable_result={"reachable": True, "status_code": 200},
-        )
-        self.assertFalse(result["has_issues"])
-
-    def test_loopback_has_issues_when_caddy_unreachable(self):
-        """A loopback override with Caddy down should still report an issue."""
-        result = self._eval(
-            "cloud.example.com", "203.0.113.10", ["127.0.0.1"],
-            reachable_result={"reachable": False, "error": "connection refused"},
-        )
-        self.assertTrue(result["has_issues"])
-
-    def test_ipv6_loopback_no_issue(self):
-        result = self._eval("cloud.example.com", "203.0.113.10", ["::1"])
-        self.assertEqual(result["domain_status"]["status"], "local_override")
-        self.assertFalse(result["has_issues"])
-
-    def test_genuine_mismatch_still_reports_error(self):
-        result = self._eval("cloud.example.com", "203.0.113.10", ["198.51.100.1"])
-        self.assertEqual(result["domain_status"]["status"], "dns_mismatch")
-        self.assertTrue(result["has_issues"])
-
-    def test_correct_public_dns_still_reports_ok(self):
-        result = self._eval("cloud.example.com", "203.0.113.10", ["203.0.113.10"])
-        self.assertEqual(result["domain_status"]["status"], "connected")
-        self.assertFalse(result["has_issues"])
-
-    def test_no_domain_has_issues(self):
-        result = self._eval(None, "203.0.113.10", [])
-        self.assertTrue(result["has_issues"])
-
-
-# ===========================================================================
-# api_services — composite health with loopback
-# ===========================================================================
-
-class TestApiServicesLoopbackHealth(unittest.IsolatedAsyncioTestCase):
-
-    async def _get_health(self, resolved_addrs, cached_reachable):
-        """Return the health value for a single domain-requiring service."""
-        service_cfg = {
-            "services": [
-                {"unit": "caddy.service", "icon": "nextcloud", "enabled": True, "type": "system"}
-            ]
-        }
-        with (
-            patch.object(server, "load_config", return_value=service_cfg),
-            patch.object(server, "_read_hub_overrides", return_value=({}, None, None)),
-            patch.object(server.sysctl, "is_active", return_value="active"),
-            patch.dict(server.SERVICE_DOMAIN_MAP, {"caddy.service": "nextcloud"}, clear=False),
-            patch("builtins.open", mock_open(read_data="cloud.example.com\n")),
-            patch.object(server, "_resolve_all_addresses", return_value=resolved_addrs),
-            patch.object(server, "_is_domain_reachable_cached", return_value=cached_reachable),
-            patch.object(server, "_get_listening_ports",
-                         return_value={"tcp": {80, 443}, "udp": set()}),
-            patch.object(server, "_get_firewall_allowed_ports",
-                         return_value={"tcp": set(), "udp": set()}),
-            patch.object(server, "_cached_external_ip", "203.0.113.10"),
-        ):
-            results = await server.api_services()
-
-        return results[0]["health"]
-
-    async def test_loopback_and_reachable_is_healthy(self):
-        """Loopback override + Caddy reachable → healthy, not needs_attention."""
-        health = await self._get_health(["127.0.0.1"], cached_reachable=True)
-        self.assertEqual(health, "healthy")
-
-    async def test_loopback_and_caddy_down_is_needs_attention(self):
-        """Loopback override + Caddy unreachable → needs_attention (genuine issue)."""
-        health = await self._get_health(["127.0.0.1"], cached_reachable=False)
-        self.assertEqual(health, "needs_attention")
-
-    async def test_correct_dns_and_reachable_is_healthy(self):
-        health = await self._get_health(["203.0.113.10"], cached_reachable=True)
-        self.assertEqual(health, "healthy")
-
-    async def test_dns_mismatch_is_needs_attention(self):
-        health = await self._get_health(["198.51.100.1"], cached_reachable=True)
-        self.assertEqual(health, "needs_attention")
-
-
-# ===========================================================================
-# api_domains_check — loopback detection
-# ===========================================================================
-
-class TestApiDomainsCheckLoopback(unittest.IsolatedAsyncioTestCase):
-
-    async def _check(self, resolved_addrs, external_ip="203.0.113.10"):
-        with (
-            patch.object(server, "_resolve_all_addresses", return_value=resolved_addrs),
-            patch.object(server, "_cached_external_ip", external_ip),
-        ):
-            result = await server.api_domains_check(
-                MagicMock(domains=["cloud.example.com"])
-            )
-        return result["domains"][0]
-
-    async def test_loopback_ipv4_returns_local_override(self):
-        result = await self._check(["127.0.0.1"])
-        self.assertEqual(result["status"], "local_override")
-
-    async def test_loopback_ipv6_returns_local_override(self):
-        result = await self._check(["::1"])
-        self.assertEqual(result["status"], "local_override")
-
-    async def test_correct_dns_returns_connected(self):
-        result = await self._check(["203.0.113.10"])
-        self.assertEqual(result["status"], "connected")
-
-    async def test_mismatch_returns_dns_mismatch(self):
-        result = await self._check(["198.51.100.1"])
-        self.assertEqual(result["status"], "dns_mismatch")
-
-    async def test_no_resolution_returns_unresolvable(self):
-        result = await self._check([])
-        self.assertEqual(result["status"], "unresolvable")
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,122 +0,0 @@
-import unittest
-from pathlib import Path
-
-
-RDP_NIX = Path(__file__).resolve().parents[2] / "modules" / "rdp.nix"
-USERNAME_READ = "USERNAME=\"$(tr -d '\\n' < \"$USERNAME_FILE\")\""
-USERNAME_LENGTH_GUARD = "if [ \"''${#USERNAME}\" -gt 32 ]; then"
-SHORT_PASSWORD_GUARD = 'if [ "\'\'${#PASSWORD}" -lt 8 ]; then'
-
-
-def _section(source: str, start: str, end: str) -> str:
-    start_idx = source.find(start)
-    if start_idx == -1:
-        raise AssertionError(f"Expected section start not found: {start!r}")
-    end_idx = source.find(end, start_idx)
-    if end_idx == -1:
-        raise AssertionError(f"Expected section end not found: {end!r}")
-    return source[start_idx:end_idx]
-
-
-class RdpModuleBootSetupTests(unittest.TestCase):
-    def setUp(self):
-        self.source = RDP_NIX.read_text()
-        self.gnome_service = _section(
-            self.source,
-            "systemd.services.gnome-remote-desktop = {",
-            "systemd.tmpfiles.rules = [",
-        )
-        self.setup_service = _section(
-            self.source,
-            "systemd.services.gnome-remote-desktop-setup = {",
-            "};\n}",
-        )
-
-    def test_does_not_redeclare_gnome_remote_desktop_user(self):
-        self.assertNotIn("users.users.gnome-remote-desktop", self.source)
-        self.assertNotIn("createHome = true;", self.source)
-
-    def test_main_service_requires_setup_before_starting(self):
-        self.assertIn('wantedBy = [ "graphical.target" ];', self.gnome_service)
-        self.assertIn('after = [ "gnome-remote-desktop-setup.service" ];', self.gnome_service)
-        self.assertIn('requires = [ "gnome-remote-desktop-setup.service" ];', self.gnome_service)
-
-    def test_setup_waits_for_configuration_service_and_bounded_timeout(self):
-        self.assertIn('wantedBy = [ "graphical.target" ];', self.setup_service)
-        self.assertIn('before = [ "gnome-remote-desktop.service" ];', self.setup_service)
-        self.assertIn('"dbus.service"', self.setup_service)
-        self.assertIn('"gnome-remote-desktop-configuration.service"', self.setup_service)
-        self.assertNotIn("RemainAfterExit", self.setup_service)
-        self.assertIn('TimeoutStartSec = "2min";', self.setup_service)
-        self.assertIn('timeout --kill-after=5s 10s', self.setup_service)
-        self.assertIn('echo "grdctl command timed out: $*" >&2', self.setup_service)
-        self.assertIn('echo "grdctl command failed (exit $rc): $*" >&2', self.setup_service)
-
-    def test_setup_runs_grdctl_directly_as_root(self):
-        # The oneshot service runs as root; grdctl --system is called directly.
-        # GRD 50.x invokes pkexec internally, but the call itself is plain
-        # grdctl --system, not a manual pkexec invocation.
-        self.assertIn('grdctl --system "$@"', self.setup_service)
-        self.assertNotIn("runuser", self.setup_service)
-        self.assertNotIn("sudo", self.setup_service)
-        # No direct Nix-store pkexec invocation (pkgs.polkit}/bin/pkexec).
-        self.assertNotIn("pkgs.polkit}/bin/pkexec", self.setup_service)
-
-    def test_privilege_escalation_packages_absent_from_setup_path(self):
-        self.assertNotIn("pkgs.polkit", self.setup_service)
-        self.assertNotIn("pkgs.util-linux", self.setup_service)
-
-    def test_run_wrappers_bin_prepended_to_path(self):
-        # /run/wrappers/bin must be prepended to PATH before any grdctl_system
-        # invocation so that grdctl --system resolves the NixOS setuid pkexec.
-        path_export = 'export PATH="/run/wrappers/bin:$PATH"'
-        grdctl_marker = "grdctl_system"
-        script = self.setup_service
-        path_idx = script.find(path_export)
-        grdctl_idx = script.find(grdctl_marker)
-        self.assertGreater(path_idx, -1, f"{path_export!r} not found in setup script")
-        self.assertGreater(
-            grdctl_idx, path_idx,
-            "PATH export must appear before the first grdctl_system usage",
-        )
-
-    def test_pkexec_preflight_check(self):
-        # A preflight must confirm /run/wrappers/bin/pkexec is executable
-        # with a clear error message before any GRD configuration changes.
-        self.assertIn("test -x /run/wrappers/bin/pkexec", self.setup_service)
-        self.assertIn(
-            "/run/wrappers/bin/pkexec is absent or not executable",
-            self.setup_service,
-        )
-
-    def test_hub_files_are_the_source_of_truth_for_username_and_password(self):
-        self.assertIn('DEFAULT_USERNAME="sovran"', self.setup_service)
-        self.assertIn('if [ ! -f "$USERNAME_FILE" ]; then', self.setup_service)
-        self.assertIn(USERNAME_READ, self.setup_service)
-        self.assertIn(USERNAME_LENGTH_GUARD, self.setup_service)
-        self.assertIn('case "$USERNAME" in', self.setup_service)
-        self.assertIn('[A-Za-z_][A-Za-z0-9_-]*)', self.setup_service)
-        self.assertIn("RDP username is too long (''${#USERNAME} characters, maximum 32)", self.setup_service)
-        self.assertIn("RDP username must start with a letter or underscore and contain only letters, numbers, underscores, and hyphens", self.setup_service)
-        self.assertIn('if [ ! -f "$PASSWORD_FILE" ]; then', self.setup_service)
-        self.assertIn("tr -d '\\n'", self.setup_service)
-        self.assertIn('"$PASSWORD_FILE"', self.setup_service)
-        self.assertIn(SHORT_PASSWORD_GUARD, self.setup_service)
-        self.assertIn("RDP password is too short (''${#PASSWORD} characters, minimum 8)", self.setup_service)
-        self.assertIn('grdctl_system rdp set-credentials "$USERNAME" "$PASSWORD"', self.setup_service)
-        self.assertNotIn('grdctl --system rdp set-credentials sovran "$PASSWORD"', self.setup_service)
-
-    def test_secure_permissions_are_enforced_for_state_and_secret_files(self):
-        self.assertIn('"d /var/lib/gnome-remote-desktop/tls 0700', self.source)
-        self.assertIn("chmod 700", self.setup_service)
-        self.assertIn('chmod 600 "$USERNAME_FILE"', self.setup_service)
-        self.assertIn('chmod 600 "$PASSWORD_FILE"', self.setup_service)
-        self.assertIn('chmod 600 "$CRED_FILE"', self.setup_service)
-        self.assertIn('chmod 600 "$TLS_DIR/rdp-tls.key"', self.setup_service)
-        self.assertIn('chmod 644 "$TLS_DIR/rdp-tls.crt"', self.setup_service)
-        self.assertIn('LOCAL_IP="$(hostname -I | awk \'{print $1}\')"', self.setup_service)
-        self.assertIn('LOCAL_IP="127.0.0.1"', self.setup_service)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,171 +0,0 @@
-import unittest
-from pathlib import Path
-from unittest.mock import mock_open, patch
-import sys
-import types
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-
-
-def _install_web_stubs():
-    if "fastapi" in sys.modules:
-        return
-
-    class _HTTPException(Exception):
-        def __init__(self, status_code=None, detail=None):
-            super().__init__(detail)
-            self.status_code = status_code
-            self.detail = detail
-
-    class _FastAPI:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        def mount(self, *args, **kwargs):
-            return None
-
-        def add_middleware(self, *args, **kwargs):
-            return None
-
-        def __getattr__(self, _name):
-            def _decorator_factory(*args, **kwargs):
-                def _decorator(func):
-                    return func
-
-                return _decorator
-
-            return _decorator_factory
-
-    class _BaseModel:
-        pass
-
-    class _StaticFiles:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _Jinja2Templates:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    class _BaseHTTPMiddleware:
-        pass
-
-    fastapi_module = types.ModuleType("fastapi")
-    fastapi_module.FastAPI = _FastAPI
-    fastapi_module.HTTPException = _HTTPException
-    sys.modules["fastapi"] = fastapi_module
-
-    responses_module = types.ModuleType("fastapi.responses")
-    responses_module.HTMLResponse = object
-    responses_module.JSONResponse = object
-    responses_module.RedirectResponse = object
-    sys.modules["fastapi.responses"] = responses_module
-
-    staticfiles_module = types.ModuleType("fastapi.staticfiles")
-    staticfiles_module.StaticFiles = _StaticFiles
-    sys.modules["fastapi.staticfiles"] = staticfiles_module
-
-    templating_module = types.ModuleType("fastapi.templating")
-    templating_module.Jinja2Templates = _Jinja2Templates
-    sys.modules["fastapi.templating"] = templating_module
-
-    requests_module = types.ModuleType("fastapi.requests")
-    requests_module.Request = object
-    sys.modules["fastapi.requests"] = requests_module
-
-    pydantic_module = types.ModuleType("pydantic")
-    pydantic_module.BaseModel = _BaseModel
-    sys.modules["pydantic"] = pydantic_module
-
-    starlette_base_module = types.ModuleType("starlette.middleware.base")
-    starlette_base_module.BaseHTTPMiddleware = _BaseHTTPMiddleware
-    sys.modules["starlette.middleware.base"] = starlette_base_module
-
-    starlette_middleware_module = types.ModuleType("starlette.middleware")
-    starlette_middleware_module.base = starlette_base_module
-    sys.modules["starlette.middleware"] = starlette_middleware_module
-
-    starlette_module = types.ModuleType("starlette")
-    starlette_module.middleware = starlette_middleware_module
-    sys.modules["starlette"] = starlette_module
-
-
-_install_web_stubs()
-from sovran_systemsos_web import server
-
-
-class ServiceDetailRouterWordingTests(unittest.IsolatedAsyncioTestCase):
-    async def test_livekit_service_detail_includes_internal_ip(self):
-        service_cfg = {
-            "services": [
-                {"unit": "livekit.service", "icon": "element-call", "enabled": True, "type": "system"}
-            ]
-        }
-        domain_eval = {
-            "domain_status": {"status": "ok"},
-            "domain_reachable": {"reachable": True},
-            "domain_check_steps": [],
-            "has_issues": False,
-        }
-
-        with (
-            patch.object(server, "load_config", return_value=service_cfg),
-            patch.object(server, "_read_hub_overrides", return_value=({}, None, None)),
-            patch.object(server.sysctl, "is_active", return_value="active"),
-            patch.dict(server.SERVICE_DOMAIN_MAP, {"livekit.service": "element-call"}, clear=False),
-            patch.dict(
-                server.SERVICE_PORT_REQUIREMENTS,
-                {"livekit.service": [{"port": "7881", "protocol": "TCP", "description": "LiveKit"}]},
-                clear=False,
-            ),
-            patch("builtins.open", mock_open(read_data="call.example.com\n")),
-            patch.object(server, "_evaluate_domain_checklist", return_value=domain_eval),
-            patch.object(server, "_get_internal_ip", return_value="192.168.1.44"),
-            patch.object(server, "_save_internal_ip"),
-            patch.object(server, "_get_listening_ports", return_value={"tcp": {7881}, "udp": set()}),
-            patch.object(server, "_get_firewall_allowed_ports", return_value={"tcp": set(), "udp": set()}),
-        ):
-            result = await server.api_service_detail("livekit.service")
-
-        self.assertEqual(result["internal_ip"], "192.168.1.44")
-        self.assertEqual(result["extra_ports"][0]["status"], "listening")
-        self.assertEqual(result["domain_check_steps"][-1]["label"], "Router Setup Needed")
-
-    async def test_livekit_router_step_uses_not_ready_yet_wording(self):
-        service_cfg = {
-            "services": [
-                {"unit": "livekit.service", "icon": "element-call", "enabled": True, "type": "system"}
-            ]
-        }
-        domain_eval = {
-            "domain_status": {"status": "ok"},
-            "domain_reachable": {"reachable": True},
-            "domain_check_steps": [],
-            "has_issues": False,
-        }
-
-        with (
-            patch.object(server, "load_config", return_value=service_cfg),
-            patch.object(server, "_read_hub_overrides", return_value=({}, None, None)),
-            patch.object(server.sysctl, "is_active", return_value="active"),
-            patch.dict(server.SERVICE_DOMAIN_MAP, {"livekit.service": "element-call"}, clear=False),
-            patch.dict(
-                server.SERVICE_PORT_REQUIREMENTS,
-                {"livekit.service": [{"port": "7881", "protocol": "TCP", "description": "LiveKit"}]},
-                clear=False,
-            ),
-            patch("builtins.open", mock_open(read_data="call.example.com\n")),
-            patch.object(server, "_evaluate_domain_checklist", return_value=domain_eval),
-            patch.object(server, "_get_internal_ip", return_value="192.168.1.44"),
-            patch.object(server, "_save_internal_ip"),
-            patch.object(server, "_get_listening_ports", return_value={"tcp": set(), "udp": set()}),
-            patch.object(server, "_get_firewall_allowed_ports", return_value={"tcp": set(), "udp": set()}),
-        ):
-            result = await server.api_service_detail("livekit.service")
-
-        self.assertEqual(result["extra_ports"][0]["status"], "closed")
-        self.assertIn("Not ready yet", result["domain_check_steps"][-1]["detail"])
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,99 +0,0 @@
-"""Regression test for Starlette 1.1.0+ TemplateResponse keyword-argument style.
-
-Prior to this fix, the three HTML routes called:
-    templates.TemplateResponse("name.html", {"request": request, ...})
-which passes the context dict as the second positional argument.  With the
-updated Starlette/FastAPI versions shipped in NixOS unstable (Starlette 1.1.0,
-FastAPI 0.136.3) that positional argument is the template name, causing Jinja2
-to receive a dict as a cache key and raise:
-    TypeError: unhashable type: 'dict'
-
-The fix updates every call to use keyword arguments:
-    templates.TemplateResponse(request=request, name="name.html", context={...})
-"""
-
-import ast
-import unittest
-from pathlib import Path
-
-
-SERVER_PY = Path(__file__).resolve().parents[1] / "sovran_systemsos_web" / "server.py"
-
-
-def _template_response_calls(source: str):
-    """Return a list of ast.Call nodes that are TemplateResponse calls."""
-    tree = ast.parse(source)
-    calls = []
-    for node in ast.walk(tree):
-        if not isinstance(node, ast.Call):
-            continue
-        func = node.func
-        if isinstance(func, ast.Attribute) and func.attr == "TemplateResponse":
-            calls.append(node)
-    return calls
-
-
-class TemplateResponseSignatureTests(unittest.TestCase):
-    def setUp(self):
-        self.source = SERVER_PY.read_text()
-        self.calls = _template_response_calls(self.source)
-
-    def test_at_least_one_template_response_call_found(self):
-        self.assertGreater(len(self.calls), 0, "No TemplateResponse calls found in server.py")
-
-    def test_no_old_style_positional_dict_context(self):
-        """No TemplateResponse call should pass a dict literal as its second positional arg.
-
-        The old style was:
-            templates.TemplateResponse("name.html", {"request": request, ...})
-        where args[0] is a string and args[1] is a Dict node.  That pattern
-        triggers the Starlette 1.1.0 bug.
-        """
-        for call in self.calls:
-            positional = call.args
-            if len(positional) >= 2 and isinstance(positional[1], ast.Dict):
-                self.fail(
-                    f"Found old-style TemplateResponse call at line {call.lineno}: "
-                    "second positional argument is a dict literal.  "
-                    "Use keyword arguments (request=, name=, context=) instead."
-                )
-
-    def test_request_not_duplicated_in_context(self):
-        """The 'request' key must not appear inside the context= dict when
-        request= is already passed as a dedicated keyword argument."""
-        for call in self.calls:
-            kw_dict = {kw.arg: kw.value for kw in call.keywords if isinstance(kw, ast.keyword)}
-
-            if "request" not in kw_dict:
-                continue  # no request= kwarg, nothing to check
-
-            context_node = kw_dict.get("context")
-            if not isinstance(context_node, ast.Dict):
-                continue
-
-            for key_node in context_node.keys:
-                if isinstance(key_node, ast.Constant) and key_node.value == "request":
-                    self.fail(
-                        f"TemplateResponse at line {call.lineno} passes 'request' both as "
-                        "request= keyword argument and inside the context dict."
-                    )
-
-    def test_all_calls_use_keyword_arguments(self):
-        """Every TemplateResponse call should use keyword arguments for request, name,
-        and context rather than relying on positional ordering."""
-        for call in self.calls:
-            kw_args = {kw.arg for kw in call.keywords if isinstance(kw, ast.keyword)}
-            self.assertIn(
-                "request",
-                kw_args,
-                f"TemplateResponse at line {call.lineno} is missing keyword argument 'request='.",
-            )
-            self.assertIn(
-                "name",
-                kw_args,
-                f"TemplateResponse at line {call.lineno} is missing keyword argument 'name='.",
-            )
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -145,12 +145,13 @@
    ranger fastfetch gedit openssl pwgen
    aspell aspellDicts.en lm_sensors
    hunspell hunspellDicts.en_US
-    synadm brave dua
+    synadm brave-origin dua
    gparted pv unzip parted screen zenity
    libargon2 gnome-terminal libreoffice-fresh
    dig firefox wp-cli axel
    lk-jwt-service livekit-libwebrtc livekit
    matrix-synapse age onlyoffice-desktopeditors
+    tor-browser
  ];

  # ── Shell ──────────────────────────────────────────────────
@@ -192,12 +193,9 @@ backup	/etc/nix-bitcoin-secrets/	localhost/
  };

  # ── Cron ───────────────────────────────────────────────────
-  services.cron = {
-    enable = true;
-    systemCronJobs = [
-      "*/15 * * * * root /run/current-system/sw/bin/bash /var/lib/njalla/njalla.sh"
-    ];
-  };
+  # The legacy njalla.sh root cron job has been replaced by the systemd timer
+  # defined in modules/core/njalla.nix (sovran-ddns-update.timer).  Cron is
+  # retained so that rsnapshot and other module-defined cron jobs continue to run.

