From 7d1eb62d75edfd3d2af673dd14ff7d536134acd6 Mon Sep 17 00:00:00 2001
From: c4ch3c4d3 <bryce@zuccaro.me>
Date: Sat, 22 Aug 2026 13:26:09 -0600
Subject: [PATCH] feat(reliability): START=49 boot guard installed by deploy

---
 .../user/remote_access/pager-webui/mk8-guard.init | 15 +++++++++++++++
 payload/user/remote_access/pager-webui/server.py  |  7 +++++++
 scripts/deploy.sh                                 |  3 +++
 3 files changed, 25 insertions(+)
 create mode 100644 payload/user/remote_access/pager-webui/mk8-guard.init

diff --git a/payload/user/remote_access/pager-webui/mk8-guard.init b/payload/user/remote_access/pager-webui/mk8-guard.init
new file mode 100644
index 0000000..526ac30
--- /dev/null
+++ b/payload/user/remote_access/pager-webui/mk8-guard.init
@@ -0,0 +1,15 @@
+#!/bin/sh /etc/rc.common
+# Mark VIII boot guard: enforce safe PineAP UCI before the S50 stack starts.
+START=49
+STOP=90
+
+GUARD_DIR="/root/payloads/user/remote_access/pager-webui"
+[ -f "$GUARD_DIR/server.py" ] || GUARD_DIR="/mmc/mk8/releases/current"
+
+start() {
+    [ -f "$GUARD_DIR/server.py" ] || return 0
+    /usr/bin/python3 "$GUARD_DIR/server.py" --reconcile \
+        >/tmp/mk8-guard.log 2>&1 || true
+}
+
+stop() { return 0; }
diff --git a/payload/user/remote_access/pager-webui/server.py b/payload/user/remote_access/pager-webui/server.py
index 7d6c991..baa21aa 100644
--- a/payload/user/remote_access/pager-webui/server.py
+++ b/payload/user/remote_access/pager-webui/server.py
@@ -7194,6 +7194,13 @@ if __name__ == '__main__':
         result = restore_pager_truth(resnapshot=False)
         print(json.dumps(result))
         sys.exit(0 if result.get('ok') else 1)
+    if '--reconcile' in sys.argv:
+        try:
+            import mk8_guard
+            print(json.dumps(mk8_guard.reconcile()))
+        except Exception as exc:  # boot must never fail here
+            print(json.dumps({'error': str(exc)}))
+        sys.exit(0)
     signal.signal(signal.SIGTERM, _request_shutdown)
     signal.signal(signal.SIGINT, _request_shutdown)
     serve()
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 40cff3a..fdb6afb 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -203,6 +203,9 @@ if /etc/init.d/pagerwebui running >/dev/null 2>&1; then
 else
     /etc/init.d/pagerwebui start
 fi
+cp -f '$REMOTE_PAYLOAD_DIR/mk8-guard.init' /etc/init.d/mk8-guard
+chmod 755 /etc/init.d/mk8-guard
+/etc/init.d/mk8-guard enable
 echo EXTRACT_OK"
 run_ssh "$TARGET" "$REMOTE_COMMAND"
 printf 'Installed to /root/payloads/%s/\n' "$REMOTE_PAYLOAD_DIR"