  # ── Tor ────────────────────────────────────────────────────
  services.tor = { enable = true; client.enable = true; torsocks.enable = true; };
@@ -5,11 +5,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1783519926,
-        "narHash": "sha256-2zwAN4lNitHFrHVnRZG3YcvpdtWOoF0cOBstxMeB1KI=",
+        "lastModified": 1787839684,
+        "narHash": "sha256-xTafqsVs2/zyGsaCel41QT5Lpbs/rG56Kp+YsmLXL8I=",
        "owner": "emmanuelrosa",
        "repo": "btc-clients-nix",
-        "rev": "731a1e11c2fefb14f0aa4b1f03cfa85c19c28d71",
+        "rev": "ef81159876930802ef9861aa5c039cec6886a30f",
        "type": "github"
      },
      "original": {
@@ -18,32 +18,6 @@
        "type": "github"
      }
    },
-    "extra-container": {
-      "inputs": {
-        "flake-utils": [
-          "nix-bitcoin",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nix-bitcoin",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1766155727,
-        "narHash": "sha256-XGp4HHH6D6ZKiO5RnMzqYJYnZB538EnEflvlTsOKpvo=",
-        "owner": "erikarvstedt",
-        "repo": "extra-container",
-        "rev": "b450bdb24fca1076973c852d87bcb49b8eb5fd49",
-        "type": "github"
-      },
-      "original": {
-        "owner": "erikarvstedt",
-        "ref": "0.14",
-        "repo": "extra-container",
-        "type": "github"
-      }
-    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -52,11 +26,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782949081,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "lastModified": 1785627969,
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
        "type": "github"
      },
      "original": {
@@ -65,54 +39,13 @@
        "type": "github"
      }
    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nix-bitcoin": {
-      "inputs": {
-        "extra-container": "extra-container",
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2",
-        "nixpkgs-25_05": "nixpkgs-25_05",
-        "nixpkgs-unstable": "nixpkgs-unstable"
-      },
-      "locked": {
-        "lastModified": 1779253922,
-        "narHash": "sha256-k5DpYVfyy27ELuEiV+51EfVg7B6vKUW63NWeA6eKGd0=",
-        "owner": "fort-nix",
-        "repo": "nix-bitcoin",
-        "rev": "1496f842477976c085cd96f1837ea12444014088",
-        "type": "github"
-      },
-      "original": {
-        "owner": "fort-nix",
-        "ref": "release",
-        "repo": "nix-bitcoin",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1782911660,
-        "narHash": "sha256-PbR+tJ5E/Ux+01UtdFKqblccVA4/FgWbkym4ev3VHHQ=",
+        "lastModified": 1785590095,
+        "narHash": "sha256-CNO2szJbdLjVN/Hi1BML9MSALz1GM2fIdwnzs404QO8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "cf720c15e108d432d29041cc5a185630809acefb",
+        "rev": "e568f3b19d54b08f48bfae9b12b3e124d1a28002",
        "type": "github"
      },
      "original": {
@@ -121,29 +54,13 @@
        "type": "github"
      }
    },
-    "nixpkgs-25_05": {
-      "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1783856661,
-        "narHash": "sha256-ZGP04e+Q6WyQJGA9ZvI5CL6+heGQldbAG9U1T9NGvmU=",
+        "lastModified": 1787753485,
+        "narHash": "sha256-BZWCi9ZRJiARTuKTbbtvFTj7t1TK4G3UEckT3HyNfRg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "569d578509928497eddc3fdbf94a799027050be4",
+        "rev": "062346a6d85bc4b49dfaa61c986e9c5be21217d1",
        "type": "github"
      },
      "original": {
@@ -153,45 +70,29 @@
        "type": "github"
      }
    },
-    "nixpkgs-unstable": {
+    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
-        "owner": "NixOS",
+        "lastModified": 1787753485,
+        "narHash": "sha256-BZWCi9ZRJiARTuKTbbtvFTj7t1TK4G3UEckT3HyNfRg=",
+        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "062346a6d85bc4b49dfaa61c986e9c5be21217d1",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "owner": "nixos",
+        "ref": "nixos-26.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1778737229,
-        "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
+        "lastModified": 1787498568,
+        "narHash": "sha256-9i/VTdusq/+NM/tz+J1Re+ojkMB8MBf0QshnYfzHz30=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1783776592,
-        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
+        "rev": "56c02bc00adcf003215cc4bd996d6efaf4cff188",
        "type": "github"
      },
      "original": {
@@ -201,13 +102,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1783791668,
-        "narHash": "sha256-zbcZ1dmBTPfJ7Mlqh/yLEPGpgJnwuv4Xr1xucy2WqMA=",
+        "lastModified": 1787364730,
+        "narHash": "sha256-NcYt9QJfpJiF1lAyN8BDPB4EeScbPU+EwQqPiBElrpU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "716c7a2664ca8325617b8a7fbb609273f2c4cae7",
+        "rev": "a831408e6378bc02ebf8cc09b52c96ca86f6bab4",
        "type": "github"
      },
      "original": {
@@ -217,18 +118,34 @@
        "type": "github"
      }
    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1787736819,
+        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nixvim": {
      "inputs": {
        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_4",
-        "systems": "systems_2"
+        "nixpkgs": "nixpkgs_3",
+        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1783941741,
-        "narHash": "sha256-F+3M1IZrJa920cx2/k2AMKqedEodxLF7COJVkLJwUBo=",
+        "lastModified": 1787691219,
+        "narHash": "sha256-CjeJTOjrluiDuL0W/YBFkSBOQjBYmdKwj7hWAJ4PIh0=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "e6715f01d9f56f07a27a01386b85ae22b06f0705",
+        "rev": "ebec1ae277a50b16e7d6682edd009ef585d68261",
        "type": "github"
      },
      "original": {
@@ -240,28 +157,33 @@
    "root": {
      "inputs": {
        "btc-clients": "btc-clients",
-        "nix-bitcoin": "nix-bitcoin",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
        "nixpkgs-stable": "nixpkgs-stable",
-        "nixvim": "nixvim"
+        "nixvim": "nixvim",
+        "sovran-bitcoin": "sovran-bitcoin"
      }
    },
-    "systems": {
+    "sovran-bitcoin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4",
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "lastModified": 1788226637,
+        "narHash": "sha256-MMtcA7phjkde0uw9QzTWZCuA938fhoVIuojgRu4R2eo=",
+        "owner": "naturallaw777",
+        "repo": "Sovran_Bitcoin",
+        "rev": "7dd51e069690129ee6fbde2136f82b62c09c3d39",
        "type": "github"
      },
      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
+        "owner": "naturallaw777",
+        "repo": "Sovran_Bitcoin",
        "type": "github"
      }
    },
-    "systems_2": {
+    "systems": {
+      "flake": false,
      "locked": {
        "lastModified": 1774449309,
        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
@@ -3,13 +3,15 @@

 	inputs = {
 		nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-		nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
 		nixvim.url = "github:nix-community/nixvim";
 		btc-clients.url = "github:emmanuelrosa/btc-clients-nix";
 		nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
+
+		# Bitcoin / Lightning stack — standalone flake, consumed as a module.
+		sovran-bitcoin.url = "github:naturallaw777/Sovran_Bitcoin";
 	};

-	outputs = { self, nixpkgs, nix-bitcoin, nixvim, btc-clients, nixpkgs-stable, ... }:
+	outputs = { self, nixpkgs, nixvim, btc-clients, nixpkgs-stable, sovran-bitcoin, ... }:

 	let
 		overlay-stable = final: prev: {
@@ -17,12 +19,30 @@
 				system = prev.stdenv.hostPlatform.system;
 				config.allowUnfree = true;
 			};
+
+			# Pin LiveKit to 1.13.6: element-calling.nix sets
+			# rtc.advertise_internal_ip, which gives LAN callers a host candidate
+			# so calls work on Wi-Fi without the router needing NAT-hairpin. That
+			# flag is only honoured when node_ip is set manually from LiveKit
+			# v1.13.6 (mediatransportutil f234b53); nixpkgs-unstable currently
+			# ships 1.13.5. Remove this override once nixpkgs-unstable reaches
+			# >= 1.13.6.
+			livekit = prev.livekit.overrideAttrs (old: {
+				version = "1.13.6";
+				src = prev.fetchFromGitHub {
+					owner = "livekit";
+					repo = "livekit";
+					rev = "v1.13.6";
+					hash = "sha256-sUAx6ooeEUUqot5xuZv7xiQa3DdRFVULteTwYgFUzCI=";
+				};
+				vendorHash = "sha256-nOGSmoNuQQm/sIVI1HojsiS4GkbhA68uYMQ6X7d4a5Q=";
+			});
 		};
 	in
 	{
 		nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
 			modules = [
-				{ nixpkgs.hostPlatform = "x86_64-linux"; }
+				{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable ]; }
 				self.nixosModules.Sovran_SystemsOS
 				./hardware-configuration.nix
 				./role-state.nix
@@ -32,10 +52,10 @@

 		nixosConfigurations.sovran_systemsos-iso = nixpkgs.lib.nixosSystem {
 			modules = [
-				{ nixpkgs.hostPlatform = "x86_64-linux"; }
-				({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-stable ]; })
+				{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable ]; }
 				./iso/common.nix
-				nix-bitcoin.nixosModules.default
+				sovran-bitcoin.nixosModules.default
+				./modules/sovran-bitcoin-integration.nix
 				nixvim.nixosModules.nixvim
 			];
 		};
@@ -46,7 +66,8 @@
 					nixpkgs.overlays = [ overlay-stable ];
 				})
 				./configuration.nix
-				nix-bitcoin.nixosModules.default
+				sovran-bitcoin.nixosModules.default
+				./modules/sovran-bitcoin-integration.nix
 				nixvim.nixosModules.nixvim
 			];
 			config = {
@@ -57,5 +78,14 @@
 				];
 			};
 		};
+
+		checks.x86_64-linux = let
+			pkgs = import nixpkgs {
+				system = "x86_64-linux";
+			};
+		in {
+			# Bitcoin hardening and package checks now live in the Sovran_Bitcoin flake.
+			# Run them with: nix build github:naturallaw777/Sovran_Bitcoin#checks.x86_64-linux
+		};
 	};
 }
@@ -3,6 +3,14 @@
 let
  sovranSource = builtins.path { path = ../.; name = "sovran-systemsos"; };

+  # Read version from VERSION file if it exists, otherwise fall back to "dev"
+  versionFile = if builtins.pathExists ../VERSION
+                then builtins.readFile ../VERSION
+                else "dev";
+
+  # Clean version (remove 'v' prefix and newlines)
+  cleanVersion = builtins.replaceStrings ["v" "\n" "\r"] ["" "" ""] versionFile;
+
  pythonEnv = pkgs.python3.withPackages (ps: [ ps.pygobject3 ps.pycairo ]);

  installerPy = pkgs.writeShellScriptBin "sovran-install" ''
@@ -18,7 +26,8 @@ in
    "${modulesPath}/installer/cd-dvd/installation-cd-graphical-gnome.nix"
  ];

-  image.baseName = lib.mkForce "Sovran_SystemsOS";
+  # Dynamic ISO filename with version
+  image.baseName = lib.mkForce "Sovran_SystemsOS-${cleanVersion}";
  isoImage.splashImage = ./assets/splash-logo.png;

  services.gnome.gnome-initial-setup.enable = false;
@@ -103,25 +103,81 @@ def human_size(nbytes):
    return f"{nbytes:.1f} PB"

 def check_internet():
-    """Return True if the machine can reach the internet."""
+    """Return True if the machine can reach the internet.
+
+    Some VM NAT setups and managed networks block ICMP even when HTTPS works,
+    so keep the existing ping checks but fall back to small HTTPS requests.
+    """
+    checks = [
+        ["ping", "-c", "1", "-W", "5", "nixos.org"],
+        ["curl", "--location", "--fail", "--silent", "--show-error", "--connect-timeout", "5", "--max-time", "10", "--output", "/dev/null", "https://cache.nixos.org/nix-cache-info"],
+        ["curl", "--location", "--fail", "--silent", "--show-error", "--connect-timeout", "5", "--max-time", "10", "--output", "/dev/null", "https://nixos.org/"],
+        ["ping", "-c", "1", "-W", "5", "1.1.1.1"],
+    ]
+
+    for cmd in checks:
+        try:
+            result = subprocess.run(cmd, capture_output=True, text=True)
+            if result.returncode == 0:
+                return True
+            log(f"Connectivity check failed ({' '.join(cmd)}): {result.stderr.strip() or result.stdout.strip()}")
+        except Exception as e:
+            log(f"Connectivity check failed ({' '.join(cmd)}): {e}")
+
+    return False
+
+def detect_virtualization():
+    """Return the VM technology name when running inside a VM, else None."""
    try:
        result = subprocess.run(
-            ["ping", "-c", "1", "-W", "5", "nixos.org"],
+            ["systemd-detect-virt", "--vm"],
            capture_output=True, text=True
        )
        if result.returncode == 0:
-            return True
+            name = result.stdout.strip()
+            if name == "none":
+                return None
+            return name or "virtual machine"
    except Exception:
        pass
-    # Fallback: try a second host in case DNS for nixos.org is down
-    try:
-        result = subprocess.run(
-            ["ping", "-c", "1", "-W", "5", "1.1.1.1"],
-            capture_output=True, text=True
-        )
-        return result.returncode == 0
-    except Exception:
-        return False
+
+    # Fallback for minimal environments where systemd-detect-virt is absent.
+    dmi_paths = [
+        "/sys/class/dmi/id/product_name",
+        "/sys/class/dmi/id/sys_vendor",
+        "/sys/class/dmi/id/board_vendor",
+    ]
+    markers = (
+        "kvm", "qemu", "virtualbox", "vmware", "hyper-v",
+        "bhyve", "parallels", "xen", "bochs", "virtual",
+    )
+    for dmi_path in dmi_paths:
+        try:
+            value = open(dmi_path, "r", encoding="utf-8", errors="ignore").read().strip()
+        except OSError:
+            continue
+        lowered = value.lower()
+        if any(marker in lowered for marker in markers):
+            return value or "virtual machine"
+
+    return None
+
+def detect_boot_mode():
+    """Return the firmware mode used to boot the installer ISO."""
+    return "uefi" if os.path.isdir("/sys/firmware/efi") else "bios"
+
+def boot_mode_label(mode):
+    if mode == "uefi":
+        return "UEFI (systemd-boot)"
+    return "Legacy BIOS (GRUB)"
+
+def nix_string(value):
+    """Quote a Python string for a simple Nix string literal."""
+    escaped = value.replace("\\", "\\\\")
+    escaped = escaped.replace('"', '\\"')
+    escaped = escaped.replace("\n", "\\n").replace("\r", "\\r").replace("\t", "\\t")
+    escaped = escaped.replace("${", "\\${")
+    return f'"{escaped}"'

 def symbolic_icon(name):
    """Create a crisp symbolic icon suitable for use as an ActionRow prefix."""
@@ -159,6 +215,10 @@ class InstallerWindow(Adw.ApplicationWindow):
        self.data_size = None
        self.data_drive_has_timechain = False
        self.free_password = None
+        self.virtualization = detect_virtualization()
+        self.boot_mode = detect_boot_mode()
+
+        log(f"Installer environment: boot_mode={self.boot_mode}, virtualization={self.virtualization or 'none'}")

        # Root navigation view
        self.nav = Adw.NavigationView()
@@ -343,7 +403,7 @@ class InstallerWindow(Adw.ApplicationWindow):
        if os.path.exists(LOGO):
            try:
                img = Gtk.Image.new_from_file(LOGO)
-                img.set_pixel_size(480)
+                img.set_pixel_size(320 if self.virtualization else 480)
                hero.append(img)
            except Exception:
                pass
@@ -363,39 +423,41 @@ class InstallerWindow(Adw.ApplicationWindow):
        sep.set_margin_end(40)
        outer.append(sep)

-        notice_frame = Gtk.Frame()
-        notice_frame.add_css_class("card")
-        notice_frame.set_margin_start(40)
-        notice_frame.set_margin_end(40)
-        notice_frame.set_margin_top(20)
-        notice_frame.set_margin_bottom(4)
+        if self.virtualization:
+            vm_frame = Gtk.Frame()
+            vm_frame.add_css_class("card")
+            vm_frame.set_margin_start(40)
+            vm_frame.set_margin_end(40)
+            vm_frame.set_margin_top(12)
+            vm_frame.set_margin_bottom(4)

-        notice_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=12)
-        notice_box.set_margin_top(12)
-        notice_box.set_margin_bottom(12)
-        notice_box.set_margin_start(16)
-        notice_box.set_margin_end(16)
+            vm_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=12)
+            vm_box.set_margin_top(12)
+            vm_box.set_margin_bottom(12)
+            vm_box.set_margin_start(16)
+            vm_box.set_margin_end(16)

-        notice_icon = symbolic_icon("dialog-information-symbolic")
-        notice_icon.set_valign(Gtk.Align.START)
-        notice_box.append(notice_icon)
+            vm_icon = symbolic_icon("computer-symbolic")
+            vm_icon.set_valign(Gtk.Align.START)
+            vm_box.append(vm_icon)

-        notice_lbl = Gtk.Label()
-        notice_lbl.set_use_markup(True)
-        notice_lbl.set_wrap(True)
-        notice_lbl.set_xalign(0)
-        notice_lbl.set_halign(Gtk.Align.FILL)
-        notice_lbl.set_markup(
-            "<span weight='bold'>Heads up — Server + Desktop prerequisites</span>\n"
-            "• A domain or subdomain from <span weight='bold'>https://njal.la</span>\n"
-            "• The ability to open / forward ports on your router\n\n"
-            "Don't worry — after install, the onboarding wizard walks you through every step.\n"
-            "<span size='small'>Desktop Only and Node Only do not require a domain or port forwarding.</span>"
-        )
-        notice_box.append(notice_lbl)
+            vm_lbl = Gtk.Label()
+            vm_lbl.set_use_markup(True)
+            vm_lbl.set_wrap(True)
+            vm_lbl.set_xalign(0)
+            vm_lbl.set_halign(Gtk.Align.FILL)
+            vm_lbl.set_markup(
+                f"<span weight='bold'>Virtual machine detected: {GLib.markup_escape_text(self.virtualization)}</span>\n"
+                f"Boot mode: <span weight='bold'>{boot_mode_label(self.boot_mode)}</span>. "
+                "For the smoothest VM test, use 8+ GB RAM, NAT/bridged networking, "
+                "and a thin-provisioned virtual OS disk of at least 256 GB. "
+                "For Node or Server + Desktop, attach a second 2 TB virtual data disk; "
+                "otherwise choose Desktop Only."
+            )
+            vm_box.append(vm_lbl)

-        notice_frame.set_child(notice_box)
-        outer.append(notice_frame)
+            vm_frame.set_child(vm_box)
+            outer.append(vm_frame)

        # Role label
        role_lbl = Gtk.Label()
@@ -409,7 +471,7 @@ class InstallerWindow(Adw.ApplicationWindow):
        # Role cards
        roles = [
            ("Server + Desktop",
-             "Full sovereign experience: beautiful desktop, your own cloud, secure messaging, Bitcoin node, and more.",
+             "Full sovereignty: host your own websites, cloud, chat, passwords, and Bitcoin services instead of relying on Big Tech. Sovran_SystemsOS walks you through getting your domain from Njal.la and connecting everything. One router task is required: forward ports 80 and 443 to this computer.",
             "Server+Desktop"),
            ("Desktop Only",
             "A beautiful, easy-to-use desktop without the background server applications.",
@@ -448,7 +510,10 @@ class InstallerWindow(Adw.ApplicationWindow):

            available = has_second_drive or key not in NEEDS_DATA_DRIVE
            if not available:
-                card.set_subtitle(desc + "\n⚠ Requires a second internal drive (not detected)")
+                drive_hint = "⚠ Requires a second internal drive (not detected)"
+                if self.virtualization:
+                    drive_hint += " — in a VM, attach a second virtual disk or choose Desktop Only"
+                card.set_subtitle(desc + f"\n{drive_hint}")
                card.set_sensitive(False)
            else:
                card.set_subtitle(desc)
@@ -531,9 +596,10 @@ class InstallerWindow(Adw.ApplicationWindow):
        # ── OS Drive group ────────────────────────────────────────────
        os_group = Adw.PreferencesGroup()
        os_group.set_title("OS Drive  (NixOS Boot + Root)")
-        os_group.set_description(
-            "Choose the drive for the NixOS installation.  Minimum 256 GB required."
-        )
+        os_description = "Choose the drive for the NixOS installation.  Minimum 256 GB required."
+        if self.virtualization:
+            os_description += " In a VM, a thin-provisioned virtual disk is OK."
+        os_group.set_description(os_description)
        os_group.set_margin_top(24)
        os_group.set_margin_start(40)
        os_group.set_margin_end(40)
@@ -546,6 +612,8 @@ class InstallerWindow(Adw.ApplicationWindow):
            row.set_title(f"/dev/{name}")
            type_label = tran.upper() if tran else "Disk"
            meets = "✓ Meets 256 GB minimum" if size >= BYTES_256GB else "✗ Below 256 GB minimum"
+            if self.virtualization and size < BYTES_256GB:
+                meets += " (expand the virtual disk)"
            row.set_subtitle(f"{human_size(size)}  ·  {type_label}  —  {meets}")
            row.add_prefix(symbolic_icon("drive-harddisk-symbolic"))

@@ -570,11 +638,14 @@ class InstallerWindow(Adw.ApplicationWindow):
        if self.role != "Desktop Only":
            data_group = Adw.PreferencesGroup()
            data_group.set_title("Bitcoin Timechain & Backups Drive")
-            data_group.set_description(
+            data_description = (
                "💡 Tip: Always assign your LARGEST drive here.  "
                "The full Bitcoin timechain is over 700 GB and grows continuously — "
                "a 2 TB or larger drive is required."
            )
+            if self.virtualization:
+                data_description += " In a VM, attach a second 2 TB thin-provisioned virtual disk for Node or Server + Desktop."
+            data_group.set_description(data_description)
            data_group.set_margin_top(20)
            data_group.set_margin_start(40)
            data_group.set_margin_end(40)
@@ -599,6 +670,8 @@ class InstallerWindow(Adw.ApplicationWindow):
                row.set_title(f"/dev/{name}")
                type_label = tran.upper() if tran else "Disk"
                meets = "✓ Meets 2 TB minimum" if size >= BYTES_2TB else "✗ Below 2 TB minimum"
+                if self.virtualization and size < BYTES_2TB:
+                    meets += " (use a 2 TB thin-provisioned virtual disk)"
                row.set_subtitle(f"{human_size(size)}  ·  {type_label}  —  {meets}")
                row.add_prefix(symbolic_icon("drive-harddisk-symbolic"))

@@ -655,10 +728,16 @@ class InstallerWindow(Adw.ApplicationWindow):
            dlg = Adw.MessageDialog()
            dlg.set_transient_for(self)
            dlg.set_heading("OS Drive Too Small")
-            dlg.set_body(
+            body = (
                f"The selected OS drive (/dev/{os_name}, {human_size(os_size)}) "
                f"does not meet the 256 GB minimum.  Please choose a larger drive."
            )
+            if self.virtualization:
+                body += (
+                    "\n\nVM tip: expand the virtual OS disk to at least 256 GB. "
+                    "Thin-provisioned disks usually do not consume the full size immediately."
+                )
+            dlg.set_body(body)
            dlg.add_response("ok", "OK")
            dlg.present()
            return
@@ -668,12 +747,18 @@ class InstallerWindow(Adw.ApplicationWindow):
            dlg = Adw.MessageDialog()
            dlg.set_transient_for(self)
            dlg.set_heading("Bitcoin Drive Too Small")
-            dlg.set_body(
+            body = (
                f"The selected Bitcoin Timechain & Backups drive "
                f"(/dev/{data_name}, {human_size(data_size)}) "
                f"does not meet the 2 TB minimum.  "
                f"Please choose a larger drive or select \"None\"."
            )
+            if self.virtualization:
+                body += (
+                    "\n\nVM tip: attach a second 2 TB thin-provisioned virtual disk "
+                    "for Node or Server + Desktop test installs."
+                )
+            dlg.set_body(body)
            dlg.add_response("ok", "OK")
            dlg.present()
            return
@@ -829,7 +914,12 @@ class InstallerWindow(Adw.ApplicationWindow):
    # ── Worker: partition ─────────────────────────────────────────────────

    def partition_path(self, dev_path, num):
-        return f"{dev_path}p{num}" if "nvme" in dev_path else f"{dev_path}{num}"
+        base = os.path.basename(dev_path)
+        needs_p = (
+            base.startswith(("nvme", "mmcblk", "loop", "md")) or
+            (base[-1:].isdigit())
+        )
+        return f"{dev_path}p{num}" if needs_p else f"{dev_path}{num}"

    def detect_existing_timechain_data(self, data_path, buf=None):
        data_p1 = self.partition_path(data_path, 1)
@@ -900,12 +990,19 @@ class InstallerWindow(Adw.ApplicationWindow):

        time.sleep(2)

-        # ── Partition boot disk: 512M ESP + rest as root ──
-        GLib.idle_add(append_text, buf, "\n=== Partitioning boot disk ===\n")
-        run_stream(["sudo", "sgdisk",
-                    "-n", "1:1M:+512M", "-t", "1:EF00", "-c", "1:ESP",
-                    "-n", "2:0:0",      "-t", "2:8300", "-c", "2:root",
-                    boot_path], buf)
+        # ── Partition boot disk ──
+        if self.boot_mode == "uefi":
+            GLib.idle_add(append_text, buf, "\n=== Partitioning boot disk (UEFI) ===\n")
+            run_stream(["sudo", "sgdisk",
+                        "-n", "1:1M:+512M", "-t", "1:EF00", "-c", "1:ESP",
+                        "-n", "2:0:0",      "-t", "2:8300", "-c", "2:root",
+                        boot_path], buf)
+        else:
+            GLib.idle_add(append_text, buf, "\n=== Partitioning boot disk (Legacy BIOS) ===\n")
+            run_stream(["sudo", "sgdisk",
+                        "-n", "1:1M:+1M", "-t", "1:EF02", "-c", "1:BIOS-boot",
+                        "-n", "2:0:0",    "-t", "2:8300", "-c", "2:root",
+                        boot_path], buf)

        run_stream(["sudo", "partprobe", boot_path], buf)
        time.sleep(2)
@@ -925,7 +1022,10 @@ class InstallerWindow(Adw.ApplicationWindow):
        boot_p1 = self.partition_path(boot_path, 1)
        boot_p2 = self.partition_path(boot_path, 2)

-        run_stream(["sudo", "mkfs.vfat", "-F", "32", boot_p1], buf)
+        if self.boot_mode == "uefi":
+            run_stream(["sudo", "mkfs.vfat", "-F", "32", boot_p1], buf)
+        else:
+            GLib.idle_add(append_text, buf, "Skipping ESP format for Legacy BIOS install.\n")
        run_stream(["sudo", "mkfs.ext4", "-F", "-L", "sovran_systemsos", boot_p2], buf)

        if data_path and not self.data_drive_has_timechain:
@@ -935,8 +1035,11 @@ class InstallerWindow(Adw.ApplicationWindow):
        # ── Mount filesystems ──
        GLib.idle_add(append_text, buf, "\n=== Mounting filesystems ===\n")
        run_stream(["sudo", "mount", boot_p2, "/mnt"], buf)
-        run_stream(["sudo", "mkdir", "-p", "/mnt/boot/efi"], buf)
-        run_stream(["sudo", "mount", "-o", "umask=0077,defaults", boot_p1, "/mnt/boot/efi"], buf)
+        if self.boot_mode == "uefi":
+            run_stream(["sudo", "mkdir", "-p", "/mnt/boot/efi"], buf)
+            run_stream(["sudo", "mount", "-o", "umask=0077,defaults", boot_p1, "/mnt/boot/efi"], buf)
+        else:
+            GLib.idle_add(append_text, buf, "Legacy BIOS install: /boot/efi mount not required.\n")

        if data_path:
            data_p1 = self.partition_path(data_path, 1)
@@ -966,12 +1069,33 @@ class InstallerWindow(Adw.ApplicationWindow):
        is_server = str(self.role == "Server+Desktop").lower()
        is_desktop = str(self.role == "Desktop Only").lower()
        is_node = str(self.role == "Node (Bitcoin-only)").lower()
+        boot_overrides = ""
+        if self.boot_mode == "bios":
+            grub_device = nix_string(f"/dev/{self.boot_disk}")
+            boot_overrides = f"""
+
+  # The installer ISO was booted in Legacy BIOS mode, so install GRUB to the
+  # target disk instead of using the default UEFI systemd-boot configuration.
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+  boot.loader.grub.enable = lib.mkForce true;
+  boot.loader.grub.device = lib.mkForce {grub_device};
+  fileSystems."/boot/efi".enable = lib.mkForce false;
+"""
+        elif self.virtualization:
+            boot_overrides = """
+
+  # VM UEFI firmware can reject or forget NVRAM boot-entry writes. Keep the
+  # normal UEFI systemd-boot layout, but use the fallback removable path instead
+  # of depending on EFI variable updates.
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+"""
        content = f"""# THIS FILE IS AUTO-GENERATED BY THE INSTALLER. DO NOT EDIT.
 {{ config, lib, ... }}:
 {{
  sovran_systemsOS.roles.server_plus_desktop = lib.mkDefault {is_server};
  sovran_systemsOS.roles.desktop = lib.mkDefault {is_desktop};
-  sovran_systemsOS.roles.node = lib.mkDefault {is_node};
+  sovran_systemsOS.roles.node = lib.mkDefault {is_node};{boot_overrides}
 }}
 """
        proc = subprocess.run(
@@ -1008,6 +1132,11 @@ class InstallerWindow(Adw.ApplicationWindow):
        boot_row.set_subtitle(f"/dev/{self.boot_disk}  —  {human_size(self.boot_size)}")
        details.add(boot_row)

+        boot_mode_row = Adw.ActionRow()
+        boot_mode_row.set_title("Boot Mode")
+        boot_mode_row.set_subtitle(boot_mode_label(self.boot_mode))
+        details.add(boot_mode_row)
+
        if self.data_disk:
            data_row = Adw.ActionRow()
            data_row.set_title("Data Disk")
@@ -12,6 +12,11 @@ Options:
  --deploy-key "ssh-ed25519 AAAA..."  SSH pubkey for remote access after install
  --headscale-server URL       Headscale login server for post-install Tailnet
  --headscale-key KEY          Headscale pre-auth key for the installed OS
+
+VM notes:
+  Desktop test installs still need a 256 GB OS disk (thin-provisioned is OK).
+  Node/server installs need a separate 2 TB data disk. UEFI is preferred; UEFI
+  VMs avoid NVRAM boot-entry writes, and legacy BIOS VMs use GRUB.
 USAGE
 }

@@ -25,6 +30,8 @@ DEPLOY_KEY=""
 HEADSCALE_SERVER=""
 HEADSCALE_KEY=""
 DATA_DISK_HAS_TIMECHAIN=false
+BOOT_MODE=""
+VIRTUALIZATION=""

 FLAKE="/etc/sovran/flake"
 LOG="/tmp/sovran-headless-install.log"
@@ -69,6 +76,22 @@ case "$ROLE" in
    *) die "--role must be one of: server, desktop, node" ;;
 esac

+# ── Detect firmware / VM environment ─────────────────────────────────────────
+if [[ -d /sys/firmware/efi ]]; then
+    BOOT_MODE="uefi"
+else
+    BOOT_MODE="bios"
+fi
+
+if command -v systemd-detect-virt >/dev/null 2>&1; then
+    if VIRT_RESULT=$(systemd-detect-virt --vm 2>/dev/null); then
+        [[ "$VIRT_RESULT" != "none" ]] && VIRTUALIZATION="$VIRT_RESULT"
+    fi
+fi
+
+log "Boot mode: ${BOOT_MODE} ($([[ "$BOOT_MODE" == uefi ]] && echo systemd-boot || echo GRUB))"
+[[ -n "$VIRTUALIZATION" ]] && log "Virtual machine detected: ${VIRTUALIZATION}"
+
 # ── Validate disk existence and size ─────────────────────────────────────────
 log "=== Validating disks ==="

@@ -96,13 +119,26 @@ fi
 # ── Helper: partition suffix ──────────────────────────────────────────────────
 part_suffix() {
    local dev="$1" n="$2"
-    if [[ "$dev" == *nvme* ]]; then
+    local base
+    base=$(basename "$dev")
+    if [[ "$base" == nvme* || "$base" == mmcblk* || "$base" == loop* || "$base" == md* || "$base" =~ [0-9]$ ]]; then
        echo "${dev}p${n}"
    else
        echo "${dev}${n}"
    fi
 }

+nix_string() {
+    local value="$1"
+    value="${value//\\/\\\\}"
+    value="${value//\"/\\\"}"
+    value="${value//$'\n'/\\n}"
+    value="${value//$'\r'/\\r}"
+    value="${value//$'\t'/\\t}"
+    value="${value//\$\{/\\\$\{}"
+    printf '"%s"' "$value"
+}
+
 # ── Detect existing Bitcoin timechain data on data disk ───────────────────────
 if [[ -n "$DATA_DISK" ]]; then
    DATA_P1=$(part_suffix "$DATA_DISK" 1)
@@ -142,12 +178,19 @@ partprobe "$DISK"
 sleep 2

 # ── Step 2: Partition OS disk ─────────────────────────────────────────────────
-log "=== Partitioning OS disk ==="
-
-sgdisk \
-    -n "1:1M:+512M" -t "1:EF00" -c "1:ESP" \
-    -n "2:0:0"      -t "2:8300" -c "2:root" \
-    "$DISK"
+if [[ "$BOOT_MODE" == "uefi" ]]; then
+    log "=== Partitioning OS disk (UEFI) ==="
+    sgdisk \
+        -n "1:1M:+512M" -t "1:EF00" -c "1:ESP" \
+        -n "2:0:0"      -t "2:8300" -c "2:root" \
+        "$DISK"
+else
+    log "=== Partitioning OS disk (Legacy BIOS) ==="
+    sgdisk \
+        -n "1:1M:+1M" -t "1:EF02" -c "1:BIOS-boot" \
+        -n "2:0:0"    -t "2:8300" -c "2:root" \
+        "$DISK"
+fi

 partprobe "$DISK"
 sleep 2
@@ -168,7 +211,11 @@ log "=== Formatting partitions ==="
 BOOT_P1=$(part_suffix "$DISK" 1)
 BOOT_P2=$(part_suffix "$DISK" 2)

-mkfs.vfat -F 32 "$BOOT_P1"
+if [[ "$BOOT_MODE" == "uefi" ]]; then
+    mkfs.vfat -F 32 "$BOOT_P1"
+else
+    log "Skipping ESP format for Legacy BIOS install"
+fi
 mkfs.ext4 -F -L sovran_systemsos "$BOOT_P2"

 if [[ -n "$DATA_DISK" && "$DATA_DISK_HAS_TIMECHAIN" != true ]]; then
@@ -180,8 +227,12 @@ fi
 log "=== Mounting filesystems ==="

 mount "$BOOT_P2" /mnt
-mkdir -p /mnt/boot/efi
-mount -o umask=0077,defaults "$BOOT_P1" /mnt/boot/efi
+if [[ "$BOOT_MODE" == "uefi" ]]; then
+    mkdir -p /mnt/boot/efi
+    mount -o umask=0077,defaults "$BOOT_P1" /mnt/boot/efi
+else
+    log "Legacy BIOS install: /boot/efi mount not required"
+fi

 if [[ -n "$DATA_DISK" ]]; then
    DATA_P1=$(part_suffix "$DATA_DISK" 1)
@@ -219,16 +270,41 @@ case "$ROLE" in
        IS_SERVER=false; IS_DESKTOP=false; IS_NODE=true ;;
 esac

-cat > /mnt/etc/nixos/role-state.nix <<EOF
+{
+    cat <<EOF
 # THIS FILE IS AUTO-GENERATED BY THE INSTALLER. DO NOT EDIT.
 { config, lib, ... }:
 {
  sovran_systemsOS.roles.server_plus_desktop = lib.mkDefault ${IS_SERVER};
  sovran_systemsOS.roles.desktop = lib.mkDefault ${IS_DESKTOP};
  sovran_systemsOS.roles.node = lib.mkDefault ${IS_NODE};
-}
 EOF

+    if [[ "$BOOT_MODE" == "bios" ]]; then
+        GRUB_DEVICE=$(nix_string "$DISK")
+        cat <<EOF
+
+  # The installer ISO was booted in Legacy BIOS mode, so install GRUB to the
+  # target disk instead of using the default UEFI systemd-boot configuration.
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+  boot.loader.grub.enable = lib.mkForce true;
+  boot.loader.grub.device = lib.mkForce ${GRUB_DEVICE};
+  fileSystems."/boot/efi".enable = lib.mkForce false;
+EOF
+    elif [[ -n "$VIRTUALIZATION" ]]; then
+        cat <<EOF
+
+  # VM UEFI firmware can reject or forget NVRAM boot-entry writes. Keep the
+  # normal UEFI systemd-boot layout, but use the fallback removable path instead
+  # of depending on EFI variable updates.
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+EOF
+    fi
+
+    echo "}"
+} > /mnt/etc/nixos/role-state.nix
+
 # ── Step 10: Write custom.nix with deploy config ──────────────────────────────
 log "=== Writing custom.nix ==="

@@ -1,7 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-lib.mkIf config.sovran_systemsOS.features.bitcoin-core {
-  
-  services.bitcoind.package = lib.mkForce config.nix-bitcoin.pkgs.bitcoind;
-
-}
@@ -1,116 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-lib.mkIf config.sovran_systemsOS.services.bitcoin {
-
-  services.bitcoind = {
-    enable = true;
-    package = pkgs.bitcoind-knots;
-    dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
-    txindex = true;
-    tor.proxy = true;
-    tor.enforce = true;
-    disablewallet = true;
-    extraConfig = ''
-      peerbloomfilters=1
-      server=1
-    '';
-  };
-
-  nix-bitcoin.onionServices.bitcoind.enable = true;
-  nix-bitcoin.onionServices.electrs.enable = true;
-  nix-bitcoin.onionServices.rtl.enable = true;
-
-  services.electrs = {
-    enable = true;
-    tor.enforce = true;
-    dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Electrs_Data";
-  };
-
-  services.lnd = {
-    enable = true;
-    tor.enforce = true;
-    tor.proxy = true;
-    extraConfig = ''
-      protocol.option-scid-alias=true
-    '';
-  };
-
-  nix-bitcoin.onionServices.lnd.public = true;
-
-  services.lnd.lndconnect = {
-    enable = true;
-    onion = true;
-  };
-
-  services.rtl = {
-    enable = true;
-    tor.enforce = true;
-    port = 3050;
-    nightTheme = true;
-    nodes = {
-      lnd = {
-        enable = true;
-      };
-    };
-  };
-
-  services.btcpayserver = {
-    enable = config.sovran_systemsOS.web.btcpayserver;
-  };
-
-  services.btcpayserver.lightningBackend = "lnd";
-
-  nix-bitcoin.generateSecrets = true;
-  nix-bitcoin.nodeinfo.enable = true;
-
-  nix-bitcoin.operator = {
-    enable = true;
-    name = "free";
-  };
-
-  nix-bitcoin.useVersionLockedPkgs = false;
-
-  systemd.services.bitcoind = {
-    requires = [ "run-media-Second_Drive.mount" ];
-    after    = [ "run-media-Second_Drive.mount" ];
-    serviceConfig.PrivateUsers = lib.mkForce false;
-  };
-
-  systemd.services.electrs = {
-    requires = lib.mkForce [ "run-media-Second_Drive.mount" ];
-    after    = [ "run-media-Second_Drive.mount" "bitcoind.service" ];
-    wants    = [ "bitcoind.service" ];
-  };
-
-  systemd.services.lnd = {
-    wants = [ "bitcoind.service" ];
-    # requires for bitcoind set by nix-bitcoin; mkForce removes it
-    requires = lib.mkForce [ ];
-  };
-
-  systemd.services.sovran-btc-permissions = {
-    description = "Fix Bitcoin/Electrs data directory ownership on second drive";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "run-media-Second_Drive.mount" ];
-    before = [ "bitcoind.service" "electrs.service" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      if [ -d /run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node ]; then
-        chown -R bitcoin:bitcoin /run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node
-      fi
-      if [ -d /run/media/Second_Drive/BTCEcoandBackup/Electrs_Data ]; then
-        chown -R electrs:electrs /run/media/Second_Drive/BTCEcoandBackup/Electrs_Data
-      fi
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [ 3051 ];
-  networking.firewall.allowedUDPPorts = [ 3051 ];
-
-  sovran_systemsOS.domainRequirements = [
-    { name = "btcpayserver"; label = "BTCPay Server"; example = "pay.yourdomain.com"; }
-  ];
-}
@@ -12,6 +12,7 @@ let
    || config.sovran_systemsOS.services.nextcloud
    || config.sovran_systemsOS.services.vaultwarden
    || config.sovran_systemsOS.features.haven
+    || config.sovran_systemsOS.features."nwc-wallets"
    || config.sovran_systemsOS.features.element-calling;
 in
 {
@@ -70,6 +71,7 @@ in
      BTCPAY=$(read_domain btcpayserver)
      VAULTWARDEN=$(read_domain vaultwarden)
      HAVEN=$(read_domain haven)
+      LIGHTNING=$(read_domain lightning)
      ACME_EMAIL=$(read_domain sslemail)

      # Start with global config — use ACME only when domain-based services are active
@@ -186,6 +188,20 @@ $HAVEN {
 EOF
      fi

+      # ── Lightning Wallet Connections LNURL ──────────────────────
+      if [ -n "$LIGHTNING" ]; then
+        cat >> /run/caddy/Caddyfile <<EOF
+
+$LIGHTNING {
+  # LNURL discovery and callback are served by the dedicated
+  # nwc-lnurl service on loopback port 8181.  Only these paths
+  # are proxied; the Alby Hub management port (18080) is never exposed.
+  reverse_proxy /.well-known/lnurlp/* http://127.0.0.1:8181
+  reverse_proxy /lnurlp/* http://127.0.0.1:8181
+}
+EOF
+      fi
+
      # ── Sovran Hub (LAN access via mDNS) ────────────
      cat >> /run/caddy/Caddyfile <<EOF

@@ -32,22 +32,31 @@
 # regenerated by the system activation script.  The ``system.activationScripts``
 # hook below converts it to a writable file each time the system is activated
 # (i.e. after every ``nixos-rebuild switch``) and then injects the Sovran block.
-# The same script is also run by the ``sovran-hosts-update.service`` unit so
-# that the Hub can trigger it immediately after saving a domain without
-# requiring a full rebuild.
+# The same wrapped Nix-store executable is reused by both the activation hook
+# and the ``sovran-hosts-update.service`` unit, ensuring a deterministic runtime
+# PATH in every execution context.

-{
-  # ── Helper script (stored in the Nix store, never reads /var/lib at eval) ──
+let
+  # ── Wrapped Nix-store executable ──────────────────────────────────────────
+  # Built with pkgs.writeShellApplication so that all required runtime tools
+  # (awk, grep, coreutils) are declared explicitly and injected into PATH by
+  # Nix.  Both the systemd service and the activation hook reference this same
+  # store-path executable — there is no second raw script body.
+  hostsUpdateScript = pkgs.writeShellApplication {
+    name = "sovran-hosts-update";

-  environment.systemPackages = [ pkgs.coreutils ];
+    # Declare every external command the script calls.  These packages are
+    # added to the script's runtime PATH by writeShellApplication; nothing from
+    # the system PATH is relied upon.
+    runtimeInputs = [
+      pkgs.coreutils   # readlink, cp, mv, chmod, mktemp, rm, tr, head
+      pkgs.gawk        # awk
+      pkgs.gnugrep     # grep
+    ];

-  environment.etc."sovran-hosts-update.sh" = {
-    mode = "0755";
    text = ''
-      #!/bin/sh
      # Regenerate the Sovran-managed loopback block in /etc/hosts.
      # Safe to run multiple times — idempotent.
-      set -eu

      DOMAINS_DIR="/var/lib/domains"
      HOSTS_FILE="/etc/hosts"
@@ -66,19 +75,20 @@

      # ── Step 2: remove any existing Sovran block ──────────────────────────
      # Use a temp file so the operation is atomic.
+      # awk -v passes marker strings safely without shell interpolation.
      TMP=$(mktemp "$HOSTS_FILE.XXXXXX")
      trap 'rm -f "$TMP"' EXIT
-      awk "
-        /^$BEGIN_MARKER\$/ { skip=1; next }
-        /^$END_MARKER\$/   { skip=0; next }
+      awk -v begin="$BEGIN_MARKER" -v end="$END_MARKER" '
+        $0 == begin { skip=1; next }
+        $0 == end   { skip=0; next }
        !skip
-      " "$HOSTS_FILE" > "$TMP"
+      ' "$HOSTS_FILE" > "$TMP"

      # ── Step 3: collect valid configured service domains ──────────────────
      # NOTE: The hostname validation regex below must stay in sync with
      # _SAFE_DOMAIN_RE in app/sovran_systemsos_web/server.py.
      ENTRIES=""
-      for KEY in matrix wordpress nextcloud btcpayserver vaultwarden haven element-calling; do
+      for KEY in matrix wordpress nextcloud btcpayserver vaultwarden haven element-calling lightning; do
        FILE="$DOMAINS_DIR/$KEY"
        [ -f "$FILE" ] || continue
        # Read the domain value (strip all whitespace, limit to 253 chars)
@@ -97,11 +107,13 @@

      # ── Step 4: append the Sovran block if there are any entries ──────────
      if [ -n "$ENTRIES" ]; then
-        printf '\n%s\n' "$BEGIN_MARKER" >> "$TMP"
-        printf '%s\n' "# These entries route configured service domains to local Caddy." >> "$TMP"
-        printf '%s\n' "# They are managed automatically — do not edit this block." >> "$TMP"
-        printf '%s\n' "$ENTRIES" >> "$TMP"
-        printf '%s\n' "$END_MARKER" >> "$TMP"
+        {
+          printf '\n%s\n' "$BEGIN_MARKER"
+          printf '%s\n' "# These entries route configured service domains to local Caddy."
+          printf '%s\n' "# They are managed automatically — do not edit this block."
+          printf '%s\n' "$ENTRIES"
+          printf '%s\n' "$END_MARKER"
+        } >> "$TMP"
      fi

      # ── Step 5: atomically replace /etc/hosts ─────────────────────────────
@@ -110,6 +122,14 @@
    '';
  };

+in
+{
+  # ── /etc/sovran-hosts-update.sh — operator discoverability symlink ─────────
+  # Retain the familiar /etc path so administrators can inspect or manually
+  # invoke the helper.  The target is the wrapped Nix-store executable, so
+  # there is no second raw script body to keep in sync.
+  environment.etc."sovran-hosts-update.sh".source = lib.getExe hostsUpdateScript;
+
  # ── Systemd service ────────────────────────────────────────────────────────

  systemd.services.sovran-hosts-update = {
@@ -126,18 +146,24 @@
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
-      ExecStart = "/etc/sovran-hosts-update.sh";
+      # Point directly at the wrapped Nix-store executable, not the /etc path.
+      ExecStart = lib.getExe hostsUpdateScript;
    };
  };

  # ── Activation script (runs after every nixos-rebuild switch) ─────────────
  # This ensures the loopback block survives rebuilds that restore the /etc/hosts
  # symlink.  The "users" and "etc" scripts must complete first.
+  # The same wrapped Nix-store executable used by the systemd service is
+  # referenced here, guaranteeing identical runtime dependencies in both
+  # execution contexts.

  system.activationScripts.sovranDomainLoopback = {
    text = ''
-      if [ -x /etc/sovran-hosts-update.sh ] && [ -d /var/lib/domains ]; then
-        /etc/sovran-hosts-update.sh || true
+      if [ -d /var/lib/domains ]; then
+        if ! ${lib.getExe hostsUpdateScript}; then
+          echo "warning: sovran-hosts-update: failed to update /etc/hosts loopback entries" >&2
+        fi
      fi
    '';
    deps = [ "etc" "users" ];
@@ -1,32 +1,137 @@
 { config, pkgs, lib, ... }:

 {
-  # ── Ensure njalla directory and base script exist on every build ──
+  # ── Ensure njalla directory exists on every build ────────────────────────
  systemd.tmpfiles.rules = [
    "d /var/lib/njalla 0750 root root -"
  ];

-  # ── Create base njalla.sh if it doesn't exist yet ────────────
-  systemd.services.njalla-init = {
-    description = "Initialize Njal.la DDNS script if missing";
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    unitConfig = {
-      ConditionPathExists = "!/var/lib/njalla/njalla.sh";
-    };
-    script = ''
-      cat > /var/lib/njalla/njalla.sh <<'SCRIPT'
-#!/usr/bin/env bash
-IP=$(dig @resolver4.opendns.com myip.opendns.com +short -4)
-
-## Add DDNS entries below — one curl per line
-## Managed via Sovran Hub web interface
-SCRIPT
-
-      chmod 700 /var/lib/njalla/njalla.sh
-    '';
+  # ── Install the shared validation helper so the DDNS runner can import it ─
+  # The exact same _validate_ddns_url() function used by the Hub web application
+  # is installed here as a read-only system file.  The DDNS runner imports it
+  # directly so the two code paths share one validator — no weaker inline copy.
+  environment.etc."sovran/security_helpers.py" = {
+    source = ../../app/sovran_systemsos_web/security_helpers.py;
+    mode   = "0444";
+    user   = "root";
+    group  = "root";
  };
-}
+
+  # ── Safe DDNS update service ─────────────────────────────────────────────
+  # Reads DDNS update URLs from the JSON store written by the Hub API and
+  # invokes curl directly — no shell interpolation, no script execution.
+  # Replaces the legacy root cron job that ran /var/lib/njalla/njalla.sh.
+  systemd.services.sovran-ddns-update = {
+    description = "Sovran Njal.la DDNS update (safe JSON-based runner)";
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      Type        = "oneshot";
+      User        = "root";
+      ExecStart   = "${pkgs.python3}/bin/python3 /var/lib/sovran/ddns-update.py";
+      # Harden the service — it only needs network access and read access to
+      # /var/lib/njalla/ddns_urls.json.
+      NoNewPrivileges    = true;
+      ProtectSystem      = "strict";
+      ReadWritePaths     = [ "/var/lib/njalla" "/var/lib/secrets" ];
+      ReadOnlyPaths      = [ "/etc/sovran" ];
+      ProtectHome        = true;
+      PrivateTmp         = true;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+    };
+  };
+
+  # Run the update every 15 minutes
+  systemd.timers.sovran-ddns-update = {
+    description = "Sovran Njal.la DDNS update timer";
+    wantedBy    = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec    = "2min";
+      OnUnitActiveSec = "15min";
+      Persistent   = true;
+    };
+  };
+
+  # Install the Python runner script at build time so the service can find it.
+  # The script is owned by root and not world-writable.
+  # Uses _validate_ddns_url() from /etc/sovran/security_helpers.py — the same
+  # production validator used by the Hub API — before executing any curl call.
+  # No shell is used; no redirects; no script execution.
+  # ${IP} placeholder is preserved in stored URLs and substituted at runtime;
+  # the URL is validated after substitution so any remaining $ is rejected.
+  system.activationScripts.sovran-ddns-update-script = ''
+    install -d -m 0755 /var/lib/sovran
+    cat > /var/lib/sovran/ddns-update.py <<'PYEOF'
+#!/usr/bin/env python3
+"""Sovran safe DDNS update runner.
+
+Reads ddns_urls.json, substitutes the public IP for the ''${IP} placeholder,
+validates each URL using the production _validate_ddns_url() from
+/etc/sovran/security_helpers.py, then calls curl per URL.
+No shell interpolation.  No redirects.  No script execution.
+"""
+import ipaddress, json, os, subprocess, sys
+
+sys.path.insert(0, '/etc/sovran')
+try:
+    from security_helpers import _validate_ddns_url
+except ImportError:
+    sys.exit(1)  # validator missing — fail so systemd logs the misconfiguration
+
+URLS_FILE = "/var/lib/njalla/ddns_urls.json"
+
+try:
+    with open(URLS_FILE) as f:
+        urls = json.load(f)
+    if not isinstance(urls, list):
+        raise ValueError("not a list")
+except Exception:
+    sys.exit(0)  # no URLs configured — nothing to do
+
+# Resolve current public IP via the shared detector — one script, one cache
+# (STUN -> DNS -> opt-in HTTPS echo; see /var/lib/sovran/public-ip.py).
+# The detector refreshes /var/lib/secrets/external-ip, which the Hub and
+# LiveKit read as well, so the whole system shares a single detected value.
+public_ip = ""
+try:
+    r = subprocess.run(
+        [sys.executable, "/var/lib/sovran/public-ip.py", "check"],
+        capture_output=True, text=True, timeout=20,
+    )
+    raw = r.stdout.strip().splitlines()[0] if r.stdout.strip() else ""
+    ipaddress.ip_address(raw)  # validates — raises if not a real IP
+    public_ip = raw
+except Exception:
+    pass
+
+if not public_ip:
+    # Last resort: the shared cache file, if the detector is unavailable.
+    try:
+        with open("/var/lib/secrets/external-ip") as f:
+            raw = f.read().strip()
+        ipaddress.ip_address(raw)
+        public_ip = raw
+    except Exception:
+        pass
+
+if not public_ip:
+    sys.exit(0)  # no IP resolved — skip to avoid sending bare ''${IP}
+
+for raw_url in urls:
+    try:
+        # Substitute ''${IP} placeholder then validate through production validator.
+        # After substitution there must be no $ left; _validate_ddns_url rejects
+        # any remaining $ expression.
+        url = raw_url.replace("''${IP}", public_ip)
+        _validate_ddns_url(url)
+        subprocess.run(
+            ["curl", "--silent", "--max-time", "15", "--fail", "--no-location", url],
+            timeout=20, check=False,
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+    except Exception:
+        pass
+PYEOF
+    chmod 0500 /var/lib/sovran/ddns-update.py
+  '';
+}
@@ -0,0 +1,323 @@
+# ── Unified public-IP detection (privacy-first) ─────────────────────────────
+#
+# One script, one cache file, every consumer on the system reads the same
+# value. Previously the public IP was detected independently in three places,
+# each phoning home to a different third party:
+#   * the Hub (server.py _get_external_ip) → api.ipify.org / ifconfig.me /
+#     icanhazip.com over HTTPS on every /api/network call and every
+#     background-loop tick
+#   * DDNS (ddns-update.py) → myip.opendns.com via OpenDNS
+#   * LiveKit → STUN (its own embedded detection)
+#
+# This module replaces all of that with a single script
+# (/var/lib/sovran/public-ip.py) that detects the IP once per TTL using the
+# least-exposing mechanism available, and caches it in
+# /var/lib/secrets/external-ip. Consumers (Hub, DDNS, LiveKit) read the cache
+# and only invoke the script when it is missing or stale.
+#
+# Detection chain (first success wins, stops immediately):
+#   1. pin         — sovran_systemsOS.elementCalling.externalIP (baked in)
+#   2. cache       — /var/lib/secrets/external-ip if newer than cacheTTL
+#   3. STUN        — UDP binding request (one packet, no application data,
+#                    no HTTP metadata; the same protocol every WebRTC client
+#                    uses). Server configurable via publicIP.stunServer.
+#   4. DNS         — "myip.opendns.com" A query via publicIP.dnsResolver
+#                    (single DNS query, no HTTP headers)
+#   5. HTTPS echo  — ONLY endpoints listed in publicIP.httpsEcho (empty by
+#                    default → never contacted)
+#
+# Privacy property: while the cache is fresh, zero third parties are
+# contacted. When detection runs, at most ONE party learns the IP per
+# refresh interval (default 5 minutes), and the STUN/DNS mechanisms expose
+# nothing beyond the bare address.
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  stunServer  = config.sovran_systemsOS.publicIP.stunServer;
+  stunPort    = config.sovran_systemsOS.publicIP.stunPort;
+  dnsResolver = config.sovran_systemsOS.publicIP.dnsResolver;
+  httpsEcho   = config.sovran_systemsOS.publicIP.httpsEcho;
+  cacheTTL    = config.sovran_systemsOS.publicIP.cacheTTL;
+
+  # Optional pin shared with element-calling (baked in at build time).
+  pin = if config.sovran_systemsOS.elementCalling.externalIP != null then config.sovran_systemsOS.elementCalling.externalIP else "";
+
+  echoList = lib.concatStringsSep "," (map (u: "'${u}'") httpsEcho);
+in
+{
+  options.sovran_systemsOS.publicIP = {
+    stunServer = lib.mkOption {
+      type = lib.types.str;
+      default = "stun.l.google.com";
+      description = ''
+        STUN server used to discover the public IP over UDP. STUN is the most
+        privacy-preserving detection mechanism: a single stateless packet,
+        no HTTP metadata. Only used when the cache is stale.
+      '';
+    };
+    stunPort = lib.mkOption {
+      type = lib.types.port;
+      default = 19302;
+    };
+    dnsResolver = lib.mkOption {
+      type = lib.types.str;
+      default = "resolver4.opendns.com";
+      description = ''
+        DNS resolver used as fallback (myip.opendns.com trick) when STUN is
+        unavailable (e.g. ISP blocks UDP egress). A single DNS query, no
+        HTTP headers.
+      '';
+    };
+    httpsEcho = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "https://api.ipify.org" ];
+      description = ''
+        OPT-IN HTTPS endpoints that return the caller's public IP as a bare
+        IPv4 literal. Each listed endpoint observes this server's public IP
+        and HTTP metadata every time detection runs. Empty by default — no
+        HTTPS echo service is ever contacted unless you add one here. This is
+        the last-resort fallback after STUN and DNS.
+      '';
+    };
+    cacheTTL = lib.mkOption {
+      type = lib.types.int;
+      default = 300;
+      description = "Seconds the detected public IP is cached before re-detection.";
+    };
+  };
+
+  # ── Install the unified detector ──────────────────────────────────────────
+  # This module declares `options` above, so ALL configuration must go under
+  # the `config` attribute: NixOS forbids mixing bare top-level settings
+  # (like `system.*`) with the `options`/`config` keyword attributes in the
+  # same module. (Fixes: "Module ... has an unsupported attribute `system'".)
+  config.system.activationScripts.sovranPublicIpInstall = lib.stringAfter [ "users" ] ''
+    install -d -m 0755 /var/lib/sovran
+    cat > /var/lib/sovran/public-ip.py <<'PYEOF'
+#!/usr/bin/env python3
+"""sovran-public-ip — one detector, one cache, every consumer reads the same IP.
+
+Privacy-first detection chain (first success wins):
+  1. pin     — baked in from sovran_systemsOS.elementCalling.externalIP
+  2. cache   — /var/lib/secrets/external-ip if newer than CACHE_TTL seconds
+  3. STUN    — UDP binding request (one packet, no application data)
+  4. DNS     — myip.opendns.com A query via the configured resolver
+  5. HTTPS   — ONLY endpoints baked in from publicIP.httpsEcho (opt-in)
+
+Usage:
+  public-ip.py check     print current public IP (cache first; refresh if stale)
+  public-ip.py refresh   force re-detection, update the cache file, print IP
+
+Exit status: 0 with the IP on stdout on success; 1 if no IP is available
+(cached value, if any, is still printed to stdout with a warning on stderr).
+"""
+import ipaddress
+import os
+import random
+import socket
+import struct
+import sys
+import time
+import urllib.request
+
+CACHE_FILE = "/var/lib/secrets/external-ip"
+PIN        = "${pin}"
+STUN_SERVER = "${stunServer}"
+STUN_PORT   = ${toString stunPort}
+DNS_RESOLVER = "${dnsResolver}"
+DNS_HOST     = "myip.opendns.com"
+ECHO_URLS    = [ ${echoList} ]
+CACHE_TTL    = ${toString cacheTTL}
+TIMEOUT      = 3.0
+
+# ---------------------------------------------------------------------------
+# Detection primitives
+# ---------------------------------------------------------------------------
+
+def is_usable_ip(text: str) -> bool:
+    """True if text is a globally routable IPv4 that LiveKit may advertise."""
+    try:
+        ip = ipaddress.ip_address(text)
+    except ValueError:
+        return False
+    if ip.version != 4:
+        return False
+    if (ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_multicast
+            or ip.is_reserved or ip.is_unspecified or not ip.is_global):
+        return False
+    # RFC 6598 shared (CGNAT) space — not reachable from the internet.
+    if ip in ipaddress.ip_network("100.64.0.0/10"):
+        return False
+    return True
+
+
+def stun_public_ip() -> str | None:
+    """RFC 5389 Binding request over UDP; returns the mapped (public) IPv4."""
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(TIMEOUT)
+    try:
+        txid = random.randbytes(12)
+        req = struct.pack("!HHI", 0x0001, 0, 0) + txid  # Binding request
+        sock.sendto(req, (STUN_SERVER, STUN_PORT))
+        data, _ = sock.recvfrom(2048)
+    except OSError:
+        return None
+    finally:
+        sock.close()
+
+    if len(data) < 20:
+        return None
+    mtype, _mlen = struct.unpack("!HH", data[:4])
+    if mtype != 0x0101:  # Binding success response
+        return None
+
+    cookie = data[4:8]
+    i = 20
+    while i + 4 <= len(data):
+        atype, alen = struct.unpack("!HH", data[i : i + 4])
+        aval = data[i + 4 : i + 4 + alen]
+        if atype in (0x0001, 0x0020) and len(aval) >= 8:  # MAPPED / XOR-MAPPED
+            family = aval[1]
+            if family == 0x01:  # IPv4
+                raw = aval[4:8]
+                if atype == 0x0020:  # XOR with magic cookie + txid prefix
+                    raw = bytes(b ^ c for b, c in zip(raw, cookie + txid[:4]))
+                return socket.inet_ntop(socket.AF_INET, raw)
+        i += 4 + ((alen + 3) // 4) * 4
+    return None
+
+
+def dns_public_ip() -> str | None:
+    """Minimal DNS A query for myip.opendns.com against the given resolver."""
+    qid = random.randint(0, 0xFFFF)
+    qname = b"".join(bytes([len(p)]) + p.encode() for p in DNS_HOST.split(".")) + b"\x00"
+    query = struct.pack("!HHHHHH", qid, 0x0100, 1, 0, 0, 0) + qname + struct.pack("!HH", 1, 1)
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(TIMEOUT)
+    try:
+        sock.sendto(query, (DNS_RESOLVER, 53))
+        data, _ = sock.recvfrom(4096)
+    except OSError:
+        return None
+    finally:
+        sock.close()
+
+    try:
+        if len(data) < 12:
+            return None
+        rid, _flags, _qd, an, _ns, _ar = struct.unpack("!HHHHHH", data[:12])
+        if rid != qid or an == 0:
+            return None
+        i = 12
+        for _ in range(_qd):  # skip question
+            while data[i] != 0:
+                i += 1 + data[i]
+            i += 5
+        for _ in range(an):
+            if data[i] & 0xC0 == 0xC0:
+                i += 2
+            else:
+                while data[i] != 0:
+                    i += 1 + data[i]
+                i += 1
+            rtype, _rclass, _ttl, rdlen = struct.unpack("!HHIH", data[i : i + 10])
+            i += 10
+            if rtype == 1 and rdlen == 4:
+                return socket.inet_ntop(socket.AF_INET, data[i : i + 4])
+            i += rdlen
+    except (IndexError, struct.error):
+        return None
+    return None
+
+
+def echo_public_ip() -> str | None:
+    """Opt-in HTTPS echo endpoints (baked in at build time; empty by default)."""
+    for url in ECHO_URLS:
+        try:
+            req = urllib.request.Request(url, headers={"User-Agent": "sovran-public-ip"})
+            with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
+                text = resp.read().decode().strip()
+            if is_usable_ip(text):
+                return text
+        except Exception:
+            continue
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Cache handling
+# ---------------------------------------------------------------------------
+
+def read_cache() -> str:
+    try:
+        with open(CACHE_FILE) as f:
+            return f.read().strip()
+    except OSError:
+        return ""
+
+
+def write_cache(ip: str) -> None:
+    try:
+        os.makedirs(os.path.dirname(CACHE_FILE), exist_ok=True)
+        tmp = f"{CACHE_FILE}.tmp"
+        with open(tmp, "w") as f:
+            f.write(ip + "\n")
+        os.replace(tmp, CACHE_FILE)
+    except OSError:
+        pass
+
+
+def cache_fresh() -> bool:
+    try:
+        return time.time() - os.path.getmtime(CACHE_FILE) < CACHE_TTL
+    except OSError:
+        return False
+
+
+def detect() -> str:
+    """Run the chain; returns usable IP or an empty string."""
+    if PIN and is_usable_ip(PIN):
+        return PIN
+    for fn in (stun_public_ip, dns_public_ip, echo_public_ip):
+        try:
+            cand = fn()
+        except Exception:
+            continue
+        if cand and is_usable_ip(cand):
+            return cand
+    return ""
+
+
+def main() -> int:
+    force = len(sys.argv) > 1 and sys.argv[1] == "refresh"
+    ip = ""
+    if not force and cache_fresh():
+        ip = read_cache()
+    if not ip:
+        ip = detect()
+        if ip:
+            write_cache(ip)
+        else:
+            stale = read_cache()
+            if stale:
+                print(stale)
+                print("WARNING: detection failed; using last known public IP", file=sys.stderr)
+                return 0
+            print("ERROR: could not determine a public IP (STUN/DNS unreachable)", file=sys.stderr)
+            return 1
+    print(ip)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
+PYEOF
+    chmod 0555 /var/lib/sovran/public-ip.py
+  '';
+}
@@ -3,9 +3,9 @@
 {
  config = lib.mkMerge [

-    # nix-bitcoin is globally imported by the flake (nixosModules.Sovran_SystemsOS).
-    # This default satisfies nix-bitcoin's generateSecrets assertion so that Desktop
-    # Only systems can evaluate without enabling any Bitcoin services.
+    # The Sovran_Bitcoin flake module is always imported (see flake.nix).
+    # This default satisfies the secrets assertion so Desktop-Only systems evaluate
+    # without enabling any Bitcoin services.
    {
      nix-bitcoin.generateSecrets = lib.mkDefault true;
    }
@@ -33,7 +33,8 @@
        haven = lib.mkForce false;
        mempool = lib.mkForce false;
        element-calling = lib.mkForce false;
-        bitcoin-core = lib.mkForce false;
+        bitcoin-tor-gossip = lib.mkForce false;
+        "nwc-wallets" = lib.mkForce false;
      };

      sovran_systemsOS.web.btcpayserver = lib.mkForce false;
@@ -45,22 +45,20 @@
      haven = lib.mkEnableOption "Haven NOSTR relay";
      mempool = lib.mkEnableOption "Bitcoin Mempool Explorer";
      element-calling = lib.mkEnableOption "Element Video and Audio Calling";
-      bitcoin-core = lib.mkEnableOption "Bitcoin Core";
-      rdp = lib.mkEnableOption "Gnome Remote Desktop";
-      sshd = lib.mkEnableOption "SSH remote access";
-
-      # Deprecated: BIP-110 is now built into mainline Bitcoin Knots and is the
-      # default node. This option is retained ONLY so that existing machines with
-      # `sovran_systemsOS.features.bip110 = lib.mkForce true;` left in their local
-      # custom.nix continue to evaluate. It has no effect and will be removed in a
-      # future release once the Hub has cleaned up old custom.nix files.
-      bip110 = lib.mkOption {
+      bitcoin-tor-gossip = lib.mkEnableOption "Advertise the Bitcoin Core onion service through Bitcoin peer gossip";
+      # Compatibility shim for Hub-managed settings from releases where Core
+      # was an optional replacement for the default node. Core is now always
+      # selected when the Bitcoin service is enabled.
+      bitcoin-core = lib.mkOption {
        type = lib.types.nullOr lib.types.bool;
        default = null;
        internal = true;
        visible = false;
-        description = "(Deprecated, no-op) BIP-110 is now built into Bitcoin Knots.";
+        description = "Deprecated no-op: Bitcoin Core is the default node implementation.";
      };
+      "nwc-wallets" = lib.mkEnableOption "Lightning Wallet Connections";
+      rdp = lib.mkEnableOption "Gnome Remote Desktop";
+      sshd = lib.mkEnableOption "SSH remote access";
    };

    # ── Web exposure (controls Caddy vhosts) ──────────────────
@@ -81,6 +79,41 @@
      };
    };

+    # ── Element Calling (video/audio) tuning ──────────────────
+    elementCalling = {
+      fullAccessHomeservers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "matrix.peer.example.com" ];
+        description = ''
+          Additional Matrix server_names (beyond this server itself) that may
+          trigger LiveKit room creation on this server's SFU via lk-jwt-service.
+
+          Not needed for the common federated setup: each participant's client
+          always obtains its token from its own homeserver's JWT service and
+          publishes to its own SFU, and the participant who starts a call
+          creates the room on their own SFU — the remote user merely joins
+          (joining does not require full access).
+
+          Only set this for asymmetric cases: e.g. a peer homeserver that has
+          no focus of its own, or calls whose first participant lands on this
+          server's SFU but belongs to the peer.
+        '';
+      };
+      externalIP = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "203.0.113.10";
+        description = ''
+          Optional pin: force LiveKit to advertise this public IPv4 in its
+          host/TURN ICE candidates. Not required in normal operation — the
+          module auto-detects the public IP at runtime (HTTPS egress
+          detection, falling back to STUN). Set it only to override a
+          mis-detected address (e.g. multi-WAN/VPN setups).
+        '';
+      };
+    };
+
    # ── Domain setup registry ─────────────────────────────────
    domainRequirements = lib.mkOption {
      type = lib.types.listOf (lib.types.submodule {
@@ -102,14 +135,4 @@
    };
  };

-  config = lib.mkIf (config.sovran_systemsOS.features.bip110 != null) {
-    warnings = [
-      ''
-        sovran_systemsOS.features.bip110 is deprecated and has no effect:
-        BIP-110 is now built into mainline Bitcoin Knots, which is the default node.
-        You can safely remove the `sovran_systemsOS.features.bip110` line from
-        /etc/nixos/custom.nix. The Sovran Hub will also remove it automatically.
-      ''
-    ];
-  };
 }
@@ -3,6 +3,16 @@
 let
  cfg = config.sovran_systemsOS;

+  # Read the OS version from the repo-root VERSION file at eval time so the
+  # Hub always ships a real, baked-in version string instead of relying on
+  # a runtime file lookup (which returns "dev" when /etc/nixos/VERSION is
+  # missing, e.g. in a dev checkout — this is the "vdev" bug in the Hub UI).
+  versionFile = ../../VERSION;
+  sovranVersion =
+    if builtins.pathExists versionFile
+    then builtins.replaceStrings [ "v" "\n" "\r" ] [ "" "" "" ] (builtins.readFile versionFile)
+    else "1.0.0";
+
  monitoredServices =
    # ── Infrastructure — System Passwords (always present) ─────
    [
@@ -27,13 +37,10 @@ let
        { label = "How to Connect"; value = "1. Install an RDP client (e.g. Remmina, Microsoft Remote Desktop)\n2. Create a new RDP connection\n3. Enter the Address above as the host\n4. Enter the Username and Password above"; }
      ]; }
    ]
-    # ── Bitcoin Base (node implementations) ────────────────────
+    # ── Bitcoin Base ────────────────────────────────────────────
    ++ lib.optionals cfg.services.bitcoin [
-      { name = "Bitcoin Knots + BIP110"; unit = "bitcoind.service"; type = "system"; icon = "bip110";        enabled = cfg.services.bitcoin && !cfg.features.bitcoin-core; category = "bitcoin-base"; credentials = [
-        { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
-      ]; }
-      { name = "Bitcoin Core";           unit = "bitcoind.service"; type = "system"; icon = "bitcoin-core";  enabled = cfg.features.bitcoin-core;  category = "bitcoin-base"; credentials = [
-        { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
+      { name = "Bitcoin Core"; unit = "bitcoind.service"; type = "system"; icon = "bitcoin-core"; enabled = cfg.services.bitcoin; category = "bitcoin-base"; credentials = [
+        { label = "Tor Bitcoin P2P Address — Reachable only through Tor"; file = "/var/lib/tor/onion/bitcoind/hostname"; suffix = ":8333"; }
      ]; }
    ]
    # ── Bitcoin Apps (services on top of the node) ─────────────
@@ -55,12 +62,14 @@ let
      ]; }
      { name = "Zeus Connect";       unit = "zeus-connect-setup.service"; type = "system"; icon = "zeus";   enabled = cfg.services.bitcoin;  category = "bitcoin-apps"; credentials = [
        { label = "QR Code"; file = "/var/lib/secrets/zeus-connect-url"; qrcode = true; qronly = true; }
-        { label = "How to Connect"; value = "1. Download Zeus from App Store or Google Play\n2. Open Zeus → Scan Node Config\n3. Scan the QR code above"; }
      ]; }
      { name = "Sparrow Auto-Link"; unit = "sparrow-autoconnect.service"; type = "system"; icon = "sparrow"; enabled = cfg.services.bitcoin; category = "bitcoin-apps"; credentials = [
        { label = "Server"; value = "tcp://127.0.0.1:50001 (Electrs)"; }
        { label = "Status"; value = "Auto-configured on first boot"; }
      ]; }
+      { name = "Lightning Wallet Connections"; unit = "albyhub.service"; type = "system"; icon = "nwc"; enabled = cfg.features."nwc-wallets"; category = "bitcoin-apps"; credentials = [
+        { label = "Lightning Address Domain"; file = "/var/lib/domains/lightning"; }
+      ]; }
      { name = "Mempool";            unit = "mempool.service";      type = "system"; icon = "mempool";      enabled = cfg.features.mempool;  category = "bitcoin-apps"; credentials = [
        { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/mempool-frontend/hostname"; prefix = "http://"; }
        { label = "Local Network — Access on your home network only"; file = "/var/lib/secrets/internal-ip"; prefix = "http://"; suffix = ":60847"; }
@@ -76,7 +85,7 @@ let
        { label = "Test Username";    file = "/var/lib/secrets/matrix-test-username"; }
        { label = "Test Password";    file = "/var/lib/secrets/matrix-test-password"; }
      ]; }
-      { name = "Element-Call";   unit = "livekit.service";        type = "system"; icon = "element-calling"; enabled = cfg.features.element-calling;  category = "communication"; credentials = []; }
+      { name = "LiveKit (Element Call)"; unit = "livekit.service"; type = "system"; icon = "element-calling"; enabled = cfg.features.element-calling; category = "communication"; credentials = []; }
    ]
    # ── Self-Hosted Apps (server+desktop only) ─────────────────
    ++ lib.optionals cfg.roles.server_plus_desktop [
@@ -113,8 +122,34 @@ let
      role             = activeRole;
      services         = monitoredServices;
      feature_manager  = true;
+      feature_states   = {
+        bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;
+      };
+      sovran_version   = sovranVersion;
    });

+  generatedVersions = pkgs.writeText "sovran-hub-versions.json" (builtins.toJSON {
+    "caddy.service" = if pkgs ? caddy then pkgs.caddy.version else "2.8.4";
+    "tor.service" = if pkgs ? tor then pkgs.tor.version else "0.4.8.12";
+    "gnome-remote-desktop.service" = if pkgs ? gnome-remote-desktop then pkgs.gnome-remote-desktop.version else "46.0";
+    "bitcoind.service" = if pkgs ? bitcoind then pkgs.bitcoind.version else "27.1.0";
+    "electrs.service" = if pkgs ? electrs then pkgs.electrs.version else "0.10.6";
+    "lnd.service" = if pkgs ? lnd then pkgs.lnd.version else "0.18.0";
+    # Vendored packages come from the Sovran_Bitcoin flake overlay
+    # (pkgs.sovran-bitcoin.*).  Evaluate them directly so the Hub shows
+    # the exact versions this system ships.
+    "rtl.service" = pkgs.sovran-bitcoin.rtl.version;
+    "btcpayserver.service" = lib.getVersion config.services.btcpayserver.package;
+    "albyhub.service" = pkgs.sovran-bitcoin.albyhub.version;
+    "mempool.service" = pkgs.sovran-bitcoin.mempool-backend.version;
+    "matrix-synapse.service" = if pkgs ? matrix-synapse then pkgs.matrix-synapse.version else "1.115.0";
+    "livekit.service" = if pkgs ? livekit then pkgs.livekit.version else "1.5.2";
+    "vaultwarden.service" = if pkgs ? vaultwarden then pkgs.vaultwarden.version else "1.32.0";
+    # Nextcloud and WordPress are downloaded into /var/lib/www, so their
+    # deployed versions are read from their own PHP version files by the Hub.
+    "haven-relay.service" = if pkgs ? haven-relay then pkgs.haven-relay.version else (if pkgs ? haven then pkgs.haven.version else "0.1.0");
+  });
+
  # ── Update wrapper script ──────────────────────────────────────
  update-script = pkgs.writeShellScript "sovran-hub-update.sh" ''
    set -uo pipefail
@@ -122,8 +157,10 @@ let

    LOG="/var/log/sovran-hub-update.log"
    STATUS="/var/log/sovran-hub-update.status"
+    GENERATION="/var/log/sovran-hub-update.generation"

    echo "RUNNING" > "$STATUS"
+    rm -f "$GENERATION"
    : > "$LOG"
    exec > >(tee -a "$LOG") 2>&1

@@ -147,16 +184,23 @@ let

    if [ "$RC" -eq 0 ]; then
      echo "── Step 2/3: nixos-rebuild boot (stage next reboot) ──"
-      BOOT_OUT=$(nixos-rebuild boot --flake /etc/nixos --print-build-logs \
+      # Stream output straight into $LOG (see rebuild-script) so the Hub UI
+      # shows live progress instead of an empty log during long builds.
+      nixos-rebuild boot --flake /etc/nixos --print-build-logs \
        --option connect-timeout 10 \
        --option stalled-download-timeout 90 \
        --option download-attempts 7 \
-        --option fallback true 2>&1)
+        --option fallback true
      BOOT_RC=$?
-      echo "$BOOT_OUT"
      if [ "$BOOT_RC" -ne 0 ]; then
        echo "[ERROR] nixos-rebuild boot failed"
        RC=1
+      elif ! readlink -f /nix/var/nix/profiles/system > "$GENERATION"; then
+        # The marker is informational only.  The Hub derives pending-reboot
+        # state from the NixOS system profile itself, so failing to record
+        # the marker must not fail an otherwise successful update.
+        echo "[WARNING] update succeeded but its staged generation could not be recorded"
+        rm -f "$GENERATION"
      fi
      echo ""
    fi
@@ -202,20 +246,23 @@ let
    echo "══════════════════════════════════════════════════"
    echo ""
    echo "── Rebuilding system configuration ──────────────"
-    SWITCH_OUT=$(nixos-rebuild switch --flake /etc/nixos --print-build-logs \
+    # Stream output straight into $LOG (tee'd by the exec redirect above) so
+    # the Hub UI shows live progress.  Capturing the output in a variable
+    # kept the log empty for the entire build+activation, which made long
+    # rebuilds can otherwise look like a hang.
+    nixos-rebuild switch --flake /etc/nixos --print-build-logs \
      --option connect-timeout 10 \
      --option stalled-download-timeout 90 \
      --option download-attempts 7 \
-      --option fallback true 2>&1)
+      --option fallback true
    SWITCH_RC=$?
-    echo "$SWITCH_OUT"
    if [ "$SWITCH_RC" -eq 0 ]; then
      echo ""
      echo "══════════════════════════════════════════════════"
      echo "  ✓ Rebuild completed successfully"
      echo "══════════════════════════════════════════════════"
      echo "SUCCESS" > "$STATUS"
-    elif echo "$SWITCH_OUT" | grep -q "switchInhibitors\|Pre-switch checks failed"; then
+    elif grep -q "switchInhibitors\|Pre-switch checks failed" "$LOG"; then
      echo ""
      echo "  ✓ Build succeeded — a reboot is required to apply this rebuild"
      echo "  (Critical system components changed; running nixos-rebuild boot instead)"
@@ -240,17 +287,31 @@ let
    fi
  '';

-  # ── Brave launcher wrapper: stable profile dir so Wayland app_id is
-  #    deterministic and GNOME Shell can match the window to the .desktop
-  #    entry (fixes generic gear icon appearing in the dock).
+  # ── Brave Origin launcher wrapper: a *persistent* per-user profile dir.
+  #    It must NOT be wiped on exit: the Hub's logout marker cookie
+  #    (hub_manual_logout) and the session cookie live in this profile.
+  #    Launching from a fresh/ephemeral profile every time throws away the
+  #    marker, so /auto-login would mint a new session and silently log the
+  #    user straight back in after they signed out and reopened the window.
+  #    A stable directory also keeps the Wayland app_id deterministic so
+  #    GNOME Shell can match the window to the .desktop entry (dock icon).
  hub-brave-wrapper = pkgs.writeShellScript "sovran-hub-brave.sh" ''
-    export PATH="${lib.makeBinPath [ pkgs.brave pkgs.coreutils ]}:$PATH"
-    HUB_DATA="/tmp/sovran-hub-brave-$(id -u)"
+    export PATH="${lib.makeBinPath [ pkgs.brave-origin pkgs.coreutils ]}:$PATH"
+    # Per-user, persistent browser state. $XDG_STATE_HOME keeps it out of the
+    # way of backups and survives reboots and window close/reopen.
+    if [ -n "$XDG_STATE_HOME" ]; then
+      HUB_DATA="$XDG_STATE_HOME/sovran-hub-browser"
+    else
+      HUB_DATA="$HOME/.local/state/sovran-hub-browser"
+    fi
    mkdir -p "$HUB_DATA"
-    trap '[ -n "$HUB_DATA" ] && rm -rf "$HUB_DATA"' EXIT INT TERM
    export BAMF_DESKTOP_FILE_HINT="/run/current-system/sw/share/applications/sovran-hub.desktop"
    export GIO_LAUNCHED_DESKTOP_FILE="/run/current-system/sw/share/applications/sovran-hub.desktop"
-    brave --app=http://localhost:8937/auto-login \
+    # With a persistent profile Brave Origin's one-time "Proceed with Origin
+    # for free on Linux" onboarding dialog only appears once; keep skipping it
+    # anyway so it can never block auto-login (Linux-only switch).
+    brave-origin --app=http://localhost:8937/auto-login \
+          --skip-origin-startup-dialog \
          --class=sovran-hub \
          --user-data-dir="$HUB_DATA" \
          --password-store=basic \
@@ -285,7 +346,8 @@ let

  sovran-hub-web = pkgs.python3Packages.buildPythonApplication {
    pname   = "sovran-systemsos-hub-web";
-    version = "1.0.0";
+    # Keep the package metadata in lockstep with the version shown in the Hub.
+    version = sovranVersion;
    format  = "other";

    src = ../../app;
@@ -308,6 +370,8 @@ let
      cp -r sovran_systemsos_web $out/lib/sovran-hub-web/

      cp ${generatedConfig} $out/lib/sovran-hub-web/config.json
+      cp ${generatedVersions} $out/lib/sovran-hub-web/versions.json
+      printf '%s' "${sovranVersion}" > $out/lib/sovran-hub-web/VERSION

      install -d $out/share/sovran-hub/icons
      cp icons/* $out/share/sovran-hub/icons/ 2>/dev/null || true
@@ -341,7 +405,11 @@ DESKTOP
 import os, sys
 base = os.path.join("$out", "lib", "sovran-hub-web")
 sys.path.insert(0, base)
+# Canonical NWC implementation — single source of truth from the
+# Sovran_Bitcoin flake (imported directly by server.py).
+sys.path.insert(0, os.path.join("${pkgs.sovran-bitcoin.nwc}", "lib", "sovran-nwc"))
 os.environ["SOVRAN_HUB_CONFIG"] = os.path.join(base, "config.json")
+os.environ["SOVRAN_HUB_VERSIONS"] = os.path.join(base, "versions.json")
 os.environ["SOVRAN_HUB_ICONS"]  = os.path.join("$out", "share", "sovran-hub", "icons")
 import uvicorn
 uvicorn.run(
@@ -353,6 +421,9 @@ uvicorn.run(
 LAUNCHER
      chmod +x $out/bin/sovran-hub-web

+      # nwc-wallet / nwc-lnurl binaries are no longer shipped here: the
+      # Sovran_Bitcoin flake provides them (env-wrapped nwc-wallet via
+      # albyhub.nix, nwc-lnurl.service via lnurl.nix) — single source of truth.
      runHook postInstall
    '';

@@ -364,6 +435,12 @@ LAUNCHER

 in
 {
+  options.services.sovranHub.webPackage = lib.mkOption {
+    type        = lib.types.package;
+    default     = sovran-hub-web;
+    description = "The sovran-hub-web Python application package. Other modules use this to reference Hub-installed scripts without duplicating the Python path setup.";
+  };
+
  config = {
    systemd.services.sovran-hub-web = {
      description = "Sovran_SystemsOS Hub Web Interface";
@@ -382,13 +459,25 @@ in
      };

      path = [
+        pkgs.bash
+        pkgs.gawk
        pkgs.qrencode
        pkgs.curl
        pkgs.iproute2
        pkgs.nftables
        pkgs.iptables
        pkgs.hostname
-      ] ++ lib.optional cfg.services.bitcoin config.services.bitcoind.package;
+        pkgs.coreutils
+        pkgs.findutils
+        pkgs.gnugrep
+        pkgs.rsync
+        pkgs.acl
+        pkgs.util-linux
+      ]
+      ++ lib.optional cfg.services.bitcoin config.services.bitcoind.package
+      ++ lib.optionals cfg.services.bitcoin [ pkgs.lnd ]
+      ++ lib.optionals (cfg.services.nextcloud || cfg.services.synapse) [ config.services.postgresql.package ]
+      ++ lib.optionals config.services.mysql.enable [ config.services.mysql.package ];
    };

    systemd.services.sovran-hub-update = {
@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Sovran restricted journal helper.
+
+A root-owned, non-user-writable diagnostic tool that wraps journalctl with
+a strict allowlist of safe flags.  Replaces the ``journalctl *`` sudo rule
+in tech-support.nix.
+
+Accepted flags:
+  --unit / -u <name>        must be one of the explicitly approved service units
+  --lines / -n <N>          positive integer (max 10000)
+  --priority / -p <level>   0-7 or emerg/alert/crit/err/warning/notice/info/debug
+  --since <datetime>        ISO 8601 date/datetime (no paths, no filesystem roots)
+  --until <datetime>        ISO 8601 date/datetime (no paths, no filesystem roots)
+  --output / -o <format>    short | short-iso | cat | json | verbose
+
+At least one ``--unit`` flag is required; whole-journal queries are rejected.
+All other flags, paths, directories, roots, namespaces, and output
+destinations are rejected with a non-zero exit code.
+"""
+
+import re
+import subprocess
+import sys
+
+# ── Allowlists ────────────────────────────────────────────────────────────────
+
+# Explicit approved units.  Only these four services may be queried through
+# the restricted journal helper.  Any other unit is rejected.
+_APPROVED_UNITS: frozenset[str] = frozenset([
+    "sovran-hub-web.service",
+    "caddy.service",
+    "bitcoind.service",
+    "lnd.service",
+])
+
+_ALLOWED_PRIORITIES = frozenset([
+    "0", "1", "2", "3", "4", "5", "6", "7",
+    "emerg", "alert", "crit", "err", "warning", "notice", "info", "debug",
+])
+
+_ALLOWED_OUTPUT_FORMATS = frozenset([
+    "short", "short-iso", "cat", "json", "verbose",
+])
+
+# ISO 8601 date or datetime: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS (no paths)
+_DATETIME_RE = re.compile(r'^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2})?)?$')
+
+_MAX_LINES = 10000
+
+# ── Argument parser ───────────────────────────────────────────────────────────
+
+
+def _die(msg: str) -> None:
+    print(f"sovran-journal-helper: {msg}", file=sys.stderr)
+    sys.exit(1)
+
+
+def _validate_unit(val: str) -> str:
+    if val not in _APPROVED_UNITS:
+        _die(
+            f"rejected unit name: {val!r} "
+            f"(allowed: {', '.join(sorted(_APPROVED_UNITS))})"
+        )
+    return val
+
+
+def _validate_lines(val: str) -> str:
+    try:
+        n = int(val)
+    except ValueError:
+        _die(f"rejected: --lines must be a positive integer, got {val!r}")
+    if n <= 0 or n > _MAX_LINES:
+        _die(f"rejected: --lines must be between 1 and {_MAX_LINES}, got {n}")
+    return str(n)
+
+
+def _validate_priority(val: str) -> str:
+    if val not in _ALLOWED_PRIORITIES:
+        _die(f"rejected priority: {val!r}")
+    return val
+
+
+def _validate_datetime(val: str) -> str:
+    if not _DATETIME_RE.match(val):
+        _die(f"rejected: datetime {val!r} (must be YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS)")
+    return val
+
+
+def _validate_output(val: str) -> str:
+    if val not in _ALLOWED_OUTPUT_FORMATS:
+        _die(f"rejected output format: {val!r}")
+    return val
+
+
+def main() -> None:
+    args = sys.argv[1:]
+    cmd = ["journalctl"]
+    unit_count = 0
+
+    i = 0
+    while i < len(args):
+        arg = args[i]
+
+        if arg in ("--unit", "-u"):
+            i += 1
+            if i >= len(args):
+                _die("--unit requires a value")
+            cmd += ["--unit", _validate_unit(args[i])]
+            unit_count += 1
+        elif arg.startswith("--unit="):
+            cmd += ["--unit", _validate_unit(arg[len("--unit="):])]
+            unit_count += 1
+
+        elif arg in ("--lines", "-n"):
+            i += 1
+            if i >= len(args):
+                _die("--lines requires a value")
+            cmd += ["--lines", _validate_lines(args[i])]
+        elif arg.startswith("--lines="):
+            cmd += ["--lines", _validate_lines(arg[len("--lines="):])]
+        elif re.match(r'^-n\d+$', arg):
+            cmd += ["--lines", _validate_lines(arg[2:])]
+
+        elif arg in ("--priority", "-p"):
+            i += 1
+            if i >= len(args):
+                _die("--priority requires a value")
+            cmd += ["--priority", _validate_priority(args[i])]
+        elif arg.startswith("--priority="):
+            cmd += ["--priority", _validate_priority(arg[len("--priority="):])]
+
+        elif arg == "--since":
+            i += 1
+            if i >= len(args):
+                _die("--since requires a value")
+            cmd += ["--since", _validate_datetime(args[i])]
+        elif arg.startswith("--since="):
+            cmd += ["--since", _validate_datetime(arg[len("--since="):])]
+
+        elif arg == "--until":
+            i += 1
+            if i >= len(args):
+                _die("--until requires a value")
+            cmd += ["--until", _validate_datetime(args[i])]
+        elif arg.startswith("--until="):
+            cmd += ["--until", _validate_datetime(arg[len("--until="):])]
+
+        elif arg in ("--output", "-o"):
+            i += 1
+            if i >= len(args):
+                _die("--output requires a value")
+            cmd += ["--output", _validate_output(args[i])]
+        elif arg.startswith("--output="):
+            cmd += ["--output", _validate_output(arg[len("--output="):])]
+
+        else:
+            _die(
+                f"rejected flag: {arg!r}. "
+                "Allowed flags: --unit, --lines, --priority, --since, --until, --output"
+            )
+
+        i += 1
+
+    if unit_count == 0:
+        _die(
+            "at least one --unit flag is required; "
+            f"allowed units: {', '.join(sorted(_APPROVED_UNITS))}"
+        )
+
+    result = subprocess.run(cmd)
+    sys.exit(result.returncode)
+
+
+if __name__ == "__main__":
+    main()
@@ -44,6 +44,35 @@ let
      fi
    fi

+    # ── Brave Origin migration (existing installs upgrading from `brave`) ──
+    # The old package's brave-browser.desktop no longer exists, so GNOME drops
+    # it from the dock and the Browsers folder.  Swap the id in place, but only
+    # when the stale value is still present (never touch user customizations).
+    if [ -f "$USER_DB" ]; then
+      FAVS="$(${pkgs.dconf}/bin/dconf read /org/gnome/shell/favorite-apps 2>/dev/null || true)"
+      if [ -n "$FAVS" ]; then
+        NEW_FAVS="''${FAVS//brave-browser.desktop/brave-origin.desktop}"
+        if [ "$NEW_FAVS" != "$FAVS" ]; then
+          ${pkgs.dconf}/bin/dconf write /org/gnome/shell/favorite-apps "$NEW_FAVS"
+        fi
+      fi
+
+      BROWSER_APPS="$(${pkgs.dconf}/bin/dconf read /org/gnome/desktop/app-folders/folders/Browsers/apps 2>/dev/null || true)"
+      if [ -n "$BROWSER_APPS" ]; then
+        NEW_BROWSER_APPS="''${BROWSER_APPS//brave-browser.desktop/brave-origin.desktop}"
+        if [ "$NEW_BROWSER_APPS" != "$BROWSER_APPS" ]; then
+          ${pkgs.dconf}/bin/dconf write /org/gnome/desktop/app-folders/folders/Browsers/apps "$NEW_BROWSER_APPS"
+        fi
+      fi
+    fi
+
+    # A previous fresh install wrote the user's mimeapps.list with the old id;
+    # XDG gives it precedence over the new system-wide default, so rewrite it.
+    MIME_LIST="$HOME/.config/mimeapps.list"
+    if [ -f "$MIME_LIST" ] && ${pkgs.gnugrep}/bin/grep -q 'brave-browser\.desktop' "$MIME_LIST"; then
+      ${pkgs.gnused}/bin/sed -i 's/brave-browser\.desktop/brave-origin.desktop/g' "$MIME_LIST"
+    fi
+
    # Already applied — skip
    if [ -f "$STAMP" ]; then
      exit 0
@@ -61,11 +90,11 @@ let
    mkdir -p "$HOME/.config"
    cat > "$HOME/.config/mimeapps.list" << EOF
 [Default Applications]
-text/html=brave-browser.desktop
-x-scheme-handler/http=brave-browser.desktop
-x-scheme-handler/https=brave-browser.desktop
-x-scheme-handler/about=brave-browser.desktop
-x-scheme-handler/unknown=brave-browser.desktop
+text/html=brave-origin.desktop
+x-scheme-handler/http=brave-origin.desktop
+x-scheme-handler/https=brave-origin.desktop
+x-scheme-handler/about=brave-origin.desktop
+x-scheme-handler/unknown=brave-origin.desktop
 EOF

    ${pkgs.dconf}/bin/dconf load / << EOF
@@ -104,7 +133,7 @@ search-filter-time-type='last_modified'
 [org/gnome/shell]
 disabled-extensions=['just-perfection-desktop@just-perfection']
 enabled-extensions=['appindicatorsupport@rgcjonas.gmail.com', 'dash-to-dock-cosmic-@halfmexicanhalfamazing@gmail.com', 'Vitals@CoreCoding.com', 'dash-to-dock@micxgx.gmail.com', 'pop-shell@system76.com', 'date-menu-formatter@marcinjakubowski.github.com', 'light-style@gnome-shell-extensions.gcampax.github.com']
-favorite-apps=['brave-browser.desktop', 'org.gnome.Settings.desktop', 'org.gnome.Nautilus.desktop', 'sovran-hub.desktop', 'org.gnome.Software.desktop', 'org.gnome.Geary.desktop', 'org.gnome.Contacts.desktop', 'org.gnome.Calendar.desktop', 'sparrow.desktop', 'Bisq.desktop', 'bisq2.desktop']
+favorite-apps=['brave-origin.desktop', 'org.gnome.Settings.desktop', 'org.gnome.Nautilus.desktop', 'sovran-hub.desktop', 'org.gnome.Software.desktop', 'org.gnome.Geary.desktop', 'org.gnome.Contacts.desktop', 'org.gnome.Calendar.desktop', 'sparrow.desktop', 'Bisq.desktop', 'bisq2.desktop']
 welcome-dialog-last-shown-version='48.4'

 [org/gnome/desktop/app-folders]
@@ -112,7 +141,7 @@ folder-children=['Browsers', 'Office', 'Terminal', 'Chat', 'Bitcoin', 'Media', '

 [org/gnome/desktop/app-folders/folders/Browsers]
 name='Browsers'
-apps=['brave-browser.desktop', 'firefox.desktop', 'org.gnome.Epiphany.desktop']
+apps=['brave-origin.desktop', 'firefox.desktop', 'org.gnome.Epiphany.desktop']

 [org/gnome/desktop/app-folders/folders/Office]
 name='Office'
@@ -269,7 +298,7 @@ in
        ];

        favorite-apps = [
-          "brave-browser.desktop"
+          "brave-origin.desktop"
          "org.gnome.Settings.desktop"
          "org.gnome.Nautilus.desktop"
          "sovran-hub.desktop"
@@ -292,7 +321,7 @@ in
      "org/gnome/desktop/app-folders/folders/Browsers" = {
        name = "Browsers";
        apps = [
-          "brave-browser.desktop"
+          "brave-origin.desktop"
          "firefox.desktop"
          "org.gnome.Epiphany.desktop"
        ];
@@ -433,13 +462,13 @@ in
  ];

  xdg.mime.defaultApplications = {
-    "text/html" = "brave-browser.desktop";
-    "x-scheme-handler/http" = "brave-browser.desktop";
-    "x-scheme-handler/https" = "brave-browser.desktop";
-    "x-scheme-handler/about" = "brave-browser.desktop";
-    "x-scheme-handler/unknown" = "brave-browser.desktop";
+    "text/html" = "brave-origin.desktop";
+    "x-scheme-handler/http" = "brave-origin.desktop";
+    "x-scheme-handler/https" = "brave-origin.desktop";
+    "x-scheme-handler/about" = "brave-origin.desktop";
+    "x-scheme-handler/unknown" = "brave-origin.desktop";
  };

-  environment.sessionVariables.BROWSER = "brave-browser";
+  environment.sessionVariables.BROWSER = "brave-origin";

 }
@@ -11,11 +11,10 @@
 #     (u:sovran-support:---) by the Hub API as soon as a session is started.
 #   • The Hub web UI lets the user grant time-limited access to wallet files
 #     and view a full audit log of every session event.
-#   • Scoped sudo rules allow support staff to edit custom.nix, trigger rebuilds,
-#     restart services, and read logs — without full root or wallet access.
-#
-# The `acl` package provides the `setfacl` / `getfacl` utilities required by
-# the Hub's _apply_wallet_acls() and _revoke_wallet_acls() helpers.
+#   • Scoped sudo rules allow support staff to restart specific services and
+#     read logs — without full root, wallet access, Nix editing, or rebuilds.
+#   • journalctl access is provided only through the root-owned
+#     sovran-journal-helper script (see below) with an allowlist of safe flags.
 {
  # ── System packages ────────────────────────────────────────────────────────
  environment.systemPackages = [ pkgs.acl ];
@@ -42,18 +41,40 @@
    "d /var/lib/sovran-support/.ssh 0700 sovran-support sovran-support -"
  ];

+  # ── Restricted journal helper ─────────────────────────────────────────────
+  # The helper is root-owned, not writable by any user, and accepts only a
+  # narrow allowlist of safe journalctl flags.  It is the sole mechanism by
+  # which the support user may read journal logs.
+  environment.etc."sovran/sovran-journal-helper.py" = {
+    source = ./sovran-journal-helper.py;
+    mode   = "0500";
+    user   = "root";
+    group  = "root";
+  };
+
  # ── Scoped sudo rules for support staff ───────────────────────────────────
-  # Grants only the minimum privileges needed for a support session.
-  # Support staff cannot stop/disable/mask services or access wallet files.
+  # Grants only the minimum privileges needed for diagnostic support.
+  # Editing Nix configuration and running nixos-rebuild are intentionally
+  # excluded: combining those two permissions provides a trivial path to
+  # arbitrary root code execution.  Systemctl access is limited to a small
+  # allowlist of named service restart operations.  journalctl is available
+  # only through the restricted helper above.
  security.sudo.extraRules = [
    {
      users = [ "sovran-support" ];
      commands = [
-        { command = "/run/current-system/sw/bin/nano /etc/nixos/custom.nix";        options = [ "NOPASSWD" ]; }
-        { command = "/run/current-system/sw/bin/nano /etc/nixos/configuration.nix"; options = [ "NOPASSWD" ]; }
-        { command = "/run/current-system/sw/bin/nixos-rebuild switch --flake /etc/nixos"; options = [ "NOPASSWD" ]; }
-        { command = "/run/current-system/sw/bin/systemctl restart *";               options = [ "NOPASSWD" ]; }
-        { command = "/run/current-system/sw/bin/journalctl *";                      options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl restart sovran-hub-web.service"; options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl restart caddy.service";       options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl restart bitcoind.service";    options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl restart lnd.service";         options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl status sovran-hub-web.service"; options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl status caddy.service";        options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl status bitcoind.service";     options = [ "NOPASSWD" ]; }
+        { command = "/run/current-system/sw/bin/systemctl status lnd.service";          options = [ "NOPASSWD" ]; }
+        # Restricted journal helper: accepts only safe flags (--unit, --lines,
+        # --priority, --since, --until, --output).  Rejects paths, directories,
+        # namespaces, roots, and arbitrary output destinations.
+        { command = "/run/current-system/sw/bin/python3 /etc/sovran/sovran-journal-helper.py *"; options = [ "NOPASSWD" ]; }
      ];
    }
  ];
@@ -111,7 +111,15 @@ in
        echo "$ROOT_PASS" > "$SECRET_FILE"
        chmod 600 "$SECRET_FILE"
      fi
-      echo "root:$(cat "$SECRET_FILE")" | chpasswd
+      # If the file contains a scrypt hash (salt:hash), skip chpasswd — the
+      # password was already set via the Hub security reset endpoint and this
+      # service is only re-running as a manual recovery step.
+      CONTENT="$(cat "$SECRET_FILE")"
+      if echo "$CONTENT" | grep -qE '^[0-9a-f]{32}:[0-9a-f]{64,}$'; then
+        echo "root-password-setup: stored value is already hashed — skipping chpasswd" >&2
+      else
+        echo "root:$CONTENT" | chpasswd
+      fi
    '';
  };

@@ -33,9 +33,15 @@ lib.mkIf config.sovran_systemsOS.features.element-calling {
    '';
  };

-  ####### ENSURE SERVICES START AFTER KEY EXISTS #######
-  systemd.services.livekit.after = [ "livekit-key-setup.service" "livekit-turn-setup.service" ];
-  systemd.services.livekit.wants = [ "livekit-key-setup.service" "livekit-turn-setup.service" ];
+  ####### ENSURE SERVICES START AFTER KEY & NETWORK EXIST #######
+  # Ordering against network-online.target matters: livekit-turn-setup detects
+  # the primary interface from the IPv4 default route. If it runs before the
+  # network is up (no default route yet) it exits 1 and, being a hard
+  # dependency of livekit.service, takes livekit down with it — the Hub then
+  # shows a "failed" red dot until livekit is restarted manually. See the
+  # livekit-turn-setup block for the matching network-online ordering.
+  systemd.services.livekit.after = [ "network-online.target" "livekit-key-setup.service" "livekit-turn-setup.service" ];
+  systemd.services.livekit.wants = [ "network-online.target" "livekit-key-setup.service" "livekit-turn-setup.service" ];
  systemd.services.lk-jwt-service.after = [ "livekit-key-setup.service" ];
  systemd.services.lk-jwt-service.wants = [ "livekit-key-setup.service" ];

@@ -114,7 +120,12 @@ EOF
  #     substituted) that the overridden ExecStart loads.
  systemd.services.livekit-turn-setup = {
    description = "Stage TURN cert and generate LiveKit runtime config from domain files";
-    after = [ "caddy.service" "livekit-key-setup.service" ];
+    # Wait for a default IPv4 route before detecting the interface, and for
+    # Caddy to have started (cert generation is async, so also see the retry
+    # loop below). Otherwise on a cold boot this unit can fail / produce empty
+    # certs, which breaks livekit.service (requiredBy) and shows a red dot.
+    after = [ "network-online.target" "caddy.service" "livekit-key-setup.service" ];
+    wants = [ "network-online.target" ];
    before = [ "livekit.service" ];
    requiredBy = [ "livekit.service" ];
    wantedBy = [ "multi-user.target" ];
@@ -125,19 +136,39 @@ EOF
    unitConfig = {
      ConditionPathExists = "/var/lib/domains/element-calling";
    };
-    path = [ pkgs.coreutils pkgs.findutils pkgs.iproute2 pkgs.gawk ];
+    path = [ pkgs.coreutils pkgs.findutils pkgs.iproute2 pkgs.gawk pkgs.python3 ];
    script = ''
      MATRIX=$(cat /var/lib/domains/matrix)
+      ELEMENT_CALLING=$(cat /var/lib/domains/element-calling)

      mkdir -p /run/livekit

      # Copy Caddy's already-issued matrix cert/key into LiveKit's state dir.
      # The ACME CA hostname directory can vary, so glob for the domain dir.
-      CRT=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.crt" | head -n1)
-      KEY=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.key" | head -n1)
-      cp "$CRT" /var/lib/livekit/turn.crt
-      cp "$KEY" /var/lib/livekit/turn.key
-      chmod 640 /var/lib/livekit/turn.crt /var/lib/livekit/turn.key
+      # Caddy issues ACME certs asynchronously, so on a fresh boot the cert may
+      # not exist yet. Retry (bounded) so we never write an empty turn.crt/key;
+      # otherwise embedded TURN silently breaks until the next livekit restart.
+      CRT=""
+      KEY=""
+      for _ in $(seq 1 30); do
+        CRT=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.crt" | head -n1)
+        KEY=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.key" | head -n1)
+        if [ -n "$CRT" ] && [ -n "$KEY" ] \
+           && [ -s "$CRT" ] && [ -s "$KEY" ]; then
+          break
+        fi
+        CRT=""
+        KEY=""
+        echo "Waiting for Caddy to issue the $MATRIX ACME certificate..."
+        sleep 2
+      done
+      if [ -z "$CRT" ] || [ -z "$KEY" ]; then
+        echo "ERROR: Caddy ACME certificate for $MATRIX not available after retries; TURN will not be enabled for LiveKit." >&2
+      else
+        cp "$CRT" /var/lib/livekit/turn.crt
+        cp "$KEY" /var/lib/livekit/turn.key
+        chmod 640 /var/lib/livekit/turn.crt /var/lib/livekit/turn.key
+      fi

      # Detect the primary network interface from the IPv4 default route.
      # Restricting LiveKit to this single interface prevents it from
@@ -154,56 +185,144 @@ EOF
      fi
      echo "Detected primary network interface: $IFACE"

+      # Derive the LAN subnet this box sits on so the embedded TURN relay
+      # is allowed to hand media to LiveKit's LAN host candidate (see the
+      # allow_restricted_peer_cidrs block below). Computed from the primary
+      # interface's own address, so it always matches the subnet the LAN
+      # clients (phones on Wi-Fi) actually live on.
+      LAN_CIDR=$(ip -4 -o addr show dev "$IFACE" | awk '{print $4}' | grep -vE '^(127\.|169\.254\.)' | head -n1 | python3 -c 'import sys, ipaddress; s = sys.stdin.read().strip(); print(str(ipaddress.ip_network(s, strict=False)) if s else "")' 2>/dev/null)
+      echo "Derived LAN CIDR for TURN relay: ${LAN_CIDR:-<none>}"
+
      # Generate the full LiveKit config the daemon will load. turn.domain and
      # rtc.interfaces.includes are only known at runtime, so they are
      # substituted here. The cert/key paths point at the LoadCredential-staged
      # copies under /run/credentials.
-      cat > /run/livekit/livekit.yaml <<EOF
+      #
+      # Determine the public IPv4 to advertise in LiveKit ICE candidates.
+      # Remote peers must be able to reach this address, so it must be the
+      # server's public IP — or the router's WAN IP when the server is behind
+      # NAT with port-forwarding. It does not need to be assigned to this box,
+      # and it may be dynamic.
+      #
+      # Reuse the shared detector (/var/lib/sovran/public-ip.py — see
+      # modules/core/public-ip.nix) instead of running our own: one script,
+      # one cache, privacy-first (STUN -> DNS -> opt-in HTTPS echo). Priority:
+      #   1. sovran_systemsOS.elementCalling.externalIP (explicit pin, if set)
+      #   2. /var/lib/secrets/external-ip (the shared cache)
+      #   3. run the detector now (it refreshes the cache)
+      #   4. STUN auto-detection (use_external_ip) as the fallback, with a
+      #      warning — this is where broken installs used to silently end up
+      #      advertising a private IP, causing "call connects but no video".
+      EXTERNAL_IP='${if config.sovran_systemsOS.elementCalling.externalIP != null then config.sovran_systemsOS.elementCalling.externalIP else ""}'
+
+      PUBLIC_IP="$EXTERNAL_IP"
+      if [ -z "$PUBLIC_IP" ] && [ -f /var/lib/secrets/external-ip ]; then
+        PUBLIC_IP=$(tr -d '[:space:]' < /var/lib/secrets/external-ip 2>/dev/null)
+      fi
+      if [ -z "$PUBLIC_IP" ] && [ -x /var/lib/sovran/public-ip.py ]; then
+        PUBLIC_IP=$(python3 /var/lib/sovran/public-ip.py check 2>/dev/null | head -n1)
+      fi
+
+      # Reject non-routable addresses (loopback, private, link-local, CGNAT).
+      # A detected/pinned address like this must never be advertised.
+      if [ -n "$PUBLIC_IP" ] && printf '%s' "$PUBLIC_IP" | grep -qE \
+        '^(0\.|127\.|10\.|100\.64\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'; then
+        echo "WARNING: external IP '$PUBLIC_IP' is not routable; falling back to STUN auto-detection." >&2
+        PUBLIC_IP=""
+      fi
+
+      if [ -n "$PUBLIC_IP" ]; then
+        cat > /run/livekit/livekit.yaml <<EOF
+port: 7880
+rtc:
+  use_external_ip: false
+  node_ip: $PUBLIC_IP
+  advertise_internal_ip: true
+  tcp_port: 7881
+  udp_port: 7882
+  interfaces:
+    includes:
+      - $IFACE
+EOF
+        echo "LiveKit will advertise public IP: $PUBLIC_IP"
+      else
+        cat > /run/livekit/livekit.yaml <<EOF
 port: 7880
 rtc:
  use_external_ip: true
  skip_external_ip_validation: true
+  advertise_internal_ip: true
  tcp_port: 7881
  udp_port: 7882
-  port_range_start: 30000
-  port_range_end: 40000
  interfaces:
    includes:
      - $IFACE
+EOF
+        echo "WARNING: could not determine a public IP for LiveKit; using STUN auto-detection. If calls connect without media, check STUN egress or set sovran_systemsOS.elementCalling.externalIP." >&2
+      fi
+
+      # Webhooks → lk-jwt-service. The JWT service validates the HMAC
+      # signature against the same key file it issues tokens with, and uses
+      # the events (participant_left / room_finished) to detect abruptly
+      # disconnected participants instead of waiting for the delayed-event
+      # timeout. The URL hits local Caddy via the /etc/hosts loopback
+      # override and is routed to the JWT service by the element-calling
+      # vhost (/livekit/jwt/sfu_webhook → 8073).
+      LK_KEY=$(cut -d: -f1 < ${livekitKeyFile} | tr -d '[:space:]')
+
+      # TURN/TLS is intentionally not configured (no tls_port): LiveKit
+      # advertises turns:<domain>:443 to clients regardless of tls_port, so
+      # a 5349 TURN/TLS listener would be unreachable and only adds attack
+      # surface. The staged cert/key stay for a future TURN/TLS-on-443
+      # (Caddy layer4 SNI) setup.
+      cat >> /run/livekit/livekit.yaml <<EOF
 room:
  auto_create: false
 turn:
  enabled: true
  domain: $MATRIX
-  tls_port: 5349
  udp_port: 3478
+  relay_range_start: 40000
+  relay_range_end: 40099
  cert_file: /run/credentials/livekit.service/turn-cert
  key_file: /run/credentials/livekit.service/turn-key
 EOF

+      # By default the embedded TURN relay refuses to send media to
+      # private/loopback peers. That would force its final hop to the
+      # public/WAN IP (hairpin NAT) — exactly what breaks calls on routers
+      # without NAT loopback. Allow the LAN subnet so the relay can deliver
+      # directly to LiveKit's LAN host candidate instead.
+      if [ -n "$LAN_CIDR" ]; then
+        cat >> /run/livekit/livekit.yaml <<EOF
+  allow_restricted_peer_cidrs:
+    - $LAN_CIDR
+EOF
+      fi
+
+      cat >> /run/livekit/livekit.yaml <<EOF
+webhook:
+  api_key: $LK_KEY
+  urls:
+    - https://$ELEMENT_CALLING/livekit/jwt/sfu_webhook
+EOF
+
      chmod 644 /run/livekit/livekit.yaml
    '';
  };

  ####### LIVEKIT SERVICE #######
+  # NOTE: the runtime config (rtc ports, TURN, webhook, node_ip) is generated
+  # by livekit-turn-setup and delivered via LoadCredential; the upstream
+  # module's `settings` block is therefore intentionally NOT used (it would
+  # be dead config that silently diverges from what LiveKit actually loads).
+  # The firewall ports are opened explicitly below; openFirewall is left off
+  # so the upstream module does not also open 7880/tcp publicly (Caddy fronts
+  # the SFU on this host).
  services.livekit = {
    enable = true;
-    openFirewall = true;
+    openFirewall = false;
    keyFile = livekitKeyFile;
-    settings = {
-      rtc.use_external_ip = true;
-      rtc.skip_external_ip_validation = true;
-      rtc.tcp_port = 7881;
-      rtc.udp_port = 7882;
-      rtc.port_range_start = 30000;
-      rtc.port_range_end = 40000;
-      room.auto_create = false;
-      turn = {
-        enabled = true;
-        tls_port = 5349;
-        udp_port = 3478;
-      };
-    };
  };

  # Override ExecStart to load the runtime-generated config (which carries the
@@ -223,10 +342,14 @@ EOF
    "turn-key:/var/lib/livekit/turn.key"
  ];

-  networking.firewall.allowedTCPPorts = [ 5349 7881 ];
+  # 5349/TCP (TURN/TLS) is deliberately absent — see livekit-turn-setup. RTC
+  # media uses the single UDP mux (7882); the 30000-40000 range is gone so
+  # media is no longer spread across 10000 ports. The TURN relay allocation
+  # range (40000-40099) is kept separate from the media mux.
+  networking.firewall.allowedTCPPorts = [ 7881 ];
  networking.firewall.allowedUDPPorts = [ 3478 7882 ];
  networking.firewall.allowedUDPPortRanges = [
-    { from = 30000; to = 40000; } # LiveKit internal TURN relay range
+    { from = 40000; to = 40099; } # LiveKit embedded TURN relay allocation range
  ];

  ####### JWT SERVICE RUNTIME CONFIG #######
@@ -247,12 +370,26 @@ EOF
    script = ''
      ELEMENT_CALLING=$(cat /var/lib/domains/element-calling)
      MATRIX=$(cat /var/lib/domains/matrix)
+      FULL_ACCESS_HOMESERVERS="$MATRIX"
+
+      # Federated peers may also be granted LiveKit room-creation (full access)
+      # on this SFU via sovran_systemsOS.elementCalling.fullAccessHomeservers.
+      # Without this, remote users can join existing calls but cannot be the
+      # first to start one on your SFU.
+      EXTRA_HS='${lib.concatStringsSep "," config.sovran_systemsOS.elementCalling.fullAccessHomeservers}'
+      if [ -n "$EXTRA_HS" ]; then
+        FULL_ACCESS_HOMESERVERS="$FULL_ACCESS_HOMESERVERS,$EXTRA_HS"
+      fi

      mkdir -p /run/lk-jwt-service

      cat > /run/lk-jwt-service/env <<EOF
 LIVEKIT_URL=wss://$ELEMENT_CALLING
-LIVEKIT_FULL_ACCESS_HOMESERVERS=$MATRIX
+LIVEKIT_FULL_ACCESS_HOMESERVERS=$FULL_ACCESS_HOMESERVERS
+# Re-check, every 60s, that connected participants are still on the SFU;
+# guards against missed SFU webhooks (e.g. an SFU restart) leaving stale
+# call members in Matrix rooms.
+LIVEKIT_SANITY_CHECK_INTERVAL_SECONDS=60
 EOF

      chmod 640 /run/lk-jwt-service/env
@@ -264,6 +401,9 @@ EOF
    enable = true;
    port = 8073;
    keyFile = livekitKeyFile;
+    # Required by the upstream module's option type, but overridden at runtime
+    # by EnvironmentFile (/run/lk-jwt-service/env, generated above from the
+    # element-calling domain). Kept as a harmless placeholder.
    livekitUrl = "wss://placeholder.local";
  };

@@ -271,6 +411,126 @@ EOF
    "/run/lk-jwt-service/env"
  ];

+  # Restart LiveKit / lk-jwt-service when a rebuild regenerates their runtime
+  # configs (new domains, externalIP, full-access list), mirroring the domain
+  # change flow.
+  # Re-run the config generator and restart LiveKit when a rebuild regenerates
+  # the runtime config, or when the Hub persists a new external IP (dynamic
+  # WAN IPs), so the advertised ICE candidate stays current without a manual
+  # restart. The trigger chain: external-ip change → livekit-turn-setup
+  # re-runs → rewrites livekit.yaml → livekit restarts with the new config.
+  systemd.services.livekit-turn-setup.restartTriggers = [ "/var/lib/secrets/external-ip" ];
+  systemd.services.livekit.restartTriggers = [ "/run/livekit/livekit.yaml" ];
+  systemd.services.lk-jwt-service.restartTriggers = [ "/run/lk-jwt-service/env" ];
+
+  ####### PUBLIC REACHABILITY SELF-CHECK #######
+  # Diagnostic only — never a hard dependency of livekit/caddy. Catches the
+  # classic "call connects but no media" setup errors at boot instead of at
+  # call time:
+  #   * the element-calling domain having no public records (or resolving to
+  #     loopback/link-local/CGNAT for remote peers),
+  #   * the lk-jwt-service being unreachable through Caddy,
+  #   * the MatrixRTC transports endpoint being absent (Element X cannot
+  #     discover calling and shows MISSING_MATRIX_RTC_TRANSPORT).
+  # The check queries only the operator's own DNS provider (the domain's
+  # authoritative nameservers, resolved via the local resolver) plus the
+  # server's own Caddy and public IP — no third-party resolver or service is
+  # contacted. dig queries resolvers directly, so the /etc/hosts loopback
+  # overrides (modules/core/local-domain-loopback.nix) do not influence the
+  # result.
+  systemd.services.element-calling-public-check = {
+    description = "Verify Element Calling domain, JWT service and MatrixRTC transports endpoint are publicly reachable";
+    after = [ "network-online.target" "caddy.service" "livekit.service" "lk-jwt-service.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    unitConfig = {
+      ConditionPathExists = "/var/lib/domains/element-calling";
+    };
+    path = [ pkgs.coreutils pkgs.gawk pkgs.dnsutils pkgs.curl ];
+    script = ''
+      ELEMENT_CALLING=$(cat /var/lib/domains/element-calling)
+      MATRIX=$(cat /var/lib/domains/matrix)
+      FAIL=0
+
+      echo "── Element Calling public reachability self-check ──"
+
+      # 1) Authoritative DNS view (bypassing the /etc/hosts loopback
+      #    overrides). Resolve the domain's own nameservers via the local
+      #    resolver, then query those nameservers directly — the only party
+      #    that sees the query is the DNS provider the operator already uses
+      #    for the domain.
+      NS_LIST=$(dig +short NS "$ELEMENT_CALLING" 2>/dev/null | tr '\n' ' ')
+      if [ -n "$NS_LIST" ]; then
+        IPS=""
+        for NSRV in $NS_LIST; do
+          IPS=$( { dig +short A "$ELEMENT_CALLING" "@$NSRV" 2>/dev/null; dig +short AAAA "$ELEMENT_CALLING" "@$NSRV" 2>/dev/null; } | tr '\n' ' ' )
+          [ -n "$IPS" ] && break
+        done
+        echo "Authoritative nameservers for $ELEMENT_CALLING: $NS_LIST"
+      else
+        echo "WARNING: could not resolve nameservers for $ELEMENT_CALLING via the local resolver; using the local resolver's answer instead." >&2
+        IPS=$( { dig +short A "$ELEMENT_CALLING" 2>/dev/null; dig +short AAAA "$ELEMENT_CALLING" 2>/dev/null; } | tr '\n' ' ' )
+      fi
+
+      if [ -z "$IPS" ]; then
+        echo "ERROR: no A/AAAA records for $ELEMENT_CALLING at its authoritative nameservers. Remote peers cannot reach this LiveKit; calls will connect without media." >&2
+        FAIL=1
+      else
+        echo "Public DNS for $ELEMENT_CALLING: $IPS"
+        for IP in $IPS; do
+          case "$IP" in
+            0.*|127.*|169.254.*|100.64.*|::1|fe80:*|fc*:*|fd*:*)
+              echo "ERROR: $ELEMENT_CALLING resolves to $IP (loopback/link-local/CGNAT). Remote peers cannot reach it." >&2
+              FAIL=1 ;;
+          esac
+        done
+      fi
+
+      # 2) lk-jwt-service healthz through Caddy (validates the proxy chain).
+      if curl -fsS --max-time 10 "https://$ELEMENT_CALLING/livekit/jwt/healthz" >/dev/null 2>&1; then
+        echo "OK: https://$ELEMENT_CALLING/livekit/jwt/healthz responds"
+      else
+        echo "ERROR: https://$ELEMENT_CALLING/livekit/jwt/healthz not reachable through Caddy." >&2
+        FAIL=1
+      fi
+
+      # 3) Same healthz via the first public IP (tests the full NAT path).
+      #    NOTE: if this box is behind the same NAT you are testing through,
+      #    routers without hairpin NAT will fail this step — the warning is
+      #    then expected and harmless; verify from an external device instead.
+      if [ -n "$IPS" ]; then
+        PUBIP=$(echo "$IPS" | awk '{print $1}')
+        if curl -fsS --max-time 15 --resolve "$ELEMENT_CALLING:443:$PUBIP" "https://$ELEMENT_CALLING/livekit/jwt/healthz" >/dev/null 2>&1; then
+          echo "OK: healthz reachable via public IP $PUBIP (NAT path works)"
+        else
+          echo "WARNING: healthz NOT reachable via public IP $PUBIP — check router port-forwarding (443/TCP) and NAT hairpin. Expected if the router lacks hairpin NAT; verify from an external device." >&2
+        fi
+      fi
+
+      # 4) MatrixRTC transports registry (MSC4519) — required by Element X.
+      CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "https://$MATRIX/_matrix/client/unstable/org.matrix.msc4143/rtc/transports")
+      case "$CODE" in
+        401|200)
+          echo "OK: MatrixRTC transports endpoint present (HTTP $CODE; auth required is expected)" ;;
+        404)
+          echo "ERROR: /_matrix/client/unstable/org.matrix.msc4143/rtc/transports missing (HTTP 404) — Element X cannot discover calling. Enable msc4143_enabled and matrix_rtc.transports in Synapse." >&2
+          FAIL=1 ;;
+        *)
+          echo "WARNING: transports endpoint returned HTTP $CODE" >&2 ;;
+      esac
+
+      if [ "$FAIL" -eq 1 ]; then
+        echo "── Element Calling self-check FAILED — see errors above ──" >&2
+        exit 1
+      fi
+      echo "── Element Calling self-check passed ──"
+    '';
+  };
+
  ####### SYNAPSE RUNTIME CONFIG (element-calling additions) #######
  systemd.services.element-calling-synapse-config = {
    description = "Generate Synapse runtime config for Element Calling";
@@ -287,6 +547,7 @@ EOF
    path = [ pkgs.coreutils ];
    script = ''
      MATRIX=$(cat /var/lib/domains/matrix)
+      ELEMENT_CALLING=$(cat /var/lib/domains/element-calling)

      mkdir -p /run/matrix-synapse

@@ -296,7 +557,17 @@ public_baseurl: "https://$MATRIX"
 serve_server_wellknown: true
 experimental_features:
  msc3266_enabled: true
+  # MSC4143: enables the MatrixRTC transports registry endpoint
+  # (/_matrix/client/unstable/org.matrix.msc4143/rtc/transports, MSC4519).
+  # Element X requires this endpoint to discover the LiveKit focus; without it
+  # mobile clients fail with MISSING_MATRIX_RTC_TRANSPORT / cannot start calls.
+  msc4143_enabled: true
  msc4222_enabled: true
+# MSC4519: advertise this site's LiveKit focus via the transports registry.
+matrix_rtc:
+  transports:
+    - type: livekit
+      livekit_service_url: "https://$ELEMENT_CALLING/livekit/jwt"
 max_event_delay_duration: "24h"
 rc_message:
  per_second: 0.5
@@ -1,14 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-lib.mkIf config.sovran_systemsOS.features.mempool {
-
-  services.mempool = {
-      enable = true;
-      frontend.enable = true;
-  };
-
-  services.mysql.package = lib.mkForce pkgs.mariadb;
-
-  nix-bitcoin.onionServices.mempool-frontend.enable = true;
-
-}
@@ -17,6 +17,7 @@
    ./core/no-sleep.nix
    ./core/cpu-performance.nix
    ./core/local-domain-loopback.nix
+    ./core/public-ip.nix

    # ── Always on (no flag) ───────────────────────────────────
    ./php.nix
@@ -27,14 +28,11 @@
    ./wordpress.nix
    ./nextcloud.nix
    ./vaultwarden.nix
-    ./bitcoinecosystem.nix
    ./wallet-autoconnect.nix

    # ── Features (default OFF — enable in custom.nix) ─────────
    ./haven.nix
    ./element-calling.nix
-    ./mempool.nix
-    ./bitcoin-core.nix
    ./rdp.nix
    ./sshd.nix
  ];
@@ -0,0 +1,134 @@
+# Sovran Bitcoin integration layer — bridges Sovran_SystemsOS options to the
+# Sovran_Bitcoin flake module.
+#
+# This is the ONLY place where OS-specific Bitcoin customizations live.
+# All bitcoin service modules (bitcoind, electrs, lnd, rtl, btcpayserver,
+# mempool, albyhub, lnurl) and vendored packages come from the Sovran_Bitcoin
+# flake input.
+#
+# What this file does:
+#   1. Maps sovran_systemsOS.services.bitcoin → sovran-bitcoin.enable
+#   2. Maps sovran_systemsOS.features.* → sovran-bitcoin.features.*
+#   3. Applies OS-specific overrides (Second_Drive paths, operator "free",
+#      forced wallet enable, Hub firewall port, domain requirements)
+#   4. Wires the Sovran Hub's NWC environment to the Alby Hub service
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.sovran_systemsOS;
+
+  # ── NWC environment for the Sovran Hub web app ─────────────────
+  # The Hub's web package provides nwc-wallet and nwc-lnurl binaries that
+  # need to know where Alby Hub and LND are.  Sovran_Bitcoin's modules
+  # handle the base Alby Hub service; this layers on the Hub-specific
+  # tooling environment.
+  lndRpcAddress = config.services.lnd.rpcAddress or "127.0.0.1";
+  lndRpcPort = toString (config.services.lnd.rpcPort or 10009);
+  lndCertPath = config.services.lnd.certPath or "/var/lib/lnd/tls.cert";
+
+  hubNwcEnvironment = {
+    NWC_ALBY_HUB_API_BASE = "http://127.0.0.1:18080";
+    NWC_LND_ADDRESS = "${lndRpcAddress}:${lndRpcPort}";
+    NWC_LND_CERT_FILE = lndCertPath;
+    NWC_LND_MACAROON_FILE = "/run/lnd/albyhub.macaroon";
+    NWC_RELAY =
+      if cfg.features.haven
+      then "wss://haven.${config.networking.domain}/nostr"
+      else "wss://relay.getalby.com,wss://relay2.getalby.com";
+  };
+in {
+  # ── 1. Map OS options → Sovran_Bitcoin options ─────────────────
+  sovran-bitcoin = lib.mkIf cfg.services.bitcoin {
+    enable = true;
+    operatorName = "free";
+    bitcoindTorGossip = cfg.features.bitcoin-tor-gossip;
+
+    features = {
+      electrs = true;
+      lnd = true;
+      rtl = true;
+      btcpayserver = cfg.web.btcpayserver;
+      mempool = cfg.features.mempool;
+      nwc = cfg.features."nwc-wallets";
+      lnurl = cfg.features."nwc-wallets";
+    };
+  };
+
+  # ── 2. Second_Drive data paths (OS-specific) ──────────────────
+  services.bitcoind = lib.mkIf cfg.services.bitcoin {
+    dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
+    # The OS always enables the bitcoind wallet — the Hub and BTCPay need it.
+    disablewallet = lib.mkForce false;
+  };
+
+  services.electrs = lib.mkIf cfg.services.bitcoin {
+    dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Electrs_Data";
+  };
+
+  # ── 3. Second_Drive mount dependencies ─────────────────────────
+  systemd.services.bitcoind = lib.mkIf cfg.services.bitcoin {
+    requires = [ "run-media-Second_Drive.mount" ];
+    after    = [ "run-media-Second_Drive.mount" ];
+    serviceConfig.PrivateUsers = lib.mkForce false;
+  };
+
+  systemd.services.electrs = lib.mkIf cfg.services.bitcoin {
+    requires = lib.mkForce [ "run-media-Second_Drive.mount" ];
+    after    = [ "run-media-Second_Drive.mount" "bitcoind.service" ];
+    wants    = [ "bitcoind.service" ];
+  };
+
+  systemd.services.lnd = lib.mkIf cfg.services.bitcoin {
+    wants    = [ "bitcoind.service" ];
+    # nix-bitcoin sets `requires = [ "bitcoind.service" ]`; the OS removes it
+    # so LND can start even if bitcoind is temporarily down.
+    requires = lib.mkForce [ ];
+  };
+
+  # ── 4. Permission fixup for Second_Drive ───────────────────────
+  systemd.services.sovran-btc-permissions = lib.mkIf cfg.services.bitcoin {
+    description = "Fix Bitcoin/Electrs data directory ownership on second drive";
+    wantedBy = [ "multi-user.target" ];
+    after  = [ "run-media-Second_Drive.mount" ];
+    before = [ "bitcoind.service" "electrs.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      if [ -d /run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node ]; then
+        chown -R bitcoin:bitcoin /run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node
+      fi
+      if [ -d /run/media/Second_Drive/BTCEcoandBackup/Electrs_Data ]; then
+        chown -R electrs:electrs /run/media/Second_Drive/BTCEcoandBackup/Electrs_Data
+      fi
+    '';
+  };
+
+  # ── 5. Firewall — Hub management port ──────────────────────────
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.services.bitcoin [ 3051 ];
+  networking.firewall.allowedUDPPorts = lib.mkIf cfg.services.bitcoin [ 3051 ];
+
+  # ── 6. NWC / LNURL — Sovran Hub integration ───────────────────
+  # Sovran_Bitcoin's albyhub.nix and lnurl.nix handle the base services.
+  # This section wires the Hub's web app environment so the Hub can
+  # display NWC status and the nwc-wallet CLI works from the Hub shell.
+  
+  services.sovran-lnurl = lib.mkIf cfg.features."nwc-wallets" {
+  # The Hub writes the Lightning Address domain to this file.
+    domainFile = "/var/lib/domains/lightning";
+  };
+  
+  systemd.services.sovran-hub-web.environment = lib.mkIf cfg.features."nwc-wallets"
+    hubNwcEnvironment;
+
+  # ── 7. Domain requirements ─────────────────────────────────────
+  sovran_systemsOS.domainRequirements = lib.mkIf cfg.services.bitcoin (
+    [
+      { name = "btcpayserver"; label = "BTCPay Server"; example = "pay.yourdomain.com"; }
+    ]
+    ++ lib.optionals cfg.features."nwc-wallets" [
+      { name = "lightning"; label = "Lightning Address Domain"; example = "pay.yourdomain.com"; needsDDNS = true; }
+    ]
+  );
+}
@@ -229,6 +229,30 @@ CREDS
        chmod 600 "$CREDS_FILE"
      fi

+      # Provision a private, random Matrix administrator for the Hub's Admin
+      # API calls.  This is deliberately separate from the visible bootstrap
+      # admin account: installations where @admin pre-dated Sovran do not have
+      # its password, but Hub user management must still work.  Keeping the
+      # generated localpart in this root-only file makes the operation
+      # idempotent without exposing this service credential in the Hub UI.
+      HUB_ADMIN_CREDS="/var/lib/secrets/matrix-hub-admin"
+      if [ ! -s "$HUB_ADMIN_CREDS" ]; then
+        HUB_ADMIN_USER="sovran-hub-$(pwgen -sA0 20 1)"
+        HUB_ADMIN_PASS=$(pwgen -s 32 1)
+        if register_new_matrix_user -c /run/matrix-synapse/runtime-config.yaml \
+          -u "$HUB_ADMIN_USER" -p "$HUB_ADMIN_PASS" -a http://localhost:8008; then
+          (umask 077; cat > "$HUB_ADMIN_CREDS" <<CREDS
+username=$HUB_ADMIN_USER
+password=$HUB_ADMIN_PASS
+CREDS
+          )
+          echo "Created private Matrix Hub service administrator."
+        else
+          echo "Failed to create the private Matrix Hub service administrator." >&2
+          exit 1
+        fi
+      fi
+
      # Always write individual credential files for the hub UI, even if the bulk
      # credentials file already existed from a prior run (umask 077 ensures mode 600).
      # If passwords were not freshly generated above, parse them from the bulk file.
@@ -47,29 +47,44 @@ EOF
  systemd.services.zeus-connect-setup = {
    description = "Save Zeus lndconnect URL";
    wantedBy = [ "multi-user.target" ];
-    after = [ "lnd.service" ];
+    after = [ "lnd.service" "onion-addresses.service" ];
+    wants = [ "lnd.service" "onion-addresses.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
-    path = [ pkgs.coreutils "/run/current-system/sw" ];
+    # sudo is required: the lndconnect wrapper re-execs as the lnd user so it
+    # can read admin.macaroon (not group-readable).
+    path = [ pkgs.coreutils pkgs.gnugrep pkgs.sudo "/run/current-system/sw" ];
    script = ''
      SECRET_FILE="/var/lib/secrets/zeus-connect-url"
      mkdir -p /var/lib/secrets

+      # LND may still be creating the wallet / macaroon, and the dedicated
+      # lnd-rest onion hostname is published by onion-addresses.service.
      URL=""
-      if command -v lndconnect >/dev/null 2>&1; then
-        URL=$(lndconnect --url 2>/dev/null || true)
-      elif command -v lnconnect-clnrest >/dev/null 2>&1; then
-        URL=$(lnconnect-clnrest --url 2>/dev/null || true)
-      fi
+      ATTEMPTS=0
+      while [ "$ATTEMPTS" -lt 60 ]; do
+        if command -v lndconnect >/dev/null 2>&1; then
+          URL=$(lndconnect --url 2>/dev/null | tr -d '\r' | tail -n 1 || true)
+        fi
+        # Zeus LND REST over Tor: lndconnect://<v3-onion>:8080?macaroon=...
+        if echo "$URL" | grep -q '^lndconnect://' \
+           && echo "$URL" | grep -q '\.onion' \
+           && echo "$URL" | grep -q 'macaroon='; then
+          break
+        fi
+        URL=""
+        ATTEMPTS=$((ATTEMPTS + 1))
+        sleep 2
+      done

      if [ -n "$URL" ]; then
-        echo "$URL" > "$SECRET_FILE"
+        printf '%s\n' "$URL" > "$SECRET_FILE"
        chmod 600 "$SECRET_FILE"
        echo "Zeus connect URL saved."
      else
-        echo "No lndconnect URL available yet."
+        echo "No valid lndconnect URL available yet."
      fi
    '';
  };
@@ -0,0 +1,563 @@
+#!/usr/bin/env bash
+#
+# release-stable.sh
+# Automated stable release script for Sovran_SystemsOS
+#
+# Features:
+# - Detects latest tag and suggests next version
+# - Pushes main → stable on Gitea
+# - Creates annotated tag
+# - Auto-updates CHANGELOG.md
+# - Creates releases on both GitHub and Gitea via API
+#
+# Usage:
+#   ./scripts/release-stable.sh [version] [--message "text"]
+#
+# Requirements:
+#   - gh CLI (for GitHub releases)
+#   - GITEA_TOKEN env var (for Gitea releases)
+#
+
+set -euo pipefail
+
+# Always operate from the repository root, regardless of the caller's cwd.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Configuration
+GITEA_REMOTE_DEFAULT="gitea"
+GITHUB_REMOTE_DEFAULT="origin"
+GITEA_API_URL="https://git.sovransystems.com/api/v1"
+CHANGELOG_FILE="CHANGELOG.md"
+
+# Auto-detect remotes
+detect_remote() {
+    local preferred="$1"
+    local keyword="$2"
+    if git remote | grep -q -x "$preferred"; then
+        echo "$preferred"
+        return
+    fi
+    local found
+    found=$(git remote -v | grep -i "$keyword" | head -n 1 | awk '{print $1}')
+    if [[ -n "$found" ]]; then
+        echo "$found"
+        return
+    fi
+    echo "$preferred"
+}
+
+GITEA_REMOTE=$(detect_remote "$GITEA_REMOTE_DEFAULT" "sovransystems\|gitea")
+GITHUB_REMOTE=$(detect_remote "$GITHUB_REMOTE_DEFAULT" "github")
+
+echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║     Sovran_SystemsOS Automated Stable Release Script       ║${NC}"
+echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"
+echo
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Helper: Get latest tag
+# ─────────────────────────────────────────────────────────────────────────────
+# GitHub release tags are fetched into a private namespace instead of
+# refs/tags/. GitHub and Gitea contain some same-named historical tags that
+# point to different objects; sharing refs/tags/ would make either fetch fail
+# with "would clobber existing tag".
+GITHUB_TAG_NAMESPACE="refs/release-tags/github"
+
+get_latest_tag() {
+    local exclude="${1:-}"
+    local tag
+
+    while IFS= read -r tag; do
+        if [[ -n "$exclude" && "$tag" == "v${exclude#v}" ]]; then
+            continue
+        fi
+        printf '%s\n' "$tag"
+        return 0
+    done < <(git for-each-ref \
+        --sort=-version:refname \
+        --format='%(refname:strip=3)' \
+        "${GITHUB_TAG_NAMESPACE}/v*")
+
+    return 0
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Helper: Suggest next version (patch bump)
+# ─────────────────────────────────────────────────────────────────────────────
+suggest_next_version() {
+    local current="$1"
+    if [[ -z "$current" ]]; then
+        echo "1.0.0"
+        return
+    fi
+
+    # Remove 'v' prefix
+    local ver="${current#v}"
+    IFS='.' read -r major minor patch <<< "$ver"
+
+    # Default: bump patch
+    echo "${major}.$((minor)).$((patch + 1))"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 0: Preflight and fetch everything
+# ─────────────────────────────────────────────────────────────────────────────
+echo -e "${BLUE}Step 0: Running release preflight...${NC}"
+
+# A release must start from an exact, committed, reproducible tree. This also
+# prevents release metadata generated below from being mixed with local work.
+if [[ -n "$(git status --porcelain)" ]]; then
+    echo -e "${RED}Error: the working tree is not clean. Commit, stash, or remove local changes first.${NC}" >&2
+    git status --short >&2
+    exit 1
+fi
+
+for remote in "$GITHUB_REMOTE" "$GITEA_REMOTE"; do
+    if ! git remote | grep -q -x "$remote"; then
+        echo -e "${RED}Error: required remote '$remote' is not configured.${NC}" >&2
+        exit 1
+    fi
+done
+
+for command_name in gh curl; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo -e "${RED}Error: required command '$command_name' is not installed.${NC}" >&2
+        exit 1
+    fi
+done
+if ! gh auth status >/dev/null 2>&1; then
+    echo -e "${RED}Error: GitHub CLI is not authenticated. Run 'gh auth login' first.${NC}" >&2
+    exit 1
+fi
+if [[ -z "${GITEA_TOKEN:-}" ]]; then
+    echo
+    read -rsp "Enter your Gitea API token (input hidden): " GITEA_TOKEN
+    echo
+fi
+if [[ -z "${GITEA_TOKEN:-}" ]]; then
+    echo -e "${RED}Error: a GITEA_TOKEN with write:repository scope is required.${NC}" >&2
+    exit 1
+fi
+
+echo -e "  Fetching GitHub (${GITHUB_REMOTE}) and Gitea (${GITEA_REMOTE})..."
+# Never fetch either host's tags into refs/tags/. Historical tags with the same
+# name differ between the hosts, and Git correctly refuses to clobber them.
+git fetch "$GITHUB_REMOTE" --prune --no-tags
+git fetch "$GITEA_REMOTE" --prune --no-tags
+git fetch "$GITHUB_REMOTE" --prune --no-tags \
+    "+refs/tags/*:${GITHUB_TAG_NAMESPACE}/*"
+
+GITHUB_MAIN_REF="refs/remotes/${GITHUB_REMOTE}/main"
+GITEA_STAGING_REF="refs/remotes/${GITEA_REMOTE}/staging-dev"
+
+if ! git rev-parse --verify "$GITHUB_MAIN_REF" >/dev/null 2>&1; then
+    echo -e "${RED}Error: cannot resolve GitHub main at ${GITHUB_MAIN_REF}.${NC}" >&2
+    exit 1
+fi
+if ! git rev-parse --verify "$GITEA_STAGING_REF" >/dev/null 2>&1; then
+    echo -e "${RED}Error: cannot resolve Gitea staging-dev at ${GITEA_STAGING_REF}.${NC}" >&2
+    exit 1
+fi
+
+HEAD_COMMIT=$(git rev-parse HEAD)
+GITHUB_MAIN_COMMIT=$(git rev-parse "$GITHUB_MAIN_REF")
+GITEA_STAGING_COMMIT=$(git rev-parse "$GITEA_STAGING_REF")
+
+if [[ "$GITHUB_MAIN_COMMIT" != "$GITEA_STAGING_COMMIT" ]]; then
+    echo -e "${RED}Error: GitHub main and Gitea staging-dev are not synchronized.${NC}" >&2
+    echo "  GitHub main       : $GITHUB_MAIN_COMMIT" >&2
+    echo "  Gitea staging-dev : $GITEA_STAGING_COMMIT" >&2
+    exit 1
+fi
+if [[ "$HEAD_COMMIT" != "$GITHUB_MAIN_COMMIT" ]]; then
+    echo -e "${RED}Error: local HEAD is not the synchronized release candidate.${NC}" >&2
+    echo "  Local HEAD  : $HEAD_COMMIT" >&2
+    echo "  Remote HEAD : $GITHUB_MAIN_COMMIT" >&2
+    echo "Update/check out the synchronized commit, then run the script again." >&2
+    exit 1
+fi
+
+echo -e "  ${GREEN}✓${NC} Clean tree; GitHub main and Gitea staging-dev match local HEAD"
+
+LATEST_TAG=$(get_latest_tag)
+NEXT_VERSION=$(suggest_next_version "$LATEST_TAG")
+
+echo -e "  Latest tag   : ${CYAN}${LATEST_TAG:-none}${NC}"
+echo -e "  Suggested    : ${GREEN}v${NEXT_VERSION}${NC}"
+echo
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Get version from user or argument
+# ─────────────────────────────────────────────────────────────────────────────
+if [ $# -ge 1 ] && [[ "$1" != --* ]]; then
+    VERSION="$1"
+    shift
+else
+    read -rp "Enter version to release (default: ${NEXT_VERSION}): " input_version
+    VERSION="${input_version:-$NEXT_VERSION}"
+fi
+
+# Strip 'v' if user added it
+VERSION="${VERSION#v}"
+TAG="v${VERSION}"
+
+if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo -e "${RED}Error: version must use MAJOR.MINOR.PATCH format (for example, 1.1.1).${NC}" >&2
+    exit 1
+fi
+remote_has_tag() {
+    local remote="$1"
+    [[ -n "$(git ls-remote --tags "$remote" "refs/tags/${TAG}" "refs/tags/${TAG}^{}")" ]]
+}
+
+if git show-ref --verify --quiet "refs/tags/${TAG}" || \
+   git show-ref --verify --quiet "${GITHUB_TAG_NAMESPACE}/${TAG}" || \
+   remote_has_tag "$GITHUB_REMOTE" || remote_has_tag "$GITEA_REMOTE"; then
+    echo -e "${RED}Error: tag ${TAG} already exists locally or on a remote.${NC}" >&2
+    echo "Refusing to move or overwrite an existing release tag." >&2
+    exit 1
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Get release message
+# ─────────────────────────────────────────────────────────────────────────────
+RELEASE_MESSAGE=""
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --message|-m)
+            RELEASE_MESSAGE="$2"
+            shift 2
+            ;;
+        *)
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$RELEASE_MESSAGE" ]]; then
+    echo
+    read -rp "Enter release headline (or press Enter for default): " input_msg
+    if [[ -n "$input_msg" ]]; then
+        RELEASE_MESSAGE="$input_msg"
+    else
+        RELEASE_MESSAGE="Sovran_SystemsOS ${TAG} — Stable Release"
+    fi
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Helper: Generate categorized release notes from commit history
+# Groups commits since the last tag into Keep-a-Changelog sections based on
+# conventional-commit prefixes (feat/fix/docs/security/etc.) and keywords.
+# ─────────────────────────────────────────────────────────────────────────────
+generate_release_notes() {
+    local range="$1"
+
+    local added="" changed="" fixed="" security="" docs=""
+
+    while IFS= read -r subject; do
+        # Skip noise commits
+        case "$subject" in
+            "Initial plan"|"initial plan") continue ;;
+            "Merge pull request"*|"Merge branch"*) continue ;;
+            "chore: bump VERSION"*|"docs: update CHANGELOG"*) continue ;;
+            "Address code review"*|"Address review"*|"Address validation"*) continue ;;
+        esac
+
+        # Strip conventional-commit prefix for display
+        local clean
+        clean="$(echo "$subject" | sed -E 's/^(feat|fix|docs|chore|refactor|test|security|perf|style|ci|build)(\([^)]*\))?!?:[[:space:]]*//')"
+        # Capitalize first letter
+        clean="$(echo "${clean:0:1}" | tr '[:lower:]' '[:upper:]')${clean:1}"
+
+        case "$subject" in
+            security:*|security\(*)         security+="- ${clean}"$'\n' ;;
+            feat:*|feat\(*)                 added+="- ${clean}"$'\n' ;;
+            fix:*|fix\(*|Fix\ *|fixed\ *)   fixed+="- ${clean}"$'\n' ;;
+            docs:*|docs\(*)                 docs+="- ${clean}"$'\n' ;;
+            refactor:*|refactor\(*|chore:*|chore\(*|removed\ *|Updated\ *|updated\ *) changed+="- ${clean}"$'\n' ;;
+            test:*|test\(*)                 continue ;;
+            *)                              added+="- ${clean}"$'\n' ;;
+        esac
+    done < <(git log --no-merges --format='%s' "$range" 2>/dev/null | awk '!seen[$0]++')
+
+    local notes=""
+    if [[ -n "$added" ]];    then notes+=$'### Added\n'"$added"$'\n'; fi
+    if [[ -n "$changed" ]];  then notes+=$'### Changed\n'"$changed"$'\n'; fi
+    if [[ -n "$fixed" ]];    then notes+=$'### Fixed\n'"$fixed"$'\n'; fi
+    if [[ -n "$security" ]]; then notes+=$'### Security\n'"$security"$'\n'; fi
+    if [[ -n "$docs" ]];     then notes+=$'### Documentation\n'"$docs"$'\n'; fi
+
+    if [[ -z "$notes" ]]; then
+        notes=$'### Changed\n- Incremental stable updates\n'
+    fi
+
+    printf '%s' "$notes"
+}
+
+# Build notes from the previous canonical GitHub tag. Use its private ref so a
+# conflicting local or Gitea tag with the same name cannot select the wrong
+# commit.
+PREV_TAG=$(get_latest_tag "$TAG")
+PREV_TAG_REF="${GITHUB_TAG_NAMESPACE}/${PREV_TAG}"
+if [[ -n "$PREV_TAG" ]] && git rev-parse -q --verify "$PREV_TAG_REF" >/dev/null; then
+    COMMIT_RANGE="${PREV_TAG_REF}..HEAD"
+    COMMIT_RANGE_DISPLAY="${PREV_TAG}..HEAD"
+else
+    COMMIT_RANGE="HEAD"
+    COMMIT_RANGE_DISPLAY="HEAD"
+fi
+
+echo
+echo -e "${BLUE}Generating draft release notes from ${COMMIT_RANGE_DISPLAY}...${NC}"
+RELEASE_NOTES="$(generate_release_notes "$COMMIT_RANGE")"
+
+# Let the user review/edit the generated notes before publishing
+NOTES_FILE="$(mktemp "/tmp/release-notes-${TAG}.XXXXXX.md")"
+trap 'rm -f "$NOTES_FILE"' EXIT
+{
+    echo "## Sovran_SystemsOS ${TAG}"
+    echo
+    echo "${RELEASE_MESSAGE}"
+    echo
+    echo "$RELEASE_NOTES"
+    echo "**Full changelog:** [CHANGELOG.md](https://github.com/naturallaw777/Sovran_SystemsOS/blob/main/CHANGELOG.md)"
+} > "$NOTES_FILE"
+
+echo -e "  ${GREEN}✓${NC} Draft notes written to: ${CYAN}${NOTES_FILE}${NC}"
+echo
+echo "──────────────── Draft Release Notes ────────────────"
+cat "$NOTES_FILE"
+echo "──────────────────────────────────────────────────────"
+echo
+read -rp "Edit the notes before publishing? (y/N): " edit_confirm
+if [[ "$edit_confirm" =~ ^[Yy]$ ]]; then
+    "${EDITOR:-nano}" "$NOTES_FILE"
+    RELEASE_NOTES="$(sed -n '/^###/,$p' "$NOTES_FILE" | sed '/^\*\*Full changelog/d')"
+fi
+RELEASE_BODY="$(cat "$NOTES_FILE")"
+
+echo
+echo -e "${YELLOW}════════════════════════════════════════════════════════════${NC}"
+echo -e "${YELLOW}  Preparing Release${NC}"
+echo -e "${YELLOW}════════════════════════════════════════════════════════════${NC}"
+echo "  Version       : ${TAG}"
+echo "  Message       : ${RELEASE_MESSAGE}"
+echo "  Gitea Remote  : ${GITEA_REMOTE}"
+echo "  GitHub Remote : ${GITHUB_REMOTE}"
+echo
+
+read -rp "Proceed with this release? (y/N): " confirm
+if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+    echo "Aborted."
+    exit 0
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 1: Prepare and commit all release metadata
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 1: Preparing release metadata for ${TAG}...${NC}"
+
+# VERSION drives ISO naming.
+echo "${VERSION}" > VERSION
+
+# Update every versioned ISO filename in README.md.
+README_FILE="README.md"
+if [[ ! -f "$README_FILE" ]]; then
+    echo -e "${RED}Error: ${README_FILE} not found.${NC}" >&2
+    exit 1
+fi
+OLD_ISO_VER=$(grep -oE 'Sovran_SystemsOS-[0-9]+\.[0-9]+\.[0-9]+\.iso' "$README_FILE" \
+    | head -1 | sed 's/Sovran_SystemsOS-//; s/\.iso//')
+if [[ -z "$OLD_ISO_VER" ]]; then
+    echo -e "${RED}Error: no versioned ISO reference found in ${README_FILE}.${NC}" >&2
+    exit 1
+fi
+if [[ "$OLD_ISO_VER" != "$VERSION" ]]; then
+    sed "s/Sovran_SystemsOS-${OLD_ISO_VER}/Sovran_SystemsOS-${VERSION}/g" \
+        "$README_FILE" > "$README_FILE.tmp"
+    mv "$README_FILE.tmp" "$README_FILE"
+fi
+
+# Add the changelog entry before tagging so the tag and stable branch contain it.
+TODAY=$(date +%Y-%m-%d)
+NEW_ENTRY="## [${VERSION}] - ${TODAY}
+
+${RELEASE_NOTES}
+[${VERSION}]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/${TAG}
+"
+
+if [[ ! -f "$CHANGELOG_FILE" ]]; then
+    echo -e "${RED}Error: ${CHANGELOG_FILE} not found.${NC}" >&2
+    exit 1
+fi
+awk -v new_entry="$NEW_ENTRY" '
+    BEGIN { printed=0 }
+    /^---$/ && !printed {
+        print
+        print ""
+        print new_entry
+        printed=1
+        next
+    }
+    { print }
+    END { if (!printed) exit 2 }
+' "$CHANGELOG_FILE" > "${CHANGELOG_FILE}.tmp" || {
+    rm -f "${CHANGELOG_FILE}.tmp"
+    echo -e "${RED}Error: could not find the changelog insertion marker.${NC}" >&2
+    exit 1
+}
+mv "${CHANGELOG_FILE}.tmp" "$CHANGELOG_FILE"
+
+git add VERSION "$README_FILE" "$CHANGELOG_FILE"
+if git diff --cached --quiet; then
+    echo -e "${RED}Error: release preparation produced no changes.${NC}" >&2
+    exit 1
+fi
+git commit -m "chore(release): prepare ${TAG}"
+RELEASE_COMMIT=$(git rev-parse HEAD)
+
+echo -e "  ${GREEN}✓${NC} VERSION, README, and CHANGELOG committed"
+echo -e "  Release commit: ${CYAN}${RELEASE_COMMIT}${NC}"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 2: Publish the final release commit to every release branch
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 2: Publishing the final release commit...${NC}"
+
+# GitHub main and Gitea staging-dev were verified equal during preflight, so
+# these are normal fast-forward pushes. Stable is an intentional promotion and
+# uses a lease to prevent overwriting a branch changed since the fetch.
+git push "$GITHUB_REMOTE" HEAD:main
+git push "$GITEA_REMOTE" HEAD:staging-dev
+git push "$GITEA_REMOTE" HEAD:stable --force-with-lease
+
+# Verify all three branch tips before creating an immutable release tag.
+remote_branch_commit() {
+    local remote="$1"
+    local branch="$2"
+    git ls-remote "$remote" "refs/heads/${branch}" | awk 'NR == 1 { print $1 }'
+}
+
+PUBLISHED_GITHUB=$(remote_branch_commit "$GITHUB_REMOTE" main)
+PUBLISHED_STAGING=$(remote_branch_commit "$GITEA_REMOTE" staging-dev)
+PUBLISHED_STABLE=$(remote_branch_commit "$GITEA_REMOTE" stable)
+if [[ "$PUBLISHED_GITHUB" != "$RELEASE_COMMIT" || \
+      "$PUBLISHED_STAGING" != "$RELEASE_COMMIT" || \
+      "$PUBLISHED_STABLE" != "$RELEASE_COMMIT" ]]; then
+    echo -e "${RED}Error: post-push verification failed; no release tag was created.${NC}" >&2
+    echo "  Expected          : $RELEASE_COMMIT" >&2
+    echo "  GitHub main       : ${PUBLISHED_GITHUB:-missing}" >&2
+    echo "  Gitea staging-dev : ${PUBLISHED_STAGING:-missing}" >&2
+    echo "  Gitea stable      : ${PUBLISHED_STABLE:-missing}" >&2
+    exit 1
+fi
+echo -e "  ${GREEN}✓${NC} GitHub main, Gitea staging-dev, and Gitea stable all match"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 3: Tag the final release commit and publish the tag
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 3: Creating annotated tag ${TAG} on ${RELEASE_COMMIT}...${NC}"
+git tag -a "$TAG" -m "${RELEASE_MESSAGE}
+
+- Stable release of Sovran_SystemsOS
+- See CHANGELOG.md for full details" "$RELEASE_COMMIT"
+
+git push "$GITHUB_REMOTE" "$TAG"
+git push "$GITEA_REMOTE" "$TAG"
+
+# For an annotated tag, ^{} resolves the commit referenced by the tag object.
+remote_tag_commit() {
+    local remote="$1"
+    git ls-remote "$remote" "refs/tags/${TAG}^{}" | awk 'NR == 1 { print $1 }'
+}
+GITHUB_TAG_COMMIT=$(remote_tag_commit "$GITHUB_REMOTE")
+GITEA_TAG_COMMIT=$(remote_tag_commit "$GITEA_REMOTE")
+if [[ "$GITHUB_TAG_COMMIT" != "$RELEASE_COMMIT" || "$GITEA_TAG_COMMIT" != "$RELEASE_COMMIT" ]]; then
+    echo -e "${RED}Error: published tag verification failed.${NC}" >&2
+    exit 1
+fi
+echo -e "  ${GREEN}✓${NC} ${TAG} points to the final release commit on GitHub and Gitea"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 4: Create GitHub release via gh CLI
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 4: Creating GitHub release...${NC}"
+
+title_suffix="${RELEASE_MESSAGE#Sovran_SystemsOS v* — }"
+title_suffix="${title_suffix#Sovran_SystemsOS * — }"
+gh release create "$TAG" \
+    --repo naturallaw777/Sovran_SystemsOS \
+    --title "${TAG} — ${title_suffix}" \
+    --notes-file "$NOTES_FILE"
+echo -e "  ${GREEN}✓${NC} GitHub release created successfully"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 5: Create Gitea release via API
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 5: Creating Gitea release via API...${NC}"
+
+GITEA_REPO="Sovran_Systems/Sovran_SystemsOS"
+
+# Build JSON safely because release notes may contain quotes and newlines.
+if command -v jq >/dev/null 2>&1; then
+    PAYLOAD=$(jq -n \
+        --arg tag "$TAG" \
+        --arg name "$TAG — Stable Release" \
+        --arg body "$RELEASE_BODY" \
+        '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')
+else
+    PAYLOAD=$(python3 -c "import json,sys; print(json.dumps({'tag_name': sys.argv[1], 'name': sys.argv[1] + ' — Stable Release', 'body': open(sys.argv[2]).read(), 'draft': False, 'prerelease': False}))" "$TAG" "$NOTES_FILE")
+fi
+
+RESPONSE_FILE=$(mktemp "/tmp/gitea-release-${TAG}.XXXXXX.json")
+HTTP_STATUS=$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD" \
+    "${GITEA_API_URL}/repos/${GITEA_REPO}/releases")
+
+if [[ "$HTTP_STATUS" != "201" ]]; then
+    echo -e "${RED}Error: Gitea release creation failed (HTTP ${HTTP_STATUS}).${NC}" >&2
+    cat "$RESPONSE_FILE" >&2
+    rm -f "$RESPONSE_FILE"
+    exit 1
+fi
+rm -f "$RESPONSE_FILE"
+echo -e "  ${GREEN}✓${NC} Gitea release created successfully"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Final Summary
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${GREEN}╔════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${GREEN}║           ✅ Release ${TAG} completed successfully!          ║${NC}"
+echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
+echo
+echo "Next manual steps (recommended):"
+echo "  • Build the installer ISO:"
+echo "    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage"
+echo "  • Package, verify, and upload ISO to CDN:"
+echo "    ./scripts/upload-cdn.sh --upload"
+echo "  • Verify the ISO download and checksum from the public CDN"
+echo "  • Verify releases on both GitHub and Gitea"
+echo
+echo -e "${CYAN}Tag created: ${TAG}${NC}"
+git show "${TAG}" --quiet
+
+# Clean up temp notes file
+rm -f "${NOTES_FILE}"
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+#
+# upload-cdn.sh
+# Copies built ISO out of the nix store, generates versioned SHA-256 checksum,
+# verifies it, and optionally uploads to CDN.
+#
+# Usage:
+#   ./scripts/upload-cdn.sh [--upload]
+#
+# EVERYTHING this script creates lives OUTSIDE the repository, even when you
+# run it from inside the repo:
+#   - the nix build output symlink  -> $ISO_OUT_DIR/result
+#   - the ISO and .sha256 files     -> $ISO_OUT_DIR
+# The repo working tree stays completely clean.
+#
+# Environment variables (optional):
+#   ISO_OUT_DIR        - dir for the build symlink + ISO + checksum
+#                        (default: ~/Sovran-builds)
+#   CDN_RSYNC_TARGET   - rsync destination (e.g. user@server:/var/www/downloads/)
+#   CDN_RCLONE_REMOTE  - rclone remote target (e.g. s3:my-bucket/downloads/)
+#   CDN_UPLOAD_CMD     - custom upload command
+#
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Always operate from the repo root, no matter where the script is invoked from
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Read version from VERSION file
+if [ ! -f VERSION ]; then
+    echo -e "${RED}Error: VERSION file not found in $REPO_ROOT.${NC}" >&2
+    exit 1
+fi
+VERSION=$(cat VERSION | tr -d '\n\r ')
+ISO_NAME="Sovran_SystemsOS-${VERSION}.iso"
+SHA_NAME="${ISO_NAME}.sha256"
+
+# Output directory OUTSIDE the repo (override with ISO_OUT_DIR)
+OUT_DIR="${ISO_OUT_DIR:-$HOME/Sovran-builds}"
+mkdir -p "$OUT_DIR"
+OUT_DIR="$(cd "$OUT_DIR" && pwd)"
+ISO_PATH="$OUT_DIR/${ISO_NAME}"
+SHA_PATH="$OUT_DIR/${SHA_NAME}"
+RESULT_LINK="$OUT_DIR/result"
+
+echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║      Sovran_SystemsOS CDN ISO Packaging & Upload Tool      ║${NC}"
+echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"
+echo -e "  Version : ${CYAN}${VERSION}${NC}"
+echo -e "  ISO     : ${CYAN}${ISO_NAME}${NC}"
+echo -e "  Repo    : ${CYAN}${REPO_ROOT}${NC}   (left untouched)"
+echo -e "  Output  : ${CYAN}${OUT_DIR}${NC}   (outside the repo)"
+echo
+
+# Locate or build ISO
+SRC_ISO=""
+if [ -f "$RESULT_LINK/iso/${ISO_NAME}" ]; then
+    SRC_ISO="$RESULT_LINK/iso/${ISO_NAME}"
+elif [ -f "$RESULT_LINK/iso/Sovran_SystemsOS.iso" ]; then
+    SRC_ISO="$RESULT_LINK/iso/Sovran_SystemsOS.iso"
+elif [ -f "result/iso/${ISO_NAME}" ]; then
+    SRC_ISO="result/iso/${ISO_NAME}"   # legacy: from an older in-repo build
+elif [ -f "result/iso/Sovran_SystemsOS.iso" ]; then
+    SRC_ISO="result/iso/Sovran_SystemsOS.iso"
+else
+    FOUND=$(find "$RESULT_LINK" result -name "*.iso" 2>/dev/null | head -n 1 || true)
+    if [ -n "$FOUND" ]; then
+        SRC_ISO="$FOUND"
+    fi
+fi
+
+if [ -z "$SRC_ISO" ] || [ ! -f "$SRC_ISO" ]; then
+    echo -e "${YELLOW}Built ISO not found. Building via Nix (result link goes outside the repo)...${NC}"
+    rm -f "$RESULT_LINK"
+    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage \
+        --out-link "$RESULT_LINK"
+
+    if [ -f "$RESULT_LINK/iso/${ISO_NAME}" ]; then
+        SRC_ISO="$RESULT_LINK/iso/${ISO_NAME}"
+    else
+        FOUND=$(find "$RESULT_LINK" -name "*.iso" 2>/dev/null | head -n 1 || true)
+        if [ -n "$FOUND" ]; then
+            SRC_ISO="$FOUND"
+        fi
+    fi
+fi
+
+if [ -z "$SRC_ISO" ] || [ ! -f "$SRC_ISO" ]; then
+    echo -e "${RED}Error: Failed to locate built ISO.${NC}" >&2
+    exit 1
+fi
+
+echo -e "${BLUE}Step 1: Copying built ISO to output dir (outside repo)...${NC}"
+cp -v "$SRC_ISO" "$ISO_PATH"
+echo -e "  ${GREEN}✓${NC} Copied to $ISO_PATH"
+
+echo
+echo -e "${BLUE}Step 2: Generating versioned SHA-256 checksum...${NC}"
+sha256sum "$ISO_PATH" > "$SHA_PATH"
+echo -e "  ${GREEN}✓${NC} Generated $SHA_PATH"
+cat "$SHA_PATH"
+
+echo
+echo -e "${BLUE}Step 3: Verifying checksum...${NC}"
+sha256sum --check "$SHA_PATH"
+echo -e "  ${GREEN}✓${NC} Checksum verified successfully"
+
+# Parse arguments for upload
+DO_UPLOAD=0
+for arg in "$@"; do
+    case $arg in
+        --upload)
+            DO_UPLOAD=1
+            shift
+            ;;
+    esac
+done
+
+if [ "$DO_UPLOAD" -eq 1 ]; then
+    echo
+    echo -e "${BLUE}Step 4: Uploading to CDN...${NC}"
+
+    UPLOADED=0
+    if [ -n "${CDN_UPLOAD_CMD:-}" ]; then
+        echo -e "  Running custom CDN_UPLOAD_CMD..."
+        eval "$CDN_UPLOAD_CMD"
+        UPLOADED=1
+    fi
+
+    if [ -n "${CDN_RSYNC_TARGET:-}" ]; then
+        echo -e "  Uploading via rsync to ${CDN_RSYNC_TARGET}..."
+        rsync -avP "$ISO_PATH" "$SHA_PATH" "${CDN_RSYNC_TARGET}"
+        UPLOADED=1
+    fi
+
+    if [ -n "${CDN_RCLONE_REMOTE:-}" ]; then
+        echo -e "  Uploading via rclone to ${CDN_RCLONE_REMOTE}..."
+        rclone copy "$ISO_PATH" "$SHA_PATH" "${CDN_RCLONE_REMOTE}"
+        UPLOADED=1
+    fi
+
+    if [ "$UPLOADED" -eq 0 ]; then
+        echo -e "  ${YELLOW}⚠ Warning: --upload requested, but no upload method specified.${NC}"
+        echo -e "     Set CDN_RSYNC_TARGET, CDN_RCLONE_REMOTE, or CDN_UPLOAD_CMD."
+    else
+        echo -e "  ${GREEN}✓${NC} Upload complete."
+    fi
+else
+    echo
+    echo -e "${GREEN}╔════════════════════════════════════════════════════════════╗${NC}"
+    echo -e "${GREEN}║           ✅ ISO packaging & verification complete!        ║${NC}"
+    echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
+    echo -e "Ready files (in ${CYAN}${OUT_DIR}${NC}, outside the repo):"
+    ls -lh "$ISO_PATH" "$SHA_PATH"
+    echo
+    echo "To upload to CDN, run:"
+    echo "  ./scripts/upload-cdn.sh --upload"
+    echo "(configure CDN_RSYNC_TARGET, CDN_RCLONE_REMOTE, or CDN_UPLOAD_CMD)"
+fi
@@ -0,0 +1,73 @@
+"""Regression tests for the Bitcoin Core Tor IBD gossip Hub option.
+
+These tests intentionally avoid importing the FastAPI application so they can run
+in the repository's lightweight test environment without NixOS service access.
+"""
+
+import ast
+import os
+import unittest
+
+
+_REPO_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+
+
+def _read(*parts: str) -> str:
+    with open(os.path.join(_REPO_ROOT, *parts), encoding="utf-8") as source:
+        return source.read()
+
+
+def _literal_assignment(source: str, name: str):
+    tree = ast.parse(source)
+    for node in tree.body:
+        if isinstance(node, ast.Assign):
+            if any(isinstance(target, ast.Name) and target.id == name for target in node.targets):
+                return ast.literal_eval(node.value)
+    raise AssertionError(f"Assignment {name} was not found")
+
+
+class TestBitcoinTorGossipNixWiring(unittest.TestCase):
+    def test_integration_layer_maps_tor_gossip_option(self):
+        """The integration layer must bridge sovran_systemsOS.features.bitcoin-tor-gossip
+        to sovran-bitcoin.bitcoindTorGossip."""
+        integration = _read("modules", "sovran-bitcoin-integration.nix")
+        self.assertIn("bitcoindTorGossip", integration)
+        self.assertIn("bitcoin-tor-gossip", integration)
+
+    def test_hub_option_and_evaluated_state_are_declared(self):
+        roles = _read("modules", "core", "roles.nix")
+        hub = _read("modules", "core", "sovran-hub.nix")
+        self.assertIn("bitcoin-tor-gossip = lib.mkEnableOption", roles)
+        self.assertIn("bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;", hub)
+
+
+class TestBitcoinTorGossipHubWiring(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server_source = _read("app", "sovran_systemsos_web", "server.py")
+        cls.registry = _literal_assignment(cls.server_source, "FEATURE_REGISTRY")
+
+    def test_feature_is_modal_only_and_explains_risk(self):
+        feature = next(item for item in self.registry if item["id"] == "bitcoin-tor-gossip")
+        self.assertTrue(feature["modal_only"])
+        self.assertIn("bitcoin-service", feature["requires"])
+        self.assertTrue(any("clearnet" in detail for detail in feature["details"]))
+        self.assertTrue(any("bandwidth" in detail for detail in feature["details"]))
+
+    def test_backend_rejects_gossip_without_bitcoin_service(self):
+        self.assertIn(
+            "Enable the Bitcoin service before advertising its Tor IBD service.",
+            self.server_source,
+        )
+
+    def test_core_modal_renders_and_controls_the_option(self):
+        frontend = _read(
+            "app", "sovran_systemsos_web", "static", "js", "service-detail.js"
+        )
+        self.assertIn("Tor IBD Service Advertising", frontend)
+        self.assertIn("svc-detail-related-feature-btn", frontend)
+        self.assertIn("handleFeatureToggle(relatedFeat", frontend)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,222 @@
+"""Regression tests for Hub update completion and polling recovery."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_APP_PARENT = _REPO_ROOT / "app"
+if str(_APP_PARENT) not in sys.path:
+    sys.path.insert(0, str(_APP_PARENT))
+
+from sovran_systemsos_web.update_state import (  # noqa: E402
+    effective_update_status,
+    reboot_is_pending,
+)
+
+
+# Real store paths observed on the incident machine that prompted this rework.
+RUNNING_GENERATION = (
+    "84rsiqi66nc68jbikd26ms50ap831xf8-nixos-system-nixos-26.11.20260817.ec2d622"
+)
+PREVIOUS_GENERATION = (
+    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-nixos-system-nixos-26.11.20260816.old"
+)
+# What the stale Hub log still claimed was staged: a two-week-old update cycle.
+HUB_LOG_GENERATION = (
+    "yis0saq6p8fhqcaii0h2yzqf0blhdwns-nixos-system-nixos-26.11.20260804.e72e4f2"
+)
+
+
+class TestRebootPendingState(unittest.TestCase):
+    """Reboot-pending state is derived from NixOS, not from Hub marker files.
+
+    The system profile (what boots next) is compared against
+    /run/current-system (what is running).  This stays correct no matter
+    which tool performed the update: Hub "Update System", a terminal
+    ``nixos-rebuild``, or an SSH support session.
+    """
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        root = Path(self.tmp.name)
+        self.store = root / "store"
+        self.store.mkdir()
+        # /nix/var/nix/profiles/system is a two-hop chain: the diagnostics on
+        # the incident box showed ``system`` -> ``system-148-link`` -> store.
+        self.profile = root / "system"
+        self.profile_entry = root / "system-148-link"
+        # /run/current-system links straight to the running store path.
+        self.current = root / "current-system"
+
+    def _store_dir(self, name: str) -> str:
+        path = self.store / name
+        path.mkdir(exist_ok=True)
+        return str(path)
+
+    def _stage(self, booted: str, running: str) -> None:
+        """Stage ``booted`` as the boot default with ``running`` live."""
+        os.symlink(self._store_dir(booted), self.profile_entry)
+        os.symlink(self.profile_entry, self.profile)
+        os.symlink(self._store_dir(running), self.current)
+
+    def test_hub_update_staged_and_not_yet_rebooted_is_pending(self):
+        self._stage(booted=RUNNING_GENERATION, running=PREVIOUS_GENERATION)
+        self.assertTrue(
+            reboot_is_pending(str(self.profile), str(self.current))
+        )
+
+    def test_staged_generation_booted_is_no_longer_pending(self):
+        self._stage(booted=RUNNING_GENERATION, running=RUNNING_GENERATION)
+        self.assertFalse(
+            reboot_is_pending(str(self.profile), str(self.current))
+        )
+
+    def test_terminal_switch_needs_no_reboot(self):
+        # nixos-rebuild switch moves the profile AND current-system together.
+        self._stage(booted=RUNNING_GENERATION, running=RUNNING_GENERATION)
+        self.assertFalse(
+            reboot_is_pending(str(self.profile), str(self.current))
+        )
+
+    def test_rollback_leaves_nothing_pending(self):
+        # nixos-rebuild switch --rollback points both at the rollback target.
+        self._stage(booted=PREVIOUS_GENERATION, running=PREVIOUS_GENERATION)
+        self.assertFalse(
+            reboot_is_pending(str(self.profile), str(self.current))
+        )
+
+    def test_unverifiable_state_is_never_a_reboot_demand(self):
+        # No profile and no running system readable: the Hub must not nag
+        # about a reboot it cannot substantiate.
+        self.assertFalse(
+            reboot_is_pending(str(self.profile), str(self.current))
+        )
+
+    def test_stale_hub_marker_clears_after_terminal_updates(self):
+        """The exact incident: terminal-updated machine, frozen Hub marker.
+
+        The user's last Hub update (old updater, weeks prior) left
+        REBOOT_REQUIRED behind.  Every update since ran in a terminal and
+        never touched the Hub's files, so the log still records a staged
+        generation from 2026-08-04 while the machine runs a 2026-08-17
+        build.  With the profile and the running system in agreement, the
+        stale claim must reconcile to IDLE regardless of anything the old
+        marker/log files say.
+        """
+        root = Path(self.tmp.name)
+        log = root / "sovran-hub-update.log"
+        log.write_text(
+            "Done. The new configuration is "
+            f"/nix/store/{HUB_LOG_GENERATION}\n"
+            "✓ Update staged successfully\n",
+            encoding="utf-8",
+        )
+        # Deliberately no sovran-hub-update.generation marker: the updater
+        # that produced this state predates the marker feature.
+        self.assertFalse(
+            (root / "sovran-hub-update.generation").exists()
+        )
+
+        self._stage(booted=RUNNING_GENERATION, running=RUNNING_GENERATION)
+        self.assertEqual(
+            effective_update_status(
+                "REBOOT_REQUIRED", str(self.profile), str(self.current)
+            ),
+            "IDLE",
+        )
+
+    def test_genuine_pending_reboot_claim_survives(self):
+        # A staged generation that has NOT been booted yet: the claim is
+        # true and must keep surfacing until the reboot really happens.
+        self._stage(booted=RUNNING_GENERATION, running=PREVIOUS_GENERATION)
+        self.assertEqual(
+            effective_update_status(
+                "REBOOT_REQUIRED", str(self.profile), str(self.current)
+            ),
+            "REBOOT_REQUIRED",
+        )
+
+    def test_other_statuses_pass_through_unchanged(self):
+        self._stage(booted=RUNNING_GENERATION, running=RUNNING_GENERATION)
+        for status in ("RUNNING", "FAILED", "SUCCESS", "IDLE"):
+            self.assertEqual(
+                effective_update_status(
+                    status, str(self.profile), str(self.current)
+                ),
+                status,
+            )
+
+
+class TestUpdatePollingWiring(unittest.TestCase):
+    """Guard the browser failure modes that caused a permanent spinner."""
+
+    @classmethod
+    def setUpClass(cls):
+        js_dir = _REPO_ROOT / "app" / "sovran_systemsos_web" / "static" / "js"
+        cls.update_js = (js_dir / "update.js").read_text(encoding="utf-8")
+        cls.rebuild_js = (js_dir / "rebuild.js").read_text(encoding="utf-8")
+        cls.helpers_js = (js_dir / "helpers.js").read_text(encoding="utf-8")
+        cls.events_js = (js_dir / "events.js").read_text(encoding="utf-8")
+        cls.template = (
+            _REPO_ROOT / "app" / "sovran_systemsos_web" / "templates" / "index.html"
+        ).read_text(encoding="utf-8")
+
+    def test_status_fetches_have_an_abort_timeout(self):
+        self.assertIn("function apiFetchWithTimeout", self.helpers_js)
+        self.assertIn("new AbortController()", self.helpers_js)
+        self.assertIn("controller.abort()", self.helpers_js)
+        self.assertIn("apiFetchWithTimeout(", self.update_js)
+        self.assertIn("STATUS_POLL_FETCH_TIMEOUT", self.update_js)
+
+    def test_async_update_polls_cannot_overlap(self):
+        self.assertIn("_updatePollInFlight", self.update_js)
+        self.assertIn(
+            "if (_updateFinished || _updatePollInFlight) return;", self.update_js
+        )
+        self.assertIn("finally", self.update_js)
+
+    def test_connection_failure_has_explicit_non_running_ui(self):
+        self.assertIn("showUpdateStatusUnavailable", self.update_js)
+        self.assertIn("Update status unavailable", self.update_js)
+        self.assertIn("Retry Status", self.template)
+        self.assertIn("retryUpdateStatus", self.events_js)
+
+    def test_rdp_or_tab_resume_forces_reconciliation(self):
+        self.assertIn("resumeUpdateStatusAfterInterruption", self.events_js)
+        self.assertIn('window.addEventListener("focus"', self.events_js)
+        self.assertIn('document.addEventListener("visibilitychange"', self.events_js)
+
+    def test_verbose_log_rendering_is_bounded(self):
+        self.assertIn("UPDATE_VISIBLE_LOG_MAX_CHARS", self.update_js)
+        self.assertIn("document.createTextNode(text)", self.update_js)
+        self.assertNotIn("$modalLog.textContent += text", self.update_js)
+
+    def test_page_reload_restores_running_or_completed_update(self):
+        self.assertIn("restoreUpdateModalIfNeeded", self.update_js)
+        self.assertIn("await restoreUpdateModalIfNeeded();", self.events_js)
+        self.assertIn('current.result === "reboot_required"', self.update_js)
+
+    def test_all_javascript_remains_syntax_valid(self):
+        node = shutil.which("node")
+        if not node:
+            self.skipTest("node is not available in this test environment")
+        for script in (
+            _REPO_ROOT / "app" / "sovran_systemsos_web" / "static" / "js"
+        ).glob("*.js"):
+            result = subprocess.run(
+                [node, "--check", str(script)], capture_output=True, text=True
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,56 @@
+"""Regression tests for the Hub Zeus Connect QR.
+
+The Zeus Connect setup service (modules/wallet-autoconnect.nix) and the Hub QR
+encoding are tested here.  The lndconnect wrapper itself is now part of the
+Sovran_Bitcoin flake — its contract tests live in that repository.
+"""
+
+import os
+import re
+import unittest
+
+_REPO_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+
+
+def _read(relpath: str) -> str:
+    with open(os.path.join(_REPO_ROOT, relpath), encoding="utf-8") as fh:
+        return fh.read()
+
+
+class TestZeusConnectSetup(unittest.TestCase):
+    """zeus-connect-setup must wait for the REST onion and validate the URI."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.src = _read("modules/wallet-autoconnect.nix")
+
+    def test_waits_for_onion_addresses(self):
+        self.assertIn("onion-addresses.service", self.src)
+
+    def test_rejects_non_lndconnect_output(self):
+        self.assertIn("^lndconnect://", self.src)
+        self.assertIn("\\.onion", self.src)
+        self.assertIn("macaroon=", self.src)
+
+    def test_no_clightning_fallback(self):
+        self.assertNotIn("lnconnect-clnrest", self.src)
+
+
+class TestHubQrFallback(unittest.TestCase):
+    """Hub QR encoding must not die on a payload that is too large for ECC H."""
+
+    def test_qrencode_falls_back_to_lower_ecc(self):
+        src = _read("app/sovran_systemsos_web/server.py")
+        self.assertIn('for ecc in ("H", "Q", "L")', src)
+
+    def test_qronly_does_not_hide_uri_when_qr_fails(self):
+        src = _read("app/sovran_systemsos_web/server.py")
+        self.assertIn("Don't hide the URI if we could not render a scannable QR.", src)
+
+    def test_zeus_guide_mentions_use_tor(self):
+        src = _read("app/sovran_systemsos_web/static/js/service-detail.js")
+        self.assertIn("Use Tor", src)
+
+
+if __name__ == "__main__":
+    unittest.main()
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" width="128" height="120" fill="none"><g clip-path="url(#a)"><path fill="#472459" d="M127.2 65.67c-5.13 5.11-12.23 3.88-17.35-1.25l-41.4-41.6 19.4-19.47a11.35 11.35 0 0 1 18.4 3.37l21.58 56.22a2.5 2.5 0 0 1-.57 2.67l-13.63 13.57 13.58-13.51Z"/><path fill="url(#b)" d="m109.85 64.42-54.16-54.4a13.13 13.13 0 0 0-18.57-.05L3.87 43.07a13.13 13.13 0 0 0-.05 18.57l54.16 54.4a13.13 13.13 0 0 0 18.57.04l10.7-10.64 3.12-3.12-10-10.03a19.04 19.04 0 0 1-23.83-2.56l-6.8-6.85a2.46 2.46 0 0 1 0-3.5l3.35-3.32-8.4-8.46a3.67 3.67 0 0 1-.34-4.9 3.57 3.57 0 0 1 5.29-.23l8.51 8.56 6.68-6.63-8.41-8.46a3.67 3.67 0 0 1-.33-4.9 3.58 3.58 0 0 1 5.3-.24l8.5 8.57 3.36-3.34a2.47 2.47 0 0 1 3.5.01l6.8 6.84a19.03 19.03 0 0 1 2.41 23.86l10 10.03 5.69-5.67 8.16-8.12 17.4-17.31c-5.15 5.11-12.25 3.88-17.36-1.25Z"/></g><defs><linearGradient id="b" x1="63.6" x2="63.6" y1="6.15" y2="119.91" gradientUnits="userSpaceOnUse"><stop stop-color="#FFCA4A"/><stop offset="1" stop-color="#F7931A"/></linearGradient><clipPath id="a"><path fill="#fff" d="M0 0h128v119.91H0z"/></clipPath></defs></svg>